Subject: EXPECTED CASUALTY CALCULATIONS 

FOR COMMERCIAL SPACE LAUNCH AND 

REENTRY MISSIONS

Date: August 30, 2000 

Initiated By: AST-1

AC No: 431.35-1

Change:

1. PURPOSE. This advisory circular provides an acceptable 

methodology for estimating the value, or upper limit of 

the value, of Expected Casualty Ec for commercial space 

launch and reentry missions. 

2. BACKGROUND. The FAA Office of the Associate 

Administrator for Commercial Space Transportation (AST) 

is responsible for licensing commercial space launch and 

reentry (return from Earth orbit or outer space) 

operations. A principal objective of the licensing 

process is to limit risk to public health and safety, and 

safety of property, and to protect national security and 

foreign policy interests of the United States. Sections 

415, 431 and 435 establish that, to be eligible for 

licensing, the launch of a launch vehicle (415.35(a)), 

the launch and reentry of a reusable launch vehicle 

(431.35(b)), or the reentry of a reentry mission (435.35)

shall not exceed an expected average number of 0.00003 

casualties per mission (Ec < 30 X 10-6). The purpose of 

the requirement is to ensure that risks to public safety 

presented by launch and reentry operations is limited to 

an acceptable level, defined in a manner consistent with 

acceptable launch risk at national ranges administered by 

the Air Force. 

In summary, a license applicant is in compliance with 

sections 415.35(a), 431.35(b) or 435.35 if its expected 

casualty calculation utilizes the methodologies and 

procedures detailed in this advisory and yields an Ec of 

less than or equal to 0.00003. For further information: 

Ronald Gress, Manager, Licensing and Safety Division, 

(202) 267-8602. 
2

3. DISCUSSION. Expected casualty is used in the space 

transportation industry as a measure of risk to public 

safety from a specific mission, and is one of the factors 

typically used within the U.S. Government to determine if 

a mission may proceed or a license may be granted. 

Expected casualty is the expected average number of human 

casualties per commercial space mission. Human casualty 

is defined as a fatality or serious injury. For the 

purpose of this advisory circular, a human casualty is 

considered to be any human contact with a piece of 

vehicle debris that can cause injury or exposure to 

explosive overpressure of 3.5 pounds per square inch 

(psi) or greater. Note: 3.5 psi is the level that will 

cause eardrum damage to 1% of the exposed population. 

Reference DOD 6055.9-STD, DOD Ammunition and Explosive 

Safety Standards, August, 1997. Another way of 

expressing the measure of expected casualty is that if 

thousands of identical missions were conducted and all 

the casualties that resulted were added up and the sum 

divided by the number of missions, the actual casualties 

and the expected casualties per mission should ideally be 

the same. 

For the purpose of this advisory circular, a mission 

includes all licensed flight segments throughout the 

mission. If there are activities that occur on orbit 

that are not conducted under a license, these segments, 

or phases, are not included in the mission. For example, 

a sub-orbital mission might include launch, stage 

separations, stage ignitions and payload landing or 

recovery. An orbital mission of an expendable launch 

vehicle (ELV) might include vehicle launch, multiple 

booster stage separations, stage ignitions, booster stage 

recovery, and payload insertion into orbit. (Note: The 

reentry of orbiting stages of an ELV is not a licensed 

activity and while vehicle orbiting stages and payloads 

eventually reenter the Earth’s atmosphere they are not 

usually designed to survive reentry and most components 

burn up before reaching the Earth’s surface. Therefore 

public risk from ELV reentry stages is very small.) A 

mission involving a reusable launch vehicle (RLV) might 

include launch vehicle takeoff, stage separation and 
3

launch vehicle recovery, ascent of upper stages to orbit, 

payload separation, reentry of the vehicle upper stage 

from orbit and its recovery or landing. RLV missions may 

include contingency or emergency abort scenarios, use of 

alternate recovery sites or flight termination events.

In order to explain the basic methodology, this advisory 

circular uses simplified examples. The number of 

possible events and inputs are selected to allow the 

reader to focus on the process, rather than on the large 

number of events and situations that may actually need to 

be considered, in performing a specific Ec analysis. 

Actual analyses are generally far more extensive, yet all 

utilize the basics described in this document.

The methodology described here provides acceptable 

approaches. However, the user is cautioned that the 

applicant is responsible for demonstrating that the 

inputs to the formula and assumptions made are 

appropriate for the situation being addressed. Advisory 

Circular 431.35-2, Reusable Launch Vehicle System Safety 

Process, provides guidance on the types of analyses which 

would support the development of some of the data, such 

as failure modes, used in the calculation of Ec. 

3.1 Overview of Expected Casualty. Risk is defined by 

the safety community as the product of the probability of 

occurrence of an event and the consequences of that 

event. If there is more than one possible event, total 

risk is the sum over all possible events of the products 

of the probability of each event and its associated 

consequence. While the probability of an event is always 

between zero and one, the consequences of that event can 

be any value. For risk, the larger the value the greater 

the risk. Risk can be relatively high if the probability 

is high and can be high if the consequence is great even 

if the probability is low. Risk can be lowered by 

reducing the probability of an event occurring or by 

reducing the consequences of an event. For example, a 

highly reliable system will increase the probability of 

success and lower risk. Planning a mission that avoids 

flight operations over populated areas will decrease or 

eliminate consequences of human casualties and thereby 

reduce the risk measure of Ec. 

