### SUPPLEMENT: STANDARD 321-07

RANGE SAFETY GROUP



### COMMON RISK CRITERIA STANDARDS FOR NATIONAL TEST

RANGES: SUPPLEMENT

WHITE SANDS MISSILE RANGE

REAGAN TEST SITE

YUMA PROVING GROUND

DUGWAY PROVING GROUND

ABERDEEN TEST CENTER

NATIONAL TRAINING CENTER

ELECTRONIC PROVING GROUND

HIGH ENERGY LASER SYSTEMS TEST FACILITY

NAVAL AIR WARFARE CENTER WEAPONS DIVISION, PT. MUGU NAVAL AIR WARFARE CENTER WEAPONS DIVISION, CHINA LAKE NAVAL AIR WARFARE CENTER AIRCRAFT DIVISION, PATUXENT RIVER NAVAL UNDERSEA WARFARE CENTER DIVISION, NEWPORT

PACIFIC MISSILE RANGE FACILITY NAVAL UNDERSEA WARFARE CENTER DIVISION, KEYPORT

30TH SPACE WING

45TH SPACE WING

AIR FORCE FLIGHT TEST CENTER

AIR ARMAMENT CENTER

ARNOLD ENGINEERING DEVELOPMENT CENTER

BARRY M. GOLDWATER RANGE

NATIONAL NUCLEAR SECURITY ADMINISTRATION (NEVADA)

DISTRIBUTION A: APPROVED FOR PUBLIC RELEASE

DISTRIBUTION IS UNLIMITEDThis page intentionally left blank.

### SUPPLEMENT: STANDARD 321-07

COMMON RISK CRITERIA FOR NATIONAL TEST RANGES:

SUPPLEMENT

JUNE 2007

Prepared by

RANGE SAFETY GROUP

RISK COMMITTEE

Published by

Secretariat Range Commanders Council U.S. Army White Sands Missile Range,

New Mexico 88002-5110This page intentionally left blank.

### TABLE OF CONTENTS

LIST OF FIGURES ................................................................................................................ .........v

LIST OF TABLES................................................................................................................. ....... vii

CHANGES TO THIS EDITION ................................................................................................... ix

FOREWORD ....................................................................................................................... .......... xi

PREFACE........................................................................................................................ ............ xiii

ACRONYMS....................................................................................................................... ..........xv

CHAPTER 1: INTRODUCTION......................................................................................... 1-1 1.1 Purpose............................................................................................................ 1-1 1.2 Scope............................................................................................................... 1-1 1.3 Application...................................................................................................... 1-1

CHAPTER 2: RISK MANAGEMENT PROCESS LEVEL II.......................................... 2-1 2.1 Historical Background .................................................................................... 2-1 2.2 Risk Management Process - Level II .............................................................. 2-1 2.3 Detailed Checklists for Phases of the Risk Analysis Process ......................... 2-4

2.4 Phase I: Mission Definition and Hazard Identification.................................. 2-4

2.5 Phase II: Risk Assessment ........................................................................... 2-11 2.6 Phase III: Criteria Comparison and Risk Reduction.................................... 2-19 2.7 Phase IV: Risk Acceptance .......................................................................... 2-22

CHAPTER 3: GENERAL RISK MODEL REQUIREMENTS ........................................ 3-1 3.1 Specific to Policy ............................................................................................ 3-1 3.2 Transparency, Clarity, Consistency and Reasonableness (TCCR)................. 3-1 3.3 Verification and Validation (V&V) ................................................................ 3-1 3.4 Configuration Control ..................................................................................... 3-2 3.5 Liability Protection ......................................................................................... 3-2 3.6 Best Estimate of Expected Value.................................................................... 3-2 3.7 Balance of Accuracy, Simplicity, and Fidelity ............................................... 3-2 3.8 Conservatism and Uncertainty ........................................................................ 3-2 3.9 Balance of Element Fidelity............................................................................ 3-3

CHAPTER 4: RISK CRITERIA IMPLEMENTATION GUIDELINES......................... 4-1

4.1 Introduction..................................................................................................... 4-1 4.2 Guidelines for Application of the Criteria ...................................................... 4-4 4.3 Catastrophic Risk Evaluation........................................................................ 4-17 4.4 Hazard Areas for Ships and Aircraft............................................................. 4-19 4.5 Spacecraft Protection .................................................................................... 4-28

iiiCHAPTER 5: RISK CRITERIA RATIONALE................................................................. 5-1

5.1 Rationale for Risk Metrics .............................................................................. 5-1

5.2 Criteria Rationale Overview ........................................................................... 5-5 5.3 Rationale for Casualty Limits ......................................................................... 5-8 5.4 Rationale for Fatality Guideline Limits ........................................................ 5-27 5.5 Rationale for Catastrophic Risk Criteria....................................................... 5-41 5.6 Rationale for Aircraft and Ship Risk Management Requirements ............... 5-44 5.7 Rationale for Spacecraft Protection Requirements ....................................... 5-52 5.8 Using Aviation as a Benchmark for Launch Risk......................................... 5-55 5.9 References for Chapter 5............................................................................... 5-63

CHAPTER 6: HAZARD THRESHOLDS........................................................................... 6-1 6.1 Defining Criteria for Hazard Thresholds ........................................................ 6-1 6.2 Unsheltered People ......................................................................................... 6-4 6.3 Sheltered People............................................................................................ 6-11 6.4 References for Chapter 6............................................................................... 6-32

CHAPTER 7: APPROACHES AND CONS IDERATIONS FOR DEBRIS RISK

ASSESSMENT MODELS............................................................................ 7-1 7.1 Vehicle Breakup Debris Models..................................................................... 7-5 7.2 Debris Dispersion Models............................................................................. 7-11

7.3 Debris Distribution Models........................................................................... 7-31 7.4 Impact Probab ility Models............................................................................ 7-36 7.5 Modeling for Explosive Fragments............................................................... 7-39 7.6 Vulnerability and Casualty Models............................................................... 7-43 7.7 Models for Casualty Area and Fragment Probability of Casualty................ 7-57 7.8 Risk (Casualty/Fatality) Expectation Models ............................................... 7-59 7.9 Catastrophic Risk Modeling.......................................................................... 7-63 7.10 Risk Prediction Uncertainty.......................................................................... 7-67

CHAPTER 8: OTHER HAZARDS...................................................................................... 8-1

8.1 Introduction to Other Hazards......................................................................... 8-1

8.2 Toxic Release Assessment .............................................................................. 8-1 8.3 Far-Field Window Breakage........................................................................... 8-9 8.4 Radiation Hazard Analysis Guidelines ......................................................... 8-11

GLOSSARY

ivLIST OF FIGURES

Figure 2-1. Level 2 risk management process flowchart................................................... 2-3 Figure 4-1. Risk profile from example problem. ............................................................... 4-3 Figure 4-4. Evaluating residual risk remaining with the defined hazard area. ................ 4-27 Figure 5-1. Criteria inte r-relationships. ............................................................................. 5-7 Figure 5-2. Outline of logic used to compare aviation and range risks........................... 5-16 Figure 5-3. Universal Risk Scale: injuries for annual probability of injury to an individual resulting fr om involuntary activities................................... 5-22 Figure 5-4. Comparison of methods that are used to introduce catastrophe

aversion into the ri sk analysis. ...................................................................... 5-43 Figure 6-1. Eleven (11) ft-lb criterion compared to probability of casualty curves for the ge neral public........................................................................... 6-7 Figure 6-2. Comparison of 11 ft-lb criterion with injury models and sample data points. ...................................................................................................... 6-8 Figure 6-3. Air blast imp acting a stru cture...................................................................... 6-15 Figure 6-4. Diffraction of blast front across structure (looking down). .......................... 6-16 Figure 6-5. Free-field blast wave overpressure time history. .......................................... 6-17 Figure 6-6. Structural damage due to air blast impacting lightly constructed

structures. ...................................................................................................... 6-20 Figure 6-7. Serious injury due to air blast impacting lightly constructed structures....... 6-20 Figure 6-8. Breakage due to air blast impacting large, annealed windows ..................... 6-21 Figure 6-9. Serious injury due to air blast impacting large, annealed windows.............. 6-21 Figure 6-10. Hull materials for vesse ls of different lengths. ............................................. 6-23 Figure 7-1. Sample impact point scatter plot................................................................... 7-15 Figure 7-2. Debris centerline showing variation of the impact with fragment ballistic coefficient ( β ).................................................................................. 7-25 Figure 7-3. Aircraft im pact geometry. ............................................................................. 7-36 Figure 7-4. Procedure for computing risks due to an explosive fragment....................... 7-43 Figure 7-5. Hazards to an Unsheltered Person From Inert Debris Impact ...................... 7-49 Figure 7-6. Example of fragment penetrating multiple floors of a structure................... 7-51 Figure 7-7. Typical risk profile........................................................................................ 7-65 Figure 7-8. Comparison of catastrophe tolerant and catastrophe intolerant limit lines... 7-66 Figure 7-9. The effect of uncertainty distribution breadth on the average value of e

c. .... 7-69

vThis page intentionally left blank.

viLIST OF TABLES

Table 2-1. Risk Management Process (Step I-1).............................................................. 2-6 Table 2-2. Risk Management Process (Step I-2).............................................................. 2-7 Table 2-3. Risk Management Process (Step I-3).............................................................. 2-8 Table 2-4. Risk Management Process (Step I-4).............................................................. 2-9 Table 2-5. Risk Management Process (Step I-5)............................................................ 2-10 Table 2-6. Risk Management Process (Review: R-1) ................................................... 2-10 Table 2-7. Risk Management Process (Step II-1) .......................................................... 2-13 Table 2-8. Risk Management Process (Step II-2) .......................................................... 2-14 Table 2-9. Risk Management Process (Step II-3) .......................................................... 2-15 Table 2-10. Risk Management Process (Step II-4) .......................................................... 2-15 Table 2-11. Risk Management Process (Step II-5) .......................................................... 2-16 Table 2-12. Risk Management Process (Step II-6) .......................................................... 2-16 Table 2-13. Risk Management Process (Review: R-2) ................................................... 2-16 Table 2-14. Risk Management Process (Step II-7) .......................................................... 2-17 Table 2-15. Risk Management Process (Review: R-3) ................................................... 2-18 Table 2-16. Risk Management Process (Step III-1) ......................................................... 2-20 Table 2-17. Risk Management Process (Step III-2) ......................................................... 2-20 Table 2-18. Risk Management Process (Step III-3) ......................................................... 2-21 Table 2-19. Risk Management Process (Step III-4) ......................................................... 2-21 Table 2-20. Risk Management Process (Step III-5) ......................................................... 2-21 Table 2-21. Risk Management Process (Step IV-1)......................................................... 2-23 Table 2-22. Risk Management Process (Step IV-2a) ....................................................... 2-23 Table 4-1. Example Risk Profile Data.............................................................................. 4-3 Table 4-2. Orbital Period Change (Per Revolution) of the ISS...................................... 4-30 Table 5-1. Maximum Acceptable Casualty Risk to People.............................................. 5-8 Table 5-2. Typical Ratio of Expected Fatalities to Casualties ....................................... 5-10

Table 5-3. Ratio of Ground Casualties to Ground Fatalities Based on 20 Years of NTSB Data From 1984 Through 2003 ..................................................... 5-17

Table 5-4. Individual Mission Risk for the General Public as of 2006.......................... 5-19 Table 5-5. General Public Individual Probability of Casualty Risk............................... 5-23

Table 5-6. Mission Essential I ndividual Casualty Risk ................................................. 5-26 Table 5-7. Maximum Acceptable Fatality Risk to People ............................................. 5-27

Table 5-8. Individual Annual Risk for the General Public............................................. 5-27 Table 5-9. Summary of Individual Fatality Risk Criteria............................................... 5-28

Table 5-10. Fatalities Due to Accidents in Public............................................................ 5-29

Table 5-11. Fatalities Due to A ccidents in the Home ...................................................... 5-30 Table 5-12. Summary of U.S. and Foreign Annual Fatality Risk Criteria....................... 5-30 Table 5-13. Individual Mission Risk for the General Public (as of 2006) ....................... 5-31 Table 5-14. Typical Ratio of Expected Fatalities to Casualties ....................................... 5-32

Table 5-15. Collective Mission Risk for the General Public ........................................... 5-32 Table 5-16. Risk to People on the Ground From Commercial Aircraft and

General Aviation........................................................................................... 5-33

Table 5-17. Collective Annual Risk for the General Public............................................. 5-34

viiTable 5-18. Risk to People on the Ground From Commercial Aircraft and

General Aviation........................................................................................... 5-35 Table 5-19. Casualty Risk to General Public ................................................................... 5-35 Table 5-20. Summary of U.S. and Foreign Annual Fatality Risk Criteria....................... 5-37

Table 5-21. Individual Mission Risk for Mission Essential Personnel ............................ 5-37 Table 5-22. Occupati onal Fatalities.................................................................................. 5-39

Table 5-23. Collective Mission Risk for Mission Essential Personnel ............................ 5-39

Table 5-24. Collective Annual Risk for Mission Essential Personnel ............................. 5-40 Table 5-25. Annual Risk for Flights In the U.S. Based On A 5-Year Average (1993-1997)* .................................................................................. 5-48

Table 5-26. Aircraft Risk Crite ria of National Ranges*................................................... 5-49 Table 5-27. Ship Risk Criteria of National Ranges.......................................................... 5-51

Table 5-28. Ratio of Ground Casualties to Ground Fatalities Based on 20 Years of NTSB Data From 1984 Through 2003 ..................................................... 5-59 Table 5-29. Ratio of Expected Casualties and Expected Fatalities Computed by

Lara for Various Missions............................................................................. 5-60 Table 6-1. Injury Thresholds ............................................................................................ 6-4 Table 6-2. Reported E/A Values for Penetrating Injuries ................................................ 6-9 Table 6-3. Body Part Sensitivity to Overpressure.......................................................... 6-11

Table 6-4. Threshold Values for Roof Penetration ........................................................ 6-13 Table 6-5. Threshold Values for Ship Cabin and Deckhouse Roof Penetration............ 6-24 Table 7-1. Guide to Contents of Chapter 7....................................................................... 7-2 Table 8-1. Commonly Used N on-toxic Propellants ......................................................... 8-2 Table 8-2. Commonly Used toxic Propellants and By-Products...................................... 8-3 Table 8-3. Uncommon toxic Propellants and Combustion By-products.......................... 8-4 Table 8-4. Toxic Potential Casualty Distances................................................................. 8-6

viiiCHANGES TO THIS EDITION

This document is the Supplement to Standard 321-07 (Common Risk Criteria for National Test Ranges). Both the basic 321-07 document and this Supplement are updates to the 2002 version of RCC Document 321-02, Common Risk Criteria for National Test Ranges: Inert Debris. The following subparagraphs contain a summary of changes.

a. Expanded Scope . The scope of the standard is expanded to include other flight hazards in addition to inert debris. The scope now addresses risks due to explosive debris, overpressure, and toxics. To accommodate this change, the Risk Committee recommended that casualty, rather than fatality, is the primary measure of risk and has defined acceptable casualty risk criteria. Fatality risk criteria remain as a supplemental measure of risk for those range operations that are dominated by fatality

risk.

b. New hazard thresholds . New hazard thresholds are defined to account for casualty risk. Debris fragment thresholds are provided for blunt trauma injuries and chunky penetrating injuries, and overpressure thresholds are provided for unsheltered and sheltered people. In addition, debris fragment thresholds for penetrating structures are updated to reflect the results of recent studies.

c. Aircraft vulnerability thresholds . The aircraft vulnerability thresholds are revised to remove the excess conservatism. The previous standard defined a single threshold for all types of aircraft. A separate set of vulnerability models are defined for large commercial jet transports to more accurately represent the robustness of those

aircraft.

d. Ship probability of impact . The probability of impact criteria for ships is revised to be more in line with United Nations International Maritime Organization and current range practices.

e. Manned spacecraft protection . The manned spacecraft protection policies and criteria are revised to remove excess conservatism and clear up inconsistencies in application. The probability of impact criterion is updated to provide more realistic assumptions of space launch activity and to provide an equivalent level of protection as that afforded to mission essential personnel. As another means of reducing excess conservatism, an ellipsoidal minimum miss distance volume is provided as an alternative to the spherical miss distance presented in the previous standard.

f. Catastrophic risk protection . This revised Supplement introduces the subject of catastrophic risk protection. Some provisiona l, advisory criteria are provided, as well as guidelines for analyzing and assessing catastrophic risk.

g. Implementation guidelines . A new chapter (Chapter 4 ) is added to this Supplement to provide implementation guidelines for applying the criteria to address aggregation and accumulation of risk from the various hazards, multiple phase/multiple launch

ixmissions, annual risk management, and catastrophic risk. It also provides guidance on determining the beginning and end of a mission for applying the per mission

criteria.

h. Screening criteria for other hazards . A new chapter (Chapter 8 ) is included in this Supplement to provide guidelines on screening criteria for casualty producing hazards such as Distant Focusing Overpressure (DFO), toxics and radiation.

i. Risk management process . The eight-step process for analyzing risk from inert debris is replaced with a more comprehensive overall range safety process that expands the concept to address hazards beyond just inert debris and includes the major activities required to conduct the entire risk management process. A checklist of factors and considerations is provided to aid in proper execution of the process.

j. Modeling considerations . Two chapters were added to this Supplement to address modeling considerations. Chapter 3 provides advisory requirements for modeling tools and Chapter 7 addresses some approaches and considerations for debris risk

assessment models.

xFOREWORD

The Risk and Lethality Commonality Team (RALCT) was formed in 1996 for reaching a

consensus on reasonable common standards for debris protection criteria and analytical methods. The initial version, RCC 321-97, was very useful, but was limited in scope due to the complexity of the subject and time constraints. The original version was updated in 1999 and again in 2002 to provide greater detail. In August 2004, the Range Commander’s Council (RCC), Range Safety Group (RSG) determined that the “Common Risk Criteria for National Test Ranges, Subtitle: Inert Debris”, RCC Document 321-02, should be updated and expanded for other flight safety hazards (in addition to inert debris) and consequences potentially generated by Range operations.

The RALCT became a standing committee under the RCC Range Safety Group in 2004. It was renamed the “Risk Committee” (RC) in February 2005 when work on this revision began in earnest. The Committee has updated RCC Document 321-02 (now Standard 321-07) to

include:

a. Risk acceptability criteria and supporting rationale for additional flight safety hazards and consequences potentially generated by Range operations.

b. The major activities required to conduct the entire risk management process and considerations to address hazards beyond just inert debris.

c. Top-level requirements for computational models used to analyze the risks posed by inert and explosive debris.

d. Updated hazard thresholds for inert and explosive debris, as well as screening criteria for other hazards including toxics, distan t focusing overpressure, and ionizing and non-ionizing radiation.

e. Factors and considerations for acceptable debris risk assessment models.

Document (RCC Document 321-07) is the basic document that defines consensus standards for the range risk management process and risk criteria. This document (RCC Document 321-07: Supplement), provides additional detailed information to assist in implementation of the standards in the basic document. The criteria in this document should not be considered absolute; rather, this document is intended to provide guidance on defining acceptable risks for hazardous range operations and to assist the user in developing more

consistent risk assessments.

This supplement is an RCC Standard that represents the collective efforts of both government and contractor personnel and is the result of an extensive cooperative effort.

Herein, the use of the word “Supplement” or the phrase “this Supplement” refers to this document. This supplemental document makes many references to the basic Standard (RCC Document 321-07). For clarity, the basic document is often referred to as the “Standard.” For example, “Chapter 3 of the Standard” refers to Chapter 3 of RCC Document 321-07.

xiThis page intentionally left blank.

xiiPREFACE

This document presents the results of Task RS-46, Range Safety Group (RSG) in the Range Commanders Council (RCC). Planned and unplanned hazardous events generated by flight operations present a safety concern for all test ranges. Each range has established its own set of criteria and analytical methods for protecting personnel, facilities, aircraft, and other assets from hazardous operations. Although these separate efforts have been very successful, the logical relationships among criteria used at the te st ranges and across different hazards are often difficult to comprehend. The consensus standards presented in this document are intended to:

a. Promote a uniform process among the ranges.

b. Promote valid, repeatable risk assessments.

c. Foster innovation to support challenging missions.

d. Nurture openness and trustworthiness among the ranges, range users and the public.

e. Simplify the scheduling process.

f. Present common risk criteria that can reduce cost for users of multiple test ranges.

The RCC gives special acknowledgement for production of this document to:

Mr. Corey Cather : Chairman, RSG Risk Committee 30th Space Wing, 30 SW/SELP

806 13th Street STE 3 Vandenberg AFB, CA 93437-5230 Phone: (805) 606-1662 DSN 276-1662 Fax: (805) 605-7227 DSN 275-7227

E-mail: corey.cather@vandenberg.af.mil

Acknowledgements also go to the many participating members of the Range Safety Group Risk Committee as shown on the following page.

Please direct any questions to:

Secretariat, Range Commanders Council

ATTN: CSTE-DTC-WS-RCC 100 Headquarters Avenue White Sands Missile Range, New Mexico 88002-5110 Telephone: (505) 678-1107, DSN 258-1107

E-mail rcc@wsmr.army.mil

xiiiRANGE SAFETY GROUP RISK COMMITTEE PARTICIPANTS

RCC RSG RISK COMMITTEE MEMBERS

AFSPC/30th Space Wing - 30 SW AFSPC/45th Space Wing - 45 SW Air Armament Center Eglin Air Force Base - AAC Air Force Flight Test Center - AFFTC Naval Air Systems Command headquartered at Patuxent River, MD (NAVAIR PR) Naval Air Warfare Center Weapons Division - NAWCWD Pacific Missile Range Facility - PMRF U.S. Army Kwajalein Atoll/Reagan Test Site - USAKA/RTS White Sands Missile Range - WSMR Yuma Proving Ground - YPG

RCC RSG RISK COMMITTEE ASSOCIATE MEMBERS

Federal Aviation Administration - FAA/AST Missile Defense Agency; Safety, Quality and Mission Assurance Directorate - MDA/QS National Aeronautics and Space Administra tion Dryden Flight Research Center (NASA/DFRC) National Aeronautics and Space Administration Headquarters - NASA HQ National Aeronautics and Space Administ ration Kennedy Space Center - NASA KSC National Aeronautics and Space Administration Wallops Flight Facility - NASA Wallops

Sandia National Laboratories - SNL

RCC RSG RISK COMMITTEE SUPPORTING ORGANIZATIONS

3D Research Corporation - 3D Research ACTA, Inc. - ACTA Aerospace Corporation Air Force Space Command - AFSPC Analysis, Planning, Test Research, Inc. - APT Research Headquarters, Air Force Safety Center , Weapons Safety Division - HQ AFSC Research Triangle Institute, International - RTI SRS Technologies System Test and Evaluation Planning and Analysis Lab - STEPAL TYBRIN Corporation

xivACRONYMS

ABS American Bureau of Shipping ADS Automatic Destruct System

ACCGIH American Conference of G overnment Industrial Hygienists

AFB Air Force Base ACGIH American Conference of Government Industrial Hygienists AEGL Acute Emergency Guidance Level AFETAC Air Force Environmental Technical Applications Center AFSPC Air Force Space Command

AIAA American Institute of Aeronautics and Astronautics AIS Abbreviated Injury Scale ALARP As Low as Reasonably Practicable

ALCM Air Launched Cruise Missile

ANSI American National Standards Institute

APA Administrative Procedures Act AST Associate Administrator for Space Transportation (FAA)

BMD Ballistic Missile Defense

BRL Ballistics Research Lab CA Conjunction Assessment CCAS Cape Canaveral Air Station

CDC Centers for Disease Control CFR Code of Federal Regulations CMMI Capability Maturity Model Integration

COLA Collision Avoidance COP critical operations personnel CSC Conical Shaped Charge CSLA Commercial Launch Space Act DDESB Department of Defense Explosives Safety Board DFO Distant Focusing Overpressure DoD Department of Defense DODD Department of Defense Directive DODI Department of Defense Instruction DOL Department of Labor DOT Department of Transportation E/A energy to area ratio ELV Expendable Launch Vehicle ER Eastern Range EPA Environmental Protection Agency

FAA Federal Aviation Administration FDA Food and Drug Administration FEMA Federal Emergency Management Agency FMEA Failure Modes Effects Analysis FMECA Failure Modes Effects and Criticality Analysis FOD Foreign Object Damage

xvFRP Fiber Reinforced Plastic FSS Flight Safety System

FTCA Federal Tort Claims Act FTS Flight Termination System GEMS Generalized Energy Management System GGUAS Global Gridded Upper Atmosphere Statistics GNC Guidance, Navigation, and Control

GP General Public

GPa Refers to: Annual General Public Risk GPS Global Positioning System GRAM Global Reference Atmospheric Model HACK Hazard Area Computation Kernel HEBF High Energy Blast Facility HSC High-speed Craft HSE Health and Safety Executive (UK) ICAO International Civil Aviation Organization ICV Intercept Control Volume IDLH Immediately Dangerous to Life or Health IIP Instantaneous Impact Point ILL Impact Limit Line IMO International Maritime Organization (United Nations) IRIG Inter-Range Instrumentation Group ISDS Inadvertent Separation Destruct System ISS International Space Station IUS Inertial Upper Stage KE Kinetic Energy KIDD Kinetic Impact Debris Distribution KSC Kennedy Space Center

LAP Launch Assist Platform LNG Liquid Natural Gas

LOC Level of Concern LSC Linear Shaped Charge

MEa Refers to: Annual Mission Essential Risk

MEP Mission Essential Personnel MFCO Missile Flight Control Officer

MPL Maximum Probable Loss MRTFB Major Range and Test Facility Base

MSL Mean Sea Level NASA National Aeronautics and Space Administration

NAWC Naval Air Warfare Center NDI/NDT Non-destructive Inspection / Non-destructive Test NIOSH National Institute of Occupational Safety And Health NOAA National Ocean & Atmospheric Administration

NOHD Nominal Ocular Hazard Distance NPRM Notice of Proposed Rulemaking NRC Nuclear Regulatory Commission

xviNTSB National Transportation Safety Board OSHA Occupational Safety and Health Administration

OV Orbital Vehicle PDF Probability Density Function PIRAT Propellant Impact Risk Assessment Team PSS Premature Separation System RALCT Risk and Lethality Commonality Team RANS Range Squadron

RC Risk Committee RCC Range Commanders Council

RLV Reusable Launch Vehicle RSG Range Safety Group RSS Range Safety System RSO Range Safety Officer SEI Software Engineering Institute SLASO Space Licensing and Safety Office (Australia)

SLCM Surface Launched Cruise Missile SPCS Space Control Squadron

SRI Stanford Research Institute

STIL Short Term Interval Launch STS Space Transportation System TCCR Transparency, Clarity, Consistency, & Reasonableness TM Telemetry

TNT Trinitrotoluene TPS Thermal Protection System

TT Thrust Termination TSPI Time Space and Position Information

TVC Thrust Vector Controller

USAF United States Air Force

USCG United States Coast Guard

USC United States Code VAFB Vandenberg Air Force Base

V&V Verification and Validation WR Western Range WSMR White Sands Missile Range

xviiThis page intentionally left blank.

xviii

### CHAPTER 1

INTRODUCTION

1.1 Purpose

This document supplements the policies, criteria, and risk management process established by RCC Standard 321-07. It also provides supporting rationale and guidance on models and analyses to assist safety professionals in implementing the policies and criteria.

1.2 Scope

This Supplement is for use by DoD national ranges and the Major Range and Test Facility Base (MRTFB) members. The information provided applies to launch and reentry hazards generated by endoatmospheric and exoatmospheric range activities including both guided and unguided missiles and missile intercepts, space launches and reentry vehicles. This document does not include aviation operations or Unmanned Aerial Vehicle (UAV) operations (see the 321 Standard, paragraph 1.2). RCC Document 323-99 provides criteria for UAVs.

1.3 Application

Range safety authorities are expected to use the criteria, analysis principles, and processes defined by the RCC 321-07 Standard and this Supplement document; however, the range Commander or his designated representative is the final decision authority for accepting risk and proceeding with a mission.

The intent of the safety criteria and guidelines is to provide definitive and quantifiable measures to protect mission-essential personnel and the general public. The analysis principles and processes defined in this Supplement can be used to characterize the operational risk for a mission. Definitive criteria provide a standard by which the range Commander's actions can be compared to those of any reasonable person in similar circumstances. All of the criteria have been evaluated from various perspectives and are considered reasonable. A discussion of the supporting rationale for the risk criteria is presented in Chapter 5 of this supplement.

The risk management and safety assessment processes presented in this Supplement should be used to consistently characterize and assess the hazards associated with a specific scenario to support an informed risk acceptance decision. Results obtained by applying these analytical methods, or other methods based on the principles endorsed here, are the product of a disciplined process to establish objective safety recommendations. Therefore, the risk estimates should not be subjectively altered at the end of the process. Such changes could invalidate the informed decision process that helps protect the government from liability.

1-1The RSG Risk Committee recognizes that there is uncertainty in the computed launch risks; however, consensus does not yet exist within the current Standard on the practice for characterizing risk uncertainty. This is a significant area to be addressed, but the schedule of this update/review phase did not allow for the considerable time required to develop criteria and recommended approaches. Uncertainty will be more completely addressed in the future updates of this supplement.

1-2

### CHAPTER 2

RISK MANAGEMENT PROCESS LEVEL II

Chapter 2 of the 321-07 Standard presents a risk management process that provides a systematic and logical approach for identifying hazards and controlling risks. Risk assessment is not a single, fixed methodology; rather it is a systematic approach to organizing and analyzing scientific knowledge and information about potentia lly hazardous activities. Therefore, the risk management process steps presented here should not be considered as binding rules. However, these process steps do provide a strong foundation from which the responsible safety office may depart consistent with DoD policy when considering the unique situation posed by a range activity. A risk management policy can legitimately contain only those elements that are relevant and significant based on the specific requirements of the missions performed at the range in question. Each range must perform a careful review to ensure that all needed considerations and analyses are included in its risk assessment process. In addition, assessment of unique or unusual hazards may require a range to expand on the considerations included in this chapter.

Most test ranges have developed integrated tools to automate this process. Desirable characteristics for these tools are identified in Chapter 3 and Chapter 7 of this Supplement. It is incumbent on the ranges to ensure that the tools adequately incorporate these characteristics and accurately convey the risk estimate and the uncertainties inherent in the methods and data used.

2.1 Historical Background

The original RCC Document 321 included a top-level approach to risk analysis to aid safety professionals in implementing the policies and criteria of the standard. The approach, known as the 8-Step Process, provided a description of activities included in the analysis of inert debris risk. The revision of RCC Document 321 expands the concept to include the major activities required to conduct the entire Risk Management Process and includes considerations to address hazards beyond just inert debris.

This newly defined approach is an adaptation of the risk management process currently accepted as standard by the system safety community and provides a more comprehensive picture of overall risk management. The approach highlights the iterative aspects and critical reviews commonly found in successful risk management programs and in existing range practices. While providing insight, this approach neither is an “approved” methodology nor inclusive of all considerations required to properly assess the risks encountered by every range or mission. The remainder of this chapter describes the new risk management process developed for this standard. Each function of the original 8-Step process can be found within the steps of this new process.

2.2 Risk Management Process - Level II

This chapter of the Supplement expands the pr ocess defined in Chapter 2 of the Standard to the next level of detail. The flowchart presented in Figure 2-1 provides an overview of the

2-1major analysis tasks required to perform risk mana gement from the flight safety perspective. Tasks are grouped into the four phases of Risk Management described in Chapter 2 of the Standard. The objectives of each phase are desc ribed in the subparagraphs below. Paragraph 2.3 gives a brief description of the steps within each phase and provides checklists of analytical considerations for each step that might be incl uded in the specific analysis approach adopted by
a test range.

2.2.1 Mission Definition and Hazard Identification . Definition of the vehicle, safety control systems, and planned manner of flight are required to support identification of the hazards associated with the mission. Potential hazard sources are then examined by evaluating the system being flown and the range safety constraints. Information sources include range safety data packages, system description documents, mission essential personnel locations, surrounding population data, locations of facilities or properties to be protected, the range safety system used, and lessons learned from similar missions. The hazards associated with launch or test operations typically result from inert and explosive debris, chemical toxicity of propellants released inadvertently to the atmosphere or normal combustion of the propellant, and the distant focusing of an overpressure blast wave under certain meteorological conditions. These hazards may be the result of a launch vehicle or test article malfunction and subsequent breakup or intact impact, or the combustion and release of chemical constituents during normal operations.

2.2.2 Risk Assessment . The initial approach in the risk management process is to contain the hazards and isolate them from populated areas wherever practical or to define hazard containment areas to minimize the population exposed and/or evacuate persons not associated with the hazard-generating event. This is in accordance with the primary policy that no hazardous condition is acceptable if mission objectives can be attained from a safer approach, methodology, or position (i.e., minimizing the hazards and conducting the mission as safely as reasonably possible). If hazards cannot be containe d or minimized to an insignificant level, then more detailed assessments should be performed to determine if the remaining risk is acceptable.

Hazard levels are first defined using qualitative and quantitative methods. This approach will result in basic measures of the hazards including debris size, quantity, mass, impact kinetic energy and explosive potential. Risks are then defined using qualitative and quantitative methods to assess and compare the hazard level to the vulnerability of the protected asset (personnel, facility, or other asset). This assessment produces risk measures such as individual probability of fatality (P f ), expected casualties (E

c ), etc. This phase provides information needed

to determine whether further risk reduction measures are warranted.

2-2PHASE III: Criteria Comparison & Risk Reduction PHASE I:

Mission Definition and Hazard Identification PHASE II:

Risk Assessment

PHASE IV: Risk Acceptance “Mission” includes: (1) flight vehicle description, (2) flight scenario, (3) safety system, (4) operating rules / limits I-5. Identify Hazards

and Hazard Producing Events

I-1. Define Vehicle/System I-2. Define

Mission

Scenario

I-4. Define Safety System(s) I-3. Define Safety Limits/ Operating Rules

Termination Criteria Operational Limits
Protected Assets/Areas R-1. Hazard Analysis Input Review II-3. Propagate

Hazard

Characteristics

II-6. Assess

Containment Feasibility II-1. Characterize

Hazards at

Events II-2. Model Dispersion of

Hazard Source

Locations

II-4. Compute Spatial / Temporal

Statistics at Assets

Spatial Temporal

II-5. Create/Refine Flight Termination

Criteria

R-2. Critical Review of Data and Assumptions II-7. Compute Risks

• Individual

• Collective • CatastrophicRefine Assessment

TO

IV-1

Yes

R-3.

Critical Analysis

Review

III-1. Evaluate Risks vs

RCC-321Criteria

• Risk Reduction Opportunities • Risk Reduction Requirements III-2. Refine Assumptions And Analysis

III-4. Refine Safety Limits / Operating Rules

III-5. Modify System Design TO

I-3 TO

I-2

TO

I-1 III-3. Modify

Planned Mission

Scenario TO

II-1

IV-1. Review Mission, Proposed Operating Rules,

And Risk Analyses (Designated Authority)

IV-3. Follow Mission

Rules – Terminate if

Real-time Limits

are Violated IV-2a. Approve Mission –

Launch When

Constraints are Met IV-2b. Disapprove Mission as Proposed TO

III-1

NOTE: Checklists for all numbered boxes are provided in sections 2.3.1-2.3.4 PHASE III: Criteria Comparison & Risk Reduction PHASE I:

Mission Definition and Hazard Identification PHASE II:

Risk Assessment

PHASE IV: Risk Acceptance “Mission” includes: (1) flight vehicle description, (2) flight scenario, (3) safety system, (4) operating rules / limits I-5. Identify Hazards

and Hazard Producing Events

I-1. Define Vehicle/System I-2. Define

Mission

Scenario

I-4. Define Safety System(s) I-3. Define Safety Limits/ Operating Rules

Termination Criteria Operational Limits
Protected Assets/Areas R-1. Hazard Analysis Input Review II-3. Propagate

Hazard

Characteristics

II-6. Assess

Containment Feasibility II-1. Characterize

Hazards at

Events II-2. Model Dispersion of

Hazard Source

Locations

II-4. Compute Spatial / Temporal

Statistics at Assets

Spatial Temporal

II-5. Create/Refine Flight Termination

Criteria

R-2. Critical Review of Data and Assumptions II-7. Compute Risks

• Individual

• Collective • CatastrophicRefine Assessment

TO

IV-1

Yes

R-3.

Critical Analysis

Review

III-1. Evaluate Risks vs

RCC-321Criteria

• Risk Reduction Opportunities • Risk Reduction Requirements III-2. Refine Assumptions And Analysis

III-4. Refine Safety Limits / Operating Rules

III-5. Modify System Design TO

I-3 TO

I-2

TO

I-1 III-3. Modify

Planned Mission

Scenario TO

II-1

IV-1. Review Mission, Proposed Operating Rules,

And Risk Analyses (Designated Authority)

IV-3. Follow Mission

Rules – Terminate if

Real-time Limits

are Violated IV-2a. Approve Mission –

Launch When

Constraints are Met IV-2b. Disapprove Mission as Proposed TO

III-1

NOTE: Checklists for all numbered boxes are provided in sections 2.3.1-2.3.4

Figure 2-1. Level 2 risk management process flowchart.

2.2.3 Criteria Comparison and Risk Reduction . If the risk is unacceptable when initially compared to the criteria, then various protective measures should be considered to eliminate, mitigate, or control the risks. Elimination is achieved by design or system changes that remove the hazard source. Mitigation is achieved by reducing the hazard level or the effect of the hazard. Control is achieved by using flight termination systems, containment approaches, evacuation, sheltering, or other measures to protect assets from the hazards. Risk reduction should include confirmation of the resolution of anomalies and failures of all safety critical systems during previous tests or flights. Implementation of these measures may warrant a reassessment of the risk using revised assumptions and inputs.

2-32.2.4 Risk Acceptance . Each organization should establish and use procedures that assure that risk levels are reviewed at the proper level of authority. This review should compare the operational risk to the criteria defined in this document and other applicable mission documents. In general, higher-risk operations require a higher level of approval. This final and necessary step in risk management is the acceptance of operational risks by a properly designated and informed authority. In general, this acceptance should be documented using existing procedures. These procedures should include the means of en suring that planned standards and controls are being implemented.

2.3 Detailed Checklists for Phases of the Risk Analysis Process

Figure 2-1 above provides only a top-level flow of the types of activities required to identify, assess, mitigate, and accept the risks resulting from a flight operation. The checklists below provide additional insight into those factors that should be considered for incorporation into a range’s analysis process. Considerations are provided for the steps in the four phases of the Level 2 risk management process shown at Figure 2-1 . The checklists for each phase are contained in the following paragraphs as follows:

Phase Title Paragraph

I Mission Definition and Hazard Identification 2.4

II Risk Assessment 2.5

III Criteria Comparison and Risk Reduction 2.6

IV Risk Acceptance 2.7

The checklists below are not exhaustive and may not contain all parameters that should be considered in a given analysis. Each test range is responsible for determining the level of analysis required to assess the risks of a given mission. Some examples of factors that should be considered in the range’s process can be found in Chapters 3 and 7 of this supplement.

2.4 Phase I: Mission Definition and Hazard Identification

For the purpose of the flight safety analysis discussions the term “mission” is defined to include a flight vehicle description, the flight scenario, the Flight Termination System on board the vehicle, the range safety system from where the vehicle will be controlled, and the rules and safety limits under which the operation must be conducted.

Phase I of the Risk Management process is the information-gathering phase. This is often accomplished through technical reviews and meetings between the range users and the range operations and safety personnel. The purpose of this phase is to identify credible scenarios that can either intentionally, or unintentionally, produce hazards and define the scope of the risk assessment to be performed. The outcome of this phase will be a list of hazards and hazardous events to be analyzed in the Risk Assessment phase. Key steps of this phase and items that

should be considered are described below.

2-42.4.1 Step I-1: Define Vehicle/System . Identify characteristics of the vehicle and vehicle behavior that can create potential hazards, represent a means of controlling hazards or can affect the magnitude of the hazard. See the checklist at Table 2-1

.

2.4.2 Step I-2: Define Mission Scenario . Define where and how the vehicle is intended to fly in order to identify potential hazardous events or pre-determined bounds that may be dictated by mission/program requirements. See the checklist at Table 2-2

.

2.4.3 Step I-3: Define Safety Limits/Operating Rules . Identify known or pre-defined safety limits and operating rules to serve as a baseline for beginning the analysis. These are typically revised and refined based on analysis results (See Step II-5). See the checklist at Table 2-3

.

2.4.4 Step I-4: Define Safety System(s) . Identify planned and available means of controlling, containing or mitigating the hazards and the characteristics of the safety system(s) that define/bound the scope of the assessment. See the checklist at Table 2-4

.

2.4.5 Step I-5: Identify Hazards and Hazard Producing Events . Given the inputs of the previous four steps, define the hazards and hazardous events that will be evaluated in the risk analysis and assessment. See the checklist at Table 2-5

.

2.4.6 Review R-1: Hazard Analysis Input Review . Review at this point provides an opportunity to reconfirm the scope of the analysis to be performed and verify that all of the

hazards to be assessed are reasonable and feasible. See the checklist at Table 2-6

.

2-5TABLE 2-1. RISK MANAGEMENT PROCESS (STEP I-1)

Define the Vehicle/System

A. Vehicle characteristics
Configuration

• Booster stack – motors/stages (liquid/solid, strap-ons), interstages, skirt(s), payload fairings

• Payload(s) and reentry bodies
Mass properties as a function of time

• Dry weight

• Propellant (to include ambient and pressurized conditions)

Structural limits
Thrust history/capability
Turn capability (velocity turn data, malfunction turn trajectories or lateral acceleration)
Guidance/Control systems (TVC, fins, jets/thrusters, etc.)
On-board data/tracking instrumentation (TM, GPS units, transponders)

• Data rates

• Tracking uncertainties
B. Vehicle Failure Modes and Responses
Failure Mode Effects and Criticality Analysis (FMECA)/Failure Modes and Effects Analysis (FMEA)
Event Tree Analysis

C. Vehicle Failure Probabilities – derived from:

Historical data

Similar vehicles
Reliability analysis or demonstration
Bayesian analysis
Relevancy of aging data (ex. fading memory filter)

2-6TABLE 2-2. RISK MANAGEMENT PROCESS (STEP I-2)

Define Mission Scenario

A. Mission Objectives
Type of Mission

• Payload launch

o Orbital (including type of orbit)

o Suborbital

• Demo/Experiment

• Intercept
Data Collection /Performance Requirements

• Altitude requirements

• Range requirements

• Velocity requirements

• Vehicle attitude requirements

• Event/timing requirements

• Program instrumentation requirements
Other Program auxiliary requirements (e.g., sun angle, distance from land target flies, etc.)
B. Nominal Flight Trajectory/Scenario
Flight path (including target area for suborbital launches)
Event timing (staging, other hardware jettisons, GNC maneuvers, energy management, payload deployments)
Intercept geometry
C. Flight performance envelope
3-sigma bounds of trajectories derived from GNC performance and motor performance defining lofted, depressed, maximum cross range left and right, short range (cold motor), long range (hot motor)
Allowable or permitted intercept control volume

2-7TABLE 2-3. RISK MANAGEMENT PROCESS (STEP I-3)

Define Mission Scenario

A. First cut flight termination criteria
Credible RSO and system reaction time
Pre-defined flight corridors (azimuth fans, impact limit lines, etc.)
Destruct or flight termination limit lines, vertical plane limits, vehicle attitude criteria, protection circles, gates, etc.

Rules for “No Data” destruct
B. General safety and operating rules
No IIP overflight
Protected Assets/Areas - “assets”(also called receptors) includes people

• Regions to be protected

• High value assets (facilities, property or other)

• Population centers

• Staffed personnel locations
Pre-defined personnel sheltering and evacuation requirements
Minimum number of tracking data sources and other applicable requirements such as capability of failing gracefully, etc.

Initial launch commit criteria and launch constraints
Special mission rules identified by the range user or flight analysts

2-8TABLE 2-4. RISK MANAGEMENT PROCESS (STEP I-4)

Define Safety Systems

A. Vehicle Flight Terminati on System (FTS) characteristics

Determine need for FTS - dependent on type of vehicle (some do not require FTS) and capability of a vehicle to hazard a protected area
Type(s) of system(s)

1. Commanded

2. Automatic (such as triggered by a premature separation)

3. Autonomous (such as vehicle system determining violation of some predetermined criteria)

Termination method(s)

• Linear Shaped Charge (LSC) - longitudinal, circumferential

• Conical Shaped Charge (CSC)

• Thrust Termination (TT) - ports, fuel line cuts

FTS reliability

System delays – the time to receive and execute the termination command

Antenna type/patterns

B. Range Safety System (RSS) characteristics

Identify system(s) to be used

• Fixed, land-based system

• Mobile (land, sea, air platform)

Mode(s) of operation

• Manual destruct

• Automatic destruct

Antenna type(s) - directional (dish or helix) or omni

Antenna location(s) (for plume shadow assessment)

Transmit range (for link margin analysis)

System delays

• Time to receive and process Time, Sp ace and Position Information (TSPI) data

• Time to transmit after Destruct button push

Method of handover, if applicable (transfer of command and control)

C. Tracking instrumentation feeds (accur acy, frequency of data, data latency)

2-9TABLE 2-5. RISK MANAGEMENT PROCESS (STEP I-5)

Identify Hazards and Hazard Producing Events

A. Inert Debris Impact
B. Explosive Debris (near-range effects)
C. Distant Focusing Overpressure (DFO)

D. Toxics
E. Hazard producing scenarios:

Malfunctioning vehicle terminated at destruct line or due to other criteria such as potential loss of FTS link or tracking data or obviously erratic flight
Malfunctioning vehicle exceeding structural limits
Motor case rupture (overpressure, burn-through – explosion while following nominal trajectory)
Inadvertent separation of strap-on motors during either normal flight or during a

vehicle malfunction
Scheduled jettisons
Planned intercept event (whether KE, explosive, or directed energy)
Planned destruct (post-mission prevention of recovery)
Planned payload deployments and activations

TABLE 2-6. RISK MANAGEMENT PR OCESS (REVIEW: R-1)

Hazard Analysis Input Review

A. Sanity check that all potential/feasible hazards have been addressed.

Have common cause failures been addressed?

Have multiple simultaneous or sequential failures (stacked failures) been included that

are not realistic or feasible?
B. Have the failure modes and responses been adequately identified, supported, justified,

and rationalized?
C. Do the failure probabilities make sense?
Consider similarities and differences between similar vehicles and similar subsystems

Are the failure probabilities justified by the vehicle’s flight experience?

D. Have there been any new design changes to the systems (vehicle or other) since the risk management process was started?

2-102.5 Phase II: Risk Assessment

Phase II of the Risk Management Process consists of conducting qualitative and quantitative risk analyses and assessments to determine the level of risk posed by the mission. The output of Phase II will be the measures of risk to be evaluated against the acceptable risk criteria. The Risk Assessment Phase may be an iterative process where portions of the analysis are conducted more than once as data inputs and assumptions are refined and finalized. All assumptions and the uncertainties associated with these assumptions should be noted at each step for consideration in the critical reviews and decision-making phases. If the analyses shows that containment is achieved then the analyst can finalize the assessment at that point, document the results, and proceed directly into the reviews of the Risk Acceptance Phase (Phase IV) of the

process.

Risk assessments should be conducted using tools that are both validated (fulfills the requirements of the task) and verified (correctly executes the function). Assessments can either be industry-accepted tools or custom tools develope d by the range to meet their specific analysis needs. The tools used should be documented to include a statement identifying the means of validation and verification. Example statements include commercially produced; industry accepted; compared to available empirical data either from launch accident, planned event or from lab tests/experiments; compared to other accepted or validated tools; and demonstrated to match theoretical models. Additional information on recommended tool/model requirements is provided in Chapter 3 of this supplement.

2.5.1 Step II-1: Characterize Hazards at Events . Identify specific, detailed characteristics of the hazards to be evaluated. Hazards other than those listed here may need to be included as described in Chapter 8 of this supplement. See the checklist at Table 2-7

.

2.5.2 Step II-2: Model Dispersion of Hazard Source Locations . Define the origination points of the hazard sources (whether they be debris, toxics, or explosives) taking into account wind dispersions and the uncertainties in vehicle performance and in the hazardous event models. See

the checklist at Table 2-8

.

2.5.3 Step II-3: Propagate Hazard Characteristics (Spatial and Temporal) . Propagate the results of the hazardous events to the points and times of interest. This could be debris propagated to the ground, to aircraft altitudes, or to orbital demise; or explosive or toxic hazards characterized as a function of time and distance from the hazard origination or at specific asset/receptor locations. The outcome of this step is defined hazard characteristics at the points and times of interest. Items that may affect propagation and post-propagation characteristics of

the hazards are listed. See the checklist at Table 2-9

.

2.5.4 Step II-4: Compute Spatial/Temporal Statistics at Protected Assets Exposed to Hazard. Identify the assets (also called receptors) for which risk is to be assessed and determine the level of the hazard exposure for each identified asset. Levels of hazard exposure are often expressed in the form of density statistics or as function of time. See the checklist at Table 2-10

.

2-11NOTE: These next two steps are often performed as an iterative process.

2.5.5 Step II-5: Create/Refine Flight Termination Criteria . In some cases flight termination criteria (particularly destruct boundaries) are not defined until after the debris statistics are produced. In these situations this may occur before or during the containment feasibility assessment. In other cases flight termination criteria are adjusted after assessing containment feasibility as a means of achieving containment. As stated in paragraph 2.3.3 of the Standard, flight termination criteria should be optimized by balancing the risk given a failure and flight termination against the risk given a failure and no flight termination. See the checklist at

Table 2-11

.

2.5.6 Step II-6: Assess Containment Feasibility . Identify the ability to contain hazards and thus not put any personnel or property at risk. Containment may be achievable by implementing flight termination criteria and launch constraints, thus this step is performed in close coordination with Step II-5 above. See the checklist at Table 2-12

.

2.5.7 Review R-2: Critical Review of Data and Assumptions . Review at this stage allows the analyst to double check inputs and assumptions and make any necessary or available adjustments to the analysis before going on to computing the risk numbers, which can be a time-consuming process. See the checklist at Table 2-13

.

If containment is achieved and the analyst has conducted the critical review of data and assumptions, the assessment may be ended here and the analyst may proceed to documenting the results, conditions, and assumptions for review with the decision authority in Step IV-1 of the Risk Acceptance Phase (paragraph 2.7 ). The steps of the risk reduction phase are no longer required.

2.5.8 Step II-7: Compute Risks . Calculate the various measures of risk that are to be evaluated against the acceptable risk criteria. This includes Individual, Collective and Catastrophic risk for the people exposed. Measures of risk are commonly expressed as Probability of Impact, Probability of Casualty/Fatality, Expected Casualty/Fatality and Probability of N or more Casualties. See the checklist at Table 2-14

.

2.5.9 Perform Review R-3: Critical Analysis Review . This is a final sanity check and “all

bases covered” review to assure that the risk numbers to be evaluated in the Risk Reduction phase and to be presented to the decision authority are as accurate as possible. See the checklist

at Table 2-15

.

2-12TABLE 2-7. RISK MANAGEMENT PROCESS (STEP II-1)

Characterize Hazards at Events

A. Debris lists - includes size, shape, material, ballistic coefficient and fragment imparted velocity information (See paragraph 7.1 for additional guidance on the development of debris lists.)

FTS event - either commanded, auto, or Premature Separation System(PSS) - including time variance
Breakup – aerodynamic/inertial, motor pressure (explosion), structural failure
Intercept – relevant mechanisms considered, e.g., direct hit vs. glancing blow, explosive, directed energy; special characteristics of the target or intercept mechanism
Payload deployment activities (explosive and dispersal payloads)
Credibility of debris list

• Accounts for total mass of vehicle hardware and propellants

• Consistent with launch accident debris data

• Debris pieces adequately defined in terms of weight, size, shape, ballistic characteristics, imparted velocity, propellant content (type, weight)

B. Initial source clouds for toxics
C. Explosives quantities, yields, and geometries
D. Residual thrust dispersion of prematurely separated strap-on motors

2-13TABLE 2-8. RISK MANAGEMENT PROCESS (STEP II-2)

Model Dispersion of Hazard Source Locations

A. State Vector(s) at event including any imparted velocity from event – flight termination, overpressure/burst, momentum transfer from intercept
B. Failure turns - some modeling options are:

Credible malfunction trajectories
Velocity turn data (turn angle and velocity magnitude histories)
Maximum energy footprint
90-degree turn

Maximum rate turn

Extreme rate tumble
C. Address significant sources of uncertainty which may include:

3-sigma data of performance and/or event model
Monte Carlo of trajectories and/or performance and event model data
Tracking instrumentation uncertainties (Uncertainty in measuring the state vector. This largely affects real-time displays but should be accounted for in analysis when defining/refining flight termination criteria.)

D. Winds

Measured

Statistical

2-14TABLE 2-9. RISK MANAGEMENT PROCESS (STEP II-3)

Propagate Hazard Characteristics (Spatial and Temporal)

A. Drag – tumbling or trim (consider applicable flow regime)
B. Aerodynamic lift
C. Gravity (appropriate degree of refinement)
D. Meteorological profile

E. Winds

Measured

Statistical
F. Aero-thermal demise and propellant burn
G. Vapor cloud dispersion rate
H. Vapor cloud travel rate
I. Time for debris to pass through aircraft altitude
J. Blast wave propagation

TABLE 2-10. RISK MANAGEMENT PROCESS (STEP II-4)

Compute Spatial/Temporal Statistics at Protected Assets Exposed to Hazard

A. Identify assets
Personnel – category, location and number (includes distribution by shelter types)

• What is at risk? (unsheltered people, people in cars, people in structures, - are the people in locations where the safety organization can restrict their presence?)
Aircraft – category, size, engines, # passengers, location (including altitude), flight path and speed
Surface craft – category, size, # personnel, material (metal, fiberglass, wood, etc.), location, speed
Spacecraft – type, location (ephemeris)
Valuable structures/equipment – (control centers, instrumentation sites, radars, etc.)
Protected natural spaces
B. Debris density (or PDF) by hazard level at location (accounting for flight termination action once flight termination criteria are defined)

At altitude (as a function of time)

At surface

C. Toxic cloud concentration as function of time at location

Peak at location
Time of exposure
D. Explosive pressure and impulse at assets

2-15TABLE 2-11. RISK MANAGEMENT PROCESS (STEP II-5)

Create/Refine Flight Termination Criteria

A. Define/refine flight termination boundaries
B. Define exclusion areas (often referred to as caution or hazard areas)
C. Refine/revise the launch commit criteria and launch constraints as necessary
D. Return to Step II-1 and recompute the debris statistics once flight termination criteria

and launch criteria are finalized

TABLE 2-12. RISK MANAGEMENT PROCESS (STEP II-6)

Assess Containment Feasibility

A. Are any assets at risk?
B. Does debris, explosive, or toxic hazard reach any protected area or defined boundary?

TABLE 2-13. RISK MANAGEMENT PR OCESS (REVIEW: R-2)

Critical Review of Data and Assumptions

A. Sanity check of assumptions
B. Update/refine inputs as available
C. Replace assumptions with better data if/when provided
D. Return to Step II-1 and refine analyses with revised/new data as necessary

2-16TABLE 2-14. RISK MANAGEMENT PROCESS (STEP II-7)

Compute Risks

A. Probability of modeled event
B. “Lethal Hazard” Area and “Casualty Area”(measured as function of asset size and/or debris size and shape, terminal trajectory characteristics such as angle of impact and impact velocity, nature of debris – inert, burning, explosive, and impact phenomenon such as cratering, sliding and bouncing). Defined for:

Person

Aircraft
Ship

Structure
C. Probabilities of impact on asset(s)
D. Assess post-impact hazards at receptors (assets)

Explosion (overpressure/impulse and secondary fragmentation)
Cratering

Bounce/slide

Heat/fire
Asphyxiation
E. Modification of hazard by structures as applicable

Type of structure

• Structure category (reinforced concrete, steel frame, tilt-up, corrugated metal, wood frame, etc.)

• Material makeup (wood, steel, concrete, glass, brick, etc.)

• Construction method

• Number of stories

• Wall/Roof thickness

• Number and types of windows
Protection provided
Spalling

Penetration
Collapse
Window breakage (flying glass shards)
Ventilation, air exchange rate
(Continued on next page)

2-17TABLE 2-14 (Continued)

F. Probability of casualty/fatality from inert debris

G. Probability of casualty/fatality from toxics

H. Probability of casualty/fatality versus overpressure and impulse for explosive debris

Person

Aircraft
Ship

Structure
I. Expected Fatality/Casualty (aggregate risk from the various scenarios, hazards and assets (receptors))

Individual

Collective
Catastrophic
Risk profile (plots the probability of an accident causing a given number of casualties vs. the number of casualties – Pr(# casualties > C for all C))

TABLE 2-15. RISK MANAGEMENT PR OCESS (REVIEW: R-3)

Critical Analysis Review

A. Sanity check of assumptions and processes
B. Update/refine inputs as they are made available. Examples:
Revised trajectories
Updated aero/thrust models
Updated mass properties

Refined wind data

Refined debris lists
Updated census counts
C. Return to Step II-1 and refine risk analysis and assessment with revised/new data if

necessary

2-182.6 Phase III: Criteria Comparison and Risk Reduction

During Phase III of the Risk Management Process, the risk measures computed by the analyst are evaluated to determine if there is a need or desire for risk reduction measures to be taken to eliminate, mitigate, or control risks. Not all of the steps of the Risk Reduction phase are required to be performed – only those that are found applicable. Most often, risk reduction is accomplished through modification of the mission de finition and requires coordination with the range user to determine reasonable, appropriate measures since some modifications can severely impact cost and schedule. Risk reduction should also include confirmation of the resolution of anomalies or failures of all safety critical system s during previous tests or flights. Once risk reduction measures are taken, the hazards are reassessed to compute the revised levels of risk. The end result of this phase is a comparative summary of the measures of risk against the appropriate criteria and a recommendation for the decision authority to either approve or disapprove the mission. The steps for Phase III are shown below.

2.6.1 Step III-1: Evaluate Risks vs. Criteria . Compare risk measures with established criteria to determine if risk reduction is required or desired. Identify areas where risk reduction may be

achievable. See the checklist at Table 2-16

.

2.6.2 Step III-2: Refine Assumptions and Analysis (returning to Step II-1) . Reevaluate the analysis methodology to determine if any assumptions should be adjusted or if any steps or processes should be refined with further detail. See the checklist at Table 2-17

.

2.6.3 Step III-3: Modify Planned Mission Scenario (returning to Step I-2) . Reevaluate the scenario and determine if any changes can be made to move the hazards further away from endangered areas while still meeting mission requirements. See the checklist at Table 2-18

.

2.6.4 Step III-4: Refine Safety Limits/Operating Rules (returning to Step I-3) . Reevaluate the safety and mission rules to determine any changes that can eliminate or control the hazards or can reduce the severity and/or probability of the hazard. Again, flight termination criteria should be optimized by balancing the risk given a failure and flight termination against the risk given a failure and No flight termination. See the checklist at Table 2-19

.

2.6.5 Step III-5: Modify System Design (returning to Step I-1) . Reevaluate the vehicle and safety system(s) designs to determine if any modifications can be made that will eliminate hazards or significantly reduce the hazardous effect. See the checklist at Table 2-20

.

2-19TABLE 2-16. RISK MANAGEMENT PROCESS (STEP III-1)

Evaluate Risks vs. Criteria

A. Compare computed risks to acceptable risk criteria for all categories of assets

B. Evaluate risks for common sense checks even if criteria are not exceeded

Does the scenario make sense?

Can minor modifications be made to achieve containment or to reduce risk?
C. Identify Risk Reduction Requirements

What area of risk is exceeded – personnel, aircraft, etc.?
By how much are the criteria exceeded?
D. Identify Risk Reduction Opportunities

Have assumptions been made that are very conservative and could be revised so as to justifiably reduce the predicted risk?
What area(s) of the mission definition can affect risk reduction?
What area(s) of the mission definition provide the greatest risk reduction?
What area(s) of the mission definition can be altered most easily?
What area(s) of the mission definition can be altered with the least schedule/cost impact?
What evacuations and sheltering of people can be realistically accomplished?

Prioritize areas of focus

TABLE 2-17. RISK MANAGEMENT PROCESS (STEP III-2)

Refine Assumptions and Analysis (returning to Step II

A. Remove any excess conservatism in assumptions (so long as the reduction is supportable).
B. Adjust level of depth of the analysis
Was any part of the process initially deemed unnecessary that should be reconsidered? (example: initially looked at only worst cases or bounding cases now refine to assess Monte Carlos or 3-sigma performance)

2-20TABLE 2-18. RISK MANAGEMENT PROCESS (STEP III-3)

Modify Planned Mission Scenario (returning to Step I-2)

A. Shift trajectory azimuth
B. Increase or decrease quadrant elevation
C. Modify flight profile - doglegs, Gene ralized Energy Management Steering (GEMS) maneuvers, pitch up, pitch down, piled river, lofting, etc.

TABLE 2-19. RISK MANAGEMENT PROCESS (STEP III-4)

Refine Safety Limits/Operating Rules (returning to Step I-3)

A. Adjust destruct lines, impact limit lines and/or protection boundaries
B. Adjust allowable RSO response time (so long as the adjustment is supportable)
C. Evacuate or shelter personnel
D. Implement hands-off gates or critical event markers
E. Implement gates or critical event markers for staging, ignition or performance
F. Utilize automatic destruct system if available

TABLE 2-20. RISK MANAGEMENT PROCESS (STEP III-5)

Modify System Design (Returning to Step I-1)

A. Remove or add ballast
B. Impose hardware or software steering limits
C. Implement inhibit logic
D. Increase tracking instrumentation reliability/accuracy
E. Refine system delay times
F. Modify Vehicle Flight Termination System

Type of system – automatic or autonomous vs. commanded
Modify post-termination states – terminate thrust, deploy chutes, disperse fuel, change debris fragmentation, etc.

• Change termination method – LSC > CSC > TT > Line Cut

• Change location of charge – raceway vs. aft dome vs. forward dome

2-212.7 Phase IV: Risk Acceptance

Once the risk assessment is complete and all necessary risk reduction measures are taken, final results and recommendations (including proposed operating/mission rules) are presented to the appropriate decision authority. The result of this phase can be one of the following

outcomes:

a. An approved mission,

b. An approved or disapproved mission with further instructions or

c. A decision to reject the mission.

To ensure that the decision authority is fully informed, the analysis/assessment should be fully documented to include the assumptions made and justifications, results, recommendations of the analysis team, models used for the analysis, and uncertainties associated with the assumptions and models. Information on models used should include version numbers and a brief description of certification and/or he ritage. (Examples: industry-accepted model XX version #.#, Debris generator X, custom deve loped by Organization Y and verified using available empirical (or test) data or via comparative analysis against Tool Z.)

After reviewing the information the decision authority may either approve the mission with the noted risks or disapprove the mission. If the mission is disapproved, the safety organization and the range user may elect to continue efforts to reduce risks to an acceptable level. If no further risk reduction is possible and the predicted risks are still too high, the appropriate decision authority may reject the mission as unsafe and determine that it should not be pursued. If the risks are acceptable and the mission is approved, the authority is issued to proceed with a countdown and subsequent launch once all of the defined launch commit criteria launch constraints are met. Once the vehicle is launched the defined flight termination criteria are in effect and the flight will be terminated if those criteria are violated in order to ensure the approved level of risk is not exceeded.

2.7.1 Step IV-1: Review Mission, Operating Rules and Risk Analyses (Designated Authority)

. Present analysis results, conditions, and recommendations to the decision authority. These

should include the elements shown at Table 2-21

.

2.7.2 Step IV-2a: Approve Mission – Launch When Constraints are Met . The decision authority accepts the mission risk and approves operating/mission rules and launch constraints. The countdown proceeds and liftoff is allowed if launch constraints are met. A “Hold” is issued if launch constraints are not met; however, the appropriate designated decision authority is allowed to implement a real-time waiver if deemed necessary. Some of the significant

constraints considered are shown at Table 2-22

.

2.7.3 Step IV-2b: Disapprove Mission as Proposed (returning to Step III-1) . If the risks remain too high or the operating rules are too severe or restrictive, the decision authority may disapprove the mission thus requiring the analyst and range user to return to the Risk Reduction Phase in an attempt to identify and implement any further risk reduction measures. If all measures have been exhausted and the risks still exceed established criteria then a waiver may be

2-22requested by the range user and granted by the appropriate authority if the need is justified or the mission may be rejected.

2.7.4 Step IV-3: Follow Mission Rules . Terminate the mission if real-time limits are violated. During execution of an approved mission, the defined flight termination criteria are in effect and the flight will be terminated if those criteria are violated in order to ensure the approved level of

risk is not exceeded.

TABLE 2-21. RISK MANAGEMENT PROCESS (STEP IV-1)

Review Mission, Operating Rules and Risk Analyses (Designated Authority)

A. Measures of risk that are presented
B. Risk level or loss potential

Maximum risk in event of a flight termination action
Maximum risk should flight termination fail
Risk profiles, if used
Sensitivity analyses
C. Key analysis assumptions
D. Population centers potentially at risk
E. Facilities, property or other assets at risk

F. Protective measures
G. Operating rules

H. Launch Constraints and Launch Commit Criteria
I. Flight Termination Criteria

TABLE 2-22. RISK MANAGEMENT PROCESS (STEP IV-2A)

Approve Mission – Launch When Constraints are Met

A. Hazard area cleared
B. Personnel in approved shelters
C. Vehicle FTS operating properly (battery levels good, signal strength, etc.)
D. Range Safety system operating properl y (receiving good data, transmit-power good, etc.)
E. Casualty expectation under current meteorological conditions within approved limits

2-23This page intentionally left blank.

2-24

### CHAPTER 3

GENERAL RISK MODEL REQUIREMENTS

Computer models and simulations are typically used to estimate the risk involved in an activity. This chapter describes general model requirements that should be applied to computational tools used to analyze the flight safety risks in support of decisions governing safety. In general, a model is a technical representation of a system, theory, or phenomenon that accounts for its known or inferred properties and may be used for further study of its characteristics. For the purposes of this chapter, in range safety usage, models are defined as those tools developed for the specific task of analyzing flight risks.

3.1 Specific to Policy

Models must provide results that support decisions based on risk policy. Compliance with risk policy is assessed using established criteria that consist of two components. The components are a well-defined measure of risk, and a threshold of acceptability. Models must produce a valid estimate of one or more of the measures of risk stipulated by applicable criteria.

3.2 Transparency, Clarity, Consistency and Reasonableness (TCCR)

Models must uphold standards of transparency, clarity, consistency, and reasonableness accepted by the scientific community. Specifically, models must reflect:

a. Transparency . Provide decision-makers a clear understanding of the technical approach used. This understanding must include key supporting assumptions as well as the limitations of the model and the results it produces.

b. Clarity . Produce results that can be clearly displayed and communicated.

c. Consistency . Use processes and approaches that are consistent with (similar to or accepted by) those used by scientific communities involved in studying similar problems. This requirement is intended to ensure scientific accountability rather than

to stifle innovation.

d. Reasonableness . Use appropriate technical procedures and input data that, if subjected to scrutiny, would be accepted by the scientific community, government agencies, and to the degree possible, the general public. Available resources may limit the approaches used.

3.3 Verification and Validation (V&V)

Models should provide a formally documented “Basis of Confidence” in the results produced. Numerous methods can be used to build confidence in a model, including:

a. Comparison to “real world” results.

b. Comparison to other models that have been independently developed and possess an accepted “basis of confidence.”

c. Formally documented Verification and Validation (V&V).

d. Peer reviews/expert elicitations.

3-13.4 Configuration Control

Model development should follow processes that are formally managed and controlled. A documented process should be used to request, implement, and test changes to the model. In unusual circumstances, an abbreviated review of model changes may be necessary to support near-term mission requirements. The full requirements of the documented process should be met prior to repeated use of results from the upgraded model to make safety decisions. The development of computer codes implementing models should adhere to industry standards such as the Software Engineering Institute’s (SEI) Capability Maturity Model Integration (CMMI). 1
The use of CMM Level 2 is recommended as a minimum requirement. Each range should develop and implement an accreditation process that is applied to all models used for flight safety analysis and support. This accreditation process should identify verification and validation requirements (V&V) for safety critical software and safety analysis software. The results of V&V efforts for safety critical soft ware should be formally documented including the source and nature of any external data used to conduct validation. Requirements for accreditation of safety-critical software should be greater than requirements for safety analysis

software.

3.5 Liability Protection

Models must produce results that meet the “best available” information-test affording the decision-maker the opportunity to make a fully informed decision that qualifies for liability protection under the Discretionary Function Exclus ion of the Federal Tort Claims Act (FTCA) (28 U.S.C. Section 2680(a)).

3.6 Best Estimate of Expected Value

Models should produce the best estimate of the risk based on available inputs and require the use of best engineering estimates. A conservative estimate can be developed by using slightly conservative inputs when data are uncertain or are unavailable and need to be estimated. An analysis of the uncertainties and sensitivities of results is highly desirable.

3.7 Balance of Accuracy, Simplicity, and Fidelity

Models must produce the most accurate results possible considering real world limitations such as computer run time, computational resources, cost, and time to develop input data, and the diminishing return on further investment. Compliance with this standard requires a balance between modeling fidelity, uncertainties in input data, and the ability to communicate understanding of both the analysis process and the results.

3.8 Conservatism and Uncertainty

Model development must consider the dangers of excessive conservatism. Where possible, developers should avoid compounding conservatism in analytical results by using best estimate approaches for developing input data and modeling algorithms. Potential variation in

1 Information on CMMI standards can be found at http://www.sei.cmu.edu/cmmi/models/

3-2the input data and inaccuracies in the modeling results should be addressed by the acknowledgement and documentation of uncertainties as discussed in Section 2.3.5 of the Standard rather than by introducing bias in the risk estimate.

3.9 Balance of Element Fidelity

Models should clarify the accuracy of analytical results based on assessment of the accuracy of each element of the risk model. Assessments of models should focus on the accuracy of the risk estimation rather than the fidelity of a single element.

