SUPPLEMENT: STANDARD 321-07 

 

 RANGE SAFETY GROUP 

COMMON RISK CRITERIA STANDARDS FOR NATIONAL TEST 

RANGES: SUPPLEMENT 

WHITE SANDS MISSILE RANGE 

REAGAN TEST SITE 

YUMA PROVING GROUND 

DUGWAY PROVING GROUND 

ABERDEEN TEST CENTER 

NATIONAL TRAINING CENTER 

ELECTRONIC PROVING GROUND 

HIGH ENERGY LASER SYSTEMS TEST FACILITY 

NAVAL AIR WARFARE CENTER WEAPONS DIVISION, PT. MUGU 

NAVAL AIR WARFARE CENTER WEAPONS DIVISION, CHINA LAKE 

NAVAL AIR WARFARE CENTER AIRCRAFT DIVISION, PATUXENT RIVER 

NAVAL UNDERSEA WARFARE CENTER DIVISION, NEWPORT 

PACIFIC MISSILE RANGE FACILITY 

NAVAL UNDERSEA WARFARE CENTER DIVISION, KEYPORT 

30TH SPACE WING 

45TH SPACE WING 

AIR FORCE FLIGHT TEST CENTER 

AIR ARMAMENT CENTER 

ARNOLD ENGINEERING DEVELOPMENT CENTER 

BARRY M. GOLDWATER RANGE 

NATIONAL NUCLEAR SECURITY ADMINISTRATION (NEVADA) 

DISTRIBUTION A: APPROVED FOR PUBLIC RELEASE 

DISTRIBUTION IS UNLIMITED
This page intentionally left blank. 
SUPPLEMENT: STANDARD 321-07 

COMMON RISK CRITERIA FOR NATIONAL TEST RANGES: 

SUPPLEMENT 

JUNE 2007 

Prepared by 

RANGE SAFETY GROUP 

RISK COMMITTEE

Published by 

Secretariat 

Range Commanders Council 

U.S. Army White Sands Missile Range, 

New Mexico 88002-5110 
This page intentionally left blank. 
TABLE OF CONTENTS 

LIST OF FIGURES .........................................................................................................................v 

LIST OF TABLES........................................................................................................................ vii 

CHANGES TO THIS EDITION ................................................................................................... ix 

FOREWORD ................................................................................................................................. xi 

PREFACE.................................................................................................................................... xiii 

ACRONYMS.................................................................................................................................xv 

CHAPTER 1: INTRODUCTION......................................................................................... 1-1 

1.1 Purpose............................................................................................................ 1-1 

1.2 Scope............................................................................................................... 1-1 

1.3 Application...................................................................................................... 1-1 

CHAPTER 2: RISK MANAGEMENT PROCESS LEVEL II.......................................... 2-1 

2.1 Historical Background .................................................................................... 2-1 

2.2 Risk Management Process - Level II .............................................................. 2-1 

2.3 Detailed Checklists for Phases of the Risk Analysis Process ......................... 2-4 

2.4 Phase I: Mission Definition and Hazard Identification.................................. 2-4 

2.5 Phase II: Risk Assessment ........................................................................... 2-11 

2.6 Phase III: Criteria Comparison and Risk Reduction.................................... 2-19 

2.7 Phase IV: Risk Acceptance .......................................................................... 2-22 

CHAPTER 3: GENERAL RISK MODEL REQUIREMENTS ........................................ 3-1 

3.1 Specific to Policy ............................................................................................ 3-1 

3.2 Transparency, Clarity, Consistency and Reasonableness (TCCR)................. 3-1 

3.3 Verification and Validation (V&V) ................................................................ 3-1 

3.4 Configuration Control ..................................................................................... 3-2 

3.5 Liability Protection ......................................................................................... 3-2 

3.6 Best Estimate of Expected Value.................................................................... 3-2 

3.7 Balance of Accuracy, Simplicity, and Fidelity ............................................... 3-2 

3.8 Conservatism and Uncertainty ........................................................................ 3-2 

3.9 Balance of Element Fidelity............................................................................ 3-3 

CHAPTER 4: RISK CRITERIA IMPLEMENTATION GUIDELINES......................... 4-1 

4.1 Introduction..................................................................................................... 4-1 

4.2 Guidelines for Application of the Criteria ...................................................... 4-4 

4.3 Catastrophic Risk Evaluation........................................................................ 4-17 

4.4 Hazard Areas for Ships and Aircraft............................................................. 4-19 

4.5 Spacecraft Protection .................................................................................... 4-28 

iii
CHAPTER 5: RISK CRITERIA RATIONALE................................................................. 5-1 

5.1 Rationale for Risk Metrics .............................................................................. 5-1 

5.2 Criteria Rationale Overview ........................................................................... 5-5 

5.3 Rationale for Casualty Limits ......................................................................... 5-8 

5.4 Rationale for Fatality Guideline Limits ........................................................ 5-27 

5.5 Rationale for Catastrophic Risk Criteria....................................................... 5-41 

5.6 Rationale for Aircraft and Ship Risk Management Requirements ............... 5-44 

5.7 Rationale for Spacecraft Protection Requirements ....................................... 5-52 

5.8 Using Aviation as a Benchmark for Launch Risk......................................... 5-55 

5.9 References for Chapter 5............................................................................... 5-63 

CHAPTER 6: HAZARD THRESHOLDS........................................................................... 6-1 

6.1 Defining Criteria for Hazard Thresholds ........................................................ 6-1 

6.2 Unsheltered People ......................................................................................... 6-4 

6.3 Sheltered People............................................................................................ 6-11 

6.4 References for Chapter 6............................................................................... 6-32 

CHAPTER 7: APPROACHES AND CONSIDERATIONS FOR DEBRIS RISK 

ASSESSMENT MODELS............................................................................ 7-1 

7.1 Vehicle Breakup Debris Models..................................................................... 7-5 

7.2 Debris Dispersion Models............................................................................. 7-11 

7.3 Debris Distribution Models........................................................................... 7-31 

7.4 Impact Probability Models............................................................................ 7-36 

7.5 Modeling for Explosive Fragments............................................................... 7-39 

7.6 Vulnerability and Casualty Models............................................................... 7-43 

7.7 Models for Casualty Area and Fragment Probability of Casualty................ 7-57 

7.8 Risk (Casualty/Fatality) Expectation Models ............................................... 7-59 

7.9 Catastrophic Risk Modeling.......................................................................... 7-63 

7.10 Risk Prediction Uncertainty.......................................................................... 7-67 

CHAPTER 8: OTHER HAZARDS...................................................................................... 8-1 

8.1 Introduction to Other Hazards......................................................................... 8-1 

8.2 Toxic Release Assessment .............................................................................. 8-1 

8.3 Far-Field Window Breakage........................................................................... 8-9 

8.4 Radiation Hazard Analysis Guidelines ......................................................... 8-11 

GLOSSARY

iv
LIST OF FIGURES 

Figure 2-1. Level 2 risk management process flowchart................................................... 2-3 

Figure 4-1. Risk profile from example problem. ............................................................... 4-3 

Figure 4-4. Evaluating residual risk remaining with the defined hazard area. ................ 4-27 

Figure 5-1. Criteria inter-relationships. ............................................................................. 5-7 

Figure 5-2. Outline of logic used to compare aviation and range risks........................... 5-16 

Figure 5-3. Universal Risk Scale: injuries for annual probability of injury 

to an individual resulting from involuntary activities................................... 5-22 

Figure 5-4. Comparison of methods that are used to introduce catastrophe 

aversion into the risk analysis. ...................................................................... 5-43 

Figure 6-1. Eleven (11) ft-lb criterion compared to probability of casualty 

curves for the general public........................................................................... 6-7 

Figure 6-2. Comparison of 11 ft-lb criterion with injury models and sample 

data points. ...................................................................................................... 6-8 

Figure 6-3. Air blast impacting a structure...................................................................... 6-15 

Figure 6-4. Diffraction of blast front across structure (looking down). .......................... 6-16 

Figure 6-5. Free-field blast wave overpressure time history. .......................................... 6-17 

Figure 6-6. Structural damage due to air blast impacting lightly constructed 

structures. ...................................................................................................... 6-20 

Figure 6-7. Serious injury due to air blast impacting lightly constructed structures....... 6-20 

Figure 6-8. Breakage due to air blast impacting large, annealed windows ..................... 6-21 

Figure 6-9. Serious injury due to air blast impacting large, annealed windows.............. 6-21 

Figure 6-10. Hull materials for vessels of different lengths. ............................................. 6-23 

Figure 7-1. Sample impact point scatter plot................................................................... 7-15 

Figure 7-2. Debris centerline showing variation of the impact with fragment 

ballistic coefficient (β).................................................................................. 7-25 

Figure 7-3. Aircraft impact geometry. ............................................................................. 7-36 

Figure 7-4. Procedure for computing risks due to an explosive fragment....................... 7-43 

Figure 7-5. Hazards to an Unsheltered Person From Inert Debris Impact ...................... 7-49 

Figure 7-6. Example of fragment penetrating multiple floors of a structure................... 7-51 

Figure 7-7. Typical risk profile........................................................................................ 7-65 

Figure 7-8. Comparison of catastrophe tolerant and catastrophe intolerant limit lines... 7-66 

Figure 7-9. The effect of uncertainty distribution breadth on the average value of ec..... 7-69 

v
This page intentionally left blank. 

vi
LIST OF TABLES 

Table 2-1. Risk Management Process (Step I-1).............................................................. 2-6 

Table 2-2. Risk Management Process (Step I-2).............................................................. 2-7 

Table 2-3. Risk Management Process (Step I-3).............................................................. 2-8 

Table 2-4. Risk Management Process (Step I-4).............................................................. 2-9 

Table 2-5. Risk Management Process (Step I-5)............................................................ 2-10 

Table 2-6. Risk Management Process (Review: R-1) ................................................... 2-10 

Table 2-7. Risk Management Process (Step II-1) .......................................................... 2-13 

Table 2-8. Risk Management Process (Step II-2) .......................................................... 2-14 

Table 2-9. Risk Management Process (Step II-3) .......................................................... 2-15 

Table 2-10. Risk Management Process (Step II-4) .......................................................... 2-15 

Table 2-11. Risk Management Process (Step II-5) .......................................................... 2-16 

Table 2-12. Risk Management Process (Step II-6) .......................................................... 2-16 

Table 2-13. Risk Management Process (Review: R-2) ................................................... 2-16 

Table 2-14. Risk Management Process (Step II-7) .......................................................... 2-17 

Table 2-15. Risk Management Process (Review: R-3) ................................................... 2-18 

Table 2-16. Risk Management Process (Step III-1) ......................................................... 2-20 

Table 2-17. Risk Management Process (Step III-2) ......................................................... 2-20 

Table 2-18. Risk Management Process (Step III-3) ......................................................... 2-21 

Table 2-19. Risk Management Process (Step III-4) ......................................................... 2-21 

Table 2-20. Risk Management Process (Step III-5) ......................................................... 2-21 

Table 2-21. Risk Management Process (Step IV-1)......................................................... 2-23 

Table 2-22. Risk Management Process (Step IV-2a) ....................................................... 2-23 

Table 4-1. Example Risk Profile Data.............................................................................. 4-3 

Table 4-2. Orbital Period Change (Per Revolution) of the ISS...................................... 4-30 

Table 5-1. Maximum Acceptable Casualty Risk to People.............................................. 5-8 

Table 5-2. Typical Ratio of Expected Fatalities to Casualties ....................................... 5-10 

Table 5-3. Ratio of Ground Casualties to Ground Fatalities Based on 20 Years 

of NTSB Data From 1984 Through 2003 ..................................................... 5-17 

Table 5-4. Individual Mission Risk for the General Public as of 2006.......................... 5-19 

Table 5-5. General Public Individual Probability of Casualty Risk............................... 5-23 

Table 5-6. Mission Essential Individual Casualty Risk ................................................. 5-26 

Table 5-7. Maximum Acceptable Fatality Risk to People ............................................. 5-27 

Table 5-8. Individual Annual Risk for the General Public............................................. 5-27 

Table 5-9. Summary of Individual Fatality Risk Criteria............................................... 5-28 

Table 5-10. Fatalities Due to Accidents in Public............................................................ 5-29 

Table 5-11. Fatalities Due to Accidents in the Home ...................................................... 5-30 

Table 5-12. Summary of U.S. and Foreign Annual Fatality Risk Criteria....................... 5-30 

Table 5-13. Individual Mission Risk for the General Public (as of 2006) ....................... 5-31 

Table 5-14. Typical Ratio of Expected Fatalities to Casualties ....................................... 5-32 

Table 5-15. Collective Mission Risk for the General Public ........................................... 5-32 

Table 5-16. Risk to People on the Ground From Commercial Aircraft and 

General Aviation........................................................................................... 5-33 

Table 5-17. Collective Annual Risk for the General Public............................................. 5-34 

vii
Table 5-18. Risk to People on the Ground From Commercial Aircraft and 

General Aviation........................................................................................... 5-35 

Table 5-19. Casualty Risk to General Public ................................................................... 5-35 

Table 5-20. Summary of U.S. and Foreign Annual Fatality Risk Criteria....................... 5-37 

Table 5-21. Individual Mission Risk for Mission Essential Personnel ............................ 5-37 

Table 5-22. Occupational Fatalities.................................................................................. 5-39 

Table 5-23. Collective Mission Risk for Mission Essential Personnel ............................ 5-39 

Table 5-24. Collective Annual Risk for Mission Essential Personnel ............................. 5-40 

Table 5-25. Annual Risk for Flights In the U.S. Based On A 5-Year 

Average (1993-1997)* .................................................................................. 5-48 

Table 5-26. Aircraft Risk Criteria of National Ranges*................................................... 5-49 

Table 5-27. Ship Risk Criteria of National Ranges.......................................................... 5-51 

Table 5-28. Ratio of Ground Casualties to Ground Fatalities Based on 20 Years 

of NTSB Data From 1984 Through 2003 ..................................................... 5-59 

Table 5-29. Ratio of Expected Casualties and Expected Fatalities Computed by 

Lara for Various Missions............................................................................. 5-60 

Table 6-1. Injury Thresholds ............................................................................................ 6-4 

Table 6-2. Reported E/A Values for Penetrating Injuries ................................................ 6-9 

Table 6-3. Body Part Sensitivity to Overpressure.......................................................... 6-11 

Table 6-4. Threshold Values for Roof Penetration ........................................................ 6-13 

Table 6-5. Threshold Values for Ship Cabin and Deckhouse Roof Penetration............ 6-24 

Table 7-1. Guide to Contents of Chapter 7....................................................................... 7-2 

Table 8-1. Commonly Used Non-toxic Propellants ......................................................... 8-2 

Table 8-2. Commonly Used toxic Propellants and By-Products...................................... 8-3 

Table 8-3. Uncommon toxic Propellants and Combustion By-products.......................... 8-4 

Table 8-4. Toxic Potential Casualty Distances................................................................. 8-6 

viii
 CHANGES TO THIS EDITION 

 This document is the Supplement to Standard 321-07 (Common Risk Criteria for 

National Test Ranges). Both the basic 321-07 document and this Supplement are updates to the 

2002 version of RCC Document 321-02, Common Risk Criteria for National Test Ranges: Inert 

Debris. The following subparagraphs contain a summary of changes. 

a. Expanded Scope. The scope of the standard is expanded to include other flight 

hazards in addition to inert debris. The scope now addresses risks due to explosive 

debris, overpressure, and toxics. To accommodate this change, the Risk Committee 

recommended that casualty, rather than fatality, is the primary measure of risk and 

has defined acceptable casualty risk criteria. Fatality risk criteria remain as a 

supplemental measure of risk for those range operations that are dominated by fatality 

risk. 

b. New hazard thresholds. New hazard thresholds are defined to account for casualty 

risk. Debris fragment thresholds are provided for blunt trauma injuries and chunky 

penetrating injuries, and overpressure thresholds are provided for unsheltered and 

sheltered people. In addition, debris fragment thresholds for penetrating structures 

are updated to reflect the results of recent studies. 

c. Aircraft vulnerability thresholds. The aircraft vulnerability thresholds are revised to 

remove the excess conservatism. The previous standard defined a single threshold for 

all types of aircraft. A separate set of vulnerability models are defined for large 

commercial jet transports to more accurately represent the robustness of those 

aircraft. 

d. Ship probability of impact. The probability of impact criteria for ships is revised to 

be more in line with United Nations International Maritime Organization and current 

range practices. 

e. Manned spacecraft protection. The manned spacecraft protection policies and criteria 

are revised to remove excess conservatism and clear up inconsistencies in application. 

The probability of impact criterion is updated to provide more realistic assumptions 

of space launch activity and to provide an equivalent level of protection as that 

afforded to mission essential personnel. As another means of reducing excess 

conservatism, an ellipsoidal minimum miss distance volume is provided as an 

alternative to the spherical miss distance presented in the previous standard. 

f. Catastrophic risk protection. This revised Supplement introduces the subject of 

catastrophic risk protection. Some provisional, advisory criteria are provided, as well 

as guidelines for analyzing and assessing catastrophic risk. 

g. Implementation guidelines. A new chapter (Chapter 4) is added to this Supplement to 

provide implementation guidelines for applying the criteria to address aggregation 

and accumulation of risk from the various hazards, multiple phase/multiple launch 

ix
missions, annual risk management, and catastrophic risk. It also provides guidance 

on determining the beginning and end of a mission for applying the per mission 

criteria. 

h. Screening criteria for other hazards. A new chapter (Chapter 8) is included in this 

Supplement to provide guidelines on screening criteria for casualty producing hazards 

such as Distant Focusing Overpressure (DFO), toxics and radiation. 

i. Risk management process. The eight-step process for analyzing risk from inert debris 

is replaced with a more comprehensive overall range safety process that expands the 

concept to address hazards beyond just inert debris and includes the major activities 

required to conduct the entire risk management process. A checklist of factors and 

considerations is provided to aid in proper execution of the process. 

j. Modeling considerations. Two chapters were added to this Supplement to address 

modeling considerations. Chapter 3 provides advisory requirements for modeling 

tools and Chapter 7 addresses some approaches and considerations for debris risk 

assessment models. 

x
FOREWORD 

 The Risk and Lethality Commonality Team (RALCT) was formed in 1996 for reaching a 

consensus on reasonable common standards for debris protection criteria and analytical methods. 

The initial version, RCC 321-97, was very useful, but was limited in scope due to the complexity 

of the subject and time constraints. The original version was updated in 1999 and again in 2002 

to provide greater detail. In August 2004, the Range Commander’s Council (RCC), Range 

Safety Group (RSG) determined that the “Common Risk Criteria for National Test Ranges, 

Subtitle: Inert Debris”, RCC Document 321-02, should be updated and expanded for other flight 

safety hazards (in addition to inert debris) and consequences potentially generated by Range 

operations. 

 The RALCT became a standing committee under the RCC Range Safety Group in 2004. 

It was renamed the “Risk Committee” (RC) in February 2005 when work on this revision began 

in earnest. The Committee has updated RCC Document 321-02 (now Standard 321-07) to 

include: 

a. Risk acceptability criteria and supporting rationale for additional flight safety hazards 

and consequences potentially generated by Range operations. 

b. The major activities required to conduct the entire risk management process and 

considerations to address hazards beyond just inert debris. 

c. Top-level requirements for computational models used to analyze the risks posed by 

inert and explosive debris. 

d. Updated hazard thresholds for inert and explosive debris, as well as screening criteria 

for other hazards including toxics, distant focusing overpressure, and ionizing and 

non-ionizing radiation. 

e. Factors and considerations for acceptable debris risk assessment models. 

 Document (RCC Document 321-07) is the basic document that defines consensus 

standards for the range risk management process and risk criteria. This document (RCC 

Document 321-07: Supplement), provides additional detailed information to assist in 

implementation of the standards in the basic document. The criteria in this document should not 

be considered absolute; rather, this document is intended to provide guidance on defining 

acceptable risks for hazardous range operations and to assist the user in developing more 

consistent risk assessments. 

 This supplement is an RCC Standard that represents the collective efforts of both 

government and contractor personnel and is the result of an extensive cooperative effort. 

Herein, the use of the word “Supplement” or the phrase “this Supplement” 

refers to this document. This supplemental document makes many 

references to the basic Standard (RCC Document 321-07). For clarity, the 

basic document is often referred to as the “Standard.” For example, 

“Chapter 3 of the Standard” refers to Chapter 3 of RCC Document 321-07. 

xi
This page intentionally left blank. 

xii
PREFACE 

 This document presents the results of Task RS-46, Range Safety Group (RSG) in the 

Range Commanders Council (RCC). Planned and unplanned hazardous events generated by 

flight operations present a safety concern for all test ranges. Each range has established its own 

set of criteria and analytical methods for protecting personnel, facilities, aircraft, and other assets 

from hazardous operations. Although these separate efforts have been very successful, the 

logical relationships among criteria used at the test ranges and across different hazards are often 

difficult to comprehend. The consensus standards presented in this document are intended to: 

a. Promote a uniform process among the ranges. 

b. Promote valid, repeatable risk assessments. 

c. Foster innovation to support challenging missions. 

d. Nurture openness and trustworthiness among the ranges, range users and the public. 

e. Simplify the scheduling process. 

f. Present common risk criteria that can reduce cost for users of multiple test ranges. 

 The RCC gives special acknowledgement for production of this document to: 

Mr. Corey Cather: Chairman, RSG Risk Committee 

30th Space Wing, 30 SW/SELP 

806 13th Street STE 3 

Vandenberg AFB, CA 93437-5230 

Phone: (805) 606-1662 DSN 276-1662 

Fax: (805) 605-7227 DSN 275-7227 

E-mail: corey.cather@vandenberg.af.mil

 Acknowledgements also go to the many participating members of the Range Safety 

Group Risk Committee as shown on the following page. 

Please direct any questions to: 

Secretariat, Range Commanders Council 

ATTN: CSTE-DTC-WS-RCC 

100 Headquarters Avenue 

White Sands Missile Range, New Mexico 88002-5110 

Telephone: (505) 678-1107, DSN 258-1107 

E-mail rcc@wsmr.army.mil

xiii
RANGE SAFETY GROUP RISK COMMITTEE PARTICIPANTS 

RCC RSG RISK COMMITTEE MEMBERS 

AFSPC/30th Space Wing - 30 SW 

AFSPC/45th Space Wing - 45 SW 

Air Armament Center Eglin Air Force Base - AAC 

Air Force Flight Test Center - AFFTC 

Naval Air Systems Command headquartered at Patuxent River, MD (NAVAIR PR) 

Naval Air Warfare Center Weapons Division - NAWCWD 

Pacific Missile Range Facility - PMRF 

U.S. Army Kwajalein Atoll/Reagan Test Site - USAKA/RTS 

White Sands Missile Range - WSMR 

Yuma Proving Ground - YPG 

RCC RSG RISK COMMITTEE ASSOCIATE MEMBERS 

Federal Aviation Administration - FAA/AST 

Missile Defense Agency; Safety, Quality and Mission Assurance Directorate - MDA/QS 

National Aeronautics and Space Administration Dryden Flight Research Center 

(NASA/DFRC) 

National Aeronautics and Space Administration Headquarters - NASA HQ 

National Aeronautics and Space Administration Kennedy Space Center - NASA KSC 

National Aeronautics and Space Administration Wallops Flight Facility - NASA Wallops 

Sandia National Laboratories - SNL 

RCC RSG RISK COMMITTEE SUPPORTING ORGANIZATIONS 

3D Research Corporation - 3D Research 

ACTA, Inc. - ACTA 

Aerospace Corporation 

Air Force Space Command - AFSPC 

Analysis, Planning, Test Research, Inc. - APT Research 

Headquarters, Air Force Safety Center, Weapons Safety Division - HQ AFSC 

Research Triangle Institute, International - RTI 

SRS Technologies 

System Test and Evaluation Planning and Analysis Lab - STEPAL 

TYBRIN Corporation 

xiv
 ACRONYMS 

ABS American Bureau of Shipping 

ADS Automatic Destruct System 

ACCGIH American Conference of Government Industrial Hygienists 

AFB Air Force Base 

ACGIH American Conference of Government Industrial Hygienists 

AEGL Acute Emergency Guidance Level 

AFETAC Air Force Environmental Technical Applications Center 

AFSPC Air Force Space Command 

AIAA American Institute of Aeronautics and Astronautics 

AIS Abbreviated Injury Scale 

ALARP As Low as Reasonably Practicable 

ALCM Air Launched Cruise Missile 

ANSI American National Standards Institute 

APA Administrative Procedures Act 

AST Associate Administrator for Space Transportation (FAA) 

BMD Ballistic Missile Defense 

BRL Ballistics Research Lab 

CA Conjunction Assessment 

CCAS Cape Canaveral Air Station 

CDC Centers for Disease Control 

CFR Code of Federal Regulations 

CMMI Capability Maturity Model Integration 

COLA Collision Avoidance 

COP critical operations personnel 

CSC Conical Shaped Charge 

CSLA Commercial Launch Space Act 

DDESB Department of Defense Explosives Safety Board 

DFO Distant Focusing Overpressure 

DoD Department of Defense 

DODD Department of Defense Directive 

DODI Department of Defense Instruction 

DOL Department of Labor 

DOT Department of Transportation 

E/A energy to area ratio 

ELV Expendable Launch Vehicle 

ER Eastern Range 

EPA Environmental Protection Agency 

FAA Federal Aviation Administration 

FDA Food and Drug Administration 

FEMA Federal Emergency Management Agency 

FMEA Failure Modes Effects Analysis 

FMECA Failure Modes Effects and Criticality Analysis 

FOD Foreign Object Damage 

xv
FRP Fiber Reinforced Plastic 

FSS Flight Safety System 

FTCA Federal Tort Claims Act 

FTS Flight Termination System 

GEMS Generalized Energy Management System 

GGUAS Global Gridded Upper Atmosphere Statistics 

GNC Guidance, Navigation, and Control 

GP General Public 

GPa Refers to: Annual General Public Risk 

GPS Global Positioning System 

GRAM Global Reference Atmospheric Model 

HACK Hazard Area Computation Kernel 

HEBF High Energy Blast Facility 

HSC High-speed Craft 

HSE Health and Safety Executive (UK) 

ICAO International Civil Aviation Organization 

ICV Intercept Control Volume 

IDLH Immediately Dangerous to Life or Health 

IIP Instantaneous Impact Point 

ILL Impact Limit Line 

IMO International Maritime Organization (United Nations) 

IRIG Inter-Range Instrumentation Group 

ISDS Inadvertent Separation Destruct System 

ISS International Space Station 

IUS Inertial Upper Stage 

KE Kinetic Energy 

KIDD Kinetic Impact Debris Distribution 

KSC Kennedy Space Center 

LAP Launch Assist Platform 

LNG Liquid Natural Gas 

LOC Level of Concern 

LSC Linear Shaped Charge 

MEa Refers to: Annual Mission Essential Risk 

MEP Mission Essential Personnel 

MFCO Missile Flight Control Officer 

MPL Maximum Probable Loss 

MRTFB Major Range and Test Facility Base 

MSL Mean Sea Level 

NASA National Aeronautics and Space Administration 

NAWC Naval Air Warfare Center 

NDI/NDT Non-destructive Inspection / Non-destructive Test 

NIOSH National Institute of Occupational Safety And Health 

NOAA National Ocean & Atmospheric Administration 

NOHD Nominal Ocular Hazard Distance 

NPRM Notice of Proposed Rulemaking 

NRC Nuclear Regulatory Commission 

xvi
NTSB National Transportation Safety Board 

OSHA Occupational Safety and Health Administration 

OV Orbital Vehicle 

PDF Probability Density Function 

PIRAT Propellant Impact Risk Assessment Team 

PSS Premature Separation System 

RALCT Risk and Lethality Commonality Team 

RANS Range Squadron 

RC Risk Committee 

RCC Range Commanders Council 

RLV Reusable Launch Vehicle 

RSG Range Safety Group 

RSS Range Safety System 

RSO Range Safety Officer 

SEI Software Engineering Institute 

SLASO Space Licensing and Safety Office (Australia) 

SLCM Surface Launched Cruise Missile 

SPCS Space Control Squadron 

SRI Stanford Research Institute 

STIL Short Term Interval Launch 

STS Space Transportation System 

TCCR Transparency, Clarity, Consistency, & Reasonableness 

TM Telemetry 

TNT Trinitrotoluene 

TPS Thermal Protection System 

TT Thrust Termination 

TSPI Time Space and Position Information 

TVC Thrust Vector Controller 

USAF United States Air Force 

USCG United States Coast Guard 

USC United States Code 

VAFB Vandenberg Air Force Base 

V&V Verification and Validation 

WR Western Range 

WSMR White Sands Missile Range 

xvii
This page intentionally left blank. 

xviii
CHAPTER 1 

INTRODUCTION 

1.1 Purpose 

 This document supplements the policies, criteria, and risk management process 

established by RCC Standard 321-07. It also provides supporting rationale and guidance on 

models and analyses to assist safety professionals in implementing the policies and criteria. 

1.2 Scope 

 This Supplement is for use by DoD national ranges and the Major Range and Test 

Facility Base (MRTFB) members. The information provided applies to launch and reentry 

hazards generated by endoatmospheric and exoatmospheric range activities including both 

guided and unguided missiles and missile intercepts, space launches and reentry vehicles. This 

document does not include aviation operations or Unmanned Aerial Vehicle (UAV) operations 

(see the 321 Standard, paragraph 1.2). RCC Document 323-99 provides criteria for UAVs. 

1.3 Application 

 Range safety authorities are expected to use the criteria, analysis principles, and 

processes defined by the RCC 321-07 Standard and this Supplement document; however, the 

range Commander or his designated representative is the final decision authority for accepting 

risk and proceeding with a mission. 

 The intent of the safety criteria and guidelines is to provide definitive and quantifiable 

measures to protect mission-essential personnel and the general public. The analysis principles 

and processes defined in this Supplement can be used to characterize the operational risk for a 

mission. Definitive criteria provide a standard by which the range Commander's actions can be 

compared to those of any reasonable person in similar circumstances. All of the criteria have 

been evaluated from various perspectives and are considered reasonable. A discussion of the 

supporting rationale for the risk criteria is presented in Chapter 5 of this supplement. 

 The risk management and safety assessment processes presented in this Supplement 

should be used to consistently characterize and assess the hazards associated with a specific 

scenario to support an informed risk acceptance decision. Results obtained by applying these 

analytical methods, or other methods based on the principles endorsed here, are the product of a 

disciplined process to establish objective safety recommendations. Therefore, the risk estimates 

should not be subjectively altered at the end of the process. Such changes could invalidate the 

informed decision process that helps protect the government from liability. 

1-1
The RSG Risk Committee recognizes that there is uncertainty in the 

computed launch risks; however, consensus does not yet exist within the 

current Standard on the practice for characterizing risk uncertainty. This is 

a significant area to be addressed, but the schedule of this update/review 

phase did not allow for the considerable time required to develop criteria 

and recommended approaches. Uncertainty will be more completely 

addressed in the future updates of this supplement. 

1-2
CHAPTER 2 

RISK MANAGEMENT PROCESS LEVEL II 

 Chapter 2 of the 321-07 Standard presents a risk management process that provides a 

systematic and logical approach for identifying hazards and controlling risks. Risk assessment is 

not a single, fixed methodology; rather it is a systematic approach to organizing and analyzing 

scientific knowledge and information about potentially hazardous activities. Therefore, the risk 

management process steps presented here should not be considered as binding rules. However, 

these process steps do provide a strong foundation from which the responsible safety office may 

depart consistent with DoD policy when considering the unique situation posed by a range 

activity. A risk management policy can legitimately contain only those elements that are 

relevant and significant based on the specific requirements of the missions performed at the 

range in question. Each range must perform a careful review to ensure that all needed 

considerations and analyses are included in its risk assessment process. In addition, assessment 

of unique or unusual hazards may require a range to expand on the considerations included in 

this chapter. 

 Most test ranges have developed integrated tools to automate this process. Desirable 

characteristics for these tools are identified in Chapter 3 and Chapter 7 of this Supplement. It is 

incumbent on the ranges to ensure that the tools adequately incorporate these characteristics and 

accurately convey the risk estimate and the uncertainties inherent in the methods and data used. 

2.1 Historical Background 

 The original RCC Document 321 included a top-level approach to risk analysis to aid 

safety professionals in implementing the policies and criteria of the standard. The approach, 

known as the 8-Step Process, provided a description of activities included in the analysis of inert 

debris risk. The revision of RCC Document 321 expands the concept to include the major 

activities required to conduct the entire Risk Management Process and includes considerations to 

address hazards beyond just inert debris. 

 This newly defined approach is an adaptation of the risk management process currently 

accepted as standard by the system safety community and provides a more comprehensive 

picture of overall risk management. The approach highlights the iterative aspects and critical 

reviews commonly found in successful risk management programs and in existing range 

practices. While providing insight, this approach neither is an “approved” methodology nor 

inclusive of all considerations required to properly assess the risks encountered by every range 

or mission. The remainder of this chapter describes the new risk management process developed 

for this standard. Each function of the original 8-Step process can be found within the steps of 

this new process. 

2.2 Risk Management Process - Level II 

 This chapter of the Supplement expands the process defined in Chapter 2 of the Standard 

to the next level of detail. The flowchart presented in Figure 2-1 provides an overview of the 

2-1
major analysis tasks required to perform risk management from the flight safety perspective. 

Tasks are grouped into the four phases of Risk Management described in Chapter 2 of the 

Standard. The objectives of each phase are described in the subparagraphs below. Paragraph 2.3

gives a brief description of the steps within each phase and provides checklists of analytical 

considerations for each step that might be included in the specific analysis approach adopted by 

a test range. 

2.2.1 Mission Definition and Hazard Identification. Definition of the vehicle, safety control 

systems, and planned manner of flight are required to support identification of the hazards 

associated with the mission. Potential hazard sources are then examined by evaluating the 

system being flown and the range safety constraints. Information sources include range safety 

data packages, system description documents, mission essential personnel locations, surrounding 

population data, locations of facilities or properties to be protected, the range safety system used, 

and lessons learned from similar missions. The hazards associated with launch or test operations 

typically result from inert and explosive debris, chemical toxicity of propellants released 

inadvertently to the atmosphere or normal combustion of the propellant, and the distant focusing 

of an overpressure blast wave under certain meteorological conditions. These hazards may be 

the result of a launch vehicle or test article malfunction and subsequent breakup or intact impact, 

or the combustion and release of chemical constituents during normal operations. 

2.2.2 Risk Assessment. The initial approach in the risk management process is to contain the 

hazards and isolate them from populated areas wherever practical or to define hazard 

containment areas to minimize the population exposed and/or evacuate persons not associated 

with the hazard-generating event. This is in accordance with the primary policy that no 

hazardous condition is acceptable if mission objectives can be attained from a safer approach, 

methodology, or position (i.e., minimizing the hazards and conducting the mission as safely as 

reasonably possible). If hazards cannot be contained or minimized to an insignificant level, then 

more detailed assessments should be performed to determine if the remaining risk is acceptable. 

Hazard levels are first defined using qualitative and quantitative methods. This approach 

will result in basic measures of the hazards including debris size, quantity, mass, impact kinetic 

energy and explosive potential. Risks are then defined using qualitative and quantitative 

methods to assess and compare the hazard level to the vulnerability of the protected asset 

(personnel, facility, or other asset). This assessment produces risk measures such as individual 

probability of fatality (Pf), expected casualties (Ec), etc. This phase provides information needed 

to determine whether further risk reduction measures are warranted. 

2-2
PHASE III:

Criteria Comparison & Risk Reduction

PHASE I:

Mission Definition and Hazard Identification

PHASE II:

Risk Assessment

PHASE IV:

Risk Acceptance

“Mission” includes: (1) flight vehicle 

description, (2) flight scenario, (3) safety 

system, (4) operating rules / limits I-5. Identify Hazards 

and Hazard

Producing Events 

I-1. Define

Vehicle/System

I-2. Define

Mission

Scenario

I-4. Define

Safety System(s)

I-3. Define 

Safety Limits/

Operating Rules

Termination Criteria

Operational Limits

Protected Assets/Areas

R-1. Hazard 

Analysis 

Input Review

II-3. Propagate

Hazard

Characteristics

II-6. Assess

Containment

Feasibility

II-1. Characterize

Hazards at

Events

II-2. Model 

Dispersion of 

Hazard Source 

Locations

II-4. Compute

Spatial / Temporal

Statistics at Assets

Spatial

Temporal

II-5. Create/Refine

Flight Termination

Criteria

R-2. Critical Review of

Data and Assumptions

II-7. Compute Risks

• Individual 

• Collective

• Catastrophic

Refine Assessment

TO

IV-1

Yes

R-3. 

Critical

Analysis

Review

III-1. Evaluate Risks vs

RCC-321Criteria

• Risk Reduction Opportunities

• Risk Reduction Requirements

III-2. Refine

Assumptions

And Analysis

III-4. Refine

Safety Limits /

Operating Rules

III-5. Modify

System Design

TO

I-3

TO

I-2

TO

I-1

III-3. Modify

Planned Mission

Scenario

TO

II-1

IV-1. Review Mission,

Proposed Operating Rules,

And Risk Analyses

(Designated Authority)

IV-3. Follow Mission 

Rules – Terminate if

Real-time Limits 

are Violated

IV-2a. Approve Mission –

Launch When

Constraints are Met

IV-2b. Disapprove

Mission as Proposed

TO

III-1

NOTE: Checklists for all numbered boxes are provided in sections 2.3.1-2.3.4

PHASE III:

Criteria Comparison & Risk Reduction

PHASE I:

Mission Definition and Hazard Identification

PHASE II:

Risk Assessment

PHASE IV:

Risk Acceptance

“Mission” includes: (1) flight vehicle 

description, (2) flight scenario, (3) safety 

system, (4) operating rules / limits I-5. Identify Hazards 

and Hazard

Producing Events 

I-1. Define

Vehicle/System

I-2. Define

Mission

Scenario

I-4. Define

Safety System(s)

I-3. Define 

Safety Limits/

Operating Rules

Termination Criteria

Operational Limits

Protected Assets/Areas

R-1. Hazard 

Analysis 

Input Review

II-3. Propagate

Hazard

Characteristics

II-6. Assess

Containment

Feasibility

II-1. Characterize

Hazards at

Events

II-2. Model 

Dispersion of 

Hazard Source 

Locations

II-4. Compute

Spatial / Temporal

Statistics at Assets

Spatial

Temporal

II-5. Create/Refine

Flight Termination

Criteria

R-2. Critical Review of

Data and Assumptions

II-7. Compute Risks

• Individual 

• Collective

• Catastrophic

Refine Assessment

TO

IV-1

Yes

R-3. 

Critical

Analysis

Review

III-1. Evaluate Risks vs

RCC-321Criteria

• Risk Reduction Opportunities

• Risk Reduction Requirements

III-2. Refine

Assumptions

And Analysis

III-4. Refine

Safety Limits /

Operating Rules

III-5. Modify

System Design

TO

I-3

TO

I-2

TO

I-1

III-3. Modify

Planned Mission

Scenario

TO

II-1

IV-1. Review Mission,

Proposed Operating Rules,

And Risk Analyses

(Designated Authority)

IV-3. Follow Mission 

Rules – Terminate if

Real-time Limits 

are Violated

IV-2a. Approve Mission –

Launch When

Constraints are Met

IV-2b. Disapprove

Mission as Proposed

TO

III-1

NOTE: Checklists for all numbered boxes are provided in sections 2.3.1-2.3.4

Figure 2-1. Level 2 risk management process flowchart. 

2.2.3 Criteria Comparison and Risk Reduction. If the risk is unacceptable when initially 

compared to the criteria, then various protective measures should be considered to eliminate, 

mitigate, or control the risks. Elimination is achieved by design or system changes that remove 

the hazard source. Mitigation is achieved by reducing the hazard level or the effect of the 

hazard. Control is achieved by using flight termination systems, containment approaches, 

evacuation, sheltering, or other measures to protect assets from the hazards. Risk reduction 

should include confirmation of the resolution of anomalies and failures of all safety critical 

systems during previous tests or flights. Implementation of these measures may warrant a 

reassessment of the risk using revised assumptions and inputs. 

2-3
2.2.4 Risk Acceptance. Each organization should establish and use procedures that assure that 

risk levels are reviewed at the proper level of authority. This review should compare the 

operational risk to the criteria defined in this document and other applicable mission documents. 

In general, higher-risk operations require a higher level of approval. This final and necessary 

step in risk management is the acceptance of operational risks by a properly designated and 

informed authority. In general, this acceptance should be documented using existing procedures. 

These procedures should include the means of ensuring that planned standards and controls are 

being implemented. 

2.3 Detailed Checklists for Phases of the Risk Analysis Process 

 Figure 2-1 above provides only a top-level flow of the types of activities required to 

identify, assess, mitigate, and accept the risks resulting from a flight operation. The checklists 

below provide additional insight into those factors that should be considered for incorporation 

into a range’s analysis process. Considerations are provided for the steps in the four phases of 

the Level 2 risk management process shown at Figure 2-1. The checklists for each phase are 

contained in the following paragraphs as follows: 

Phase Title Paragraph

I Mission Definition and Hazard Identification 2.4 

II Risk Assessment 2.5

III Criteria Comparison and Risk Reduction 2.6

IV Risk Acceptance 2.7

The checklists below are not exhaustive and may not contain all parameters that should 

be considered in a given analysis. Each test range is responsible for determining the level of 

analysis required to assess the risks of a given mission. Some examples of factors that should be 

considered in the range’s process can be found in Chapters 3 and 7 of this supplement. 

2.4 Phase I: Mission Definition and Hazard Identification 

 For the purpose of the flight safety analysis discussions the term “mission” is defined to 

include a flight vehicle description, the flight scenario, the Flight Termination System on board 

the vehicle, the range safety system from where the vehicle will be controlled, and the rules and 

safety limits under which the operation must be conducted. 

Phase I of the Risk Management process is the information-gathering phase. This is 

often accomplished through technical reviews and meetings between the range users and the 

range operations and safety personnel. The purpose of this phase is to identify credible scenarios 

that can either intentionally, or unintentionally, produce hazards and define the scope of the risk 

assessment to be performed. The outcome of this phase will be a list of hazards and hazardous 

events to be analyzed in the Risk Assessment phase. Key steps of this phase and items that 

should be considered are described below. 

2-4
2.4.1 Step I-1: Define Vehicle/System. Identify characteristics of the vehicle and vehicle 

behavior that can create potential hazards, represent a means of controlling hazards or can affect 

the magnitude of the hazard. See the checklist at Table 2-1. 

2.4.2 Step I-2: Define Mission Scenario. Define where and how the vehicle is intended to fly 

in order to identify potential hazardous events or pre-determined bounds that may be dictated by 

mission/program requirements. See the checklist at Table 2-2. 

2.4.3 Step I-3: Define Safety Limits/Operating Rules. Identify known or pre-defined safety 

limits and operating rules to serve as a baseline for beginning the analysis. These are typically 

revised and refined based on analysis results (See Step II-5). See the checklist at Table 2-3. 

2.4.4 Step I-4: Define Safety System(s). Identify planned and available means of controlling, 

containing or mitigating the hazards and the characteristics of the safety system(s) that 

define/bound the scope of the assessment. See the checklist at Table 2-4. 

2.4.5 Step I-5: Identify Hazards and Hazard Producing Events. Given the inputs of the 

previous four steps, define the hazards and hazardous events that will be evaluated in the risk 

analysis and assessment. See the checklist at Table 2-5. 

2.4.6 Review R-1: Hazard Analysis Input Review. Review at this point provides an 

opportunity to reconfirm the scope of the analysis to be performed and verify that all of the 

hazards to be assessed are reasonable and feasible. See the checklist at Table 2-6. 

2-5
TABLE 2-1. RISK MANAGEMENT PROCESS (STEP I-1) 

Define the Vehicle/System 

A. Vehicle characteristics 

Configuration 

• Booster stack – motors/stages (liquid/solid, strap-ons), interstages, skirt(s), 

payload fairings 

• Payload(s) and reentry bodies 

Mass properties as a function of time 

• Dry weight 

• Propellant (to include ambient and pressurized conditions) 

Structural limits 

Thrust history/capability 

Turn capability (velocity turn data, malfunction turn trajectories or lateral 

acceleration) 

Guidance/Control systems (TVC, fins, jets/thrusters, etc.) 

On-board data/tracking instrumentation (TM, GPS units, transponders) 

• Data rates 

• Tracking uncertainties 

B. Vehicle Failure Modes and Responses 

Failure Mode Effects and Criticality Analysis (FMECA)/Failure Modes and 

Effects Analysis (FMEA) 

Event Tree Analysis 

C. Vehicle Failure Probabilities – derived from: 

Historical data 

Similar vehicles 

Reliability analysis or demonstration 

Bayesian analysis 

Relevancy of aging data (ex. fading memory filter) 

2-6
TABLE 2-2. RISK MANAGEMENT PROCESS (STEP I-2) 

Define Mission Scenario 

A. Mission Objectives 

Type of Mission 

• Payload launch 

o Orbital (including type of orbit) 

o Suborbital 

• Demo/Experiment 

• Intercept 

Data Collection /Performance Requirements 

• Altitude requirements 

• Range requirements 

• Velocity requirements 

• Vehicle attitude requirements 

• Event/timing requirements 

• Program instrumentation requirements 

Other Program auxiliary requirements (e.g., sun angle, distance from land 

target flies, etc.) 

B. Nominal Flight Trajectory/Scenario 

Flight path (including target area for suborbital launches) 

Event timing (staging, other hardware jettisons, GNC maneuvers, energy 

management, payload deployments) 

Intercept geometry 

C. Flight performance envelope 

3-sigma bounds of trajectories derived from GNC performance and motor 

performance defining lofted, depressed, maximum cross range left and right, 

short range (cold motor), long range (hot motor) 

Allowable or permitted intercept control volume 

2-7
TABLE 2-3. RISK MANAGEMENT PROCESS (STEP I-3) 

Define Mission Scenario 

A. First cut flight termination criteria 

Credible RSO and system reaction time 

Pre-defined flight corridors (azimuth fans, impact limit lines, etc.) 

Destruct or flight termination limit lines, vertical plane limits, vehicle attitude criteria, 

protection circles, gates, etc. 

Rules for “No Data” destruct 

B. General safety and operating rules 

No IIP overflight 

Protected Assets/Areas - “assets”(also called receptors) includes people 

• Regions to be protected 

• High value assets (facilities, property or other) 

• Population centers 

• Staffed personnel locations 

Pre-defined personnel sheltering and evacuation requirements 

Minimum number of tracking data sources and other applicable requirements such as 

capability of failing gracefully, etc. 

Initial launch commit criteria and launch constraints 

Special mission rules identified by the range user or flight analysts 

2-8
TABLE 2-4. RISK MANAGEMENT PROCESS (STEP I-4) 

Define Safety Systems 

A. Vehicle Flight Termination System (FTS) characteristics 

Determine need for FTS - dependent on type of vehicle (some do not require FTS) and capability of a 

vehicle to hazard a protected area 

Type(s) of system(s) 

1. Commanded 

2. Automatic (such as triggered by a premature separation) 

3. Autonomous (such as vehicle system determining violation of some predetermined criteria) 

Termination method(s) 

• Linear Shaped Charge (LSC) - longitudinal, circumferential 

• Conical Shaped Charge (CSC) 

• Thrust Termination (TT) - ports, fuel line cuts 

FTS reliability 

System delays – the time to receive and execute the termination command 

Antenna type/patterns 

B. Range Safety System (RSS) characteristics 

Identify system(s) to be used 

• Fixed, land-based system 

• Mobile (land, sea, air platform) 

Mode(s) of operation 

• Manual destruct 

• Automatic destruct 

Antenna type(s) - directional (dish or helix) or omni 

Antenna location(s) (for plume shadow assessment) 

Transmit range (for link margin analysis) 

System delays 

• Time to receive and process Time, Space and Position Information (TSPI) data 

• Time to transmit after Destruct button push 

Method of handover, if applicable (transfer of command and control) 

C. Tracking instrumentation feeds (accuracy, frequency of data, data latency) 

2-9
TABLE 2-5. RISK MANAGEMENT PROCESS (STEP I-5) 

Identify Hazards and Hazard Producing Events 

A. Inert Debris Impact 

B. Explosive Debris (near-range effects) 

C. Distant Focusing Overpressure (DFO) 

D. Toxics 

E. Hazard producing scenarios: 

Malfunctioning vehicle terminated at destruct line or due to other criteria such as 

potential loss of FTS link or tracking data or obviously erratic flight 

Malfunctioning vehicle exceeding structural limits 

Motor case rupture (overpressure, burn-through – explosion while following nominal 

trajectory) 

Inadvertent separation of strap-on motors during either normal flight or during a 

vehicle malfunction 

Scheduled jettisons 

Planned intercept event (whether KE, explosive, or directed energy) 

Planned destruct (post-mission prevention of recovery) 

Planned payload deployments and activations 

TABLE 2-6. RISK MANAGEMENT PROCESS (REVIEW: R-1) 

Hazard Analysis Input Review 

A. Sanity check that all potential/feasible hazards have been addressed. 

Have common cause failures been addressed? 

Have multiple simultaneous or sequential failures (stacked failures) been included that 

are not realistic or feasible? 

B. Have the failure modes and responses been adequately identified, supported, justified, 

and rationalized? 

C. Do the failure probabilities make sense? 

Consider similarities and differences between similar vehicles and similar subsystems 

Are the failure probabilities justified by the vehicle’s flight experience? 

D. Have there been any new design changes to the systems (vehicle or other) since the risk 

management process was started? 

2-10
2.5 Phase II: Risk Assessment 

 Phase II of the Risk Management Process consists of conducting qualitative and 

quantitative risk analyses and assessments to determine the level of risk posed by the mission. 

The output of Phase II will be the measures of risk to be evaluated against the acceptable risk 

criteria. The Risk Assessment Phase may be an iterative process where portions of the analysis 

are conducted more than once as data inputs and assumptions are refined and finalized. All 

assumptions and the uncertainties associated with these assumptions should be noted at each step 

for consideration in the critical reviews and decision-making phases. If the analyses shows that 

containment is achieved then the analyst can finalize the assessment at that point, document the 

results, and proceed directly into the reviews of the Risk Acceptance Phase (Phase IV) of the 

process. 

Risk assessments should be conducted using tools that are both validated (fulfills the 

requirements of the task) and verified (correctly executes the function). Assessments can either 

be industry-accepted tools or custom tools developed by the range to meet their specific analysis 

needs. The tools used should be documented to include a statement identifying the means of 

validation and verification. Example statements include commercially produced; industry 

accepted; compared to available empirical data either from launch accident, planned event or 

from lab tests/experiments; compared to other accepted or validated tools; and demonstrated to 

match theoretical models. Additional information on recommended tool/model requirements is 

provided in Chapter 3 of this supplement. 

2.5.1 Step II-1: Characterize Hazards at Events. Identify specific, detailed characteristics of 

the hazards to be evaluated. Hazards other than those listed here may need to be included as 

described in Chapter 8 of this supplement. See the checklist at Table 2-7. 

2.5.2 Step II-2: Model Dispersion of Hazard Source Locations. Define the origination points 

of the hazard sources (whether they be debris, toxics, or explosives) taking into account wind 

dispersions and the uncertainties in vehicle performance and in the hazardous event models. See 

the checklist at Table 2-8. 

2.5.3 Step II-3: Propagate Hazard Characteristics (Spatial and Temporal). Propagate the 

results of the hazardous events to the points and times of interest. This could be debris 

propagated to the ground, to aircraft altitudes, or to orbital demise; or explosive or toxic hazards 

characterized as a function of time and distance from the hazard origination or at specific 

asset/receptor locations. The outcome of this step is defined hazard characteristics at the points 

and times of interest. Items that may affect propagation and post-propagation characteristics of 

the hazards are listed. See the checklist at Table 2-9. 

2.5.4 Step II-4: Compute Spatial/Temporal Statistics at Protected Assets Exposed to Hazard. 

Identify the assets (also called receptors) for which risk is to be assessed and determine the level 

of the hazard exposure for each identified asset. Levels of hazard exposure are often expressed 

in the form of density statistics or as function of time. See the checklist at Table 2-10. 

2-11
NOTE: These next two steps are often performed as an iterative process. 

2.5.5 Step II-5: Create/Refine Flight Termination Criteria. In some cases flight termination 

criteria (particularly destruct boundaries) are not defined until after the debris statistics are 

produced. In these situations this may occur before or during the containment feasibility 

assessment. In other cases flight termination criteria are adjusted after assessing containment 

feasibility as a means of achieving containment. As stated in paragraph 2.3.3 of the Standard, 

flight termination criteria should be optimized by balancing the risk given a failure and flight 

termination against the risk given a failure and no flight termination. See the checklist at 

Table 2-11. 

2.5.6 Step II-6: Assess Containment Feasibility. Identify the ability to contain hazards and 

thus not put any personnel or property at risk. Containment may be achievable by implementing 

flight termination criteria and launch constraints, thus this step is performed in close 

coordination with Step II-5 above. See the checklist at Table 2-12. 

2.5.7 Review R-2: Critical Review of Data and Assumptions. Review at this stage allows the 

analyst to double check inputs and assumptions and make any necessary or available adjustments 

to the analysis before going on to computing the risk numbers, which can be a time-consuming 

process. See the checklist at Table 2-13. 

If containment is achieved and the analyst has conducted the critical 

review of data and assumptions, the assessment may be ended here and the 

analyst may proceed to documenting the results, conditions, and 

assumptions for review with the decision authority in Step IV-1 of the Risk 

Acceptance Phase (paragraph 2.7). The steps of the risk reduction phase 

are no longer required. 

2.5.8 Step II-7: Compute Risks. Calculate the various measures of risk that are to be 

evaluated against the acceptable risk criteria. This includes Individual, Collective and 

Catastrophic risk for the people exposed. Measures of risk are commonly expressed as 

Probability of Impact, Probability of Casualty/Fatality, Expected Casualty/Fatality and 

Probability of N or more Casualties. See the checklist at Table 2-14. 

2.5.9 Perform Review R-3: Critical Analysis Review. This is a final sanity check and “all 

bases covered” review to assure that the risk numbers to be evaluated in the Risk Reduction 

phase and to be presented to the decision authority are as accurate as possible. See the checklist 

at Table 2-15. 

2-12
TABLE 2-7. RISK MANAGEMENT PROCESS (STEP II-1) 

Characterize Hazards at Events 

A. Debris lists - includes size, shape, material, ballistic coefficient and fragment imparted 

velocity information (See paragraph 7.1 for additional guidance on the development of 

debris lists.) 

FTS event - either commanded, auto, or Premature Separation System(PSS) - 

including time variance 

Breakup – aerodynamic/inertial, motor pressure (explosion), structural failure 

Intercept – relevant mechanisms considered, e.g., direct hit vs. glancing blow, 

explosive, directed energy; special characteristics of the target or intercept mechanism 

Payload deployment activities (explosive and dispersal payloads) 

Credibility of debris list 

• Accounts for total mass of vehicle hardware and propellants 

• Consistent with launch accident debris data 

• Debris pieces adequately defined in terms of weight, size, shape, ballistic 

characteristics, imparted velocity, propellant content (type, weight) 

B. Initial source clouds for toxics 

C. Explosives quantities, yields, and geometries 

D. Residual thrust dispersion of prematurely separated strap-on motors 

2-13
TABLE 2-8. RISK MANAGEMENT PROCESS (STEP II-2) 

Model Dispersion of Hazard Source Locations 

A. State Vector(s) at event including any imparted velocity from event – flight 

termination, overpressure/burst, momentum transfer from intercept 

B. Failure turns - some modeling options are: 

Credible malfunction trajectories 

Velocity turn data (turn angle and velocity magnitude histories) 

Maximum energy footprint 

90-degree turn 

Maximum rate turn 

Extreme rate tumble 

C. Address significant sources of uncertainty which may include: 

3-sigma data of performance and/or event model 

Monte Carlo of trajectories and/or performance and event model data 

Tracking instrumentation uncertainties (Uncertainty in measuring the state vector. 

This largely affects real-time displays but should be accounted for in analysis when 

defining/refining flight termination criteria.) 

D. Winds 

Measured 

Statistical 

2-14
TABLE 2-9. RISK MANAGEMENT PROCESS (STEP II-3) 

Propagate Hazard Characteristics (Spatial and Temporal) 

A. Drag – tumbling or trim (consider applicable flow regime) 

B. Aerodynamic lift 

C. Gravity (appropriate degree of refinement) 

D. Meteorological profile 

E. Winds 

Measured 

Statistical 

F. Aero-thermal demise and propellant burn 

G. Vapor cloud dispersion rate 

H. Vapor cloud travel rate 

I. Time for debris to pass through aircraft altitude 

J. Blast wave propagation 

TABLE 2-10. RISK MANAGEMENT PROCESS (STEP II-4) 

Compute Spatial/Temporal Statistics at Protected Assets Exposed to Hazard 

A. Identify assets 

Personnel – category, location and number (includes distribution by shelter types) 

• What is at risk? (unsheltered people, people in cars, people in structures, - are the 

people in locations where the safety organization can restrict their presence?) 

Aircraft – category, size, engines, # passengers, location (including altitude), flight 

path and speed 

Surface craft – category, size, # personnel, material (metal, fiberglass, wood, etc.), 

location, speed 

Spacecraft – type, location (ephemeris) 

Valuable structures/equipment – (control centers, instrumentation sites, radars, etc.) 

Protected natural spaces 

B. Debris density (or PDF) by hazard level at location (accounting for flight termination 

action once flight termination criteria are defined) 

At altitude (as a function of time) 

At surface 

C. Toxic cloud concentration as function of time at location 

Peak at location 

Time of exposure 

D. Explosive pressure and impulse at assets 

2-15
TABLE 2-11. RISK MANAGEMENT PROCESS (STEP II-5) 

Create/Refine Flight Termination Criteria 

A. Define/refine flight termination boundaries 

B. Define exclusion areas (often referred to as caution or hazard areas) 

C. Refine/revise the launch commit criteria and launch constraints as necessary 

D. Return to Step II-1 and recompute the debris statistics once flight termination criteria 

and launch criteria are finalized 

TABLE 2-12. RISK MANAGEMENT PROCESS (STEP II-6) 

Assess Containment Feasibility 

A. Are any assets at risk? 

B. Does debris, explosive, or toxic hazard reach any protected area or defined boundary? 

TABLE 2-13. RISK MANAGEMENT PROCESS (REVIEW: R-2) 

Critical Review of Data and Assumptions 

A. Sanity check of assumptions 

B. Update/refine inputs as available 

C. Replace assumptions with better data if/when provided 

D. Return to Step II-1 and refine analyses with revised/new data as necessary 

2-16
TABLE 2-14. RISK MANAGEMENT PROCESS (STEP II-7) 

Compute Risks 

A. Probability of modeled event 

B. “Lethal Hazard” Area and “Casualty Area”(measured as function of asset size and/or 

debris size and shape, terminal trajectory characteristics such as angle of impact and 

impact velocity, nature of debris – inert, burning, explosive, and impact phenomenon 

such as cratering, sliding and bouncing). Defined for: 

Person 

Aircraft 

Ship 

Structure 

C. Probabilities of impact on asset(s) 

D. Assess post-impact hazards at receptors (assets) 

Explosion (overpressure/impulse and secondary fragmentation) 

Cratering 

Bounce/slide 

Heat/fire 

Asphyxiation 

E. Modification of hazard by structures as applicable 

Type of structure 

• Structure category (reinforced concrete, steel frame, tilt-up, corrugated metal, 

wood frame, etc.) 

• Material makeup (wood, steel, concrete, glass, brick, etc.) 

• Construction method 

• Number of stories 

• Wall/Roof thickness 

• Number and types of windows 

Protection provided 

Spalling 

Penetration 

Collapse 

Window breakage (flying glass shards) 

Ventilation, air exchange rate 

(Continued on next page)

2-17
TABLE 2-14 (Continued) 

F. Probability of casualty/fatality from inert debris 

G. Probability of casualty/fatality from toxics 

H. Probability of casualty/fatality versus overpressure and impulse for explosive debris 

Person 

Aircraft 

Ship 

Structure 

I. Expected Fatality/Casualty (aggregate risk from the various scenarios, hazards and 

assets (receptors)) 

Individual 

Collective 

Catastrophic 

Risk profile (plots the probability of an accident causing a given number of casualties 

vs. the number of casualties – Pr(# casualties > C for all C)) 

TABLE 2-15. RISK MANAGEMENT PROCESS (REVIEW: R-3) 

Critical Analysis Review 

A. Sanity check of assumptions and processes 

B. Update/refine inputs as they are made available. Examples: 

Revised trajectories 

Updated aero/thrust models 

Updated mass properties 

Refined wind data 

Refined debris lists 

Updated census counts 

C. Return to Step II-1 and refine risk analysis and assessment with revised/new data if 

necessary 

2-18
2.6 Phase III: Criteria Comparison and Risk Reduction 

 During Phase III of the Risk Management Process, the risk measures computed by the 

analyst are evaluated to determine if there is a need or desire for risk reduction measures to be 

taken to eliminate, mitigate, or control risks. Not all of the steps of the Risk Reduction phase are 

required to be performed – only those that are found applicable. Most often, risk reduction is 

accomplished through modification of the mission definition and requires coordination with the 

range user to determine reasonable, appropriate measures since some modifications can severely 

impact cost and schedule. Risk reduction should also include confirmation of the resolution of 

anomalies or failures of all safety critical systems during previous tests or flights. Once risk 

reduction measures are taken, the hazards are reassessed to compute the revised levels of risk. 

The end result of this phase is a comparative summary of the measures of risk against the 

appropriate criteria and a recommendation for the decision authority to either approve or 

disapprove the mission. The steps for Phase III are shown below. 

2.6.1 Step III-1: Evaluate Risks vs. Criteria. Compare risk measures with established criteria 

to determine if risk reduction is required or desired. Identify areas where risk reduction may be 

achievable. See the checklist at Table 2-16. 

2.6.2 Step III-2: Refine Assumptions and Analysis (returning to Step II-1). Reevaluate the 

analysis methodology to determine if any assumptions should be adjusted or if any steps or 

processes should be refined with further detail. See the checklist at Table 2-17. 

2.6.3 Step III-3: Modify Planned Mission Scenario (returning to Step I-2). Reevaluate the 

scenario and determine if any changes can be made to move the hazards further away from 

endangered areas while still meeting mission requirements. See the checklist at Table 2-18. 

2.6.4 Step III-4: Refine Safety Limits/Operating Rules (returning to Step I-3). Reevaluate the 

safety and mission rules to determine any changes that can eliminate or control the hazards or 

can reduce the severity and/or probability of the hazard. Again, flight termination criteria should 

be optimized by balancing the risk given a failure and flight termination against the risk given a 

failure and No flight termination. See the checklist at Table 2-19. 

2.6.5 Step III-5: Modify System Design (returning to Step I-1). Reevaluate the vehicle and 

safety system(s) designs to determine if any modifications can be made that will eliminate 

hazards or significantly reduce the hazardous effect. See the checklist at Table 2-20. 

2-19
TABLE 2-16. RISK MANAGEMENT PROCESS (STEP III-1) 

Evaluate Risks vs. Criteria 

A. Compare computed risks to acceptable risk criteria for all categories of assets 

B. Evaluate risks for common sense checks even if criteria are not exceeded 

Does the scenario make sense? 

Can minor modifications be made to achieve containment or to reduce risk? 

C. Identify Risk Reduction Requirements 

What area of risk is exceeded – personnel, aircraft, etc.? 

By how much are the criteria exceeded? 

D. Identify Risk Reduction Opportunities 

Have assumptions been made that are very conservative and could be revised so as to 

justifiably reduce the predicted risk? 

What area(s) of the mission definition can affect risk reduction? 

What area(s) of the mission definition provide the greatest risk reduction? 

What area(s) of the mission definition can be altered most easily? 

What area(s) of the mission definition can be altered with the least schedule/cost 

impact? 

What evacuations and sheltering of people can be realistically accomplished? 

Prioritize areas of focus 

TABLE 2-17. RISK MANAGEMENT PROCESS (STEP III-2) 

Refine Assumptions and Analysis (returning to Step II 

A. Remove any excess conservatism in assumptions (so long as the reduction is 

supportable). 

B. Adjust level of depth of the analysis 

Was any part of the process initially deemed unnecessary that should be reconsidered? 

(example: initially looked at only worst cases or bounding cases now refine to assess 

Monte Carlos or 3-sigma performance) 

2-20
TABLE 2-18. RISK MANAGEMENT PROCESS (STEP III-3) 

Modify Planned Mission Scenario (returning to Step I-2) 

A. Shift trajectory azimuth 

B. Increase or decrease quadrant elevation 

C. Modify flight profile - doglegs, Generalized Energy Management Steering (GEMS) 

maneuvers, pitch up, pitch down, piled river, lofting, etc. 

TABLE 2-19. RISK MANAGEMENT PROCESS (STEP III-4) 

Refine Safety Limits/Operating Rules (returning to Step I-3) 

A. Adjust destruct lines, impact limit lines and/or protection boundaries 

B. Adjust allowable RSO response time (so long as the adjustment is supportable) 

C. Evacuate or shelter personnel 

D. Implement hands-off gates or critical event markers 

E. Implement gates or critical event markers for staging, ignition or performance 

F. Utilize automatic destruct system if available 

TABLE 2-20. RISK MANAGEMENT PROCESS (STEP III-5) 

Modify System Design (Returning to Step I-1) 

A. Remove or add ballast 

B. Impose hardware or software steering limits 

C. Implement inhibit logic 

D. Increase tracking instrumentation reliability/accuracy 

E. Refine system delay times 

F. Modify Vehicle Flight Termination System 

Type of system – automatic or autonomous vs. commanded 

Modify post-termination states – terminate thrust, deploy chutes, disperse fuel, change 

debris fragmentation, etc. 

• Change termination method – LSC > CSC > TT > Line Cut 

• Change location of charge – raceway vs. aft dome vs. forward dome 

2-21
2.7 Phase IV: Risk Acceptance 

 Once the risk assessment is complete and all necessary risk reduction measures are taken, 

final results and recommendations (including proposed operating/mission rules) are presented to 

the appropriate decision authority. The result of this phase can be one of the following 

outcomes: 

a. An approved mission, 

b. An approved or disapproved mission with further instructions or 

c. A decision to reject the mission. 

To ensure that the decision authority is fully informed, the analysis/assessment should be 

fully documented to include the assumptions made and justifications, results, recommendations 

of the analysis team, models used for the analysis, and uncertainties associated with the 

assumptions and models. Information on models used should include version numbers and a 

brief description of certification and/or heritage. (Examples: industry-accepted model XX 

version #.#, Debris generator X, custom developed by Organization Y and verified using 

available empirical (or test) data or via comparative analysis against Tool Z.) 

After reviewing the information the decision authority may either approve the mission 

with the noted risks or disapprove the mission. If the mission is disapproved, the safety 

organization and the range user may elect to continue efforts to reduce risks to an acceptable 

level. If no further risk reduction is possible and the predicted risks are still too high, the 

appropriate decision authority may reject the mission as unsafe and determine that it should not 

be pursued. If the risks are acceptable and the mission is approved, the authority is issued to 

proceed with a countdown and subsequent launch once all of the defined launch commit criteria 

launch constraints are met. Once the vehicle is launched the defined flight termination criteria 

are in effect and the flight will be terminated if those criteria are violated in order to ensure the 

approved level of risk is not exceeded. 

2.7.1 Step IV-1: Review Mission, Operating Rules and Risk Analyses (Designated Authority). 

Present analysis results, conditions, and recommendations to the decision authority. These 

should include the elements shown at Table 2-21. 

2.7.2 Step IV-2a: Approve Mission – Launch When Constraints are Met. The decision 

authority accepts the mission risk and approves operating/mission rules and launch constraints. 

The countdown proceeds and liftoff is allowed if launch constraints are met. A “Hold” is issued 

if launch constraints are not met; however, the appropriate designated decision authority is 

allowed to implement a real-time waiver if deemed necessary. Some of the significant 

constraints considered are shown at Table 2-22. 

2.7.3 Step IV-2b: Disapprove Mission as Proposed (returning to Step III-1). If the risks 

remain too high or the operating rules are too severe or restrictive, the decision authority may 

disapprove the mission thus requiring the analyst and range user to return to the Risk Reduction 

Phase in an attempt to identify and implement any further risk reduction measures. If all 

measures have been exhausted and the risks still exceed established criteria then a waiver may be 

2-22
requested by the range user and granted by the appropriate authority if the need is justified or the 

mission may be rejected. 

2.7.4 Step IV-3: Follow Mission Rules. Terminate the mission if real-time limits are violated. 

During execution of an approved mission, the defined flight termination criteria are in effect and 

the flight will be terminated if those criteria are violated in order to ensure the approved level of 

risk is not exceeded. 

TABLE 2-21. RISK MANAGEMENT PROCESS (STEP IV-1) 

Review Mission, Operating Rules and Risk Analyses (Designated Authority) 

A. Measures of risk that are presented 

B. Risk level or loss potential 

Maximum risk in event of a flight termination action 

Maximum risk should flight termination fail 

Risk profiles, if used 

Sensitivity analyses 

C. Key analysis assumptions 

D. Population centers potentially at risk 

E. Facilities, property or other assets at risk 

F. Protective measures 

G. Operating rules 

H. Launch Constraints and Launch Commit Criteria 

I. Flight Termination Criteria 

TABLE 2-22. RISK MANAGEMENT PROCESS (STEP IV-2A) 

Approve Mission – Launch When Constraints are Met 

A. Hazard area cleared 

B. Personnel in approved shelters 

C. Vehicle FTS operating properly (battery levels good, signal strength, etc.) 

D. Range Safety system operating properly (receiving good data, transmit-power good, etc.)

E. Casualty expectation under current meteorological conditions within approved limits 

2-23
This page intentionally left blank. 

2-24
CHAPTER 3 

GENERAL RISK MODEL REQUIREMENTS 

 Computer models and simulations are typically used to estimate the risk involved in an 

activity. This chapter describes general model requirements that should be applied to 

computational tools used to analyze the flight safety risks in support of decisions governing 

safety. In general, a model is a technical representation of a system, theory, or phenomenon that 

accounts for its known or inferred properties and may be used for further study of its 

characteristics. For the purposes of this chapter, in range safety usage, models are defined as 

those tools developed for the specific task of analyzing flight risks. 

3.1 Specific to Policy 

 Models must provide results that support decisions based on risk policy. Compliance 

with risk policy is assessed using established criteria that consist of two components. The 

components are a well-defined measure of risk, and a threshold of acceptability. Models must 

produce a valid estimate of one or more of the measures of risk stipulated by applicable criteria. 

3.2 Transparency, Clarity, Consistency and Reasonableness (TCCR) 

 Models must uphold standards of transparency, clarity, consistency, and reasonableness 

accepted by the scientific community. Specifically, models must reflect: 

a. Transparency. Provide decision-makers a clear understanding of the technical 

approach used. This understanding must include key supporting assumptions as well 

as the limitations of the model and the results it produces. 

b. Clarity. Produce results that can be clearly displayed and communicated. 

c. Consistency. Use processes and approaches that are consistent with (similar to or 

accepted by) those used by scientific communities involved in studying similar 

problems. This requirement is intended to ensure scientific accountability rather than 

to stifle innovation. 

d. Reasonableness. Use appropriate technical procedures and input data that, if 

subjected to scrutiny, would be accepted by the scientific community, government 

agencies, and to the degree possible, the general public. Available resources may 

limit the approaches used. 

3.3 Verification and Validation (V&V) 

 Models should provide a formally documented “Basis of Confidence” in the results 

produced. Numerous methods can be used to build confidence in a model, including: 

a. Comparison to “real world” results. 

b. Comparison to other models that have been independently developed and possess an 

accepted “basis of confidence.” 

c. Formally documented Verification and Validation (V&V). 

d. Peer reviews/expert elicitations. 

3-1
3.4 Configuration Control 

 Model development should follow processes that are formally managed and controlled. 

A documented process should be used to request, implement, and test changes to the model. In 

unusual circumstances, an abbreviated review of model changes may be necessary to support 

near-term mission requirements. The full requirements of the documented process should be met 

prior to repeated use of results from the upgraded model to make safety decisions. The 

development of computer codes implementing models should adhere to industry standards such 

as the Software Engineering Institute’s (SEI) Capability Maturity Model Integration (CMMI).1

 

The use of CMM Level 2 is recommended as a minimum requirement. Each range should 

develop and implement an accreditation process that is applied to all models used for flight 

safety analysis and support. This accreditation process should identify verification and 

validation requirements (V&V) for safety critical software and safety analysis software. The 

results of V&V efforts for safety critical software should be formally documented including the 

source and nature of any external data used to conduct validation. Requirements for 

accreditation of safety-critical software should be greater than requirements for safety analysis 

software. 

3.5 Liability Protection 

 Models must produce results that meet the “best available” information-test affording the 

decision-maker the opportunity to make a fully informed decision that qualifies for liability 

protection under the Discretionary Function Exclusion of the Federal Tort Claims Act (FTCA) 

(28 U.S.C. Section 2680(a)). 

3.6 Best Estimate of Expected Value 

 Models should produce the best estimate of the risk based on available inputs and require 

the use of best engineering estimates. A conservative estimate can be developed by using 

slightly conservative inputs when data are uncertain or are unavailable and need to be estimated. 

An analysis of the uncertainties and sensitivities of results is highly desirable. 

3.7 Balance of Accuracy, Simplicity, and Fidelity 

 Models must produce the most accurate results possible considering real world 

limitations such as computer run time, computational resources, cost, and time to develop input 

data, and the diminishing return on further investment. Compliance with this standard requires a 

balance between modeling fidelity, uncertainties in input data, and the ability to communicate 

understanding of both the analysis process and the results. 

3.8 Conservatism and Uncertainty 

 Model development must consider the dangers of excessive conservatism. Where 

possible, developers should avoid compounding conservatism in analytical results by using best 

estimate approaches for developing input data and modeling algorithms. Potential variation in 

 

1

 Information on CMMI standards can be found at http://www.sei.cmu.edu/cmmi/models/

3-2
the input data and inaccuracies in the modeling results should be addressed by the 

acknowledgement and documentation of uncertainties as discussed in Section 2.3.5 of the 

Standard rather than by introducing bias in the risk estimate. 