Expected casualty for a mission measures the public 

safety risk of conducting the mission and includes all 
4

contributions to risk as a result of the mission. Ec is 

expressed as the summation over the mission of the 

products of the probability of each possible event and 

the casualty consequences of each possible event. 

Casualty consequence is expressed as the product of the 

casualty area of debris (see 3.2.2) and the population 

density of the area at risk. The basic equation is:

 n

 Ec = S Pi x Aci x Dpi

 

i=1

where:

 n = the number of possible different events,

 Pi = probability of occurrence of the ith event,

 Aci = the casualty area of impacting debris for 

 the ith event, and

 Dpi = the population density of the area at risk

 for the ith event.

Ec is the sum of the expected casualties calculated for 

each possible mission event. Acceptable Ec is limited to 

thirty expected casualties per million missions (i.e., 

maximum Ec for a mission is less than .00003) for AST 

licensed missions. This standard reflects the FAA’s 

determination that the public will be protected from 

licensed commercial space missions such that risk 

confronting the public from a commercial space launch and 

reentry mission is significantly less than the average 

background risk experienced by the general public in 

daily activities. The 30 x 10-6 risk level is consistent 

with launch standards currently used at federal ranges 

(reference: Eastern and Western Range 127-1 Range Safety 

Requirements, Sec. 1.4(d), March 31, 1995). 

In order to compare expected casualty with voluntary 

annual individual risk, the expected casualty, which is a 

collective risk, must be converted to annual individual 

risk. For example, a collective risk of 30 x 10-6 for a 

defined population of one hundred thousand people exposed 

to a single launch results in a probability of injury or 

death to a single exposed individual of 3 x 10-10. If 

there were one hundred launches per year, annual 

individual risk would be 3 x 10-8. The U.S. annual 

individual probability of fatality due to a non-
5

occupational accident has been estimated as 2 x 10-4

(reference: Report No. 97/350-2.1-01, Acceptable Risk 

Criteria for Launches from National Ranges: Rationale, 

ACTA, for the Department of the Air Force, 30th and 45th

Space Wings, September, 30, 1997). For the same defined 

population of one hundred thousand, there would be .003 

casualties from commercial space operations and 20.0 

fatalities from non-occupational accidents expected per 

year. Thus, the risk to the public from commercial space 

operations is several orders of magnitude less than the 

risk of fatality from accidents. It is noted that

expected casualty is defined as a fatality or serious 

injury while the comparison statistics measure fatalities 

only.

Inputs to the Ec analysis should consider all reasonable 

mission scenarios that may result in a public casualty. 

An Ec value of 30 x 10

-6 (or .00003) reflects an upper 

limit on allowable expected casualties. Because of this, 

the applicant need only demonstrate that the true value 

of Ec is less than the threshold and need not necessarily 

determine the precise value of Ec. Therefore, use of 

conservative assumptions with respect to the calculation 

inputs will ensure that Ec limitations are not exceeded. 

The system safety process used to identify and manage 

risk and the Ec methodology work together to achieve a 

level of safety. The system safety process is used to 

identify failure modes, their probability of occurrence 

(Pi) and associated consequences of commercial space 

missions. The system safety process (see Advisory 

Circular AC 431-01), as illustrated in the following 

chart, will evaluate risk to the public from planned 

trajectories and sequence of events as well as unplanned 

variances to the nominal mission. These factors are 

critical to the determination of risk and Ec. If risk is 

too large additional mitigation measures will be 

necessary to achieve safety.
6

Under the Ec methodology, the vehicle breakup 

characteristics are identified and the casualty area (Ac) 

calculated. Contributing factors to Ac include: human 

exposure to debris and the debris size, weight, velocity 

components, ballistic coefficients (weight/maximum crosssectional area of a piece of debris), kinetic energy, 

impact, bounce, slide and fragmentation characteristics 

of that debris, as well as any explosive properties the 

debris might have. 

Finally population density (Dp) profiles for the areas at 

risk must be determined and factored into the expected 

casualty calculations. 

In summary, because risk is the product of probability 

and consequence, several options are available to the 

applicant that will enable compliance with the Ec limit of 

thirty casualties per million missions. Reducing the 

system probability of failure is normally achieved by a 

rigorous design, development and test process coupled 

with successful operational experience and continuous 

system improvement. Management planning for safety and 

reliability early in the development process will 

minimize the likelihood of various failure modes and thus 

reduce casualty expectations and provide enhanced 

operational flexibility. Reducing the consequences of 

mission or vehicle failure is most directly achieved by 

avoiding operations over or near populated areas. The 

applicant may be expected to implement additional risk 

reduction measures as needed to satisfy the Ec standard. 

These include but are not limited to operational 

procedure changes, system redesign, material, software 
7

and launch or recovery site changes. 