3-3This page intentionally left blank.

3-4

### CHAPTER 4

RISK CRITERIA IMPLEMENTATION GUIDELINES

4.1 Introduction

This chapter provides guidelines for implementation of the acceptable risk criteria presented in RCC Document 321-07, Chapter 3. The guidelines are presented to help:

a. Determine the start and end of a flight in terms of application of the per mission risk

criteria.

b. Establish appropriate risk criteria for complex missions, such as those that involve multiple launches or distinct phases of flight.

c. Facilitate the proper management of annual risk.

4.1.1 Context and Purpose of this Chapter . RCC 321-07 Chapter 2 expresses the general policy and goals of this standard, which includes the assertion that all ranges should strive to achieve complete containment of hazards resulting from both normal and malfunctioning flights. However, many range missions cannot be accomplished using a containment approach. If a planned mission cannot be reasonably accomplished using a containment approach, a risk management approach should be authorized by the range Commander or his designated representative. The risk management approach should conform to the guidelines presented in this document or otherwise demonstrate compliance with the policy objectives presented in Chapter 2 of RCC 321-07. The guidelines and rationale presented in this chapter are intended to help the range Commander understand and balance the factors that affect mission acceptability. These factors include criticality of mission objectives, protection of life and property, the potential for high consequence mishaps, local political factors, and governing range or programmatic environmental requirements.

Range Commanders should not accept adverse consequences (such as any casualty) as being routine or permissible. However, some range missions cannot be accomplished without a finite probability of producing adverse consequences. “Acceptable” risks as discussed here should be interpreted as “tolerable” risks. By implementing the guidelines presented here, the range Commander may tolerate these risks to secure certain benefits from a range activity with the confidence that the risks are properly managed within prescribed limits.

4.1.2 Different Measures of Risk

.

a. Individual and Collective Risk . Risk is a measure that accounts for both the consequence of an event and the probability of occurrence over a specified exposure interval. Individual risk and collective risk are two important measures of risk, both of which can be expressed on an annual or per mission basis. For example, collective risk on an annual basis is analogous to an estimate of the average number of people hit by lightning each year, while individual annual risk would be an individual's likelihood of being hit by lightning in any given year. Collective risk on a per mission basis is analogous to an estimate of the average number of people injured by

4-1an earthquake, while individual risk would be the likelihood of an individual in a given location being injured by the earthquake. Collective risk is often expressed in terms of expected values; the average (mean) consequences that can occur as a result of an event if the event were to be repeated many times.

Mean risk estimates do not convey important information about the uncertainties associated with limited accident experience, incomplete knowledge of accident phenomenology, an inherent randomness in certain accident phenomena. Therefore, sensitivity studies should be performed to determine those uncertainties most important to the risk estimates. The results of sensitivity studies should show, for example, the range of variation together with the underlying assumptions that

dominate this variation.

b. Risk Profile . A risk profile provides more information about the nature of the risks posed by an event than mean individual and collective risk values. A risk profile is a plot that shows the probability of exceeding various outcomes (e.g. numbers of deaths, number of casualties, or amount of monetary damages) resulting from a future event. Specifically, the abscissa of a casualty risk profile is the number of casualties (N) and the ordinate is the probability of N or more casualties.

Consider an example launch where the vehicle has a 5 percent chance of failure. Most of the failures do not result in any casualties; range safety action at an abort boundary or aerodynamic break up before reaching the abort boundaries causes the debris to impact in unpopulated regions. However, in this hypothetical example there are five (and only five) failure scenarios where casualties result. The probabilities and consequences for this example are shown in Table 4-1 . The data for abscissa and ordinate of the risk profile are listed in the last two columns of Table 4-1 . The data for the ordinate of the risk profile are the sum of all of the probabilities for scenarios that produce N or more casualties.

Figure 4-1 illustrates the risk profile for this simplified example launch. The E C for this particular case is 62×10 -6 and the probability of a casualty producing accident P( ≥ 1) is 12.6×10 -6 . More information on this example is available in paragraph 4.3

.

Unlike the single valued E C, risk profiles illustrate the combination of consequences contributing to collective risk. Thus, the decision-maker can quickly see whether the risk is from a very rare large consequence outcome or from more frequent, smaller consequence outcomes. This standard uses risk profiles to define limits on catastrophic risks. Paragraph 4.3 shows how a risk profile or a simplified approach may be used to evaluate compliance with the catastrophic risk criteria presented in RCC 321-07, Chapter 3.

4-2TABLE 4-1. EXAMPLE RISK PROFILE DATA

Scenario Index (i) Scenario Probability Number of

Casualties

(N) for

Scenario i Total Probability of N

or More

Casualties

1 0.0499874 0

2 0.0000100 1 0.0000126

3 0.0000010 8 0.0000026

4 0.0000010 24 0.0000016

5 0.0000005 32 0.0000006

6 0.0000001 40 0.0000001

Total = 0.05

1.E-07 1.E-06 1.E-05 1.E-04

1 1 0

N - Number of CasualtiesP[>=N]

1 0 0

Figure 4-1. Risk profile from example problem.

4-3One of the conveniences of using a risk profile (i.e. a discrete representation of the more common F-N curve) is that the area under a discrete risk profile equals the collective

risk. 2 The following equations prove this point.



## ( ) () ( ) ( ) ...3211 + + +=≥ pppP (Eqn 4-1)



## ( ) () ( ) ...32 2 + + =≥ pp P



## ( ) ( ) ...3 3 + =≥ p P

·

·

· 

## ( ) () ( ) ( ) ( max

max max

1 1 2 2 3 3 ... N

k P k p p p N pN

= ≥ = + + ++ 

## ∑ )



## ) () ( 

## ∑∑

= = ×=≥ max

1 max

1 N

k N

k kpkkP

The right side of this equation is recognizable as the classical definition of expected casualties, E C : 

## ( ) 

## ∑

= ×= max

1 N

k C kpkE (Eqn 4-2)

The E C for this particular case is 62×10 -6 and the probability of a casualty producing accident P( ≥ 1) is 12.6×10 -6 . More information on this example is available in paragraph 4.3

.

4.2 Guidelines for Application of the Criteria

4.2.1 Risk Accrual

.

a. Total Risk . The individual and collective risk criteria prescribed in RCC 321-07, Chapter 3, use the total risks, which account for all hazards to all people, including those in all transportation systems, throughout the flight portion of the entire mission. Subsequent paragraphs provide guidelines for circumstances where separate risk budgets may be justified for distinct phases of flight, or if multiple vehicles are involved. Unless those special circumstances exist, each criterion should be compared to the total risk estimate - the combined risk due to all hazards throughout the mission. Subsequent paragraphs also provide guidelines for implementation of probability of impact limits to define hazard areas for ships and aircraft.

2 Collins et al, “Measures and Technique s for Inserting Catastrophe Aversion Into the Explosives Safety Risk Management Process,” 32nd Explosives Safety Se minar in Philadelphia, PA – August 22-24, 2006.

4-4b. Accumulated and Aggregated Risk . This standard uses the terms “accumulated risk” and “aggregated risk.” The accumulated risk refers to the risk from a single hazard throughout all phases of a mission. The aggregated risk refers to the accumulated

risk due to all hazards associated with a mission, which includes, but is not limited to, the risk due to any debris impact, toxic release, and distant focusing of blast

overpressure.

When multiple hazards exist, the aggregated risks (individual and collective) can always be estimated as the sum of the accumulated risk from each hazard. More sophisticated methods to compute the aggregated risks may be used to eliminate double counting, which can occur if a mission simultaneously poses multiple hazards to certain exposed populations. If multiple hazards exist, the range Commander should be briefed on the risks due to each hazard in order to make a fully informed

decision.

Unless special circumstances exist (such as those described in this chapter), the total risk for the mission of an orbital expendable launch vehicle (ELV) should be the aggregated risk that is accumulated from liftoff through orbital insertion, including any planned debris releases. 3 Similarly, for the mission of a suborbital launch vehicle, the total risk should be the aggregated risk that is accumulated from liftoff through the impact of all pieces of the launch vehicle, including the payload.

4.2.2 Consequence Metrics . Paragraph 3.1 of the Standard requires a range to “estimate the expected casualties associated with each activity th at falls within the scope of this document,” and states that “additional measures of risk may be useful for range operations that are dominated by fatality to ensure fatality risks do not exceed acceptable limits.” In this context, “estimate” refers to a point estimate, while the overall process is called the risk assessment. Thus, the intent of this requirement is to ensure that an estimate of the expected casualties is documented for each range activity that intends to comply with this Standard. However, there may be certain circumstances where the range Commander should be informed of the estimated fatality risks as well.

Computation of fatality risks (both individual and collective) in addition to expected casualties are performed at the discretion of the safety analyst or the range commander. However, fatality risks should be computed in addition to casualty risks for those missions where: (1) any one hazard (e.g. inert debris, t oxic, Distant Focusing Overpressure (DFO), etc.) produces expected casualties for the general public greater than 50E-6 (50 percent of tolerable general population limit) AND; (2) the nature of the hazards posed suggests fatality risks may be of significance. For example, consider a hypothetical inert debris hazard with E C = 60E-6. If an examination of the debris distribution indicates that potentially fatal debris (e.g. KE > 58 ft-lbs) falls within defined containment or evacuated hazard areas, no further action is necessary; but if potentially fatal debris falls outside of the containment zone onto populated areas, then fatality risks should also be calculated. These should not be interpreted as limiting the discretion of the analyst or range Commander to compute fatality risks under other circumstances.

3 Planned debris releases includes intercept debris, jettisons stages, nozzle covers, fairings, inter-stage hardware, etc.

4-54.2.3 Annual Risks and Per Mission Risks . Annual risk acceptability criteria serve an important role in the implementation of a robust risk management system. First, a range should periodically conduct a formal review to ensure that its activities in recent years and its mission risk acceptability policy are consistent with its annual risk acceptability criteria. This review is intended to ensure that the level of activity at a range, and the risks accepted on a per mission basis, do not equate to inordinate annual risks. Specifically, if this review finds that the sum of the mission risks accepted annually on average, for the past or the future, exceeds the annual risk criteria in this standard, then the range should revise its mission risk acceptability policy to ensure that the annual risk in the foreseeable future comply with the criteria presented here.

This standard contains primary risk management criteria on a per mission basis for several reasons. First, the range Commander’s decision to authorize a flight is typically made in consideration of the safety and importance of a mission. Since the goal of risk management is to facilitate fully informed decisions, the risk acceptability criteria should be directly correlated to the risk acceptance decision. In some cases, it may be difficult to estimate the risk from a single mission since it may be difficult to delineate what constitutes a single mission. Therefore, this standard also endorses the use of annual risk management, in lieu of per mission risk management, in certain circumstances. Specifically, risk management using only an annual measure of collective risk is only justified for range operations that occur frequently and pose low risk on a per mission basis. In this context, “low risk” means about two orders of magnitude below the per mission criteria for collective and individual risks. For example, empirical data from a range’s past activities (where many “missions” of a similar nature have been safely executed) may be used to demonstrate that the annual risks comply with the limits prescribed in RCC 321-07, Chapter 3, and that the per “mission” risks comply with this guideline. In those cases, the risk analyst should evaluate the similarity of the empirical data by comparing the probability of any hazardous events, the magnitude of the potential hazards presented, and the exposure to any hazardous events.

4.2.4 Defining “Per Mission .” This standard presents criteria for acceptable risks on a “per mission” basis. The RCC intends for the standard risk acceptability criteria to apply to the entire mission, unless special conditions exist, as defined in these guidelines, where separate risk budgets can be applied to distinct phases of flight. In general, orbital missions have three distinct phases of flight. These phases are flight from Earth to orbit, sustained flight on orbit for an indefinite period, and return flight from orbit to the Earth. There are precedents in federal law for establishing launch risk criteria that apply strictly to the risk from flight 4 for an ELV and

RLV 5 mission. The RCC intends for the standard criteria to be implemented in a manner consistent with these precedents, except when pa st precedent is in direct conflict with these guidelines. For example, the FAA’s current regulation sets limits on the risk that “commences

4 In 1999,the FAA has promulgated limits on ELV “acceptable flight risk through orbital insertion.” (See 14 CFR 415.35(a)) The FAA’s most recent regula tion to govern expendable launches allows “the flight of a launch vehicleonly if the risk associated with the total flight” satisfy certain criteria (See 14 CFR 417.107b in Docket No. FAA2000-7953).

5 14 CFR 401.5 defines Reusable launch vehicle (RLV) as “a launch vehicle that is designed to return to Earth substantially intact and therefore may be launched more than one time or that contains vehicle stages that may be recovered by a launch operator for future use in the operation of a substantia lly similar launch vehicle.” The Space

Shuttle Orbiter and SpaceShipOne are examples that meet the definition of an RLV.

4-6upon initiation of the launch phase of flight ... and concludes upon landing on Earth of the RLV,” 6 but the RCC foresees conditions, specified in paragraph 4.2.4.g , where the standard risk limits may legitimately be applied to distinct phases of flight for an RLV. Therefore, guidelines to help discern the beginning and end of flight ar e important to establish appropriate risk budgets for complex range activities. The following paragraphs present guidelines to help define “per mission,” to understand the precedents for defining distinct phases of flight within a mission, and to establish appropriate risk budgets for complex range activities.

a. ELV and Suborbital Vehicles . In some cases, the definition of the “mission,” for the current purpose, is relatively straightforward and well established in past precedents. For example, unless special circumstances exist (such as those described in paragraph 4.2.4g and paragraph 4.2.5 ), the mission of a typical 7 expendable space launch vehicle begins at liftoff and ends at orbital insertion. Therefore, the per mission risk criteria specified in RCC 321-07, Chapter 3, should be compared to the total risks posed from liftoff until orbital insertion, including the risks from all hazards due to all foreseeable malfunctions and from any planned debris releases, with the exceptions noted in paragraph 4.2.4g and paragraph 4.2.5 . Similarly, for the mission of a suborbital launch vehicle, the per mission risk criteria specified in Chapter 3 of the Standard should be compared the total risk posed from liftoff until through the impact of all pieces of the launch vehicle, including the payload. These guidelines are consistent with current practices, the direction given to range Commanders in paragraph 4.2.9.8 of DODD 3200.11, and the current federal law governing

commercial launches. 8 Even though the current practice 9 and federal regulations for ELVs only set limits on the risk from liftoff to orbital insertion, and launch risks for people on Earth or in aircraft are generally insignificant beyond orbital insertion, there are legitimate safety concerns associated with launch beyond orbital insertion, as discussed in paragraph 4.2.4e

.

b. Beginning of Flight . The plain language definition of flight is “the motion of an object in or through a medium, especially through the Earth’s atmosphere or through space.” 10 Thus, flight typically begins with the first motion of the object that poses risk. Therefore, the per mission risk criteria specified in RCC 321-07, Chapter 3, should be compared to the total risks posed by a mission starting with the first motion of the object, which is often liftoff. Paragraph 4.2.4c gives guidance on the treatment and discernment of pre-flight risks from a mission.

The use of carrier aircraft can complicat e the definition of the beginning of flight for a launch vehicle. The FAA has a regulation that proposes ...

6 See 14 CFR 431.35a

7 A typical space launch vehicle is inject ed into a pre-determined and sustainable orbit for an indefinite period of time prior to reentry or disposal.

8 See 14 CFR 415.35(a)

9 For example, see Air Force AFSPCMAN 91-710 paragraph A4.3.5.

10 See Webster’s II New Riverside University Dictionary, 1984.

4-7“For flight analysis purposes, flight begins at a time in which a launch vehicle normally or inadvertently lifts off from a launch platform. Liftoff occurs with any motion of the launch vehicle with respect to the launch platform.” 11

Recent FAA guidelines clarify that,

“the term ‘liftoff’ is often used in the context of motion with respect to a fixed asset,

such as a launch pad or sea platform, but here liftoff also includes separation from a carrier aircraft. For other types of launch platforms, the determination of liftoff will be on a case-by-case basis and may need to consider the threat to the general public before separation of the launch vehicle, such as when a balloon launching craft is

airborne.” 12

c. Beginning of the “Mission” Risks . In a sense, the “per mission” risk limits in this standard equate in practice to risk limits for each distinct flight phase of a mission, consistent with past precedents. Specifically, the RCC does not intend the standard criteria given in RCC 321-07, Chapter 3, to apply to pre-flight range activities. However, there are often significant risks posed prior to flight about which the range Commander should make informed decisions. The need for a range Commander to manage mission risks, including those posed by pre-flight hazards, means that the beginning of the “mission” or “launch” for the purposes of evaluating the overall mission safety should not always be lifto ff for a vertically launched vehicle orseparation from a carrier aircraft. Even so, the Risk Committee recommends that preflight safety decisions be based on other methods and criteria. 13

As an example, the FAA determined that the initiation of the launch phase of flight for the SpaceShipOne (i.e. the starting point for an RLV risk estimate per 14 CFR 431.35) was at ignition, subsequent to separation from the carrier aircraft (called the White Knight ). For SpaceShipOne , the FAA found that pre-flight operations posed negligible risks due to its small size and selected propellants. 14 The FAA determined that separation from the ca rrier aircraft (i.e. independent motion of the launch vehicle from the carrier aircraft) defined the point where risk from SpaceShipOne increased. However, the FAA had issued an experimental airworthiness certificate that covered the glid ing portion of flight prior to ignition. Therefore, the FAA treated the SpaceShipOne as an aircraft unless it was operated as

a suborbital rocket.

11 See 14 CFR § 417.224(c) in Federal Aviation Administration, Department of Transportation, 14 CFR Parts 401, 406, 413, 415, 417 Licensing and Safety Requirements for Launch; Final Rule , Federal Register, Vol 71, No. 165, August 25, 2006

12 See FAA’s “Guide to Probability of Failure Analysis for New Expendable Launch Vehicles, Version 1.0” November 2005, HQ-032105, accessed at http://ast.f aa.gov/files/pdf/Guide_P robability_Failure_110205.pdf

13 Pre-flight risks are typically subject to ground safe ty, system safety, and explosives safety criteria.

14 Because it uses a hybrid rocket motor and N 2 O oxidizer, there are comparatively small risks due to solid rocket motor handling and processing such as fire, explosion, debr is, or unintended motor stage flight. Nor are there any liquid propellant hazards such as t oxicity or vapor cloud explosions.

4-8FAA guidelines 12 state that “preflight anomalies exist that should be accounted for by launch risk analyses even though liftoff did not occur.” For example, an anomaly that could occur without liftoff and pose a hazard “should be accounted for by risk analyses as an on-pad failure.” 15 The RCC does not intend that the risks from any such preflight anomalies be compared to the per mission risk criteria given in Chapter 3 of the Standard.

d. Definition of Suborbital Vehicle and Trajectory . Suborbital flights of missiles and rockets are relatively well understood, however, the opening of space to commercial enterprises introduces “hybrid” vehicles. Hybrid vehicles are vehicles that have some

of the characteristics of aircraft and some of the characteristics of launch vehicles. In 2004, Congress found that opening space to the American people and to their private commercial enterprises was a worthy goal, and that the creation of a clear legal and regulatory regime for commercial human space flight would advance that goal. Those findings accompanied passage of the Commercial Space Launch Amendments Act (CSLAA) of 2004 (also known as H.R. 3752). Prior to passage of the CSLAA, the absence of definitions for the terms “suborbital rocket” and “suborbital trajectory” created confusion as to the appropriate re gulatory regime for “hybrid” vehicles. The CSLAA provided definitions for “suborbital rocket” and “suborbital trajectory:”

“Suborbital rocket means a rocket-propelled vehicle intended for flight on a suborbital trajectory whose thrust is greater than its lift for the majority of the powered portion of its flight. Suborbital trajectory means the intentional flight path of a launch vehicle, reentry vehicle, or any portion thereof, whose vacuum instantaneous impact point does not leave the surface of the Earth.”

These definitions should be used as guidelines to determine if a particular hybrid vehicle should be treated like aircraft or like a launch vehicle for the purposes of risk management. Congress recognized that hybrid vehicles with certain flight plans may be subject to dual regulation as both aircraft and launch vehicles.

e. End of “Flight .” As discussed above for a typical ELV mission, the per mission risk criteria specified in RCC 321-07, Chapter 3, should be compared to the total risk posed from liftoff until orbital insertion. Orbital insertion takes place when a launch vehicle achieves orbital state (velocity and position) or when its drag corrected instantaneous impact point leaves the earth without intending to re-establish on the Earth prior to reentry, and thrust has been discontinued. Similarly, for the flight of a suborbital launch vehicle, the per mission risk criteria specified in RCC 321-07, Chapter 3, should be compared the total risk posed from liftoff until the impact of all pieces of the launch vehicle, including the payload. These guidelines are based on current practices, and are consistent with the direction given to range Commanders in

15 Note, however, such on-pad failures without liftoff should not be included in the “flight” history of a subject vehicle for the purposes of estimating the probability of an in-flight failure.

4-9paragraph 4.2.9.8 of DODD 3200.11, and consistent with current Federal law governing commercial launches. 16

f. Safety Concerns Beyond Orbital Insertion . The Risk Committee recognizes that missions that involve vehicles, objects, or debris at altitudes above 150 km may create legitimate post orbital insertion safety concerns, just as there may be important pre-flight risks. However, there are several reasons that only the criteria in paragraph

3.5 , which address the protection of manned spacecraft, apply to the management of risks posed beyond orbital insertion: (1) Using the definition of orbital insertion adopted here, the launch risks posed beyond orbital insertion are insignificant for people on Earth or in aircraft. (2) Establishment of separate flight risk acceptability criteria that set limits on the risk from liftoff to orbital insertion is consistent with the direction provided in

DODD 3200.11 and current federal law for ELVs. (3) Ending the collective and individual risk assessment for flight of a typical ELV at orbital insertion also makes sense from a “flight termination” perspective, the exercise of positive control, and the hazards resulting from that process.

Nevertheless, the appropriate authorities must address legitimate safety concerns associated with launch beyond orbital insertion. Under the Convention on International Liability Caused by Space Objects (Liability Convention, entered into force September 1972), the U.S. Government accepts absolute liability for damage on the ground or to aircraft in flight, outside of the United States, when the United States is deemed a launching State under the terms of the Outer Space Treaties. Liability for damage caused elsewhere, such as on orbit damage, is also accepted by the Government as a launching State under the Liability Convention but only if the damage is the fault of persons for whom the launching State is responsible. Under Article VI of the Treaty on Principles Governing the Activities of States in the Exploration and Use of Outer Space, including the Moon and Other Celestial Bodies, the U.S. Government bears responsibility for national activities in outer space, including those carried on by non-governmental

entities. 17

For these reasons, the range Commander should address legitimate safety concerns associated with launch beyond orbital insertion. For example, damage involving other orbiting assets (manned or active) may still occur subsequent to orbital insertion. Without taking appropriate measures, there is a potentially serious risk from the collision of a launch vehicle or its components with other objects in space. Dangerous orbital debris might also be generated unless appropriate measures are taken after orbital insertion. The DoD has a policy that “the creation of space debris shall be minimized.” 18 Specifically, “the probability of collision with known objects during launch and orbital lifetime

16 See 14 CFR 415.35a

17 Outer Space Treaty, entered into force October 1967

18 See DODI 3100.12, Sept. 14, 2000 paragraph 6.3

4-10shall be estimated and limited in the development of the design and mission profile for spacecraft or upper stages.” 19 The following measures should be implemented to address the concerns beyond orbital insertion: (4) Prevention of unplanned physical contact between the vehicle and its

components. (5) Minimization of debris generation from the conversion of energy sources into energy that fragments the vehicle or its components. Energy sources include chemical, pressure, and kinetic energy. (6) Development of reentry procedures to ensure safety of personnel is maintained as required by international space law and consistent with mission requirements. (7) Performance of conjunction assessments and development of collision avoidance procedures to avoid contact with other spacecraft from the launch vehicle, jettisoned components and payload through a sufficient number of revolutions after orbital insertion to account for the type of orbit injected into or operating in, the altitude of the manned spacecraft, and the time until the vehicle or component can be properly catalogued. (8) Proper disposal of orbiting objects.

DODD 3100.10 directs that all DoD activities to, in, through, or from space, or aimed above the horizon with the potential to inadvertently and adversely affect satellites or humans in space, shall be conducted in a safe and responsible manner that protects space systems, their mission effectiveness, and humans in space, consistent with national security requirements. DODD 3100.10 also directs that all such activities shall be coordinated with U.S. Space Command (or its successor). 20
Clearly, the responsibility for risk management during flight phases subsequent to payload separation typically lies with the spacecraft operator, except for planned reentry missions that terminate on a test range. In the latter case, reentry risk is the responsibility of the test range conducting the reentry operation and/or the lead range initiating the launch in accordance with direction in DODD 3200.11. For these final flight phases, the range Commander should coordinate with the spacecraft operator and Air Force Space Command (AFSC), 1 st Space Control Squadron (SPCS), to ensure that safety issues beyond orbital insertion are addressed to the extent necessary to reduce the U.S. Government’s absolute liability under international

treaties.

DODI 3100.12 sets limits on the risk from disposal of a spacecraft or an upper stage at the end of mission life. DODI 3100.12 specifically requires programs involving on orbit operations plan to dispose of a spacecraft or upper stage using atmospheric reentry, maneuvering to an appropriate storage orbit, or direct retrieval (See paragraph 6.4). Atmospheric reentry is only allowed if atmospheric drag will limit the lifetime to no longer than 25 y ears after completion of mission. If atmospheric reentry is used, “either the risk of injury from the total debris casualty

19 See DODI 3100.12 paragraph 6.3.3

20 DODI 3100.10, July 9, 1999, paragraph 4.11.7 states that these activities sh all be coordinated with U.S. Space Command (succeeded by AF Space Command), as appropriate, for predictive avoidance or de-confliction with U.S., friendly, and othe r space operations.

4-11area for components and structural fragments surviving reentry shall not exceed 1 in 10,000 (based upon an evenly distributed human population density across the Earth), or it shall be confined to a broad ocean or essentially unpopulated area.” 21

However, the criteria in Chapter 3 of the Standard that apply beyond orbital insertion are concerned with the protection of manned spacecraft from collision with those injected vehicles, objects, or debris. This can be accomplished by delaying initiation of the launch mission or defining avoidance volumes as described in paragraph 4.5 . Paragraph 4.5 provides specific guidance for the range Commander to implement the spacecraft protection criteria presented in RCC 321-07, Chapter 3.

g. End of Flight Involving Reentry . Using the plain language definition of “flight,” a flight involving reentry ends when the ve hicle discontinues motion through “Earth’s atmosphere or through space.” 22 As previously mentioned, the RCC intends for the standard risk acceptability criteria to apply to the entire flight of a mission, unless there are distinct phases of flight or other special conditions as defined in these guidelines. However, there often may be decision points between distinct phases of flight for an RLV that meet the conditions specified in paragraph 4.2.4h

.

A current Federal regulation states that, for an orbital RLV flight, but not the mission, “ends after deployment of a payload for an RLV having payload deployment as a mission objective.” However the same regulation states that, “for other orbital RLVs, flight ends upon completion of the firs t sustained, steady-state orbit of an RLV at its intended location.” Statutory mandates have strongly influenced the FAA’s decision to make a “regulatory distinction” between the end of the flight of an ELV and RLV. Using the end of flight definition for an ELV 23 was not considered appropriate for an RLV because doing so would suggest that launch continues through vehicle reentry and landing. This would have been illogical in light of direction from Congress that reentry of an RLV is subject to, and in fact requires, a separate reentry license by the FAA. Instead, the FAA proposed to use payload deployment as the point to end the flight of an RLV, and thus end the launch phase of an RLV mission. Therefore, the current FAA regulations hold that reentry 24
commences upon initiation of operations necessary to assure reentry readiness and safety, that are uniquely associated with reentry and that are critical to ensuring public health and safety and the safety of property during reentry. Even so, the FAA’s current regulation limits the total risk from an RLV mission that “commences upon initiation of the launch phase of flight ... and concludes upon landing on Earth

of the RLV.” 25

21 See DODI 3100.12 paragraph 6.4.1

22 See Webster’s II New Riverside University Dictionary, 1984.

23 14 CFR 401.5: “For purposes of an ELV launch, flight ends after the licensee’s last exercise of control over its

launch vehicle.”

24 In plain language, reentry is defined as the event occu rring when a spacecraft or other object comes back into the sensible atmosphere after going to higher altitudes, or the ac tions involved in this event. A regulatory definition is given in 14 CFR 401.5 and sited below.

25 See 14 CFR 431.35a

4-12For SpaceShipOne , the FAA determined that the end of flight (i.e. the ending point for an RLV risk estimate) corresponded to the point of the last motion of the

launch vehicle. This was because the FAA determined that SpaceShipOne no longer posed any hazards after landing. The FAA found that ending the risk assessment for SpaceShipOne at any earlier point (such as an altitude of 60,000 feet when it resumed gliding flight) was not appropriate. At any earlier point, SpaceShipOne was still flying, and it had been exposed to “unique” space launch environments (i.e., accelerations, reentry loading, and thermal heating of vehicle). The fact that it may have resumed “gliding flight” does not necessarily mean that it has returned to a flight-proven (i.e. inherently safe) glider configuration.

h. Separate Risk Budgets for Distinct Flight Phases . This paragraph provides guidelines for circumstances where the per mission risk criteria specified in RCC 321-07, Chapter 3, may be applied separately to distinct phases of flight. In all cases, the risk acceptance decision-maker (e.g. the range Commander) should be presented with the best estimate of the total risk that accounts for all phases of an operation. If applicable, the risk acceptance decision-maker should also be presented with the best estimate of the risk by phase of flight, such as launch to orbit, on orbit, and entry

risks.

The per mission risk criteria specified in RCC 321-07, Chapter 3, should be compared to the total risk posed by an operation (i.e. the aggregated risk from all phases of an operation) unless there is a decision point between distinct phases where all of the following conditions are satisfied: (1) The vehicle has sufficient controllability to allow operational options that could reduce the risk posed by a subsequent phase (or phases) significantly. (2) The decisions as to whether or how to proceed with a subsequent phase is based on a risk assessment that is conducted or validated just prior to each phase of flight. 26
(3) The risk assessment for subsequent phases is made or validated using updated vehicle status and updated predictions of flight conditions.

Examples of how these three decision conditions should be evaluated are discussed below. If there is a decision point between distinct phases where these three conditions are satisfied, then the risk acceptance decision maker compare the per mission risk criteria specified in RCC 321-07, Chapter 3, independently for each phase of flight separated by such a decision point. As a secondary consideration, the risk acceptance decision-maker should examine whether the operational options would result in distinctly different population groups being hazarded. If the operational options would result in distinctly different population groups being hazarded, then there is additional justification to apply the per mission risk criteria

26 A risk assessment completed earlier may be sufficient if conditions during subsequent flight remain consistent with the assumptions made for the earlier risk assessment.

4-13specified in RCC 321-07, Chapter 3, independently to the distinct phases of the operation that meet the three decision conditions.

The Space Shuttle (or more formally the Space Transportation System, STS) launch service to the International Space Station (ISS) is an illustrative example of how the three (and a half, if consideration is given to distinctly different population groups being hazarded) decision conditions should be used. A STS operation to service the ISS includes at least three phases: from liftoff until orbital insertion; on orbit; and return from orbit to landing. In general, four risk estimates (relevant to this discussion) are made for a STS operation: the risks to people in the launch area; the risks to people from Eurasian over-flight prior to orbital insertion; the risks from orbital debris during on orbit operations; and the risks to people from reentry. 27

The three decision conditions indicate that the risks from an STS operation from liftoff through orbital insertion should comply with the per mission risk criteria specified in RCC 321-07, Chapter 3, because there is no decision point between liftoff and the commencement of Eurasian over-flight that would satisfy conditions at paragraph 4.2.4h (2) and paragraph 4.2.4h (3) above. Specifically, the decision to proceed with Eurasian over-flight (from a public safety perspective) is based on a risk assessment that is conducted or validated just prior to liftoff, not just prior to the beginning of Eurasian over-flight. Also, the risk assessment for Eurasian over-flight is not made nor validated using updated vehicle status and updated predictions of flight conditions (i.e. those conditions known to exist after liftoff and prior to the commencement of Eurasian over-flight). The STS has some capability to abort its mission prior to orbital insertion, and return either to the launch site or to alternative emergency landing sites. However, the decisions made during any such aborted STS are driven entirely by concerns for the safety of the crew, and are entirely independent of the risk criteria defined in RCC 321-07, Chapter 3, (for the public or otherwise).

Reentry of the STS Orbiter is a decision point that satisfies the three (and a half)

decision conditions. The first condition is satisfied because the Orbiter can return from orbit, under normal conditions, to various landing sites. 28 The Orbiter’s ability to approach each landing site using distinctly different trajectories also satisfies the

first condition. 29 The condition of the Orbiter prior to reentry is evaluated based on

27 14 CFR 401.5 defines reenter; reentry as “to return or attempt to return, purposefully, a reentry vehicle and its payload, if any, from Earth orbit or from outer space to Earth. The term ‘‘reenter; reentry’’ includes activities conducted in Earth orbit or outer space to determine reentry readiness and that are critical to ensuring public health and safety and the safety of property during reentry fli ght. The term ‘‘reenter; reentry’’ also includes activities conducted on the ground after vehicle landing on Earth to ensure the reentry vehicle does not pose a threat to public health and safety or the safety of property.”

28 The STS Orbiter has KSC as its primary landing site, with Edwards Air Force Base and White Sands Missile Range as back-up.

29 Not only can the Orbiter land using an ascending of de scending node (approaching the landing site generally from the South or North), but the Orbiter’s cross range capability also facilitates the choice to land with distinctly different trajectories.

4-14post orbital insertion conditions, such as on orbit inspections. 30 The second and third conditions are satisfied because NASA decides how to proceed with reentry (i.e., which landing site and trajectory to use) based on risk assessments, including public risk assessments, which are conducted just prior to reentry based on updated vehicle status and flight condition predictions.

The proposed launch of the Kistler K-1 is another illustrative example of how the three (and a half) decision conditions should be implemented. Kistler proposed to launch the K-1 from the Eastern Range. Sin ce the K-1 had not flown previously, it is difficult to be as definitive, but the following discussion is based on the best available information. The K-1 is designed as a two-stage to orbit vehicle, where both stages return to the launch site. The first stage is referred to as the Launch Assist Platform (LAP), and the second stage as the Orbital Vehicle (OV). The planned mission profile would include three phases. These phases include the LAP returning to the launch site (approaching from the East), the OV over-flight of Eurasia or Africa, and the OV return from orbit to the launch site (approaching from the West). Therefore, the risk acceptance decision-maker should consider risk estimates from liftoff through separation of the LAP from the OV, LAP f light from separation through its landing, OV over-flight from separation through orbita l insertion and OV reentry. At this time, it appears that the entire mission is pre-programmed such that no decisions are made during the operation. Therefore, the decision to initiate the K-1 flight equates to the decision to accept the risk from the entire K-1 mission from liftoff through the end of reentry for the OV, unless there are options that may be exercised that could change the risk after the decision to initiate flight. Therefore, the total risks from proposed K-1 mission should be compared to the per mission risk criteria specified in Chapter 3 of the Standard.

4.2.5 Separate Risk Budgets for Multiple Launches . This paragraph provides guidelines for circumstances where the per mission risk criteria specified in RCC 321-07, Chapter 3, may be applied separately to multiple flights. In all cases, the risk acceptance decision-maker for the lead range (e.g. the range Commander) should be presented with the best estimate of the total risk that accounts for all aspects of an activity the range is involved with, including multiple flights from different locations. The risk accep tance decision-maker should also be presented

with the best estimate of the risks due to each flight, broken down by phase of flight if applicable. In all cases, the mission rules should clearly define the conditions necessary for each launch to proceed in the most comprehensive manner possible.

30 For example, NASA inspects the Orbiter to confirm th at the Thermal Protection Sy stem (TPS) has not been compromised due to debris impacts during ascent, such as the foam impact that le d to the Columbia accident.

4-15The per mission risk criteria specified in RCC 321-07, Chapter 3, should be compared to the total risk posed by an operation (i.e. the aggregated risk from all flight phases of an operation) unless there is a decision point between each flight where the following separate flight phase test is satisfied:

a. The initiation of each flight has sufficient controllability to allow operational options that could reduce the risk posed by a flight significantly, AND

b. The decisions as to whether or how to initiate a subsequent flight is based on a risk assessment that is conducted or validated just prior to each flight, AND

c. The risk assessment for each subsequent flight is made or validated using updated vehicle status and updated predictions of flight conditions, AND

d. The decision to initiate any subsequent flight is made with the knowledge that there is no current risk from the previous flight(s), OR

e. The probability of failure, and other critical input data, for the risk estimate of the subsequent flight accounts for the failure of the previous flight(s).

Note that the separate flight phase test is passed if the first four conditions are passed, or if the first three and the fifth condition are passed: not all five conditions need to be satisfied.

The Short Term Interval Launch (STIL) operations conducted from Vandenberg AFB illustrate how the separate flight phase test should be evaluated. The STIL range activity

involves two Minuteman III vehicles launched within about two hours of each other. Each vehicle is launched from a separate facility on the northern part of VAFB, and is targeted for the same general area. Complete risk analyses are done for both vehicles prior to the first launch using the latest vehicle status and predicted flight conditions. The risk estimates for the second launch are updated after the first launch using the latest vehicle status and predicted flight conditions. The “per mission” risk criteria specified in RCC 321-07, Chapter 3, should be compared to the total risk posed by each STIL launch because four of the above five decision conditions are satisfied. The first and second launches are independently initiated: the second launch could be held if the first launch fails. Holding the second launch is an operational option that could reduce the risk posed by a flight significantly. Therefore, the first condition is met. The decision to initiate the second flight is based on a risk assessment that is conducted or validated just prior to each flight, so the second condition is met. The risk assessment for the second flight is made or validated using updated vehicle status and updated predictions of flight conditions, so the third condition is met. The decision to initiate the second flight is made with the knowledge that there is no current risk from the previous flight, so the fourth condition is met. If the first launch was a failure, the risk assessment for the second flight would account for failure of the first (in terms of probability of failure, etc.), so the fifth condition is also met. As a secondary consideration, if the subsequent launch would result in distinctly different population groups being hazarded, then there is additional justification to apply the per mission risk criteria specified in RCC 321-07, Chapter 3, independently to the subsequent launch.

WSMR does “ripple fire” tests where two missiles are in thrust controlled flight at the same time, under a single risk budget. However, if thrust and substantial control are complete for a flight (such that the instantaneous impact point (IIP) cannot change significantly), any subsequent missile launch gets a separate risk budget because the outcome of the first launch is

4-16known from a safety perspective. These “shoot l ook shoot” and “ripple fire” approaches to risk management are consistent with these guidelines.

A typical “salvo” mission where two vehicles are launched from the same range nearly simultaneously would not satisfy the separate fli ght phase test. A typical salvo mission does not allow separate decisions between launches that would reduce the total risk from the mission. Also, risks cannot be re-evaluated using updated conditions between launches for a typical salvo mission. Therefore, the total risk from all la unches involved in a typical salvo mission should be compared to the per mission criteria specified in RCC 321-07, Chapter 3.

4.3 Catastrophic Risk Evaluation

This standard recommends catastrophic risk aversion to protect against incidents involving multiple casualties, for example loss of a bus, ship, or aircraft. Catastrophic risk assessments are especially useful for pre-flight analyses intended to evaluate and mitigate potentially catastrophic outcomes. RCC 321-07, Chapter 3, establishes provisional and advisory catastrophic risk limits for the general public defined by the following formula.

(Eqn 4-3) -4 1.5 10NP

≤×

where

P is the cumulative probability of all events capable of causing N or more casualties.

N is number of casualties 31 based on the occupant load as defined in

Table 3-1 of the Standard.

10 -4 is the maximum acceptable E C as defined in paragraph 3.2.1.2 of the

Standard.

Consider again the hypothetical example presented in paragraph 4.1.2b . Figure 4-2 compares the risk profile computed for this example and the catastrophic risk criteria established in this standard for the general public. The fact that the example launch risk profile has points above the acceptable risk profile (the straight line) indicates that this example launch presents an excessive catastrophic risk.

31 OSHA promulgated a formal definiti on of catastrophe in 29 CFR 1960.2: “An accident resulting in five or more agency and/or non-agency people being hospitalized for inpatient care.” Santa Barbara County, CA uses a minimum number of 10 people to define a catastrophe.

4-171.E-07 1.E-06 1.E-05 1.E-04

1 1 0

N - Number of CasualtiesP[>=N]

1 0 0

Figure 4-2. Example risk profile compared with the general public catastrophic

risk criteria.

Due to the limited number of scenarios that can produce casualties in this example, computation of the risk profile is straightforward. However, computing the risk profile for actual flights often requires a considerable effort. Th erefore, the Risk Committee devised a simplified and conservative method to screen for excessive catastrophic risk for transportation systems only, which are typically the only significant sour ces of potentially excessive catastrophic risks. Basically, the catastrophic risk screening method entails replacing the number of casualties contributed by the occupant load of each transportation system from each failure scenario, N

, everywhere in an otherwise standard E C computation with N 1.5 . Specifically, the catastrophic risk averse pseudo-E C for transportation systems may be computed using a standard E C computation but replacing the number of casualties contributed by each transportation system from each failure scenario, N , which equals the occupancy load for a transportation system as given in Table 3-1 of the Standard, with N 1.5 . If the resulting catastrophic risk averse pseudo-E C is less than 1×10 -4 for the general public, then the catastrophic risk is generally acceptable. 32 If the catastrophic risk averse pseudo-E C is greater than 1×10 -4 for the general public, then a risk profile should be computed to determine if the catastrophic risk complies with the standard

criteria.

32 There are exceptions, involving cases where a scenario threat ens multiple transportation systems (such as two aircraft), where the pseudo-E C is not a conservative indicator of the catastrophe potential.

4-18In general, a risk profile can be computed based on a complete set of credible and mutually exclusive scenarios, where each scenario has a finite probability and a consequence in terms of casualties. A formal definition of “scenario” is provided in Chapter 7 of this Supplement. Based on a complete set of scenarios, a histogram can be generated where the abscissa is the number of casualties ( N

) and the ordinate is the probability of N casualties. The risk profile is a complementary cumulative probability distribution diagram that can be computed based on this histogram, which gives the total probability of at least N casualties for each value of N. The ordinate of the resulting risk profile is the probability of N or more

casualties.

Even without computation of a complete risk profile, the catastrophe aversion criteria may be used to identify individual scenarios or failure modes that present elevated catastrophe potential and practical mitigations. For example, the analyst could show that a malfunction turn during a particular period of flight combined with the absence of a flight termination system on a vehicle, or the presence of a large concentration of spectators in a particular location, corresponds to a point above the solid line shown in Figure 4-2 . Any single scenario that corresponds to a point above the solid line shown in Figure 4-2 conclusively demonstrates that the launch exceeds the recommended catastrophe aversion criteria.

4.4 Hazard Areas for Ships and Aircraft

This paragraph provides guidelines for proper implementation of the requirements regarding ship and aircraft hazard regions:

a. For planned debris releases.

b. In response to a mishap.

c. Based on probability of impact limits, and

d. That demonstrate compliance with the individual, collective, and catastrophic risk

limits.

4.4.1 Planned Debris Impacts . This paragraph provides guidance to facilitate proper implementation of the requirement given in paragraph 3.3.3 of the Standard:

“The range must confirm that Notices to Airmen are issued that encompass the volume

and duration necessary to protect from each planned debris release capable of causing

an aircraft accident.”

Planned debris releases include any solid object planned to fall uncontrolled through the navigable airspace as the result of a range activity, such as intercept debris, jettisoned stages, nozzle covers, fairings, and inter-stage hardware. In order to satisfy the requirement in paragraph 3.3.3 of the 321-07 Standard , a range must confirm that Notices to Airmen (NOTAMs) are issued for each area hazarded by a planned debris release capable of causing an

4-19aircraft accident. To determine if a planned debris release is “capable of causing an aircraft accident,” a range should:

a. Use the aircraft vulnerability models for commercial aircraft or hazard threshold for other aircraft presented in Chapter 6 of this Supplement, or

b. Use other valid 33 methods to evaluate debris impacts capable of causing an “aircraft

accident” as defined in 49 CFR 830.2.

To determine the “volume and duration necessary to protect from each planned debris release” a range should:

c. Define a finite region(s) and demonstrate compliance with paragraph 3.3.1.1 of the

Standard for non-mission aircraft and 3.3.2.1 of the Standard for mission aircraft, or

d. If the area is under active surveillance and air traffic control, and there is no region that exceeds the probability of impact levels specified in 3.3.1.1 for non-mission aircraft and 3.3.2.1 for mission aircraft, then the planned impact hazard volume and duration should encompass the two sigma impact dispersion area 34 from the ground level up to an altitude of 60,000 feet. 35

e. If the area is not under active surveillance and air traffic control, and there is noregion that exceeds the probability of impact levels specified in 3.3.1.1 for nonmission aircraft and 3.3.2.1 for mission aircraft, then the planned impact hazard volume and duration should encompass the three sigma impact dispersion area 36 from the ground level up to an altitude of 60,000 feet.

In order to satisfy the requirement in paragraph 3.4.3 of the 321-07 Standard, a range must confirm that Notices To Mariners (NOTMARs) “are issued that encompass the area and duration necessary to protect from each planned debris impact capable of causing a ship accident.” To determine if a planned debris release is “capable of causing a ship accident,” a range should:

f. Use the ship hazard threshold presented in Chapter 6 of this Supplement, or

g. Use other valid methods to evaluate debris impacts capable of causing a “ship

accident.” 37

This standard refers to a planned debris release as “capable of causing an ship accident,” which is a more precise term compared to those used for debris generated by unplanned events, because planned debris characteristics are often relatively well known.

33 i.e. methods that comply with the guidelines specified in this Supplement, which may include aircraft specific models that account for the known trajectories of aircraft

34 i.e. 95 percent confidence of containment of the planne d debris impacts capable of causing an aircraft accident

35 60,000 feet, used here, is typically the maxi mum altitude under active control by the FAA.

36 i.e. 99.7 percent confidence of containment of the planne d debris impacts capable of causing an aircraft accident

37 Based on safety concerns and the de finition in 33 CFR 173-4, “ship accident” is defined here as any event that results in loss of life, personal injury which requires medical treatment beyond first aid, or complete loss of the

vessel.

4-20To determine the “area and duration necessary to protect from each planned debris release” a range should consider:

h. Defining a finite region(s) and demonstrate compliance with paragraph 3.4.1.1 of the Standard for non-mission ships and 3.4.2.1 for mission ships, or

i. If there is no region that exceeds the probability of impact levels specified in paragraph 3.3.1.1 for non-mission aircraft and paragraph 3.3.2.1 for mission aircraft, then the planned impact hazard area and duration should encompass the three sigma impact dispersion area. 38

4.4.2 Mishap Response Hazard Areas for Aircraft . This section provides guidance to facilitate proper implementation of the standard require ments given in paragraph 3.3.4 of RCC 321-07,

which states:

“The range must coordinate with the FAA to ensure timely notification of any expected air traffic hazard associated with range activities. In the event of a mishap, the range must promptly inform the FAA of the volume and duration of airspace where an aircraft hazard is predicted.”

a. Pre-flight Analyses, Timely Notification, and FAA Coordination . Pre-flight analyses and coordination with the FAA should be performed “to ensure timely notification of any expected air traffic hazard associated with range activities.” To demonstrate compliance with this requirement, a range should (at a minimum): (1) Identify the volume and duration of airspace necessary to protect from each planned debris release capable of causing an aircraft accident as described in paragraph 4.4.1

. (2) Identify all regions of airspace where debris that poses an aircraft hazard could be predicted in the event of a mishap. 39
(3) Develop and implement a standard procedure, in coordination with the FAA, to ensure timely notification of any air traffic hazards that could occur from range

activities.

Current practice at the Eastern Range (ER) provides an example of how a range can “coordinate with the FAA to ensure timely notification of any expected air traffic hazard associated with range activities.” The ER protects non-essential and mission essential aircraft from the hazards associated with expendable launch vehicle debris using a combination of exclusionary and risk analysis methods. To protect aircraft from potential launch vehicle hazards, the 45th Space Wing develops three types of

hazard areas for aircraft.

38 i.e. 99.7 percent confidence of containment of the pl anned debris impacts capable of causing an boat accident

39 Debris that poses an aircraft h azard should be defined by the range in coordination with the FAA depending on the type of aircraft in the vicinity, the debris characteristics, etc. The intention here is to provide more protection than the “debris capable of causing an accident” as a means of compensati ng for the larger uncertainties inherent in an unplanned event. Adding a substantial buffe r to any calculated hazard area is recommended.

4-21For the launch area, the 45th Space Wing defines two types of airspace. First, the range operates multiple FAA assigned special use airspaces (SUAs). The range has been assigned SUAs in the form of three Restricted Areas and two Warning Areas. When the range requests through the 45 Range Squadron (RANS) that these areas be considered “hot,” control of the airspace is transferred to the range and a NOTAM is published to that effect. Because the SUAs encompass more airspace than is needed to protect aircraft from the potential effects of a launch vehicle, the range does not necessarily hold a launch if an aircraft is within an SUA.

Within the SUAs, the range calculates the potential three-sigma dispersion (based on a conservative estimate of potential wind effects) from a launch vehicle destructing on the nominal trajectory for every point in time where the vehicle’s dispersion is wholly or partially contained within the vicinity of the launch site. The potential three-sigma dispersion is based on explosive forces acting only perpendicularly to the nominal trajector y, three-sigma monthly winds acting only perpendicularly to the nominal trajectory, and vehicle debris divided into nine classes with the smallest element considered having a ballistic coefficient of three. This calculated dispersion footprint at sea level is extended to infinity and is defined as the “Aircraft Corridor.” Due to logistical limitations for surveillance, the “Aircraft Corridor” extends downrange to the outer limit of the “hot” SUAs. A launch will be

held if an aircraft either is observed or is calculated to be in the “Aircraft Corridor” at the time of launch. Therefore, the “Aircr aft Corridor” is an absolute exclusion area

for non-mission essential aircraft.

The vicinity of the ER launch site depends on vehicle performance and the limitations of the range’s surveillance assets. The vicinity of the ER launch site bounds the first group of scheduled impacting vehicle components if they impact within the range surveillance assets’ eff ective range of between 70 and 100 nautical miles from the launch point. While the entire vicinity of the ER launch site does not have to be evacuated of aircraft, the entire vicinity of the ER launch site is under surveillance up through the launch.

Although there is no formal definition, impact locations more than 100nm downrange have been treated as “downrange impact locations.” For downrange impact locations where components or debris from a staging action impact the earth, the 45th Space Wing issues a NOTAM for each impact location in accordance with International Civil Aviation Organization (ICAO) procedures through the 45 RANS Office. The NOTAM area is requested to enclose both the three-sigma dispersion of the impacting components and a five nautical mile “buffer” added to the three-sigma dispersion envelope in the downrange, up-range, and cross-range directions. The range does not typically survey downrange impact locations, unless mission related

resources are available for other reasons.

The mission essential airborne assets that survey the launch area are protected to the one in one million probability of impact level. The 45th Space Wing calculates the probability of impact for mission essential aircraft with a reasonable level of

4-22confidence because the vulnerability area and the asset locations are known. While every effort is made to station a support aircraft outside the mission’s Impact Limit Lines (ILLs), if the aircraft must be within the ILLs, a worst-case scenario is analyzed to assess the asset’s safety. As a worst case, the analysis assumes the rocket travels directly at the aircraft’s support location. An aircraft’s support location within the ILLs may be acceptable if the aircraft is capable of reaching safety under such a

worst-case scenario.

In other situations, it may be appropriate to account for the density of air traffic and demonstrate compliance with the long term acceptable risk guidelines. For example, in areas where only a malfunction can threaten aircraft, a reasonable level of aircraft safety might be provided using statistical air traffic density data and compliance with the long term acceptable risk guidelines described in paragraph 4.4.2a

.

b. Defining Mishap Hazard Areas . Paragraph 3.3.4 of the Standard states that, “in the event of a mishap, the range must promptly inform the FAA of the volume and duration of airspace where an aircraft hazard is predicted.” In the event of a space launch malfunction, there may be enough time to activate a real-time system that would effectively mitigate the risk to aircraft by redirecting aircraft near the expected space vehicle debris hazard area before debris reaches aircraft altitudes. 40 In all cases, a range should implement the fastest available method to inform the FAA of air traffic hazards in the event of a range mishap. The RCC is aware of several acceptable methods to demonstrate overall compliance with this requirement as

described below.

A range should select the most appropriate method to define “the volume and duration of airspace where an aircraft hazard is predicted” based on the specific situation and the discretion of the range Commander. In all cases, a range Commander should implement all measures necessary to protect aircraft from unreasonable risks generated by a range mishap. This paragraph provides guidelines to help a range define: (1) “where an aircraft hazard is predicted” in the event of a mishap. (2) Reasonable risks generated by a range mishap.

40 Larson E. W .F., et al., Determination of Risk to Airc raft from Space Vehicle Debris, Proceedings of the First IAASS Symposium, Nice, France, October 2005.

4-23An approach to comply with paragraph 3.3.4 of the Standard is to implement aircraft hazard volumes based on pre-flight analyses. For example, a range may: (3) Compute “three-sigma impact dispersion” areas on the ground that provide 99.7 percent confidence of containment of the debris impacts that could be hazardous to aircraft for predefined failure times or state vectors. (4) Compute the maximum time for any debris that could be hazardous to aircraft to reach the ground for the same predefined failure times or state vectors. (5) Define an aircraft hazard volume to encompass the three-sigma impact dispersion area for each predefined failure time or state vector, inclusive of the airspace from ground level to an altitude of 60,000 ft. (6) Inform the FAA of the appropriate aircraft hazard volume and duration based on the mishap failure time or the best estimated state vector for the mishap.

Another approach to comply with paragraph 3.3.4 of the Standard is to implement aircraft hazard volumes that encompass all regions of airspace where commercial aircraft would be exposed to debris capable of causing an aircraft accident with a probability of impact exceeding 1E-7 for a single aircraft. This probability of impact calculation should account for the fact that the mishap has occurred, and assume that aircraft are present at the hazard volume boundary. Protection against potential catastrophes based on the provisional criteria should also be provided in the event of a mishap.

4.4.3 Hazard Areas for Ships and Aircraft Using Probability of Impact Limits . Three risk metrics have been defined to protect occupants of ships and aircraft; they are individual risk, collective risk, and catastrophic risk. Meeting the acceptability criteria requires a combination of hazard containment and evaluation of residual risk. The approach outlined in this paragraph is to first develop exclusion criteria (hazard areas) to protect against catastrophic risks and assure that individual risks are acceptable and then to assess the residual total collective risks to all people (unsheltered, land-based sheltered, and people in ships and aircraft) to assure compliance with the collective risk standard. Figure 4-3 provides an overview of a process for developing hazard areas. Figure 4-4 illustrates steps for evaluating the residual risk after posting warnings for the

hazard area.

The Standard provides requirements to define ship and aircraft hazard areas. For example, paragraph 3.4.1.1 of the Standard requires that “Non-mission ships will be restricted from hazard areas where the probability of impact of debris capable of causing a casualty exceeds 10E-6 (1E-5) for non-mission ships.” The ship and aircraft hazard area requirements in the Standard can be satisfied using the vulnerability thresholds given in Chapter 6 of this Supplement. Specifically, paragraph 6.3.3 of this Supplement defines vulnerability models for commercial aircraft and a hazard threshold for other aircraft for debris potentially injurious to personnel and catastrophe producing debris. Paragraph 6.3.2 of this Supplement defines ship vulnerability thresholds for debris potentially hazardous to personnel. For example, the probability of impact requirement given in paragraph 3.4.1.1 of the Standard should be satisfied based on representative ship sizes and the probability of impact computed for all debris capable of producing a casualty to an unsheltered person. In addition, paragraph 3.4.1.1 requires that “non-mission ships should also be restricted from hazard areas where the cumulative probability

4-24of impact of debris capable of causing a catastrophic accident exceeds 1E-6 for all non-mission ships.” Although no threshold is provided in this document for defining a catastrophic accident or for determining which debris is catastrophe-producing debris for ships per se, the analyst may choose to account for any reasonably expected 41 scenario that results in five or more 42 casualties as a catastrophic accident. Furthermore, in the absence of valid ship vulnerability modeling, the analyst may choose to account for debris capable of causing a catastrophic accident for ships based on any debris capable of deck penetration as described in Chapter 4 and Chapter 6 this Supplement. More specifically, an acceptable approach to satisfy the advisory catastrophic risk criteria using ship hazard areas would be to assume that catastrophe-producing debris includes all debris capable of penetrating the deck or other protective structure for a ship, i.e. debris that exceeds the thresholds given for ship in paragraph 6.3.2 of this Supplement. For example, if a ship with 100 occupants is present at the boundary of a hazard area, then any such ship should be restricted from areas where the probability of impact exceeds 1E-7 from all debris that exceeds the thresholds given in paragraph 6.3.2 . In all cases, the final hazard areas should be the union of the areas required to comply with the individual risk, collective risk, and catastrophic risk

criteria.

As shown in Figure 4-3 , a practical implementation of defining the hazard areas involves the following steps:

a. Determining the debris that has the potential for producing serious injuries to occupants of the vehicle.

b. Determining impact probability contours at the allowable individual casualty risk.

c. Determining the debris that has the potential for producing a catastrophic accident.

d. Determining impact probability contours at the allowable catastrophic risk probability.

e. Computing a preliminary hazard area as the envelope of the contours developed in step b and step d.

The preliminary hazard area should then be evaluated to assess the feasibility of controlling access to the area, as well as the feasibility and need to monitor traffic in the area. This latter evaluation will consider factors such as traffic density and distance of the preliminary hazard area to land. Surveillance regions are typically functions of need (traffic density in a hazard region) and technical feasibility of monitoring. Thus, surveillance may be limited to the vicinity of the launch site and selected downrange regions where assets are already deployed. Based on these feasibility evaluations, the hazard area boundaries may be adjusted to produce a

final hazard area.

41 In 14 CFR 440.3, the FAA defines “reasonably expected ” for the purpose of setting insurance requirements: “having a probability of occurrence on the order of no less than one in ten million” for third party losses, and “having a probability of occurrence on the order of no le ss than one in one hundred thousand” for Government property and personnel. Since these probabilities often ha ve considerable uncertainty, the analyst should use threshold probability levels ten times below the FAA valu es. For example, account fo r any scenario where the chance of ten or more public casualties is above 1E-8.

42 OSHA promulgated a formal definiti on of catastrophe in 29 CFR 1960.2: “An accident resulting in five or more agency and/or non-agency people being hospitalized for inpatient care.” Santa Barbara County, CA uses a minimum number of 10 people to define a catastrophe.

4-25Figure 4-3. Overview of process for determining P I based hazard areas.

10,000 fragments Notional

Counts

5,000 fragments

1,000 fragments Comprehensive Debris Catalog

Filter



# + Filter Debris Capable of Producing Casualty P*

cas P I =

Debris Capable of Producing Catastrophic Accident P I Contours At Criterion for Casualty (Individual risk)

P I Contours At Criterion for Catastrophic Risk P I = P* cat



# =

Figure 4-4 illustrates an exam ple evaluation of the residual risk af ter posting warnings f o r the hazard area. Even though, the dots in Figure 4-4 suggest a uniform traffic density, real traffic data usually reveals established routes. Figure 4-4 is intended to em phasize that the analyst should assess the effect of the adopted hazard area, planned m e thods of notification, access control, and surveillance on the traffic density inside the hazard area. For exam ple, the analyst

m a y choose to reduce the traffic density in areas where warnings are issued. However, without

surveillance confirm a tion, the analyst should not assum e that all traffic heeds any warning. Therefore, collective risk should be assessed for the hazard area and the regions outside the hazard area, where feasible, and com b ined with ot her m i ssion collective risks to assure that the planned m i ssion com p lies with the standard risk criteria. These results should be part of the basis for Flight Plan Approval by the range.

These results also becom e part of the basis for day of launch preparations and launchcom m it decisions. Typically, a buffer is added to the hazard area(s) to develop NOTAMs and

NOTMARs. These form al notices should be dissem i nated through the appropriate governm e nt channels to all potentially af f ected parties. On m i ssion day, traf f i c in the surveillance area should be inventoried. As feasible and necessary , com m unications with fowlers in the restricted

area should advise them the m o st expeditious way to m ove to lower hazard areas and depart the region. W h en traffic nearby the posted region is significant, the analyst should verify that the

contribution of this traffic to total m i ssion risk does not cause the collective risk to exceed

tolerable lim its published in this standard. W h en risk levels are excessive, the m i ssion should be held until they can be reduced to acceptable levels.

4-26

## Statistical Traffic Density Statistical Traffic Density

Modified for Notification



# Risk Analysis

Figure 4-4. Evaluating residual risk remaining with the defined hazard area.

4.4.4 Compliance with Individual, Collective, and Catastrophic Risk Limits . Proper implementation of the probability of impact limits for ship and aircraft hazard areas and use of the vulnerability thresholds and models in paragraph 6.3 of this Supplement, can be used to demonstrate compliance with the individual and catastrophic risk criteria established in Chapter 3 of RCC 321-07. Paragraph 3.3.1a of the St andard requires that non-mission aircraft be

“restricted 43 from hazard volumes of airspace where the cumulative probability of impact of debris capable of causing a casualty on an aircraft exceeds 0.1E-6 (1E-7).” Paragraph 6.3.3 of this Supplement defines two types of aircraft vulne rability models (i.e. fragment characteristics): casualty producing, and catastrophic. Clearly, compliance with this probability of impact requirement based on all potential casualty and catastrophe producing debris demonstrates compliance with the individual risk limits established in paragraph 3.2.1.1 (i.e. probability of casualty below 1E-6 for a single mission, and 1E-7 probability of fatality if fatality risks are computed), regardless of the number of people in potentially threatened aircraft. Consider a commercial aircraft with a maximum occupancy of 400 people. To comply with the catastrophic risk criteria given in paragraph 3.6.3 of the Standard, hazard areas should be designed to limit the probability of impact with potentially casualty producing debris to 1E-7, and limit the probability of impact with potentially catastrophi c debris to 1E-8. In such a case, the catastrophic risk averse pseudo-E C defined in paragraph 4.3 equals 8E-5, which is below 1E-4,

43 In this context restricted from means that the range will (1) ensure that appropriate warnings/restrictions are issued through the FAA, and (2) not pro ceed with the hazardous activity if the range has knowledge that any aircraft

hazard volume is violated.

4-27and thus complies with the catastrophic risk criteria. A similar analysis can demonstrate risk compliance for people in ships.

To demonstrate compliance with the collective risk criteria established in paragraph 3.2.1.2 of RCC 321-07, the analysis must account for the collective risk to people in each type of vehicle. This requires estimates of the number of vehicles exposed, probabilities of impact to exposed vehicles, and the potential consequences of an impact to exposed vehicles. For planned impact areas, the analysis should assume at least one vehicle is present continuously at the boundary of each hazard area. If the available traffic data indicates that more than one aircraft may reasonably be expected to typically occupy a hazard area (i.e. empirical traffic data indicates more than a 10 percent chance that more than one vehicle would normally transit through the hazard area throughout the time period when the mission could pose a threat), then the analysis should assume that the maximum number of vehicles reasonably expected to typically occupy a hazard area are continuously at the boundary of each hazard area. Based on these exposure levels, conservative estimates of the collective risks for people in vehicles can be made using the probability of impact levels at the boundary of each hazard area. The total collective risk estimate should assume that each casualty-producing debris impact produces one casualty, and each catastrophic impact produces a number of casualties equal to the maximum occupancy of the vehicle not associated with the mission, and equal to the actual occupancy of any vehicle related to the mission. In areas where only a malfunction can threaten aircraft, a reasonable collective risk estimate can be based on statistical traffic density data.

4.5 Spacecraft Protection

4.5.1 Definition of Manned Spacecraft . The previous RCC 321-02 standard, as well as many NASA, DoD, and FAA regulations, have differe ntiated between spacecraft capable of being manned (mannable or inhabitable) and those that are actually manned. In some cases, distinct separation criteria were applied for the different category of spacecraft and it was left to the individual range to determine appropriate categories and criteria. Therefore to clarify the language, and the purpose and intent of the terminology adopted by the authors of the original standard, the Risk Committee has redefined manned spacecraft to include both occupied spacecraft and also those objects of importance that intend to be docked to and occupied.

The Risk Committee reasoned that if objects intended to be manned were compromised while en route to a manned orbiting laboratory or space station, then human life would also be compromised when the two objects docked and access was established, or if the vital cargo to sustain life was lost or rendered inaccessible to the manned station. They were consequently afforded the same level of protection. If the previously unmanned vehicle is not intended to be occupied again after separating from the manned spacecraft, then it would no longer be considered a manned object and afforded the same level of protection as an active satellite or debris depending on its subsequent value. An exam ple of this is the Progress vehicle that should be considered manned while en route to or docked with the International Space Station (ISS), but considered only as an active satellite or debris after final separation since it will be disposed to burn up on reentry. Similarly, if a spacecraft is capable of sustaining life, but has been placed into orbit for demonstration or testing purposes but without means to dock and be boarded, then it should be categorized as an active satellite and protected to that level, if at all.

4-284.5.2 Protection Criteria . Determining the collision probability associated with a conjunction assessment against manned objects is preferable when it can be computed but it requires considerable more effort on the part of the launch range to acquire the covariance data required of the launch vehicle and its jettisoned components during the various orbits that a mission will attain. When covariance data is not practical to develop or obtain, or the quality of it is questionable, and acceptable alternative would be to determine the maximum dispersion for each flight portion of the mission in the various orbits and apply that as maximum cap on the dispersion for that portion. This will still allow collision probability to be estimated but will provide results that are more conservative than when using covariance data but will likely not be as conservative as using miss distance volumes. The use of ellipsoidal (200 km in-tract x 50 km cross-tract and radial) or spherical (200 km) mi ss distance volumes is customary when collision probability cannot be computed. As a practical matter, spherical miss distance volumes should only be used with large launch windows or at the flight analyst’s discretion.

4.5.3 Accounting for Spatial and Temporal Dispersions in CA and COLA . When performing conjunction assessments, collision probability should be encouraged and used whenever practicable since covariance or dispersion data is accounted for in the conjunction assessment and no further adjustments or screening are required in the collision avoidance process. However, when using an ellipsoidal or spherical screening volume to perform conjunction assessments, the spatial dispersions (in-track, cross-track, and radial) associated with the launch vehicle or its jettisoned components should be added to the appropriate dimension of the hard body volume attributed to the vehicle or component. The miss distance volume (ellipsoid or sphere) should be applied with respect to the manned object being protected and increased appropriately for known dispersions associated with the spacecraft. As an alternative, when either the launch vehicle or components are treated as a point mass in the conjunction assessment, the spatial dispersions should be added to the miss distance volume about the manned object. If a spherical miss distance volume is used, the largest spatial dispersion in any direction should be added to the 200 km separation distance.

As part of the collision avoidance process, the launch wait period should be equivalently adjusted to account for arrival time dispersions associated with the launch vehicle or its jettisoned components. The analyst should also consider whether the manned spacecraft has maneuvered since the time its last ephemeris was established and determine the cumulative time based on the orbital period change per revolution and the number of revolutions prior to launch and account for this arrival time dispersion in the launch wait period. For example, the ISS operates in a near circular orbit with an average altitude of 407 km (350 km to 460 km) 44 and in an inclination of 51.6°. If the ISS were to pe rform a maneuver after the epoch time, the date and time at which the Keplerian element set defining the ephemeris of its orbit was established and valid, uncertainty in the arrival time would have been introduced into a subsequent conjunction assessment using that element set. Assuming the apogee and perigee of the station spread about its average altitude, i.e. 415 km to 400 km, the orbital period change (per revolution), Δ P, or arrival time uncertainty per revolution, can be calculated and is shown in Table 4-2, where Δ R, represents the expected incremental change in the orbital radius, or altitude, of the ISS after the

44 " The International Space Station, A Guide for European Users", ESA BR-137, 1999

4-29maneuver. Thus a typical maneuver of the ISS resulting in an altitude change of 7 km would result in approximately 8.6 sec change in the orbital period and the analyst would multiply this value by the number of revolutions expected before liftoff of the launch vehicle to determine the temporal dispersion to add to the launch wait period. The values in Table 4-2 will not change appreciably for the range of operational altitudes of the ISS.

TABLE 4-2. ORBITAL PERIOD CHANGE (PER REVOLUTION) OF THE ISS

Δ R (km) 1 2 3 4 5 7 10 15 20 25

Δ P (sec) 1.23 2.46 3.69 4.92 6.15 8.61 12.30 18.45 24.59 30.74

The individual range has the responsibility to incorporate the dispersions into the CA/COLA process, but the 1 st Space Control Squadron (SPCS) should be involved in the process, when practicable, to improve the dispersion estimates. Thus the range would obtain and provide covariance data to the 1 st SPCS for conjunction assessment and the estimated collision probability. As an alternative, and part of the collision avoidance process, the range could utilize a simplified model for estimating maximum collision probability as based on actual separation distance, conjunction geometry, and maximum or capped spatial and temporal dispersions.

4.5.4 Vulnerability of Spacecraft . When debris is planned to be injected into orbit that affect manned spacecraft altitudes, the vulnerability levels and associated critical areas utilized in accompanying risk assessments should be determined from the operator of the manned asset. Vulnerability levels and critical areas were provided to the Missile Defense Agency (MDA) in 2004 for surface vulnerability area and critical cross-sectional areas for the ISS. These area data were provided in two parts; the first for the Russian Modules (Zarya, Zvezda, etc.) that are vulnerable to smaller debris and comprise a smaller area, and the more robust U.S. modules with larger vulnerable areas. For hazardous debris from 3mm to 1 cm, the ISS vulnerable area provided to MDA was 125 m 2 with a critical cross sectional area of 30 m 2 . For hazardous debris greater than or equal to 1 cm the ISS vulnerable area specified was 725 m 2 and the critical cross

sectional area is 180 m 2

. When vulnerability of a spacecraft is unknown, the Risk Committee maintains that the value stated in the previous versions of RCC 321 standard of 1mm should be used. This was based on the Eastern and Western Ranges’ understanding of the vulnerability of the Space Shuttle. This value has also been established in other USG regulatory language as the minimum debris size that most spacecraft and satellites are designed for protection. The analyst needs toconsider the special case where astronauts are expected or known to be performing extravehicular activities (EVAs) outside of their spacecraft. In this case, options for consideration are planning missions or delay launch to preclude endangering the astronauts, allowing no planned debris to enter within the miss distance volume protecting the spacecraft, or as the only remaining option, coordinating with the manned spacecraft operator regarding spacesuit vulnerability.

