10/2/95 rev

EXECUTIVE SUMMARY

This report, entitled "Hazard Analysis of Commercial Space

Transportation," is devoted to the review and discussion of

generic hazards associated with the ground, launch, orbital and

re-entry phases of space operations. Since the DOT Office of

Commercial Space Transportation (OCST) has been charged with

protecting the public health and safety by the Commercial Space

Act of 1984 (P.L. 98-575), it must promulgate and enforce

appropriate safety criteria and regulatory requirements for

licensing the emerging commercial space launch industry. This

report was sponsored by OCST to identify and assess prospective

safety hazards associated with commercial launch activities, the

involved equipment, facilities, personnel, public property,

people and environment. The report presents, organizes and

evaluates the technical information available in the public

domain, pertaining to the nature, severity and control of

prospective hazards and public risk exposure levels arising from

commercial space launch activities. The US Government spaceoperational experience and risk control practices established at

its National Ranges serve as the basis for this review and

analysis.

The report consists of three self-contained, but complementary,

volumes focusing on Space Transportation: I. Operations; II.

Hazards; and III. Risk Analysis. This Executive Summary is

attached to all 3 volumes, with the text describing that volume

highlighted.

Volume I: Space Transportation Operations provides the technical

background and terminology, as well as the issues and regulatory

context, for understanding commercial space launch activities and

the associated hazards. Chapter 1, The Context for a Hazard

Analysis of Commercial Space Activities, discusses the purpose,

scope and organization of the report in light of current national

space policy and the DOT/OCST regulatory mission. It also

introduces some basic definitions and outlines the approach to a

generic Hazard Analysis for future commercial space operations.

Chapter 2, Range Operations, Controls and Safety, discusses the

tracking and flight control systems, as well as the mission

planning and approval process. The chapter describes the

prelaunch ground safety and launch flight safety procedures

developed and enforced at the National Ranges to ensure launch

and mission success, personnel safety and to protect the public

from the potential impacts of a launch accident. Chapter 3,

Expendable Launch Vehicles (ELV) Characteristics, introduces the

basic propulsion technology, configuration and capability for

operational US launch vehicles (Titan, Delta, Atlas/Centaur,

Scout) likely to be commercialized in the near term. ELV

historical launch performance, operational reliability data and 
the bearing this record has on public safety issues are also

discussed. Chapter 4, Launch and Orbital Operations, describes

the phases of space operations, from ground preparation to

launch, through orbital transfer, operation and re- entry. It

also provides the reader with sufficient background to understand

possible ELV and mission failures during launch, orbital

maneuvers and orbit insertion and operation.

Volume II : Space Transportation Hazards identifies and discusses

the major and generic classes of hazards associated with each

phase of space operations. Chapter 5, Pre-launch and Launch

Hazards, identifies the types of hazards, such as explosions,

fires, toxic vapors and debris, as a function of accident

scenario and time after launch and defines their nature and

severity indices. Further, a comparative perspective on

potential ELV space launch accidents is provided by analogy to

more common and socially accepted transportation and industrial

accidents involving chemicals and fuels. Chapter 6 is devoted to

Orbital Collision Hazards, shedding light on the Low Earth Orbit

(LEO) and Geosynchronous Earth Orbit (GEO) space environment and

the increasing threat of on orbit collisions to spacecraft. The

sources and density of orbital debris are discussed and their

implications for the probabilities of collisions involving

operational satellites are quantified. Chapter 7 defines and

reviews Re-Entry Hazards and their quantification by addressing

the orbital lifetime and decay of space objects depending on

their orbital characteristics, the behavior and survivability of

space objects upon re-entering Earth's atmosphere and the

uncertainties associated with predicting points of entry and

ground impacts.

Volume III: Space Transportation Risk Analysis introduces the

methods and uses of Risk Analysis as they apply to the

qualitative evaluation and quantitative assessment of public risk

exposure from commercial space operations. Chapter 8 introduces

the concepts of risk acceptability and relative risk and the

tools of Risk Analysis Methodology developed for a broad range of

industrial and regulatory purposes. These include: failure

analysis methods (which focus on failure modes and failure

chains); consequence analysis methods (which focus on the

severity of possible consequences of failures); hazard analysis

methods (focused on the identification and ranking of hazards);

and integrated probabilistic risk analysis methods, such as Fault

Tree Analysis, which quantify risk as the mathematical product of

an event probability and its consequence magnitude. Chapter 9

discusses the Applications of Risk Analysis to Space Launch

Operations as used to date by the Government Agencies (NASA, DOD,

DOE) concerned with assuring and maintaining high operability and

safety standards for space launch operations. The chapter

reviews the objectives, concepts, tools and uses of risk analyses
conducted at the National Ranges by sponsoring agencies, in light

of de-facto risk/safety goals, criteria and priorities. Finally,

Chapter 10 provides an integrated Generic Risk Assessment of

Representative Launch Scenarios background by reviewing the risk

associated with typical ELV missions from current Range

locations. Then the benefits of established Range Safety

Controls are quantified, relative to their hypothetical absence,

employing the framework of a simplified Community Damage (COMDAM)

model in a typical Risk Matrix evaluation procedure.
10/2/95 rev

ACKNOWLEDGMENTS

This report was initiated and sponsored by Norman Bowles,

Associate Director of Licensing Programs in the Office of

Commercial Space Transportation (OCST) at the US Department of

Transportation (DOT), to gather and organize a wide range of

materials relevant to the hazards of the emerging commercial

space ventures, in order to assist OCST in its rulemaking and

licensing decisions. The analysis focuses on the potential

hazards of space launch activities of interest to the commercial

space transportation industry, based on the US Government launch

experience to date, the methods of analysis and operating

procedures sucessfully used in managing launch risks. This

research project was directed by Richard Robichaud of the DOT

Transportation Systems Center (TSC).

This text includes contributions and review comments from many

people, who authored sections, contributed information, and

rendered constructive criticism. Dr. Aviva Brecher, TSC, a

specialist in space systems and hazard analysis, authored several

chapters, contributed to others, edited and produced the report.

Dr. Brecher built on initial efforts of Kevin Kolodzy of

Dynatrend, along with Dr. John Stickler and William Hathaway of

TSC, who reported on the topics of expendable launch vehicles,

collisions in space and space launch hazards. As the scope of

the report expanded, Dr. Jon Collins of ACTA Inc., a consulting

firm known for its unique capabilities in rocket hazard and

overflight analysis, contributed chapters on launch and orbital

operations, Range Safety Controls and operation and hazard

analysis of representative launch scenarios. Also, Dr. Albert

Moussa of BlazeTech Inc., a company specializing in the analysis

of fires and explosive hazards, authored the chapter on

propellant hazards and Douglas Furciniti of UNISYS wrote the

chapter on re-entry hazards. These individuals also contributed

to the overall organization and general critique of this

document. Robert A. Rudich of TSC and Douglas J. Furciniti of

Dynatrend played a major role in compiling, editing and producing

the present report.

We are grateful to Loyd Parker of the Research Triangle

Institute, who specializes in launch and Range Safety operations

and analysis, for constructive comments and helping TSC obtain

current information for this report. Norman Bowles is thanked

for his vision, support, guidance and the review conducted by him

and OCST staff members Ronald Gress, Giora Hadar and Dr. Richard

Will. 

No acknowledgment would be complete without thanking those who

supplied the data and information that provided substance to this

report. Our thanks are extended to Lou Ullian, Chief Engineer

for Safety of Eastern Space and Missile Center; Col.

Niederhauser, Director of Safety, and his staff from the Western

Space and Missile Center; Weston Wolff, Chief of Operations 
Control, and his staff at the White Sands Missile Range. We

thank the management and technical staff of the General Dynamics

Space Systems, Martin Marietta Denver Aerospace, McDonnell

Douglas Astronautics Co., LTV Missiles and Electronics Group,

AMROC, and Space Services Inc. for cooperation in supplying

industrial information.

We also wish to express our gratitude to Lana Agnew of Dynatrend

for researching and obtaining reference materials, and to UNISYS

staff for working long and hard in compiling text and assembling

earlier drafts of the report. Of particular note is the

editorial work, patience and skill exhibited by Robert A. Rudich,

and by Jim Kelley during the many text revisions and integration.

Our gratitude is also extended to A.L. Lavery and the rest of

TSC's Safety and Security Systems staff for their support and

assistance.
10/2/95 rev

1. THE CONTEXT FOR A HAZARD ANALYSIS OF COMMERCIAL SPACE

ACTIVITIES

1.1 POLICY AND MARKET CONTEXT

A new set of realities, shaping space activities worldwide, must be

considered in order to provide the context for the nature, scope

and thrust of commercial space efforts in the US. An extensive set

of recent Congressional legislation, studies and reports(1-8) has

documented the rapidly changing climate for international

cooperation and competition in space activities and the need for

greater political and economic flexibility in providing access to

and services for space exploration and exploitation, if the US is

to maintain its leadership in space. The arena of space

technology, infrastructure development and new space applications

has expanded in recent years to include more developed and third

world nations.(2,8) In 1986 alone, the USSR had 91 successful space

launches vs. the US with 6 and 2 each for China, Japan and ESA

(European Space Agency). The US is revising and reshaping its

space policy and priorities. These changes are needed if it is to

provide the national and international leadership and foster the

stability to ensure that, following the initial space exploration

and utilization phase, the promise of commercial space development

becomes a reality.(3-7) This will enable the US aerospace industry

to capitalize on its technical superiority for the benefit of

mankind and economic pay-back.

Both Congress and the Administration have proposed, enacted and

promoted new space commercialization initiatives, most notably in

privatizing remote sensing satellites and promoting the use of

commercial expendable launch vehicles (ELV's) and launch services

to place both government and commercial satellites into orbit.(6,7,9)

In May 1983, the President issued a new policy for

commercialization of ELV's and in February 1984, by Executive Order

12465 ("Expendable Launch Vehicles in Space"), he designated the

Department of Transportation (DOT) as the lead agency to facilitate

and encourage commercial ELV activities and to license commercial

space operations.

The STS-Challenger disaster and ensuing ELV accidents have severely

limited the US access to space and indirectly provided new

opportunities and incentives to ELV manufacturers and to commercial

payloads and launch services providers.(7,10) As a result, all

government agencies involved in space activities have been

instructed to enable, foster and implement the new commercial space

policies and laws and to develop the supporting regulatory

framework and technology infrastructure for greater private sector

participation in space transportation and development efforts.

1-1
1.2 REGULATORY CONTEXT FOR COMMERCIAL SPACE OPERATIONS

The Commercial Space Launch Act of October 30, 1984 (Public Law 98-

575) (the Act), assigned to the Secretary of Transportation the

responsibility for carrying out the Act.(6) The purpose of this Act

is:

(1) to promote economic growth and entrepreneurial activity

through utilization of the space environment for peaceful purposes;

(2) to encourage the United States private sector to provide

launch vehicles and associated launch services by simplifying and

expediting the issue of commercial launch licenses, facilitating

and encouraging the use of excess Government-developed space launch

capabilities and transferring technology to the private sector ;

(3) to designate an executive department to oversee and coordinate

the conduct of commercial launch operations; to issue and transfer

commercial launch licenses authorizing such activities; and to

protect the public health and safety, safety of property, national

security and foreign policy interests of the United States.

In 1984, the Secretary of Transportation created the Office of

Commercial Space Transportation (OCST) and delegated to it the

Secretary's responsibilities. As stated in Section 8(a)(2) of the

Act, the Secretary is charged with prescribing "requirements as are

necessary to protect the public health and safety, safety of

property, and national security and foreign policy interests of the

United States."

To carry out this responsibility, OCST established a program to

develop safety and regulatory requirements for commercial space

launch license applicants.(12) The Transportation Systems Center

(TSC) is providing technical support to OCST to this end and has

been assisting in the development of launch safety requirements

based on the Preliminary Hazards Analysis embodied in this report.

However, it must be made clear that the focus of OCST licensing and

regulatory activities is primarily on public safety and not on

mission success.(6,12) This unique perspective and mandate for DOT

is and will be reflected in the OCST safety research, rule making

and licensing activities. DOT will have to regulate not just

commercial launch sites and commercial launches, but payloads

launched aboard these vehicles. These include retrievable

materials processing, re-entry systems, non-government research

activities and many other, as yet unforeseen, commercial space

systems.

DOT/OCST will also license the construction and operation of new

private launch Ranges, as well as any commercial Range Safety

services.(12) OCST will also specify the certification requirements

1-2
for Range Safety personnel and launch services providers, that

might impact the public safety. Under the Act, DOT must also issue

licenses for any launch vehicle or operation on foreign territory

by a US citizen or company.

1.3 PURPOSE AND SCOPE OF REPORT: HAZARD ANALYSIS OR RISK

ASSESSMENT

This report presents the results of a technical review and analysis

of literature and information in the public domain, conducted to

identify and evaluate the prospective hazards to the public and the

environment, and to assess risk exposure levels associated with

commercial space activities. Included in the report is a review of

the present status of US space technology and practices (Vol. 1),

as they relate to the hazards associated with commercial space

missions and their mitigation (Vol. 2). In this analysis, a

commercial space mission is comprised of four phases: prelaunch,

launch, orbital and re-entry (Table 1-1). For each mission phase

the potential classes of hazards which pertain to the people,

procedure, equipment, facility and environmental elements are

identified.