3.2 Elements of Ec. The following is a more detailed 

discussion of the meaning of each of the elements of the 

expected casualty calculation formula and provides an 

acceptable methodology as to how they are to be derived. 

3.2.1 Probability of Failure. An applicant identifies 

mission scenarios and the failure modes that present risk 

to the public. 

Example: a vehicle loses guidance control and breaks up 

during flight over a populated area. 

System safety engineering methods (See Advisory Circular 

431.35-2), such as failure modes and effects and fault 

tree type analyses are used to determine which modes 

present a hazard to the public and the probability (Pi) of 

their occurrence. The probability calculations should 

account for all possible outcomes. That is, the sum of 

all probabilities for a mission must equal one. In the 

simplest terms; P(success) + P(failure) = 1.0.

In this context, P(success) is associated with zero 

consequences (i.e., P(success) x 0.0 = 0.0), and a successful 

mission or successful mission abort will contribute 

nothing to the expected casualty calculations. 

On the other hand, P(failure) must usually be broken down by 

the nature of the failure (e.g., does vehicle break up or 

remain intact)and the location of the vehicle at the time 

of failure. For example, if the failure is an explosion 

soon after launch the amount of impacting debris may be 

at a maximum because the bulk of the propellant has not 

been burned and early boost stages, if any, have not been 

safely jettisoned. This may be contrasted with an out of 

control ballistic reentry of a single stage vehicle with 

no propellant or hazardous material on board. The latter 

scenario would involve minimal debris generation. Also, 

the location along the flight path will determine the 

population at risk (see Section 3.2.3 Population Density) 

from any falling debris resulting from vehicle failure. 

This may be particularly important when areas of 

drastically different homogeneous population density 

require separate assessments of the likelihood of events 

exposing each area. 
8

For some vehicles, it may be appropriate to look at each 

second of flight, as each second may result in different 

amounts of debris and debris characteristics. The 

applicant may need to recognize that population 

characteristics of the debris footprint may change from 

second to second. It is also not unusual for there to be 

different possible failure modes at the same time with 

separate probabilities of occurrence, each resulting in 

different debris characteristics (e.g., explosion or 

thrust failure). Here the applicant may have an 

opportunity to simplify the problem by assuming the total 

failure likelihood at each time step in the flight and 

the worst debris characteristics for all failure modes. 

Such an assumption would result in a conservative 

estimation of Ec. 

For other vehicles, particular points or events along the 

flight path may have greater likelihood of failure, such 

as stage separations or stage ignitions. Some vehicles 

may have systems intended to detect problems and take 

steps to avoid or mitigate the consequences. However, 

not all system failures may be detected and the 

consequences of some failures may not be mitigated even 

if detected. Thus the distribution of failure 

probability may be made up of a combination of distinct 

events and uniform distributions. Once again, all 

probabilities for failure events should add to the 

overall failure probability of the vehicle and the sum of 

all probabilities of all events (failures and success) 

should add to 1.0.

Not all outcomes contribute to Ec. For example, a 

successful mission, a successful contingency abort or 

emergency abort that does not jeopardize public health or 

safety, and vehicle failure modes occurring during 

segments of flight over unpopulated areas do not 

contribute to casualty expectation. 

To illustrate the concept of probability of failure 

events as applied to commercial space operations, 

consider an extremely simple example: the launch of a two 

stage vehicle where a reusable second stage delivers a 

payload to orbit, reenters the atmosphere and performs a 

controlled landing at a remote site. In a nominal 

mission, the first stage is jettisoned over an 

unpopulated area five minutes after launch and the second 

stage attains orbit ten minutes later. Landing occurs 30 
9

minutes after reentry initiation. If an emergency 

develops during first stage boost, the vehicle has the 

capability to abort by jettisoning the first stage and 

returning the second stage to an alternate landing site. 

The second stage boost phase may also be aborted by 

terminating thrust and maneuvering to an alternate 

landing site or in some circumstances aborting to orbit. 

Extensive design and systems analyses have been performed 

as well as Failure Modes and Effects Analyses and Fault 

Tree Analyses as part of the Systems Safety Process (see 

AC 431.35-2). Based on these analyses and some empirical 

data, the vehicle has a 90% probability of success, a 9% 

probability of mission failure and a 1% probability of 

mission abort. Note that in this example successful 

mission aborts do not necessarily contribute to expected 

casualty and will therefore be treated separately. 

Assume that analysis and testing determined that the 

failure probability is distributed such that .05 of the 

failure probability is during the first stage boost, .03 

is during second stage boost and .01 is during reentry. 

(Note: an example where there is a probability of failure 

on-orbit such that reentry is not or cannot be attempted 

is presented later in this document). If there is no 

indication of specific points or events in the mission 

(e.g., stage ignition) having a different probability of 

failure with respect to any other point of time in the 

mission, spreading the failure and abort probabilities 

uniformly over the mission yields:

 3 

 P(failure) = Σ P(failure per event)

 

i=1

 = .05(first stage boost) + 

 .03(second stage boost) +

 .01(reentry) 

 = .09

 P(abort) = .01

Breaking these down into one second intervals yields:

 Pf(1st stage) / second = .05 / 300sec = 1.667 x 10-

4/sec

 

 Pf(2nd stage) / second = .03 / 600sec = 0.5 x 10-4/sec

 Pf(reentry) / second = .01 / 1800sec = 5.56 x 10-
10

6/sec

 P(abort) / second = .01 / 2700sec = 3.70 x 10-6/sec.