3.9 Balance of Element Fidelity 

 Models should clarify the accuracy of analytical results based on assessment of the 

accuracy of each element of the risk model. Assessments of models should focus on the 

accuracy of the risk estimation rather than the fidelity of a single element. 

3-3
This page intentionally left blank. 

3-4
CHAPTER 4 

RISK CRITERIA IMPLEMENTATION GUIDELINES 

4.1 Introduction 

 This chapter provides guidelines for implementation of the acceptable risk criteria 

presented in RCC Document 321-07, Chapter 3. The guidelines are presented to help: 

a. Determine the start and end of a flight in terms of application of the per mission risk 

criteria. 

b. Establish appropriate risk criteria for complex missions, such as those that involve 

multiple launches or distinct phases of flight. 

c. Facilitate the proper management of annual risk. 

4.1.1 Context and Purpose of this Chapter. RCC 321-07 Chapter 2 expresses the general 

policy and goals of this standard, which includes the assertion that all ranges should strive to 

achieve complete containment of hazards resulting from both normal and malfunctioning flights. 

However, many range missions cannot be accomplished using a containment approach. If a 

planned mission cannot be reasonably accomplished using a containment approach, a risk 

management approach should be authorized by the range Commander or his designated 

representative. The risk management approach should conform to the guidelines presented in 

this document or otherwise demonstrate compliance with the policy objectives presented in 

Chapter 2 of RCC 321-07. The guidelines and rationale presented in this chapter are intended to 

help the range Commander understand and balance the factors that affect mission acceptability. 

These factors include criticality of mission objectives, protection of life and property, the 

potential for high consequence mishaps, local political factors, and governing range or 

programmatic environmental requirements. 

Range Commanders should not accept adverse consequences (such as any casualty) as 

being routine or permissible. However, some range missions cannot be accomplished without a 

finite probability of producing adverse consequences. “Acceptable” risks as discussed here 

should be interpreted as “tolerable” risks. By implementing the guidelines presented here, the 

range Commander may tolerate these risks to secure certain benefits from a range activity with 

the confidence that the risks are properly managed within prescribed limits. 

4.1.2 Different Measures of Risk. 

a. Individual and Collective Risk. Risk is a measure that accounts for both the 

consequence of an event and the probability of occurrence over a specified exposure 

interval. Individual risk and collective risk are two important measures of risk, both 

of which can be expressed on an annual or per mission basis. For example, collective 

risk on an annual basis is analogous to an estimate of the average number of people 

hit by lightning each year, while individual annual risk would be an individual's 

likelihood of being hit by lightning in any given year. Collective risk on a per 

mission basis is analogous to an estimate of the average number of people injured by 

4-1
an earthquake, while individual risk would be the likelihood of an individual in a 

given location being injured by the earthquake. Collective risk is often expressed in 

terms of expected values; the average (mean) consequences that can occur as a result 

of an event if the event were to be repeated many times. 

Mean risk estimates do not convey important information about the uncertainties 

associated with limited accident experience, incomplete knowledge of accident 

phenomenology, an inherent randomness in certain accident phenomena. Therefore, 

sensitivity studies should be performed to determine those uncertainties most 

important to the risk estimates. The results of sensitivity studies should show, for 

example, the range of variation together with the underlying assumptions that 

dominate this variation. 

b. Risk Profile. A risk profile provides more information about the nature of the risks 

posed by an event than mean individual and collective risk values. A risk profile is a 

plot that shows the probability of exceeding various outcomes (e.g. numbers of 

deaths, number of casualties, or amount of monetary damages) resulting from a future 

event. Specifically, the abscissa of a casualty risk profile is the number of casualties 

(N) and the ordinate is the probability of N or more casualties. 

 Consider an example launch where the vehicle has a 5 percent chance of failure. 

Most of the failures do not result in any casualties; range safety action at an abort 

boundary or aerodynamic break up before reaching the abort boundaries causes the 

debris to impact in unpopulated regions. However, in this hypothetical example there 

are five (and only five) failure scenarios where casualties result. The probabilities 

and consequences for this example are shown in Table 4-1. The data for abscissa and 

ordinate of the risk profile are listed in the last two columns of Table 4-1. The data 

for the ordinate of the risk profile are the sum of all of the probabilities for scenarios 

that produce N or more casualties. 

 Figure 4-1 illustrates the risk profile for this simplified example launch. The EC

for this particular case is 62×10-6 and the probability of a casualty producing accident 

P(≥1) is 12.6×10-6. More information on this example is available in paragraph 4.3. 

 Unlike the single valued EC, risk profiles illustrate the combination of 

consequences contributing to collective risk. Thus, the decision-maker can quickly 

see whether the risk is from a very rare large consequence outcome or from more 

frequent, smaller consequence outcomes. This standard uses risk profiles to define 

limits on catastrophic risks. Paragraph 4.3 shows how a risk profile or a simplified 

approach may be used to evaluate compliance with the catastrophic risk criteria 

presented in RCC 321-07, Chapter 3. 

4-2
TABLE 4-1. EXAMPLE RISK PROFILE DATA 

Scenario Index 

(i) 

Scenario 

Probability 

Number of 

Casualties 

(N) for 

Scenario i 

Total 

Probability of N 

or More 

Casualties 

1 0.0499874 0 

2 0.0000100 1 0.0000126 

3 0.0000010 8 0.0000026 

4 0.0000010 24 0.0000016 

5 0.0000005 32 0.0000006 

6 0.0000001 40 0.0000001 

Total = 0.05 

1.E-07

1.E-06

1.E-05

1.E-04

1 10

N - Number of Casualties

P[>=N]

100

Figure 4-1. Risk profile from example problem. 

4-3
One of the conveniences of using a risk profile (i.e. a discrete representation of the more 

common F-N curve) is that the area under a discrete risk profile equals the collective 

risk.2

 The following equations prove this point. 

( ) () ( ) +=≥ + pppP ( )+...3211 (Eqn 4-1) 

P( ) () 2 =≥ + pp ( )+...32 

P( ) 3 =≥ p( )+...3 · 

· 

· 

( ) () ( ) ( ) ( max

max max

1

1 2 2 3 3 ...

N

k

P k p p p N pN =

∑ ≥ = + + ++ )

)

 

() ( ∑∑= =

×=≥

max

1

max

1

N

k

N

k

kpkkP

 

 The right side of this equation is recognizable as the classical definition of 

expected casualties, EC: 

∑ ( ) =

×=

max

1

N

k

C kpkE (Eqn 4-2) 

 The EC for this particular case is 62×10-6 and the probability of a casualty 

producing accident P(≥ 1) is 12.6×10-6. More information on this example is 

available in paragraph 4.3. 

4.2 Guidelines for Application of the Criteria 

4.2.1 Risk Accrual. 

a. Total Risk. The individual and collective risk criteria prescribed in RCC 321-07, 

Chapter 3, use the total risks, which account for all hazards to all people, including 

those in all transportation systems, throughout the flight portion of the entire mission. 

Subsequent paragraphs provide guidelines for circumstances where separate risk 

budgets may be justified for distinct phases of flight, or if multiple vehicles are 

involved. Unless those special circumstances exist, each criterion should be 

compared to the total risk estimate - the combined risk due to all hazards throughout 

the mission. Subsequent paragraphs also provide guidelines for implementation of 

probability of impact limits to define hazard areas for ships and aircraft. 

 

2

 Collins et al, “Measures and Techniques for Inserting Catastrophe Aversion Into the Explosives Safety Risk 

Management Process,” 32nd Explosives Safety Seminar in Philadelphia, PA – August 22-24, 2006. 

4-4
b. Accumulated and Aggregated Risk. This standard uses the terms “accumulated risk” 

and “aggregated risk.” The accumulated risk refers to the risk from a single hazard 

throughout all phases of a mission. The aggregated risk refers to the accumulated 

risk due to all hazards associated with a mission, which includes, but is not limited to, 

the risk due to any debris impact, toxic release, and distant focusing of blast 

overpressure. 

When multiple hazards exist, the aggregated risks (individual and collective) can 

always be estimated as the sum of the accumulated risk from each hazard. More 

sophisticated methods to compute the aggregated risks may be used to eliminate 

double counting, which can occur if a mission simultaneously poses multiple hazards 

to certain exposed populations. If multiple hazards exist, the range Commander 

should be briefed on the risks due to each hazard in order to make a fully informed 

decision. 

Unless special circumstances exist (such as those described in this chapter), the 

total risk for the mission of an orbital expendable launch vehicle (ELV) should be the 

aggregated risk that is accumulated from liftoff through orbital insertion, including 

any planned debris releases.3

 Similarly, for the mission of a suborbital launch vehicle, 

the total risk should be the aggregated risk that is accumulated from liftoff through 

the impact of all pieces of the launch vehicle, including the payload. 

4.2.2 Consequence Metrics. Paragraph 3.1 of the Standard requires a range to “estimate the 

expected casualties associated with each activity that falls within the scope of this document,” 

and states that “additional measures of risk may be useful for range operations that are 

dominated by fatality to ensure fatality risks do not exceed acceptable limits.” In this context, 

“estimate” refers to a point estimate, while the overall process is called the risk assessment. 

Thus, the intent of this requirement is to ensure that an estimate of the expected casualties is 

documented for each range activity that intends to comply with this Standard. However, there 

may be certain circumstances where the range Commander should be informed of the estimated 

fatality risks as well. 

Computation of fatality risks (both individual and collective) in addition to expected 

casualties are performed at the discretion of the safety analyst or the range commander. 

However, fatality risks should be computed in addition to casualty risks for those missions 

where: (1) any one hazard (e.g. inert debris, toxic, Distant Focusing Overpressure (DFO), etc.) 

produces expected casualties for the general public greater than 50E-6 (50 percent of tolerable 

general population limit) AND; (2) the nature of the hazards posed suggests fatality risks may be 

of significance. For example, consider a hypothetical inert debris hazard with EC = 60E-6. If an 

examination of the debris distribution indicates that potentially fatal debris (e.g. KE > 58 ft-lbs) 

falls within defined containment or evacuated hazard areas, no further action is necessary; but if 

potentially fatal debris falls outside of the containment zone onto populated areas, then fatality 

risks should also be calculated. These should not be interpreted as limiting the discretion of the 

analyst or range Commander to compute fatality risks under other circumstances. 

 

3

 Planned debris releases includes intercept debris, jettisons stages, nozzle covers, fairings, inter-stage hardware, etc. 

4-5
4.2.3 Annual Risks and Per Mission Risks. Annual risk acceptability criteria serve an 

important role in the implementation of a robust risk management system. First, a range should 

periodically conduct a formal review to ensure that its activities in recent years and its mission 

risk acceptability policy are consistent with its annual risk acceptability criteria. This review is 

intended to ensure that the level of activity at a range, and the risks accepted on a per mission 

basis, do not equate to inordinate annual risks. Specifically, if this review finds that the sum of 

the mission risks accepted annually on average, for the past or the future, exceeds the annual risk 

criteria in this standard, then the range should revise its mission risk acceptability policy to 

ensure that the annual risk in the foreseeable future comply with the criteria presented here. 

This standard contains primary risk management criteria on a per mission basis for 

several reasons. First, the range Commander’s decision to authorize a flight is typically made in 

consideration of the safety and importance of a mission. Since the goal of risk management is to 

facilitate fully informed decisions, the risk acceptability criteria should be directly correlated to 

the risk acceptance decision. In some cases, it may be difficult to estimate the risk from a single 

mission since it may be difficult to delineate what constitutes a single mission. Therefore, this 

standard also endorses the use of annual risk management, in lieu of per mission risk 

management, in certain circumstances. Specifically, risk management using only an annual 

measure of collective risk is only justified for range operations that occur frequently and pose 

low risk on a per mission basis. In this context, “low risk” means about two orders of magnitude 

below the per mission criteria for collective and individual risks. For example, empirical data 

from a range’s past activities (where many “missions” of a similar nature have been safely 

executed) may be used to demonstrate that the annual risks comply with the limits prescribed in 

RCC 321-07, Chapter 3, and that the per “mission” risks comply with this guideline. In those 

cases, the risk analyst should evaluate the similarity of the empirical data by comparing the 

probability of any hazardous events, the magnitude of the potential hazards presented, and the 

exposure to any hazardous events. 

4.2.4 Defining “Per Mission.” This standard presents criteria for acceptable risks on a “per 

mission” basis. The RCC intends for the standard risk acceptability criteria to apply to the entire 

mission, unless special conditions exist, as defined in these guidelines, where separate risk 

budgets can be applied to distinct phases of flight. In general, orbital missions have three 

distinct phases of flight. These phases are flight from Earth to orbit, sustained flight on orbit for 

an indefinite period, and return flight from orbit to the Earth. There are precedents in federal law 

for establishing launch risk criteria that apply strictly to the risk from flight4

 for an ELV and 

RLV5

 mission. The RCC intends for the standard criteria to be implemented in a manner 

consistent with these precedents, except when past precedent is in direct conflict with these 

guidelines. For example, the FAA’s current regulation sets limits on the risk that “commences 

 

4

 In 1999,the FAA has promulgated limits on ELV “acceptable flight risk through orbital insertion.” (See 14 CFR 

415.35(a)) The FAA’s most recent regulation to govern expendable launches allows “the flight of a launch vehicle 

only if the risk associated with the total flight” satisfy certain criteria (See 14 CFR 417.107b in Docket No. FAA2000-7953).

5

 14 CFR 401.5 defines Reusable launch vehicle (RLV) as “a launch vehicle that is designed to return to Earth 

substantially intact and therefore may be launched more than one time or that contains vehicle stages that may be 

recovered by a launch operator for future use in the operation of a substantially similar launch vehicle.” The Space 

Shuttle Orbiter and SpaceShipOne are examples that meet the definition of an RLV.

4-6
upon initiation of the launch phase of flight ... and concludes upon landing on Earth of the 

RLV,”6

 but the RCC foresees conditions, specified in paragraph 4.2.4.g, where the standard risk 

limits may legitimately be applied to distinct phases of flight for an RLV. Therefore, guidelines 

to help discern the beginning and end of flight are important to establish appropriate risk budgets 

for complex range activities. The following paragraphs present guidelines to help define “per 

mission,” to understand the precedents for defining distinct phases of flight within a mission, and 

to establish appropriate risk budgets for complex range activities. 

a. ELV and Suborbital Vehicles. In some cases, the definition of the “mission,” for the 

current purpose, is relatively straightforward and well established in past precedents. 

For example, unless special circumstances exist (such as those described in paragraph 

4.2.4g and paragraph 4.2.5), the mission of a typical7 expendable space launch 

vehicle begins at liftoff and ends at orbital insertion. Therefore, the per mission risk 

criteria specified in RCC 321-07, Chapter 3, should be compared to the total risks 

posed from liftoff until orbital insertion, including the risks from all hazards due to all 

foreseeable malfunctions and from any planned debris releases, with the exceptions 

noted in paragraph 4.2.4g and paragraph 4.2.5. Similarly, for the mission of a 

suborbital launch vehicle, the per mission risk criteria specified in Chapter 3 of the 

Standard should be compared the total risk posed from liftoff until through the impact 

of all pieces of the launch vehicle, including the payload. These guidelines are 

consistent with current practices, the direction given to range Commanders in 

paragraph 4.2.9.8 of DODD 3200.11, and the current federal law governing 

commercial launches.8

 Even though the current practice9 and federal regulations for 

ELVs only set limits on the risk from liftoff to orbital insertion, and launch risks for 

people on Earth or in aircraft are generally insignificant beyond orbital insertion, 

there are legitimate safety concerns associated with launch beyond orbital insertion, 

as discussed in paragraph 4.2.4e. 

b. Beginning of Flight. The plain language definition of flight is “the motion of an 

object in or through a medium, especially through the Earth’s atmosphere or through 

space.”10 Thus, flight typically begins with the first motion of the object that poses 

risk. Therefore, the per mission risk criteria specified in RCC 321-07, Chapter 3, 

should be compared to the total risks posed by a mission starting with the first motion 

of the object, which is often liftoff. Paragraph 4.2.4c gives guidance on the treatment 

and discernment of pre-flight risks from a mission. 

 The use of carrier aircraft can complicate the definition of the beginning of flight 

for a launch vehicle. The FAA has a regulation that proposes ... 

 

6

 See 14 CFR 431.35a 

7

 A typical space launch vehicle is injected into a pre-determined and sustainable orbit for an indefinite period of 

time prior to reentry or disposal. 

8

 See 14 CFR 415.35(a) 

9

 For example, see Air Force AFSPCMAN 91-710 paragraph A4.3.5. 10 See Webster’s II New Riverside University Dictionary, 1984. 

4-7
“For flight analysis purposes, flight begins at a time in which a launch vehicle 

normally or inadvertently lifts off from a launch platform. Liftoff occurs with any 

motion of the launch vehicle with respect to the launch platform.” 11 

 Recent FAA guidelines clarify that, 

 

“the term ‘liftoff’ is often used in the context of motion with respect to a fixed asset, 

such as a launch pad or sea platform, but here liftoff also includes separation from a 

carrier aircraft. For other types of launch platforms, the determination of liftoff will 

be on a case-by-case basis and may need to consider the threat to the general public 

before separation of the launch vehicle, such as when a balloon launching craft is 

airborne.” 12

c. Beginning of the “Mission” Risks. In a sense, the “per mission” risk limits in this 

standard equate in practice to risk limits for each distinct flight phase of a mission, 

consistent with past precedents. Specifically, the RCC does not intend the standard 

criteria given in RCC 321-07, Chapter 3, to apply to pre-flight range activities. 

However, there are often significant risks posed prior to flight about which the range 

Commander should make informed decisions. The need for a range Commander to 

manage mission risks, including those posed by pre-flight hazards, means that the 

beginning of the “mission” or “launch” for the purposes of evaluating the overall 

mission safety should not always be liftoff for a vertically launched vehicle or 

separation from a carrier aircraft. Even so, the Risk Committee recommends that preflight safety decisions be based on other methods and criteria.13 

 As an example, the FAA determined that the initiation of the launch phase of 

flight for the SpaceShipOne (i.e. the starting point for an RLV risk estimate per 

14 CFR 431.35) was at ignition, subsequent to separation from the carrier aircraft 

(called the White Knight). For SpaceShipOne, the FAA found that pre-flight 

operations posed negligible risks due to its small size and selected propellants.14 The 

FAA determined that separation from the carrier aircraft (i.e. independent motion of 

the launch vehicle from the carrier aircraft) defined the point where risk from 

SpaceShipOne increased. However, the FAA had issued an experimental 

airworthiness certificate that covered the gliding portion of flight prior to ignition. 

Therefore, the FAA treated the SpaceShipOne as an aircraft unless it was operated as 

a suborbital rocket. 

 

11 See 14 CFR § 417.224(c) in Federal Aviation Administration, Department of Transportation, 14 CFR Parts 401, 

406, 413, 415, 417 Licensing and Safety Requirements for Launch; Final Rule, Federal Register, Vol 71, No. 165, 

August 25, 2006 

12 See FAA’s “Guide to Probability of Failure Analysis for New Expendable Launch Vehicles, Version 1.0” 

November 2005, HQ-032105, accessed at http://ast.faa.gov/files/pdf/Guide_Probability_Failure_110205.pdf 13 Pre-flight risks are typically subject to ground safety, system safety, and explosives safety criteria. 14 Because it uses a hybrid rocket motor and N2O oxidizer, there are comparatively small risks due to solid rocket 

motor handling and processing such as fire, explosion, debris, or unintended motor stage flight. Nor are there any 

liquid propellant hazards such as toxicity or vapor cloud explosions.

4-8
 FAA guidelines12 state that “preflight anomalies exist that should be accounted for 

by launch risk analyses even though liftoff did not occur.” For example, an anomaly 

that could occur without liftoff and pose a hazard “should be accounted for by risk 

analyses as an on-pad failure.” 15 The RCC does not intend that the risks from any 

such preflight anomalies be compared to the per mission risk criteria given in 

Chapter 3 of the Standard. 

d. Definition of Suborbital Vehicle and Trajectory. Suborbital flights of missiles and 

rockets are relatively well understood, however, the opening of space to commercial 

enterprises introduces “hybrid” vehicles. Hybrid vehicles are vehicles that have some 

of the characteristics of aircraft and some of the characteristics of launch vehicles. In 

2004, Congress found that opening space to the American people and to their private 

commercial enterprises was a worthy goal, and that the creation of a clear legal and 

regulatory regime for commercial human space flight would advance that goal. 

Those findings accompanied passage of the Commercial Space Launch Amendments 

Act (CSLAA) of 2004 (also known as H.R. 3752). Prior to passage of the CSLAA, 

the absence of definitions for the terms “suborbital rocket” and “suborbital trajectory” 

created confusion as to the appropriate regulatory regime for “hybrid” vehicles. The 

CSLAA provided definitions for “suborbital rocket” and “suborbital trajectory:” 

“Suborbital rocket means a rocket-propelled vehicle intended for flight on a 

suborbital trajectory whose thrust is greater than its lift for the majority of the 

powered portion of its flight. Suborbital trajectory means the intentional flight path 

of a launch vehicle, reentry vehicle, or any portion thereof, whose vacuum 

instantaneous impact point does not leave the surface of the Earth.” 

 These definitions should be used as guidelines to determine if a particular hybrid 

vehicle should be treated like aircraft or like a launch vehicle for the purposes of risk 

management. Congress recognized that hybrid vehicles with certain flight plans may 

be subject to dual regulation as both aircraft and launch vehicles. 

e. End of “Flight.” As discussed above for a typical ELV mission, the per mission risk 

criteria specified in RCC 321-07, Chapter 3, should be compared to the total risk 

posed from liftoff until orbital insertion. Orbital insertion takes place when a launch 

vehicle achieves orbital state (velocity and position) or when its drag corrected 

instantaneous impact point leaves the earth without intending to re-establish on the 

Earth prior to reentry, and thrust has been discontinued. Similarly, for the flight of a 

suborbital launch vehicle, the per mission risk criteria specified in RCC 321-07, 

Chapter 3, should be compared the total risk posed from liftoff until the impact of all 

pieces of the launch vehicle, including the payload. These guidelines are based on 

current practices, and are consistent with the direction given to range Commanders in 

 

15 Note, however, such on-pad failures without liftoff should not be included in the “flight” history of a subject 

vehicle for the purposes of estimating the probability of an in-flight failure.

4-9
paragraph 4.2.9.8 of DODD 3200.11, and consistent with current Federal law 

governing commercial launches.16 

f. Safety Concerns Beyond Orbital Insertion. The Risk Committee recognizes that 

missions that involve vehicles, objects, or debris at altitudes above 150 km may 

create legitimate post orbital insertion safety concerns, just as there may be important 

pre-flight risks. However, there are several reasons that only the criteria in paragraph 

3.5, which address the protection of manned spacecraft, apply to the management of 

risks posed beyond orbital insertion: 

(1) Using the definition of orbital insertion adopted here, the launch risks posed 

beyond orbital insertion are insignificant for people on Earth or in aircraft. 

(2) Establishment of separate flight risk acceptability criteria that set limits on the 

risk from liftoff to orbital insertion is consistent with the direction provided in 

DODD 3200.11 and current federal law for ELVs. 

(3) Ending the collective and individual risk assessment for flight of a typical ELV at 

orbital insertion also makes sense from a “flight termination” perspective, the 

exercise of positive control, and the hazards resulting from that process. 

 Nevertheless, the appropriate authorities must address legitimate safety 

concerns associated with launch beyond orbital insertion. Under the Convention 

on International Liability Caused by Space Objects (Liability Convention, entered 

into force September 1972), the U.S. Government accepts absolute liability for 

damage on the ground or to aircraft in flight, outside of the United States, when 

the United States is deemed a launching State under the terms of the Outer Space 

Treaties. Liability for damage caused elsewhere, such as on orbit damage, is also 

accepted by the Government as a launching State under the Liability Convention 

but only if the damage is the fault of persons for whom the launching State is 

responsible. Under Article VI of the Treaty on Principles Governing the 

Activities of States in the Exploration and Use of Outer Space, including the 

Moon and Other Celestial Bodies, the U.S. Government bears responsibility for 

national activities in outer space, including those carried on by non-governmental 

entities.17

 For these reasons, the range Commander should address legitimate safety 

concerns associated with launch beyond orbital insertion. For example, damage 

involving other orbiting assets (manned or active) may still occur subsequent to 

orbital insertion. Without taking appropriate measures, there is a potentially 

serious risk from the collision of a launch vehicle or its components with other 

objects in space. Dangerous orbital debris might also be generated unless 

appropriate measures are taken after orbital insertion. The DoD has a policy that 

“the creation of space debris shall be minimized.”18 Specifically, “the 

probability of collision with known objects during launch and orbital lifetime 

 

16 See 14 CFR 415.35a 

17 Outer Space Treaty, entered into force October 1967 

18 See DODI 3100.12, Sept. 14, 2000 paragraph 6.3 

4-10
shall be estimated and limited in the development of the design and mission 

profile for spacecraft or upper stages.”19 The following measures should be 

implemented to address the concerns beyond orbital insertion: 

(4) Prevention of unplanned physical contact between the vehicle and its 

components. 

(5) Minimization of debris generation from the conversion of energy sources into 

energy that fragments the vehicle or its components. Energy sources include 

chemical, pressure, and kinetic energy. 

(6) Development of reentry procedures to ensure safety of personnel is maintained as 

required by international space law and consistent with mission requirements. 

(7) Performance of conjunction assessments and development of collision avoidance 

procedures to avoid contact with other spacecraft from the launch vehicle, 

jettisoned components and payload through a sufficient number of revolutions 

after orbital insertion to account for the type of orbit injected into or operating in, 

the altitude of the manned spacecraft, and the time until the vehicle or component 

can be properly catalogued. 

(8) Proper disposal of orbiting objects. 

 DODD 3100.10 directs that all DoD activities to, in, through, or from space, or 

aimed above the horizon with the potential to inadvertently and adversely affect 

satellites or humans in space, shall be conducted in a safe and responsible manner 

that protects space systems, their mission effectiveness, and humans in space, 

consistent with national security requirements. DODD 3100.10 also directs that all 

such activities shall be coordinated with U.S. Space Command (or its successor).20 

Clearly, the responsibility for risk management during flight phases subsequent to 

payload separation typically lies with the spacecraft operator, except for planned 

reentry missions that terminate on a test range. In the latter case, reentry risk is the 

responsibility of the test range conducting the reentry operation and/or the lead range 

initiating the launch in accordance with direction in DODD 3200.11. For these final 

flight phases, the range Commander should coordinate with the spacecraft operator 

and Air Force Space Command (AFSC), 1st Space Control Squadron (SPCS), to 

ensure that safety issues beyond orbital insertion are addressed to the extent 

necessary to reduce the U.S. Government’s absolute liability under international 

treaties. 

 DODI 3100.12 sets limits on the risk from disposal of a spacecraft or an upper 

stage at the end of mission life. DODI 3100.12 specifically requires programs 

involving on orbit operations plan to dispose of a spacecraft or upper stage using 

atmospheric reentry, maneuvering to an appropriate storage orbit, or direct retrieval 

(See paragraph 6.4). Atmospheric reentry is only allowed if atmospheric drag will 

limit the lifetime to no longer than 25 years after completion of mission. If 

atmospheric reentry is used, “either the risk of injury from the total debris casualty 

 

19 See DODI 3100.12 paragraph 6.3.3 

20 DODI 3100.10, July 9, 1999, paragraph 4.11.7 states that these activities shall be coordinated with U.S. Space 

Command (succeeded by AF Space Command), as appropriate, for predictive avoidance or de-confliction with U.S., 

friendly, and other space operations. 

4-11
area for components and structural fragments surviving reentry shall not exceed 

1 in 10,000 (based upon an evenly distributed human population density across the 

Earth), or it shall be confined to a broad ocean or essentially unpopulated area.”21

 However, the criteria in Chapter 3 of the Standard that apply beyond orbital 

insertion are concerned with the protection of manned spacecraft from collision with 

those injected vehicles, objects, or debris. This can be accomplished by delaying 

initiation of the launch mission or defining avoidance volumes as described in 

paragraph 4.5. Paragraph 4.5 provides specific guidance for the range Commander to 

implement the spacecraft protection criteria presented in RCC 321-07, Chapter 3. 

g. End of Flight Involving Reentry. Using the plain language definition of “flight,” a 

flight involving reentry ends when the vehicle discontinues motion through “Earth’s 

atmosphere or through space.”22 As previously mentioned, the RCC intends for the 

standard risk acceptability criteria to apply to the entire flight of a mission, unless 

there are distinct phases of flight or other special conditions as defined in these 

guidelines. However, there often may be decision points between distinct phases of 

flight for an RLV that meet the conditions specified in paragraph 4.2.4h. 

 A current Federal regulation states that, for an orbital RLV flight, but not the 

mission, “ends after deployment of a payload for an RLV having payload deployment 

as a mission objective.” However the same regulation states that, “for other orbital 

RLVs, flight ends upon completion of the first sustained, steady-state orbit of an RLV 

at its intended location.” Statutory mandates have strongly influenced the FAA’s 

decision to make a “regulatory distinction” between the end of the flight of an ELV 

and RLV. Using the end of flight definition for an ELV23 was not considered 

appropriate for an RLV because doing so would suggest that launch continues 

through vehicle reentry and landing. This would have been illogical in light of 

direction from Congress that reentry of an RLV is subject to, and in fact requires, a 

separate reentry license by the FAA. Instead, the FAA proposed to use payload 

deployment as the point to end the flight of an RLV, and thus end the launch phase of 

an RLV mission. Therefore, the current FAA regulations hold that reentry24

commences upon initiation of operations necessary to assure reentry readiness and 

safety, that are uniquely associated with reentry and that are critical to ensuring 

public health and safety and the safety of property during reentry. Even so, the 

FAA’s current regulation limits the total risk from an RLV mission that “commences 

upon initiation of the launch phase of flight ... and concludes upon landing on Earth 

of the RLV.”25

 

21 See DODI 3100.12 paragraph 6.4.1 

22 See Webster’s II New Riverside University Dictionary, 1984. 

23 14 CFR 401.5: “For purposes of an ELV launch, flight ends after the licensee’s last exercise of control over its 

launch vehicle.” 

24 In plain language, reentry is defined as the event occurring when a spacecraft or other object comes back into the 

sensible atmosphere after going to higher altitudes, or the actions involved in this event. A regulatory definition is 

given in 14 CFR 401.5 and sited below. 

25 See 14 CFR 431.35a 

4-12
 For SpaceShipOne, the FAA determined that the end of flight (i.e. the ending 

point for an RLV risk estimate) corresponded to the point of the last motion of the 

launch vehicle. This was because the FAA determined that SpaceShipOne no longer 

posed any hazards after landing. The FAA found that ending the risk assessment for 

SpaceShipOne at any earlier point (such as an altitude of 60,000 feet when it resumed 

gliding flight) was not appropriate. At any earlier point, SpaceShipOne was still 

flying, and it had been exposed to “unique” space launch environments (i.e., 

accelerations, reentry loading, and thermal heating of vehicle). The fact that it may 

have resumed “gliding flight” does not necessarily mean that it has returned to a 

flight-proven (i.e. inherently safe) glider configuration. 

h. Separate Risk Budgets for Distinct Flight Phases. This paragraph provides guidelines 

for circumstances where the per mission risk criteria specified in RCC 321-07, 

Chapter 3, may be applied separately to distinct phases of flight. In all cases, the risk 

acceptance decision-maker (e.g. the range Commander) should be presented with the 

best estimate of the total risk that accounts for all phases of an operation. If 

applicable, the risk acceptance decision-maker should also be presented with the best 

estimate of the risk by phase of flight, such as launch to orbit, on orbit, and entry 

risks. 

 The per mission risk criteria specified in RCC 321-07, Chapter 3, should be 

compared to the total risk posed by an operation (i.e. the aggregated risk from all 

phases of an operation) unless there is a decision point between distinct phases where 

all of the following conditions are satisfied: 

(1) The vehicle has sufficient controllability to allow operational options that could 

reduce the risk posed by a subsequent phase (or phases) significantly. 

(2) The decisions as to whether or how to proceed with a subsequent phase is based 

on a risk assessment that is conducted or validated just prior to each phase of 

flight.26 

(3) The risk assessment for subsequent phases is made or validated using updated 

vehicle status and updated predictions of flight conditions. 

 Examples of how these three decision conditions should be evaluated are 

discussed below. If there is a decision point between distinct phases where these 

three conditions are satisfied, then the risk acceptance decision maker compare the 

per mission risk criteria specified in RCC 321-07, Chapter 3, independently for each 

phase of flight separated by such a decision point. As a secondary consideration, the 

risk acceptance decision-maker should examine whether the operational options 

would result in distinctly different population groups being hazarded. If the 

operational options would result in distinctly different population groups being 

hazarded, then there is additional justification to apply the per mission risk criteria 

 

26 A risk assessment completed earlier may be sufficient if conditions during subsequent flight remain consistent 

with the assumptions made for the earlier risk assessment. 

4-13
specified in RCC 321-07, Chapter 3, independently to the distinct phases of the 

operation that meet the three decision conditions. 

 The Space Shuttle (or more formally the Space Transportation System, STS) 

launch service to the International Space Station (ISS) is an illustrative example of 

how the three (and a half, if consideration is given to distinctly different population 

groups being hazarded) decision conditions should be used. A STS operation to 

service the ISS includes at least three phases: from liftoff until orbital insertion; 

on orbit; and return from orbit to landing. In general, four risk estimates (relevant to 

this discussion) are made for a STS operation: the risks to people in the launch area; 

the risks to people from Eurasian over-flight prior to orbital insertion; the risks from 

orbital debris during on orbit operations; and the risks to people from reentry.27 

 The three decision conditions indicate that the risks from an STS operation from 

liftoff through orbital insertion should comply with the per mission risk criteria 

specified in RCC 321-07, Chapter 3, because there is no decision point between 

liftoff and the commencement of Eurasian over-flight that would satisfy conditions at 

paragraph 4.2.4h(2) and paragraph 4.2.4h(3) above. Specifically, the decision to 

proceed with Eurasian over-flight (from a public safety perspective) is based on a risk 

assessment that is conducted or validated just prior to liftoff, not just prior to the 

beginning of Eurasian over-flight. Also, the risk assessment for Eurasian over-flight 

is not made nor validated using updated vehicle status and updated predictions of 

flight conditions (i.e. those conditions known to exist after liftoff and prior to the 

commencement of Eurasian over-flight). The STS has some capability to abort its 

mission prior to orbital insertion, and return either to the launch site or to alternative 

emergency landing sites. However, the decisions made during any such aborted STS 

are driven entirely by concerns for the safety of the crew, and are entirely 

independent of the risk criteria defined in RCC 321-07, Chapter 3, (for the public or 

otherwise). 

 Reentry of the STS Orbiter is a decision point that satisfies the three (and a half) 

decision conditions. The first condition is satisfied because the Orbiter can return 

from orbit, under normal conditions, to various landing sites.28 The Orbiter’s ability 

to approach each landing site using distinctly different trajectories also satisfies the 

first condition.29 The condition of the Orbiter prior to reentry is evaluated based on 

 

27 14 CFR 401.5 defines reenter; reentry as “to return or attempt to return, purposefully, a reentry vehicle and its 

payload, if any, from Earth orbit or from outer space to Earth. The term ‘‘reenter; reentry’’ includes activities 

conducted in Earth orbit or outer space to determine reentry readiness and that are critical to ensuring public health 

and safety and the safety of property during reentry flight. The term ‘‘reenter; reentry’’ also includes activities 

conducted on the ground after vehicle landing on Earth to ensure the reentry vehicle does not pose a threat to public 

health and safety or the safety of property.”

28 The STS Orbiter has KSC as its primary landing site, with Edwards Air Force Base and White Sands Missile 

Range as back-up. 

29 Not only can the Orbiter land using an ascending of descending node (approaching the landing site generally from 

the South or North), but the Orbiter’s cross range capability also facilitates the choice to land with distinctly 

different trajectories. 

4-14
post orbital insertion conditions, such as on orbit inspections.30 The second and third 

conditions are satisfied because NASA decides how to proceed with reentry 

(i.e., which landing site and trajectory to use) based on risk assessments, including 

public risk assessments, which are conducted just prior to reentry based on updated 

vehicle status and flight condition predictions. 

 The proposed launch of the Kistler K-1 is another illustrative example of how the 

three (and a half) decision conditions should be implemented. Kistler proposed to 

launch the K-1 from the Eastern Range. Since the K-1 had not flown previously, it is 

difficult to be as definitive, but the following discussion is based on the best available 

information. The K-1 is designed as a two-stage to orbit vehicle, where both stages 

return to the launch site. The first stage is referred to as the Launch Assist Platform 

(LAP), and the second stage as the Orbital Vehicle (OV). The planned mission 

profile would include three phases. These phases include the LAP returning to the 

launch site (approaching from the East), the OV over-flight of Eurasia or Africa, and 

the OV return from orbit to the launch site (approaching from the West). Therefore, 

the risk acceptance decision-maker should consider risk estimates from liftoff through 

separation of the LAP from the OV, LAP flight from separation through its landing, 

OV over-flight from separation through orbital insertion and OV reentry. At this 

time, it appears that the entire mission is pre-programmed such that no decisions are 

made during the operation. Therefore, the decision to initiate the K-1 flight equates 

to the decision to accept the risk from the entire K-1 mission from liftoff through the 

end of reentry for the OV, unless there are options that may be exercised that could 

change the risk after the decision to initiate flight. Therefore, the total risks from 

proposed K-1 mission should be compared to the per mission risk criteria specified in 

Chapter 3 of the Standard. 

4.2.5 Separate Risk Budgets for Multiple Launches. This paragraph provides guidelines for 

circumstances where the per mission risk criteria specified in RCC 321-07, Chapter 3, may be 

applied separately to multiple flights. In all cases, the risk acceptance decision-maker for the 

lead range (e.g. the range Commander) should be presented with the best estimate of the total 

risk that accounts for all aspects of an activity the range is involved with, including multiple 

flights from different locations. The risk acceptance decision-maker should also be presented 

with the best estimate of the risks due to each flight, broken down by phase of flight if 

applicable. In all cases, the mission rules should clearly define the conditions necessary for 

each launch to proceed in the most comprehensive manner possible. 

 

30 For example, NASA inspects the Orbiter to confirm that the Thermal Protection System (TPS) has not been 

compromised due to debris impacts during ascent, such as the foam impact that led to the Columbia accident. 

4-15
 The per mission risk criteria specified in RCC 321-07, Chapter 3, should be compared to 

the total risk posed by an operation (i.e. the aggregated risk from all flight phases of an 

operation) unless there is a decision point between each flight where the following separate flight 

phase test is satisfied: 

a. The initiation of each flight has sufficient controllability to allow operational options 

that could reduce the risk posed by a flight significantly, AND 

b. The decisions as to whether or how to initiate a subsequent flight is based on a risk 

assessment that is conducted or validated just prior to each flight, AND 

c. The risk assessment for each subsequent flight is made or validated using updated 

vehicle status and updated predictions of flight conditions, AND 

d. The decision to initiate any subsequent flight is made with the knowledge that there is 

no current risk from the previous flight(s), OR 

e. The probability of failure, and other critical input data, for the risk estimate of the 

subsequent flight accounts for the failure of the previous flight(s). 

Note that the separate flight phase test is passed if the first four conditions are passed, or 

if the first three and the fifth condition are passed: not all five conditions need to be satisfied. 

 

The Short Term Interval Launch (STIL) operations conducted from Vandenberg AFB 

illustrate how the separate flight phase test should be evaluated. The STIL range activity 

involves two Minuteman III vehicles launched within about two hours of each other. Each 

vehicle is launched from a separate facility on the northern part of VAFB, and is targeted for the 

same general area. Complete risk analyses are done for both vehicles prior to the first launch 

using the latest vehicle status and predicted flight conditions. The risk estimates for the second 

launch are updated after the first launch using the latest vehicle status and predicted flight 

conditions. The “per mission” risk criteria specified in RCC 321-07, Chapter 3, should be 

compared to the total risk posed by each STIL launch because four of the above five decision 

conditions are satisfied. The first and second launches are independently initiated: the second 

launch could be held if the first launch fails. Holding the second launch is an operational option 

that could reduce the risk posed by a flight significantly. Therefore, the first condition is met. 

The decision to initiate the second flight is based on a risk assessment that is conducted or 

validated just prior to each flight, so the second condition is met. The risk assessment for the 

second flight is made or validated using updated vehicle status and updated predictions of flight 

conditions, so the third condition is met. The decision to initiate the second flight is made with 

the knowledge that there is no current risk from the previous flight, so the fourth condition is 

met. If the first launch was a failure, the risk assessment for the second flight would account for 

failure of the first (in terms of probability of failure, etc.), so the fifth condition is also met. As a 

secondary consideration, if the subsequent launch would result in distinctly different population 

groups being hazarded, then there is additional justification to apply the per mission risk criteria 

specified in RCC 321-07, Chapter 3, independently to the subsequent launch. 

WSMR does “ripple fire” tests where two missiles are in thrust controlled flight at the 

same time, under a single risk budget. However, if thrust and substantial control are complete 

for a flight (such that the instantaneous impact point (IIP) cannot change significantly), any 

subsequent missile launch gets a separate risk budget because the outcome of the first launch is 

4-16
known from a safety perspective. These “shoot look shoot” and “ripple fire” approaches to risk 

management are consistent with these guidelines. 

A typical “salvo” mission where two vehicles are launched from the same range nearly 

simultaneously would not satisfy the separate flight phase test. A typical salvo mission does not 

allow separate decisions between launches that would reduce the total risk from the mission. 

Also, risks cannot be re-evaluated using updated conditions between launches for a typical salvo 

mission. Therefore, the total risk from all launches involved in a typical salvo mission should be 

compared to the per mission criteria specified in RCC 321-07, Chapter 3. 

4.3 Catastrophic Risk Evaluation 

 This standard recommends catastrophic risk aversion to protect against incidents 

involving multiple casualties, for example loss of a bus, ship, or aircraft. Catastrophic risk 

assessments are especially useful for pre-flight analyses intended to evaluate and mitigate 

potentially catastrophic outcomes. RCC 321-07, Chapter 3, establishes provisional and advisory 

catastrophic risk limits for the general public defined by the following formula. 

(Eqn 4-3) 1.5 -4 ≤× 10NP

where 

P is the cumulative probability of all events capable of causing N or more 

casualties. 

N is number of casualties31 based on the occupant load as defined in 

Table 3-1 of the Standard. 

10-4 is the maximum acceptable EC as defined in paragraph 3.2.1.2 of the 

Standard. 

Consider again the hypothetical example presented in paragraph 4.1.2b. Figure 4-2

compares the risk profile computed for this example and the catastrophic risk criteria established 

in this standard for the general public. The fact that the example launch risk profile has points 

above the acceptable risk profile (the straight line) indicates that this example launch presents an 

excessive catastrophic risk. 

 

31 OSHA promulgated a formal definition of catastrophe in 29 CFR 1960.2: “An accident resulting in five or more 

agency and/or non-agency people being hospitalized for inpatient care.” Santa Barbara County, CA uses a 

minimum number of 10 people to define a catastrophe. 

4-17
1.E-07

1.E-06

1.E-05

1.E-04

1 10

N - Number of Casualties

P[>=N]

100

Figure 4-2. Example risk profile compared with the general public catastrophic 

risk criteria. 

Due to the limited number of scenarios that can produce casualties in this example, 

computation of the risk profile is straightforward. However, computing the risk profile for actual 

flights often requires a considerable effort. Therefore, the Risk Committee devised a simplified 

and conservative method to screen for excessive catastrophic risk for transportation systems 

only, which are typically the only significant sources of potentially excessive catastrophic risks. 

Basically, the catastrophic risk screening method entails replacing the number of casualties 

contributed by the occupant load of each transportation system from each failure scenario, N, 

everywhere in an otherwise standard EC computation with N1.5. Specifically, the catastrophic 

risk averse pseudo-EC for transportation systems may be computed using a standard EC

computation but replacing the number of casualties contributed by each transportation system 

from each failure scenario, N, which equals the occupancy load for a transportation system as 

given in Table 3-1 of the Standard, with N 1.5. If the resulting catastrophic risk averse pseudo-EC

is less than 1×10-4 for the general public, then the catastrophic risk is generally acceptable.32 If 

the catastrophic risk averse pseudo-EC is greater than 1×10-4 for the general public, then a risk 

profile should be computed to determine if the catastrophic risk complies with the standard 

criteria. 

 

32 There are exceptions, involving cases where a scenario threatens multiple transportation systems (such as two 

aircraft), where the pseudo-EC is not a conservative indicator of the catastrophe potential. 

4-18
In general, a risk profile can be computed based on a complete set of credible and 

mutually exclusive scenarios, where each scenario has a finite probability and a consequence in 

terms of casualties. A formal definition of “scenario” is provided in Chapter 7 of this 

Supplement. Based on a complete set of scenarios, a histogram can be generated where the 

abscissa is the number of casualties (N) and the ordinate is the probability of N casualties. The 

risk profile is a complementary cumulative probability distribution diagram that can be 

computed based on this histogram, which gives the total probability of at least N casualties for 

each value of N. The ordinate of the resulting risk profile is the probability of N or more 

casualties. 

Even without computation of a complete risk profile, the catastrophe aversion criteria 

may be used to identify individual scenarios or failure modes that present elevated catastrophe 

potential and practical mitigations. For example, the analyst could show that a malfunction turn 

during a particular period of flight combined with the absence of a flight termination system on a 

vehicle, or the presence of a large concentration of spectators in a particular location, 

corresponds to a point above the solid line shown in Figure 4-2. Any single scenario that 

corresponds to a point above the solid line shown in Figure 4-2 conclusively demonstrates that 

the launch exceeds the recommended catastrophe aversion criteria. 

4.4 Hazard Areas for Ships and Aircraft 

 This paragraph provides guidelines for proper implementation of the requirements 

regarding ship and aircraft hazard regions: 

a. For planned debris releases. 

b. In response to a mishap. 

c. Based on probability of impact limits, and 

d. That demonstrate compliance with the individual, collective, and catastrophic risk 

limits. 

4.4.1 Planned Debris Impacts. This paragraph provides guidance to facilitate proper 

implementation of the requirement given in paragraph 3.3.3 of the Standard: 

“The range must confirm that Notices to Airmen are issued that encompass the volume 

and duration necessary to protect from each planned debris release capable of causing 

an aircraft accident.” 

Planned debris releases include any solid object planned to fall uncontrolled through the 

navigable airspace as the result of a range activity, such as intercept debris, jettisoned stages, 

nozzle covers, fairings, and inter-stage hardware. In order to satisfy the requirement in 

paragraph 3.3.3 of the 321-07 Standard , a range must confirm that Notices to Airmen 

(NOTAMs) are issued for each area hazarded by a planned debris release capable of causing an 

4-19
aircraft accident. To determine if a planned debris release is “capable of causing an aircraft 

accident,” a range should: 

a. Use the aircraft vulnerability models for commercial aircraft or hazard threshold for 

other aircraft presented in Chapter 6 of this Supplement, or 

b. Use other valid33 methods to evaluate debris impacts capable of causing an “aircraft 

accident” as defined in 49 CFR 830.2. 

To determine the “volume and duration necessary to protect from each planned debris 

release” a range should: 

c. Define a finite region(s) and demonstrate compliance with paragraph 3.3.1.1 of the 

Standard for non-mission aircraft and 3.3.2.1 of the Standard for mission aircraft, or 

d. If the area is under active surveillance and air traffic control, and there is no region 

that exceeds the probability of impact levels specified in 3.3.1.1 for non-mission 

aircraft and 3.3.2.1 for mission aircraft, then the planned impact hazard volume and 

duration should encompass the two sigma impact dispersion area34 from the ground 

level up to an altitude of 60,000 feet.35

e. If the area is not under active surveillance and air traffic control, and there is no 

region that exceeds the probability of impact levels specified in 3.3.1.1 for nonmission aircraft and 3.3.2.1 for mission aircraft, then the planned impact hazard 

volume and duration should encompass the three sigma impact dispersion area36 from 

the ground level up to an altitude of 60,000 feet. 

In order to satisfy the requirement in paragraph 3.4.3 of the 321-07 Standard, a range 

must confirm that Notices To Mariners (NOTMARs) “are issued that encompass the area and 

duration necessary to protect from each planned debris impact capable of causing a ship 

accident.” To determine if a planned debris release is “capable of causing a ship accident,” a 

range should: 

f. Use the ship hazard threshold presented in Chapter 6 of this Supplement, or 

g. Use other valid methods to evaluate debris impacts capable of causing a “ship 

accident.”37 

This standard refers to a planned debris release as “capable of causing an ship accident,” 

which is a more precise term compared to those used for debris generated by unplanned events, 

because planned debris characteristics are often relatively well known. 

 

33 i.e. methods that comply with the guidelines specified in this Supplement, which may include aircraft specific 

models that account for the known trajectories of aircraft 

34 i.e. 95 percent confidence of containment of the planned debris impacts capable of causing an aircraft accident 35 60,000 feet, used here, is typically the maximum altitude under active control by the FAA. 36 i.e. 99.7 percent confidence of containment of the planned debris impacts capable of causing an aircraft accident 37 Based on safety concerns and the definition in 33 CFR 173-4, “ship accident” is defined here as any event that 

results in loss of life, personal injury which requires medical treatment beyond first aid, or complete loss of the 

vessel. 

4-20
To determine the “area and duration necessary to protect from each planned debris 

release” a range should consider: 

h. Defining a finite region(s) and demonstrate compliance with paragraph 3.4.1.1 of the 

Standard for non-mission ships and 3.4.2.1 for mission ships, or 

i. If there is no region that exceeds the probability of impact levels specified in 

paragraph 3.3.1.1 for non-mission aircraft and paragraph 3.3.2.1 for mission aircraft, 

then the planned impact hazard area and duration should encompass the three sigma 

impact dispersion area.38

4.4.2 Mishap Response Hazard Areas for Aircraft. This section provides guidance to facilitate 

proper implementation of the standard requirements given in paragraph 3.3.4 of RCC 321-07, 

which states: 

“The range must coordinate with the FAA to ensure timely notification of any expected 

air traffic hazard associated with range activities. In the event of a mishap, the range 

must promptly inform the FAA of the volume and duration of airspace where an aircraft 

hazard is predicted.” 

a. Pre-flight Analyses, Timely Notification, and FAA Coordination. Pre-flight analyses 

and coordination with the FAA should be performed “to ensure timely notification of 

any expected air traffic hazard associated with range activities.” To demonstrate 

compliance with this requirement, a range should (at a minimum): 

(1) Identify the volume and duration of airspace necessary to protect from each 

planned debris release capable of causing an aircraft accident as described in 

paragraph 4.4.1. 

(2) Identify all regions of airspace where debris that poses an aircraft hazard could be 

predicted in the event of a mishap.39

(3) Develop and implement a standard procedure, in coordination with the FAA, to 

ensure timely notification of any air traffic hazards that could occur from range 

activities. 

 Current practice at the Eastern Range (ER) provides an example of how a range 

can “coordinate with the FAA to ensure timely notification of any expected air traffic 

hazard associated with range activities.” The ER protects non-essential and mission 

essential aircraft from the hazards associated with expendable launch vehicle debris 

using a combination of exclusionary and risk analysis methods. To protect aircraft 

from potential launch vehicle hazards, the 45th Space Wing develops three types of 

hazard areas for aircraft. 

 

38 i.e. 99.7 percent confidence of containment of the planned debris impacts capable of causing an boat accident 39 Debris that poses an aircraft hazard should be defined by the range in coordination with the FAA depending on 

the type of aircraft in the vicinity, the debris characteristics, etc. The intention here is to provide more protection 

than the “debris capable of causing an accident” as a means of compensating for the larger uncertainties inherent in 

an unplanned event. Adding a substantial buffer to any calculated hazard area is recommended. 

4-21
 For the launch area, the 45th Space Wing defines two types of airspace. First, the 

range operates multiple FAA assigned special use airspaces (SUAs). The range has 

been assigned SUAs in the form of three Restricted Areas and two Warning Areas. 

When the range requests through the 45 Range Squadron (RANS) that these areas be 

considered “hot,” control of the airspace is transferred to the range and a NOTAM is 

published to that effect. Because the SUAs encompass more airspace than is needed 

to protect aircraft from the potential effects of a launch vehicle, the range does not 

necessarily hold a launch if an aircraft is within an SUA. 

 Within the SUAs, the range calculates the potential three-sigma dispersion (based 

on a conservative estimate of potential wind effects) from a launch vehicle 

destructing on the nominal trajectory for every point in time where the vehicle’s 

dispersion is wholly or partially contained within the vicinity of the launch site. The 

potential three-sigma dispersion is based on explosive forces acting only 

perpendicularly to the nominal trajectory, three-sigma monthly winds acting only 

perpendicularly to the nominal trajectory, and vehicle debris divided into nine classes 

with the smallest element considered having a ballistic coefficient of three. This 

calculated dispersion footprint at sea level is extended to infinity and is defined as the 

“Aircraft Corridor.” Due to logistical limitations for surveillance, the “Aircraft 

Corridor” extends downrange to the outer limit of the “hot” SUAs. A launch will be 

held if an aircraft either is observed or is calculated to be in the “Aircraft Corridor” at 

the time of launch. Therefore, the “Aircraft Corridor” is an absolute exclusion area 

for non-mission essential aircraft. 

 The vicinity of the ER launch site depends on vehicle performance and the 

limitations of the range’s surveillance assets. The vicinity of the ER launch site 

bounds the first group of scheduled impacting vehicle components if they impact 

within the range surveillance assets’ effective range of between 70 and 100 nautical 

miles from the launch point. While the entire vicinity of the ER launch site does not 

have to be evacuated of aircraft, the entire vicinity of the ER launch site is under 

surveillance up through the launch. 

 Although there is no formal definition, impact locations more than 100nm 

downrange have been treated as “downrange impact locations.” For downrange 

impact locations where components or debris from a staging action impact the earth, 

the 45th Space Wing issues a NOTAM for each impact location in accordance with 

International Civil Aviation Organization (ICAO) procedures through the 45 RANS 

Office. The NOTAM area is requested to enclose both the three-sigma dispersion of 

the impacting components and a five nautical mile “buffer” added to the three-sigma 

dispersion envelope in the downrange, up-range, and cross-range directions. The 

range does not typically survey downrange impact locations, unless mission related 

resources are available for other reasons. 

 The mission essential airborne assets that survey the launch area are protected to 

the one in one million probability of impact level. The 45th Space Wing calculates 

the probability of impact for mission essential aircraft with a reasonable level of 

4-22
confidence because the vulnerability area and the asset locations are known. While 

every effort is made to station a support aircraft outside the mission’s Impact Limit 

Lines (ILLs), if the aircraft must be within the ILLs, a worst-case scenario is analyzed 

to assess the asset’s safety. As a worst case, the analysis assumes the rocket travels 

directly at the aircraft’s support location. An aircraft’s support location within the 

ILLs may be acceptable if the aircraft is capable of reaching safety under such a 

worst-case scenario. 

 In other situations, it may be appropriate to account for the density of air traffic 

and demonstrate compliance with the long term acceptable risk guidelines. For 

example, in areas where only a malfunction can threaten aircraft, a reasonable level of 

aircraft safety might be provided using statistical air traffic density data and 

compliance with the long term acceptable risk guidelines described in 

paragraph 4.4.2a. 

 

b. Defining Mishap Hazard Areas. Paragraph 3.3.4 of the Standard states that, “in the 

event of a mishap, the range must promptly inform the FAA of the volume and 

duration of airspace where an aircraft hazard is predicted.” In the event of a space 

launch malfunction, there may be enough time to activate a real-time system that 

would effectively mitigate the risk to aircraft by redirecting aircraft near the expected 

space vehicle debris hazard area before debris reaches aircraft altitudes.40 In all 

cases, a range should implement the fastest available method to inform the FAA of air 

traffic hazards in the event of a range mishap. The RCC is aware of several 

acceptable methods to demonstrate overall compliance with this requirement as 

described below. 

 A range should select the most appropriate method to define “the volume and 

duration of airspace where an aircraft hazard is predicted” based on the specific 

situation and the discretion of the range Commander. In all cases, a range 

Commander should implement all measures necessary to protect aircraft from 

unreasonable risks generated by a range mishap. This paragraph provides guidelines 

to help a range define: 

(1) “where an aircraft hazard is predicted” in the event of a mishap. 

(2) Reasonable risks generated by a range mishap. 

 

40 Larson E. W .F., et al., Determination of Risk to Aircraft from Space Vehicle Debris, Proceedings of the First IAASS 

Symposium, Nice, France, October 2005.

4-23
 An approach to comply with paragraph 3.3.4 of the Standard is to implement 

aircraft hazard volumes based on pre-flight analyses. For example, a range may: 

(3) Compute “three-sigma impact dispersion” areas on the ground that 

provide 99.7 percent confidence of containment of the debris impacts that could 

be hazardous to aircraft for predefined failure times or state vectors. 

(4) Compute the maximum time for any debris that could be hazardous to aircraft to 

reach the ground for the same predefined failure times or state vectors. 

(5) Define an aircraft hazard volume to encompass the three-sigma impact dispersion 

area for each predefined failure time or state vector, inclusive of the airspace from 

ground level to an altitude of 60,000 ft. 

(6) Inform the FAA of the appropriate aircraft hazard volume and duration based on 

the mishap failure time or the best estimated state vector for the mishap. 

 Another approach to comply with paragraph 3.3.4 of the Standard is to implement 

aircraft hazard volumes that encompass all regions of airspace where commercial 

aircraft would be exposed to debris capable of causing an aircraft accident with a 

probability of impact exceeding 1E-7 for a single aircraft. This probability of impact 

calculation should account for the fact that the mishap has occurred, and assume that 

aircraft are present at the hazard volume boundary. Protection against potential 

catastrophes based on the provisional criteria should also be provided in the event of 

a mishap. 

4.4.3 Hazard Areas for Ships and Aircraft Using Probability of Impact Limits. Three risk 

metrics have been defined to protect occupants of ships and aircraft; they are individual risk, 

collective risk, and catastrophic risk. Meeting the acceptability criteria requires a combination of 

hazard containment and evaluation of residual risk. The approach outlined in this paragraph is to 

first develop exclusion criteria (hazard areas) to protect against catastrophic risks and assure that 

individual risks are acceptable and then to assess the residual total collective risks to all people 

(unsheltered, land-based sheltered, and people in ships and aircraft) to assure compliance with 

the collective risk standard. Figure 4-3 provides an overview of a process for developing hazard 

areas. Figure 4-4 illustrates steps for evaluating the residual risk after posting warnings for the 

hazard area. 

The Standard provides requirements to define ship and aircraft hazard areas. For 

example, paragraph 3.4.1.1 of the Standard requires that “Non-mission ships will be restricted 

from hazard areas where the probability of impact of debris capable of causing a casualty 

exceeds 10E-6 (1E-5) for non-mission ships.” The ship and aircraft hazard area requirements in 

the Standard can be satisfied using the vulnerability thresholds given in Chapter 6 of this 

Supplement. Specifically, paragraph 6.3.3 of this Supplement defines vulnerability models for 

commercial aircraft and a hazard threshold for other aircraft for debris potentially injurious to 

personnel and catastrophe producing debris. Paragraph 6.3.2 of this Supplement defines ship 

vulnerability thresholds for debris potentially hazardous to personnel. For example, the 

probability of impact requirement given in paragraph 3.4.1.1 of the Standard should be satisfied 

based on representative ship sizes and the probability of impact computed for all debris capable 

of producing a casualty to an unsheltered person. In addition, paragraph 3.4.1.1 requires that 

“non-mission ships should also be restricted from hazard areas where the cumulative probability 

4-24
of impact of debris capable of causing a catastrophic accident exceeds 1E-6 for all non-mission 

ships.” Although no threshold is provided in this document for defining a catastrophic accident 

or for determining which debris is catastrophe-producing debris for ships per se, the analyst may 

choose to account for any reasonably expected41 scenario that results in five or more 42 casualties 

as a catastrophic accident. Furthermore, in the absence of valid ship vulnerability modeling, the 

analyst may choose to account for debris capable of causing a catastrophic accident for ships 

based on any debris capable of deck penetration as described in Chapter 4 and Chapter 6 this 

Supplement. More specifically, an acceptable approach to satisfy the advisory catastrophic risk 

criteria using ship hazard areas would be to assume that catastrophe-producing debris includes 

all debris capable of penetrating the deck or other protective structure for a ship, i.e. debris that 

exceeds the thresholds given for ship in paragraph 6.3.2 of this Supplement. For example, if a 

ship with 100 occupants is present at the boundary of a hazard area, then any such ship should be 

restricted from areas where the probability of impact exceeds 1E-7 from all debris that exceeds 

the thresholds given in paragraph 6.3.2. In all cases, the final hazard areas should be the union 

of the areas required to comply with the individual risk, collective risk, and catastrophic risk 

criteria. 

As shown in Figure 4-3, a practical implementation of defining the hazard areas involves 

the following steps: 

a. Determining the debris that has the potential for producing serious injuries to 

occupants of the vehicle. 

b. Determining impact probability contours at the allowable individual casualty risk. 

c. Determining the debris that has the potential for producing a catastrophic accident. 

d. Determining impact probability contours at the allowable catastrophic risk 

probability. 

e. Computing a preliminary hazard area as the envelope of the contours developed in 

step b and step d. 

The preliminary hazard area should then be evaluated to assess the feasibility of 

controlling access to the area, as well as the feasibility and need to monitor traffic in the area. 

This latter evaluation will consider factors such as traffic density and distance of the preliminary 

hazard area to land. Surveillance regions are typically functions of need (traffic density in a 

hazard region) and technical feasibility of monitoring. Thus, surveillance may be limited to the 

vicinity of the launch site and selected downrange regions where assets are already deployed. 

Based on these feasibility evaluations, the hazard area boundaries may be adjusted to produce a 

final hazard area. 

 

41 In 14 CFR 440.3, the FAA defines “reasonably expected” for the purpose of setting insurance requirements: 

“having a probability of occurrence on the order of no less than one in ten million” for third party losses, and 

“having a probability of occurrence on the order of no less than one in one hundred thousand” for Government 

property and personnel. Since these probabilities often have considerable uncertainty, the analyst should use 

threshold probability levels ten times below the FAA values. For example, account for any scenario where the 

chance of ten or more public casualties is above 1E-8. 

42 OSHA promulgated a formal definition of catastrophe in 29 CFR 1960.2: “An accident resulting in five or more 

agency and/or non-agency people being hospitalized for inpatient care.” Santa Barbara County, CA uses a 

minimum number of 10 people to define a catastrophe. 

4-25
Figure 4-3. Overview of process for determining PI based hazard areas. 

10,000 fragments 

Notional 

Counts 

5,000 fragments 

1,000 fragments 

Comprehensive 

Debris Catalog 

Filter 

Filter +

Debris Capable 

of Producing 

Casualty 

PI P*cas =

Debris Capable 

of Producing 

Catastrophic Accident 

PI Contours At Criterion for 

Casualty (Individual risk) 

PI Contours At Criterion for 

Catastrophic Risk 

PI = P*cat 

=

Figure 4-4 illustrates an example evaluation of the residual risk after posting warnings for 

the hazard area. Even though, the dots in Figure 4-4 suggest a uniform traffic density, real traffic 

data usually reveals established routes. Figure 4-4 is intended to emphasize that the analyst 

should assess the effect of the adopted hazard area, planned methods of notification, access 

control, and surveillance on the traffic density inside the hazard area. For example, the analyst 

may choose to reduce the traffic density in areas where warnings are issued. However, without 

surveillance confirmation, the analyst should not assume that all traffic heeds any warning. 

Therefore, collective risk should be assessed for the hazard area and the regions outside the 

hazard area, where feasible, and combined with other mission collective risks to assure that the 

planned mission complies with the standard risk criteria. These results should be part of the 

basis for Flight Plan Approval by the range. 

These results also become part of the basis for day of launch preparations and launchcommit decisions. Typically, a buffer is added to the hazard area(s) to develop NOTAMs and 

NOTMARs. These formal notices should be disseminated through the appropriate government 

channels to all potentially affected parties. On mission day, traffic in the surveillance area 

should be inventoried. As feasible and necessary, communications with fowlers in the restricted 

area should advise them the most expeditious way to move to lower hazard areas and depart the 

region. When traffic nearby the posted region is significant, the analyst should verify that the 

contribution of this traffic to total mission risk does not cause the collective risk to exceed 

tolerable limits published in this standard. When risk levels are excessive, the mission should be 

held until they can be reduced to acceptable levels. 

4-26
Statistical Traffic Density 

Statistical Traffic 

Density 

Modified for Notification 

Risk Analysis 

Figure 4-4. Evaluating residual risk remaining with the defined hazard area. 

4.4.4 Compliance with Individual, Collective, and Catastrophic Risk Limits. Proper 

implementation of the probability of impact limits for ship and aircraft hazard areas and use of 

the vulnerability thresholds and models in paragraph 6.3 of this Supplement, can be used to 

demonstrate compliance with the individual and catastrophic risk criteria established in Chapter 

3 of RCC 321-07. Paragraph 3.3.1a of the Standard requires that non-mission aircraft be 

“restricted43 from hazard volumes of airspace where the cumulative probability of impact of 

debris capable of causing a casualty on an aircraft exceeds 0.1E-6 (1E-7).” Paragraph 6.3.3 of 

this Supplement defines two types of aircraft vulnerability models (i.e. fragment characteristics): 

casualty producing, and catastrophic. Clearly, compliance with this probability of impact 

requirement based on all potential casualty and catastrophe producing debris demonstrates 

compliance with the individual risk limits established in paragraph 3.2.1.1 (i.e. probability of 

casualty below 1E-6 for a single mission, and 1E-7 probability of fatality if fatality risks are 

computed), regardless of the number of people in potentially threatened aircraft. Consider a 

commercial aircraft with a maximum occupancy of 400 people. To comply with the catastrophic 

risk criteria given in paragraph 3.6.3 of the Standard, hazard areas should be designed to limit 

the probability of impact with potentially casualty producing debris to 1E-7, and limit the 

probability of impact with potentially catastrophic debris to 1E-8. In such a case, the 

catastrophic risk averse pseudo-EC defined in paragraph 4.3 equals 8E-5, which is below 1E-4, 

 

43 In this context restricted from means that the range will (1) ensure that appropriate warnings/restrictions are 

issued through the FAA, and (2) not proceed with the hazardous activity if the range has knowledge that any aircraft 

hazard volume is violated. 

4-27
and thus complies with the catastrophic risk criteria. A similar analysis can demonstrate risk 

compliance for people in ships. 

To demonstrate compliance with the collective risk criteria established in 

paragraph 3.2.1.2 of RCC 321-07, the analysis must account for the collective risk to people in 

each type of vehicle. This requires estimates of the number of vehicles exposed, probabilities of 

impact to exposed vehicles, and the potential consequences of an impact to exposed vehicles. 

For planned impact areas, the analysis should assume at least one vehicle is present continuously 

at the boundary of each hazard area. If the available traffic data indicates that more than one 

aircraft may reasonably be expected to typically occupy a hazard area (i.e. empirical traffic data 

indicates more than a 10 percent chance that more than one vehicle would normally transit 

through the hazard area throughout the time period when the mission could pose a threat), then 

the analysis should assume that the maximum number of vehicles reasonably expected to 

typically occupy a hazard area are continuously at the boundary of each hazard area. Based on 

these exposure levels, conservative estimates of the collective risks for people in vehicles can be 

made using the probability of impact levels at the boundary of each hazard area. The total 

collective risk estimate should assume that each casualty-producing debris impact produces one 

casualty, and each catastrophic impact produces a number of casualties equal to the maximum 

occupancy of the vehicle not associated with the mission, and equal to the actual occupancy of 

any vehicle related to the mission. In areas where only a malfunction can threaten aircraft, a 

reasonable collective risk estimate can be based on statistical traffic density data. 

4.5 Spacecraft Protection 

4.5.1 Definition of Manned Spacecraft. The previous RCC 321-02 standard, as well as many 

NASA, DoD, and FAA regulations, have differentiated between spacecraft capable of being 

manned (mannable or inhabitable) and those that are actually manned. In some cases, distinct 

separation criteria were applied for the different category of spacecraft and it was left to the 

individual range to determine appropriate categories and criteria. Therefore to clarify the 

language, and the purpose and intent of the terminology adopted by the authors of the original 

standard, the Risk Committee has redefined manned spacecraft to include both occupied 

spacecraft and also those objects of importance that intend to be docked to and occupied. 

 The Risk Committee reasoned that if objects intended to be manned were compromised 

while en route to a manned orbiting laboratory or space station, then human life would also be 

compromised when the two objects docked and access was established, or if the vital cargo to 

sustain life was lost or rendered inaccessible to the manned station. They were consequently 

afforded the same level of protection. If the previously unmanned vehicle is not intended to be 

occupied again after separating from the manned spacecraft, then it would no longer be 

considered a manned object and afforded the same level of protection as an active satellite or 

debris depending on its subsequent value. An example of this is the Progress vehicle that should 

be considered manned while en route to or docked with the International Space Station (ISS), but 

considered only as an active satellite or debris after final separation since it will be disposed to 

burn up on reentry. Similarly, if a spacecraft is capable of sustaining life, but has been placed 

into orbit for demonstration or testing purposes but without means to dock and be boarded, then 

it should be categorized as an active satellite and protected to that level, if at all. 

4-28
4.5.2 Protection Criteria. Determining the collision probability associated with a conjunction 

assessment against manned objects is preferable when it can be computed but it requires 

considerable more effort on the part of the launch range to acquire the covariance data required 

of the launch vehicle and its jettisoned components during the various orbits that a mission will 

attain. When covariance data is not practical to develop or obtain, or the quality of it is 

questionable, and acceptable alternative would be to determine the maximum dispersion for each 

flight portion of the mission in the various orbits and apply that as maximum cap on the 

dispersion for that portion. This will still allow collision probability to be estimated but will 

provide results that are more conservative than when using covariance data but will likely not be 

as conservative as using miss distance volumes. The use of ellipsoidal (200 km in-tract x 50 km 

cross-tract and radial) or spherical (200 km) miss distance volumes is customary when collision 

probability cannot be computed. As a practical matter, spherical miss distance volumes should 

only be used with large launch windows or at the flight analyst’s discretion. 

4.5.3 Accounting for Spatial and Temporal Dispersions in CA and COLA. When performing 

conjunction assessments, collision probability should be encouraged and used whenever 

practicable since covariance or dispersion data is accounted for in the conjunction assessment 

and no further adjustments or screening are required in the collision avoidance process. 

However, when using an ellipsoidal or spherical screening volume to perform conjunction 

assessments, the spatial dispersions (in-track, cross-track, and radial) associated with the launch 

vehicle or its jettisoned components should be added to the appropriate dimension of the hard 

body volume attributed to the vehicle or component. The miss distance volume (ellipsoid or 

sphere) should be applied with respect to the manned object being protected and increased 

appropriately for known dispersions associated with the spacecraft. As an alternative, when 

either the launch vehicle or components are treated as a point mass in the conjunction 

assessment, the spatial dispersions should be added to the miss distance volume about the 

manned object. If a spherical miss distance volume is used, the largest spatial dispersion in any 

direction should be added to the 200 km separation distance. 

As part of the collision avoidance process, the launch wait period should be equivalently 

adjusted to account for arrival time dispersions associated with the launch vehicle or its 

jettisoned components. The analyst should also consider whether the manned spacecraft has 

maneuvered since the time its last ephemeris was established and determine the cumulative time 

based on the orbital period change per revolution and the number of revolutions prior to launch 

and account for this arrival time dispersion in the launch wait period. For example, the ISS 

operates in a near circular orbit with an average altitude of 407 km (350 km to 460 km)44and in 

an inclination of 51.6°. If the ISS were to perform a maneuver after the epoch time, the date and 

time at which the Keplerian element set defining the ephemeris of its orbit was established and 

valid, uncertainty in the arrival time would have been introduced into a subsequent conjunction 

assessment using that element set. Assuming the apogee and perigee of the station spread about 

its average altitude, i.e. 415 km to 400 km, the orbital period change (per revolution), ΔP, or 

arrival time uncertainty per revolution, can be calculated and is shown in Table 4-2, where ΔR, 

represents the expected incremental change in the orbital radius, or altitude, of the ISS after the 

 

44 "The International Space Station, A Guide for European Users", ESA BR-137, 1999 

4-29
maneuver. Thus a typical maneuver of the ISS resulting in an altitude change of 7 km would 

result in approximately 8.6 sec change in the orbital period and the analyst would multiply this 

value by the number of revolutions expected before liftoff of the launch vehicle to determine the 

temporal dispersion to add to the launch wait period. The values in Table 4-2 will not change 

appreciably for the range of operational altitudes of the ISS. 

TABLE 4-2. ORBITAL PERIOD CHANGE (PER REVOLUTION) OF THE ISS 

ΔR (km) 1 2 3 4 5 7 10 15 20 25 

ΔP (sec) 1.23 2.46 3.69 4.92 6.15 8.61 12.30 18.45 24.59 30.74

The individual range has the responsibility to incorporate the dispersions into the 

CA/COLA process, but the 1st Space Control Squadron (SPCS) should be involved in the 

process, when practicable, to improve the dispersion estimates. Thus the range would obtain and 

provide covariance data to the 1st SPCS for conjunction assessment and the estimated collision 

probability. As an alternative, and part of the collision avoidance process, the range could utilize 

a simplified model for estimating maximum collision probability as based on actual separation 

distance, conjunction geometry, and maximum or capped spatial and temporal dispersions. 

4.5.4 Vulnerability of Spacecraft. When debris is planned to be injected into orbit that affect 

manned spacecraft altitudes, the vulnerability levels and associated critical areas utilized in 

accompanying risk assessments should be determined from the operator of the manned asset. 

Vulnerability levels and critical areas were provided to the Missile Defense Agency (MDA) in 

2004 for surface vulnerability area and critical cross-sectional areas for the ISS. These area data 

were provided in two parts; the first for the Russian Modules (Zarya, Zvezda, etc.) that are 

vulnerable to smaller debris and comprise a smaller area, and the more robust U.S. modules with 

larger vulnerable areas. For hazardous debris from 3mm to 1 cm, the ISS vulnerable area 

provided to MDA was 125 m2

 with a critical cross sectional area of 30 m2. For hazardous debris 

greater than or equal to 1 cm the ISS vulnerable area specified was 725 m2

 and the critical cross 

sectional area is 180 m2

.