1-3
These hazards have been identified and evaluated in light of

DOT/OCST's mission, based on the review of existing literature and

practice of space related risk analyses (Vol.3).

The following definitions will aid the reader with the assimilation

of information in this report. An extensive Glossary of terms has

been provided (Appendix A) and a discussion of terminology and

procedures is given in Chapter 8 (Vol. 3).

An accident is defined as an undesirable event resulting from any

phase of commercial ELV launch operations and space activities with

the potential to cause injury or death to people, or damage to

property.

Risk assessment is the systematic examination of an actual or

proposed system or operation, to identify and evaluate potentially

hazardous events and their consequences. The principal purpose of

such an analysis is to assist policy makers, regulators and

managers in deciding on risk avoidance, risk reduction or

mitigation strategies. It can lead to either confirming the

continued acceptability of a system or operation from the safety

point of view, or setting new risk acceptability and regulatory

thresholds for the protection of public safety (see Ch. 8, Vol. 3).

Although the terms Risk Assessment and Hazard Analysis are both

used in this report in nearly synonymous fashion, the latter is

part of the former. There are other closely related terms used in

the literature in similar contexts: "Hazard" is often interchanged

with "Risk", and "Analysis" for "Assessment", thus giving four

common usage expressions, namely: risk assessment, risk analysis,

hazard assessment and hazard analysis. 

i) An Analysis is typically a technical procedure following an

established pattern;

ii) An Assessment is the consideration of the results of analysis

in a wider context to determine the significance of the analytical

findings;

iii) A Hazard is considered to be an existing property, condition,

or situation, which has the potential to cause harm. For example,

liquid hydrogen used as a rocket propellant is a hazard because of

its chemical nature, and intrinsic flammability and explosiveness. 

iv) Risk is related to both the consequences of an accident (i.e.,

hazard potential being realized and causing harm) and its

likelihood of occurrence (Ch. 8, Vol.3). Risk is mathematically

expressed as the product of the probability of an accident and the

magnitude of its consequence. Thus, the risk from a liquid

hydrogen tank is the product of the probability that its

containment will fail and the magnitude of the resulting explosion

1-4
and/or fire damage. Hence, people and property may be considered

"at risk" from a nearby hazard.

v) An Accident occurs when the hazard potential for damage is

activated by a stimulus and results in damage to a given system,

component or operation, or in injury to people. Other operational

and technical definitions for terms used throughout the report are

given in the Glossary (Appendix A).

It must be kept in mind that a system or operation is considered to

be "safe" when its risks are deemed economically, socially and

politically acceptable, based on prevailing standards. These issues

will be discussed and illustrated in detail in Vol. 3.

1.4 APPROACH TO HAZARD ANALYSIS FOR COMMERCIAL SPACE OPERATIONS

For over two decades, the US Government has been one of the world

leaders in the development and exploration of outer space. In this

role, the Government mission agencies (NASA and DOD) have developed

and successfully implemented launch safety requirements in support

of a wide variety of space missions (see Chs. 2 and 4 of Vol.1).

Launch safety requirements have been established for both unmanned

and manned space systems and operations, as well as for integration

of specific payloads. As such, the standards presently in use at

Government Ranges have evolved not only out of the need to protect

the public safety and property, but also from the need to protect

launch site personnel, facilities and on board astronauts; to

ensure mission success; to evaluate launch vehicle performance; and

to provide research results that would assist in expanding the

national space exploration effort.

Since the only currently available launch sites are National Ranges

owned and operated by US Government agencies (DOD and NASA as first

parties), the basic launch and system safety regulations now in

place at these facilities will probably continue to be observed in

the near future by any commercial launch vehicle provider or

operator that requires access to and use of Government launch

facilities (second party). Cost, access and time constraints may

influence the viability of commercial launch operations on these

Ranges, while vehicle reliability and safety will remain major

concerns. Recognizing this situation, OCST has undertaken an

effort to examine ELV safety standards, launch hazards and risk

analysis methods to ensure the protection of public safety and

property(12) (third party), as opposed to Government launch facility

(first party) and ELV or satellite manufacturers and operators

(second party) who enter User Agreements.

As the initial effort in the development of a program to address

the safety issues, this report focuses on the identification and

evaluation of the safety hazards associated with ELV's and their

1-5
launch operations from established and available Government Ranges

as well as new launch sites that may be developed and operated in

the future by commercial entities, or in partnership with states

and federal entities.

Protecting the public health and safety as stated in the Act,

requires that safety regulations be directed at preventing the

occurrence of potentially hazardous accidents and at minimizing or

mitigating the consequences of hazardous events. This will be

accomplished by employing system safety concepts and risk

assessment methodology to identify and resolve prospective safety

hazards. The first step in applying system safety concepts is to

define the commercial space launch hazards (preliminary hazard

analysis, PHA). With the hazards defined, it is then possible to

identify and rank those associated with each specific commercial

space launch. Only after the hazards have been identified and

satisfactorily assessed, will the goal of providing the public with

the highest degree of safety practical have been accomplished. For

the preliminary hazard analysis (PHA) presented in this report

(Vol. 2), the operational commercial space launch phases have been

defined as follows:

1. Prelaunch; 2. Launch; 3. Orbit; 4. Re-entry

For each of these life and operability phases of the commercial

space launch process, it is possible to identify the generic

classes of hazards that are associated with each phase (see Table

1-1)and to define appropriate regulatory oversight. To identify

these hazards, a clear understanding of the system and its

operation is necessary, as well as an analysis of the relevant

accident history for specific launch systems and subsystems

during each phase of launch operation. An analysis of previous

accidents is necessary, but not sufficient, for the identification

of prospective hazards, since both vehicle configurations (see Ch.

3, Vol. 1) and launch and Range Safety procedures (see Ch. 2,

Vol.1) have improved with time. In 30 years of Government space

launch activities and ELV operations to date, both the military and

civilian sectors have had an excellent safety record and there have

been no major accidents with reported public injuries. Therefore,

the data base from which the hazards can be identified is limited,

and known to be incomplete, with rare identical failures (see

Ch.3). Furthermore, an examination of historical launch data can

provide only a tentative list of probable causes and likely

accident scenarios and may be incorrect for the purpose of

projecting future performance. Special statistical methods may

have to be used to account for "learning" from past failures in

order to avoid repeating them (see Ch. 9, Vol.3).(7) Previous

government ELV and space missions will, however, have to be used to

generate a set of representative, expected, and projected

commercial space launch missions (see Ch. 10, Vol.3). This

1-6
approach will allow us to examine and evaluate generic hazards

associated with commercial space ELV missions (see Chs. 5-7,

Vol.2).

1.5 OVERVIEW OF THE REPORT ORGANIZATION

This report is intended to inform and educate a broad readership on

the generic sources and nature of hazards associated with space

launch activities. Therefore, it is intended to provide both the

necessary technical background and the specific hazard analysis

methodology, in order to enable a non-technical reader to

understand and appreciate the variety of technical issues involved.

Volume 1: Space Transportation Operations provides the background

on Range Operations (Ch. 2), current Expendable Launch Vehicles

(Ch. 3), and Space Launch and Orbital Missions (Ch. 4). Chapter 2

describes the Range Safety Control systems in place and established

practices at the National Ranges. Chapter 3 introduces the basic

technology, and typical proven and proposed configurations of ELV's

likely to be used for commercial space missions in the near future.

The historical reliability based on launch success/failure

statistics for the major classes of operational ELV's in the US are

also presented in Chapter 3. Chapter 4 describes the space launch

and orbital operational phases. 

Volume 2: Space Transportation Hazards introduces the generic

classes of hazards associated with the use of these ELV's in space

launch operations. Chapter 5 discusses fires, explosions, toxic

vapor clouds and debris impacts. 

A relative risk context is provided in Chapter 5 to enable the

reader to judge launch hazards by comparison with other common 

industrial and transportation hazards. Chapter 6 discusses orbital

collision hazards to satellites in low and geosynchronous Earth

orbits. Chapter 7 reviews and evaluates those hazards to people

and property associated with both controlled, and uncontrolled reentry of space objects. 

Volume 3: Space Transportation Risk Analysis deals with the

analytical tools available to assess public risks (Ch.8), the

modeling and application of such tools to space operations (Ch.9)

and illustrates the specific risks associated with commercial ELV

launches in the near future (Ch.10).

Since DOT/OCST will sponsor and perform risk assessment/risk

management research to support commercial space launch licensing

reviews and awards, Chapter 8 defines and introduces the standard

methods of Risk Assessment. Chapter 9 reviews the published

technical risk assessments conducted for selected space

applications, focusing specifically on when, how and why such risk

1-7
studies were conducted and on the software tools available for this

purpose. 

Finally, in Chapter 10, an illustration of risk analysis is

provided for representative ELV launch/mission scenarios which

indicates how the public risk exposure from commercial space

activities may be estimated, both with and without Range Safety

controls in place. Also, a conceptual risk assessment and

acceptability matrix is provided for comparing public risk levels

associated with each phase of space launch operations. The

benefits of Range Safety control systems and practices now enforced

at Government Ranges as the key safeguards to manage and minimize

the public risk exposure from future space activities to

"acceptable" levels are made clear in Chapter 10.

1-8
REFERENCES TO CHAPTER 1

1. "Civilian Space Policy and Applications," US Congress, Office

of Technology Assessment, OTA-STI-178, June 1982.

2. "International Cooperation and Competition in Civilian Space

Activities," US Congress, OTA-ISC-240, July 1984.

3. "Civilian Space Stations and the US Future in Space," OTA-STI241, Nov. 1984.

4. "Commercialization of Land and Weather Satellites," US

Congress, House Committee on Science and Technology, 1983.

5. "Pioneering the Space Frontier," Report of the National

Commission on Space, May 1986.

6. (a) "Commercial Space Launch Act," (Report to accompany HR

3942), US Congress, House Committee on Science and Technology,

1984.

(b) "The Expendable Launch Vehicle Commercialization Act," ibid.,

1986.

(c) "The Land Remote - Sensing Commercialization Act of 1986,"

(Report to accompany HR 5155), ibid, 1984.

7. "Space Issues", (Info Pack IP 371) and attached Issue Briefs:

IB86121 "Space Launch Options after the Shuttle Accident," and IB

87018 "Space Policy," prepared by the Congressional Research

Service (CRS).

8. "Space Activities of the United States, Soviet Union and Other

Launching Countries: 1957-1986," by Marcia Smith, US Congress, CRS

87-229 SPR (Feb. 1988).

9. "Encouraging Business Ventures in Space Technologies,"

National Academy. of Public Administration Report for NASA, 1985.

10. Report of the Presidential Commission on the Space Shuttle

Challenger Accident, June 1986.

11. "Space Stations and the Law: Selected Legal Issues,"

Background Paper, US Congress, OTA-BP-ISC-41, August 1986.

12. (a) "Commercial Space Transportation; Licensing Process for

Commercial Space Launch Activities; Notice of Policy and Request

for Comments," 14 CFR Ch. III, Feb. 25, 1985 (FR 50, No. 37, p.

7714 et seq.)

(b) "Commercial Space Transportation; Licensing Regulations;

Interim Final Rule and Request for Comments," 14 CFR Ch. iii, Feb.

26, 1986 (FR 51, No. 38, p. 6871 et seq.)

(c) "Commercial Space Transportation; Licensing Regulations; Final

Rule," April 4, 1988 (FR 53, No. 64, p. 11004 et seq.)

1-9
10/2/95 rev

2. RANGE OPERATIONS, CONTROLS AND SAFETY

2.1 RANGE CHARACTERISTICS FOR SAFE OPERATION

2.1.1 US Government Launch Sites

The US Government has traditionally operated separate civilian

and military space programs. NASA is the lead agency for

civilian space activities, and assists as necessary, the

Departments of Energy, Interior, Commerce, Transportation and

Agriculture which also maintain space research and utilization

programs.

The US Space Command (US SPACECOM) coordinates all military space

activities, but the three services also have operational Space

Commands. DOD recently established a Consolidated Space Test

Center (CSTC) under the Space and Missile Test Organization

(SAMTO). A very recent DOD regulation governing military Range

activities designated the Air Force as the lead agency for the

tri-service conceptual Space Test Range at Onizuka AFB, in

California, with a special focus on safety issues.

The Eastern Test Range (ETR) is under the direction of the USAF

Eastern Space and Missile Center (ESMC) at Patrick Air Force

Base, Florida, and the Western Test Range (WTR) is under the

direction of the USAF Western Space and Missile Center (WSMC) at

Vandenberg Air Force Base, California. WTR launches are from

Vandenberg Air Force Base; ETR launches are from the Cape

Canaveral Air Force Station (CCAFS). NASA space missions are

launched from the Florida Kennedy Space Center (KSC), also on

Cape Canaveral and occasionally from WFF. 

The United States has a major launch site in Florida at Cape

Kennedy (NASA) and CCAFS (DOD) for manned, lunar and planetary

launches, and for launching satellites to geostationary orbit

(primarily for weather and communications). It has another major

West Coast launch site at Vandenberg Air Force Base (VAFB),

California, for satellites (including weather, Earth resources,

navigation and reconnaissance) which must go into polar orbits.