Note that multiplying the time in each phase by its Pf and 

summing the product yields Pf = 0.09 for the 2700 second 

mission. 

Uniformly distributing the probability of failure over 

the 2700 seconds of the mission yields a probability of 

failure per second of:

 Pf(mission) / second = 0.09 / 2700sec = 0.33 x 10-

4/sec.

Note that in either case the total probability of failure 

over the 2700 second (45 minutes) mission is 0.09, and as 

noted earlier:

 

 P(total) = Ps(.9) + Pf(.09) + Pa(.01) = 1.0.

In reality, probability of catastrophic failure may not 

be uniformly distributed during the flight and the 

analysis must consider the actual probability 

distribution over the mission. Normally the probability 

of failure is greater during periods of powered flight or

discrete events such as stage ignition or separation. In 

these circumstances uniform distribution of failure 

probability is inappropriate. 

 

3.2.2 Casualty Area. The next step is the determination 

of casualty area during each step of the mission. The Ac

is the aggregate casualty area of each piece of debris 

created by a vehicle failure at a particular point on its 

trajectory. The casualty area for each piece of debris 

is the area within which 100 percent of the unprotected 

population on the ground is assumed to be a casualty. 

Some debris will not cause casualties and therefore will 

not contribute to casualty area. For example fragments 

with low ballistic coefficients (small light pieces)or 

those with low kinetic energy (less than 58 ft-lb has 

been used) will not be expected to cause casualties. 

(Note: The effects of sheltering (e.g., people in 

structures etc.) typically reduce the number of 

casualties and can be examined. However, applying 

assumptions of this nature requires considerably more 

analysis and supporting documentation in order to 
11

demonstrate that the treatment is appropriate.) The 

casualty area is based on the characteristics of the 

debris piece including its size, the path angle of its 

trajectory, impact explosion, skip, splatter, and bounce 

as well as the size of a person. Debris may be created 

by planned stage jettison operations, vehicle breakup due 

to aerodynamic overload, in flight explosion or other 

failure modes. The characteristics of debris at any 

given time in flight may also depend on the failure mode. 

Major factors in assessing debris hazards include: the 

number, weight and size of the fragments, where they will 

land, each impacting fragment’s energy and velocity 

vector; whether the fragment is inert or explosive. 

The first step in the determination of casualty area is a 

vehicle debris or breakup analysis. The analysis will 

provide debris lists for all potential failure modes 

throughout the course of the planned mission. These 

lists are intended to estimate the immediate post breakup 

environment of the malfunctioned vehicle, the fragment 

characteristics over time through impact and the public 

safety risk resulting from the fragments upon impact. 

Factors to be considered in the breakup analysis 

typically include, but may not be limited to: 

 (1) Casualty area from debris, explosive forces and 

other hazards of impact of the intact vehicle versus 

failure time where breakup is a possible failure mode; 

 (2) Fragments and components (inert and explosive) 

produced upon vehicle breakup that impact the Earth due 

to each failure mode. (Fragments may be categorized into 

classes, so that the hazards associated with the “mean” 

piece in each class adequately represent the hazards for 

every piece in the class. The number of pieces in the 

class and “mean” piece should be identified.);

 (3) Quantities of confined and unconfined propellant 

chunks and fueled components that will impact, as a 

function of vehicle malfunction time, and;

 (4) Probability and TNT equivalency of impact 

explosions and numbers of fragments projected from each 

vehicle failure mode, as function of vehicle time into 

flight the malfunction (failure mode) occurs. 

These types of breakup analyses have been common practice 

in the launch vehicle industry and are based upon prior 

experience, empirical data, structural analysis, system 

safety methodologies and engineering judgment.

The applicant should ensure that the major portion of the 
12

vehicle by mass has been accounted for. As mentioned 

above, not all fragments will contribute to casualty 

area. Pieces with low kinetic energy, pieces with low 

ballistic coefficients and pieces of propellant that burn 

or vaporize before impact would not be likely to cause a 

casualty. 

3.2.2.1 Inert Debris. The casualty area of a vertically 

falling inert piece of debris is a circle whose radius is 

the sum of the radius of a circle with area equal to the 

largest cross sectional area of the piece and the radius 

of a human being (1.0 ft). This is illustrated in figure 

1. Note that for Ac calculations, an acceptable dimension 

for a human is a 6 ft tall cylinder with a 1 ft radius. 