When vulnerability of a spacecraft is unknown, the Risk Committee maintains that the 

value stated in the previous versions of RCC 321 standard of 1mm should be used. This was 

based on the Eastern and Western Ranges’ understanding of the vulnerability of the Space 

Shuttle. This value has also been established in other USG regulatory language as the minimum 

debris size that most spacecraft and satellites are designed for protection. The analyst needs to 

consider the special case where astronauts are expected or known to be performing extravehicular activities (EVAs) outside of their spacecraft. In this case, options for consideration are 

planning missions or delay launch to preclude endangering the astronauts, allowing no planned 

debris to enter within the miss distance volume protecting the spacecraft, or as the only 

remaining option, coordinating with the manned spacecraft operator regarding spacesuit 

vulnerability. 

4-30
CHAPTER 5 

RISK CRITERIA RATIONALE 

As stated in the RCC 321 Standard, Chapter 2, paragraph 2.3 (Risk Management 

Process), the initial goal of range risk management should be to isolate the hazards from 

populated areas whenever practical. This goal is consistent with the primary policy that no 

hazardous condition is acceptable if mission objectives can be achieved with a safer approach, 

methodology, or position to minimize the hazards and conduct the mission as safely as 

reasonably possible. When hazards cannot be contained or minimized to an insignificant level, 

then more detailed assessments must be performed to determine if the remaining risk is 

acceptable. 

During the development of this standard, the Risk Committee sought criteria that would 

promote an improved ability to effectively manage risks (and thereby protect everyone), and 

accommodate a diverse mix of missions without compromising safety. This chapter presents the 

rationale behind each criterion (the information considered, and the connection between the 

available facts and the selection of each criteria). The purposes of this chapter are to: 

a. Establish that the criteria in Chapter 3 (of the RCC 321 Standard) are reasonable and 

rational. 

b. Provide insight into the criteria to facilitate proper implementation. 

c. Help the risk acceptance decision maker understand and balance the factors that 

affect mission acceptability: e.g., criticality of mission objectives, protection of life 

and property, the potential for high consequence mishaps, local political factors, and 

governing range or programmatic environmental requirements. 

This chapter is structured into the following paragraphs: 

Paragraph 5.1 – Rationale for Risk Metrics. 

Paragraph 5.2 – Criteria Rationale Overview. 

Paragraph 5.3 – Rational for Casualty Limits. 

Paragraph 5.4 – Rationale for Fatality Guideline Limits. 

Paragraph 5.5 – Rationale for Catastrophic Risk Criteria. 

Paragraph 5.6 – Rationale for Aircraft and Ship Risk Management Requirements. 

Paragraph 5.7 – Rationale for Spacecraft Protection Requirements. 

Paragraph 5.8 – Using Aviation as a Benchmark for Launch Risk. 

Paragraph 5.9 – References for Chapter 5. 

5.1 Rationale for Risk Metrics 

5.1.1 Aggregated Risk Criteria. This standard endorses risk criteria that limit the aggregated 

mission risk from range of activities (i.e. the total risks, which account for all hazards throughout 

flight). For example, RCC 321 Standard paragraph 3.2.1.2 states that the collective risk for the 

general public must not exceed 100E-6 (1E-4) expected casualties (EC) for any single mission. 

5-1
The Risk Committee considered the fact that current practice includes both setting limits 

on the risks posed by separate hazards45, 46 and limits on the aggregated risk posed by all 

hazards47 from launches. Careful consideration was given to the pros and cons of both 

approaches. This standard endorses the use of aggregated risk limits for the reasons given on 

subparagraphs a through d below. 

a. Although there have been valid reasons (Reference 5a) given for setting limits on the 

risks posed by separate hazards, acceptance of higher risk levels simply because there 

are multiple hazards present does not appear rational to the common man. For 

example, a risk acceptability criteria that limits the risk posed by separate hazards 

(e.g. one limit for the risk from toxic releases, another limit for debris, etc) 

theoretically allows a system that incorporates toxic materials to pose greater risks 

simply because toxics are present. 

b. Aggregated risk limits provide the maximum flexibility for management of risk from 

various hazards, although other sources of requirements may still impose limits on 

certain hazards (for example Immediately Dangerous to Life and Health, IDLH, for 

toxics as described in Chapter 8 of this Supplement). For example, a mission could 

be designed to eliminate the risk from certain hazards (such as toxic releases and 

Distant Focusing Overpressure (DFO) in order to comply with the aggregated risk 

limit 100E-6 expected casualties due to over-flight of a downrange land mass (such as 

Europe or Africa). However, a similar mission that included toxic and DFO hazards 

could pose virtually the same aggregated risk, but fail to meet limits set for the risks 

posed by separate hazards. Maximum flexibility is attributed to management of the 

total risk from a mission instead of setting separate limits for each hazard. The 

aggregated risk management approach treats a single hazard that presents a certain 

risk level the same as many hazards with the same total risk level. Aggregated risk 

management is the most flexible, logical, and consistent approach. 

c. Aggregated risk limits provide the maximum flexibility for management of risk to 

various exposed populations, especially those in various transportation modes. The 

probability of impact limits intended to constrain the risks posed to people on-board 

ships or aircraft are often convenient and efficient means to define hazard areas as 

discussed in Chapter 4 of this Supplement. However, setting limits on the aggregated 

risk to all exposed populations allows, for example, more sophisticated methods that 

 

45 AFSPCMAN 91-710 paragraph A4.3.5: “The risk associated with the total flight to all members of the general 

public, excluding persons in waterborne vessels and aircraft, shall not exceed an expected average number of 

0.00003 casualties (Ec < 30 x 10-6) from impacting inert and explosive debris, Ec < 30 x 10-6 for toxic release 

(exposure to rocket propellant effluent), and Ec < 30 x 10-6 for far field blast overpressure.” 46 14 CFR 415.35a for ELVs establishes 30E-6 expected casualties from debris hazards only as the level of 

acceptable flight risk through orbital insertion for commercial launches. The preamble clarified that 14 

CFR 415.35a was intended to limit “risk from debris, not from toxic releases or blast overpressure, which the 

federal launch ranges handle through other means.” (See Federal Register, Vol. 64, No. 76, April 21, 1999, page 

19605) 

47 In the preamble to 14 CFR 431.35 for RLVs, the FAA wrote that the “Ec must also account for casualties related 

to secondary explosions, hazardous material exposure such as toxic substances, and lateral debris movement 

following impact.” (See Federal Register, Vol. 65, No. 182, September 19, 2000, page 56624) 

5-2
provide acceptable risk levels with potentially fewer restrictions on ship or air traffic. 

For example, this standard now allows using part of the aggregated risk budget for 

ship or aircraft risks as an alternative to using relatively simple and conservative 

probability of impact limits to define ship or aircraft hazard areas. 

d. Aggregated risk limits quantify the threat from all hazards in the simplest and most 

logical manner because the total risk is expressed in a single value. To support a 

fully informed decision to authorize a mission, the decision authority should be 

advised of the various sources of risk, etc. However, aggregated risk limits provide 

the most definitive basis to consistently characterize, evaluate, and compare the risks 

associated with a range activity because the risk acceptability is defined by a single 

value. 

5.1.2 Casualty and Fatality Risk Limits. The previous versions of this standard used fatalities 

as the consequence metric to define acceptable risks for a variety of reasons. A 1996 survey of 

national ranges showed that acceptable risk has historically been expressed in terms of 

casualties. However, until recently the lower injury threshold for defining casualty varied 

widely among the ranges, and in all cases, the term included fatality. Furthermore, the previous 

versions of this standard applied only to inert debris hazards, where a relatively high percentage 

of casualties is expected to be fatalities. Thus, fatality was chosen as the measure of risk for 

previous versions of this standard. 

In 2006, the Risk Committee developed a consensus on the definition of casualty and 

other issues (such as threshold values) that facilitate risk estimates based on casualty 

consequences, which are discussed in Chapter 6 of this Supplement. A casualty is defined here 

as serious injury or worse, including death, for a human. For the purposes of this standard, the 

Risk Committee adopted Abbreviated Injury Scale (AIS) level 3 to characterize serious injury.48 

Also, the risk acceptability criteria now apply to all launch vehicle hazards, including those from 

toxic releases where a relatively low percentage of casualties are expected to be fatalities. 

Casualty was chosen as the primary consequence metric for this revised standard 

because: 

a. Casualty is consistent with current and past range practices that have produced a 

excellent public safety record. 

b. Using a casualty criteria instead of separate criteria for fatalities and serious injuries 

avoids the uncertainty associated with promptness and effectiveness of medical 

treatment that can prevent serious injuries from becoming fatal.49

 

48 Serious injuries are formally defined in U.S. law 49 CFR 830.2 for the purpose of reporting the consequences of 

aviation accidents. However, the FAA has accepted that “the use of AIS level 3 or greater is appropriate for 

describing a medical condition sufficiently to allow modeling of casualties for purposes of determining whether a 

launch satisfies the public risk criteria.” (See Federal Register, Part III, Department of Transportation, Federal 

Aviation Administration, 14 CFR Parts 413, 415, and 417, Licensing and Safety Requirements for Launch (See 

Reference 5a). 49 Medical treatment can often save a seriously injured individual from dying, but the availability of such medical 

treatment is highly unpredictable. 

5-3
c. Casualty measures are necessary to provide a reasonable level of protection from 

serious injuries due to all launch vehicle hazards. 

d. Serious injuries are onerous.50

This standard endorses the use of fatality as a supplemental consequence metric for 

several reasons. Evaluation of both casualty and fatality risks can provide a more in-depth 

understanding of mission risks. Specifically, a range Commander may view missions with the 

same risk of casualties differently depending on the risk of fatalities. For example, a range 

Commander may view a mission that poses only inert debris hazards, with risks of 90E-6 

expected casualties and 45E-6 expected fatalities, differently from a mission that poses only 

toxic release hazards, with risks of 90E-6 expected casualties and less than 0.1E-6 expected 

fatalities. Furthermore, some range operations might pose a very high ratio of potential fatalities 

to potential casualties. For example, a mission that poses risks only from very large and dense 

pieces of inert debris could produce virtually equal risks of casualty and fatality. In such a case, 

a range Commander may choose to limit the risk of fatality in addition to the risk of casualty. 

5.1.3 Best Estimate Risk Limits and the Role of Uncertainty. The RCC intends for the risk 

criteria in Chapter 3 of the Standard to be compared to best estimate of individual and collective 

risks. The use of best estimate individual and collective risk estimates is consistent with the 

FAA’s regulations on risks from commercial launch51 and reentry52 vehicles, and is the current 

practice at the national ranges (see footnote 45, and footnote 46). 

The use of “best estimates” also appears to be reasonable and rational in comparison with 

the Nuclear Regulatory Commission (NRC) approach: “the Commission has adopted the use of 

mean estimates for purposes of implementing the quantitative objectives of this safety goal 

policy” (Reference 5b). The RCC recognizes, just as the NRC did, that uncertainties are inherent 

in risk based decision-making. It appears that the current RCC approach to risk limits and 

uncertainty is the same as the approach initially taken by the NRC some 20 years ago. For 

example, it appears that NRC references to “mean estimates” equate to the “best estimates” used 

in this Standard, which presently do not always completely account for all sources of 

uncertainty; the NRC stated that the “use of mean estimates does not, however, resolve the need 

to quantify (to the extent reasonable) and understand those important uncertainties involved 

in...risk predictions.” 

 

50 A DOT study on the economic impact of motor vehicle crashes in 2000 found that, “serious injury can be 

catastrophic to the victim’s economic well being in addition to their physical and emotional condition.” (See 

Blincoe et al, DOT HS 809 446, May 2002, p.7) Furthermore, motor vehicle crash data and government cost 

analysis guidelines show that debilitating injuries typically incur more economic damage than fatalities. (See 

Blincoe et al Table 2 and GRA Inc Report, Economic Values for FAA Investment And Regulatory Decisions, a 

Guide, Dec 2005) 

51 14 CFR 415.35a: “Acceptable flight risk through orbital insertion for an orbital launch vehicle, and through 

impact for a suborbital launch vehicle, is measured in terms of the expected average number of casualties (Ec) to the 

collective members of the public exposed to debris hazards from any one launch.” See Federal Register, Vol. 64, 

No. 76, April 21, 1999, page 19618. See also (Reference 5g) at 14 CFR 417.107(b). 52 14 CFR 435.31b: “Acceptable risk for a proposed mission is measured in terms of the expected average number 

of casualties (Ec).” See Federal Register, Vol. 65, No. 182, September 19, 2000, page 56660 

5-4
The RCC recognizes that the following statements regarding uncertainties, which were 

published with the NRC safety goals, also apply to risk management for range activities: 

a. “Uncertainties are not caused by use of quantitative methodology in decision-making 

but are merely highlighted through the use of the quantification process.” 

b. “A number of uncertainties arise because of a direct lack of severe accident 

experience or knowledge of accident phenomenology along with data related to 

probability distributions.” 

c. “Through the use of quantitative techniques important uncertainties have been and 

continue to be brought into better focus and may even be reduced compared to those 

that would remain with sole reliance on deterministic decision-making.” 

d. “For this reason, sensitivity studies should be performed to determine those 

uncertainties most important to the probabilistic estimates. The results of sensitivity 

studies should be displayed showing, for example, the range of variation together 

with the underlying science or engineering assumptions that dominate this variation.” 

e. “Depending on the decision needs, the probabilistic results should also be reasonably 

balanced and supported through the use of deterministic arguments. In this way, 

judgments can be made by the decision-maker about the degree of confidence to be 

given to these estimates and assumptions. This is a key part of the process of 

determining the degree of conservatism that may be warranted for particular 

decisions. This defense-in-depth approach is expected to continue to ensure the 

protection of public health and safety.” 

5.2 Criteria Rationale Overview 

 In establishing the standard criteria, five separate types of logic generally used were: 

a. Consistency with prior range or closely related safety criteria. 

b. Similar regulatory experience. 

c. Comparable accident statistics and background risk levels. 

d. Internal consistency. 

e. Legal considerations. 

The five types are summarized below, followed by the rationale for each criterion. 

5.2.1 Consistency with Prior Safety Criteria. The national ranges have a 50-year history of 

successful protection from falling debris. This excellent safety record was achieved using 

criteria that have varied over time and among ranges. Therefore, a primary goal of the standard 

criteria is to retain the main body of existing criteria while promoting consistency among the 

ranges. 

5.2.2 Similar Regulatory Experience. The criteria consider similar regulatory experience of 

local, state, federal, and international organizations. Numerous precedents have been set by 

other regulatory agencies to define acceptable risk levels. These precedents vary widely in their 

relevance and applicability to this standard. In some cases, similar regulatory experience 

includes federal laws governing commercial space transportation risks. 

5-5
5.2.3 Comparable Accident Statistics and Background Risk Levels. The standard criteria 

compare favorably with generic accident experience data for categories that correlate with 

potential range accidents. The use of accident statistics has a specific and limited purpose. The 

history of risk from falling rocket launch debris shows no casualties. We are comparing 

potential accidents from falling debris to actual accident experience in other categories, which 

have a much larger statistical base, to ensure that the acceptable risk levels defined here do not 

exceed those risk levels that have been experienced in the past. 

In some cases, the standard criteria are rationalized by comparison to background risk 

levels. The policy objectives given in Chapter 2 of the Standard include that “the general public 

should not be exposed, individually or collectively, to a risk level greater than the background 

risk in comparable involuntary activities.” In this context, the RCC considers “comparable 

involuntary activities” as those where the risk arises from manmade activities that: 

a. Are subject to government regulations or are otherwise controlled by a government 

agency. 

b. Are of vital interest to the U.S.53

c. Impose involuntary risk of serious injury or worse on the public. 

 Paragraph 5.3.1b and paragraph 5.6.2 elaborate on the use of background risk levels for 

comparable involuntary and voluntary activities, respectively, as important benchmarks for risk 

acceptability standards. 

5.2.4 Internal Consistency. Each acceptable risk criterion is supported by rationale founded in 

the previous three categories, and also by their relationship with one another. Each criterion is 

related to the other criteria by assumptions which reflect a reasonable set of conditions at the 

U.S. launch ranges. Figure 5-1 shows the inter-relationships between the criteria. Specifics of 

these are discussed in the applicable sections. 

 

53 In 2004, Congress identified space transportation as “inherently risky.” (see 49 USC Chapter 701, referred to as 

the Commercial Space Launch Act (CSLA), §70101 (a)(12), 12/2004). At the same time, Congress found that “a 

robust US space transportation industry is vital to the Nation's economic well-being and national security,” (CSLA 

§70101, which gives reference Pub. L.106-405, Sec. 2, 11/1/2000, 114 Stat. 1751). The Major Range and Test 

Facility Bases (MRTFBs) have long been regarded as “national assets,” and thus vital to the interests of the US. 

5-6
1000E-6 Expected Fatalities 10000E-6 Expected Fatalities

3000E-6 Expected Casualties 30000E-6 Expected Casualties

Annual

Probability of Manned 

Spacecraft Impact **** **** 1E-6

10E-6 Probability of Ship Impact 100E-6 Probability of Ship Impact

0.1E-6 Probability of Aircraft Impact 1E-6 Probability of Aircraft Impact

30E-6 Expected Fatalities 300E-6 Expected Fatalities

Individual Probability of 

Fatality 1E-6 Individual Probability of Fatality 0.1E-6

100E-6 Expected Casualties 300E-6* Expected Casualties

Individual Probability of 

Casualty 10E-6 Individual Probability of Casualty 1E-6

Per 

Mission

Max. Acceptable Undesired Event Max. Acceptable Undesired Event

General Public Mission Essential/Critical Operations

1000E-6 Expected Fatalities 10000E-6 Expected Fatalities

3000E-6 Expected Casualties 30000E-6 Expected Casualties

Annual

Probability of Manned 

Spacecraft Impact **** **** 1E-6

10E-6 Probability of Ship Impact 100E-6 Probability of Ship Impact

0.1E-6 Probability of Aircraft Impact 1E-6 Probability of Aircraft Impact

30E-6 Expected Fatalities 300E-6 Expected Fatalities

Individual Probability of 

Fatality 1E-6 Individual Probability of Fatality 0.1E-6

100E-6 Expected Casualties 300E-6* Expected Casualties

Individual Probability of 

Casualty 10E-6 Individual Probability of Casualty 1E-6

Per 

Mission

Max. Acceptable Undesired Event Max. Acceptable Undesired Event

General Public Mission Essential/Critical Operations

10X

10X

10X

10X

10X

10X

10X 3X 10X

* MEP/COP Expected Casualties capped at 300E-6 to be more consistent with current range practices

3X 3X

3X same

~30/ 

year

300X 300X

10X

10X

10X

10X

10X

10X

10X 3X 10X

* MEP/COP Expected Casualties capped at 300E-6 to be more consistent with current range practices

3X 3X

3X same

~30/ 

year

300X 300X

Figure 5-1. Criteria inter-relationships. 

5.2.5 Legal Considerations. The standard criteria are supported by five legal principles related 

to safety criteria, which are described below. 

a. Reasonable Risk. Increasingly, decision makers have encountered opposition to 

acceptable risk decisions based on expert judgments or on risk comparisons that may 

be deemed inappropriate. The courts, however, have often upheld these decisions on 

the basis that the decision by the federal agency was reasonable. The term 

reasonable, or more commonly unreasonable, appears in several federal statutes 

(such as the Toxic Substances Control Act) and is used as the primary criterion in 

making difficult decisions. Reasonableness is undefined in these laws, leaving the 

regulatory agencies and courts to determine what constitutes a reasonable decision. 

In general, all of the commonality criteria are reasonable because they are supported 

by at least three of the five lines of logic. 

b. De Manifestis and De Minimis. Two levels of risk are distinguished by their Latin 

names: de manifestis and de minimis. De manifestis risk, literally a “manifest” risk 

of obvious concern, has its roots in the legal definition of an “obvious risk”: a risk 

that is instantly recognized by a person of ordinary intelligence as inherently 

unacceptable. De minimis risk, on the other hand, defines a level of risk that is below 

regulatory concern. This term stems from the legal principle, de minimis non curat 

lex: “the law does not concern itself with trifles.” 

 In recent years, there has been a growing recognition that the perception and 

acceptability of risks by the general public must be considered. For example, the 

annual risk of an individual dying in an automobile accident in the United States has 

5-7
been stated as 2E-4 (Reference 5c). This risk is widely accepted by the public 

because of the great benefit perceived from automobile transportation. However, for 

other activities, a much lower risk is typically perceived as acceptable. Thus, a single 

de minimis value may not be sufficient. 

c. Informed Decision. The “informed decision” principle is used in tort claims against 

the U.S. Government. The Federal Tort Claims Act (FTCA) enjoins the U.S. court 

system from second-guessing decisions made by properly authorized government 

officials in determining the acceptability of operational risks. A key test under the 

FTCA requires that the decision-making official be fully advised and informed of the 

known risks. Failure to fully advise the decision-making authority of known risks 

can result in liability of the U.S. Government or its officials. 

d. Rationale. The Administrative Procedures Act (APA), specifically Section 10 

of 5 U.S.C. §§ 701-706, provides the principal statutory authority governing judicial 

review of actions by a regulatory agency. Under the APA, the judgment and 

discretion of a regulatory agency are reviewed under the “arbitrary, capricious, abuse 

of discretion” standard. The case law on the scope of judicial review is extensive and 

not easily summarized. However, using this standard, courts have upheld agency 

determinations that were rational, based on consideration of the relevant factors, and 

within the agency’s authority delegated by statute. More specifically, a court is not to 

overrule the agency’s judgment provided that the agency examines the relevant data 

and documents a rational connection between the facts and the choices made 

(Reference 5d, and Reference 5e). In essence, the agency must provide a rational 

explanation of its decision or be subject to injunction by a court under the “arbitrary 

and capricious” standard of the APA. 

5.3 Rationale for Casualty Limits 

Table 5-1 summarizes the casualty criteria for both the general public and mission 

essential/critical operations personnel. Rationale for these numbers is presented in the following 

sections. 

TABLE 5-1. MAXIMUM ACCEPTABLE CASUALTY RISK TO PEOPLE 

Per Mission Criteria General Public Mission Essential 

Individual Probability of Casualty 1E-6 10E-6 

Expected Casualties 100E-6 300E-6 

Annual Criteria 

Expected Casualties 3000E-6 30000E-6 

5-8
5.3.1 General Public Collective Risk Per Mission (GP: 100E-6 EC). Limiting the collective 

risk for the general public to 100E-6 (1E-4) expected casualties per mission is rational and 

reasonable in light of the following: 

a. Past RCC launch safety criteria. 

b. Launch safety criteria used by other organizations. 

c. Federal law governing launch and reentry risks. 

d. Risks accepted for “comparable involuntary activities.” 

e. Internal consistency (correlation with other criteria). 

f. Legal considerations. 

5.3.2 Justification of the 100E-6 Collective Risk Standard. The following subsections describe 

how the 100E-6 collective risk standard is justified from all of these perspectives. 

a. Prior Safety Criteria (GP: 100E-6 EC). In 1997, the RCC established a collective risk 

limit for the general public equal to 30E-6 (3E-4) expected fatalities due to inert 

debris for any single mission. Five separate types of logic were used to establish that 

criteria: 

(1) Consistency with prior safety criteria. 

(2) Legal considerations. 

(3) Similar regulatory experience. 

(4) Comparable accident statistics. 

(5) Correlation to the other criteria. 

The rationale behind that previous criterion is still valid and applicable to the 

current fatality risk criteria because a) the previous and current criteria use the same

numerical limits for fatality risks, and b) the only difference is that updated criterion 

applies to all sources of hazards from range activities, not just inert debris. 

Limiting the collective risk for the general public to 100E-6 (1E-4) expected 

casualties per mission ensures protection that is generally consistent with, or more 

conservative than, the previous limit of 30E-6 (3E-4) expected fatalities due to inert 

debris. Specifically, the typical ratio of fatality expectation to casualty expectation 

for the typical hazards listed in Table 5-2 indicate that the 100E-6 (1E-4) expected 

casualties criteria is likely to limit a range activity more than the previous limit, 

unless the range activity presents inert debris hazards only. For example, a launch 

with inert and explosive debris hazards and a risk estimate of 100E-6 (1E-4) expected 

casualties would typically correspond to about 25E-6 expected fatalities. Table 5-2

shows that the other hazards, such as toxic releases and DFO, typically produce even 

smaller ratios of expected fatalities to expected casualties. So the 100E-6 expected 

casualty limit provides more protection than the 30E-6 expected fatality limit, 

particularly if toxic or DFO risks are significant. Thus, the current standard for 

expected casualties is rational: consistent with the previous expected fatality criteria 

from a safety perspective. This same ratio between the expected casualties and 

expected fatalities criteria for general public is carried over the mission 

essential/critical operations personnel categories and annual criteria. 

5-9
TABLE 5-2. TYPICAL RATIO OF EXPECTED FATALITIES TO CASUALTIES 

Hazard Scenario Range of EF / EC

Large inert debris impacts 0.6 to 0.8 

Explosive and inert debris impacts 0.1 to 0.8, 0.25 typical 

Distant Focusing Overpressure (DFO) 0.001 to 0.03, 0.01 typical 

Solid rocket propellant toxic release 0.001 typical 

 There are hypothetical circumstances where much larger or smaller fractions of 

expected casualties would be expected fatalities. For example, if building impacts are 

severe enough to cause collapse, the number of expected fatalities might equal the 

number of casualties. However, those circumstances are unusual because areas 

vulnerable to such severe impacts are typically designated hazard areas and 

evacuated. Therefore, where there is the potential for such circumstances, 

implementation of the supplemental fatality risk criteria, in addition to the primary 

casualty risk criteria, is advisable. 

b. Similar Regulatory Experience (GP: 100E-6 EC). Limiting the collective risk for the 

general public to 100E-6 (1E-4) expected casualties per mission is consistent with the 

following closely related launch safety criteria set by other organizations. The 

criteria are explained as follows: 

(1) DODI 3100.12: If atmospheric reentry is used for post mission disposal of a 

spacecraft or upper stage, “either the risk of injury from the total debris casualty 

area for components and structural fragments surviving reentry shall not exceed 

1 in 10,000 (based upon an evenly distributed human population density across 

the Earth), or it shall be confined to a broad ocean or essentially unpopulated 

area.” This DoD Instruction essentially established 100E-6 expected casualties as 

a standard for risk acceptability from an uncontrolled reentry; NASA54 has, and 

ESA55 is considering, the same threshold value. 

(2) NASA 8715.5 adopted a limit of “100E-6 expected casualties per controlled 

entry, applied for a combination of all hazards.” (See paragraph 3.2.4.5.c.3) 

(3) The Commonwealth of Australia Space Licensing and Safety Office (SLASO) 

established 100E-6 as “the maximum third party collective risk (the sum of 

casualty risks to all individuals in the general public) on a per launch basis.”56 

(4) AFSPCMAN 91-710: “The risk associated with the total flight to all members of 

the general public, excluding persons in waterborne vessels and aircraft, shall not 

exceed an expected average number of 0.00003 casualties (EC < 30 E-6) from 

 

54 NASA Safety Standard NSS 1740.14: Guidelines and assessment procedures for limiting orbital debris, August 

1995, page 7-1. 

55 “Update of the ESA Space Debris Mitigation Handbook,” R. Walker et al, Ref: QINETIQ/KI/SPACE/CR021539 

July 2002 section 1.9.3 

56 SLASO Flight Safety Analysis Code, Second Edition, 1 July 2002, paragraph 3.1.1 

5-10
impacting inert and explosive debris, EC < 30E-6 for toxic release (exposure to 

rocket propellant effluent), and EC < 30E-6 for far field blast overpressure.” This 

USAF expected casualty criterion for each hazard applies to each launch from 

liftoff through orbital insertion, including planned impact for an orbital launch, 

and through final impact for a suborbital launch. Notice that the AFSPCMAN 

91-710 criteria allows a theoretical maximum of 90E-6 expected casualties, 

excluding any risks from hazards other than toxic release, far-field overpressure 

(DFO), and impacting inert and explosive debris. Given the uncertainty inherent 

in even the most sophisticated launch risk estimate available today, there is 

essentially no real difference between a limit of 90E-6 or 100E-6 expected 

casualties. If another hazard was presented by a launch, such as from radioactive 

materials, then more risk might be accepted under AFSPCMAN 91-710. 

 

 Therefore, limiting the collective risk for the general public to 100E-6 (1E-4) 

expected casualties for any single mission is reasonable and rational compared 

with closely related safety criteria established by other U.S. and foreign agencies. 

c. Federal Law Governing Commercial Launch. In 1999, the FAA promulgated a 

federal law (14 CFR 415.35a) to establish 30E-6 expected casualties from debris 

hazards only as the level of acceptable flight risk through orbital insertion for 

commercial launches: “To obtain safety approval, an applicant shall demonstrate 

that the risk level associated with debris from an applicant’s proposed launch shall 

not exceed an expected average number of 0.00003 casualties per launch 

(EC < 30 E-6).” The preamble to that law clarified that the 14 CFR 415.35a was 

intended to limit “risk from debris, not from toxic releases or blast overpressure, 

which the federal launch ranges handle through other means”(Reference 5f).57 The 

preamble stated that the FAA derived that limit “from launch risk guidance employed 

by the Air Force at its Eastern Range, Cape Canaveral Air Station, and its Western 

Range, Vandenberg Air Force Base, to define acceptable risk.” In adopting this 

acceptable flight risk limit for debris the FAA wrote that it “believes that commercial 

launches should not expose the public to risk greater than normal background risk, 

which the FAA defined in its NPRM as those risks voluntarily accepted in the course 

of normal day-to-day activities.” 

 The RCC recognizes that it was reasonable for the FAA to limit flight risk to 

30E-6 expected casualties from debris based on the information available in 1999. 

Indeed, the National Academy of Sciences found, “a collective risk standard 

(i.e., a casualty expectation, or Ec) of 30E-6 per launch for members of the general 

public is consistent with risk standards of many other fields in which the public is 

involuntarily exposed to risk, both domestically and internationally.” 58 Also, the Air 

Force document with range safety requirements provided information to justify 30E-6 

expected casualties as a level defining acceptable launch risk without high 

 

57 In this context the FAA refers to DFO as “blast overpressure.” 58 Finding 3-3 on page 19 of “Streamlining Space Launch Range Safety,” National Academy Press, 2000, IBSN 0-

309-06931-9 

5-11
management review.59 When the FAA issued 14 CFR 415.35a, it believed that the 

federal launch ranges were implementing safety requirements to contain any hazards 

from toxic releases or DFO: 

“For toxic releases and blast overpressure, the federal launch ranges implement 

specific safety requirements designed to keep toxic releases and the effects of blast 

from reaching the public. For example, if more than a given number of parts per 

million of a toxic release would reach people, a launch will be delayed until 

conditions improve. Likewise, if atmospheric effects threaten to carry overpressure 

impact to persons outside the federal launch site, a launch will be delayed. Because 

these measures achieve safety, the FAA will rely on them rather than implementing 

an EC analysis requirement for toxic releases and blast overpressure” (Reference 5f). 

 More recently, the FAA promulgated more comprehensive risk acceptability 

criteria that would limit the collective risk from launch to 30E-6 expected casualties 

for each hazard, such as debris, distant focusing overpressure, and toxics. 

Specifically in 2006, the FAA issued a rule to limit the collective launch risks such 

that “a launch operator may initiate the flight of a launch vehicle only if the risk 

associated with the total flight to all members of the public, excluding persons in 

waterborne vessels and aircraft, does not exceed an expected average number of 

0.00003 casualties (EC ≤ 30E-6) from impacting inert and impacting explosive 

debris, EC ≤ 30E-6 for toxic release, and EC ≤ 30E-6 for far field blast 

overpressure”(Reference 5g). This FAA collective risk criterion “for each hazard 

applies to each launch from liftoff through orbital insertion, including each planned 

impact, for an orbital launch, and through final impact for a suborbital launch.” 

 A recent FAA regulation to establish launch risk criteria acknowledged “that a 

risk assessment that determines the total risk due to all hazards associated with a 

single launch would be an ideal approach.” Indeed, the FAA’s initial proposal (in 

October 2000) sought to “require that an aggregate of the hazards created by a 

particular launch not exceed an EC of 30E-6” (Reference 5a). The FAA found that 

the Eastern and Western Ranges “were receptive to this approach because it 

supported a theoretical goal of launch risk management, which is to quantify all 

hazards in a single, normalized risk measure.” However, the launch industry objected 

to that proposal as overly restrictive. The FAA was motivated to establish a law 

consistent with current practice at the Eastern and Western Ranges, thus the FAA’s 

current regulation sets limits on ELV flight risks in a manner entirely consistent with 

the latest USAF requirements in AFSPCMAN 91-710. 

 The FAA’s latest flight risk criteria for launch allows a theoretical maximum 

of 90E-6 expected casualties, excluding any risks from hazards other than toxic 

release, far-field overpressure (DFO), and impacting inert and explosive debris 

(Reference 5g). As stated before, when considering the uncertainty, there is 

essentially no difference between limits of 90E-6 or 100E-6 expected casualties. 

 

59 Appendix 1D of EWR 127-1, 1997 edition 

5-12
Therefore, limiting the collective risk for the general public to 100E-6 (1E-4) 

expected casualties per mission is reasonable and rationale compared with Federal 

laws governing commercial launch risks. Furthermore, the underlying rationale used 

to establish the FAA risk limits also supports the risk criteria presented in Chapter 3 

of the Standard. Specifically, a limit on the collective risk for the general public 

equal to 100E-6 (1E-4) expected casualties per mission: 

(1) Can be derived “from launch risk guidance employed by the Air Force at its 

Eastern Range, Cape Canaveral Air Station, and its Western Range, Vandenberg 

Air Force Base, to define acceptable risk,” and 

(2) Prevents exposing “the public to risk greater than normal background risk, which 

the FAA defined ... as those risks voluntarily accepted in the course of normal 

day-to-day activities.” 

 This section shows how the 100E-6 expected casualty limit can be derived from the 

“from launch risk guidance employed by the Air Force.” The following sections on risks 

accepted for comparable involuntary activities and comparable accident statistics demonstrate 

how the current the 100E-6 expected casualty limit meets the second condition. 

d. Comparable Accident Statistics and Background Risk Levels (GP: 100E-6 EC). Civil 

aviation obviously meets the three conditions considered necessary to be a 

“comparable involuntary activity,” explained in paragraph 5.2.3. Congress, the RCC, 

the USAF, an American National Standard, and the Commonwealth of Australia 

identified the risk posed by conventional aircraft as a benchmark for the acceptable 

risk from launch vehicles: 

(1) Pubic Law 81-60. In 1949, Congress enacted PL 81-60, Guided Missiles—Joint 

Long Range Proving Ground, which authorized the Secretary of the Air Force to 

establish a joint proving ground, which became the present-day Eastern Range. 

However, this statute only authorized the establishment of a range, and does not 

apply to its current operations. An observation in legislative history of PL 81-60 

delineated, to a degree, how the location must be chosen: “from a safety 

standpoint (test flights of missiles) will be no more dangerous than conventional 

airplanes flying overhead.” This language was clearly intended to allay public 

fears when missile testing was in its infancy, and was not intended to set future 

standards. However, this legislative background language clearly suggests that 

the launch and flight of launch vehicles should present no greater risk to the 

general public than the over-flight of conventional aircraft. Although this 

legislative background language is not binding in any way to current decisions 

made by any federal agency, it does indicate that Congress found a logical 

connection between appropriate risk levels for range activities and conventional 

aircraft. 

(2) EWR 127-1. The USAF relatively recently imposed requirements that explicitly 

linked the involuntary risk imposed on the public from launches to the risk from 

conventional aircraft. “To provide for the public safety, the Ranges, using a 

Range Safety Program, shall ensure that the launch and flight of launch vehicles 

and payloads present no greater risk to the general public than that imposed by 

5-13
the over-flight of conventional aircraft.”60 Note that “over-flight” in this context 

refers to the entire flight. The most recent study that quantified the annual risk to 

the population near Cape Canaveral from potential in-flight aviation accidents 

included accidents in the cruise and maneuvering phases of flights to and from 

remote airports, as well as the climb, approach, and descent phases of flight to and 

from local airports.61 

(3) RCC 323-99, Paragraph 2 states that “Any UAV operation or test must show a 

level of risk to human life no greater than that for an operation or test of a piloted 

aircraft.” 

(4) ANSI/AIAA S-061-1998. Section 4.5: An association of space transportation 

professionals developed and published an “American National Standard on 

Commercial Launch Safety” that ties public risk to general aviation over-flight. 

“During the launch and flight phase of commercial space vehicle operations, the 

safety risk for the general public should be no more hazardous than that caused 

by other hazardous human activities (e.g. general aviation over-flight).” 

(5) Prior to establishing regulations aimed at limiting the level of public risk 

associated with space launch activities, the Commonwealth of Australia funded a 

study to “develop a risk benchmark which can be used by the Space Licensing 

and Safety Office for evaluating the risk of casualties to the general public from 

space launch activities.” That study concluded “that it is reasonable to use the 

current collective risk of injuries to the public from aviation as a basis for setting 

a limit to the collective risk to the public from space launch activities” (Reference 

5h). 

 Clearly, the RCC is not alone in identifying aviation as a “comparable 

involuntary activity,” and thus a legitimate benchmark for acceptable risks from 

range activities. Therefore, it is rational and reasonable to establish risk limits 

such that range activities “will be no more dangerous than conventional airplanes 

flying overhead.” 

 

60 Eastern and Western Range 127-1, Range Safety Requirements, 1998, see page 1-viii. 61 See footnote on page iii of Reference 5t. 

5-14
 Unfortunately, there are several factors that complicate the comparison of risks posed 

to people on the ground from aviation and the risk criteria presented in Chapter 3 of the 

Standard: 

(6) While aviation risks can be estimated using empirical data on the number of 

people seriously injured or killed on the ground, the risks posed by range 

activities are predictions based on computational models generally fraught with 

more uncertainty than the empirical data on aviation risks. 

(7) The available empirical data on aviation risks to ground dwellers does not clearly 

and consistently distinguish between consequences suffered by those exposed 

voluntarily and involuntarily. 

(8) While the risks posed by aviation are due to literally millions of flights that occur 

all over the country, range activities are relatively infrequent and typically pose 

risks to a much more localized population. 

(9) The empirical data on aviation risks suggests that ground dweller risks are 

strongly dependent on proximity to an airport. However, no study is available to 

resolve the dependence of ground dweller risk on proximity to an airport to the 

extent necessary to make definitive comparisons to the risks posed by range 

activities. 

(10) It is difficult to quantify the population exposed to risks from typical range 

activities or the risks posed by aviation to a comparable population. 

Paragraph 5.8 (Using Aviation as a Benchmark for Launch Risk) describes 

how the risks posed to ground dwellers by conventional aviation can be 

used to help identify reasonable risk limits for range activities. 

Paragraph 5.8 indicates that the data and analyses of the risk imposed by 

the over-flight of conventional aircraft indicate that a limit for the 

collective risk for the general public on the order of 100E-6 (1E-4) 

expected casualties for any single mission is reasonable and rational. 

 Despite these complications, the following data and analyses of the risk imposed by 

the over-flight of conventional aircraft strongly suggest that a limit for the collective risk 

for the general public on the order of 100E-6 (1E-4) expected casualties for any single 

mission is reasonable and rational. Figure 5-2 outlines the analysis steps taken to 

establish a rational connection between the Standard collective risk limit and the 

empirically estimated risk to ground dwellers near a major airport in the U.S. 

 

 Based on the data on all civil aviation accidents in the U.S. that killed people on the 

ground from 1964 to 1999 (Reference 5i), it was estimated that the average risk of 

fatality for individuals involuntarily exposed to civil aviation accidents within five miles 

of top 100 airports was about 3E-8 in the year 2000. Based on the decreasing trend noted 

in the number of involuntarily exposed people killed on the ground by civil aviation 

accidents between 1964 and 1999, and the projected increases in the number of airport 

operations and the U.S. population, it appears that the collective risk will remain fairly 

constant, increasing from 3.8 expected fatalities in 2005 to 4.3 expected fatalities in 

2015. Thompson et al found that the uncertainty in these projections is a less important 

5-15
factor than the variability due to distance from an airport. Therefore, these estimates of 

the risk to ground dwellers posed by U.S. civil aviation are not expected to change much 

over the next ten years. 

Figure 5-2. Outline of logic used to compare aviation and range risks. 

ESTIMATE PROBABILITY OF CASUALTY (PC) FOR AN INDIVIDUAL 

GROUND DWELLER NEAR A MAJOR AIRPORT ON AN ANNUAL BASIS 

ESTIMATE THE NUMBER OF INDIVIDUALS 

EXPOSED TO TYPICAL RANGE ACTIVITIES (NE)

ESTIMATE THE EQUIVALENT COLLECTIVE ANNUAL 

RISK = PC x NE

DIVIDE BY A FACTOR OF TEN TO ALLOW FOR UNCERTAINTY 

IN PREDICTED RISK FROM A RANGE ACTIVITY

DIVIDE BY THE NUMBER OF MISSIONS PER YEAR 

THE RESULT IS THE MAXIMUM ALLOWABLE PER MISSION RISK TO 

ENSURE THAT RANGE ACTIVITIES “WILL BE NO MORE DANGEROUS 

THAN CONVENTIONAL AIRPLANES FLYING OVERHEAD.”

 As discussed in paragraph 5.1.2, the risk of fatality alone is not an optimal measure of 

public risk. An analysis of data acquired from the NTSB on injuries (both minor and 

serious as defined in 49 CFR 830.2) and fatalities for people on the ground from civil 

aviation accidents for the 20 year period from 1984 through 2003 (Reference 5j), shows 

that aviation accidents produce an average of about two to three times as many casualties 

as fatalities. As shown in Table 5-3, the average ratio of casualties to fatalities on the 

ground from civil aviation accidents is 2.5; this ratio is somewhat constant over the years 

(the 99.97 upper bound values are based on year to year variations) and applies to general 

aviation (relatively small airplanes) as well as commercial airline accidents. Table 5-2

shows that this ratio is close to typical predictions made for launch accidents involving 

debris hazards only. Using the ratio of about three casualties to one fatality on the 

ground from civil aviation accidents, produces a rough estimate of 1E-7 for the average 

annual individual risk of casualty from civil aviation accidents for people that dwell 

within five miles of a top 100 airport. 

5-16
TABLE 5-3. RATIO OF GROUND CASUALTIES TO GROUND FATALITIES 

BASED ON 20 YEARS OF NTSB DATA FROM 1984 THROUGH 2003 

Aviation Category Average 99.87 Percentile Upper Bound 

All U.S. Civil (Part 91, 121 and 135) 2.5 5.4 

Airlines (Part 121) 2.0 5.9 

General Aviation (Part 91) 2.7 5.4 

 Experience with large orbital expendable launch vehicles at the federal launch ranges 

demonstrates that launch area risks are typically limited to approximately 300,000 people 

near the launch point.62 In addition, experience with the flights of SpaceShipOne, the 

only suborbital reusable launch vehicle flights to date, indicates that the risks were borne 

by approximately 300,000 people. Of course, far fewer than 300,000 people bear the 

majority of the total public risk from typical launches. However, the aviation risks are 

also disproportionately borne by those under the dominant flight paths used for take-off 

and landing as well.(Reference 5k) Multiplying the average risk of casualty for 

individuals involuntarily exposed to civil aviation accidents within five miles of top 100 

airports in the year 2000 (i.e. 1E-7) by 300,000 people equates to a collective risk of 

about 0.03 casualties per year. Therefore, a collective risk of no greater than 

0.03 casualties per year for the general public would meet the intent to ensure range 

activities are no more dangerous than the over-flight of conventional aircraft. For the 

same reasons, a collective risk of no greater than 0.01 fatalities per year for involuntarily 

exposed people would meet the intent to ensure range activities are no more dangerous 

than the over-flight of conventional aircraft. 

 While aviation risks can be estimated using empirical data on the number of people 

seriously injured or killed on the ground, the risks posed by range activities are 

predictions based on computational models, typically fraught with more uncertainty than 

the empirical data on aviation risks. To ensure that range activities pose a collective risk 

of no greater than 0.03 casualties per year (or 0.01 fatalities per year) for people 

involuntarily exposed, it is prudent to make a reasonable allowance for the uncertainty 

present in range safety risk predictions. The risk assessment process described in 

Chapter 2 of this Supplement takes steps to minimize this uncertainty; nevertheless, with 

all of the uncertainties in the modeling process and input data, any expected casualty 

estimate probably has, at the very least, plus or minus a one-order-of-magnitude of 

uncertainty. So, to make some allowance for the uncertainty inherent in range safety risk 

predictions, the RCC has established annual risk criteria that are approximately ten times 

lower than the risks estimated for aviation over-flight based on empirical data. 

Furthermore, all criteria have been set to the nearest factor of three (approximately onehalf order of magnitude on a logarithmic scale). Further refinement is not warranted due 

to the lack of precision in range safety risk predictions. 

 

62 See Reference 5t (Table 1 on page 6 and Table 7 on page 20). 

5-17
 The preceding analysis demonstrates that limiting the collective risks to the general 

public from range activities to no greater than 0.003 casualties and 0.001 fatalities per 

year is reasonable and rational because a representative sample of about 300,000 people 

that dwell within five miles of a top 100 airport in the U.S. are exposed to comparable 

risks. The same logic used in previous versions of this standard can be used to link these 

annual collective risk criteria to per mission criteria. Specifically, using an average 

of 30 missions per year these annual limits correspond to 100E-6 expected casualties 

and 30E-6 expected fatalities. Using 30 missions per year is conservative in this context 

because the recent history from the Eastern and Western Ranges shows closer to 

15 launches per year. 

 

 More specific factors considered relevant in this analysis are documented in 

paragraph 5.8. 

e. Internal Consistency (GP: 100E-6 EC). The annual and per mission collective risk 

limits are consistent with the each other assuming on the order of 30 missions per 

year. This standard sets casualty risk limits that are consistently about a factor of 

three higher than the fatality limits for reasons discussed in paragraph 5.3.4a. 

 As described in the previous section, all criteria have been set to the nearest factor 

of three, which is approximately one-half order of magnitude on a logarithmic scale, 

and further refinement is not warranted due to the lack of precision in range safety 

risk predictions. 

f. Legal Considerations (GP: 100E-6 EC). The previous sections provide a rational 

explanation that establishes connections between the relevant facts and the collective 

risk limit of 100E-6 expected casualties (and 30E-6 expected fatalities) per mission 

for the general public. These collective risk limits appear to be reasonable in light of: 

(1) Past RCC launch safety criteria. 

(1) Launch safety criteria used by other organizations. 

(2) Federal law governing launch and reentry risks. 

(3) Risks accepted for “comparable involuntary activities.” 

(4) Internal consistency (correlation with other criteria). 

 Comparisons of the criteria in this standard to de manifestis and de minimis levels 

are best done on an annual risk basis, as presented in 5.4.4. 

5.3.3 General Public Individual Risk Per Mission (GP: 1E-6 PC). Limiting the individual risk 

for the general public to 1E-6 probability of casualty per mission is rational and reasonable in 

light of the following topics which are discussed below. These topics include launch safety 

criteria used by other organizations, federal law governing launch and reentry risks, risks 

accepted for “comparable involuntary activities,” comparable accident statistics, and 

legal considerations. 

5-18
a. Prior Safety Criteria (GP: 1E-6 PC). Limiting the individual risk for the general 

public to 1E-6 probability of casualty per mission is consistent with current practice 

at the national ranges. Currently the majority of the ranges protect for a probability 

of casualty of 1E-6 on a per mission basis. Table 5-4 shows individual mission risk 

criteria for the general public currently used by various ranges. 

TABLE 5-4. INDIVIDUAL MISSION RISK FOR THE GENERAL PUBLIC AS OF 

2006 

Range* Individual Probability of Casualty 

Eastern Range 1E-6 

Eglin AFB 1E-6 

NASA – Wallops Flight Facility 1E-6 

NAWC – Point Mugu 1E-7

Pacific Missile Range Facility 1E-7 

Reagan Test Site 1E-6 

Western Range 1E-6 

White Sands Missile Range 1E-6** 

RCC 321-06 Standard Criterion 1E-6 

* Table lists only ranges that have criteria in this category 

** Probability of one or more casualties 

b. Similar Regulatory Experience (GP: 1E-6 PC). The FAA promulgated a regulation in 

2000 that limits the individual risk from an RLV mission to one in a million 

probability of casualty for members of the public.63 In 2006, the FAA issued a final 

rule with a similar individual risk limit for ELV launches.64 The differences between 

the ELV and RLV regulations regarding individual risks are twofold. First, the RLV 

individual risk limit applies to all hazards, while the proposed ELV rule would limit 

the individual risk per hazard. Second, the RLV rule applies to risks from all phases 

of flight from liftoff through landing, while the ELV rule would apply from liftoff 

through orbital insertion. Thus, limiting the individual risk for the general public to 

1E-6 probability of casualty per mission is reasonably consistent with FAA 

regulations. 

 

63 14 CFR 431.35b: “For public risk, the risk level to an individual does not exceed .000001 per mission (or 

individual risk criterion of 1E-6).” 

64 14 CFR 417.107b (Ref 5g): “a launch operator may initiate flight only if the risk to any individual member of the 

public does not exceed a casualty expectation (Pc) of 0.000001 per launch (Pc ≤ 1 E-6) for each hazard.” 

5-19
c. Comparable Accident Statistics and Background Risk Levels (GP: 1E-6 PC). 

(1) Background Risk. Paragraph 5.3.1d presented data and analysis to demonstrate 

that the annual risks experienced by ground dwellers near major airports are 

comparable to the limits set in this standard. However, the annual risk to ground 

dwellers near major airports are produced by many thousands of operations, and 

the risk to ground dwellers near a range are typically due to only a few dozen 

missions. Therefore, the individual risks to ground dwellers near an airport are 

undoubtedly extremely low on a per flight basis compared to those near a range. 

There are no directly comparable involuntary activities in terms of individual 

risks on a per mission basis. However, for the purpose of comparing the per mission 

individual risk limits set in this standard to other individual risk limits used to 

regulate comparable involuntary activities on an annual basis, there are reasons to 

believe that the same individual members of the public are typically not exposed to 

the maximum allowable risk from a large percentage of range activities that occur 

over a year. The reasons include the following: 

• Wind conditions at most ranges are highly variable, so the highest public risk 

area typically varies greatly from one range activity to the next. 

• The time of day of range activities typically varies greatly from one activity to 

the next. 

• Individuals are typically highly mobile in the U.S. today. 

With this in mind, a rough comparison can be made between the per mission 

individual risk limits set in this standard (i.e. of 1E-6 probability of casualty and 1E-7 

probability of fatality) and the annual individual risk limits used to govern 

comparable involuntary activities: land use in the vicinity of European airports and 

chemical installations, and the current practice of the DoD Explosive Safety Board 

(DDESB). European authorities have determined that, “although small compared 

with the risks from day to day activities, the risks to persons ‘on the ground’ from 

aircraft crashing on take-off and landing are comparable to those presented by large 

chemical installations.” Whether a public hazard is posed by the aviation or chemical 

industry, the Europeans generally recognize 1E-4 as the maximum annual individual 

risk of death that should be tolerated, and “1E-6 is universally considered to be 

broadly acceptable” (Reference 5l). The British specifically regard an individual 

annual risk of fatality below 1E-6 as “so low that they merge into the background 

risks of life, and they require no action” (Reference 5k). At least one U.S. 

Government agency has used the one in a million annual individual fatality risk limit: 

the DDESB established65 that the individual risk of fatality for any member of the 

public should be below 1E-6 on an annual basis due to the presence of an explosive 

storage site that needs a waiver from the DoD prescriptive standards, “until approval 

of risk based policy changes to DOD 6055.9-STD are incorporated.” 

The UK and Netherlands (NL) have policies that anyone not gaining direct 

benefit from an activity must be removed from areas where the annual fatality risk 

 

65 DDESB Memorandum “Risk Based Explosives Safety Siting,” 5 December 2001, and “327th Meeting of the 

DDESB,” 14 December 2004. 

5-20
exceeds 1E-4.

66 Within areas where the individual risk of fatality from aviation 

exceeds 1E-5 per year, both the NL and UK Governments prevent any further 

building. The UK allows unrestricted development where the individual annual risk 

of fatality due to aircraft over-flight is less than 1E-5 (Reference 5l). The NL has a 

more conservative approach than the UK: in areas where the individual annual risk 

of fatality is between 1E-5 and 1E-6 due to aircraft over-flight, the Dutch prevent 

future development of housing, hospitals, and/or schools, however; all existing 

development is permitted to remain. For land use planning around chemical 

installations, these governments have imposed less restrictive risk limits than those 

applied near airports in areas where the annual individual risks exceed 1E-5, but more 

restrictive requirements for risks between 1E-5 and 1E-6. 

The purpose of these comparisons is to show that: 

• Individual risks of fatality below 1E-6 per year have been considered “so low that 

they merge into the background risks of life, and they require no action.” 

• An individual member of the public would have to be exposed to the maximum 

allowable individual risk from over a hundred range activities in a year to exceed 

the maximum annual risk tolerated by European governments in the vicinity of 

airport and chemical installations. 

• Although there are some differences between the limits imposed by European 

governments based on the annual individual risks to the public from the aviation 

and chemical industries, existing developments exposed to less than 1E-5 annual 

individual probability of fatality generally are permitted to remain. 

Keep in mind that the individual risk limits used to govern comparable 

involuntary activities are based on annual fatalities risks, while this standard sets 

limits the individual risk of casualty primarily (and fatality as a supplemental 

measure) on a per mission basis. However, considering the number of range 

activities per year, and the logic supporting the assumption that the same individual 

members of the public are unlikely to be exposed to the maximum allowable risk 

from a large percentage of range activities that occur over a year, the per mission 

individual risk limits set in this standard (i.e. of 1E-6 probability of casualty and 1E-7 

probability of fatality) appear generally consistent with individual risk limits 

governing comparable involuntary activities. 

The Nuclear Regulatory Commission (NRC) stated a safety goal that: “the 

overall mean frequency of a large release of radioactive materials to the environment 

from a reactor accident should be less than 1 in 1,000,000 per year of reactor 

operation.” Although this NRC risk criterion is on an annual basis with a different 

consequence, it is an example of a U.S. regulatory agency using 1E-6 as an important 

benchmark. 

(2) Comparable Accident Statistics. Comparable accident statistics were used to 

generate a Universal Risk Scales (URS) based on APT Research studies. The 

 

66 The results in Reference 5l show that the 1E-4 annual individual risk of fatality contours are contained within the 

airport property for typical airports. Also see page B4. 

5-21
URS for Injury presents actual injury risk statistics from historical accident data 

and regulatory standards in a common graphical format to help communicate risk 

levels and assist the decision maker in establishing acceptable risks. The URS for 

Injury to an individual resulting from involuntary activities is shown in 

Figure 5-3. Note that the URS present annual risk since most accident data is 

given on an annualized basis. Making an assumption of 15 missions per year 

based on recent history from the ER and WR, per event statistics can be 

approximated from annual accident data some of which are summarized in 

Table 5-5. These data are presented to communicate historical risk levels, some 

of which are not necessarily viewed as acceptable. The data collected are for 

injuries that were medically attended to and caused one full day or more of 

restricted activity. This roughly correlates to AIS Level 2, which is a less severe 

injury than the AIS Level 3 adopted as the casualty measure. This more 

conservative measure serves as a reasonable upper bound for defining a maximum 

allowable risk. 

Regulatory Standards Annual Risk Actual Risk Experience

10-1

10-2

10-3

10-4

10-5

10-6

10-7

10-8

1⁄2 Severe Weather Event (Missouri – 2001-2004) 3,4

1⁄2 Non-Sexual Assault (U.S. – 2001-2004) 1,2,3 1⁄2 Violent Crime (U.S. – 2001-2004) 1⁄2Cut / Pierce (U.S. – 2001-2004) 1,2,3 1,2,3

1⁄2Falls (U.S. – 2001-2004) 1,2,3

1⁄2 All Causes - Black (U.S. – 2001-2004) 1,2,3

1⁄2 Dog Bite (U.S. – 2001-2004) 1,2,3

UK Department of 3⁄4

the Environment for

Serious Health Effects 23

1⁄2Other Bite / Bee Stings (U.S. – 2001-2004) 1,2,3

1⁄2Struck by / Against an Object (U.S. – 2001-2004) 1,2,3

Cancer Risk from Air Pollution 3⁄4

from a Single Existing Facility 

(AQMD) 25

Cancer Risk from Air Pollution 3⁄4

from a New Facility (AQMD) 24

1⁄2 All Causes - Males (U.S. – 2001-2004) 1,2,3

1⁄2 All Causes (U.S. – 2001-2004) 1,2,3 1⁄2 All Causes - Females 

(U.S. – 2001-2004) 1,2,3

1⁄2 Severe Weather Event (U.S. – 2001-2004) 3,4

1⁄2 Severe Weather Event (Connecticut – 2001-2004) 3,4

1⁄2 International Terrorism (U.S. – 2000-2003) 3,11

1⁄2 Bathtubs and Showers (U.S. – 2002) 1,2,3

1⁄2 Ladders (U.S. – 2002) 1,2,3

1⁄2 Toilets (U.S. – 2002) 1⁄2 Lawn Mowers (U.S. – 2002) 1,2,3 1,2,3

1⁄2 Refrigerators (U.S. – 2002) 1,2,3

1⁄2 Beds (U.S. – 2002) 1,2,3

1⁄2 All Causes – White/ 

Non-Hispanic (U.S. – 2001-2004) 1,2,3

Regulatory Standards Annual Risk Actual Risk Experience

10-1

10-2

10-3

10-4

10-5

10-6

10-7

10-8

Regulatory Standards Annual Risk Actual Risk Experience

10-1

10-2

10-3

10-4

10-5

10-6

10-7

10-8

1⁄2 Severe Weather Event (Missouri – 2001-2004) 3,4

1⁄2 Non-Sexual Assault (U.S. – 2001-2004) 1,2,3 1⁄2 Violent Crime (U.S. – 2001-2004) 1⁄2Cut / Pierce (U.S. – 2001-2004) 1,2,3 1,2,3

1⁄2Falls (U.S. – 2001-2004) 1,2,3

1⁄2 All Causes - Black (U.S. – 2001-2004) 1,2,3

1⁄2 Dog Bite (U.S. – 2001-2004) 1,2,3

UK Department of 3⁄4

the Environment for

Serious Health Effects 23

1⁄2Other Bite / Bee Stings (U.S. – 2001-2004) 1,2,3

1⁄2Struck by / Against an Object (U.S. – 2001-2004) 1,2,3

Cancer Risk from Air Pollution 3⁄4

from a Single Existing Facility 

(AQMD) 25

Cancer Risk from Air Pollution 3⁄4

from a New Facility (AQMD) 24

1⁄2 All Causes - Males (U.S. – 2001-2004) 1,2,3

1⁄2 All Causes (U.S. – 2001-2004) 1,2,3 1⁄2 All Causes - Females 

(U.S. – 2001-2004) 1,2,3

1⁄2 Severe Weather Event (U.S. – 2001-2004) 3,4

1⁄2 Severe Weather Event (Connecticut – 2001-2004) 3,4

1⁄2 International Terrorism (U.S. – 2000-2003) 3,11

1⁄2 Bathtubs and Showers (U.S. – 2002) 1,2,3

1⁄2 Ladders (U.S. – 2002) 1,2,3

1⁄2 Toilets (U.S. – 2002) 1⁄2 Lawn Mowers (U.S. – 2002) 1,2,3 1,2,3

1⁄2 Refrigerators (U.S. – 2002) 1,2,3

1⁄2 Beds (U.S. – 2002) 1,2,3

1⁄2 All Causes – White/ 

Non-Hispanic (U.S. – 2001-2004) 1,2,3

 Figure 5-3. Universal Risk Scale: injuries for annual probability of injury to an 

individual resulting from involuntary activities. 

5-22
TABLE 5-5. GENERAL PUBLIC INDIVIDUAL PROBABILITY OF CASUALTY 

RISK 

1

Activity/Source Per Event2 Annual3

Unintentional Strike by/against an object 1.03E-3 1.55E-2 

Motor Vehicle Occupant 6.94E-4 1.04E-2 

Battle of Britain (British Civilians) 6.67E-4 -- 

Lawn Mowers 1.67E-5 2.51E-4 

Refrigerators 6.94E-6 1.04E-4 

Severe Weather Events (Missouri – worst) 3.37E-6 5.06E-5 

Severe Weather Events (U.S. average) 6.43E-7 9.64E-6 

Commonality Criterion per Mission 1E-6 -- 

1. Data is compiled from various sources: National Electronic Injury Surveillance System, Consumer Product 

Safety Commission, National Center for Injury Prevention and Control, U.S. Census Bureau, and House of 

Commons Library. 

2. With the exception of the Battle of Britain, the per event statistics are derived from annual statistics by 

dividing the annual values by 15 to model the assumption of 15 missions per year. 

3. Risk is based on the exposed populations: Battle of Britain ~48 million, Missouri ~6 million, all others ~289 

million.

d. Legal Considerations (GP: 1E-6 PC). The previous sections provide a rational 

explanation that establishes connections between the relevant facts and the individual 

risk limit of 1E-6 probability of casualty (and 1E-7 probability of fatality) per mission 

for the general public. The standard individual risk limits are rationally connected to 

the available facts and are reasonable in light of the following conclusions from the 

previous sections. 

(1) Current practices of several of the national ranges include individual risk limits of 

1E-6 probability of casualty or 1E-7 probability of fatality. 

(2) Federal law governing commercial RLV missions limits individual risk to 1E-6 

probability of casualty for members of the public. 

(3) European governments treat individual risks of fatality below 1E-6 per year as 

“so low that they merge into the background risks of life, and they require no 

action.” 

(4) Individual members of the public are typically unlikely to be subject to a 

maximum risk from a large percentage of range activities over a year. 

(5) An individual member of the public would have to be exposed to the maximum 

allowable individual risk from over a hundred range activities in a year to exceed 

the maximum risk tolerated by European governments on an annual basis in the 

vicinity of airport and chemical installations. 

(6) 1E-4 and 1E-6 fatalities per year have essentially been established in Europe as 

maximum tolerable and broadly acceptable levels, respectively. Because 

individual members of the public are typically unlikely to be subject to a 

maximum risk from a large percentage of range activities over a year, the 

standard individual risk limits of 1E-6 probability of casualty and 1E-7 

5-23
probability of fatality per mission appear roughly between the maximum tolerable

and broadly acceptable levels, but certainly closer to the broadly acceptable

level. 

5.3.4 General Public Annual Collective Risk (GPa: 0.003 EC). 

a. Prior Safety Criteria and Internal Consistency (GPa: 0.003 EC). Previous versions of 

this standard established an annual collective risk criterion of 0.001 expected 

fatalities. That criterion was justified by: 

(1) Prior use at the national ranges. 

(2) Similar regulatory experience. 

(3) Comparable accident statistics. 

(4) Internal consistency with other criteria in the RCC 321 Standard. 

 As shown in Table 5-3, NTSB data from the twenty year period from 1984 

through 2003 reveals an average ratio of about three casualties to fatalities on the 

ground from civil aviation accidents. This ratio of casualties to fatalities for ground 

dwellers exposed to aircraft accidents is fairly constant over the years and applies to 

general aviation (relatively small airplanes) as well as commercial airline accidents. 

Civil aircraft and range accidents that present inert debris hazards only are reasonably 

expected to involve generally similar materials, gross vehicle weights, and highly 

variable degrees of fragmentation. Since conventional aircraft accidents and typical 

range accidents that present inert debris hazards only are logically expected to 

produce a similar average ratio of casualties to fatalities for ground dwellers (i.e. 

close to three), an annual collective risk limit 0.003 casualties is consistent with the 

previously established RCC limit of 0.001 expected fatalities for inert debris only. 

This is also consistent with the limits defined for the Per Mission criteria as indicated 

in Figure 5-1. 

 The data in Table 5-2 show that a ratio of casualty expectation to fatality 

expectation less than three is typical for the dominant range hazards often addressed 

by risk management. Therefore, it is conservative to establish a limit on the annual 

collective risk of casualties from all range hazards that is three times higher than the 

previously established limit for fatalities due to inert debris only. Experience at the 

USAF Western Range indicates “that one hazard usually predominates as the source 

of risk” because “the conditions that are conducive to driving up the risk of one 

hazard usually render another hazard less significant” (Reference 5m). Furthermore, 

the ranges can often mitigate toxic and DFO risks by various means as described in 

Chapter 8 of this Supplement. Therefore, an annual collective risk limit 0.003 

casualties from all hazards is not unreasonably conservative relative to the previously 

established limit of 0.001 expected fatalities for inert debris only. 

b. Similar Regulatory Experience (GPa: 0.003 EC). Regulations typically use fatality 

risk metrics. Given the regulatory experience described below, and the reasonability 

of using a factor of three between casualty expectation and fatality expectation (as 

5-24
presented in paragraph 5.3.3a), limiting the annual collective risk for the general 

public to 0.003 is rational and reasonable. 

c. Comparable Accident Statistics and Background Risk Levels (GPa: 0.003 EC). Civil 

Aviation in the U.S. The data and analyses presented in paragraph 5.3.1c demonstrate 

that an annual limit of 0.003 general public casualties from range activities is 

reasonable and rational compared to the risk posed by aviation over-flight to a 

representative sample of about 300,000 people that dwell within five miles of a top 

100 airport in the U.S. That conclusion was primarily supported by an analysis of 

empirical data that resolved ground dweller risks as a function of distance to an 

airport (irrespective of the distance from the dominant take-off and landing flight 

paths), which tends to produce an underestimate of the highest ground dweller risks 

near major airports. Other data and analysis of aviation related risks presented in 

other sections also indicate that annual limit of 0.003 general public casualties from a 

range’s activities is reasonable and rational. 

d. Legal Considerations (GPa: 0.003 EC). Limiting the annual collective risk for the 

general public to 0.003 is rational and reasonable in light of the following: 

(1) Past RCC launch safety criteria. 

(2) Similar regulatory experience. 

(3) Comparable accident statistics. 

5.3.5 Mission Essential and Critical Operations Personnel Casualty Risk Limits. The 

development of the criteria for tolerable risk for mission essential and critical operations 

personnel (i.e. voluntarily accepted risks) started with the establishment of the tolerable risk 

levels for uninvolved personnel. The next step was to apply a factor to the risk acceptability for 

uninvolved personnel to obtain a risk tolerability level for mission essential personnel. Finally, 

an adjustment was made in the case of the collective risk of casualties as described below. 

As discussed in paragraph 5.6.2, people ordinarily accept a wide range of risks depending 

on their perception of the risks and benefits. Most importantly, people are far more tolerant of 

risks that are imposed on them voluntarily than risks imposed on these without any sense of 

benefit or consent. Applying a factor between voluntary and involuntary risks has historical 

precedent. Chauncey Starr’s landmark paper (Reference 5n) concluded that people who were 

exposed to risk voluntarily would accept 1000 times more risk for the same benefit as those who 

were involuntarily exposed to the risk. Subsequently, other researchers concluded that the factor 

of 1000 was too high and not really constant. The risk acceptability criteria given in Chapter 3 

of RCC 321-07 for related workers (i.e. mission essential personnel and critical operations 

personnel), who are voluntarily exposed and receive direct compensation for their involvement 

in range activities, are generally ten times higher than the risk acceptability for involuntarily 

exposed people. Using a factor of ten is consistent with current practice at the national ranges67, 

past RCC standards68, NASA’s range safety program requirements69, and the policy of foreign 

 

67 AFSPCMAN 91-710, paragraph 3.3.3 

68 RCC Standard 321-02, page 3-1. 

69 NASA NPR 8715.5, paragraph 3.2.4.5 

5-25
governments.70 As shown in Figure 5-1, this factor of ten is applied to all but one of the 

voluntary risk criteria. 

a. Voluntary Risk Criterion. The only voluntary risk criterion in this standard that is not a 

factor of ten higher than the corresponding criterion for the general public involves the 

collective risk of casualties. Specifically, the collective risk for mission essential and 

critical operations personnel is limited to 300E-6 expected casualties, which is only three 

times the corresponding criterion for the general public. The RCC chose this more 

conservative criterion after determining that this is consistent with past risks experienced 

at the national ranges. 

b. Comparable Accident Statistics and Background Risk Levels. Similar to the general 

public category, comparable accident statistics for this category are only available on an 

annualized basis. With a conservative assumption of 15 missions per year, per event, 

statistics can be approximated from annual accident data (Table 5-6). 

TABLE 5-6. MISSION ESSENTIAL INDIVIDUAL CASUALTY RISK1

Activity/Source Per Event 2 Annual 3

Construction Workers 2.81 E-3 4.21E-2 

Agricultural Workers 2.2E-3 3.29E-2 

Government Workers 1.6E-3 2.40E-2 

Service Workers (police, firemen, etc.) 1.18E-3 1.77E-2 

Gulf War 2.01E-4 -- 

Machinery 6.4E-5 9.59E-4 

Commonality Criterion per Mission 10E-6 -- 

1. Data is compiled from various sources: Bureau of Labor Statistics, National Center for 

Health Statistics, State Vital Statistics Departments, State Industrial Commissions, 

National Electronic Injury Surveillance System, Consumer Product Safety Commission, 

National Center for Injury Prevention and Control, U.S. Census Bureau, and U.S. 

Department of Veterans Affairs. 

2. With the exception of the Gulf War, the per event statistics are derived from annual 

statistics by dividing the annual values by 15 to model the assumption of 15 missions per 

year. 

3. Risk is based on exposed population, which varies for each activity. 

 

70 UK Health and Safety Executive (HSE), “Reducing Risks, Protecting People: HSE’s Decision-Making Process,” 

ISBN 0 7176 2151 0, first published in 2001, page 44 

5-26
5.4 Rationale for Fatality Guideline Limits 

The fatality limits are essentially unchanged71 from RCC 321-02; however, these criteria 

are now a supplemental metric for the reasons discussed in paragraph 5.1.2. The rationale 

documented in the RCC 321-02 Supplement Chapter 3 that is applicable to those limits is still 

valid and is presented below. Use of annual risk limits for individuals was determined by the 

Risk Committee as not being practical or feasible since it is impossible to track the whereabouts 

of an individual from mission to mission in order to accumulate their risk. Therefore, annual 

individual risk limits are no longer used. The rationale for the unused annual fatality limits is 

still retained here because it provided useful information and data to support the remaining 

related criteria. 

Table 5-7 shows the supplemental fatality criteria for both the general public and mission 

essential/critical operations personnel. 

TABLE 5-7. MAXIMUM ACCEPTABLE FATALITY RISK TO PEOPLE 

Per Mission Criteria General Public Mission Essential 

Individual Probability of Fatality 0.1E-6 1E-6 

Expected Fatalities 30E-6 300E-6 

Annual Criteria 

Expected Fatalities 1000E-6 10000E-6 

5.4.1 General Public Annual Individual Risk (GPa: N/A PF). - NO LONGER USED

a. Prior Safety Criteria (GPa: N/A PF). The commonality criterion is comparable to 

historical data from the national ranges. The criterion reflects the same risk level that 

is used at the Eastern and Western Ranges (Table 5-8). 

TABLE 5-8. INDIVIDUAL ANNUAL RISK FOR THE GENERAL PUBLIC 

Range1 Annual Probability of Casualty 

Eastern Range 1E-6 

Western Range 1E-6 

Commonality Criterion 1E-6 (See note 2)

1. Table lists only ranges that have criteria in this category 

2. Probability of Fatality 

 

71 The Mission Essential individual probability of fatality limit was reduced from 3E-6 to 1E-6 to maintain the factor 

of 10 difference with the individual probability of fatality limit set for the public. 

5-27
b. Similar Regulatory Experience. (GPa: N/A PF) 

(1) Federal Statutes. Federal statutes provide numerous precedents for acceptable 

risk levels. These are documented in numerous technical papers. One such paper 

(Reference 5o) examined risk criteria employed as part of the regulatory 

procedures with twelve Federal statutes promulgated by the Department of Labor 

(DOL), Environmental Protection Agency (EPA), and the Food and Drug 

Administration (FDA) (Reference 5p). Eleven of the twelve consider individual 

risk in some manner.

 Individual risk is used as a criterion in two distinct ways. In some cases, 

such as OSHA, risk is used to trigger action by a regulatory agency. The second 

use targets allowable residual risk after implementation of a regulatory action. 

Table 5-9, "Summary of Individual Fatality Risk Criteria," presents information 

on a lifetime and annual basis, assuming a lifetime exposure of 70 years. The 

fourth column compares the debris risk standard to the risk criteria cited in the 

statutes. 

TABLE 5-9. SUMMARY OF INDIVIDUAL FATALITY RISK CRITERIA 

Affected Trigger Level Target Residual Level Debris Risk

Group (Lifetime) (Annual) (Lifetime) (Annual) (Annual) 

Public 1E-6 - 1E-4 1.4E-8 - 1.4E-6 1E-7 - 1E-4 1.4E-9 - 1.4E-6 1E-6 

(EPA, FDA) (EPA, FDA) 

(2) Regulating Carcinogens. A review of 132 regulatory decisions involving cancer 

risks for which numerical risk estimates were available found a correlation in the 

levels of acceptable risk (Reference 5q). The review focused on the decisions to 

regulate in relation to acceptable individual risk, population (collective) risk, and 

total population at risk. The risk measures used varied significantly among the 

132 cases and significant differences exist among the bases for the various risk 

estimates. Nevertheless, this review identified consistency in the apparent de 

minimis and de manifestis levels of concern underpinning the standards adopted. 

In the 132 cases studied, individual risks were "always" regulated when they rose 

above one in 12,500 (8E-5) per year and were regulated at lower risk levels when 

more than 10 cancers in the U.S. population per year were estimated. Individual 

risks were "never" regulated when they were below one in 500,000 (2E-6) 

annually and estimated cancers in the U.S. population remained fewer than about 

one in 20 years (5E-2 annual). The levels of protection provided by the debris 

standard are consistent with the foregoing de manifestis level. In some cases, 

because of the high visibility of a debris producing event, the debris standard is 

more conservative than the de minimis level. 

(3) `British Ministry of Defense. The British Ministry of Defense has adopted a de 

manifestis individual risk standard of 1E-6 per year for fatalities from operation of 

explosive storage facilities. For these same facilities the de minimis individual 

5-28
risk standard is 1E-8 per year. The United Kingdom Department of the 

Environment has stated that a risk of 1E-6 per year (individual risk) of serious 

health effects is acceptable. 