A smaller launch site for small space payloads and for suborbital research rockets is the NASA/Goddard Space Flight Center

(GSFC) Wallops Flight Facility (WFF) site at Wallops Island,

Virginia. Sub-orbital launches and short-range vertical testing

are accomplished at White Sands, New Mexico, from the White Sands

Missile Range (WSMR). In addition, the US Government has

conducted launches from a number of other CONUS and off-shore

sites.

Each of the National Ranges has unique capabilities related to

its mission, siting and facilities, as well as specific

requirements for the Range Users (see Vol. 3, Chs. 9, 10). The

2-1
safety philosophy of ground and Range operations is generally

that of dealing with controlled, managed and acceptable risks.

Procedures have been established to handle and store all

materials (propellants, etc.) which may be a hazard, control and

monitor electromagnetic emissions and govern transportation of

materials to and from the facility.(4) The storage of propellants

and explosives used in Expendable Launch Vehicles (ELV's) is

controlled by quantity-distance criteria, as specified.(3)

Failure modes and effects analyses (FMEA) are prepared, when

necessary, for all potentially hazardous activities and devices

(see Ch. 8). Quantitative risk analysis has rarely been used to

establish launch and space operational risk because of the

conservative philosophy of vehicle design, ground and launch

procedures and the difficulty in developing realistic estimates

of hazardous event probabilities and accident scenarios (see

discussion in Vol 3, Chs. 9 and 10).

Since there are currently no private commercial space launch

range facilities in the US, we will describe the past and current

practices at US Government Range facilities. It is assumed

throughout this report that the level of operational safety at

licensed commercial space facilities will be comparable or

equivalent to the level of safety maintained at US Government

Ranges.

2.1.2 Ground Operations and Safety

One of the principal responsibilities of the launch Range is to

perform all of those tasks which eliminate, or at least

acceptably minimize, the hazards from an expendable launch

vehicle (ELV), both prior to and during the launch.(1-3) This is

accomplished by establishing:

(1) requirements and procedures for storage and handling of

propellants, explosives, radioactive materials and toxics;

(2) performance and reliability requirements for flight

termination systems (FTS) on the vehicle;

(3) a real-time tracking and control system at the Range; and

(4) mission abort, vehicle destruct or flight termination

criteria which are sufficient to provide the necessary

protection to people both within (on- Range) and outside

(down-Range) the boundaries of the launch facility.

At each Range there is a hierarchy of regulations and

requirements for Ground and Launch safety implementation (see

also Chs. 6, 7, Vol. 2). Generally, the National Ranges take

responsibility for the vehicle handling and safe operation from

receipt until the time of orbital insertion. Safety issues

associated with on-orbit impacts and re-entry from orbit are not

normally the responsibility of the Range (see Chs. 6, 7, Vol. 2).

2-2
Control of public risks from jettisoned stages and hardware prior

to orbital insertion are a Range responsibility.

The following sections provide a general introduction to the

various aspects of planning, ground operations and flight

control, all with a specific emphasis on safety. Chapter 10 in

Vol. 3 provides a more detailed discussion of launch hazards and

their minimization by Range Safety controls.

2.1.3 Range Safety Control System

The NASA "Range Safety Handbook" states: "The flight safety

goals are to contain the flight of all vehicles and preclude an

impact which might endanger human life, cause damage to property

or result in embarrassment to NASA or the US Government.

Although the risk of such an impact can never be completely

eliminated, the flight should be carefully planned to minimize

the risks involved while enhancing the probability for attaining

the mission objectives."(7)

The real-time Range Safety (or Flight) Control System must

accurately and reliably perform the following functions:

(1) Continually monitor the launch vehicle performance and

determine whether the vehicle is behaving normally or

failing;

(2) Track the vehicle and predict (in real-time) where the

vehicle or pieces of the vehicle will impact in case of

failure and if flight termination action is taken;

(3) Determine if there is a need to delay or abort the launch or

destruct the vehicle, based on a comparison of predetermined

criteria with the current vehicle status; and

(4) If necessary to protect the public, send a command to abort

the mission either by vehicle destruct or engine shutdown

(thrust termination). Note that the term "destruct" is used

generically in this report to denote flight termination

actions for Range Safety purposes. In reality, thrust (and

the flight) can be terminated on command for some ELV's

without vehicle destruction.

Figure 2-1 describes pictorially the activities of the various

elements of the Range Safety Control System.

Vehicle performance is determined at all Ranges by visual

observation (early in flight) and by real-time telemetry

measurements of vehicle status as a back-up to the computed

(wind-corrected) behavior of the instantaneous impact point

(IIP), discussed below in more detail. The actual location of

the vehicle is less important than where the vehicle and its

debris will land in case of both normal operation, accidental

failure, abort or destruct. Therefore, in tracking a vehicle,

velocity data must be obtained either directly or by

2-3
differentiating successive measures of position. The most

frequently used method of obtaining the velocity and position

data has been the use of radar trackers, which measure the

vehicle position in terms of azimuth, elevation and range

relative to the tracker, expressed in a launch-pad centered

reference coordinate system. Radars are also capable of

2-4
determining range rate, i.e., the rate at which a vehicle is

moving toward or away from the radar. A single tracker near the

launch pad can provide satisfactory information for two or more

minutes of flight depending on the rate at which the launch

vehicle is traveling away from the tracker. The quality/accuracy

of the tracking data is often affected by several factors, two of

which are: (1) multi-path of returned signals which occurs at

low antenna elevation angles; and (2) the plume signal

attenuation due to high temperature ionization caused by the

solid rocket motor exhaust. Multiple radar trackers are used to

minimize these problems and to provide redundant measurements, so

that failure of a single tracker will not jeopardize the mission.

Early in flight, when the launch vehicle is still close to the

ground, the radar may not be able to track the vehicle. In this

case, visual observation and telemetry may be the only means of

determining whether there is a malfunction and whether the

vehicle maintains the correct attitude. Position and velocity

data, along with the predicted instantaneous impact point (IIP)

are typically displayed in real-time in the Launch Control Center

(LCC).

Although not yet applied at the National Ranges, it is possible

to use satellite information for determination of vehicle

position and velocity. An electronics package on board the

launch vehicle could collect information for calculating the

range relative to several separately located navigation

satellites and could be telemetered to a ground station,

processed and converted into vehicle position and velocity. This

will become practical when the Global Positioning System (GPS)

satellites become operational. Some Ranges have used three or

more geographically spaced telemetry antennas and associated

computer equipment to infer the vehicle position and velocity

from the Doppler phase shift of the received telemetry signals.

The launch vehicle velocity and position information are

generally used to compute an instantaneous impact point (IIP).

The IIP is displayed on a screen or chart indicating where the

vehicle will impact on the surface if flight were to be aborted

at that instant. This impact point is usually computed, assuming

no atmosphere, as a vacuum IIP (VIIP) which allows simpler and

more rapid trajectory computation. Inclusion of atmospheric drag

is generally not necessary to satisfy the objectives of the realtime Range Safety. However, a drag and wind correction is

applied in some cases.

Early in the flight the IIP advances slowly, but as the vehicle

altitude, velocity and acceleration increase, the IIP change rate

also increases. Very early in flight, the IIP change rate

increases from zero to several miles per second. Later, it

increases to tens of miles and then hundreds of miles per second.

As the vehicle reaches orbital velocity, the IIP rate essentially

goes to infinity because the vehicle will no longer come down. 

2-5
The difference between the advance of the IIP and the present

position (sub- vehicle point) (SVP) is illustrated in Figure 2-2.

It is the advancing IIP that the Range Safety Officer (RSO) is

usually observing during a launch. Prior to the launch, a map is

prepared with lines drawn to represent the limits of excursion

which, when exceeded, will dictate a command signal to terminate

flight. A typical set of "destruct lines" is shown in 

Figure 2-3.

The destruct lines are deliberately offset from land or populated

areas to accommodate: (1) vehicle performance characteristics

and wind effects; (2) the correction for using a vacuum instead

of a drag- corrected impact point; (3) the scatter of vehicle

debris; (4) the inaccuracies and safety-related tolerances of the

vehicle tracking and monitoring system; and (5) the time delays

between IIP impingement on a destruct line and the time at which

flight termination actually takes place (i.e., human decision

time lag). By proper selection of the destruct lines, debris can

be prevented from impacting on or near inhabited areas.The

ability of the system to accurately predict the ELV impact point

diminishes as the vehicle advances into the flight and the IIP is

moving more rapidly along the ground track. Consequently, the

difficulties in performing the Range Safety Control function

increase with time, particularly if there are land masses or

population centers that must be protected near the ground path of

the launch trajectory. Regardless of the flight time, the Range

Control problem is always more difficult if the flight plan is

designed to move close to or over a populated area. If a flight

plan requires violation of a prudently designed abort line, a

risk analysis is performed to determine if the risk is

acceptable. If the risk is small enough, the Range Commander may

choose to permit a launch without an abort line for portions of

the flight (for further discussion see Vol. 3, Ch. 10).

2.2 LAUNCH PLANNING

The principal mission of Range Safety personnel is the protection

of life and property both off and on-site at the launch facility.

In keeping with that objective, the Range must not be negligent,

nor impose undue restrictions on launch conditions, that could

result in a high probability of a good vehicle being destroyed.

Minimization of the probability of terminating a "good" flight,

and simultaneous minimization of the potential risk due to a

malfunctioning ELV, is accomplished through careful mission

planning, preparation and approval prior to the launch. The

planning is in two parts: (1) mission definition such that land

overflights or other risky aspects of the launch are avoided

and/or minimized; and (2) development of data which support the

real-time decision and implementation of active control and

destruct activities. These two aspects are discussed in the

following subsections.

2-6
2-7
2.2.1 Mission Planning

Figure 2-4 contains a map showing the ground trace of a

hypothetical launch from Vandenberg Air Force Base (VAFB) on an

azimuth which causes overflight of islands south of the base,

flight along the coast and overflight of a portion of Chile and

Argentina (in fact, such azimuths are restricted, as discussed in

Ch. 10). The greatest risk is in the immediate vicinity of the

launch area and to any occupants of the nearby islands. Since

the overflight of these islands is planned, abort lines cannot

protect their inhabitants. Abort lines can protect the coast

from vehicle overflight and debris impacts, in case of destruct.

However, if the intended flight path is too close to the coast

and the abort lines are too close to the planned flight path,

there is the possibility that the IIP of a good, but slightly

drifting, vehicle will cross the abort line and thus require a

commanded destruct. The overflight of the tip of South America

is not as serious a problem because the rate of advance of the

IIP is so rapid and the vehicle altitude is so high at that point

in flight that there is a much smaller possibility of any hazard

to that region. A failure would have to occur within a specific

time interval (a second or two of flight) in order for any

resulting debris to impact the region (see Ch. 10 for a more indepth discussion of such risks).

In addition to considering where the aborted or destroyed vehicle

will land, one must also consider where the debris from normally

jettisoned spent stages will impact. For example, the vehicle

might fly safely over the islands, but drop an empty rocket

casing on one of them. Mission planning must consider and avoid

all of the hazards associated with normal launch operations, as

well as other potential hazards associated with potential

accidental failures for the particular launch plan.

A Range user may request a particular trajectory to satisfy

desired mission requirements (i.e., orbital inclination) or

payload constraints. For example, a trajectory having a more

easterly azimuth will enable the vehicle to put a heavier payload

into orbit. If the launch vehicle is limited in lift capacity,

the Range user may try to get the most favorable launch azimuth

(in this case, eastern) in order to increase the amount of

payload the vehicle can place into orbit. The Range Safety

function in the mission planning stage is to limit the range of

allowed launch azimuths to those which keep the risk to people on

the ground at acceptably low levels. Another mission planning

responsibility is to evaluate all other aspects of the planned

launch, e.g., impact points of jettisoned stages, to assure the

acceptability of the overall risk of the mission.

There are situations where the conflict between safety

requirements and mission objectives require special studies to

determine risks and define tradeoffs. In these cases detailed 

2-8
risk analyses are performed using models that consider the

probability of the vehicle failing in a variety of modes and

simulate the behavior of the missile during and after

malfunction,including the effect of activating the flight

termination system. 

Such risk analyses usually compute the land impact probability

and associated casualty expectation (the average number of

casualties expected per launch). Typically, missions with

casualty expectations of less than one in a million are

considered reasonably safe. If the risks are higher, the mission

ordinarily comes under more scrutiny (see Chs. 9, 10 for more

detailed discussion).

One of the options for maintaining a low risk for a launch is to

move the abort lines away from the populated areas and closer to

the trace of the IIP for the nominal trajectory. While this

decreases the overall launch risk, it increases the probability

of aborting a good vehicle. Considering the very high value of

many of the launch vehicles and their payloads, these tight abort

lines put additional pressure on the Range Safety Officer (RSO)

who must decide on an active destruct command.

2-9
Another option to minimize the risk of a normal, or failed,

launch to the population surrounding the Range is to place much

tighter constraints on the tolerable wind and other

meteorological conditions at the time of the launch.

2.2.2 Standard Procedures to Prepare for a Launch

The National Ranges have provided standards and requirements for

organizations desiring to launch vehicles from their facilities.

For example, the United States Air Force has specific safety

requirements issued for each of the Ranges under USAF control.