4-30

### CHAPTER 5

RISK CRITERIA RATIONALE

As stated in the RCC 321 Standard, Chapter 2, paragraph 2.3 (Risk Management Process), the initial goal of range risk management should be to isolate the hazards from populated areas whenever practical. This goal is consistent with the primary policy that no hazardous condition is acceptable if mission objectives can be achieved with a safer approach, methodology, or position to minimize the hazards and conduct the mission as safely as reasonably possible. When hazards cannot be cont ained or minimized to an insignificant level, then more detailed assessments must be performed to determine if the remaining risk is acceptable.

During the development of this standard, the Risk Committee sought criteria that would promote an improved ability to effectively manage risks (and thereby protect everyone), and accommodate a diverse mix of missions without compromising safety. This chapter presents the rationale behind each criterion (the information considered, and the connection between the available facts and the selection of each criteria). The purposes of this chapter are to:

a. Establish that the criteria in Chapter 3 (of the RCC 321 Standard) are reasonable and

rational.

b. Provide insight into the criteria to facilitate proper implementation.

c. Help the risk acceptance decision maker understand and balance the factors that affect mission acceptability: e.g., criticality of mission objectives, protection of life and property, the potential for high consequence mishaps, local political factors, and governing range or programmatic environmental requirements.

This chapter is structured into the following paragraphs:

Paragraph 5.1 – Rationale for Risk Metrics. Paragraph 5.2 – Criteria Rationale Overview. Paragraph 5.3 – Rational for Casualty Limits. Paragraph 5.4 – Rationale for Fatality Guideline Limits. Paragraph 5.5 – Rationale for Catastrophic Risk Criteria. Paragraph 5.6 – Rationale for Aircraft and Ship Risk Management Requirements. Paragraph 5.7 – Rationale for Spacecraft Protection Requirements. Paragraph 5.8 – Using Aviation as a Benchmark for Launch Risk. Paragraph 5.9 – References for Chapter 5.

5.1 Rationale for Risk Metrics

5.1.1 Aggregated Risk Criteria . This standard endorses risk criteria that limit the aggregated mission risk from range of activities (i.e. the total risks, which account for all hazards throughout flight). For example, RCC 321 Standard paragraph 3.2.1.2 states that the collective risk for the general public must not exceed 100E-6 (1E-4) expected casualties (E C ) for any single mission.

5-1The Risk Committee considered the fact that current practice includes both setting limits on the risks posed by separate hazards 45

, 46 and limits on the aggregated risk posed by all

hazards 47 from launches. Careful consideration was given to the pros and cons of both approaches. This standard endorses the use of aggregated risk limits for the reasons given on subparagraphs a through d below.

a. Although there have been valid reasons (Reference 5a ) given for setting limits on the risks posed by separate hazards, acceptance of higher risk levels simply because there are multiple hazards present does not appear rational to the common man. For example, a risk acceptability criteria that limits the risk posed by separate hazards (e.g. one limit for the risk from toxic releases, another limit for debris, etc) theoretically allows a system that incorporates toxic materials to pose greater risks simply because toxics are present.

b. Aggregated risk limits provide the maximum flexibility for management of risk from various hazards, although other sources of requirements may still impose limits on certain hazards (for example Immediately Dangerous to Life and Health, IDLH, for toxics as described in Chapter 8 of this Supplement). For example, a mission could be designed to eliminate the risk from certain hazards (such as toxic releases and Distant Focusing Overpressure (DFO) in orde r to comply with the aggregated risk limit 100E-6 expected casualties due to over-flight of a downrange land mass (such as Europe or Africa). However, a similar mission that included toxic and DFO hazards could pose virtually the same aggregated risk, but fail to meet limits set for the risks posed by separate hazards. Maximum flexibility is attributed to management of the total risk from a mission instead of setting separate limits for each hazard. The aggregated risk management approach treats a single hazard that presents a certain risk level the same as many hazards with the same total risk level. Aggregated risk management is the most flexible, logical, and consistent approach.

c. Aggregated risk limits provide the maximum flexibility for management of risk to various exposed populations, especially those in various transportation modes. The probability of impact limits intended to constrain the risks posed to people on-board ships or aircraft are often convenient and efficient means to define hazard areas as discussed in Chapter 4 of this Supplement. However, setting limits on the aggregated risk to all exposed populations allows, for example, more sophisticated methods that

45 AFSPCMAN 91-710 paragraph A4.3.5: “The risk associated with th e total flight to all members of the general public, excluding persons in waterborne vessels and aircraft, shall not ex ceed an expected average number of 0.00003 casualties (Ec < 30 x 10-6) from impacting inert and explosive debris, Ec < 30 x 10-6 for toxic release (exposure to rocket propellant effluent), and Ec < 30 x 10-6 for far field blast overpressure.”

46 14 CFR 415.35a for ELVs establishes 30E-6 expected casualties from debris hazards only as the level of acceptable flight risk through orbita l insertion for commercial launches. The preamble clarified that 14 CFR 415.35a was intended to limit “risk from debris, not from toxic releases or blast overpressure, which the federal launch ranges handle through other means.” (See Fe deral Register, Vol. 64, No. 76, April 21, 1999, page 19605)

47 In the preamble to 14 CFR 431.35 for RLVs, the FAA wrot e that the “Ec must also account for casualties related to secondary explosions, hazardous mate rial exposure such as toxic substa nces, and lateral debris movement following impact.” (See Federal Register, Vo l. 65, No. 182, September 19, 2000, page 56624)

5-2provide acceptable risk levels with potentially fewer restrictions on ship or air traffic. For example, this standard now allows using part of the aggregated risk budget for ship or aircraft risks as an alternative to using relatively simple and conservative probability of impact limits to define ship or aircraft hazard areas.

d. Aggregated risk limits quantify the threat from all hazards in the simplest and most logical manner because the total risk is expressed in a single value. To support a fully informed decision to authorize a mission, the decision authority should be advised of the various sources of risk, etc. However, aggregated risk limits provide the most definitive basis to consistently characterize, evaluate, and compare the risks associated with a range activity because the risk acceptability is defined by a single

value.

5.1.2 Casualty and Fatality Risk Limits . The previous versions of this standard used fatalities as the consequence metric to define acceptable risks for a variety of reasons. A 1996 survey of national ranges showed that acceptable risk has historically been expressed in terms of casualties. However, until recently the lower injury threshold for defining casualty varied widely among the ranges, and in all cases, the term included fatality. Furthermore, the previous versions of this standard applied only to inert debris hazards, where a relatively high percentage of casualties is expected to be fatalities. Thus, fatality was chosen as the measure of risk for previous versions of this standard.

In 2006, the Risk Committee developed a consensus on the definition of casualty and other issues (such as threshold values) that facilitate risk estimates based on casualty consequences, which are discussed in Chapter 6 of this Supplement. A casualty is defined here as serious injury or worse, including death, for a human. For the purposes of this standard, the Risk Committee adopted Abbreviated Injury Scale (AIS) level 3 to characterize serious injury. 48
Also, the risk acceptability criteria now apply to all launch vehicle hazards, including those from toxic releases where a relatively low percentage of casualties are expected to be fatalities.

Casualty was chosen as the primary consequence metric for this revised standard

because:

a. Casualty is consistent with current and past range practices that have produced a excellent public safety record.

b. Using a casualty criteria instead of separate criteria for fatalities and serious injuries avoids the uncertainty associated with promptness and effectiveness of medical treatment that can prevent serious injuries from becoming fatal. 49

48 Serious injuries are formally defined in U.S. law 49 CFR 830.2 for the purpose of reporting the consequences of aviation accidents. However, the FAA has accepted that “t he use of AIS level 3 or greater is appropriate for describing a medical condition sufficiently to allow mode ling of casualties for purposes of determining whether a launch satisfies the public risk criteria.” (See Federal Regi ster, Part III, Department of Transportation, Federal Aviation Administration, 14 CFR Parts 413, 415, and 417, Licensing and Safety Requirements for Launch (See

Reference 5a ).

49 Medical treatment can often save a seriously injured individual from dying, but the availability of such medical treatment is highly unpredictable.

5-3c. Casualty measures are necessary to provide a reasonable level of protection from serious injuries due to all launch vehicle hazards.

d. Serious injuries are onerous. 50

This standard endorses the use of fatality as a supplemental consequence metric for several reasons. Evaluation of both casualty and fatality risks can provide a more in-depth understanding of mission risks. Specifically, a range Commander may view missions with the same risk of casualties differently depending on the risk of fatalities. For example, a range Commander may view a mission that poses only inert debris hazards, with risks of 90E-6 expected casualties and 45E-6 expected fatalities, differently from a mission that poses only toxic release hazards, with risks of 90E-6 expected casualties and less than 0.1E-6 expected fatalities. Furthermore, some range operations might pose a very high ratio of potential fatalities to potential casualties. For example, a mission that poses risks only from very large and dense pieces of inert debris could produce virtually equal risks of casualty and fatality. In such a case, a range Commander may choose to limit the risk of fatality in addition to the risk of casualty.

5.1.3 Best Estimate Risk Limits and the Role of Uncertainty . The RCC intends for the risk criteria in Chapter 3 of the Standard to be compared to best estimate of individual and collective

risks. The use of best estimate individual and collective risk estimates is consistent with the FAA’s regulations on risks from commercial launch 51 and reentry 52 vehicles, and is the current practice at the national ranges (see footnote 45 , and footnote 46 ).

The use of “best estimates” also appears to be reasonable and rational in comparison with the Nuclear Regulatory Commission (NRC) approach : “the Commission has adopted the use of mean estimates for purposes of implementing the quantitative objectives of this safety goal policy” (Reference 5b ). The RCC recognizes, just as the NRC did, that uncertainties are inherent in risk based decision-making. It appears that the current RCC approach to risk limits and uncertainty is the same as the approach initially taken by the NRC some 20 years ago. For example, it appears that NRC references to “mean estimates” equate to the “best estimates” used in this Standard, which presently do not always completely account for all sources of uncertainty; the NRC stated that the “use of m ean estimates does not, however, resolve the need to quantify (to the extent reasonable) and understand those important uncertainties involved in...risk predictions.”

50 A DOT study on the economic impact of motor vehicle crashes in 2000 found that, “serious injury can be catastrophic to the victim’s economic well being in add ition to their physical and emotional condition.” (See Blincoe et al, DOT HS 809 446, May 2002, p.7) Furthermore, motor vehicle crash data and government cost analysis guidelines show that debilita ting injuries typically incur more economic damage than fatalities. (See Blincoe et al Table 2 and GRA Inc Report, Economic Values for FAA Investment And Regulatory Decisions, a Guide, Dec 2005)

51 14 CFR 415.35a: “Acceptable flight risk through orbital insertion for an orbital launch vehicle, and through impact for a suborbital launch vehicle, is measured in term s of the expected average num ber of casualties (Ec) to the collective members of the public exposed to debris hazards from any one launch.” See Federal Register, Vol. 64, No. 76, April 21, 1999, page 19618. See also (Reference 5g ) at 14 CFR 417.107(b).

52 14 CFR 435.31b: “Acceptable risk for a proposed mission is measured in terms of the expected average number of casualties (Ec).” See Federal Register, Vo l. 65, No. 182, September 19, 2000, page 56660

5-4The RCC recognizes that the following statements regarding uncertainties, which were published with the NRC safety goals, also apply to risk management for range activities:

a. “Uncertainties are not caused by use of quantitative methodology in decision-making but are merely highlighted through the use of the quantification process.”

b. “A number of uncertainties arise because of a direct lack of severe accident experience or knowledge of accident phenomenology along with data related to probability distributions.”

c. “Through the use of quantitative techniques important uncertainties have been and continue to be brought into better focus and may even be reduced compared to those that would remain with sole reliance on deterministic decision-making.”

d. “For this reason, sensitivity studies should be performed to determine those uncertainties most important to the probabilistic estimates. The results of sensitivity studies should be displayed showing, for ex ample, the range of variation together with the underlying science or engineering assumptions that dominate this variation.”

e. “Depending on the decision needs, the probabilistic results should also be reasonably balanced and supported through the use of deterministic arguments. In this way, judgments can be made by the decision-maker about the degree of confidence to be given to these estimates and assumptions. This is a key part of the process of determining the degree of conservatism that may be warranted for particular decisions. This defense-in-depth approach is expected to continue to ensure the protection of public health and safety.”

5.2 Criteria Rationale Overview

In establishing the standard criteria, five separate types of logic generally used were:

a. Consistency with prior range or closely related safety criteria.

b. Similar regulatory experience.

c. Comparable accident statistics and background risk levels.

d. Internal consistency.

e. Legal considerations.

The five types are summarized below, followed by the rationale for each criterion.

5.2.1 Consistency with Prior Safety Criteria . The national ranges have a 50-year history of successful protection from falling debris. This excellent safety record was achieved using criteria that have varied over time and among ranges. Therefore, a primary goal of the standard criteria is to retain the main body of existing criteria while promoting consistency among the

ranges.

5.2.2 Similar Regulatory Experience . The criteria consider similar regulatory experience of local, state, federal, and international organizations. Numerous precedents have been set by other regulatory agencies to define acceptable risk levels. These precedents vary widely in their relevance and applicability to this standard. In some cases, similar regulatory experience includes federal laws governing commercial space transportation risks.

5-55.2.3 Comparable Accident Statistics and Background Risk Levels . The standard criteria compare favorably with generic accident experience data for categories that correlate with potential range accidents. The use of accident statistics has a specific and limited purpose. The history of risk from falling rocket launch debris shows no casualties. We are comparing potential accidents from falling debris to actual accident experience in other categories, which have a much larger statistical base, to ensure that the acceptable risk levels defined here do not exceed those risk levels that have been experienced in the past.

In some cases, the standard criteria are rationalized by comparison to background risk levels. The policy objectives given in Chapter 2 of the Standard include that “the general public should not be exposed, individually or collectively, to a risk level greater than the background risk in comparable involuntary activities.” In this context, the RCC considers “comparable involuntary activities” as those where the risk arises from manmade activities that:

a. Are subject to government regulations or are otherwise controlled by a government

agency. b. Are of vital interest to the U.S. 53

c. Impose involuntary risk of serious injury or worse on the public.

Paragraph 5.3.1b and paragraph 5.6.2 elaborate on the use of background risk levels for comparable involuntary and voluntary activities, respectively, as important benchmarks for risk acceptability standards.

5.2.4 Internal Consistency . Each acceptable risk criterion is supported by rationale founded in the previous three categories, and also by their relationship with one another. Each criterion is related to the other criteria by assumptions which reflect a reasonable set of conditions at the U.S. launch ranges. Figure 5-1 shows the inter-relationships between the criteria. Specifics of these are discussed in the applicable sections.

53 In 2004, Congress identified space transportation as “inhe rently risky.” (see 49 USC Chapter 701, referred to as the Commercial Space Launch Act (CSLA), §70101 (a)(12), 12/ 2004). At the same time, Congress found that “a robust US space transportation industry is vital to the Nation's economic well- being and national security,” (CSLA §70101, which gives reference Pub. L.106-405, Sec. 2, 11/1/2000, 114 Stat. 1751). The Major Range and Test Facility Bases (MRTFBs) have long been regarded as “national assets,” and t hus vital to the interests of the US.

5-6Expected Fatalities 10000E-6 Expected Fatalities 1000E-6 Expected Casualties 30000E-6 Expected Casualties 3000E-6

Annual Probability of Manned Spacecraft Impact 1E-6 **** **** Probability of Ship Impact 100E-6 Probability of Ship Impact 10E-6 Probability of Aircraft Impact 1E-6 Probability of Aircraft Impact 0.1E-6 Expected Fatalities 300E-6 Expected Fatalities 30E-6 Individual Probability of Fatality 1E-6 Individual Probability of Fatality 0.1E-6 Expected Casualties 300E-6* Expected Casualties 100E-6 Individual Probability of Casualty 10E-6 Individual Probability of Casualty 1E-6

Per

Mission Undesired Event Max. Acceptable Undesired Event Max. Acceptable Mission Essential/Critical Operations General Public

Expected Fatalities 10000E-6 Expected Fatalities 1000E-6 Expected Casualties 30000E-6 Expected Casualties 3000E-6

Annual Probability of Manned Spacecraft Impact 1E-6 **** **** Probability of Ship Impact 100E-6 Probability of Ship Impact 10E-6 Probability of Aircraft Impact 1E-6 Probability of Aircraft Impact 0.1E-6 Expected Fatalities 300E-6 Expected Fatalities 30E-6 Individual Probability of Fatality 1E-6 Individual Probability of Fatality 0.1E-6 Expected Casualties 300E-6* Expected Casualties 100E-6 Individual Probability of Casualty 10E-6 Individual Probability of Casualty 1E-6

Per

Mission Undesired Event Max. Acceptable Undesired Event Max. Acceptable Mission Essential/Critical Operations General Public

10X

10X

10X

10X

10X 10X 3X 10X 10X

* MEP/COP Expected Casualties capped at 300E-6 to be more consistent with current range practices 3X 3X

3X same

~30/

year 300X 300X 10X

10X

10X

10X

10X 10X 3X 10X 10X

* MEP/COP Expected Casualties capped at 300E-6 to be more consistent with current range practices 3X 3X

3X same

~30/

year 300X 300X

Figure 5-1. Criteria inter-relationships.

5.2.5 Legal Considerations . The standard criteria are supported by five legal principles related to safety criteria, which are described below.

a. Reasonable Risk

. Increasingly, decision makers have encountered opposition to acceptable risk decisions based on expert judgments or on risk comparisons that may be deemed inappropriate. The courts, however, have often upheld these decisions on the basis that the decision by the federal agency was reasonable . The term

reasonable , or more commonly unreasonable , appears in several federal statutes (such as the Toxic Substances Control Act) and is used as the primary criterion in making difficult decisions. Reasonableness is undefined in these laws, leaving the regulatory agencies and courts to determine what constitutes a reasonable decision. In general, all of the commonality criteria are reasonable because they are supported by at least three of the five lines of logic.

b. De Manifestis and De Minimis

. Two levels of risk are distinguished by their Latin

names: de manifestis and de minimis

. De manifestis risk, literally a “manifest” risk of obvious concern, has its roots in the legal definition of an “obvious risk”: a risk that is instantly recognized by a person of ordinary intelligence as inherently unacceptable. De minimis risk, on the other hand, defines a level of risk that is below regulatory concern. This term stems from the legal principle, de minimis non curat

lex : “the law does not concern itself with trifles.”

In recent years, there has been a growing recognition that the perception and acceptability of risks by the general public must be considered. For example, the annual risk of an individual dying in an automobile accident in the United States has

5-7been stated as 2E-4 (Reference 5c ). This risk is widely accepted by the public because of the great benefit perceived from automobile transportation. However, for other activities, a much lower risk is typically perceived as acceptable. Thus, a single

de minimis value may not be sufficient.

c. Informed Decision

. The “informed decision” principle is used in tort claims against the U.S. Government. The Federal Tort Claims Act (FTCA) enjoins the U.S. court system from second-guessing decisions made by properly authorized government officials in determining the acceptability of operational risks. A key test under the FTCA requires that the decision-making offici al be fully advised and informed of the known risks. Failure to fully advise the decision-making authority of known risks can result in liability of the U.S. Government or its officials.

d. Rationale

. The Administrative Procedures Act (APA), specifically Section 10 of 5 U.S.C. §§ 701-706, provides the principa l statutory authority governing judicial review of actions by a regulatory agency. Under the APA, the judgment and discretion of a regulatory agency are reviewed under the “arbitrary, capricious, abuse of discretion” standard. The case law on the scope of judicial review is extensive and not easily summarized. However, using this standard, courts have upheld agency determinations that were rational, based on consideration of the relevant factors, and within the agency’s authority delegated by statute. More specifically, a court is not to overrule the agency’s judgment provided that the agency examines the relevant data

and documents a rational connection between the facts and the choices made (Reference 5d , and Reference 5e ). In essence, the agency must provide a rational explanation of its decision or be subject to injunction by a court under the “arbitrary and capricious” standard of the APA.

5.3 Rationale for Casualty Limits

Table 5-1 summarizes the casualty criteria for both the general public and mission essential/critical operations personnel. Rationale for these numbers is presented in the following

sections.

TABLE 5-1. MAXIMUM ACCEPTABLE CASUALTY RISK TO PEOPLE

Per Mission Criteria General Public Mission Essential

Individual Probability of Casualty 1E-6 10E-6
Expected Casualties 100E-6 300E-6

Annual Criteria

Expected Casualties 3000E-6 30000E-6

5-85.3.1 General Public Collective Risk Per Mission (GP: 100E-6 E C ). Lim iting the collective risk for the general public to 100E-6 (1E-4) expected casualties per m i ssion is rational and reasonable in light of the following:

a. Past RCC launch safety criteria.

b. Launch safety criteria used by other organizations.

c. Federal law governing launch and reentry risks.

d. Risks accepted for “com p arable involuntary activities.”

e. Internal consistency (correlation with other criteria).

f. Legal considerations.

5.3.2 Justification of the 100E-6 Collective Risk Standard . The following subsections describe

how the 100E-6 collective risk standard is justified from all of these perspectives.

a. Prior Saf e ty Criteria (GP: 100E-6 E C ). In 1997, the RCC established a collective risk

lim it f o r the general public equal to 30E-6 (3E-4) expected fatalities due to inert

debris for any single m i ssion. Five separate types of logic were used to establish that

criteria: (1) Consistency with prior saf e ty criteria. (2) Legal considerations. (3) Sim ilar regulatory experience. (4) Com p arable accident statistics. (5) Correlation to the other criteria.

The rationale behind that previous criterion is still valid and applicable to the current fatality risk criteria because a) the previous and current criteria use the sam e

num erical lim its for fatality risks, and b) the only difference is that updated criterion applies to all sources of hazards from range activities, not just inert debris.

Lim iting the collective risk for the general public to 100E-6 (1E-4) expected casualties per m i ssion ensures protection that is generally consistent with, or m o re conservative than, the previous lim it of 30E-6 (3E-4) expected fatalities due to inert

debris. Specif i cally, the typical ratio of f

a tality expectation to casualty expectation for the typical hazards listed in Table 5-2 indicate that the 100E-6 (1E-4) expected casualties criteria is likely to lim it a range activity m o re than the previous lim it, unless the range activity presents inert debris hazards only. For exam ple, a launch with inert and explosive debris hazards and a risk estim ate of 100E-6 (1E-4) expected casualties would typically correspond to about 25E-6 expected fatalities. Table 5-2 shows that the other hazards, such as toxic releases and DFO, typically produce even

sm aller ratios of expected fatalities to expected casualties. So the 100E-6 expected casualty lim it provides m o re protection than the 30E-6 expected f a tality lim it, particularly if toxic or DFO risks are si gnificant. Thus, the current standard for expected casualties is rational: consistent with the previous expected f a tality criteria

f r om a saf e ty perspective. This sam e ratio between the expected casualties and expected fatalities criteria for general public is carried over the m i ssion essential/critical operations personnel categories and annual criteria.

5-9TABLE 5-2. TYPICAL RATIO OF EXPECTED FATALITIES TO CASUALTIES

Hazard Scenario Range of E F / E C Large inert debris impacts 0.6 to 0.8

Explosive and inert debris impacts 0.1 to 0.8, 0.25 typical

Distant Focusing Overpressure (DFO) 0.001 to 0.03, 0.01 typical

Solid rocket propellant toxic release 0.001 typical

There are hypothetical circumstances where much larger or smaller fractions of expected casualties would be expected fatalities. For example, if building impacts are severe enough to cause collapse, the number of expected fatalities might equal the number of casualties. However, those circumstances are unusual because areas vulnerable to such severe impacts are typically designated hazard areas and evacuated. Therefore, where there is the potential for such circumstances, implementation of the supplemental fatality risk criteria, in addition to the primary casualty risk criteria, is advisable.

b. Similar Regulatory Experience (GP: 100E-6 E C ). Limiting the collective risk for the general public to 100E-6 (1E-4) expected casualties per mission is consistent with the following closely related launch safety criteria set by other organizations. The criteria are explained as follows: (1) DODI 3100.12: If atmospheric reentry is used for post mission disposal of a spacecraft or upper stage, “either the risk of injury from the total debris casualty area for components and structural fragments surviving reentry shall not exceed 1 in 10,000 (based upon an evenly distributed human population density across the Earth), or it shall be confined to a broad ocean or essentially unpopulated area.” This DoD Instruction essentially established 100E-6 expected casualties as a standard for risk acceptability from an uncontrolled reentry; NASA 54 has, and

ESA 55 is considering, the same threshold value. (2) NASA 8715.5 adopted a limit of “100E-6 expected casualties per controlled entry, applied for a combination of all hazards.” (See paragraph 3.2.4.5.c.3) (3) The Commonwealth of Australia Space Licensing and Safety Office (SLASO) established 100E-6 as “the maximum third party collective risk (the sum of casualty risks to all individuals in the general public) on a per launch basis.” 56 (4) AFSPCMAN 91-710: “The risk associated w ith the total flight to all members of the general public, excluding persons in waterborne vessels and aircraft, shall not exceed an expected average number of 0.00003 casualties (E C < 30 E-6) from

54 NASA Safety Standard NSS 1740.14: Guidelines and assessment proce dures for limiting orbital debris, August 1995, page 7-1.

55 “Update of the ESA Space Debris Mitigation Handbook,” R. Walker et al, Ref: QINETIQ/KI/SPACE/CR021539 July 2002 section 1.9.3

56 SLASO Flight Safety Analysis Code, S econd Edition, 1 July 2002, paragraph 3.1.1

5-10impacting inert and explosive debris, E C < 30E-6 for toxic release (exposure to rocket propellant effluent), and E C < 30E-6 for far field blast overpressure.” This USAF expected casualty criterion for each hazard applies to each launch from liftoff through orbital insertion, including planned impact for an orbital launch, and through final impact for a suborbital launch. Notice that the AFSPCMAN 91-710 criteria allows a theoretical maximum of 90E-6 expected casualties, excluding any risks from hazards other than toxic release, far-field overpressure (DFO), and impacting inert and explosive debris. Given the uncertainty inherent in even the most sophisticated launch risk estimate available today, there is essentially no real difference between a limit of 90E-6 or 100E-6 expected casualties. If another hazard was presented by a launch, such as from radioactive materials, then more risk might be accepted under AFSPCMAN 91-710.

Therefore, limiting the collective risk for the general public to 100E-6 (1E-4) expected casualties for any single mission is reasonable and rational compared with closely related safety criteria established by other U.S. and foreign agencies.

c. Federal Law Governing Commercial Launch . In 1999, the FAA promulgated a federal law (14 CFR 415.35a) to establish 30E-6 expected casualties from debris

hazards only as the level of acceptable flight risk through orbital insertion for commercial launches: “To obtain safety approval, an applicant shall demonstrate that the risk level associated with debris from an applicant’s proposed launch shall not exceed an expected average number of 0.00003 casualties per launch (E C < 30 E-6).” The preamble to that law clarified that the 14 CFR 415.35a was intended to limit “risk from debris, not from toxic releases or blast overpressure, which the federal launch ranges handle through other means”(Reference 5f ). 57 The preamble stated that the FAA derived that limit “from launch risk guidance employed by the Air Force at its Eastern Range, Cape Canaveral Air Station, and its Western Range, Vandenberg Air Force Base, to define acceptable risk.” In adopting this acceptable flight risk limit for debris the FAA wrote that it “believes that commercial launches should not expose the public to risk greater than normal background risk, which the FAA defined in its NPRM as those risks voluntarily accepted in the course of normal day-to-day activities.”

The RCC recognizes that it was reasonable for the FAA to limit flight risk to 30E-6 expected casualties from debris based on the information available in 1999. Indeed, the National Academy of Sciences found, “a collective risk standard (i.e., a casualty expectation, or Ec) of 30E-6 per launch for members of the general public is consistent with risk standards of many other fields in which the public is involuntarily exposed to risk, both domestically and internationally.” 58 Also, the Air Force document with range safety requirements provided information to justify 30E-6 expected casualties as a level defining acceptable launch risk without high

57 In this context the FAA refers to DFO as “blast overpressure.”

58 Finding 3-3 on page 19 of “Streamlining Space Launch Ra nge Safety,” National Academy Press, 2000, IBSN 0-

309-06931-9

5-11management review. 59 When the FAA issued 14 CFR 415.35a, it believed that the federal launch ranges were implementing safety requirements to contain any hazards

from toxic releases or DFO:

“For toxic releases and blast overpressure, the federal launch ranges implement specific safety requirements designed to keep toxic releases and the effects of blast from reaching the public. For example, if more than a given number of parts per million of a toxic release would reach people, a launch will be delayed until conditions improve. Likewise, if atmospheric effects threaten to carry overpressure impact to persons outside the federal launch site, a launch will be delayed. Because these measures achieve safety, the FAA will rely on them rather than implementing an EC analysis requirement for toxic releases and blast overpressure” (Reference 5f ).

More recently, the FAA promulgated more comprehensive risk acceptability criteria that would limit the collective risk from launch to 30E-6 expected casualties for each hazard, such as debris, distant focusing overpressure, and toxics. Specifically in 2006, the FAA issued a rule to limit the collective launch risks such that “a launch operator may initiate the flight of a launch vehicle only if the risk associated with the total flight to all members of the public, excluding persons in waterborne vessels and aircraft, does not exceed an expected average number of 0.00003 casualties (EC ≤ 30E-6) from impacting inert and impacting explosive
debris, EC ≤ 30E-6 for toxic release, and EC ≤ 30E-6 for far field blast overpressure”(Reference 5g ). This FAA collective risk criterion “for each hazard applies to each launch from liftoff through orbital insertion, including each planned impact, for an orbital launch, and through final impact for a suborbital launch.”

A recent FAA regulation to establish launch risk criteria acknowledged “that a

risk assessment that determines the total risk due to all hazards associated with a single launch would be an ideal approach.” Indeed, the FAA’s initial proposal (in October 2000) sought to “require that an aggregate of the hazards created by a particular launch not exceed an E C of 30E-6” (Reference 5a ). The FAA found that the Eastern and Western Ranges “were receptive to this approach because it supported a theoretical goal of launch risk management, which is to quantify all hazards in a single, normalized risk measure.” However, the launch industry objected to that proposal as overly restrictive. The FAA was motivated to establish a law consistent with current practice at the Eastern and Western Ranges, thus the FAA’s current regulation sets limits on ELV flight risks in a manner entirely consistent with the latest USAF requirements in AFSPCMAN 91-710.

The FAA’s latest flight risk criteria for launch allows a theoretical maximum of 90E-6 expected casualties, excluding any risks from hazards other than toxic release, far-field overpressure (DFO), and impacting inert and explosive debris (Reference 5g ). As stated before, when considering the uncertainty, there is essentially no difference between limits of 90E-6 or 100E-6 expected casualties.

59 Appendix 1D of EWR 127-1, 1997 edition

5-12Therefore, limiting the collective risk for the general public to 100E-6 (1E-4) expected casualties per mission is reasonable and rationale compared with Federal laws governing commercial launch risks. Furthermore, the underlying rationale used to establish the FAA risk limits also supports the risk criteria presented in Chapter 3 of the Standard. Specifically, a limit on the collective risk for the general public equal to 100E-6 (1E-4) expected casualties per mission: (1) Can be derived “from launch risk guidance employed by the Air Force at its Eastern Range, Cape Canaveral Air Station, and its Western Range, Vandenberg Air Force Base, to define acceptable risk,” and (2) Prevents exposing “the public to risk greater than normal background risk, which the FAA defined ... as those risks voluntarily accepted in the course of normal day-to-day activities.”

This section shows how the 100E-6 expected casualty limit can be derived from the “from launch risk guidance employed by the Air Force.” The following sections on risks accepted for comparable involuntary activities and comparable accident statistics demonstrate how the current the 100E-6 expected casualty limit meets the second condition.

d. Comparable Accident Statistics and Background Risk Levels (GP: 100E-6 E C ). Civil aviation obviously meets the three conditions considered necessary to be a “comparable involuntary activity,” explained in paragraph 5.2.3 . Congress, the RCC, the USAF, an American National Standard, and the Commonwealth of Australia identified the risk posed by conventional aircraft as a benchmark for the acceptable

risk from launch vehicles: (1) Pubic Law 81-60. In 1949, Congress enacted PL 81-60, Guided Missiles—Joint Long Range Proving Ground , which authorized the Secretary of the Air Force to establish a joint proving ground, which became the present-day Eastern Range. However, this statute only authorized the establishment of a range, and does not apply to its current operations. An observation in legislative history of PL 81-60 delineated, to a degree, how the location must be chosen: “ from a safety standpoint ( test flights of missiles) will be no more dangerous than conventional airplanes flying overhead.” This language was clearly intended to allay public fears when missile testing was in its infancy, and was not intended to set future standards. However, this legislative background language clearly suggests that the launch and flight of launch vehicles should present no greater risk to the general public than the over-flight of conventional aircraft. Although this legislative background language is not binding in any way to current decisions made by any federal agency, it does indicate that Congress found a logical connection between appropriate risk levels for range activities and conventional

aircraft. (2) EWR 127-1. The USAF relatively recently imposed requirements that explicitly linked the involuntary risk imposed on the public from launches to the risk from conventional aircraft. “To provide for the public safety, the Ranges, using a Range Safety Program, shall ensure that the launch and flight of launch vehicles and payloads present no greater risk to the general public than that imposed by

5-13the over-flight of conventional aircraft .” 60 Note that “over-flight” in this context refers to the entire flight. The most recent study that quantified the annual risk to the population near Cape Canaveral from potential in-flight aviation accidents included accidents in the cruise and maneuvering phases of flights to and from remote airports, as well as the climb, approach, and descent phases of flight to and from local airports. 61
(3) RCC 323-99, Paragraph 2 states that “A ny UAV operation or test must show a level of risk to human life no greater than that for an operation or test of a piloted

aircraft.” (4) ANSI/AIAA S-061-1998. Section 4.5: An association of space transportation professionals developed and published an “American National Standard on Commercial Launch Safety” that ties public risk to general aviation over-flight. “During the launch and flight phase of commercial space vehicle operations, the safety risk for the general public should be no more hazardous than that caused by other hazardous human activities (e.g. general aviation over-flight) .” (5) Prior to establishing regulations aimed at limiting the level of public risk associated with space launch activities, the Commonwealth of Australia funded a study to “develop a risk benchmark which can be used by the Space Licensing and Safety Office for evaluating the risk of casualties to the general public from space launch activities.” That study concluded “ that it is reasonable to use the current collective risk of injuries to the public from aviation as a basis for setting a limit to the collective risk to the public from space launch activities ” (Reference

5h ).

Clearly, the RCC is not alone in identifying aviation as a “comparable involuntary activity,” and thus a legitimate benchmark for acceptable risks from range activities. Therefore, it is rational and reasonable to establish risk limits such that range activities “will be no more dangerous than conventional airplanes flying overhead.”

60 Eastern and Western Range 127- 1, Range Safety Requirement s, 1998, see page 1-viii.

61 See footnote on page iii of Reference 5t

.

5-14Unfortunately, there are several factors that complicate the comparison of risks posed to people on the ground from aviation and the risk criteria presented in Chapter 3 of the

Standard: (6) While aviation risks can be estimated using empirical data on the number of people seriously injured or killed on the ground, the risks posed by range activities are predictions based on computational models generally fraught with more uncertainty than the empirical data on aviation risks. (7) The available empirical data on aviation risks to ground dwellers does not clearly and consistently distinguish between consequences suffered by those exposed voluntarily and involuntarily. (8) While the risks posed by aviation are due to literally millions of flights that occur all over the country, range activities are relatively infrequent and typically pose risks to a much more localized population. (9) The empirical data on aviation risks suggests that ground dweller risks are strongly dependent on proximity to an air port. However, no study is available to resolve the dependence of ground dweller risk on proximity to an airport to the extent necessary to make definitive comparisons to the risks posed by range

activities. (10) It is difficult to quantify the population exposed to risks from typical range activities or the risks posed by aviation to a comparable population.

Paragraph 5.8 (Using Aviation as a Benchmark for Launch Risk) describes how the risks posed to ground dwellers by conventional aviation can be used to help identify reasonable risk limits for range activities. Paragraph 5.8 indicates that the data and analyses of the risk imposed by the over-flight of conventional aircraft indicate that a limit for the collective risk for the general public on the order of 100E-6 (1E-4) expected casualties for any single mission is reasonable and rational.

Despite these complications, the following data and analyses of the risk imposed by the over-flight of conventional aircraft strongly suggest that a limit for the collective risk for the general public on the order of 100E-6 (1E-4) expected casualties for any single mission is reasonable and rational. Figure 5-2 outlines the analysis steps taken to

establish a rational connection between the Standard collective risk limit and the empirically estimated risk to ground dwellers near a major airport in the U.S.

Based on the data on all civil aviation accidents in the U.S. that killed people on the ground from 1964 to 1999 (Reference 5i ), it was estimated that the average risk of fatality for individuals involuntarily exposed to civil aviation accidents within five miles of top 100 airports was about 3E-8 in the year 2000. Based on the decreasing trend noted in the number of involuntarily exposed people killed on the ground by civil aviation accidents between 1964 and 1999, and the projected increases in the number of airport operations and the U.S. population, it appears that the collective risk will remain fairly constant, increasing from 3.8 expected fatalities in 2005 to 4.3 expected fatalities in 2015. Thompson et al found that the uncertainty in these projections is a less important

5-15factor than the variability due to distance from an airport. Therefore, these estimates of the risk to ground dwellers posed by U.S. civil aviation are not expected to change much over the next ten years.

Figure 5-2. Outline of logic used to compare aviation and range risks. ESTIMATE PROBABILITY OF CASUALTY (P C ) FOR AN INDIVIDUAL
GROUND DWELLER NEAR A MAJOR AIRPORT ON AN ANNUAL BASIS

ESTIMATE THE NUMBER OF INDIVIDUALS EXPOSED TO TYPICAL RANGE ACTIVITIES (N E )

ESTIMATE THE EQUIVALENT COLLECTIVE ANNUAL
RISK = P C x N E

DIVIDE BY A FACTOR OF TEN TO ALLOW FOR UNCERTAINTY
IN PREDICTED RISK FROM A RANGE ACTIVITY

DIVIDE BY THE NUMBER OF MISSIONS PER YEAR

THE RESULT IS THE MAXIMUM ALLOWABLE PER MISSION RISK TO
ENSURE THAT RANGE ACTIVITIES “WILL BE NO MORE DANGEROUS
THAN CONVENTIONAL AIRPLANES FLYING OVERHEAD.”

As discussed in paragraph 5.1.2 , the risk of fatality alone is not an optimal measure of public risk. An analysis of data acquired from the NTSB on injuries (both minor and serious as defined in 49 CFR 830.2) and fatalities for people on the ground from civil aviation accidents for the 20 year period from 1984 through 2003 (Reference 5j ), shows that aviation accidents produce an average of about two to three times as many casualties

as fatalities. As shown in Table 5-3 , the average ratio of casualties to fatalities on the ground from civil aviation accidents is 2.5; this ratio is somewhat constant over the years (the 99.97 upper bound values are based on year to year variations) and applies to general aviation (relatively small airplanes) as well as commercial airline accidents. Table 5-2 shows that this ratio is close to typical predictions made for launch accidents involving debris hazards only. Using the ratio of about three casualties to one fatality on the ground from civil aviation accidents, produces a rough estimate of 1E-7 for the average annual individual risk of casualty from civil aviation accidents for people that dwell within five miles of a top 100 airport.

5-16TABLE 5-3. RATIO OF GROUND CASUA LTIES TO GROUND FATALITIES

BASED ON 20 YEARS OF NTSB DATA FROM 1984 THROUGH 2003

Aviation Category Average 99.87 Percentile Upper Bound

All U.S. Civil (Part 91, 121 and 135) 2.5 5.4

Airlines (Part 121) 2.0 5.9

General Aviation (Part 91) 2.7 5.4

Experience with large orbital expendable launch vehicles at the federal launch ranges demonstrates that launch area risks are typically limited to approximately 300,000 people near the launch point. 62 In addition, experience with the flights of SpaceShipOne , the only suborbital reusable launch vehicle flights to date, indicates that the risks were borne by approximately 300,000 people. Of course, far fewer than 300,000 people bear the majority of the total public risk from typical launches. However, the aviation risks are also disproportionately borne by those under the dominant flight paths used for take-off and landing as well.(Reference 5k ) Multiplying the average risk of casualty for individuals involuntarily exposed to civil av iation accidents within five miles of top 100 airports in the year 2000 (i.e. 1E-7) by 300,000 people equates to a collective risk of about 0.03 casualties per year. Therefore, a collective risk of no greater than 0.03 casualties per year for the general public would meet the intent to ensure range activities are no more dangerous than the over-flight of conventional aircraft. For the same reasons, a collective risk of no greater than 0.01 fatalities per year for involuntarily exposed people would meet the intent to ensure range activities are no more dangerous than the over-flight of conventional aircraft.

While aviation risks can be estimated using empirical data on the number of people seriously injured or killed on the ground, the risks posed by range activities are predictions based on computational models, typically fraught with more uncertainty than the empirical data on aviation risks. To ensure that range activities pose a collective risk of no greater than 0.03 casualties per year (or 0.01 fatalities per year) for people involuntarily exposed, it is prudent to make a reasonable allowance for the uncertainty present in range safety risk predictions. The risk assessment process described in Chapter 2 of this Supplement takes steps to minimize this uncertainty; nevertheless, with all of the uncertainties in the modeling process and input data, any expected casualty estimate probably has, at the very least, plus or minus a one-order-of-magnitude of uncertainty. So, to make some allowance for the uncertainty inherent in range safety risk predictions, the RCC has established annual risk criteria that are approximately ten times lower than the risks estimated for aviation over-flight based on empirical data.Furthermore, all criteria have been set to the nearest factor of three (approximately onehalf order of magnitude on a logarithmic scale). Further refinement is not warranted due to the lack of precision in range safety risk predictions.

62 See Reference 5t (Table 1 on page 6 and Table 7 on page 20).

5-17The preceding analysis demonstrates that limiting the collective risks to the general public from range activities to no greater than 0.003 casualties and 0.001 fatalities per year is reasonable and rational because a representative sample of about 300,000 people that dwell within five miles of a top 100 airport in the U.S. are exposed to comparable risks. The same logic used in previous versions of this standard can be used to link these annual collective risk criteria to per mission criteria. Specifically, using an average of 30 missions per year these annual limits correspond to 100E-6 expected casualties and 30E-6 expected fatalities. Using 30 missions per year is conservative in this context because the recent history from the Eastern and Western Ranges shows closer to 15 launches per year.

More specific factors considered relevant in this analysis are documented in paragraph 5.8

.

e. Internal Consistency (GP: 100E-6 E C ). The annual and per mission collective risk limits are consistent with the each other assuming on the order of 30 missions per year. This standard sets casualty risk limits that are consistently about a factor of three higher than the fatality limits for reasons discussed in paragraph 5.3.4a

.

As described in the previous section, all criteria have been set to the nearest factor of three, which is approximately one-half order of magnitude on a logarithmic scale, and further refinement is not warranted due to the lack of precision in range safety risk predictions.

f. Legal Considerations (GP: 100E-6 E C ). The previous sections provide a rational explanation that establishes connections between the relevant facts and the collective risk limit of 100E-6 expected casualties (and 30E-6 expected fatalities) per mission for the general public. These collective risk limits appear to be reasonable in light of: (1) Past RCC launch safety criteria. (1) Launch safety criteria used by other organizations. (2) Federal law governing launch and reentry risks. (3) Risks accepted for “comparable involuntary activities.” (4) Internal consistency (correlation with other criteria).

Comparisons of the criteria in this standard to de manifestis and de minimis levels are best done on an annual risk basis, as presented in 5.4.4

.

5.3.3 General Public Individual Risk Per Mission (GP: 1E-6 P C ). Limiting the individual risk for the general public to 1E-6 probability of casualty per mission is rational and reasonable in light of the following topics which are discusse d below. These topics include launch safety criteria used by other organizations, federal law governing launch and reentry risks, risks accepted for “comparable involuntary activities,” comparable accident statistics, and legal considerations.

5-18a. Prior Safety Criteria (GP: 1E-6 P C ). Limiting the individual risk for the general public to 1E-6 probability of casualty per mission is consistent with current practice at the national ranges. Currently the majority of the ranges protect for a probability of casualty of 1E-6 on a per mission basis. Table 5-4 shows individual mission risk criteria for the general public currently used by various ranges.

TABLE 5-4. INDIVIDUAL MISSION RISK FOR THE GENERAL PUBLIC AS OF

2006

Range* Individual Probability of Casualty

Eastern Range 1E-6 Eglin AFB 1E-6 NASA – Wallops Flight Facility 1E-6

1E-7 NAWC – Point Mugu Pacific Missile Range Facility 1E-7 Reagan Test Site 1E-6 Western Range 1E-6 White Sands Missile Range 1E-6**

RCC 321-06 Standard Criterion 1E-6
* Table lists only ranges that have criteria in this category ** Probability of one or more casualties

b. Similar Regulatory Experience (GP: 1E-6 P C ). The FAA promulgated a regulation in

2000 that limits the individual risk from an RLV mission to one in a million probability of casualty for members of the public. 63 In 2006, the FAA issued a final

rule with a similar individual risk limit for ELV launches. 64 The differences between the ELV and RLV regulations regarding indivi dual risks are twofold. First, the RLV individual risk limit applies to all hazards, while the proposed ELV rule would limit the individual risk per hazard. Second, the RLV rule applies to risks from all phases of flight from liftoff through landing, while the ELV rule would apply from liftoff through orbital insertion. Thus, limiting the individual risk for the general public to 1E-6 probability of casualty per mission is reasonably consistent with FAA regulations.

63 14 CFR 431.35b: “For public risk, the risk level to an individual does not exceed .000001 per mission (or individual risk criterion of 1E-6).”

64 14 CFR 417.107b (Ref 5g ): “a launch operator may initiate flight only if the risk to any individual member of the public does not exceed a casualty expect ation (Pc) of 0.000001 per launch (Pc ≤ 1 E-6) for each hazard.”

5-19c. Comparable Accident Statistics and Background Risk Levels (GP: 1E-6 P C ). (1) Background Risk . Paragraph 5.3.1d presented data and analysis to demonstrate

that the annual risks experienced by ground dwellers near major airports are comparable to the limits set in this standard. However, the annual risk to ground dwellers near major airports are produced by many thousands of operations, and the risk to ground dwellers near a range are typically due to only a few dozen missions. Therefore, the individual risks to ground dwellers near an airport are undoubtedly extremely low on a per flight basis compared to those near a range.

There are no directly comparable involuntary activities in terms of individual risks on a per mission basis. However, for the purpose of comparing the per mission

individual risk limits set in this standard to other individual risk limits used to regulate comparable involuntary activities on an annual basis, there are reasons to believe that the same individual members of the public are typically not exposed to the maximum allowable risk from a large percentage of range activities that occur over a year. The reasons include the following:

• Wind conditions at most ranges are highly variable, so the highest public risk area typically varies greatly from one range activity to the next.

• The time of day of range activities typically varies greatly from one activity to

the next.

• Individuals are typically highly mobile in the U.S. today.

With this in mind, a rough comparison can be made between the per mission individual risk limits set in this standard (i.e. of 1E-6 probability of casualty and 1E-7 probability of fatality) and the annual individual risk limits used to govern comparable involuntary activities: land use in the vicinity of European airports and chemical installations, and the current practice of the DoD Explosive Safety Board (DDESB). European authorities have determined that, “although small compared with the risks from day to day activities, the risks to persons ‘on the ground’ from aircraft crashing on take-off and landing are comparable to those presented by large

chemical installations .” Whether a public hazard is posed by the aviation or chemical industry, the Europeans generally recognize 1E-4 as the maximum annual individual

risk of death that should be tolerated, and “1E-6 is universally considered to be broadly acceptable ” ( Reference 5l ). The British specifically regard an individual annual risk of fatality below 1E-6 as “so low that they merge into the background risks of life, and they require no action” (Reference 5k ). At least one U.S. Government agency has used the one in a million annual individual fatality risk limit:

the DDESB established 65 that the individual risk of fatality for any member of the public should be below 1E-6 on an annual basis due to the presence of an explosive storage site that needs a waiver from the DoD prescriptive standards, “until approval of risk based policy changes to DOD 6055.9-STD are incorporated.” The UK and Netherlands (NL) have policies that anyone not gaining direct benefit from an activity must be removed from areas where the annual fatality risk

65 DDESB Memorandum “Risk Based Explosives Safety Siting,” 5 December 2001, and “327 th Meeting of the DDESB,” 14 December 2004.

5-20exceeds 1E-4

. 66 Within areas where the individual risk of fatality from aviation exceeds 1E-5 per year, both the NL and UK Governments prevent any further building. The UK allows unrestricted development where the individual annual risk of fatality due to aircraft over-flight is less than 1E-5 (Reference 5l ). The NL has a more conservative approach than the UK: in areas where the individual annual risk of fatality is between 1E-5 and 1E-6 due to aircraft over-flight, the Dutch prevent future development of housing, hospitals, and/or schools, however; all existing development is permitted to remain. For land use planning around chemical installations, these governments have imposed less restrictive risk limits than those applied near airports in areas where the annual individual risks exceed 1E-5, but more restrictive requirements for risks between 1E-5 and 1E-6.

The purpose of these comparisons is to show that:

• Individual risks of fatality below 1E-6 per year have been considered “so low that they merge into the background risks of life, and they require no action.”

• An individual member of the public would have to be exposed to the maximum allowable individual risk from over a hundred range activities in a year to exceed the maximum annual risk tolerated by European governments in the vicinity of airport and chemical installations.

• Although there are some differences between the limits imposed by European governments based on the annual individual risks to the public from the aviation and chemical industries, existing developments exposed to less than 1E-5 annual individual probability of fatality generally are permitted to remain.

Keep in mind that the individual risk limits used to govern comparable involuntary activities are based on annual fatalities risks, while this standard sets limits the individual risk of casualty primarily (and fatality as a supplemental measure) on a per mission basis. However, considering the number of range activities per year, and the logic supporting the assumption that the same individual members of the public are unlikely to be exposed to the maximum allowable risk from a large percentage of range activities that occur over a year, the per mission individual risk limits set in this standard (i.e. of 1E-6 probability of casualty and 1E-7 probability of fatality) appear generally consistent with individual risk limits governing comparable involuntary activities.

The Nuclear Regulatory Commission (NRC) stated a safety goal that: “the overall mean frequency of a large release of radioactive materials to the environment from a reactor accident should be less than 1 in 1,000,000 per year of reactor operation.” Although this NRC risk criterion is on an annual basis with a different consequence, it is an example of a U.S. regulatory agency using 1E-6 as an important

benchmark. (2) Comparable Accident Statistics . Comparable accident statistics were used to generate a Universal Risk Scales (URS) based on APT Research studies. The

66 The results in Reference 5l show that the 1E-4 annual i ndividual risk of fatality cont ours are contained within the airport property for typical airports. Also see page B4.

5-21URS for Injury presents actual injury risk statistics from historical accident data and regulatory standards in a common graphical format to help communicate risk levels and assist the decision maker in establishing acceptable risks. The URS for Injury to an individual resulting from involuntary activities is shown in Figure 5-3. Note that the URS present annual risk since most accident data is given on an annualized basis. Making an assumption of 15 missions per year based on recent history from the ER and WR, per event statistics can be approximated from annual accident data some of which are summarized in

Table 5-5 . These data are presented to communicate historical risk levels, some of which are not necessarily viewed as acceptable. The data collected are for injuries that were medically attended to and caused one full day or more of restricted activity. This roughly correlates to AIS Level 2, which is a less severe injury than the AIS Level 3 adopted as the casualty measure. This more conservative measure serves as a reasonable upper bound for defining a maximum

allowable risk.

Annual Risk Actual Risk Experience Regulatory Standards



### 10 -1



### 10 -2



### 10 -3



### 10 -4



### 10 -5



### 10 -6



### 10 -7



### 10 -8 1⁄2 Severe Weather Event (Missouri – 2001-2004) 3,4 1⁄2 Non-Sexual Assault (U.S. – 2001-2004) 1,2,3 1⁄2 Violent Crime (U.S. – 2001-2004) 1,2,3 1⁄2 Cut / Pierce (U.S. – 2001-2004) 1,2,3

1⁄2 Falls (U.S. – 2001-2004) 1,2,3 1⁄2 All Causes - Black (U.S. – 2001-2004) 1,2,3

1⁄2 Dog Bite (U.S. – 2001-2004) 1,2,3

UK Department of 3⁄4

the Environment for

Serious Health Effects 23 1⁄2 Other Bite / Bee Stings (U.S. – 2001-2004) 1,2,3 1⁄2 Struck by / Against an Object (U.S. – 2001-2004) 1,2,3

Cancer Risk from Air Pollution 3⁄4 from a Single Existing Facility (AQMD) 25 Cancer Risk from Air Pollution 3⁄4 from a New Facility (AQMD) 24 1⁄2 All Causes - Males (U.S. – 2001-2004) 1,2,3 1⁄2 All Causes (U.S. – 2001-2004) 1,2,3 1⁄2 All Causes - Females

(U.S. – 2001-2004) 1,2,3

1⁄2 Severe Weather Event (U.S. – 2001-2004) 3,4

1⁄2 Severe Weather Event (Connecticut – 2001-2004) 3,4

1⁄2 International Terrorism (U.S. – 2000-2003) 3,11 1⁄2 Bathtubs and Showers (U.S. – 2002) 1,2,3 1⁄2 Ladders (U.S. – 2002) 1,2,3

1⁄2 Toilets (U.S. – 2002) 1,2,3 1⁄2 Lawn Mowers (U.S. – 2002) 1,2,3

1⁄2 Refrigerators (U.S. – 2002) 1,2,3 1⁄2 Beds (U.S. – 2002) 1,2,3 1⁄2 All Causes – White/

Non-Hispanic (U.S. – 2001-2004) 1,2,3 Annual Risk Actual Risk Experience Regulatory Standards



### 10 -1



### 10 -2



### 10 -3



### 10 -4



### 10 -5



### 10 -6



### 10 -7



### 10 -8 Annual Risk Actual Risk Experience Regulatory Standards



### 10 -1



### 10 -2



### 10 -3



### 10 -4



### 10 -5



### 10 -6



### 10 -7



### 10 -8 1⁄2 Severe Weather Event (Missouri – 2001-2004) 3,4 1⁄2 Non-Sexual Assault (U.S. – 2001-2004) 1,2,3 1⁄2 Violent Crime (U.S. – 2001-2004) 1,2,3 1⁄2 Cut / Pierce (U.S. – 2001-2004) 1,2,3

1⁄2 Falls (U.S. – 2001-2004) 1,2,3 1⁄2 All Causes - Black (U.S. – 2001-2004) 1,2,3

1⁄2 Dog Bite (U.S. – 2001-2004) 1,2,3

UK Department of 3⁄4

the Environment for

Serious Health Effects 23 1⁄2 Other Bite / Bee Stings (U.S. – 2001-2004) 1,2,3 1⁄2 Struck by / Against an Object (U.S. – 2001-2004) 1,2,3

Cancer Risk from Air Pollution 3⁄4 from a Single Existing Facility (AQMD) 25 Cancer Risk from Air Pollution 3⁄4 from a New Facility (AQMD) 24 1⁄2 All Causes - Males (U.S. – 2001-2004) 1,2,3 1⁄2 All Causes (U.S. – 2001-2004) 1,2,3 1⁄2 All Causes - Females

(U.S. – 2001-2004) 1,2,3

1⁄2 Severe Weather Event (U.S. – 2001-2004) 3,4

1⁄2 Severe Weather Event (Connecticut – 2001-2004) 3,4

1⁄2 International Terrorism (U.S. – 2000-2003) 3,11 1⁄2 Bathtubs and Showers (U.S. – 2002) 1,2,3 1⁄2 Ladders (U.S. – 2002) 1,2,3

1⁄2 Toilets (U.S. – 2002) 1,2,3 1⁄2 Lawn Mowers (U.S. – 2002) 1,2,3

1⁄2 Refrigerators (U.S. – 2002) 1,2,3 1⁄2 Beds (U.S. – 2002) 1,2,3 1⁄2 All Causes – White/

Non-Hispanic (U.S. – 2001-2004) 1,2,3

Figure 5-3. Universal Risk Scale: injuries for annual probability of injury to an individual resulting from involuntary activities.

5-22TABLE 5-5. GENERAL PUBLIC INDIVIDUAL PROBABILITY OF CASUALTY

RISK

1 Activity/Source Per Event 2 Annual 3

Unintentional Strike by/against an object 1.03E-3 1.55E-2

Motor Vehicle Occupant 6.94E-4 1.04E-2

Battle of Britain (British Civilians) 6.67E-4

--

Lawn Mowers 1.67E-5 2.51E-4

Refrigerators 6.94E-6 1.04E-4

Severe Weather Events (Missouri – worst) 3.37E-6 5.06E-5

Severe Weather Events (U.S. average) 6.43E-7 9.64E-6

Commonality Criterion per Mission 1E-6

-- 1. Data is compiled from various sources: National El ectronic Injury Surveillan ce System, Consumer Product Safety Commission, National Center for Injury Preventi on and Control, U.S. Census Bureau, and House of Commons Library. 2. With the exception of the Battle of Britain, the per event statistics are derived from annual statistics by dividing the annual values by 15 to model the assumption of 15 missions per year. 3. Risk is based on the exposed populations: Battle of Britain ~48 million, Missouri ~6 million, all others ~289

million.

d. Legal Considerations (GP: 1E-6 P C ). The previous sections provide a rational explanation that establishes connections between the relevant facts and the individual risk limit of 1E-6 probability of casualty (and 1E-7 probability of fatality) per mission for the general public. The standard individual risk limits are rationally connected to the available facts and are reasonable in light of the following conclusions from the previous sections. (1) Current practices of several of the national ranges include individual risk limits of 1E-6 probability of casualty or 1E-7 probability of fatality. (2) Federal law governing commercial RLV missions limits individual risk to 1E-6 probability of casualty for members of the public. (3) European governments treat individual risks of fatality below 1E-6 per year as “so low that they merge into the background risks of life, and they require no

action.” (4) Individual members of the public are typically unlikely to be subject to a maximum risk from a large percentage of range activities over a year. (5) An individual member of the public would have to be exposed to the maximum allowable individual risk from over a hundred range activities in a year to exceed the maximum risk tolerated by European governments on an annual basis in the vicinity of airport and chemical installations. (6) 1E-4 and 1E-6 fatalities per year have essentially been established in Europe as

maximum tolerable and broadly acceptable levels, respectively. Because individual members of the public are typically unlikely to be subject to a maximum risk from a large percentage of range activities over a year, the standard individual risk limits of 1E-6 probability of casualty and 1E-7

5-23probability of fatality per mission appear roughly between the maximum tolerable

and broadly acceptable levels, but certainly closer to the broadly acceptable

level.

5.3.4 General Public Annual Collective Risk (GPa: 0.003 E C ).

a. Prior Safety Criteria and Internal Consistency (GPa: 0.003 E C ). Previous versions of this standard established an annual collective risk criterion of 0.001 expected fatalities. That criterion was justified by: (1) Prior use at the national ranges. (2) Similar regulatory experience. (3) Comparable accident statistics. (4) Internal consistency with other criteria in the RCC 321 Standard.

As shown in Table 5-3 , NTSB data from the twenty year period from 1984 through 2003 reveals an average ratio of about three casualties to fatalities on the ground from civil aviation accidents. This ratio of casualties to fatalities for ground dwellers exposed to aircraft accidents is fairly constant over the years and applies to general aviation (relatively small airplanes) as well as commercial airline accidents. Civil aircraft and range accidents that present inert debris hazards only are reasonably expected to involve generally similar materials, gross vehicle weights, and highly variable degrees of fragmentation. Sin ce conventional aircraft accidents and typical range accidents that present inert debris hazards only are logically expected to produce a similar average ratio of casualties to fatalities for ground dwellers (i.e. close to three), an annual collective risk limit 0.003 casualties is consistent with the previously established RCC limit of 0.001 expected fatalities for inert debris only.

This is also consistent with the limits defined for the Per Mission criteria as indicated in Figure 5-1

.

The data in Table 5-2 show that a ratio of casualty expectation to fatality expectation less than three is typical for the dominant range hazards often addressed by risk management. Therefore, it is conservative to establish a limit on the annual collective risk of casualties from all range hazards that is three times higher than the previously established limit for fatalities due to inert debris only. Experience at the USAF Western Range indicates “that one hazard usually predominates as the source of risk” because “the conditions that are conducive to driving up the risk of one hazard usually render another hazard less significant” (Reference 5m ). Furthermore, the ranges can often mitigate toxic and DFO risks by various means as described in Chapter 8 of this Supplement. Therefore, an annual collective risk limit 0.003 casualties from all hazards is not unreasonably conservative relative to the previously established limit of 0.001 expected fatalities for inert debris only.

b. Similar Regulatory Experience (GPa: 0.003 E C ). Regulations typically use fatality risk metrics. Given the regulatory experience described below, and the reasonability of using a factor of three between casualty expectation and fatality expectation (as

5-24presented in paragraph 5.3.3a ), limiting the annual collective risk for the general public to 0.003 is rational and reasonable.

c. Comparable Accident Statistics and Background Risk Levels (GPa: 0.003 E C ). Civil

Aviation in the U.S. The data and analyses presented in paragraph 5.3.1c demonstrate that an annual limit of 0.003 general public casualties from range activities is reasonable and rational compared to the risk posed by aviation over-flight to a representative sample of about 300,000 people that dwell within five miles of a top 100 airport in the U.S. That conclusion was primarily supported by an analysis of empirical data that resolved ground dweller risks as a function of distance to an airport (irrespective of the distance from the dominant take-off and landing flight paths), which tends to produce an underestimate of the highest ground dweller risks near major airports. Other data and analysis of aviation related risks presented in other sections also indicate that annual limit of 0.003 general public casualties from a range’s activities is reasonable and rational.

d. Legal Considerations (GPa: 0.003 E C ). Limiting the annual collective risk for the general public to 0.003 is rational and reasonable in light of the following: (1) Past RCC launch safety criteria. (2) Similar regulatory experience. (3) Comparable accident statistics.

5.3.5 Mission Essential and Critical Operations Personnel Casualty Risk Limits . The development of the criteria for tolerable risk for mission essential and critical operations personnel (i.e. voluntarily accepted risks) started with the establishment of the tolerable risk levels for uninvolved personnel. The next step was to apply a factor to the risk acceptability for uninvolved personnel to obtain a risk tolerability level for mission essential personnel. Finally, an adjustment was made in the case of the collective risk of casualties as described below.

As discussed in paragraph 5.6.2 , people ordinarily accept a wide range of risks depending on their perception of the risks and benefits. Most importantly, people are far more tolerant of risks that are imposed on them voluntarily than risks imposed on these without any sense of benefit or consent. Applying a factor between voluntary and involuntary risks has historical precedent. Chauncey Starr’s landmark paper (Reference 5n ) concluded that people who were exposed to risk voluntarily would accept 1000 times more risk for the same benefit as those who were involuntarily exposed to the risk. Subsequently, other researchers concluded that the factor of 1000 was too high and not really constant. The risk acceptability criteria given in Chapter 3 of RCC 321-07 for related workers (i.e. mission essential personnel and critical operations personnel), who are voluntarily exposed and receive direct compensation for their involvement in range activities, are generally ten times higher than the risk acceptability for involuntarily exposed people. Using a factor of ten is consistent with current practice at the national ranges 67

, past RCC standards 68 , NASA’s range safety program requirements 69 , and the policy of foreign

67 AFSPCMAN 91-710, paragraph 3.3.3

68 RCC Standard 321-02, page 3-1.

69 NASA NPR 8715.5, paragraph 3.2.4.5

5-25governments. 70 As shown in Figure 5-1 , this factor of ten is applied to all but one of the voluntary risk criteria.

a. Voluntary Risk Criterion . The only voluntary risk criterion in this standard that is not a factor of ten higher than the corresponding criterion for the general public involves the collective risk of casualties. Specifically, the collective risk for mission essential and critical operations personnel is limited to 300E-6 expected casualties, which is only three times the corresponding criterion for the general public. The RCC chose this more conservative criterion after determining that this is consistent with past risks experienced at the national ranges.

b. Comparable Accident Statistics and Background Risk Levels . Similar to the general public category, comparable accident statistics for this category are only available on an annualized basis. With a conservative assumption of 15 missions per year, per event, statistics can be approximated from annual accident data (Table 5-6).

TABLE 5-6. MISSION ESSENTIAL INDIVIDUAL CASUALTY RISK 1

Activity/Source Per Event 2 Annual 3

Construction Workers 2.81 E-3 4.21E-2

Agricultural Workers 2.2E-3 3.29E-2

Government Workers 1.6E-3 2.40E-2

Service Workers (police, firemen, etc.) 1.18E-3 1.77E-2

Gulf War 2.01E-4

-- Machinery 6.4E-5 9.59E-4

Commonality Criterion per Mission 10E-6 --

1. Data is compiled from various sources: Bureau of Labor Statistics, National Center for Health Statistics, State Vital Statistics Departments, State Industrial Commissions, National Electronic Injury Surveillance System, Consumer Product Safety Commission, National Center for Injury Prevention and Control, U.S. Census Bureau, and U.S. Department of Veterans Affairs. 2. With the exception of the Gulf War, the per event statistics are derived from annual statistics by dividing the annual values by 15 to model the assumption of 15 missions per

year. 3. Risk is based on exposed population, which varies for each activity.

70 UK Health and Safety Executive (HSE), “Reducing Risks, Protecting People: HSE’s Decision-Making Process,” ISBN 0 7176 2151 0, first published in 2001, page 44

5-265.4 Rationale for Fatality Guideline Limits

The fatality limits are essentially unchanged 71 from RCC 321-02; however, these criteria are now a supplemental metric for the reasons discussed in paragraph 5.1.2 . The rationale documented in the RCC 321-02 Supplement Chapter 3 that is applicable to those limits is still valid and is presented below. Use of annual risk limits for individuals was determined by the Risk Committee as not being practical or feasible since it is impossible to track the whereabouts of an individual from mission to mission in order to accumulate their risk. Therefore, annual individual risk limits are no longer used. The rationale for the unused annual fatality limits is still retained here because it provided useful information and data to support the remaining

related criteria.

Table 5-7 shows the supplemental fatality criteria for both the general public and mission essential/critical operations personnel.

TABLE 5-7. MAXIMUM ACCEPTABLE FATALITY RISK TO PEOPLE

Per Mission Criteria General Public Mission Essential

Individual Probability of Fatality 0.1E-6 1E-6
Expected Fatalities 30E-6 300E-6

Annual Criteria
Expected Fatalities 1000E-6 10000E-6

5.4.1 General Public Annual Individual Risk (GPa: N/A P F ). - NO LONGER USED

a. Prior Safety Criteria (GPa: N/A P F ). The commonality criterion is comparable to historical data from the national ranges. The criterion reflects the same risk level that is used at the Eastern and Western Ranges (Table 5-8).

TABLE 5-8. INDIVIDUAL ANNUAL RISK FOR THE GENERAL PUBLIC

Range 1 Annual Probability of Casualty

Eastern Range 1E-6

Western Range 1E-6 Commonality Criterion 1E-6 (See note 2)

1. Table lists only ranges that have criteria in this category 2. Probability of Fatality

71 The Mission Essential individual probability of fatality limit was reduced from 3E-6 to 1E-6 to maintain the factor of 10 difference with the individual proba bility of fatality limit set for the public.

5-27b. Similar Regulatory Experience . (GPa: N/A P F ) (1) Federal Statutes

. Federal statutes provide numerous precedents for acceptable risk levels. These are documented in numerous technical papers. One such paper (Reference 5o ) examined risk criteria employed as part of the regulatory procedures with twelve Federal statutes promulgated by the Department of Labor (DOL), Environmental Protection Agency (EPA), and the Food and Drug Administration (FDA) (Reference 5p ). Eleven of the twelve consider individual

risk in some manner.

Individual risk is used as a criterion in two distinct ways. In some cases, such as OSHA, risk is used to trigger action by a regulatory agency. The second use targets allowable residual risk after implementation of a regulatory action. Table 5-9, "Summary of Individual Fatality Risk Criteria," presents information on a lifetime and annual basis, assuming a lifetime exposure of 70 years. The fourth column compares the debris risk standard to the risk criteria cited in the

statutes.