(4) Dutch Acceptable Risk Standards. The acceptable risk standards used by Dutch 

industries for public individual fatality risk are 1E-6 per year for established 

nuclear power plants and chemical industries, and 1E-8 per year for future nuclear 

power plants. 

(5) Israeli Ministry of Defense. The Israeli Ministry of Defense uses a directly 

comparable standard for maximum annual individual fatality risk from launch 

operations for the non-participating, uninformed general public is 1E-5; higher 

risk levels are tolerated for nonparticipating, uninformed workers in industrial 

facilities. 

c. Comparable Accident Statistics and Background Risk Levels (GPa: N/A PF). An 

assumption was made that individuals who are not mission essential should not incur 

a higher risk of fatality than risk experienced by the general population at home or in 

public. To facilitate evaluation of the criterion for risk to other personnel, 

comparisons are made to two categories from the accident database. Table 5-10 

shows data on accidents occurring in public and Table 5-11 shows data on accidents 

in the home. These comparisons show that the commonality standard maximum risk 

to an individual other than essential is significantly less on an annual basis than the 

risks from accidents occurring in the home or in public. 

TABLE 5-10. FATALITIES DUE TO ACCIDENTS IN PUBLIC 

Individual Probability of Fatalitya Public Event 

Average Annually 

Falls 1.61E-05

Drowning 8.44E-06

Firearms 2.30E-06

Fires and burns 7.67E-07

Air transport 3.45E-06

Water transport 2.68E-06

Railroad 2.30E-06

Other transport 1.15E-06

All other publicb 3.84E-05

Total 7.56E-05

a. Based on total 1994 U.S. population of 260,711,000. 

b. Includes: medical complications, excessive heat/cold, suffocation by ingestion, and poisoning, etc. 

Note: Criterion for general public (Maximum) = 1.0E-6

5-29
TABLE 5-11. FATALITIES DUE TO ACCIDENTS IN THE 

HOME 

Home Event a Individual Probability of Fatalityb

Average Annually 

Falls 3.26E-05 

Poisoning by solids and liquids 2.45E-05 

Poisoning by gases and vapors 1.92E-06 

Fires and burns 1.50E-05 

Suffocation-ingested object 5.37E-06 

Suffocation-mechanical 2.68E-06 

Firearms 3.45E-06 

Drowning 3.45E-06 

All other home c 1.34E-05 

Total 1.02E-04 

a. Includes: medical complications, excessive heat/cold, suffocation by ingestion, and 

poisoning,. 

b. Based on total 1994 U.S. population of 260,711,000. 

c. Includes: electric current, explosive materials, hot substances, corrosive liquid, and 

steam. 

Note: Data obtained from the 1995 National Safety Council, Accident Facts: 1995 Ed., 

Itasce, IL Accident Facts were used to calculate the risk of several accidents on 

an annual basis. 

Note: Criterion for general public (Maximum) = 1.0E-6

d. Legal Considerations (GPa: N/A PF). Risks are reasonable, and in the same range as 

the de manifestis level used by other agencies. Table 5-12 is a summary of the annual 

public fatality risk based on existing regulations used by the U.S. and foreign 

countries.

TABLE 5-12. SUMMARY OF U.S. AND FOREIGN ANNUAL FATALITY RISK 

CRITERIA 

De Minimis De Manifestis Commonality Standard

Individual Risk 

(Public) 

1.4E-9a - 2E-6b

1E-8c

1.4E-8a

 - 1E-6a,d

1E-6c 1E-6 

a. Environmental Protection Agency 

b. Regulatory carcinogen study 

c. Clusters around this value 

d. British and Dutch 

5-30
5.4.2 General Public Individual Risk Per Mission (GP: 0.1E-6 PF). 

a. Prior Safety Criteria (GP: 0.1E-6 PF). The commonality criterion is consistent with 

historical data from the national ranges. Currently the majority of the ranges protect 

for a probability of casualty of 1E-6. The commonality criterion protects against 

fatality; however, the risk level is an order of magnitude lower than that afforded to 

casualty. Therefore, consistency is maintained. Table 5-13 shows individual mission 

risk for the general public. 

TABLE 5-13. INDIVIDUAL MISSION RISK FOR THE GENERAL PUBLIC (AS OF 

2006) 

Rangea Individual Probability of Casualty 

Eastern Range 1E-6 

Eglin AFB 1E-6 

NASA – Wallops Flight Facility 1E-6 

NAWC – Point Mugu 1E-7

Pacific Missile Range Facility 1E-7 

Reagan Test Site 1E-6 

Western Range 1E-6 

 E-6 White Sands Missile Range b

RCC 321-06 Standard Criterion for PF 1E-7c

a. Table lists only ranges that have criteria in this category. 

b. Probability of one or more casualties. 

c. Probability of fatality. 

b. Similar Regulatory Experience. (GP: 0.1E-6 PF). There are few types of regulatory 

experience other than range safety that address risks related to single events, such as 

launch, in contrast to ongoing operations of a facility. By extension, the annual 

regulatory experience cited in paragraph 5.4.1b justifies the maximum per mission 

risk. 

c. Comparable Accident Statistics and Background Risk Levels (GP: 0.1E-6 PF). 

Comparable accident statistics for this category are difficult to find because most 

accident statistics are given on an annualized basis. 

d. Legal Considerations (GP: 0.1E-6 PF). Risks are reasonable. This criterion is below 

the de minimis level; however, the potential high visibility warrants the standard. 

5.4.3 General Public Collective Risk Per Mission (GP: 30E-6 EF). 

a. Prior Safety Criteria (GP: 30E-6 EF). The numerical values for the maximum 

acceptable individual and collective fatality risks presented in Chapter 3 of the 

Standard are identical to those established previously by the RCC (See RCC 321-02). 

5-31
 However, the updated fatality risk criteria in Chapter 3 of the Standard limit the 

risks from all hazards throughout a mission, and not just the inert debris risks limited 

previously. The current Standard clearly provides more comprehensive protection 

than the previous criteria because the same fatality risk limits now apply to the 

aggregated risks from all types of hazards associated with a range activity, not just 

the inert debris hazard. Therefore, the rationale used for the previous fatality risk 

criteria still applies to the updated criteria from a safety perspective. In addition, past 

experience shows that the fatality risks posed by typical range hazards are small 

relative to those posed by inert debris. For example, Table 5-14 lists the typical ratio 

of fatality expectation to casualty expectation for the dominant range hazards often 

addressed by risk management. Therefore, it is reasonable and rational to set fatality 

risk limits for the total risks posed by a mission using the same numerical values as 

those previously established for inert debris only. 

TABLE 5-14. TYPICAL RATIO OF EXPECTED FATALITIES TO CASUALTIES 

Hazard Scenario Range of EF / EC

Large inert debris impacts 0.6 to 0.8 

Explosive and inert debris impacts 0.1 to 0.8, 0.25 typical 

Distant Focusing Overpressure (DFO) 0.001 to 0.03, 0.01 typical 

Solid rocket propellant toxic release 0.001 typical 

Notes: *These are based on AIS level 3 threshold for casualty. 

 *These results are based on various mixtures of sheltering levels. 

The commonality criterion is comparable to historical data from the national ranges. 

Recognizing that the RCC criterion now apply to additional hazards besides inert debris, the 

criterion reflect the same or very similar risk levels used by four of the ranges (Table 5-15). 

TABLE 5-15. COLLECTIVE MISSION RISK FOR THE 

GENERAL PUBLIC 

Rangea Expected Casualties Per Mission 

Eastern Range 3E-5 

Eglin AFB 1E-5 to 1E-6 

Kwajalein Missile Range 1E-6 

NASA - Wallops Flight Facility 1E-6 

Western Range 3E-5 

Commonality Criteria for EF 3E-5b

a. Table only shows ranges that have criteria in this category. 

b. Expected Fatalities.

5-32
b. Similar Regulatory Experience. (GP: 30E-6 EF). Few types of regulatory experience 

(other than range safety) address risks related to single events, such as a launch, as 

opposed to ongoing facility operations. Existing precedents are provided on an 

annual basis. 

c. Comparable Accident Statistics and Background Risk Levels (GP: 30E-6 EF). 

Comparable accident statistics are difficult to find because ranges are event-oriented, 

whereas industries have continuous operations. If aircraft operating for a day are 

compared to a single operation at a range, then the following information can be used 

for comparison: 

(1) Risk to People on the Ground from Commercial Aircraft. Accident data from the 

period 1980 to 1995 were analyzed to determine the average fatality rate 

(fatalities per departure) to people on the ground for air carriers and general 

aviation (Reference 5r). The average fatality rates for this group of people were 

6E-7 per departure for air carriers and 3E-7 for general aviation. These average 

fatality rates were used in conjunction with published numbers of air carrier and 

general aviation operations (based on the assumption that each flight was counted 

as two operations – a landing and a departure) for FY93 to produce collective risk 

estimates to people on the ground in the areas adjacent to several sizes of airports. 

The results are shown in Table 5-16. This indicates that the launch day risk of 

living near a facility is similar to the everyday risk of living near a small airport 

and an order of magnitude less than the daily risk of living near a major airport. 

A more in depth analysis of the risks to people on the ground from civil aviation 

is presented in paragraph 5.8. 

TABLE 5-16. RISK TO PEOPLE ON THE GROUND FROM COMMERCIAL 

AIRCRAFT AND GENERAL AVIATION 

Number of Departures (1993) 

Airport Air Carrier Gen. Aviation Collective Fatality Risk 

Los Angeles, CA 3.1E+5 2.5E+4 ~5E-4 per day 

Orlando, FL 1.5E+5 1.2E+4 ~3E-4 per day 

Melbourne, FL 1.0E+4 9.6E+4 ~9E-5 per day 

Santa Maria, CA 9.4E+3 3.2E+4 ~4E-5 per day 

(2) Internal Consistency (GP: 30E-6 EF). This criterion correlates with and is 

supported by other criteria in this category as shown in Figure 5-1. 

(3) Legal Considerations. (GP: 30E-6 EF). Risks are very reasonable. This criterion 

is well below the de minimis level for collective protection; however, the potential 

high visibility warrants the standard. 

5-33
5.4.4 General Public Annual Collective Risk (GPa: 1000E-6 EF). 

a. Prior Safety Criteria (GPa: 1000E-6 EF). The commonality guideline is comparable 

to historical data from the national ranges. Recognizing that the RCC guideline is 

now applicable to additional hazards besides just inert debris, the guideline reflects a 

risk level similar to that used at the Eastern and Western Ranges. Table 5-17 shows 

the collective annual risk for the general public. 

TABLE 5-17. COLLECTIVE ANNUAL RISK FOR THE GENERAL PUBLIC 

Rangea Annual Expected Casualties 

Eastern Range 1E-3 

Western Range 1E-3 

Commonality Criterion for EF 1E-3b

a. Table lists only ranges that have criteria in this category. 

b. Expected Fatalities.

b. Similar Regulatory Experience. (GPa: 1000E-6 EF). At the federal level, only the 

Nuclear Regulatory Commission (NRC) has considered numerical risk criteria for 

limiting annual collective risk. Their criterion protect large masses of people from 

effects of invisible radiation and are therefore very conservative. More applicable 

criterion have been identified at the foreign and local level as follows: 

(1) Hong Kong. Hong Kong has adopted acceptable public fatality risk profile 

standards for facilities storing hazardous materials. The de minimis annual 

collective risk standard is 7E-5; the de manifestis value is 7E-3. 

(2) Dutch Acceptable Risk Standards. The acceptable risk standards used by Dutch 

industries for collective public annual fatality risk are 1.1E-3 per year for 

established nuclear power plants and chemical industries, and 1.1E-5 per year for 

future nuclear power plants. 

(3) British Ministry of Defense. The British Ministry of Defense has adopted a 

de manifestis collective fatality risk standard of 6E-3; the de minimis collective 

fatality risk standard is 6E-5. 

(4) Santa Barbara County. The County of Santa Barbara in California uses risk based 

guidelines for review of petrochemical facilities. The maximum annual societal 

fatality risk to the general public surrounding a facility under these guidelines is 

1E-3; additional constraints are imposed on the probability of any specific 

number of fatalities per year. 

c. Comparable Accident Statistics and Background Risk Levels (GPa: 1000E-6 EF). 

(1) Risk to People on the Ground from Commercial Aircraft. Accident data from the 

period 1980 to 1995 were analyzed to determine the average fatality rate 

(fatalities per departure) to people on the ground for air carriers and general 

aviation (Reference 5r). The average fatality rates for this group of people were 

5-34
6E-7 per departure for air carriers and 3E-7 for general aviation. These average 

fatality rates were used in conjunction with published numbers of air carrier and 

general aviation operations (based on the assumption that each flight was counted 

as two operations – a landing and a departure) for FY93 to produce collective risk 

estimates to people on the ground in the areas adjacent to several sizes of airports. 

The results are shown in Table 5-18. 

TABLE 5-18. RISK TO PEOPLE ON THE GROUND FROM COMMERCIAL 

AIRCRAFT AND GENERAL AVIATION 

Number of Departures (1993) 

Airport Air Carriers Gen. Aviation Collective Fatality Risk 

Los Angeles, CA 3.1E+5 2.5E+4 ~0.2 per year 

Orlando, FL 1.5E+5 1.2E+4 ~0.09 per year 

Melbourne, FL 1.0E+4 9.6E+4 ~0.03 per year 

Santa Maria, CA 9.4E+3 3.2E+4 ~0.02 per year 

(2) Comparative Public Risks due to Military Aircraft Operations. Risks to the 

general public from military aircraft crashes were estimated for five 

“representative” Air Force bases selected on the basis of relatively large numbers 

of aircraft operations and their having relatively large nearby populations 

(Reference 5s). The assessment is based on accident data for the years 1977 

through 1981, and on models addressing aircraft crash frequency by runway 

angular sector and representative aircraft crash area. Table 5-19 summarizes 

these results. 

TABLE 5-19. CASUALTY RISK TO GENERAL PUBLIC 

Air Force Base (AFB) Annual Collective Risk 

March AFB 0.004 

Mather AFB 0.02 

McClellan AFB 0.1 

Nellis AFB 0.2 

Sheppard AFB 0.01 

Average 0.07 

(3) Aviation Risk in the Cape Canaveral Air Station (CCAS) Area. A study was 

performed to assess the PL81-60 (discussed in paragraph 5.3.1c) risks for the 

Eastern Range (Reference 5t). The risks from general aviation and military 

aviation flights over the region for both on and off-base were quantified. Air 

5-35
carrier operation risk was omitted because this risk was assessed to be negligible 

in comparison to general aviation and military aviation risks. 

 The risk estimates used the same population database as in launch risk 

analyses, with one exception: the transient population at the viewing stand or on 

the causeway during a launch was excluded. Moreover, methodologies for 

quantifying risk were, whenever possible, selected to parallel the methodologies 

used for quantifying launch risk. Because these risk estimates were being used to 

quantify a standard for acceptable launch risk levels, the analysis assumptions 

which could not be totally resolved were addressed one of two ways; either 

assumptions were treated so as to underestimate risks from aircraft over-flight or 

they were treated parametrically. 

 Thus, the study resulted in an estimate of annual collective casualty risk to the 

off-base populations ranging from 1.8E-2 to 8.8E-2. These results have been 

interpreted as providing a limit for risk to the general public but being of marginal 

relevance to worker risk. However, the text of the legislative history is not seen 

as addressing risk to essential workers. 

(4) Studies on Acceptable Collective Risks in the United Kingdom. Multiple fatality 

fire occurrence data from the United Kingdom, United States, and worldwide 

were examined to formulate a basis for an acceptable fatality risk criterion in the 

chemical and process industry (Reference 5u). 

 This study asserts that the acceptable level of societal risk is related to the size 

of the affected group. It bases this assertion on precedents in the requirements for 

design of different types of structures and on reasonableness of risk allocation. 

For a community of 100,000 people in the vicinity of the range, this criterion is 

equivalent to an annual (collective) fatality expectation of 6E-3, a collective risk 

level comparable to Commonality Standard 321-02. For the current (estimated 

November 1, 1996) United States population of 266E+6, this corresponds to a 

national collective risk criterion of 16, a value remarkably close to the acceptable 

national collective risk level of 10, above which allowable individual risk criteria 

are reduced for the purpose of regulating carcinogens. 

d. Internal Consistency (GPa: 1000E-6 EF). This criterion correlates with other criteria 

in this category as shown in Figure 5-1. 

e. Legal Considerations (GPa: 1000E-6 EF). This criterion is very reasonable. "One 

death in a millennium," while not exactly precise, is a useful way to think of this 

standard. 

5-36
Table 5-20 provides a summary of the collective annual risk for the public. The 

data was taken from a summary of the entire body of existing regulations used by the 

U.S. and foreign countries. 

TABLE 5-20. SUMMARY OF U.S. AND FOREIGN ANNUAL FATALITY RISK 

CRITERIA 

De Minimis De Manifestis 

Commonality 

Criterion 

Collective Risk 

(Public) 

1.1E-5a - 5 E-2b

1.1E-5c

2E-6d

 – 10b

1.1E-3c 1E-3 

a. Santa Barbara County. 

b. Regulatory carcinogen study. 

c. Clusters around this value. 

d. Nuclear Regulatory Commission. 

5.4.5 Mission Essential Individual Risk per Mission (ME: 1E-6 PF). 

a. Prior Safety Criteria (ME: 1E-6 PF). Four of the national ranges have used criteria in 

this category. The commonality criterion protects against fatality; however, the risk 

level is half an order of magnitude lower than that afforded to casualty by the 

majority of the ranges. Therefore, consistency is maintained. Table 5-21 provides 

this data. 

TABLE 5-21. INDIVIDUAL MISSION RISK FOR MISSION ESSENTIAL 

PERSONNEL 

Rangea Individual Probability of Casualty 

Eastern Range 1E-5 

NAWC - Point Mugu 1E-6 

Western Range 1E-5 

1E-5 White Sands Missile Range b

Commonality Criterion for PF 1E-6c

a. Table lists only ranges that have criteria in this category. 

b. Probability of one or more casualties. 

c. Probability of fatality. 

b. Similar Regulatory Experience. (ME: 1E-6 PF). Few types of regulatory experience, 

other than range safety, address risks related to single events such as a launch, in 

contrast to the risks related to ongoing facility operations. 

5-37
One directly comparable regulatory requirement lies within the Israeli criterion 

for defense community personnel participating in a test. The Israeli Ministry of 

Defense derives the allowable individual risk per test based on the planned number of 

tests per year and an annual criterion. 

c. Comparable Accident Statistics and Background Risk Levels (ME: 1E-6 PF). The 

commonality criterion for voluntary risk is comparable to other voluntary risks taken 

everyday in the U.S. For example, the number of automobile deaths per 200 miles is 

3.6E-6 and the number of deaths per 200-mile trip in a private plane is 3.4E-5. 

d. Internal Consistency (ME: 1E-6 PF). Mission essential criteria, as a group, relates to 

general public at one order of magnitude higher risk. In addition, mission essential 

criteria correlate to each other, as shown in Figure 5-1. 

e. Legal Considerations. (ME: 1E-6 PF). The criterion is reasonable. It is near the 

de minimis level. 

5.4.6 Mission Essential Annual Individual Risk – NO LONGER USED (MEa: N/A PF) 

a. Prior Safety Criteria (MEa: N/A PF). Prior use at national ranges has been limited 

and inconsistent. To maintain reasonableness and consistency, an annual PF of 3E-5 

is the commonality criterion. 

b. Similar Regulatory Experience (MEa: N/A PF). 

(1) Occupational Safety and Health Administration. The U.S. Department of Labor, 

Occupational Safety and Health Administration, must regulate chemical risks 

when it can show that they pose a "significant risk." In the benzene Supreme 

Court decision (Industrial Union Department vs. American Petroleum Institute, 

488 U.S. 607 (1980)), Justice Stevens stated that "if the odds are one in a 

thousand..., a reasonable person might well consider the risk significant..." Based 

on a working lifetime of forty years, this translates into an annual individual risk 

of 2.5E-5. 

(2) Israeli Ministry of Defense. The Israeli Ministry of Defense uses an annual 

individual risk criterion of 1E-3 for mission essential workers. 

c. Comparable Accident Statistics and Background Risk Levels (MEa: N/A PF). The 

adopted maximum risk criterion compares favorably to actual average risk in other 

occupations. 

 The assumption is made that individuals who work as mission essential personnel 

on the range recognize and accept an inherent associated risk. This assumption 

allows direct comparison with the occupations in Table 5-22. This table illustrates 

that the maximum acceptable annual risk for any single individual is comparable to 

the average actual risk from a variety of industries. 

5-38
TABLE 5-22. OCCUPATIONAL FATALITIES 

Annual Probability of Fatality Per Person 

Industry (Averages) Dept. of Labora 1994 Accident Factsb

Agriculture 2.40E-04 2.60E-04 

Mining, quarrying 2.70E-04 2.70E-04 

Construction 1.50E-04 1.50E-04 

Manufacturing 4.00E-05 4.00E-05 

Transportation and public utilities 1.30E-04 1.20E-04 

Trade 1.00E-04 2.00E-05 

Services 3.00E-05 2.00E-05 

Government 3.00E-05 3.00E-05 

All Industries (Avg.) 5.00E-05 4.00E-05 

Commonality Criterion for Mission Essential Personnel (Maximum) = 1.0E-04 

a. U.S. Department of Labor, Bureau of Labor Statistics, Census of Fatal Occupational Injuries, 1994. 

b. Accident Facts, 1994 Edition, National Safety Council. 

d. Legal Considerations. (MEa: N/A PF). Risks are reasonable based on comparison of 

other regulations, accident experience, and other criteria. 

5.4.7 Mission Essential Collective Risk Per Mission (ME: 300E-6 EF) 

a. Prior Safety Criteria (ME: 300E-6 EF). Most ranges use this type of criterion. The 

commonality guideline is comparable to historical data from the national ranges. 

This is an important guideline to ranges because it is used by range safety 

organizations to help limit the total number of personnel exposed to any given 

mission. The guideline reflects the same or similar risk level to that used at four of 

the ranges as shown in Table 5-23. 

TABLE 5-23. COLLECTIVE MISSION RISK FOR MISSION ESSENTIAL 

PERSONNEL 

Rangea Expected Casualties Per Mission 

Eastern Range 3E-4 

Eglin AFB 1E-4 to 1E-5 

Kwajalein Missile Range 1E-5 

Wallops Flight Facility 1E-5 

Western Range 3E-4 

Commonality Criterion for EF 3E-4b

a. Table lists only ranges that have criteria in this category. 

b. Expected fatalities.

5-39
b. Similar Regulatory Experience. (ME: 300E-6 EF). Few types of regulatory 

experience, other than range safety, address risks related to single events such as a 

launch, in contrast to ongoing facility operations. Existing precedents are provided 

on an annual basis. 

c. Comparable Accident Statistics and Background Risk Levels (ME: 300E-6 EF). 

Comparable accident statistics are difficult to find because ranges are event-oriented, 

whereas industries have continuous operations. 

d. Internal Consistency (ME: 300E-6 EF). A primary rationale for this criterion is its 

correlation to the single test criterion for individual mission essential personnel. 

e. Legal Considerations. (ME: 300E-6 EF). Risks are reasonable, they are significantly 

below de minimis level. 

5.4.8 Mission Essential Annual Collective Risk (MEa: 10000E-6 EF) 

a. Prior Safety Criteria (MEa: 10000E-6 EF). The commonality guideline is comparable 

to historical data from the national ranges. Recognizing that the RCC guideline is 

now applicable to additional hazards besides just inert debris, the guideline reflects a 

similar risk level as that used at the Eastern and Western Ranges. Table 5-24 shows 

collective annual risk for mission essential personnel. 

TABLE 5-24. COLLECTIVE ANNUAL RISK FOR MISSION ESSENTIAL 

PERSONNEL 

Rangea Annual Expected Casualties 

Eastern Range 1E-2 

Western Range 1E-2 

1E-2b Commonality Criteria for EF

a. Table lists only ranges that have criteria in this category. 

b. Expected fatalities.

b. Similar Regulatory Experience. (MEa: 10000E-6 EF). Limited regulatory precedents 

have been found in this category, including the following: 

(1) British Ministry of Defense. The British Ministry of Defense applies a collective 

risk criterion of 6E-3 per year to all people (workers and surrounding populations) 

at explosive manufacturing facilities. 

(2) Santa Barbara County. The county of Santa Barbara in California uses risk-based 

guidelines to review petrochemical facilities. Under these guidelines, the 

maximum annual societal fatality risk to workers at a facility is 1.1E-1; additional 

constraints are imposed on the probability of any specific number of fatalities per 

year. 

5-40
(3) Israeli Ministry of Defense. The annual collective fatality risk for mission 

workers in Israel (assumed to involve 10 tests) may be as high as 2E-2. 

c. Comparable Accident Statistics and Background Risk Levels (MEa: 10000E-6 EF). 

Collective risk is small relative to other industries. 

d. Internal Consistency (MEa: 10000E-6 EF). An important rationale for this number is 

its correlation to the single test criterion. This guideline also reflects the 

multiplicative effect of other conservative criteria (e.g., few people x low risk per 

event x few discrete events = very low collective risks). 

e. Legal Considerations. (MEa: 10000E-6 EF). Risks are very small. They are well 

below the de minimis level. "One death in a hundred years" is a useful way to 

consider this criterion.

5.5 Rationale for Catastrophic Risk Criteria 

 The RCC Document 321-07 has several key issues that bear repeating. Paragraph 2.2 of 

the Standard includes a policy objective statement that “the risk of a catastrophic mishap should 

be mitigated.” Paragraph 3.6 recommends “catastrophic risk criteria are designed to protect 

against scenarios involving numerous casualties” by facilitating the identification of scenarios 

that exceed these criteria and implementation of practical mitigations. The criteria were 

established primarily to mitigate the potential for catastrophes involving transportation systems, 

but they also have practical application for safety planning to protect people in the vicinity of the 

launch point. The catastrophic risk acceptability criteria presented in Chapter 3 address the fact 

that “surveys repeatedly confirm that accidents involving multiple fatalities on public transport 

are less socially acceptable than accidents involving private road transport,”72 which rarely 

involve large numbers of casualties. The European approach to governing land use in the 

vicinity of an airport based on individual risks alone has been criticized because “in any other 

industry tolerability is established on the basis of probabilities falling as the potential number of 

casualties increases.”73 While that criticism may not be entirely valid,74 the RCC endorses the 

catastrophe aversion incorporated into the criteria presented in paragraph 3.6 of the Standard 

because criteria solely based on casualty expectation and individual probability of casualty 

appear indifferent to the fact that accidents involving many casualties are perceived by the public 

as disproportionately more objectionable than those involving a few casualties. Furthermore, 

implementation of the catastrophic risk criteria in Chapter 3 should help a range refute potential 

criticism of using collective risk limits without complete quantification of uncertainty. 

 

72 Grayling T, and Bishop S., Sustainable Aviation 2030, Institute for Public Policy Research, August 2001, p. 40 73 Aviation Environment Federation, Public Safety Zones, Current Policy and the case for Change, www.aef.org.uk 74 Neither the Dutch nor UK Governments intend to relate the planning zones at runway ends to levels of risk 

measures that overtly account for society’s aversion to accidents with multiple fatalities and/or injuries because a) 

some argue that such risk criteria are not well developed in the land-use planning field, and b) “the proposed zones 

are intended to limit the exposure of large numbers of people, thereby controlling and minimizing” the risk of 

accidents with multiple fatalities and/or injuries. See Davies and Quinn, Public Safety Zones: Cork, Dublin, and 

Shannon Airports, February 2005, page B3. 

5-41
In this supplement, catastrophe aversion limits are defined by the general formula, 

 P × N1.5 ≤ Criterion 

 where 

P is the cumulative probability of all events capable of causing N or 

more casualties. 

N is the number of casualties associated with a scenario. 

Criterion is the maximum allowable collective risk for the event with various 

scenarios as feasible outcomes. 

Paragraph 3.6 of the Standard recommends a risk criterion of 1E-4 for the general public, 

and 3E-4 for mission essential and critical operations personnel. The above formula is used to 

define the recommended catastrophe aversion criteria, but is not used to indicate how to compute 

the potential for catastrophic outcomes. Paragraph 4.3 provides guidelines designed to facilitate 

evaluation of catastrophe potential. 

The form of this catastrophe aversion criterion was chosen after a review of several 

catastrophe averse models used by U.S. agencies and other agencies around the world. 

Figure 5-4 summarizes the various methods reviewed during the development of this standard.75 

The line showing indifference to catastrophe in Figure 5-4 reflects no special concern for 

multiple casualties, i.e. no catastrophe aversion. Criteria based on casualty expectation and 

individual risks contain no catastrophe aversion. 

 

75 Most of the methods shown are summarized in the risk analysis approaches by different countries in the NATO 

Allied Ammunition Storage and Transport Publication, NATO – AASTP-4, which was prepared by NATO AC/258, 

Risk Analysis Working Group (RAWG). 

5-42
1

10

100

1000

10000

1 10 100

Indifferent to

catastrophe, N’ = N

N’ = N1.5

N’ = 320+16(N-20) for N>20

N’ = N×2N//5 for N≤20,

N’ = N2

N’ = N×2N//5

N – number of people in pop. center

N’ – Pseudo N in order to be 

catastrophe averse 

Figure 5-4. Comparison of methods that are used to introduce catastrophe aversion 

into the risk analysis. 

The Netherlands, both for industrial risk and explosive storage risk, has used the most 

catastrophe averse formula: P × N2 ≤ criterion. This approach has also been used by the County 

of Santa Barbara in California (the location of Vandenberg Air Force Base (VAFB), although 

never imposed upon VAFB). This is represented by the line representing N’=N2

 in Figure 5-4. 

The curves in Figure 5-4 that use the factor 2N/5 are employed in Switzerland, Norway, 

and Sweden for handling risk due to potential explosions of stored, transported, or processed 

explosives. The Swiss modify the curve above N=20 so that it increases linearly with N and 

does not continue to rise so dramatically. 

 The RCC selected N1.5 to incorporate a reasonable level of catastrophe aversion into the 

risk acceptability criteria. Figure 5-4 shows the RCC criteria in the center between no 

catastrophe aversion and the most conservative N2

. The RCC catastrophic risk criterion is 

similar to those that use of the factor 2N/5 method for N<10 and less restrictive for N>10. 

Specifically, the RCC catastrophic risk criterion does not impose unreasonable conservatism 

with respect to large population centers, such as commercial aircraft or some ships, where a 

catastrophic accident could lead to numerous casualties. For instance, the value of N’ for an 

aircraft carrying 400 people is (400)1.5 = 8000, which would inflate the pseudo-EC or pseudo-EF

(described in paragraph 4.3) by a factor of 20. 

5-43
5.6 Rationale for Aircraft and Ship Risk Management Requirements 

5.6.1 Introduction. Previous versions of this standard limited the fatality risks (both individual 

and collective) from inert debris to people in transportation systems such as ships or aircraft. 

The revised standard applies the same numerical limits on fatality risks as supplemental criteria 

to protect against all hazards to the general public and essential personnel.76 The standard also 

now endorses casualty as the primary consequence metric to ensure reasonable risks. Previous 

sections provide the rationale for the use of casualties as the primary consequence metric, the 

selection of 1E-6 probability of casualty to limit the risk to individual members of the general 

public and the selection of 100E-6 expected casualties to limit the collective risk to the general 

public. 

 Previous versions of this standard defined ship hazard areas based on the probability of 

impact (PI) by “debris capable of causing a catastrophic accident,” and aircraft hazard areas 

based on the PI from “debris capable of causing a fatal accident.”77 Such PI limits are commonly 

used at the ranges as a generally convenient means to protect people in these transportation 

systems from unreasonable catastrophic risks. However, PI limits are indirect and imprecise 

means to set limit risks. The primary shortcoming is that PI limits fail to limit the precise 

consequences that are onerous because of the extreme variability in the vulnerability of various 

ships or aircraft to debris impacts. For example, “debris capable of causing a fatal accident” 

with a highly vulnerable aircraft (such as certain types of helicopter) is unlikely to have much 

effect on a commercial transport aircraft. Thus, aircraft hazard areas based on the 1E-7 PI limit 

and the minimum debris characteristics (mass, material, etc) “capable of causing a fatal accident” 

can produce overly conservative restrictions for air traffic or range activities. Therefore, PI

limits such as those specified in Sections 3.3 and 3.4 of the Standard, whether combined with 

conservative or non-conservative debris thresholds, are not always the best way to ensure the 

safety of the traveling public. While the revised standard continues to endorse the use of PI

limits as convenient and efficient means to define hazard areas for ships and aircraft, ranges now 

have an option to use explicit catastrophic risk criteria to ensure the safety of people in any sort 

of transportation system. 

 The revised Standard provides greater flexibility by setting direct limits on aggregated 

risks, instead of the previous approach of defining ship and aircraft hazard areas based on PI

limits. Section 5.1.1 provides the rationale for aggregated risk limits, and the same logic applies 

to extending those limits to account for exposed populations in ships or aircraft. Such 

aggregated risk limits provide the maximum flexibility for the management of risks to various 

exposed populations, including those in various transportation modes. The probability of impact 

limits intended to constrain the catastrophic risks posed to people on-board ships or aircraft, in 

combination with the hazard thresholds and vulnerability models in Chapter 6 of this 

Supplement, are often convenient and efficient means to define hazard areas as discussed below. 

However, setting limits on the aggregated risk to all exposed populations allows more 

 

76 The term “essential personnel” is used here to refer to mission essential and critical operations personnel, which 

are formally defined in the glossary, 

77 See RCC 321-02 paragraphs 3.2.1 and 3.3.1.2. 

5-44
sophisticated methods to ensure reasonable risks with potentially fewer restrictions on ship or air 

traffic. 

5.6.2 Qualitative Standard for Aircraft and Ship Risk Management Requirements. People 

ordinarily accept a wide range of risks depending on their perception of the risks and benefits. 

During the development of risk related policies, experts have noted that people generally accept 

higher risks if those risks are perceived to be voluntary, familiar, natural, under their control,78

fairly distributed, not threatening to children, and devoid of catastrophic potential (References 

5v, 5w, and 5x). These “outrage factors” suggest that people are likely to be relatively intolerant 

of accidents/risks from range activities, which are typically involuntary, exotic, man-made, 

beyond individual control, potentially catastrophic, likely to capture a great deal of media 

attention, etc. However, the main point here is that people are far less tolerant of risks that are 

imposed on them without any form of consent (i.e. involuntary risks) or any sense of benefit 

from the source of risk (References 5n and 5x). 

 In establishing a federal law to define acceptable flight risk limits for launches, the FAA 

noted that “commercial launches should not expose the public to risk greater than normal 

background risk, which the FAA defined in its Notice of Proposed Rulemaking (NPRM) as those 

risks voluntarily accepted in the course of normal day-to-day activities” (Reference 5f). Other 

organizations have also used “normal background” risks, particularly from other types of 

accidents, as important benchmarks for acceptable risks in a variety of fields (References 5k and 

5v). 79,80,81 

 In light of the distinctly different tolerance of voluntary and involuntary risks, and the 

general principle that acceptable risk levels should be correlated with background risks, the RCC 

endorses the following qualitative standard as a guideline for the development and 

implementation of range requirements: 

For any individual uninvolved in the mission, but participating in a voluntary activity that 

increases their background risk (such as traveling in an aircraft or waterborne vessel), the 

chances of casualty resulting from the mission should be less than the background risk 

associated with the voluntary activity. 

5.6.3 Rationale for Limits on Probability of Impact to Aircraft. The established practice at 

most national ranges is to allow no risk to any aircraft from launch operations by using 

containment areas. Normally, containment is achieved by constraining operations or by closing 

air lanes through agreements with the Federal Aviation Administration (FAA). A notable 

exception to this policy is the risk to which general aviation was subjected during the tests of the 

Surface-Launched Cruise Missile (SLCM) and the Air-Launched Cruise Missile (ALCM). 

 

78 People tend to be more sensitive to risks, even voluntarily accepted risks, when someone else is in control, such 

as flying in an airplane piloted by someone else, and less concerned about risks when they feel in control, such as 

driving in an automobile. 

79 See AFSPCMAN 91-710 paragraph A4.3 

80 See Nuclear Regulatory Safety Policy Goals in Federal Register, Vol. 51, August 21, 1986, page 28044 

81 UK Health and Safety Executive (HSE), “Reducing Risks, Protecting People: HSE’s Decision-Making Process,” 

ISBN 0 7176 2151 0, first published in 2001. 

5-45
Another exception involves exoatmospheric intercepts from ballistic missile defense (BMD) 

tests that have some potential for spreading extremely small particles of debris across a wide 

area. For these exceptions, a risk assessment is appropriate. 

A significant consideration in establishing this standard is the size of the fragment that 

could hazard aircraft. The standard is based on the probability of impact with “debris capable of 

producing a casualty” for ships and aircraft, and a more stringent standard of “debris capable of 

causing a catastrophic accident” for ships. The thresholds given in Chapter 6 should be used to 

define “debris capable of producing a casualty” and “debris capable of causing a catastrophic 

accident” as described in Chapter 4. This approach results in a standard that is conservative 

since many impacts by debris near the thresholds defined in Chapter 6 of this Supplement are 

unlikely to cause casualties. 

a. Limit of 1E-7 Probability of Impact for Non-mission Aircraft. Limiting non-mission 

aircraft to regions where the probability of impact with debris capable of producing a 

casualty does not exceed 1E-7 will demonstrate compliance with the qualitative 

standard described in Section 5.6.2. Data from the NTSB aviation accident database 

indicates that there was an average of eight fatal accidents on U.S. air carriers 

(operated under 14 CFR Part 121 or scheduled flights under Part 135) for every ten 

million departures during the 20-year period from 1984 to 2003. This suggests that 

the probability of a fatal accident has been about 8E-7 per departure of a U.S. 

commercial air carrier aircraft over the last 20 years. The data behind these estimates 

generally exclude incidents involving sabotage or suicide, since these are not 

considered accidental (Reference 5y). Not surprisingly, this data also show that the 

“background risk” accepted by a passenger on a commercial transport flight appears 

to fall between the long and short term acceptable risk levels identified in the FAA’s 

Advisory Circular (AC) 39-8, which are described below. The “background risk” 

accepted by occupants of U.S. general aviation aircraft may be significantly higher 

than commercial passengers. Data from the NTSB aviation accident database 

indicates that the probability of a fatal accident per departure of aircraft operated 

under Part 91 was about 8E-6, or about ten times higher than that for commercial 

aircraft passengers during the same 20-year period. However, this estimate is more 

uncertain due to the relatively unreliable data on the number of general aviation 

departures compared to commercial flights. 

 Advisory Circular (AC) 39-8 is an FAA guidelines used “to identify unsafe 

conditions and determine when an ‘unsafe condition is likely to exist or develop in 

other products of the same type design’ before prescribing corrective action” for 

transport aircraft (Reference 5z). Specifically, AC 39-8 is aimed at assessing the risk 

of unsafe conditions on products associated with the power plant or auxiliary power 

unit installations on transport category airplanes. However, the general concepts, 

safety goals, and definitions (especially for the consequences of concern) presented 

there are relevant to the development of standards for public protection, particularly 

for the protection of the flying public from spacecraft hazards. For example, AC 39-8 

recognizes “that acceptable risk levels should be regarded as upper limits, to be 

allowed only when reducing the risk further would result in undue burden.” This 

5-46
FAA guideline is functionally equivalent to the RCC preference to ensure safety by 

complete containment of range hazards. 

 AC 39-8 provides short term acceptable risk levels that equate to where “the 

malfunction is beginning to contribute more risk than the aggregate risk from all 

other causes, including contributions from the crew.” Specifically, AC 39-8 

identifies the probability of no greater than 4E-6 for a “level 4 event” as a short term 

acceptable risk for each flight. Level 4 events include serious injuries or worse (i.e. 

casualties), hull loss when occupants were on-board, and forced landings. AC 39-8 

uses the NTSB definition of serious injuries; however, “the level 4 risk guidelines are 

intended to cover exposures to the most severe of ‘serious injuries’ (i.e., lifethreatening injuries).” Therefore, the level 4 event guideline may be relaxed if only 

non-life threatening injuries are involved (such as simple fractures). AC 39-8 

identifies the probability of no greater than 1E-9 for a “level 4 event” as a long term 

acceptable risk for each flight. 

 The long and short term acceptable risk guidance published in AC 39-8 set 

important bounds that can be used to define acceptable aircraft risks. Clearly, any 

space activity that meets the long term acceptable risk guidelines in AC 39-8 protect 

against unreasonable risks from a range activity. Conversely, any range activity that 

generates aircraft risks in excess of the short term acceptable risk guidelines does not 

protect against unreasonable risks. Since only a fraction of the “debris impacts 

capable of producing a casualty” on an aircraft due to a range activity are likely to 

actually produce a level 4 event, it is clear that compliance with the 1E-7 probability 

of impact criterion given in paragraph 3.3.1.1 of the Standard (and the 1E-6 PI

criterion in 3.3.2.1) of the Standard will ensure that no aircraft are exposed to 

unacceptable short term risks as defined in AC 39-8. Therefore, limiting non-mission 

aircraft to regions where the probability of impact with debris capable of producing a 

casualty on an aircraft does not exceed 1E-7 will ensure reasonable aircraft risks 

based on FAA guidelines given in AC 39-8. 

 When this RCC standard was first established, risk statistics were gathered on 

comparable risks of aircraft being struck by objects in midair. Two non-military 

sources of midair strikes have resulted in downed aircraft, as shown in Table 5-25. 

These statistics indicate that the risks resulting from a preexisting hazard of either 

bird strikes or midair collisions exceed the risks allowed by this standard because 

only a fraction of the impacts “with debris capable of producing a casualty” on an 

aircraft are reasonably expected to produce a serious injury or worse. 

 Table 5-26 shows that the standard criteria are the same as those used at Wallops 

Flight Facility , and are one order of magnitude more conservative than those used at 

Reagan Test Site, and the Eastern Range. 

Section 4.4.4 of this Supplement demonstrates that proper implementation of the 

PI limits for aircraft hazard areas and use of the aircraft vulnerability models and 

hazard thresholds in paragraph 6.3.3 will ensure compliance with the individual and 

5-47
catastrophic risk criteria established in Chapter 3 of RCC 321-07. Thus, limiting the 

PI with debris capable of producing a casualty on an aircraft is a reasonable and 

rationale means to ensure that range activities do not pose risks that exceed a) the 

background risks for people in aircraft, b) risk guidelines used by the FAA to 

“determine unsafe conditions...for transport aircraft”, c) the individual risk limits 

established in this standard, d) the catastrophic risk criteria, and e) current practice at 

the national ranges. 

TABLE 5-25. ANNUAL RISK FOR FLIGHTS IN THE U.S. BASED ON A 5-YEAR 

AVERAGE (1993-1997)a

Number of 

Fatalities 

(EF/year) 

Number of 

Injuries 

Probability of 

Fatality / 

Flight(Ref 5bb), b

Probability of 

Injury / 

Flight(Ref 5s), b

Bird Strikes 1 (0.2/yr)(Ref 5aa), c 10 (2/yr)(Ref 5t), d 3.2E-9 3.2E-8 

Midair 

Collisions 

96 (19.2/yr)(Ref 5t), e 31 (6.2/yr)(Ref 5t), d 3.1E-7 1.0E-7 

a. Impact statistics are based on a 5-year average (1993-1997). All of the midair collisions involved fixed wing 

aircraft. In this time period, collisions between helicopters, ultralights, and gliders occurred, but they were 

not considered in this study. During the referenced 5-year period, 29 aircraft were struck by birds, resulting 

in 1 fatality and 10 injuries; 124 aircraft were involved in midair collisions, resulting in 96 deaths and 31 

injuries. 

b. Assuming an average of 62,281,350 flights per year for all fixed wing, powered aircraft in the U.S. (based on 

air traffic activity at FAA, and contract airport control towers and facilities). 

c. Indian Shores, Florida ( 7/15/94). A pelican impacted the windshield of a Cessna 172 causing the 

incapacitated pilot to lose control, pitch up, invert the aircraft, and impact the water. 

d. Nashville International Airport, Nashville, Tennessee (7/8/96). A Southwest Airlines Boeing 737 ingests a 

bird in the left engine on takeoff, causing a compressor stall. Excessive braking due to a rejected takeoff 

caused a fire to erupt from the right brake. During the evacuation of the plane, 5 passengers were injured, 1 

seriously; 117 passengers and 5 crew members were not injured. There were five other injuries from birds 

in this 5-year period. Three of the injuries were caused by birds penetrating the windshields of aircraft, 

striking the pilots. The other two injuries were caused by the pilots striking the ground while maneuvering to 

avoid contact with flocks of birds. 

e. All of these midair collisions involved general aviation aircraft. In this time period, there were also midair 

collisions between helicopters and gliders, but they were not considered in this study. 

5-48
TABLE 5-26. AIRCRAFT RISK CRITERIA OF NATIONAL RANGES* 

Range Mission Essential Other 

Eastern Range 1E-6 1E-6 

Eglin AFB 1E-4 to 1E-3 Containment 

NAWC - Point Mugu RSO Discretion Containment 

Pacific Missile Range 

Facility 

1E-6 1E-7 

Reagan Test Site 1E-6 1E-6 

Wallops Flight Facility 1E-7 1E-7 

Western Range 1E-6, sched. DR debris; 

1E-8 breakup debris 

Containment 

White Sands Missile Range Containment Containment 

Standard Criteria 1E-6 1E-7 

* Risk expressed in terms of probability of impact 

b. Rationale for 1E-6 Probability of Impact for Mission Aircraft. The standard criterion 

for protecting mission essential aircraft is consistent with historical data from the 

national ranges. This same criterion is currently used by the Eastern and Western 

Ranges and Reagan Test Site (formerly known as the Kwajalein Missile Range). The 

criterion also reflects a lower risk than that accepted by Eglin AFB (PI = 1E-4 to 

1E-3). Table 5-26 shows the aircraft risk criteria of national ranges. The previous 

section shows that this criterion is consistent with risk guidelines used by the FAA to 

“determine unsafe conditions...for transport aircraft.” Thus, the standard criteria are 

reasonable in light of currently used criteria that have provided an excellent safety 

record and current FAA guidelines. The criterion was designed to provide 

catastrophe aversion and to be consistent with the collective risk criterion as 

described in Section 4.4.4. 

5.6.4 Rationale for Mishap Response Requirements. This section provides the rationale for the 

requirement given in paragraph 3.3.4 of the Standard: 

“The range must coordinate with the FAA to ensure timely notification of any expected 

air traffic hazard associated with range activities. In the event of a mishap, the range 

must promptly inform the FAA of the volume and duration of airspace where an aircraft 

hazard is predicted.” 

5-49
Range coordination with the FAA is reasonable and prudent because the FAA is the 

executive agency with primary responsibility for aircraft safety. The RCC has chosen to avoid 

setting a specific quantitative standard for risk acceptability in the event of a mishap because: 

a. Appropriate measures for aircraft protection in the event of a range mishap depends 

on many factors, such as the type of aircraft in the vicinity and the nature of the 

aircraft hazard. 

b. Conditional risk is fundamentally different than pre-flight risk. 

c. The definition of aircraft hazard areas in the event of a range mishap is a topic where 

range safety practices and technology advances are evolving (Reference 5cc). 

d. Specific RCC limits could stifle innovation in this important area. 

5.6.5 Rationale for 1E-5 Probability of Impact to Ships. The International Maritime 

Organization (IMO) is the United Nations (UN) organization for safety and environmental 

protection regulations for maritime activities. The IMO has been developing a risk-based 

approach to safety and environmental protection regulations (Reference 5v). The IMO prefers to 

refer to the “risk evaluation criteria,” instead of the standard risk acceptance criteria, to 

emphasize that the criteria will not be the only factor in a decision because other considerations 

may be deemed appropriate. The IMO has not yet agreed to any explicit risk evaluation criteria, 

but a formally proposed one is under consideration. The IMO proposed explicit risk evaluation 

criteria would use essentially follow the approach taken by the UK’s Health and Safety 

Executive (HSE). The IMO proposal and current HSE regulations use annual individual risks to 

define three risk regions: 

a. An intolerable region (above the maximum tolerable risk level), where risks must be 

reduced regardless of costs. 

b. A broadly acceptable region (below the broadly acceptable risk level) where risks are 

too small to require reductions that incur cost. 

c. A middle region where risks should be “As Low As Reasonably Practicable” 

(ALARP). In the ALARP region, risks should be reduced as long as the risk 

reduction is not disproportionate to the costs. 

The IMO’s proposed risk evaluation criteria is based on the premise that involuntary 

risks should be “substantially below the total accident risks accepted in daily life,” but “similar 

to risks that are accepted from other involuntary sources.” The IMO proposal endorses the risk 

thresholds put forward by the HSE. Individual annual fatality risks are: 

d. Below 1E-6 are broadly acceptable for everyone: crew and public. 

e. Above 1E-3 are intolerable for crew. 

f. Above 1E-4 are intolerable for the public (passengers and public ashore). 

5-50
The IMO proposal notes that it may be appropriate to have a more demanding target for 

new ship designs and that individual annual fatality risks should be: 

g. Below 1E-4 for crew, and 

h. Below 1E-5 for passengers and public ashore. 

Note that the IMO criteria are for individual annual fatality risks, whereas the Standard 

sets limits for cumulative probability of impact with debris capable of causing a ship accident. 

Since only a fraction of the impacts “capable of causing a ship accident” are expected to produce 

a fatality, the 1E-5 probability of impact criterion standard appears to be conservative relative to 

the IMO criteria. 

The standard criteria for protecting ships are consistent with criteria used by six of the 

national ranges as shown in Table 5-27. Note that the standard criterion for hazard ship areas 

limits the cumulative probability of impact of debris capable of causing a ship accident. The 

Eastern and Western Ranges have used the same approach and numerical values to define hazard 

areas for non-mission ships. Other ranges, such as the Reagan Test Site, have set lower 

probability of impact limits for individual ships instead. The standard criteria allow mission 

essential and critical operations ships to be exposed to a probability of impact that is ten times 

higher than the general public, consistent with the rationale provided in Section 5.3.4. 

 

TABLE 5-27. SHIP RISK CRITERIA OF NATIONAL RANGES 

Range Criteria for Mission 

Essential Ships 

Criteria for Non-Mission 

Essential Ships 

Eastern Range 1E-5* 1E-5* 

Eglin AFB 2 - 3 sigma hazard area cleared for all ships 

Reagan Test Site 1E-6 1E-6 

NAWC - Point Mugu 1E-5 1E-6 

PMRF – Barking 

S d

1E-5 1E-6 

Wallops Flight 

FFFFF ili

1E-5 1E-5 

Western Range 1E-5* 1E-5* 

Commonality Criteria 1E-4* 1E-5* 

* Risk expressed in terms of cumulative probability of impact 

5-51
Therefore, a per mission limit of 1E-5 probability of an impact capable of causing a ship 

accident appears reasonable in light of: 

i. IMO’s (United Nations) proposed risk evaluation criteria. 

j. The improbability of the same individuals on ships being threatened by multiple 

launches. 

k. The conservative definition of a ship accident (such that a high percentage of these 

boat accidents caused by a debris impact would typically produce a casualty or 

fatality). 

l. Current criteria used at the national ranges. 

m. The uncertainty in the overall calculation of PI for ships exposed to debris from range 

activities. 

Furthermore, the best estimates of the annual individual risks historically accepted by 

people on ships show that limiting non-mission ships to regions where the probability of impact 

capable of causing a ship accident does not exceed 1E-5 will demonstrate compliance with the 

qualitative standard described in Section 5.6.2. Skjong (Reference 5v) showed that: 

n. Annual individual risks are on the order of 1E-4 based on 20 years of data from 

1978-1998 for crew of various ship types.82 

o. The risk of three to 1000 or more fatalities per year from collision, grounding, and 

fire are between 1E-4 and 1E-3 for passenger ships with 3000 people on board (see 

Figure 6 in (Reference 5dd)). 

The current Standard also maintains that non-mission ships be restricted from hazard 

areas where the cumulative probability of impact of debris capable of causing a catastrophic 

accident83 exceeds 1E-6. This requirement is consistent with the catastrophe protection provided 

ships by previous versions of the Standard.

5.7 Rationale for Spacecraft Protection Requirements 

5.7.1 Collision Probability. Similar to the rationale presented in paragraph 5.3.1c of this 

Supplement for deriving per event risk from annual risk and the currently stated EWR 127-1 

rationale for the public casualty risk criteria of 30E-6, the criterion for collision probability was 

revised. Based on the assumptions that no more than one collision in 1000 years is acceptable at 

a world-wide launch rate of 100 flights per year and of sufficient altitude to pose a risk to 

manned spacecraft, this would result in a hit probability of 1E-5 per spacecraft per launch. This 

is the same level of protection afforded to ships; however, most ship crews and passengers have 

life saving devices available to them and also the chance of being rescued. Not all spacecraft 

have lifeboats readily available and the capability to perform rescues in space is almost nonexistent today, therefore an additional order of magnitude level of protection level (1E-6) would 

be warranted. The additional order of magnitude could also be justified using the logic approach 

 

82 See the figure in Reference 5v. 83 In the absence of valid ship vulnerability modeling, this includes any debris capable of deck penetration as 

described in Chapters 4 and 6 of this Supplement. 

5-52
described in Figure 5-2 of paragraph 5.3.1d accounting for the uncertainty in predicting the 

probability for this activity. A separate justification or rationale for adopting the 1E-6 criterion 

for collision probability is that the Risk Committee considered the crew aboard manned 

spacecraft to be in the newly defined category of critical operations personnel and therefore 

should have the same level of protection as mission essential aircraft. 

5.7.2 Ellipsoidal Miss Distance Volume. Typically, the greatest dispersions associated with an 

orbiting object or a launch vehicle is in either’s in-track direction. Since a 200 km miss distance 

has been used by the ranges for several decades, it can provide an acceptable upper bound on intrack dimension of the miss distance volume and continue the excellent record for collision 

avoidance that has been successfully used against occupied spacecraft. After reviewing the 

observed cross-track variability of launch vehicles, the position and arrival time variability of 

spacecraft, and reviewing mission assurance conjunction assessments against other classes of 

space objects that have been performed over the years with 35 km or less miss distances, a 50 km 

miss distance perpendicular to the in-track axis for both the radial and cross-track dimensions 

was selected. Therefore miss distance volumes of 200 km in-track by 50 km cross-track and 

radial were defined as the acceptable ellipsoidal volume and 200 km retained as the spherical 

volume, either of which is to be applied about the manned spacecraft during the conjunction 

assessment. 

5.7.3 Duration of Conjunction Assessment. In evaluating the language in the previous versions 

of RCC 321 and to what duration the individual ranges were performing or providing data for the 

conjunction assessments, the Risk Committee found that the language was conflicting and the 

practices varied from range to range. For suborbital missions, the duration should cover at least 

the period of flight Limiting duration to orbit insertion or orbit insertion plus one revolution does 

not ensure adequate protection to manned spacecraft. Events observed in the recent past, for 

launch objects inserted into low earth orbit (LEO) or park orbit, has determined conjunctions 

occurring with the International Space Station (ISS) three or four revolutions after orbit 

insertion. In addition, conjunction assessments must also consider jettisoned components that 

typically occur after orbit insertion and may remain in different orbits than the launch vehicle’s 

upper stage or payload. The committee found that the proper duration for the analysis was 

dependent on several factors that must be considered to determine adequate time for a 

meaningful conjunction assessment: 

a. The type and shape of orbit (park, transfer, interplanetary, circular, highly elliptical) 

of the launch vehicle or jettisoned components in relation to the manned spacecraft, 

b. The orbital period of the manned spacecraft relative to orbital period of launch 

vehicle or jettisoned component. 

c. The altitude of the launched object relative to the manned spacecraft. 

d. The time required by either the 1st Space Control Squadron (SPCS) to catalogue the 

object(s) or the period of coverage another agency or range user may be performing 

in their conjunction analysis for mission assurance or other purposes and including 

the manned spacecraft. 

For near circular LEO or park orbits orbit insertion typically occurs for at altitudes 

of 125 to 175 km while manned spacecraft are at higher altitudes (300 – 350 km). Often, 

5-53
conjunctions for objects in park orbits result from the object being within 200 km miss distance 

of the manned spacecraft but whose maximum altitude capability is greater than 100 km from the 

spacecraft. Conjunctions in this case are more likely due to inclination crossings at large, 

separated distances rather than altitude crossings that are more likely to produce a collision. 

Therefore extending conjunction assessments past one revolution may identify multiple 

encounters in subsequent revolutions of the manned spacecraft and launch objects especially 

when their periods are nearly synchronous. Many of these conjunctions may be mitigated by the 

additional Conjunction Assessment (CA) and Collision Avoidance (COLA) screening criteria 

described in paragraphs 2.2.4 of this standard and 5.7.5 of this Supplement. The Space Control 

Center in Cheyenne Mountain, operated by the 1st SPCS, will likely have catalogued and be 

tracking objects remaining in LEO after 6 to 9 hours. Since objects in LEO have periods of from 

90 to 95 minutes per revolution, the analyst should consider extending the duration of the 

conjunction assessment for approximately 4 to 6 revolutions past orbit insertion to cover the 

period until the launched object is catalogued. 

Launch vehicles or components in moderately to highly elliptical or transfer orbits, and 

interplanetary trajectories are likely to produce conjunctions that potentially would result in 

collisions. For these type missions, the previous practice of ending the CA at orbit insertion did 

not address the more likely conjunction due to an altitude crossing and resulted in inadequate 

protection of the manned spacecraft. Similarly, if the assessment duration was extended to orbit 

insertion plus one revolution, the threat to manned spacecraft would only be addressed if the 

launch vehicle or component was directly injected into this type orbit on ascent. For GEO or 

MEO missions, orbital insertion first occurs with park orbit, and then subsequent powered flight 

segments produce the elliptical transfer orbit involving an altitude crossing. Thus, assessment 

duration needs to be extended to cover these additional powered and coast flight segments and in 

particular until the vehicle or components clear the altitude of the manned spacecraft by at least 

the miss distance criteria selected or until the collision probability is expected to be within 

acceptable limits. Often a jettisoned stage is left in park orbit for these missions and must also 

be screened against the manned object as described in the previous paragraph. The analyst 

should consider that orbital periods of moderate elliptical orbits typically range from 600 to 120 

minutes per revolution and the 1st SPCS will likely have catalogued the launched objects after 1 

to 5 revolutions, respectively. 

5.7.4 Pre-screening Criteria. The two altitude screens stated in paragraph 2.2.4 of the Standard 

were predicated on the current operating regions of manned spacecraft and the known 

performance capabilities of launched vehicles and components. The minimum altitudes of the 

Space Shuttle, ISS, and Shenzhou spacecraft were considered when establishing the initial screen 

for launch vehicles, jettisoned components, or planned debris needing to exceed 150 km altitude 

before CAs are necessary. Space shuttle history indicated that their lowest orbit was122 nm, or 

226 km and the ISS minimum altitude is in the range of 310 to 320 km before maneuvers to 

boost the orbit are considered. The Chinese Shenzhou 5 and 6 spacecraft were launched to 

minimum altitude of 211 km before raising the orbit to a final perigee of approximately 332 km. 

The Risk Committee also considered that other manned objects could be inserted into lower 

orbits than current manned objects, however, there are operational and protective concerns 

regarding the population of satellites and debris in those lower orbit bands and whether manned 

spacecraft can be sustained in those orbits for long periods of time. For these reasons, and 

5-54
discussions with NASA offices responsible for protecting and determining when to maneuver the 

ISS, the minimum altitude of 150 km was determined to be appropriate. In addition, this is 

consistent with current findings and regulations of the FAA/AST office responsible for licensing 

commercial U.S. launches. 

The second screen is intended to eliminate unwarranted conjunction assessments. This 

screen, of requiring the maximum (3-sigma) altitude capability of the launch vehicle, 

components, or planned debris to be within 50 km of, or above, the operating altitude of the 

manned spacecraft before a CA or COLA is required,. Even though it has been in practice for 

several decades, the Risk Committee recognized that 200 km, when used with a spherical miss 

distance, is very conservative when considering the likelihood that a conjunction will occur. In 

addition, conjunction assessments are typically calculated using nominal or expected 

performance of the vehicle, and the inclusion of malfunction scenarios are considered 

impractical. For the planned trajectory of a launch vehicle or its components to exhibit 

performance beyond their 3-sigma altitude capability, and, in addition, bridge an additional 

50 km separation distance to threaten a manned spacecraft was therefore considered extremely 

remote. The 50 km separation distance is also equivalent to the recommended radial dimension 

when using ellipsoidal miss distance volumes; hence the altitude screening allows the analyst to 

perform a simple assessment beforehand as to the likelihood of a conjunction. 

5.7.5 Arrival Time and Separation Uncertainty of the Launch Vehicle and Spacecraft. Unless 

collision probability is calculated, the current practice is to base conjunction assessments on miss 

distance separation of point estimates of the launched object and the spacecraft. A simple and 

straightforward application of known or estimated dispersions of the vehicle and spacecraft 

could provide an analysis product consistent with similar practices in containment or risk 

assessment. Currently, dispersions are only accounted for at the Eastern and Western Ranges by 

adding pads to launch wait periods based on maximum arrival time dispersion per revolution of 

an assumed maneuvered spacecraft. This approach is overly conservative. 

It would be more appropriate to increase miss distance volumes directly by the 

appropriate amount to account for spatial dispersions and to increase launch wait periods but 

only by the arrival time dispersion of the launch vehicle and the uncertainty of known maneuvers 

of the spacecraft. Historically, the large miss distance of 200 km spherical could be assumed to 

account for dispersions in the launch vehicle and spacecraft, however, the Committee considered 

it more mathematically rigorous to treat the miss distance and dispersion criteria as separate and 

combine them in the manner recommended in paragraph 4.5.3 of this Supplement. For practical 

consideration, the dispersions associated with the launch vehicle may be significantly larger than 

the dispersions associated with the spacecraft such that only the LV dispersions need to be 

addressed. 

5.8 Using Aviation as a Benchmark for Launch Risk 

 As discussed in paragraph 5.3.1d, there is broad recognition that aviation is a legitimate 

benchmark for acceptable risks from launch activities. This section describes how the risks 

posed to ground dwellers by conventional aviation can be used to help identify reasonable risk 

limits for range activities. The following data and analyses of the risk imposed by the over-flight 

5-55
of conventional aircraft indicate that a limit for the collective risk for the general public on the 

order of 100E-6 (i.e. 1E-4) expected casualties for any single mission is reasonable and rational. 

 Thompson et al examined data on all civil aviation accidents in the U.S. that killed 

people on the ground from 1964 to 1999 (Reference 5i). Thompson et al excluded fatalities that 

resulted from voluntary exposure, either by being on the airstrip or otherwise being involved 

with the aircraft involved, and focused their analysis on the involuntary risks of being killed by 

an airplane accident. For example, Thompson et al considered a ground crew member or 

someone killed while taking pictures on the runway voluntarily exposed. They classified people 

who live on private property near airports as involuntarily exposed because there are no policies 

to warn them about the risk, “even though some might reasonably suspect that living near an 

airport leads to heightened exposure.” 

 Thompson et al found that the involuntary risk of fatality to individuals on the ground 

from civil aviation accidents increases by about a factor of 100 within two miles of an airport, 

from about one in a hundred million (1E-8) to one in a million (1E-6) per year for a hypothetical 

person that remains in the same location for an entire year. They found that the increase in 

individual risk due to proximity from an airport appears somewhat greater near the busiest 100 

airports, and somewhat less near the busiest 2550 airports. However, those differences appear to 

be negligible given the limited spatial resolution of the Thompson el al data, where the distance 

from the airport was considered instead of the distance from the runway under the dominant 

take-off and landing flight paths. The current lack of resolution in the aviation ground dweller 

data permits identification of only very approximate risk levels, and prevents a more detailed 

analysis from credibly separating the background risk from commercial flights (flown under 14 

CFR Part 121 or Part 135) from general aviation (flown under 14 CFR Part 91) near airports on a 

nationwide basis84. The recent development of ground dweller risk models for European 

airports suggests that further study could produce more precise estimates than those presented 

here (Reference 5k). 

The data and analysis presented by Thompson et al is insufficient to identify a precise 

background risk to involuntarily exposed groups of people in the vicinity of airports. However, 

ACTA, Inc. estimated that the average risk of fatality for individuals involuntarily exposed to 

civil aviation accidents within five miles of top 100 airports was about 3E-8 in the year 2000 as 

follows. 

 Thompson et al projected one fatality related to operations at a top 100 airport in the year 

2000 from all types of civil aviation accidents.85 An accident was considered related to an 

airport if all the following conditions were met: 

a. the airport was registered with the FAA 

b. the airport was the origin or final destination of the flight 

c. the accident occurred within ten miles of the airport. 

 

84 The ANSI/AIAA standard on Commercial Launch Safety suggested that such an estimate of the background risk 

presented by non-commercial aviation might provide a better basis for comparison to risks accepted from launches. 85 See page 1033 

5-56
 Thompson et al projected an expected number of fatalities equal to 0.94 in the year 2000 

for all airport unrelated accidents across the entire U.S.86 ACTA assumed that the risks from 

airport unrelated accidents are independent of proximity to an airport. ACTA estimated that 

36 percent of the U.S. population lived within ten miles of a top 100 airport in the year 2000 

based on the results shown in Figure 6 of Thompson et al and an assumption that those lines 

continue with the same slope beyond the five mile mark where the graph ends at 13 percent. 

Based on Figure 7 from Thompson et al, ACTA estimated that the average individual risk of 

fatality in the year 2000 was approximately 6x10-9 for people that dwell between five and ten 

miles of a top 100 airport. 

By using the following five values estimated for the year 2000 based on Thompson el al: 

d. Thirteen (13) percent of the population live within five miles of a top 100 airport. 

e. Thirty six (36) percent of the population live within ten miles of a top 100 airport. 

f. An expected number of fatalities equal to 1.0 for all types of civil aviation accidents 

related to the Top 100 airports. 

g. An expected number of fatalities equal to 0.94 for all accidents across the entire U.S. 

unrelated to airports. 

h. A total population of the U.S. given in Table IV as 275,306,000. 

and the following equations, 

Risk Within 10 Miles of a Top 100 Airport = Risk Related to Airport + Risk Unrelated to Airport 

MILES

UNRELATED

MILES

RELATED

MILES EFTOTAL EF EF 10 10 10 = + (Eqn. 5-1) 

( )( )( ) 34.11000,306,27536.0104.3 10 9 = =+ − EF x MILES

TOTAL

Risk Within 10 Miles of Top 100 Airport = Risk Within 5 Miles + Risk between 5 and 10 

miles: 

34.1 ( )( )( ) ( )( )( 000,306,27513.036.0106000,306,27513.0 ) 5 9 = + − − P x MILES

TOTAL

 

86 See equation 20 also on page 1033 

5-57
It is estimated that: 

5 8 107.2 − P = x MILES

TOTAL (Eqn. 5-2) 

 Thus, it was estimated that the average risk of fatality for individuals involuntarily 

exposed to civil aviation accidents within five miles of top 100 airports was about 3x10-8 in the 

year 2000. 

The principle shortcomings of the above estimate are: 

i. The Thompson el al data reported ground dweller risk as a function of distance from 

the airport only, not in terms of the distance from a runway under the dominant takeoff and landing flight paths, and 

j. The current lack of high fidelity data on the distribution of population density near 

the top 100 airports in the U.S. 

 While these shortcomings are real, this estimate is still valid for the intended purpose as a 

benchmark for acceptable launch risks because there are reasons to be confident that the actual 

risks from aviation are even higher. The first reason is related to the spatial distribution of 

ground dweller risk from aviation near an airport. Figure 7 in Thompson et al assumes that 

people dwelling at an equal distance from a major airport are subject to an equal risk. However, 

some European nations now govern land use near airports based on triangular public safety 

zones that extend from the runways (Reference 5l) based on data from various empirical 

analyses (Reference 5k). Thus, it is clear that the annual risk from aviation over-flight for 

ground dwellers located at a particular distance from the airport and under the dominant flight 

paths is much higher than the average annual risk for any location at the same distance from the 

airport. More simply stated, a person located directly under the dominant flight paths say 1 mile 

from an airport is exposed to much higher risk than a person located a mile from an airport but 

away from the dominant flight paths. 

 

 Specifically, a comparison of the annual individual probability of fatality (PF) contours 

computed for the Cork and Dublin airports and Figure 7 of Thompson et al shows about two 

orders of magnitude difference: directly under the dominant take-off and landing flight paths 

Davies and Quinn estimated 1E-6 PF contours extend well beyond five miles from the runway, 

where the Thompson data indicates PF levels flatten out below 1E-8. Therefore, the average 

ground dweller risks posed by aviation based on Thompson et al underestimate the actual risks 

posed to ground dwellers directly under the dominant take-off and landing flight paths. 

 Thompson et al made projections of the annual involuntary risk to people on the ground 

from U.S. civil aviation accidents in the years 2000, 2005, 2010, and 2015. Based on the 

decreasing trend noted in the number of involuntarily exposed people killed on the ground by 

civil aviation accidents between 1964 and 1999, the projected increases in the number of airport 

operations and the U.S. population, the results suggest that the collective risk will remain fairly 

constant in that period, increasing from 3.8 expected fatalities in 2005 to 4.3 expected fatalities 

in 2015. Thompson et al found that the uncertainty in these projections is a less important factor 

than the variability due to distance from an airport. Therefore, these estimates of the risk to 

5-58
ground dwellers posed by U.S. civil aviation are not expected to change much over the next ten 

years. 

 The risk of fatality alone is not an optimal measure of public risk. Therefore, ACTA 

analyzed data acquired from the NTSB on injuries (both minor and serious as defined in 

49 CFR 830.2) and fatalities for people on the ground from civil aviation accidents for the 20 

year period between 1984 and 2003. The NTSB data shows that aviation accidents produce an 

average of about two to three times as many casualties as fatalities. As shown in Table 5-28, the 

average ratio of 2.5 casualties to fatalities on the ground from civil aviation accidents is 

somewhat constant over the years (the 99.87 upper bound values are based on year to year 

variations) and applies to general aviation (relatively small airplanes) as well as commercial 

airline accidents. In this case, the number of casualties was computed by adding the number of 

serious injuries, as defined in 49 CFR 830.2, to the number of fatalities reported by the NTSB. 

This ratio is close to the average of predictions made for failures of expendable launch vehicles 

as shown in Table 5-29. All of these expected casualty predictions were based on Abbreviated 

Injury Scale (AIS) 3 or greater, including fatality. 

TABLE 5-28. RATIO OF GROUND CASUALTIES TO GROUND FATALITIES 

BASED ON 20 YEARS OF NTSB DATA FROM 1984 THROUGH 2003 

Aviation Category Average 99.87 Percentile Upper Bound 

All U.S. Civil (Part 91, 121 and 135) 2.5 5.4 

Airlines (Part 121) 2.0 5.9 

General Aviation (Part 91) 2.7 5.4 

The results in Thompson et al indicate that the risk to people involuntarily exposed to 

civil aviation accidents is substantially higher for people who dwell near airports. The average 

annual individual risk of casualty from civil aviation accidents for people that dwell within five 

miles of a top 100 airport was (roughly) estimated at 1E-7. This estimate was formed by 

extrapolating the results presented by Thompson et al that showed about a third of the total 

collective risk of fatalities was borne by people dwelling within about five miles of a top 100 

airport in the year 2000, and the ratio of about three casualties to fatalities on the ground from 

civil aviation accidents observed in the data acquired from the NTSB. 

 The data acquired from the NTSB provides evidence to bolster confidence in the estimate 

of about 3.5 fatalities a year between 2005 and 2015 for people involuntarily exposed to risk 

from civil aviation accidents across the entire U.S. The data acquired from the NTSB shows 

about 17 casualties as an annual average for all types of civil aviation during the four years from 

2000 to 2003, including those that Thompson et al would consider voluntarily exposed but 

excluding all casualties due to intentional acts (such as the terrorist attacks in 2001). A 

comparison of the data in Figure 1 from Thompson et al on fatalities for people involuntarily 

exposed to the data acquired from the NTSB results in a ratio of about two between total 

fatalities on the ground from civil aviation accidents and those for people involuntarily exposed. 

Dividing the 17 casualties recorded on average for the four years from 2000 to 2003 by two 

produces an estimate of 8.5 casualties for people involuntarily exposed. Dividing 8.5 by 2.5, the 

5-59
ratio of casualties to fatalities on the ground from civil aviation accidents, results in an estimated 

3.4 fatalities for people involuntarily exposed, which is remarkably close to the projection of 3.5 

expected fatalities listed for the year 2000 in Table IV of Thompson et al. 