These documents describe the safety policy and procedures and

also define the data submittal and launch preparation

requirements for the Range user.(1,2) The categories covered by

these requirements include ground safety (handling of

propellants, ordnance, noise, hazardous operations, toxics,

etc.), flight analysis (vehicle trajectory, mission, etc.),

flight termination systems (FTS), ground operations and flight

operations. Included in the flight analysis portion are

requirements for trajectory modeling and descriptions along with

the dynamic characteristics of the vehicle during a malfunction

turn.This information is used by Range personnel to construct the

abort lines. Ref. 5 is an example of the equipment requirements

to support typical missions from a National Range.

2-10
REFERENCES TO CHAPTER 2

1. "Range Safety Requirements, Range Safety Regulation," ESMC

Regulation 127-1, Dept. of the Air Force, Headquarters Eastern

Space and Missile Center (AFSC), Patrick Air Force Base, Florida,

July 30, 1984.

2. "Range Safety Requirements, Range Safety Regulation," WSMC

Regulation 127-1, Dept. of the Air Force, Headquarters Western

Space and Missile Center (AFSC), Vandenberg Air Force Base,

California, May 15 1985.

3. Air Force Regulation (AFR) 127-100, Safety-Explosives Safety

Standards (May, 1983; 2nd revision Jan., 1985).

4. Hazards of Chemical Rockets and Propellants Handbook: Vol.

I, General Safety Engineering Design Criteria; Vol. II, Solid

Rocket Propellant Processing, Handling, Storage, and

Transportation; Vol. III, Liquid Propellant Handling, Storage,

and Transportation. CPIA 394, Vol. I, II, and III. Chemical

Propulsion Information Agency, 8621 Georgia Ave, Silver Spring MD

20910, September, 1984.

5. "Missile Flight Control Operations Requirements," WSMC

MFCOR, Dept. of the Air Force, Headquarters Western Space and

Missile Center (AFSC), Vandenberg Air Force Base, California, 3

January 1984.

6. "Space Activities of the US, Soviet Union and other

Launching Countries: 1957-1986", M.S. Smith, C.R.S. US Congress

Report 87-229 SPR, Feb. 1987.

7. "Range Safety Handbook", NASA GHB 1771.1, Sept. 1984.

2-11
6/20/95 rev

3. EXPENDABLE LAUNCH VEHICLE (ELV) CHARACTERISTICS

Currently under revision.
10/2/95 rev

4. LAUNCH AND ORBITAL OPERATIONS 1

4.1 PHASES OF LAUNCH THROUGH ORBITAL OPERATION

Launch and orbital operations can be divided into two or three

phases:

(1) the initial launch and boost phase which terminates when the

vehicle obtains the velocity and altitude necessary to achieve

Earth orbit;

(2) the orbital transfer phase, during which properly timed

firings of rocket motors move the satellite into the desired

final orbit; and

(3) depending upon the mission, return from orbit. Re-entry is

further discussed in Vol. 2, Ch. 7.

4.1.1 Launch Phase

The prime objective during the launch phase is for the boost

vehicle to overcome Earth's gravitational pull, rise through the

atmosphere and overcome frictional heating. It must provide a

satellite with an initial vertical and final orbital velocity

(almost parallel to the surface of the Earth) using sustainer and

upper rocket stages which will keep it in orbit. Depending on

the latitude of the launch point, the desired orbital inclination

and altitude, the initial orbit may not be the final orbit for

the satellite. To change inclination the boost and higher stages

of the ELV must rotate the attitude of the vehicle, so that it

will be moving in the proper direction, and then pitch over to

the orbital plane gradually as it gains velocity and altitude.

The gradual programmed pitchover (called a gravity turn) is

carefully designed so that the angle of attack (the angle between

the axis of the vehicle and the vector of the aerodynamic forces)

is kept as close to zero as possible. The gravity turn is

preceded by a small pitchover maneuver called the "kick angle."

If this is not accomplished, the aerodynamic loads on the vehicle

will build up and overcome the guidance and control system,

thereby producing a deviation from the planned flight path. If

the angle of attack becomes too large, the airloads may overstress the vehicle and cause its structural failure. The

aerodynamic force effects are proportional to one half of the

product of the local atmospheric density and the vehicle velocity

squared (called dynamic pressure or "q"). In some vehicles,

failure can begin at less than 10 degrees angle of attack during

 

 

1 The information in this chapter was developed using the references listed

at the end of the chapter. This material is intended for readers with little or no

background in either orbital mechanics or rocketry. Others can proceed directly to

Chapter 5.

4-1
the "high q" portion of flight. A typical trajectory profile is

shown in Figure 4-1.

When the vehicle reaches a very high altitude, the atmospheric

density becomes so low that the dynamic pressure is essentially

zero regardless of the velocity. After this, the zero angle of

attack is no longer required and different pitch attitudes and

pitchover rates can be used.

Control of all launch vehicles is maintained by gimballing

(tilting) the engine nozzles or some equivalent way for changing

the direction of the engine thrust. Launch vehicles must be

controlled continuously because they are, without exception,

aerodynamically unstable, i.e., a slight increase in angle of

attack will cause the aerodynamic forces to attempt to increase

the angle of attack even further. Severe wind shears during the

early post-launch period of flight create difficulty for most

vehicles, as the guidance and control systems must act to

minimize the pitching or yawing due to abrupt angle-of-attack

changes which they create.

Most launch vehicles contain several stages. Thrust is initially

provided by the lowest (and largest) boost stage. When the fuel

for this first stage is consumed, the spent fuel casing is

jettisoned to Earth, the remainder of the vehicle separates from

it and the next stage is fired to continue the flight. 

Part of the preparation for any mission is the planning for the

impact location of the spent stages (and other jettisoned

equipment) in order to minimize the risk to people and property

on the ground (see Ch. 2).

Most of the current launch vehicles use solid rockets fastened to

a central core vehicle which is usually a liquid propellant

stage. These "strap-on" solid rocket motors (SRM's) augment the

first stage thrust and are jettisoned when their propellant is

consumed.

4.1.2 Orbital Insertion and Orbital Operations

It is not possible to describe the myriad of possible orbital

parameters which may be desired or designed for different mission

objectives. This discussion will only briefly cover the very

simplest example. Consider the sequence of events illustrated in

Figure 4-2. In the first illustration (a), a satellite (with a

booster stage) is placed in a low "parking" orbit around the

Earth. The rockets are fired in orbit and then shut off. The

result of this orbital correction firing is the creation of a new

elliptical "transfer" orbit which has an apogee (greatest

distance from the Earth) which is at a higher altitude above the

Earth than the original orbit (Figure 4-2(b)). If the satellite

has no further propulsion, it will continue to follow this

4-2
4-3
4-4
elliptical orbit indefinitely, passing (ideally) through its

initial perigee point once very revolution. If the objective is

to reach a higher circular orbit, the built-in rockets (apogee

kick motors, AKM) can be fired again (for a specified period of

time) when the satellite reaches the apogee of the elliptical

orbit, and the new orbit will be as shown in Figure 4-2(c).

4.1.3 Orbital Decay and Re-entry

Once out of the densest portion of the atmosphere, the ELV and

its payload (satellite) has only very small drag forces acting

upon it to reduce the satellite velocity. Consequently, the

satellite will continue to orbit until reverse thrust (retropropulsion) is applied for a planned re-entry or decay forces

eventually cause an uncontrolled re-entry. Controlled descent

from an orbit reverses the firing sequence for orbit transfer.

Rocket engines fire for a determined interval and angle and the

vehicle/satellite now follows an elliptical orbit with apogee at

the original orbital altitude and perigee at an altitude much

closer to the Earth. If the perigee is within denser portions of

the atmosphere, the vehicle/satellite will start to slow down

gradually because of aerodynamic drag and descend to the Earth

sooner due to orbital decay (see Vol. 2, Ch. 7). Aerodynamic

heating is intense because of the very high vehicle velocity as

it is coming out of orbit and the slow initial braking during reentry. Objects not designed to withstand this heat by protection

from a heat and ablation shield generally break up and, often,

vaporize altogether. Re-entry vehicles (RV's) similar to those

provided for ICBM's have been proposed for recoverable payloads.

Satellites which are placed in very low Earth orbit may not need

any propulsion to return from orbit. Even at an altitude of 200

miles, the very low density of air molecules still applies a

small, but continuous drag force. These satellites will very

slowly lose both velocity and orbital altitude and the decay will

gradually increase until the object is traveling slow enough to

re-enter the Earth's atmosphere. This unplanned re-entry is

discussed further in Ch. 7. Figure 4-3 shows approximate orbital

lifetimes for satellites in circular orbits. Orbital lifetime is

a direct function of the mass to drag ratio of the satellite.

This ratio is represented by the ballistic coefficient β which is

equal to W/CDA; where W is the weight, CD is the drag coefficient

of the body, and A is the cross-section area. The shaded area in

the figure shows the range of lifetime in orbit for objects whose

ballistic coefficients range from 10 to 300 lb/ft2. The larger

values of ballistic coefficient correspond to the longer

lifetimes in the shaded region shown in Figure 4-3.

If rocket engines are used to de-orbit, as proposed for

recoverable payloads that use re-entry vehicles (RV's), the 

4-5
4-6
potential hazard from the re-entering spacecraft is controllable.

However, the hazard from a decayed satellite re-entry is

uncontrolled and usually cannot be predicted with any accuracy

(see Ch. 7).

4.2 BASIC ORBITAL CHARACTERISTICS

A satellite stays in orbit because the centrifugal (outward)

force equals the Earth's gravitational pull (inward). The

centrifugal force is proportional to V2/R, where R is the distance

from the center of the Earth to the satellite and V is the

component of satellite velocity which is perpendicular to the

radius R. The gravitational pull decreases with distance and is

proportional to 1/R2. For low Earth orbits (LEO), the

gravitational pull is stronger and, consequently, satellites must

have a higher velocity to compensate and, thus, circumnavigate

the globe much more rapidly. Figure 4-4 shows the relationship

between orbital velocity and altitude above the surface of the

Earth for circular orbits. Figure 4-5 gives the period (the time

required to complete one circular orbit) as a function of

altitude above the surface of the Earth.

Not all orbits are circular; many are elliptical and are employed

in orbital transfer and other mission applications. The perigee

of an elliptical orbit is the minimum altitude of the orbit; the

apogee is the maximum altitude (see Figure 4-6). The

eccentricity is a measure of the ellipticity of the orbit. The

formula for eccentricity is:

e = ra - rp ÷ ra + rp (4-1)

where ra is the distance from the center of the Earth to the

apogee altitude and rp is the distance from the center of the

Earth to the perigee altitude. The apogee and perigee altitudes

for a circular orbit are equal, hence a circular orbit has zero

eccentricity. Elliptical orbits having the same perigee altitude

as a circular orbit always have a longer period, with the period

increasing with the eccentricity.

The free flight path of a suborbital rocket or an expendable

launch vehicle (ELV) is also elliptical. These vehicles, after

completion of powered flight, follow a ballistic trajectory with

an apogee above the surface of the Earth and a perigee which is

below the surface of the Earth (see Figure 4-6).

4-7
4-8
4-9
4-10
The concepts of energy and angular momentum are essential in

understanding orbital mechanics. The total mechanical energy has

two components, kinetic energy (K.E.) and potential energy

(P.E.). As long as no additional force is being applied to the

satellite (e.g., aerodynamic or rocket thrust), the total energy

of the satellite remains constant, i.e.,

Total mechanical energy = K.E. + P.E. = constant (4-2)

The kinetic energy is proportional to the square of the velocity

of the satellite. Potential energy results from the combination

of gravitational attraction and distance to the gravitational

source. The total energy per unit mass, E, will remain constant

throughout the orbit (circular or elliptical) unless a force

impulse, such as rocket thrust or drag, is applied to the

satellite. Thrust in the direction of the velocity vector will

increase the energy and thrust or drag in the direction opposite

to the velocity vector will decrease the energy.

Hence, an orbiting satellite has both Kinetic Energy: KE = mv2/2

and Potential (Gravitational) Energy: GmM/r at its orbit

altitude (r = R+h; where R is the Earth's radius, h is altitude

above the Earth and M is the Earth's mass). The constant μ = GM

in (ft/sec)3 or (m/sec)3 is the constant product of the Universal

Gravitational constant and Earth's mass.

This simplifies the total energy per unit mass for an orbiting

satellite to a specific mechanical energy:

Es = E÷M = (KE + PE)÷ m = (v2÷2) - (μ÷r) = const. (4-3)

If Es<0, the path is parabolic; if Es=0, the satellite is in a

captive orbit (elliptical, or circular). If Es>0, the path is

hyperbolic and the satellite will escape Earth's gravitational

pull. The escape velocity is obtained from:

(vesc

2 ÷ 2)-(μ ÷ r)= 0; vesc = 36,700 ft/sec or about 12 km/sec (4-

4)

For launch velocities below vesc , the satellite will either

return to Earth (suborbital injection velocities) and follow a

ballistic (parabolic trajectory) or orbit in a circular or

elliptical orbit with a speed (v) and period (P) determined as

below in equation (4-5):

P = (2∏r) ÷ v v =

4-11
4-12
Two body gravitational interactions and no energy dissipation are

assumed for the present discussion. The effects of solar wind,

atmospheric drag and lung-solar perturbation on orbital

parameters and decay are discussed in Ch. 7. Figure 4-7 shows

the velocity vs. range for a rocket and payload.