TABLE 5-9. SUMMARY OF INDIVIDUAL FATALITY RISK CRITERIA

Trigger Level Target Residual Level Debris Risk Affected Group (Lifetime) (Annual) (Lifetime) (Annual) (Annual)

Public 1E-6 - 1E-4 1.4E-8 - 1.4E-6 1E-7 - 1E-4 1.4E-9 - 1.4E-6 1E-6
(EPA, FDA) (EPA, FDA)

(2) Regulating Carcinogens

. A review of 132 regulatory decisions involving cancer

risks for which numerical risk estimates were available found a correlation in the levels of acceptable risk (Reference 5q ). The review focused on the decisions to regulate in relation to acceptable individual risk, population (collective) risk, and total population at risk. The risk measures used varied significantly among the 132 cases and significant differences exist among the bases for the various risk estimates. Nevertheless, this review identified consistency in the apparent de

minimis and de manifestis levels of concern underpinning the standards adopted. In the 132 cases studied, individual risks were "always" regulated when they rose above one in 12,500 (8E-5) per year and were regulated at lower risk levels when more than 10 cancers in the U.S. population per year were estimated. Individual risks were "never" regulated when they were below one in 500,000 (2E-6) annually and estimated cancers in the U.S. population remained fewer than about one in 20 years (5E-2 annual). The levels of protection provided by the debris standard are consistent with the foregoing de manifestis level. In some cases, because of the high visibility of a debris producing event, the debris standard is

more conservative than the de minimis level. (3) `British Ministry of Defense

. The British Ministry of Defense has adopted a de manifestis individual risk standard of 1E-6 per year for fatalities from operation of explosive storage facilities. For these same facilities the de minimis individual

5-28risk standard is 1E-8 per year. The United Kingdom Department of the Environment has stated that a risk of 1E-6 per year (individual risk) of serious health effects is acceptable. (4) Dutch Acceptable Risk Standards

. The acceptable risk standards used by Dutch industries for public individual fatality risk are 1E-6 per year for established nuclear power plants and chemical industries, and 1E-8 per year for future nuclear power plants. (5) Israeli Ministry of Defense

. The Israeli Ministry of Defense uses a directly comparable standard for maximum annual individual fatality risk from launch operations for the non-participating, uninformed general public is 1E-5; higher risk levels are tolerated for nonparticipating, uninformed workers in industrial

facilities.

c. Comparable Accident Statistics and Background Risk Levels (GPa: N/A P F ). An assumption was made that individuals who are not mission essential should not incur a higher risk of fatality than risk experienced by the general population at home or in public. To facilitate evaluation of the criterion for risk to other personnel, comparisons are made to two categories from the accident database. Table 5-10 shows data on accidents occurring in public and Table 5-11 shows data on accidents in the home. These comparisons show that the commonality standard maximum risk to an individual other than essential is significantly less on an annual basis than the risks from accidents occurring in the home or in public.

TABLE 5-10. FATALITIES DUE TO ACCIDENTS IN PUBLIC

Individual Probability of Fatality a Public Event

Average Annually

Falls 1.61E-05 Drowning 8.44E-06

Firearms 2.30E-06

Fires and burns 7.67E-07 Air transport 3.45E-06 Water transport 2.68E-06

Railroa d 2.30E-06 Other transport 1.15E-06 All other public b 3.84E-05

Total 7.56E-05
a. Based on total 1994 U.S. population of 260,711,000. b. Includes: medical complicati ons, excessive heat/cold, suffocation by ingestion, and poisoning, etc.

Note : Criterion for general public (Maximum) = 1.0E-6

5-29TABLE 5-11. FATALITIES DUE TO ACCIDENTS IN THE

HOME

Home Event a Individual Probability of Fatality b

Average Annually

Falls 3.26E-05 Poisoning by solids and liquids 2.45E-05 Poisoning by gases and vapors 1.92E-06

Fires and burns 1.50E-05 Suffocation-ingested object 5.37E-06

Suffocation-mechanical 2.68E-06

Firearms 3.45E-06 Drowning 3.45E-06

All other home c 1.34E-05

Total 1.02E-04

a. Includes: medical complications, excessive heat/cold, suffocation by ingestion, and poisoning,. b. Based on total 1994 U.S. population of 260,711,000. c. Includes: electric current, explosive materials, hot substances, corrosive liquid, and

steam.

Note : Data obtained from the 1995 National Safety Council, Accident Facts: 1995 Ed., Itasce, IL Accident Facts were used to calculate the risk of several accidents on

an annual basis. Note: Criterion for general public (Maximum) = 1.0E-6

d. Legal Considerations (GPa: N/A P F ). Risks are reasonable, and in the same range as

the de manifestis level used by other agencies. Table 5-12 is a summary of the annual public fatality risk based on existing regulations used by the U.S. and foreign

countries.

TABLE 5-12. SUMMARY OF U.S. AND FO REIGN ANNUAL FATALITY RISK

CRITERIA

De Minimis De Manifestis Commonality Standard

Individual Risk (Public) 1.4E-9 a - 2E-6 b

1E-8 c 1.4E-8 a - 1E-6 a,d

1E-6 c 1E-6

a. Environmental Protection Agency b. Regulatory carcinogen study

c. Clusters around this value

d. British and Dutch

5-305.4.2 General Public Individual Risk Per Mission (GP: 0.1E-6 P F ).

a. Prior Safety Criteria (GP: 0.1E-6 P F ). The commonality criterion is consistent with historical data from the national ranges. Currently the majority of the ranges protect for a probability of casualty of 1E-6. The commonality criterion protects against fatality; however, the risk level is an order of magnitude lower than that afforded to casualty. Therefore, consistency is maintained. Table 5-13 shows individual mission risk for the general public.

TABLE 5-13. INDIVIDUAL MISSION RISK FOR THE GENERAL PUBLIC (AS OF 2006)

Range a Individual Probability of Casualty
Eastern Range 1E-6 Eglin AFB 1E-6 NASA – Wallops Flight Facility 1E-6

1E-7 NAWC – Point Mugu Pacific Missile Range Facility 1E-7 Reagan Test Site 1E-6
Western Range 1E-6

E-6 b White Sands Missile Range

RCC 321-06 Standard Criterion for P F 1E-7 c

a. Table lists only ranges that have criteria in this category. b. Probability of one or more casualties. c. Probability of fatality.

b. Similar Regulatory Experience . (GP: 0.1E-6 P F ). There are few types of regulatory experience other than range safety that address risks related to single events, such as launch, in contrast to ongoing operations of a facility. By extension, the annual regulatory experience cited in paragraph 5.4.1b justifies the maximum per mission

risk.

c. Comparable Accident Statistics and Background Risk Levels (GP: 0.1E-6 P F ). Comparable accident statistics for this category are difficult to find because most accident statistics are given on an annualized basis.

d. Legal Considerations (GP: 0.1E-6 P F ). Risks are reasonable. This criterion is below

the de minimis level; however, the potential high visibility warrants the standard.

5.4.3 General Public Collective Risk Per Mission (GP: 30E-6 E F ).

a. Prior Safety Criteria (GP: 30E-6 E F ). The numerical values for the maximum acceptable individual and collective fatality risks presented in Chapter 3 of the Standard are identical to those established previously by the RCC (See RCC 321-02).

5-31However, the updated fatality risk criteria in Chapter 3 of the Standard limit the risks from all hazards throughout a mission, and not just the inert debris risks limited previously. The current Standard clearly provides more comprehensive protection than the previous criteria because the same fatality risk limits now apply to the aggregated risks from all types of hazards associated with a range activity, not just the inert debris hazard. Therefore, the rationale used for the previous fatality risk criteria still applies to the updated criteria from a safety perspective. In addition, past experience shows that the fatality risks posed by typical range hazards are small relative to those posed by inert debris. For example, Table 5-14 lists the typical ratio of fatality expectation to casualty expectation for the dominant range hazards often addressed by risk management. Therefore, it is reasonable and rational to set fatality risk limits for the total risks posed by a mission using the same numerical values as those previously established for inert debris only.

TABLE 5-14. TYPICAL RATIO OF EXPECTED FATALITIES TO CASUALTIES

Hazard Scenario Range of E F / E C Large inert debris impacts 0.6 to 0.8
Explosive and inert debris impacts 0.1 to 0.8, 0.25 typical

Distant Focusing Overpressure (DFO) 0.001 to 0.03, 0.01 typical

Solid rocket propellant toxic release 0.001 typical

Notes : *These are based on AIS level 3 threshold for casualty.

*These results are based on various mixtures of sheltering levels.

The commonality criterion is comparable to historical data from the national ranges. Recognizing that the RCC criterion now apply to additional hazards besides inert debris, the criterion reflect the same or very similar risk levels used by four of the ranges (Table 5-15).

TABLE 5-15. COLLECTIVE MI SSION RISK FOR THE

GENERAL PUBLIC

Range a Expected Casualties Per Mission

Eastern Range 3E-5
Eglin AFB 1E-5 to 1E-6

Kwajalein Missile Range 1E-6

NASA - Wallops Flight Facility 1E-6

Western Range 3E-5

Commonality Criteria for E F 3E-5 b

a. Table only shows ranges that have criteria in this category. b. Expected Fatalities.

5-32b. Similar Regulatory Experience . (GP: 30E-6 E F ). Few types of regulatory experience (other than range safety) address risks related to single events, such as a launch, as opposed to ongoing facility operations. Existing precedents are provided on an

annual basis.

c. Comparable Accident Statistics and Background Risk Levels (GP: 30E-6 E F ). Comparable accident statistics are difficult to find because ranges are event-oriented, whereas industries have continuous operations. If aircraft operating for a day are compared to a single operation at a range, then the following information can be used for comparison: (1) Risk to People on the Ground from Commercial Aircraft

. Accident data from the period 1980 to 1995 were analyzed to determine the average fatality rate (fatalities per departure) to people on the ground for air carriers and general aviation (Reference 5r ). The average fatality rates for this group of people were 6E-7 per departure for air carriers and 3E-7 for general aviation. These average fatality rates were used in conjunction with published numbers of air carrier and general aviation operations (based on the assumption that each flight was counted as two operations – a landing and a departure) for FY93 to produce collective risk estimates to people on the ground in the areas adjacent to several sizes of airports. The results are shown in Table 5-16. This indicates that the launch day risk of living near a facility is similar to the everyday risk of living near a small airport and an order of magnitude less than the daily risk of living near a major airport. A more in depth analysis of the risks to people on the ground from civil aviation is presented in paragraph 5.8

.

TABLE 5-16. RISK TO PEOPLE ON THE GROUND FROM COMMERCIAL

AIRCRAFT AND GENERAL AVIATION

Number of Departures (1993) Airport Air Carrier Gen. Aviation Collective Fatality Risk
Los Angeles, CA 3.1E+5 2.5E+4 ~5E-4 per day

Orlando, FL 1.5E+5 1.2E+4 ~3E-4 per day

Melbourne, FL 1.0E+4 9.6E+4 ~9E-5 per day

Santa Maria, CA 9.4E+3 ~4E-5 per day 3.2E+4

(2) Internal Consistency (GP: 30E-6 EF). This criterion correlates with and is supported by other criteria in this category as shown in Figure 5-1

. (3) Legal Considerations. (GP: 30E-6 EF). Risks are very reasonable. This criterion

is well below the de minimis level for collective protection; however, the potential high visibility warrants the standard.

5-335.4.4 General Public Annual Collective Risk (GPa: 1000E-6 E F ).

a. Prior Safety Criteria (GPa: 1000E-6 E F ). The commonality guideline is comparable to historical data from the national ranges. Recognizing that the RCC guideline is now applicable to additional hazards besides just inert debris, the guideline reflects a risk level similar to that used at the Eastern and Western Ranges. Table 5-17 shows the collective annual risk for the general public.

TABLE 5-17. COLLECTIVE ANNUAL RISK FOR THE GENERAL PUBLIC

Range a Annual Expected Casualties

Eastern Range 1E-3

Western Range 1E-3

Commonality Criterion for E F 1E-3 b

a. Table lists only ranges that have criteria in this category. b. Expected Fatalities.

b. Similar Regulatory Experience . (GPa: 1000E-6 E F ). At the federal level, only the Nuclear Regulatory Commission (NRC) has c onsidered numerical risk criteria for limiting annual collective risk. Their criterion protect large masses of people from

effects of invisible radiation and are theref ore very conservative. More applicable criterion have been identified at the foreign and local level as follows: (1) Hong Kong . Hong Kong has adopted acceptable public fatality risk profile standards for facilities storing hazardous materials. The de minimis annual collective risk standard is 7E-5; the de manifestis value is 7E-3. (2) Dutch Acceptable Risk Standards . The acceptable risk standards used by Dutch industries for collective public annual fatality risk are 1.1E-3 per year for established nuclear power plants and chemical industries, and 1.1E-5 per year for future nuclear power plants. (3) British Ministry of Defense . The British Ministry of Defense has adopted a de manifestis collective fatality risk standard of 6E-3; the de minimis collective fatality risk standard is 6E-5. (4) Santa Barbara County . The County of Santa Barbara in California uses risk based guidelines for review of petrochemical facilities. The maximum annual societal fatality risk to the general public surrounding a facility under these guidelines is 1E-3; additional constraints are imposed on the probability of any specific number of fatalities per year.

c. Comparable Accident Statistics and Background Risk Levels (GPa: 1000E-6 E F ). (1) Risk to People on the Ground from Commercial Aircraft

. Accident data from the period 1980 to 1995 were analyzed to determine the average fatality rate (fatalities per departure) to people on the ground for air carriers and general aviation (Reference 5r ). The average fatality rates for this group of people were

5-346E-7 per departure for air carriers and 3E-7 for general aviation. These average fatality rates were used in conjunction with published numbers of air carrier and general aviation operations (based on the assumption that each flight was counted as two operations – a landing and a departure) for FY93 to produce collective risk estimates to people on the ground in the areas adjacent to several sizes of airports.

The results are shown in Table 5-18.

TABLE 5-18. RISK TO PEOPLE ON THE GROUND FROM COMMERCIAL

AIRCRAFT AND GENERAL AVIATION

Number of Departures (1993)

Airport Air Carriers Gen. Aviation Collective Fatality Risk

Los Angeles, CA 3.1E+5 2.5E+4 ~0.2 per year

Orlando, FL 1.5E+5 1.2E+4 ~0.09 per year

Melbourne, FL 1.0E+4 9.6E+4 ~0.03 per year

Santa Maria, CA 9.4E+3 3.2E+4 ~0.02 per year

(2) Comparative Public Risks due to Military Aircraft Operations

. Risks to the general public from military aircraft crashes were estimated for five “representative” Air Force bases selected on the basis of relatively large numbers of aircraft operations and their having relatively large nearby populations (Reference 5s ). The assessment is based on accident data for the years 1977 through 1981, and on models addressing aircraft crash frequency by runway angular sector and representative aircraft crash area. Table 5-19 summarizes

these results.

TABLE 5-19. CASUALTY RISK TO GENERAL PUBLIC

Air Force Base (AFB) Annual Collective Risk

March AFB 0.004

Mather AFB 0.02

McClellan AFB 0.1

Nellis AFB 0.2

Sheppard AFB 0.01

Average 0.07

(3) Aviation Risk in the Cape Canaveral Air Station (CCAS) Area . A study was performed to assess the PL81-60 (discussed in paragraph 5.3.1c ) risks for the Eastern Range (Reference 5t ). The risks from general aviation and military aviation flights over the region for both on and off-base were quantified. Air

5-35carrier operation risk was omitted because this risk was assessed to be negligible in comparison to general aviation and military aviation risks.

The risk estimates used the same population database as in launch risk analyses, with one exception: the transient population at the viewing stand or on the causeway during a launch was excluded. Moreover, methodologies for quantifying risk were, whenever possible, selected to parallel the methodologies used for quantifying launch risk. Because these risk estimates were being used to quantify a standard for acceptable launch risk levels, the analysis assumptions which could not be totally resolved were addressed one of two ways; either assumptions were treated so as to underestimate risks from aircraft over-flight or they were treated parametrically.

Thus, the study resulted in an estimate of annual collective casualty risk to the off-base populations ranging from 1.8E-2 to 8.8E-2. These results have been interpreted as providing a limit for risk to the general public but being of marginal relevance to worker risk. However, the text of the legislative history is not seen as addressing risk to essential workers. (4) Studies on Acceptable Collective Risks in the United Kingdom

. Multiple fatality fire occurrence data from the United Kingdom, United States, and worldwide were examined to formulate a basis for an acceptable fatality risk criterion in the chemical and process industry (Reference 5u ).

This study asserts that the acceptable level of societal risk is related to the size of the affected group. It bases this assertion on precedents in the requirements for design of different types of structures a nd on reasonableness of risk allocation. For a community of 100,000 people in the vicinity of the range, this criterion is equivalent to an annual (collective) fatality expectation of 6E-3, a collective risk level comparable to Commonality Standard 321-02. For the current (estimated November 1, 1996) United States population of 266E+6, this corresponds to a national collective risk criterion of 16, a value remarkably close to the acceptable national collective risk level of 10, above which allowable individual risk criteria are reduced for the purpose of regulating carcinogens.

d. Internal Consistency (GPa: 1000E-6 E F ). This criterion correlates with other criteria in this category as shown in Figure 5-1

.

e. Legal Considerations (GPa: 1000E-6 E F ). This criterion is very reasonable. "One death in a millennium," while not exactly precise, is a useful way to think of this

standard.

5-36Table 5-20 provides a summary of the collective annual risk for the public. The data was taken from a summary of the entire body of existing regulations used by the U.S. and foreign countries.

TABLE 5-20. SUMMARY OF U.S. AND FO REIGN ANNUAL FATALITY RISK

CRITERIA

De Minimis De Manifestis Commonality

Criterion

Collective Risk (Public) 1.1E-5 a - 5 E-2 b

1.1E-5 c 2E-6 d – 10 b

1.1E-3 c 1E-3

a. Santa Barbara County. b. Regulatory carcinogen study.

c. Clusters around this value. d. Nuclear Regulatory Commission.

5.4.5 Mission Essential Individual Risk per Mission (ME: 1E-6 P F ).

a. Prior Safety Criteria (ME: 1E-6 P F ). Four of the national ranges have used criteria in this category. The commonality criterion protects against fatality; however, the risk level is half an order of magnitude lower than that afforded to casualty by the majority of the ranges. Therefore, consistency is maintained. Table 5-21 provides

this data.

TABLE 5-21. INDIVIDUAL MISSION RI SK FOR MISSION ESSENTIAL

PERSONNEL

Range a Individual Probability of Casualty

Eastern Range 1E-5
NAWC - Point Mugu 1E-6

Western Range 1E-5

1E-5 b White Sands Missile Range

Commonality Criterion for P F 1E-6 c

a. Table lists only ranges that have criteria in this category. b. Probability of one or more casualties. c. Probability of fatality.

b. Similar Regulatory Experience . (ME: 1E-6 P F ). Few types of regulatory experience, other than range safety, address risks related to single events such as a launch, in contrast to the risks related to ongoing facility operations.

5-37One directly comparable regulatory requirement lies within the Israeli criterion for defense community personnel participating in a test. The Israeli Ministry of Defense derives the allowable individual risk per test based on the planned number of tests per year and an annual criterion.

c. Comparable Accident Statistics and Background Risk Levels (ME: 1E-6 P F ). The commonality criterion for voluntary risk is comparable to other voluntary risks taken everyday in the U.S. For example, the number of automobile deaths per 200 miles is 3.6E-6 and the number of deaths per 200-mile trip in a private plane is 3.4E-5.

d. Internal Consistency (ME: 1E-6 P F ). Mission essential criteria, as a group, relates to general public at one order of magnitude higher risk. In addition, mission essential criteria correlate to each other, as shown in Figure 5-1

.

e. Legal Considerations . (ME: 1E-6 P F ). The criterion is reasonable. It is near the

de minimis level.

5.4.6 Mission Essential Annual Individual Risk – NO LONGER USED (MEa: N/A P F )

a. Prior Safety Criteria (MEa: N/A P F ). Prior use at national ranges has been limited and inconsistent. To maintain reasonableness and consistency, an annual P F of 3E-5 is the commonality criterion.

b. Similar Regulatory Experience (MEa: N/A P F ). (1) Occupational Safety and Health Administration

. The U.S. Department of Labor, Occupational Safety and Health Administration, must regulate chemical risks when it can show that they pose a "significant risk." In the benzene Supreme Court decision (Industrial Union Department vs. American Petroleum Institute, 488 U.S. 607 (1980)), Justice Stevens stated that "if the odds are one in a thousand..., a reasonable person might well consider the risk significant..." Based on a working lifetime of forty years, this translates into an annual individual risk

of 2.5E-5. (2) Israeli Ministry of Defense

. The Israeli Ministry of Defense uses an annual

individual risk criterion of 1E-3 for mission essential workers.

c. Comparable Accident Statistics and Background Risk Levels (MEa: N/A P F ). The adopted maximum risk criterion compares favorably to actual average risk in other occupations.

The assumption is made that individuals who work as mission essential personnel on the range recognize and accept an inherent associated risk. This assumption allows direct comparison with the occupations in Table 5-22. This table illustrates that the maximum acceptable annual risk for any single individual is comparable to the average actual risk from a variety of industries.

5-38TABLE 5-22. OCCUPATIONAL FATALITIES

Annual Probability of Fatality Per Person Industry (Averages) Dept. of Labor a 1994 Accident Facts b

Agriculture 2.40E-04 2.60E-04 Mining, quarrying 2.70E-04 2.70E-04

Construction 1.50E-04 1.50E-04 Manufacturing 4.00E-05 4.00E-05 Transportation and public utilities 1.30E-04 1.20E-04

Trade 1.00E-04 2.00E-05

Services 3.00E-05 2.00E-05

Government 3.00E-05 3.00E-05 All Industries (Avg.) 5.00E-05 4.00E-05 Commonality Criterion for Mission Essential Personnel (Maximum) = 1.0E-04

a. U.S. Department of Labor, Bureau of Labor Sta tistics, Census of Fatal Occupational Injuries, 1994.

b. Accident Facts , 1994 Edition, National Safety Council.

d. Legal Considerations . (MEa: N/A P F ). Risks are reasonable based on comparison of other regulations, accident experience, and other criteria.

5.4.7 Mission Essential Collective Risk Per Mission (ME: 300E-6 E F )

a. Prior Safety Criteria (ME: 300E-6 E F ). Most ranges use this type of criterion. The commonality guideline is comparable to historical data from the national ranges. This is an important guideline to ranges because it is used by range safety organizations to help limit the total number of personnel exposed to any given mission. The guideline reflects the same or similar risk level to that used at four of the ranges as shown in Table 5-23.

TABLE 5-23. COLLECTIVE MISSION RI SK FOR MISSION ESSENTIAL

PERSONNEL

Range a Expected Casualties Per Mission

Eastern Range 3E-4 Eglin AFB 1E-4 to 1E-5
Kwajalein Missile Range 1E-5
Wallops Flight Facility 1E-5
Western Range 3E-4
Commonality Criterion for E F 3E-4 b

a. Table lists only ranges that have criteria in this category. b. Expected fatalities.

5-39b. Similar Regulatory Experience . (ME: 300E-6 E F ). Few types of regulatory experience, other than range safety, address risks related to single events such as a launch, in contrast to ongoing facility operations. Existing precedents are provided

on an annual basis.

c. Comparable Accident Statistics and Background Risk Levels (ME: 300E-6 E F ). Comparable accident statistics are difficult to find because ranges are event-oriented, whereas industries have continuous operations.

d. Internal Consistency (ME: 300E-6 E F ). A primary rationale for this criterion is its correlation to the single test criterion for individual mission essential personnel.

e. Legal Considerations . (ME: 300E-6 E F ). Risks are reasonable, they are significantly

below de minimis level.

5.4.8 Mission Essential Annual Collective Risk (MEa: 10000E-6 E F )

a. Prior Safety Criteria (MEa: 10000E-6 E F ). The commonality guideline is comparable to historical data from the national ranges. Recognizing that the RCC guideline is now applicable to additional hazards besides just inert debris, the guideline reflects a similar risk level as that used at the Eastern and Western Ranges. Table 5-24 shows collective annual risk for mission essential personnel.

TABLE 5-24. COLLECTIVE ANNUAL RISK FOR MISSION ESSENTIAL

PERSONNEL

Range a Annual Expected Casualties

Eastern Range 1E-2

Western Range 1E-2

1E-2 b Commonality Criteria for E F

a. Table lists only ranges that have criteria in this category. b. Expected fatalities.

b. Similar Regulatory Experience . (MEa: 10000E-6 E F ). Limited regulatory precedents have been found in this category, including the following: (1) British Ministry of Defense . The British Ministry of Defense applies a collective risk criterion of 6E-3 per year to all people (workers and surrounding populations) at explosive manufacturing facilities. (2) Santa Barbara County

. The county of Santa Barbara in California uses risk-based guidelines to review petrochemical facilities. Under these guidelines, the maximum annual societal fatality risk to workers at a facility is 1.1E-1; additional constraints are imposed on the probability of any specific number of fatalities per

year.

5-40(3) Israeli Ministry of Defense

. The annual collective fatality risk for mission workers in Israel (assumed to involve 10 tests) may be as high as 2E-2.

c. Comparable Accident Statistics and Background Risk Levels (MEa: 10000E-6 E F ).

Collective risk is small relative to other industries.

d. Internal Consistency (MEa: 10000E-6 E F ). An important rationale for this number is its correlation to the single test criterion. This guideline also reflects the multiplicative effect of other conservative criteria (e.g., few people x low risk per

event x few discrete events = very low collective risks).

e. Legal Considerations . (MEa: 10000E-6 E F ). Risks are very small. They are well

below the de minimis level. "One death in a hundred years" is a useful way to

consider this criterion.

5.5 Rationale for Catastrophic Risk Criteria

The RCC Document 321-07 has several key issues that bear repeating. Paragraph 2.2 of the Standard includes a policy objective statement that “the risk of a catastrophic mishap should be mitigated.” Paragraph 3.6 recommends “catastrophic risk criteria are designed to protect against scenarios involving numerous casualties” by facilitating the identification of scenarios that exceed these criteria and implementation of practical mitigations. The criteria were established primarily to mitigate the potential for catastrophes involving transportation systems, but they also have practical application for safety planning to protect people in the vicinity of the launch point. The catastrophic risk acceptability criteria presented in Chapter 3 address the fact that “surveys repeatedly confirm that accidents involving multiple fatalities on public transport are less socially acceptable than accidents involving private road transport,” 72 which rarely involve large numbers of casualties. The European approach to governing land use in the vicinity of an airport based on individual risks alone has been criticized because “in any other industry tolerability is established on the basis of probabilities falling as the potential number of

casualties increases.” 73 While that criticism may not be entirely valid, 74 the RCC endorses the catastrophe aversion incorporated into the criteria presented in paragraph 3.6 of the Standard because criteria solely based on casualty expectation and individual probability of casualty appear indifferent to the fact that accidents involving many casualties are perceived by the public as disproportionately more objectionable than those involving a few casualties. Furthermore, implementation of the catastrophic risk criteria in Chapter 3 should help a range refute potential criticism of using collective risk limits wit hout complete quantification of uncertainty.

72 Grayling T, and Bishop S., Sustainable Aviation 2030, Institute for Public Policy Research, August 2001, p. 40

73 Aviation Environment Federation, P ublic Safety Zones, Current Policy and the case for Change, www.aef.org.uk

74 Neither the Dutch nor UK Governments intend to relate th e planning zones at runway ends to levels of risk measures that overtly account for societ y’s aversion to accidents with multiple fatalities and/or injuries because a) some argue that such risk criteria are not well developed in the land-use planning field, and b) “the proposed zones are intended to limit the exposure of large numbers of people, thereby controlling and minimizing” the risk of accidents with multiple fatalities and/or injuries. See Davies and Quinn, Public Safety Zones: Cork, Dublin, and Shannon Airports, February 2005, page B3.

5-41In this supplement, catastrophe aversion limits are defined by the general formula,

P × N 1.5 ≤ Criterion

where

P is the cumulative probability of all events capable of causing N or

more casualties.

N is the number of casualties associated with a scenario.

Criterion is the maximum allowable collective risk for the event with various

scenarios as feasible outcomes.

Paragraph 3.6 of the Standard recommends a risk criterion of 1E-4 for the general public, and 3E-4 for mission essential and critical operations personnel. The above formula is used to define the recommended catastrophe aversion criteria, but is not used to indicate how to compute the potential for catastrophic outcomes. Paragraph 4.3 provides guidelines designed to facilitate evaluation of catastrophe potential.

The form of this catastrophe aversion criterion was chosen after a review of several catastrophe averse models used by U.S. agencies and other agencies around the world. Figure 5-4 summarizes the various methods reviewed during the development of this standard. 75
The line showing indifference to catastrophe in Figure 5-4 reflects no special concern for multiple casualties, i.e. no catastrophe aversion. Criteria based on casualty expectation and individual risks contain no catastrophe aversion.

75 Most of the methods shown are summarized in the risk analysis approaches by different countries in the NATO Allied Ammunition Storage and Transport Publication, NATO – AASTP-4, which was pr epared by NATO AC/258, Risk Analysis Working Group (RAWG).

5-421 10 100 1000 10000

1 10 100 Indifferent to catastrophe, N’ = N N’ = N 1.5 N’ = 320+16(N-20) for N>20 N’ = N×2 N//5 for N ≤ 20, N’ = N 2 N’ = N×2 N//5

N – number of people in pop. centerN’ – Pseudo N in order to becatastrophe averse

Figure 5-4. Comparison of methods that are used to introduce catastrophe aversion into the risk analysis.

The Netherlands, both for industrial risk and explosive storage risk, has used the most catastrophe averse formula: P × N 2 ≤ criterion. This approach has also been used by the County of Santa Barbara in California (the location of Vandenberg Air Force Base (VAFB), although never imposed upon VAFB). This is represented by the line representing N’=N 2 in Figure 5-4.

The curves in Figure 5-4 that use the factor 2 N/5 are employed in Switzerland, Norway, and Sweden for handling risk due to potential expl osions of stored, transported, or processed explosives. The Swiss modify the curve above N=20 so that it increases linearly with N and does not continue to rise so dramatically.

The RCC selected N 1.5 to incorporate a reasonable level of catastrophe aversion into the risk acceptability criteria. Figure 5-4 shows the RCC criteria in the center between no catastrophe aversion and the most conservative N 2 . The RCC catastrophic risk criterion is

similar to those that use of the factor 2 N/5 method for N<10 and less restrictive for N>10. Specifically, the RCC catastrophic risk criterion does not impose unreasonable conservatism with respect to large population centers, such as commercial aircraft or some ships, where a catastrophic accident could lead to numerous casualties. For instance, the value of N’ for an aircraft carrying 400 people is (400) 1.5 = 8000, which would inflate the pseudo-E C or pseudo-E F (described in paragraph 4.3 ) by a factor of 20.

5-435.6 Rationale for Aircraft and Ship Risk Management Requirements

5.6.1 Introduction . Previous versions of this standard limited the fatality risks (both individual and collective) from inert debris to people in transportation systems such as ships or aircraft. The revised standard applies the same numerical limits on fatality risks as supplemental criteria to protect against all hazards to the general public and essential personnel. 76 The standard also now endorses casualty as the primary consequence metric to ensure reasonable risks. Previous sections provide the rationale for the use of casualties as the primary consequence metric, the selection of 1E-6 probability of casualty to limit the risk to individual members of the general public and the selection of 100E-6 expected casualties to limit the collective risk to the general public.

Previous versions of this standard defined ship hazard areas based on the probability of impact (P I ) by “debris capable of causing a catastrophic accident,” and aircraft hazard areas

based on the P I from “debris capable of causing a fatal accident.” 77 Such P I limits are commonly used at the ranges as a generally convenient means to protect people in these transportation systems from unreasonable catastrophic risks. However, P I limits are indirect and imprecise means to set limit risks. The primary shortcoming is that P I limits fail to limit the precise consequences that are onerous because of the extreme variability in the vulnerability of various ships or aircraft to debris impacts. For example, “debris capable of causing a fatal accident” with a highly vulnerable aircraft (such as certain types of helicopter) is unlikely to have much effect on a commercial transport aircraft. Thus, aircraft hazard areas based on the 1E-7 P I limit and the minimum debris characteristics (mass, material, etc) “capable of causing a fatal accident” can produce overly conservative restrictions for air traffic or range activities. Therefore, P I limits such as those specified in Sections 3.3 and 3.4 of the Standard, whether combined with conservative or non-conservative debris thresholds, are not always the best way to ensure the safety of the traveling public. While the revised standard continues to endorse the use of P I limits as convenient and efficient means to define hazard areas for ships and aircraft, ranges now have an option to use explicit catastrophic risk criteria to ensure the safety of people in any sort of transportation system.

The revised Standard provides greater flexibility by setting direct limits on aggregated risks, instead of the previous approach of de fining ship and aircraft hazard areas based on P I limits. Section 5.1.1 provides the rationale for aggregated risk limits, and the same logic applies to extending those limits to account for exposed populations in ships or aircraft. Such aggregated risk limits provide the maximum flexibility for the management of risks to various exposed populations, including those in various transportation modes. The probability of impact limits intended to constrain the catastrophic risks posed to people on-board ships or aircraft, in combination with the hazard thresholds and vulnerability models in Chapter 6 of this Supplement, are often convenient and efficient means to define hazard areas as discussed below. However, setting limits on the aggregated risk to all exposed populations allows more

76 The term “essential personnel” is used here to refer to mission essential and critical operations personnel, which are formally defined in the glossary,

77 See RCC 321-02 paragraphs 3.2.1 and 3.3.1.2.

5-44sophisticated methods to ensure reasonable risks with potentially fewer restrictions on ship or air

traffic.

5.6.2 Qualitative Standard for Aircraft and Ship Risk Management Requirements . People ordinarily accept a wide range of risks depending on their perception of the risks and benefits. During the development of risk related policies, experts have noted that people generally accept higher risks if those risks are perceived to be voluntary, familiar, natural, under their control, 78
fairly distributed, not threatening to children, and devoid of catastrophic potential (References

5v

, 5w , and 5x ). These “outrage factors” suggest that people are likely to be relatively intolerant of accidents/risks from range activities, which are typically involuntary, exotic, man-made, beyond individual control, potentially catastrophic, likely to capture a great deal of media attention, etc. However, the main point here is that people are far less tolerant of risks that are imposed on them without any form of consent (i.e. involuntary risks) or any sense of benefit from the source of risk (References 5n and 5x ).

In establishing a federal law to define acceptable flight risk limits for launches, the FAA noted that “commercial launches should not expose the public to risk greater than normal background risk, which the FAA defined in its No tice of Proposed Rulemaking (NPRM) as those risks voluntarily accepted in the course of normal day-to-day activities” (Reference 5f ). Other organizations have also used “normal background” risks, particularly from other types of accidents, as important benchmarks for acceptable ri sks in a variety of fields (References 5k and 5v). 79

, 80

, 81

In light of the distinctly different tolera nce of voluntary and involuntary risks, and the general principle that acceptable risk levels should be correlated with background risks, the RCC endorses the following qualitative standard as a guideline for the development and implementation of range requirements:

For any individual uninvolved in the mission, but participating in a voluntary activity that increases their background risk (such as traveling in an aircraft or waterborne vessel), the chances of casualty resulting from the mission should be less than the background risk associated with the voluntary activity

.

5.6.3 Rationale for Limits on Probability of Impact to Aircraft . The established practice at most national ranges is to allow no risk to any aircraft from launch operations by using containment areas. Normally, containment is achieved by constraining operations or by closing air lanes through agreements with the Federal Aviation Administration (FAA). A notable exception to this policy is the risk to which general aviation was subjected during the tests of the Surface-Launched Cruise Missile (SLCM) and the Air-Launched Cruise Missile (ALCM).

78 People tend to be more sensitive to risks, even voluntarily accepted risks, when someone else is in control, such as flying in an airplane piloted by someone else, and less concerned about risks when they feel in control, such as driving in an automobile.

79 See AFSPCMAN 91-710 paragraph A4.3

80 See Nuclear Regulatory Safety Policy Goals in Federal Register, Vol. 51, August 21, 1986, page 28044

81 UK Health and Safety Executive (HSE), “Reducing Risks, Protecting People: HSE’s Decision-Making Process,” ISBN 0 7176 2151 0, first published in 2001.

5-45Another exception involves exoatmospheric intercepts from ballistic missile defense (BMD) tests that have some potential for spreading extremely small particles of debris across a wide area. For these exceptions, a risk assessment is appropriate.

A significant consideration in establishing this standard is the size of the fragment that could hazard aircraft. The standard is based on the probability of impact with “debris capable of producing a casualty” for ships and aircraft, and a more stringent standard of “debris capable of causing a catastrophic accident” for ships. The thresholds given in Chapter 6 should be used to define “debris capable of producing a casualty” and “debris capable of causing a catastrophic accident” as described in Chapter 4 . This approach results in a standard that is conservative since many impacts by debris near the thresholds defined in Chapter 6 of this Supplement are unlikely to cause casualties.

a. Limit of 1E-7 Probability of Impact for Non-mission Aircraft . Limiting non-mission aircraft to regions where the probability of impact with debris capable of producing a casualty does not exceed 1E-7 will demonstrate compliance with the qualitative

standard described in Section 5.6.2 . Data from the NTSB aviation accident database indicates that there was an average of eight fatal accidents on U.S. air carriers (operated under 14 CFR Part 121 or scheduled flights under Part 135) for every ten million departures during the 20-year period from 1984 to 2003. This suggests that the probability of a fatal accident has been about 8E-7 per departure of a U.S. commercial air carrier aircraft over the last 20 years. The data behind these estimates generally exclude incidents involving sabotage or suicide, since these are not considered accidental (Reference 5y ). Not surprisingly, this data also show that the “background risk” accepted by a passenger on a commercial transport flight appears to fall between the long and short term acceptable risk levels identified in the FAA’s Advisory Circular (AC) 39-8, which ar e described below. The “background risk” accepted by occupants of U.S. general aviation aircraft may be significantly higher than commercial passengers. Data from the NTSB aviation accident database indicates that the probability of a fatal accident per departure of aircraft operated under Part 91 was about 8E-6, or about ten times higher than that for commercial aircraft passengers during the same 20-year period. However, this estimate is more uncertain due to the relatively unreliable data on the number of general aviation departures compared to commercial flights.

Advisory Circular (AC) 39-8 is an FAA guidelines used “to identify unsafe conditions and determine when an ‘unsafe condition is likely to exist or develop in other products of the same type design’ before prescribing corrective action” for transport aircraft (Reference 5z ). Specifically, AC 39-8 is aimed at assessing the risk of unsafe conditions on products associated with the power plant or auxiliary power unit installations on transport category airplanes. However, the general concepts, safety goals, and definitions (especially for the consequences of concern) presented there are relevant to the development of standards for public protection, particularly for the protection of the flying public from spacecraft hazards. For example, AC 39-8 recognizes “that acceptable risk levels should be regarded as upper limits, to be allowed only when reducing the risk further would result in undue burden.” This

5-46FAA guideline is functionally equivalent to the RCC preference to ensure safety by complete containment of range hazards.

AC 39-8 provides short term acceptable risk levels that equate to where “the malfunction is beginning to contribute more risk than the aggregate risk from all other causes, including contributions from the crew.” Specifically, AC 39-8 identifies the probability of no greater than 4E-6 for a “level 4 event” as a short term acceptable risk for each flight. Level 4 events include serious injuries or worse (i.e. casualties), hull loss when occupants were on-board, and forced landings. AC 39-8 uses the NTSB definition of serious injuries; however, “the level 4 risk guidelines areintended to cover exposures to the most severe of ‘serious injuries’ (i.e., lifethreatening injuries).” Therefore, the level 4 event guideline may be relaxed if only non-life threatening injuries are involved (such as simple fractures). AC 39-8 identifies the probability of no greater than 1E-9 for a “level 4 event” as a long term acceptable risk for each flight.

The long and short term acceptable risk guidance published in AC 39-8 set important bounds that can be used to define acceptable aircraft risks. Clearly, any space activity that meets the long term acceptable risk guidelines in AC 39-8 protect against unreasonable risks from a range activity. Conversely, any range activity that generates aircraft risks in excess of the short term acceptable risk guidelines does not protect against unreasonable risks. Since only a fraction of the “debris impacts capable of producing a casualty” on an aircraft due to a range activity are likely to actually produce a level 4 event, it is clear that compliance with the 1E-7 probability of impact criterion given in paragraph 3.3.1.1 of the Standard (and the 1E-6 P I criterion in 3.3.2.1) of the Standard will ensure that no aircraft are exposed to unacceptable short term risks as defined in AC 39-8. Therefore, limiting non-mission aircraft to regions where the probability of impact with debris capable of producing a casualty on an aircraft does not exceed 1E-7 will ensure reasonable aircraft risks based on FAA guidelines given in AC 39-8.

When this RCC standard was first established, risk statistics were gathered on comparable risks of aircraft being struck by objects in midair. Two non-military sources of midair strikes have resulted in downed aircraft, as shown in Table 5-25

. These statistics indicate that the risks resulting from a preexisting hazard of either bird strikes or midair collisions exceed the risks allowed by this standard because only a fraction of the impacts “with debris capable of producing a casualty” on an aircraft are reasonably expected to produce a serious injury or worse.

Table 5-26 shows that the standard criteria are the same as those used at Wallops Flight Facility , and are one order of magnitude more conservative than those used at Reagan Test Site, and the Eastern Range.

Section 4.4.4 of this Supplement demonstrates that proper implementation of the

P I limits for aircraft hazard areas and use of the aircraft vulnerability models and hazard thresholds in paragraph 6.3.3 will ensure compliance with the individual and

5-47catastrophic risk criteria established in Chapter 3 of RCC 321-07. Thus, limiting the

P I with debris capable of producing a casualty on an aircraft is a reasonable and rationale means to ensure that range activities do not pose risks that exceed a) the background risks for people in aircraft, b) risk guidelines used by the FAA to “determine unsafe conditions...for transport aircraft”, c) the individual risk limits established in this standard, d) the catastrophic risk criteria, and e) current practice at the national ranges.

TABLE 5-25. ANNUAL RISK FOR FLIGHTS IN THE U.S. BASED ON A 5-YEAR AVERAGE (1993-1997) a

Number of

Fatalities (E F /year) Number of Injuries Probability of Fatality / Flight (Ref 5bb ), b Probability of Injury / Flight ( Ref 5s), b

Bird Strikes 1 (0.2/yr) (Ref 5aa), c 10 (2/yr) (Ref 5t), d 3.2E-9 3.2E-8

Midair

Collisions 96 (19.2/yr) (Ref 5t), e 31 (6.2/yr) (Ref 5t), d 3.1E-7 1.0E-7

a. Impact statistics are based on a 5-year average (1993- 1997). All of the midair co llisions involve d fixed wing aircraft. In this time period, collisions between helicopters, ultralights, and gliders occurred, but they were not considered in this study. During the referenced 5-y ear period, 29 aircraft were struck by birds, resulting in 1 fatality and 10 injuries; 124 airc raft were involved in midair collis ions, resulting in 96 deaths and 31 injuries. b. Assuming an average of 62,281,350 flights per year for all fixed wing, powered aircraft in the U.S. (based on air traffic activity at FAA, and contract airport control towers and facilities). c. Indian Shores, Florida ( 7/15/94). A pelican impacted the windshield of a Cessna 172 causing the incapacitated pilot to lose control, pitch up, invert the aircraft, and impact the water. d. Nashville International Airport, Nashville, Tenness ee (7/8/96). A Southwest Ai rlines Boeing 737 ingests a bird in the left engine on takeoff, causing a compressor stall. Excessive braking due to a rejected takeoff caused a fire to erupt from the right brake. During the evacuation of the plane, 5 passengers were injured, 1 seriously; 117 passengers and 5 crew members were not in jured. There were five other injuries from birds in this 5-year period. Three of the injuries were caused by birds penetrating the windshields of aircraft, striking the pilots. The other two injuries were caused by the pilots striking the ground while maneuvering to

avoid contact with flocks of birds. e. All of these midair collisions involved general aviation aircraft. In this time period, there were also midair collisions between helicopters and gliders, but they were not considered in this study.

5-48TABLE 5-26. AIRCRAFT RISK CRITERIA OF NATIONAL RANGES*

Range Mission Essential Other

Eastern Range 1E-6 1E-6

Eglin AFB 1E-4 to 1E-3 Containment

NAWC - Point Mugu RSO Discretion Containment

Pacific Missile Range Facility 1E-6 1E-7

Reagan Test Site 1E-6 1E-6

Wallops Flight Facility 1E-7 1E-7

Western Range 1E-6, sched. DR debris; 1E-8 breakup debris Containment

White Sands Missile Range Containment Containment

Standard Criteria 1E-6 1E-7

* Risk expressed in terms of probability of impact

b. Rationale for 1E-6 Probability of Impact for Mission Aircraft . The standard criterion for protecting mission essential aircraft is consistent with historical data from the national ranges. This same criterion is currently used by the Eastern and Western Ranges and Reagan Test Site (formerly known as the Kwajalein Missile Range). The criterion also reflects a lower risk than that accepted by Eglin AFB (P I = 1E-4 to 1E-3). Table 5-26 shows the aircraft risk criteria of national ranges. The previous section shows that this criterion is consistent with risk guidelines used by the FAA to “determine unsafe conditions...for transport aircraft.” Thus, the standard criteria are reasonable in light of currently used criteria that have provided an excellent safety record and current FAA guidelines. The criterion was designed to provide catastrophe aversion and to be consistent with the collective risk criterion as

described in Section 4.4.4

.

5.6.4 Rationale for Mishap Response Requirements . This section provides the rationale for the requirement given in paragraph 3.3.4 of the Standard:

“The range must coordinate with the FAA to ensure timely notification of any expected air traffic hazard associated with range ac tivities. In the event of a mishap, the range must promptly inform the FAA of the volu me and duration of airspace where an aircraft hazard is predicted.”

5-49Range coordination with the FAA is reasonable and prudent because the FAA is the executive agency with primary responsibility for aircraft safety. The RCC has chosen to avoid setting a specific quantitative standard for risk acceptability in the event of a mishap because:

a. Appropriate measures for aircraft protection in the event of a range mishap depends on many factors, such as the type of aircraft in the vicinity and the nature of the

aircraft hazard.

b. Conditional risk is fundamentally different than pre-flight risk.

c. The definition of aircraft hazard areas in the event of a range mishap is a topic where range safety practices and technology advances are evolving (Reference 5cc ).

d. Specific RCC limits could stifle innovation in this important area.

5.6.5 Rationale for 1E-5 Probability of Impact to Ships . The International Maritime Organization (IMO) is the United Nations (UN) organization for safety and environmental protection regulations for maritime activities. The IMO has been developing a risk-based approach to safety and environmental protection regulations (Reference 5v ). The IMO prefers to refer to the “risk evaluation criteria,” instead of the standard risk acceptance criteria, to emphasize that the criteria will not be the only factor in a decision because other considerations may be deemed appropriate. The IMO has not yet agreed to any explicit risk evaluation criteria, but a formally proposed one is under consideration. The IMO proposed explicit risk evaluation criteria would use essentially follow the approach taken by the UK’s Health and Safety Executive (HSE). The IMO proposal and current HSE regulations use annual individual risks to define three risk regions:

a. An intolerable region (above the maximum tolerable risk level), where risks must be reduced regardless of costs.

b. A broadly acceptable region (below the broadly acceptable risk level) where risks are too small to require reductions that incur cost.

c. A middle region where risks should be “As Low As Reasonably Practicable” (ALARP). In the ALARP region, risks should be reduced as long as the risk reduction is not disproportionate to the costs.

The IMO’s proposed risk evaluation criteria is based on the premise that involuntary risks should be “substantially below the total accident risks accepted in daily life,” but “similar to risks that are accepted from other involuntary sources.” The IMO proposal endorses the risk thresholds put forward by the HSE. Individual annual fatality risks are:

d. Below 1E-6 are broadly acceptable for everyone: crew and public.

e. Above 1E-3 are intolerable for crew.

f. Above 1E-4 are intolerable for the public (passengers and public ashore).

5-50The IMO proposal notes that it may be appropriate to have a more demanding target for new ship designs and that individual annual fatality risks should be:

g. Below 1E-4 for crew, and

h. Below 1E-5 for passengers and public ashore.

Note that the IMO criteria are for individual annual fatality risks, whereas the Standard sets limits for cumulative probability of impact w ith debris capable of causing a ship accident. Since only a fraction of the impacts “capable of causing a ship accident” are expected to produce a fatality, the 1E-5 probability of impact criterion standard appears to be conservative relative to

the IMO criteria.

The standard criteria for protecting ships are consistent with criteria used by six of the national ranges as shown in Table 5-27. Note that the standard criterion for hazard ship areas limits the cumulative probability of impact of de bris capable of causing a ship accident. The Eastern and Western Ranges have used the same approach and numerical values to define hazard areas for non-mission ships. Other ranges, such as the Reagan Test Site, have set lower probability of impact limits for individual ships instead. The standard criteria allow mission essential and critical operations ships to be exposed to a probability of impact that is ten times higher than the general public, consistent with the rationale provided in Section 5.3.4

.

TABLE 5-27. SHIP RISK CRITERIA OF NATIONAL RANGES

Range Criteria for Mission Essential Ships Criteria for Non-Mission Essential Ships

Eastern Range 1E-5* 1E-5*

Eglin AFB 2 - 3 sigma hazard area cleared for all ships

Reagan Test Site 1E-6 1E-6

NAWC - Point Mugu 1E-5 1E-6
PMRF – Barking

S d 1E-5 1E-6
Wallops Flight

FF FF F ili 1E-5 1E-5

Western Range 1E-5* 1E-5*

Commonality Criteria 1E-4* 1E-5*

* Risk expressed in terms of cumulative probability of impact

5-51Therefore, a per mission limit of 1E-5 probability of an impact capable of causing a ship accident appears reasonable in light of:

i. IMO’s (United Nations) proposed risk evaluation criteria. j. The improbability of the same individuals on ships being threatened by multiple

launches.

k. The conservative definition of a ship accident (such that a high percentage of these boat accidents caused by a debris impact would typically produce a casualty or fatality).

l. Current criteria used at the national ranges.

m. The uncertainty in the overall calculation of P I for ships exposed to debris from range

activities.

Furthermore, the best estimates of the annual individual risks historically accepted by people on ships show that limiting non-mission ships to regions where the probability of impact capable of causing a ship accident does not exceed 1E-5 will demonstrate compliance with the qualitative standard described in Section 5.6.2 . Skjong (Reference 5v ) showed that:

n. Annual individual risks are on the order of 1E-4 based on 20 years of data from 1978-1998 for crew of various ship types. 82

o. The risk of three to 1000 or more fatalities per year from collision, grounding, and fire are between 1E-4 and 1E-3 for passenger ships with 3000 people on board (see Figure 6 in (Reference 5dd )).

The current Standard also maintains that non-mission ships be restricted from hazard areas where the cumulative probability of impact of debris capable of causing a catastrophic

accident 83 exceeds 1E-6. This requirement is consistent with the catastrophe protection provided ships by previous versions of the Standard.

5.7 Rationale for Spacecraft Protection Requirements

5.7.1 Collision Probability . Similar to the rationale presented in paragraph 5.3.1c of this Supplement for deriving per event risk from annual risk and the currently stated EWR 127-1 rationale for the public casualty risk criteria of 30E-6, the criterion for collision probability was revised. Based on the assumptions that no more than one collision in 1000 years is acceptable at a world-wide launch rate of 100 flights per year and of sufficient altitude to pose a risk to manned spacecraft, this would result in a hit probability of 1E-5 per spacecraft per launch. This is the same level of protection afforded to ships; however, most ship crews and passengers have life saving devices available to them and also the chance of being rescued. Not all spacecrafthave lifeboats readily available and the capability to perform rescues in space is almost nonexistent today, therefore an additional order of magnitude level of protection level (1E-6) would be warranted. The additional order of magnitude could also be justified using the logic approach

82 See the figure in Reference 5v

. 83 In the absence of valid ship vulnerability modeling, this includes any debris capable of deck penetration as described in Chapters 4 and 6 of this Supplement.

5-52described in Figure 5-2 of paragraph 5.3.1d accounting for the uncertainty in predicting the probability for this activity. A separate justification or rationale for adopting the 1E-6 criterion for collision probability is that the Risk Committee considered the crew aboard manned spacecraft to be in the newly defined category of critical operations personnel and therefore should have the same level of protection as mission essential aircraft.

5.7.2 Ellipsoidal Miss Distance Volume . Typically, the greatest dispersions associated with an orbiting object or a launch vehicle is in either’s in-track direction. Since a 200 km miss distancehas been used by the ranges for several decades, it can provide an acceptable upper bound on intrack dimension of the miss distance volume and continue the excellent record for collision avoidance that has been successfully used agai nst occupied spacecraft. After reviewing the observed cross-track variability of launch vehicles, the position and arrival time variability of spacecraft, and reviewing mission assurance conjunction assessments against other classes of space objects that have been performed over the years with 35 km or less miss distances, a 50 km miss distance perpendicular to the in-track axis for both the radial and cross-track dimensions was selected. Therefore miss distance volumes of 200 km in-track by 50 km cross-track and radial were defined as the acceptable ellipsoidal volume and 200 km retained as the spherical volume, either of which is to be applied about the manned spacecraft during the conjunction

assessment.

5.7.3 Duration of Conjunction Assessment. In evaluating the language in the previous versions

of RCC 321 and to what duration the individual ra nges were performing or providing data for the conjunction assessments, the Risk Committee found that the language was conflicting and the practices varied from range to range. For suborbital missions, the duration should cover at least the period of flight Limiting duration to orbit insertion or orbit insertion plus one revolution does not ensure adequate protection to manned spacecraft. Events observed in the recent past, for launch objects inserted into low earth orbit (LEO) or park orbit, has determined conjunctions occurring with the International Space Station (ISS) three or four revolutions after orbit insertion. In addition, conjunction assessments must also consider jettisoned components that typically occur after orbit insertion and may remain in different orbits than the launch vehicle’s upper stage or payload. The committee found that the proper duration for the analysis was dependent on several factors that must be considered to determine adequate time for a meaningful conjunction assessment:

a. The type and shape of orbit (park, transfer, interplanetary, circular, highly elliptical) of the launch vehicle or jettisoned components in relation to the manned spacecraft,

b. The orbital period of the manned spacecraft relative to orbital period of launch vehicle or jettisoned component.

c. The altitude of the launched object relative to the manned spacecraft.

d. The time required by either the 1 st Space Control Squadron (SPCS) to catalogue the object(s) or the period of coverage another agency or range user may be performing in their conjunction analysis for mission assurance or other purposes and including the manned spacecraft.

For near circular LEO or park orbits orbit insertion typically occurs for at altitudes of 125 to 175 km while manned spacecraft are at higher altitudes (300 – 350 km). Often,

5-53conjunctions for objects in park orbits result from the object being within 200 km miss distance of the manned spacecraft but whose maximum altitude capability is greater than 100 km from the spacecraft. Conjunctions in this case are more likely due to inclination crossings at large, separated distances rather than altitude crossings that are more likely to produce a collision. Therefore extending conjunction assessments past one revolution may identify multiple encounters in subsequent revolutions of the manned spacecraft and launch objects especially when their periods are nearly synchronous. Many of these conjunctions may be mitigated by the additional Conjunction Assessment (CA) and Co llision Avoidance (COLA) screening criteria described in paragraphs 2.2.4 of this standard and 5.7.5 of this Supplement. The Space Control Center in Cheyenne Mountain, operated by the 1 st SPCS, will likely have catalogued and be tracking objects remaining in LEO after 6 to 9 hours. Since objects in LEO have periods of from 90 to 95 minutes per revolution, the analyst should consider extending the duration of the conjunction assessment for approximately 4 to 6 revolutions past orbit insertion to cover the period until the launched object is catalogued.

Launch vehicles or components in moderately to highly elliptical or transfer orbits, and interplanetary trajectories are likely to produce conjunctions that potentially would result in collisions. For these type missions, the previous practice of ending the CA at orbit insertion did not address the more likely conjunction due to an altitude crossing and resulted in inadequate protection of the manned spacecraft. Similarly, if the assessment duration was extended to orbit insertion plus one revolution, the threat to manned spacecraft would only be addressed if the launch vehicle or component was directly injected into this type orbit on ascent. For GEO or MEO missions, orbital insertion first occurs with park orbit, and then subsequent powered flight segments produce the elliptical transfer orbit involving an altitude crossing. Thus, assessment duration needs to be extended to cover these additional powered and coast flight segments and in particular until the vehicle or components clear the altitude of the manned spacecraft by at least the miss distance criteria selected or until the collision probability is expected to be within acceptable limits. Often a jettisoned stage is left in park orbit for these missions and must also be screened against the manned object as described in the previous paragraph. The analyst should consider that orbital periods of moderate elliptical orbits typically range from 600 to 120 minutes per revolution and the 1st SPCS will likely have catalogued the launched objects after 1 to 5 revolutions, respectively.

5.7.4 Pre-screening Criteria . The two altitude screens stated in paragraph 2.2.4 of the Standard were predicated on the current operating regions of manned spacecraft and the known performance capabilities of launched vehicles and components. The minimum altitudes of the Space Shuttle, ISS, and Shenzhou spacecraft were considered when establishing the initial screen for launch vehicles, jettisoned components, or planned debris needing to exceed 150 km altitude before CAs are necessary. Space shuttle history i ndicated that their lowest orbit was122 nm, or 226 km and the ISS minimum altitude is in the range of 310 to 320 km before maneuvers to boost the orbit are considered. The Chinese Shenzhou 5 and 6 spacecraft were launched to minimum altitude of 211 km before raising the orbit to a final perigee of approximately 332 km. The Risk Committee also considered that other manned objects could be inserted into lower orbits than current manned objects, however, there are operational and protective concerns regarding the population of satellites and debris in those lower orbit bands and whether manned spacecraft can be sustained in those orbits for long periods of time. For these reasons, and

5-54discussions with NASA offices responsible for protecting and determining when to maneuver the ISS, the minimum altitude of 150 km was determined to be appropriate. In addition, this is consistent with current findings and regulations of the FAA/AST office responsible for licensing

commercial U.S. launches.

The second screen is intended to eliminate unwarranted conjunction assessments. This screen, of requiring the maximum (3-sigma) altitude capability of the launch vehicle, components, or planned debris to be within 50 km of, or above, the operating altitude of the manned spacecraft before a CA or COLA is required,. Even though it has been in practice for several decades, the Risk Committee recognized that 200 km, when used with a spherical miss distance, is very conservative when considering the likelihood that a conjunction will occur. In addition, conjunction assessments are typically calculated using nominal or expected performance of the vehicle, and the inclusion of malfunction scenarios are considered impractical. For the planned trajectory of a launch vehicle or its components to exhibit performance beyond their 3-sigma altitude capability, and, in addition, bridge an additional 50 km separation distance to threaten a manned spacecraft was therefore considered extremely remote. The 50 km separation distance is also equivalent to the recommended radial dimension when using ellipsoidal miss distance volumes; hence the altitude screening allows the analyst to perform a simple assessment beforehand as to the likelihood of a conjunction.

5.7.5 Arrival Time and Separation Uncertainty of the Launch Vehicle and Spacecraft . Unless collision probability is calculated, the current practice is to base conjunction assessments on miss distance separation of point estimates of the launched object and the spacecraft. A simple and straightforward application of known or estimat ed dispersions of the vehicle and spacecraft could provide an analysis product consistent with similar practices in containment or risk assessment. Currently, dispersions are only accounted for at the Eastern and Western Ranges by adding pads to launch wait periods based on maximum arrival time dispersion per revolution of an assumed maneuvered spacecraft. This approach is overly conservative.

It would be more appropriate to increase miss distance volumes directly by the appropriate amount to account for spatial dispersions and to increase launch wait periods but only by the arrival time dispersion of the launch vehicle and the uncertainty of known maneuvers of the spacecraft. Historically, the large miss distance of 200 km spherical could be assumed to account for dispersions in the launch vehicle and spacecraft, however, the Committee considered it more mathematically rigorous to treat the miss distance and dispersion criteria as separate and combine them in the manner recommended in paragraph 4.5.3 of this Supplement. For practical consideration, the dispersions associated with the launch vehicle may be significantly larger than the dispersions associated with the spacecraft su ch that only the LV dispersions need to be

addressed.

5.8 Using Aviation as a Benchmark for Launch Risk

As discussed in paragraph 5.3.1d , there is broad recognition that aviation is a legitimate benchmark for acceptable risks from launch activities. This section describes how the risks posed to ground dwellers by conventional aviation can be used to help identify reasonable risk limits for range activities. The following data and analyses of the risk imposed by the over-flight

5-55of conventional aircraft indicate that a limit for the collective risk for the general public on the order of 100E-6 (i.e. 1E-4) expected casualties for any single mission is reasonable and rational.

Thompson et al examined data on all civil aviation accidents in the U.S. that killed people on the ground from 1964 to 1999 (Reference 5i ). Thompson et al excluded fatalities that resulted from voluntary exposure, either by being on the airstrip or otherwise being involved with the aircraft involved, and focused their analysis on the involuntary risks of being killed by an airplane accident. For example, Thompson et al considered a ground crew member or someone killed while taking pictures on the runway voluntarily exposed. They classified people who live on private property near airports as involuntarily exposed because there are no policies to warn them about the risk, “even though some might reasonably suspect that living near an airport leads to heightened exposure.”

Thompson et al found that the involuntary ri sk of fatality to individuals on the ground from civil aviation accidents increases by about a f actor of 100 within two miles of an airport, from about one in a hundred million (1E-8) to one in a million (1E-6) per year for a hypothetical person that remains in the same location for an entire year. They found that the increase in individual risk due to proximity from an airpor t appears somewhat greater near the busiest 100 airports, and somewhat less near the busiest 2550 ai rports. However, those differences appear to be negligible given the limited spatial resolution of the Thompson el al data, where the distance from the airport was considered instead of the distance from the runway under the dominant take-off and landing flight paths. The current lack of resolution in the aviation ground dweller data permits identification of only very approximate risk levels, and prevents a more detailed analysis from credibly separating the background risk from commercial flights (flown under 14 CFR Part 121 or Part 135) from general aviation (flown under 14 CFR Part 91) near airports on a

nationwide basis 84 . The recent development of ground dweller risk models for European airports suggests that further study could produce more precise estimates than those presented here (Reference 5k ).

The data and analysis presented by Thompson et al is insufficient to identify a precise background risk to involuntarily exposed groups of pe ople in the vicinity of airports. However, ACTA, Inc. estimated that the average risk of fatality for individuals involuntarily exposed to civil aviation accidents within five miles of top 100 airports was about 3E-8 in the year 2000 as

follows.

Thompson et al projected one fatality related to operations at a top 100 airport in the year 2000 from all types of civil aviation accidents. 85 An accident was considered related to an airport if all the following conditions were met:

a. the airport was registered with the FAA

b. the airport was the origin or final destination of the flight

c. the accident occurred within ten miles of the airport.

84 The ANSI/AIAA standard on Commercial Launch Safety sugge sted that such an estimate of the background risk presented by non-commercial aviation mi ght provide a better basis for comparison to risks accepted from launches.

85 See page 1033

5-56Thompson et al projected an expected number of fatalities equal to 0.94 in the year 2000 for all airport unrelated accidents across the entire U.S. 86 ACTA assumed that the risks from airport unrelated accidents are independent of proxi mity to an airport. ACTA estimated that 36 percent of the U.S. population lived within ten miles of a top 100 airport in the year 2000 based on the results shown in Figure 6 of Thompson et al and an assumption that those lines continue with the same slope beyond the five mile mark where the graph ends at 13 percent. Based on Figure 7 from Thompson et al, ACTA es timated that the average individual risk of fatality in the year 2000 was approximately 6x10 -9 for people that dwell between five and ten miles of a top 100 airport.

By using the following five values estimated for the year 2000 based on Thompson el al:

d. Thirteen (13) percent of the population live within five miles of a top 100 airport.

e. Thirty six (36) percent of the population live within ten miles of a top 100 airport.

f. An expected number of fatalities equal to 1.0 for all types of civil aviation accidents related to the Top 100 airports.

g. An expected number of fatalities equal to 0.94 for all accidents across the entire U.S. unrelated to airports.

h. A total population of the U.S. given in Table IV as 275,306,000.

and the following equations

,

Risk Within 10 Miles of a Top 100 Airport = Risk Related to Airport + Risk Unrelated to Airport

MILES

UNRELATED MILES

RELATED MILES

TOTAL EF EF EF 10 10 10 + = (Eqn. 5-1)



# ( ) ( ) ( ) 34.11000,306,27536.0104.3 9 10 =+ = − x EF MILES

TOTAL

Risk Within 10 Miles of Top 100 Airport = Risk Within 5 Miles + Risk between 5 and 10

miles: 

# ( ) ( ) ( ) 

# ( ) ( )( ) 000,306,27513.036.0106000,306,27513.0 34.1 9 5

− + = − x P MILES

TOTAL

86 See equation 20 also on page 1033

5-57It is estimated that :

8 5 107.2

− = x P MILES

TOTAL (Eqn. 5-2)

Thus, it was estimated that the average risk of fatality for individuals involuntarily exposed to civil aviation accidents within five miles of top 100 airports was about 3x10 -8 in the year 2000

.

The principle shortcomings of the above estimate are:

i. The Thompson el al data reported ground dweller risk as a function of distance fromthe airport only, not in terms of the distance from a runway under the dominant takeoff and landing flight paths, and j. The current lack of high fidelity data on the distribution of population density near the top 100 airports in the U.S.

While these shortcomings are real, this estimate is still valid for the intended purpose as a benchmark for acceptable launch risks because there are reasons to be confident that the actual risks from aviation are even higher. The first reason is related to the spatial distribution of ground dweller risk from aviation near an airport. Figure 7 in Thompson et al assumes that people dwelling at an equal distance from a major airport are subject to an equal risk. However, some European nations now govern land use near airports based on triangular public safety zones that extend from the runways (Reference 5l ) based on data from various empirical analyses (Reference 5k ). Thus, it is clear that the annual risk from aviation over-flight for ground dwellers located at a particular distance from the airport and under the dominant flight paths is much higher than the average annual risk for any location at the same distance from the airport. More simply stated, a person located directly under the dominant flight paths say 1 mile from an airport is exposed to much higher risk than a person located a mile from an airport but away from the dominant flight paths.

Specifically, a comparison of the annual individual probability of fatality (P F ) contours computed for the Cork and Dublin airports and Figure 7 of Thompson et al shows about two orders of magnitude difference: directly under the dominant take-off and landing flight paths Davies and Quinn estimated 1E-6 P F contours extend well beyond five miles from the runway, where the Thompson data indicates P F levels flatten out below 1E-8. Therefore, the average ground dweller risks posed by aviation based on Thompson et al underestimate the actual risks posed to ground dwellers directly under the dominant take-off and landing flight paths.

Thompson et al made projections of the annual involuntary risk to people on the ground from U.S. civil aviation accidents in the years 2000, 2005, 2010, and 2015. Based on the decreasing trend noted in the number of involuntarily exposed people killed on the ground by civil aviation accidents between 1964 and 1999, the projected increases in the number of airport operations and the U.S. population, the results suggest that the collective risk will remain fairly constant in that period, increasing from 3.8 expected fatalities in 2005 to 4.3 expected fatalities in 2015. Thompson et al found that the uncertainty in these projections is a less important factor than the variability due to distance from an airport. Therefore, these estimates of the risk to

5-58ground dwellers posed by U.S. civil aviation are not expected to change much over the next ten

years.

The risk of fatality alone is not an optimal measure of public risk. Therefore, ACTA analyzed data acquired from the NTSB on injuries (both minor and serious as defined in 49 CFR 830.2) and fatalities for people on the ground from civil aviation accidents for the 20 year period between 1984 and 2003. The NTSB data shows that aviation accidents produce an average of about two to three times as many casualties as fatalities. As shown in Table 5-28, the average ratio of 2.5 casualties to fatalities on the ground from civil aviation accidents is somewhat constant over the years (the 99.87 upper bound values are based on year to year variations) and applies to general aviation (relatively small airplanes) as well as commercial airline accidents. In this case, the number of casualties was computed by adding the number of serious injuries, as defined in 49 CFR 830.2, to the number of fatalities reported by the NTSB. This ratio is close to the average of predictions made for failures of expendable launch vehicles

as shown in Table 5-29 . All of these expected casualty predictions were based on Abbreviated Injury Scale (AIS) 3 or greater, including fatality.

TABLE 5-28. RATIO OF GROUND CASUA LTIES TO GROUND FATALITIES

BASED ON 20 YEARS OF NTSB DATA FROM 1984 THROUGH 2003

Aviation Category Average 99.87 Percentile Upper Bound

All U.S. Civil (Part 91, 121 and 135) 2.5 5.4
Airlines (Part 121) 2.0 5.9
General Aviation (Part 91) 2.7 5.4

The results in Thompson et al indicate that the risk to people involuntarily exposed to civil aviation accidents is substantially higher for people who dwell near airports. The average annual individual risk of casualty from civil aviation accidents for people that dwell within five miles of a top 100 airport was (roughly) estimated at 1E-7. This estimate was formed by extrapolating the results presented by Thompson et al that showed about a third of the total collective risk of fatalities was borne by people dwelling within about five miles of a top 100 airport in the year 2000, and the ratio of about three casualties to fatalities on the ground from civil aviation accidents observed in the data acquired from the NTSB.

The data acquired from the NTSB provides evidence to bolster confidence in the estimate of about 3.5 fatalities a year between 2005 and 2015 for people involuntarily exposed to risk from civil aviation accidents across the entire U.S. The data acquired from the NTSB shows about 17 casualties as an annual average for all types of civil aviation during the four years from 2000 to 2003, including those that Thompson et al would consider voluntarily exposed but excluding all casualties due to intentional acts (such as the terrorist attacks in 2001). A comparison of the data in Figure 1 from Thom pson et al on fatalities for people involuntarily exposed to the data acquired from the NTSB re sults in a ratio of about two between total fatalities on the ground from civil aviation accident s and those for people involuntarily exposed. Dividing the 17 casualties recorded on average for the four years from 2000 to 2003 by two produces an estimate of 8.5 casualties for people involuntarily exposed. Dividing 8.5 by 2.5, the

5-59ratio of casualties to fatalities on the ground from civil aviation accidents, results in an estimated 3.4 fatalities for people involuntarily exposed, which is remarkably close to the projection of 3.5 expected fatalities listed for the year 2000 in Table IV of Thompson et al.