TABLE 5-29. RATIO OF EXPECTED CASUALTIES AND EXPECTED 

FATALITIES COMPUTED BY LARA FOR VARIOUS MISSIONS

Date Analysis Name Mode* Ef/Ec 

11/10/2003 Delta IV ER-GTO MT 0.37

11/10/2003 Delta IV ER-GTO OT 0.71 

11/25/2003 Atlas IIAS EOS-WR MT 0.10 

11/25/2003 Atlas IIAS EOS-WR OT 0.11 

02/13/2004 Falcon 1 normal fragment list MT 0.56 

02/13/2004 Falcon 1 normal fragment list OT 0.57 

02/13/2004 Falcon 1 Intact Vehicle MT 0.12 

02/13/2004 Falcon 1 Intact Vehicle OT 0.12 

02/16/2004 Delta IV medium +(4,2) mean Dec wind MT 0.15 

02/16/2004 Delta IV medium +(4,2) mean Dec wind OT 0.10 

02/19/2004 Delta IV medium +(4,2) mean Oct wind MT 0.15 

04/09/2004 Delta II Gravity Probe B 21-Quick Mean Winds MT 0.21 

04/09/2004 Delta II Gravity Probe B 21-Quick Mean Winds OT 0.24 

08/10/2005 90% SW winds part of 21-Quick for Atlas V 411 MT 0.55 

08/11/2005 90% SW winds part of 21-Quick for Atlas V 411 OT 0.54 

08/19/2005 Mean November wind 21-Quick for Atlas V 411 MT 0.32 

08/20/2005 Mean November wind 21-Quick for Atlas V 411 OT 0.30 

11/16/2005 Atlas V 431 Prelim Baseline MT 0.63 

11/16/2005 Atlas V 431 Prelim Baseline OT 0.63 

08/16/2003 W4413 BV-6 (OBV) T-3 hour OT 0.27 

08/17/2003 W4413 BV-6 (OBV) T-3 hour MT 0.25 

12/02/2003 W4430 Atlas IIAS T-6 hour OT 0.23 

12/02/2003 W4430 Atlas IIAS T-6 hour MT 0.12 

04/20/2004 W6642 Delta 2 7920 Gravity Probe-B T-6 hour MT 0.19 

04/20/2004 W6642 Delta 2 7920 Gravity Probe-B T-6 hour OT 0.14 

05/20/2004 W7711 Taurus XL Roaksat-2 T-3 hour OT 0.54 

05/20/2004 W7711 Taurus XL Rocsat-2 T-3 hour MT 0.19 

07/14/2004 W1988 Delta II 7920 AURA Day 3 T-6 hour MT 0.16 

07/14/2004 W1988 Delta II 7920 AURA Day 3 T-6 hour OT 0.05 

05/20/2005 W3838 Delta II NOAA T-6 MT 0.35 

05/20/2005 W3838 Delta II NOAA T-6 OT 0.59 

10/04/2005 W7817 Delta IV Medium+(4,2) L-1 OT 0.64 

10/04/2005 W7817 Delta IV Medium+(4,2) L-1 MT 0.63 

 Average 0.33 

 * OT means On-Trajectory failure mode, and MFT means malfunction turn failure mode 

5-60
Experience with orbital expendable launch vehicles at the federal launch ranges 

demonstrates that launch area risks are typically limited to approximately 300,000 people near 

the launch point.87 In addition, experience with the flights of SpaceShipOne, the only suborbital 

reusable launch vehicle flights to date, indicates that the risks were borne by approximately 

300,000 people (Reference 5ee). Of course, far fewer than 300,000 people bear the majority of 

the total public risk from typical launches. However, aviation risks to ground dwellers are also 

disproportionately borne by those under the dominant flight paths used for take-off and landing. 

Multiplying the average risk of fatality for individuals involuntarily exposed to civil aviation 

accidents within five miles of top 100 airports in the year 2000 (i.e. 3E-8) by 300,000 people 

equates to a collective risks of about 0.01 fatalities and 0.03 casualties per year. Therefore, a 

collective risk of no greater than 0.03 casualties per year for the general public is a reasonable 

safety goal for spaceflight because a representative sample of about 300,000 people that dwell 

within five miles of a top 100 airport appear to be exposed to a comparable risk due to civil 

aviation over-flight. For the same reasons, a collective risk of no greater than 0.01 fatalities per 

year for involuntarily exposed people is a reasonable safety goal for spaceflight activities. 

 While aviation risks can be estimated using empirical data on the number of people 

seriously injured or killed on the ground, the risks posed by range activities are predictions based 

on computational models, typically fraught with more uncertainty than the empirical data on 

aviation risks. To ensure that range activities pose a collective risk of no greater than 0.03 

casualties per year (or 0.01 fatalities per year) for people involuntarily exposed, it is prudent to 

make a reasonable allowance for the uncertainty present in range safety risk predictions. The 

risk assessment process described in Chapter 2 of this Supplement takes steps to minimize this 

uncertainty. Nevertheless, with all of the uncertainties in the process, a one-order-of-magnitude 

(factor of ten) degree of uncertainty probably remains in any calculation. Although there is little 

data available to substantiate that estimate, recent efforts also indicate that any expected casualty 

estimate for launch probably has at the very least plus or minus an one-order-of-magnitude of 

uncertainty (Reference 5ff). Therefore, a reasonable allowance for the uncertainty inherent in 

range safety risk predictions suggests that the annual risk criteria for range activities should be at 

least ten times lower than the risks estimated for aviation over-flight based on empirical data. 

Furthermore, the standard risk criteria have been set to the nearest factor of three (approximately 

one-half order of magnitude on a logarithmic scale). Further refinement is not warranted due to 

the lack of precision in range safety risk predictions. 

The foregoing analysis demonstrates that limiting the collective risks to the 

general public from range activities to no greater than 0.003 casualties and 

0.001 fatalities per year is reasonable and rational because a representative 

sample of about 300,000 people that dwell within five miles of a top 100 

airport in the U.S. are exposed to comparable risks. The same logic used 

in previous versions of the RCC 321 Standard can be used to link these 

annual collective risk criteria to per mission criteria. Specifically, using an 

average of 30 missions per year these annual limits correspond to 100E-6 

expected casualties and 30E-5 expected fatalities. 

 

87 See Reference 5t (Table 1 on page 6 and Table 7 on page 20). 

5-61
A previous ACTA analysis of the risk from general aviation accidents to people in the vicinity of 

the Cape Canaveral Air Station (CCAS) provides additional evidence on the estimated 

background risk to people on the ground from civil aviation in the U.S. (Reference 5t). 

Specifically, Philipson estimated a minimum of 0.018 expected casualties on the ground 

annually from general aviation accidents in an area with a total population of about 267,000 

people. This result appears roughly consistent with the forgoing estimate that all civil aviation 

over-flight poses a collective risk of about 0.03 expected casualties per year for a group of 

300,000 involuntarily exposed people that dwell within five miles of a Top 100 airport. 

5-62
5.9 References for Chapter 5 

a. Federal Register, Vol. 67, No. 146, 30 July 2002, pages 49461, 49462, and 49465. 

b. Federal Register, Vol. 51, August 21, 1986, page 28044 

c. Cohrssen, J.J. and V.T. Covello, Risk Analysis: A Guide to Principle and Methods for 

Analyzing Health and Environmental Risks, Council on Environmental Quality, 1989. 

d. Motor Vehicle Manufacturers Association v. State Farm Mutual Auto. Ins. Co. 463 U.S. 

29, at 42-57, 103 S. Ct. 2856 (1983) 

e. Illinois Public Telecommunications Association v. FCC, 117 F.3d 555, 564 (D.C. Cir. 

1997) 

f. Federal Register, Vol. 64, No. 76, April 21, 1999, pages 19605 & 19606 

g. Federal Aviation Administration, Department of Transportation, 14 CFR Parts 401, 406, 

413, 415, 417 Licensing and Safety Requirements for Launch; Final Rule, Federal 

Register, Vol 71, No. 165, August 25, 2006 

h. Fulton and Robinson, Benchmark Public Risk Levels for Australian Space Launch 

Activities, August 2000, 

http://www.industry.gov.au/library/content_library/Benchmarkpublicrisks.pdf

i. Thompson K.M, Rabouw R.F, and Cooke R.M, The Risk of Groundling Fatalities from 

Unintentional Plane Crashes, Risk Analysis, Vol. 21, No 6, 2001 

j. Wilde et al, Investigation of Risk Acceptability for Experimental Permit Regulation 

Development, ACTA Report. No. 06-527/10.1-01, 2006 

k. Evans et al, Third Party Risk Near Airport and Public Safety Zone Policy, R&D Rept. 

9636, National Air Traffic Services Limited, London, June 1997 

l. Davies and Quinn, Public Safety Zones: Cork, Dublin, and Shannon Airports, February 

2005, pages 5, B1, B2. 

m. Federal Register, Vol. 65, No. 207, 25 October 2000, page 63936 

n. Starr, C., “Societal Benefit versus Technological Risk,” Science, Vol 165, pp.1232-38, 

1969. 

o. Appendix A.6, “Federal Agency Risk Assessment and Risk Management Practices”, 

prepared by Dr. L. Rhomberg of the Center for Risk Analysis at the Harvard School of 

Public Health in Commission on Risk Assessment and Risk Management, 1996. Risk 

Assessment and Risk Management in Regulatory Decision Making, June 13, 1996. 

p. Statutes include: the Federal Food, Drug, and Cosmetic Act (FFDCA) by the Food and 

Drug Administration (FDA); the Occupational Safety and Health Act (OSHA) by the 

Department of Labor; the Administrative Procedures Act; the Consumer Product Safety 

Act (CPSA) and the Federal Health and Safety Act (FHSA) by the Consumer Product 

Safety Commission; as well as seven standards promulgated by the EPA: Clean Air Act 

(CAA), Clean Water Act/Federal Water Pollution Control Act (CWA), Safe Drinking 

Water Act/Public Health Service Act (SDWA), Resource Conservation and Recovery 

Act/amending Solid Waste Disposal Act (RCRA), Comprehensive Environmental 

Response, Compensation, and Liability Act (CERCLA), Toxic Substance Control Act 

(TSCA), and Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA). 

5-63
q. Travis, C. C., S. Richter, E. Crouch, R. Wilson, and E. Klema, "Cancer Risk 

Management: A Review of 132 Federal Regulatory Decisions", Environmental Science 

and Technology, Vol. 21, No. 5, 1987 pp. 415-420. 

r. National Transportation Safety Board, "Annual Review of Aircraft Accident Data: U.S. 

Air Carrier Operations Calendar Year 1990,” PB94-102787. 

s. Philipson, L. and D. Hoefer, “Comparative Public Risks Due to Military Aircraft 

Operations”, J. H. Wiggins Company Technical Report 82-3093, Prepared for WSMC/SE 

under Contract FO4703-79-C-004, September, 1982. 

t. Philipson, L., “Refined Estimate of the Risk from Aviation Accidents to the Population in 

the CCAS Area of Concern”, ACTA Technical Report 94/297/46-01, ACTA, Inc., 

Torrance, CA, 1994. 

u. Rasbah, D. J., “Criteria for Acceptability for Use with Quantitative Approaches to Fire 

Safety”, presented at the Fire Prevention for Industry and Trade, BVD, Symposium of 

Fire Protection Concepts, Zurich, March 12-14, 1984, and “Criteria for Decisions on 

Acceptability of Major Fire and Explosion Hazards with Particular Reference to the 

Chemical and Fuel Industries”, I. Chem. E. Symposium Series No. 58. 

v. R. Skjong, “Risk Acceptance Criteria: Current Proposal and IMO Position,” Conference 

Proceedings from Valencia, Spain 4-6 June 2002. 

w. T. Hardy, “Risk Perception and Communication in Commercial Reusable Launch 

Vehicle Operations,” presented at the 1st IAASS Safety Conference, Nice, FR, October 25-

27, 2005. 

x. V. Covello and P. Sandman. "Risk communication: Evolution and Revolution," in 

Wolbarst A. (ed.) Solutions to an Environment in Peril. Baltimore, MD: John Hopkins 

University Press (2001): 164-178. 

y. National Transportation Safety Board, Safety Report: Survivability of Accidents 

Involving Part 121 US Air Carrier Operations, 1983 through 2000, NTSB/SR-01/01 

March 5, 2001. 

z. Federal Aviation Administration, Advisory Circular No. 39-8, Continued Airworthiness 

Assessments of Powerplants and Auxiliary Power Unit Installations of Transport 

Category Planes, Washington, DC, September 2003. 

aa. National Transportation Safety Board, “NTSB Aviation Accident/Incident Database,” 

http://nasdac.faa.gov/lib, February 1999 (4 March 1999). 

bb. Federal Aviation Administration, Statistical Handbook of Aviation, 

http://www.bts.gov/ntda/shafaa, May 1999 (5 March 1999). 

cc. Van Suetendael R,, et al., Accommodating Commercial Space Operations in the National 

Airspace System, Journal of Air Traffic Control, Vol. 47, No. 3, July-September 2005. 

dd. Vanem, E. and Skjong, R. (2004) “Collision and Grounding of Passenger Ships – Risk 

Assessment and Emergency Evacuations,” from International Congress on Collision and 

Grounding of Ships, ICCGS 2004, Izu, Japan, 25–27 October 2004. 

ee. Larson E., Quantitative Public Risk Analysis for SpaceShipOne, ACTA # 04-527/1, 

12/2004. 

ff. Collins J, et al, Development of Risk Profiles and Risk Uncertainty Models for 

Application to Launch Risk Analysis – FY05 Activity, Report No. 05-551/5.4-02, 

September 2005.

5-64
CHAPTER 6 

HAZARD THRESHOLDS 

Characterization of human vulnerability to the hazards associated with launch and flight 

is a critical element in risk analysis and risk management. It requires addressing the 

vulnerability of unsheltered people to the various hazards as well as characterizing the effects of 

these hazards on buildings and other structures. The vulnerability of humans, buildings, and 

other structures is an evolving field of study, and publishing a single set of vulnerability curves 

could stifle innovation in this important element of flight safety analysis. Therefore, while 

previous editions of RCC 321 have published vulnerability curves for hazardous debris, the Risk 

Committee has determined that it better serves the interest of the national ranges to replace the 

vulnerability curves with a set of consensus threshold values. The threshold values included in 

this chapter are intended to allow analysts to perform conservative risk estimates. Analysts 

should verify the suitability of these thresholds for other applications such as containment before 

using them for those applications. When a flight safety analyst has access to valid vulnerability 

relationships, allowing a more refined analysis, these relationships should be used in place of the 

thresholds published in this chapter.88

The material in this chapter is organized as follows. The first section clarifies the 

meaning and intended use of hazard thresholds. The second section presents hazard thresholds 

for unsheltered persons. The third section provides hazard thresholds for people inside of 

buildings, ships and aircraft. As applicable, separate subsections are devoted to fragment 

hazards and explosive overpressure hazards. In each subsection, terms are defined and hazard 

thresholds are cited. Each subsection also includes an explanation of how thresholds were 

determined with appropriate references for methodology, supporting data, and/or supporting 

practices. 

The scope of this chapter is limited to hazard thresholds. Chapter 2 of this Supplement 

provides guidelines for the overall risk management process. Chapter 7 discusses approaches 

and considerations for debris risk assessment models. 

6.1 Defining Criteria for Hazard Thresholds 

6.1.1 Threshold Philosophy. Thresholds have been determined that represent a “low 

probability” of the adverse outcomes being addressed. In a perfect world, the term “low 

probability” would be quantified with a value such as 1 percent. Unfortunately, this is at best, an 

approximation in the real world. Purely empirical models are frequently limited by the size of 

the data samples. Very large sample sizes are required to confidently report a 1 percent value. 

Analytic methods draw on a combination of engineering models and reasonable statistical 

 

88 Flight safety analysts choosing to use the fatality curves published in earlier versions of RCC 321 must assure that 

their intended application is consistent with the assumptions used in developing these curves. Notable assumptions 

for the fatality curves were that all debris weighs less than two pounds and that populations at risk are reasonably 

represented by median adult males. Analysts employing other numerical criteria published in previous versions of 

RCC 321 should verify that these numbers are still credible in the light of improved understanding of structural 

vulnerability. 

6-1
assumptions. Exact values for low percentile points are critically dependent on the statistical 

assumptions. Alternative, equally credible assumptions about probability distributions can 

change a value from a 1 percent to a 5 percent or to a 0.1 percent value. 

The threshold values provided in this chapter can be used to define consequences in a 

simplistic (tier 1) manner in order to provide conservative risk estimates. Risk analysis can be 

conducted using a two-tiered approach. The tier 1 approach allows an analyst to initially employ 

relatively simple metrics to establish a casualty (or other consequence) from a hazard threshold. 

For example, the tier 1 approach would count any person as a casualty if they are predicted to be 

impacted above the threshold values. If the range determines that the result of the tier 1 analysis 

demonstrates adequate safety, no further analysis is required within conservative assumptions. 

However, if the tier 1 analysis indicates excessive risks, then a potential alternative to risk 

mitigation is implementing a tier 2 approach. The tier 2 approach replaces the hazard thresholds 

with valid vulnerability models. In general, the thresholds presented herein that should be used 

are: 

a. To determine if a more sophisticated analysis is warranted. 

b. As an alternative when higher-fidelity models are unavailable. 

c. As an alternative when the quality of the data available to support the analysis is so 

low that an additional margin of safety is prudent. 

6.1.2 Hazard Generation and Uncertainty. Hazards may be generated by planned events or by 

malfunctioning systems. Examples of planned events which produce hazards include jettisons of 

hardware, weapon system engagements, and boosters/rockets that produce toxic exhaust. Most 

hazards associated with malfunctions begin with an event that produces hazardous fragments 

ranging in size from intact vehicles down to small fragments. Following the initial hazard 

producing event, there are frequently a series of events that modify the nature of the original 

hazard or generate secondary hazards. These events range from additional fragmentation 

through explosions and events that release toxic vapor, particulates, or aerosols. 

Hazard generating events occur in a dynamic environment. The initial conditions for 

each subsequent event are dependent on the previous event(s) and the propagation of the hazard 

through the atmosphere. Moreover, the ground impact of fragments with attached solid 

propellant, contained liquid propellant, or ordnance, may result in an explosion generating a 

blast wave and/or a release of toxic materials. 

Uncertainties are associated with each step of this process, beginning with the initial 

generation of a hazardous event and continuing the propagation of each related hazard through 

the subsequent hazardous events, and ultimately to people or property at risk. The hazard 

thresholds characterized in this section relate to the threats generated by inert debris and blast 

waves. It is useful to group the uncertainties into a group associated with the hazard level and 

uncertainties associated with the people or structures at risk. This introductory material 

addresses hazard level uncertainty; discussions of some of the uncertainties associated with the 

people or structures at risk are presented in each applicable subsection. 

6-2
The hazard level uncertainty at each receptor depends on the uncertainties in each step of 

hazard generation and propagation as well as the uncertainty associated with the hazard 

propagations. Fragment catalogs for all classes of debris generating events are known to contain 

significant levels of uncertainty. Although there are important differences among the different 

types of fragment generating events, most fragment catalogs share several common 

characteristics: 

a. Time dependency of fragmentation is either neglected or highly simplified. For 

example, there may be an initial fragmentation followed by secondary fragmentation 

when explosive fragments hit the ground. 

b. Catalog development typically begins with defining those factors that are known with 

confidence. Subsequent steps involve choices the analyst makes among various 

credible assumptions. Discrete values and probability distributions consistent with 

the limited known information and the assumptions are then used to build the 

fragment catalogs. There is rarely a single credible choice for an assumption. 

c. Formulation of the catalog development analysis is strongly biased by the catalog 

developer’s prior experience with predicting fragmentation and the prior data 

requirements of the fragment list users with whom the catalog developer worked. 

This affects a number of important choices such as whether to model a particular 

variable by providing selected statistics, discrete values or probability distributions 

and which specific fragment characteristics to model. 

How the flight safety analyst sees these uncertainties, and his options to evaluate their 

implications, depends both on the methodology employed by the fragment catalog developer and 

the risk analysis tools available to the flight safety analyst. Some risk analysis tools are designed 

to employ discrete lists of well-specified fragments. Other tools employ combinations of 

discrete values together with probability distributions for other values. This uncertainty is 

frequently expressed by flight safety analysts in two distinct ways. First, uncertainty may be 

expressed in the values characterizing a fragment or group of fragments based on the assumption 

that the particular fragment catalog, as a whole, is correct. Second, uncertainty can be accounted 

for with the definition of alternative fragment catalogs. Alternative fragment catalogs recognize 

that frequently there are alternative credible breakup patterns for the missile or rocket. When 

alternative credible fragment catalogs can be identified, they can each be evaluated against the 

hazard criteria. The flight safety analyst may then choose to compute a weighted average of the 

resulting risks or use a bounding analysis as deemed appropriate. This approach can also be 

used to explore known biases or data limitations in the methodologies on which the catalog was 

based. 

The use of threshold criteria is sensitive to both the individual fragment characteristics as 

well as the characteristics of the fragment catalog. A critical parameter is the number of pieces 

of debris above the threshold mass (especially for aircraft). A related parameter is the mass 

distribution of pieces. This parameter, in conjunction with fragment drag characteristics, 

determines fragment impact kinetic energy. Fragment projected area and fragment materials are 

also important parameters. Most of the structural vulnerability thresholds are keyed to 

conservative assumptions about fragment shape and density. 

6-3
In addition to the uncertainty in characteristics of impacting fragments, human 

vulnerability can be affected by fragment protrusions and lacerating edges. Fragment catalogs 

typically do not report this type of information and it is not practical to predict either fragment 

impact orientations or the state of rotational motion at time of body impact. 

Blast wave hazards are typically characterized by the pressure and positive impulse (the 

area under the initial positive portion of a pressure versus time curve89) at a receptor. The 

uncertainties at the receptor arise from the uncertainty in the effective yield of the explosion, 

uncertainty in the propagation resulting from atmospheric effects and terrain effects, and 

uncertainty in local amplification at the receptor by terrain and structures. 

6.2 Unsheltered People 

This section presents hazard thresholds for two hazards. They are fragment hazards and 

blast hazards. Within the boundaries of a range, people at risk are typically able-bodied adults. 

Outside the range, people potentially exposed often include people of all ages and physical 

conditions. Consequently, it is vital that threshold criteria be designed to protect a diverse 

population in terms of ages and physical conditions. 

Hazard thresholds presented are values above which people are treated as experiencing 

particular levels of injury. Thus, a blunt trauma casualty threshold should be interpreted as 

meaning that a person struck by a fragment with kinetic energy above the threshold becomes a 

casualty. As discussed in Chapter 7 of this Supplement, the determination of the area within 

which a person is vulnerable depends on the dimensions of a person and the dimensions of the 

fragment. 

As an initial approximation outside of the immediate launch area, most debris impacts are 

nearly vertical. Under these circumstances, exposed persons are typically represented as having 

a circular vulnerable region with a one-foot radius. 

Table 6-1 summarizes the injury thresholds for people presented in this section. 

TABLE 6-1. INJURY THRESHOLDS 

Hazard Mechanism Injury Level Threshold Value 

Blunt trauma Casualty 11 ft-lb 

Blunt trauma Fatality 25 ft-lb 

Chunky penetration Casualty 34 ft-lb/in2

Overpressure Casualty 2 psi 

6.2.1 Fragment Hazards. When a fragment impacts the human body, body segments are 

accelerated and portions of the body segments may be deflected. Excessive acceleration of body 

 

89 See Figure 6-5. 

6-4
organs or excessive body deformations cause injuries known as blunt trauma. Fragments 

impacting directly over a fragile organ, such as the liver, can cause localized blunt trauma. 

Heavy fragments can crush body segments between the fragments and a rigid object such as the 

ground or a wall. Threshold impact kinetic energies to protect against blunt trauma and crushing 

injuries are governed by levels required to protect against blunt trauma. 

Penetrating injuries can result from relatively small, compact high-speed blunt fragments 

such as a bullet (chunky penetration) striking the body. These impacts injure by penetrating the 

body wall and depositing energy in the tissue. Glass shards and ragged metal may cause 

lacerating penetration injuries. Most commonly, these laceration injury levels are dependent on 

the orientation of the impacting fragment with respect to the body surface. 

a. Blunt Trauma and Crushing Injuries. The threshold criterion for protection against 

blunt trauma and crushing injuries is 11 ft-lb impact kinetic energy. This criterion is 

designed to afford protection against injury levels of an Abbreviated Injury Scale 

(AIS) of level 3 or worse. The threshold criterion for protection against blunt trauma 

and crushing fatalities is 25 ft-lb impact kinetic energy. 

(1) Development of the Hazard Thresholds. The 11 ft-lb criterion is based on 

precedent and upon models of human vulnerability demonstrating the 

effectiveness of the chosen level as a screening criterion. 

The national ranges have used a variety of criteria to determine that an 

impacting fragment is hazardous. Some of these have been based on impact 

kinetic energy, some of them have been based on the ballistic coefficient of an 

impacting fragment, some of them have been based on higher fidelity injury 

modeling. The 11 ft-lb impact kinetic energy criterion is the lower bound of all 

previously used criteria. Moreover, in a number of cases this value was used to 

protect against all levels of injuries. FAA/AST published a Notice of Proposed 

Rule Making (Reference 6a) that adopted 11 ft-lb as a threshold criterion for all 

commercial launches. 

The 25 ft-lb lethality threshold was derived from the lethality curves by body 

part presented in Feinstein (Reference 6f). Feinstein presents 10 percent, 

50 percent, and 90 percent fatality curves by body part. These curves were 

previously interpreted as representing points on a lognormal probability 

distribution and used to derive the RCC 321-97 (Reference 6b) lethality curves. 

The one percent point on the RCC lethality curves for standing adult male persons 

is 18.5 ft-lb; the 1 percent point average of sitting, standing and prone positions 

is 21.7 ft-lb. 

Careful review of RCC 321-97 shows a significant modeling error. Standing 

persons are treated as having more than a 40 percent probability of being 

impacted in the thorax by vertically falling fragments. This error arose by 

treating impacts to the shoulders as impacts to the thorax. Horizontal impacts to 

the thorax pose a serious threat of fatality. By contrast, vertical impacts to the 

shoulders are one of the least threatening impacts to produce fatalities. 

6-5
Using the conservative assumption that the vertical impacts are dominated by 

the vulnerability of the head would result in a 1 percent threshold for adult males 

of 28 ft-lb. The treatment of the head as the most vulnerable body part is also 

appropriate for seated persons. Prone persons would have significant exposure to 

the thorax. For certain fragment weights, Feinstein shows the thorax to be more 

vulnerable at the 1 percent threshold. Nevertheless, only a small portion of the 

exposed population is in a full prone position. When prone persons represent a 

significant portion of the population, a more stringent criterion of 16 ft-lb should 

be used as the 1 percent threshold for adult males. 

Data provided in Reference 6d suggests that overall 1 percent population 

thresholds can be estimated as seven-eighths of the adult male threshold. The 

25 ft-lb fatality threshold was computed on this basis. (The same logic would 

provide a 14 ft-lb fatality threshold when prone persons dominate the exposure.) 

An additional important source of conservatism for standing persons is that 

the casualty area/fatality area computation in Chapter 7 treats the entire exposed 

area of the person as being as vulnerable as the head. 

(2) Confidence in Models. While kinetic energy by itself is not necessarily a good 

predictor of injury, blunt trauma injury is strongly dependent on the mass (m) and 

velocity (v) of the fragment. No single simple function of mass and velocity 

correlates well with injury for all fragment weights. This has been recognized for 

some time. Reference 6f shows several weight regimes for injury modeling. The 

proposed measures for predicting injury are of the form mvx

. The exponent of the 

velocity depends on the fragment mass. A major reason why no single function 

of mass and velocity applies universally is that body response to an impact, not 

impacting fragment characteristics, causes injury. Excessive displacement of 

organs and strains within tissues cause damage. Nevertheless, for the purpose of 

establishing an injury threshold, impact kinetic energy is a valid and available 

quantity. The 11 ft-lb threshold provides a significant but reasonable amount of 

conservatism in protecting against blunt trauma and crushing injuries 

(Reference 6c). 

Figure 6-1 compares the proposed threshold value of 11 ft-lb to the predicted 

probability of casualty from blunt trauma injuries for the general public (a mixed 

population of adults and children) (Reference 6d). Impacts on the head 

(vertically), thorax, and abdomen (horizontally) are shown for various fragment 

weights. In all cases, the 11 ft-lb criterion is at or below the threshold of injury 

predicted by the models. Although only one set of model results is illustrated 

here, this conclusion is supported by the human vulnerability modeling 

community (References 6e, 6f, and 6g). 

6-6
0

20

40

60

80

100

0 5 10 15 20 25

Velocity (ft/s)

Probability of Casualty (%)

Head (Model)

Thorax (Model)

Abdomen (Model)

11 ft-lb threshold

1000 lb Fragment

0

20

40

60

80

100

0 5 10 15 20 25 30

Velocity (ft/s)

Probability of Casualty (%)

Head (Model)

Thorax (Model)

Abdomen (Model)

11 ft-lb threshold

80 lb Fragment

0

20

40

60

80

100

0 10 20 30 40 50 6

Velocity (ft/s)

Probability of Casualty (%)

0

Head (Model)

Thorax (Model)

Abdomen (Model)

11 ft-lb threshold

10 lb Fragment

0

20

40

60

80

100

0 50 100 150 200 250

Velocity (ft/s)

Probability of Casualty (%)

Head (Model)

Thorax (Model)

Abdomen (Model)

11 ft-lb threshold

1 lb Fragment

Figure 6-1. Eleven (11) ft-lb criterion compared to probability of casualty curves 

for the general public. 

Figure 6-2 shows that in addition to providing threshold level protection for 

all of the general public, the 11 ft-lb criterion provides significant protection for 

children. The figure compares the 11 ft-lb threshold with selected injury models 

and sample data points including impacting golf balls, baseballs and a small 

fragment from the skin of a destroyed vehicle. The modeled injury curves have a 

probability of approximately 75 percent of resulting in an injury severity level of 

the labeled AIS level and approximately 25 percent of the next higher AIS level. 

The chart shows AIS level 3 for a median adult male and AIS levels 1, 2 and 3 for 

a one-year old child. The curves for a child are shown to provide an indication of 

the conservatism of the criterion. The curves for a one-year old child are based 

on modeling only the mass of a one year old. No adjustment has been made for 

the difference in injury level that a child receives as a result of a given body part 

response (e.g., head acceleration) in comparison to an adult. Therefore, these 

curves should be interpreted as indicative of the conservatism of the criterion 

rather than to be taken as literally predicting the injury level. Nevertheless, the 

curves in Figure 6-2 for one-year olds indicate that the 11 ft-lb criterion 

“protects” the child against the AIS level 3 injuries for most of the range of 

weights and for lesser injuries for the larger weights. 

6-7
1

10

100

1000

0.1 1 10 100

Weight (lb)

Velocity (fps)

11 foot-pounds

1 year old, blunt trauma, AIS = 1

1 year old, blunt trauma, AIS = 2

1 year old, blunt trauma, AIS = 3

Median adult male, blunt trauma, AIS = 3

Golf Ball (Terminal Velocity)

Golf Ball (Propelled)

Baseball (Terminal Velocity)

Baseball (Fastball)

Small skin fragment (Terminal Velocity)

Figure 6-2. Comparison of 11 ft-lb criterion with injury models and sample data 

points. 

(3) Effect of Input Data Uncertainty. Input data includes fragment characterization 

and characterization of persons at risk. Uncertainty associated with the impacting 

fragment was discussed in paragraph 6.1.2. It is not generally possible to know 

the type of person who might be hit, other than on a statistical basis. While the 

11 ft-lb criterion is believed to offer reasonably adequate protection even for 

small children, it is much less conservative for small children than it is for adults. 

Moreover, blunt trauma is one of several possible injury mechanisms as noted in 

paragraph 6.2.1. Each fragment should be evaluated for all of the relevant injury 

mechanisms. 

b. Chunky Penetrating Injuries. Penetration injuries require two conditions. First, the 

fragment must penetrate the protective combination of clothing and skin. Second, 

having penetrated the clothing and skin protecting the tissue, the fragment must 

possess sufficient residual energy to cause significant damage to internal tissue or 

organs. Fragments with a small contact area have a greater chance of penetrating the 

protective layer about the body. However, once the skin has been fully penetrated, 

fragments with small effective cross-sections can pass through the body without 

transferring significant energy levels to the surrounding tissue. Nevertheless, impact 

kinetic energy per contact area of the fragment is the best single parameter predictor 

of the onset of significant injury. 

The threshold criterion for protection against non-lacerating penetration injuries is 

a kinetic energy to area ratio of 34 ft-lb/in2

. 

(1) Development of the Hazard Thresholds. Essentially all simplified models of 

penetrating injuries are based on the ratio of the impact kinetic energy, E, of the 

fragment to the area, A, presented by the fragment. Where models differ 

significantly, however, is in the definition of the area A. In some cases, A is the 

average cross sectional area of the fragment, while in others, it is a smaller initial 

6-8
contact area. This leads to a large variation in the reported value of energy-toarea (E/A) statistics. 

 Table 6-2 displays the reported median and threshold values for E/A for various 

levels of penetration (skin penetration or casualty), with various amounts of 

protection (light clothing, bare skin) from a variety of sources (References 6h, 6i, 

and 6j). 

TABLE 6-2. REPORTED ENERGY/AREA VALUES FOR PENETRATING 

INJURIES 

Type of Value Consequence Protection E/A (ft-lb/in2) 

Median Skin Penetration Bare skin 40-109 

Median Skin Penetration Light Clothing 80 

Median Casualty Light Clothing 85 

Threshold Skin Penetration Bare skin 10-64 

Threshold Casualty Light Clothing 34 

 The threshold value for casualty is of primary interest. A threshold E/A of 

34 ft-lb/in2 is reported for casualty-level injuries (AIS ≥ 3) for persons with light 

clothing protection. Only Sturdivan (Reference 6h and Reference 6i) reports values 

for casualties. This value is, broadly speaking, consistent with the conservative end 

of the range of reported values for skin penetration. Additionally, the FAA 

(Reference 6k) considered a value of 40 ft-lb/in2 as part of a proposed rule. 

(2) Confidence in Models. This E/A value for probability of casualty with light 

clothing is conservative, as it is below some of the reported thresholds for bare 

skin penetration. Reasons for the conservatism might include a somewhat 

different experimental setup leading to differences in the data, actual differences 

in the model or analysis, or differences in the definition of A. 

The definition of A used in Sturdivan, et al (Reference 6i) is the average cross 

sectional area, which is a larger value than if A were defined as an initial contact 

area. A larger value of A obviously leads to a smaller value of E/A. This is 

advantageous for two reasons. First, the average cross sectional area is far easier 

to estimate than the initial contact area for a generic fragment, and is likely to be 

the area actually used in computing E/A for breakup lists, whether or not it was 

used in the underlying vulnerability model. Second, in setting threshold values, a 

conservative approach is desirable to insure that the at-risk population is 

adequately protected, and this value meets that standard as well. 

Thus, the value 34 ft-lb/in2

 appears reasonable. 

6-9
(3) Effect of Input Data Uncertainty. There are a few caveats, however, as some of 

the input parameters could affect the threshold. No consideration has been given 

to the possibility of greater sensitivities of children, the aged, and the infirm 

populations. For skin penetration only, there is not expected to be significant 

differences due to youth, though the elderly might be slightly more susceptible. 

For the injury after skin penetration, children might be more susceptible to 

intrusion by a fragment of a given size than an adult. For example, their internal 

organs are closer together, so a fragment of a fixed size which might impact a 

single organ in an adult is conceivably more likely to impact multiple organs in a 

very small child. The direct impact of organs, however, is not explicitly 

accounted for in this model, just the energy deposited in the tissue. Thus, this 

threshold criterion is likely to be less conservative for populations of children. 

Additionally, for populations with significantly different levels of clothing 

protection (such as extreme tropical or equatorial populations), this threshold 

criterion is less conservative. 

As mentioned above, the differences in fragment presented area and how it is 

measured have an effect on the threshold. Using an area measurement of only the 

contact area would yield larger values of E/A. Moreover, fragments of different 

characteristics (e.g., compliance, shape, etc.) are expected to vary significantly in 

the threat posed as will the location on the body of the impact. 

6.2.2 Blast Hazards. Blast hazards represent a second mechanical injury hazard. The 

explosive safety community refers to the air-blast injuries produced by the direct effect of the 

shock wave on the body as “primary” injuries. The acceleration of the body wall by the shock 

wave transmits shock waves into closed body cavities. The imparted energy is dissipated at 

interfaces between tissue and air or different tissue types having different densities. This energy 

dissipation produces damage to tissue. Typical primary injuries include damage to the ear, 

damage to the larynx, damage to the gastro-intestinal tract, and damage to the lungs. Injuries 

produced by fragments of the explosive device or debris from the environment are called 

“secondary” injuries and injuries produced by the gross displacement of the body by the blast 

overpressures and subsequent impact on hard or sharp parts of the environment are called 

“tertiary” injuries (Reference 6l). This section addresses primary injuries. Secondary injuries 

are addressed by the section on fragment injury. 

The threshold criterion for protection against air-blast overpressure injuries is 2 psi 

incident overpressure. This threshold is designed to protect against primary injuries. The 

threshold does not address secondary and tertiary injuries.

It is broadly accepted in the national range community that protection against eardrum 

rupture should define the air-blast overpressure threshold. Nevertheless, published values range 

from 2 psi (Reference 6m) to 5 psi (Reference 6n). The 2 psi value was adopted as the most 

recent published value and the most conservative. All of these values are asserted to be 1 

percent probability of effect thresholds. Moreover, essentially all overpressure vulnerability 

6-10
models are based on common sets of test data. Variations in threshold are ascribed to how the 

data has been analyzed and modeled. 

In order to place this threshold in context, Table 6-3 lists sensitivities to overpressure for 

various body parts. 

TABLE 6-3. BODY PART SENSITIVITY TO OVERPRESSURE 

Organ 

Threshold (1%) 

Overpressure (psi) 

Median 

Overpressure (psi) 

Middle/inner ear90 0.2 1 

Eardrum 2 15 

Larynx 6 10 

Gastro-Intestinal Tract 8 12 

Lungs 11 16 

As noted above, the conservative approach of using a lower bound estimate of 1 percent 

thresholds was used in developing the overpressure criterion. Nevertheless, no consideration has 

been made for possible greater sensitivities of children, the aged and the infirm. Body mass 

differences are expected to be an important factor in the susceptibility of children’s organs in the 

abdomen and the thorax. It is not expected that body mass differences will be important in 

determining eardrum susceptibility. The pliability of the tissue constituting the eardrum may, by 

contrast, be quite variable in these other population groups. It is speculated that the eardrum 

would be more pliable among young people and more rigid and thinner among older or infirm 

populations. Additionally, some have suggested that the size of the ear cavity should affect the 

eardrum response to overpressure waves. 

Thus, while the threshold is conservative, extra precautions might be considered when 

populations at risk are expected to include significant numbers of elderly or infirm persons. 

Very low overpressures are highly sensitive to variations in propagation conditions, uncertainty 

in characterizing source terms, and terrain conditions. While the 2 psi overpressure is at the low 

end of air-blast overpressures, it is high enough so these factors are not expected to dominate. 

6.3 Sheltered People 

Kinetic energy thresholds for buildings and transportation system structures are 

thresholds for penetrating the protective structure. Thus, a fragment may deplete all of its kinetic 

energy in the act of penetrating the structure or it may have residual kinetic energy after 

penetrating the structure. Conservatively, an analyst may consider all fragments that penetrate 

the structure as hazardous. Alternatively, the analyst may add to the residual kinetic energy after 

structural penetration the kinetic energy the fragment acquires falling to a level/height at which it 

can reach a person. The hazard from any secondary fragments formed during the penetration 

 

90 Middle/inner ear injury thresholds have been included for completeness although they are regarded as less severe 

injuries. 

6-11
process must also be considered. The kinetic energy of primary and secondary fragments may 

be compared with the thresholds for injuring people. 

6.3.1 Buildings

a. Fragment Hazards. Hazard thresholds for building structures are based on the 

conservatively estimated minimum hazard which can penetrate the roof of the 

building. Even at the threshold level there is more than an order of magnitude 

variation between the least vulnerable and the most vulnerable structures. Thus, to 

limit the excess conservatism contained in the threshold values it was desirable to 

categorize structures. Consistency with fundamental models would require a 

classification based on roof characteristics. However, this approach would result in 

building classes that would be difficult to use by a flight safety analyst. Instead, four 

different building classes have been defined that more directly relate to the type of 

information that may be available to an analyst from community planning maps, 

census data and similar sources: 

Class A

• Mobile homes and trailers. 

• Temporary office trailers. 

Class B

• Single family dwellings. 

• Duplex and fourplex residential dwellings. 

• Small condominiums and townhouses. 

• Small apartment buildings. 

Class C

• Small retail commercial buildings (gas stations, stores, restaurants, strip 

malls). 

• Small office and medical office buildings. 

Class D

• Manufacturing plants. 

• Warehouses. 

• Public buildings (large shopping malls, large office buildings, large 

apartment buildings, hotels, etc.). 

These building classes were then translated into the structural roof types. 

Typically, this resulted in more than one structural type for a given class of 

buildings as indicated below. Finally, the weakest structural type (designated by 

asterisks) within each class was chosen, conservatively, to represent that class of 

buildings. 

6-12
 Class A

• 22 gage corrugated steel roof . 

• 24 gage corrugated aluminum roof.* 

• 1⁄2 inch plywood roof. 

 Class B

• Wood roof*. 

 Class C

• Composite roof (rigid insulation on steel).* 

• Corrugated steel roof (pre-engineered metal building type roof). 

• Light weight concrete on corrugated steel decking roof. 

 Class D

• Light weight concrete on corrugated steel decking roof.* 

• Reinforced concrete slab roof. 

Penetration threshold values for the four classes of buildings described above are shown 

in Table 6-4. Table 6-4 shows the building category by class and weakest construction, and 

penetration thresholds in terms of the minimum kinetic impact energy of a compact, irregularly 

shaped, tumbling steel fragment (CD = 0.75) impacting the roof at terminal velocity at 5,000 feet 

MSL91. Fragment weights corresponding to the minimum kinetic energy for penetration are also 

listed to assist the analyst in interpreting the criteria. Steel was selected as the basis for these 

calculations because it is the densest of the most common fragment materials. 

TABLE 6-4. THRESHOLD VALUES FOR ROOF PENETRATION 

Building category Penetration Criteria 

Generic 

Class 

Roof 

Construction 

Minimum Weight 

Fragment (lb) 

Minimum Kinetic 

Energy (ft-lb) 

A 24 gage corrugated aluminum 0.037 17 

B 5/8 inch plywood 0.075 30 

C Composite roof (2 inch rigid gypsum 

insulation on steel purlines) 

0.075 30 

D 3 1⁄2 inch Light weight concrete on 

22 gage corrugated steel decking 

0.500 414 

(1) Development of the Hazard Thresholds. The values presented in Table 6-4 are 

based on structural vulnerability models (Reference 6x, 6y, and 6kk) 

demonstrating the effectiveness of these levels as screening criteria. Fragment 

impact kinetic energy thresholds for buildings (roof penetration) were computed 

based on compact fragments having the density of steel impacting the roof 

vertically at terminal velocity for 5,000 feet MSL. A nominal drag coefficient 

of 0.75 was assumed for irregular-shaped tumbling fragments. “Compact 

 

91 An impact altitude of 5,000 feet MSL was selected to be representative of impact altitudes over inland ranges. 

When applied to a coastal range it represents an additional source of conservatism. 

6-13
fragments” are defined as fragments having relatively small surface area-tovolume ratios. These computations include several levels of conservatism: 

• Threshold values for roof penetration were conservatively selected in lieu of 

threshold values for injury given roof penetration. The impact kinetic energy 

to penetrate a roof depends on the shape and density of the fragment, the 

construction of the roof and the impact geometry. Fragments impacting a roof 

in the region between supporting beams require less kinetic energy to 

penetrate the roof than fragments impacting over supporting structure. 

• The weakest structural type within a building class was chosen to represent 

that class of building. 

• Steel, the densest common fragment material, was used for the calculations. 

(2) Confidence in Models. Confidence in the models used to obtain the threshold 

values given in Table 6-4 was established in a recently conducted verification and 

validation effort92 (Reference 6z). Following completion of the verification 

effort, validation of the models was conducted by comparing analytically 

predicted results with available experimental data from recently conducted tests 

(References 6aa and 6ii). Independent validation of the analytical model was 

performed by Karagozian and Case, structural engineers (Reference 6jj). 

 Tests with both steel and concrete impactors (fragments) were conducted 

against concrete and wood targets. Impacting objects consisted of steel and 

concrete spheres of various sizes fired against the targets at various speeds. These 

tests support the effectiveness of the Table 6-4 values as screening criteria. For 

many of the test cases the model and the test results agree. Whenever the model 

disagrees with the test results, the model is conservative. In other words, it 

predicts penetration for a case for which no penetration was observed. 

 Finally, the use of threshold penetration values as risk criteria ignores any 

tolerance by the human body to insult. The net effect of compounding 

conservatisms in the fragment characteristics, roof penetration models and human 

injury models is what may be considered very conservative results. This level of 

conservatism is necessary to ensure safety in situations where more specific data 

is unavailable. 

(3) Effect of Input Data Uncertainty on Application of Model. Input data uncertainty 

is associated with the impacting fragment and with the roof model, the former 

being the larger (See paragraph 6.1.2). 

 The uncertainty associated with the input parameters of roof structures has 

been investigated (Reference 6s), but so far only for steel frame buildings. In this 

case, variations in design configuration as well as material properties were 

considered. For present purposes, where penetration energy thresholds are of 

interest, it is primarily the uncertainty in the material properties of the roof plates 

 

92 Verification is defined as ensuring that the mathematical algorithms comprising the models are solved correctly in 

a numerical sense, while validation is defined as ensuring that the mathematical models themselves correctly 

represent the physics of the intended applications. 

6-14
that affect the penetration energy threshold. For corrugated steel decking, the 

coefficient of variation was found to be approximately 22 percent, implying a 

22 percent coefficient of variation on penetration energy for the plate shear failure 

mode. 

 These relatively small uncertainties are considered to be more than offset by 

the conservative assumptions on the fragment characteristics (compact steel 

fragments) and roof penetration models used to estimate threshold penetration 

values. 

b. Blast Hazards. When the front of an air blast wave strikes the face of a structure, 

reflection occurs as shown in Figure 6-3. As a result, the building surface facing the 

explosion experiences overpressure levels at least twice that of the free-field 

(commonly call side-on) wave front. The reflected shock front propagates back into 

the air in all directions with the high pressure region expanding outward towards 

regions of lower pressure. 

Point of Explosion

Blast Over-pressure

The violent rise in air pressure 

above normal atmospheric 

pressure.

Reflected Pressure

The amount of pressure felt by 

an object standing directly in 

the path of an expanding blast 

wave.

Side-on Pressure

The impulse of pressure 

undergone by an object as a 

blast wave envelopes and 

passes it.

Drag (Suction)

The negative pressure effect felt 

on the rear face of a structure 

as a blast wave moves away 

from the building.

Point of Explosion

Blast Over-pressure

The violent rise in air pressure 

above normal atmospheric 

pressure.

Reflected Pressure

The amount of pressure felt by 

an object standing directly in 

the path of an expanding blast 

wave.

Side-on Pressure

The impulse of pressure 

undergone by an object as a 

blast wave envelopes and 

passes it.

Drag (Suction)

The negative pressure effect felt 

on the rear face of a structure 

as a blast wave moves away 

from the building.

Drag (Dynamic 

Pressure) 

The forces acting on the 

building faces as a result 

of the blast wind 

Side-On Pressure

The forces acting on the 

building surfaces that do 

not face the explosion 

Reflected Pressure

The amplified forces 

acting on the building 

surfaces directly facing 

the explosion 

Blast Overpressure 

The violent rise in air 

pressure above the 

normal atmospheric 

pressure 

Figure 6-3. Air blast impacting a structure. 

As the blast wave front continues to move forward, the reflected overpressure on 

the face on the structure quickly drops back to the level without reflection plus an 

added drag force associated with the wind (dynamic) pressure caused by acceleration 

of the air mass. The wave front then bends, or “diffracts,” around the structure as 

shown in Figure 6-4 (see part b through part e). 

6-15
Figure 6-4. Diffraction of blast front across structure (looking down). 

In (b), the wave front has just reached the front face and will be reflected back. 

In (c), the blast wave has proceeded half way down the structure and in (d) has just 

passed the rear of the structure. At this time, the pressure on the front face has 

dropped to some extent while the pressure begins to build up on the back face. 

Finally in (e), when the blast front has passed the structure, approximately equal 

pressures are exerted on the sides and top and a pressure differential exists between 

the front and back faces due to wind forces. 

The pressure differential between the front and back faces has its maximum value 

when the blast wave has not completely surrounded the structure producing a lateral 

(or translational) force that tends to deflect the structure in the same direction as the 

blast wave. This force is known as the “diffraction loading” because it operates while 

the blast wave is being diffracted around the structure. The extent of diffraction 

loading is strongly dependent on the size/geometry of the structure. 

When the blast wave has engulfed the structure, the pressure differential is small 

and the loading is then almost entirely due to the “drag pressure” exerted on the 

building by the blast wind. The actual pressures on all faces of the structure are in 

excess of ambient but decrease steadily until the positive phase of the blast wave has 

ended (see Figure 6-5). Hence, the diffraction loading on a structure (without 

openings) is eventually replaced by an inward compression (squeezing action) 

combined with the dynamic pressure of the blast wave. 

Diffraction and drag loads acting on a structure can result in significant damage 

(and even collapse) resulting in injuries to occupants from thrown debris, flying glass 

shards, and structural collapse. The levels of structural/window damage and injuries 

are functions of both the peak overpressure (amplitude) and impulse (area under the 

pressure versus time curve over the positive phase duration) of the blast wave shown 

in Figure 6-5. 

6-16
Figure 6-5. Free-field blast wave overpressure time history. 

Large footprint buildings with small windows and door areas and fairly strong 

exterior walls respond mainly to diffraction loading (the effect of the shock front 

moving across the building). For small structures or structures with many openings, 

however, the pressures on different faces (or individual structural elements) from 

diffraction forces act for only a short time and are quickly equalized. These “drag 

sensitive” structures respond primarily to the drag forces whose magnitudes 

correlates with the duration (or impulse) of the blast wave. Drag sensitive structures 

include television and electric transmission towers, utility poles, smokestacks and 

steel buildings with light walls of asbestos, aluminum, or corrugated steel. (Some 

steel buildings can become drag sensitive because of the failure of the walls at low 

overpressure that result in many openings.) 

Window breakage is primarily the result of overpressure loading from the 

diffraction of the blast wave around the structure. Once a window fails, the 

differential pressure acting on the shards (the diffracted plus dynamic pressure acting 

on one side and atmospheric pressure on the interior of the structure) accelerates them 

inward until the pressure equalizes on the shards or the blast wave dies out. The 

velocity imparted to glass fragments and their potential to injury occupants is 

therefore strongly dependent on the impulse, or duration, of the blast wave. 

6-17
Based on the above discussion, the threshold criteria for protection against 

building damage and injury93 to its occupants due to blast waves is broken into three 

parts: 

(1) When buildings have no windows, the threshold criterion is 1 psi incident (or 

free-field) overpressure at a distance measured from the center of the explosive 

source to the nearest point on the structure. 

Note: When buildings have a significant amount of glazed area94, the threshold 

criterion depends on the impulse of the blast wave, or equivalently, the yield of 

the explosion as follows: 

(2) For yields ≤ 50,000 pounds equivalent Trinitrotoluene (TNT) yield: Threshold 

criterion = 0.50 psi incident overpressure. 

(3) For yields > 50,000 pounds equivalent TNT yield: Threshold criterion = 0.25 psi 

overpressure. 

The one psi threshold criterion defined for structural damage is consistent with 

the Department of Defense Explosive Safety Board’s guideline for the distance 

buildings (without windows) must be sited from an explosive source for air blast 

effects (Reference 6p). The lower overpressure criteria for structures with windows, 

0.5 psi and 0.25 psi, were set to ensure a low probability of serious injuries due to 

glass breakage for TNT equivalent yields of up to 50,000 pounds and above 50,000 

pounds, respectively. 

The air blast threshold criteria defined above are conservative estimates of the 

overpressure levels at which the onset of serious injuries occur based on available 

accident and controlled test data. For example, the 1 psi free-field (incident) 

overpressure threshold level for structural damage is shown overlaid in Figure 6-6 on 

a overpressure-impulse (P-I) diagram model developed for a small wood frame 

structure (~2500 square feet). Also superimposed on the damage P-I diagram are 

accident and test data gathered from several different sources relating to the blast 

damage of lightly constructed structures. The numbers in the small circles indicate 

the percent damage estimated for lightly constructed structures (structures vulnerable 

to air blast) exposed to the air blast from conventional bombs and nuclear explosions. 

Also shown along the axes of the P-I diagram are regions of expected damage from 

other researchers. The red lines running diagonally across the P-I diagram represent 

the overpressure and impulse for various size TNT explosions (although not shown, 

the lower P-I values are explosions farther from the receptor while the higher P-I 

values are for closer in explosions). Recognizing the significant variability that is 

reflected in the data due to construction, geometry, and blast loading, the damage P-I 

diagram is in general agreement with these data. At the 1 psi threshold, there is little 

chance of structural damage and therefore virtually no chance of serious injuries from 

structural damage as shown by the serious injury P-I diagram in Figure 6-7. 

 

93 Protection against injury is intended to be a protection against severe injury or casualties (AIS≥3). 94 The threshold presented for buildings with windows is intended to be applied only for buildings with low 

densities of exposed populations. It is to be used only for direct overpressure loading; it is not to be applied to 

Distant Focusing Overpressure analyses. 

6-18
Figure 6-8 and Figure 6-9 show P-I diagrams for the probability of breakage and 

serious injury for large, annealed (weaker) glass windows. Overlaid on these 

diagrams are the 0.25 psi and 0.5 psi threshold levels for explosions with equivalent 

TNT weights of >50,000 lbs and <50,000 lbs, respectively. Figure 6-8 and Figure 6-9

indicate that although a significant percentage of these large and relatively weak 

windows could break, shards that enter the room are unlikely to present a hazard to 

occupants. Although incident overpressure is used as a convenient metric for these 

diagrams, the results account for the effects of reflected overpressures predicted for 

building walls. These physics-based P-I breakage and injury models are consistent 

with observed data. For example, Figure 6-9 shows the overpressure levels below 

which there were no recorded glass-related serious injuries from the Khobar and 

Oklahoma City bombings. More detailed comparisons show good agreement 

between these computational predictions and the evidence from historical events 

(such as Khobar Towers and Oklahoma City explosions), and DoD test data 

(Reference 6hh). The 0.5 psi threshold for explosions <50,000 lbs of TNT 

conservatively falls below these two data points. Also note that the 0.5 psi threshold 

becomes more conservative for smaller TNT weights. 

As stated above, the threshold side-on overpressure levels (also called incident or 

free-field levels - those measured at the location of interest but neglecting the 

presence of the structure) were conservatively set to essentially eliminate the 

probability of serious injuries for the most vulnerable building and window types. In 

practical situations, an explosion can affect people in a large area and occupants will 

be distributed across many building types and each building type could have various 

numbers, types, and sizes of windows. To more accurately estimate the probability of 

serious injury, air blast models are available (such as the P-I diagrams shown in 

Figure 6-6 through Figure 6-9). These models estimate the full range of occupant 

injury for different generic structure and window types (Reference 6q). 

Application of these thresholds uses two types of input data. The first is the 

characterization of the blast loading and the second is the characterization of the 

buildings at risk. The thresholds have been formulated so that the only critical 

building characteristic is the presence of windows. When there is uncertainty as to 

whether buildings have windows, the analyst should conservatively assume windows 

are present. Larger uncertainties are associated with the explosive yield and 

explosive overpressure. The analyst is advised to consider the effects of terrain, 

buildings and meteorological conditions on overpressure levels. 

6-19
Figure 6-6. Structural damage due to air blast impacting lightly constructed structures. 

Figure 6-7. Serious injury due to air blast impacting lightly constructed structures. 

TNT Wt, 

(lb) 

10.000

100.000

1000.000

0.100 1.000 10.000 100.000

Incident Overpressure (psi)

Incident Impulse (psi-msec)

Prob of Casualty (%)

SERIOUS INJURY 0.1 Small Residential

Wood Frame House 0.5

1.0

5.0

10.0

20.0

30.0

40.0 5000K

50.0

60.0

70.0

80.0 500K 90.0

100.0

50K

5K

1K

6-20
Figure 6-8. Breakage due to air blast impacting large, annealed windows 

Figure 6-9. Serious injury due to air blast impacting large, annealed windows. 

TNT Wt, 

(lb) 

10

100

1000

0.1 1.0 10.0

Incident Overpressure (psi)

Incident Impulse (psi-msec)

TNT Wt, 

(lb) 

Prob of Breakage (%)

1

10

30

50

70

90

100

WINDOW BREAKAGE

Large Annealed Glass 

5000K

500K

50K

5K

1K

0.25 

0.5

10

100

1000

0.1 1.0 10.0

Incident Overpressure (psi)

Incident Impulse (psi-msec)

Prob of Casualty (%)

0.01

0.10

1.00

5.00

10.00

12.00

SERIOUS INJURY

Large Annealed Glass 

(Unblocked GAR = 14.5%)

5K

50K

500K

5000K

1K

0.25 

0.5

Khobar (26,000 lb TNT)

– no SI below 0.9 psi

OK City (4,000 lb TNT)

– no SI below 2 psi

6-21
6.3.2 Ships. Hazard thresholds for ships were designed to protect against fragments 

penetrating ship cabin or deckhouse roofs. As in the case of buildings, the threshold levels vary 

by more than an order of magnitude between the least vulnerable and the most vulnerable types. 

Thus, to reduce the conservatism, different thresholds were developed for various categories of 

ships. Consistency with the underlying models would require a classification based on roof 

characteristics. This approach would produce ship structural classes that would be difficult to 

use by a flight safety analyst. Instead, five different ship classes are defined that more directly 

relate to the type of information that may be available to an analyst: the length of ships. The 

following length categories include the types of ships indicated below each category: 

Ships less than 25 feet in length

• Small fishing vessels 

• Small pleasure craft 

Ships 25 to 50 feet in length

• Small to medium size fishing vessels 

• Small to medium size pleasure craft 

Ships 50 to 100 feet in length

• Medium sized fishing vessels 

• Medium sized pleasure craft 

• Tug boats 

Ships 100 to 300 feet in length

• Large fishing vessels 

• Large pleasure craft 

• Coast Guard patrol ships 

Ships greater than 300 feet in length

• Container ships 

• Tankers95

• Other cargo ships 

• Pleasure cruise ships96

• Military ships 

While the foregoing classification of ship categories is based on the length of the vessel, 

fragment penetration vulnerability is more directly related to the construction material and 

thickness of the cabin/deckhouse roof. Design guides drawn from the American Bureau of 

Shipping (ABS) rules and other trade publications (References 6r through 6v) show that the 

choice of construction material and thickness for the cabin/deckhouse roof are related to size. 

 

95 LNG tankers are designed and built to the requirements specific for such vessels, in addition to those in the Rules 

for Building and Classing Steel Vessels. If there are any differences in the deckhouse roof thickness (and none are 

expected according to the Guide for Building and Classing Membrane Tank LNG Vessels) the requirements for the 

deckhouse on a LNG tanker are expected to be more stringent than those for a general steel vessel. However, the 

consequences may be more catastrophic considering the fire and explosion hazards. 96 The penetration thresholds for steel vessels apply to passenger cruise ships. The ABS Guide for Building and 

Classing Passenger Vessels (Reference 6t) refers to the Rules for Building and Classing Steel Vessels for scantling 

requirements of the deckhouse. However, a cruise ship typically has a significant number of the passengers out in 

the open areas. The protection criterion for unsheltered persons should be applied to these passengers. 

6-22
For this reason, the fragment impact hazard thresholds were evaluated for both the length of the 

vessel and roof construction material. Typically, this resulted in more than one structural 

material type for a given length category as illustrated in Figure 6-10 and the list that follows. 

Figure 6-10. Hull materials for vessels of different lengths. 

Ships less than 25 feet in length

• No roof is assumed 

• Use risk for unsheltered people 

Ships 25 to 50 feet in length

• Wood* 

• Fiber reinforced plastic (FRP) 

Ships 50 to 100 feet in length

• Wood* 

• Fiber reinforced plastic 

• Steel HSC (high speed craft) 

• Steel DISP (displacement craft) 

Ships 100 to 300 feet in length

• Steel HSC (high speed craft) 

• Steel DISP (displacement craft)* 

Ships greater than 300 feet in length

• Steel* 

Finally, the weakest structural material type within a category was chosen, 

conservatively, to represent that category of ships. These structural material types are indicated 

by the asterisks in the itemized list above. 

6-23
Penetration threshold values for the five ship length categories described above are 

shown in Table 6-5. Table 6-5 shows the ship category by length and weakest construction, and 

penetration thresholds in terms of the minimum kinetic impact energy of a compact, irregularly 

shaped, tumbling steel fragment (CD = 0.75) impacting the roof at terminal velocity at mean sea 

level (MSL). Fragment weights corresponding to the minimum kinetic energy for penetration 

are also listed to assist analysts in interpreting the criteria. Steel was again selected as the 

fragment material for these calculations because it is the densest of the most common fragment 

materials. 

TABLE 6-5. THRESHOLD VALUES FOR SHIP CABIN AND DECKHOUSE ROOF 

PENETRATION 

Ship Category Penetration Criteria 

Generic 

Class of Ship 

Roof 

Material 

Minimum Weight 

Fragment (lb) 

Minimum Kinetic 

Energy (ft-lb) 

< 25 ft No roof is assumed Use criteria for unsheltered persons 

25-50 ft 1/2 inch plywood 0.050 19 

50-100 ft 3/4 inch plywood 0.121 63 

100-300 ft 0.13 inch steel 2.5 3,000 

> 300 ft 0.20 inch steel 5.8 9,500 

The thicknesses for fiber reinforced plastic (FRP) and wood roofs were calculated using 

the scantling rules provided in (Reference 6r); the thicknesses for the steel roofs for vessels of 

100 ft to 300 ft in length are based on the minimum required thickness in the ABS Guide for 

Building and Classing Motor Pleasure Yachts (Reference 6s); the minimum roof thickness for 

steel vessels with a length of 300 ft or more was taken from the ABS Rules for Building and 

Classing Steel Vessels Under 90 Meters in Length (Reference 6u) to be conservative. 

a. Development of the Hazard Thresholds. Fragment impact kinetic energy thresholds 

for roof penetration are based on compact steel fragments impacting the roof 

vertically at terminal velocity for the particular fragment at MSL. A nominal drag 

coefficient of 0.75 was assumed for irregular-shaped tumbling fragments. “Compact 

fragments” are defined as fragments having relatively small surface area-to-volume 

ratios. These computations include several levels of conservatism: 

(1) Threshold values for roof penetration were conservatively selected in lieu of 

threshold values for injury given roof penetration. The impact kinetic energy to 

penetrate a roof depends on the shape and density of the fragment, the 

construction of the roof, and the impact geometry. Fragments impacting between 

support beams require less kinetic energy to penetrate the roof than fragments 

impacting over supporting structure. Moreover, vertically impacting fragments 

typically require less kinetic energy to penetrate than do fragments impacting at 

some lesser angle. 

(2) The weakest structural type within a ship class was chosen to represent that class 

of ships. 

6-24
(3) Steel, the densest common fragment material, was used for the calculations. 

b. Confidence in Models. Confidence in the steel plate penetration model used to obtain 

the critical penetration kinetic energies shown in Table 6-5 is based on comparative 

studies documented in References 6ll, 6mm, and 6nn. These studies compared 

various empirical models with published test data and with nonlinear finite element 

calculations. 

 Confidence in the wood model (drawn from Reference 6y) was established via 

comparison with test data. 

 For the penetration of steel plate targets, the Stanford Research Institute (SRI) and 

the Ballistics Research Laboratory (BRL) equations have been widely used. 

Comparisons with several sets of experimental data show that the BRL equation gives 

reasonable agreement with all of them, while the performance of the SRI equation is 

less satisfactory (Reference 6w). The BRL equation has been used to establish the 

penetration thresholds for steel roofs in Table 6-5. 

c. Level of Conservatism in Threshold Values. There are two types of input data 

uncertainty to consider; they are input data uncertainty associated with the impacting 

fragment and the uncertainty associated with the roof model, with the former being 

the larger (See paragraph 6.1.2). 

 Consistent with the level of simplification, significant uncertainties and 

inaccuracy are to be expected when aggregating dozens of vessel length/construction 

combinations into the five generic classes and in the characterization of the impacting 

fragments. The uncertainties and inaccuracy are dealt with through conservative 

assumptions in the development of the thresholds, including assumptions made in the 

determination of the vessel scantlings, the characterization of the fragments, and the 

derivation of the penetration models. Considering all these factors together, the final 

thresholds are believed to contain a level of conservatism commensurate with the 

intended purpose. 

6.3.3 Aircraft. The consequences of fragments impacting aircraft range from just barely 

noticeable on ground inspection to catastrophic. Factors determining the consequences include 

fragment mass, fragment shape and material, fragment impact velocity vector, aircraft type, 

aircraft velocity vector, location, and geometry of the impact. In contrast to ships and ground 

based receptors, aircraft velocities may contribute significantly to the relative velocity of a 

fragment with respect to the aircraft and, hence, to the impact kinetic energy. Moreover, aircraft 

are complex systems with some parts that may be relatively easily damaged by small dense rigid 

debris (such as metal parts of a fragmented missile). 

Aircraft vary significantly in their vulnerability. Some parts of an aircraft are critical to 

flight while other parts are not, and some portions are more easily damaged by debris than 

others. In addition, there is significant variation between the types of aircraft (helicopters, 

airplanes), size (two orders of magnitude), and the purpose for which they were designed 

6-25
(military, passenger transport, private use). The differences are manifested in many ways, such 

as different systems (engines, control, pressurization, etc.), locations of systems (fuel tank, 

control lines, etc.) 

materials used in construction (skin type, windshield type, support structures, etc.), and 

reliability (military planes are designed to survive attack and passenger planes have significant 

redundancy, whereas general aviation has much lower levels of protection). 

a. Primary Aircraft Vulnerability Thresholds. As a result of the complexity of the 

problem, the original version of RCC 321 published criteria based on the most 

vulnerable systems of the most vulnerable aircraft. This offered the advantage of 

simplicity at the cost of being much more conservative than necessary for some other 

aircraft classes. When these classes are most likely to be hazarded, unnecessary 

protection may be applied to them, limiting missions and/or increasing cost 

significantly. 

 These early versions of RCC 321 determined that a screening standard should be 

based on protecting the windshields of general aviation airplanes and protecting small 

turboshaft piston engines with axial flow compressors. Such engines were cited as 

being used to power small aircraft and helicopters such as the Bell Jet Ranger. 

Criteria were defined based on FATEPEN2 (an empirical code) analyses of 

windshields and expert opinion evaluations of the vulnerability of the piston engines 

and the windshield of general aviation planes (Reference 6bb). Based on this study, 

conservative threshold fragment mass criteria applicable to any aircraft were 

developed (Reference 6cc), as follows: 

(1) Tungsten debris: 0.5 g 

(2) Steel debris: 1 g 

(3) Aluminum debris: >1 g 

 These thresholds were based on defining the minimum mass piece that could 

cause failure of a piston engine (which therefore could lead to loss of the aircraft) and 

the minimum mass piece that could penetrate a windshield (which could incapacitate 

the pilot, leading to loss of the aircraft). 

 Since very little debris is tungsten, a “1 gram compact fragment” has traditionally 

been used as the threshold for hazard to aircraft. Some analysts have treated low 

density fragments separately. These protection approaches remain appropriate for all 

aircraft with the exception of large commercial transport aircraft unless less 

conservative thresholds can be justified 97. 

 

97 For example, some military aircraft are hardened to protect against debris and projectiles. Obviously, higher 

thresholds would apply. However, research has not yet been performed to determine the appropriate thresholds or 

to which aircraft they should apply. Thus, the conservative 1 gram value should still be used. 

6-26
b. Large Commercial Transport Aircraft .

98 Large passenger jets (Reference 6dd) have 

a high priority for protection. Their size results in a bigger “target” making the 

probability of impacting them generally higher than for many other planes. 

Moreover, they carry many passengers so that the consequence of an impact may be 

very high. However, they are designed to meet strict standards for structural 

integrity, redundancy of critical system, etc. Therefore, detailed studies have been 

performed to study their vulnerability. The commercial transport aircraft class is 

limited to aircraft with all the following characteristics: 

(1) Aluminum skin (composite skin aircraft have not been studied, nor are yet in 

production), 

(2) Multiple turbofan engines, and 

(3) Governed by the FAA certification requirements of 14 CFR Part 23/25. 

 A detailed study (Reference 6oo) produced the following quadratic relationships 

between the mass of an impacting fragment, m (in grams), and the projected area99 (in 

ft2

) of a commercial transport aircraft vulnerable to a casualty producing event (i.e., a 

single casualty regardless of the occupancy of the aircraft), , and 

a catastrophic event, 

PROJ ACAS

PROJ ACAT

 Where 

 2 0.0085 8.5 200 PROJ A mm CAS = ++

 and 

 2 0.025 4 PROJ ACAT = + m m

 These equations apply to all fragments between 0.05 grams and 300 grams. 

Fragments below 0.05 grams are not predicted to penetrate any commercial transport 

skin based on the FAA-JTCG equation for normal impacts. Fragments of at least 300 

grams should (1) be assumed to produce a catastrophe for any impact on an aircraft, 

(2) use the maximum feasible projected area (APROJ),100 and (3) account for the 

maximum projected fragment area (AFRAG) as follows: 

 

98 Note to reviewers: The results listed in this document have been cross-validated with empirical data. Peer review 

by the FAA professionals has not yet been performed. 

99 (Reserved) 

99 The projected area is the projection of the aircraft surface onto the plane perpendicular to the impact vector, In 

terms of plan and front areas and assuming an aircraft flying horizontally and debris falling vertically, 

sin( ) cos( ) proj front top AA A = + θ θ , where θ is the angle of the impact vector from the vertical, 

i.e. ( ). 1 tan / aircraft debris θ v v − =

101 (Reserved) 102 (Reserved) 100 The maximum feasible projected area should consider all possible combinations of aircraft type and fragment 

impact speed, which is discussed in Paragraph 7.3.3. 

6-27
( )

2

proj AAA CAT = + PROJ FRAG . 

 A generally conservative approximation is to neglect the impact angle and 

fragment size and use the maximum area of the largest aircraft potentially at risk, 

which is 12,000 ft2

 for a B747. 

 These simplified generic commercial aircraft vulnerability models (AVMs) are 

based on the best available information, methods, and reasonably conservative 

assumptions made in each area where there was no conventional approach or there 

was un-quantified uncertainty. For example, the impacting object is assumed to be a 

compact metal fragment such as a solid sphere, solid cube, or a solid cylinder with a 

small aspect ratio. Also, these model results assume that fragments are falling at 

speeds near the terminal velocity at aircraft altitudes (which may be twice the 

terminal velocity at ground level). It is highly likely that the only fragments with 

significantly higher speeds at aircraft altitudes would also be larger than the criteria 

specified in all areas of concern.101 These AVMs were subject to independent review 

by recognized experts. Thus, these AVMs are considered valid for use in the 

development of aircraft hazard areas designed to comply with the RCC 321 Standard. 

However, there remains considerable uncertainty about the results because of the lack 

of test data on impacts at highly oblique angles, which are clearly important to the 

vulnerability of commercial transport aircraft. 

 These AVMs are considered provisional because (see Reference 6oo): 

(4) They are based on a version of the empirically derived FAA penetration equation 

(FAA-JTCG) that was modified by ACTA to account for obliquity in a manner 

that appears reasonably conservative, yet has not been completely substantiated 

due to a lack of test data. 

(5) While there is sufficient evidence to demonstrate that the FAA penetration 

equation produces valid results for low obliquity impacts, there are no test data 

available for the high obliquity angles expected for fragments below 300 grams 

and the best available analysis demonstrated that the present vulnerability model 

results are sensitive to the treatment of obliquity. 

(6) High fidelity numerical models (LS-DYNA) have been developed that produce 

results consistent with the available test data at low obliquity angles. However, 

experience with these finite element models indicates that their application in a 

parameter space devoid of test data produces highly uncertain results near the 

threshold penetration velocity. 

(7) The potential for a drastic consequence event associated with potential impacts of 

launch vehicle debris on commercial aircraft warrants extreme caution in the 

 

101 Small fragments will normally have low ballistic coefficients, producing a sufficiently high drag to weight ratio 

such that they will slow to speeds near terminal velocity before they could impact aircraft. The only place that 

small fragments will have a significantly higher speed than terminal velocity is likely to be in the immediate

vicinity of a launch accident or intercept event, from which it is assumed that aircraft would normally be excluded 

anyway. 

6-28
development of safety criteria. Even a single casualty on-board an aircraft due to 

a launch vehicle debris impact could have enormous repercussions. 

 Regardless of the vulnerability model or hazard threshold levels used, aircraft 

hazard areas should be based on the largest aircraft in common use (which is 

currently the B747) because, (1) it presents the largest vulnerable area of any 

commercial transport, and thus will define hazard areas that are reasonably expected 

to provide adequate protection for all other types of commercial transport aircraft, 

and (2) the best available probabilistic aircraft vulnerability model results indicate 

that other common types of aircraft (the B757 in particular) can exhibit a higher 

conditional probability of adverse consequences (given an impact) than the B747 at 

threshold levels, but the total area susceptible to adverse consequences is always 

larger for the B747 than those associated with other commercial transport aircraft 

examined (B737-800, B757m and B767) (Reference 6oo). No attempt should be 

made to scale the quadratic vulnerability models presented here for application to 

other commercial transport aircraft. Instead, it is recommended that the B747 based 

quadratic equations be applied to all planes in the commercial transport class as 

defined at the beginning of this section. 

(8) Development of Aircraft Vulnerability Models. The aircraft vulnerability models 

presented here are based on an event tree analysis of commerical transport 

aircraft,, and a combination of empirical equations and physics based numerical 

simulations of penetration using a finite element code (LS-DYNA). 

 The event tree analysis examined design practices and FAA regulations to 

determine which failure modes could occur due to the smallest debris. This analysis, 

combined with past experience with impacts on this class of aircraft, produced three 

fundamental conclusions (Reference 6oo): 

• A fuel tank penetration through the top surface of the wing with an area of at 

least two square inches should be considered a potentially catastrophic event 

(Reference 6oo). Another FAA sponsored study reviewed historical accident 

data and found that fuel tank penetrations, leakage, and “the fires resulting 

from such leakage can pose great danger to an aircraft structure” (Reference 

6pp). Fragment impacts to any part of the fuel system, including specifically 

the wing fuel tanks appear to have been treated as catastrophic by the FAA’s 

Uncontained Engine Debris Damage Assessment Model (UEDDAM).102 

Specifically, in the assessment of the vulnerability of a generic twin engine jet 

to uncontained engine failures, a conservative assumption was made that any 

fragment penetration of a fuel tank results in a catastrophic consequence 

(Reference 6qq). However, small penetrations of the fuel lines or tanks are 

unlikely to produce casualties (or other severe consequences such as hull loss 

 

102 The UEDDAM code was developed to address an industry-FAA need for an analytical tool capable of 

conducting rotor burst assessment that incorporates fragment penetration, system level hazard assessment, and 

multiple debris fragments. UEDDAM was developed as a design tool capable of conducting aircraft configuration 

trade studies and as certification tool to show compliance with Title 14 Code of Federal Regulations (CFR) 

25.903(d)(1). UEDDAM is based on vulnerability assessment codes used in industry during aircraft design and 

development to minimize the vulnerability of military aircraft to ballistic threats. 

6-29
or a forced landing) based on FAA guidelines used to assess the continued 

airworthiness of transport aircraft (Reference 6rr). 