To this, add the effects of any horizontal velocity 

component (such as wind or trajectory angles) to 

calculate the basic casualty area. The equation for 

basic casualty area is:

Ac(basic) = 2[r(p) + r(f)]d + π[r(p) + r(f)]2

 Where: r(p) = radius of person (1 ft)

 r(f) = radius of the fragment

 d = (height of person (6 ft)) / tangent(impact 
13

angle)

The basic casualty area is illustrated in figure 2. Note 

that ‘d’ is the horizontal distance that the debris 

travels as it falls the height of a person (6 ft) and the 

impact angle is the angle that the velocity vector makes 

with the horizontal plane or surface impacted.

Adjustments to account for other effects that may 

increase casualty area would then be made. Among the 

effects to be considered are: area increases due to the 

impacting debris tendency to slide, skid, bounce, 

ricochet or splatter. Pieces of debris may slide or skid 

after impact adding to the casualty area as a function of 

horizontal velocity and the coefficient of friction of 

the impacted surface. Debris that remains essentially 

intact may bounce or ricochet along the impacted surface 

and also add to effective casualty area. If an inert 

vehicle piece or component impacts an open area, piece 

fragments or chunks of the impacted surface may be 

forcefully projected from the point of impact. For high 

velocity impacts on hard surfaces such as rock or 

concrete, fragments and surface chunks may be thrown 

considerable distances. These effects are mutually 

exclusive so the conservative approach is to add the 
14

largest increase to the basic casualty area to determine 

the composite casualty area for each piece of debris. 

Reference "Casualty Areas from Impacting Inert Debris for 

People in the Open", Research Triangle Institute Report 

No. RTI/5180/60-31F dated April 13, 1995, for a procedure 

to calculate composite casualty area as well as sample 

casualty area calculations for existing launch vehicles. 

This report is available on AST’s Web Site. Previous 

analysis of various launch vehicles shows that the 

effective casualty area of an inert piece of debris 

represents an increase by a factor of from 1.7 to 7.0 

over basic casualty area when the effects of slide, 

bounce and splatter are accounted for. Originally, basic 

casualty area was multiplied by 1.5 in order to account 

for bounce, skip and splatter. Currently used 

calculation methods give effective casualty areas that 

range from 3.0 to 7.0 times greater that the basic 

casualty area. Therefore, a simple and conservative 

approach in the calculation of the inert portion of Ac is 

to apply a factor of 7.0 to the basic casualty area.

3.2.2.2 Explosive Debris. If the debris may explode on 

impact, equations can be used to calculate effective 

casualty areas based upon equivalent TNT yields. To 

account for explosive contributions to casualty area, the 

propellant or hazardous material is converted to 

equivalent weight of TNT. An acceptable assumption for 

the purposes of Ec calculation is a blast overpressure 

threshold of 3.5 pounds per square inch. A 3.5 psi 

overpressure will result in eardrum damage to 1% of 

exposed (unprotected) population. Overpressures as low 

as 0.5 psi may cause glass breakage that results in 

casualties to building occupants.

The radius of the explosive debris casualty area is 

expressed as an equation of the form:

D = K x W1/3

 Where: D is the distance (ft),

 K is a distance scaling factor (ft/lb1/3), 

and

 W is the net equivalent weight of TNT (lb).

The factor K is derived from scaling laws (reference: 

Chemical Propulsion Information Agency Publication 394, 

Hazards of Chemical Rockets and Propellants, June 30, 

1985). If D1 is the distance from a reference explosion 
15

of W1 lb of material at which a specified overpressure is 

found, then for any explosion of W lb of the same 

material, the same overpressure will occur at a distance 

D such that:

D/D1 = (W/W1)

1/3.

The distance scaling factor K is defined as

K = D/W1/3 (ft/lb1/3).

W is the TNT equivalent weight and D is the distance from 

the center of the explosion at which a specific 

overpressure occurs. In this methodology, the equivalent 

weight of a particular explosive/propellant is the weight 

of TNT required to produce an overpressure of equal 

magnitude produced by a unit weight of the 

explosive/propellant in question. Acceptable K factors 

may be obtained from DOD 6055.9-STD, DOD Ammunition and 

Explosive Safety Standards, August, 1997 or from CPIA 

Publication 394, Hazards of Chemical Rockets and 

Propellants, June 30, 1985. 

The explosive equivalent range for credible TNT yields 

varies from 5 to 50% for LH2/LOX and 18 to 100% for solid 

rocket motors (reference: Hazard Analysis of Commercial 

Space Transportation, OCST-RD-RES01-88, May, 1988). Note 

that the lower bound for these yields is zero since the 

propellants may react or burn without producing

casualties. Acceptable measures of equivalent TNT 

explosive yields for various propellants may be obtained 

from such sources as: 

Farber, E.A. and J.H. Deese, A Systematic approach for 

the Analytical Analysis and Prediction of the Yield from 

Liquid Propellant Explosions, Tech. Paper 347, 

Engineering Progress At the University of Florida, March 

3, 1966,

Kinsel, T.I., Determination of the TNT equivalency of a 

Typical Class 1.1 Solid Rocket Propellant (Blast 

Hazards), AFRPL-TR-80-24, April, 1980,

DOD 6055.9-STD, DOD Ammunition and Explosives Safety 

Standards, August 1997, and
16

Chemical Propulsion Information Agency Publication 394, 

Hazards of Chemical Rockets and Propellants, June 30, 

1985.