Since energy is conserved, it is now possible to visualize the

exchange between potential and kinetic energy in an elliptical

orbit. When the satellite is nearest to the Earth (perigee), the

potential energy is least and the kinetic energy is at its peak.

Hence the satellite reaches its highest velocity at the perigee

and its lowest velocity at the apogee (where the potential energy

is highest).

The kinetic energy required for different orbits can be related

to a characteristic velocity. The characteristic velocity is

also the summation of all the velocity increments attained by

propulsion to establish the desired orbit. Table 4-1 (from Ref.

1) describes the characteristic velocities for a number of

missions.

4-13
4-14
Angular momentum is also a conserved quantity, so that without an

external application of torque for a period of time, a spinning

body will neither increase nor decrease its rate of spin.

Satellite orbits have an angular momentum, which is about an axis

through the center of the Earth. The orbital angular momentum,

H, is given by:

H = (R)x(v)x(cos θ) (4-6)

where H is the angular momentum, R is the distance from the

satellite to the center of the Earth and θ is the angle between

the velocity vector and a line in the orbital plane which is

perpendicular to the position vector (see Figure 4-8). The

product "v x cos θ" can also be referred to as the tangential

velocity. H is constant except when the satellite is accelerated

or decelerated by thrust or drag.

The equations for conservation of energy and angular momentum are

necessary to analyze the dynamics of satellite orbits. The

oblateness of the Earth requires some additional terms over those

shown in Equation 4-3 for the potential energy expression, to

obtain more accuracy in the orbital predictions; and the

gravitational fields of the Moon and the Sun, in particular,

should also be considered in increasing prediction accuracy.

The plane of the orbit is defined by the longitude of the

ascending node and its inclination. These are shown in 

Figure 4-9. The ascending node is the point where the projection

of the satellite path crosses the celestial equator from south to

north. The inclination is the angle formed by the plane of the

orbit and the equator. It is measured counterclockwise from the

eastern portion of the equator to the ascending node. Thus,

satellites which orbit west to east (normal or prograde) have an

inclination <90o; orbits going east to west (retrograde) have an

inclination >90o. An alternate method sometimes used to

designate retrograde inclination is to measure the angle

clockwise from the western portion of the equator and state it as

an Xo retrograde inclination (see Fig. 10-8). A third term often

used to describe orbits is the right ascension (ê). This is the

arc of the celestial equator measured eastward from the direction

of the vernal equinox to the ascending node.

The choice of orbit depends upon the mission of the satellite.

ow Earth orbits (LEO) serve a variety of purposes and do not

necessarily operate close to the plane of the equator. In fact, 

orbits with higher inclinations (near polar) provide the

satellite the opportunity to cover a larger portion of the

Earth's surface(see Figure 4-10).

4-15
4-16
Communications satellites are generally placed in geosynchronous

Earth orbits (GEO) where they complete one revolution of the

Earth in 23 hours, 56 minutes and 4 seconds. A satellite in a

geosynchronous orbit on the equatorial plane will appear

stationary to observers standing on the equator. In order to

have this day-long orbital period,2 a satellite must be at an

altitude of roughly 19,300 nautical miles above the surface of

the Earth (5.6 Earth radii). The plane of the orbits of these

satellites is either the same as the plane of the equator or at

some relatively small inclination angle to the equator. Ideally,

equatorial orbits can be achieved directly, with no mid-course

 

 

2 Our "solar day" of 24 hours corresponds to the Earth's apparent spin period

but the Earth actually rotates approximately one and 1/365 turns in that time. One

rotation of the Earth takes 23 hours, 56 minutes and 4 seconds. Time on a scale

based on exactly one rotation of the Earth is referred to as sidereal time. One 24-

hour day of sidereal time is equivalent to 23 hours, 56 minutes and 4 seconds of

solar time. 

4-17
corrections, only by launches from the equator. Launches from

points north and south of the equator have a minimum inclination

which is related to the launch site latitude. Thus, equatorial

orbits are normally achieved by maneuvers whereby the satellite

is reoriented and a rocket motor is fired perpendicular to the

plane of the current orbit to create a new orbit orientation (see

Figure 4-11).

4-18
Since the orientation of the orbit is relatively motionless in

space while the Earth turns inside it, the ground track of the

orbit will recess (fall behind). The rate of recession is based

on the number of degrees the Earth rotates while the satellite is

completing one orbit. The northern-most and southern-most range

of the ground track are equal to the inclination of the orbit.

A typical ground track is shown in Figure 4-10. The width of the

ground track, as seen by the satellite from orbit, is also called

a "swath" or "footprint" of the satellite.

There are external forces which perturb the otherwise stationary

orbital plane and cause it to change orientation. The largest

effects are caused by the oblateness of the Earth and the

gravitational pull of both the Sun and the Moon, called lungsolar perturbations. Their relative importance varies with the

altitude of the orbit. The relative effects in terms of

acceleration (Earth gravitational units, or g's) for a satellite

200 n mi. above the Earth are shown in Table 4-2. As the

altitude of the orbit increases, the relative effect of the

Earth's oblateness decreases and the Sun and the Moon's influence

increases.

4-19
While the attraction of bodies other than the Earth can distort

the orbit, the oblateness of the Earth will cause the plane of

the orbit to precess around an axis through the pole of the

Earth. The additional girth of the Earth around the equator

(oblateness) produces a torque on the orbit and the result is a

precessional motion not unlike that of a gyro or top. The

precession rate can be defined as the number of degrees the line

of nodes moves in one solar day. The nodal precession rate for

circular orbits is shown in Figure 4-12. Note that the effect of

the Earth's oblateness lessens with the altitude of the orbit and

also with the inclination of the orbit. A polar orbit will not

precess.

The rotation of the Earth has an influence on the ability to

launch satellites into desired final orbits. Looking down upon

the North Pole, the Earth rotates counterclockwise. At the time

of launch, the rocket already has a horizontal component of

velocity which equals in magnitude the product of the Earth's

rate of rotation and the distance to the axis through the poles

of the Earth. If the ELV is launched in the direction of this

velocity vector (eastward), it reaches orbital velocity easier

than if it is launched in a westerly direction, in which case

this surface velocity must be first overcome. (This effect

varies with the latitude of the launch point. It is greatest at

the equator and absent at the North or South Poles.) This factor

is one influence on selection of a site for conducting launches.

Therefore, in the United States, eastward launches of satellites

into equatorial orbits from ETR, Florida augment the ELV thrust.

More payload can be placed into orbit than from an identical

launch made from, for example, Maine. The satellite launches

from the West coast are almost always to the south to achieve

polar (high inclination angle) orbits. Polar orbits are

perpendicular to the velocity provided by the Earth's rotation,

thus the rotation neither helps nor hinders the polar launch.

However, the launch corridors used at both ETR and the West coast

are chosen primarily for safety considerations. Launches

eastward from ETR and southward from the West coast fly over

water rather than inhabited territory and do not pose hazards to

populated areas due to jettisoned stages or other debris.

4-20
4-21
REFERENCES TO CHAPTER 4

1. Hazard, Hap (edited by Heizz F. Gehlhaar and LT. Ronald G.

Higden), U.S. Space Launch Systems (Rev. 2), Navy Space Systems

Activity, Los Angeles, California, 1 July 1977.

2. Bate, Roger R., Donald D. Mueller and Jerry E. White,

Fundamentals of Astrodynamics, Dove Publications, New York, New

York 1971.

3. Cochran, Curtis D., Dennis M. Gorman and Joseph D. Dumoulin

(Editors), Space Handbook, (2nd Rev.) Air University Press,

Maxwell Air Force Base, Alabama, 1985. (AU-18)

4. Thomson, William T., Introduction to Space Dynamics, John

Wiley & Sons, New York, New York, 1961.

5. White, J. Frederick (Editor), Flight Performance Handbook for

Powered Flight Operations, Space Technology Laboratories (now

TRW), Redondo Beach, California, 1962.

4-22
10/2/95 rev

5. PRE-LAUNCH AND LAUNCH HAZARDS

5.1 INTRODUCTION

5.1.1 Background and Objectives

A hazard is the existence of any property or condition which,

when activated, can cause injury, death, or result in damage to

property. Of interest to this study are launch-related hazards

which could affect third parties, namely people or property not

connected with ELV operations. Thus, hazards which have effects

contained within the boundaries of the Range are not discussed

explicitly in this context.

A hazard potential exists because large quantities of liquid

and/or solid propellants are part of the ELV and they could be

unintentionally released in case of a launch accident. This

hazard decreases with time into the flight because the quantities

of on-board propellants decrease as they are consumed and the

vehicle moves away from both the launch site and nearby populated

areas. The exposure to launch accident hazards is greatest

during the first few minutes after launch.

The major generic hazards in the event of an accident involving

propellants during pre-launch and launch operations are:

1. Explosions: uncontrolled combustion of these

propellants at a very fast rate per unit volume such that

part of the chemical energy is converted to mechanical

energy and part to heat. The mechanical energy is produced

in the form of a blast wave with the potential of causing

damage by crushing forces and winds (Sec. 5.2).

2. Debris: vehicle fragments that may land upon

structures or populated areas. Fragments may include

burning propellants which could explode or burn upon landing

thus posing additional hazards of types 1 and 3 (Sec. 5.3).

3. Fires: uncontrolled combustion of the propellants at

a slower rate than occurs in explosions, thus converting

their chemical energy into heat only. The corresponding

hazard is thermal radiation to people and property in the

proximity of the fire (Sec. 5.4).

4. Toxic Vapor Clouds: some hypergolic propellants (such

as monomethylhydrazine, nitrogen tetroxide and Aerozine-50)

are toxic and corrosive. If released in an accident,

unreacted vapors and aerosols may be transported by

prevailing winds in the form of clouds. Hydrazine vapors

are colorless and become white when combined with

atmospheric moisture; nitrogen tetroxide vapors are reddish

brown. Such clouds may pose a health hazard to people and

are potentially harmful to animals and vegetation (Sec.5.5).

Other toxic propellants include fuming nitric acids, liquid

5-1
fluorine, anhydrous ammonia, nitromethane, ethylene oxide,

chlorine trifluoride, chlorine, nitrogen trifluoride,

hydrogen peroxide, hydrogen chloride and hydrogen cyanide.

Hazards associated with noise, sonic boom and small quantity

releases of toxic materials are not considered in the same

severity category as the hazards listed above and are not

addressed in this report.

In a given accident, one or more of these hazards may occur and

prevail in importance over the others, depending on the specific

circumstances of the event such as: vehicle design, accident

location, failure mode, propellant type, amount of propellant

released, mode of release, environmental conditions and proximity

of people and property. Sometimes, the occurrence of one hazard

may preclude another because they compete for the same

propellant. For example, when most of the propellant is consumed

in a fire, a vapor cloud will not form. Other times, the hazards

may be sequential -- such as the formation of toxic vapors in a

fire or an explosion which may later pose a toxic vapor cloud

hazard. The possible off-range impacts of launch accidents are

illustrated in Sec.5.6.

This chapter presents a generic discussion of the major types of

hazards associated with the ground preparation and launch of

ELV's namely: explosions, debris, fires and vapor clouds. The

objective is to provide an overview of the mechanisms involved in

these hazards, the types of analyses used and the damage

criteria. The hazards are considered to be of very low

likelihood. Their applicability to, and magnitude in, any launch

operation should be established by detailed analyses of the

specific circumstances in each case. Such analyses for typical

launch operations are discussed in Ch. 10, Vol. 3. A second

objective is to provide a perspective on launch hazards by

comparison with industrial and transportation accidents.

5.1.2 Major Information Resources on Rocket Propellant Hazards

In order to assess public risk exposure derived from launch

hazards, information must be drawn from reports of major

experimental and theoretical studies of the behavior of

accidentally released propellants and fuels.(1,3) These studies

include test programs carried out by government agencies (NASA

and DOD) where realistic accident scenarios were simulated on a

large scale. Two notable test programs were projects PYRO(2) and

SOPHY.(3) Both are summarized briefly below to illustrate the

experimental basis for the information that follows in this

chapter:

1. Project PYRO tested the explosive yield and flammability of

liquid propellants namely:

5-2
• hypergolics (Aerozine-50 & Nitrogen Tetroxide used as

fuel and oxidizer in both the Titan and Delta vehicles)

in mass ratio of 2.25/1, in several configurations and

with total weights of up to 200 to 1000 lb (90 to 450

kg);

• Liquid Oxygen/RP-1 (used in the Atlas vehicle) in mass

ratio of 2.25/1 and with a total weight of up to 25,000

lb (11,000kg);

• Liquid Oxygen - Liquid Hydrogen (used in the Centaur

vehicle) in mass ratio of 5/1 and in total weights of

up to 100,000lb(45,000kg);

• Full-scale Saturn S-IV and a modified Titan I first

stage.

Also, three accident conditions were simulated to produce

different types of mixing effects:

• failure of an interior bulkhead separating fuel and

oxidizer;

• fall back of a space vehicle on the launch pad with

complete tank rupture and subsequent ignition;

• high velocity impact of a space vehicle after launch.

2. Project SOPHY addressed the hazards associated with

handling, transporting, testing and launching of solid

propellants. Solid propellants were tested in various

geometries, sizes and weights (the latter varied from a few

hundred to half a million pounds). Shock initiation was produced

with a TNT charge centered on the end face of the propellant.