• The potential for a catastrophic outcome from a single launch vehicle debris 

impact on an engine of a commercially certified aircraft is negligible 

(Reference 6oo). This finding is based on the facts that: (1) certified 

commercial aircraft must be able to continue safe flight following the loss of 

thrust from any single engine, (2) debris impacts are unlikely to generate a 

potentially catastrophic condition due to engine fragment throw. 

• Historical experience indicates that fragment impacts from uncontained gas 

turbine failures often produce “significant damage” without casualty or other 

serious consequences, even prior to the implementation of FAA design 

guidelines intended to reduce this threat. Specifically, even prior to 

implementation of Advisory Circular 20-128A, fragment impacts from 

uncontained gas turbine engine failures were about six times more likely to 

produce “significant damage” without casualty than an outcome involving 

casualties, hull loss, or a crash landing (Reference 6qq). 

 The only other failure mode for debris smaller than 300 g that resulted in nontrivial probability of a casualty was a penetration of the fuselage, which could directly 

injure a crew member or passenger or lead to a non-catastrophic depressurization 

event (Reference 6oo). 

 The aircraft vulnerability models presented here are consistent with the input 

parameter uncertainties and sensitivities found using the best available techniques 

(Reference 6oo). Simulations of penetration also included other sensitivity studies, 

such as impact location on the aircraft, skin thickness, aircraft velocity and fragment 

parameters. Although the true extent of the modeling uncertainty contained in the 

present results is unknown, these results are based on the best available information 

and reasonably conservative assumptions made in each area where there is no 

conventional approach or there is un-quantified uncertainty. Since these results are 

based on the best available information, and are based on analysis that has been 

independently reviewed, they are deemed appropriate for immediate use. However, 

ranges should continue to use of the more conservative thresholds already established 

(i.e. the 1 gram steel cube and others defined in RCC 321-02) for all other types of 

aircraft because no attempt has been made to updated the vulnerability models for 

other aircraft types. It is important to ensure the present AVMs are applied only to 

aircraft in the correct class. The estimated risk could be significantly under-stated if 

the commercial transport thresholds are used for aircraft that do not meet the 

requirements of the class. Applicable aircraft classes are defined in Paragraph 

6.3.3.b. 

(9) Confidence in Models. To assess the confidence in the thresholds, the shape of 

the fragment and orientation upon impact were varied. A reasonably conservative 

(more penetrating) shape was used to develop the present AVMs. It is 

theoretically possible for a fragment to penetrate with lower mass if the shape and 

orientation were ideal (such as a thin rod impacting end on). However, this 

6-30
scenario is considered remote because fragments are generally assumed to be 

tumbling as they fall. 

 In addition, the event tree analysis is considered conservative, for the 

following reasons: 

• Some fuel tank penetrations will not be catastrophic. 

• Some fuselage penetrations will not cause injury. 

• The ballistic resistance of interior wall panels and insulation for the fuselage 

and cockpit was neglected due to insufficient data. 

• Past experience shows that this class of aircraft can land safely after 

sustaining substantial damage from uncontained engine fragment impacts or 

even a missile strike (Reference 6dd). 

6-31
6.4 References for Chapter 6 

a. Federal Register, July 30, 2002. Part III Department of Transportation, Federal Aviation 

Administration, 14 CFR Parts 413, 415, and 417, Licensing and Safety Requirements for 

Launch: Proposed Rule.

b. Common Risk Criteria for National Test Ranges: Inert Debris, Supplement to Standard 

321-97, Risk and Lethality Commonality Team, Range Safety Group, Range 

Commanders Council, February 12, 1997. 

c. Haber, J. and H. Der Avanesian, Human Vulnerability to Inert Debris, Minutes of the 

29th Explosive Safety Seminar, July, 2000. 

d. Haber, J. M., A. M. Linn, and H. Der Avanessian, Human Vulnerability to Inert Debris, 

ACTA Report 05-550/3.1-01, September, 2005. 

e. Stuhmiller, J., K. Kan, K. Ho, Interim Total Body Model: A Model of Impact Injury, 

Jaycor Technical Report J2997.43-00-107, April 2000. 

f. Feinstein, D. et al, Personal Casualty Study, IITRI Project J6067 Final Report, July, 

1968. 

g. Cooper, G., B. Pearce, M. Stainer, and R. Maynard, The Biomechanical Response Of The 

Thorax To Nonpenetrating Impact With Particular Reference To Cardiac Injuries, J. 

Trauma, Vol 22, No. 12, December, 1982. 

h. Lewis, J. H., P. A. Coon, V. R. Clare, and L. M. Sturdivan, An Empirical/Mathematical 

Model to Estimate the Probability of Skin Penetration by Various Projectiles, Technical 

Report ARCSL-TR-78004, April 1978, Aberdeen Proving Grounds, Maryland. 

i. Sturdivan, L. M., A Mathematical Model of Penetration of Chunky Projectiles in a 

Gelatin Tissue Simulant, Technical Report ARCSL-TR-78055, December 1978, 

Aberdeen Proving Grounds, Maryland. 

j. DiMaio, V. J., Penetration and Perforation of Skin by Bullets and Missiles, The 

American Journal of Forensic Medicine and Pathology, Vol 2, No. 2, June, 1981. 

k. Federal Register, July 30, 2002. Part III Department of Transportation, Federal Aviation 

Administration, 14 CFR Parts 413, 415, and 417, Licensing and Safety Requirements for 

Launch: Proposed Rule.

l. Galbraith, K., Review of Blast Injury Data and Models, Defence Evaluation and Research 

Agency for the Health and Safety Executive, Contract Research Report 192/1998, 

Salisbury, Great Britain. 

m. Richmond, D. R. et al, Damage-Risk Criteria for Personnel Exposed to Repeated 

AirBlasts, Minutes of the 20th Explosive Safety Seminar, August, 1982 cited in 

Montgomery, R. and J. Ward, Facility Damage and Personnel Injury from Explosive 

Blast, RTI Report RTI/5180/26-08F, April, 1993. 

n. Bowen, I.G., E.R. Fletcher, and D. R. Raymond, Estimate of Man’s Tolerance to the 

Direct Effects of Air Blast, 1968, Technical Progress Report DASA-2113, Defense 

Atomic Support Agency cited in (Galbraith, 1998). 

o. Chrostowski, J., et al, Development of Structure and Vehicle Vulnerability Models FY 

2004 Activities, Technical Report No. 04-530/3.2, ACTA, Inc., Torrance, CA, September 

2004. 

6-32
p. DOD 6055.9-STD, “DoD Ammunition and Explosives Safety Standards,” October, 1992. 

q. Lambert, R., J. Chrostowski, P. Wilde, and W. Gan, Structure and Vehicle Vulnerability 

Models For Explosion Overpressure, Technical Report No. 05-550/3.2-01, ACTA, Inc., 

Torrance, CA, September 2005. 

r. Gerr, D., The Elements of Boat Strength, International Marine, Camden, Maine, 2000. 

s. ABS Guide for Building and Classing Motor Pleasure Yachts, American Bureau of 

Shipping, February 2000. 

t. ABS Guide for Building and Classing Passenger Vessels, American Bureau of Shipping, 

February 2001. 

u. ABS Rules for Building and Classing Steel Vessels under 90 Meters in Length, Part 3: 

Hull Construction and Equipment, American Bureau of Shipping, February 2006. 

v. ABS Rules for Building and Classing Steel Vessels, Part 3: Hull Construction and 

Equipment, American Bureau of Shipping, February 2006. 

w. Jones, N., Low velocity perforation of metal plates, in Shock and Impact on Structures, 

C.A. Brebbia and V. Sanchez-Galvez, ed., Computational Mechanics Publications, 

Southampton, UK, 1994. 

x. Hasselman, Timothy and Legg, Mark, “Update of Casualty and Fatality Risk Models for 

Roof Penetration by Inert Debris,” Report No. 00-430/16.4-02, ACTA Inc. Torrance, CA, 

September 2000. 

y. Bogosian, D. D., and Dunn, B. W., “An Analytical Model of Debris Penetration into 

Conventional Buildings: Hazard Area Computational Kernel (HACK), Version 1.2,” 

Technical Report No. TR-96-28.1, Karagozian and Case, Glendale, CA, September 1996. 

z. Hasselman, T., Gan, W., Lotatti, I., Wathugala, W., Legg, M., Bogosian, D., and Dunn, 

B., “Structure and Vehicle Vulnerability Models for Inert Debris,” Technical Report No. 

05-550/3.2-02, ACTA Inc., Torrance, CA, September 2005. 

aa. J. Tancreto, J. Tatom, and M. Swisdak, Jr., “SPIDER – A Test Program to Determine the 

Response of Typical Wall and Roof Panels to Debris Impact,” Proceedings of the 31st

Department of Defense Explosives Safety Seminar, San Antonio, TX., August 2004. 

bb. Yateau, J. D., R. H. Zernow and R. F. Recht, Compact Fragment Multiple Plate 

Penetration Model (FATEPEN2) Volumes 1 and 2, Applied Research Associates, Inc., 

prepared for the Naval Surface Warfare Center, Dahlgren, VA. January, 1991. 

cc. Cole, J. Kenneth, Larry W. Young, and Terry Jordan-Culler, Hazards of Falling Debris 

to People, Aircraft, and Watercraft, Sandia National Laboratories, Report SAND97-

0805, April 1997. 

dd. Larson, Erik, and Isaac Lottati, Status Report on Investigation of the Vulnerability of 

Aircraft to Debris from Space Accidents, ACTA Inc, Report No. 05-527/9.4, 

December 2006. 

ee. Livermore Software Technology Corporation, LS-DYNA (computer program). 

http://www.lstc.com/. 

ff. Manchor, J. and C. Frankenberger. Engine Debris Penetration Testing, 

DOT/FAA/AR-99/19. 

gg. Lundin S., Engine Debris Fuselage Penetration Testing, Phase I, DOT/FAA/AR-01/27. 

6-33
hh. Wilde P. and Chrostowski, J, Comparing Explosive and Inert Debris Vulnerability Model 

Results to Historical Event Data, ACTA Inc, Report No. 06-527/9.2, June 2006. 

ii. “SPIDER 1B Testing Quick-Look Report,” Naval Facilities Engineering Service Center, 

RBESCT Meeting, Huntsville, AL, November 2004. 

jj. D. Bogosian and B. Dunn, “Independent Verification and Validation Assessment of 

HACK/CF,” TR-05-52.2, Karagozian & Case, Glendale, Ca., September 2005. 

kk. Structural Analysis and Design of Nuclear Power Plants, Chapter 6, “Design Against 

Impact Loads,” ASCE Manual 58. 

ll. Baeker, J. L., Philipson, L., and Tran, D., “Offshore Oil Hazards,” J. H. Wiggins 

Company, Redondo Beach, CA, September 1984. 

mm. Hasselman, T. K., Li, X., and Gan, W., “Casualty and Fatality Risk Models for Roof 

Penetration by Inert Debris,” ACTA, Inc, Torrance, CA, September 1999. 

nn. Gan, W., “A Review of Empirical Steel Plate Perforation Formulas,” Interoffice 

Correspondence, June 2006. 

oo. Wilde P., Draper, C. Lottati I., Larson E., and Hasselman T., Vulnerability of 

Commercial Transport Aircraft to Debris from Space Accidents, ACTA Inc, Report No. 

06-527/11.3, April 2007. 

pp. Federal Aviation Administration, “The Potential for Fuel Tank Fire and Hydrodynamic 

Ram from Uncontained Aircraft Engine Debris”, DOT/FAA/AR-96/95, January 1997. 

qq. Seng, S., J. Manion, C. Frankenberger, “Uncontained Engine Debris Analysis Using the 

Uncontained Engine Debris Damage Assessment Model”, DOT/FAA/AR-04/16, 

September 2004. 

rr. Federal Aviation Administration, Advisory Circular 39-8, available at 

http://www.airweb.faa.gov/Regulatory_and_Guidance_Library/rgAdvisoryCircular.nsf/

ss. Federal Aviation Administration, Advisory Circular 20-128A, available at 

http://www.airweb.faa.gov/Regulatory_and_Guidance_Library/rgAdvisoryCircular.nsf/

6-34
CHAPTER 7 

APPROACHES AND CONSIDERATIONS FOR DEBRIS RISK ASSESSMENT 

MODELS 

The purpose of this chapter is to document the important considerations and factors that 

should be addressed in developing good debris risk assessment models. To do this the overall 

process of computing debris risks has been broken down into its primary modeling areas. For 

each of these modeling areas there is a section that describes the function and purpose of the 

model followed by a discussion of the modeling in terms of the general approach and the 

considerations and factors to be addressed. For many of the sections, there is also a discussion 

of the data that may be available for input to the model. Where appropriate, alternative modeling 

approaches and considerations are presented based on the type of data used. 

The intent of this chapter is to provide guidelines for developing good models rather than 

prescribing specific models or methods. General approaches are discussed to provide guidance 

to the modeler and to record “lessons learned” over many years of developing debris risk models 

at the major test ranges. 

The models discussed here are those needed to compute the debris impact risks for a 

given debris generating event such as a vehicle failure scenario or a weapons system debris 

generating event, such as a target intercept. A vehicle failure scenario is defined to be a specific 

mode of failure occurring at a specific time of flight and resulting in a specific type of vehicle 

breakup; this includes the case where the vehicle remains intact to impact. Failure scenarios may 

include very unlikely events that need to be addressed because of their potential catastrophic 

outcome. 

Many of the modeling considerations and factors presented in this chapter may not need 

to be addressed. This will depend on the application of the model, the level of fidelity required, 

the availability of data, and the time constraints for performing an analysis. For many of the 

models, alternative modeling approaches are presented, ranging from relatively simplistic to 

relatively complex, with the complex models generally requiring increased development time, 

more detailed input data, and increased computation time. The analyst will need to determine 

the complexity of the models required for his application. In some cases simpler models can, 

using the appropriate assumptions and input data, lead to conservative (high) estimates of the 

debris risks and may be sufficient if the resulting levels of risk are acceptable. Also, a range that 

can achieve a low level of risk by containing debris within predefined boundaries may be able to 

employ simple “worst case” models to demonstrate that containment is achieved. Worst case 

models must address maximum deviations from nominal conditions, malfunctions leading to 

worst case lateral turns, wind conditions which can push hazardous debris out of the planned 

containment area, etc. A range that has missions for which debris containment cannot be 

achieved, and for which the levels of risk can exceed acceptable limits, may need to use more 

complex models to assure that adequate safety is achieved. 

7-1
To aid the reader locate material relevant to the area of debris risk assessment modeling 

of concern, Table 7-1 presents a guide to the content of each of the chapter sections. The table 

also acts as an outline of the steps in the modeling process. 

TABLE 7-1. GUIDE TO CONTENTS OF CHAPTER 7 

Para. Modeling Area Notes 

7.1 Vehicle Breakup 

Debris Models 

Characterization (weights, sizes, ballistic coefficients, etc.) of the 

fragments expected to result from vehicle breakup or from a weapons 

test, such as an intercept. “Debris” includes an intact vehicle, or 

component of the vehicle, if no breakup is expected. Breakup can result 

from abnormal aerodynamic and inertial loads, activation of a flight 

termination system, weapon system action (intercept, etc.) or reentry 

heating. 

7.2 Debris Dispersion 

Models 

The term “debris dispersions” is used to refer to the variation in the 

position of a fragment as it falls and at impact (or at a specified altitude). 

The sources of debris dispersion include variations in the initial breakup 

state vector due deviations of the vehicle from the nominal (intended) 

trajectory prior to breakup, and the dynamic effects on the fragments 

during free fall. Includes a discussion of important considerations for an 

impact predictor. 

7.2.1 Vehicle Normal 

Trajectory Uncertainty 

due to Guidance and 

Performance Factors 

Dispersions due to breakup state vector variations resulting from normal 

variations in the vehicle guidance system and motor performance. These 

variations are within expected limits and are influenced by various 

factors such as launch day atmospheric conditions and variations in the 

thrust achieved by operating motors. 

7.2.2 Vehicle Malfunction 

Turns 

Dispersions due to breakup state vector variations resulting from 

deviations of a vehicle from its intended trajectory following a hardware 

or software failure (malfunction), including a failure of the vehicle 

guidance system. 

7.2.3 Debris Imparted 

Velocities 

Dispersions due to velocities imparted to vehicle fragments. These 

imparted velocities can be produced by the explosive charges used in 

flight termination systems, pressure forces created by an explosion, 

rupture of a pressurized vessel, rotational motion of the vehicle and/or 

weapon system events such as a hit-to-kill intercept. 

7.2.4 Fragment Aerodynamic 

Drag Uncertainty 

Dispersions due to uncertainty in the aerodynamic drag force acting on a 

fragment. 

7.2.5 Fragment Aerodynamic 

Lift Effects 

Dispersions due to uncertainty in the aerodynamic lift force acting on a 

fragment. 

7.2.6 Wind Drift and Wind 

Uncertainty 

Dispersions due to wind acting on a fragment. Includes both the shift in 

the position of a fragment during free fall due to the expected wind, and 

uncertainty due to the uncertainty in the wind. 

7.2.7 Free Flight of 

Inadvertently Separated 

Thrusting Motors 

Dispersions due to free flight of inadvertently separated thrusting 

motors. This affects the dispersions of the debris resulting from the 

subsequent breakup of a motor (or of the intact motor if no breakup 

occurs). 

7-2
7.3 Debris Distribution 

Models 

Characterization of the overall uncertainty distribution for fragment 

position during free fall and at surface impact, accounting for all sources 

of position uncertainty. Uses the output of the debris dispersion models 

discussed in Section 7.2. The debris distribution models are used to 

compute probabilities of fragment impact. 

7.3.1 Impact Distribution 

Functions for Multiple 

Dispersion Sources 

Generation of two-dimensional impact uncertainty distribution functions 

to represent multiple sources of debris dispersion. 

7.3.2 Scatter Plots for 

Multiple Dispersion 

Sources 

Generation of two-dimensional scatter plots to represent impact 

uncertainty due to multiple sources of debris dispersion. 

7.3.3 Considerations for 

Three-Dimensional 

Models 

Generation of three-dimensional debris position uncertainty 

distributions. May be required for computation of impact probabilities 

for an aircraft or a spacecraft following a prescribed flight path. 

7.4 Impact Probability 

Models 

Using the distribution models developed in Section 7.3 to compute 

probabilities of fragment impact onto populated locations and other 

assets of concern. The focus is on the computation of impact 

probabilities using two-dimensional characterizations of debris impact 

distributions. (Computation of impact probabilities using threedimensional distributions is addressed in Section 7.3.3). 

7.5 Modeling for 

Explosive Fragments 

Addresses modeling issues specific to the computation of risks for 

explosive fragments, where hazards result not only from the fragment 

directly impacting an asset but also from the products of the explosion 

(explosive loads, ejected secondary debris). 

7.5.1 Explosive Yield 

Models 

Prediction of the explosive yield of the impact explosion of a fragment 

carrying volatile material (liquid propellants, solid propellant, etc.). The 

yield is expressed in terms of the weight of TNT that would produce an 

essentially equivalent explosion. 

 7.5.2 Risk Computation for 

Explosive Fragments 

Computation of the risks resulting from blast loads (defined by peak 

overpressure and impulse) and secondary debris generated by an 

explosion. Includes computation of casualties for people directly 

exposed to blast loads and indirectly hazarded due to structural damage 

or collapse and window breakage. 

7.6 Vulnerability and 

Casualty Models 

Models to predict the level of injury or damage to humans, structures or 

vehicles due to impact by a fragment or due to blast loads. These 

models are used to relate probability of impact to expected casualties or 

fatalities. 

7.6.1 Human Vulnerability 

Models 

Prediction of the probability of human casualty or fatality. 

7.6.1a Human Vulnerability 

to Inert Debris Impact 

Probability of casualty/fatality due to direct impact by a fragment or by 

secondary debris. 

7.6.1b Human Vulnerability 

to Blast Loads 

Probability of casualty/fatality due to exposure to blast loads 

(overpressure and impulse). 

 7.6.2 Model for the 

Casualty Area for 

Inert Debris Impact in 

the Open 

Area within which an unsheltered person becomes a casualty/fatality due 

to fragment impact and secondary effects. 

7-3
7.6.3 Structural 

Vulnerability Models 

Assessment of damage to structures and prediction of casualties/fatalities 

for occupants. 

7.6.3a Vulnerability 

modeling for Inert 

Debris Impact on a 

Structure 

Prediction of casualties/fatalities within a structure due to inert debris 

penetration. 

7.6.3b Vulnerability 

modeling for 

Explosive Debris 

Blast Loads on 

Structures 

Prediction of casualties/fatalities within a structure due to blast loads 

acting on the structure. 

7.6.4 Ship/Boat 

Vulnerability Models 

Vulnerability of ships/boats to inert debris and to explosive debris, and 

prediction of resulting casualties/fatalities. 

7.6.5 Aircraft Vulnerability 

Models 

Vulnerability of aircraft to inert debris impact. 

7.7 Models for Casualty 

Area and Fragment 

Probability of 

Casualty 

Computation of casualty area, or fragment probability of casualty, based 

on the vulnerability models presented in paragraph 7.6. These quantities 

are used in the prediction of casualty/fatality expectation. 

7.8 Risk 

(Casualty/Fatality) 

Expectation Models 

Combining the output of the preceding models to generate risk estimates 

(casualty/fatality expectations, individual probability of 

casualty/fatality). Includes discussion on development of a population 

library. 

7.9 Catastrophic Risk 

Modeling 

Addresses methods for predicting and averting potential catastrophic 

accidents (many casualties/fatalities). 

7.10 Risk Prediction 

Uncertainty 

Addresses methods for assessing uncertainty in the prediction of 

casualty/fatality expectation, and implementing this into the decision 

making process. 

Note: Although the resulting debris data is an input to the debris risk models, it is of such fundamental 

importance, involving challenging modeling considerations, that it has been given its own section. Other input 

data items will be discussed, in more general terms, in the specific sections where the data are used in the 

model(s).

7-4
7.1 Vehicle Breakup Debris Models 

7.1.1 Model Description. If a missile or space vehicle malfunctions, the vehicle may break up 

spontaneously or it may be destroyed by the safety officer, thereby producing hundreds or 

thousands of primary components and pieces. In some cases, malfunction or failure may simply 

mean that the vehicle has strayed outside normal limits. It is also possible that a malfunctioning 

vehicle will remain intact to impact. For warheads and kinetic-kill vehicles, fragmentation 

results from a planned event. Precisely how (or even whether) breakup occurs is subject to 

considerable uncertainty. Although many pieces are inert, breakup may also produce intact (or 

nearly so) components, propellant tanks with or without propellant, solid-propellant chunks, and 

high-pressure vessels that may explode or rupture violently upon impact. The character of 

vehicle breakup is likely to change continuously throughout flight as propellants are consumed 

and aerodynamic loads change. Breakup characteristics may also be failure-mode dependent. A 

debris model appropriate for risk computations defines the characterizations of the fragments 

expected to result from vehicle breakup, including the case where no breakup occurs. 

 Regardless of whether or how breakup occurs, there are two fragment models of interest: 

Model 1. The breakup model as it exists immediately after failure. 

Model 2. The debris model as it exists upon impact with objects on the ground (open 

areas, people, structures) and with objects above the ground (aircraft, 

satellites). 

It may require considerable effort to map fragment Model 1 into Model 2. Things to be 

considered during this mapping include progressive breakup (not all fragmentation occurs at the 

time of failure), propellant utilization or consumption, dynamics associated with burning 

propellant, whether or not the burning continues within a partially intact motor; aero-thermal 

effects on inert materials including ablation, and ignition and combustion of energetic materials 

which survive breakup, and fragment demise (disappearance from the catalog). 

The goal of the debris-modeling process is to define the numbers of pieces, weights, 

sizes, aerodynamic characteristics, and breakup-imparted velocities for the debris produced 

under all breakup conditions that may pose a risk. Included are characteristics of the debris that 

influence the behavior of the debris between failure and impact (or other encounter). Results 

obtained after accounting for all secondary affects include the revised debris catalog at encounter 

and the corresponding fragment weights, sizes, and residual explosive potential. 

In some cases it may be possible to format the detailed debris information for direct input 

to risk-analysis software. However, the debris lists for some vehicles are extensive, and most 

risk-analysis software has limitations in the number of debris categories allowed. Additionally, 

much of the debris may differ in only minor details, thus leading to inefficiency in computations 

with little gain in accuracy of results. Consequently, for the sake of efficiency in computations, 

and to accommodate limitations in most risk-analysis software, the debris lists are condensed 

into a smaller number of classes, with all fragments in any one class having similar 

characteristics. The goal is to develop a set of debris classes so that the hazards associated with 

7-5
the “mean” piece in a class adequately represent the hazards of each piece in the class. When 

done properly, the resulting risks are not affected significantly. 

7.1.2 Data Sources. When developing debris models for risk estimations, the analyst usually 

begins with information supplied by the vehicle manufacturer (as listed below). This data may 

not always be available, so in some cases the analyst will need to develop a debris model using 

assumptions and data from similar vehicles/components. 

a. Description of vehicle and payload: Overview of vehicle with scaled diagram, 

general arrangement and dimensions of components including alternate and optional 

components; description of materials used in construction, inert weights and 

propellant types and weights for every stage and component; nature and purpose of a 

typical flight or mission of interest 

b. Engine and/or Motor data: Including case material (outer case, lining, insulation, 

thickness, density), descriptions of nozzles and steering mechanisms, descriptions of 

propellant types and ingredients, propellant density, propellant weights versus time. 

(1) Solid Motor: Motor core radius (to outer edge of propellant); grain design; 

internal pressure and web thickness versus time. 

(2) Liquid Engine: Pumping and pressurization systems and associated stored 

energy, materials, and pressurization. 

c. Description of Flight Termination System (FTS) (command, automatic, separation): 

Type of system (terminates thrust, destroys vehicle, induces tumble, etc.), 

descriptions of all components and activation mechanisms, exact locations of all 

charges (beginning point, length, gap, ending point), descriptions of circumstances 

for any delays in activation of charges, discussion of whether and under what 

circumstances destruct might ignite a non-thrusting motor. 

d. Trajectory data for a typical mission: Nominal and dispersed trajectories, 

comprehensive malfunction trajectories or malfunction turn data, event times 

(ignitions, steering programs, burnouts, jettisons). Trajectory data are used to obtain 

vehicle velocity and altitude from which to calculate aerodynamic and inertial loads 

for use in estimating vehicle breakup. Event times are used to indicate vehicle 

configuration at each breakup time. 

e. Descriptions of planned debris: Jettisoned components, aerodynamic and inertial 

breakup of jettisoned components, nozzle closure covers, etc. 

f. Breakup debris lists: The manufacturer’s expected debris resulting from destruct 

action and subsequent aerodynamic loads at various event times including numbers of 

fragments, weights and dimensions of pieces, construction materials, drag 

characteristics (reference area, ballistic coefficient or drag coefficient versus Mach 

number), and breakup imparted velocities. In some cases, manufacturers also provide 

expected debris from breakup resulting from aerodynamic and inertial loads on a 

7-6
malfunctioning vehicle. When such lists are not provided, and these types of 

breakups are feasible, then it is left to the risk analyst to develop them. 

g. Kinetic intercept debris lists: Estimate of intercept debris resulting from a hit-to-kill 

interaction between an interceptor and target vehicle, or more generally from any 

introduction of controlled external energy leading to vehicle failure and breakup (e.g. 

high intensity laser). Debris estimates should consider variations in the intercept 

event such as a glancing blow which may result in relatively few, mostly large 

fragments versus a direct head-on impact which generates very large numbers of 

relatively small fragments. Kinetic intercept debris lists are typically generated by 

the risk analyst using standardized programs and input data files based on the 

materials and configuration of the vehicle. 

7.1.3 Modeling Considerations. Considerations for developing a debris model are discussed 

below. 

a. In developing a debris model, the analyst may consider the various failure response 

modes, breakup circumstances, outcomes, and debris classes to be accounted for in 

the risk computations. 

b. For many launch vehicles, some of the debris will have different characteristics 

depending on whether breakup occurs as a result of a destruct action or as a result of 

failure (explosion, abnormal aerodynamic and inertial loads, etc.). 

c. Before using supplied debris lists, they should be checked for accuracy and 

reasonableness. Some debris lists only model fragmentation based on a uniform 

distribution of size and quantity of fragments. One easy check is to compare the total 

weight of all fragments with the known dry weight of the vehicle. Another check is 

to compare the new information with corresponding information for the same vehicle 

or similar vehicles. Investigations into early launch accidents (where debris was 

recoverable) have provided some insight into how vehicles break up. If a 

manufacturer’s list differs substantially from expectations, the risk analyst may either 

modify the list or justify the supplied list based on destruct system design and 

component construction and materials. An example of poor modeling that may be 

modified is the breakup of solid rocket motor propellant into chunks of equal weight. 

In particular, many manufacturers’ debris lists have been prepared only for use in 

estimating risks to people and structures on the ground. They under-predict the 

numbers of low-mass debris that may need to be considered when estimating risks to 

aircraft and spacecraft. 

d. Supplied values of breakup-imparted velocities can be checked for reasonableness 

using empirical equations for pressure ruptures and explosions. More sophisticated 

models can be used to estimate maximum imparted speeds of propellant and case 

fragments from a destructed thrusting solid rocket motor. Breakup imparted speeds 

are highly uncertain. Often, an estimate of the maximum imparted speed is assumed 

to represent a three-sigma value of a one-sided normal probability distribution or of a 

7-7
Maxwellian distribution. Imparted velocity direction is also highly uncertain and is 

often modeled as equally probable in all directions, though other distributions may be 

required for special circumstances. 

e. The possibility of failure of the destruct system should be considered. System failure 

may be due to loss of command communications, loss of battery power, failures or 

ruptures of vehicle systems resulting in loss of control or power connectivity, or 

inaction or delayed action of the safety officer. The latter may occur because of 

mission rules established before launch. If the destruct system fails, there is a 

possibility of an intact impact accompanied by an explosive yield or the possibility of 

breakup from aerodynamic or inertial loads. Associated debris models for these 

scenarios might be required. 

f. Some supplied debris lists provide drag reference areas instead of actual areas for 

some fragments. Actual fragment areas are needed for roof-penetration and effective 

casualty area computations. 

g. Every accident investigation provides new insight into how launch vehicles break up, 

and leads to changes in debris modeling. Future investigations are likely to continue 

these changes. The nature and extent of breakup seems to strongly depend on the 

nature of the failure and the interaction of the failure with the destruct system. Even 

if experiments could be conducted to repeatedly break up the same vehicle design 

with command destruct, the resulting fragments would likely vary significantly 

among the trials. Even the manufacturers are unsure how their vehicles will break up 

by command destruct. For example, one manufacturer with years of experience 

recently lowered the second-stage fragment count by an order of magnitude. As 

another example, two manufacturers of similarly sized and constructed solid rocket 

motors provided lists of miscellaneous hardware debris (i.e., debris that is not case or 

propellant). One list contained 1106 fragments, while the other contained 2 

fragments. Part of the problem may be due to application. In earlier years, supplied 

debris lists were used primarily to determine hazard areas for containment. In more 

recent years, the debris lists have also been used for risk estimation. A realistic 

debris model is more important for risk estimation than it is for containment 

prediction. 

h. Varying lengths of time may elapse between breakup and encounter, depending upon 

when in flight failure occurs. During these time intervals, debris characteristics may 

change, especially for propellant-bearing components and solid propellant chunks. 

i. For solid propellant systems, the risk assessment must include consideration of a 

large number of propellant dynamic, thermodynamic, and chemical factors. These 

factors include, but may not be limited to: 

(1) If the motor is burning at the time of fragmentation, the mechanisms that might 

quench the motor or the propellant chunks must be considered. Conversely, if the 

motor is not burning at the time of fragmentation, the mechanisms for ignition of 

the propellant or the propellant chunks must be considered. 

7-8
(2) Ignition mechanisms may include heating associated with the breakup event, 

internal pressure of the motor at breakup, external dynamic pressure at time of 

breakup, and both symmetric and asymmetric heating of the fragments by aerothermal forces during propagation after breakup. 

(3) The dynamics are different for propellant adhering to case fragments than for 

free-falling propellant chunks. Also, fragment tumble can affect ignition and 

combustion mechanisms. 

(4) The kinetics of propellant burning are known to be dramatically different at the 

low ambient pressures associated with free falling propellant chunks as compared 

to those for the operational pressures of the motor. Thus propellant fragments and 

propellant in damaged motors will burn at different rates than in an intact 

operational motor, and the burning of fragments may be asymmetric due to 

fragment dynamics. While vehicle vendors can provide the burn rates for motor 

operational pressures, burn rates for low pressures are usually not available and 

will need to be estimated based on limited experimental data for the solid 

propellant, or similar propellants, and may require extrapolation to the pressures 

of concern. The influence of the shock wave around a supersonic propellant 

fragment, and the buildup of product gases behind the fragment, on the burn rate 

are other consideration. 

(5) The dynamics of thrust associated with asymmetric fragment combustion may 

need to be considered. 

(6) Solid propellant chunks can completely burn up (demise) during free fall, 

particularly if they are burning immediately following motor breakup. 

j. For liquid-propellant components, it may be necessary for the analyst to decide 

whether the nature of breakup allows the propellants to remain on board. 

(1) If so, and the component was thrusting, the possibility of continued propellant 

consumption (and thrusting) may need to be considered. Additionally, it may be 

necessary for the analyst to decide whether the heat of reentry causes remaining 

propellants to boil off or leak from damaged tanks. 

(2) If not, the breakup will typically disperse the liquid as an aerosol which has 

dynamics including interaction with atmospheric oxygen (or other chemicals) and 

possible ignition of fuel components, heating and absorption of pressurized 

liquids or cryogenic fuels in the atmosphere, and the possible settling of both inert 

and toxic fuel components over a broad area following dispersion. Aerosolized 

and vaporized fuel components, particularly toxic components, must be 

considered separately from treatment of inert, non-explosive solid debris. 

k. The demise of inert fragments can occur during free fall due to ablation or melting, 

especially for inert debris reentering from space. 

l. For missions involving planned intercepts of vehicles, the development of intercept 

debris models (debris from the interceptor and from the target), as well as the 

dispersions of the debris, require a special modeling approach. Dynamic loading 

during an intercept is typically modeled by a statistical tool that has been validated 

through comparison with data from laboratory tests. Because of the high energy 

7-9
associated with these events, consideration needs to be given to the material content 

and configuration of the impacting bodies, the closing velocity, the size and mass 

distributions of the fragments (having extensive low mass/small area tails), and the 

post-intercept velocities including the perturbation of the average velocity of the 

fragments resulting from each body due to the net momentum transfer between the 

bodies. Energy loss can result in melting, frictional ablation, vaporization and 

ionization of impacted metals, as well as production of an optical flash which 

represents a significant portion of the relative energy. Typically, three classes of 

intercept debris generation models can be applied:

(1) Purely statistical models (of which Impact is the best known) that apply 

constrained power-law or exponential distribution models to fragment size and 

mass. 

(2) Empirical models (of which KIDD is the best known) that use constraining test 

data to determine limiting fragments and constrain the parameters used in 

statistical models to generate the smaller fragments. 

(3) Hydrocodes, which are high fidelity finite element models for shock propagation 

and penetration, but are constrained from accurate depiction of the smaller 

fragments due to the limiting size and time resolution of the element models, and 

which are often prohibitively expensive to run.

7.1.4 Model Uncertainty. 

a. FTS, Aerodynamic, and Inertial Breakup. Every accident investigation provides new 

insight into how launch vehicles break up, which leads to improvements in debris 

modeling. Future investigations are likely to continue these changes. The nature and 

extent of breakup seems to depend strongly on failure mode and the interaction of the 

failure mode with the destruct system operation. If the risk analyst could foresee all 

plausible breakup scenarios and assign an accurate probability to each, and if accurate 

debris lists could be determined for each scenario, the resulting probabilistic debris 

model would lead to improved accuracy of the estimations of risk. However, none of 

these is possible. The analyst cannot be sure that breakup scenarios have been 

included that should not have been, or that important scenarios are missing. The 

ability to prepare a complete debris list is also compromised by the inability to track 

all but the largest of the debris fragments, to recover more than a fraction of the 

largest fragments, and to reconstruct fragment dynamics from the positions of 

recovered fragments. Even if an accurate model for all scenarios existed, the 

associated probabilities of occurrence would be based on engineering judgment. 

Sensitivity studies may be conducted to estimate the variations in risks from 

variations in breakup scenario probabilities and from variations in the extent of 

breakup associated with each scenario. However, the uncertainty in risk due to 

incompleteness in the list of credible breakup scenarios remains unknown. 

b. Intercept Impact Breakup. In many ways, the uncertainty in breakup models for 

debris from intercepts is even greater than the uncertainty in FTS and aerodynamic 

breakup models. It is simply impossible to recover the debris from intercepts, and 

controlled tests are generally restricted to scaled models of the interceptor at 

7-10
velocities below – sometimes significantly below – the velocity of the intercept being 

modeled. Intercepts can occur head on or off the center line of the vehicle, and under 

hypervelocity conditions the angle of contact between interceptor and target 

significantly affects the post-impact breakup and dynamics. Localized energy 

transfer under impact conditions can exceed the melting temperatures – or even the 

vaporization temperatures – of components, resulting in mass loss by mechanisms 

which cannot be tracked by either ground or air/space testing. Fracture lines may 

result from system joints, component weak spots, force concentrators, and other 

phenomena only apparent under hypervelocity impact conditions. Both localized 

thermo-mechanical effects, including the effects of stored energy in the system, and 

systematic effects can change the final chemical state of a fragment, its condition of 

velocity and spin, its shape and mass, and overall dynamic performance. 

7.2 Debris Dispersion Models 

Debris dispersion models are models to predict the dispersions of debris occurring from 

vehicle breakup, during free fall, or at surface impact. Vehicle “breakup” may include an intact 

vehicle that has lost thrust or is tumbling rapidly. The term “debris dispersions” is used to refer 

to the variation in the position of a fragment as it falls and at impact (or at a specified altitude). 

The sources of debris dispersions include the deviation of the vehicle from the nominal 

(intended) trajectory prior to breakup and the dynamic effects on the fragments during free fall. 

Debris dispersions are computed during free fall, or at a specified altitude, to assess 

aircraft or spacecraft risks, and at surface impact to assess risks to people and property on the 

surface (ground or water). The debris dispersions result in both an expected (mean) shift in the 

position of a fragment during freefall or at impact, and in an uncertainty in this position. 

Dispersion models are discussed for each of the significant sources of debris dispersion. 

Fundamentally, debris dispersions need to be modeled for each hazard-producing 

fragment resulting from vehicle breakup. However, fragments may be (and often are) combined 

into fragment groups (classes) and the dispersions are modeled for each group (paragraph 7.1

addresses fragment grouping). 

The focus of the discussion is on the development of debris dispersions at surface impact 

(or at a specified altitude); however additional considerations that should be addressed for 

defining 3-dimensional dispersions are also discussed. The primary purpose of modeling 

3-dimensional fragment distributions is to compute impact probabilities for an aircraft or 

spacecraft which is following a specified flight path at a given speed. Modeling of the 

3-dimensional cloud requires that the dispersions of the debris be defined as a function of time. 

There are three approaches that have been used to define debris dispersions. The first is 

to statistically represent the dispersions using models that relate the dispersions at surface impact 

(or at a specified altitude) to the initial breakup state vector using closed form solutions. The 

second is to perform Monte Carlo simulations of fragment trajectories from the breakup point to 

develop random impact points (scatter plot) to define the dispersions. The third is to compute 

7-11
the maximum (or near maximum) debris dispersions to define the limits of the impact 

displacements. 

The significant sources of debris dispersion that are addressed, due to both trajectory 

deviations of the vehicle and dynamic affects on the fragments during free fall, are: 

a. Vehicle normal trajectory uncertainty due to guidance and performance factors. 

b. Vehicle malfunctions resulting in significant trajectory deviations (referred to as 

malfunction turns). 

c. Velocities imparted to fragments at vehicle breakup. 

d. Uncertainty in the drag characteristics of a fragment. 

e. Aerodynamic lift effects acting on a fragment. 

f. Dispersion due to wind drift including the uncertainty in the wind profile. 

g. Free flight of inadvertently separated thrusting motors. 

Other sources of dispersion may need to be considered but they are usually minor 

contributors to the overall debris dispersions. These sources include uncertainty in the 

atmospheric density, variations in the impact altitude due to terrain, and uncertainties introduced 

by the Earth model employed. 

An important tool used in the generation of debris dispersions is an impact predictor 

(often referred to as a propagator). The impact predictor is used to compute the trajectory of a 

fragment from vehicle breakup to a specified time, altitude, or surface impact. Although the 

impact predictor is not discussed as a separate model in this chapter, it is important to note that it 

can compute fragment state vectors with sufficient accuracy and computational speed. Important 

considerations for a good impact predictor are: 

h. Rapid computation speed to meet the requirements for having to compute large 

numbers of trajectories (various flight times, failure modes and fragments/fragment 

groups). 

i. Capability to handle high initial decelerations. 

j. Use of an appropriate atmospheric density model for the region of concern. 

k. Ability to handle wind forces. 

l. Ability to model aerodynamic forces in a rarified (high altitude) atmosphere. 

7.2.1 Vehicle Normal Trajectory Uncertainty due to Guidance and Performance Factors. 

a. Model Description. Even when a vehicle is flying normally, the state vector of the 

vehicle at the onset of failure, and subsequently at the time of breakup, is uncertain 

due to the normal variations in the vehicle guidance (including preplanned and 

responsive maneuvers, inertial sensor tolerance, guidance algorithm performance 

accuracy, etc.) and in the motor performance (thrust variation, steering tolerance, 

etc.). Atmospheric conditions (particularly atmospheric density and wind) affect both 

guidance and motor performance. The resulting vehicle state vector uncertainty leads 

to uncertainty (dispersions) in the locations of the vehicle breakup debris during free 

7-12
fall and at impact. The purpose of the vehicle “guidance and performance” 

dispersion model is to quantify the debris dispersions. 

b. Data Sources. Data to define a vehicle’s guidance and performance state vector 

uncertainty are typically generated by the vehicle vendor and are in one of three 

forms: 

(1) The most common form are what are referred to as 3-sigma trajectories to reflect 

the fact that they are intended to represent dispersions from the nominal trajectory 

that are near maximum (i.e. will be rarely exceeded). 3-sigma trajectories are 

generated for various conditions to cover the range of state vector variation. A 

common set of trajectories include those for a 3-sigma low performing (low 

thrust) vehicle (often referred to as a cold trajectory), a 3-sigma high performing 

vehicle (often referred to as a hot trajectory), a 3-sigma deviation to the left of the 

nominal trajectory plane (left trajectory), and a 3-sigma deviation to the right of 

the nominal trajectory plane (right trajectory). In some cases other trajectories 

may be provided such as a 3-sigma high altitude (lofted) and a 3-sigma low 

altitude (depressed) trajectory. 

(2) In less frequent cases, the vehicle vendor will provide statistics for the state 

vector (versus flight time) giving the standard deviations in the state vector 

position and velocity components and, sometimes, the correlations between the 

components. These provide the terms for a covariance matrix defining the state 

vector uncertainty statistics. 

(3) In a few rare cases the vehicle vendor will provide a family of dispersed 

trajectories to characterize the potential dispersions of the vehicle trajectory due 

to variations in the various environmental, guidance and performance parameters 

that govern the trajectory. 

 There are special data issues and modeling considerations that need to be addressed when 

a mission involves an intercept of a vehicle or its payload (designated the target) by another 

vehicle/payload (designated the interceptor), where the uncertainties in both the target and 

interceptor state vectors at intercept need to be addressed. Some of these considerations and the 

type of data used are discussed below. 

c. Modeling Considerations. The modeling of debris dispersions due to guidance and 

performance factors generally varies with the type of data available from the vehicle 

vendor. The models compute fragment dispersions at surface impact (or at a 

specified altitude or a specified time) due to guidance and performance factors for a 

vehicle that breaks up or loses thrust while following a normal trajectory, or due to 

uncertainty in an intercept state vector. 

(1) The modeling of debris dispersions due to guidance and performance is the least 

straight forward when the vehicle state vector uncertainty is defined in the form 

of 3-sigma trajectories. In this case, consideration needs to be given to how to 

apply the data to define dispersions. 

• One approach is to use the state vectors at a given flight time from each of the 

3-sigma trajectories to compute the corresponding impact points for a given 

fragment/fragment group. These points can then be used to define the 3-

7-13
sigma limits for the impact dispersions. Exactly how the impact points are 

used to compute the impact dispersions is up to the interpretation of the 

analyst. For example, the most extreme impact points in the up-range, 

downrange, cross-range left and cross-range right directions could be used to 

define a contour fit of the points and to interpret this contour as a 3-sigma 

dispersion contour. 

• Another approach is to use the 3-sigma trajectory state vectors to estimate 

state vector component uncertainties to generate covariance matrices for the 

state vector for selected flight times. Corresponding fragment impact 

dispersions can then be estimated using one of the approaches discussed 

below. The state vector standard deviations for a given flight time can be 

estimated from the differences between the nominal state vector and the 

3-sigma trajectory state vectors for each state vector component. While this 

process provides estimates of the component standard deviations it does not 

provide estimates of the correlations between state vector components, and 

thus does not generate a complete state vector uncertainty covariance matrix. 

As discussed above, this can result in overstated debris impact dispersions. 

(2) The modeling of debris dispersions due to guidance and performance factors is 

the most straight forward in the less common case where the vehicle vendor 

provides a covariance matrix defining the vehicle state vector uncertainties as a 

function of flight time. There are two approaches that can be used to propagate 

the covariance to define debris dispersions. 

• The first approach is to propagate the state vector uncertainties, for given 

failure times, using analytical models (such as partial derivatives) to relate 

impact (or altitude) displacements to perturbations in the initial state vector 

components. The analytical model parameters will vary as a function of the 

initial state vector and of the fragment drag characteristics (ballistic 

coefficient or drag coefficient versus Mach number). 

• The second approach is to use the nominal vehicle state vector and the 

covariance matrix to generate perturbed state vectors for a given failure time 

and to propagate these for a given fragment (or fragment group) to impact 

using an impact predictor. The resulting impact point scatter plot can then be 

used to define the statistics of the impact dispersions. A sample scatter plot is 

shown in Figure 7-1 where impact points resulting from many random 

selections of the initial state vector are shown for two fragment ballistic 

coefficient values. The coordinates of the impact points (latitude-longitude, 

x-y, or other coordinate system) are used to calculate the mean impact point 

and the moments of the impact dispersions. 

(3) If the vehicle vendor provides a family of dispersed trajectories to characterize 

potential vehicle dispersions, the modeling is similar to the case where the vehicle 

vendor provides a covariance matrix. 

• The initial set of state vectors provided by the vendor, for given failure times 

and fragments, can be used to compute impact points and the resulting scatter 

plot to define the statistics of the impact dispersions. 

7-14
• As an alternative, the dispersed trajectories can be used to generate a 

covariance matrix and the covariance matrix propagated using analytical 

models, as discussed above. 

(4) When the mission involves an intercept of a vehicle or its payload by another 

vehicle/payload, launched usually from different sites on a coordinated schedule, 

additional factors must be considered. 

• Some launch vehicle maneuvers may be initiated based on energy 

management requirements, where the interceptor is guided, and executes 

maneuvers, based on both on-board and off-board sensor information 

regarding the target vehicle. 

• After either the target or the interceptor vehicle reaches a ballistic trajectory, 

additional maneuvering may be planned; for example, the target vehicle may 

maneuver to simulate evasive actions by a threat vehicle, and the interceptor 

will conduct both normal steering maneuvers as sensor data is improved, and 

responsive maneuvers based on command guidance or on-board course 

correction planning. 

Ballistic 

Coefficient = 

100 psf

Ballistic 

Coefficient 

= 30 psf 

Figure 7-1. Sample impact point scatter plot. 

 Intercept Control Volumes (ICV) are used to define the maximum allowable 

volume of space in which an intercept can occur. The ICV encompasses the net 

effect of the interceptor trajectory; including normal targeting, normal dispersions, 

and responsive planning and control; and the target trajectory, including dispersions 

7-15
from its nominal trajectory. The allowable size and shape of the ICV are often 

restricted based on safety criteria used to contain debris within allowable boundaries, 

or to achieve acceptable levels of risk. The ICV can be used to define variations in 

intercept debris impact points by generating impact points for various intercept state 

vectors selected from the ICV. 

 While the guidance and performance dispersions represent the state vector 

uncertainty for a vehicle following a normal trajectory, these data do not properly 

represent the state vector uncertainty for a vehicle that breaks up (or is destructed) 

while in a malfunction turn. These guidance and performance dispersions should, 

however, be accounted for as an additional source of state vector uncertainty over and 

above the consequences of the malfunction turn. Data to define guidance and 

performance state vector uncertainties during a turn are normally not generated by 

vehicle vendors. The risk analyst is thus faced with the challenge of how to define 

the guidance and performance debris impact dispersions for a vehicle in a turn. 

Lacking better data, the data for the normal trajectory may have to be used as an 

estimate of the state vector uncertainties during a malfunction turn due to guidance 

and performance factors. 

7.2.2 Vehicle Malfunction Turns. 

a. Model Description. A vehicle malfunction turn is defined to be any notable deviation 

of a vehicle from its intended trajectory that results from a failure (malfunction) of 

the vehicle hardware or software, including a failure of the vehicle guidance system. 

It includes everything from gradual turns off course to gravity turns to tumbling turns. 

It is often detected by abnormal deviations of the vehicle’s Instantaneous (projected) 

Impact Point (IIP) from the nominal IIP trace. The state vector at the time of breakup 

for a vehicle that is in a malfunction turn is highly uncertain due to the number of 

possible failure modes resulting in the turn, due to the uncertain response of the 

vehicle to the failure condition, and due to the response of a Mission Flight Safety 

Officer (MFSO) to the deviation from the intended trajectory. The resulting state 

vector uncertainty leads to uncertainty (dispersions) in the locations of the vehicle 

breakup debris during free fall and at impact. The purpose of the malfunction turn 

model is to define the debris dispersions resulting from the trajectory deviations from 

the time of the failure to the time of vehicle breakup, flight termination or impact. 

 There are many failure modes that can cause a malfunction turn and each of the 

relevant modes need to be considered. Possible malfunction turn failure modes 

include, but are not limited to: 

(1) A motor nozzle assembly failure causing loss of full control of the thrust direction 

resulting in an unplanned offset of the thrust vector. This could result, for 

example, from a failure of one or more nozzle actuators leading to a nozzle stuck 

in place, drifting to null, going hard-over, or randomly moving; or from a failure 

in a thrust injection system used to control the thrust vector direction. 

(2) A failure in the vehicle control system (hardware or software) leading to an 

erroneous command to the thrust vector control system. 

7-16
(3) A failure of a nozzle, such as a nozzle burn through, leading to a loss of a portion 

of a nozzle and a thrust offset. 

(4) The complete loss of a nozzle assembly in a solid rocket motor resulting in a 

complete loss of thrust control, and, usually, a significant drop in the thrust. 

(5) The loss of or a significant reduction in the thrust for one of the motors on a 

vehicle with multiple operating motors (core vehicle or strap-on motor). 

(6) An inadvertent separation of one or more strap-on motors. 

(7) A case burn-through for a solid rocket motor , or a leak at a case joint, resulting in 

a side thrust at the location of the burn through and a reduction in the main thrust. 

b. Data Sources. The primary sources of data to define malfunction turn behavior are 

vehicle vendors. If malfunction turn data are not available from the vendor, data can 

in some cases be developed using an appropriate trajectory simulation program.

 However, this requires a significant amount of data for the launch vehicle such as 

thrust, mass properties, and aerodynamic coefficients (including coefficients for a 

vehicle at large angles of attack). Also, unless the failure is a simple one to model 

such as a vehicle with a single thrusting motor with the nozzle locked in an offset 

position, the malfunction behavior may require that the vehicle control system be 

modeled. This may not be possible without significant information and models from 

the vendor.

 Malfunction turn data generated by vehicle vendors has primarily been of two 

types. Either type may include additional information to support development of 

debris impact dispersions. 

(1) One form of malfunction turn data is what is referred to as velocity turn curves. 

These curves give the turning capability of a vehicle expressed in terms of the 

time history of the vehicle velocity vector magnitude and velocity vector turn 

angle, for turns initiating at various flight times. The turn angle is the angle 

between the vehicle velocity vector at the start of a turn and that at a given time 

into the turn. The velocity magnitude and turn angle may be generated for 

various failure scenarios. Often the curves are generated both for pitch plane 

turns (the failure causes the vehicle turn in its pitch plane) and for yaw plane turns 

(the failure causes the vehicle turn in its yaw plane). The turn curves may be 

generated either ignoring the force of gravity during the turn or including gravity 

(or both). The purpose of generating turn curves ignoring gravity is to allow the 

velocity turn data to be used to estimate turns where the velocity vector is turning 

in a plane (plane containing the vehicle velocity vector at the start of the turn) 

other than that for which the turn data are generated. In this case the effect of 

gravity acting during a turn needs to be accounted for in the analytical model used 

by the analyst (by adjusting the vehicle turn state vector time history). 

• The major shortcoming with the velocity turn curve data is that the attitude of 

the vehicle and its velocity vector during a turn are not defined. Therefore, an 

assumption must be made regarding the direction that the velocity vector 

turns. A common assumption used is that the velocity remains in a specified 

7-17
plane, where the plane can have any orientation about the initial velocity 

vector. 

(2) A higher fidelity form of malfunction turn data are full 6 degree-of-freedom 

malfunction trajectories giving the full state vector, including the vehicle attitude, 

as a function of time into a turn. Trajectory data in this form are becoming more 

common. Typically a family of trajectories is generated for selected flight failure 

times for each of the many failure modes representing the range of vehicle 

malfunction response. In addition to providing a full state vector during a turn, 

and thus eliminating the need to assume the direction for the velocity, the attitude 

data can be used to define the orientation of the vehicle at the time of vehicle 

breakup or destruct which can in turn be used to initiate free flight simulations for 

an inadvertently separated thrusting motor or to account for the directionality of 

velocities imparted to fragments at breakup. 

(3) In addition to the malfunction turn curves or trajectories, the vehicle vendor often 

provides data to determine when during at turn a vehicle is expected to break up 

due to aerodynamic and inertial loads (including the centrifugal forces 

experienced by a tumbling vehicle), or specifies that breakup will not occur. This 

may be provided as the time into each turn that breakup is expected to occur or, 

for malfunction trajectories, as a loading condition, such as the q-alpha (dynamic 

pressure times angle of attack) value, at which breakup would be expected. In 

some cases the time or loading condition will be expressed as a range of values to 

account for uncertainty. 

(4) Other data that may be provided are the relative probabilities of the malfunction 

turn curves or malfunction trajectories for each flight time. The vendor may 

provide these relative probabilities, or it may be necessary for the range safety 

analyst to estimate them after discussions with the vendor. These probabilities 

are important for the computation of impact dispersion statistics from random 

impact points generated using the turn data. 

c. Modeling Considerations. Two important factors that need to be addressed when 

modeling malfunction turn dispersions. 

(1) The first factor relates to the fact that a launch vehicle may break up during a turn 

due to the abnormal aerodynamic and inertial loads or due to the propagation of 

the initial failure condition (such as the propagation of a nozzle burn through 

leading to an explosion). Breakup initiated by aerodynamic/inertial loads may 

also activate an Automatic Destruct System (ADS)/Inadvertent Separation 

Destruct System (ISDS) that further affects the vehicle breakup. To account for 

such breakup, the turns should be terminated at the point where breakup is 

predicted. The breakup time could be that provided by the vendor, the latest 

breakup time if a time range is provided or, if a Monte Carlo approach to 

modeling the impact dispersions is used, a randomly selected breakup time from a 

provided or estimated probability distribution. 

NOTE: In some cases it might be appropriate to assume that breakup will not 

occur during a malfunction turn so as to maximize the vehicle dispersions, and 

thus the dispersions of the vehicle fragments. This may (but not necessarily) lead 

to conservative risk predictions that could be adequate if these risks are within 

7-18
acceptable limits. If the risks are not acceptable it may be necessary to go back 

and re-compute the dispersions accounting for breakup during the turns. 

(2) The second factor relates to the effect of a flight termination system, and the 

associated flight termination criteria, on the dispersions. To account for this, 

malfunction turn simulations should model vehicle breakup as occurring 

whenever violation of a flight termination condition occurs. This requires 

tracking the flight termination condition during simulations of the turns and 

initiating termination (due to activation of the FTS by the Missile Flight Control 

Officer) when it is violated. Flight termination conditions are defined by 

established criteria such as the crossing of a destruct line by the vehicle’s 

projected vacuum impact point, the crossing of an impact limit line (ILL) by a 

projected debris footprint, or the violation of lines on a vertical plane position 

chart. 

• The determination of the time into a turn when vehicle breakup due to flight 

termination action will occur should include the delay time from when a flight 

termination criterion is violated to when actual vehicle destruct occurs. This 

delay time accounts for the time for the range safety software and hardware to 

display the position and movement of the vehicle; the human reaction time to 

detect the malfunction and activate the flight termination system; the system 

delays in sending, receiving and processing the flight termination signal; and 

the time for the flight termination hardware to perform its function. Often 

this delay time is defined as a time range or a probability distribution to 

account for uncertainty. 

• In addition to termination of a turn due to violation of the basic flight 

termination criteria, a vehicle that is in a malfunction turn may be terminated 

1) to prevent impact of an intact vehicle, 2) because the vehicle is erratic and 

the potential exists to lose positive control, or 3) because the performance of 

the vehicle is unknown and the possibility exists to violate established flight 

safety criteria. The analyst should also take this into consideration for 

determining if and when a turn is terminated. 

 If both vehicle breakup and flight termination can occur during a turn, the 

earliest of the breakup/termination times for these two phenomena is normally 

used. The analyst should keep in mind that the vehicle fragmentation that results 

from aerodynamic or inertial forces will, in most cases, be significantly different 

than that resulting from flight termination activation. 

With either form of the malfunction turn data (turn curves or turn trajectories) 

the analyst can choose to use the malfunction state vectors to 1) determine only 

the limits of debris dispersions at surface impact (or at altitude), or 2) generate 

random impact points (scatter plot). Scatter plot points can be used to compute 

the statistics of the debris impact dispersions or to generate a histogram of the 

7-19
random impact points, or risk computations can be made for each random impact 

point103. 

 The limits of the debris dispersions; such as the maximum up-range, 

downrange, cross-range left and cross-range right dispersions; can be used to 

approximate the region within which impact will occur, but this does not give any 

information as to the character or statistics of the impact distribution. With this 

approach the limits are often assumed to represent the 3-sigma dispersion contour, 

and an assumption may have to be made by the analyst as to the corresponding 

impact probability distribution. If risks are to be controlled by containment of 

debris, such as keeping it within specified range boundaries, the limits of debris 

impact may be all that is required. The containment approach could also be used 

to define clearance areas for ships and aircraft. 

• Computation of the fragment impact dispersion limits is different depending 

on whether malfunction turn curves or turn trajectories are employed. 

o With turn curves the maximum dispersions can be estimated by selecting 

the maximum velocity turn angles and, applying the corresponding 

velocity magnitudes, computing the projected impact points for a given 

fragment or fragment group. This may need to be done for each of the 

turn curves for each flight failure time, and for various orientations of the 

turn plane, in order to determine the maximum dispersion. 

o With turn trajectories there will be many trajectories, and the challenge is 

to select the proper malfunction trajectories that will sufficiently define 

the limits of the fragment impact dispersions for a given failure time. It 

may be necessary to compute the projected impact points for each of the 

trajectories, and possibly for various times during each trajectory, and then 

select the impact points that define the impact dispersion limits. 

 Random state vectors at vehicle breakup or flight termination are used to 

compute corresponding impact points resulting in a scatter plot. A scatter plot is 

generated for each fragment/fragment group of concern. The state vectors are 

generated by a Monte Carlo analysis of the malfunction trajectory and the 

breakup event (time and mode of vehicle breakup or flight termination). 

• If turn curves are used, the turn trajectories for a given failure time can be 

generated by randomly selecting a turn curve, assuming that the turn occurs in 

a plane, and randomly selecting the turn plane orientation. The relative 

probabilities of the turn curves and the probability distribution for the turn 

plane orientation angle are needed to make the random selections. These 

relative probabilities and/or the turn plane orientation probability distribution 

will need to be estimated if they are not available from the vehicle vendor. 

 

103 Risk computations can be performed for each of the random impact points, with the dispersions due to other 

sources of impact uncertainty accounted for either as part of the Monte Carlo simulations used to generate the 

random impact points, or as part of an uncertainty distribution about the random impact point. The risk contribution 

for each random impact point would, of course, need to be multiplied (weighted) by its relative probability of 

occurrence before combining with the contribution for other random impact points to get the total risk for the debris 

generating event. 

7-20
Once a turn curve and turn plane are selected the state vector during the turn 

can be computed using the velocity turn angle and magnitude history to define 

the velocity vector and, by integrating the velocity, the position vector during 

the turn. If the turn curves are generated ignoring gravity effects, the effect of 

gravity will need to be accounted for. 

• If turn trajectories are used, trajectories can be randomly selected from the set 

of trajectories provided. Relative probabilities of occurrence of the 

trajectories are needed to make the random trajectory selections. These 

relative probabilities will need to be estimated if not available from the 

vehicle vendor. 

 Statistics of the impact dispersions can be computed from the coordinates of 

the impact points in a scatter plot. These statistics provide information for 

selecting an appropriate impact distribution function. 

 Alternatively the scatter plot random impact points can be used to generate a 

histogram of the impact point distribution. This histogram provides the most 

accurate representation of the impact distribution, however computation of impact 

probabilities using a histogram is generally more complex and computationally 

intensive versus using a closed form impact distribution function. 

7.2.3 Debris Imparted Velocities. 

a. Model Description. Vehicle breakup generally results in velocities imparted to the 

resulting fragments. These imparted velocities are produced by the explosive charges 

used in flight termination systems, by pressure forces created by an explosion, by the 

rupture of a pressurized vessel or motor, and/or by the rotational motion of the 

vehicle at the time of breakup or flight termination. For weapon systems, velocities 

are created by hit-to-kill intercepts or warhead detonations. The direction and 

magnitude of the imparted velocities are often difficult to predict and are thus highly 

uncertain. The magnitude of the imparted velocities will vary with the way a vehicle 

breaks up; the variation in the explosive pressures created, the uncertainty in the 

pressure level in a rupturing vessel; the fracture pattern of motor cases, pressure 

vessels and other hardware; etc. The imparted velocity of each fragment will tend to 

have a preferred direction relative to a vehicle’s orientation. However, many of the 

same uncertainty factors for the imparted velocity magnitude apply to the imparted 

velocity direction. In addition, the uncertainty in the orientation of the vehicle at 

breakup (particularly if it is turning off course or tumbling) adds to the uncertainty in 

the net imparted velocity direction. 

The imparted velocity influences the post breakup state vectors of the fragments 

and thus affects the trajectories, and dispersions, of the fragments during free fall and 

at impact. The purpose of the imparted velocity debris dispersion model is to define 

these dispersions. 

7-21
b. Data Sources. A primary source of imparted velocity data is the velocity magnitudes 

provided by vehicle vendors for FTS-activated breakup of the launch vehicle. In 

some cases velocity magnitudes may be given for other modes of vehicle breakup 

such as an explosion.

(1) Typically only a single velocity magnitude is given for each fragment or fragment 

group, and no information is given as to the direction of the velocity. Possibly an 

uncertainty range for each magnitude will be specified or a statistical uncertainty, 

such as 1-sigma standard deviation, will be provided. 

(2) If imparted velocities are not provided by the vendor, or velocities for a different 

mode of failure are needed, the velocities can be estimated using existing models 

based on physical principals or on velocity measurements obtained from launch 

vehicle accidents (usually by analyzing video recordings of an accident). 

• Various models have been developed by launch vehicle vendors and the flight 

test ranges to predict velocities for fragments created by vehicle explosions 

and pressure vessel rupture. These models can be used to predict imparted 

velocities or to check the reasonableness of velocities provided by vendors. 

There are also models available to predict velocities, as well as the debris, 

resulting from hit-to-kill intercepts (such as the generally accepted KIDD 

model). 

c. Modeling Considerations. The analyst will first need to determine whether to 

characterize the dispersions by defining only the maximum (worst case) dispersions 

in various directions, or whether to develop a scatter plot to compute the statistics of 

the dispersions, a histogram defining the impact distribution, or to compute the risks 

directly for each random impact point. 

(1) If only the maximum dispersions are to be generated, then a best estimate of the 

maximum imparted velocity magnitude will need to be made. This maximum 

imparted velocity magnitude can then be used to compute maximum dispersions 

at impact (or at altitude) by iterating on the imparted velocity direction and 

computing the corresponding impact trajectories. Impact points for a range of 

credible imparted velocity directions are necessary to determine the maximum 

dispersion in all directions. 

(2) If a scatter plot is to be generated, the statistical characteristics of the imparted 

velocity must be determined. If only a single imparted velocity magnitude is 

provided, then it must be interpreted as a maximum value, a mean, a given 

percentile on a probability distribution, etc. in order to estimate a probability 

distribution for the velocity magnitude. If a range of values, or an uncertainty in 

the specified value, are provided, this can be used to better define the probability 

distribution. A distribution for the velocity direction is also needed. In the 

absence of any specific information, the velocity is often assumed to have an 

equal likelihood of being in any direction (uniform spherical distribution). This is 

predicated on the fact that the direction of the velocity relative to the vehicle is 

highly uncertain, and the attitude of the vehicle at the time of breakup may also be 

highly uncertain. In cases such as a vehicle explosion during a normal trajectory 

or a planned detonation, a best estimate of the imparted velocity direction can be 

7-22
made, and the uncertainty in the direction can be defined by a probability 

distribution about the preferred direction (such as a conical distribution with the 

centerline of the cone aligned along the preferred direction). 

• The probability distributions for the imparted velocity vector (magnitude and 

direction) are used in a Monte Carlo analysis to compute the scatter plot (set 

of drag corrected impact points). The scatter plot points can be used to 

compute the impact dispersion statistics (mean, standard deviations, etc.) or a 

histogram, or the random impact points can be used directly in risk 

calculations. 

(3) Three additional factors should to be considered when developing debris impact 

dispersions due to imparted velocity. 

• The impact dispersions often become significantly non-linear as the velocity 

magnitudes become large, especially for low ballistic coefficient fragments. 

Also, at higher initial altitudes the direction of the imparted velocity can 

produce significant non-linearity. Thus, linear methods (such as influence 

coefficients) to compute impact dispersions should only be used for relatively 

small imparted velocity magnitudes and lower altitudes. An impact predictor 

capable of handling high decelerations can be used to compute impact points 

for high magnitude imparted velocities. 

• Imparted velocities can result in fragments that enter into stable or temporary 

orbits, and it may be necessary to eliminate the fragments for the computation 

of surface impact risks, while accounting for them when assessing the shortterm or long-term risks to orbiting assets. 

• The distribution of imparted velocity impact points can be irregular or highly 

skewed such that a simple closed form function, such as a bivariate normal 

distribution, will not adequately represent the actual distribution. These cases 

require a more complex method to characterize the distribution (such as an 

impact point histogram) or the use of a Monte Carlo method to compute risks 

for each individual impact point. 

7.2.4 Fragment Aerodynamic Drag Uncertainty. 

a. Model Description. The location of a fragment during free fall or at impact is 

significantly affected by the aerodynamic drag force acting on the fragment. The 

drag characteristics of the fragments resulting from the breakup of a vehicle can 

usually only be roughly estimated. This uncertainty leads to uncertainty in the 

trajectory of the fragments during free fall and thus to dispersion during free fall and 

at impact. The uncertainty in fragment drag characteristics results from the fact that 

the manner in which a vehicle will break up can only be estimated and, even for a 

well defined fragment, the drag characteristics will vary or be uncertain due to the 

uncertainty in how the fragment will fall (stabilized at a given orientation, tumbling, 

etc.). In addition, the character of fragments can change during reentry due to 

aerodynamic stresses and aero-thermal heating, resulting in secondary fragmentation, 

melting, vaporization, or ablation. This not only affects the fragment drag 

characteristics, but the changes in the debris due to the heating affects (including 

fragment demise) and secondary breakup will need to be addressed in the risk 

7-23
computations. The purpose of the aerodynamic drag uncertainty debris dispersion 

model is to define the dispersions. 

b. Data Sources. The primary source of data for fragment drag characteristics is data 

provided by the vehicle vendor for specific breakup modes (usually for destruct 

breakup; sometimes for other breakup modes). See also paragraph 7.1.

(1) The most common data are the ballistic coefficients of the fragments. Since a 

fragment’s ballistic coefficient varies with Mach number, values are often given 

that are average values for subsonic and supersonic speeds (where an average or 

representative ballistic coefficient is used for each of these regimes). In some 

cases ranges of ballistic coefficient values are provided for each fragment or 

fragment group. 

(2) For some, usually well-defined, fragments the drag coefficient versus Mach 

number (along with the associated reference area) may be provided. 

(3) When drag characteristics are not provided, or the analyst wants to check the 

validity of the data, ballistic coefficients can be estimated based on a fragments 

shape, size and weight using standard formulas. For well-defined fragments the 

drag coefficient versus Mach number might be predictable using standard curves. 

c. Modeling Considerations. The dispersions due to drag uncertainty are usually 

handled by defining the uncertainties in the fragment drag force.

(1) If the drag is defined by a representative fragment ballistic coefficient, the 

uncertainty in the ballistic coefficient is used to define the dispersions. Since the 

drag force on a fragment varies significantly between supersonic and subsonic 

speeds, the appropriate ballistic coefficient should be used for these two regimes, 

and the uncertainty defined for each regime. For low ballistic coefficient 

fragments originating at lower altitudes where the atmosphere is dense, the drag 

force is high and the velocity of a fragment is slowed rapidly to subsonic speeds 

such that it may be adequate to use the subsonic ballistic coefficient for the entire 

free fall trajectory. The uncertainty in ballistic coefficient is typically defined by 

a range of values (from vehicle vendor data or engineering estimates), or may be 

defined by a statistical uncertainty or a probability distribution. Generally the 

uncertainties (or a probability distribution) are not provided by the vehicle vendor 

and it is up to the analyst to estimate these. 

(2) If the drag is defined by drag coefficient curve (drag coefficient versus Mach 

number and associated reference area) the uncertainty in the drag will need to be 

defined in terms of the uncertainty in the drag coefficient. This may be in the 

form of lower and upper bound drag coefficient versus Mach number curves. 

The approach often used to define debris dispersions due to drag uncertainty is to 

propagate a fragment to impact using the best estimate of the ballistic coefficient and 

using the maximum and minimum, or statistically varied, ballistic coefficient values 

(or by using the best estimates and statistical variations on the drag coefficient versus 

Mach number data). 

(3) The resulting impact points can then be used to characterize the fragment 

dispersion due to drag uncertainty. Since the variation in a fragment impact point 

7-24
as a function of the drag traces along a curved line, often referred to as a debris 

centerline (Figure 7-2), the dispersions of the impact point lies along this line. 

This creates a challenge for the analyst as to how to model this “one dimensional” 

distribution, especially when combining this source of impact uncertainty with the 

other sources of impact uncertainty to characterize the total impact distribution. 

A conservative approach that has been used is to approximate the drag uncertainty 

dispersions by selecting an appropriate two-dimensional distribution to represent 

the one-dimensional curvilinear distribution. 

(4) An aerodynamic regime that may need to be considered when computing the 

impact points of fragments is the portion of the trajectory that is at very high 

altitudes where the atmosphere consists of individual molecules. Here the drag 

should be accounted for by using appropriate drag models for this regime. 

Figure 7-2. Debris centerline showing variation of the impact with fragment ballistic 

coefficient (β). 

7.2.5 Fragment Aerodynamic Lift Effects. 

a. Model Description. The location of a fragment during free fall or at impact can be 

significantly affected by the aerodynamic lift force acting on the fragment. For 

reasons similar to those discussed for aerodynamic drag (paragraph 7.2.4), the lift 

force on a fragment can usually only be roughly estimated and the uncertainty leads 

to uncertainty in the trajectory of the fragment during free fall and thus in dispersions 

at any given altitude or at impact. The purpose of the lift debris dispersion model is 

to define these dispersions. 

b. Data Sources. The lift force on a fragment is usually defined by the lift-to-drag ratio, 

which is the ratio of the magnitude of the lift force to the magnitude of the drag force. 

7-25
Lift-to-drag ratios are not normally provided by vehicle vendors and therefore must 

usually be estimated by the analyst based on predicted fragment shapes. 

c. Modeling Considerations. Fragment impact dispersions due to lift can be assessed by 

simulating fragment trajectories with and without the lift force. It should be 

emphasized that while the drag force always operates in a direction opposed to the 

velocity vector, the force normally called “lift” can operate in any direction 

perpendicular to the velocity vector, even downward, and the direction can rotate as 

the fragment falls. Thus for fragments that can stabilize their orientation relative to 

the velocity vector, the larger dispersions should be accounted for by simulating 

trajectories with the lift vector stabilized in various directions. For fragments that 

will tumble during free fall or for which the direction of the lift vector is unknown 

due to the uncertainty in the fragment shape, the simulated trajectories should 

consider a rotating lift vector direction where the rate of rotation is varied. The 

impact points computed using the various assumptions on the lift vector can be used 

to define the limits on the impact dispersions, in various directions, and these can be 

used in determination of debris containment or to define hazard zones. The impact 

points can also be used to estimate impact distribution statistics characterizing the 

impact uncertainty due to lift effects.

7.2.6 Wind Drift and Wind Uncertainty. 

a. Model Description. Wind is a significant factor affecting the trajectory of fragments 

during free fall. This is particularly true for fragments experiencing high drag (low 

ballistic coefficient). The wind causes a shift in the position of a fragment during free 

fall and this shift is determined by the magnitude and direction of the wind as a 

function of altitude. Since the wind varies with both time and location, the wind 

profile can only be defined statistically. This uncertainty in the wind profile results in 

uncertainty in the free fall trajectory of fragments and thus in dispersions at any given 

altitude or at surface impact. The purpose of the wind uncertainty debris dispersion 

model is to define these dispersions. 