TABLE 5-29. RATIO OF EXPECTED CASUALTIES AND EXPECTED

FATALITIES COMPUTED BY LARA FOR VARIOUS MISSIONS

Date Analysis Name Mode* Ef/Ec

11/10/2003 Delta IV ER-GTO MT 0.37

11/10/2003 Delta IV ER-GTO OT 0.71

11/25/2003 Atlas IIAS EOS-WR MT 0.10

11/25/2003 Atlas IIAS EOS-WR OT 0.11

02/13/2004 Falcon 1 normal fragment list MT 0.56

02/13/2004 Falcon 1 normal fragment list OT 0.57

02/13/2004 Falcon 1 Intact Vehicle MT 0.12

02/13/2004 Falcon 1 Intact Vehicle OT 0.12

02/16/2004 Delta IV medium +(4,2) mean Dec wind MT 0.15

02/16/2004 Delta IV medium +(4,2) mean Dec wind OT 0.10

02/19/2004 Delta IV medium +(4,2) mean Oct wind MT 0.15

04/09/2004 Delta II Gravity Probe B 21-Quick Mean Winds MT 0.21

04/09/2004 Delta II Gravity Probe B 21-Quick Mean Winds OT 0.24

08/10/2005 90% SW winds part of 21-Quick for Atlas V 411 MT 0.55

08/11/2005 90% SW winds part of 21-Quick for Atlas V 411 OT 0.54

08/19/2005 Mean November wind 21-Quick for Atlas V 411 MT 0.32

08/20/2005 Mean November wind 21-Quick for Atlas V 411 OT 0.30

11/16/2005 Atlas V 431 Prelim Baseline MT 0.63

11/16/2005 Atlas V 431 Prelim Baseline OT 0.63

08/16/2003 W4413 BV-6 (OBV) T-3 hour OT 0.27

08/17/2003 W4413 BV-6 (OBV) T-3 hour MT 0.25

12/02/2003 W4430 Atlas IIAS T-6 hour OT 0.23

12/02/2003 W4430 Atlas IIAS T-6 hour MT 0.12

04/20/2004 W6642 Delta 2 7920 Gravity Probe-B T-6 hour MT 0.19

04/20/2004 W6642 Delta 2 7920 Gravity Probe-B T-6 hour OT 0.14

05/20/2004 W7711 Taurus XL Roaksat-2 T-3 hour OT 0.54

05/20/2004 W7711 Taurus XL Rocsat-2 T-3 hour MT 0.19

07/14/2004 W1988 Delta II 7920 AURA Day 3 T-6 hour MT 0.16

07/14/2004 W1988 Delta II 7920 AURA Day 3 T-6 hour OT 0.05

05/20/2005 W3838 Delta II NOAA T-6 MT 0.35

05/20/2005 W3838 Delta II NOAA T-6 OT 0.59

10/04/2005 W7817 Delta IV Medium+(4,2) L-1 OT 0.64

10/04/2005 W7817 Delta IV Medium+(4,2) L-1 MT 0.63

Average 0.33

* OT means On-Trajectory failure mode , and MFT means malfunction turn failure mode

5-60Experience with orbital expendable launch vehicles at the federal launch ranges demonstrates that launch area risks are typically limited to approximately 300,000 people near the launch point. 87 In addition, experience with the fli ghts of SpaceShipOne, the only suborbital reusable launch vehicle flights to date, indicates that the risks were borne by approximately 300,000 people (Reference 5ee ). Of course, far fewer than 300,000 people bear the majority of the total public risk from typical launches. However, aviation risks to ground dwellers are also disproportionately borne by those under the dominant flight paths used for take-off and landing. Multiplying the average risk of fatality for individuals involuntarily exposed to civil aviation accidents within five miles of top 100 airports in the year 2000 (i.e. 3E-8) by 300,000 people equates to a collective risks of about 0.01 fatalities and 0.03 casualties per year. Therefore, a collective risk of no greater than 0.03 casualties per year for the general public is a reasonable safety goal for spaceflight because a representative sample of about 300,000 people that dwell within five miles of a top 100 airport appear to be exposed to a comparable risk due to civil aviation over-flight . For the same reasons, a collective risk of no greater than 0.01 fatalities per year for involuntarily exposed people is a reasonable safety goal for spaceflight activities.

While aviation risks can be estimated using empirical data on the number of people seriously injured or killed on the ground, the risks posed by range activities are predictions based on computational models, typically fraught with more uncertainty than the empirical data on aviation risks. To ensure that range activities pose a collective risk of no greater than 0.03 casualties per year (or 0.01 fatalities per year) for people involuntarily exposed, it is prudent to make a reasonable allowance for the uncertainty present in range safety risk predictions. The risk assessment process described in Chapter 2 of this Supplement takes steps to minimize this uncertainty. Nevertheless, with all of the uncertainties in the process, a one-order-of-magnitude (factor of ten) degree of uncertainty probably re mains in any calculation. Although there is little data available to substantiate that estimate, recent efforts also indicate that any expected casualty estimate for launch probably has at the very least plus or minus an one-order-of-magnitude of uncertainty (Reference 5ff ). Therefore, a reasonable allowance for the uncertainty inherent in range safety risk predictions suggests that the annual risk criteria for range activities should be at least ten times lower than the risks estimated for aviation over-flight based on empirical data. Furthermore, the standard risk criteria have been set to the nearest factor of three (approximately one-half order of magnitude on a logarithmic scale) . Further refinement is not warranted due to the lack of precision in range safety risk predictions.

The foregoing analysis demonstrates that limiting the collective risks to the general public from range activities to no greater than 0.003 casualties and 0.001 fatalities per year is reasonable and rational because a representative sample of about 300,000 people that dwell within five miles of a top 100 airport in the U.S. are exposed to comparable risks. The same logic used in previous versions of the RCC 321 Standard can be used to link these annual collective risk criteria to per mission criteria. Specifically, using an average of 30 missions per year these annual limits correspond to 100E-6 expected casualties and 30E-5 expected fatalities.

87 See Reference 5t (Table 1 on page 6 and Table 7 on page 20).

5-61A previous ACTA analysis of the risk from gene ral aviation accidents to people in the vicinity of the Cape Canaveral Air Station (CCAS) provides additional evidence on the estimated background risk to people on the ground from civil aviation in the U.S. (Reference 5t ). Specifically, Philipson estimated a minimum of 0.018 expected casualties on the ground annually from general aviation accidents in an area with a total population of about 267,000 people. This result appears roughly consistent with the forgoing estimate that all civil aviation over-flight poses a collective risk of about 0.03 expected casualties per year for a group of 300,000 involuntarily exposed people that dwell within five miles of a Top 100 airport.

5-625.9 References for Chapter 5

a. Federal Register, Vol. 67, No. 146, 30 July 2002, pages 49461, 49462, and 49465.

b. Federal Register, Vol. 51, August 21, 1986, page 28044

c. Cohrssen, J.J. and V.T. Covello, Risk Analysis: A Guide to Principle and Methods for Analyzing Health and Environmental Risks, Council on Environmental Quality, 1989.

d. Motor Vehicle Manufacturers Association v. State Farm Mutual Auto. Ins. Co. 463 U.S. 29, at 42-57, 103 S. Ct. 2856 (1983)

e. Illinois Public Telecommunications Association v. FCC, 117 F.3d 555, 564 (D.C. Cir. 1997)

f. Federal Register, Vol. 64, No. 76, April 21, 1999, pages 19605 & 19606

g. Federal Aviation Administration, Department of Transportation, 14 CFR Parts 401, 406, 413, 415, 417 Licensing and Safety Requirements for Launch; Final Rule , Federal Register, Vol 71, No. 165, August 25, 2006

h. Fulton and Robinson, Benchmark Public Risk Levels for Australian Space Launch Activities, August 2000, http://www.industry.gov.au/library/content_library/Benchmarkpublicrisks.pdf

i. Thompson K.M, Rabouw R.F, and Cooke R.M, The Risk of Groundling Fatalities from

Unintentional Plane Crashes , Risk Analysis, Vol. 21, No 6, 2001
j. Wilde et al, Investigation of Risk Acceptability for Experimental Permit Regulation Development , ACTA Report. No. 06-527/10.1-01, 2006

k. Evans et al, Third Party Risk Near Airport and Public Safety Zone Policy, R&D Rept. 9636, National Air Traffic Services Limited, London, June 1997

l. Davies and Quinn, Public Safety Zones: Cork, Dublin, and Shannon Airports, February 2005, pages 5, B1, B2.

m. Federal Register, Vol. 65, No. 207, 25 October 2000, page 63936

n. Starr, C., “Societal Benefit versus Technological Risk,” Science, Vol 165, pp.1232-38,

1969.

o. Appendix A.6, “Federal Agency Risk Assessment and Risk Management Practices”, prepared by Dr. L. Rhomberg of the Center for Risk Analysis at the Harvard School of Public Health in Commission on Risk Assessment and Risk Management, 1996. Risk Assessment and Risk Management in Regulatory Decision Making, June 13, 1996.

p. Statutes include: the Federal Food, Drug, and Cosmetic Act (FFDCA) by the Food and Drug Administration (FDA); the Occupational Safety and Health Act (OSHA) by the Department of Labor; the Administrative Procedures Act; the Consumer Product Safety Act (CPSA) and the Federal Health and Safety Act (FHSA) by the Consumer Product Safety Commission; as well as seven standards promulgated by the EPA: Clean Air Act (CAA), Clean Water Act/Federal Water Pollution Control Act (CWA), Safe Drinking Water Act/Public Health Service Act (SDWA), Resource Conservation and Recovery Act/amending Solid Waste Disposal Act (RCRA), Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA), Toxic Substance Control Act (TSCA), and Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA).

5-63q. Travis, C. C., S. Richter, E. Crouch, R. Wilson, and E. Klema, "Cancer Risk Management: A Review of 132 Federal Regul atory Decisions", Environmental Science and Technology, Vol. 21, No. 5, 1987 pp. 415-420.

r. National Transportation Safety Board, "Annual Re view of Aircraft Accident Data: U.S. Air Carrier Operations Calendar Year 1990,” PB94-102787.

s. Philipson, L. and D. Hoefer, “Comparative Public Risks Due to Military Aircraft Operations”, J. H. Wiggins Company Tec hnical Report 82-3093, Prepared for WSMC/SE under Contract FO4703-79-C-004, September, 1982.

t. Philipson, L., “Refined Estimate of the Risk from Aviation Accidents to the Population in the CCAS Area of Concern”, ACTA Technical Report 94/297/46-01, ACTA, Inc., Torrance, CA, 1994.

u. Rasbah, D. J., “Criteria for Acceptability fo r Use with Quantitative Approaches to Fire Safety”, presented at the Fire Prevention for Industry and Trade, BVD, Symposium of Fire Protection Concepts, Zurich, March 12-14, 1984, and “Criteria for Decisions on Acceptability of Major Fire and Explosion H azards with Particular Reference to the Chemical and Fuel Industries”, I. Chem. E. Symposium Series No. 58.

v. R. Skjong, “Risk Acceptance Criteria: Current Proposal and IMO Position,” Conference Proceedings from Valencia, Spain 4-6 June 2002.

w. T. Hardy, “Risk Perception and Communication in Commercial Reusable Launch Vehicle Operations,” presented at the 1st IAASS Safety Conference, Nice, FR, October 25-

27, 2005

.

x. V. Covello and P. Sandman. "Risk communication: Evolution and Revolution," in Wolbarst A. (ed.) Solutions to an Environment in Peril. Baltimore, MD: John Hopkins University Press (2001): 164-178.

y. National Transportation Safety Board, Safety Report: Survivability of Accidents Involving Part 121 US Air Carrier Operations, 1983 through 2000 , NTSB/SR-01/01
March 5, 2001.

z. Federal Aviation Administration, Advisory Circular No. 39-8, Continued Airworthiness Assessments of Powerplants and Auxiliary Power Unit Installations of Transport Category Planes, Washington, DC, September 2003.

aa. National Transportation Safety Board, “NTSB Aviation Accident/Incident Database,” http://nasdac.faa.gov/lib , February 1999 (4 March 1999).

bb. Federal Aviation Administration, Statistical Handbook of Aviation, http://www.bts.gov/ntda/shafaa , May 1999 (5 March 1999).

cc. Van Suetendael R,, et al., Accommodating Commercial Space Operations in the National Airspace System, Journal of Air Traffic Control, Vol. 47, No. 3, July-September 2005.

dd. Vanem, E. and Skjong, R. (2004) “Collision and Grounding of Passenger Ships – Risk Assessment and Emergency Evacuations ,” from International Congress on Collision and Grounding of Ships, ICCGS 2004, Izu, Japan, 25–27 October 2004.

ee. Larson E., Quantitative Public Risk Analysis for SpaceShipOne, ACTA # 04-527/1,

12/2004.

ff. Collins J, et al, Development of Risk Profiles and Risk Uncertainty Models for Application to Launch Risk Analysis – FY05 Activity , Report No. 05-551/5.4-02, September 2005.

5-64

### CHAPTER 6

HAZARD THRESHOLDS

Characterization of human vulnerability to the hazards associated with launch and flight is a critical element in risk analysis and risk management. It requires addressing the vulnerability of unsheltered people to the various hazards as well as characterizing the effects of these hazards on buildings and other structures. The vulnerability of humans, buildings, and other structures is an evolving field of study, and publishing a single set of vulnerability curves could stifle innovation in this important element of flight safety analysis. Therefore, while previous editions of RCC 321 have published vulnerability curves for hazardous debris, the Risk Committee has determined that it better serves the interest of the national ranges to replace the vulnerability curves with a set of consensus threshold values. The threshold values included in this chapter are intended to allow analysts to perform conservative risk estimates. Analysts should verify the suitability of these thresholds for other applications such as containment before using them for those applications. When a flight safety analyst has access to valid vulnerability relationships, allowing a more refined analysis, these relationships should be used in place of the thresholds published in this chapter. 88

The material in this chapter is organized as follows. The first section clarifies the meaning and intended use of hazard thresholds. The second section presents hazard thresholds for unsheltered persons. The third section provides hazard thresholds for people inside of buildings, ships and aircraft. As applicable, separate subsections are devoted to fragment hazards and explosive overpressure hazards. In each subsection, terms are defined and hazard thresholds are cited. Each subsection also includes an explanation of how thresholds were determined with appropriate references for methodology, supporting data, and/or supporting practices.

The scope of this chapter is limited to hazard thresholds. Chapter 2 of this Supplement provides guidelines for the overall risk management process. Chapter 7 discusses approaches

and considerations for debris risk assessment models.

6.1 Defining Criteria for Hazard Thresholds

6.1.1 Threshold Philosophy . Thresholds have been determined that represent a “low probability” of the adverse outcomes being addressed. In a perfect world, the term “low probability” would be quantified with a value such as 1 percent. Unfortunately, this is at best, an approximation in the real world. Purely empirical models are frequently limited by the size of the data samples. Very large sample sizes are required to confidently report a 1 percent value. Analytic methods draw on a combination of e ngineering models and reasonable statistical

88 Flight safety analysts choosing to use the fatality curves published in earlie r versions of RCC 321 must assure that their intended application is consistent with the assumpti ons used in developing these curves. Notable assumptions for the fatality curves were that all debris weighs less than two pounds and that populati ons at risk are reasonably represented by median adult males. Analysts employing other numerical criteria published in previous versions of RCC 321 should verify that these numbers are still credible in the light of improved understanding of structural vulnerability.

6-1assumptions. Exact values for low percentile points are critically dependent on the statistical assumptions. Alternative, equally credible assumptions about probability distributions can change a value from a 1 percent to a 5 percent or to a 0.1 percent value.

The threshold values provided in this chapter can be used to define consequences in a simplistic (tier 1) manner in order to provide conservative risk estimates. Risk analysis can be conducted using a two-tiered approach. The tier 1 approach allows an analyst to initially employ relatively simple metrics to establish a casualty (or other consequence) from a hazard threshold. For example, the tier 1 approach would count any person as a casualty if they are predicted to be impacted above the threshold values. If the range determines that the result of the tier 1 analysis demonstrates adequate safety, no further analysis is required within conservative assumptions. However, if the tier 1 analysis indicates excessive risks, then a potential alternative to risk mitigation is implementing a tier 2 approach. The tier 2 approach replaces the hazard thresholds with valid vulnerability models. In general, the thresholds presented herein that should be used

are:

a. To determine if a more sophisticated analysis is warranted.

b. As an alternative when higher-fidelity models are unavailable.

c. As an alternative when the quality of the data available to support the analysis is so low that an additional margin of safety is prudent.

6.1.2 Hazard Generation and Uncertainty . Hazards may be generated by planned events or by malfunctioning systems. Examples of planned events which produce hazards include jettisons of hardware, weapon system engagements, and boosters/rockets that produce toxic exhaust. Most hazards associated with malfunctions begin with an event that produces hazardous fragments ranging in size from intact vehicles down to small fragments. Following the initial hazard producing event, there are frequently a series of events that modify the nature of the original hazard or generate secondary hazards. These events range from additional fragmentation through explosions and events that release toxic vapor, particulates, or aerosols.

Hazard generating events occur in a dynamic environment. The initial conditions for each subsequent event are dependent on the previous event(s) and the propagation of the hazard through the atmosphere. Moreover, the ground impact of fragments with attached solid propellant, contained liquid propellant, or ordnance, may result in an explosion generating a

blast wave and/or a release of toxic materials.

Uncertainties are associated with each step of this process, beginning with the initial generation of a hazardous event and continuing the propagation of each related hazard through the subsequent hazardous events, and ultimately to people or property at risk. The hazard thresholds characterized in this section relate to the threats generated by inert debris and blast waves. It is useful to group the uncertainties into a group associated with the hazard level and uncertainties associated with the people or structures at risk. This introductory material addresses hazard level uncertainty; discussions of some of the uncertainties associated with the people or structures at risk are presented in each applicable subsection.

6-2The hazard level uncertainty at each receptor depends on the uncertainties in each step of hazard generation and propagation as well as the uncertainty associated with the hazard propagations. Fragment catalogs for all classes of debris generating events are known to contain significant levels of uncertainty. Although there are important differences among the different types of fragment generating events, most fragment catalogs share several common

characteristics:

a. Time dependency of fragmentation is eith er neglected or highly simplified. For example, there may be an initial fragmentation followed by secondary fragmentation when explosive fragments hit the ground.

b. Catalog development typically begins with defining those factors that are known with confidence. Subsequent steps involve choices the analyst makes among various credible assumptions. Discrete values and probability distributions consistent with the limited known information and the assumptions are then used to build the fragment catalogs. There is rarely a single credible choice for an assumption.

c. Formulation of the catalog development analysis is strongly biased by the catalog developer’s prior experience with predicting fragmentation and the prior data requirements of the fragment list users with whom the catalog developer worked. This affects a number of important choices such as whether to model a particular variable by providing selected statistics, discrete values or probability distributions and which specific fragment characteristics to model.

How the flight safety analyst sees these uncertainties, and his options to evaluate their implications, depends both on the methodology em ployed by the fragment catalog developer and the risk analysis tools available to the flight safe ty analyst. Some risk analysis tools are designed to employ discrete lists of well-specified frag ments. Other tools employ combinations of discrete values together with probability distributions for other values. This uncertainty is frequently expressed by flight safety analysts in two distinct ways. First, uncertainty may be expressed in the values characterizing a fragme nt or group of fragments based on the assumption that the particular fragment catalog, as a whole, is correct. Second, uncertainty can be accounted for with the definition of alternative fragment catalogs. Alternative fragment catalogs recognize that frequently there are alternative credible breakup patterns for the missile or rocket. When alternative credible fragment catalogs can be identified, they can each be evaluated against the hazard criteria. The flight safety analyst may then choose to compute a weighted average of the resulting risks or use a bounding analysis as deemed appropriate. This approach can also be used to explore known biases or data limitations in the methodologies on which the catalog was

based.

The use of threshold criteria is sensitive to both the individual fragment characteristics as well as the characteristics of the fragment catalog. A critical parameter is the number of pieces of debris above the threshold mass (especially for aircraft). A related parameter is the mass distribution of pieces. This parameter, in conjunction with fragment drag characteristics, determines fragment impact kinetic energy. Fr agment projected area and fragment materials are also important parameters. Most of the structural vulnerability thresholds are keyed to conservative assumptions about fragment shape and density.

6-3In addition to the uncertainty in characteristics of impacting fragments, human vulnerability can be affected by fragment protru sions and lacerating edges. Fragment catalogs typically do not report this type of information and it is not practical to predict either fragment impact orientations or the state of rotational motion at time of body impact.

Blast wave hazards are typically characterized by the pressure and positive impulse (the area under the initial positive portion of a pressure versus time curve 89 ) at a receptor. The uncertainties at the receptor arise from the uncertainty in the effective yield of the explosion, uncertainty in the propagation resulting from atmospheric effects and terrain effects, and uncertainty in local amplification at the receptor by terrain and structures.

6.2 Unsheltered People

This section presents hazard thresholds for two hazards. They are fragment hazards and blast hazards. Within the boundaries of a range, people at risk are typically able-bodied adults. Outside the range, people potentially exposed often include people of all ages and physical conditions. Consequently, it is vital that threshold criteria be designed to protect a diverse population in terms of ages and physical conditions.

Hazard thresholds presented are values above which people are treated as experiencing particular levels of injury. Thus, a blunt trauma casualty threshold should be interpreted as meaning that a person struck by a fragment with kinetic energy above the threshold becomes a casualty. As discussed in Chapter 7 of this Supplement, the determination of the area within which a person is vulnerable depends on the dimensions of a person and the dimensions of the fragment.

As an initial approximation outside of the immediate launch area, most debris impacts are nearly vertical. Under these circumstances, exposed persons are typically represented as having a circular vulnerable region with a one-foot radius.

Table 6-1 summarizes the injury thresholds for people presented in this section.

TABLE 6-1. INJURY THRESHOLDS

Hazard Mechanism Injury Level Threshold Value

Blunt trauma Casualty 11 ft-lb

Blunt trauma Fatality 25 ft-lb

Chunky penetration Casualty 34 ft-lb/in 2

Overpressure Casualty 2 psi

6.2.1 Fragment Hazards . When a fragment impacts the human body, body segments are accelerated and portions of the body segments ma y be deflected. Excessive acceleration of body

89 See Figure 6-5

.

6-4organs or excessive body deformations cause injuries known as blunt trauma . Fragments impacting directly over a fragile organ, such as the liver, can cause localized blunt trauma

. Heavy fragments can crush body segments between the fragments and a rigid object such as the ground or a wall. Threshold impact kinetic energi es to protect against blunt trauma and crushing injuries are governed by levels required to protect against blunt trauma.

Penetrating injuries can result from relatively small, compact high-speed blunt fragments such as a bullet (chunky penetration) striking the body. These impacts injure by penetrating the body wall and depositing energy in the tissue. Glass shards and ragged metal may cause lacerating penetration injuries. Most commonly, these laceration injury levels are dependent on the orientation of the impacting fragment with respect to the body surface.

a. Blunt Trauma and Crushing Injuries . The threshold criterion for protection against blunt trauma and crushing injuries is 11 ft-lb impact kinetic energy. This criterion is designed to afford protection against injury levels of an Abbreviated Injury Scale (AIS) of level 3 or worse. The threshold criterion for protection against blunt trauma and crushing fatalities is 25 ft-lb impact kinetic energy. (1) Development of the Hazard Thresholds . The 11 ft-lb criterion is based on precedent and upon models of human vulnerability demonstrating the effectiveness of the chosen level as a screening criterion.

The national ranges have used a variety of criteria to determine that an impacting fragment is hazardous. Some of these have been based on impact kinetic energy, some of them have been based on the ballistic coefficient of an impacting fragment, some of them have been based on higher fidelity injury modeling. The 11 ft-lb impact kinetic energy criterion is the lower bound of all previously used criteria. Moreover, in a number of cases this value was used to protect against all levels of injuries. FAA/AST published a Notice of Proposed Rule Making (Reference 6a ) that adopted 11 ft-lb as a threshold criterion for all

commercial launches.

The 25 ft-lb lethality threshold was derived from the lethality curves by body part presented in Feinstein (Reference 6f ). Feinstein presents 10 percent, 50 percent, and 90 percent fatality curves by body part. These curves were previously interpreted as representing points on a lognormal probability distribution and used to derive the RCC 321-97 (Reference 6b ) lethality curves. The one percent point on the RCC lethality curves for standing adult male persons is 18.5 ft-lb; the 1 percent point average of sitting, standing and prone positions

is 21.7 ft-lb.

Careful review of RCC 321-97 shows a si gnificant modeling error. Standing persons are treated as having more than a 40 percent probability of being impacted in the thorax by vertically falling fragments. This error arose by treating impacts to the shoulders as impacts to the thorax. Horizontal impacts to the thorax pose a serious threat of fatality. By contrast, vertical impacts to the shoulders are one of the least threatening impacts to produce fatalities.

6-5Using the conservative assumption that the vertical impacts are dominated by the vulnerability of the head would result in a 1 percent threshold for adult males of 28 ft-lb. The treatment of the head as the most vulnerable body part is also appropriate for seated persons. Prone persons would have significant exposure to the thorax. For certain fragment weights, Feinstein shows the thorax to be more vulnerable at the 1 percent threshold. Nevertheless, only a small portion of the exposed population is in a full prone position. When prone persons represent a significant portion of the population, a more stringent criterion of 16 ft-lb should be used as the 1 percent threshold for adult males.

Data provided in Reference 6d suggests that overall 1 percent population thresholds can be estimated as seven-eighths of the adult male threshold. The 25 ft-lb fatality threshold was computed on this basis. (The same logic would provide a 14 ft-lb fatality threshold when prone persons dominate the exposure.)

An additional important source of conservatism for standing persons is that the casualty area/fatality area computation in Chapter 7 treats the entire exposed area of the person as being as vulnerable as the head. (2) Confidence in Model s. While kinetic energy by itself is not necessarily a good predictor of injury, blunt trauma injury is strongly dependent on the mass ( m ) and velocity ( v ) of the fragment. No single simple function of mass and velocity correlates well with injury for all fragment weights. This has been recognized for

some time. Reference 6f shows several weight regimes for injury modeling. The proposed measures for predicting injury are of the form mv x

. The exponent of the velocity depends on the fragment mass. A major reason why no single function of mass and velocity applies universally is that body response to an impact, not impacting fragment characteristics, causes injury. Excessive displacement of organs and strains within tissues cause damage. Nevertheless, for the purpose of establishing an injury threshold, impact kinetic energy is a valid and available quantity. The 11 ft-lb threshold provide s a significant but reasonable amount of conservatism in protecting against blunt trauma and crushing injuries (Reference 6c ).

Figure 6-1 compares the proposed threshold value of 11 ft-lb to the predicted probability of casualty from blunt trauma injuries for the general public (a mixed population of adults and children) (Reference 6d ). Impacts on the head (vertically), thorax, and abdomen (horizontally) are shown for various fragment weights. In all cases, the 11 ft-lb criterion is at or below the threshold of injury predicted by the models. Although only one set of model results is illustrated here, this conclusion is supported by the human vulnerability modeling community (References 6e

, 6f , and 6g ).

6-60 20 40 60 80 100

0 5 10 15 20 25 Velocity (ft/s)Probability of Casualty (%)

Head (Model)
Thorax (Model)
Abdomen (Model)

11 ft-lb threshold 1000 lb Fragment

0 20 40 60 80 100

0 5 10 15 20 25 30 Velocity (ft/s)Probability of Casualty (%)

Head (Model)
Thorax (Model)
Abdomen (Model)

11 ft-lb threshold 80 lb Fragment 0 20 40 60 80 100

0 10 20 30 40 50 6 Velocity (ft/s)Probability of Casualty (%)

0 Head (Model)
Thorax (Model)
Abdomen (Model)

11 ft-lb threshold 10 lb Fragment

0 20 40 60 80 100

0 50 100 150 200 250 Velocity (ft/s)Probability of Casualty (%)

Head (Model)
Thorax (Model)
Abdomen (Model)

11 ft-lb threshold 1 lb Fragment

Figure 6-1. Eleven (11) ft-lb criterion compared to probability of casualty curves for the general public.

Figure 6-2 shows that in addition to providing threshold level protection for all of the general public, the 11 ft-lb criterion provides significant protection for children. The figure compares the 11 ft-lb threshold with selected injury models and sample data points including impacting golf balls, baseballs and a small fragment from the skin of a destroyed vehicle. The modeled injury curves have a probability of approximately 75 percent of resulting in an injury severity level of the labeled AIS level and approximately 25 percent of the next higher AIS level. The chart shows AIS level 3 for a median adult male and AIS levels 1, 2 and 3 for a one-year old child. The curves for a child are shown to provide an indication of the conservatism of the criterion. The curves for a one-year old child are based on modeling only the mass of a one year old. No adjustment has been made for the difference in injury level that a child receives as a result of a given body part response (e.g., head acceleration) in comparison to an adult. Therefore, these curves should be interpreted as indicative of the conservatism of the criterion rather than to be taken as literally predicting the injury level. Nevertheless, the curves in Figure 6-2 for one-year olds indicate that the 11 ft-lb criterion “protects” the child against the AIS level 3 injuries for most of the range of weights and for lesser injuries for the larger weights.

6-71 10 100 1000

0.1 1 10 100 Weight (lb)Velocity (fps) 11 foot-pounds

1 year old, blunt trauma, AIS = 1

1 year old, blunt trauma, AIS = 2

1 year old, blunt trauma, AIS = 3

Median adult male, blunt trauma, AIS = 3

Golf Ball (Terminal Velocity)

Golf Ball (Propelled)

Baseball (Terminal Velocity)

Baseball (Fastball)

Small skin fragment (Terminal Velocity)

Figure 6-2. Comparison of 11 ft-lb criterion with injury models and sample data points.

(3) Effect of Input Data Uncertainty . Input data includes fragment characterization and characterization of persons at risk. Uncertainty associated with the impacting fragment was discussed in paragraph 6.1.2 . It is not generally possible to know the type of person who might be hit, other than on a statistical basis. While the 11 ft-lb criterion is believed to offer reasonably adequate protection even for small children, it is much less conservative for small children than it is for adults. Moreover, blunt trauma is one of several possible injury mechanisms as noted in paragraph 6.2.1 . Each fragment should be evaluated for all of the relevant injury

mechanisms.

b. Chunky Penetrating Injuries . Penetration injuries require two conditions. First, the fragment must penetrate the protective combination of clothing and skin. Second, having penetrated the clothing and skin protecting the tissue, the fragment must possess sufficient residual energy to cause significant damage to internal tissue or organs. Fragments with a small contact area have a greater chance of penetrating the protective layer about the body. However, once the skin has been fully penetrated, fragments with small effective cross-sections can pass through the body without transferring significant energy levels to the surrounding tissue. Nevertheless, impact kinetic energy per contact area of the fragment is the best single parameter predictor of the onset of significant injury.

The threshold criterion for protection against non-lacerating penetration injuries is a kinetic energy to area ratio of 34 ft-lb/in 2

. (1) Development of the Hazard Thresholds . Essentially all simplified models of penetrating injuries are based on the ratio of the impact kinetic energy, E, of the fragment to the area, A, presented by the fragment. Where models differ significantly, however, is in the definition of the area A . In some cases, A is the average cross sectional area of the fragment, while in others, it is a smaller initial

6-8contact area. This leads to a large variation in the reported value of energy-toarea ( E/A) statistics.

Table 6-2 displays the reported median and threshold values for E/A for various levels of penetration (skin penetration or casualty), with various amounts of protection (light clothing, bare skin) from a variety of sources (References 6h

, 6i

, and 6j ).

TABLE 6-2. REPORTED ENERGY/AREA VALUES FOR PENETRATING

INJURIES

Type of Value Consequence Protection E/A (ft-lb/in 2 )

Median Skin Penetration Bare skin 40-109

Median Skin Penetration Light Clothing 80

Median Casualty Light Clothing 85

Threshold Skin Penetration Bare skin 10-64

Threshold Casualty Light Clothing 34

The threshold value for casualty is of primary interest. A threshold E/A of

34 ft-lb/in 2 is reported for casualty-level injuries (AIS ≥ 3) for persons with light clothing protection. Only Sturdivan (Reference 6h and Reference 6i ) reports values for casualties. This value is, broadly speaking, consistent with the conservative end of the range of reported values for skin penetration. Additionally, the FAA (Reference 6k ) considered a value of 40 ft-lb/in 2 as part of a proposed rule. (2) Confidence in Models . This E/A value for probability of casualty with light clothing is conservative, as it is below some of the reported thresholds for bare skin penetration. Reasons for the conservatism might include a somewhat different experimental setup leading to di fferences in the data, actual differences in the model or analysis, or differences in the definition of A

.

The definition of A used in Sturdivan, et al (Reference 6i ) is the average cross sectional area, which is a larger value than if A were defined as an initial contact area. A larger value of A obviously leads to a smaller value of E/A . This is advantageous for two reasons. First, the average cross sectional area is far easier to estimate than the initial contact area for a generic fragment, and is likely to be the area actually used in computing E/A for breakup lists, whether or not it was used in the underlying vulnerability model. Second, in setting threshold values, a conservative approach is desirable to insure that the at-risk population is adequately protected, and this value meets that standard as well.

Thus, the value 34 ft-lb/in 2 appears reasonable.

6-9(3) Effect of Input Data Uncertainty . There are a few caveats, however, as some of the input parameters could affect the threshold. No consideration has been given to the possibility of greater sensitivities of children, the aged, and the infirm populations. For skin penetration only, there is not expected to be significant differences due to youth, though the elderly might be slightly more susceptible. For the injury after skin penetration, children might be more susceptible to intrusion by a fragment of a given size than an adult. For example, their internal organs are closer together, so a fragment of a fixed size which might impact a single organ in an adult is conceivably more likely to impact multiple organs in a very small child. The direct impact of organs, however, is not explicitly accounted for in this model, just the energy deposited in the tissue. Thus, this threshold criterion is likely to be less conservative for populations of children.

Additionally, for populations with signifi cantly different levels of clothing protection (such as extreme tropical or equatorial populations), this threshold

criterion is less conservative.

As mentioned above, the differences in fragment presented area and how it is measured have an effect on the threshold. Using an area measurement of only the contact area would yield larger values of E/A. Moreover, fragments of different characteristics (e.g., compliance, shape, etc.) are expected to vary significantly in the threat posed as will the location on the body of the impact.

6.2.2 Blast Hazards . Blast hazards represent a second mechanical injury hazard. The explosive safety community refers to the air-blast injuries produced by the direct effect of the shock wave on the body as “ primary ” injuries. The acceleration of the body wall by the shock wave transmits shock waves into closed body cavities. The imparted energy is dissipated at

interfaces between tissue and air or different tissu e types having different densities. This energy dissipation produces damage to tissue. Typical primary injuries include damage to the ear, damage to the larynx, damage to the gastro-intestinal tract, and damage to the lungs. Injuries produced by fragments of the explosive device or debris from the environment are called

“ secondary” injuries and injuries produced by the gross displacement of the body by the blast overpressures and subsequent impact on hard or sharp parts of the environment are called

“ tertiary” injuries (Reference 6l ). This section addresses primary injuries. Secondary injuries are addressed by the section on fragment injury.

The threshold criterion for protection against air-blast overpressure injuries is 2 psi incident overpressure. This threshold is designed to protect against primary injuries. The

threshold does not address secondary and tertiary injuries.

It is broadly accepted in the national range community that protection against eardrum rupture should define the air-blast overpressure threshold. Nevertheless, published values range from 2 psi (Reference 6m ) to 5 psi (Reference 6n ). The 2 psi value was adopted as the most recent published value and the most conservative. All of these values are asserted to be 1 percent probability of effect thresholds. Moreover, essentially all overpressure vulnerability

6-10models are based on common sets of test data. Variations in threshold are ascribed to how the data has been analyzed and modeled.

In order to place this threshold in context, Table 6-3 lists sensitivities to overpressure for various body parts.

TABLE 6-3. BODY PART SENSITIVITY TO OVERPRESSURE

Organ Threshold (1%) Overpressure (psi) Median Overpressure (psi)

Middle/inner ear 90 0.2 1

Eardrum 2 15
Larynx 6 10

Gastro-Intestinal Tract 8 12
Lungs 11 16

As noted above, the conservative approach of using a lower bound estimate of 1 percent thresholds was used in developing the overpressure criterion. Nevertheless, no consideration has been made for possible greater sensitivities of children, the aged and the infirm. Body mass differences are expected to be an important factor in the susceptibility of children’s organs in the abdomen and the thorax. It is not expected that body mass differences will be important in determining eardrum susceptibility. The pliability of the tissue constituting the eardrum may, by contrast, be quite variable in these other population groups. It is speculated that the eardrum would be more pliable among young people and more rigid and thinner among older or infirm populations. Additionally, some have suggested that the size of the ear cavity should affect the eardrum response to overpressure waves.

Thus, while the threshold is conservative, extra precautions might be considered when populations at risk are expected to include signi ficant numbers of elderly or infirm persons. Very low overpressures are highly sensitive to variations in propagation conditions, uncertainty in characterizing source terms, and terrain conditions. While the 2 psi overpressure is at the low end of air-blast overpressures, it is high enough so these factors are not expected to dominate.

6.3 Sheltered People

Kinetic energy thresholds for buildings and transportation system structures are thresholds for penetrating the protective structure. Thus, a fragment may deplete all of its kinetic energy in the act of penetrating the structure or it may have residual kinetic energy after penetrating the structure. Conservatively, an analyst may consider all fragments that penetrate the structure as hazardous. Alternatively, the analyst may add to the residual kinetic energy after structural penetration the kinetic energy the fragment acquires falling to a level/height at which it can reach a person. The hazard from any secondary fragments formed during the penetration

90 Middle/inner ear injury thresholds have been included for completeness although they are regarded as less severe injuries.

6-11process must also be considered. The kinetic energy of primary and secondary fragments may be compared with the thresholds for injuring people.

6.3.1 Buildings

a. Fragment Hazards . Hazard thresholds for building structures are based on the conservatively estimated minimum hazard which can penetrate the roof of the building. Even at the threshold level there is more than an order of magnitude variation between the least vulnerable and the most vulnerable structures. Thus, to

limit the excess conservatism contained in the threshold values it was desirable to categorize structures. Consistency with fundamental models would require a classification based on roof characteristics. However, this approach would result in building classes that would be difficult to use by a flight safety analyst. Instead, four different building classes have been defined that more directly relate to the type of information that may be available to an analyst from community planning maps,

census data and similar sources:

Class A

• Mobile homes and trailers.

• Temporary office trailers.

Class B

• Single family dwellings.

• Duplex and fourplex residential dwellings.

• Small condominiums and townhouses.

• Small apartment buildings.

Class C

• Small retail commercial buildings (gas stations, stores, restaurants, strip malls).

• Small office and medical office buildings.

Class D

• Manufacturing plants.

• Warehouses.

• Public buildings (large shopping malls, large office buildings, large apartment buildings, hotels, etc.).

These building classes were then translated into the structural roof types. Typically, this resulted in more than one structural type for a given class of buildings as indicated below. Finally, the weakest structural type (designated by asterisks) within each class was chosen, conservatively, to represent that class of buildings.

6-12Class A

• 22 gage corrugated steel roof .

• 24 gage corrugated aluminum roof.*

• 1⁄2 inch plywood roof.

Class B

• Wood roof*.

Class C

• Composite roof (rigid insulation on steel).*

• Corrugated steel roof (pre-engineered metal building type roof).

• Light weight concrete on corrugated steel decking roof.

Class D

• Light weight concrete on corrugated steel decking roof.*

• Reinforced concrete slab roof.

Penetration threshold values for the four classes of buildings described above are shown in Table 6-4. Table 6-4 shows the building category by class and weakest construction, and penetration thresholds in terms of the minimum kinetic impact energy of a compact, irregularly shaped, tumbling steel fragment (C D = 0.75) impacting the roof at terminal velocity at 5,000 feet

MSL 91 . Fragment weights corresponding to the minimu m kinetic energy for penetration are also listed to assist the analyst in interpreting the criteria. Steel was selected as the basis for these calculations because it is the densest of the most common fragment materials.

TABLE 6-4. THRESHOLD VALUES FOR ROOF PENETRATION

Building category Penetration Criteria

Generic

Class Roof

Construction Minimum Weight Fragment (lb) Minimum Kinetic Energy (ft-lb)

A 24 gage corrugated aluminum 0.037 17

B 5/8 inch plywood 0.075 30

C Composite roof (2 inch rigid gypsum insulation on steel purlines) 0.075 30

D 3 1⁄2 inch Light weight concrete on 22 gage corrugated steel decking 0.500 414

(1) Development of the Hazard Thresholds . The values presented in Table 6-4 are based on structural vulnerability models (Reference 6x

, 6y , and 6kk ) demonstrating the effectiveness of these levels as screening criteria. Fragment impact kinetic energy thresholds for buildings (roof penetration) were computed based on compact fragments having the density of steel impacting the roof vertically at terminal velocity for 5,000 feet MSL. A nominal drag coefficient of 0.75 was assumed for irregular-shaped tumbling fragments. “Compact

91 An impact altitude of 5,000 feet MSL was selected to be representative of impact altitudes over inland ranges. When applied to a coastal range it represen ts an additional source of conservatism.

6-13fragments” are defined as fragments having relatively small surface area-tovolume ratios. These computations include several levels of conservatism:

• Threshold values for roof penetration were conservatively selected in lieu of threshold values for injury given roof penetration. The impact kinetic energy to penetrate a roof depends on the shape and density of the fragment, the construction of the roof and the impact geometry. Fragments impacting a roof in the region between supporting beams require less kinetic energy to penetrate the roof than fragments impacting over supporting structure.

• The weakest structural type within a building class was chosen to represent that class of building.

• Steel, the densest common fragment material, was used for the calculations. (2) Confidence in Models . Confidence in the models used to obtain the threshold values given in Table 6-4 was established in a recently conducted verification and

validation effort 92 (Reference 6z ). Following completion of the verification effort, validation of the models was conducted by comparing analytically predicted results with available experimental data from recently conducted tests (References 6aa and 6ii ). Independent validation of the analytical model was performed by Karagozian and Case, structural engineers (Reference 6jj ).

Tests with both steel and concrete impactors (fragments) were conducted against concrete and wood targets. Impacting objects consisted of steel and concrete spheres of various sizes fired against the targets at various speeds. These tests support the effectiveness of the Table 6-4 values as screening criteria. For many of the test cases the model and the test results agree. Whenever the model disagrees with the test results, the model is conservative. In other words, it predicts penetration for a case for which no penetration was observed.

Finally, the use of threshold penetration values as risk criteria ignores any tolerance by the human body to insult. The net effect of compounding conservatisms in the fragment characteristics, roof penetration models and human injury models is what may be considered very conservative results. This level of conservatism is necessary to ensure safety in situations where more specific data

is unavailable. (3) Effect of Input Data Uncertainty on Application of Model . Input data uncertainty is associated with the impacting fragment and with the roof model, the former being the larger (See paragraph 6.1.2 ).

The uncertainty associated with the input parameters of roof structures has been investigated (Reference 6s ), but so far only for steel frame buildings. In this case, variations in design configuration as well as material properties were considered. For present purposes, where penetration energy thresholds are of interest, it is primarily the uncertainty in the material properties of the roof plates

92 Verification is defined as ensuring th at the mathematical algorithms comprisi ng the models are solved correctly in a numerical sense, while validation is defined as ensuri ng that the mathematical m odels themselves correctly represent the physics of the intended applications.

6-14that affect the penetration energy threshold. For corrugated steel decking, the coefficient of variation was found to be approximately 22 percent, implying a 22 percent coefficient of variation on penetration energy for the plate shear failure

mode.

These relatively small uncertainties are considered to be more than offset by the conservative assumptions on the fragment characteristics (compact steel fragments) and roof penetration models used to estimate threshold penetration

values.

b. Blast Hazards . When the front of an air blast wave strikes the face of a structure, reflection occurs as shown in Figure 6-3. As a result, the building surface facing the explosion experiences overpressure levels at least twice that of the free-field (commonly call side-on) wave front. The re flected shock front propagates back into the air in all directions with the high pressure region expanding outward towards regions of lower pressure.

Point of Explosion

Blast Over-pressure

The violent rise in air pressure above normal atmospheric

pressure. Reflected Pressure

The amount of pressure felt by an object standing directly in the path of an expanding blast

wave. Side-on Pressure

The impulse of pressure undergone by an object as a blast wave envelopes and passes it. Drag (Suction)

The negative pressure effect felt

on the rear face of a structure as a blast wave moves away from the building. Point of Explosion

Blast Over-pressure

The violent rise in air pressure above normal atmospheric

pressure. Reflected Pressure

The amount of pressure felt by an object standing directly in the path of an expanding blast

wave. Side-on Pressure

The impulse of pressure undergone by an object as a blast wave envelopes and passes it. Drag (Suction)

The negative pressure effect felt

on the rear face of a structure as a blast wave moves away from the building.

Drag (Dynamic Pressure)

The forces acting on the building faces as a result
of the blast wind Side-On Pressure

The forces acting on the building surfaces that do not face the explosion Reflected Pressure

The amplified forces acting on the building surfaces directly facing the explosion Blast Overpressure

The violent rise in air pressure above the normal atmospheric

pressure

Figure 6-3. Air blast impacting a structure.

As the blast wave front continues to move forward, the reflected overpressure on the face on the structure quickly drops back to the level without reflection plus an added drag force associated with the wind (dynamic) pressure caused by acceleration of the air mass. The wave front then bends, or “diffracts,” around the structure as shown in Figure 6-4 (see part b through part e).

6-15Figure 6-4. Diffraction of blast fr ont across structure (looking down).

In (b), the wave front has just reached the front face and will be reflected back. In (c), the blast wave has proceeded half way down the structure and in (d) has just passed the rear of the structure. At this time, the pressure on the front face has dropped to some extent while the pressure begins to build up on the back face. Finally in (e), when the blast front has passed the structure, approximately equal pressures are exerted on the sides and top and a pressure differential exists between

the front and back faces due to wind forces.

The pressure differential between the front and back faces has its maximum value when the blast wave has not completely surrounded the structure producing a lateral (or translational) force that tends to deflect the structure in the same direction as the blast wave. This force is known as the “diffraction loading” because it operates while the blast wave is being diffracted around th e structure. The extent of diffraction loading is strongly dependent on the size/geometry of the structure.

When the blast wave has engulfed the structure, the pressure differential is small and the loading is then almost entirely due to the “drag pressure” exerted on the building by the blast wind. The actual pressures on all faces of the structure are in excess of ambient but decrease steadily until the positive phase of the blast wave has ended (see Figure 6-5 ). Hence, the diffraction loading on a structure (without openings) is eventually replaced by an inward compression (squeezing action) combined with the dynamic pressure of the blast wave.

Diffraction and drag loads acting on a structure can result in significant damage (and even collapse) resulting in injuries to occupants from thrown debris, flying glass shards, and structural collapse. The levels of structural/window damage and injuries are functions of both the peak overpressure (amplitude) and impulse (area under the pressure versus time curve over the positive phase duration) of the blast wave shown in Figure 6-5

.

6-16Figure 6-5. Free-field blast wave overpressure time history.

Large footprint buildings with small windows and door areas and fairly strong exterior walls respond mainly to diffraction loading (the effect of the shock front moving across the building). For small structures or structures with many openings, however, the pressures on different faces (or individual structural elements) from diffraction forces act for only a short time and are quickly equalized. These “drag sensitive” structures respond primarily to the drag forces whose magnitudes correlates with the duration (or impulse) of the blast wave. Drag sensitive structures include television and electric transmission towers, utility poles, smokestacks and steel buildings with light walls of asbestos, aluminum, or corrugated steel. (Some steel buildings can become drag sensitive because of the failure of the walls at low overpressure that result in many openings.)

Window breakage is primarily the result of overpressure loading from the diffraction of the blast wave around the structure. Once a window fails, the differential pressure acting on the shards (t he diffracted plus dynamic pressure acting on one side and atmospheric pressure on the interior of the structure) accelerates them inward until the pressure equalizes on the shards or the blast wave dies out. The velocity imparted to glass fragments and their potential to injury occupants is therefore strongly dependent on the impulse, or duration, of the blast wave.

6-17Based on the above discussion, the threshold criteria for protection against building damage and injury 93 to its occupants due to blast waves is broken into three
parts: (1) When buildings have no windows, the threshold criterion is 1 psi incident (or free-field) overpressure at a distance measured from the center of the explosive source to the nearest point on the structure.

Note : When buildings have a significant amount of glazed area 94 , the threshold criterion depends on the impulse of the blast wave, or equivalently, the yield of the explosion as follows: (2) For yields ≤ 50,000 pounds equivalent Trinitrotoluene (TNT) yield: Threshold criterion = 0.50 psi incident overpressure. (3) For yields > 50,000 pounds equivalent TNT yield: Threshold criterion = 0.25 psi

overpressure.

The one psi threshold criterion defined for structural damage is consistent with the Department of Defense Explosive Safety Board’s guideline for the distance buildings (without windows) must be sited from an explosive source for air blast effects (Reference 6p ). The lower overpressure criteria for structures with windows, 0.5 psi and 0.25 psi, were set to ensure a low probability of serious injuries due to glass breakage for TNT equivalent yields of up to 50,000 pounds and above 50,000 pounds, respectively.

The air blast threshold criteria defined above are conservative estimates of the overpressure levels at which the onset of serious injuries occur based on available accident and controlled test data. For example, the 1 psi free-field (incident) overpressure threshold level for structural damage is shown overlaid in Figure 6-6 on a overpressure-impulse (P-I) diagram model developed for a small wood frame structure (~2500 square feet). Also superimposed on the damage P-I diagram are accident and test data gathered from several different sources relating to the blast damage of lightly constructed structures. The numbers in the small circles indicate the percent damage estimated for lightly constructed structures (structures vulnerable to air blast) exposed to the air blast from conventional bombs and nuclear explosions. Also shown along the axes of the P-I diagram are regions of expected damage from other researchers. The red lines running diagonally across the P-I diagram represent the overpressure and impulse for various size TNT explosions (although not shown, the lower P-I values are explosions farther from the receptor while the higher P-I values are for closer in explosions). Recognizing the significant variability that is reflected in the data due to construction, geometry, and blast loading, the damage P-I diagram is in general agreement with these data. At the 1 psi threshold, there is little chance of structural damage and therefore virtually no chance of serious injuries from structural damage as shown by the serious injury P-I diagram in Figure 6-7

.

93 Protection against injury is intended to be a protection against severe injury or casualties (AIS ≥ 3).

94 The threshold presented for buildings with windows is intended to be applied only for buildings with low densities of exposed populations. It is to be used only for direct overpressure loading; it is not to be applied to Distant Focusing Overpressure analyses.

6-18Figure 6-8 and Figure 6-9 show P-I diagrams for the probability of breakage and serious injury for large, annealed (weaker) glass windows. Overlaid on these diagrams are the 0.25 psi and 0.5 psi threshold levels for explosions with equivalent TNT weights of >50,000 lbs and <50,000 lbs, respectively. Figure 6-8 and Figure 6-9 indicate that although a significant percentage of these large and relatively weak windows could break, shards that enter the room are unlikely to present a hazard to occupants. Although incident overpressure is used as a convenient metric for these diagrams, the results account for the effects of reflected overpressures predicted for building walls. These physics-based P-I breakage and injury models are consistent with observed data. For example, Figure 6-9 shows the overpressure levels below which there were no recorded glass-related serious injuries from the Khobar and Oklahoma City bombings. More detailed comparisons show good agreement between these computational predictions and the evidence from historical events (such as Khobar Towers and Oklahoma City explosions), and DoD test data (Reference 6hh ). The 0.5 psi threshold for explosions <50,000 lbs of TNT conservatively falls below these two data points. Also note that the 0.5 psi threshold becomes more conservative for smaller TNT weights.

As stated above, the threshold side-on overpressure levels (also called incident or free-field levels - those measured at the location of interest but neglecting the presence of the structure) were conservatively set to essentially eliminate the probability of serious injuries for the most vulnerable building and window types. In practical situations, an explosion can affect people in a large area and occupants will be distributed across many building types and each building type could have various numbers, types, and sizes of windows. To more accurately estimate the probability of serious injury, air blast models are available (such as the P-I diagrams shown in Figure 6-6 through Figure 6-9 ). These models estimate the full range of occupant injury for different generic structure and window types (Reference 6q ).

Application of these thresholds uses two types of input data. The first is the characterization of the blast loading and the second is the characterization of the buildings at risk. The thresholds have been formulated so that the only critical building characteristic is the presence of windows. When there is uncertainty as to whether buildings have windows, the analyst should conservatively assume windows are present. Larger uncertainties are associated with the explosive yield and explosive overpressure. The analyst is advised to consider the effects of terrain, buildings and meteorological conditions on overpressure levels.

6-19Figure 6-6. Structural damage due to air blast impacting lightly constructed structures.

Figure 6-7. Serious injury due to air blast impacting lightly constructed structures. TNT Wt,

(lb)

10.000 100.000 1000.000

0.100 1.000 10.000 100.000

Incident Overpressure (psi)Incident Impulse (psi-msec) Prob of Casualty (%) SERIOUS INJURY

0.1 Small Residential

Wood Frame House 0.5

1.0

5.0

10.0

20.0

30.0

5000K 40.0

50.0

60.0

70.0

80.0 500K

90.0

100.0

50K

5K

1K

6-20Figure 6-8. Breakage due to air blast impacting large, annealed windows

Figure 6-9. Serious injury due to air blast impacting large, annealed windows. TNT Wt,

(lb)

10 100 1000

0.1 1.0 10.0

Incident Overpressure (psi)Incident Impulse (psi-msec)

TNT Wt, (lb) Prob of Breakage (%)

1

10

30

50

70

90

100 WINDOW BREAKAGE Large Annealed Glass

5000K

500K

50K

5K

1K 0.25

0.5

10 100 1000

0.1 1.0 10.0

Incident Overpressure (psi)Incident Impulse (psi-msec) Prob of Casualty (%)

0.01

0.10

1.00

5.00

10.00

12.00

SERIOUS INJURY Large Annealed Glass (Unblocked GAR = 14.5%) 5K 50K 500K 5000K

1K 0.25

0.5 Khobar (26,000 lb TNT) – no SI below 0.9 psi

OK Cit y (4,000 lb TNT) – no SI below 2 psi

6-216.3.2 Ships . Hazard thresholds for ships were designed to protect against fragments penetrating ship cabin or deckhouse roofs. As in the case of buildings, the threshold levels vary by more than an order of magnitude between the least vulnerable and the most vulnerable types. Thus, to reduce the conservatism, different thresholds were developed for various categories of ships. Consistency with the underlying models would require a classification based on roof characteristics. This approach would produce ship structural classes that would be difficult to use by a flight safety analyst. Instead, five diffe rent ship classes are defined that more directly relate to the type of information that may be available to an analyst: the length of ships. The following length categories include the types of ships indicated below each category:

Ships less than 25 feet in length

• Small fishing vessels

• Small pleasure craft Ships 25 to 50 feet in length

• Small to medium size fishing vessels

• Small to medium size pleasure craft Ships 50 to 100 feet in length

• Medium sized fishing vessels

• Medium sized pleasure craft

• Tug boats Ships 100 to 300 feet in length

• Large fishing vessels

• Large pleasure craft

• Coast Guard patrol ships Ships greater than 300 feet in length

• Container ships

• Tankers 95

• Other cargo ships

• Pleasure cruise ships 96

• Military ships

While the foregoing classification of ship categories is based on the length of the vessel, fragment penetration vulnerability is more directly related to the construction material and thickness of the cabin/deckhouse roof. Design guides drawn from the American Bureau of Shipping (ABS) rules and other trade publications (References 6r through 6v ) show that the

choice of construction material and thickness for the cabin/deckhouse roof are related to size.

95 LNG tankers are designed and built to the requirements specific for such vessels, in addition to those in the Rules for Building and Classing Steel Vessels. If there are any di fferences in the deckhouse roof thickness (and none are expected according to the Guide for Building and Classing Membrane Tank L NG Vessels) the requirements for the deckhouse on a LNG tanker are expected to be more stringent than those for a general steel vessel. However, the consequences may be more catastrophic considering the fire a nd explosion hazards.

96 The penetration thresholds for steel vessels apply to passenger cruise ships. The ABS Guide for Building and Classing Passenger Vessels (Reference 6t ) refers to the Rules for Building and Classing Steel Vessels for scantling requirements of the deckhouse. However, a cruise ship typically has a significant number of the passengers out in the open areas. The protection criterion for unsheltere d persons should be app lied to these passengers.

6-22For this reason, the fragment impact hazard thresholds were evaluated for both the length of the vessel and roof construction material. Typically, this resulted in more than one structural material type for a given length category as illustrated in Figure 6-10 and the list that follows.

Figure 6-10. Hull materials for vessels of different lengths.

Ships less than 25 feet in length

• No roof is assumed

• Use risk for unsheltered people Ships 25 to 50 feet in length

• Wood*

• Fiber reinforced plastic (FRP) Ships 50 to 100 feet in length

• Wood*

• Fiber reinforced plastic

• Steel HSC (high speed craft)

• Steel DISP (displacement craft) Ships 100 to 300 feet in length

• Steel HSC (high speed craft)

• Steel DISP (displacement craft)* Ships greater than 300 feet in length

• Steel*

Finally, the weakest structural material type within a category was chosen, conservatively, to represent that category of ships. These structural material types are indicated by the asterisks in the itemized list above.

6-23Penetration threshold values for the five ship length categories described above are shown in Table 6-5. Table 6-5 shows the ship category by length and weakest construction, and penetration thresholds in terms of the minimum kinetic impact energy of a compact, irregularly shaped, tumbling steel fragment (C D = 0.75) impacting the roof at terminal velocity at mean sea level (MSL). Fragment weights corresponding to the minimum kinetic energy for penetration are also listed to assist analysts in interpreting the criteria. Steel was again selected as the fragment material for these calculations because it is the densest of the most common fragment

materials.

TABLE 6-5. THRESHOLD VALUES FOR SHIP CABIN AND DECKHOUSE ROOF

PENETRATION

Ship Category Penetration Criteria

Generic Class of Ship Roof

Material Minimum Weight Fragment (lb) Minimum Kinetic Energy (ft-lb)

< 25 ft No roof is assumed Use criteria for unsheltered persons

25-50 ft 1/2 inch plywood 0.050 19

50-100 ft 3/4 inch plywood 0.121 63

100-300 ft 0.13 inch steel 2.5 3,000

> 300 ft 0.20 inch steel 5.8 9,500

The thicknesses for fiber reinforced plastic (FRP) and wood roofs were calculated using the scantling rules provided in (Reference 6r ); the thicknesses for the steel roofs for vessels of 100 ft to 300 ft in length are based on the minimum required thickness in the ABS Guide for Building and Classing Motor Pleasure Yachts (Reference 6s ); the minimum roof thickness for steel vessels with a length of 300 ft or more was taken from the ABS Rules for Building and Classing Steel Vessels Under 90 Meters in Length (Reference 6u ) to be conservative.

a. Development of the Hazard Thresholds . Fragment impact kinetic energy thresholds for roof penetration are based on compact steel fragments impacting the roof vertically at terminal velocity for the particular fragment at MSL. A nominal drag coefficient of 0.75 was assumed for irregular-shaped tumbling fragments. “Compact fragments” are defined as fragments having relatively small surface area-to-volume ratios. These computations include several levels of conservatism: (1) Threshold values for roof penetration were conservatively selected in lieu of threshold values for injury given roof penetration. The impact kinetic energy to penetrate a roof depends on the shape and density of the fragment, the construction of the roof, and the impact geometry. Fragments impacting between support beams require less kinetic energy to penetrate the roof than fragments impacting over supporting structure. Moreover, vertically impacting fragments typically require less kinetic energy to penetrate than do fragments impacting at some lesser angle. (2) The weakest structural type within a ship class was chosen to represent that class of ships.

6-24(3) Steel, the densest common fragment material, was used for the calculations.

b. Confidence in Models . Confidence in the steel plate penetration model used to obtain the critical penetration kinetic energies shown in Table 6-5 is based on comparative

studies documented in References 6ll

, 6mm , and 6nn . These studies compared various empirical models with published test data and with nonlinear finite element

calculations.

Confidence in the wood model (drawn from Reference 6y ) was established via comparison with test data.

For the penetration of steel plate targets, the Stanford Research Institute (SRI) and the Ballistics Research Laboratory (BRL) equations have been widely used. Comparisons with several sets of experimental data show that the BRL equation gives reasonable agreement with all of them, while the performance of the SRI equation is less satisfactory (Reference 6w ). The BRL equation has been used to establish the penetration thresholds for steel roofs in Table 6-5

.

c. Level of Conservatism in Threshold Values . There are two types of input data uncertainty to consider; they are input data uncertainty associated with the impacting fragment and the uncertainty associated with the roof model, with the former being the larger (See paragraph 6.1.2 ).

Consistent with the level of simplification, significant uncertainties and inaccuracy are to be expected when aggregating dozens of vessel length/construction combinations into the five generic classes and in the characterization of the impacting fragments. The uncertainties and inaccuracy are dealt with through conservative assumptions in the development of the thresholds, including assumptions made in the determination of the vessel scantlings, the characterization of the fragments, and the derivation of the penetration models. Considering all these factors together, the final

thresholds are believed to contain a level of conservatism commensurate with the intended purpose.

6.3.3 Aircraft . The consequences of fragments impacting aircraft range from just barely noticeable on ground inspection to catastrophic. Factors determining the consequences include fragment mass, fragment shape and material, frag ment impact velocity vector, aircraft type, aircraft velocity vector, location, and geometry of the impact. In contrast to ships and ground based receptors, aircraft velocities may contribute significantly to the relative velocity of a fragment with respect to the aircraft and, hence, to the impact kinetic energy. Moreover, aircraft are complex systems with some parts that may be relatively easily damaged by small dense rigid debris (such as metal parts of a fragmented missile).

Aircraft vary significantly in their vulnerability. Some parts of an aircraft are critical to flight while other parts are not, and some portions are more easily damaged by debris than others. In addition, there is significant varia tion between the types of aircraft (helicopters, airplanes), size (two orders of magnitude), and the purpose for which they were designed

6-25(military, passenger transport, private use). The differences are manifested in many ways, such as different systems (engines, control, pressurization, etc.), locations of systems (fuel tank, control lines, etc.) materials used in construction (skin type, wi ndshield type, support structures, etc.), and reliability (military planes are designed to survive attack and passenger planes have significant redundancy, whereas general aviation has much lower levels of protection).

a. Primary Aircraft Vulnerability Thresholds . As a result of the complexity of the problem, the original version of RCC 321 published criteria based on the most vulnerable systems of the most vulnerable aircraft. This offered the advantage of simplicity at the cost of being much more conservative than necessary for some other aircraft classes. When these classes are most likely to be hazarded, unnecessary protection may be applied to them, limiting missions and/or increasing cost significantly.

These early versions of RCC 321 determined that a screening standard should be based on protecting the windshields of general aviation airplanes and protecting small turboshaft piston engines with axial flow compressors. Such engines were cited as being used to power small aircraft and helicopters such as the Bell Jet Ranger. Criteria were defined based on FATEPEN2 (an empirical code) analyses of windshields and expert opinion evaluations of the vulnerability of the piston engines and the windshield of general aviation planes (Reference 6bb ). Based on this study, conservative threshold fragment mass criteria applicable to any aircraft were developed (Reference 6cc ), as follows: (1) Tungsten debris: 0.5 g (2) Steel debris: 1 g (3) Aluminum debris: >1 g

These thresholds were based on defining the minimum mass piece that could cause failure of a piston engine (which theref ore could lead to loss of the aircraft) and the minimum mass piece that could penetrate a windshield (which could incapacitate the pilot, leading to loss of the aircraft).

Since very little debris is tungsten, a “1 gram compact fragment” has traditionally been used as the threshold for hazard to aircraft. Some analysts have treated low density fragments separately. These protection approaches remain appropriate for all aircraft with the exception of large commercial transport aircraft unless less conservative thresholds can be justified 97

.

97 For example, some military aircraft are hardened to protect against debris and projectiles. Obviously, higher thresholds would apply. However, research has not yet b een performed to determine the appropriate thresholds or to which aircraft they should a pply. Thus, the conservative 1 gram value should still be used.

6-26b. Large Commercial Transport Aircraft

. 98 Large passenger jets (Reference 6dd ) have a high priority for protection. Their size results in a bigger “target” making the probability of impacting them generally higher than for many other planes. Moreover, they carry many passengers so that the consequence of an impact may be very high. However, they are designed to meet strict standards for structural integrity, redundancy of critical system, etc. Therefore, detailed studies have been performed to study their vulnerability. The commercial transport aircraft class is limited to aircraft with all the following characteristics: (1) Aluminum skin (composite skin aircraft have not been studied, nor are yet in production), (2) Multiple turbofan engines, and (3) Governed by the FAA certification requirements of 14 CFR Part 23/25.

A detailed study (Reference 6oo ) produced the following quadratic relationships between the mass of an impacting fragment, m (in grams), and the projected area 99 (in

ft 2 ) of a commercial transport aircraft vulnerable to a casualty producing event (i.e., a single casualty regardless of the occupancy of the aircraft), , and

a catastrophic event, PROJ

CAS A

PROJ

CAT A

Where

2 0.0085 8.5 200 PROJ

CAS A mm = ++

and

2 0.025 4 PROJ

CAT A m m = +

These equations apply to all fragments between 0.05 grams and 300 grams. Fragments below 0.05 grams are not predicted to penetrate any commercial transport skin based on the FAA-JTCG equation for normal impacts. Fragments of at least 300 grams should (1) be assumed to produce a catastrophe for any impact on an aircraft, (2) use the maximum feasible projected area (A PROJ ), 100 and (3) account for the maximum projected fragment area (A FRAG ) as follows:

98 Note to reviewers : The results listed in this document have been cross-validated with empirical data. Peer review by the FAA professionals has not yet been performed.

99 (Reserved)

99 The projected area is the projection of the aircraft surface onto the plane perpendi cular to the impact vector, In terms of plan and front areas and assuming an aircra ft flying horizontally and debris falling vertically, sin( ) cos( ) proj front top AA A θ θ = + , where θ is the angle of the impact vector from the vertical,

i.e.

. 

# ( ) 1 tan / aircraft debris v v θ

− =

101 (Reserved)

102 (Reserved)

100 The maximum feasible projected area should consider a ll possible combinations of aircraft type and fragment impact speed, which is discussed in Paragraph 7.3.3.

6-27

# ( ) 2 proj

CAT PROJ FRAG AAA = +

.

A generally conservative approximation is to neglect the impact angle and fragment size and use the maximum area of the largest aircraft potentially at risk, which is 12,000 ft 2 for a B747.

These simplified generic commercial aircraft vulnerability models (AVMs) are based on the best available information, methods, and reasonably conservative assumptions made in each area where there was no conventional approach or there was un-quantified uncertainty. For example, the impacting object is assumed to be a compact metal fragment such as a solid sphere, solid cube, or a solid cylinder with a small aspect ratio. Also, these model results assume that fragments are falling at speeds near the terminal velocity at aircraft altitudes (which may be twice the terminal velocity at ground level). It is highly likely that the only fragments with significantly higher speeds at aircraft altitudes would also be larger than the criteria specified in all areas of concern. 101 These AVMs were subject to independent review by recognized experts. Thus, these AVMs are considered valid for use in the development of aircraft hazard areas designed to comply with the RCC 321 Standard. However, there remains considerable uncertainty about the results because of the lack of test data on impacts at highly oblique angles, which are clearly important to the vulnerability of commercial transport aircraft.

These AVMs are considered provisional because (see Reference 6oo ): (4) They are based on a version of the empirically derived FAA penetration equation (FAA-JTCG) that was modified by ACTA to account for obliquity in a manner that appears reasonably conservative, yet has not been completely substantiated

due to a lack of test data. (5) While there is sufficient evidence to demonstrate that the FAA penetration equation produces valid results for low obliquity impacts, there are no test data available for the high obliquity angles expected for fragments below 300 grams and the best available analysis demonstrated that the present vulnerability model results are sensitive to the treatment of obliquity. (6) High fidelity numerical models (LS-DYNA) have been developed that produce results consistent with the available test data at low obliquity angles. However, experience with these finite element models indicates that their application in a parameter space devoid of test data produces highly uncertain results near the threshold penetration velocity. (7) The potential for a drastic consequence event associated with potential impacts of

launch vehicle debris on commercial aircraft warrants extreme caution in the

101 Small fragments will normally have low ballistic coeffici ents, producing a sufficiently high drag to weight ratio such that they will slow to speeds near terminal velocity before they could impact aircraft. The only place that

small fragments will have a significantly higher speed than terminal velocity is likely to be in the immediate vicinity of a launch accident or inter cept event, from which it is assumed that aircraft would nor mally be excluded

anyway.

6-28development of safety criteria. Even a single casualty on-board an aircraft due to a launch vehicle debris impact could have enormous repercussions.

Regardless of the vulnerability model or hazard threshold levels used, aircraft hazard areas should be based on the largest aircraft in common use (which is currently the B747) because, (1) it presents the largest vulnerable area of any commercial transport, and thus will define hazard areas that are reasonably expected to provide adequate protection for all other types of commercial transport aircraft, and (2) the best available probabilistic aircraft vulnerability model results indicate that other common types of aircraft (the B757 in particular) can exhibit a higher conditional probability of adverse consequences (given an impact) than the B747 at threshold levels, but the total area susceptible to adverse consequences is always larger for the B747 than those associated with other commercial transport aircraft examined (B737-800, B757m and B767) (Reference 6oo ). No attempt should be made to scale the quadratic vulnerability models presented here for application to other commercial transport aircraft. Instead, it is recommended that the B747 based quadratic equations be applied to all planes in the commercial transport class as defined at the beginning of this section. (8) Development of Aircraft Vulnerability Models . The aircraft vulnerability models presented here are based on an event tree analysis of commerical transport aircraft,, and a combination of empirical equations and physics based numerical simulations of penetration using a finite element code (LS-DYNA).