Air blast and fire ball data were collected and analyzed

statistically to develop scaling relationships. The critical

charge diameter required to sustain a detonation in a typical

composite propellant was determined to be between 60 and 72

inches.

These two test programs and their results were discussed

extensively in a Chemical Propulsion Information Agency (CPIA)

publication entitled "Hazards of Chemical Rockets and

Propellants".(1) The results were analyzed to identify and

quantify the resulting hazards and to develop methodologies for

use in hazard analysis. Their findings are drawn upon

extensively without having reviewed in detail the original

reports of project PYRO and SOPHY.(2,3) Other references of

interest to such analyses are safety standards AFR 127-100(4) and

DOD 6055.9-STD.(5)

Against this background, we will present a generic discussion of

the explosion, debris, fire and vapor cloud hazards associated

with the accidental release of propellants. Hazard analyses of

specific launch operations will also be discussed in Vol. 3,

Chapters 9 and 10.

5-3
5.2 EXPLOSION HAZARDS

Explosion of an ELV can occur accidentally, as with the Titan 34D

event in April, 1986, or as a result of a destruct command using

the flight termination system. In some cases, flight termination

is accomplished simply by shutting off the fuel supply to liquid

fuel engines. In this case, an explosion may not occur unless

the intact vehicle and its remaining fuel impact the ground

sharply.

An explosion is a very rapid expansion of matter into a volume

greater than its original volume. The cause of the expansion

might be combustion, electrical discharge (such as lightning) or

a purely mechanical process such as the bursting of a cylinder of

compressed gas. The faster the energy is released, the more

violent the explosion.

Rocket motors are designed to burn their fuels and release their

energy in a controlled combustion process called a deflagration,

or simply, a flame. In a deflagration the reaction front is

driven by diffusion mechanisms. At steady state, it proceeds in

the material at a rate lower than the speed of sound.

Under some conditions, the rate of energy release can increase

significantly, leading to an explosion. The combustion process

is then called a detonation. 

In a detonation the reaction front consists of a shock wave

followed by a flame. The reaction front is driven by a shock

compression mechanism. At steady state, it proceeds in the

material at a rate faster than the speed of sound.

There is a spectrum of reaction possibilities between steady

state deflagrations and detonations, such as a fast deflagration

and a weak detonation, with the potential of a transition from

one reaction to another. The deflagration-to-detonation

transition is referred to as DDT. A shock-to- detonation

transition is also possible and is referred to as SDT.(6,7)

For solid propellants (see Table 3-3, Vol. 1, Ch. 3), crosslinked double base hybrid materials (DOD Class/Division 1.1--old

Class 7) were always considered in the past to represent a

detonation hazard; most composite propellants (Class/Division

1.3--old Class 2) were considered to represent a fire

(deflagration) hazard. However, recent trends in rocket motor

design include: more energetic composite propellants, higher

solid loading densities, larger grain diameters and greater mass.

The net effect is that composite propellants may also detonate

inadvertently under the dynamic conditions of accidents.

Although, they may require a larger initiation energy than 

5-4
Class/Division 1.1 propellants and their detonation may not be

self-sustaining, resulting in lower yields(7).

A number of conditions influence the likelihood of solid

propellant detonation:(6,7)

• propellant toughness;

• motor geometry, core configuration, diameter, length to

diameter ratio, chamber pressure, case bonding

technique and propellant residual strain;

• propellant critical diameter and geometry;

• propellant granular bed characteristics (pyrolysis and

ignition) both thermally and mechanically induced,

leading to faster combustion terminating in a

detonation (DDT);

• propellant response to shock (SDT);

• propellant response to delayed reduced shock (referred

to as XDT)

• impact velocity and surface impacted (water, sand or

concrete).

A question of particular interest is whether activation of the

destruct system is likely to detonate solid rocket boosters.

This subject was studied recently by the Naval Surface Weapons

Center (NSWC) for a filament wound graphite case material.(8)

They tested:

• linear shaped charge (LSC)/propellant case

interactions;

• detonability and shock sensitivity;

• material response (breakage of propellant).

They concluded that activation of LSC would not detonate the

Solid Rocket Booster propellant. At most, a rapid burn is

expected.

For liquid propellants, the likelihood of detonation is

influenced by chemical composition and conditions such as:

• degree of fuel and oxidizer mixing and size of the

mixture prior to initiation;

• confinement of the products of combustion;

• presence of obstructions or flow instability that

generate turbulence and result in increased reaction

areas.

Such conditions are encountered in accidents to various degrees.

Thus, it is usually very difficult to predict with certainty

whether or not a detonation will occur.

Still, overpressure can result if the reaction is fast enough,

even though it is not an ideal, steady state detonation. The

5-5
main difference is in the near-field where a detonation generates

a much higher overpressure. This difference decreases further

away from the center of the explosion. The far-field is of

particular importance to this study which focuses on potential

damage to the public (third parties) off-range. Overpressure

estimation methods are presented in the next section.

5.2.1 Blast Waves

Scaling laws are used to calculate characteristic properties of

blast waves from explosions. With the aid of such laws, it is

possible to present characteristics of the blast wave, for any

yield, in a simple form. This is presented below for the case of

air at constant temperature and pressure.

Full-scale tests have shown that these relationships hold over a

wide range of explosive weights (up to and including megatons).

According to the scaling laws, if d1 is the distance from a

reference explosion of W1 lb at which a specified hydrostatic

overpressure or dynamic pressure is found, (Dynamic pressure q =

1/2 pv2, where p is air density and v is particle velocity), then

for any explosion of W lb, these same pressures will occur at a

distance, d, given by:

d/d1 = (W/W1)

1/3 (5-1)

In other words, the pressures are functions of a unique variable

(d/W1/3) called the scaled-distance or k-factor.

Cube-root scaling can also be applied to the arrival time of the

shock front, positive-phase duration and impulse; the distances

concerned are also scaled according to the cube-root law (see

Figure 5-1 for a definition of these terms). The relationships

may be expressed in the form: t/t1 = i/i1 = d/d1 = (W/W1)

1/3, where

t represents arrival time or positive-phase duration, i is the

impulse and the subscript 1 denotes the reference explosion W1.

These relationships are well established and accepted in the

literature. They form the basis of most explosion models,

including that used in Chapter 10 of this report.

It should be noted that the above relationships are for blast

waves in free field, under ideal conditions. In a real,

stratified atmosphere, shock focusing may occur producing higher

overpressures than in free field. Such effects have been taken

into account in a computer model named BLAST based on acoustic

wave propagation. The model was developed by WSMC and has been

verified experimentally.(9)

5-6
5-7
5.2.2 TNT Equivalency Analysis

It is conventional to express the magnitude of an explosion of a

given material (e.g., solid or liquid propellant) in terms of an

equivalent weight of TNT (symmetrical tri-nitrotoluene, a

conventional ordnance explosive) required to produce essentially

the same blast wave parameters. The TNT equivalent weight was

selected because of the large amount of experimental data

available on blast waves and damage produced by TNT explosions.

A given material may have several TNT equivalent weights

depending on the selected blast wave parameter, i.e., it may have

an equivalent weight based on peak overpressure, another based on

positive impulse, (see Glossary, App. A, or Figure 5-1), etc.

Peak overpressure is more commonly used, however, to define TNT

equivalence. TNT yield refers to the TNT equivalent weight

expressed as a percent of the weight of the propellant.

The TNT-equivalent analysis has a number of limitations that

should be borne in mind to obtain valid comparisons. They are:

• Not all the accidentally-released material is involved

in the explosion: part of it may disperse without

reacting and part may react at a different time or

location from the explosion. Accordingly, measured TNT

yields of liquid propellants were found to depend on

the degree of fuel/oxidizer mixing prior to explosion

initiation. This degree of mixing depends, in turn, on

the rate of mixing (a function of vehicle design,

failure mode and accident conditions) and its duration

(a function of when ignition occurs).

• Of the portion of released material that reacts in the

explosion, part of it may detonate and part may

deflagrate, with the latter contributing little energy

to the blast. Predicting whether a detonation or

deflagration (or any combination of them) will occur is

a very complex subject, as discussed earlier. The

outcome depends on the propellant properties and on the

conditions of the accident. For example, with solid

propellant fragments, an impact speed greater than 300

ft/sec is likely to have sufficient energy to initiate

the detonation of that fragment upon impact.(7)

• Even for the portion of the released material that

contributes directly to the blast energy, the blast

characteristics are different from those of a TNT

charge with an equivalent energy. Measured

overpressure amplitudes are generally lower and

durations are longer because of a slower reaction rate

for propellants than for TNT. This rate depends on

5-8
accident-specific conditions such as: strength of

initiating source, degree of confinement and shape of

propellant.

Thus, the TNT yield of a material is not an absolute property

such as density or molecular weight. Instead, it depends on the

test conditions in which it is measured. Fortunately, the

dependence of blast parameters on yield is low because of the

cube-root exponent in the scaling law (Eq. 5-1). Hence, the

prediction of a hazard distance (d) is not very sensitive to the

employed yield (W). For example, if the yield is off by 50

percent, the distance (at which a particular overpressure is

reached) is off by only 15 percent. Thus, the TNT method of

analysis has been used effectively over many years despite the

limitations mentioned above.

In 1978, NASA established an Explosive Equivalency Working Group

to define potential failure scenarios which could lead to an

explosion and to estimate the maximum credible explosive TNT

equivalency for these explosions. The most complete

documentation of the findings of this group is reportedly in a

collection of briefing charts by W.A. Riehl et al.(10) The work

performed by this group provided a basis for many subsequent

studies,(11) many of which have quoted verbatim TNT equivalent

values from Ref. 10. This is illustrated in Table 5-1, which is

extracted from a study on shuttle safety.(11) A variety of failure

modes and accident scenarios are identified for the external tank

and the solid rocket motors; a maximum credible explosive

equivalent (or TNT yield) is estimated for each case. Also, the

range for these maximum credible TNT yields varies from:

• 5 to 50% for LH2/LOX

• 18 to 100 % for the solid rocket motors

The lower bound for these yields is zero, since the propellants

may react or burn without producing mechanical damage.

Although the STS is not being considered for commercial space

transportation, Table 5-1 is very useful to illustrate that the

yield of a propellant system can vary depending on the failure

mode.

Recommended values for TNT equivalency of liquid propellants

under selected worst case accident conditions are given in AFR

127-100.(4) Since AFR 127- 100 addresses the circumstances in

handling and storing propellants, it may not apply to launch

operations. 

5-9
5-10
The values are presented in Table 5-2, where it should be noted

that:

• TNT yields for the same propellant vary depending on

the accident conditions. While this variation is

consistent with the concept of TNT yield (as discussed

above), it is important to select the appropriate value

for each set of accident conditions since the yield

varies by up to a factor of seven.

• Significant equivalent TNT yields are estimated under

the most severe scenarios. These worst case scenarios

are very unlikely, however.

For illustration, the recommended TNT yield values are applied to

three classes of ELV vehicles of interest: Atlas/Centaur, Delta

and Titan. This is presented in Table 5-3, which shows the

propellant composition, weight, TNT yield estimate and TNT

equivalent weight for each vehicle. Note that :

• for liquid propellants, the yield estimates are based

on the recommended guidelines in AFR 127-100 which

represent worst cases. Thus, they are inherently

conservative.

• For solid propellants, the yield estimates are taken

from a compilation of SRM impact detonation history.(1)

A range of values (varying over a factor of five) is

given to cover a number of accident scenarios.

TNT equivalent weights are obtained by multiplying each

propellant weight by its yield. A range of TNT weights is

obtained because of the uncertainties in the yields. Such

uncertainties are expected in view of the previous discussion of

the various factors that affect TNT yield. In reality, the

ranges vary from a lower bound of 0 (i.e., no blast) to the upper

values (i.e., worst cases) in Table 5-3. To estimate a

reasonable value within this range requires an accident-specific

analysis, which is not attempted in this generic report.

Finally, note that a hybrid propellant mix technology (liquid

oxygen/solid polybutadiene fuel) proposed by AMROC, has been

assigned a TNT equivalence of zero by the DOD Explosives Safety

Board. 

5-11
5-12
5-13
5.2.3 Damage Criteria

Blast waves from accidental explosions can cause damage to people

and property (structures) by subjecting them to transient

crushing pressures and winds (which cause drag pressures due to

the sheer force of the wind). Even though the interactions of

the waves with the objects involve very complex phenomena,

relatively simple concepts have been used quite effectively to

correlate blast wave properties with damage to a variety of

targets. The concept states that damage is primarily a function

of either the peak overpressure, the impulse or some combination

of these two factors.

Guidelines for peak overpressures required to produce failures to

structures such as shattering of glass windows and collapse of

concrete walls are presented in Table 5-4.(1) Note that a very

low pressure (force per unit area) is sufficient to cause damage,

mainly due to the large area of such surfaces. Similar criteria

are used in the hazard assessment model used in Vol. 3, Ch. 10 of

this report.

Criteria for injury of personnel standing in the open are given

in Table 5-5.(1) They cover ear drum rupture and lung hemorrhage

caused by overpressure and personnel blowdown caused by the

impulse imparted by the blast wave, with the concomitant

potential of injury due to bruises, lacerations and bone

fractures. These data are presented in graphic form in Figure 5-

2 and Figure 5-3.(12) Note that:

• The overpressure required to cause damage decreases (as

expected) with the increase in the duration of the

positive phase of the blast wave.