It should be pointed out that the modeling approach to account for fragment 

dispersions due to wind drift can vary depending on whether the analyst is 

demonstrating that fragments will be contained within prescribed boundaries, thus 

controlling the risks, or is performing a risk analysis for the case where debris cannot 

be contained. Containment can be managed by determining that the maximum debris 

dispersions will be contained under the maximum allowable launch wind, whereas a 

risk analysis will require that wind induced impact dispersion statistics be developed. 

For containment analyses it may only be necessary to establish maximum allowable 

wind profiles while risk analyses will normally require defining the wind statistics. 

b. Data Sources. The wind is usually defined in terms of a mean wind profile along 

with the associated uncertainties, usually presented on a monthly or annual basis. For 

day of mission assessments, the wind profile is usually obtained from pre-mission 

measurements using weather balloons, towers and radar profilers.

7-26
(1) The wind is usually expressed in terms of the wind components in a local 

orthogonal coordinate system (such as an east-north system) as a function of 

altitude or in terms of the wind magnitude and direction as a function of altitude. 

In most cases, wind updrafts and downdrafts are ignored. 

(2) For monthly or annual wind data, the wind is generally defined in terms of the 

mean wind profile and the uncertainty in the wind defined by the standard 

deviations determined for each of the wind components at each altitude, and the 

correlation between the two wind components. In some cases the wind statistics 

may also include the correlations between wind components at one altitude and 

those at other altitudes. Usually these correlations are only provided for the wind 

components at a given altitude and those at the immediately adjacent altitudes. 

Wind statistics for a given location and time of the year are generated from many 

wind measurements (hundreds or thousands) taken over many years. These timeof-year wind statistics are used to perform planning risk analyses (i.e. for 

predicting risks for a launch planned for a future time). 

(3) Uncertainty should also be addressed for measured winds. Here the uncertainty is 

due to the uncertainty in the measurement of the wind (instrumentation error), the 

time elapsed between the wind measurement and the time of launch, and the 

spatial variation between where the wind is measured and where the launch 

vehicle flies. The uncertainties due to instrumentation error can be estimated 

based on the characteristics of the wind measuring system and the uncertainties 

due to time delay can be developed, for given time of year, by performing statistic 

analyses of measured winds taken at short time intervals (typically one to six hour 

intervals). Uncertainty due to special variation is difficult to define and is often 

ignored (the wind statistics for a given location are assumed to apply over 

segments of flight) or the wind data used are changed as the vehicle progresses 

along its trajectory. Measured wind and associated uncertainties are used to 

perform risk analyses during the countdown prior to a launch. 

(4) Common sources of wind data are: 

• Range Commanders Council (RCC) Range Reference Atmosphere data that is 

available for most of the test ranges. 

• The Global Reference Atmospheric Model (GRAM) developed by NASA. 

This model can generate wind data for any given location on the Earth 

(latitude, longitude) using data from the Global Gridded Upper Atmosphere 

Statistics (GGUAS) database (distributed as the Global Upper Air Climatic 

Atlas) and the RCC Range Reference Atmosphere data. 

• NASA developed statistical wind data. 

• The Inter-Range Instrumentation Group (IRIG) wind statistics. 

• The AFETAC wind database covering various launch ranges. 

• Data published for a given range (both individual soundings and statistical) 

from historical wind measurements taken at the range using various 

measuring systems, such as Jimsphere, Rawinsonde, and Windsonde 

soundings, and Doppler Radar Profiler measurements. (These data are also 

used as part of the data base for the other wind data sources). 

• National Oceanic and Atmospheric Administration (NOAA) data. 

7-27
c. Modeling Considerations. Wind statistics can be used to define the uncertainties in 

the fragment position at altitude or at surface impact, to define percentile and 

maximum permissible wind profiles for given directions, or to generate random 

samples of the wind profile. Approaches for the computation of wind-created debris 

dispersions range from the computation of maximum surface impact dispersions due 

to winds in various directions, to the development of impact distribution statistics or 

scatter plots. 

(1) Maximum dispersions are usually based on the worst wind conditions for which a 

launch would be conducted. In many cases these limiting winds are expressed as 

percentile winds; that is, winds in specified directions that would be exceeded a 

specified percentage of the time. Wind corrected impact points generated using 

these wind profiles are used to define the limits of the fragment impact 

uncertainty area due to wind. 

• Percentile winds may be planar or in a given general direction, such as a wind 

coming from the South-West, and do not necessarily represent a real wind 

condition. 

• The maximum wind dispersion approach is often used for assessing the 

containment of debris and for defining caution and hazard corridors used to 

control the location and sheltering of people. The impact area defined by the 

maximum dispersion impact points could also be used to estimate a wind 

impact uncertainty probability distribution. 

(2) A wind covariance matrix can be used to compute the statistics of the debris 

impact uncertainty distributions directly, or to generate random wind profiles and 

corresponding wind corrected impact points (scatter plot) characterizing the 

impact distribution. The wind covariance matrix contains the variances of the 

wind components at each wind altitude, the correlation between the wind 

components at each altitude, and, if available, the correlations between wind 

components at a given altitude and other altitudes. It is important to include as 

much correlation data in the wind covariance matrix as possible in order to get the 

most accurate representation of the wind uncertainty and of the corresponding 

impact dispersions. 

• The statistics of the debris impact uncertainty distribution can be computed 

using analytical models (such as partial derivatives) to relate impact (or 

altitude) displacements to the wind uncertainties defined by the covariance 

matrix. 

• Random wind profiles can be generated from a wind covariance matrix using 

a procedure employing a decomposition of the covariance matrix, such as a 

Singular Value Decomposition or a Cholesky Decomposition. Scatter plots 

generated from the random wind profiles can be used to generate the statistics 

of the impact distribution and to define an appropriate impact distribution fit. 

An approach that has been used to handle wind effects for debris risk analyses is to 

compute the risks for many possible wind profiles for the time period for which a launch is 

planned. The wind profiles can be actual measured winds or random wind profiles generated 

from a wind covariance matrix. The resulting risk estimates can be used to assess the likelihood 

7-28
that the risks for a future launch will meet acceptable risk criteria. A launch agency or range can 

use this information to decide if a launch time should be restricted to a certain time of day, or 

should be planned for a different time of the year when the likelihood of exceeding acceptable 

risk levels is reduced. 

7.2.7 Free Flight of Inadvertently Separated Thrusting Motors. 

a. Model Description. Some launch vehicles carry thrusting motors that could separate 

and fly independently (free fly) to the time when the motor is destroyed or breaks up 

due to aerodynamic and inertial loads; in some cases the motor may be allowed to fly 

intact to thrust termination or impact. Potential sources of free flying motors include 

inadvertent separation of strap-on motors, early ignition and separation of upper 

stages, or ignition and separation of payload insertion motors. Also, normally 

jettisoned motors can have residual thrust that continues following separation. An 

inadvertent separation will likely affect the performance of the parent vehicle, 

including recoil from the detached motor or damage (or breakup) from the separation 

event, and this should also be considered in a risk assessment. 

 In many cases strap-on motors are required to carry an inadvertent separation 

destruct system (ISDS) that automatically destroys the motor in the event of an 

inadvertent separation. If the ISDS activates immediately upon inadvertent 

separation, dispersions due to free flight are eliminated. However, to eliminate or 

mitigate fratricide of the parent vehicle, there may be a time delay in the activation of 

the system allowing seconds of thrusting flight prior to destruct, potentially resulting 

in significant dispersions. In some cases the motors carry a termination system that 

must be activated by remote command from the Missile Flight Safety Officer 

(MFSO), and the time to destruct will depend on reaction time, signal transmission 

time, termination system activation time, and any intentional delays by the MFCO. 

 The simulation of free flight trajectories for inadvertently separated thrusting 

motors involves significant uncertainty for many reasons: 

(1) The initial attitude and attitude rates of the motor just after separation are 

uncertain, 

(2) The vehicle may be turning off course or tumbling at the time of separation thus 

adding additional uncertainty to the motor initial attitude and attitude rates, 

(3) The thrust magnitude and direction are often uncertain, particularly if the motor 

nozzle is gimbaled or is damaged during the inadvertent separation (due to 

contact with the parent vehicle), 

(4) The mass properties of the motor are uncertain and vary as the motor consumes 

propellant, and 

(5) The aerodynamic coefficients of the separated motor, particularly for large angles 

of attack, are uncertain, or are not available and need to be estimated. 

 The purpose of the dispersion model for free flight is to define the dispersions of 

the debris resulting from free flying motor destruct/breakup. These dispersions are 

7-29
often the primary source of the overall dispersions of debris resulting from a free 

flying motor. 

b. Data Sources. Generally the dispersions of a separated thrusting motor require 6 

degree-of-freedom simulations of the motor to the time of destruct, aerodynamic and 

inertial loads breakup, or surface impact. Significant amounts of data are needed to 

perform these free flight simulations. These data may be required for an undamaged 

motor and for various damage states of the motor. 

The data normally required, including their associated uncertainties, are: 

(1) Motor mass properties versus time, 

(2) Motor aerodynamic coefficients as a function of angle of attack, roll attitude, etc., 

(3) Thrust magnitude versus time, 

(4) Thrust direction (may be a function of time),

(5) Estimates of the initial attitude and attitude rates of the motor following 

separation, and

(6) Data defining when during free flight a motor will break up or be destroyed.

Some or all of these may be available from the vehicle vendor. Often some of the 

data will need to be estimated by the analyst, especially the uncertainties. Although 

aerodynamic coefficients are often available for the motor for low angles of attack, 

the extension to high angles of attack may have to be estimated based on data for 

similar motors or using computer tools developed to estimate aerodynamic 

coefficients. Initial attitudes and attitude rates are particularly difficult to predict and 

will likely need to be roughly estimated, including their associated uncertainties. 

c. Modeling Considerations. The many uncertainties in the free flight trajectories for 

separated thrusting motors generally means that the dispersions need to be evaluated 

by simulating many free flight trajectories, where the many uncertain parameters are 

randomly selected for each simulation. The state vectors at breakup, destruct or 

motor impact can then be used to generate corresponding scatter plots for the motor 

or for its fragments. These can be used to compute the statistics of the impact 

dispersions, to generate an impact distribution histogram, or to compute risks for each 

impact point1

 (after accounting for other sources of dispersion).

 Other factors that should be addressed include: 

(1) Potential damage states of the motor. For example a motor may have a nozzle 

with a fixed offset that would tend to cause the motor to tumble, but damage 

resulting from the inadvertent separation event could result in damage to the 

motor nozzle causing a change in the thrust direction and magnitude. In fact, the 

entire motor nozzle assembly including the throat could be knocked off causing 

the thrust to nearly align with the motor centerline. Although the damaged 

conditions generally result in reduced thrust, the change in the thrust direction 

could result in greater dispersions than for an undamaged motor. 

(2) Breakup of the inadvertently separated motor due to aerodynamic and inertial 

loads or destruct action and accounting for this in the free flight simulations. 

7-30
(3) In some cases the inadvertent separation of a solid propellant motor may be due to 

a burn through of the motor case, or the motor case could be punctured during 

separation, and the resulting side thrust and the effect on the motor normal thrust 

may need to be modeled in the free flight simulations. 

(4) Often it will be found that the fragment impact point scatter plot resulting from 

free flying motors is highly skewed or irregular. This presents a challenge for 

determining an adequate representation of the impact distribution. If the 

distribution cannot be modeled using a closed form distribution function, it may 

be necessary to perform risk computations using a numerical characterization of 

the distribution or by computing risks for each of the random impact points.

7.3 Debris Distribution Models 

a. Model Description. Paragraph 7.2 discussed the modeling of fragment dispersions 

for each of the important sources of position uncertainty. The subject of this section 

is the characterization of the overall distribution of fragment position during free fall 

and at surface impact accounting for all sources of position uncertainty. These 

fragment distributions are required for the calculation of impact probabilities. The 

focus of the discussion will be on the development of two-dimensional distributions 

used to compute the probabilities of fragment impact onto or near specified 

population centers or vehicles on the surface (ground or water), to define areas where 

aircraft will be at risk, or to compute rough estimates of the risk to specific aircraft. 

Subparagraph 7.3.3 will address the special considerations for developing threedimensional distributions that may be needed to compute the probabilities of impact 

for specific aircraft (or a spacecraft) following a defined flight path. 

b. Modeling Considerations. Impact distributions can be defined in various ways.

(1) One method is to fit the combined (multiple dispersion sources) dispersion 

statistics, or the distribution of random impact points (scatter plots from Monte 

Carlo simulations) that account for multiple dispersion sources, with closed form 

impact point distribution probability functions, such as bivariate normal 

distributions. A key advantage of this approach is that the closed form 

distributions are very efficient for computing impact probabilities which can be 

important for assessing the risks for a large library of locations (occupied 

buildings, groups of people in the open, populated regions, valuable assets, etc.) 

and/or for timely assessments of the risks during a launch count down. The 

shortcoming of this method is that the true distribution of impact points may have 

an irregular, skewed or segmented pattern that may not be adequately represented 

with a closed form function. The development of dispersion statistics and impact 

distribution functions is discussed in more detail in paragraph 7.3.1. 

• A variation on this approach when a scatter plot is used is to define the impact 

distribution using a rectangular grid to define the impact space and to compute 

the probability of impact within each grid cell by counting the number of 

random impact points in the cell and dividing by the total number of points 

(the resulting impact distribution can be represented by a two dimensional 

histogram). This results in a more accurate representation of the distribution 

7-31
but increases the data storage and computation time required to compute 

impact probabilities. The grid cell size is an important consideration since the 

smaller the cells the more accurate the representation of the impact point 

distribution, but if the cells are too small the impact probability in some cells 

may be under or over estimated due to under or over representation of impact 

points in the cells. Impact probability for a given location within a cell is 

computed by assuming a uniform probability of impact over the cell such that 

the impact probability is the probability of impact within the cell multiplied 

by the ratio of the area of the location to the area of the cell. 

(2) A second approach is to use random impact points that account for multiple 

sources of dispersion directly to define the impact distribution. In this case debris 

risk calculations would be performed for each of the random impact points. The 

resulting risk for each impact point is weighted by its relative probability and then 

the risks for all random impact points for the given failure scenario (failure mode, 

failure time and vehicle breakup mode) are added to get the risk. This provides a 

good representation of where a fragment can impact. However, this approach 

usually requires that a very large number of impact points be generated in order to 

adequately represent all of the possible impact locations for a fragment, and to get 

an accurate assessment of the risks. The probability of impact for a specific 

population center, and the corresponding prediction of the risk, could be 

significantly under or over predicted simply because the sample of impact points 

within and around the location are over or under represented. For example 

“holes” in the scatter of impact points could lead to a prediction of zero risk for a 

populated building where it is clear that credible deviations in the vehicle 

trajectory prior to breakup or in the fragment free fall trajectory could result in 

impacts on the building. The generation of random impact points that account for 

multiple dispersion sources is discussed in more detail in paragraph 7.3.2. 

(3) A third approach is a combination of the first and second approaches. Here, some 

of the sources of impact uncertainty are treated by generating random impact 

points, while others are treated by generating closed form impact point 

uncertainty distributions about the random impact points. Impact probabilities, 

and corresponding risks, can then be computed for each impact point, but now 

using the closed form impact distribution function to compute the impact 

probability for allocation. Again the risks need to be weighted by the relative 

probabilities of occurrence of the random impact points. The advantage of this 

method is that the impact probability distributions about each impact point help to 

“fill in” the impact region so as to avoid under or over prediction of impact 

probabilities. 

7.3.1 Impact Distribution Functions for Multiple Dispersion Sources. 

a. Model Description. The generation of impact uncertainty distribution functions to 

represent multiple sources of impact dispersion involves the combining of the 

statistics for the impact dispersions for each source, or the generation of a distribution 

function that fits a scatter plot that accounts for multiple sources of dispersion. 

7-32
b. Modeling Consideration. There are two basic approaches for developing impact 

distribution functions. 

(1) In the simplest form the generation of the combined distribution involves 

combining the maximum (or near maximum) dispersion for each dispersion 

source to get the resultant maximum. The combining of the dispersions is usually 

done by root-sum-squaring the maximum dispersion values, although a very 

conservative approach could involve adding these values. The combined 

dispersion needs to be calculated for various directions to establish a maximum 

dispersion contour. 

• If only a determination that debris is contained within prescribed range 

boundaries is required, the maximum dispersion contour may be all that is 

required. 

• If risks need to be computed, the contour will need to be assigned a statistical 

significance, such as interpreting it to be a 3-sigma dispersion contour, and a 

probability distribution function that adequately fits the contour will need to 

be assigned. 

(2) The second method is to develop impact statistics for each dispersion source in 

the form of a mean impact point (defined by the impact point coordinates) and a 

covariance matrix. The covariance matrix contains the variances in each of two 

orthogonal directions (diagonal terms) and the covariance as the off diagonal 

terms. The mean and covariance matrix for the combined dispersion sources can 

then be computed by adding the coordinate values of the means and by adding the 

covariance matrices. This requires that an assumption be made that the impact 

dispersions from the various dispersion sources are independent of each other. It 

may be necessary to verify that this assumption will not result in unacceptable 

errors in the statistics of the combined distribution. The resulting mean and 

covariance matrix statistics can be used as the basis to define an impact 

distribution function having its mean at the computed mean impact point and its 

standard deviations along principal orthogonal directions where the standard 

deviations and principal axis directions are computed from the covariance matrix. 

The challenge for the analyst is to select an appropriate impact probability density 

function that fits the statistics. 

• If the statistics of an impact distribution are generated from a scatter plot that 

accounts for multiple sources of impact uncertainty (see paragraph 7.3.2), the 

statistics can include the mean, standard deviations, correlation coefficient, 

and higher moments of the distribution. These can be used to select a closed 

form distribution function. The function can be compared with the scatter 

plot, or scatter plot histogram, to assess the goodness of fit. 

7.3.2 Scatter Plots for Multiple Dispersion Sources. 

a. Model Description. As discussed above, the distribution of impact points for some or 

all sources of impact uncertainty can be represented by scatter plots (random impact 

points). The generation of scatter plots for computing impact dispersions, for each of 

the sources of uncertainty, are addressed in paragraph 7.2. The generation of scatter 

plots representing multiple sources of impact uncertainty are addressed here. 

7-33
b. Modeling Considerations. Generating scatter plots that account for multiple sources 

of impact uncertainty requires that random trajectories be generated where random 

representations of each source of dispersion are accounted for in each impact 

trajectory simulation. Say, for example, that the sources of uncertainty to be treated 

are vehicle malfunction turn, fragment drag uncertainty and wind uncertainty. The 

generation of each random fragment impact point will then involve a random 

simulation of the vehicle malfunction trajectory (or random selection of a malfunction 

trajectory from the set of trajectories provided by a vehicle vendor) to vehicle 

breakup to establish the breakup state vector, a random selection of the fragment 

ballistic coefficient, and a simulation of the fragment free fall trajectory through a 

randomly selected wind profile. Each of these vehicle/fragment trajectory 

simulations will generate a single random impact point that accounts for all three 

dispersion sources.

 A big advantage of generating random trajectories and impact points that account 

for multiple sources of uncertainty is that any correlation between the dispersions for 

the modeled dispersion sources are fairly accurately accounted for. 

7.3.3 Considerations for Three-Dimensional Models. 

a. Model Description. The development of clearance zones for aircraft to avoid impact 

by hazardous debris from a failed launch vehicle or from a debris-generating weapons 

test can be generated using two-dimensional debris distributions at the aircraft 

altitudes of interest, similar to those developed for surface impact. Since the purpose 

of the clearance zone is to define regions where aircraft are not allowed, two 

dimensional distributions can be used to define horizontal plane (constant altitude) 

areas through which hazardous debris may fall and these, together with the time it 

takes for all hazardous debris to fall below the aircraft altitude(s), can be used to 

define the areas to be cleared and the time period that clearance is required. Using 

these two-dimensional distributions to compute the impact probability for a particular 

aircraft, however, generally results in an overstatement of the risk.

 To obtain a better estimate of the risk to a specific aircraft that is flying through a 

hazardous region (either inadvertently or intentionally, such as an aircraft providing 

launch support), a three-dimensional debris dispersion model is needed. (A threedimensional model might also be required to assess the risks for a spacecraft with a 

known orbit.) Since the debris distributions will be continually changing as the 

fragments progress (rise and/or fall), and the location of an aircraft is continually 

changing, the dispersions for each class of fragments will need to be modeled as a 

function of time. The four-dimensional distributions (three-dimensions to define 

location and one for the time) are needed to define the probability of a fragment being 

in a given location at a given time. This, together with information to predict the fall 

velocity of a fragment and the velocity of the aircraft versus time, can be used to 

determine the vulnerable volume of the aircraft. The two extra dimensions of the 

7-34
distribution (time and vertical position) makes the generation of these distributions of 

debris more complex than the generation of two-dimensional distributions. 

b. Modeling Considerations. A viable approach to define the three-dimensional 

distributions is to propagate fragments from the debris generating event to a given 

time after the event using a Monte Carlo method where each fragment (or fragment 

group) is propagated many times, with the parameters characterizing the various 

sources of debris dispersion randomly selected for each Monte Carlo iteration. Thus, 

for example, a given fragment would be propagated for a random selection of the 

initial fragment state vector based on the uncertainties due to normal trajectory 

deviations (guidance and performance uncertainties), vehicle malfunction dispersions 

and velocities imparted at breakup; and for a random selection of the fragment 

ballistic coefficient and the wind profile acting during fragment free fall. Some of the 

sources of dispersion, such as wind or lift, could be handled analytically by 

computing the dispersions for given altitudes and combining these statistically with 

the dispersions generated through the Monte Carlo approach.

 Following are comments on the general modeling approach and some important 

considerations. 

(1) The resulting three-dimensional scatter of fragment positions at a given time can 

be used to define the probability of the fragment being in a given location by 

either 1) “binning” the volume of concern and computing the probability of being 

in each bin using the number of samples in the bin, or 2) defining a threedimensional probability density function that adequately fits the random fragment 

locations. For computational efficiency the use of a probability density function 

is preferable. A density function that has been assumed in past analyses is a 

trivariate normal distribution. 

(2) The distribution of debris and the debris velocities will change significantly as an 

aircraft passes through a debris cloud, and the aircraft can be impacted not only 

on top of the aircraft but also by the aircraft running into a fragment (see Figure 

7-3). In fact, frontal impacts are usually more likely for aircraft traveling at high 

speeds (such as commercial airliners). Thus the speed of the aircraft and the 

speed of the fragment must be accounted for. The fragment velocity can be 

defined as an average velocity for each “bin”, an average over all fragment 

locations, or an average over all fragments within altitude bands. 

(3) Given the characterization of fragment position versus time, and the velocity of 

the fragment, the probability of impact on an aircraft can be computed by 

segmenting the fall time of the debris into short time segments, computing the 

probability of fragment impact on the plan area or frontal area of the aircraft 

during the time step, and adding the probabilities over all time steps. This will 

need to be done for each fragment (or for each fragment group, accounting for the 

number of fragments in the group) and the results statistically combined to get the 

probability of one-or-more impacts by a fragment hazardous to an aircraft.

(4) Previously published material shows how the areas of an aircraft can be used (in 

conjunction with the speed of the aircraft, etc) to compute (1) the probability of 

impact for aircraft one specific trajectories through a debris cloud, and (2) 

7-35
Frontal area

swept out by

Aircraft = AF

Debris Looking down - plan area of aircraft = AT

Frontal area

swept out by

Aircraft = AF

Debris Looking down - plan area of aircraft = AT

probability of impact contours.104 Both of those products are useful in 

demonstrating compliance with the probability of impact requirements contained 

in the RCC 321 Standard.

(5) The aircraft vulnerability models presented in Chapter 6 account for the velocity 

of the fragment, the velocity of the aircraft, and the various areas of a B747. 

However, the casualty area or catastrophe area (APROJ in the following equation) 

given by the Chapter 6 aircraft vulnerability models must be modified as follows 

for use as a reference area (AI) in standard probability of impact computations 

(much like the plan area of building is often used to compute the probability of 

impact on a building).

2 2

A d

I PROJ

d

v v

A A

v

+ =

Figure 7-3. Aircraft impact geometry.

7.4 Impact Probability Models 

a. Model Description. Paragraph 7.2 discussed approaches and considerations for 

modeling the dispersions of debris during free fall and at impact for the primary 

sources of debris dispersion. paragraph 7.3 discussed the development of twodimensional distributions used to compute the probabilities of fragment impact and to 

develop aircraft hazard areas, and the development of three-dimensional distributions 

for computing impact probabilities for a specific aircraft following a defined flight 

 

104 Larson E. W .F., Wilde P.D, and Linn A.M., Determination of Risk to Aircraft from Space Vehicle Debris, 

Proceedings of the First IAASS Symposium, Nice, France, October 2005. 

7-36
path. The purpose of this section is to discuss the approaches and considerations for 

using the distributions to compute probabilities of fragment impact onto populated 

locations and other assets of concern. The focus here is on the computation of impact 

probabilities for assets on the ground using two-dimensional characterizations of 

fragment impact distributions. The computation of impact probabilities for aircraft 

(or spacecraft) using three-dimensional fragment distributions is addressed in 

paragraph 7.3.3.

b. Modeling Considerations. For the purposes of this discussion, impact probability (PI) 

is defined as a conditional probability: given a debris-generating event, the 

probability a specific fragment will “impact” a specified person, building or other 

asset. The definition of “impact” is typically tied to the prediction of casualties or 

substantial damage, and thus does not necessarily imply direct physical contact. For 

an explosive fragment, “impact” includes whenever the fragment lands sufficiently 

close to a person or building to cause casualties or damage.

7-37
 The approach to computing PI depends on how the distribution of impact points is 

characterized (see paragraph 7.3). 

(1) If the impact distribution is characterized by an impact probability density 

function, the impact probability is obtained by integrating the probability 

distribution over the area of concern (the area for which an impact would cause 

casualties or damage). For people in the open this is the area within which the 

people are located. For people in structures and other assets this area will 

normally be the plan area of the structure or the plan area of a critical asset, with 

possible modification if the fragment has a steep angle of incidence at impact to 

account for side impacts on a building. As mentioned above, for explosive 

fragments the physical area occupied by people or by a structure needs to be 

expanded to include all locations where the blast loads can hazard the people or 

structure. 

• While the expanded area is considered for the calculation of casualties/deaths, 

the impact probability reported for fragments that explode upon impact is 

often based only on direct impact of a population center (e.g. directly hitting a 

building or impacting within the boundaries of a populated area). 

• The fragment impact probability distribution could be either a closed form 

distribution, such as a bivariate normal distribution, or a segmented 

distribution defined by uniform probabilities of impact within grid cells, such 

as can be generated from a scatter plot. 

(2) If the random impact points from a scatter plot are to be used directly in risk 

calculations, the risks are computed for each point (i.e. the risks are computed 

based on the fragment impacting in its specific location). In this case the “impact 

probability” to be used for each random impact point is the probability that the 

particular impact point will occur (relative to all the other sample impact points 

for the given failure time and failure mode). The casualty/fatality expectation for 

a population center is then based on whether the fragment physically hit the 

center or, for explosive fragments, impacted sufficiently close to create risks due 

to the explosion loads or secondary debris. 

• If a scatter plot is used to characterize the impact distribution for some 

sources of impact uncertainty and an impact probability density function is 

used to represent the other sources of impact uncertainty, the risks are again 

computed for each random impact point but with a probability of impact 

computed by integrating the density over the area of concern. This impact 

probability times the probability of occurrence of the random point is then the 

net impact probability. 

Although the probability of impact for each impacting fragment is all that is required 

to compute the associated risks, a total probability of impact may be desired in order 

to assess the likelihood of a fragment impact into politically or environmentally 

sensitive areas. This total probability of impact needs to account for all of the 

fragments created by the debris-generating event. A definition of total impact 

probability used at several of the ranges is the probability of one-or-more impacts. 

7-38
With the above definition, the probability of impact for a given debris generating 

event is given by the following general relationship: 

 ( ) ∏( −−=−− ( ))

i

I I 1 moreorP 11 iP (Eqn 7-1) 

 where 

 PI (i) = Impact probability for the ith fragment, 

and the product is over all fragments generated by the event. This probability of 

impact will, of course, need to be multiplied by the probability of the debrisgenerating event and summed over all events in order to get the total probability of 

impact for a population center or the total for a mission.

7.5 Modeling for Explosive Fragments 

This section discusses modeling issues specific to the computation of risks for explosive 

fragments. Paragraph 7.5.1 discusses the modeling of explosive yields for fragments that can 

explode upon impact. paragraph 7.5.2 discusses the approach and issues associated with the 

calculation of risks for explosive fragments that can hazard a population center even when the 

fragment does not physically impact on the center. 

7.5.1 Explosive Yield Models. 

a. Model Description. Failures of space launch vehicles often result in impacts of intact 

(or mostly intact) components containing liquid or solid propellants. When solid 

propellants are present, vehicle breakup can also produce multiple chunks of 

propellant as well as inert materials. When these propellant-bearing components and 

chunks impact (either the ground or an object) an explosion can occur. In addition, 

explosion of an intact vehicle may occur at the launch point, in the air or upon impact 

of the vehicle. Explosive effects – a blast wave and ejected fragments – expand 

outward rapidly and are capable of hazarding a large area. The effects of these 

hazards must be characterized to produce a valid risk estimate. 

A yield factor is usually an output of an explosive yield model. The yield factor 

for a given propellant explosion is the weight of TNT that would produce an 

equivalent explosive output divided by the weight of propellant. Although the yield 

factor concept is straightforward, a complication arises because different yield factors 

generally result depending on whether the explosive output is measured in terms of

the peak overpressure or the positive phase impulse. (See Chapter 6 of this 

Supplement for an explanation of these terms). Once the yield factor is obtained, the 

yield itself (usually expressed as pounds of TNT) is the product of the yield factor 

and the propellant weight. 

7-39
b. Data Sources. Several sources of information are available upon which yield models 

can be based, including: 

(1) Project Pyro (1968) provided test data for some models of liquid-propellant 

explosions for three combinations of oxidizer/fuel: liquid oxygen/RP-1, liquid 

oxygen/ liquid hydrogen, and hypergols (nitrogen tetroxide/hydrazine). 

Propellant weights ranged up to 100,000 pounds for the cryogenic combinations 

and up to 1,000 pounds for the hypergolic combination. Models resulting from 

Project Pyro provide yield factors as functions of impact speed on hard and soft 

surfaces. 

(2) A more recent test program (2003) for liquid propellants conducted at the White 

Sands High Energy Blast Facility (HEBF) provided data for yield models of six 

propellant combinations: liquid oxygen/liquid hydrogen, nitrogen tetroxide/liquid 

hydrogen, nitrogen tetroxide/ hydrazine, liquid oxygen/hydrazine, liquid 

oxygen/RP-1, and hydrogen peroxide/Jet A. Two types of testing took place; 

distributive mixing and drop. The distributive mixing tests were designed to 

produce the maximum mixing possible before ignition and were performed on all 

six propellant combinations. The drop tests were performed only on the liquid 

oxygen/liquid hydrogen combination in various tank configurations. The tanks 

were dropped onto a concrete pad from a tower. Maximum yields obtained from 

the HEBF tests are lower than those obtained for the three similar propellant 

combinations in Project Pyro. 

(3) Several organizations and individuals have produced models of explosive yield 

for solid propellants. Models have been developed for Class 1.1 and Class 1.3 

solid propellants. Generally, Class 1.1 materials are those whose shock 

sensitivities are greater than that of TNT, while Class 1.3 materials have shock 

sensitivities less than that of TNT. Class 1.1 propellants are used in a few spacelaunch systems and some weapons systems (e.g., Minuteman II Stage III), while 

Class 1.3 propellants are used in many space-launch and missile system 

components. A 1991 model provided maximum yield factors for both types. 

(4) The more recent (1998) PIRAT (Propellant Impact Risk Assessment Team) 

project provided new yield factors for Class 1.3 HTPB solid propellants. The 

PIRAT project measured explosive propagation in samples in a series of tests, and 

modeled the results using a two-dimensional hydrocode. The code was used to 

predict yield factors for different diameter cylindrical motors with both side-on 

and end-on impacts, as well as for different chunk weights. Models based on 

PIRAT data predict yield factors as functions of motor diameter, impact speed 

and orientation (side-on, end-on) and propellant weight for motors or motor 

segments; and as a function of impact speed and weight for propellant chunks. 

(5) Another solid propellant impact yield model that has been used is based on a 

combination of PIRAT and empirical data (from tests and accidents).105 This 

model provides the capability to compute yield factor uncertainty based on the 

observed scatter in the data and does not require knowledge of the orientation at 

impact for motor segments. 

 

105 Wilde P.D. and Anderson M, Development of a Yield Histogram for Space Shuttle Blast Risk Analyses, 1999 

JANNAF Safety and Environmental Protection Subcommittee Meeting, San Diego, 26-30 April 1999. 

7-40
c. Modeling Considerations. The following issues should be considered: 

(1) The characteristics of blast waves produced by explosions vary depending on the 

explosive material involved. The characteristics and behavior of blast waves as 

they expand outward from an explosion are well known for TNT. In addition, the 

interactions of TNT blast waves on humans and structures have been studied and 

documented. Consequently, it is convenient to estimate the explosive yield of 

rocket propellants in terms of equivalent weight of TNT (TNT yield). These 

equivalent yields are only approximate because the shapes and durations of the 

blast waves produced by propellant explosions often differ from those produced 

by TNT. 

(2) A valid yield model should account for the propellant weight at impact, the 

impact speed, the configuration or orientation of the propellant, and the impacted 

surface material. 

(3) Yield models for various propellants have been available for years. Models have 

been based on accidental explosion data, test program data, engineering 

judgment, and combinations of these. 

• Yields for liquid propellants vary with propellant type and the amount of 

mixing that occurs before ignition. Total mixing of all available propellants is 

unlikely because auto-ignition occurs within milliseconds of mixing, and the 

resulting explosion drives apart the unmixed portions. 

• Most liquid propellant explosions are characterized as deflagrations rather 

than detonations. 

• When modeling liquid-propellant yield factors, some attention must be paid to 

tank configuration. Tests show a relationship between yield factor and 

propellant area-to-weight ratio. 

Note: Impacting solid propellants may or may not explode, depending on propellant 

configuration (contained, uncontained, orientation), weight, and impact speed. Yields 

vary with these same factors plus the nature of the impacted surface. 

d. Model Uncertainty. Yields estimated from accidents and test programs often vary 

significantly from those predicted by models. In many cases, the causes of such 

variations are unknown. For liquid propellants, estimated yields vary depending on 

the volume of propellant mixing assumed to occur before ignition. Solid-propellant 

yield models based on PIRAT results are currently considered to be the best 

available. However, the two-dimensional hydrocode used in the PIRAT analyses 

assumed infinitely-long cylinders. The hydrocode only simulates fully loaded motors 

and does not model nearly spherical motors such as an Inertial Upper Stage (IUS) or 

a Star motor. The effect on yield factor of larger and larger bore-holes, resulting as 

propellant burns, is unknown. These and other factors can lead to considerable 

uncertainty in estimated yields. 

7-41
7.5.2 Risk Computation for Explosive Fragments. 

a. Model Description. The calculation of casualty (or death) expectation for fragments 

that explode at impact require special treatment due to the fact that the impact 

explosion can cause casualties even if the fragment does not physically impact a 

person or a structure. This is due to the fact that the blast loads (defined by the peak 

overpressure and the impulse) can directly cause casualties to people exposed to the 

blast loads or indirectly cause casualties due to structural damage or collapse and 

window breakage resulting from the blast loads acting on a building. Also, secondary 

debris thrown out from an explosion can be propelled into a person or structure. Thus 

the risk computations should consider all of the possible impact points of an 

explosive fragment that are sufficiently close to a person, structure or populated area 

(people distributed into various shelter categories) to create hazardous blast loads or 

impacting secondary debris.

b. Modeling Considerations. The predicted risks for an explosive fragment with a given 

explosive yield (usually defined by its TNT equivalency) will vary with the distance 

of the explosion from unsheltered people or from an occupied building due to the 

varying overpressure loads. Also, for buildings the orientation of the explosion 

relative to the building may need to be considered. A good way to address this is to 

compute the expected casualties for each potential impact location of the explosive 

fragment, as defined by the fragment impact probability distribution or the random 

impact points from a scatter plot. These would then be weighted by the probability of 

impacting in each location, and summed to get the total casualty expectation for the 

given explosive fragment (given occurrence of the debris generating event).

 The process is illustrated in Figure 7-4 where a grid has been set up about a 

population center that extends out to the maximum distance from the population 

center that the overpressure loads are hazardous to the people or the building. The 

explosion is assumed to occur in each of the grid cells and the corresponding risk 

computed. The relative probability of impacting in the grid cell is computed by 

integrating the impact probability distribution over the area of the grid cell. The risks 

for each grid cell are then multiplied (weighted) by their corresponding impact 

probability and these are summed to get the total risk for the fragment. 

 The calculation of casualties due to overpressure loads for a specific explosive 

event (location of the explosion relative to a populated site and explosive yield) is 

further discussed for unprotected people in paragraph 7.6.1b and for people in a 

building in paragraph 7.6.3. 

 A similar process may need to be performed for the secondary debris thrown out 

from an explosion (debris from the exploding vehicle fragment and/or the impacted 

surface). The secondary debris contribution to the risks becomes important when the 

debris can be thrown to distances beyond which the risks due to the overpressure 

loads are high. 

7-42
Figure 7-4. Procedure for computing risks due to an explosive fragment 

7.6 Vulnerability and Casualty Models 

Vulnerability models are used to predict the level of damage to humans, structures or 

vehicles due to the impact of a launch vehicle fragment or due to blast loads from an exploding 

fragment. Vulnerability models that may need to be considered are: 

a. The direct impact of a fragment, or secondary debris created by the fragment impact, 

onto unsheltered people. 

b. The impingement of blast loads on unsheltered people. 

c. The direct impact of a fragment onto a structure. 

d. The impingement of blast loads on a structure. 

e. The direct impact of fragments onto ships, boats and aircraft. 

f. The impingement of blast loads on ships and boats. 

The models for the direct impact of fragments, secondary debris and blast loads on 

people are referred to as human vulnerability models. These models are used to predict the 

probability of casualty (or the probability of fatality) due to these threats. These models are used 

not only to predict the casualties for unprotected people, but can also be used to predict 

casualties for people in a structure or vehicle if the debris or blast load environment within the 

structure/vehicle can be defined. 

The vulnerability models for structures and vehicles are used to predict damage levels 

that can be used both for estimating economic loss and as the basis for predicting the casualties 

to the occupants of the structure or vehicle. 

7-43
This paragraph discusses general approaches and the important considerations and factors 

for developing vulnerability models. Threshold levels defining lower bound levels of threat at 

which injury to a person or damage to a structure or vehicle will occur have been presented in 

Chapter 6 of this supplement. These threshold levels can be used to determine if the calculation 

of expected casualties or the calculation of damage to structures/vehicles will be required for a 

given threat (fragment impact or explosive loading), or to perform conservative risk analyses. 

7.6.1 Human Vulnerability Models. Human vulnerability models are used to predict the 

probability of casualty (or fatality) due to direct impact by a fragment, impact by the secondary 

debris created by the primary fragment impacting the ground, impact by the secondary structural 

debris created by the fragment penetrating into a building, or exposure to blast loads from an 

exploding fragment. These models are addressed separately for inert fragment/secondary debris 

impact and for blast loads. 

a. Human Vulnerability to Inert Debris Impact. 

(1) Model Description. This model addresses human casualties that result from 

impact by inert (non-explosive) fragments. This includes (a) direct impact by a 

vehicle fragment, including impact by the fragment after it penetrates a structure, 

(b) impact by secondary debris created due to fragment splatter or cratering of the 

impacted surface, (c) secondary debris thrown out from an exploding fragment, or 

(d) impact by the secondary debris created by fragment penetration of, or blast 

damage to, a structure.

Casualties from inert debris result from one or more of several injury 

mechanisms: 

• Penetration of the body by small, compact, high speed fragments. Since this 

generally requires high velocities it is not expected to result from impacting 

launch vehicle debris since, except for very early flight times, the fragment 

velocities are not sufficiently high. It may result, however, from secondary 

debris from an exploding fragment or from secondary debris created by 

explosion loads acting on a structure. Penetration can be segmented into 

chunky penetration and piercing penetration.

• Laceration or penetration by ragged metal fragments and glass shards by 

energy transferred to body organs and tearing of body tissues. 

• Blunt trauma resulting from the acceleration of body organs or excessive body 

deflections. Blunt trauma includes localized blunt trauma from small 

fragments that can impact over critical organs thus producing greater injuries. 

• Crushing resulting from heavy fragments pinning body segments between the 

fragment and a rigid object such as the ground or a wall. 

• Fragment impact causing a person to fall and strike the ground/floor, wall or 

other object. 

(2) Modeling Considerations. Historical models for human vulnerability to debris 

impact have been relatively simple models that predict casualty as a function of 

the fragment impact kinetic energy. These have often been expressed in terms of 

a single kinetic energy level above which a person is assumed to be a casualty. 

Common values that have been used range from about 11 foot-pounds for the 

7-44
casualty threshold to 58 foot-pounds for assured casualty. An improvement on 

this are models that provide the probability or severity of casualty as a function of 

fragment physical parameters such as kinetic energy, mass, mass density, area, 

impact velocity, shape, and various combinations of these parameters. Many of 

the early models in this area are based on data from impact tests with a variety of 

shaped impactors on humans (including both live subjects and, for higher energy 

impacts, cadavers), animals (live subjects and cadavers), and dummies. The 

highest fidelity models consider the detailed biomechanical phenomena of impact 

as a function of time for specified impacting fragments and impact conditions.

 The modeling of human vulnerability is complex and a detailed discussion of the 

various modeling approaches is beyond the scope of this Standard. Factors and 

considerations for developing human vulnerability models are as follows: 

• The model must quantify the level of injury delivered to an individual by the 

impact. As noted above, the simplest historical models have typically 

expressed an energy threshold (e.g. 11 ft-lbs) which, based on test data, 

represents the minimum impact energy where impacts have resulted in 

sufficient injury to require some level of prompt, professional medical 

attention, the minimum definition of a “severe” casualty. Fatal injuries within 

this Standard are defined to be an injury that would, with high probability, be 

fatal to the individual assuming that no medical intervention is possible. 

• All of the relevant injury mechanisms (listed above) should be addressed. 

• The characteristics of the impacting fragment need to be addressed. The key 

parameters are the fragment mass, shape, density, deformability, orientation, 

and impact velocity (both magnitude and direction). 

• The characteristics of the human that is being impacted should be addressed. 

Key parameters are the body mass, exposed area and susceptibility to injury. 

Two common categories used are adults and children. Further breakdowns 

can be considered such as male or female and age categories. It should be 

noted that age and overall health play a significant factor. Survival of a given 

level of injury varies by a large amount between elderly or infirm adults and 

robust, athletic adults in their prime; with susceptibility to the underlying 

injury varying by a factor of three or more. 

• The location of the fragment impact on the body is important. A breakdown 

of the body that has been used is the head (with special consideration for the 

eyes), thorax, abdomen and limbs. Consideration also should be given to the 

location (front, back, side) of impact on the body and the offset of the 

fragment impact location relative to the center of gravity of the impacted body 

part. 

• More sophisticated models can consider fragility of individual organs or organ 

systems and parameters directly related to injuries, such as strain levels. 

Consideration of these factors, as well as anomalous injuries such as sidebody impacts which can deliver stresses which rupture the aorta due to inbody stress concentrators, and commotio cordis, the stoppage of the heart by a 

blunt trauma impact so timed as to disrupt the normal cardiac rhythm, tend to 

be confined to research activities. 

7-45
• Body posture is another important factor since it affects both the body 

reaction and the exposed area. Common postures considered are standing, 

sitting and prone. 

• Other considerations that may need to be addressed are the affect of a 

fragment impacting multiple body parts, and impact by more than one 

fragment on a person. 

 The calculation of casualties requires that the level of injury considered to 

constitute a casualty be defined. For this RCC Standard the Abbreviated Injury Scale 

(AIS) has been selected as the method for defining level of injury. The AIS was 

originally developed for use by crash investigators to standardize data on frequency 

and severity of motor vehicle related injuries. It has been extended to 

epidemiological research, trauma center studies to predict survival probability, patient 

outcome evaluation and health care systems research. The general definitions used 

for the AIS allow injuries of different natures to fall into standardized categories. 

The AIS level selected as the minimum to constitute a casualty for debris risks is AIS 

level 3. The general definition of this level is “reversible injuries; hospitalization 

required”. 

b. Human Vulnerability to Blast Loads. 

(1) Model Description. Human casualties can result due to exposure to blast loads 

(overpressure and impulse) resulting from the impact of an explosive fragment. 

The primary sources of impact explosions are vehicle fragments, intact stages or 

an intact vehicle that contain liquid or solid propellants. The explosive yield is 

usually expressed in terms of equivalent pounds of TNT (TNT equivalency). 

Modeling to predict TNT equivalency is addressed in paragraph 7.5.1.

 The primary injury mechanisms for blast loads are injury to soft tissue and 

injury due to whole body translation106. The body parts most susceptible to soft 

tissue injury are the eardrums, lungs, gastro-intestinal (GI) tract and larynx. 

Rupture of the lungs can lead to death. Whole body translation can lead to 

casualty due to the impact of the body with a rigid object such as the ground/floor 

or a wall, resulting in blunt trauma, penetration or crushing injuries. 

(2) Modeling Considerations. Following are considerations for modeling the 

vulnerability of humans to blast loads.

• Blast load human vulnerability models should consider both the effect of the 

peak overpressure of the blast wave as well as the impulse (the integral of the 

blast wave time history). The peak overpressure is the key threat for soft 

tissue injuries to the eardrums, lungs, GI tract and larynx. The impulse leads 

to injuries due to whole body translation. 

• The potential for the occurrence of multiple injuries, that increases the 

likelihood of occurrence of a casualty, may need to be addressed. 

 

106 Whole body translation is the motion of a person due to the velocity imparted by the blast forces acting on a 

person’s body. 

7-46
• In addition to the threat from the overpressure loads from an exploding 

fragment there is also the possibility that fragments will be thrown out from 

the shattering of the hardware containing the exploding propellant or from the 

impacted ground, particularly if significant cratering occurs. The potential 

thrown debris will increase the risk to people within the throw range of the 

debris, and may even result in a larger area threatened due to fragments 

thrown beyond the range of hazardous overpressure loads. Thermal 

(including firebrands thrown out) and toxic hazards resulting from an 

explosion may also need to be considered, although these hazards have 

generally not been addressed as part of debris hazard analyses. Toxic hazards 

are generally evaluated separately (see Chapter 8) and thermal hazards have 

not heretofore been considered for debris risk analyses. 

 Models for human vulnerability to blast loads have ranged from very simple 

models that assume that a person will become a casualty if exposed to an 

overpressure greater than a specified value, to the more recent Pressure-Impulse (P-I) 

functions that give the probability of casualty (or fatality) as a function of P and I. 

These functions are portrayed as curves for various probability of casualty levels 

plotted as a function of P and I. 

7.6.2 Model for the Casualty Area for Inert Debris Impact in the Open. 

a. Model Description. Inert debris impacting into areas with unsheltered people hazards 

the people in one or more of the following ways (see Figure 7-5):

(1) Fragment impacts a person directly during its initial fall to the ground, 

(2) Fragment impacts a person during its travel following a bounce off of the 

impacted surface, 

(3) Fragment strikes a person during a slide or roll along the surface, 

(4) Fragment spatters at initial impact with pieces from the shattered fragment thrown 

out to impact a person, or 

(5) Fragment creates a crater with ejected debris from the impacted surface being 

thrown out and impacting a person. 

 The casualty area is the area on the ground about the impact point of a fragment 

within which an exposed person would be expected to become a casualty. 

b. Modeling Considerations. The modeling of the casualty area for inert debris impact 

in the open requires an evaluation of each of the above listed phenomenon. This 

involves the modeling of the kinematics of the fragment initial impact trajectory, 

bounces off of the impacted surface, and sliding or rolling along the surface; and the 

kinematics of the secondary debris resulting from splattering and cratering. It also 

involves the modeling of the velocity and mass of the fragment, or the secondary 

debris pieces, at the locations during their trajectories where they could impact a 

person. Inert debris impacts can result from inert fragments created by the breakup of 

a launch vehicle or due to an intercept event, or from fragments thrown out from the 

impact of an explosive fragment (both debris from the shattered fragment and from 

7-47
the impacted surface). The casualty areas for debris thrown out from an explosion 

may only be of concern when the fragments can be thrown beyond the range where 

the probability of casualty due to the overpressure loads is high.

 Modeling considerations and factors include: 

(1) The casualty area should address the total area about the fragment impact point 

where a person could be located and be struck by the fragment, or a secondary 

debris piece, that has sufficient mass and velocity (or kinetic energy) to cause a 

casualty. 

• The probability of casualty (AIS level 3 injury or greater) for a person at a 

given location can be based on the human vulnerability model for inert debris 

(see paragraph 7.6.1a). 

• A simple, conservative approach is to assume that any impact by a fragment 

anywhere on a person constitutes a casualty (i.e. that the probability of 

casualty is always 1.0), in which case the casualty area would become the 

total area in which a person could be located and be impacted by the fragment 

or by a secondary debris piece. 

(2) Depending on the human vulnerability model used, the model for the casualty 

area may consider the part of the body that has been impacted. For example, the 

human vulnerability model could depend on whether a fragment impacts the head, 

thorax, abdomen or a limb, and the trajectory of the fragment, and the trajectories 

of any secondary debris, would need to be analyzed to determine the body part 

impacted for each location of a person. 

(3) Since there may be large uncertainty as to whether a fragment will splatter upon 

impact versus bouncing and/or sliding, the casualty area may need to be computed 

for each of these phenomena and the resulting casualty area obtained either by 

weighting each by their relative probabilities of occurrence and adding, or by 

conservatively assuming that the one resulting in the larger casualty area applies. 

(4) The size and posture of a person needs to be defined. Usually for impacts in the 

open a person is assumed to be standing. To simplify the kinematic computations 

a cylindrical model of a person could be used. For a fragment that bounces, the 

portion of the bounce trajectory for which the bottom of a fragment is over the 

head of a person should not be included in the casualty area. 

(5) The bounce characteristics of the fragment need to be modeled. Usually this is 

expressed in terms of a coefficient of restitution107 from which the rebound 

velocity of the fragment can be computed. Since it is difficult to determine the 

bounce characteristics for each impacting fragment, it may be necessary to 

estimate a coefficient of restitution to apply to all fragments, or to all fragments 

having given general characteristics (for example, fragments consisting of 

uncontained solid propellant tend to have high bounce potential due to the 

rubbery nature of the fragments). 

 

107 The coefficient of restitution is the ratio of the rebound speed to the speed of approach in a collision. It is used 

here to compute the speed of rebound perpendicular to an impacted surface by multiplying it by the speed of 

approach perpendicular to the surface. In a perfectly elastic collision the coefficient of restitution has a value of 1.0. 

7-48
(6) The impacted surface will affect the bounce and slide of a fragment. If the impact 

surface is known, the coefficient of restitution can be based on this surface. 

However, in general the impact surface is not known and an “average” surface 

may need to be assumed, such as compacted soil. Variation of the coefficient of 

restitution with impact speed may also be a factor. 

(7) A fragment may slide upon impact. Usually slide characteristics are expressed in 

terms of a coefficient of friction that is used to estimate the slide distance. An 

average coefficient of friction may need to be estimated for all, or for specific 

categories of, fragments based on the assumed impacted surface. Generally if a 

fragment will bounce following impact the amount of sliding between bounces 

will be a relatively small contribution to the total casualty area. Also, for smaller 

fragments a slide into a person can only impact the foot or lower leg and thus may 

not constitute a serious injury. 

(8) Fragments might splatter upon impact. Modeling fragment splatter generally 

involves the definition of a maximum splatter range (or a probability distribution 

for splatter range), the number of splatter fragments, a mean splatter fragment size 

and a mean fragment weight. Experimental data and/or impact hydrocode 

simulations may be needed to develop estimates of the splatter parameters. 

Figure 7-5. Hazards to an Unsheltered Person From Inert Debris Impact 

7-49
7.6.3 Structural Vulnerability Models. Structural vulnerability models are used to assess the 

damage to structures and to predict the casualties (or fatalities) for the occupants of these 

structures. This section is presented as two subsections, one for inert debris impacting a 

structure and one for blast loads acting on a structure. 

a. Vulnerability Modeling for Inert Debris Impact on a Structure. 

(1) Model Description. Inert (non-explosive) debris from launch and test operation 

failures hazards people inside structures primarily due to the potential of the 

fragments to penetrate into the structure. The ability of a fragment to penetrate is 

primarily a function of its weight, shape and speed at impact, although the 

material and density can also play a significant role. Since most debris will 

usually be falling vertically or near vertically at the time of structure impact, the 

primary hazard is from the debris penetrating through the roof, and any ceiling, of 

the structure, and potentially through one or more floors of the structure to hazard 

people on lower floors. If hazardous fragments can be impacting at shallow 

angles of incidence, it may be necessary to consider impacts on the sides of 

structures.

 The source of the hazard from inert debris is the potential for the fragment 

itself to strike a person as well as the potential for the structural debris from the 

roof, ceiling or floor(s) brought down by the penetration of the fragment to strike 

a person. The concept is portrayed for a three-story structure with a flat plywood 

deck roof in Figure 7-6. 

 The prediction of casualties within a structure involves a description of the 

characteristics of the fragments resulting from fragment penetration (weights, 

shapes and velocities) and the application of human vulnerability models for inert 

debris as discussed in paragraph 7.6.1a. 

7-50
Figure 7-6. Example of fragment penetrating multiple floors of a structure. 

(2) Modeling Considerations. Vulnerability models for structures should be 

developed for various categories of structures to cover the range of structures that 

may be occupied and hazarded by the debris from a failed vehicle. This 

categorization can be simple or detailed depending upon the required accuracy of 

the risk analysis. In a more detailed approach, the type of roof and floors to be 

used to represent each structure category will need to be defined in order to assess 

the probabilities of penetration and the resulting debris environment (penetrating 

fragment and collapsing building structure) at each floor level.

Important considerations and factors that should be addressed for the 

development of the inert debris structural vulnerability models are: 

• Materials, sizes and spacing of the construction elements. 

7-51
• Location of the fragment impact on the structure roof relative to the structural 

elements (beams, joists, perlins, etc.). 

• Weight, shape, size and velocity of the impacting fragment. 

• Area of the roof or floor that fails, ranging from a simple punch through of 

sheathing (shear failure) to the shear or bending failures of supporting joists, 

purlins and beams. 

• Velocity of the fragment following penetration of the roof and of each floor 

(used to determine if the fragment penetrates the next floor level and to 

calculate the probability of casualty if it impacts a person) and velocities of 

each structural debris piece that results from the penetration. 

• Computation of the probabilities of casualty for people struck by a penetrating 

fragment or by the resulting structural debris pieces requires the application of 

inert debris human vulnerability models (see paragraph 7.6.1a). 

For each combination of fragment and structure category the total area for 

each floor of a building within which a person would be expected be a casualty 

(casualty area) or a fatality (fatality area) is defined. This casualty area is used in 

the calculation of the estimated number of casualties based on the density of 

people on a floor. 

 For each structure type it may be necessary to calculate casualty/fatality 

areas for a large number of fragment impact locations, weights, shapes and 

velocities to obtain a model to address all cases of concern. 

b. Vulnerability Modeling for Explosive Debris Blast Loads on Structures. 

(1) Model Description. Fragments that explode upon impact hazard people inside 

structures primarily due to blast loads (blast wave peak overpressure and 

impulse108) acting on a structure causing structural damage or collapse and 

window breakage, or blast loads acting directly on people inside a structure (due 

to open windows or other openings in the building). Casualties result from the 

flying/falling structural debris, flying glass propelled into the structure and the 

blast wave entering the structure.

Although casualties from an explosive fragment can result due to the fragment 

directly impacting and penetrating a structure without exploding (in which case 

the vulnerability models for inert debris impact on a structure would apply), or 

due to the fragment exploding upon impacting the structure (before or after 

penetration), the contribution to the total risk from these direct impacts may be 

relatively small since the probability of impacting outside of a building so as to 

cause significant casualties is usually much larger than the probability of 

impacting directly on the structure. However this contribution to the risk may 

need to be considered, particularly if the explosive yield of the fragment is small. 

 

108 Impulse is defined as the integration of the positive phase of overpressure with respect to time. 

7-52
(2) Modeling Considerations. The unique risk factor for explosive fragments is that 

they can impact a considerable distance (perhaps thousands of feet) from a 

structure and still contribute significantly to the risk. Thus risk contributions need 

to be considered for impacts in an area that is much larger than the footprint of the 

structure itself (see paragraph 7.5.2). Unlike inert debris, that usually only causes 

failure of the roof of a structure, blast loads can cause failure of walls, windows 

and vertical support members in addition to failure of the roof. 

Approaches and considerations for development of a structure vulnerability 

model for blast loads are: 

• The blast loads from an impact explosion are a function of the explosive yield 

(usually expressed in terms of TNT equivalency, see paragraph 7.5.1) and the 

distance of the explosion from a structure. The contribution to the risk needs 

to be addressed for all fragment impact locations sufficiently close to a 

structure to experience hazardous blast loads. 

• The blast loads on a structure are also a function of the orientation of the 

structure relative to the blast front, and thus the model may need to also 

consider this. 

• Atmospheric conditions effects the propagation and attenuation of the blast 

wave and thus the blast loads acting on the structure. For explosions 

occurring close enough to a building to cause significant structural damage 

the atmospheric conditions tend to be a secondary issue. Blast loads on 

structures located at large distances from the explosion, which are 

significantly affected by atmospheric conditions, usually only pose risks due 

to window breakage. These risks are not generally handled as part of a debris 

risk analysis but instead are assessed as part of a Distant Focusing 

Overpressure (DFO) risk analysis (see Chapter 8). 

• The prediction of casualties within a structure involves modeling the level of 

damage to the structure including window breakage. It includes 

determination of the level of damage to the walls, roof and other structural 

elements. 

• Blast load vulnerability models need to be developed for various categories of 

buildings covering the range of structures that may be occupied and hazarded 

by the debris from a failed vehicle. This categorization can be simple or 

detailed depending upon the necessary accuracy of the risk analysis. 

• For each structure category the type of roof, walls, floors and other key 

structural elements will need to be defined. This should include the types of 

materials (e.g., wood, brick, metal, concrete block, reinforced concrete, etc.) 

and construction methods. Also the types (e.g., annealed, tempered, dual 

paned, blast filmed), numbers and sizes of windows are needed. 

• For a simplified approach it may be possible to estimate the probability of 

casualty for a person in a structure based simply on the predicted level of 

structural damage and the number of windows broken. For example, 

empirical casualty data collected for accidental or terrorist explosions and for 

7-53
earthquakes could be used to relate the probability of casualty to the level of 

building damage and the number of broken windows. 

o The level of damage to a structure is sometimes expressed in terms of the 

percent structural damage. 

• A more detailed approach involves defining the debris and glass environments 

inside of a structure. This requires the modeling of the numbers, sizes, 

shapes, velocities and directions of travel for the structural fragments to 

determine the areas hazarded. Also the numbers, sizes and throw distances of 

the glass shards from windows should be addressed. 

o Human vulnerability models (paragraph 7.6.1a) can be used to determine 

the portions of the hazarded areas within which a person would be 

expected to become a casualty. This should account for the variation in 

the probability of a person becoming a casualty throughout the hazarded 

area, and account for all fragments and glass shards that could impact a 

person at each location. 

o Flying glass becomes the dominant contributor to casualties whenever the 

potential impact locations of an explosive fragment are beyond the range 

where significant structural damage will occur. 

7.6.4 Ship/Boat Vulnerability Models. 

a. Model Description. Risks to ships and boats can be an important consideration for 

some launch ranges, particularly those that launch out over the ocean. Although 

clearance of hazarded areas is the preferred method of reducing or eliminating the 

hazard to these vessels, there may be situations where there are ships or boats in the 

hazarded areas at the time of a launch, and a launch decision may need to be made 

based on the level of risk (casualty/fatality expectation). Thus vulnerability models 

may be required to perform the risk calculations. 

b. Modeling Considerations. 

(1) Inert Debris. The modeling of the vulnerability of ships/boats to inert debris 

impact involves the vulnerability of people to direct impact by a fragment for the 

people in the open (on the top deck) and the vulnerability of people in structures 

for the people located in the deck house, in the superstructure or below one or 

more decks. 

• The modeling approach for these is similar to those for land based structures 

and reference is made to paragraph 7.6.1a for vulnerability models for humans 

impacted by inert fragments, paragraph 7.6.2 for the modeling of the total 

casualty area for inert fragment ground impact for people in the open 

accounting for secondary effects (although the secondary effects will be 

somewhat different for impacts on a ship/boat), and paragraph 7.6.3a for 

vulnerability models for inert debris impact on structures. 

• There are some additional issues that may need to be addressed for inert 

fragments: 

o The impact could result in the capsizing or sinking of the vessel, thus 

putting the entire crew at risk, or 

7-54
o An impact could result in people being thrown overboard. 

(2) Explosive Debris. The modeling of vulnerability for ships/boats for debris that 

explodes upon water impact involves consideration of many different sources of 

risk. These sources of risk are dependent on the type of vessel, how far the 

explosion is from the vessel, and also how deep the water is where the ship is 

located. 

• First, the ship is exposed to the portion of the blast wave that is transmitted 

through the air. People on the top deck would be subjected directly to the 

blast loads. The blast wave could also damage or possibly collapse the 

deckhouse or superstructure and threaten the occupants due to the 

flying/falling debris. The blast wave could break windows resulting in flying 

glass (although windows on ships and boats will tend to be stronger and of 

materials that would make them less likely to break). If the blast loads are 

severe enough, the integrity of the ship or boat could be compromised, 

resulting in capsizing or sinking. 

• Additional sources of risk result from energy of the explosion that is 

transmitted into the water. The shock wave transmitted into the water 

(referred to as underwater shock) will travel through the water and could hit 

the side of the ship and/or reflect off the ocean floor and hit the underside of 

the ship. Because water has a higher density than air, this shock wave will 

travel through the water and reach the ship hull faster than the shock wave 

that travels through the air. The underwater shock could cause sudden 

motions of the vessel potentially injuring occupants. People who are standing 

could break their ankles or feet, people who are sitting could incur spinal 

injuries, and people that are standing or sitting could be injured by being 

thrown into bulkheads, walls or decks. The underwater shock could also 

cause failure of the hull of the ship or boat, thereby causing the vessel to sink. 

• Also the explosion energy transmitted into the water will create a wave on the 

surface of the water, which could rock the ship or boat enough to knock 

crewmembers off of their feet or, if the wave is large enough, capsize the 

vessel. This surface wave travels slower than both the underwater shock and 

the air blast wave. 

• The combined effects of these multiple sources of casualties (Air shock wave, 

underwater shock, surface wave) may need to be addressed. That is, the effect 

on the ship due to the underwater shock may affect the level of hazard posed 

by the wave action and/or by the air blast wave. 

Vulnerability models may need to be developed for various types of ships and boats. 

Consideration should be given to the various construction methods (wood, fiberglass, steel, or a 

combination of these materials) and the various sizes, which could range from a relatively small 

recreational boat to a large cargo or cruise ship several hundred feet long and having several 

decks. 

7-55
7.6.5 Aircraft Vulnerability Models. 

a. Model Description. The vulnerability of aircraft to debris impacts was under 

investigation at the time this RCC 321 Standard was developed. Chapter 6 provides 

aircraft vulnerability models for large commercial jet aircraft; vulnerability criteria 

for other classes of aircraft have not yet been assessed.

Historically a conservative estimate was used to define inert fragments that could be 

hazardous to aircraft. The risk acceptability standard for aircraft assumed that an 

impact by a compact fragment greater than 1 gram results in a catastrophic failure of 

the aircraft. This fragment weight is considered to be the approximate minimum that 

is hazardous to an aircraft. Although the hazard posed by a 1 gram fragment is based 

on ingestion by an aircraft engine, the 1 gram criteria has been used to apply to an 

impact anywhere on an aircraft. This standard was initially applied for all types of 

aircraft and fragments of all sizes, shapes and materials. At this time, the previous 

standard continues to be the best available approach for all types of aircraft except 

commercial transports. 

It has been recognized that an improved aircraft vulnerability model is needed to 

avoid unnecessary conservatism in predicting the risks to aircraft and for defining the 

clearance areas for aircraft during launch or weapon test operations. Chapter 6 of this 

Supplement presents new commercial aircraft vulnerability models based on the 

findings. This section documents important considerations for the assessment of 

aircraft vulnerability. 

b. Modeling Considerations. Modeling considerations and factors follow:

(1) In general the vulnerability of aircraft should be dependent on properties of the 

debris, the aircraft at risk, and the impact geometry, and should address the 

probability of outcomes of various severity levels caused by the impact on the 

aircraft. 

(2) The type of aircraft plays an important role in the severity of a fragment impact. 

It is important to consider the classes of aircraft of concern, and develop 

vulnerability models appropriate to each type. Aircraft materials, locations of 

critical systems, and regulatory design requirements are important for assessing 

the vulnerability of an aircraft. Possible classes of aircraft may include air carrier, 

commuter aircraft, helicopters, private jets, private small craft, and military 

aircraft. 

(3) The characteristics for each class of aircraft of concern will need to be defined, 

such as the engines, projected areas, control systems, skin type, etc. Within each 

aircraft class it may be necessary to assess the variations in the aircraft 

characteristics and select “representative” aircraft models to use for the 

development of vulnerability models to be applied to the class of aircraft. 

Engineering data for the representative aircraft will be required to define both the 

external and internal components, including material types and thicknesses. In 

order to apply the vulnerability model to other types of aircraft within a class it 

may be necessary to define parameters to allow scaling of representative aircraft 

7-56
to the other aircraft in the class, such as fuselage dimensions, wing dimensions, 

and engine size/number. 

(4) The vulnerability models should consider the effects of debris of various sizes and 

effective densities, impacting from various angles upon each section of the 

aircraft. The debris parameters to be considered include material type, shape, and 

weight. 

(5) All of the critical failure scenarios should be addressed such as engine ingestion, 

secondary fragments generated by engine or propeller damage, windshield 

penetration, wing or tail penetration, fuel line or tank rupture, compromise of 

aircraft controls or control surfaces (including electrical or hydraulic system 

damage), and cabin depressurization including penetration by the fragment into 

the fuselage (potentially creating secondary debris). Both direct and indirect 

effects need to be addressed where indirect effects include such things as ejection 

of passenger(s) due to fuselage penetration and depressurization, casualties from a 

rapid altitude drop due to a depressurization event and, of course, loss of control 

of the aircraft resulting in a crash. 

(6) Aircraft-induced aerodynamic effects may need to be considered. Examples of 

these effects include airstream deflection of debris so it does not hit the aircraft, 

or an engine sucking in debris that would otherwise not impact the aircraft. This 

is only an issue for fragment densities well below the density of aluminum. 

(7) The development of comprehensive vulnerability models may necessitate detailed 

structural effects analyses using available structural dynamics codes, use of 

available penetration models, and evidence of effects from any available incident 

data (such as debris sucked into an engine). Models should be compared with 

empirical evidence where possible. Incident data can be collected that includes 

foreign object damage (FOD) from FAA/DOT and/or military databases. 

7.7 Models for Casualty Area and Fragment Probability of Casualty 

7.7.1 Model Description. Paragraph 7.6 discussed vulnerability models for humans, structures 

and vehicles. The concept of casualty area and probability of casualty was also introduced. The 

casualty area, or the fragment probability of casualty, for an impacting fragment is used in the 

calculation of casualty (or fatality) expectation (see Paragraph 7.8) by relating the impact of a 

fragment to the expected number of casualties given impact. The purpose of this section is to 

define and discuss these parameters and the approaches and factors that should be addressed.

Casualty area (AC) is defined to be the area about the impact point of a fragment within 

which a person would be expected to become a casualty (AIS Level 3 or greater injury). It is a 

theoretical region within which 100 percent casualties are expected to occur and outside of 

which no one is a casualty. It usually accounts for the probability of a person becoming a 

casualty and therefore does not necessarily include the entire area hazarded by an impacting 

fragment. It is a weighted, or effective, area consisting of the sum of the products of sub-areas 

where the fragment could hazard a person times the corresponding probability that, if the person 

is located in the sub-area, he would become a casualty. 

7-57
Fragment probability of casualty (PCF), on the other hand, is the probability that a person 

in a given location will become a casualty, given that a fragment from a given hazardous event 

hazards the location. It is sometimes used instead of a casualty area in the calculation of casualty 

expectation. This fragment probability of casualty is not the same as the individual risk 

probability of casualty referred to elsewhere in this Standard; which is the total risk to an 

individual accounting for all hazardous events, all potential failure times, all debris generated by 

each event at each failure time, and the probabilities of occurrence of these events. 

Casualty areas are often used to compute the risks to people for inert fragments, and 

fragment probability of casualty is often used to compute the risks to people for explosive 

fragments, although this is not always the case and depends on the types of vulnerability models 

used. When casualty area is used for inert fragments it would be applied to: 

a. The direct impact of an inert fragment, or secondary debris created by the fragment 

impact, into unsheltered people, 

b. The direct impact of a penetrating inert fragment, or debris created by the fragment 

penetration, into people inside of a structure, or 

c. The direct impact of fragments into ships or boats. 

When fragment probability of casualty is used for explosive fragments, it would be 

applied to: 

d. The impingement of blast loads (peak overpressure and impulse) from an explosive 

fragment on unsheltered people, 

e. The impingement of blast loads on a structure causing structural collapse and window 

breakage, and 

f. The impingement of blast loads on ships and boats causing structural damage, 

window breakage, underwater shock, or wave action causing sudden motion of the 

ship or boat. 

It is also expected that fragment probability of casualty will be used for inert fragments 

impacting an aircraft. 

7.7.2 Modeling Considerations. Casualty area, AC, for an inert fragment for unsheltered 

people is simply the theoretical area about the impact point of a fragment within which all 

occupants would become casualties (see paragraph 7.6.2). For an inert fragment impacting a 

given type of structure the AC is the area inside of the structure (for a given floor of the structure) 

within which all occupants would become casualties (see paragraph 7.6.3a). For inert fragments 

impacting a ship or boat, the AC is either the area for unsheltered people (people on the top deck) 

or the area for sheltered people (people in the deck house or below one or more decks).

Fragment probability of casualty, PCF, due to an explosive fragment for unsheltered 

people is the probability that a person will become a casualty from an explosion at a given 

location relative to the person (see paragraph 7.6.1b). Because of variations in vulnerability in a 

normal population, not everyone exposed to given overpressure loads (peak overpressure and 

7-58
impulse) will become a casualty. The probabilities are summed (after weighting by the 

probability of impact at the location) over all hazardous impact locations. 

The PCF due to an explosive fragment for people in a given type of structure is a function 

of the damage to the structure (see paragraph 7.6.3b). 

a. One approach is to estimate the PCF for people in the structure from the level of 

structural (and glass breakage) damage based on empirical data. 

b. Another approach is to model the falling/flying debris and flying glass environments 

within the structure and then use the human vulnerability models to predict the PCF. 

(1) In this case the probability may need to be a function of the location within the 

structure (near an outer wall, in the interior of the structure, near a window, etc.). 

(2) If the environment inside of a structure is modeled, it may be determined that 

developing a casualty area would be a better way to compute the risks than using 

a fragment probability of casualty. 

Although this section addresses relatively complex methods for computing casualty areas 

and fragment probabilities of casualty, there is a very conservative approach that could be used 

that would not require complex modeling. This is to assume that anyone that is exposed to a 

hazard will become a casualty. In this case: 

c. Any unsheltered person within the total area hazarded by an inert fragment or the 

secondary debris would be assumed to be a casualty, 

d. Any person in a structure that is impacted by a fragment that can penetrate the 

structure would be assumed to be a casualty, 

e. Any unsheltered person exposed to a threshold hazardous overpressure (see 

Chapter 6) or greater would be assumed to be a casualty, 

f. Any person in a structure subject to a threshold hazardous overpressure (see 

Chapter 6) that could cause hazardous damage to the structure or its windows would 

be assumed to be a casualty, and 

g. Any person on a ship, boat or aircraft that is impacted by a hazardous fragment or a 

hazardous overpressure would be assumed to be a casualty. 

If this approach, or some conservative variation thereof, is used and the risks are found to 

be acceptable, then the more complex models may not be needed. 

7.8 Risk (Casualty/Fatality) Expectation Models 

7.8.1 Model Description. Preceding sections have discussed the various models needed to 

perform risk analyses for the debris generated by in-flight launch vehicle and weapons test 

failures, intercept events and planned hardware jettisons. This section discusses the approach 

and the considerations for combining the output of these various models to generate risk 

estimates; expressed in terms of casualty expectations, fatality expectations, individual 

probability of casualty and individual probability of fatality.

Casualty expectation is defined as the expected number of casualties from a launch or 

weapons test. It is the mean number of casualties predicted to occur as a result of a launch/test 

7-59
operation if the operation were to be repeated many times. Fatality expectation is defined 

similarly. Individual probability of casualty or probability of fatality is defined as the probability 

of a specific individual becoming a casualty or a fatality. 

The basic equation for computing the casualty expectation for a specific debris 

generating event, specific fragment and specific population center is: 

 EC = Σ PI (1/A) ACi Ni (Eqn 7-2) 

(used when the casualty model gives a casualty area, often used for inert fragments), 

or

EC = Σ PI PCFi Ni (Eqn 7-3) 

(used when the casualty model gives a fragment probability of casualty, often used for 

 explosive fragments) 

where the summation is over the number of shelter categories, and where: 

EC = Casualty Expectation.

PI = Probability of the fragment impacting so as to hazard the population center (7.4). 

A = Population center area. 

ACi = Casualty area for the ith level of sheltering (see 7.7 for casualty area calculation). 

Ni = Population in the ith level of sheltering. 

PCFi = Fragment probability of casualty for the ith level of sheltering (paragraph 7.7 

 discusses calculation of fragment probability of casualty) 

The equation for fatality expectation is the same except that casualty area or fragment 

probability of casualty is replaced by fatality area or fragment probability of fatality. 

Level of sheltering is the type of shelter afforded people, including no sheltering (in the 

open). The levels of sheltering can range from a simple model where everyone is assumed to be 

in the open or in a certain type of structure (defined by the building characteristics) to more 

complex models where people are allocated into multiple types of shelters, and a unique casualty 

area or fragment probability of casualty is computed for each shelter type. 