3.2.2.3 Total Ac. The contributions of explosive debris 

to casualty area are added to the casualty area 

attributed to inert debris to determine effective 

casualty area Ac. A conservative calculation for Ac would 

utilize the factor of 7.0 applied to the inert debris 

basic casualty area in addition to assuming the maximum 

explosive casualty area for each phase of the mission. 

Conservatively, the effective casualty area may be 

calculated as:

Aci = 7.0 x Aci(inert) + Aci(explosive).

Note: The summation of each casualty area of each 

contributor to inert and explosive debris is a 

conservative approach in that it is assumed that no 

individual debris casualty areas overlap. In actuality, 

individual areas may overlap, thus reducing the total 

effective casualty area. A piece of debris is either 

inert or explosive. If a fragment could be either, the 

larger area should be used.

3.2.2.4 Example Ac calculations. Ac may decrease as the 

mission progresses due to propellant consumption, stage 

separations and payload deliveries. Some vehicles may 

have large effective casualty areas during the early (low 

altitude) launch phase when inert and explosive debris 

contributions are accounted for; while explosive forces 

at a sufficiently high altitude of liquid fueled vehicles 

are not an issue other than that they cause breakup and 

generate debris. A reentry vehicle may not have any 

explosive material remaining that would impact after a 

breakup event and the entire Ac may be composed entirely 

of inert debris. Also the number of fragments of debris 

will depend on the failure mode and the time or phase in 

the mission. It may range from a handful of large pieces 

from a loss of thrust or aerodynamic breakup to several 

thousand pieces resulting from explosion. As an example, 

typical multistage expendable launch vehicle casualty 

areas range from 11,000 ft2 to 20,000 ft2 during the 

launch phase and from 500 ft2 to 2000 ft2 during the late 

ascent phase. Likewise the number of fragments may range 

from a few to several thousand (Reference USDOT Office of 

Commercial Space Transportation, "Baseline Assessment 
17

Eastern Space and Missile Center (ESMC)" September, 

1988).

The following provides a simple example of an acceptable 

Ac calculation: A two stage to orbit vehicle breaks up 

into five inert pieces having basic casualty areas of 10, 

30, 50, 80 and 100 ft2; and three impacting explosive 

pieces of 2, 16 and 54 lbs. Assuming that the TNT 

equivalency of the explosive pieces is 50%, the TNT 

equivalent weights are 1, 8 and 27 lbs respectively. 

Assuming that the debris falls vertically, the basic 

casualty area of the inert debris is equivalent to the 

sum of the basic casualty areas of the inert pieces. 

Therefore:

Ac(inert) = 10.+30.+50.+80.+100. = 270 ft2.

The casualty area is calculated for each explosive piece. 

Ac(explosive) = πD

2

D = KW1/3 and K is 18 for a 3.5 psi overpressure level 

which would harm an exposed person (reference: DOD 

Ammunition and Explosives Safety Standards, DOD 6055.9-

STD, August, 1997). The explosive radii are:

 D1 = 18 x (1)1/3 = 18 ft

 D2 = 18 x (8)1/3 = 36 ft

 D3 = 18 x (27)1/3 = 54 ft, and

 Ac(explosive) = π x (182 +362 +542)

 = 3.14 x 4536.

 = 14243 ft2, and

The basic casualty area of the inert debris is multiplied 

by 7.0, to conservatively account for slide, bounce and 

scatter and then added to the casualty area from the 

explosive debris. The total casualty area is: 

 Ac(total) = 7.0 x Ac(inert) + Ac(explosive)

 = 7.0 x (270) ft2 + 14243 ft2

 = 1890 ft2 + 14243 ft2

 = 16133 ft2.

Assuming the first stage is successfully separated and 

the second stage fails, breaking into four inert pieces 
18

with maximum cross-sectional areas having equivalent 

circular radii of 1, 3, 5 and 10 ft, the inert basic 

casualty area is:

Ac(inert) = π(1 + 1)2 + π(1 + 3)2

 + π(1 + 5)2 + π(1 + 10)2

 = π(4 + 16 + 36 + 121)

 = 556 ft2.

 

Applying the 7.0 factor to conservatively account for 

bounce, skip and splatter, the inert casualty area is:

Ac = 7 X 556 ft2 = 3892 ft2.

An applicant would be responsible for identification of 

debris characteristics and the calculation of Ac for each 

failure mode and time in the mission. Once again, a 

conservative approach to Ac calculation is to apply a 

factor of seven to the basic casualty area of inert 

debris and to add the maximum explosive contribution for 

the vehicle over each mission segment. The applicant may 

make further refinements to the Ac determinations as 

design, test and operational data allow.