• There is a significant variability in the

susceptibility of people to such overpressure. Such

variability can be accounted for statistically by

raising overpressure thresholds to ensure higher levels

of lethality. This should be done carefully to

maintain a realistic approach to analysis.

Finally, blast wave characteristics (Section 5.2.1) can be

combined with the present damage criteria in order to estimate

the extent of the damage (in feet) as a function of various

equivalent weights of TNT. Typical results are shown in Figure

5-4 for eardrum rupture, lung damage, etc. Similar data are

used in the next section and in Ch. 10, Vol.3 to illustrate the

assessment of both property damage and personnel injury over a

range of accident conditions.

5-14
5-15
5-16
5-17
5-18
5-19
5.2.4 Variation of Explosion Hazards with Time from

Liftoff

As noted, launch hazards decrease with time into the flight.

This point is illustrated in this section for potential third

party damage due to an accidental explosion of an ELV. The

variations of other hazards with time are not discussed.

Data are used for a typical Delta ELV system flight profile and

propellant consumption rate as a function of time elapsed after

liftoff.(13) However, qualitatively, the discussion applies

equally well to other ELV systems.

The outcome of an accident is usually determined by the specific

circumstances present at the time and location of the accident.

Usually, there are a number of variations for these circumstances

which can lead to a number of outcomes. In this illustration,

the analysis is simplified to focus on the effects of "time into

flight." 

The calculations presented below are also based on a number of

assumptions selected to make the analysis workable. For example,

for the sake of simplicity, it is assumed that all of the

propellants remaining on board will explode instantly (this

corresponds to a worst case calculable explosion scenario). In

reality, the situation is more complicated:

• some of the propellant may explode initially, producing

fragments that may explode later upon impact with the

ground (secondary explosions);

• some of the propellant may burn in a fireball; and

• some of the hypergolic propellant may disperse in the

environment without reacting, posing toxic risks or

dispersing harmlessly.

Another example of a simplifying assumption is to represent

different circumstances occurring at various times into flight by

simply changing the TNT yield. The yield is increased when the

circumstances (such as failure mode, mixing rate or impact speed)

favor a stronger explosion (as described in more detail below).

Note that each scenario can be associated with a vehicle failure

mode and is likely to occur with a particular probability value

(Section 5.6). Thus, although the discussion below makes no

explicit mention of probabilities, the predicted results are tied

to a particular probability value.

5-20
Therefore, three key changes can be identified as time elapses

from liftoff: the vehicle altitude (and down-range distance),

the quantities of propellants remaining on board and the

explosive potential of these propellants. These changes are

illustrated in Figure 5-5 and are discussed below.

5-21
First, the vehicle altitude increases very rapidly with time into

flight -- reaching roughly 20 nm. in the first 2 minutes, as

illustrated by curve A in Figure 5-5, which shows a typical

flight profile for a Delta mission.(13) Furthermore, the location

of launch sites and the direction of launch are usually selected

so the vehicle moves away from population centers. Thus, the

"separation" distance between the vehicle and the communities

potentially vulnerable, in case of a vehicle accident, increases

with time.

Second, as time elapses from liftoff, the quantity of propellants

remaining on board decreases very rapidly due to their rapid

consumption by the rocket booster and other engines. The total

weight of all propellants remaining on board is illustrated by

Curve B in Figure 5-5. Note that the total remaining propellant

weight decreases by about 50% within 2 minutes from liftoff.

Third, the explosive potential (or TNT yield) of a given quantity

of propellant may change as time elapses from liftoff. As

discussed earlier (Sec. 5.2.2), the TNT yield of a propellant in

an accidental explosion depends on its properties, as well as on

a variety of other factors, determined by the details of the

accident scenario. Example of such factors include: the sizes

of solid propellant fragments their impact speed, the rate and

extent of mixing of liquid propellants, the degree of

confinement, etc. In fact, the significance of TNT yields, how

they are estimated and the pertinent ranges of values given in

the published literature were discussed in Section 5.2.2. 

Determination of TNT yield at various times after liftoff

requires an extensive analysis. First, identify the type of

failures and accident scenarios that are likely to occur and

second, estimate the yield for each scenario and each propellant

system based on historical accident data, test data, experience

and engineering judgment. Such an analysis was done for the

Space Shuttle system by the Explosive Equivalency Working Group

established by NASA in 1978, as discussed in Section 5.2.2.

Ideally, the same type of analysis for each ELV type is needed to

establish pertinent explosive yields were the accident to occur

at various times from liftoff. However, for simplicity, another

approach which is not as rigorous, but may suffice, is used to

illustrate the explosive yield dependence on time from liftoff.

Table 5-2 in Section 5.2.2 lists upper limits for TNT yields for

ELV propellants reported in the literature. The lower bound for

these yields is zero (%), since the propellants may react or burn

without producing mechanical damage. The range of upper values

for the Delta vehicle propellants are:

5-22
• 10 to 20% for RP-1/LOX (Stage I)

• 5 to 10% for Aerozine-50/N2O4 (Stage II)

• 14 to 100% for the solid rocket motors (Booster and

Stage III)

Note that each point within these ranges can be associated with

a particular accident scenario which, in turn, may be associated

with a specific time from liftoff. For example, when a vehicle

(or its fragments) falls back on the pad soon after liftoff, the

speed at ground impact is a key factor in determining the

likelihood of detonating the solid propellants. It is known that

an impact speed of 300 ft/sec is required to detonate solid

propellants and produce significant yields. In order to reach

such terminal speeds in free-fall, a vehicle would have to start

at an altitude of approximately 1400 ft (assuming no drag). This

altitude would be reached in about 12 seconds after liftoff.

Thus, if the vehicle falls back onto the pad in the first 12

seconds (or so), a low yield is anticipated, while if it falls

back at a later time, a higher yield is anticipated. Following

this reasoning, the yields corresponding to these two situations

are assumed (for simplicity) to be the upper and lower values of

the ranges listed above for the three propellant types in the

Delta vehicle. Thus, the yields would be:

• 10, 5 and 14% (respectively for the 3 types of

propellants) in the first 0 to 12 sec after launch;

• 20, 10 and 100%, respectively, at later times into

flight. 

By multiplying these yields with the amount of propellants

remaining on board, the potential explosive energy (in terms of

equivalent pounds of TNT) is estimated as a function of time from

liftoff as illustrated by Curve C in Figure 5-5. Note that the

explosive potential starts at a low value (because of the low

yield); then increases because of the increase in yield

corresponding to higher impact speed; finally it decreases

because of the decrease in the quantity of propellant remaining

on board.

Using the potential explosive energy determined above, the

overpressure field around the explosion point was estimated

following the analysis outlined in Section 5.2.1. It was assumed

that the entire vehicle will explode at altitude and as one mass

(a more realistic assumption is a smaller explosion in flight,

breaking up the vehicle in fragments that will explode upon

ground impact). It was also assumed that any reflection or

focusing of the shock wave would have a negligible effect on the

overpressure field.

5-23
For these assumed explosion conditions, the "hazard" distances at

which critical overpressures are reached are shown as a function

of time in Figure 5-6. Three overpressure levels are used:

• 1.5 psi, for collapse of light weight structures (Curve

B)

• 0.35 psi, for window breakage with a probability of 50%

(Curve C)

• 0.20 psi, for window breakage with a probability of 10%

(Curve D)

The vehicle altitude from Figure 5-5 is also shown as Curve A in

Figure 5-6 for reference. 

5-24
In Fig. 5-6, the hazard distances first increase with time, and

then decrease -- following the behavior of the potential

explosive energy profile which is shown in Fig. 5-5.

Furthermore, Fig. 5-6 can be interpreted as follows:

• in approximately the first 25 seconds, damage such as

window breakage is possible in a distance of

approximately 1 nm. from the launch pad (or the

location of vehicle impact with ground).

• at later times, key scenarios are:

a- all the propellant explodes at the vehicle

altitude. The potential mechanical damage at ground

level is negligible (even if maximum yield is assumed)

because of the high altitude of the vehicle and its the

large separation from ground.

b- the vehicle falls back to Earth as one piece and

explodes. This is a very unlikely scenario since the

vehicle will breakup under the aerodynamic forces

produced by the fall. Even in such a worst case

scenario, Figure 5-6 suggests that the maximum

overpressure distance will be less than 1 nm. in the

first 25 to 60 sec time frame; much smaller yet at

later times because of the rapid consumption of

propellants with time of flight. The location of the

impact point will be governed by vehicle trajectory

during the fall, which in turn depends on a number of

factors as discussed in Section 5.3. 

c- the vehicle breaks up at altitude, producing

fragments, some of which may detonate as they impact

ground. The hazard of item b above is now distributed

over a broader region determined by the impact points

of the fragments. The overpressure hazard distances

around each impact point will be smaller than in b

above. They will depend on additional factor such as

number and size of fragments and their rates of

consumption during their fall. This is further

discussed in Section 5.3.

Off-range damage in any of the above cases will depend on the

presence of population centers within a radius (of the explosion

center) equal to the above distances (see Sec. 5.6).

Generally, the hazard from propellant explosion decreases

rapidly with time into flight, except for the first 10 to 25

seconds. Activation of the Flight Termination System is likely

to further reduce such explosion hazards by dispersing the

5-25
propellant. Typically, the FTS is not activated during the first

8-12 seconds (depending on ELV, mission and site) in order to

avoid damage to the pad facilities. This subject is discussed in

more detail in Ch. 3, Vol. 1 and Ch. 10, Vol. 3.).

5.3 DEBRIS HAZARDS

A debris hazard exists even for a normal successful launch,

primarily from jettisoned stages, shrouds and other components.

These can be expected to impact within the impact limit

boundaries of the flight corridor. The flight corridor is

specified by applying safety considerations to the mission flight

requirements, as discussed in Ch. 2, Vol. 1. Thus, hazards which

cannot be eliminated are controlled. Since the launch facilities

are located so that the vehicles will fly over largely

uninhabited areas and oceans, the risks to third parties in

normal operational situations are very low .

A debris hazard also exists due to failure modes such as

malfunction turns (from gradual to tumbling turns) and premature

thrust termination (from an accidental subsystem failure,

commanded thrust termination or commanded vehicle destruction).

Debris may be created either from breakup of the vehicle due to

excessive aerodynamic pressure or explosion (accidental or

commanded destruct). Major issues in assessing debris hazards

include: what is the number, weight and shape of fragments?

Where will they land? What is their impact force upon landing?

What is their impact in terms of structure penetration and

lethality? 

Illustrative examples of debris data from selected space vehicle

explosions and test data (occurring at or near ground level) are

shown in Figure 5-7 and Figure 5-8. These figures show the total

number and weight distributions of fragments (respectively) as a

function of range (i.e., distance). These distances were

determined by the forces of the explosions.

Clearly, when a vehicle is in flight at significant altitude, the

debris will land over a much larger area than in Figures 5-7 and

5-8. The distribution of debris impacts is dependent upon the

forces acting on the fragments. Initially, the velocity vector

of the vehicle is of primary importance and this contribution is

affected by the velocity vectors resulting from the turns,

tumbling and/or explosions. Thereafter, the effects of the

atmosphere on the fragments during free fall (which depend on

wind and the fragment size, shape and mass) become important.

These issues lead to uncertainties in the fragment impact

distribution which can be attributed to four basic sources:

(1) uncertainty in the vehicle state vector at vehicle

breakup or destruct;

5-26
5-27
5-28
(2) uncertainty in any destruct velocity imparted to the

fragment by a destruct system (or explosive failure); 

(3) uncertainty in the atmospheric environment during free

fall; and 

(4) uncertainty in the fragment size, aerodynamic lift and

drag.

Furthermore, impacting launch vehicle fragments can be divided

into four categories:

(1) inert pieces of vehicle structure; 

(2) pieces of solid propellant (some of which may burn up

during free fall);

(3) vehicle structures which contain propellant (solid or

liquid) that may continue to burn after landing (but are

non-explosive). They pose the risk of starting secondary

fires at the impact points; and 

(4) fragments which contain propellant and which can

explode upon impact (if their impact velocity is greater

than roughly 300 ft/s).

The casualty area of an impacting fragment is the area about the

fragment impact point within which a person would become a

casualty. Casualties may result from a direct hit, from a

bouncing fragment, from a collapsing structure resulting from an

impact on a building or other shelter, from the overpressure

pulse created by an explosive fragment, from a fire or toxic

cloud produced by the fragment or some combination thereof. The

hazard area is increased if a fragment has any significant

horizontal velocity component at impact which could result in

bouncing or other horizontal motion near ground level.

Casualty area is also affected by the sheltering of people by

structures. Structures may be divided into classes (for

computational purposes) depending on the degree of protection

they can afford.

Clearly, estimating a casualty expectation is a complex

computational problem. Different Ranges approach the problem in

different ways depending on the needs of the Range. Computer

models may be used, but the sophistication varies greatly from

Range to Range. A computer model called LARA (Ref. 9) treats

casualty areas analytically and is presented in other chapters

(Vol. 2, Ch. 4, and Vol. 3, Ch. 10).