The event tree analysis examined design practices and FAA regulations to determine which failure modes could occur due to the smallest debris. This analysis, combined with past experience with impacts on this class of aircraft, produced three fundamental conclusions (Reference 6oo ):

• A fuel tank penetration through the top surface of the wing with an area of at least two square inches should be considered a potentially catastrophic event (Reference 6oo ). Another FAA sponsored study reviewed historical accident data and found that fuel tank penetrations, leakage, and “the fires resulting from such leakage can pose great danger to an aircraft structure” (Reference 6pp). Fragment impacts to any part of the fuel system, including specifically the wing fuel tanks appear to have been treated as catastrophic by the FAA’s Uncontained Engine Debris Damage Assessment Model (UEDDAM). 102
Specifically, in the assessment of the vulnerability of a generic twin engine jet to uncontained engine failures, a conservative assumption was made that any fragment penetration of a fuel tank results in a catastrophic consequence (Reference 6qq). However, small penetrations of the fuel lines or tanks are unlikely to produce casualties (or other severe consequences such as hull loss

102 The UEDDAM code was developed to address an industry-FAA need for an analytical tool capable of conducting rotor burst assessment that incorporates fragment penetration, system level hazard assessment, and multiple debris fragments. UEDDAM was developed as a design t ool capable of conducting aircraft configuration trade studies and as certification tool to show compliance with Title 14 Code of Federal Regulations (CFR) 25.903(d)(1). UEDDAM is based on vulne rability assessment codes used in industry during airc raft design and development to minimize the vulnerability of military aircraft to ballistic threats.

6-29or a forced landing) based on FAA guidelines used to assess the continued airworthiness of transport aircraft (Reference 6rr ).

• The potential for a catastrophic outcome from a single launch vehicle debris impact on an engine of a commercially certified aircraft is negligible (Reference 6oo ). This finding is based on the facts that: (1) certified commercial aircraft must be able to continue safe flight following the loss of thrust from any single engine, (2) debris impacts are unlikely to generate a potentially catastrophic condition due to engine fragment throw.

• Historical experience indicates that fr agment impacts from uncontained gas turbine failures often produce “significant damage” without casualty or other serious consequences, even prior to the implementation of FAA design guidelines intended to reduce this threat. Specifically, even prior to implementation of Advisory Circular 20-128A, fragment impacts from uncontained gas turbine engine failures were about six times more likely to produce “significant damage” without casualty than an outcome involving casualties, hull loss, or a crash landing (Reference 6qq ).

The only other failure mode for debris smaller than 300 g that resulted in nontrivial probability of a casualty was a penetration of the fuselage, which could directly injure a crew member or passenger or lead to a non-catastrophic depressurization event (Reference 6oo ).

The aircraft vulnerability models presented here are consistent with the input parameter uncertainties and sensitivities found using the best available techniques (Reference 6oo ). Simulations of penetration also included other sensitivity studies, such as impact location on the aircraft, skin thickness, aircraft velocity and fragment parameters. Although the true extent of the modeling uncertainty contained in the present results is unknown, these results are based on the best available information and reasonably conservative assumptions made in each area where there is no conventional approach or there is un-quantified uncertainty. Since these results are based on the best available information, and are based on analysis that has been independently reviewed, they are deemed appropriate for immediate use. However, ranges should continue to use of the more conservative thresholds already established (i.e. the 1 gram steel cube and others de fined in RCC 321-02) for all other types of aircraft because no attempt has been made to updated the vulnerability models for other aircraft types. It is important to ensure the present AVMs are applied only to aircraft in the correct class. The estimated risk could be significantly under-stated if the commercial transport thresholds are used for aircraft that do not meet the requirements of the class. Applicable aircraft classes are defined in Paragraph

6.3.3.b

. (9) Confidence in Models . To assess the confidence in the thresholds, the shape of the fragment and orientation upon impact were varied. A reasonably conservative (more penetrating) shape was used to develop the present AVMs. It is theoretically possible for a fragment to penetrate with lower mass if the shape and orientation were ideal (such as a thin rod impacting end on). However, this

6-30scenario is considered remote because fragments are generally assumed to be tumbling as they fall.

In addition, the event tree analysis is considered conservative, for the following reasons:

• Some fuel tank penetrations will not be catastrophic.

• Some fuselage penetrations will not cause injury.

• The ballistic resistance of interior wall panels and insulation for the fuselage and cockpit was neglected due to insufficient data.

• Past experience shows that this class of aircraft can land safely after sustaining substantial damage from uncontained engine fragment impacts or even a missile strike (Reference 6dd ).

6-316.4 References for Chapter 6

a. Federal Register, July 30, 2002. Part III Depa rtment of Transportation, Federal Aviation Administration, 14 CFR Parts 413, 415, and 417, Licensing and Safety Requirements for Launch: Proposed Rule.

b. Common Risk Criteria for National Test Ranges: Inert Debris, Supplement to Standard

321-97 , Risk and Lethality Commonality Team, Range Safety Group, Range Commanders Council, February 12, 1997.

c. Haber, J. and H. Der Avanesian, Human Vulnerability to Inert Debris , Minutes of the

29 th Explosive Safety Seminar, July, 2000.

d. Haber, J. M., A. M. Linn, and H. Der Avanessian, Human Vulnerability to Inert Debris

, ACTA Report 05-550/3.1-01, September, 2005.

e. Stuhmiller, J., K. Kan, K. Ho, Interim Total Body Model: A Model of Impact Injury

, Jaycor Technical Report J2997.43-00-107, April 2000.

f. Feinstein, D. et al, Personal Casualty Study , IITRI Project J6067 Final Report, July,

1968.

g. Cooper, G., B. Pearce, M. Stainer, and R. Maynard, The Biomechanical Response Of The Thorax To Nonpenetrating Impact With Particular Reference To Cardiac Injuries, J. Trauma, Vol 22, No. 12, December, 1982.

h. Lewis, J. H., P. A. Coon, V. R. Clare, and L. M. Sturdivan, An Empirical/Mathematical Model to Estimate the Probability of Skin Penetration by Various Projectiles , Technical Report ARCSL-TR-78004, April 1978, Aberdeen Proving Grounds, Maryland.

i. Sturdivan, L. M., A Mathematical Model of Penetration of Chunky Projectiles in a Gelatin Tissue Simulant, Technical Report ARCSL-TR-78055, December 1978, Aberdeen Proving Grounds, Maryland.
j. DiMaio, V. J., Penetration and Perforation of Skin by Bullets and Missiles , The American Journal of Forensic Medicine and Pathology, Vol 2, No. 2, June, 1981.

k. Federal Register, July 30, 2002. Part III Depa rtment of Transportation, Federal Aviation Administration, 14 CFR Parts 413, 415, and 417, Licensing and Safety Requirements for Launch: Proposed Rule.

l. Galbraith, K., Review of Blast Injury Data and Models , Defence Evaluation and Research Agency for the Health and Safety Executive, Contract Research Report 192/1998, Salisbury, Great Britain.

m. Richmond, D. R. et al

, Damage-Risk Criteria for Personnel Exposed to Repeated

AirBlasts , Minutes of the 20 th Explosive Safety Seminar, August, 1982 cited in Montgomery, R. and J. Ward, Facility Damage and Personnel Injury from Explosive Blast, RTI Report RTI/5180/26-08F, April, 1993.

n. Bowen, I.G., E.R. Fletcher, and D. R. Raymond, Estimate of Man’s Tolerance to the Direct Effects of Air Blast, 1968, Technical Progress Report DASA-2113, Defense Atomic Support Agency cited in (Galbraith, 1998).

o. Chrostowski, J., et al, Development of Structure and Vehicle Vulnerability Models FY

2004 Activities , Technical Report No. 04-530/3.2, ACTA, Inc., Torrance, CA, September

2004.

6-32p. DOD 6055.9-STD, “DoD Ammunition and Explosives Safety Standards,” October, 1992.

q. Lambert, R., J. Chrostowski, P. Wilde, and W. Gan, Structure and Vehicle Vulnerability Models For Explosion Overpressure, Technical Report No. 05-550/3.2-01, ACTA, Inc., Torrance, CA, September 2005.

r. Gerr, D., The Elements of Boat Strength , International Marine, Camden, Maine, 2000.

s. ABS Guide for Building and Classing Motor Pleasure Yachts , American Bureau of Shipping, February 2000.

t. ABS Guide for Building and Classing Passenger Vessels , American Bureau of Shipping, February 2001.

u. ABS Rules for Building and Classing Steel Vessels under 90 Meters in Length

, Part 3: Hull Construction and Equipment , American Bureau of Shipping, February 2006.

v. ABS Rules for Building and Classing Steel Vessels

, Part 3: Hull Construction and Equipment , American Bureau of Shipping, February 2006.

w. Jones, N., Low velocity perforation of metal plates, in Shock and Impact on Structures, C.A. Brebbia and V. Sanchez-Galvez, ed., Computational Mechanics Publications, Southampton, UK, 1994.

x. Hasselman, Timothy and Legg, Mark, “Update of Casualty and Fatality Risk Models for Roof Penetration by Inert Debris,” Report No . 00-430/16.4-02, ACTA Inc. Torrance, CA, September 2000.

y. Bogosian, D. D., and Dunn, B. W., “An Analytical Model of Debris Penetration into Conventional Buildings: Hazard Area Computational Kernel (HACK), Version 1.2,” Technical Report No. TR-96-28.1, Karagozia n and Case, Glendale, CA, September 1996.

z. Hasselman, T., Gan, W., Lotatti, I., Wathugala, W., Legg, M., Bogosian, D., and Dunn, B., “Structure and Vehicle Vulnerability Models for Inert Debris,” Technical Report No. 05-550/3.2-02, ACTA Inc., Torrance, CA, September 2005.

aa. J. Tancreto, J. Tatom, and M. Swisdak, Jr., “SPIDER – A Test Program to Determine the Response of Typical Wall and Roof Panels to Debris Impact,” Proceedings of the 31 st
Department of Defense Explosives Safety Seminar, San Antonio, TX., August 2004.

bb. Yateau, J. D., R. H. Zernow and R. F. Recht, Compact Fragment Multiple Plate Penetration Model (FATEPEN2) Volumes 1 and 2 , Applied Research Associates, Inc., prepared for the Naval Surface Warfare Center, Dahlgren, VA. January, 1991.

cc. Cole, J. Kenneth, Larry W. Young, and Terry Jordan-Culler, Hazards of Falling Debris to People, Aircraft, and Watercraft, Sandia National Laboratories, Report SAND97- 0805, April 1997.

dd. Larson, Erik, and Isaac Lottati, Status Report on Investigation of the Vulnerability of Aircraft to Debris from Space Accidents , ACTA Inc, Report No. 05-527/9.4,

December 2006.

ee. Livermore Software Technology Corporation, LS-DYNA (computer program). http://www.lstc.com/

. ff. Manchor, J. and C. Frankenberger. Engine Debris Penetration Testing

, DOT/FAA/AR-99/19.

gg. Lundin S., Engine Debris Fuselage Penetration Testing, Phase I , DOT/FAA/AR-01/27.

6-33hh. Wilde P. and Chrostowski, J, Comparing Explosive and Inert Debris Vulnerability Model

Results to Historical Event Data , ACTA Inc, Report No. 06-527/9.2, June 2006.

ii. “SPIDER 1B Testing Quick-Look Report,” Na val Facilities Engineering Service Center, RBESCT Meeting, Huntsville, AL, November 2004.
jj. D. Bogosian and B. Dunn, “Independent Verification and Validation Assessment of HACK/CF,” TR-05-52.2, Karagozian & Case, Glendale, Ca., September 2005.

kk. Structural Analysis and Design of Nuclear Power Plants , Chapter 6, “Design Against Impact Loads,” ASCE Manual 58.

ll. Baeker, J. L., Philipson, L., and Tran, D., “Offshore Oil Hazards,” J. H. Wiggins Company, Redondo Beach, CA, September 1984.

mm. Hasselman, T. K., Li, X., and Gan, W., “Casualty and Fatality Risk Models for Roof Penetration by Inert Debris,” ACTA, Inc, Torrance, CA, September 1999.

nn. Gan, W., “A Review of Empirical Steel Plate Perforation Formulas,” Interoffice Correspondence, June 2006.

oo. Wilde P., Draper, C. Lottati I., Larson E., and Hasselman T., Vulnerability of Commercial Transport Aircraft to Debris from Space Accidents , ACTA Inc, Report No. 06-527/11.3, April 2007.

pp. Federal Aviation Administration, “The Potential for Fuel Tank Fire and Hydrodynamic Ram from Uncontained Aircraft Engine Debris”, DOT/FAA/AR-96/95, January 1997.

qq. Seng, S., J. Manion, C. Frankenberger, “Unc ontained Engine Debris Analysis Using the Uncontained Engine Debris Damage Assessment Model”, DOT/FAA/AR-04/16, September 2004.

rr. Federal Aviation Administration, Advisory Circular 39-8, available at http://www.airweb.faa.gov/Regulatory_and_Gui dance_Library/rgAdvisoryCircular.nsf/

ss. Federal Aviation Administration, Advisory Circular 20-128A, available at http://www.airweb.faa.gov/Regulatory_and_Gui dance_Library/rgAdvisoryCircular.nsf/

6-34

### CHAPTER 7

APPROACHES AND CONSIDERATIONS FOR DEBRIS RISK ASSESSMENT

MODELS

The purpose of this chapter is to document the important considerations and factors that should be addressed in developing good debris risk assessment models. To do this the overall process of computing debris risks has been broken down into its primary modeling areas. For each of these modeling areas there is a section that describes the function and purpose of the model followed by a discussion of the modeling in terms of the general approach and the considerations and factors to be addressed. For many of the sections, there is also a discussion of the data that may be available for input to the model. Where appropriate, alternative modeling approaches and considerations are presented based on the type of data used.

The intent of this chapter is to provide guidelines for developing good models rather than prescribing specific models or methods. General approaches are discussed to provide guidance to the modeler and to record “lessons learned” over many years of developing debris risk models at the major test ranges.

The models discussed here are those needed to compute the debris impact risks for a given debris generating event such as a vehicle failure scenario or a weapons system debris generating event, such as a target intercept. A vehicle failure scenario is defined to be a specific mode of failure occurring at a specific time of f light and resulting in a specific type of vehicle breakup; this includes the case where the vehicle remains intact to impact. Failure scenarios may include very unlikely events that need to be addressed because of their potential catastrophic

outcome.

Many of the modeling considerations and factors presented in this chapter may not need to be addressed. This will depend on the application of the model, the level of fidelity required, the availability of data, and the time constraints for performing an analysis. For many of the models, alternative modeling approaches are presented, ranging from relatively simplistic to relatively complex, with the complex models generally requiring increased development time, more detailed input data, and increased computation time. The analyst will need to determine the complexity of the models required for his application. In some cases simpler models can, using the appropriate assumptions and input data, lead to conservative (high) estimates of the debris risks and may be sufficient if the resulting levels of risk are acceptable. Also, a range that can achieve a low level of risk by containing debr is within predefined boundaries may be able to employ simple “worst case” models to demonstrate that containment is achieved. Worst case models must address maximum deviations from nominal conditions, malfunctions leading to worst case lateral turns, wind conditions which can push hazardous debris out of the planned containment area, etc. A range that has missions for which debris containment cannot be achieved, and for which the levels of risk can exceed acceptable limits, may need to use more complex models to assure that adequate safety is achieved.

7-1To aid the reader locate material relevant to the area of debris risk assessment modeling of concern, Table 7-1 presents a guide to the co ntent of each of the chapter sections. The table also acts as an outline of the steps in the modeling process.

TABLE 7-1. GUIDE TO CONTENTS OF CHAPTER 7

Para. Modeling Area Notes

7.1 Vehicle Breakup

Debris Models Characterization (weights, sizes, ballistic coefficients, etc.) of the fragments expected to result from vehicle breakup or from a weapons test, such as an intercept. “Debri s” includes an intact vehicle, or component of the vehicle, if no breakup is expected. Breakup can result from abnormal aerodynamic and inertial loads, activation of a flight termination system, weapon system action (intercept, etc.) or reentry heating.

7.2 Debris Dispersion

Models The term “debris dispersions” is used to refer to the variation in the position of a fragment as it falls and at impact (or at a specified altitude). The sources of debris dispersion include variations in the initial breakup state vector due deviations of the vehicle from the nominal (intended) trajectory prior to breakup, and the dynamic effects on the fragments during free fall. Includes a discussion of important considerations for an impact predictor.

7.2.1 Vehicle Normal Trajectory Uncertainty

due to Guidance and

Performance Factors Dispersions due to breakup state vect or variations resulting from normal variations in the vehicle guidance system and motor performance. These variations are within expected lim its and are influenced by various factors such as launch day atmospheric conditions and variations in the thrust achieved by operating motors.

7.2.2 Vehicle Malfunction

Turns Dispersions due to breakup state vector variations resulting from deviations of a vehicle from its intended trajectory following a hardware or software failure (malfunction), including a failure of the vehicle guidance system.

7.2.3 Debris Imparted

Velocities Dispersions due to velocities imparted to vehicle fragments. These imparted velocities can be produced by the explosive charges used in flight termination systems, pressure forces created by an explosion, rupture of a pressurized vessel, rotational motion of the vehicle and/or weapon system events such as a hit-to-kill in tercept.

7.2.4 Fragment Aerodynamic Drag Uncertainty Dispersions due to uncertainty in th e aerodynamic drag force acting on a fragment.

7.2.5 Fragment Aerodynamic

Lift Effects Dispersions due to uncertainty in the aerodynamic lift force acting on a fragment.

7.2.6 Wind Drift and Wind Uncertainty Dispersions due to wind acting on a fragment. Includes both the shift in the position of a fragment during free fall due to the expected wind, and uncertainty due to the uncertainty in the wind.

7.2.7 Free Flight of Inadvertently Separated Thrusting Motors Dispersions due to free flight of inadvertently separated thrusting motors. This affects the dispersions of the debris resulting from the subsequent breakup of a motor (or of the intact motor if no breakup occurs).

7-27.3 Debris Distribution

Models Characterization of the overall uncertainty distribution for fragment position during free fall and at surface impact, accounting for all sources of position uncertainty. Uses the output of the debris dispersion models

discussed in Section 7.2 . The debris distribution models are used to compute probabilities of fragment impact.

7.3.1 Impact Distribution Functions for Multiple Dispersion Sources Generation of two-dimensional impact uncertainty distribution functions to represent multiple sources of debris dispersion.

7.3.2 Scatter Plots for Multiple Dispersion

Sources Generation of two-dimensional scatter plots to represent impact uncertainty due to multiple sources of debris dispersion.

7.3.3 Considerations for

Three-Dimensional

Models Generation of three-dimensional debris position uncertainty distributions. May be required for computation of impact probabilities for an aircraft or a spacecraft following a prescribed flight path.

7.4 Impact Probability

Models Using the distribution models developed in Section 7.3 to compute probabilities of fragment impact ont o populated locations and other assets of concern. The focus is on the computation of impact probabilities using two-dimensional characterizations of debris impactdistributions. (Computation of impact probabilities using threedimensional distributions is addressed in Section 7.3.3 ).

7.5 Modeling for Explosive Fragments Addresses modeling issues specific to the computation of risks for explosive fragments, where hazards result not only from the fragment directly impacting an asset but also from the products of the explosion (explosive loads, ejected secondary debris).

7.5.1 Explosive Yield

Models Prediction of the explosive yield of the impact explosion of a fragment carrying volatile material (liquid propellants, solid propellant, etc.). The yield is expressed in terms of the weight of TNT that would produce an essentially equivalent explosion.

7.5.2 Risk Computation for Explosive Fragments Computation of the risks resulting from blast loads (defined by peak overpressure and impulse) and sec ondary debris generated by an explosion. Includes computation of casualties for people directly exposed to blast loads and indirectly hazarded due to structural damage or collapse and window breakage.

7.6 Vulnerability and Casualty Models Models to predict the level of injury or damage to humans, structures or vehicles due to impact by a fragment or due to blast loads. These models are used to relate probability of impact to expected casualties or

fatalities.

7.6.1 Human Vulnerability

Models Prediction of the probability of human casualty or fatality.

7.6.1a Human Vulnerability to Inert Debris Impact Probability of casualty/fatality due to direct impact by a fragment or by secondary debris.

7.6.1b Human Vulnerability

to Blast Loads Probability of casualty/fatality due to exposure to blast loads (overpressure and impulse).

7.6.2 Model for the Casualty Area for Inert Debris Impact in the Open Area within which an unsheltered person becomes a casualty/fatality due to fragment impact and secondary effects.

7-37.6.3 Structural Vulnerability Models Assessment of damage to structures and prediction of casualties/fatalities for occupants.

7.6.3a Vulnerability modeling for Inert Debris Impact on a

Structure Prediction of casualties/fatalities within a structure due to inert debris penetration.

7.6.3b Vulnerability modeling for Explosive Debris

Blast Loads on

Structures Prediction of casualties/fatalities within a structure due to blast loads acting on the structure.

7.6.4 Ship/Boat Vulnerability Models Vulnerability of ships/boats to inert debris and to explosive debris, and prediction of resulting casualties/fatalities.

7.6.5 Aircraft Vulnerability

Models Vulnerability of aircraft to inert debris impact.

7.7 Models for Casualty Area and Fragment Probability of Casualty Computation of casualty area, or fragment probability of casualty, based on the vulnerability models presented in paragraph 7.6 . These quantities are used in the prediction of casualty/fatality expectation.

7.8 Risk (Casualty/Fatality) Expectation Models Combining the output of the preceding m odels to generate risk estimates (casualty/fatality expectations, individual probability of casualty/fatality). Includes discussion on development of a population library.

7.9 Catastrophic Risk Modeling Addresses methods for predicting and averting potential catastrophic accidents (many casualties/fatalities).

7.10 Risk Prediction Uncertainty Addresses methods for assessing uncertainty in the prediction of casualty/fatality expectation, and implementing this into the decision making process.

Note : Although the resulting debris data is an input to the debris risk models, it is of such fundamental importance, involving challenging modeling considerations, th at it has been given its own section. Other input data items will be discussed, in more general terms, in the specific sections where the data are used in the model(s).

7-47.1 Vehicle Breakup Debris Models

7.1.1 Model Description . If a missile or space vehicle malfunctions, the vehicle may break up spontaneously or it may be destroyed by the safety officer, thereby producing hundreds or thousands of primary components and pieces. In some cases, malfunction or failure may simply mean that the vehicle has strayed outside normal limits. It is also possible that a malfunctioning vehicle will remain intact to impact. For warheads and kinetic-kill vehicles, fragmentation results from a planned event. Precisely how (or even whether) breakup occurs is subject to considerable uncertainty. Although many pieces are inert, breakup may also produce intact (or nearly so) components, propellant tanks with or without propellant, solid-propellant chunks, and high-pressure vessels that may explode or rupture violently upon impact. The character of vehicle breakup is likely to change continuously throughout flight as propellants are consumed and aerodynamic loads change. Breakup characteristics may also be failure-mode dependent. A debris model appropriate for risk computations defines the characterizations of the fragments expected to result from vehicle breakup, including the case where no breakup occurs.

Regardless of whether or how breakup occurs, there are two fragment models of interest:

Model 1 . The breakup model as it exists immediately after failure.

Model 2 . The debris model as it exists upon impact with objects on the ground (open areas, people, structures) and with objects above the ground (aircraft, satellites).

It may require considerable effort to map fragment Model 1 into Model 2. Things to be considered during this mapping include progressi ve breakup (not all fragmentation occurs at the time of failure), propellant utilization or consumption, dynamics associated with burning propellant, whether or not the burning continues within a partially intact motor; aero-thermal effects on inert materials including ablation, and ignition and combustion of energetic materials which survive breakup, and fragment demise (disappearance from the catalog).

The goal of the debris-modeling process is to define the numbers of pieces, weights, sizes, aerodynamic characteristics, and breakup-imparted velocities for the debris produced under all breakup conditions that may pose a risk. Included are characteristics of the debris that influence the behavior of the debris between failure and impact (or other encounter). Results obtained after accounting for all secondary affects include the revised debris catalog at encounter and the corresponding fragment weights, sizes, and residual explosive potential.

In some cases it may be possible to format the detailed debris information for direct input to risk-analysis software. However, the debris lists for some vehicles are extensive, and most risk-analysis software has limitations in the number of debris categories allowed. Additionally, much of the debris may differ in only minor details, thus leading to inefficiency in computations with little gain in accuracy of results. Consequen tly, for the sake of efficiency in computations, and to accommodate limitations in most risk-analysis software, the debris lists are condensed into a smaller number of classes, with all fragments in any one class having similar characteristics. The goal is to develop a set of debris classes so that the hazards associated with

7-5the “mean” piece in a class adequately represent the hazards of each piece in the class. When done properly, the resulting risks are not affected significantly.

7.1.2 Data Sources . When developing debris models for risk estimations, the analyst usually begins with information supplied by the vehicle manufacturer (as listed below). This data may not always be available, so in some cases the analyst will need to develop a debris model using assumptions and data from similar vehicles/components.

a. Description of vehicle and payload : Overview of vehicle with scaled diagram, general arrangement and dimensions of components including alternate and optional components; description of materials used in construction, inert weights and propellant types and weights for every stage and component; nature and purpose of a typical flight or mission of interest

b. Engine and/or Motor data : Including case material (outer case, lining, insulation, thickness, density), descriptions of nozzles and steering mechanisms, descriptions of propellant types and ingredients, propellant density, propellant weights versus time. (1) Solid Motor: Motor core radius (to outer edge of propellant); grain design; internal pressure and web thickness versus time. (2) Liquid Engine: Pumping and pressurization systems and associated stored energy, materials, and pressurization.

c. Description of Flight Termination System (FTS) (command, automatic, separation) : Type of system (terminates thrust, destroys vehicle, induces tumble, etc.), descriptions of all components and activation mechanisms, exact locations of all charges (beginning point, length, gap, endi ng point), descriptions of circumstances for any delays in activation of charges, discussion of whether and under what circumstances destruct might ignite a non-thrusting motor.

d. Trajectory data for a typical mission : Nominal and dispersed trajectories, comprehensive malfunction trajectories or malfunction turn data, event times (ignitions, steering programs, burnouts, jettisons). Trajectory data are used to obtain vehicle velocity and altitude from which to calculate aerodynamic and inertial loads for use in estimating vehicle breakup. Event times are used to indicate vehicle configuration at each breakup time.

e. Descriptions of planned debris : Jettisoned components, aerodynamic and inertial breakup of jettisoned components, nozzle closure covers, etc.

f. Breakup debris lists : The manufacturer’s expected debris resulting from destruct action and subsequent aerodynamic loads at various event times including numbers of fragments, weights and dimensions of pieces, construction materials, drag characteristics (reference area, ballistic coefficient or drag coefficient versus Mach number), and breakup imparted velocities. In some cases, manufacturers also provide expected debris from breakup resulting from aerodynamic and inertial loads on a

7-6malfunctioning vehicle. When such lists are not provided, and these types of breakups are feasible, then it is left to the risk analyst to develop them.

g. Kinetic intercept debris lists : Estimate of intercept debris resulting from a hit-to-kill interaction between an interceptor and target vehicle, or more generally from any introduction of controlled external energy leading to vehicle failure and breakup (e.g. high intensity laser). Debris estimates should consider variations in the intercept event such as a glancing blow which may result in relatively few, mostly large fragments versus a direct head-on impact which generates very large numbers of relatively small fragments. Kinetic intercept debris lists are typically generated by the risk analyst using standardized programs and input data files based on the materials and configuration of the vehicle.

7.1.3 Modeling Considerations . Considerations for developing a debris model are discussed

below.

a. In developing a debris model, the analyst may consider the various failure response modes, breakup circumstances, outcomes, and debris classes to be accounted for in the risk computations.

b. For many launch vehicles, some of the debris will have different characteristics depending on whether breakup occurs as a result of a destruct action or as a result of failure (explosion, abnormal aerodynamic and inertial loads, etc.).

c. Before using supplied debris lists, they should be checked for accuracy and reasonableness. Some debris lists only model fragmentation based on a uniform distribution of size and quantity of fragments. One easy check is to compare the total weight of all fragments with the known dry we ight of the vehicle. Another check is to compare the new information with corresponding information for the same vehicle or similar vehicles. Investigations into early launch accidents (where debris was recoverable) have provided some insight into how vehicles break up. If a manufacturer’s list differs substantially from expectations, the risk analyst may either modify the list or justify the supplied list based on destruct system design and component construction and materials. An example of poor modeling that may be modified is the breakup of solid rocket motor propellant into chunks of equal weight. In particular, many manufacturers’ debris lists have been prepared only for use in estimating risks to people and structures on the ground. They under-predict the numbers of low-mass debris that may need to be considered when estimating risks to aircraft and spacecraft.

d. Supplied values of breakup-imparted velocities can be checked for reasonableness using empirical equations for pressure ruptures and explosions. More sophisticated models can be used to estimate maximum imparted speeds of propellant and case fragments from a destructed thrusting solid rocket motor. Breakup imparted speeds are highly uncertain. Often, an estimate of the maximum imparted speed is assumed to represent a three-sigma value of a one-sided normal probability distribution or of a

7-7Maxwellian distribution. Imparted velocity direction is also highly uncertain and is often modeled as equally probable in all directions, though other distributions may be required for special circumstances.

e. The possibility of failure of the destruct system should be considered. System failure may be due to loss of command communications, loss of battery power, failures or ruptures of vehicle systems resulting in loss of control or power connectivity, or inaction or delayed action of the safety officer. The latter may occur because of mission rules established before launch. If the destruct system fails, there is a possibility of an intact impact accompanied by an explosive yield or the possibility of breakup from aerodynamic or inertial loads. Associated debris models for these scenarios might be required.

f. Some supplied debris lists provide drag reference areas instead of actual areas for some fragments. Actual fragment areas are needed for roof-penetration and effective casualty area computations.

g. Every accident investigation provides new insight into how launch vehicles break up, and leads to changes in debris modeling. Future investigations are likely to continue these changes. The nature and extent of breakup seems to strongly depend on the nature of the failure and the interaction of the failure with the destruct system. Even if experiments could be conducted to repeatedly break up the same vehicle design with command destruct, the resulting fragments would likely vary significantly among the trials. Even the manufacturers are unsure how their vehicles will break up by command destruct. For example, one manufacturer with years of experience recently lowered the second-stage fragment count by an order of magnitude. As another example, two manufacturers of similarly sized and constructed solid rocket motors provided lists of miscellaneous hardware debris (i.e., debris that is not case or propellant). One list contained 1106 fragments, while the other contained 2 fragments. Part of the problem may be due to application. In earlier years, supplied debris lists were used primarily to determine hazard areas for containment. In more recent years, the debris lists have also been used for risk estimation. A realistic debris model is more important for risk estimation than it is for containment prediction.

h. Varying lengths of time may elapse between breakup and encounter, depending upon when in flight failure occurs. During these time intervals, debris characteristics may change, especially for propellant-bearing components and solid propellant chunks.

i. For solid propellant systems, the risk assessment must include consideration of a large number of propellant dynamic, thermodynamic, and chemical factors. These factors include, but may not be limited to: (1) If the motor is burning at the time of fragmentation, the mechanisms that might quench the motor or the propellant chunks must be considered. Conversely, if the motor is not burning at the time of fragmentation, the mechanisms for ignition of the propellant or the propellant chunks must be considered.

7-8(2) Ignition mechanisms may include heating associated with the breakup event, internal pressure of the motor at breakup, external dynamic pressure at time ofbreakup, and both symmetric and asymmetric heating of the fragments by aerothermal forces during propagation after breakup. (3) The dynamics are different for propellant adhering to case fragments than for free-falling propellant chunks. Also, fr agment tumble can affect ignition and

combustion mechanisms. (4) The kinetics of propellant burning are known to be dramatically different at the low ambient pressures associated with free falling propellant chunks as compared to those for the operational pressures of the motor. Thus propellant fragments and propellant in damaged motors will burn at different rates than in an intact operational motor, and the burning of fragments may be asymmetric due to fragment dynamics. While vehicle vendors can provide the burn rates for motor operational pressures, burn rates for low pressures are usually not available and will need to be estimated based on limited experimental data for the solid propellant, or similar propellants, and may require extrapolation to the pressures of concern. The influence of the shock wave around a supersonic propellant fragment, and the buildup of product gases behind the fragment, on the burn rate

are other consideration. (5) The dynamics of thrust associated with asymmetric fragment combustion may

need to be considered. (6) Solid propellant chunks can completely burn up (demise) during free fall, particularly if they are burning immediately following motor breakup.

j. For liquid-propellant components, it may be necessary for the analyst to decide whether the nature of breakup allows the propellants to remain on board. (1) If so, and the component was thrusting, the possibility of continued propellant consumption (and thrusting) may need to be considered. Additionally, it may be necessary for the analyst to decide whether the heat of reentry causes remaining propellants to boil off or leak from damaged tanks. (2) If not, the breakup will typically disperse the liquid as an aerosol which has dynamics including interaction with atmospheric oxygen (or other chemicals) and possible ignition of fuel components, heating and absorption of pressurized liquids or cryogenic fuels in the atmosphere, and the possible settling of both inert and toxic fuel components over a broad area following dispersion. Aerosolized and vaporized fuel components, particularly toxic components, must be considered separately from treatment of inert, non-explosive solid debris.

k. The demise of inert fragments can occur during free fall due to ablation or melting, especially for inert debris reentering from space.

l. For missions involving planned intercepts of vehicles, the development of intercept debris models (debris from the interceptor and from the target), as well as the dispersions of the debris, require a special modeling approach. Dynamic loading during an intercept is typically modeled by a statistical tool that has been validated through comparison with data from laboratory tests. Because of the high energy

7-9associated with these events, consideration needs to be given to the material content and configuration of the impacting bodies, the closing velocity, the size and mass distributions of the fragments (having extensive low mass/small area tails), and the post-intercept velocities including the perturbation of the average velocity of the fragments resulting from each body due to the net momentum transfer between the bodies. Energy loss can result in melting, frictional ablation, vaporization and ionization of impacted metals, as well as production of an optical flash which represents a significant portion of the relative energy. Typically, three classes of intercept debris generation models can be applied: (1) Purely statistical models (of which Impact is the best known) that apply constrained power-law or exponential distribution models to fragment size and

mass. (2) Empirical models (of which KIDD is the be st known) that use constraining test data to determine limiting fragments and constrain the parameters used in statistical models to generate the smaller fragments. (3) Hydrocodes, which are high fidelity finite element models for shock propagation and penetration, but are constrained from accurate depiction of the smaller fragments due to the limiting size and time resolution of the element models, and which are often prohibitively expensive to run.

7.1.4 Model Uncertainty

.

a. FTS, Aerodynamic, and Inertial Breakup . Every accident investigation provides new insight into how launch vehicles break up, which leads to improvements in debris modeling. Future investigations are likely to continue these changes. The nature and extent of breakup seems to depend strongly on failure mode and the interaction of the failure mode with the destruct system operation. If the risk analyst could foresee all plausible breakup scenarios and assign an accurate probability to each, and if accurate debris lists could be determined for each scenario, the resulting probabilistic debris model would lead to improved accuracy of the estimations of risk. However, none of these is possible. The analyst cannot be sure that breakup scenarios have been included that should not have been, or that important scenarios are missing. The ability to prepare a complete debris list is also compromised by the inability to track all but the largest of the debris fragments, to recover more than a fraction of the largest fragments, and to reconstruct fragment dynamics from the positions of recovered fragments. Even if an accurate model for all scenarios existed, the associated probabilities of occurrence would be based on engineering judgment. Sensitivity studies may be conducted to estimate the variations in risks from variations in breakup scenario probabilities and from variations in the extent of breakup associated with each scenario. However, the uncertainty in risk due to incompleteness in the list of credible breakup scenarios remains unknown.

b. Intercept Impact Breakup . In many ways, the uncertainty in breakup models for debris from intercepts is even greater than the uncertainty in FTS and aerodynamic breakup models. It is simply impossible to recover the debris from intercepts, and controlled tests are generally restricted to scaled models of the interceptor at

7-10velocities below – sometimes significantly below – the velocity of the intercept being modeled. Intercepts can occur head on or off the center line of the vehicle, and under hypervelocity conditions the angle of contact between interceptor and target significantly affects the post-impact breakup and dynamics. Localized energy transfer under impact conditions can exceed the melting temperatures – or even the vaporization temperatures – of components, resulting in mass loss by mechanisms which cannot be tracked by either ground or air/space testing. Fracture lines may result from system joints, component weak spots, force concentrators, and other phenomena only apparent under hypervelocity impact conditions. Both localized thermo-mechanical effects, including the effects of stored energy in the system, and systematic effects can change the final chemical state of a fragment, its condition of velocity and spin, its shape and mass, and overall dynamic performance.

7.2 Debris Dispersion Models

Debris dispersion models are models to predict the dispersions of debris occurring from vehicle breakup, during free fall, or at surface impact. Vehicle “breakup” may include an intact vehicle that has lost thrust or is tumbling rapidly. The term “debris dispersions” is used to refer to the variation in the position of a fragment as it falls and at impact (or at a specified altitude). The sources of debris dispersions include th e deviation of the vehicle from the nominal (intended) trajectory prior to breakup and the dy namic effects on the fragments during free fall.

Debris dispersions are computed during free fall, or at a specified altitude, to assess aircraft or spacecraft risks, and at surface impact to assess risks to people and property on the surface (ground or water). The debris dispersions result in both an expected (mean) shift in the position of a fragment during freefall or at impact, and in an uncertainty in this position. Dispersion models are discussed for each of th e significant sources of debris dispersion.

Fundamentally, debris dispersions need to be modeled for each hazard-producing fragment resulting from vehicle breakup. However, fragments may be (and often are) combined into fragment groups (classes) and the dispersions are modeled for each group (paragraph 7.1 addresses fragment grouping).

The focus of the discussion is on the development of debris dispersions at surface impact (or at a specified altitude); however additional considerations that should be addressed for defining 3-dimensional dispersions are also discussed. The primary purpose of modeling 3-dimensional fragment distributions is to compute impact probabilities for an aircraft or spacecraft which is following a specified flight path at a given speed. Modeling of the 3-dimensional cloud requires that the dispersions of the debris be defined as a function of time.

There are three approaches that have been used to define debris dispersions. The first is to statistically represent the dispersions using models that relate the dispersions at surface impact (or at a specified altitude) to the initial breakup state vector using closed form solutions. The second is to perform Monte Carlo simulations of fragment trajectories from the breakup point to develop random impact points (scatter plot) to define the dispersions. The third is to compute

7-11the maximum (or near maximum) debris dispersions to define the limits of the impact displacements.

The significant sources of debris dispersion that are addressed, due to both trajectory deviations of the vehicle and dynamic affect s on the fragments during free fall, are:

a. Vehicle normal trajectory uncertainty due to guidance and performance factors.

b. Vehicle malfunctions resulting in significant trajectory deviations (referred to as malfunction turns).

c. Velocities imparted to fragments at vehicle breakup.

d. Uncertainty in the drag characteristics of a fragment.

e. Aerodynamic lift effects acting on a fragment.

f. Dispersion due to wind drift including the uncertainty in the wind profile.

g. Free flight of inadvertently separated thrusting motors.

Other sources of dispersion may need to be considered but they are usually minor contributors to the overall debris dispersions. These sources include uncertainty in the atmospheric density, variations in the impact altitude due to terrain, and uncertainties introduced by the Earth model employed.

An important tool used in the generation of debris dispersions is an impact predictor (often referred to as a propagator). The impact predictor is used to compute the trajectory of a fragment from vehicle breakup to a specified time, altitude, or surface impact. Although the impact predictor is not discussed as a separate model in this chapter, it is important to note that it can compute fragment state vectors with sufficient accuracy and computational speed. Important considerations for a good impact predictor are:

h. Rapid computation speed to meet the requirements for having to compute large numbers of trajectories (various flight times, failure modes and fragments/fragment groups).

i. Capability to handle high initial decelerations. j. Use of an appropriate atmospheric density model for the region of concern.

k. Ability to handle wind forces.

l. Ability to model aerodynamic forces in a rarified (high altitude) atmosphere.

7.2.1 Vehicle Normal Trajectory Uncertainty due to Guidance and Performance Factors

.

a. Model Description . Even when a vehicle is flying normally, the state vector of the vehicle at the onset of failure, and subsequently at the time of breakup, is uncertain due to the normal variations in the vehicle guidance (including preplanned and responsive maneuvers, inertial sensor tolerance, guidance algorithm performance accuracy, etc.) and in the motor performance (thrust variation, steering tolerance, etc.). Atmospheric conditions (particularly atmospheric density and wind) affect both guidance and motor performance. The resulting vehicle state vector uncertainty leads to uncertainty (dispersions) in the locations of the vehicle breakup debris during free

7-12fall and at impact. The purpose of the vehicle “guidance and performance” dispersion model is to quantify the debris dispersions.

b. Data Sources . Data to define a vehicle’s guidance and performance state vector uncertainty are typically generated by the vehicle vendor and are in one of three

forms: (1) The most common form are what are referred to as 3-sigma trajectories to reflect the fact that they are intended to represent dispersions from the nominal trajectory that are near maximum (i.e. will be rarely exceeded). 3-sigma trajectories are generated for various conditions to cover the range of state vector variation. A common set of trajectories include those for a 3-sigma low performing (low thrust) vehicle (often referred to as a cold trajectory), a 3-sigma high performing vehicle (often referred to as a hot trajectory), a 3-sigma deviation to the left of the nominal trajectory plane (left trajectory), and a 3-sigma deviation to the right of the nominal trajectory plane (right trajectory). In some cases other trajectories may be provided such as a 3-sigma high altitude (lofted) and a 3-sigma low altitude (depressed) trajectory. (2) In less frequent cases, the vehicle vendor will provide statistics for the state vector (versus flight time) giving the standard deviations in the state vector position and velocity components and, sometimes, the correlations between the components. These provide the terms for a covariance matrix defining the state vector uncertainty statistics. (3) In a few rare cases the vehicle vendor will provide a family of dispersed trajectories to characterize the potential dispersions of the vehicle trajectory due to variations in the various environmental, guidance and performance parameters that govern the trajectory.

There are special data issues and modeling considerations that need to be addressed when a mission involves an intercept of a vehicle or its payload (designated the target) by another vehicle/payload (designated the interceptor), where the uncertainties in both the target and interceptor state vectors at intercept need to be addressed. Some of these considerations and the type of data used are discussed below.

c. Modeling Considerations . The modeling of debris dispersions due to guidance and performance factors generally varies with the type of data available from the vehicle vendor. The models compute fragment dispersions at surface impact (or at a specified altitude or a specified time) due to guidance and performance factors for a vehicle that breaks up or loses thrust while following a normal trajectory, or due to uncertainty in an intercept state vector. (1) The modeling of debris dispersions due to guidance and performance is the least straight forward when the vehicle state vector uncertainty is defined in the form of 3-sigma trajectories. In this case, consideration needs to be given to how to apply the data to define dispersions.

• One approach is to use the state vectors at a given flight time from each of the 3-sigma trajectories to compute the corresponding impact points for a given fragment/fragment group. These points can then be used to define the 3-

7-13sigma limits for the impact dispersions. Exactly how the impact points are used to compute the impact dispersions is up to the interpretation of the analyst. For example, the most extreme impact points in the up-range, downrange, cross-range left and cross-range right directions could be used to define a contour fit of the points and to interpret this contour as a 3-sigma dispersion contour.

• Another approach is to use the 3-sigma trajectory state vectors to estimate state vector component uncertainties to generate covariance matrices for the state vector for selected flight times. Corresponding fragment impact dispersions can then be estimated using one of the approaches discussed below. The state vector standard deviations for a given flight time can be

estimated from the differences between the nominal state vector and the 3-sigma trajectory state vectors for each state vector component. While this process provides estimates of the component standard deviations it does not provide estimates of the correlations between state vector components, and thus does not generate a complete state vector uncertainty covariance matrix. As discussed above, this can result in overstated debris impact dispersions. (2) The modeling of debris dispersions due to guidance and performance factors is the most straight forward in the less common case where the vehicle vendor provides a covariance matrix defining the vehicle state vector uncertainties as a function of flight time. There are two approaches that can be used to propagate the covariance to define debris dispersions.

• The first approach is to propagate the state vector uncertainties, for given failure times, using analytical models (such as partial derivatives) to relate impact (or altitude) displacements to perturbations in the initial state vector components. The analytical model parameters will vary as a function of the initial state vector and of the fragment drag characteristics (ballistic coefficient or drag coefficient versus Mach number).

• The second approach is to use the nominal vehicle state vector and the covariance matrix to generate perturbed state vectors for a given failure time and to propagate these for a given fragment (or fragment group) to impact using an impact predictor. The resulting impact point scatter plot can then be used to define the statistics of the impact dispersions. A sample scatter plot is shown in Figure 7-1 where impact points resulting from many random selections of the initial state vector are shown for two fragment ballistic coefficient values. The coordinates of the impact points (latitude-longitude, x-y, or other coordinate system) are used to calculate the mean impact point and the moments of the impact dispersions. (3) If the vehicle vendor provides a family of dispersed trajectories to characterize potential vehicle dispersions, the modeling is similar to the case where the vehicle vendor provides a covariance matrix.

• The initial set of state vectors provided by the vendor, for given failure times and fragments, can be used to compute impact points and the resulting scatter plot to define the statistics of the impact dispersions.

7-14• As an alternative, the dispersed trajectories can be used to generate a covariance matrix and the covariance matrix propagated using analytical models, as discussed above. (4) When the mission involves an intercept of a vehicle or its payload by another vehicle/payload, launched usually from different sites on a coordinated schedule,

additional factors must be considered.

• Some launch vehicle maneuvers may be initiated based on energy management requirements, where the interceptor is guided, and executes maneuvers, based on both on-board and off-board sensor information regarding the target vehicle.

• After either the target or the interceptor vehicle reaches a ballistic trajectory, additional maneuvering may be planned; for example, the target vehicle may maneuver to simulate evasive actions by a threat vehicle, and the interceptor will conduct both normal steering maneuvers as sensor data is improved, and responsive maneuvers based on command guidance or on-board course correction planning.

Ballistic

Coefficient = 100 psf Ballistic

Coefficient = 30 psf

Figure 7-1. Sample impact point scatter plot.

Intercept Control Volumes (ICV) are used to define the maximum allowable volume of space in which an intercept can occur. The ICV encompasses the net effect of the interceptor trajectory; including normal targeting, normal dispersions, and responsive planning and control; and th e target trajectory, including dispersions

7-15from its nominal trajectory. The allowable size and shape of the ICV are often restricted based on safety criteria used to contain debris within allowable boundaries, or to achieve acceptable levels of risk. The ICV can be used to define variations in intercept debris impact points by generating impact points for various intercept state

vectors selected from the ICV.

While the guidance and performance dispersions represent the state vector uncertainty for a vehicle following a normal trajectory, these data do not properly represent the state vector uncertainty for a vehicle that breaks up (or is destructed) while in a malfunction turn. These guidance and performance dispersions should, however, be accounted for as an additional source of state vector uncertainty over and above the consequences of the malfunction turn. Data to define guidance and performance state vector uncertainties during a turn are normally not generated by vehicle vendors. The risk analyst is thus faced with the challenge of how to define the guidance and performance debris impact dispersions for a vehicle in a turn. Lacking better data, the data for the normal trajectory may have to be used as an estimate of the state vector uncertainties during a malfunction turn due to guidance and performance factors.

7.2.2 Vehicle Malfunction Turns

.

a. Model Description . A vehicle malfunction turn is defined to be any notable deviation of a vehicle from its intended trajectory that results from a failure (malfunction) of the vehicle hardware or software, including a failure of the vehicle guidance system. It includes everything from gradual turns off course to gravity turns to tumbling turns. It is often detected by abnormal deviations of the vehicle’s Instantaneous (projected) Impact Point (IIP) from the nominal IIP trace. The state vector at the time of breakup for a vehicle that is in a malfunction turn is highly uncertain due to the number of possible failure modes resulting in the turn, due to the uncertain response of the vehicle to the failure condition, and due to the response of a Mission Flight Safety Officer (MFSO) to the deviation from the intended trajectory. The resulting state vector uncertainty leads to uncertainty (dispersions) in the locations of the vehicle breakup debris during free fall and at impact. The purpose of the malfunction turn model is to define the debris dispersions resulting from the trajectory deviations from the time of the failure to the time of vehicle breakup, flight termination or impact.

There are many failure modes that can cause a malfunction turn and each of the

relevant modes need to be considered. Possible malfunction turn failure modes include, but are not limited to: (1) A motor nozzle assembly failure causing loss of full control of the thrust direction resulting in an unplanned offset of the thrust vector. This could result, for example, from a failure of one or more nozzle actuators leading to a nozzle stuck in place, drifting to null, going hard-over, or randomly moving; or from a failure in a thrust injection system used to control the thrust vector direction. (2) A failure in the vehicle control system (hardware or software) leading to an erroneous command to the thrust vector control system.

7-16(3) A failure of a nozzle, such as a nozzle burn through, leading to a loss of a portion

of a nozzle and a thrust offset. (4) The complete loss of a nozzle assembly in a solid rocket motor resulting in a complete loss of thrust control, and, usually, a significant drop in the thrust. (5) The loss of or a significant reduction in the thrust for one of the motors on a vehicle with multiple operating motors (core vehicle or strap-on motor). (6) An inadvertent separation of one or more strap-on motors. (7) A case burn-through for a solid rocket motor , or a leak at a case joint, resulting in a side thrust at the location of the burn through and a reduction in the main thrust.

b. Data Sources . The primary sources of data to define malfunction turn behavior are vehicle vendors. If malfunction turn data are not available from the vendor, data can in some cases be developed using an appropriate trajectory simulation program.

However, this requires a significant amount of data for the launch vehicle such as thrust, mass properties, and aerodynamic co efficients (including coefficients for a vehicle at large angles of attack). Also, unless the failure is a simple one to model such as a vehicle with a single thrusting motor with the nozzle locked in an offset position, the malfunction behavior may require that the vehicle control system be modeled. This may not be possible without significant information and models from

the vendor.

Malfunction turn data generated by vehicle vendors has primarily been of two types. Either type may include additional information to support development of debris impact dispersions. (1) One form of malfunction turn data is what is referred to as velocity turn curves. These curves give the turning capability of a vehicle expressed in terms of the time history of the vehicle velocity vector magnitude and velocity vector turn angle, for turns initiating at various flight times. The turn angle is the angle between the vehicle velocity vector at the start of a turn and that at a given time into the turn. The velocity magnitude and turn angle may be generated for various failure scenarios. Often the curves are generated both for pitch plane turns (the failure causes the vehicle turn in its pitch plane) and for yaw plane turns (the failure causes the vehicle turn in its yaw plane). The turn curves may be generated either ignoring the force of gravity during the turn or including gravity (or both). The purpose of generating turn curves ignoring gravity is to allow the velocity turn data to be used to estimate turns where the velocity vector is turning in a plane (plane containing the vehicle velocity vector at the start of the turn) other than that for which the turn data are generated. In this case the effect of gravity acting during a turn needs to be accounted for in the analytical model used by the analyst (by adjusting the vehicle turn state vector time history).

• The major shortcoming with the velocity turn curve data is that the attitude of the vehicle and its velocity vector during a turn are not defined. Therefore, an assumption must be made regarding the direction that the velocity vector turns. A common assumption used is that the velocity remains in a specified

7-17plane, where the plane can have any orientation about the initial velocity

vector. (2) A higher fidelity form of malfunction turn data are full 6 degree-of-freedom malfunction trajectories giving the full state vector, including the vehicle attitude, as a function of time into a turn. Trajectory data in this form are becoming more common. Typically a family of trajectories is generated for selected flight failure times for each of the many failure modes representing the range of vehicle malfunction response. In addition to providing a full state vector during a turn, and thus eliminating the need to assume the direction for the velocity, the attitude

data can be used to define the orientation of the vehicle at the time of vehicle breakup or destruct which can in turn be used to initiate free flight simulations for an inadvertently separated thrusting motor or to account for the directionality of velocities imparted to fragments at breakup. (3) In addition to the malfunction turn curves or trajectories, the vehicle vendor often provides data to determine when during at turn a vehicle is expected to break up due to aerodynamic and inertial loads (including the centrifugal forces experienced by a tumbling vehicle), or specifies that breakup will not occur. This may be provided as the time into each turn that breakup is expected to occur or, for malfunction trajectories, as a loading condition, such as the q-alpha (dynamic pressure times angle of attack) value, at which breakup would be expected. In some cases the time or loading condition will be expressed as a range of values to account for uncertainty. (4) Other data that may be provided are the relative probabilities of the malfunction turn curves or malfunction trajectories for each flight time. The vendor may provide these relative probabilities, or it may be necessary for the range safety analyst to estimate them after discussions with the vendor. These probabilities are important for the computation of impact dispersion statistics from random impact points generated using the turn data.

c. Modeling Considerations . Two important factors that need to be addressed when modeling malfunction turn dispersions. (1) The first factor relates to the fact that a launch vehicle may break up during a turn due to the abnormal aerodynamic and inertial loads or due to the propagation of the initial failure condition (such as the propagation of a nozzle burn through leading to an explosion). Breakup initiated by aerodynamic/inertial loads may also activate an Automatic Destruct System (ADS)/Inadvertent Separation Destruct System (ISDS) that further affects the vehicle breakup. To account for such breakup, the turns should be terminated at the point where breakup is predicted. The breakup time could be that provided by the vendor, the latest breakup time if a time range is provided or, if a Monte Carlo approach to modeling the impact dispersions is used, a randomly selected breakup time from a provided or estimated probability distribution.

NOTE : In some cases it might be appropriate to assume that breakup will not occur during a malfunction turn so as to maximize the vehicle dispersions, and thus the dispersions of the vehicle fragments. This may (but not necessarily) lead to conservative risk predictions that could be adequate if these risks are within

7-18acceptable limits. If the risks are not acceptable it may be necessary to go back and re-compute the dispersions accounting for breakup during the turns. (2) The second factor relates to the effect of a flight termination system, and the associated flight termination criteria, on the dispersions. To account for this, malfunction turn simulations should model vehicle breakup as occurring whenever violation of a flight termination condition occurs. This requires tracking the flight termination condition during simulations of the turns and initiating termination (due to activation of the FTS by the Missile Flight Control Officer) when it is violated. Flight termination conditions are defined by established criteria such as the crossing of a destruct line by the vehicle’s projected vacuum impact point, the crossing of an impact limit line (ILL) by a projected debris footprint, or the violation of lines on a vertical plane position

chart.

• The determination of the time into a turn when vehicle breakup due to flight termination action will occur should include the delay time from when a flight

termination criterion is violated to when actual vehicle destruct occurs. This delay time accounts for the time for the range safety software and hardware to display the position and movement of the vehicle; the human reaction time to detect the malfunction and activate the flight termination system; the system delays in sending, receiving and processing the flight termination signal; and the time for the flight termination hardware to perform its function. Often this delay time is defined as a time range or a probability distribution to account for uncertainty.

• In addition to termination of a turn due to violation of the basic flight termination criteria, a vehicle that is in a malfunction turn may be terminated 1) to prevent impact of an intact vehicle, 2) because the vehicle is erratic and the potential exists to lose positive cont rol, or 3) because the performance of the vehicle is unknown and the possibility exists to violate established flight safety criteria. The analyst should also take this into consideration for determining if and when a turn is terminated.

If both vehicle breakup and flight termination can occur during a turn, the earliest of the breakup/termination times for these two phenomena is normally used. The analyst should keep in mind that the vehicle fragmentation that results from aerodynamic or inertial forces will, in most cases, be significantly different than that resulting from flight termination activation.

With either form of the malfunction turn data (turn curves or turn trajectories) the analyst can choose to use the malfunction state vectors to 1) determine only the limits of debris dispersions at surface impact (or at altitude), or 2) generate random impact points (scatter plot). Scatter plot points can be used to compute the statistics of the debris impact dispersions or to generate a histogram of the

7-19random impact points, or risk computations can be made for each random impact point 103

.

The limits of the debris dispersions; such as the maximum up-range, downrange, cross-range left and cross-range right dispersions; can be used to approximate the region within which impact will occur, but this does not give any information as to the character or statistics of the impact distribution. With this approach the limits are often assumed to represent the 3-sigma dispersion contour, and an assumption may have to be made by the analyst as to the corresponding impact probability distribution. If risks are to be controlled by containment of debris, such as keeping it within specified range boundaries, the limits of debris impact may be all that is required. The containment approach could also be used to define clearance areas for ships and aircraft.

• Computation of the fragment impact dispersion limits is different depending on whether malfunction turn curves or turn trajectories are employed.

o With turn curves the maximum dispersions can be estimated by selecting the maximum velocity turn angles and, applying the corresponding velocity magnitudes, computing the projected impact points for a given fragment or fragment group. This may need to be done for each of the turn curves for each flight failure time, and for various orientations of the turn plane, in order to determine the maximum dispersion.

o With turn trajectories there will be many trajectories, and the challenge is to select the proper malfunction trajectories that will sufficiently define the limits of the fragment impact dispersions for a given failure time. It may be necessary to compute the projected impact points for each of the trajectories, and possibly for various times during each trajectory, and then select the impact points that define the impact dispersion limits.

Random state vectors at vehicle breakup or flight termination are used to compute corresponding impact points resulting in a scatter plot. A scatter plot is generated for each fragment/fragment group of concern. The state vectors are generated by a Monte Carlo analysis of the malfunction trajectory and the breakup event (time and mode of vehicle breakup or flight termination).

• If turn curves are used, the turn trajectories for a given failure time can be generated by randomly selecting a turn curve, assuming that the turn occurs in a plane, and randomly selecting the turn plane orientation. The relative probabilities of the turn curves and the probability distribution for the turn plane orientation angle are needed to make the random selections. These relative probabilities and/or the turn plane orientation probability distribution will need to be estimated if they are not available from the vehicle vendor.

103 Risk computations can be performed for each of the ra ndom impact points, with th e dispersions due to other sources of impact uncertainty accounted for either as part of the Monte Carlo simulations used to generate the random impact points, or as part of an uncertainty distribution about the random impact point. The risk contribution for each random impact point would, of course, need to be multiplied (weighted) by its relative probability of occurrence before combining with the contribution for other random impact points to get the total risk for the debris generating event.

7-20Once a turn curve and turn plane are selected the state vector during the turn can be computed using the velocity turn angle and magnitude history to define the velocity vector and, by integrating the velocity, the position vector during the turn. If the turn curves are generate d ignoring gravity effects, the effect of gravity will need to be accounted for.

• If turn trajectories are used, trajectories can be randomly selected from the set of trajectories provided. Relative probabilities of occurrence of the trajectories are needed to make the random trajectory selections. These relative probabilities will need to be estimated if not available from the

vehicle vendor.

Statistics of the impact dispersions can be computed from the coordinates of the impact points in a scatter plot. These statistics provide information for selecting an appropriate impact distribution function.

Alternatively the scatter plot random impact points can be used to generate a histogram of the impact point distribution. This histogram provides the most accurate representation of the impact distribution, however computation of impact probabilities using a histogram is generally more complex and computationally intensive versus using a closed form impact distribution function.

7.2.3 Debris Imparted Velocities

.

a. Model Description . Vehicle breakup generally results in velocities imparted to the resulting fragments. These imparted velocities are produced by the explosive charges used in flight termination systems, by pressure forces created by an explosion, by the rupture of a pressurized vessel or motor, and/or by the rotational motion of the vehicle at the time of breakup or flight termination. For weapon systems, velocities are created by hit-to-kill intercepts or warhead detonations. The direction and magnitude of the imparted velocities are often difficult to predict and are thus highly uncertain. The magnitude of the imparted velocities will vary with the way a vehicle breaks up; the variation in the explosive pressures created, the uncertainty in the pressure level in a rupturing vessel; the fracture pattern of motor cases, pressure vessels and other hardware; etc. The imparted velocity of each fragment will tend to have a preferred direction relative to a vehicle’s orientation. However, many of the same uncertainty factors for the imparted velocity magnitude apply to the imparted velocity direction. In addition, the uncertainty in the orientation of the vehicle at breakup (particularly if it is turning off course or tumbling) adds to the uncertainty in the net imparted velocity direction.

The imparted velocity influences the post breakup state vectors of the fragments and thus affects the trajectories, and disper sions, of the fragments during free fall and at impact. The purpose of the imparted velocity debris dispersion model is to define these dispersions.

7-21b. Data Sources . A primary source of imparted velocity data is the velocity magnitudes provided by vehicle vendors for FTS-activated breakup of the launch vehicle. In some cases velocity magnitudes may be given for other modes of vehicle breakup such as an explosion. (1) Typically only a single velocity magnitude is given for each fragment or fragment group, and no information is given as to the direction of the velocity. Possibly an uncertainty range for each magnitude will be specified or a statistical uncertainty, such as 1-sigma standard deviation, will be provided.

(2) If imparted velocities are not provided by the vendor, or velocities for a different mode of failure are needed, the velocities can be estimated using existing models based on physical principals or on velocity measurements obtained from launch vehicle accidents (usually by analyzing video recordings of an accident).

• Various models have been developed by launch vehicle vendors and the flight test ranges to predict velocities for fragments created by vehicle explosions and pressure vessel rupture. These models can be used to predict imparted velocities or to check the reasonableness of velocities provided by vendors. There are also models available to predict velocities, as well as the debris, resulting from hit-to-kill intercepts (such as the generally accepted KIDD model).

c. Modeling Considerations . The analyst will first need to determine whether to characterize the dispersions by defining only the maximum (worst case) dispersions in various directions, or whether to develop a scatter plot to compute the statistics of the dispersions, a histogram defining the imp act distribution, or to compute the risks directly for each random impact point. (1) If only the maximum dispersions are to be generated, then a best estimate of the maximum imparted velocity magnitude will need to be made. This maximum imparted velocity magnitude can then be used to compute maximum dispersions at impact (or at altitude) by iterating on the imparted velocity direction and computing the corresponding impact trajectories. Impact points for a range of credible imparted velocity directions are necessary to determine the maximum dispersion in all directions. (2) If a scatter plot is to be generated, the statistical characteristics of the imparted velocity must be determined. If only a single imparted velocity magnitude is provided, then it must be interpreted as a maximum value, a mean, a given percentile on a probability distribution, etc. in order to estimate a probability distribution for the velocity magnitude. If a range of values, or an uncertainty in the specified value, are provided, this can be used to better define the probability distribution. A distribution for the velocity direction is also needed. In the absence of any specific information, the velocity is often assumed to have an equal likelihood of being in any direction (uniform spherical distribution). This is predicated on the fact that the direction of the velocity relative to the vehicle is highly uncertain, and the attitude of the vehicle at the time of breakup may also be highly uncertain. In cases such as a vehicle explosion during a normal trajectory or a planned detonation, a best estimate of the imparted velocity direction can be

7-22made, and the uncertainty in the direction can be defined by a probability distribution about the preferred direction (such as a conical distribution with the centerline of the cone aligned along the preferred direction).

• The probability distributions for the imparted velocity vector (magnitude and direction) are used in a Monte Carlo analysis to compute the scatter plot (set of drag corrected impact points). The scatter plot points can be used to compute the impact dispersion statistics (mean, standard deviations, etc.) or a histogram, or the random impact points can be used directly in risk

calculations. (3) Three additional factors should to be considered when developing debris impact dispersions due to imparted velocity.

• The impact dispersions often become significantly non-linear as the velocity magnitudes become large, especially for low ballistic coefficient fragments. Also, at higher initial altitudes the direction of the imparted velocity can produce significant non-linearity. Thus, linear methods (such as influence coefficients) to compute impact dispersions should only be used for relatively small imparted velocity magnitudes and lower altitudes. An impact predictor capable of handling high decelerations can be used to compute impact points for high magnitude imparted velocities.

• Imparted velocities can result in fragments that enter into stable or temporary orbits, and it may be necessary to eliminate the fragments for the computationof surface impact risks, while accounting for them when assessing the shortterm or long-term risks to orbiting assets.

• The distribution of imparted velocity impact points can be irregular or highly skewed such that a simple closed form function, such as a bivariate normal distribution, will not adequately represent the actual distribution. These cases require a more complex method to characterize the distribution (such as an impact point histogram) or the use of a Monte Carlo method to compute risks for each individual impact point.

7.2.4 Fragment Aerodynamic Drag Uncertainty

.

a. Model Description . The location of a fragment during free fall or at impact is significantly affected by the aerodynamic drag force acting on the fragment. The drag characteristics of the fragments resulting from the breakup of a vehicle can usually only be roughly estimated. This uncertainty leads to uncertainty in the trajectory of the fragments during free fall an d thus to dispersion during free fall and at impact. The uncertainty in fragment drag characteristics results from the fact that the manner in which a vehicle will break up can only be estimated and, even for a well defined fragment, the drag characteristics will vary or be uncertain due to the uncertainty in how the fragment will fall (stabilized at a given orientation, tumbling, etc.). In addition, the character of fragments can change during reentry due to aerodynamic stresses and aero-thermal heating, resulting in secondary fragmentation, melting, vaporization, or ablation. This not only affects the fragment drag characteristics, but the changes in the debris due to the heating affects (including fragment demise) and secondary breakup will need to be addressed in the risk

7-23computations. The purpose of the aerodynamic drag uncertainty debris dispersion model is to define the dispersions.

b. Data Sources . The primary source of data for fragment drag characteristics is data provided by the vehicle vendor for specific breakup modes (usually for destruct breakup; sometimes for other breakup modes). See also paragraph 7.1

. (1) The most common data are the ballistic coefficients of the fragments. Since a fragment’s ballistic coefficient varies with Mach number, values are often given that are average values for subsonic and supersonic speeds (where an average or representative ballistic coefficient is used for each of these regimes). In some cases ranges of ballistic coefficient values are provided for each fragment or fragment group. (2) For some, usually well-defined, fragments the drag coefficient versus Mach number (along with the associated reference area) may be provided. (3) When drag characteristics are not provided, or the analyst wants to check the validity of the data, ballistic coefficients can be estimated based on a fragments shape, size and weight using standard formulas. For well-defined fragments the drag coefficient versus Mach number might be predictable using standard curves.

c. Modeling Considerations . The dispersions due to drag uncertainty are usually handled by defining the uncertainties in the fragment drag force. (1) If the drag is defined by a representative fragment ballistic coefficient, the uncertainty in the ballistic coefficient is used to define the dispersions. Since the drag force on a fragment varies significantly between supersonic and subsonic speeds, the appropriate ballistic coefficient should be used for these two regimes, and the uncertainty defined for each regime. For low ballistic coefficient fragments originating at lower altitudes where the atmosphere is dense, the drag force is high and the velocity of a fragment is slowed rapidly to subsonic speeds such that it may be adequate to use the subsonic ballistic coefficient for the entire free fall trajectory. The uncertainty in ballistic coefficient is typically defined by a range of values (from vehicle vendor data or engineering estimates), or may be defined by a statistical uncertainty or a probability distribution. Generally the uncertainties (or a probability distribution) are not provided by the vehicle vendor and it is up to the analyst to estimate these. (2) If the drag is defined by drag coefficient curve (drag coefficient versus Mach number and associated reference area) the uncertainty in the drag will need to be defined in terms of the uncertainty in the drag coefficient. This may be in the form of lower and upper bound drag coefficient versus Mach number curves.

The approach often used to define debris dispersions due to drag uncertainty is to propagate a fragment to impact using the best estimate of the ballistic coefficient and using the maximum and minimum, or statistically varied, ballistic coefficient values (or by using the best estimates and statistical variations on the drag coefficient versus Mach number data). (3) The resulting impact points can then be used to characterize the fragment dispersion due to drag uncertainty. Since the variation in a fragment impact point

7-24as a function of the drag traces along a curved line, often referred to as a debris centerline (Figure 7-2 ), the dispersions of the impact point lies along this line. This creates a challenge for the analyst as to how to model this “one dimensional” distribution, especially when combining this source of impact uncertainty with the other sources of impact uncertainty to characterize the total impact distribution. A conservative approach that has been used is to approximate the drag uncertainty dispersions by selecting an appropriate two-dimensional distribution to represent

the one-dimensional curvilinear distribution. (4) An aerodynamic regime that may need to be considered when computing the impact points of fragments is the portion of the trajectory that is at very high altitudes where the atmosphere consists of individual molecules. Here the drag should be accounted for by using appropriate drag models for this regime.

Figure 7-2. Debris centerline showing variation of the impact with fragment ballistic coefficient ( β ).

7.2.5 Fragment Aerodynamic Lift Effects

.

a. Model Description . The location of a fragment during free fall or at impact can be significantly affected by the aerodynamic lift force acting on the fragment. For reasons similar to those discussed for aerodynamic drag (paragraph 7.2.4 ), the lift force on a fragment can usually only be roughly estimated and the uncertainty leads to uncertainty in the trajectory of the fragment during free fall and thus in dispersions at any given altitude or at impact. The purpose of the lift debris dispersion model is to define these dispersions.

b. Data Sources . The lift force on a fragment is usually defined by the lift-to-drag ratio, which is the ratio of the magnitude of the lift force to the magnitude of the drag force.

7-25Lift-to-drag ratios are not normally provided by vehicle vendors and therefore must usually be estimated by the analyst based on predicted fragment shapes.

c. Modeling Considerations . Fragment impact dispersions due to lift can be assessed by simulating fragment trajectories with and without the lift force. It should be emphasized that while the drag force always operates in a direction opposed to the velocity vector, the force normally called “lift” can operate in any direction perpendicular to the velocity vector, even downward, and the direction can rotate as the fragment falls. Thus for fragments that can stabilize their orientation relative to the velocity vector, the larger dispersions should be accounted for by simulating trajectories with the lift vector stabilized in various directions. For fragments that will tumble during free fall or for which the direction of the lift vector is unknown due to the uncertainty in the fragment shape, the simulated trajectories should consider a rotating lift vector direction where the rate of rotation is varied. The impact points computed using the various assumptions on the lift vector can be used to define the limits on the impact dispersions, in various directions, and these can be used in determination of debris containment or to define hazard zones. The impact points can also be used to estimate impact distribution statistics characterizing the impact uncertainty due to lift effects.

7.2.6 Wind Drift and Wind Uncertainty

.

a. Model Description . Wind is a significant factor affecting the trajectory of fragments during free fall. This is particularly tr ue for fragments experiencing high drag (low ballistic coefficient). The wind causes a shift in the position of a fragment during free fall and this shift is determined by the magnitude and direction of the wind as a function of altitude. Since the wind varies with both time and location, the wind profile can only be defined statistically. This uncertainty in the wind profile results in uncertainty in the free fall trajectory of frag ments and thus in dispersions at any given altitude or at surface impact. The purpose of the wind uncertainty debris dispersion model is to define these dispersions.