3.2.3 Population Density. As noted in section 3.1, 

population density in the affected impact area is 

required to calculate Ec. After the launch and reentry 

trajectory are determined for each mission, those areas 

that can be affected by impacting debris for the all the 

failure modes and time of occurrence are identified. The 

population densities exposed in these areas are 

determined. Acceptable measure of population density 

areas used to perform the Ec analysis is no larger than a 

U.S. census block group for the first 100 nautical miles 

from a launch point and no bigger than a 1 degree 

latitude by 1 degree longitude grid beyond 100 nautical 

miles downrange. If there are different population 

concentrations among a number of areas, it is acceptable 

to assume that the entire larger area has the highest 

population density within that area. This approach is 

conservative because it will overestimate the expected 

casualty while reducing the number of individual 

calculations needed. Because it is very conservative, 

the applicant may decide to refine the approach (e.g., 

divide any populated area into smaller areas and 

determine the probability for each) in order to meet Ec
19

limitations if the simplified approach yields a value in 

excess of the Ec threshold. Sheltering of the population 

may also be a factor but is not considered in this 

advisory circular, as noted previously. However, any 

attempt by the applicant to address sheltering will be 

considered on a case-by-case basis. 

As an example, assume that the vehicle flies for 2 

seconds of dwell time over a desert area that includes 

.02 seconds of dwell time over a city within the area. 

The desert population density is 5 people per square mile 

and the city has 10,000 people per square mile. The 

conservative approach is to assume that the entire 2 

seconds is flown over an area with 10,000 people per

square mile. The consequence for this 2 second segment 

of flight is the product of the casualty area and the 

population density. For a vehicle casualty area of 3892 

square feet, from the previous example, the expected 

casualty of a failure in the area with a population of 

10,000 people per square mile is:

 Eci = Pi x Aci x Dpi

 = Pi x (3892/(5280 x 5280)) x 10000

 = 1.3961 x Pi.

A more complicated and less conservative refinement might 

be to proportion the flight segment according to dwell 

time over each area of homogeneous population density. 

The

result is an expected casualty of:

 Eci = Pi x Aci x [(1.98/2.0) x 5 + (.02/2.0) x 10000]

 = Pi x (3892/(5280 x 5280)) x [.99 x 5 + .01 x

10000]

 = Pi x .0001396 x 104.95

 = 0.01465 x Pi.

The examples presented assume the vehicle and its 

instantaneous impact point footprint fly a precise 

trajectory and ground track respectively. However, this 

is not likely to be the case. Vehicles typically may 

deviate from the planned flight path, thus the population 

area exposed may depend on the variance of the vehicle’s 

position relative to the planned trajectory. 

Calculations of the probability of debris impact on 

populated areas are based on statistical treatment of 

trajectory downrange and cross-range dispersions. For a 
20

normal distribution these equations may take the form of:

Pi = Pi x Px x Py.

Where the equations for Px and Py are:

The x and y values are depicted in figure 3. 

Figure 3.

This level of fidelity is beyond the scope of this 

advisory circular but is presented to illustrate the 

level of complexity that should be addressed during the Ec
21

determination process.

Population density data may be obtained from published 

sources such as the U.S. Census Bureau, The United 

Nations FAO Yearbook, the Guinness World Data Book, the 

Rand McNally World Atlas and The Carbon Dioxide 

Information Analysis Center, Oak Ridge National 

Laboratory Global Population Distribution Database. 

To demonstrate the sensitivity of expected casualty (Eci = 

Aci x Dpi) to changes in Dpi, consider that if a vehicle 

with an Aci of 1000 square feet impacts an area with Dpi of 

1.0 person per square mile, the expected casualty is 

.000036 for an impact in that area. Likewise an area 

with a population density of 100 people per square mile 

has an Eci of .0036 and an area with a density of 5000 

people per square mile has an Eci of 0.18. To put this in 

perspective, New York City has an Eci of .853 with 23,700 

people per square mile, Houston, Texas has an Eci of .108 

with Dp of 3,000 and Jacksonville, Florida has an Eci of 

.029 with Dp equal to 800. 

3.3 Example Calculations of Ec. As a simple example of an 

Ec calculation, assume a mission where a vehicle launches 

from a moderately populated coastal area, enters orbit, 

reenters and lands in a sparsely populated desert. The 

time to orbit is 15 minutes. During the first five 

minutes of flight, any debris would impact on land and 

for the remaining time to orbit, the debris would impact 

in the ocean. The reentry time from orbit to landing is 

35 minutes with the final 5 minutes over sparsely 

populated desert (the time in orbit does not contribute 

to Ec). Ac for the launch segment over land is 16,133 

square feet, 3,892 square feet for the over water segment 

and 500 square feet for the orbit and reentry segments. 

The decrease is due to fuel burn, stage separation and 

payload release. There is a city in the first segment 

overflight corridor with a Dp of 600 people per square 

mile. Conservatively, assume that the population density 

for the launch segment over land is 600 people per square 

mile. The Dp is zero for the ocean and on orbit segments. 

There is a small populated area in the desert with a 

density of 100 people per square mile and this density is 

assumed to apply over the entire overland mission 

segment. The mission probability of failure is .05 

during the first five minutes, .02 for the remainder of 

the ascent phase, .01 in orbit (i.e., failure to reenter) 
22

and .02 during reentry. The probability of a successful 

mission is .85 and the probability of abort during ascent 

is .05 (assumed to be successful, i.e., no 

casualties).Therefore the total probability of all 

identified events totals to 1.0 indicating that all 

possibilities for the mission are accounted for:

Σ Pi = .85 + .05 + .05 + .02 + .01 + .02 = 1.0.