7.8.2 Modeling Considerations. An option sometimes employed to compute EC, leading to a 

conservative (high) estimate of the casualty expectation, is to assume that everyone in a 

population center impacted by a fragment is a casualty. Then EC = Σ PI

 Ni.

Another option sometimes employed is to assume that all people within a population 

center are in the same level of sheltering, and the casualty area or probability of casualty used is 

that for the selected level of sheltering. In this case the level of sheltering often selected is no 

sheltering, i.e. all of the people are in the open. Although assuming that all people are in the 

open may lead to a conservative estimate of the EC, this is not always the case. Heavy inert 

fragments that can penetrate into a structure can pose a greater hazard (larger casualty area or 

larger fragment probability of casualty) to people inside of the structure than if they were in the 

7-60
open. Also an explosive fragment can pose a greater hazard to people inside of a structure than 

if the people were in the open. Thus, making the assumption that all people are in the open (or in 

a selected type of structure) should be done with care in that it could actually result in an 

underestimation of the risk. 

The other terms in the equation for casualty expectation require the development of a 

population library containing data defining population centers. The library consists of 

descriptions of where people are located, the area occupied, the number of people in each 

location, and definitions (or assumptions) of how these people are sheltered. The terms are: 

a. The location of people is defined in terms of the coordinates (usually latitude and 

longitude) of the centroid of the populated area. 

b. The area, A, is the land area of the population center and is the area used in the 

calculation of PI . 

c. The allocation of the people by shelter category (where Ni is the number of people in 

the ith category) can range from simply assuming that everyone is in the same type of 

sheltering to defining the number of people within each of several shelter categories 

(including unsheltered people). 

(1) The shelter categories can consist of a few basic categories for which 

vulnerability models are developed based on a representative structure description 

for each category. 

(2) For more detailed modeling, the shelter categories may consist of many structure 

types made up of specified wall, roof and window characteristics, and may 

include a separate structure category for each floor of multi-story buildings. In 

some cases unique structure categories may be developed for specific buildings 

close to a launch site for which there is a special concern for the safety of the 

occupants (or a concern for the economic loss that could result from a launch 

accident). 

Population libraries can range from relatively simple to very detailed. A basic population 

library might consist of cells defined by a grid covering the land area of concern. A common 

grid system used is a latitude-longitude grid where each grid cell covers an area defined by 

ranges of latitude and longitude. Comments regarding cell coverage are: 

d. Cells are typically a consistent size such as 1 degree in longitude by 1 degree in 

latitude. 

e. For each cell the number of people and the assumed sheltering (such as everyone in 

the open) are specified. People could also be assumed to be distributed into various 

types of sheltering, perhaps by allocating a percentage of the people to each shelter 

type. 

f. People are usually assumed to be uniformly distributed over each cell. 

g. Cells can be used to define more detail population distributions if the cell sizes are 

made smaller. 

7-61
A more detailed population library distributes people into population centers where 

each center is defined by its location, area and distribution of people by shelter 

category. 

h. The population centers typically consist of small land areas close to a launch site, 

with more specific allocations of people to shelter types, and become larger and more 

generic as the location gets further from the launch site. 

i. In the immediate launch area a population center may consist of a single building, or 

a single floor of a multi-story building. 

j. As the distance from the launch head increases the population centers become 

complexes of several buildings and/or populated open spaces, subdivisions of cities 

or towns, entire cities or, for far distances, counties, states or even countries. 

Greater detail in the population data allows for more accurate predictions of the risk. As 

mentioned earlier, the level of detail used to allocate people into shelter categories can have a 

significant affect on the risk predictions, but greater detail requires more work to define the 

locations and sheltering of people and requires the development of more numerous and more 

complex shelter vulnerability models.

The basic equation for EC presented in this section gives the risks to a given population 

center for the impact of a single fragment resulting from a debris-generating event. Each event is 

defined by a vehicle failure scenario, planned hardware jettison or weapon system planned 

debris-generating event, where a vehicle failure scenario is a specific mode of failure occurring 

at a specific time of flight and resulting in a specific mode of vehicle breakup. This EC is 

conditional in that it is the casualty expectation given that the debris-generating event occurs. 

To get the total conditional risk to the population center, the EC values need to be combined over 

all fragments generated by the event. Then to get the actual risk for the debris generating event, 

the population center conditional EC needs to be multiplied by the probability of the event 

occurring. Finally to get the total risk to the population center the contributions for all debris 

generating events (covering all flight times) need to be combined. 

The total risk for a mission is the sum over all hazarded population centers. 

Individual probability of casualty can be computed directly from the total casualty 

expectation. It is usually computed separately for each population center since the probability 

can vary significantly from population center to population center. For a given population center 

the individual probability of casualty is the total EC for the population center divided by the 

number of people in the center. In some cases the individual probability of casualty might be 

computed for each shelter category within a population center, possibly for each floor of a 

building. To get the individual probability of casualty to be used to determine if individual risk 

criteria are met, the maximum probability value over all population centers is typically used. 

Individual probability of fatality is computed similarly. 

The probabilities of occurrence of the debris-generating events are important inputs to 

risk computations: 

7-62
k. For planned events, such as a weapon system intercept or hardware jettison, it is the 

probability of achieving the event. 

l. For failure scenarios, the probabilities are usually defined for short flight time 

intervals, and the probability is computed by integrating a failure rate (probability of 

failure per second) over the time interval. A failure at a specified time during the 

interval (such as the mid-point time) is then used to represent a failure at any time 

during the interval. 

(1) The development of failure rates (for each of the credible vehicle failure modes) 

is a complex process and is beyond the scope of this Standard, although methods 

have been developed by various launch ranges and other organizations (such as 

the FAA and NASA), and many of these are documented. The accuracies of the 

failure rates are very important to the accuracies of the risk predictions. Changing 

the failure rate uniformly (over flight time) for a given failure mode by a factor 

results in the corresponding risk prediction being changed by the same factor. 

7.9 Catastrophic Risk Modeling 

a. Model Description. Catastrophic risk (casualty or fatality) modeling is a fairly new 

concept to ranges and is not common practice. It is an area of risk management that 

is gaining increasing attention and therefore, some guidelines for assessing 

catastrophic losses are presented here. 

A catastrophe, for purposes of this standard, refers to an accident where there are 

multiple casualties/fatalities, with increasing seriousness of the catastrophe being 

related to increasing numbers of casualties/fatalities.109

Most launch risk methods rely on average loss per launch or per year. There is no 

particular aversion to low probability – high loss consequences as long as the average 

risk is less than a specified collective risk criterion. Catastrophe aversion requires an 

additional criterion beyond the normal EC or EF criterion. This is compatible with 

some other fields such as systems safety that use two parameters to classify risk 

(probability of the event and consequences of the event)110.

 

109 OSHA promulgated a formal definition in 29 CFR 1960.2: “An accident resulting in five or more agency and/or 

non-agency people being hospitalized for inpatient care.” However, the city of Santa Barbara, California treats ten 

affected individuals as the defining point for catastrophic risk. Ten persons is also used in a number of standards as 

the breakpoint at which risk profiles are required to become more catastrophe averse. 

110 The risk matrix that is used by systems safety and described in U. S. Dept. of Defense Military Standard (MILSTD-882E ) measures increasing severity of consequence along one axis and decreasing frequency of occurrence 

along the other axis. It is usually applied to a single system and event, and in practice is more qualitative, having a 

severity scale that changes its measure of consequence with increasing severity. This can be more rigorously 

quantitative, however, in which case certain parameters related to the risk profile can be plotted in a risk matrix 

form. The risk profile developed for launch risk analysis is based on modeling of 1000’s of events and representing 

the results of all of these events in a single plot. Thus, parameters from the risk profile, P(≥1) (for the probability of 

a casualty or fatality producing event) can be measured along the one axis and the average number of casualties or 

fatalities given a casualty or fatality producing event can be measured along the other axis - providing a risk profile 

output in a system safety risk matrix. 

7-63
Mitigations to reduce the potential for a catastrophe should focus on the part of the 

EC that is connected to the catastrophe potential. 

b. Modeling Considerations. Aversion to catastrophe is accomplished by assigning a 

progressively greater restriction on activities that produce greater numbers of 

casualties. Two approaches can be used: 

(1) The first approach makes use of a risk profile whose development can be a timeconsuming and resource heavy process. 

(2) The second approach replaces “N”, representing the number of exposed persons 

in a population center, by “Nk

” in the determination of casualty or fatality 

expectation. For a case where there is single exposed site, the casualty 

expectation EC = E(N) is replaced by ECk = E(Nk

). 

 The risk profile has two parameters, whereas ECk has one. Using a risk profile is 

more accurate. Using a power of N, (Nk

), is only accurate for one event and one 

population center, however it will always inflate the casualty expectation with the 

degree of inflation increasing for population centers (that have casualties) with larger 

populations. 

7.9.1 Catastrophe Aversion Using a Risk Profile. A risk profile displays the probability of 

exceedance of levels of loss; it is a complementary cumulative distribution. It can be used for 

number of people or for levels of financial loss (in discrete intervals).It can be for a single event

or be annualized. The annualized risk profile is commonly referred to in some other industries 

as the F-N curve. 

A risk profile is developed by simulating 1000’s of accidents and recording the number 

of casualties from each accident in a single histogram that has the probability of exactly one 

casualty, exactly two casualties, etc., i.e. P(1), P(2), etc. Risk profile requisites include: 

a. The simulated accidents must cover the full range of the failures, breakups, 

dispersions and populations potentially at risk, accounting for all potential failure 

times. 

b. The risk profile is constructed from the histogram, i.e. each value in the risk profile, 

P(≥N), is computed by adding all of the terms in the histogram for N and above. 

c. The histogram is discrete (exactly 1, exactly 2, etc.) and therefore the risk profile is a 

discrete complementary cumulative distribution. 

A typical risk profile is shown in Figure 7-7. 

Indifference to catastrophe is shown on a risk profile plot as a line that decreases one 

order of magnitude in probability with each increasing order of magnitude in number of 

casualties (see Figure 7-8).The product of the value of P(≥N) and N is constant along the line. 

The slope is -1 on a log-log scale. 

If the slope is steeper than -1, and the acceptability criterion is “P(≥N) must fall below 

the line for each value of N,” then the line is providing some aversion to catastrophic events. 

7-64
Figure 7-8 shows lines with slopes of -1.5 and -2 that represent progressively more catastrophe 

aversion. The EC associated with each of these lines is 30×10-6. The line with a slope of -1.5 is 

consistent with the catastrophe criteria proposed in the standard, P×N1.5≤1×10-4 (casualties1.5). 

The line with a slope of -2 is used by some other countries and some locations in the United 

States, but is it used with a higher starting probability value (value at N equal to 1). 

Risk mitigation should be applied with an emphasis on reducing the risk profile so that it 

falls below the limit line for catastrophe. 

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1 10 100

N - Number of Casualties

P[>=N]

The risk profile is discrete, not 

continuous. The descending 

symbols with increasing n represent 

the height of bars for each value of 

P[≥N] (at N). The heights represent 

the sum of all of the probabilities 

from P[N] to P[Nmax]

P[≥1 casualty] - also the 

probability of a casualty 

producing accident

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1 10 100

N - Number of Casualties

P[>=N]

1.E-08

1.E-07

1.E-06

1.E-05

1.E-04

1.E-03

1 10 100

N - Number of Casualties

P[>=N]

The risk profile is discrete, not 

continuous. The descending 

symbols with increasing n represent 

the height of bars for each value of 

P[≥N] (at N). The heights represent 

the sum of all of the probabilities 

from P[N] to P[Nmax]

P[≥1 casualty] - also the 

probability of a casualty 

producing accident

Figure 7-7. Typical risk profile. 

7-65
Figure 7-8. Comparison of catastrophe tolerant and catastrophe intolerant limit lines. 

7.9.2 Catastrophe Aversion Using a Modified Expectation Calculation. Catastrophe aversion 

using an altered EC computation substitutes the occupancy of each population center 

with a “pseudo N” that is larger than the normal occupancy as follows: 

a. The occupancy can be raised by powers; for a population center with “N” exposed 

persons the number of exposed persons is replaced by “Nk

”. 

(1) An alternate approach that uses factors on “N”, instead of powers of “N”, has 

been employed in Europe for explosives safety storage. Norway, Sweden and 

Switzerland use a factor, φ, equal to 2N/5 (see footnotes 111 and 112) with the 

pseudo occupancy for a population center becoming φ×N. 

b. A risk analysis is performed based on the altered occupancies. 

 If the casualty expectation or fatality expectation satisfies the normal acceptability 

criterion, then catastrophic risk from multiple casualties or fatalities has been averted. 

 A weakness of this approach is that if the population is broken up into many small 

population groups the risk analysis result is different (smaller) than if fewer, larger 

 

111 NATO Allied Ammunition Storage and Transport Publication, NATO-AASTP-4, which was prepared by NATO 

AC/258, Risk Analysis Working Group (RAWG). 

112 The Swiss cap the factor when n≥20. Above n=20, n is set equal to 20 and the factor remains a constant 

220/5=16. 

7-66
groups are used to represent the population. In both cases, incorporating powers or 

factors to establish a pseudo N, the catastrophe potential will be reduced, but the 

result will not always be consistent. 

 In the U.S. in the 1970’s, the USAF Western Range applied a factor of 103

 (N x 

1000) to the number of people in certain populations who were unrelated to the 

activity and potentially hostile to the consequences of an accident. The risk analysis 

was run with the remaining part of the population having no factor applied. The 

mission design was then optimized with these adjusted populations to satisfy both the 

standard risk acceptability criterion and the primary objectives of the mission. The 

factor of 103

 was drawn from Chauncey Starr’s paper113 that attempted to quantify 

the additional risk a person would voluntarily accept in an activity as a function of the 

benefit derived from the activity.114

7.10 Risk Prediction Uncertainty 

7.10.1 Model Description. Risk (casualty or fatality) prediction models simulate complex 

events, requiring many sub-models that, at best, only approximate behaviors and have uncertain 

parameters. This discussion addresses the considerations for performing risk analyses that 

incorporate uncertainty into the decision making procedure.

Uncertainties are described in the two general categories of aleatory and epistemic. 

a. Aleatory uncertainty is the uncontrollable variability of events, is typified by the 

distribution of debris impacts from one accident to another (the same initial 

conditions will not produce exactly the same consequences in sequential trials). In 

launch risk analysis models, the effect of aleatory uncertainty is most frequently 

averaged in the process of determining impact probability or EC. 

b. Epistemic uncertainty is the uncertainty in the model and its parameters. The model 

and its parameters may contain inadequacies that introduce model or systematic 

uncertainty. If epistemic uncertainty is accounted for, then the computed EC is no 

longer a point value but represented by a probability distribution. 

 

113 Starr, Chauncey, “Societal Benefit versus Technological Risk,” Science, Vol.165, pp. 1232-38, 1969. 114 Otway, H.J., Cohen, J.J., “Revealed Preferences: Comments on the Starr Benefit-Risk Relationships,” Vienna: 

Institute of Applied Systems Analysis, 1975. 

7-67
7.10.2 Modeling Considerations. Options for accounting for uncertainty in model architecture 

include applying a Monte Carlo technique (random sampling of parameter uncertainties) or a 

simplified method where uncertainty factors/multipliers are applied to parameters that dominate 

the EC computation. Significant sources of uncertainty that have been considered for debris risk 

analyses are: 

a. The failure probability 

b. The debris list 

c. The debris impact distributions 

d. The yield from the impact of explosive debris 

e. The fragment probability of casualty, PCF, given a hit by inert debris 

f. The PCF given exposure to the shockwave from exploding debris 

g. The PCF given inert debris impact on a roof that is sheltering a person 

h. The PCF given that the shockwave from exploding debris impacts a building that is 

sheltering a person. 

i. The number of people in each population center. 

 The above is not a complete list but only highlights those that tend to dominate the 

uncertainty. Related comments are: 

j. Failure probability uncertainty directly affects the uncertainty in the risk analysis 

results. Methods used to obtain failure probabilities normally result in less 

uncertainty if they account for different stages, flight phases, and/or different failure 

modes. The distribution of failure probability versus time also has a significant affect 

on risk predictions. 

k. Debris list uncertainty is very difficult to model. Due to a lack of valid empirical 

data, debris lists are difficult to develop and are thus a significant source of model 

uncertainty. 

l. Debris impact distributions have uncertainties due to the appropriateness of the 

distributions, shifts in the midpoints of the distributions because of the difficulty in 

modeling vehicle behaviors prior to breakup, and changes in the size of the 

distributions for the same reasons. 

m. The uncertainties in items d to h above are most easily modeled by uncertainty 

factors. However, using uncertainty factors is a “top down” approach and has the 

potential of leading to an overstatement of the effect of the uncertainty in these 

parameters. 

 An uncertainty analysis produces a probability distribution for EC (or EF). The 

probability distribution will most likely tend to look somewhat like a normal 

distribution on a log-scale, i.e. a lognormal distribution. The distribution can be used 

to compute the average (or mean) EC or to provide corresponding cumulative values 

at confidence/probability levels, such as 90 percent or 95 percent. The decision 

maker can use these numbers to make decisions regarding the acceptability of the 

risk. 

7-68
 The fact that the uncertainty distribution tends to be lognormal (or a similarly 

shaped distribution) means that the average EC from the distribution is larger than the 

 EC computed before uncertainties are introduced. Figure 7-9 shows how EC

grows as the ratio of the 95 percent and 5 percent levels of the uncertainty 

distribution grows. It is highly unlikely that the uncertainty distribution for EC will 

have a ratio of the EC95/EC05 (see footnote 115) of less than 100. This means that the 

average value of EC considering uncertainty may be at least double the point estimate 

of EC computed without considering uncertainty. 

0

1

2

3

4

5

1 10 100 1000

Ratio of P95/P5 of Uncertainty Distribution

Factor of EC(average) / EC(Point Estimate)

Figure 7-9. The effect of uncertainty distribution breadth on the average value of ec. 

 

115 EC95 is the value of EC at the 0.95 level of the cumulative distribution for the uncertainty of EC and EC05 is the 

value at the 0.05 level. 

7-69
This page intentionally left blank. 

7-70
CHAPTER 8 

OTHER HAZARDS 

8.1 Introduction to Other Hazards 

 A flight safety analysis must evaluate all hazards to ensure a compliance with the risk 

acceptability criteria provided in Chapter 3 of the Standard. The focus of the RCC-321 Standard 

has traditionally been on the inert and explosive debris resulting from a range mishap, but other 

hazards can exist and sometimes pose significant risks. These other hazards typically include 

exposure to toxic propellants, glass breakage from far field (below one psi peak) overpressure, 

and exposure to radiation. This chapter provides screening criteria and analysis considerations 

for hazard and risk assessments of these other hazards, as well as acceptable means to 

demonstrate negligible risk from other hazards by exclusion or containment. 

8.2 Toxic Release Assessment 

8.2.1 Scope. A flight safety analysis is used to establish launch commit criteria that protect all 

exposed people from any hazard associated with toxic release from a catastrophic116

launch abort or a nominal launch and demonstrate compliance with the risk criteria of 

Chapter 3. The analysis should: 

a. Account for any toxic release that will occur during the proposed flight of a launch 

vehicle or that would occur in the event of a flight mishap. 

b. determine if toxic release can occur based on an evaluation of the propellants, launch 

vehicle materials, and estimated combustion by-products. 

c. account for both normal combustion by-products and the chemical composition of 

any un-reacted propellants. 

d. account for any operational constraints and emergency procedures that provide 

protection from toxic release. 

e. account for all people that may be exposed to the toxic release, including those on 

land and on any waterborne vessels, populated offshore structures, and aircraft that 

are not operated in direct support of the launch. 

8.2.2 Strategy. To ensure adequate protection from exposure to any toxic release, toxics must 

be identified and either the risks contained or managed to acceptable levels. Guidelines for 

accomplishing this are provided in paragraph 8.2.3 through paragraph 8.2.5. 

 

116 “catastrophic” meaning that the vehicle is destroyed with or without FTS activation; not to be confused with 

“catastrophic risk” which implies that a large number of people are casualties 

8-1
8.2.3 Basic Hazard Analysis. A toxic release hazard analysis for launch vehicle flight should 

identify all propellants used for each launch and identify whether each propellant is toxic or nontoxic. If the launch vehicle, including all launch vehicle components and payloads, uses only 

those propellants listed in Table 8-1, then no toxic release hazard analysis is necessary. 

TABLE 8-1. COMMONLY USED NON-TOXIC PROPELLANTS 

Item Chemical Name Formula 

1 Liquid Hydrogen H2

2 Liquid Oxygen O2

3 Kerosene (RP-1) CH1.96

a. Common Toxic Propellants. Table 8-2 lists commonly used toxic propellants and the 

associated toxic concentration thresholds, in parts per million (ppm), that constitute 

the lowest concentration that initiates an expectation of casualty used by the federal 

launch ranges for computing casualty risks. The toxic concentration thresholds given 

in Table 8-2 are based on Air Force sponsored expert elicitations of panels of 

toxicologists.117 For toxic propellant or combustion by-products, a range should 

prevent exposure to concentrations above the level of concern (LOC) or equivalent 

established by the U.S Environmental Protection Agency (EPA), Federal Emergency 

Management Agency (FEMA), Occupational Safety and Health Administration 

(OSHA), National Institute of Occupational Safety and Health (NIOSH) of the 

Centers for Disease Control (CDC), the American Conference of Government 

Industrial Hygienists (ACGIH),or Department of Transportation (DOT) unless an 

EPA Acute Emergency Guidance Level (AEGL) exists for a toxicant that is more 

conservative than the LOC (that is, lower after reduction for duration of exposure). If 

an LOC has not been established, the range should demonstrate that exposure at the 

proposed toxic concentration threshold will not cause a casualty. 

As explained in Paragraph 5.1.1 of this Supplement, the acceptable risk criteria in 

this standard are for the aggregated risk from all hazards associated with an operation. 

A range may need to establish a lower launch risk criteria for a toxic release to ensure 

that acceptable exposure concentrations for the general public are not exceeded when 

appropriate mitigations are in place. For example, the Eastern Range has placed a 

cap of 30E-6 expected casualties for the general public for a toxic release based on a 

Monte Carlo analysis of toxic risk for each launch vehicle, considering varying 

weather profiles and presenting an assessment of the toxic concentration levels to 

which the general public is exposed. They found that the concentration levels will 

not exceed the LOC for the general public if the collective risk is limited to 30E-6 or 

less with mitigations that include reverse 911 that facilitate shelter-in-place and 

 

117 See Nyman et al, FAA Launch Emission Toxic Screening Methodology Final Report, ACTA Report. No. FAA 

00-01, June, 2000. A more recent elicitation produced revised thresholds for NO2 and HNO3. 

8-2
evacuations. Reverse 911 is a multi-line outbound calling system capable of sending 

recorded messages to a specific area with time critical information. Since those 

results are dependent on many factors, such as the location, size, and other 

characteristics of the surrounding population centers, a similar analysis should be 

performed for each range to ensure compliance with allowable toxic exposure limits 

that may be set by the Range Commander, federal, state, or local governments. 

TABLE 8-2. COMMONLY USED TOXIC PROPELLANTS AND BY-PRODUCTS 

Chemical Name Formula 

Toxic Concentration 

Threshold (ppm)

Nitrogen Tetroxide N2O4 4 

Mixed Oxides of Nitrogen (MON) NO, NO2, N2O4 4 

Nitric Acid HNO3 4 

Hydrazine N2H4 8 

Monomethylhydrazine (MMH) CH3NHNH2 5 

Unsymmetrical Dimethylhydrazine 

(UDMH) (CH3)2NNH2 5 

Ammonium Perchlorate/Aluminum 

(threshold given for HCl by-product) NH3ClO4/Al 10 

b. Uncommon Toxic Propellants. Any propellant not identified in Table 8-1 or 

Table 8-2 falls into the category of unique or uncommon propellants, such as those 

identified in Table 8-3, which are toxic or produce toxic combustion by-products. 

Table 8-3 is not an exhaustive list of possible toxic propellants and combustion byproducts. For a launch that uses any propellant listed in Table 8-3 or any other 

unique propellant not listed, a toxic release hazard analysis should identify the 

chemical composition of the propellant and all combustion by-products and the 

release scenarios. 

c. Analysis Products. The products of a basic toxic release hazard analysis for launch 

vehicle flight should include the following: 

(1) For each launch, a listing of all toxics used on all launch vehicle components and 

any payloads. 

(2) The chemical composition of each toxic and all toxic combustion by-products. 

(3) The quantities of each toxic and all toxic combustion by-products involved in the 

launch. 

(4) For each toxic and combustion product, identification of the toxic concentration 

threshold used and a description of how the toxic concentration threshold was 

determined. 

8-3
TABLE 8-3. UNCOMMON TOXIC PROPELLANTS AND COMBUSTION BYPRODUCTS 

Item Chemical Name 

Toxic Concentration Threshold 

Formula (ppm) 

1 Fluorine F2

2 Hydrogen Fluoride HF Determined according to § 8.2.3a. 

3 Potassium Perchlorate KClO4

4 Lithium Perchlorate LiClO4

5 Chlorine Oxides Cl2O, ClO2, CL2O6, Cl2O7

6 Chlorine Trifluoride ClF3

7 Beryllium Be 

8 Beryllium Borohydride Be(BH4)2

9 Boron B 

10 Boron Trifluoride BF3

11 Diborane B2H6

12 Pentaborane B5H9

13 Hexaborane B6H10

14 Aluminum Borohydride Al(BH4)3

15 Lithium Borohydride Li(BH4)2

16 Ammonia NH3

17 Ammonium Nitrate NH4NO3

18 Ozone O3

19 Methylamine CH3NH2

20 Ethylamine CH3CH2NHH2

21 Triethylamine (C2H5)3N 

22 Ethylenediamine NH2CH2CH2NH2

23 Diethylenetriamine NH2C2H4NHC2H4NH2

24 Aniline C6H5NH2

25 Monoethylaniline C6H5NHC2H5

26 Xylidine (CH3)2C6H3NH3

27 Trimethylaluminum Al(CH3)3

28 Dimethylberyllium Be(CH3)2

29 Nitromethane CH3NO2

30 Tetranitromethane C(NO2)4

31 Nitroglycerine C3H5(ONO2)3

32 Butyl Mercaptan CH3(CH2)2CH2SH 

33 Dimethyl Sulfide (CH3)2S 

34 Tetraethyl Silicate (C2H5)4SiO4

8-4
8.2.4 Toxic Hazard Containment. For a launch that uses any toxic propellant, a potential 

casualty distance for each toxicant and a toxic hazard area for the launch should be determined. 

A potential casualty distance for a toxicant is the furthest distance from the launch point where 

toxic concentrations may be greater than the associated toxic concentration threshold in the event 

of a release during flight. A toxic hazard area defines the region on the Earth’s surface that may 

be exposed to toxic concentrations greater than the toxic concentration threshold of any toxicant 

involved in a launch in the event of a release during flight. From the potential casualty 

distances, the toxic hazard area can be determined. A toxic release hazard analysis may 

determine the potential casualty distance for each toxicant as described in paragraphs 8.2.4a or 

8.2.4b and a toxic hazard area as described in paragraph 8.2.4c. A range should strive to contain 

the toxic hazard by evacuating people or by imposing meteorological constraints; however, if the 

hazard cannot be contained then a statistical risk management approach should be employed. 

a. Sample Potential Casualty Distances for Common Propellants. Table 8-4 lists 

potential casualty distances as a function of propellant quantity and toxic 

concentration threshold for commonly used propellants released in the event of a 

launch vehicle failure. These potential casualty distances were published by the FAA 

during their rulemaking on launch safety118. These potential casualty distances were 

designed to provide reasonably conservative estimates, however, the analyst is 

responsible to ensure that these potential casualty distances are appropriate for a 

particular launch. These distances are intended to facilitate a determination of 

whether a toxic risk analysis is warranted. A range should take actions to protect 

people at greater distances when an airborne toxicant released in a nominal or aborted 

rocket launch may produce concentrations above the Level of Concern (LOC), or an 

EPA established acute emergency guidance level (AEGL) if the AEGL is more 

conservative than the LOC (that is, lower after reduction for duration of exposure) for 

the commodity of concern.. 

 Table 8-4 lists the potential casualty distance as a function of the total weight of 

propellant in the vehicle (all stages combined) at the beginning of flight.. A toxic 

release hazard analysis may use the potential casualty distances corresponding to the 

toxic concentration thresholds established for a launch to determine the toxic hazard 

area for a launch, unless the launch conditions invalidate the assumptions used in the 

development of these distances. The launch conditions and assumptions used in the 

development of these distances are summarized in paragraph 8.2.4b. 

 

118 Federal Register / Vol. 65, No. 207 / Wednesday, October 25, 2000, page 63963

8-5
8-6

TABLE 8-4. TOXIC POTENTIAL CASUALTY DISTANCES 

Potential casualty distances from the Launch Point 

Concentrations (ppm) and Potential casualty distances (km) 

Quantity NO2

4 ppm1

UDMH

5 ppm1

N2H4

8 ppm1

MMH

5 ppm1

NO

4 ppm1

HNO3

4 ppm1

HCl2

10 ppm1

(pounds) (km) (km) (km) (km) (km) (km) (km) 

100 8 4 3 5 9 8 0 

300 14 8 7 9 17 15 0 

500 18 10 8 12 20 19 0 

1000 26 15 11 17 26 24 0 

2000 36 19 13 21 33 31 0 

3000 44 22 15 24 39 35 1 

4000 47 24 16 27 42 39 2 

5000 50 26 17 29 45 42 2 

7500 58 30 20 35 52 48 2 

10000 64 34 22 37 58 52 3 

20000 78 42 27 47 71 66 4 

30000 91 47 29 55 81 76 5 

40000 99 52 31 59 88 81 5 

50000 105 56 34 64 100 87 6 

60000 111 59 35 67 104 92 7 

70000 116 62 36 72 109 100 8 

80000 123 64 37 74 114 104 9 

90000 126 68 38 77 118 108 9 

100000 130 69 39 79 122 111 10 

125000 138 74 42 85 131 119 12 

150000 145 78 44 95 138 125 13 

175000 151 81 45 99 144 131 14 

200000 160 88 47 103 156 136 16 

250000 167 94 49 110 163 148 18 

300000 175 99 50 117 171 155 21 

350000 182 103 52 122 179 161 22 

400000 189 107 53 128 186 167 25 

450000 203 110 54 132 193 173 27 

500000 207 114 57 136 196 178 28 

750000 230 127 61 157 206 184 37 

1000000 247 140 64 170 220 195 43 

1 Indicates a toxic concentration threshold from Table 8-2. 

2 HCl emissions from catastrophic launch vehicle failure.
b. Sample Assumptions for Propellants. For a launch that involves any uncommon or 

unique propellant, a toxic release hazard analysis will need to determine the potential 

casualty distance for each such propellant. It is up to the analysts to determine if the 

assumptions are adequate or need to be adjusted for the particular conditions expected 

at their launch site during planned operations. Some previous analyses, including 

those that generated Table 8-4 above, have used the conditions and assumptions listed 

below: 

(1) Surface wind speed of 2.9 knots with a wind speed increase of 1.0 knot per 1000 

feet of altitude. 

(2) Surface temperature of 32 degrees Fahrenheit with a dry bulb temperature lapse 

rate of 13.7 degrees Fahrenheit per 1000 feet over the first 500 feet of altitude and 

a lapse rate of 3.0 degrees F per 1000 feet above 500 feet. 

(3) Directional wind shear of 2 degrees per 1000 feet of altitude. 

(4) Relative humidity of 50 percent. 

(5) Capping temperature inversion at the thermally stabilized exhaust cloud center of 

mass altitude. 

(6) Worst case initial source term assuming instantaneous release of fully loaded 

propellant storage tanks or pressurized motor segments. 

(7) Worst case combustion or mixing ratios such that production of toxic chemical 

species is maximized within the bounds of reasonable uncertainties. 

(8) Evaluation of toxic hazards for both normal launch and vehicle abort failure 

modes. 

c. Toxic Hazard Area. Having determined the potential casualty distance for each 

toxicant, a toxic release hazard analysis should determine the toxic hazard area for a 

launch as a circle centered as the launch point with a radius equal to the greatest 

potential casualty distance for all the toxicants involved in the launch. If the toxic 

release does not originate at the launch point then the toxic hazard area should be 

adjusted or expanded accordingly. Containment is satisfied if: 

(1) There are no populated areas contained or partially contained within the toxic 

hazard area; and 

(2) No member of the public is present within the toxic hazard area during preflight 

fueling, launch countdown, flight and immediate post flight operations at the 

launch site. 

d. Evacuation of the Toxic Hazard Area. For a launch where there is a populated area 

that is inside or partially within a toxic hazard area, containment may be achieved if 

the range evacuates all people from the populated areas at risk and ensures that no 

one is present within the toxic hazard area during preflight fueling and flight. 

e. Flight Meteorological Constraints. Containment of toxic hazards may also be 

achieved by constraining the flight of a launch vehicle to favorable wind conditions 

or to times when atmospheric conditions result in reduced potential casualty distances 

such that any potentially affected populated area is outside the toxic hazard area. A 

range may reduce the potential casualty distances by imposing operational 

8-7
meteorological restrictions on specific parameters that mitigate potential toxic 

downwind concentrations levels at any potentially affected populated area to levels 

below the toxic concentration threshold of each toxicant in question. 

f. Containment Analysis Products. The products of a toxic release containment analysis 

for launch vehicle flight should include the following: 

(1) The potential casualty distance for each toxic propellant and combustion product 

and a description of how it was determined. 

(2) A graphic depiction of the toxic hazard area or areas. 

(3) A listing of any wind or other constraints on flight, and any plans for evacuation. 

(4) A description of how the range determines real-time wind direction in relation to 

the launch site and any populated area and any other meteorological condition in 

order to implement constraints on flight or to implement evacuation plans. 

8.2.5 Statistical Risk Management. If toxic hazards cannot be contained as described, the 

range should use statistical toxic risk management to protect public safety. For each such case, a 

range should perform a toxic risk assessment and develop launch commit criteria that protect the 

public from unacceptable risk due to planned and potential toxic release. A range should ensure 

that the resultant toxic risk meets the collective and individual risk criteria requirements 

contained in Chapter 3 of the Standard. 

a. Toxic Risk Assessment. A toxic risk assessment should account for the following: 

(1) All credible vehicle failure and non-failure modes, along with the consequent 

release and combustion of propellants and other vehicle combustible materials. 

(2) Vehicle failure rates associated with credible toxic release modes. 

(3) The effect of positive or negative buoyancy on the rise or descent of each released 

toxicant. 

(4) The influence of atmospheric physics on the transport and diffusion of each 

toxicant. 

(5) Meteorological conditions at the time of launch. 

(6) Population density, location, susceptibility (health categories) and sheltering for 

all populations within each potential toxic hazard area. 

(7) Exposure duration and toxic propellant concentration or dosage that would result 

in casualty for all populations. 

b. Risk Management Products. When using the statistical toxic risk management 

approach of paragraph 8.2.5, the products of the risk assessment for launch vehicle 

flight should include the following: 

(1) A description of the range’s toxic risk management process, including an 

explanation of how the range ensures that any toxic risk from launch meets the 

risk criteria of Chapter 3 of the Standard. 

(2) A listing of all models used. 

(3) A listing of all launch commit criteria that protect the public from unacceptable 

risk due to planned and potential toxic release. 

(4) A description of how the range measures and displays real-time meteorological 

conditions in order to determine whether conditions at the time of flight are 

8-8
within the envelope of those used for toxic risk assessment and to develop launch 

commit criteria, or for use in any real-time physics models used to ensure 

compliance with the toxic launch commit criteria. 

8.3 Far-Field Window Breakage 

8.3.1 General. Flight safety analysis is also used to establish launch commit criteria that 

protect people from any hazard associated with far field blast window breakage effects due to 

potential explosions during launch vehicle flight and demonstrate compliance with the risk 

criteria of Chapter 3 of the Standard. The far field blast window breakage analysis should 

account for distant focusing overpressure and any overpressure enhancement to establish the 

potential for broken windows due to peak incident overpressures below 1.0 psi and related 

casualties due to falling or projected glass shards. As with all hazards, containing the hazard is 

the primary goal but if containment cannot be achieved then a statistical risk analysis must be 

performed to ensure compliance with the risk criteria. 

8.3.2 Example Containment Method. This section describes an acceptable means, but not the 

only acceptable means, to demonstrate negligible risk due to far field window breakage. 

Specifically, a range may demonstrate containment of far field window breakage effects 

using the following screening method: 

a. Explosive yield factors. The analysis uses explosive yield factor curves for each type 

or class of solid or liquid propellant aboard the launch vehicle. Each explosive yield 

factor curve should be based on the most accurate explosive yield data for the 

corresponding type or class of solid or liquid propellant based on empirical data or 

computational modeling. 

b. Maximum credible explosive yield. The analysis establishes the maximum credible 

explosive yield resulting from normal and malfunctioning launch vehicle flight. The 

explosive yield accounts for impact mass and velocity of impact on the Earth’s 

surface. The analysis accounts for explosive yield expressed as a TNT equivalent for 

peak overpressure. 

c. Population exposed to the hazard. The example analysis demonstrates whether any 

population centers are vulnerable to a distant focusing overpressure hazard using the 

methodology provided by section 6.3.2.4 of the American National Standard 

Institute’s ANSI S2.20–1983, ‘‘Estimating Air Blast Characteristics for Single Point 

Explosions in Air with a Guide to Evaluation of Atmospheric Propagation and 

Effects’’ and as follows: 

(1) For the purposes of this analysis, a population center includes any area outside 

the launch site control that contains an exposed site. An exposed site includes 

any structure that may be occupied by human beings, and that has at least one 

window, but does not include automobiles, airplanes, and waterborne vessels. 

The analysis accounts for the most recent census information on each population 

center. The analysis treats any exposed site for which no census information is 

available as a ‘single residence.’ The analysis treats any area where census 

8-9
information indicates a population equal to or less than four persons as a ‘single 

residence.’ 

(2) The analysis identifies the distance between the location of the maximum 

credible impact explosion and the location of each population center potentially 

exposed. Unless the location of the potential explosion site is limited to a 

defined region, the analysis accounts for the distance between the potential 

explosion site and a population center as the minimum distance between any 

point within the region contained by the flight safety limits and the nearest 

exposed site within the population center. 

(3) The analysis accounts for all weather conditions optimized for a distant focus 

overpressure hazard by applying an atmospheric blast ‘‘focus factor’’ (F) of 5. 

(4) The analysis determines, using the methodology of section 6.3.2.4 of ANSI 

S2.20–1983, for each population center, whether the maximum credible 

explosive yield of a launch meets, exceeds or is less than the ‘‘no damage yield 

limit,’’ of the population center. If the maximum credible explosive yield is less 

than the ‘‘no damage yield limit’’ for all exposed sites, the remaining 

requirements of paragraph 8.3.2 do not apply. If the maximum credible 

explosive yield meets or exceeds the ‘‘no damage yield limit’’ for a population 

center then that population center is vulnerable to far field window breakage 

from the launch and the requirements of paragraphs (d) and (e) (below) apply. 

d. Estimate the quantity of broken windows. The example analysis uses a focus factor 

of 5 and the methods provided by ANSI S2.20–1983 to estimate the number of 

potential broken windows within each population center determined vulnerable to the 

far field window breakage as required by paragraph (3) above. 

e. Determine and implement measures necessary to prevent far field window breakage. 

For each population center that is vulnerable to far field window breakage from a 

launch, the analysis should identify mitigation measures to protect people from 

serious injury from broken windows and the launch commit criteria needed to enforce 

the mitigation measures. The mitigation measures may include one or more of the 

following: 

(1) Apply an anti-shatter film to all exposed sites where the maximum credible yield 

exceeds the ‘‘no damage yield limit.’’ 

(2) Evacuate the exposed people to a location that is not vulnerable to the far field 

window breakage prior to the planned flight time. 

8-10
8.3.3 Statistical Risk Management. If containment of the far-field window breakage hazard is 

not demonstrated, then the range must perform a risk analysis to demonstrate that the launch will 

comply with the risk criteria of Chapter 3.

a. Analysis Considerations. The analysis should account for: 

(1) The potential for distant focusing overpressure or overpressure enhancement 

given current meteorological conditions and terrain characteristics; 

(2) The potential for broken windows due to peak incident overpressures below 1.0 

psi and related casualties; 

(3) The explosive capability of the launch vehicle on the pad at liftoff, at impact, at 

altitude, and potential explosions resulting from debris impacts, including the 

potential for mixing of liquid propellants; 

(4) Characteristics of the launch vehicle flight and the surroundings that would affect 

the population’s susceptibility to injury, such as, shelter types and time of day of 

the proposed launch; 

(5) Characteristics of the potentially affected windows, including their size, location, 

orientation, glazing material, and regional conditions; and 

(6) The hazard characteristics of the potential glass shards, such as falling from upper 

building stories or being propelled into or out of a shelter toward potentially 

occupied spaces. 

b. Analysis Products. The products of a far field window breakage analysis should 

include: 

(1) A description of the methodology used to produce the far field blast overpressure 

analysis results, a tabular description of the analysis input data, and a description 

of any far field window breakage mitigation measures implemented. 

(2) For any far field window breakage hazard or risk analysis, an example set of the 

analysis computations. 

(3) The values for the maximum credible explosive yield as a function of time of 

flight. 

(4) The distance between the potential explosion location and any population center 

vulnerable to the far field blast overpressure hazard. For each population center, 

identify the exposed populations by location, number of people, and window 

types and sizes. 

(5) Any mitigation measures established to protect people from far field window 

breakage hazards and any launch commit criteria established to ensure the 

mitigation measures are enforced. 

8.4 Radiation Hazard Analysis Guidelines 

8.4.1 General. A flight safety analysis should establish launch commit criteria that protect 

people from any hazard associated with radiation effects due to unconstrained directed energy or 

released radioisotope materials caused by equipment malfunction or vehicle flight anomalies. 

8.4.2 Hazard Definition. The hazards to humans from radiation exposure can logically be 

divided into two categories; hazards caused by exposure to non-ionizing radiation and hazards 

8-11
due to ionizing radiation. The electromagnetic spectrum of radiation spans extremely low 

frequency energy wavelengths (1010 μm +) through high frequency wavelengths (10-6 μm and 

smaller) with the visible light portion (0.4 – 0.8 μm) being most familiar. The effects of this 

energy on the human body are dependent upon exposure time and distance. The low frequency, 

large wavelength energies of the spectrum can be considered non-ionizing, since there is not a 

tendency to strip electrons from atomic structure as is the case for ionizing energies in the high 

frequency, small wavelength portion. The neutral zone of visible light provides a separation of 

these two hazards. The human eye has evolved to operate in this region and is less vulnerable to 

damage from energies of this portion of the spectrum. However, visible light can also present 

risk to the optic receptors and must be examined. 

8.4.3 Non-Ionizing Radiation Hazards. On the ranges, non-ionizing radiation hazards are 

typically provided from sources that generally involve electromagnetic emissions from 

equipment such as radio and microwave devices which can include: 

a. Spacecraft/flight vehicle telemetry and communications systems 

b. Radar systems 

c. Satellite earth stations 

d. Radio frequency (RF) generators 

e. Cellular telephone base stations 

f. Heat sealers (radiofrequency and microwave heat sealers) 

g. Lasers and laser pointers 

h. Microwave communications transmitters and receivers 

i. Non-destructive inspection and test (NDI/NDT) equipment 

j. 60 Hz electrical power system, power lines, substations, transformers, etc. 

k. Ultraviolet radiators 

These non-ionizing hazards tend to affect the most vulnerable human body systems; the 

optic nerves and the skin, as directed energy exposure provides for localized heating to the point 

of cellular damage. The more sensitive optic nerve tends to provide the lower limit of exposure 

since damage can occur rapidly before the autonomous nervous system can react to cause eyelid 

closure or blink response. Of the sources listed, laser systems can provide substantial risk since 

the directed energy can potentially reach long distances affecting ground or airborne personnel 

unrelated to the operation (e.g., airline pilots flying near the area, workers on distant elevated 

platforms or buildings). Strict procedural controls and beam control inhibits are used to mitigate 

this risk and include: 

l. Screening and Safety Procedures. ANSI standard Z136.1 defines the nominal ocular 

hazard distance (NOHD) which is dependent on the divergence, wavelength, and 

power of the laser and the effects of magnifying or eye-protection devices. Safety 

procedures for “typical” range laser applications are provided in RCC document 316-

98. These requirements allow for determination of a potentially affected region that 

must be cleared of personnel. 

m. Risk Analysis Guidelines. For high powered lasers, containment is not possible 

according to these guidelines. In these cases, a probabilistic analysis needs to be 

performed that considers failures of the system and examines the possibility for 

8-12
exposure in more detail. Guidelines for risk analyses involving high power lasers are 

not the scope of this effort. Instead the analyst should examine RCC-316-98. 

8.4.4 Ionizing Radiation Hazards. Ionizing radiation sources can affect the human system by 

stripping electrons from atomic structures, and thus causing alterations in the DNA that can 

ultimately lead to life-threatening cancers. Sometimes difficult to detect, particles of radioactive 

substances can enter the human body via multiple pathways through the respiratory, skin, 

digestive, and circulatory systems. 

a. Screening and Safety Procedures. DOT regulations on transportation container 

design test and qualification provide protection from release of radioisotope materials 

in many accident conditions. Following these basic procedures, monitoring worker 

exposure, and limiting access to these sources is often sufficient. However, in the 

case of Major Radiological Source that may be schedule for launch, there is no DOT 

approved vessel to completely contain the radioisotope material in the event of a 

launch abort. 

 Major Radiological Sources are determined based upon the particular isotope’s A2

value. Values for sources can be found in the International Atomic Energy Agency’s 

Safety Series Number ST-1, Regulations for the Safe Transport of Radioactive 

Material – 1996 Edition. Should the inventory exceed the A2 value for that 

radionuclide it is considered a Major Source and more extensive safety review and 

security protocols become necessary. 

 For launch approval of Major Radiological Sources the range must comply with 

the requirements of Presidential Directive/National Security Council Memorandum 

25 (PD/NSC-25), which calls for a review of the nuclear risk in the event of an 

accident during launch processing or ascent to orbit through the time when the object 

can no longer encounter Earth. PD/NSC-25 charters the Interagency Nuclear Safety 

Review Panel (INSRP), empanelled for each mission, to conduct an extensive review 

of the Launch Program’s nuclear Safety Analysis Report (SAR) and provide an 

independent Safety Evaluation Report (SER) to the President’s Office of Science and 

Technology Policy (OSTP) prior to granting approval for launch. 

 

b. Risk Analysis Guidelines. For small radioisotope sources a specific, formal risk 

assessment may not be required other than a hazard analysis that identifies the 

dangers of exposure and provides procedural mitigations. For “Major Radiological 

Sources” scheduled for launch, PD/NSC-25 dictates that a thorough risk assessment 

must be accomplished to include pre-launch, ascent, and any potential orbital 

maneuvers prior to escape from Earth. 

 A risk assessment for Major Radiological Sources scheduled for launch should 

include an extensive analysis of all potential accidents that can release any quantity of 

radioisotope from the system. A detailed probabilistic risk assessment for Major 

Radiological Sources should provide subsystem failure probabilities that sum to a 

total launch failure probability, apportioned through the phases of pre-launch, ascent, 

8-13
staging, and escape orbit transfer. Event sequence diagrams often provide a means to 

estimate the conditional probabilities leading to accident outcome conditions that 

describe the effects a particular accident scenario may have on the radioisotope 

source. By understanding the potential threat to the source material, the potential 

release quantity and particle size distribution can be modeled for meteorological 

dispersion and ecological uptake. Sensitivity and uncertainty analyses in the risk 

assessment are used to provide an overall estimate of worst case release and latent 

cancer fatalities given an accident. 

 This Major Radiological Source risk estimate is provided to the decision maker 

for evaluation and approval or disapproval. Since each mission is unique, hazard 

assessment methodology can vary. For the most part the need for a critical evaluation 

drives state-of-the art modeling techniques and often times extensive testing of any 

hazardous systems that may threaten the radioactive source. AFI 91-110 has 

additional requirements radioactive source use and for launch approval of major 

radiation sources, but relies on the PD/NSC-25 process to provide risk acceptance. 

8-14
GLOSSARY 

3-sigma: Three times the standard deviation, typically referenced to the mean value. 

Abbreviated Injury Scale (AIS): An anatomically based, consensus derived, global severity 

scoring system that classifies each injury in every body region according to its relative 

importance on a 6 point ordinal scale. 

Acceptable risk: A predetermined criterion or standard for a maximum risk ceiling which 

permits the evaluation of cost, national priority interests, and number of tests to be conducted. 

Accumulated risk: The combined collective risk to all individuals exposed to a particular 

hazard through all phases of an operation. Guidance Information: for the flight of an expendable 

orbital launch vehicle, risk should be accumulated from liftoff through orbital insertion; for the 

flight of a suborbital launch vehicle, risk should be accumulated from liftoff through the impact 

of all pieces of the launch vehicle, including the payload. 

Aggregated risk: The accumulated risk due to all hazards associated with a flight. Guidance 

Information. For a specified launch, aggregated risk includes, but is not limited to, the risk due 

to debris impact, toxic release, and distant focusing of blast overpressure.

Aleatory uncertainty: The kind of uncertainty resulting from randomness or unpredictability 

due to stochasticity. Aleatory uncertainty is also known as variability, stochastic uncertainty, 

Type I or Type A uncertainty, irreducible uncertainty, and objective uncertainty. 

As Low As Reasonably Practicable (ALARP): That level of risk which can be lowered further 

only by an increment in resource expenditure that cannot be justified by the resulting decrement 

in risk. Often identified or verified by formal or subjective application of cost-benefit or multiattribute utility theory. 

Automatic Destruct System (ADS): A destruct system that self-activates under certain failure 

conditions, such as when vehicle breakup is sensed via a lanyard pulled or a break-wire 

separated or when data or communications links are lost. Often ADS activates destruct charges 

on the break-point stage (usually the weakest part of the vehicle) and all lower stages. 

Background Risk: risks voluntarily accepted in the course of normal activities. 

Basis of confidence: The foundation for a users’ trust or belief that software will perform its 

intended function in a right, proper, or effective way. Typically refers to a specific document 

containing the results of IV&V efforts, testing, and/or comparisons with either real world data or 

results produced by other validated models. 

Best available: The most accurate and/or realistic information available when a risk assessment 

is performed. 
Best practice (1): A management idea which asserts that there is a technique, method, process, 

activity, incentive or reward that is more effective at delivering a particular outcome than any 

other technique, method, process, etc. The idea is that with proper processes, checks, and 

testing, a project can be rolled out and completed with fewer problems and unforeseen 

complications. 

Best practice (2): An acceptable level of effort that represents the best choice available given 

the circumstances. 

Binning: The allocation of data points into bins according to the value(s) associated with the 

data point. For example, for data points defining a location in space (latitude, longitude, 

altitude) it is the placement of each point into its appropriate bin where the bins are the 3-

dimensions cells defined by a 3-dimensional grid (each cell is defined by the latitude, longitude 

and altitude values defining the cell boundaries). 

Carcinogen: Any substance that produces cancer. 

Casualty: A serious injury or worse, including death, for a human. For the purposes of this 

standard, serious injury is defined as Abbreviated Injury Scale (AIS) Level 3 or greater except 

where prior general practice at the range has been to protect to a lesser level of injury than AIS 

level 3, such as eardrum protection. 

Casualty expectation: See Expected Casualties

Catastrophe: Any event that produces a large numbers of casualties or has a severe impact on 

continued range operations.

Clarity: An EPA TCCR principle of uncertainty characterization; the assessment is free from 

obscure language and is easy to understand. Brevity and plain English are employed; technical 

terms are avoided; simple tables, graphs, and equations are used. 

Clearance Zone: An area or volume from which objects at risk (people, ships, aircraft, etc.) are 

to be restricted or eliminated in order to control the risks. 

Coefficient of restitution: The ratio of speed of separation to speed of approach in a collision. 

Cold trajectory: The vehicle follows the planned profile but, due to low performance of a 

motor, arrives at the various points in the profile late. This can also be described as moving 

slower and not flying as far downrange as nominal predictions at any given time in flight. The 

decreased performance does not necessarily produce an unacceptable trajectory. 

Collective risk: The total risk to all individuals exposed to any hazard from an operation. 

Unless otherwise noted, collective risk is the mean number of casualties (EC) predicted to result 

from all hazards associated with an operation. Collective risk is specified as either for a mission 

or per year. The collective risk should include the aggregated and accumulated risk.
Collision Avoidance (COLA): The process of determining and implementing a course of action 

to avoid potential on orbit collisions with manned objects or with other specified orbiting 

objects. The process includes the determination of wait periods in either the launch window or 

spacecraft thrust firings based on validated conjunction assessments or risk analyses and 

accounts for uncertainties in spatial dispersions and arrival time of the orbiting objects and/or 

launch vehicle. 

Compounding conservatism: An analysis approach that results in extremely conservative 

results by making a series of conservative assumptions (See Conservatism).

Conjunction Assessment (CA): The process of determining the point of closest approach of 

two orbiting objects, or between a launch vehicle and an orbiting object, in association with a 

specified miss distance screening criteria or the corresponding probability of collision. 

Associated with the closest approach assessment is the closest approach distance, the times of 

launch or orbital firing that would result in the closest approach, and meeting the miss distance 

or collision probability criteria. 

Conservatism: As used in risk analysis modeling, conservatism is a set of modeling 

assumptions that exaggerates the risk by overstating event probabilities, hazard probabilities or 

consequences. Conservatism refers to the degree of overstating risk. 

Consistency: An EPA TCCR principle of uncertainty characterization; Conclusions of the risk 

assessment are characterized in harmony with other government actions. 

Containment: The launch safety strategy/process of minimizing risk to the maximum extent 

practical by keeping hazardous operations within defined hazard areas that are unpopulated or 

where the population is controlled and adequate protection can be provided to highly valued 

resources; to stop, hold, or surround a hazard.

Credibility: The quality that makes something (as a witness or some evidence) worthy of belief; 

credible.

Critical operations personnel: Critical operations personnel include persons not essential to 

the specific operation or launch currently being conducted, but who are required to perform 

safety, security, or other critical tasks at the range. To be treated as critical operations personnel 

they must be notified of a neighboring hazardous operation and either trained in mitigation 

techniques or accompanied by a properly trained escort. Critical operations personnel do not 

include individuals in training for any job or individuals performing routine activities such as 

administrative, maintenance, or janitorial. Critical operations personnel may occupy safety 

clearance zones and hazardous launch areas and need not be evacuated with the general public. 

Critical operations personnel should be included in the same risk category as mission 

essential personnel.

De manifestis: A level of risk that is instantly recognized by a person of ordinary intelligence as 

inherently unacceptable. 
De minimis non curat lex: {Latin} The law does not concern itself with trifles - often 

shortened to de minimus. 

De minimis threshold: The level of mishap risk below which a hazard does not warrant any 

expenditure of resources to track or mitigate. 

Debris impact risk: The potential for injury, death or property damage resulting from the 

impact of falling debris. (Separate from explosive or toxic debris risk.)

Decision Authority: The range Commander or senior official designated by the range 

Commander to make risk decisions on his or her behalf.

Deflagration: An explosion where the propagation of the explosive reaction into the un-reacted 

material is by heat and mass transfer. In a deflagration, the propagation rate is always less than 

the speed of sound in the un-reacted material. 

Depressed trajectory: The actual trajectory profile is lower (depressed) than expected.

Detonation: An explosion where the propagation of the explosive reaction into the un-reacted 

material is by shock compressive heating. In a detonation, the propagation rate is at least as fast 

as the speed of sound in the un-reacted material. 

Diffraction: A description of how overpressure wave fronts bend around structures and objects 

Diffusion: Dispersion of gasses or particulates by atmospheric turbulence. 

Discrete complementary cumulative distribution: The complementary cumulative 

distribution is one (1) minus the cumulative distribution, i.e. 1-F(x). The word “Discrete” is 

used to refer to the fact that x in the distribution can only have integer values. 

Discretionary function: A deed involving an exercise of personal judgment and conscience.. 

Also “discretionary act”; Not an implementation of a hard and fast rule. Relates to 

“Discretionary Function Exclusion” of Federal Torts Claims Act. 

Distributive mixing test: A liquid propellant explosive test used to study the effects of initial 

surface area contact between fuel and oxidizer propellant components on the blast yield 

produced in an explosion. The configurations used in these tests permit the ratio of the initial 

surface area of contact to the total propellant weight to be precisely controlled.

Distant focusing: An atmospheric phenomenon that can produce greatly enhanced overpressure 

due to sonic velocity gradients with respect to altitude.

Endoatmospheric: Within the Earth’s atmosphere; generally considered to be those altitudes 

below 100 km. 
Energetic materials: Materials that can burn or explode when subjected to a heat source or 

shock loading. 

Epistemic uncertainty: The kind of uncertainty arising from imperfect knowledge. Epistemic 

uncertainty is also known as incertitude, ignorance, subjective uncertainty, Type II or Type B 

uncertainty, reducible uncertainty, and state-of-knowledge uncertainty. 

Exoatmospheric: Outside the Earth’s atmosphere; generally considered to be those altitudes 

above 100 km. 

Expected casualties: The mean number of casualties predicted to occur as a result of an 

operation if the operation were to be repeated many times. This risk is expressed with the 

following notation: 1E-7 = 10-7 = 1 in ten million. 

Expected fatalities: The mean number of fatalities predicted to occur as a result of an operation 

if the operation were to be repeated many times. This risk is expressed with the following 

notation: 1E-7 = 10-7 = 1 in ten million. 

Explosive yield: The energetic yield of a given quantity of explosive material, such as solid 

propellant. It is generally expressed in terms of equivalent weight of TNT since the energetic 

yield of TNT (defined by the overpressures and temperatures created) is well documented). 

Failure modes: How a vehicle, system or component might fail. 

Far-field overpressure: An overpressure occurring at a significant 

distance from an explosion that may be enhanced by atmospheric effects. 

Fatal injury: any injury that results in death within 30 days of the accident.

Fragmentation: The break up of an in-flight vehicle into fragments (components of the vehicle, 

pieces of the structure, chunks of solid propellant, miscellaneous hardware, etc.) due to explosive 

loads, aerodynamic and inertial loads, activation of a flight termination system, intercept with 

another vehicle, or impact on a surface. 

Federal Tort Claims Act: A statute that limits federal sovereign immunity and allows recovery 

in federal court for tort damages caused by federal employees, but only if the law of the state 

where the injury occurred would hold a private person liable for the injury 28 USCA 2671-2680. 

Also FTCA. 

Fidelity: The accuracy of the representation when compared to the real world. 

Flight commit criteria: See Launch Commit Criteria

Flight Safety System (FSS): Includes airborne and ground safety systems, tracking safety 

system, and telemetry data transmission systems that must meet flight safety and customer 
requirements, as well as established reliability and single point failure requirements (See also 

Flight Termination System and Range Safety System).

Flight Termination System (FTS): The airborne portion of the Flight Safety System. A flight 

termination system ends the flight of a vehicle and consists of the entire system on an airborne 

vehicle used to receive, decode, and execute a flight termination (this includes ADS, ISDS and 

ground command signals). It includes all wiring, power systems, and methods or devices 

(including inadvertent separation destruct systems) used to terminate flight (See also Flight 

Safety System and Range Safety System).

Focus factor: The ratio produced by dividing the peak incident overpressure experienced under 

actual atmospheric conditions by the peak incident overpressure predicted under standard 

atmospheric conditions without winds. 

Generalized Energy Management Steering (GEMS): Boost velocity control is achieved by 

burning all boost propulsion stages to burnout, shaping the trajectory to use all the energy, 

without thrust termination. 

General public: All people not declared mission essential or critical operations personnel. This 

includes the public plus range personnel not essential to a mission, visitors, press, and 

personnel/dependents living on the base/facility. 

Handover: The transfer of flight safety control of a vehicle from one range safety System to 

another. Control may be transferred manually by the Range Safety Officer or automatically 

based on achieving some predetermined conditions.

Hazard: Any real or potential condition that can cause injury, illness, or death of personnel, or 

damage to or loss of equipment or property.

Hazard threshold: The lowest level at which adverse outcomes are expected to appear. 

Hazard area: A geographical or geometrical surface area that is susceptible to a hazard from a 

planned event or unplanned malfunction. 

Hazard volume: A geographical or geometrical volume of airspace that is susceptible to a 

hazard from a planned event or unplanned malfunction. 

Hazardous operation: Thos activities which, by their nature, expose personnel or property to 

dangers not normally experienced in day-to-day actions. 

Hot trajectory: The vehicle follows the planned profile but, due to higher than expected 

performance (thrust) from its motors, arrives at the various points in the profile early. This can 

also be described as flying further downrange and moving faster than nominal predictions at any 

given time in flight. 
Hydrocode: A computational tool capable of modeling the behavior of continuous media over a 

wide range of speeds. It can also be adapted to treat material strength and a range of rheological 

models for material behavior. It considers the effects of external and internal forces on a 

predefined mesh of cells which represent the system being studied. It assumes that over a short 

period of time these forces are constant, and uses them to adjust the geometry of the mesh 

accordingly. The forces are then recalculated and the process repeats until the required solution 

is found. 

Immediately dangerous to life and health (IDLH): The maximum level to which a healthy 

individual can be exposed to a chemical for 30 minutes and escape without suffering irreversible 

health effects or impairing symptoms. Used as a "level of concern" (See: level of concern).

Impact: The impingement of a fragment on a surface, a structure, a person or a vehicle. 

Inadvertent Separation Destruct System (ISDS): a specialized form of ADS located on 

vehicle components that automatically activates when inadvertent separation of the component 

from the main vehicle is sensed. There is often a built-in delay included, in hope that the 

separated component will be sufficiently displaced at charge activation to preclude damage to 

the main vehicle.

Individual risk: Individual risk is the risk that a person will suffer a consequence. Unless 

otherwise noted, individual risk is expressed as the probability that an individual will become a 

casualty due to all hazards (PC) from an operation at a specific location. Guidance Information. 

If each person in a group is subject to the same individual risk, then the collective risk may be 

computed as the individual risk multiplied by the number of people in the group. In the context 

of this document, individual risk refers to the probability that the exposed individual will 

become a casualty as a result of all hazards from a mission.

Informed decision: The “informed decision” principle is used in tort claims against the U.S. 

Government. The Federal Tort Claims Act (FTCA) enjoins the U.S. court system from secondguessing decisions made by properly authorized government officials in determining the 

acceptability of operational risks. A key test under the FTCA requires that the decision-making 

official be fully advised and informed of the known risks. Failure to fully advise the decisionmaking authority of known risks can result in liability of the U.S. Government or its officials. 

Involuntary activity: No choice was made by the person affected which placed them in a 

position of increased risk; or the activity participated in or the item used was one that is 

generally done or used by more than 99 percent of the population. Examples: bathing, using 

coins or drinking glasses. 

Launch commit criteria: Hazardous or safety critical parameters, including, but not limited to, 

those associated with the launch vehicle, payload, ground support equipment, flight safety 

system, hazardous area clearance requirements, and meteorological conditions that must be 

within defined limits to ensure that public, launch area, and launch complex safety can be 

maintained during a launch operation. 
Launch Wait: A specified launch window period during which a range or range user shall not 

initiate flight in order to prevent collisions with on orbit manned objects or other protected 

orbital object. 

Level of Concern: The concentration in air of an extremely hazardous substance above which 

there may be serious immediate health effects to anyone exposed to it for short periods. 

Lofted trajectory: The actual trajectory profile is higher (lofted) than expected.

Manned spacecraft: a spacecraft that is either currently occupied or intended to be occupied. 

Includes spacecraft en route to, and in support of, manned missions. 

Maxwellian distribution: A one-dimensional probability density function defined by a single 

parameter. 

Mishap: An unplanned event or series of events resulting in death, injury, occupational illness, 

or damage to or loss of equipment or property or damage to the environment. 

Mission: A flight test or operation. It may include multiple vehicles or all phases of the flight 

beginning with liftoff/launch. See Supplement paragraph 4.2.4 for details on defining a mission 

for risk assessment. 

Mission essential: Those persons and assets necessary to safely and successfully complete a 

specific hazardous operation or launch.

Mission rules: Rules that define safety constraints and conditions and establish the boundaries 

within which the safety team operates. The lead safety organization develops the mission rules 

and briefs the range user to ensure a complete understanding of the intent and application of 

them. Mission rules are documented and become part of the range safety plan.

Monte Carlo analysis: 1. A numerical analysis method that uses repeated sampling of random 

values from known (or postulated) distributions to estimate an unknown distribution.

Nominal Ocular Hazard Distance (NOHD): The distance along the axis of the laser beam 

beyond which the irradiance (W/cm2

) or radiant exposure (J/cm2) is not expected to exceed the 

appropriate maximum permissible exposure; that is, the safe distance from the laser. 

Outrage factor: The components of outrage regarding public perception of imposed risk.; i.e. Is 

the risk voluntary? Is the risk fair? Is the risk familiar? Who has control of the risk? Is the 

responsible party open and responsive? etc. 

Overpressure: The pressure caused by an explosion over and above normal atmospheric 

pressure. It can be significantly affected by the atmospheric conditions, particularly the 

temperature and wind profiles. 
Probabilistic modeling: A process that employs statistical principles and the laws of 

probability to quantify the variability and uncertainty in a quantity. The results of probabilistic 

models typically express the ratio of the outcomes that would produce a given event to the total 

number of possible outcomes.

Probability of casualty: The likelihood that a person will suffer a serious injury or worse, 

including a fatal injury, from a hazardous event. This risk is expressed with the following 

notation: 1E-7 = 10-7 = 1 in ten million. 

Probability of fatality: The likelihood that a person will die from a hazardous event. This risk 

is expressed with the following notation: 1E-7 = 10-7 = 1 in ten million. 

Prudent person: See Reasonable Person 

Q-Alpha: The product of the dynamic pressure and the angle-of-attack for an in-flight vehicle. 

The dynamic pressure is a function of the velocity of the vehicle relative to the air mass and the 

local density of the atmosphere (1/2 * density * velocity2

). In still air, the angle of attack is 

usually the angle between the longitudinal axis of the vehicle and the velocity vector of the 

vehicle. 

Range Safety Officer (RSO): Range Safety Officer is a generic term used in this document to 

designate the individual or individuals responsible for making range safety decisions, 

particularly flight termination decisions. During real-time, the RSO is delegated the authority to 

execute the range Commander’s range safety policies and has sole responsibility for making 

range safety decisions. Other commonly used designations include Missile Flight Safety Officer 

(MFSO) and Missile Flight Control Officer (MFCO). 

Range Safety System (RSS): The ground-based portion of the Flight Safety System. An 

integrated system of hardware, software, and human operators which is necessary to provide 

mission safety support. Includes instrumentation and communication infrastructure needed to 

fulfill safety’s flight control responsibility. See also Flight Safety System and Flight Termination 

System

Reasonable care: As a test of liability for negligence, the degree of care that a prudent and 

competent person engaged in the same line of business or endeavor would exercise under similar 

circumstances - Also termed due care; ordinary care; adequate care; proper care. 

Reasonable person: A hypothetical person used as a legal standard, especially to determine if 

someone acted with negligence. The reasonable person acts sensibly, does things without 

serious delay, and takes proper but not excessive precautions. Also termed Reasonable Man or 

Prudent Person. 

Reasonableness: An EPA TCCR principle of uncertainty characterization; the assessment is 

based on sound judgment. The components of the risk characterization are well integrated into 

an overall conclusion of risk which is complete, informative, well balanced and useful for 

decision making. The characterization is based on the best available scientific information. The 
policy judgments required to carry out the risk analyses use common sense given the statutory 

requirements and guidance from higher authority. Appropriate plausible alternative estimates of 

risk under various candidate risk management alternatives are identified and explained. 

Reentry: The event occurring when a spacecraft or other object comes back into the sensible 

atmosphere after going to higher altitudes.

Residual mishap risk: The risk that remains after all approved mitigations have been 

implemented. 

Risk: Risk is a measure that accounts for both the probability of occurrence and the 

consequence of a hazard to a population or installation. Unless otherwise noted, risk to people is 

measured in casualties and expressed as individual risk or collective risk.

Risk analysis: A study of potential risk under a given set of conditions. Risk Analysis is an 

activity that includes the complete array of tasks from data gathering, identification of hazards, 

estimation of associated risks, and verification of results.

Risk management: Risk management is a systematic and logical process to identify hazards 

and control the risk they pose. 

Risk profile: A plot that shows the probability of an accident causing a given number of 

casualties (vertical axis) vs. the number of casualties (horizontal axis). The area under the plot is 

a measure of the casualty expectation. When a catastrophe-averse function is plotted on the 

same graph, the presence or absence of catastrophic risk is indicated.

Safety: Relative protection from adverse consequences.

Sensitivity: The degree to which the model outputs are affected by changes in a selected input 

parameter. 

Sensitivity analysis: The computation of the effect of changes in input values or assumptions 

(including boundaries and model function form) on the outputs. The study of how uncertainty in 

a model output can be systematically apportioned to different sources of uncertainty in the model 

input. By investigating the “relative sensitivity” of model parameters, a user can become 

knowledgeable of the relative importance of parameters in the model.

Serious injury: Any injury that: (1) requires hospitalization for more than 48 hours, 

commencing within 7 days from the date the injury was received; (2) results in a fracture of any 

bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, 

muscle, or tendon damage; (4) involves any internal organ; or (5) involves second- or thirddegree burns, or any burns affecting more than 5 percent of the body surface.

Ship Accident: A “ship accident” occurs if the vessel is involved in an accident that results in 

loss of life, personal injury which requires medical treatment beyond first aid, or complete loss 
of the vessel. This definition is consistent with the level of protection afforded people involved 

in a “boat accident” as defined in current regulations. 

Sigma: Standard deviation. 

Spacecraft Critical Cross Sectional Area: The maximum cross sectional area of vulnerable 

surfaces of a manned spacecraft in the direction that the spacecraft is traveling. 

Spacecraft Vulnerable Area: The entire surface area of a manned spacecraft that would hazard 

human life if any portion of it was breached. For a cylindrical shaped spacecraft the vulnerable 

area would be the surface area of the cylinder rather than its cross sectional area or projected 

area to a debris density flux. 

Statistical risk management: Risk management that makes use of probabilistic modeling, 

formal risk analyses, and risk acceptability criteria. 

Substantial damage: Relating to aircraft vulnerability means damage or failure that adversely 

affects the structural strength, performance, or flight characteristics of the aircraft, and that 

would normally require major repair or replacement of the affected component. 

Susceptibility: The quality or state of being open, subject or unresistant to some stimulus, 

influence or agency.

TCCR: EPA principles of uncertainty characterization; see Transparency, Clarity, Consistency, 

and Reasonableness. 

TNT equivalent: The explosive yield of a material expressed in terms of the weight of 

trinitrotoluene (TNT) that will produce an essentially equivalent yield. TNT equivalent, or 

“TNT equivalency”, is used to characterize explosions since the overpressures and temperatures 

produced by TNT are well documented.

Toxic hazard area: A generic term that describes an area in which predicted concentration of 

propellant or toxic byproduct vapors or aerosols may exceed acceptable tier levels; predictions 

are based on an analysis of potential source strength, applicable exposure limit, and prevailing 

meteorological conditions; toxic hazard areas are plotted for potential, planned, and unplanned 

propellant releases and launch operations. 

Toxic release hazard analysis: Analysis to ensure people are not exposed to concentration 

thresholds for each toxicant involved in a launch or in the event of a flight mishap. Results are 

used to establish flight commit criteria that protect people from a toxic release casualty. 

Toxicant: A substance that can cause death, disease, behavioral abnormalities, cancer, genetic 

mutations, physiological or reproductive malfunctions, or physical deformities in any organism 

or its offspring. The quantities and length of exposure necessary to cause these effects can vary 

widely. See also Toxic Substance 
Toxic substance: A chemical or mixture that may present an unreasonable risk of injury to 

health or the environment. See also Toxicant 

Toxics: A Generic term for the toxic propellants and combustion by-products resulting from a 

nominal launch vehicle flight or catastrophic launch abort. 

Transparency: An EPA TCCR principle of uncertainty characterization; explicitness in the 

risk assessment process. It ensures any reader understands all the steps, logic, key assumptions, 

limitations, and decisions in the risk assessment, and comprehends the supporting rationale that 

leads to the outcome. 

Uncertainty: The absence of perfectly detailed knowledge. Uncertainty includes incertitude 

(the exact value is unknown) and variability (the value is changing). Uncertainty may also 

include other forms such as vagueness, ambiguity, and fuzziness (in the sense of border-line 

cases).

Uncertainty analysis: An investigation of the effects of lack of knowledge or potential errors 

on the model and when conducted in combination with a sensitivity analysis allows a model user 

to be more informed about the confidence that can be placed on model results.

Validation: refers to the set of activities that ensure that the software that has been built is 

traceable to customer requirements. The validation process determines whether the 

mathematical model being used accurately represents the phenomenon being modeled and to 

what degree of accuracy. This process ensures that the simulation adequately represents the 

appropriate physics by comparing the output of a simulation with data gathered in experiments 

and quantifying the uncertainties in both. 

Variability: Observed differences attributable to true heterogeneity or diversity. Variability is 

the result of natural random processes and is usually not reducible by further measurement or 

study (although it can be better characterized). 

Verification: refers to the set of activities that ensure that software correctly implements a 

specific function. The verification process determines whether a computer simulation code for a 

particular problem accurately represents the solutions of the mathematical model. Evidence is 

collected to ascertain whether the numerical model is being solved correctly. This process 

ensures that sound software-quality practices are used and the software codes themselves are free 

of defects and errors. It also checks that the code is correctly solving the mathematical equations 

in the algorithms and verifies that the time and space steps or zones chosen for the mathematical 

model are sufficiently resolved. 

Voluntary activity: The person affected made a choice which placed them in an increased 

position of risk compared to the rest of the population. This includes career and job choices. 

Examples: repetitive motion injuries, recreational boating, etc. 

Vulnerability relationship: A model of the relation of hazard level compared to the probability 

or degree of an adverse outcome. 
Worst-case: A semi-quantitative term referring to the maximum possible exposure, dose, or 

risk, that can conceivably occur, whether or not this exposure, dose, or risk actually occurs in a 

specific population. 

***** NOTHING FOLLOWS *****