It should be pointed out that the modeling approach to account for fragment dispersions due to wind drift can vary depending on whether the analyst is demonstrating that fragments will be contained within prescribed boundaries, thus controlling the risks, or is performing a risk analysis for the case where debris cannot be contained. Containment can be managed by determining that the maximum debris dispersions will be contained under the maximum allowable launch wind, whereas a risk analysis will require that wind induced impact dispersion statistics be developed. For containment analyses it may only be necessary to establish maximum allowable wind profiles while risk analyses will normally require defining the wind statistics.

b. Data Sources . The wind is usually defined in terms of a mean wind profile along with the associated uncertainties, usually presented on a monthly or annual basis. For day of mission assessments, the wind profile is usually obtained from pre-mission measurements using weather balloons, towers and radar profilers.

7-26(1) The wind is usually expressed in terms of the wind components in a local orthogonal coordinate system (such as an east-north system) as a function of altitude or in terms of the wind magnitude and direction as a function of altitude. In most cases, wind updrafts and downdrafts are ignored. (2) For monthly or annual wind data, the wind is generally defined in terms of the mean wind profile and the uncertainty in the wind defined by the standard deviations determined for each of the wind components at each altitude, and the correlation between the two wind components. In some cases the wind statistics may also include the correlations between wind components at one altitude and those at other altitudes. Usually these correlations are only provided for the wind components at a given altitude and those at the immediately adjacent altitudes. Wind statistics for a given location and time of the year are generated from manywind measurements (hundreds or thousands) taken over many years. These timeof-year wind statistics are used to perform planning risk analyses (i.e. for predicting risks for a launch planned for a future time). (3) Uncertainty should also be addressed for measured winds. Here the uncertainty is due to the uncertainty in the measurement of the wind (instrumentation error), the time elapsed between the wind measurement and the time of launch, and the spatial variation between where the wind is measured and where the launch

vehicle flies. The uncertainties due to instrumentation error can be estimated based on the characteristics of the wind measuring system and the uncertainties due to time delay can be developed, for given time of year, by performing statistic analyses of measured winds taken at short time intervals (typically one to six hour intervals). Uncertainty due to special variation is difficult to define and is often ignored (the wind statistics for a given location are assumed to apply over segments of flight) or the wind data used are changed as the vehicle progresses along its trajectory. Measured wind and associated uncertainties are used to perform risk analyses during the countdown prior to a launch. (4) Common sources of wind data are:

• Range Commanders Council (RCC) Range Reference Atmosphere data that is available for most of the test ranges.

• The Global Reference Atmospheric Model (GRAM) developed by NASA. This model can generate wind data for any given location on the Earth (latitude, longitude) using data from the Global Gridded Upper Atmosphere Statistics (GGUAS) database (distributed as the Global Upper Air Climatic Atlas) and the RCC Range Reference Atmosphere data.

• NASA developed statistical wind data.

• The Inter-Range Instrumentation Group (IRIG) wind statistics.

• The AFETAC wind database covering various launch ranges.

• Data published for a given range (both individual soundings and statistical) from historical wind measurements taken at the range using various measuring systems, such as Jimsphere, Rawinsonde, and Windsonde soundings, and Doppler Radar Profiler measurements. (These data are also used as part of the data base for the other wind data sources).

• National Oceanic and Atmospheric Administration (NOAA) data.

7-27c. Modeling Considerations . Wind statistics can be used to define the uncertainties in the fragment position at altitude or at surface impact, to define percentile and maximum permissible wind profiles for given directions, or to generate random samples of the wind profile. Approaches for the computation of wind-created debris dispersions range from the computation of maximum surface impact dispersions due to winds in various directions, to the development of impact distribution statistics or scatter plots. (1) Maximum dispersions are usually based on the worst wind conditions for which a launch would be conducted. In many cases these limiting winds are expressed as percentile winds; that is, winds in specified directions that would be exceeded a specified percentage of the time. Wind corrected impact points generated using these wind profiles are used to define the limits of the fragment impact uncertainty area due to wind.

• Percentile winds may be planar or in a given general direction, such as a wind coming from the South-West, and do not necessarily represent a real wind

condition.

• The maximum wind dispersion approach is often used for assessing the containment of debris and for defining caution and hazard corridors used to control the location and sheltering of people. The impact area defined by the maximum dispersion impact points could also be used to estimate a wind impact uncertainty probability distribution. (2) A wind covariance matrix can be used to compute the statistics of the debris impact uncertainty distributions directly, or to generate random wind profiles and corresponding wind corrected impact points (scatter plot) characterizing the impact distribution. The wind covariance matrix contains the variances of the wind components at each wind altitude, the correlation between the wind components at each altitude, and, if available, the correlations between wind components at a given altitude and other altitudes. It is important to include as much correlation data in the wind covariance matrix as possible in order to get the most accurate representation of the wind uncertainty and of the corresponding impact dispersions.

• The statistics of the debris impact uncertainty distribution can be computed using analytical models (such as partial derivatives) to relate impact (or altitude) displacements to the wind uncertainties defined by the covariance

matrix.

• Random wind profiles can be generated from a wind covariance matrix using a procedure employing a decomposition of the covariance matrix, such as a Singular Value Decomposition or a Cholesky Decomposition. Scatter plots generated from the random wind profiles can be used to generate the statistics of the impact distribution and to define an appropriate impact distribution fit.

An approach that has been used to handle wind effects for debris risk analyses is to compute the risks for many possible wind profiles for the time period for which a launch is planned. The wind profiles can be actual meas ured winds or random wind profiles generated from a wind covariance matrix. The resulting risk estimates can be used to assess the likelihood

7-28that the risks for a future launch will meet acceptable risk criteria. A launch agency or range can use this information to decide if a launch time should be restricted to a certain time of day, or should be planned for a different time of the year when the likelihood of exceeding acceptable

risk levels is reduced.

7.2.7 Free Flight of Inadvertently Separated Thrusting Motors

.

a. Model Description . Some launch vehicles carry thrusting motors that could separate and fly independently (free fly) to the time when the motor is destroyed or breaks up due to aerodynamic and inertial loads; in some cases the motor may be allowed to fly intact to thrust termination or impact. Potential sources of free flying motors include inadvertent separation of strap-on motors, early ignition and separation of upper stages, or ignition and separation of payload insertion motors. Also, normally jettisoned motors can have residual thrust that continues following separation. An inadvertent separation will likely affect the performance of the parent vehicle, including recoil from the detached motor or damage (or breakup) from the separation event, and this should also be considered in a risk assessment.

In many cases strap-on motors are required to carry an inadvertent separation destruct system (ISDS) that automatically destroys the motor in the event of an inadvertent separation. If the ISDS activates immediately upon inadvertent separation, dispersions due to free flight are eliminated. However, to eliminate or mitigate fratricide of the parent vehicle, there may be a time delay in the activation of the system allowing seconds of thrusting flight prior to destruct, potentially resulting in significant dispersions. In some cases the motors carry a termination system that must be activated by remote command from the Missile Flight Safety Officer (MFSO), and the time to destruct will depend on reaction time, signal transmission time, termination system activation time, and any intentional delays by the MFCO.

The simulation of free flight trajectories for inadvertently separated thrusting motors involves significant uncertainty for many reasons: (1) The initial attitude and attitude rates of the motor just after separation are uncertain, (2) The vehicle may be turning off course or tumbling at the time of separation thus adding additional uncertainty to the motor initial attitude and attitude rates, (3) The thrust magnitude and direction are often uncertain, particularly if the motor nozzle is gimbaled or is damaged during the inadvertent separation (due to contact with the parent vehicle), (4) The mass properties of the motor are uncertain and vary as the motor consumes propellant, and (5) The aerodynamic coefficients of the separated motor, particularly for large angles of attack, are uncertain, or are not available and need to be estimated.

The purpose of the dispersion model for free flight is to define the dispersions of the debris resulting from free flying motor destruct/breakup. These dispersions are

7-29often the primary source of the overall dispersions of debris resulting from a free flying motor.

b. Data Sources . Generally the dispersions of a separated thrusting motor require 6 degree-of-freedom simulations of the motor to the time of destruct, aerodynamic and inertial loads breakup, or surface impact. Si gnificant amounts of data are needed to perform these free flight simulations. These data may be required for an undamaged motor and for various damage states of the motor.

The data normally required, including their associated uncertainties, are: (1) Motor mass properties versus time, (2) Motor aerodynamic coefficients as a function of angle of attack, roll attitude, etc., (3) Thrust magnitude versus time,

(4) Thrust direction (may be a function of time),

(5) Estimates of the initial attitude and attitude rates of the motor following separation, and

(6) Data defining when during free flight a motor will break up or be destroyed.

Some or all of these may be available from the vehicle vendor. Often some of the data will need to be estimated by the anal yst, especially the uncertainties. Although aerodynamic coefficients are often available for the motor for low angles of attack, the extension to high angles of attack may have to be estimated based on data for similar motors or using computer tools developed to estimate aerodynamic coefficients. Initial attitudes and attitude rates are particularly difficult to predict and will likely need to be roughly estimated, including their associated uncertainties.

c. Modeling Considerations . The many uncertainties in the free flight trajectories for separated thrusting motors generally means that the dispersions need to be evaluated by simulating many free flight trajectories, where the many uncertain parameters are randomly selected for each simulation. The state vectors at breakup, destruct or motor impact can then be used to generate corresponding scatter plots for the motor or for its fragments. These can be used to compute the statistics of the impact dispersions, to generate an impact distribution histogram, or to compute risks for each impact point 1 (after accounting for other sources of dispersion).

Other factors that should be addressed include: (1) Potential damage states of the motor. For example a motor may have a nozzle with a fixed offset that would tend to cause the motor to tumble, but damage resulting from the inadvertent separation event could result in damage to the motor nozzle causing a change in the thrust direction and magnitude. In fact, the entire motor nozzle assembly including the throat could be knocked off causing the thrust to nearly align with the motor centerline. Although the damaged conditions generally result in reduced thrust, the change in the thrust direction could result in greater dispersions than for an undamaged motor. (2) Breakup of the inadvertently separated motor due to aerodynamic and inertial loads or destruct action and accounting for this in the free flight simulations.

7-30(3) In some cases the inadvertent separation of a solid propellant motor may be due to a burn through of the motor case, or the motor case could be punctured during separation, and the resulting side thrust and the effect on the motor normal thrust may need to be modeled in the free flight simulations. (4) Often it will be found that the fragment impact point scatter plot resulting from free flying motors is highly skewed or irregular. This presents a challenge for determining an adequate representation of the impact distribution. If the distribution cannot be modeled using a closed form distribution function, it may be necessary to perform risk computations using a numerical characterization of the distribution or by computing risks for each of the random impact points.

7.3 Debris Distribution Models

a. Model Description . Paragraph 7.2 discussed the modeling of fragment dispersions for each of the important sources of position uncertainty. The subject of this section

is the characterization of the overall distri bution of fragment position during free fall and at surface impact accounting for all sources of position uncertainty. These fragment distributions are required for the calculation of impact probabilities. The focus of the discussion will be on the development of two-dimensional distributions used to compute the probabilities of fragment impact onto or near specified population centers or vehicles on the surface (ground or water), to define areas where aircraft will be at risk, or to compute rough estimates of the risk to specific aircraft. Subparagraph 7.3.3 will address the special considerations for developing threedimensional distributions that may be needed to compute the probabilities of impact for specific aircraft (or a spacecraft) following a defined flight path.

b. Modeling Considerations

. Impact distributions can be defined in various ways. (1) One method is to fit the combined (multiple dispersion sources) dispersion statistics, or the distribution of random impact points (scatter plots from Monte Carlo simulations) that account for multiple dispersion sources, with closed form impact point distribution probability functions, such as bivariate normal distributions. A key advantage of this approach is that the closed form distributions are very efficient for computing impact probabilities which can be important for assessing the risks for a large library of locations (occupied buildings, groups of people in the open, populated regions, valuable assets, etc.) and/or for timely assessments of the risks during a launch count down. The shortcoming of this method is that the true distribution of impact points may have an irregular, skewed or segmented pattern that may not be adequately represented with a closed form function. The development of dispersion statistics and impact distribution functions is discussed in more detail in paragraph 7.3.1

.

• A variation on this approach when a scatter plot is used is to define the impact distribution using a rectangular grid to define the impact space and to compute the probability of impact within each grid cell by counting the number of random impact points in the cell and dividing by the total number of points (the resulting impact distribution can be represented by a two dimensional histogram). This results in a more accurate representation of the distribution

7-31but increases the data storage and computation time required to compute impact probabilities. The grid cell size is an important consideration since the smaller the cells the more accurate the representation of the impact point distribution, but if the cells are too small the impact probability in some cells may be under or over estimated due to under or over representation of impact points in the cells. Impact probability for a given location within a cell is computed by assuming a uniform probability of impact over the cell such that the impact probability is the probability of impact within the cell multiplied by the ratio of the area of the location to the area of the cell. (2) A second approach is to use random impact points that account for multiple sources of dispersion directly to define the impact distribution. In this case debris risk calculations would be performed for each of the random impact points. The resulting risk for each impact point is weighted by its relative probability and then the risks for all random impact points for the given failure scenario (failure mode, failure time and vehicle breakup mode) are added to get the risk. This provides a good representation of where a fragment can impact. However, this approach usually requires that a very large number of impact points be generated in order to adequately represent all of the possible impact locations for a fragment, and to get an accurate assessment of the risks. The probability of impact for a specific population center, and the corresponding prediction of the risk, could be significantly under or over predicted simp ly because the sample of impact points within and around the location are over or under represented. For example “holes” in the scatter of impact points could lead to a prediction of zero risk for a populated building where it is clear that credible deviations in the vehicle trajectory prior to breakup or in the fragment free fall trajectory could result in impacts on the building. The generation of random impact points that account for multiple dispersion sources is discussed in more detail in paragraph 7.3.2

. (3) A third approach is a combination of the first and second approaches. Here, some of the sources of impact uncertainty are treated by generating random impact points, while others are treated by generating closed form impact point uncertainty distributions about the random impact points. Impact probabilities, and corresponding risks, can then be computed for each impact point, but now using the closed form impact distribution function to compute the impact probability for allocation. Again the risks need to be weighted by the relative probabilities of occurrence of the random impact points. The advantage of this method is that the impact probability distributions about each impact point help to “fill in” the impact region so as to avoid under or over prediction of impact probabilities.

7.3.1 Impact Distribution Functions for Multiple Dispersion Sources

.

a. Model Description . The generation of impact uncertainty distribution functions to represent multiple sources of impact dispersion involves the combining of the statistics for the impact dispersions for each source, or the generation of a distribution function that fits a scatter plot that accounts for multiple sources of dispersion.

7-32b. Modeling Consideration . There are two basic approaches for developing impact

distribution functions. (1) In the simplest form the generation of the combined distribution involves combining the maximum (or near maximum) dispersion for each dispersion source to get the resultant maximum. The combining of the dispersions is usually done by root-sum-squaring the maximum dispersion values, although a very conservative approach could involve adding these values. The combined dispersion needs to be calculated for various directions to establish a maximum dispersion contour.

• If only a determination that debris is contained within prescribed range boundaries is required, the maximum dispersion contour may be all that is required.

• If risks need to be computed, the contour will need to be assigned a statistical significance, such as interpreting it to be a 3-sigma dispersion contour, and a probability distribution function that adequately fits the contour will need to be assigned. (2) The second method is to develop impact statistics for each dispersion source in the form of a mean impact point (defined by the impact point coordinates) and a

covariance matrix. The covariance matrix contains the variances in each of two orthogonal directions (diagonal terms) and the covariance as the off diagonal terms. The mean and covariance matrix for the combined dispersion sources can then be computed by adding the coordinate values of the means and by adding the covariance matrices. This requires that an assumption be made that the impact dispersions from the various dispersion sources are independent of each other. It may be necessary to verify that this assumption will not result in unacceptable errors in the statistics of the combined distribution. The resulting mean and covariance matrix statistics can be used as the basis to define an impact distribution function having its mean at the computed mean impact point and its standard deviations along principal orthogonal directions where the standard deviations and principal axis directions are computed from the covariance matrix. The challenge for the analyst is to select an appropriate impact probability density

function that fits the statistics.

• If the statistics of an impact distribution are generated from a scatter plot that accounts for multiple sources of impact uncertainty (see paragraph 7.3.2 ), the statistics can include the mean, standard deviations, correlation coefficient, and higher moments of the distribution. These can be used to select a closed form distribution function. The function can be compared with the scatter plot, or scatter plot histogram, to assess the goodness of fit.

7.3.2 Scatter Plots for Multiple Dispersion Sources

.

a. Model Description . As discussed above, the distribution of impact points for some or all sources of impact uncertainty can be represented by scatter plots (random impact points). The generation of scatter plots for computing impact dispersions, for each of the sources of uncertainty, are addressed in paragraph 7.2 . The generation of scatter plots representing multiple sources of impact uncertainty are addressed here.

7-33b. Modeling Considerations . Generating scatter plots that account for multiple sources of impact uncertainty requires that random trajectories be generated where random representations of each source of dispersion are accounted for in each impact trajectory simulation. Say, for example, that the sources of uncertainty to be treated are vehicle malfunction turn, fragment drag uncertainty and wind uncertainty. The generation of each random fragment impact point will then involve a random simulation of the vehicle malfunction trajectory (or random selection of a malfunction trajectory from the set of trajectories provided by a vehicle vendor) to vehicle breakup to establish the breakup state vector, a random selection of the fragment ballistic coefficient, and a simulation of the fragment free fall trajectory through a randomly selected wind profile. Each of these vehicle/fragment trajectory simulations will generate a single random impact point that accounts for all three dispersion sources.

A big advantage of generating random trajectories and impact points that account for multiple sources of uncertainty is that any correlation between the dispersions for the modeled dispersion sources are fairly accurately accounted for.

7.3.3 Considerations for Three-Dimensional Models

.

a. Model Description . The development of clearance zones for aircraft to avoid impact by hazardous debris from a failed launch vehicle or from a debris-generating weapons test can be generated using two-dimensional debris distributions at the aircraft altitudes of interest, similar to those developed for surface impact. Since the purpose of the clearance zone is to define regions where aircraft are not allowed, two dimensional distributions can be used to define horizontal plane (constant altitude) areas through which hazardous debris may fall and these, together with the time it takes for all hazardous debris to fall below the aircraft altitude(s), can be used to define the areas to be cleared and the time period that clearance is required. Using these two-dimensional distributions to compute the impact probability for a particular aircraft, however, generally results in an overstatement of the risk.

To obtain a better estimate of the risk to a specific aircraft that is flying through a hazardous region (either inadvertently or intentionally, such as an aircraft providinglaunch support), a three-dimensional debris dispersion model is needed. (A threedimensional model might also be required to assess the risks for a spacecraft with a known orbit.) Since the debris distributions will be continually changing as the fragments progress (rise and/or fall), and the location of an aircraft is continually changing, the dispersions for each class of fragments will need to be modeled as a function of time. The four-dimensional distributions (three-dimensions to define location and one for the time) are needed to define the probability of a fragment being in a given location at a given time. This, together with information to predict the fall velocity of a fragment and the velocity of the aircraft versus time, can be used to

determine the vulnerable volume of the aircraft. The two extra dimensions of the

7-34distribution (time and vertical position) makes the generation of these distributions of debris more complex than the generation of two-dimensional distributions.

b. Modeling Considerations . A viable approach to define the three-dimensional distributions is to propagate fragments from the debris generating event to a given time after the event using a Monte Carlo method where each fragment (or fragment group) is propagated many times, with the parameters characterizing the various sources of debris dispersion randomly selected for each Monte Carlo iteration. Thus, for example, a given fragment would be propagated for a random selection of the initial fragment state vector based on the uncertainties due to normal trajectory deviations (guidance and performance uncertainties), vehicle malfunction dispersions and velocities imparted at breakup; and for a random selection of the fragment ballistic coefficient and the wind profile acting during fragment free fall. Some of the sources of dispersion, such as wind or lift, could be handled analytically by computing the dispersions for given altitudes and combining these statistically with the dispersions generated through the Monte Carlo approach.

Following are comments on the general modeling approach and some important

considerations. (1) The resulting three-dimensional scatter of fragment positions at a given time can be used to define the probability of the fragment being in a given location by either 1) “binning” the volume of concern and computing the probability of beingin each bin using the number of samples in the bin, or 2) defining a threedimensional probability density function that adequately fits the random fragment locations. For computational efficiency the use of a probability density function is preferable. A density function that has been assumed in past analyses is a

trivariate normal distribution. (2) The distribution of debris and the debris velocities will change significantly as an aircraft passes through a debris cloud, and the aircraft can be impacted not only on top of the aircraft but also by the aircraft running into a fragment (see Figure

7-3 ). In fact, frontal impacts are usually more likely for aircraft traveling at high speeds (such as commercial airliners). Thus the speed of the aircraft and the speed of the fragment must be accounted for. The fragment velocity can be defined as an average velocity for each “bin”, an average over all fragment locations, or an average over all fragments within altitude bands. (3) Given the characterization of fragment position versus time, and the velocity of the fragment, the probability of impact on an aircraft can be computed by segmenting the fall time of the debris into short time segments, computing the probability of fragment impact on the plan area or frontal area of the aircraft during the time step, and adding the probabilities over all time steps. This will need to be done for each fragment (or for each fragment group, accounting for the number of fragments in the group) and the results statistically combined to get the probability of one-or-more impacts by a fragment hazardous to an aircraft. (4) Previously published material shows how the areas of an aircraft can be used (in conjunction with the speed of the aircraft, etc) to compute (1) the probability of impact for aircraft one specific trajectories through a debris cloud, and (2)

7-35Frontal area swept out by

Aircraft = A F Debris Looking down - plan area of aircraft = A T

Frontal area swept out by

Aircraft = A F Debris Looking down - plan area of aircraft = A T

probability of impact contours. 104 Both of those products are useful in demonstrating compliance with the probability of impact requirements contained

in the RCC 321 Standard. (5) The aircraft vulnerability models presented in Chapter 6 account for the velocity of the fragment, the velocity of the aircraft, and the various areas of a B747. However, the casualty area or catastrophe area ( A PROJ in the following equation) given by the Chapter 6 aircraft vulnerability models must be modified as follows for use as a reference area ( A I ) in standard probability of impact computations (much like the plan area of building is often used to compute the probability of impact on a building).

2 2

A d

I PROJ

d v v A A

v +

=

Figure 7-3. Aircraft impact geometry.

7.4 Impact Probability Models

a. Model Description . Paragraph 7.2 discussed approaches and considerations for modeling the dispersions of debris during free fall and at impact for the primary sources of debris dispersion. paragraph 7.3 discussed the development of twodimensional distributions used to compute the probabilities of fragment impact and to develop aircraft hazard areas, and the development of three-dimensional distributions for computing impact probabilities for a specific aircraft following a defined flight

104 Larson E. W .F., Wilde P.D, and Linn A.M., Determination of Risk to Aircraft from Space Vehicle Debris

, Proceedings of the First IAASS Sym posium, Nice, France, October 2005.

7-36path. The purpose of this section is to discuss the approaches and considerations for using the distributions to compute probabilities of fragment impact onto populated locations and other assets of concern. The focus here is on the computation of impact probabilities for assets on the ground using two-dimensional characterizations of fragment impact distributions. The computation of impact probabilities for aircraft (or spacecraft) using three-dimensional fragment distributions is addressed in paragraph 7.3.3

.

b. Modeling Considerations

. For the purposes of this discussion, impact probability (P I ) is defined as a conditional probability: given a debris-generating event, the probability a specific fragment will “impact” a specified person, building or other asset. The definition of “impact” is typically tied to the prediction of casualties or substantial damage, and thus does not necessarily imply direct physical contact. For an explosive fragment, “impact” includes whenever the fragment lands sufficiently close to a person or building to cause casualties or damage.

7-37The approach to computing P I depends on how the distribution of impact points is characterized (see paragraph 7.3 ). (1) If the impact distribution is characterized by an impact probability density function, the impact probability is obtained by integrating the probability distribution over the area of concern (the area for which an impact would cause casualties or damage). For people in the open this is the area within which the people are located. For people in structures and other assets this area will normally be the plan area of the structure or the plan area of a critical asset, with possible modification if the fragment has a steep angle of incidence at impact to account for side impacts on a building. As mentioned above, for explosive fragments the physical area occupied by people or by a structure needs to be expanded to include all locations where the blast loads can hazard the people or

structure.

• While the expanded area is considered for the calculation of casualties/deaths, the impact probability reported for fragments that explode upon impact is often based only on direct impact of a population center (e.g. directly hitting a building or impacting within the boundaries of a populated area).

• The fragment impact probability distribution could be either a closed form distribution, such as a bivariate normal distribution, or a segmented distribution defined by uniform probabilities of impact within grid cells, such as can be generated from a scatter plot. (2) If the random impact points from a scatter plot are to be used directly in risk calculations, the risks are computed for each point (i.e. the risks are computed based on the fragment impacting in its specific location). In this case the “impact probability” to be used for each random impact point is the probability that the particular impact point will occur (relative to all the other sample impact points for the given failure time and failure mode). The casualty/fatality expectation for a population center is then based on whether the fragment physically hit the center or, for explosive fragments, impacted sufficiently close to create risks due to the explosion loads or secondary debris.

• If a scatter plot is used to characterize the impact distribution for some sources of impact uncertainty and an impact probability density function is used to represent the other sources of impact uncertainty, the risks are again computed for each random impact point but with a probability of impact computed by integrating the density over the area of concern. This impact probability times the probability of occurre nce of the random point is then the net impact probability.

Although the probability of impact for each im pacting fragment is all that is required to compute the associated risks, a total probability of impact may be desired in order to assess the likelihood of a fragment impact into politically or environmentally sensitive areas. This total probability of impact needs to account for all of the fragments created by the debris-generating event. A definition of total impact probability used at several of the ranges is the probability of one-or-more impacts.

7-38With the above definition, the probability of impact for a given debris generating event is given by the following general relationship:



## ( ) ( ) ( ) 

## ∏

−−=−−

i I I iP moreorP 11 1 (Eqn 7-1)

where

P I ( i ) = Impact probability for the i th fragment,

and the product is over all fragments generated by the event. This probability ofimpact will, of course, need to be multiplied by the probability of the debrisgenerating event and summed over all events in order to get the total probability of impact for a population center or the total for a mission.

7.5 Modeling for Explosive Fragments

This section discusses modeling issues specific to the computation of risks for explosive fragments. Paragraph 7.5.1 discusses the modeli ng of explosive yields for fragments that can explode upon impact. paragraph 7.5.2 discusses the approach and issues associated with the calculation of risks for explosive fragm e nts that can hazard a population center even when the fragm e nt does not physically im pact on the center.

7.5.1 Explosive Yield Models

.

a. Model Description . Failures of space launch vehicles often result in im pacts of intact (or m o stly intact) com p onents containing liquid or solid propellants. W h en solid propellants are present, vehicle breakup can also produce m u ltiple chunks of propellant as well as inert m a terials. W h en these propellant-bearing com ponents and

chunks im pact (either the ground or an object) an explosion can occur. In addition, explosion of an intact vehicle m a y occur at the launch point, in the air or upon im pact of the vehicle. Explosive effects – a blast wave and ejected fragm e nts – expand outward rapidly and are capable of hazardi ng a large area. The effects of these

hazards m u st be characterized to produce a valid risk estim ate.

A yield factor is usually an output of an explosive yield m odel. The yield factor for a given propellant explosion is th e weight of TNT that would produce an equivalent explosive output divided by th e weight of propellant. Although the yield factor concept is straightforward, a com p li cation arises because different yield factors generally result depending on whether the explosive output is m easured in term s of the peak overpressure or the positive phase im pulse. (See Chapter 6 of this Supplem e nt for an explanation of these term s). Once the yield factor is obtained, the yield itself (usually expressed as pounds of TNT) is the product of the yield factor and the propellant weight.

7-39b. Data Sources . Several sources of information are available upon which yield models can be based, including: (1) Project Pyro (1968) provided test data for some models of liquid-propellant explosions for three combinations of oxidizer/fuel: liquid oxygen/RP-1, liquid oxygen/ liquid hydrogen, and hypergols (nitrogen tetroxide/hydrazine). Propellant weights ranged up to 100,000 pounds for the cryogenic combinations and up to 1,000 pounds for the hypergolic combination. Models resulting from Project Pyro provide yield factors as func tions of impact speed on hard and soft

surfaces. (2) A more recent test program (2003) for liquid propellants conducted at the White Sands High Energy Blast Facility (HEBF) provided data for yield models of six propellant combinations: liquid oxygen/liquid hydrogen, nitrogen tetroxide/liquid hydrogen, nitrogen tetroxide/ hydrazine, liquid oxygen/hydrazine, liquid oxygen/RP-1, and hydrogen peroxide/Jet A. Two types of testing took place; distributive mixing and drop. The distributive mixing tests were designed to produce the maximum mixing possible before ignition and were performed on all six propellant combinations. The drop tests were performed only on the liquid oxygen/liquid hydrogen combination in various tank configurations. The tanks were dropped onto a concrete pad from a tower. Maximum yields obtained from the HEBF tests are lower than those obtained for the three similar propellant combinations in Project Pyro. (3) Several organizations and individuals have produced models of explosive yield for solid propellants. Models have been developed for Class 1.1 and Class 1.3 solid propellants. Generally, Class 1.1 materials are those whose shock sensitivities are greater than that of TNT, while Class 1.3 materials have shocksensitivities less than that of TNT. Class 1.1 propellants are used in a few spacelaunch systems and some weapons systems (e.g., Minuteman II Stage III), while Class 1.3 propellants are used in many space-launch and missile system components. A 1991 model provided maximum yield factors for both types. (4) The more recent (1998) PIRAT (Propellant Impact Risk Assessment Team) project provided new yield factors for Cl ass 1.3 HTPB solid propellants. The PIRAT project measured explosive propagation in samples in a series of tests, and modeled the results using a two-dimensional hydrocode. The code was used to predict yield factors for different diamet er cylindrical motors with both side-on and end-on impacts, as well as for different chunk weights. Models based on PIRAT data predict yield factors as functions of motor diameter, impact speed and orientation (side-on, end-on) and propellant weight for motors or motor segments; and as a function of impact speed and weight for propellant chunks. (5) Another solid propellant impact yield model that has been used is based on a combination of PIRAT and empirical data (from tests and accidents). 105 This model provides the capability to compute yield factor uncertainty based on the observed scatter in the data and does not require knowledge of the orientation at impact for motor segments.

105 Wilde P.D. and Anderson M, Development of a Yield Histogram fo r Space Shuttle Blast Risk Analyses , 1999 JANNAF Safety and Environmenta l Protection Subcommittee Meeti ng, San Diego, 26-30 April 1999.

7-40c. Modeling Considerations . The following issues should be considered: (1) The characteristics of blast waves produced by explosions vary depending on the explosive material involved. The characteristics and behavior of blast waves as they expand outward from an explosion are well known for TNT. In addition, the

interactions of TNT blast waves on humans and structures have been studied and documented. Consequently, it is convenient to estimate the explosive yield of rocket propellants in terms of equivalent weight of TNT (TNT yield). These equivalent yields are only approximate because the shapes and durations of the blast waves produced by propellant expl osions often differ from those produced by TNT. (2) A valid yield model should account for the propellant weight at impact, the impact speed, the configuration or orientation of the propellant, and the impacted

surface material. (3) Yield models for various propellants have been available for years. Models have been based on accidental explosion data, test program data, engineering judgment, and combinations of these.

• Yields for liquid propellants vary with propellant type and the amount of mixing that occurs before ignition. Total mixing of all available propellants is unlikely because auto-ignition occurs within milliseconds of mixing, and the resulting explosion drives apart the unmixed portions.

• Most liquid propellant explosions are characterized as deflagrations rather

than detonations.

• When modeling liquid-propellant yield factors, some attention must be paid to tank configuration. Tests show a relationship between yield factor and propellant area-to-weight ratio.

Note : Impacting solid propellants may or may not explode, depending on propellant configuration (contained, uncontained, orientation), weight, and impact speed. Yields vary with these same factors plus the nature of the impacted surface.

d. Model Uncertainty . Yields estimated from accidents and test programs often vary significantly from those predicted by models. In many cases, the causes of such variations are unknown. For liquid propellants, estimated yields vary depending on the volume of propellant mixing assumed to occur before ignition. Solid-propellant yield models based on PIRAT results are currently considered to be the best available. However, the two-dimensional hydrocode used in the PIRAT analyses assumed infinitely-long cylinders. The hydrocode only simulates fully loaded motors and does not model nearly spherical motors such as an Inertial Upper Stage (IUS) or a Star motor. The effect on yield factor of larger and larger bore-holes, resulting as propellant burns, is unknown. These and other factors can lead to considerable uncertainty in estimated yields.

7-417.5.2 Risk Computation for Explosive Fragments

.

a. Model Description . The calculation of casualty (or death) expectation for fragments that explode at impact require special treatment due to the fact that the impact explosion can cause casualties even if the fragment does not physically impact a person or a structure. This is due to the fact that the blast loads (defined by the peak overpressure and the impulse) can directly cause casualties to people exposed to the blast loads or indirectly cause casualties due to structural damage or collapse and window breakage resulting from the blast loads acting on a building. Also, secondary debris thrown out from an explosion can be propelled into a person or structure. Thus the risk computations should consider all of the possible impact points of an explosive fragment that are sufficiently cl ose to a person, structure or populated area (people distributed into various shelter categories) to create hazardous blast loads or impacting secondary debris.

b. Modeling Considerations . The predicted risks for an explosive fragment with a given explosive yield (usually defined by its TNT equivalency) will vary with the distance of the explosion from unsheltered people or from an occupied building due to the varying overpressure loads. Also, for buildings the orientation of the explosion relative to the building may need to be considered. A good way to address this is to compute the expected casualties for each potential impact location of the explosive fragment, as defined by the fragment impact probability distribution or the random impact points from a scatter plot. These would then be weighted by the probability of impacting in each location, and summed to get the total casualty expectation for the given explosive fragment (given occurrence of the debris generating event).

The process is illustrated in Figure 7-4 where a grid has been set up about a population center that extends out to the maximum distance from the population center that the overpressure loads are hazardous to the people or the building. The explosion is assumed to occur in each of the grid cells and the corresponding risk computed. The relative probability of impacting in the grid cell is computed by integrating the impact probability distribution over the area of the grid cell. The risks for each grid cell are then multiplied (weighted) by their corresponding impact probability and these are summed to get the total risk for the fragment.

The calculation of casualties due to overpressure loads for a specific explosive event (location of the explosion relative to a populated site and explosive yield) is further discussed for unprotected people in paragraph 7.6.1b and for people in a building in paragraph 7.6.3

.

A similar process may need to be performed for the secondary debris thrown out from an explosion (debris from the explod ing vehicle fragment and/or the impacted surface). The secondary debris contribution to the risks becomes important when the debris can be thrown to distances beyond which the risks due to the overpressure loads are high.

7-42Figure 7-4. Procedure for computing risks due to an explosive fragment

7.6 Vulnerability and Casualty Models

Vulnerability models are used to predict the level of damage to humans, structures or vehicles due to the impact of a launch vehicle fragment or due to blast loads from an exploding fragment. Vulnerability models that may need to be considered are:

a. The direct impact of a fragment, or second ary debris created by the fragment impact, onto unsheltered people.

b. The impingement of blast loads on unsheltered people.

c. The direct impact of a fragment onto a structure.

d. The impingement of blast loads on a structure.

e. The direct impact of fragments onto ships, boats and aircraft.

f. The impingement of blast loads on ships and boats.

The models for the direct impact of fragments, secondary debris and blast loads on people are referred to as human vulnerability models. These models are used to predict the probability of casualty (or the probability of fatality) due to these threats. These models are used not only to predict the casualties for unprotected people, but can also be used to predict casualties for people in a structure or vehicle if the debris or blast load environment within the

structure/vehicle can be defined.

The vulnerability models for structures and vehicles are used to predict damage levels that can be used both for estimating economic loss and as the basis for predicting the casualties to the occupants of the structure or vehicle.

7-43This paragraph discusses general approaches and the important considerations and factors for developing vulnerability models. Threshold levels defining lower bound levels of threat at which injury to a person or damage to a structure or vehicle will occur have been presented in Chapter 6 of this supplement. These threshold levels can be used to determine if the calculation of expected casualties or the calculation of damage to structures/vehicles will be required for a given threat (fragment impact or explosive loading), or to perform conservative risk analyses.

7.6.1 Human Vulnerability Models . Human vulnerability models are used to predict the probability of casualty (or fatality) due to direct impact by a fragment, impact by the secondary debris created by the primary fragment impacting the ground, impact by the secondary structural debris created by the fragment penetrating into a building, or exposure to blast loads from an exploding fragment. These models are addressed separately for inert fragment/secondary debris impact and for blast loads.

a. Human Vulnerability to Inert Debris Impact

. (1) Model Description . This model addresses human casualties that result from impact by inert (non-explosive) fragments. This includes (a) direct impact by a vehicle fragment, including impact by the fragment after it penetrates a structure, (b) impact by secondary debris created due to fragment splatter or cratering of the impacted surface, (c) secondary debris thrown out from an exploding fragment, or (d) impact by the secondary debris created by fragment penetration of, or blast damage to, a structure.

Casualties from inert debris result from one or more of several injury

mechanisms:

• Penetration of the body by small, compact, high speed fragments. Since this generally requires high velocities it is not expected to result from impacting launch vehicle debris since, except for very early flight times, the fragment velocities are not sufficiently high. It may result, however, from secondary debris from an exploding fragment or from secondary debris created by explosion loads acting on a structure. Penetration can be segmented into chunky penetration and piercing penetration.

• Laceration or penetration by ragged metal fragments and glass shards by energy transferred to body organs and tearing of body tissues.

• Blunt trauma resulting from the acceleration of body organs or excessive body

deflections. Blunt trauma includes localized blunt trauma from small fragments that can impact over critical organs thus producing greater injuries.

• Crushing resulting from heavy fragments pinning body segments between the fragment and a rigid object such as the ground or a wall.

• Fragment impact causing a person to fall and strike the ground/floor, wall or other object. (2) Modeling Considerations

. Historical models for human vulnerability to debris impact have been relatively simple models that predict casualty as a function of the fragment impact kinetic energy. These have often been expressed in terms of a single kinetic energy level above which a person is assumed to be a casualty. Common values that have been used range from about 11 foot-pounds for the

7-44casualty threshold to 58 foot-pounds for assured casualty. An improvement on this are models that provide the probability or severity of casualty as a function of fragment physical parameters such as kinetic energy, mass, mass density, area, impact velocity, shape, and various combinations of these parameters. Many of the early models in this area are based on data from impact tests with a variety of shaped impactors on humans (including both live subjects and, for higher energy impacts, cadavers), animals (live subjects and cadavers), and dummies. The highest fidelity models consider the detailed biomechanical phenomena of impact as a function of time for specified impacting fragments and impact conditions.

The modeling of human vulnerability is complex and a detailed discussion of the various modeling approaches is beyond the scope of this Standard. Factors and considerations for developing human vulnerability models are as follows:

• The model must quantify the level of injury delivered to an individual by the impact. As noted above, the simplest historical models have typically expressed an energy threshold (e.g. 11 ft-lbs) which, based on test data, represents the minimum impact energy where impacts have resulted in sufficient injury to require some level of prompt, professional medical attention, the minimum definition of a “severe” casualty. Fatal injuries within this Standard are defined to be an injury that would, with high probability, be fatal to the individual assuming that no medical intervention is possible.

• All of the relevant injury mechanisms (listed above) should be addressed.

• The characteristics of the impacting fragment need to be addressed. The key parameters are the fragment mass, shape, density, deformability, orientation, and impact velocity (both magnitude and direction).

• The characteristics of the human that is being impacted should be addressed. Key parameters are the body mass, exposed area and susceptibility to injury. Two common categories used are adults and children. Further breakdowns can be considered such as male or female and age categories. It should be noted that age and overall health play a significant factor. Survival of a given level of injury varies by a large amount between elderly or infirm adults and robust, athletic adults in their prime; with susceptibility to the underlying injury varying by a factor of three or more.

• The location of the fragment impact on the body is important. A breakdown of the body that has been used is the head (with special consideration for the eyes), thorax, abdomen and limbs. Consideration also should be given to the location (front, back, side) of impact on the body and the offset of the fragment impact location relative to the center of gravity of the impacted body
part.

• More sophisticated models can consider fragility of individual organs or organ systems and parameters directly related to injuries, such as strain levels.Consideration of these factors, as well as anomalous injuries such as sidebody impacts which can deliver stresses which rupture the aorta due to inbody stress concentrators, and commotio cordis , the stoppage of the heart by a blunt trauma impact so timed as to disrupt the normal cardiac rhythm, tend to

be confined to research activities.

7-45• Body posture is another important factor since it affects both the body reaction and the exposed area. Common postures considered are standing, sitting and prone.

• Other considerations that may need to be addressed are the affect of a fragment impacting multiple body parts, and impact by more than one fragment on a person.

The calculation of casualties requires that the level of injury considered to constitute a casualty be defined. For this RCC Standard the Abbreviated Injury Scale (AIS) has been selected as the method for defining level of injury. The AIS was originally developed for use by crash investigators to standardize data on frequency and severity of motor vehicle related injuries. It has been extended to epidemiological research, trauma center studies to predict survival probability, patient outcome evaluation and health care systems research. The general definitions used for the AIS allow injuries of different natures to fall into standardized categories. The AIS level selected as the minimum to constitute a casualty for debris risks is AIS level 3. The general definition of this level is “reversible injuries; hospitalization required”.

b. Human Vulnerability to Blast Loads

. (1) Model Description

. Human casualties can result due to exposure to blast loads (overpressure and impulse) resulting from the impact of an explosive fragment. The primary sources of impact explosions are vehicle fragments, intact stages or an intact vehicle that contain liquid or so lid propellants. The explosive yield is usually expressed in terms of equivalent pounds of TNT (TNT equivalency). Modeling to predict TNT equivalency is addressed in paragraph 7.5.1

.

The primary injury mechanisms for blast loads are injury to soft tissue and injury due to whole body translation 106 . The body parts most susceptible to soft tissue injury are the eardrums, lungs, gastro-intestinal (GI) tract and larynx. Rupture of the lungs can lead to death. Whole body translation can lead to casualty due to the impact of the body with a rigid object such as the ground/floor or a wall, resulting in blunt trauma, penetration or crushing injuries. (2) Modeling Considerations

. Following are considerations for modeling the vulnerability of humans to blast loads.

• Blast load human vulnerability models should consider both the effect of the peak overpressure of the blast wave as well as the impulse (the integral of the blast wave time history). The peak overpressure is the key threat for soft tissue injuries to the eardrums, lungs, GI tract and larynx. The impulse leads to injuries due to whole body translation.

• The potential for the occurrence of multiple injuries, that increases the likelihood of occurrence of a casualty, may need to be addressed.

106 Whole body translation is the motion of a person due to the velocity imparted by the blast forces acting on a person’s body.

7-46• In addition to the threat from the overpressure loads from an exploding fragment there is also the possibility that fragments will be thrown out from the shattering of the hardware containing the exploding propellant or from the impacted ground, particularly if significant cratering occurs. The potential thrown debris will increase the risk to people within the throw range of the debris, and may even result in a larger area threatened due to fragments thrown beyond the range of hazardous overpressure loads. Thermal (including firebrands thrown out) and toxic hazards resulting from an explosion may also need to be considered, although these hazards have generally not been addressed as part of debris hazard analyses. Toxic hazards are generally evaluated separately (see Chapter 8 ) and thermal hazards have not heretofore been considered for debris risk analyses.

Models for human vulnerability to blast loads have ranged from very simple models that assume that a person will become a casualty if exposed to an overpressure greater than a specified value, to the more recent Pressure-Impulse (P-I) functions that give the probability of casualty (or fatality) as a function of P and I. These functions are portrayed as curves for various probability of casualty levels plotted as a function of P and I.

7.6.2 Model for the Casualty Area for Inert Debris Impact in the Open

.

a. Model Description

. Inert debris impacting into areas with unsheltered people hazards the people in one or more of the following ways (see Figure 7-5 ): (1) Fragment impacts a person directly during its initial fall to the ground, (2) Fragment impacts a person during its travel following a bounce off of the impacted surface, (3) Fragment strikes a person during a slide or roll along the surface, (4) Fragment spatters at initial impact with pieces from the shattered fragment thrown out to impact a person, or (5) Fragment creates a crater with ejected debris from the impacted surface being thrown out and impacting a person.

The casualty area is the area on the ground about the impact point of a fragment within which an exposed person would be expected to become a casualty.

b. Modeling Considerations

. The modeling of the casualty area for inert debris impact in the open requires an evaluation of each of the above listed phenomenon. This involves the modeling of the kinematics of the fragment initial impact trajectory, bounces off of the impacted surface, and sliding or rolling along the surface; and the kinematics of the secondary debris resulting from splattering and cratering. It also involves the modeling of the velocity and mass of the fragment, or the secondary debris pieces, at the locations during their trajectories where they could impact a person. Inert debris impacts can result from inert fragments created by the breakup of a launch vehicle or due to an intercept event, or from fragments thrown out from the impact of an explosive fragment (both debris from the shattered fragment and from

7-47the impacted surface). The casualty areas for debris thrown out from an explosion may only be of concern when the fragments can be thrown beyond the range where the probability of casualty due to the overpressure loads is high.

Modeling considerations and factors include: (1) The casualty area should address the total area about the fragment impact point where a person could be located and be struck by the fragment, or a secondary debris piece, that has sufficient mass and velocity (or kinetic energy) to cause a casualty.

• The probability of casualty (AIS level 3 injury or greater) for a person at a given location can be based on the human vulnerability model for inert debris (see paragraph 7.6.1a ).

• A simple, conservative approach is to assume that any impact by a fragment anywhere on a person constitutes a casualty (i.e. that the probability of casualty is always 1.0), in which case the casualty area would become the total area in which a person could be located and be impacted by the fragment or by a secondary debris piece. (2) Depending on the human vulnerability model used, the model for the casualty area may consider the part of the body that has been impacted. For example, the human vulnerability model could depend on whether a fragment impacts the head, thorax, abdomen or a limb, and the trajectory of the fragment, and the trajectories of any secondary debris, would need to be analyzed to determine the body part impacted for each location of a person. (3) Since there may be large uncertainty as to whether a fragment will splatter upon impact versus bouncing and/or sliding, the casualty area may need to be computed for each of these phenomena and the resulting casualty area obtained either by weighting each by their relative probabilities of occurrence and adding, or by conservatively assuming that the one resulting in the larger casualty area applies. (4) The size and posture of a person needs to be defined. Usually for impacts in the open a person is assumed to be standing. To simplify the kinematic computations a cylindrical model of a person could be used. For a fragment that bounces, the portion of the bounce trajectory for which the bottom of a fragment is over the head of a person should not be included in the casualty area. (5) The bounce characteristics of the fragment need to be modeled. Usually this is expressed in terms of a coefficient of restitution 107 from which the rebound velocity of the fragment can be computed. Since it is difficult to determine the bounce characteristics for each impacting fragment, it may be necessary to estimate a coefficient of restitution to apply to all fragments, or to all fragments having given general characteristics (for example, fragments consisting of uncontained solid propellant tend to have high bounce potential due to the rubbery nature of the fragments).

107 The coefficient of restitution is the ra tio of the rebound speed to the speed of a pproach in a collision. It is used here to compute the speed of rebound perpendicular to an impacted surface by multiply ing it by the speed of approach perpendicular to the surface. In a perfectly elastic collision the coeffi cient of restitution has a value of 1.0.

7-48(6) The impacted surface will affect the bounce and slide of a fragment. If the impact surface is known, the coefficient of res titution can be based on this surface. However, in general the impact surface is not known and an “average” surface may need to be assumed, such as compacted soil. Variation of the coefficient of restitution with impact speed may also be a factor. (7) A fragment may slide upon impact. Usually slide characteristics are expressed in

terms of a coefficient of friction that is used to estimate the slide distance. An average coefficient of friction may need to be estimated for all, or for specific categories of, fragments based on the assumed impacted surface. Generally if a fragment will bounce following impact the amount of sliding between bounces will be a relatively small contribution to the total casualty area. Also, for smaller fragments a slide into a person can only impact the foot or lower leg and thus may not constitute a serious injury. (8) Fragments might splatter upon impact. Modeling fragment splatter generally involves the definition of a maximum splatter range (or a probability distribution for splatter range), the number of splatter fragments, a mean splatter fragment size and a mean fragment weight. Experimental data and/or impact hydrocode simulations may be needed to develop estimates of the splatter parameters.

Figure 7-5. Hazards to an Unsheltered Person From Inert Debris Impact

7-497.6.3 Structural Vulnerability Models . Structural vulnerability models are used to assess the damage to structures and to predict the casualties (or fatalities) for the occupants of these structures. This section is presented as two subsections, one for inert debris impacting a structure and one for blast loads acting on a structure.

a. Vulnerability Modeling for Inert Debris Impact on a Structure

. (1) Model Description

. Inert (non-explosive) debris from launch and test operation failures hazards people inside structures primarily due to the potential of the fragments to penetrate into the structure. The ability of a fragment to penetrate is primarily a function of its weight, shape and speed at impact, although the material and density can also play a significant role. Since most debris will usually be falling vertically or near vertically at the time of structure impact, the primary hazard is from the debris penetrating through the roof, and any ceiling, of the structure, and potentially through one or more floors of the structure to hazard people on lower floors. If hazardous fragments can be impacting at shallow angles of incidence, it may be necessary to consider impacts on the sides of

structures.

The source of the hazard from inert debris is the potential for the fragment itself to strike a person as well as the potential for the structural debris from the roof, ceiling or floor(s) brought down by the penetration of the fragment to strike a person. The concept is portrayed for a three-story structure with a flat plywood deck roof in Figure 7-6

.

The prediction of casualties within a structure involves a description of the characteristics of the fragments resulting from fragment penetration (weights, shapes and velocities) and the application of human vulnerability models for inert debris as discussed in paragraph 7.6.1a

.

7-50Figure 7-6. Example of fragment penetrating multiple floors of a structure.

(2) Modeling Considerations

. Vulnerability models for structures should be developed for various categories of structures to cover the range of structures that may be occupied and hazarded by the debris from a failed vehicle. This categorization can be simple or detailed depending upon the required accuracy of the risk analysis. In a more detailed approach, the type of roof and floors to be used to represent each structure category will need to be defined in order to assess the probabilities of penetration and the resulting debris environment (penetrating fragment and collapsing building structure) at each floor level.

Important considerations and factors that should be addressed for the development of the inert debris structural vulnerability models are:

• Materials, sizes and spacing of the construction elements.

7-51• Location of the fragment impact on the structure roof relative to the structural elements (beams, joists, perlins, etc.).

• Weight, shape, size and velocity of the impacting fragment.

• Area of the roof or floor that fails, ranging from a simple punch through of sheathing (shear failure) to the shear or bending failures of supporting joists, purlins and beams.

• Velocity of the fragment following penetration of the roof and of each floor (used to determine if the fragment penetrates the next floor level and to calculate the probability of casualty if it impacts a person) and velocities of each structural debris piece that results from the penetration.

• Computation of the probabilities of casualty for people struck by a penetrating fragment or by the resulting structural debris pieces requires the application of inert debris human vulnerability models (see paragraph 7.6.1a ).

For each combination of fragment and structure category the total area for each floor of a building within which a person would be expected be a casualty (casualty area) or a fatality (fatality area) is defined. This casualty area is used in the calculation of the estimated number of casualties based on the density of people on a floor.

For each structure type it may be necessary to calculate casualty/fatality areas for a large number of fragment impact locations, weights, shapes and

velocities to obtain a model to address all cases of concern.

b. Vulnerability Modeling for Explosive Debris Blast Loads on Structures

. (1) Model Description

. Fragments that explode upon impact hazard people inside structures primarily due to blast loads (blast wave peak overpressure and impulse 108 ) acting on a structure causing structural damage or collapse and window breakage, or blast loads acting directly on people inside a structure (due to open windows or other openings in the building). Casualties result from the flying/falling structural debris, flying glass propelled into the structure and the blast wave entering the structure.

Although casualties from an explosive fragment can result due to the fragment directly impacting and penetrating a structure without exploding (in which case the vulnerability models for inert debris impact on a structure would apply), or due to the fragment exploding upon impacting the structure (before or after penetration), the contribution to the total risk from these direct impacts may be relatively small since the probability of impacting outside of a building so as to cause significant casualties is usually much larger than the probability of impacting directly on the structure. However this contribution to the risk may need to be considered, particularly if the explosive yield of the fragment is small.

108 Impulse is defined as the integration of the positive phase of overpressure with respect to time.

7-52(2) Modeling Considerations

. The unique risk factor for explosive fragments is that they can impact a considerable distance (perhaps thousands of feet) from a structure and still contribute significantly to the risk. Thus risk contributions need to be considered for impacts in an area that is much larger than the footprint of the structure itself (see paragraph 7.5.2 ). Unlike inert debris, that usually only causes failure of the roof of a structure, blas t loads can cause failure of walls, windows and vertical support members in addition to failure of the roof.

Approaches and considerations for development of a structure vulnerability

model for blast loads are:

• The blast loads from an impact explosion are a function of the explosive yield (usually expressed in terms of TNT equivalency, see paragraph 7.5.1 ) and the distance of the explosion from a structure. The contribution to the risk needs to be addressed for all fragment impact locations sufficiently close to a structure to experience hazardous blast loads.

• The blast loads on a structure are also a function of the orientation of the structure relative to the blast front, and thus the model may need to also

consider this.

• Atmospheric conditions effects the propagation and attenuation of the blast wave and thus the blast loads acting on the structure. For explosions occurring close enough to a building to cause significant structural damage the atmospheric conditions tend to be a secondary issue. Blast loads on structures located at large distances from the explosion, which are significantly affected by atmospheric conditions, usually only pose risks due to window breakage. These risks are not generally handled as part of a debris risk analysis but instead are assessed as part of a Distant Focusing Overpressure (DFO) risk analysis (see Chapter 8 ).

• The prediction of casualties within a structure involves modeling the level of damage to the structure including window breakage. It includes determination of the level of damage to the walls, roof and other structural

elements.

• Blast load vulnerability models need to be developed for various categories of buildings covering the range of structures that may be occupied and hazarded by the debris from a failed vehicle. This categorization can be simple or detailed depending upon the necessary accuracy of the risk analysis.

• For each structure category the type of roof, walls, floors and other key structural elements will need to be defined. This should include the types of materials (e.g., wood, brick, metal, concrete block, reinforced concrete, etc.) and construction methods. Also the types (e.g., annealed, tempered, dual paned, blast filmed), numbers and sizes of windows are needed.

• For a simplified approach it may be possible to estimate the probability of casualty for a person in a structure based simply on the predicted level of structural damage and the number of windows broken. For example, empirical casualty data collected for accidental or terrorist explosions and for

7-53earthquakes could be used to relate the probability of casualty to the level of building damage and the number of broken windows.

o The level of damage to a structure is sometimes expressed in terms of the percent structural damage.

• A more detailed approach involves defining the debris and glass environments inside of a structure. This requires the modeling of the numbers, sizes, shapes, velocities and directions of travel for the structural fragments to determine the areas hazarded. Also the numbers, sizes and throw distances of the glass shards from windows should be addressed.

o Human vulnerability models (paragraph 7.6.1a ) can be used to determine the portions of the hazarded areas within which a person would be expected to become a casualty. This should account for the variation in the probability of a person becoming a casualty throughout the hazarded area, and account for all fragments and glass shards that could impact a person at each location.

o Flying glass becomes the dominant contributor to casualties whenever the potential impact locations of an explosive fragment are beyond the range where significant structural damage will occur.

7.6.4 Ship/Boat Vulnerability Models

.

a. Model Description

. Risks to ships and boats can be an important consideration for some launch ranges, particularly those that launch out over the ocean. Although clearance of hazarded areas is the preferred method of reducing or eliminating the hazard to these vessels, there may be situations where there are ships or boats in the hazarded areas at the time of a launch, and a launch decision may need to be made based on the level of risk (casualty/fatality expectation). Thus vulnerability models may be required to perform the risk calculations.

b. Modeling Considerations

. (1) Inert Debris . The modeling of the vulnerability of ships/boats to inert debris impact involves the vulnerability of people to direct impact by a fragment for the people in the open (on the top deck) and the vulnerability of people in structures for the people located in the deck house, in the superstructure or below one or

more decks.

• The modeling approach for these is similar to those for land based structures and reference is made to paragraph 7.6.1a for vulnerability models for humans impacted by inert fragments, paragraph 7.6.2 for the modeling of the total casualty area for inert fragment ground impact for people in the open accounting for secondary effects (although the secondary effects will be somewhat different for impacts on a ship/boat), and paragraph 7.6.3a for vulnerability models for inert debris impact on structures.

• There are some additional issues that may need to be addressed for inert fragments:

o The impact could result in the capsizing or sinking of the vessel, thus putting the entire crew at risk, or

7-54o An impact could result in people being thrown overboard. (2) Explosive Debris . The modeling of vulnerability for ships/boats for debris that explodes upon water impact involves consideration of many different sources of risk. These sources of risk are dependent on the type of vessel, how far the explosion is from the vessel, and also how deep the water is where the ship is

located.

• First, the ship is exposed to the portion of the blast wave that is transmitted through the air. People on the top deck would be subjected directly to the blast loads. The blast wave could also damage or possibly collapse the deckhouse or superstructure and threaten the occupants due to the flying/falling debris. The blast wave could break windows resulting in flying glass (although windows on ships and boats will tend to be stronger and of materials that would make them less likely to break). If the blast loads are severe enough, the integrity of the ship or boat could be compromised, resulting in capsizing or sinking.

• Additional sources of risk result from energy of the explosion that is

transmitted into the water. The shock wave transmitted into the water (referred to as underwater shock) will travel through the water and could hit the side of the ship and/or reflect off the ocean floor and hit the underside of the ship. Because water has a higher density than air, this shock wave will travel through the water and reach the ship hull faster than the shock wave that travels through the air. The underwater shock could cause sudden motions of the vessel potentially injuring occupants. People who are standing could break their ankles or feet, people who are sitting could incur spinal injuries, and people that are standing or sitting could be injured by being thrown into bulkheads, walls or decks. The underwater shock could also cause failure of the hull of the ship or boat, thereby causing the vessel to sink.

• Also the explosion energy transmitted into the water will create a wave on the surface of the water, which could rock the ship or boat enough to knock crewmembers off of their feet or, if the wave is large enough, capsize the

vessel. This surface wave travels slower than both the underwater shock and

the air blast wave.

• The combined effects of these multiple sources of casualties (Air shock wave, underwater shock, surface wave) may need to be addressed. That is, the effect on the ship due to the underwater shock may affect the level of hazard posed by the wave action and/or by the air blast wave.

Vulnerability models may need to be developed for various types of ships and boats. Consideration should be given to the various construction methods (wood, fiberglass, steel, or a combination of these materials) and the various sizes, which could range from a relatively small recreational boat to a large cargo or cruise ship several hundred feet long and having several

decks.

7-557.6.5 Aircraft Vulnerability Models

.

a. Model Description

. The vulnerability of aircraft to debris impacts was under investigation at the time this RCC 321 Standard was developed. Chapter 6 provides aircraft vulnerability models for large commercial jet aircraft; vulnerability criteria for other classes of aircraft have not yet been assessed.

Historically a conservative estimate was used to define inert fragments that could be hazardous to aircraft. The risk acceptability standard for aircraft assumed that an impact by a compact fragment greater than 1 gram results in a catastrophic failure of the aircraft. This fragment weight is considered to be the approximate minimum that is hazardous to an aircraft. Although the hazard posed by a 1 gram fragment is based on ingestion by an aircraft engine, the 1 gram criteria has been used to apply to an impact anywhere on an aircraft. This standard was initially applied for all types of aircraft and fragments of all sizes, shapes and materials. At this time, the previous standard continues to be the best available approach for all types of aircraft except commercial transports.

It has been recognized that an improved aircraft vulnerability model is needed to avoid unnecessary conservatism in predicting the risks to aircraft and for defining the clearance areas for aircraft during launch or weapon test operations. Chapter 6 of this Supplement presents new commercial aircraft vulnerability models based on the findings. This section documents important considerations for the assessment of aircraft vulnerability.

b. Modeling Considerations

. Modeling considerations and factors follow: (1) In general the vulnerability of aircraft should be dependent on properties of the debris, the aircraft at risk, and the impact geometry, and should address the probability of outcomes of various severity levels caused by the impact on the

aircraft. (2) The type of aircraft plays an important role in the severity of a fragment impact. It is important to consider the classes of aircraft of concern, and develop vulnerability models appropriate to each type. Aircraft materials, locations of critical systems, and regulatory design requirements are important for assessing the vulnerability of an aircraft. Possible classes of aircraft may include air carrier, commuter aircraft, helicopters, private jets, private small craft, and military

aircraft. (3) The characteristics for each class of aircraft of concern will need to be defined, such as the engines, projected areas, control systems, skin type, etc. Within each aircraft class it may be necessary to assess the variations in the aircraft characteristics and select “representative” aircraft models to use for the development of vulnerability models to be applied to the class of aircraft. Engineering data for the representative aircraft will be required to define both the external and internal components, including material types and thicknesses. In order to apply the vulnerability model to other types of aircraft within a class it may be necessary to define parameters to allow scaling of representative aircraft

7-56to the other aircraft in the class, such as fuselage dimensions, wing dimensions, and engine size/number. (4) The vulnerability models should consider the effects of debris of various sizes and effective densities, impacting from various angles upon each section of the aircraft. The debris parameters to be considered include material type, shape, and weight. (5) All of the critical failure scenarios should be addressed such as engine ingestion, secondary fragments generated by engine or propeller damage, windshield penetration, wing or tail penetration, fuel line or tank rupture, compromise of aircraft controls or control surfaces (including electrical or hydraulic system damage), and cabin depressurization including penetration by the fragment into the fuselage (potentially creating secondary debris). Both direct and indirect effects need to be addressed where indirect effects include such things as ejection of passenger(s) due to fuselage penetration and depressurization, casualties from a rapid altitude drop due to a depressurization event and, of course, loss of control of the aircraft resulting in a crash. (6) Aircraft-induced aerodynamic effects may need to be considered. Examples of these effects include airstream deflection of debris so it does not hit the aircraft, or an engine sucking in debris that would otherwise not impact the aircraft. This is only an issue for fragment densities well below the density of aluminum. (7) The development of comprehensive vulnerability models may necessitate detailed structural effects analyses using availa ble structural dynamics codes, use of available penetration models, and evidence of effects from any available incident data (such as debris sucked into an engine). Models should be compared with empirical evidence where possible. Incident data can be collected that includes foreign object damage (FOD) from FAA/DOT and/or military databases.

7.7 Models for Casualty Area and Fragment Probability of Casualty

7.7.1 Model Description

. Paragraph 7.6 discussed vulnerability models for humans, structures and vehicles. The concept of casualty area and probability of casualty was also introduced. The casualty area, or the fragment probability of casualty, for an impacting fragment is used in the calculation of casualty (or fatality) expectation (see Paragraph 7.8 ) by relating the impact of a fragment to the expected number of casualties given impact. The purpose of this section is to define and discuss these parameters and the approaches and factors that should be addressed.

Casualty area (A C ) is defined to be the area about the impact point of a fragment within which a person would be expected to become a casualty (AIS Level 3 or greater injury). It is a theoretical region within which 100 percent casualties are expected to occur and outside of which no one is a casualty. It usually accounts for the probability of a person becoming a casualty and therefore does not necessarily include the entire area hazarded by an impacting fragment. It is a weighted, or effective, area co nsisting of the sum of the products of sub-areas where the fragment could hazard a person times the corresponding probability that, if the person is located in the sub-area, he would become a casualty.

7-57Fragment probability of casualty (PCF), on the other hand, is the probability that a person in a given location will become a casualty, given that a fragment from a given hazardous event

hazards the location. It is sometimes used instead of a casualty area in the calculation of casualty expectation. This fragment probability of casualty is not the same as the individual risk probability of casualty referred to elsewhere in this Standard; which is the total risk to an individual accounting for all hazardous events, all potential failure times, all debris generated by each event at each failure time, and the pr obabilities of occurrence of these events.

Casualty areas are often used to compute the risks to people for inert fragments, and fragment probability of casualty is often used to compute the risks to people for explosive fragments, although this is not always the case and depends on the types of vulnerability models used. When casualty area is used for inert fragments it would be applied to:

a. The direct impact of an inert fragment, or secondary debris created by the fragment impact, into unsheltered people,

b. The direct impact of a penetrating inert fragment, or debris created by the fragment penetration, into people inside of a structure, or

c. The direct impact of fragments into ships or boats.

When fragment probability of casualty is used for explosive fragments, it would be applied to:

d. The impingement of blast loads (peak overpressure and impulse) from an explosive fragment on unsheltered people,

e. The impingement of blast loads on a structure causing structural collapse and window breakage, and

f. The impingement of blast loads on ships and boats causing structural damage, window breakage, underwater shock, or wave action causing sudden motion of the ship or boat.

It is also expected that fragment probability of casualty will be used for inert fragments impacting an aircraft.

7.7.2 Modeling Considerations

. Casualty area, A C , for an inert fragment for unsheltered people is simply the theoretical area about the impact point of a fragment within which all occupants would become casualties (see paragraph 7.6.2 ). For an inert fragment impacting a given type of structure the A C is the area inside of the structure (for a given floor of the structure) within which all occupants would become casualties (see paragraph 7.6.3a ). For inert fragments impacting a ship or boat, the A C is either the area for unsheltered people (people on the top deck) or the area for sheltered people (people in the deck house or below one or more decks).

Fragment probability of casualty, P CF , due to an explosive fragment for unsheltered people is the probability that a person will become a casualty from an explosion at a given location relative to the person (see paragraph 7.6.1b ). Because of variations in vulnerability in a normal population, not everyone exposed to given overpressure loads (peak overpressure and

7-58impulse) will become a casualty. The probabilities are summed (after weighting by the probability of impact at the location) over all hazardous impact locations.

The P CF due to an explosive fragment for people in a given type of structure is a function of the damage to the structure (see paragraph 7.6.3b ).

a. One approach is to estimate the P CF for people in the structure from the level of structural (and glass breakage) damage based on empirical data.

b. Another approach is to model the falling/fl ying debris and flying glass environments within the structure and then use the human vulnerability models to predict the P CF

. (1) In this case the probability may need to be a function of the location within the structure (near an outer wall, in the interior of the structure, near a window, etc.). (2) If the environment inside of a structure is modeled, it may be determined that developing a casualty area would be a better way to compute the risks than using a fragment probability of casualty.

Although this section addresses relatively complex methods for computing casualty areas and fragment probabilities of casualty, there is a very conservative approach that could be used that would not require complex modeling. This is to assume that anyone that is exposed to a hazard will become a casualty. In this case:

c. Any unsheltered person within the total area hazarded by an inert fragment or the secondary debris would be assumed to be a casualty,

d. Any person in a structure that is impacted by a fragment that can penetrate the structure would be assumed to be a casualty,

e. Any unsheltered person exposed to a threshold hazardous overpressure (see Chapter 6 ) or greater would be assumed to be a casualty,

f. Any person in a structure subject to a threshold hazardous overpressure (see Chapter 6 ) that could cause hazardous damage to the structure or its windows would be assumed to be a casualty, and

g. Any person on a ship, boat or aircraft that is impacted by a hazardous fragment or a hazardous overpressure would be assumed to be a casualty.

If this approach, or some conservative variation thereof, is used and the risks are found to be acceptable, then the more complex models may not be needed.

7.8 Risk (Casualty/Fatality) Expectation Models

7.8.1 Model Description

. Preceding sections have discussed the various models needed to perform risk analyses for the debris generated by in-flight launch vehicle and weapons test failures, intercept events and planned hardware jettisons. This section discusses the approach and the considerations for combining the output of these various models to generate risk estimates; expressed in terms of casualty expectations, fatality expectations, individual probability of casualty and individual probability of fatality.

Casualty expectation is defined as the expected number of casualties from a launch or weapons test. It is the mean number of casualties predicted to occur as a result of a launch/test

7-59operation if the operation were to be repeated many times. Fatality expectation is defined similarly. Individual probability of casualty or probability of fatality is defined as the probability of a specific individual becoming a casualty or a fatality.

The basic equation for computing the casualty expectation for a specific debris generating event, specific fragment and specific population center is:

E C = 

### Σ P I (1/A) A Ci N i (Eqn 7-2) (used when the casualty model gives a casualty area, often used for inert fragments),

or

E C = 

### Σ P I P CFi N i (Eqn 7-3) (used when the casualty model gives a fragment probability of casualty, often used for explosive fragments)

where the summation is over the number of shelter categories, and where:

E C = Casualty Expectation.

P I = Probability of the fragment impacting so as to hazard the population center ( 7.4 ). A = Population center area.

A Ci = Casualty area for the i th level of sheltering (see 7.7 for casualty area calculation).

N i = Population in the i th level of sheltering.

P CFi = Fragment probability of casualty for the i th level of sheltering (paragraph 7.7 discusses calculation of fragment probability of casualty)

The equation for fatality expectation is the same except that casualty area or fragment probability of casualty is replaced by fatality area or fragment probability of fatality.

Level of sheltering is the type of shelter afforded people, including no sheltering (in the open). The levels of sheltering can range from a simple model where everyone is assumed to be in the open or in a certain type of structure (defined by the building characteristics) to more complex models where people are allocated into multiple types of shelters, and a unique casualty area or fragment probability of casualty is computed for each shelter type.

7.8.2 Modeling Considerations . An option sometimes employed to compute E C , leading to a conservative (high) estimate of the casualty expectation, is to assume that everyone in a
population center impacted by a fragment is a casualty. Then E C = 

### Σ P I N i

.