The expected casualty for the mission is:

 Ec = S Pi x Ai x Di

 

 = (.85) x 0 + (.05) x 0 +

 (.05) x 16133 x 600/(5280)(5280) +

 (.02) x 3892 x 0 +

 (.01) x 500 x 0 +

 (.02)(30/35) x 500 x 0 +

 (.02)(5/35) x 500 x 100/(5280)(5280)

 = 0 + 0 + .01736 + 0 + 0 + 0 +.000005

 = .01737 

The mission does not meet the allowable Ec of .00003 using 

conservative assumptions. Adding some measure of 

fidelity to these assumptions demonstrates the following: 

If the vehicle impact area is only over the city for the 

last 2 seconds of the over land launch segment and the 

rest of the segment is unpopulated, the probability of 

failure over the city becomes (.05)(2/300). Also, the 

effective casualty area drops to 3892 square feet due to 

propellant burn-off. Likewise the overland reentry 

segment is only over the populated area for 10 seconds 

and the probability of impact becomes 

(.02)(10/300)(5/35). 

Therefore:

 Ec = (.85) x 0 + (.05) x 0 

 

 +(.05)(298/300) x 16133 x 0
23

 + (.05)(2/300) x 3892 x 600/(5280)(5280)

 

 + (.02) x 3892 x 0

 

 + (.01) x 500 x 0

 + (.02)(30/35) x 500 x 0

 + (.02)(290/300)(5/35) x 500 x 0

 + (.02)(10/300)(5/35) x 500 x 

100/(5280)(5280)

 = 0 + 0 + 0 + .0000279 + 0 + 0 + 0 + 0 + 

.0000002

 = .0000281

This is less than the allowable expected casualty value. 

This example demonstrates how a simple refinement to a 

conservative Ec calculation process may produce acceptable 

results.

As a special example of expected casualty analysis, 

assume that an applicant wants to define a mission that 

will satisfy the requirement for an unproven reusable 

launch vehicle. Failure is assumed impacting in each 

exposed populated area along its flight. Given that 

failure is assumed (probability = 1.0) and that the 

effective casualty areas are defined by the vehicle 

design, the applicant must solve for allowable population 

densities that meet the threshold value of expected 

casualty (i.e., Ec is less than 30 X 10-6) throughout the 

mission.

Assume a two stage to orbit vehicle with the second stage 

reentering after payload insertion. The maximum casualty 

areas have been calculated to be 16,133 ft

2 during the 

launch stage, 3,892 ft2 during the second stage to orbit 

phase, and 500 ft2 during the reentry phase. From the 

risk equation for each phase:

Eci = Pi x Aci x Dpi.

The solution for allowable population density for each 

phase becomes:
24

Dpi = Eci / (Pi x Aci).

With a failure probability of 1.0, the allowable 

population densities are:

Dp(launch) = (30. X 10-6) / 16133ft2/(5280ft/mi)2

 = .0519 people/mi2

 Dp(2nd stage) = (30. X 10-6) / 3892ft2/(5280ft/mi)2

 = .2149 people/mi2 

 Dp(reentry) = (30. X 10-6) / 500ft2/(5280ft/mi)2

 = 1.6727 people/mi2

Therefore a mission using an unproven vehicle must be 

planned to avoid overflight of areas with population 

densities greater than those calculated in this example.

3.4 Summary. In the calculation of public risk (Ec), each 

failure mode, its probability and its consequence must be 

evaluated to ensure that the 30 x 10-6 expected casualty 

threshold for the total mission is not exceeded. 

An applicant may elect to simplify the Ec analysis by 

making conservative assumptions that lead to an 

overestimation of Ec. These assumptions might include: 

(1) Conservative or worst case assignments of probability 

to the failure modes,

(2) Applying a factor of 7.0 to the basic casualty area 

from inert debris, 

(3) Applying the maximum casualty area from explosive 

debris for each phase of flight over the entire phase, 

and 

(4) Applying the population density of a segment within a 

flight corridor over a larger area having actual 

population densities equal to or less than this segment.

An applicant may apply refinements that lead to “higher 

fidelity” expected casualty values in order to meet 

expected public safety thresholds. These analyses will 

be evaluated on a case-by-case basis to validate 

assumptions used. 

Using an acceptable methodology, such as that detailed in 

this Advisory Circular, an applicant would be required to 

demonstrate that the Ec for a proposed mission is equal to 
25

or less than the acceptable expected casualty threshold, 

not the exact value for Ec. Hence, an applicant may begin 

the risk management process using conservative 

assumptions and mitigate risks during the vehicle design, 

development, test and operational mission planning 

process to ensure that public safety considerations are 

satisfied.

Original Signed by:

Patricia Grace Smith

Associate Administrator for

 Commercial Space Transportation