Another option sometimes employed is to assume that all people within a population center are in the same level of sheltering, and the casualty area or probability of casualty used is that for the selected level of sheltering. In this case the level of sheltering often selected is no sheltering, i.e. all of the people are in the op en. Although assuming that all people are in the open may lead to a conservative estimate of the EC, this is not always the case. Heavy inert fragments that can penetrate into a structure can pose a greater hazard (larger casualty area or larger fragment probability of casualty) to people inside of the structure than if they were in the

7-60open. Also an explosive fragment can pose a greater hazard to people inside of a structure than if the people were in the open. Thus, making the assumption that all people are in the open (or in a selected type of structure) should be done with care in that it could actually result in an

underestimation of the risk.

The other terms in the equation for casualty expectation require the development of a population library containing data defining population centers. The library consists of descriptions of where people are located, the area occupied, the number of people in each location, and definitions (or assumptions) of how these people are sheltered. The terms are:

a. The location of people is defined in terms of the coordinates (usually latitude and longitude) of the centroid of the populated area.

b. The area, A, is the land area of the population center and is the area used in the

calculation of P I

.

c. The allocation of the people by shelter category (where N i is the number of people in

the i th category) can range from simply assuming that everyone is in the same type of sheltering to defining the number of people within each of several shelter categories (including unsheltered people). (1) The shelter categories can consist of a few basic categories for which vulnerability models are developed based on a representative structure description for each category. (2) For more detailed modeling, the shelter categories may consist of many structure types made up of specified wall, roof and window characteristics, and may include a separate structure category for each floor of multi-story buildings. In some cases unique structure categories may be developed for specific buildings close to a launch site for which there is a special concern for the safety of the occupants (or a concern for the economic loss that could result from a launch accident).

Population libraries can range from relatively simple to very detailed. A basic population library might consist of cells defined by a grid covering the land area of concern. A common grid system used is a latitude-longitude grid where each grid cell covers an area defined by ranges of latitude and longitude. Comments regarding cell coverage are:

d. Cells are typically a consistent size such as 1 degree in longitude by 1 degree in

latitude.

e. For each cell the number of people and the assumed sheltering (such as everyone in the open) are specified. People could also be assumed to be distributed into various types of sheltering, perhaps by allocating a percentage of the people to each shelter
type.

f. People are usually assumed to be uniformly distributed over each cell.

g. Cells can be used to define more detail population distributions if the cell sizes are

made smaller.

7-61A more detailed population library distributes people into population centers where each center is defined by its location, area and distribution of people by shelter
category.

h. The population centers typically consist of small land areas close to a launch site, with more specific allocations of people to shelter types, and become larger and more generic as the location gets further from the launch site.

i. In the immediate launch area a population center may consist of a single building, or a single floor of a multi-story building. j. As the distance from the launch head increases the population centers become complexes of several buildings and/or populated open spaces, subdivisions of cities or towns, entire cities or, for far distances, counties, states or even countries.

Greater detail in the population data allows for more accurate predictions of the risk. As mentioned earlier, the level of detail used to allocate people into shelter categories can have a significant affect on the risk predictions, but greater detail requires more work to define the locations and sheltering of people and requires the development of more numerous and more complex shelter vulnerability models.

The basic equation for E C presented in this section gives the risks to a given population center for the impact of a single fragment resulting from a debris-generating event. Each event is defined by a vehicle failure scenario, planned hardware jettison or weapon system planned debris-generating event, where a vehicle failure scenario is a specific mode of failure occurring at a specific time of flight and resulting in a specific mode of vehicle breakup. This E C is conditional in that it is the casualty expectation given that the debris-generating event occurs. To get the total conditional risk to the population center, the E C values need to be combined over all fragments generated by the event. Then to get the actual risk for the debris generating event, the population center conditional E C needs to be multiplied by the probability of the event occurring. Finally to get the total risk to the population center the contributions for all debris generating events (covering all flight times) need to be combined.

The total risk for a mission is the sum over all hazarded population centers.

Individual probability of casualty can be computed directly from the total casualty expectation. It is usually computed separately for each population center since the probability can vary significantly from population center to population center. For a given population center the individual probability of casualty is the total E C for the population center divided by the number of people in the center. In some cases the individual probability of casualty might be computed for each shelter category within a population center, possibly for each floor of a building. To get the individual probability of casualty to be used to determine if individual risk criteria are met, the maximum probability value over all population centers is typically used. Individual probability of fatality is computed similarly.

The probabilities of occurrence of the debris-generating events are important inputs to risk computations:

7-62k. For planned events, such as a weapon system intercept or hardware jettison, it is the probability of achieving the event.

l. For failure scenarios, the probabilities are usually defined for short flight time intervals, and the probability is computed by integrating a failure rate (probability of failure per second) over the time interval. A failure at a specified time during the interval (such as the mid-point time) is then used to represent a failure at any time during the interval. (1) The development of failure rates (for each of the credible vehicle failure modes) is a complex process and is beyond the scope of this Standard, although methods have been developed by various launch ranges and other organizations (such as the FAA and NASA), and many of these are documented. The accuracies of the failure rates are very important to the accuracies of the risk predictions. Changing the failure rate uniformly (over flight time) for a given failure mode by a factor results in the corresponding risk prediction being changed by the same factor.

7.9 Catastrophic Risk Modeling

a. Model Description . Catastrophic risk (casualty or fatality) modeling is a fairly new concept to ranges and is not common practice. It is an area of risk management that is gaining increasing attention and therefore, some guidelines for assessing catastrophic losses are presented here.

A catastrophe, for purposes of this standard, refers to an accident where there are multiple casualties/fatalities, with increasing seriousness of the catastrophe being related to increasing numbers of casualties/fatalities. 109

Most launch risk methods rely on average loss per launch or per year. There is no particular aversion to low probability – high loss consequences as long as the average risk is less than a specified collective risk criterion. Catastrophe aversion requires an additional criterion beyond the normal EC or EF criterion. This is compatible with some other fields such as systems safety that use two parameters to classify risk (probability of the event and consequences of the event) 110

.

109 OSHA promulgated a formal definition in 29 CFR 1960.2: “An accident resu lting in five or more agency and/or non-agency people being hospitalized for inpatient care.” However, the city of Santa Barbara, California treats ten affected individuals as the defining point for catastrophic risk . Ten persons is also used in a number of standards as the breakpoint at which risk profiles are required to become more catastrophe averse.

110 The risk matrix that is used by systems safety and de scribed in U. S. Dept. of Defense Military Standard (MILSTD-882E ) measures increasing severity of consequen ce along one axis and decreasing frequency of occurrence along the other axis. It is usually app lied to a single system and event, and in practice is more qualitative, having a severity scale that changes its measure of consequence with increasing severity. This can be more rigorously quantitative, however, in which case certain parameters related to the risk profile can be plotted in a risk matrix form. The risk profile developed for launch risk analysis is based on modeling of 1000’s of events and representing the results of all of these events in a single plot. Thus, parameters from the risk profile, P( ≥ 1) (for the probability of a casualty or fatality producing event) can be measured along the one axis and the average number of casualties or fatalities given a casualty or fatality pr oducing event can be measured along the other axis - providing a risk profile output in a system safety risk matrix.

7-63Mitigations to reduce the potential for a catastrophe should focus on the part of the EC that is connected to the catastrophe potential.

b. Modeling Considerations

. Aversion to catastrophe is accomplished by assigning a progressively greater restriction on activities that produce greater numbers of casualties. Two approaches can be used: (1) The first approach makes use of a risk profile whose development can be a timeconsuming and resource heavy process. (2) The second approach replaces “N”, representing the number of exposed persons in a population center, by “N k ” in the determination of casualty or fatality expectation. For a case where there is single exposed site, the casualty expectation E C = E(N) is replaced by E Ck = E(N k ).

The risk profile has two parameters, whereas E Ck has one. Using a risk profile is more accurate. Using a power of N, (N k ), is only accurate for one event and one population center, however it will always in flate the casualty expectation with the degree of inflation increasing for population centers (that have casualties) with larger populations.

7.9.1 Catastrophe Aversion Using a Risk Profile . A risk profile displays the probability of exceedance of levels of loss; it is a complementary cumulative distribution. It can be used for number of people or for levels of financial loss (in discrete intervals).It can be for a single event

or be annualized . The annualized risk profile is commonly referred to in some other industries

as the F-N curve.

A risk profile is developed by simulating 1000’s of accidents and recording the number of casualties from each accident in a single histogram that has the probability of exactly one casualty, exactly two casualties, etc., i.e. P(1), P(2), etc. Risk profile requisites include:

a. The simulated accidents must cover the full range of the failures, breakups, dispersions and populations potentially at risk, accounting for all potential failure

times.

b. The risk profile is constructed from the histogram, i.e. each value in the risk profile, P( ≥N), is computed by adding all of the terms in the histogram for N and above.

c. The histogram is discrete (exactly 1, exactly 2, etc.) and therefore the risk profile is a discrete complementary cumulative distribution.

A typical risk profile is shown in Figure 7-7

.

Indifference to catastrophe is shown on a risk profile plot as a line that decreases one order of magnitude in probability with each increasing order of magnitude in number of casualties (see Figure 7-8 ).The product of the value of P( ≥N) and N is constant along the line. The slope is -1 on a log-log scale.

If the slope is steeper than -1, and the acceptability criterion is “P( ≥N) must fall below the line for each value of N,” then the line is providing some aversion to catastrophic events.

7-64Figure 7-8 shows lines with slopes of -1.5 and -2 that represent progressively more catastrophe

aversion. The E C associated with each of these lines is 30×10 -6 . The line with a slope of -1.5 is consistent with the catastrophe criteria proposed in the standard, P×N 1.5 ≤ 1×10 -4 (casualties 1.5 ). The line with a slope of -2 is used by some other countries and some locations in the United States, but is it used with a higher starting probability value (value at N equal to 1).

Risk mitigation should be applied with an emphasis on reducing the risk profile so that it falls below the limit line for catastrophe.

1.E-08 1.E-07 1.E-06 1.E-05 1.E-04 1.E-03

1 10 100

N - Number of CasualtiesP[>=N] The risk profile is discrete, not continuous. The descending symbols with increasing n represent the height of bars for each value of P[ ≥ N] (at N). The heights represent the sum of all of the probabilities from P[N] to P[N

max ] P[ ≥ 1 casualty] - also the probability of a casualty producing accident

1.E-08 1.E-07 1.E-06 1.E-05 1.E-04 1.E-03

1 10 100

N - Number of CasualtiesP[>=N]

1.E-08 1.E-07 1.E-06 1.E-05 1.E-04 1.E-03

1 10 100

N - Number of CasualtiesP[>=N] The risk profile is discrete, not continuous. The descending symbols with increasing n represent the height of bars for each value of P[ ≥ N] (at N). The heights represent the sum of all of the probabilities from P[N] to P[N

max ] P[ ≥ 1 casualty] - also the probability of a casualty producing accident

Figure 7-7. Typical risk profile.

7-65Figure 7-8. Comparison of catastrophe tolerant and catastrophe intolerant limit lines.

7.9.2 Catastrophe Aversion Using a Modified Expectation Calculation . Catastrophe aversion using an altered E C computation substitutes the occupancy of each population center with a “pseudo N” that is larger than the normal occupancy as follows:

a. The occupancy can be raised by powers; for a population center with “N” exposed persons the number of exposed persons is replaced by “N k ”. (1) An alternate approach that uses factor s on “N”, instead of powers of “N”, has been employed in Europe for explosives safety storage. Norway, Sweden and Switzerland use a factor, φ , equal to 2 N/5 (see footnotes 111 and 112 ) with the pseudo occupancy for a population center becoming φ ×N.

b. A risk analysis is performed based on the altered occupancies.

If the casualty expectation or fatality expectation satisfies the normal acceptability criterion, then catastrophic risk from multiple casualties or fatalities has been averted.

A weakness of this approach is that if the population is broken up into many small population groups the risk analysis result is different (smaller) than if fewer, larger

111 NATO Allied Ammunition Storage and Transport Publication, NATO-AASTP-4, which was prepared by NATO AC/258, Risk Analysis Working Group (RAWG).

112 The Swiss cap the factor when n ≥ 20. Above n=20, n is set equal to 20 and the factor remains a constant

2 20/5 =16.

7-66groups are used to represent the population. In both cases, incorporating powers or factors to establish a pseudo N, the catastrophe potential will be reduced, but the result will not always be consistent.

In the U.S. in the 1970’s, the USAF Western Range applied a factor of 10 3 (N x 1000) to the number of people in certain populations who were unrelated to the activity and potentially hostile to the consequences of an accident. The risk analysis was run with the remaining part of the population having no factor applied. The mission design was then optimized with these adjusted populations to satisfy both the standard risk acceptability criterion and the primary objectives of the mission. The

factor of 10 3 was drawn from Chauncey Starr’s paper 113 that attempted to quantify the additional risk a person would voluntarily accept in an activity as a function of the benefit derived from the activity. 114

7.10 Risk Prediction Uncertainty

7.10.1 Model Description

. Risk (casualty or fatality) prediction models simulate complex events, requiring many sub-models that, at best , only approximate behaviors and have uncertain parameters. This discussion addresses the considerations for performing risk analyses that incorporate uncertainty into the decision making procedure.

Uncertainties are described in the two general categories of aleatory and epistemic.

a. Aleatory uncertainty is the uncontrollable variability of events, is typified by the distribution of debris impacts from one accident to another (the same initial conditions will not produce exactly the same consequences in sequential trials). In launch risk analysis models, the effect of aleatory uncertainty is most frequently averaged in the process of determining impact probability or E C

.

b. Epistemic uncertainty is the uncertainty in the model and its parameters. The model and its parameters may contain inadequacies that introduce model or systematic uncertainty. If epistemic uncertainty is accounted for, then the computed E C is no longer a point value but represented by a probability distribution.

113 Starr, Chauncey, “Societal Benefit versus Technological Risk,” Science , Vol.165, pp. 1232-38, 1969.

114 Otway, H.J., Cohen, J.J., “Revealed Preferences: Comments on the Starr Benefit-Risk Relationships,” Vienna: Institute of Applied Systems Analysis, 1975.

7-677.10.2 Modeling Considerations

. Options for accounting for uncertainty in model architecture include applying a Monte Carlo technique (random sampling of parameter uncertainties) or a simplified method where uncertainty factors/multipliers are applied to parameters that dominate

the E C computation. Significant sources of uncertainty that have been considered for debris risk analyses are:

a. The failure probability

b. The debris list

c. The debris impact distributions

d. The yield from the impact of explosive debris

e. The fragment probability of casualty, P CF , given a hit by inert debris

f. The P CF given exposure to the shockwave from exploding debris

g. The P CF given inert debris impact on a roof that is sheltering a person

h. The P CF given that the shockwave from exploding debris impacts a building that is sheltering a person.

i. The number of people in each population center.

The above is not a complete list but only highlights those that tend to dominate the uncertainty. Related comments are:

j. Failure probability uncertainty directly affects the uncertainty in the risk analysis results. Methods used to obtain failure probabilities normally result in less uncertainty if they account for different stag es, flight phases, and/or different failure modes. The distribution of failure probability versus time also has a significant affect on risk predictions.

k. Debris list uncertainty is very difficult to model. Due to a lack of valid empirical data, debris lists are difficult to develop and are thus a significant source of model uncertainty.

l. Debris impact distributions have uncertainties due to the appropriateness of the distributions, shifts in the midpoints of the distributions because of the difficulty in modeling vehicle behaviors prior to breakup, and changes in the size of the

distributions for the same reasons.

m. The uncertainties in items d to h above are most easily modeled by uncertainty factors. However, using uncertainty factors is a “top down” approach and has the potential of leading to an overstatement of the effect of the uncertainty in these
parameters.

An uncertainty analysis produces a probability distribution for E C (or E F ). The probability distribution will most likely tend to look somewhat like a normal distribution on a log-scale, i.e. a lognormal distribution. The distribution can be used to compute the average (or mean) E C or to provide corresponding cumulative values at confidence/probability levels, such as 90 percent or 95 percent. The decision maker can use these numbers to make decisions regarding the acceptability of the

risk.

7-68The fact that the uncertainty distribution tends to be lognormal (or a similarly shaped distribution) means that the average E C from the distribution is larger than the

E C computed before uncertainties are introduced. Figure 7-9 shows how E C grows as the ratio of the 95 percent and 5 percent levels of the uncertainty distribution grows. It is highly unlikely that the uncertainty distribution for E C will

have a ratio of the E C95 /E C05 (see footnote 115 ) of less than 100. This means that the average value of E C considering uncertainty may be at least double the point estimate

of E C computed without considering uncertainty.

0 1 2 3 4 5

1 10 100 1000

Ratio of P 95 /P 5 of Uncertainty DistributionFactor of EC(average) / EC(Point Estimate)

Figure 7-9. The effect of uncertainty di stribution breadth on the average value of e

c.

115 E C95 is the value of E C at the 0.95 level of the cumulative distribution for the uncertainty of E C and E C05 is the

value at the 0.05 level.

7-69This page intentionally left blank.

7-70

### CHAPTER 8

OTHER HAZARDS

8.1 Introduction to Other Hazards

A flight safety analysis must evaluate all hazards to ensure a compliance with the risk acceptability criteria provided in Chapter 3 of the Standard. The focus of the RCC-321 Standard has traditionally been on the inert and explosive debris resulting from a range mishap, but other hazards can exist and sometimes pose significant risks. These other hazards typically include exposure to toxic propellants, glass breakage from far field (below one psi peak) overpressure, and exposure to radiation. This chapter provides screening criteria and analysis considerations for hazard and risk assessments of these other hazards, as well as acceptable means to demonstrate negligible risk from other hazards by exclusion or containment.

8.2 Toxic Release Assessment

8.2.1 Scope . A flight safety analysis is used to establish launch commit criteria that protect all exposed people from any hazard associated with toxic release from a catastrophic 116
launch abort or a nominal launch and demonstrate compliance with the risk criteria of Chapter 3. The analysis should:

a. Account for any toxic release that will occu r during the proposed flight of a launch vehicle or that would occur in the event of a flight mishap.

b. determine if toxic release can occur based on an evaluation of the propellants, launch vehicle materials, and estimated combustion by-products.

c. account for both normal combustion by-products and the chemical composition of any un-reacted propellants.

d. account for any operational constraints and emergency procedures that provide protection from toxic release.

e. account for all people that may be exposed to the toxic release, including those on land and on any waterborne vessels, populated offshore structures, and aircraft that are not operated in direct support of the launch.

8.2.2 Strategy . To ensure adequate protection from exposure to any toxic release, toxics must be identified and either the risks contained or managed to acceptable levels. Guidelines for accomplishing this are provided in paragraph 8.2.3 through paragraph 8.2.5

.

116 “catastrophic” meaning that the vehicle is destroyed with or without FTS ac tivation; not to be confused with “catastrophic risk” which implies that a large number of people are casualties

8-18.2.3 Basic Hazard Analysis . A toxic release hazard analysis for launch vehicle flight shouldidentify all propellants used for each launch and identify whether each propellant is toxic or nontoxic. If the launch vehicle, including all launch vehicle components and payloads, uses only those propellants listed in Table 8-1, then no toxic release hazard analysis is necessary.

TABLE 8-1. COMMONLY USED NON-TOXIC PROPELLANTS

Item Chemical Name Formula

1 Liquid Hydrogen H 2

2 Liquid Oxygen O 2

3 Kerosene (RP-1) CH 1.96

a. Common Toxic Propellants . Table 8-2 lists commonly used toxic propellants and the associated toxic concentration thresholds, in parts per million (ppm), that constitute the lowest concentration that initiates an expectation of casualty used by the federal launch ranges for computing casualty risks. The toxic concentration thresholds given

in Table 8-2 are based on Air Force sponsored expert elicitations of panels of toxicologists. 117 For toxic propellant or combustion by-products, a range should prevent exposure to concentrations above the level of concern (LOC) or equivalent established by the U.S Environmental Protection Agency (EPA), Federal Emergency Management Agency (FEMA), Occupational Safety and Health Administration (OSHA), National Institute of Occupationa l Safety and Health (NIOSH) of the Centers for Disease Control (CDC), th e American Conference of Government Industrial Hygienists (ACGIH),or Department of Transportation (DOT) unless an EPA Acute Emergency Guidance Level (AEGL) exists for a toxicant that is more conservative than the LOC (that is, lower af ter reduction for duration of exposure). If an LOC has not been established, the range should demonstrate that exposure at the proposed toxic concentration threshold will not cause a casualty.

As explained in Paragraph 5.1.1 of this Supplement, the acceptable risk criteria in this standard are for the aggregated risk from all hazards associated with an operation. A range may need to establish a lower launch risk criteria for a toxic release to ensure that acceptable exposure concentrations for the general public are not exceeded when appropriate mitigations are in place. For example, the Eastern Range has placed a cap of 30E-6 expected casualties for the general public for a toxic release based on a Monte Carlo analysis of toxic risk for each launch vehicle, considering varying weather profiles and presenting an assessment of the toxic concentration levels to which the general public is exposed. They found that the concentration levels will not exceed the LOC for the general public if the collective risk is limited to 30E-6 or less with mitigations that include reverse 911 that facilitate shelter-in-place and

117 See Nyman et al, FAA Launch Emission Toxic Scr eening Methodology Final Report

, ACTA Report. No. FAA 00-01, June, 2000. A more recent elicitati on produced revised thresholds for NO 2 and HNO 3

.

8-2evacuations. Reverse 911 is a multi-line outbound calling system capable of sending recorded messages to a specific area with time critical information. Since those results are dependent on many factors, such as the location, size, and other characteristics of the surrounding population centers, a similar analysis should be performed for each range to ensure compliance with allowable toxic exposure limits that may be set by the Range Commander, federal, state, or local governments.

TABLE 8-2. COMMONLY USED TOXIC PROPELLANTS AND BY-PRODUCTS

Chemical Name Formula Toxic Concentration Threshold (ppm)

Nitrogen Tetroxide N 2 O 4 4

Mixed Oxides of Nitrogen (MON) NO, NO 2 , N 2 O 4 4

Nitric Acid HNO 3 4

Hydrazine N 2 H 4 8

Monomethylhydrazine (MMH) CH 3 NHNH 2 5
Unsymmetrical Dimethylhydrazine (UDMH) (CH 3 ) 2 NNH 2 5

Ammonium Perchlorate/Aluminum (threshold given for HCl by-product) NH 3 ClO 4 /Al 10

b. Uncommon Toxic Propellants . Any propellant not identified in Table 8-1 or Table 8-2 falls into the category of unique or uncommon propellants, such as those

identified in Table 8-3 , which are toxic or produce toxic combustion by-products.

Table 8-3 is not an exhaustive list of possible toxic propellants and combustion byproducts. For a launch that uses any propellant listed in Table 8-3 or any other unique propellant not listed, a toxic release hazard analysis should identify the chemical composition of the propellant and all combustion by-products and the

release scenarios.

c. Analysis Products . The products of a basic toxic release hazard analysis for launch vehicle flight should include the following: (1) For each launch, a listing of all toxics used on all launch vehicle components and any payloads. (2) The chemical composition of each toxic and all toxic combustion by-products. (3) The quantities of each toxic and all toxic combustion by-products involved in the

launch. (4) For each toxic and combustion product, identification of the toxic concentration threshold used and a description of how the toxic concentration threshold was

determined.

8-3TABLE 8-3. UNCOMMON TOXIC PROPELLANTS AND COMBUSTION BYPRODUCTS

Item Chemical Name Toxic Concentration Threshold (ppm) Formula

1 Fluorine F 2

2 Hydrogen Fluoride HF Determined according to § 8.2.3a

.

3 Potassium Perchlorate KClO 4

4 Lithium Perchlorate LiClO 4

5 Chlorine Oxides Cl 2 O, ClO 2 , CL 2 O 6 , Cl 2 O 7

6 Chlorine Trifluoride ClF 3

7 Beryllium Be

8 Beryllium Borohydride Be(BH 4 ) 2

9 Boron B

10 Boron Trifluoride BF 3

11 Diborane B 2 H 6

12 Pentaborane B 5 H 9

13 Hexaborane B 6 H 10

14 Aluminum Borohydride Al(BH 4 ) 3

15 Lithium Borohydride Li(BH 4 ) 2

16 Ammonia NH 3

17 Ammonium Nitrate NH 4 NO 3

18 Ozone O 3

19 Methylamine CH 3 NH 2

20 Ethylamine CH 3 CH 2 NHH 2

21 Triethylamine (C 2 H 5 ) 3 N

22 Ethylenediamine NH 2 CH 2 CH 2 NH 2

23 Diethylenetriamine NH 2 C 2 H 4 NHC 2 H 4 NH 2

24 Aniline C 6 H 5 NH 2

25 Monoethylaniline C 6 H 5 NHC 2 H 5

26 Xylidine (CH 3 ) 2 C 6 H 3 NH 3

27 Trimethylaluminum Al(CH 3 ) 3

28 Dimethylberyllium Be(CH 3 ) 2

29 Nitromethane CH 3 NO 2

30 Tetranitromethane C(NO 2 ) 4

31 Nitroglycerine C 3 H 5 (ONO 2 ) 3

32 Butyl Mercaptan CH 3 (CH 2 ) 2 CH 2 SH

33 Dimethyl Sulfide (CH 3 ) 2 S

34 Tetraethyl Silicate (C 2 H 5 ) 4 SiO 4

8-48.2.4 Toxic Hazard Containment . For a launch that uses any toxic propellant, a potential casualty distance for each toxicant and a toxic hazard area for the launch should be determined. A potential casualty distance for a toxicant is the furthest distance from the launch point where toxic concentrations may be greater than the associated toxic concentration threshold in the event of a release during flight. A toxic hazard area de fines the region on the Earth’s surface that may be exposed to toxic concentrations greater than the toxic concentration threshold of any toxicant

involved in a launch in the event of a releas e during flight. From the potential casualty distances, the toxic hazard area can be determined. A toxic release hazard analysis may determine the potential casualty distance for each toxicant as described in paragraphs 8.2.4a or 8.2.4b and a toxic hazard area as described in paragraph 8.2.4c . A range should strive to contain the toxic hazard by evacuating people or by imposing meteorological constraints; however, if the hazard cannot be contained then a statistical risk management approach should be employed.

a. Sample Potential Casualty Distances for Common Propellants . Table 8-4 lists potential casualty distances as a function of propellant quantity and toxic concentration threshold for commonly used propellants released in the event of a launch vehicle failure. These potential casualty distances were published by the FAA during their rulemaking on launch safety 118 . These potential casualty distances were designed to provide reasonably conservative estimates, however, the analyst is responsible to ensure that these potential casualty distances are appropriate for a particular launch. These distances are intended to facilitate a determination of whether a toxic risk analysis is warranted. A range should take actions to protect people at greater distances when an airborne toxicant released in a nominal or aborted rocket launch may produce concentrations above the Level of Concern (LOC), or an EPA established acute emergency guidance level (AEGL) if the AEGL is more conservative than the LOC (that is, lower after reduction for duration of exposure) for the commodity of concern..

Table 8-4 lists the potential casualty distance as a function of the total weight of propellant in the vehicle (all stages combined) at the beginning of flight.. A toxic release hazard analysis may use the potential casualty distances corresponding to the

toxic concentration thresholds established for a launch to determine the toxic hazard area for a launch, unless the launch conditions invalidate the assumptions used in the development of these distances. The launch conditions and assumptions used in the development of these distances are summarized in paragraph 8.2.4b

.

118 Federal Register / Vol. 65, No. 207 / Wednesday, October 25, 2000, page 63963

8-58-6 TABLE 8-4. TOXIC POTENTIAL CASUALTY DISTANCES

Potential casualty distances from the Launch Point

Concentrations (ppm) and Potent ial casualty distances (km) Quantity NO 2 4 ppm 1 UDMH 5 ppm 1 N 2 H 4 8 ppm 1 MMH 5 ppm 1 NO 4 ppm 1 HNO 3 4 ppm 1 HCl 2
10 ppm 1

(pounds) (km) (km) (km) (km) (km) (km) (km)

100 8 4 3 5 9 8 0

300 14 8 7 9 17 15 0

500 18 10 8 12 20 19 0

1000 26 15 11 17 26 24 0

2000 36 19 13 21 33 31 0

3000 44 22 15 24 39 35 1

4000 47 24 16 27 42 39 2

5000 50 26 17 29 45 42 2

7500 58 30 20 35 52 48 2

10000 64 34 22 37 58 52 3

20000 78 42 27 47 71 66 4

30000 91 47 29 55 81 76 5

40000 99 52 31 59 88 81 5

50000 105 56 34 64 100 87 6

60000 111 59 35 67 104 92 7

70000 116 62 36 72 109 100 8

80000 123 64 37 74 114 104 9

90000 126 68 38 77 118 108 9

100000 130 69 39 79 122 111 10

125000 138 74 42 85 131 119 12

150000 145 78 44 95 138 125 13

175000 151 81 45 99 144 131 14

200000 160 88 47 103 156 136 16

250000 167 94 49 110 163 148 18

300000 175 99 50 117 171 155 21

350000 182 103 52 122 179 161 22

400000 189 107 53 128 186 167 25

450000 203 110 54 132 193 173 27

500000 207 114 57 136 196 178 28

750000 230 127 61 157 206 184 37

1000000 247 140 64 170 220 195 43

1 Indicates a toxic concentration threshold from Table 8-2

. 2 HCl emissions from catastrophic launch vehicle failure.b. Sample Assumptions for Propellants . For a launch that involves any uncommon or unique propellant, a toxic release hazard analysis will need to determine the potential casualty distance for each such propellant. It is up to the analysts to determine if the assumptions are adequate or need to be adjusted for the particular conditions expected at their launch site during planned operations. Some previous analyses, including those that generated Table 8-4 above, have used the conditions and assumptions listed

below: (1) Surface wind speed of 2.9 knots with a wind speed increase of 1.0 knot per 1000

feet of altitude. (2) Surface temperature of 32 degrees Fahrenheit with a dry bulb temperature lapse rate of 13.7 degrees Fahrenheit per 1000 feet over the first 500 feet of altitude and a lapse rate of 3.0 degrees F per 1000 feet above 500 feet. (3) Directional wind shear of 2 degrees per 1000 feet of altitude. (4) Relative humidity of 50 percent. (5) Capping temperature inversion at the thermally stabilized exhaust cloud center of

mass altitude. (6) Worst case initial source term assuming instantaneous release of fully loaded propellant storage tanks or pressurized motor segments. (7) Worst case combustion or mixing ratios such that production of toxic chemical species is maximized within the bounds of reasonable uncertainties. (8) Evaluation of toxic hazards for both normal launch and vehicle abort failure

modes.

c. Toxic Hazard Area . Having determined the potential casualty distance for each toxicant, a toxic release hazard analysis should determine the toxic hazard area for a launch as a circle centered as the launch point with a radius equal to the greatest potential casualty distance for all the toxicants involved in the launch. If the toxic release does not originate at the launch point then the toxic hazard area should be adjusted or expanded accordingly. Containment is satisfied if: (1) There are no populated areas contained or partially contained within the toxic hazard area; and (2) No member of the public is present within the toxic hazard area during preflight fueling, launch countdown, flight and immediate post flight operations at the

launch site.

d. Evacuation of the Toxic Hazard Area . For a launch where there is a populated area that is inside or partially within a toxic hazard area, containment may be achieved if the range evacuates all people from the populated areas at risk and ensures that no one is present within the toxic hazard area during preflight fueling and flight.

e. Flight Meteorological Constraints . Containment of toxic hazards may also be achieved by constraining the flight of a launch vehicle to favorable wind conditions or to times when atmospheric conditions result in reduced potential casualty distances such that any potentially affected populated area is outside the toxic hazard area. A range may reduce the potential casualty distances by imposing operational

8-7meteorological restrictions on specific parameters that mitigate potential toxic downwind concentrations levels at any potentially affected populated area to levels below the toxic concentration threshold of each toxicant in question.

f. Containment Analysis Products . The products of a toxic release containment analysis for launch vehicle flight should include the following: (1) The potential casualty distance for each toxic propellant and combustion product and a description of how it was determined. (2) A graphic depiction of the toxic hazard area or areas. (3) A listing of any wind or other constraint s on flight, and any plans for evacuation. (4) A description of how the range determines real-time wind direction in relation to the launch site and any populated area and any other meteorological condition in order to implement constraints on flight or to implement evacuation plans.

8.2.5 Statistical Risk Management . If toxic hazards cannot be contained as described, the range should use statistical toxic risk management to protect public safety. For each such case, a range should perform a toxic risk assessment and develop launch commit criteria that protect the public from unacceptable risk due to planned and potential toxic release. A range should ensure that the resultant toxic risk meets the collective and individual risk criteria requirements contained in Chapter 3 of the Standard.

a. Toxic Risk Assessment . A toxic risk assessment should account for the following: (1) All credible vehicle failure and non-failure modes, along with the consequent release and combustion of propellants and other vehicle combustible materials. (2) Vehicle failure rates associated with credible toxic release modes. (3) The effect of positive or negative buoyancy on the rise or descent of each released

toxicant. (4) The influence of atmospheric physics on the transport and diffusion of each

toxicant. (5) Meteorological conditions at the time of launch. (6) Population density, location, susceptibility (health categories) and sheltering for all populations within each potential toxic hazard area. (7) Exposure duration and toxic propellant concentration or dosage that would result in casualty for all populations.

b. Risk Management Products . When using the statistical toxic risk management approach of paragraph 8.2.5 , the products of the risk assessment for launch vehicle flight should include the following: (1) A description of the range’s toxic risk management process, including an explanation of how the range ensures that any toxic risk from launch meets the risk criteria of Chapter 3 of the Standard. (2) A listing of all models used. (3) A listing of all launch commit criteria that protect the public from unacceptable risk due to planned and potential toxic release. (4) A description of how the range measures and displays real-time meteorological conditions in order to determine whether conditions at the time of flight are

8-8within the envelope of those used for toxic risk assessment and to develop launch commit criteria, or for use in any real-time physics models used to ensure compliance with the toxic launch commit criteria.

8.3 Far-Field Window Breakage

8.3.1 General . Flight safety analysis is also used to establish launch commit criteria that protect people from any hazard associated with far field blast window breakage effects due to potential explosions during launch vehicle flight and demonstrate compliance with the risk criteria of Chapter 3 of the Standard. The fa r field blast window breakage analysis should account for distant focusing overpressure and any overpressure enhancement to establish the potential for broken windows due to peak incident overpressures below 1.0 psi and related casualties due to falling or projected glass shards. As with all hazards, containing the hazard is the primary goal but if containment cannot be achieved then a statistical risk analysis must be performed to ensure compliance with the risk criteria.

8.3.2 Example Containment Method . This section describes an acceptable means, but not the only acceptable means, to demonstrate negligible risk due to far field window breakage. Specifically, a range may demonstrate contai nment of far field window breakage effects using the following screening method:

a. Explosive yield factors

. The analysis uses explosive yield factor curves for each type or class of solid or liquid propellant aboard the launch vehicle. Each explosive yield factor curve should be based on the most accurate explosive yield data for the corresponding type or class of solid or liquid propellant based on empirical data or computational modeling.

b. Maximum credible explosive yield

. The analysis establishes the maximum credible explosive yield resulting from normal and malfunctioning launch vehicle flight. The explosive yield accounts for impact mass and velocity of impact on the Earth’s surface. The analysis accounts for explosive yield expressed as a TNT equivalent for peak overpressure.

c. Population exposed to the hazard

. The example analysis demonstrates whether any population centers are vulnerable to a distant focusing overpressure hazard using the methodology provided by section 6.3.2.4 of the American National Standard Institute’s ANSI S2.20–1983, ‘‘Estimating Air Blast Characteristics for Single Point Explosions in Air with a Guide to Evaluation of Atmospheric Propagation and

Effects’’ and as follows: (1) For the purposes of this analysis, a population center includes any area outside the launch site control that contains an exposed site. An exposed site includes any structure that may be occupied by human beings, and that has at least one window, but does not include automobiles, airplanes, and waterborne vessels. The analysis accounts for the most recent census information on each population center. The analysis treats any exposed site for which no census information is available as a ‘single residence.’ The analysis treats any area where census

8-9information indicates a population equal to or less than four persons as a ‘single

residence.’ (2) The analysis identifies the distance between the location of the maximum credible impact explosion and the location of each population center potentially exposed. Unless the location of the potential explosion site is limited to a defined region, the analysis accounts for the distance between the potential explosion site and a population center as the minimum distance between any point within the region contained by the flight safety limits and the nearest exposed site within the population center. (3) The analysis accounts for all weather conditions optimized for a distant focus overpressure hazard by applying an atmospheric blast ‘‘focus factor’’ (F) of 5. (4) The analysis determines, using the methodology of section 6.3.2.4 of ANSI S2.20–1983, for each population center, whether the maximum credible explosive yield of a launch meets, exceeds or is less than the ‘‘no damage yield limit,’’ of the population center. If the maximum credible explosive yield is less than the ‘‘no damage yield limit’’ for all exposed sites, the remaining requirements of paragraph 8.3.2 do not apply. If the maximum credible explosive yield meets or exceeds the ‘‘no damage yield limit’’ for a population center then that population center is vulnerable to far field window breakage from the launch and the requirements of paragraphs (d) and (e) (below) apply.

d. Estimate the quantity of broken windows . The example analysis uses a focus factor of 5 and the methods provided by ANSI S2.20–1983 to estimate the number of potential broken windows within each population center determined vulnerable to the far field window breakage as required by paragraph (3) above.

e. Determine and implement measures necessary to prevent far field window breakage

. For each population center that is vulnerable to far field window breakage from a launch, the analysis should identify mitigation measures to protect people from serious injury from broken windows and the launch commit criteria needed to enforce the mitigation measures. The mitigation measures may include one or more of the following: (1) Apply an anti-shatter film to all exposed sites where the maximum credible yield exceeds the ‘‘no damage yield limit.’’ (2) Evacuate the exposed people to a location that is not vulnerable to the far field window breakage prior to the planned flight time.

8-108.3.3 Statistical Risk Management . If containment of the far-field window breakage hazard is not demonstrated, then the range must perform a risk analysis to demonstrate that the launch will comply with the risk criteria of Chapter 3.

a. Analysis Considerations . The analysis should account for: (1) The potential for distant focusing overpressure or overpressure enhancement given current meteorological conditions and terrain characteristics; (2) The potential for broken windows due to peak incident overpressures below 1.0 psi and related casualties; (3) The explosive capability of the launch vehicle on the pad at liftoff, at impact, at altitude, and potential explosions resulting from debris impacts, including the potential for mixing of liquid propellants; (4) Characteristics of the launch vehicle flight and the surroundings that would affect the population’s susceptibility to injury, such as, shelter types and time of day of the proposed launch; (5) Characteristics of the potentially affected windows, including their size, location, orientation, glazing material, and regional conditions; and (6) The hazard characteristics of the potential glass shards, such as falling from upper building stories or being propelled into or out of a shelter toward potentially occupied spaces.

b. Analysis Products . The products of a far field window breakage analysis should

include: (1) A description of the methodology used to produce the far field blast overpressure analysis results, a tabular description of the analysis input data, and a description of any far field window breakage mitigation measures implemented. (2) For any far field window breakage hazard or risk analysis, an example set of the analysis computations. (3) The values for the maximum credible explosive yield as a function of time of flight. (4) The distance between the potential explosion location and any population center vulnerable to the far field blast overpressure hazard. For each population center, identify the exposed populations by location, number of people, and window types and sizes. (5) Any mitigation measures established to protect people from far field window breakage hazards and any launch commit criteria established to ensure the mitigation measures are enforced.

8.4 Radiation Hazard Analysis Guidelines

8.4.1 General . A flight safety analysis should establish launch commit criteria that protect people from any hazard associated with radiation effects due to unconstrained directed energy or released radioisotope materials caused by equipment malfunction or vehicle flight anomalies.

8.4.2 Hazard Definition . The hazards to humans from radiation exposure can logically be divided into two categories; hazards caused by exposure to non-ionizing radiation and hazards

8-11due to ionizing radiation . The electromagnetic spectrum of radiation spans extremely low frequency energy wavelengths (10 10 μ m +) through high frequency wavelengths (10 -6 μ m and smaller) with the visible light portion (0.4 – 0.8 μ m) being most familiar. The effects of this energy on the human body are dependent upon exposure time and distance. The low frequency, large wavelength energies of the spectrum can be considered non-ionizing , since there is not a tendency to strip electrons from atomic structure as is the case for ionizing energies in the high frequency, small wavelength portion. The neutra l zone of visible light provides a separation of these two hazards. The human eye has evolved to operate in this region and is less vulnerable to damage from energies of this portion of the sp ectrum. However, visible light can also present risk to the optic receptors and must be examined.

8.4.3 Non-Ionizing Radiation Hazards . On the ranges, non-ionizing radiation hazards are typically provided from sources that generally involve electromagnetic emissions from equipment such as radio and microwave devices which can include:

a. Spacecraft/flight vehicle telemetry and communications systems

b. Radar systems

c. Satellite earth stations

d. Radio frequency (RF) generators

e. Cellular telephone base stations

f. Heat sealers (radiofrequency and microwave heat sealers)

g. Lasers and laser pointers

h. Microwave communications transmitters and receivers

i. Non-destructive inspection and test (NDI/NDT) equipment j. 60 Hz electrical power system, power lines, substations, transformers, etc.

k. Ultraviolet radiators

These non-ionizing hazards tend to affect the most vulnerable human body systems; the optic nerves and the skin, as directed energy exposure provides for localized heating to the point of cellular damage. The more sensitive optic nerve tends to provide the lower limit of exposure since damage can occur rapidly before the autonomous nervous system can react to cause eyelid closure or blink response. Of the sources listed, laser systems can provide substantial risk since the directed energy can potentially reach long di stances affecting ground or airborne personnel unrelated to the operation (e.g., airline pilots fl ying near the area, workers on distant elevated platforms or buildings). Strict procedural controls and beam control inhibits are used to mitigate

this risk and include:

l. Screening and Safety Procedures . ANSI standard Z136.1 defines the nominal ocular hazard distance (NOHD) which is dependent on the divergence, wavelength, and power of the laser and the effects of magnifying or eye-protection devices. Safety procedures for “typical” range laser applications are provided in RCC document 316- 98. These requirements allow for determination of a potentially affected region that must be cleared of personnel.

m. Risk Analysis Guidelines . For high powered lasers, containment is not possible according to these guidelines. In these cases, a probabilistic analysis needs to be performed that considers failures of the system and examines the possibility for

8-12exposure in more detail. Guidelines for risk analyses involving high power lasers are not the scope of this effort. Instead the analyst should examine RCC-316-98.

8.4.4 Ionizing Radiation Hazards . Ionizing radiation sources can affect the human system by stripping electrons from atomic structures, an d thus causing alterations in the DNA that can ultimately lead to life-threatening cancers. Sometimes difficult to detect, particles of radioactive substances can enter the human body via multiple pathways through the respiratory, skin, digestive, and circulatory systems.

a. Screening and Safety Procedures . DOT regulations on transportation container design test and qualification provide protection from release of radioisotope materials in many accident conditions. Following these basic procedures, monitoring worker exposure, and limiting access to these sources is often sufficient. However, in the case of Major Radiological Source that may be schedule for launch, there is no DOT approved vessel to completely contain the radioisotope material in the event of a

launch abort.

Major Radiological Sources are determined based upon the particular isotope’s A 2 value. Values for sources can be found in the International Atomic Energy Agency’s Safety Series Number ST-1, Regulations for the Safe Transport of Radioactive Material – 1996 Edition. Should the inventory exceed the A 2 value for that radionuclide it is considered a Major Source and more extensive safety review and security protocols become necessary.

For launch approval of Major Radiological Sources the range must comply with the requirements of Presidential Directive/National Security Council Memorandum 25 (PD/NSC-25), which calls for a review of the nuclear risk in the event of an accident during launch processing or ascent to orbit through the time when the object can no longer encounter Earth. PD/NSC-25 charters the Interagency Nuclear Safety Review Panel (INSRP), empanelled for each mission, to conduct an extensive review of the Launch Program’s nuclear Safety Analysis Report (SAR) and provide an independent Safety Evaluation Report (SER) to the President’s Office of Science and Technology Policy (OSTP) prior to granting approval for launch.

b. Risk Analysis Guidelines . For small radioisotope sources a specific, formal risk assessment may not be required other than a hazard analysis that identifies the dangers of exposure and provides procedural mitigations. For “Major Radiological Sources” scheduled for launch, PD/NSC-25 dictates that a thorough risk assessment must be accomplished to include pre-launch, ascent, and any potential orbital maneuvers prior to escape from Earth.

A risk assessment for Major Radiological Sources scheduled for launch should include an extensive analysis of all potential accidents that can release any quantity of radioisotope from the system. A detailed probabilistic risk assessment for Major Radiological Sources should provide subsystem failure probabilities that sum to a total launch failure probability, apportioned through the phases of pre-launch, ascent,

8-13staging, and escape orbit transfer. Event sequence diagrams often provide a means to estimate the conditional probabilities leading to accident outcome conditions that describe the effects a particular accident scenario may have on the radioisotope source. By understanding the potential threat to the source material, the potential release quantity and particle size distribution can be modeled for meteorological dispersion and ecological uptake. Sensitivity and uncertainty analyses in the risk assessment are used to provide an overall estimate of worst case release and latent cancer fatalities given an accident.

This Major Radiological Source risk estimate is provided to the decision maker for evaluation and approval or disapproval. Since each mission is unique, hazard assessment methodology can vary. For the most part the need for a critical evaluation drives state-of-the art modeling techniques and often times extensive testing of any hazardous systems that may threaten the radioactive source. AFI 91-110 has additional requirements radioactive source use and for launch approval of major radiation sources, but relies on the PD/NSC-25 process to provide risk acceptance.

8-14GLOSSARY

3-sigma: Three times the standard deviation, typically referenced to the mean value.

Abbreviated Injury Scale (AIS): An anatomically based, consensus derived, global severity scoring system that classifies each injury in every body region according to its relative importance on a 6 point ordinal scale.

Acceptable risk: A predetermined criterion or standard for a maximum risk ceiling which permits the evaluation of cost, national priority interests, and number of tests to be conducted.

Accumulated risk: The combined collective risk to all individuals exposed to a particular hazard through all phases of an operation. Guidan ce Information: for the flight of an expendable orbital launch vehicle, risk should be accumulated from liftoff through orbital insertion; for the flight of a suborbital launch vehicle, risk should be accumulated from liftoff through the impact of all pieces of the launch vehicle, including the payload.

Aggregated risk : The accumulated risk due to all hazards associated with a flight. Guidance Information. For a specified launch, aggregated risk includes, but is not limited to, the risk due to debris impact, toxic release, and distant focusing of blast overpressure.

Aleatory uncertainty : The kind of uncertainty resulting from randomness or unpredictability due to stochasticity. Aleatory uncertainty is also known as variability, stochastic uncertainty, Type I or Type A uncertainty, irreducible uncertainty, and objective uncertainty.

As Low As Reasonably Practicable (ALARP): That level of risk which can be lowered further only by an increment in resource expenditure that cannot be justified by the resulting decrementin risk. Often identified or verified by formal or subjective application of cost-benefit or multiattribute utility theory.

Automatic Destruct System (ADS) : A destruct system that self-activates under certain failure conditions, such as when vehicle breakup is sensed via a lanyard pulled or a break-wire separated or when data or communications links are lost. Often ADS activates destruct charges on the break-point stage (usually the weakest part of the vehicle) and all lower stages.

Background Risk: risks voluntarily accepted in the course of normal activities

.

Basis of confidence: The foundation for a users’ trust or belief that software will perform its intended function in a right, proper, or effective way. Typically refers to a specific document containing the results of IV&V efforts, testing, and/or comparisons with either real world data or results produced by other validated models.

Best available: The most accurate and/or realistic information available when a risk assessment is performed.Best practice (1): A management idea which asserts that there is a technique, method, process, activity, incentive or reward that is more effective at delivering a particular outcome than any other technique, method, process, etc. The idea is that with proper processes, checks, and testing, a project can be rolled out and completed with fewer problems and unforeseen complications.

Best practice (2): An acceptable level of effort that represents the best choice available given

the circumstances.

Binning: The allocation of data points into bins according to the value(s) associated with the data point. For example, for data points defining a location in space (latitude, longitude, altitude) it is the placement of each point into its appropriate bin where the bins are the 3- dimensions cells defined by a 3-dimensional grid (each cell is defined by the latitude, longitude and altitude values defining the cell boundaries).

Carcinogen: Any substance that produces cancer

.

Casualty : A serious injury or worse, including death, for a human. For the purposes of this standard, serious injury is defined as Abbrevia ted Injury Scale (AIS) Level 3 or greater except where prior general practice at the range has been to protect to a lesser level of injury than AIS level 3, such as eardrum protection.

Casualty expectation: See Expected Casualties

Catastrophe: Any event that produces a large numbers of casualties or has a severe impact on continued range operations.

Clarity: An EPA TCCR principle of uncertainty charact erization; the assessment is free from obscure language and is easy to understand. Brevity and plain English are employed; technical terms are avoided; simple tables, graphs, and equations are used.

Clearance Zone: An area or volume from which objects at risk (people, ships, aircraft, etc.) are

to be restricted or eliminated in order to control the risks.

Coefficient of restitution : The ratio of speed of separation to speed of approach in a collision.

Cold trajectory: The vehicle follows the planned profile but, due to low performance of a motor, arrives at the various points in the profile late. This can also be described as moving slower and not flying as far downrange as nom inal predictions at any given time in flight. The decreased performance does not necessarily produce an unacceptable trajectory.

Collective risk: The total risk to all individuals exposed to any hazard from an operation. Unless otherwise noted, collective risk is the mean number of casualties (E C ) predicted to result from all hazards associated with an operation. Collective risk is specified as either for a mission or per year. The collective risk should include the aggregated and accumulated risk.Collision Avoidance (COLA): The process of determining and implementing a course of action to avoid potential on orbit collisions with ma nned objects or with other specified orbiting objects. The process includes the determination of wait periods in either the launch window or spacecraft thrust firings based on validated conjunction assessments or risk analyses and accounts for uncertainties in spatial dispersions and arrival time of the orbiting objects and/or

launch vehicle.

Compounding conservatism: An analysis approach that results in extremely conservative results by making a series of conservative assumptions (See Conservatism).

Conjunction Assessment (CA): The process of determining the point of closest approach of two orbiting objects, or between a launch vehicl e and an orbiting object, in association with a specified miss distance screening criteria or the corresponding probability of collision. Associated with the closest approach assessment is the closest approach distance, the times of launch or orbital firing that would result in the closest approach, and meeting the miss distance or collision probability criteria.

Conservatism: As used in risk analysis modeling, conservatism is a set of modeling assumptions that exaggerates the risk by overstating event probabilities, hazard probabilities or consequences. Conservatism refers to the degree of overstating risk.

Consistency: An EPA TCCR principle of uncertainty char acterization; Conclusions of the risk assessment are characterized in harmony with other government actions.

Containment: The launch safety strategy/process of minimizing risk to the maximum extent practical by keeping hazardous operations within defined hazard areas that are unpopulated or where the population is controlled and adequate protection can be provided to highly valued

resources; to stop, hold, or surround a hazard.

Credibility: The quality that makes something (as a witness or some evidence) worthy of belief;

credible.

Critical operations personnel : Critical operations personnel include persons not essential to the specific operation or launch currently being conducted, but who are required to perform safety, security, or other critical tasks at the range. To be treated as critical operations personnel they must be notified of a neighboring h azardous operation and either trained in mitigation techniques or accompanied by a properly trained escort. Critical operations pers onnel do not include individuals in training for any job or individuals performing routine activities such as administrative, maintenance, or janitorial. Critical operations personnel may occupy safety

clearance zones and hazardous launch areas and need not be evacuated with the general public. Critical operations personnel should be included in the same risk category as mission essential personnel.

De manifestis: A level of risk that is instantly recognized by a person of ordinary intelligence as inherently unacceptable.De minimis non curat lex: {Latin} The law does not concern itself with trifles - often

shortened to de minimus

.

De minimis threshold: The level of mishap risk below which a hazard does not warrant any expenditure of resources to track or mitigate.

Debris impact risk: The potential for injury, death or property damage resulting from the impact of falling debris. (Separate from explosive or toxic debris risk.)

Decision Authority: The range Commander or senior official designated by the range

Commander to make risk decisions on his or her behalf.

Deflagration: An explosion where the propagation of the explosive reaction into the un-reacted material is by heat and mass transfer. In a deflagration, the propagation rate is always less than the speed of sound in the un-reacted material.

Depressed trajectory : The actual trajectory profile is lower (depressed) than expected.

Detonation: An explosion where the propagation of the explosive reaction into the un-reacted material is by shock compressive heating. In a detonation, the propagation rate is at least as fast as the speed of sound in the un-reacted material.

Diffraction: A description of how overpressure wave fr onts bend around structures and objects

Diffusion: Dispersion of gasses or particulates by atmospheric turbulence.

Discrete complementary cumulative distribution: The complementary cumulative distribution is one (1) minus the cumulative distribution, i.e. 1-F(x). The word “Discrete” is used to refer to the fact that x in the distribution can only have integer values.

Discretionary function : A deed involving an exercise of personal judgment and conscience..

Also “discretionary act” ; Not an implementation of a hard and fast rule. Relates to “Discretionary Function Exclusion” of Federal Torts Claims Act.

Distributive mixing test: A liquid propellant explosive test used to study the effects of initial surface area contact between fuel and oxidizer propellant components on the blast yield produced in an explosion. The configurations used in these tests permit the ratio of the initial surface area of contact to the total propellant weight to be precisely controlled.

Distant focusing: An atmospheric phenomenon that can produce greatly enhanced overpressure due to sonic velocity gradients with respect to altitude.

Endoatmospheric: Within the Earth’s atmosphere; generally considered to be those altitudes

below 100 km.Energetic materials: Materials that can burn or explode when subjected to a heat source or shock loading.

Epistemic uncertainty: The kind of uncertainty arising from imperfect knowledge. Epistemic uncertainty is also known as incertitude, ignorance, subjective uncertainty, Type II or Type B uncertainty, reducible uncertainty, and state-of-knowledge uncertainty.

Exoatmospheric: Outside the Earth’s atmosphere; generally considered to be those altitudes

above 100 km.

Expected casualties: The mean number of casualties predicted to occur as a result of an operation if the operation were to be repeated many times. This risk is expressed with the following notation: 1E-7 = 10 -7 = 1 in ten million.

Expected fatalities: The mean number of fatalities predicted to occur as a result of an operation if the operation were to be repeated many times. This risk is expressed with the following

notation: 1E-7 = 10 -7 = 1 in ten million.

Explosive yield: The energetic yield of a given quantity of explosive material, such as solid propellant. It is generally expressed in terms of equivalent weight of TNT since the energetic yield of TNT (defined by the overpressures and temperatures created) is well documented).

Failure modes: How a vehicle, system or component might fail.

Far-field overpressure: An overpressure occurring at a significant distance from an explosion that may be enhanced by atmospheric effects.

Fatal injury: any injury that results in death within 30 days of the accident

.

Fragmentation: The break up of an in-flight vehicle into fragments (components of the vehicle, pieces of the structure, chunks of solid propellant, miscellaneous hardware, etc.) due to explosive loads, aerodynamic and inertial loads, activation of a flight termination system, intercept with another vehicle, or impact on a surface.

Federal Tort Claims Act : A statute that limits federal sovereign immunity and allows recovery in federal court for tort damages caused by federal employees, but only if the law of the state where the injury occurred would hold a private person liable for the injury 28 USCA 2671-2680.

Also FTCA.

Fidelity: The accuracy of the representation when compared to the real world.

Flight commit criteria : See Launch Commit Criteria

Flight Safety System (FSS): Includes airborne and ground safety systems, tracking safety system, and telemetry data transmission systems that must meet flight safety and customerrequirements, as well as established reliability and single point failure requirements ( See also Flight Termination System and Range Safety System ).

Flight Termination System (FTS): The airborne portion of the Flight Safety System. A flight termination system ends the flight of a vehicle and consists of the entire system on an airborne vehicle used to receive, decode, and execute a flight termination (this includes ADS, ISDS and ground command signals). It includes all wiring, power systems, and methods or devices (including inadvertent separation destruct systems) used to terminate flight ( See also Flight Safety System and Range Safety System ).

Focus factor: The ratio produced by dividing the peak incident overpressure experienced under actual atmospheric conditions by the peak incident overpressure predicted under standard atmospheric conditions without winds.

Generalized Energy Management Steering (GEMS): Boost velocity control is achieved by burning all boost propulsion stages to burnout, shaping the trajectory to use all the energy,

without thrust termination.

General public: All people not declared mission essential or critical operations personnel. This includes the public plus range personnel not essential to a mission, visitors, press, and personnel/dependents living on the base/facility.

Handover: The transfer of flight safety control of a vehicle from one range safety System to another. Control may be transferred manually by the Range Safety Officer or automatically based on achieving some predetermined conditions.

Hazard: Any real or potential condition that can cause injury, illness, or death of personnel, or damage to or loss of equipment or property.

Hazard threshold: The lowest level at which adverse outcomes are expected to appear.

Hazard area: A geographical or geometrical surface area that is susceptible to a hazard from a planned event or unplanned malfunction.

Hazard volume: A geographical or geometrical volume of airspace that is susceptible to a hazard from a planned event or unplanned malfunction.

Hazardous operation: Thos activities which, by their nature, expose personnel or property to dangers not normally experienced in day-to-day actions.

Hot trajectory: The vehicle follows the planned profile but, due to higher than expected performance (thrust) from its motors, arrives at the various points in the profile early. This can also be described as flying further downrange a nd moving faster than nominal predictions at any given time in flight.Hydrocode: A computational tool capable of modeling the behavior of continuous media over a wide range of speeds. It can also be adapted to treat material strength and a range of rheological

models for material behavior. It considers the effects of external and internal forces on a predefined mesh of cells which represent the system being studied. It assumes that over a short period of time these forces are constant, and uses them to adjust the geometry of the mesh accordingly. The forces are then recalculated and the process repeats until the required solution

is found.

Immediately dangerous to life and health (IDLH): The maximum level to which a healthy individual can be exposed to a chemical for 30 minutes and escape without suffering irreversible health effects or impairing symptoms. Used as a "level of concern" (See: level of concern).

Impact: The impingement of a fragment on a surface, a structure, a person or a vehicle.

Inadvertent Separation Destruct System (ISDS): a specialized form of ADS located on vehicle components that automatically activates when inadvertent separation of the component from the main vehicle is sensed. There is often a built-in delay included, in hope that the separated component will be sufficiently displaced at charge activation to preclude damage to

the main vehicle.

Individual risk: Individual risk is the risk that a person will suffer a consequence. Unless otherwise noted, individual risk is expressed as the probability that an individual will become a casualty due to all hazards (P C ) from an operation at a specific location. Guidance Information. If each person in a group is subject to the same individual risk, then the collective risk may be computed as the individual risk multiplied by the number of people in the group. In the context of this document, individual risk refers to the probability that the exposed individual will become a casualty as a result of all hazards from a mission.

Informed decision: The “informed decision” principle is used in tort claims against the U.S.Government. The Federal Tort Claims Act (FTCA) enjoins the U.S. court system from secondguessing decisions made by properly authorized government officials in determining the acceptability of operational risks. A key test under the FTCA requires that the decision-makingofficial be fully advised and informed of the known risks. Failure to fully advise the decisionmaking authority of known risks can result in liability of the U.S. Government or its officials.

Involuntary activity: No choice was made by the person affected which placed them in a position of increased risk; or the activity participated in or the item used was one that is generally done or used by more than 99 percent of the population. Examples: bathing, using coins or drinking glasses.

Launch commit criteria: Hazardous or safety critical parameters, including, but not limited to, those associated with the launch vehicle, payload, ground support equipment, flight safety system, hazardous area clearance requirements, and meteorological conditions that must be within defined limits to ensure that public, launch area, and launch complex safety can be maintained during a launch operation.Launch Wait: A specified launch window period during which a range or range user shall not initiate flight in order to prevent collisions with on orbit manned objects or other protected orbital object.

Level of Concern : The concentration in air of an extremely hazardous substance above which there may be serious immediate health effects to anyone exposed to it for short periods.

Lofted trajectory: The actual trajectory profile is higher (lofted) than expected.

Manned spacecraft: a spacecraft that is either currently occupied or intended to be occupied. Includes spacecraft en route to, and in support of, manned missions.

Maxwellian distribution: A one-dimensional probability density function defined by a single
parameter.

Mishap: An unplanned event or series of events resulting in death, injury, occupational illness, or damage to or loss of equipment or property or damage to the environment.

Mission: A flight test or operation. It may include multiple vehicles or all phases of the flight beginning with liftoff/launch. See Supplement paragraph 4.2.4 for details on defining a mission

for risk assessment.

Mission essential: Those persons and assets necessary to safely and successfully complete a specific hazardous operation or launch.

Mission rules : Rules that define safety constraints and conditions and establish the boundaries within which the safety team operates. The lead safety organization develops the mission rules and briefs the range user to ensure a complete understanding of the intent and application of them. Mission rules are documented and become part of the range safety plan.

Monte Carlo analysis: 1. A numerical analysis method that uses repeated sampling of random values from known (or postulated) distributions to estimate an unknown distribution.

Nominal Ocular Hazard Distance (NOHD): The distance along the axis of the laser beam beyond which the irradiance (W/cm 2 ) or radiant exposure (J/cm 2 ) is not expected to exceed the appropriate maximum permissible exposure; that is, the safe distance from the laser.

Outrage factor: The components of outrage regarding public perception of imposed risk.; i.e. Is the risk voluntary? Is the risk fair? Is the risk familiar? Who has control of the risk? Is the responsible party open and responsive? etc.

Overpressure: The pressure caused by an explosion over and above normal atmospheric pressure. It can be significantly affected by the atmospheric conditions, particularly the temperature and wind profiles.Probabilistic modeling: A process that employs statistical principles and the laws of probability to quantify the variability and uncertainty in a quantity. The results of probabilistic models typically express the ratio of the outcomes that would produce a given event to the total number of possible outcomes.

Probability of casualty: The likelihood that a person will suffer a serious injury or worse, including a fatal injury, from a hazardous event. This risk is expressed with the following

notation: 1E-7 = 10 -7 = 1 in ten million.

Probability of fatality: The likelihood that a person will die from a hazardous event. This risk is expressed with the following notation: 1E-7 = 10 -7 = 1 in ten million.

Prudent person: See Reasonable Person

Q-Alpha: The product of the dynamic pressure and the angle-of-attack for an in-flight vehicle. The dynamic pressure is a function of the velocity of the vehicle relative to the air mass and the local density of the atmosphere (1/2 * density * velocity 2 ). In still air, the angle of attack is usually the angle between the longitudinal axis of the vehicle and the velocity vector of the

vehicle.

Range Safety Officer (RSO): Range Safety Officer is a generic term used in this document to designate the individual or individuals re sponsible for making range safety decisions, particularly flight termination decisions. During real-time, the RSO is delegated the authority to execute the range Commander’s range safety policies and has sole responsibility for making range safety decisions. Other commonly used designations include Missile Flight Safety Officer (MFSO) and Missile Flight Control Officer (MFCO).

Range Safety System (RSS): The ground-based portion of the Flight Safety System. An integrated system of hardware, software, and human operators which is necessary to provide mission safety support. Includes instrumentation and communication infrastructure needed to fulfill safety’s flight control responsibility. See also Flight Safety System and Flight Termination System

Reasonable care: As a test of liability for negligence, the degree of care that a prudent and competent person engaged in the same line of business or endeavor would exercise under similar circumstances - Also termed due care; ordinary care; adequate care; proper care.

Reasonable person: A hypothetical person used as a legal standard, especially to determine if someone acted with negligence. The reasonable person acts sensibly, does things without serious delay, and takes proper but not excessive precautions. Also termed Reasonable Man or Prudent Person

.

Reasonableness: An EPA TCCR principle of uncertainty characterization; the assessment is based on sound judgment. The components of the risk characterization are well integrated into an overall conclusion of risk which is complete, informative, well balanced and useful for decision making. The characterization is based on the best available scientific information. Thepolicy judgments required to carry out the risk analyses use common sense given the statutory requirements and guidance from higher authority. Appropriate plausible alternative estimates of risk under various candidate risk management alternatives are identified and explained.

Reentry: The event occurring when a spacecraft or other object comes back into the sensible atmosphere after going to higher altitudes.

Residual mishap risk: The risk that remains after all approved mitigations have been implemented.

Risk: Risk is a measure that accounts for both the probability of occurrence and the consequence of a hazard to a population or installation. Unless otherwise noted, risk to people is measured in casualties and expressed as individual risk or collective risk.

Risk analysis: A study of potential risk under a given set of conditions. Risk Analysis is an activity that includes the complete array of tasks from data gathering, identification of hazards, estimation of associated risks, and verification of results.

Risk management: Risk management is a systematic and logical process to identify hazards and control the risk they pose.

Risk profile: A plot that shows the probability of an accident causing a given number of casualties (vertical axis) vs. the number of casualties (horizontal axis). The area under the plot is a measure of the casualty expectation. When a catastrophe-averse function is plotted on the same graph, the presence or absence of catastrophic risk is indicated.

Safety: Relative protection from adverse consequences.

Sensitivity: The degree to which the model outputs are affected by changes in a selected input
parameter

.

Sensitivity analysis: The computation of the effect of changes in input values or assumptions (including boundaries and model function form) on the outputs. The study of how uncertainty in a model output can be systematically apportioned to different sources of uncertainty in the model input. By investigating the “relative sensitivity” of model parameters, a user can become knowledgeable of the relative importance of parameters in the model.

Serious injury: Any injury that: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve,muscle, or tendon damage; (4) involves any internal organ; or (5) involves second- or thirddegree burns, or any burns affecting more than 5 percent of the body surface.

Ship Accident: A “ship accident” occurs if the vessel is involved in an accident that results in loss of life, personal injury which requires medical treatment beyond first aid, or complete lossof the vessel. This definition is consistent with the level of protection afforded people involved in a “boat accident” as defined in current regulations.

Sigma: Standard deviation.

Spacecraft Critical Cross Sectional Area : The maximum cross sectional area of vulnerable surfaces of a manned spacecraft in the dir ection that the spacecraft is traveling.

Spacecraft Vulnerable Area: The entire surface area of a manned spacecraft that would hazard human life if any portion of it was breached. Fo r a cylindrical shaped spacecraft the vulnerable area would be the surface area of the cylinder rather than its cross sectional area or projected area to a debris density flux.

Statistical risk management: Risk management that makes use of probabilistic modeling, formal risk analyses, and risk acceptability criteria.

Substantial damage: Relating to aircraft vulnerability means damage or failure that adversely affects the structural strength, performance, or flight characteristics of the aircraft, and that would normally require major repair or replacement of the affected component.

Susceptibility: The quality or state of being open, subject or unresistant to some stimulus, influence or agency

.

TCCR: EPA principles of uncertainty characterization; see Transparency

, Clarity

, Consistency

, and Reasonableness

.

TNT equivalent: The explosive yield of a material expressed in terms of the weight of trinitrotoluene (TNT) that will produce an essen tially equivalent yield. TNT equivalent, or “TNT equivalency”, is used to characterize explosions since the overpressures and temperatures produced by TNT are well documented.

Toxic hazard area: A generic term that describes an area in which predicted concentration of propellant or toxic byproduct vapors or aerosols may exceed acceptable tier levels; predictions are based on an analysis of potential source strength, applicable exposure limit, and prevailing meteorological conditions; toxic hazard areas are plotted for potential, planned, and unplanned propellant releases and launch operations.

Toxic release hazard analysis : Analysis to ensure people are not exposed to concentration thresholds for each toxicant involved in a launch or in the event of a flight mishap. Results are used to establish flight commit criteria that protect people from a toxic release casualty.

Toxicant: A substance that can cause death, disease, behavioral abnormalities, cancer, genetic mutations, physiological or reproductive malfunctions, or physical deformities in any organism or its offspring. The quantities and length of exposure necessary to cause these effects can vary widely. See also Toxic SubstanceToxic substance: A chemical or mixture that may present an unreasonable risk of injury to

health or the environment. See also Toxicant

Toxics: A Generic term for the toxic propellants and combustion by-products resulting from a nominal launch vehicle flight or catastrophic launch abort.

Transparency: An EPA TCCR principle of uncertainty characterization; explicitness in the risk assessment process. It ensures any reader understands all the steps, logic, key assumptions, limitations, and decisions in the risk assessment, and comprehends the supporting rationale that

leads to the outcome.

Uncertainty: The absence of perfectly detailed knowledge. Uncertainty includes incertitude (the exact value is unknown) and variability (the value is changing). Uncertainty may also include other forms such as vagueness, ambiguity, and fuzziness (in the sense of border-line cases).

Uncertainty analysis: An investigation of the effects of lack of knowledge or potential errors on the model and when conducted in combination with a sensitivity analysis allows a model user to be more informed about the confidence that can be placed on model results.

Validation: refers to the set of activities that ensure that the software that has been built is traceable to customer requirements. The validation process determines whether the mathematical model being used accurately represents the phenomenon being modeled and to what degree of accuracy. This process ensures that the simulation adequately represents the appropriate physics by comparing the output of a simulation with data gathered in experiments and quantifying the uncertainties in both.

Variability: Observed differences attributable to true heterogeneity or diversity. Variability is the result of natural random processes and is usually not reducible by further measurement or study (although it can be better characterized ).

Verification: refers to the set of activities that ensure that software correctly implements a specific function. The verification process determ ines whether a computer simulation code for a particular problem accurately represents the solutions of the mathematical model. Evidence is collected to ascertain whether the numerical model is being solved correctly. This process ensures that sound software-quality practices are used and the software codes themselves are free of defects and errors. It also checks that the code is correctly solving the mathematical equations in the algorithms and verifies that the time and space steps or zones chosen for the mathematical model are sufficiently resolved.

Voluntary activity: The person affected made a choice which placed them in an increased position of risk compared to the rest of the population. This includes career and job choices. Examples: repetitive motion injuries, recreational boating, etc.

Vulnerability relationship: A model of the relation of hazard level compared to the probability or degree of an adverse outcome.Worst-case : A semi-quantitative term referring to the maximum possible exposure, dose, or risk, that can conceivably occur, whether or not this exposure, dose, or risk actually occurs in a specific population.

***** NOTHING FOLLOWS *****