5.4 FIRE HAZARDS

The fire hazards of accidentally released solid and liquid

propellants depend on the details of the accident scenario

including: the thermodynamic state of the propellant, the amount

5-29
of the release, vehicle location and speed (on launch pad versus

in flight), the presence of confining surfaces and ignition

sources, etc. The major types of fires that can develop are:

• Fireball: where burning occurs in a ball of fire that

expands and rises in the air (due to buoyancy forces)

until the propellant is consumed.

• Pool fire: where a film of propellant is formed on the

ground and burns with a flame attached to the film.

• Vapor cloud fire: where ignition is delayed and vapors

are carried away by prevailing winds, thus forming a

flammable cloud that may ignite at a later time.

• Various combinations of the above fires.

These fires are discussed below.

5.4.1 Fireballs

Fireballs are produced when the propellant is quickly vaporized

or atomized. These conditions include flash vaporization of

pressurized liquids and releases during flight at high speed.

The vapors or fine droplets can then rise under the effects of

buoyancy as they burn in the fireball.

The main damage mechanism is thermal radiation to people and

property. Another damage mechanism is firebrands from burning

solid propellants and hot debris which might start secondary

fires where they land. A third damage mechanism is impact damage

by vessel fragments which have been reported to travel large

distances. Overpressure may also develop due to the initial high

rate of energy release associated with vessel failure, but it is

usually insignificant.

The damage potential depends on key fireball parameters such as

diameter, rise rate, duration and temperature or emissive power.

These parameters have been quantified in several experimental and

analytical studies.(1) In fact, the ball diameter was found to

scale roughly with the 1/3 power of the weight of released

propellant.

The chemical composition of the products of combustion depend on

the chemical composition of the propellants. The combustion

products contain mainly water vapors and oxides of carbon and

nitrogen. Thermal radiation emitted in the form of water vapor

will be (partly) reduced by moisture absorption in the

atmosphere. The transmitted radiation can impact people and

structures. Table 5-6 shows critical radiation fluxes required

to cause burn injury and start secondary fires (such as by

igniting fuels placed inside and outside buildings). Note that

as the exposure time increases, the required radiant flux

decreases, as expected.

5-30
5-31
5.4.2 Pool Fires

Pool fires are produced when liquid propellants are accidentally

spilled on the ground such as:

• from a vehicle in pre-launch phase: this scenario is

outside the scope of this study since its impact is not

likely to extend outside the Range boundaries.

• from ground operations such as propellant transport to

the Range and storage, handling and transfer within the

Range. In this case, the impact may occur outside the

Range boundary.

A spilled liquid will spread on the ground under the effect of

gravity, filling small-scale crevices in a ground with surface

roughness or large-scale depressions in an undulating terrain.

While spreading, cryogenic propellants (such as liquid hydrogen

and oxygen) will boil violently due to heat transfer from the

relatively warm ground. A propellant at ambient temperature

(such as RP-1) will evaporate more slowly. Some flash

vaporization of cryogenic liquids will also occur because their

vessels are usually maintained at slightly above atmospheric

pressure.

Ignition produces a pool fire with a flame base which spreads

along with the liquid film and a flame height determined by the

rate of evaporation and the rate of mixing of fuel and oxidizer.

The overall character of such a pool fire is essentially a

turbulent diffusion flame which may continue to expand on flat

ground (or remains stationary if the liquid has accumulated in a

depression area) until it runs out of fuel.

The danger of pool fires consist of thermal radiation to people

and property (as in the case of fireballs) and direct flame

impingement on structures near the fire.

5.4.3 Vapor Cloud Fires

In the pool fire scenario described above, if:

• the liquid pool does not ignite immediately after the

release, because of lack of an ignition source; and

• the released propellant has a high vapor pressure such

as liquid hydrogen, oxygen, nitrogen, air or methane

which boil due to heat transfer from the environment

and not from a fire;

5-32
then, a large amount of vapor will be produced and transported by

prevailing winds to form a vapor cloud. In this scenario, the

resulting cloud is elongated in shape and is called a "plume".

Its leading edge advances with the wind and its trailing edge is

formed at the evaporating pool (the source of the vapors). As

the leading edge moves further downwind, ambient air is entrained

in the cloud, thus increasing its volume and decreasing the vapor

concentration. This process is called atmospheric dispersion and

is discussed further in the next section.

If a flammable cloud encounters an ignition source, a fire will

spread through the cloud, engulfing in flames whatever is

contained in the cloud. This is referred to as a vapor cloud

fire. Under some conditions (particularly the presence of

obstructions or confinement in the cloud) overpressure can be

produced, posing the added risk of mechanical damage.

Alternatively, as the cloud disperses, the vapor concentration

may drop below the flammable limit prior to encountering an

ignition source. Thus, the hazard is dissipated without any

adverse impact.

5.5 TOXIC VAPOR CLOUDS

The evaluation of the toxicity of any material is a very complex

subject. Toxicity data are very sparse and questionable except

for the common toxins. When available, they are usually for

continuous exposures as one would find in a factory environment

and not for the short exposures characteristic of launch

operations.

Still, the issue is of great interest because toxic materials may

be released during ELV launches as combustion products, or in the

event of an accident, as uncombusted propellants. The most

notorious ones are hypergolic liquid propellants such as

monomethyl hydrazine, Aerozine-50 and nitrogen tetroxide. 

Their chemical properties and toxic Threshold Limit Values (TLV)

are listed in Appendix B along with other characteristics of

interest. If such materials are released in the environment,

they may be carried by the wind and travel windward as they

disperse. This atmospheric dispersion is described below.

5.5.1 Atmospheric Dispersion

Over the years, the subject of atmospheric dispersion has been

studied extensively in connection with air pollution studies from

power plants and automotive vehicles. These studies addressed

the case of continuous releases from normal operations where

pollutant concentrations were monitored over long periods of

time.

5-33
In this study, the interest is mainly in larger uncontrolled

"instantaneous" releases (as would occur in an accident). Then,

a large amount of potentially noxious vapor may be produced and

transported by prevailing winds to form a vapor cloud. There are

two main types of vapor clouds:

• a "plume": an elongated cloud whose the leading edge

travels with the wind, while the trailing edge remains

stationary at the source of the vapors. Conditions

which produce a plume are described in the preceding

section;

• a "puff": a more or less spherical cloud where both

leading and trailing edges move together downwind.

In reality, a combination of these two cloud geometries may

occur, depending on accident conditions.

As the cloud travels downwind, ambient air is entrained in the

cloud; this increases its volume and decreases the vapor

concentration. The process can be further complicated by

chemical interactions among hypergolic vapors and between vapors

and entrained air.

Such cases of large "instantaneous" releases have also been

studied experimentally. Large scale tests involving the spillage

of large quantities of chemicals were carried out and

concentrations were measured downwind. The most notable tests,

carried out as part of national and international programs

include:(21)

(1) the liquefied natural gas (LNG) dispersion tests at the

Naval Weapons Center, China Lake, California, for the

US Department of Energy;

(2) the ammonia spill tests at the above location for the

Fertilizer Institute and the US Coast Guard;

(3) the Porton Down tests in England involving the

instantaneous release of Freon;

(4) the heavy gas dispersion trials on behalf of the Health

and Safety Executive of the British Government and

other participants; and

(5) the LNG spill tests conducted by Shell UK Ltd. at

Maplin Sands, England.

Based on such tests, it is recognized that cloud dispersion

depends mainly on:

5-34
• ambient conditions such as wind, atmospheric stability

and local terrain.

• the buoyancy of the vapor cloud. It is important to

determine whether the cloud is lighter or heavier than

air because the former will disperse much faster than

the latter. The presence of aerosols (fine droplets

sprayed from the spilled liquid) increases the

effective density of the cloud and modifies its

dispersion characteristics. Also, cloud density may

vary in space and time so that some portions may be

lighter than air and others heavier.

• the size and location of the release, i.e., whether it

is on ground level (from an accident on the launch pad)

or from an elevated altitude (from an accident in

flight).

There are several models in the literature describing the

dispersion behavior of heavier-than-air gases under a wide range

of conditions.(14 a, b, c) Models which discuss the dispersion of

vapors released passively (as from a boiling pool of liquid)

include Van Ulden,(15) Britter,(16) and Colenbrander.(17) There are

also models in the air pollution literature dealing with release

of neutral and positively buoyant vapors from stacks.

In general, the dispersion of vapors in the far-field (after

sufficient dilution) can be predicted with reasonable accuracy by

the standard Gaussian models of Pasquill(18) and Gifford.(19)

However, in the near-field, these models have to be modified to

take into account the effects of initial gravitational spreading,

jet mixing or the effects of aerosol evaporation.(20)

5.5.2 Rocket Exhaust Products

Most of the combustion products from rocket engines are harmless

or unlikely to exist in concentrations which would affect the

health and safety of third parties. These combustion products

may include:

• water and water vapors

• nitrogen

• hydrogen

• carbon monoxide and dioxide

• hydrogen chloride 

• aluminum oxide

Of these combustion products, carbon monoxide and hydrogen

chloride may be considered hazardous. Aluminum oxide is not

toxic, but may contribute to certain lung diseases if exposure

persists over time. The remaining combustion products are not

5-35
dangerous unless present in sufficient concentration to cause

asphyxiation, which is not the case. Threshold Limit Values

(TLV) for major combustion products are given in Table 5-7 for

various exposure durations for both controlled (Range personnel)

and uncontrolled (third party) populations.

For illustration, Figure 5-9 shows results from a model using the

NASA/MSFC (buoyant-rise, multilayer dispersion model of exhaust

products) to compute peak instantaneous concentrations of

hydrogen chloride as a function of downwind distances from the

launch pad for sea breeze meteorological conditions and certain

vehicle configurations. Also, Figure 5-9 shows the exposure

criteria limit (as given in Table 5-7) for 10 minute-exposure of

uncontrolled populations (third parties). Note that this limit

is not exceeded at downwind distances of interest. In 1985, the

Committee on Toxicology, Board on Toxicology and Environmental

Health Hazards, Commission on Life Sciences, National Research

Council published a document entitled "Emergency and Continuous

Exposure Levels for Selected Airborne Contaminants," Volume V.(20a)

This document updates recommendations for public exposure to the

hydrazines and creates a new category, Short-term Public

Emergency Guidance Levels (SPEGL's) for up to 24 hours for

hydrazine propellants. The data in this document affects values

for the uncontrolled population exposure to hydrazine shown in

Table 5-7.

5.5.3 Releases During Accident Conditions

In the case of a near-pad explosion, all of the propellant is

unlikely to be combusted. Thus, a vapor cloud containing vapors

and aerosols of hydrazine, nitrogen tetroxide and hydrocarbon

fuels might result. Other chemicals such as fuel additives and

contaminants may also be present. These materials are toxic (see

TLV values listed in Appendix B) and in high concentrations may

cause adverse health effects, particularly if meteorological

conditions at the time of the accident do not favor rapid

dispersion to below toxic levels. 

The Titan 34 D explosion at WSMC of April 18, 1986, produced a

vapor cloud containing toxic Aerozine-50 (Unsymmetric

dimethylhydrazine and hydrazine blend) and nitrogen dioxide.

There was no verified exposure of third parties to toxic

concentrations exceeding established limits. However, reports

indicate that doctors examined 74 people for possible exposure to

the clouds and two were kept in the hospital for observation (see

also Ch. 10).

5-36
5-37
5-38
Depending on their chemical properties (see Appendix B),

accidentally released vapors may only be flammable (e.g.,

hydrogen) or also toxic (e.g., hydrazine and nitrogen tetroxide).

The Threshold Limit Values (TLV) for exposure to various toxic

propellants or their combustion products, shown in Table 5-7 and

Appendix B, are on the order of 0.1-100 ppm, while typical

flammability limits are on the order of 1-10% (i.e., 10,000-

100,000 ppm). Because the minimum vapor concentrations with

toxic impacts are much below those required to sustain a flame,

the potential size of a toxic cloud is much greater than that of

a flammable cloud. Accordingly, for equal amounts of released

propellants, the potential for toxic impacts is of greater

concern than for fire damage.

5.6 OFF-RANGE IMPACTS ASSOCIATED WITH ELV OPERATIONS

This section presents a summary discussion of the potential offrange impacts associated with ELV operations (See Table 5-8).

Potential ELV hazards were discussed in this chapter with no

explicit mention of the associated probabilities. However, each

hazard is tied to a particular probability value -- that of the

occurrence of the enabling conditions. This fact should be

remembered in assessing the significance of potential off-range

impacts. The subject of assessing impacts from the perspective

of both their magnitude and probability is referred to as Risk

Analysis, and it, along with the various methods used to quantify

risks, is discussed in detail in Chs. 8 and 9, Vol. 3.

Illustrative examples of the application of Failure Analysis

methods to space systems are given in Ch. 9, Vol 3. They are

typically focused on a specific phase of launch operations and

are rarely integrated, as is attempted (qualitatively) below.

Examples of the results from such a preliminary hazard analysis

are given in Table 5-8 for the main phases of ELV operations:

pre-launch, launch and pre-orbital. As usually done, the failure

types are classified in a manner compatible with the availability

of data. For example, in Table 5-8, all failures leading to

vehicle break up in flight,are lumped into one category for which

a failure rate may be estimated based on historical data for each

ELV. 

Hazard Analysis is then used to analyze the consequences of the

types of accidents identified in Failure Analysis. These

consequences include explosion, fire, toxic vapor clouds and

inert debris. The principles of physics and chemistry are used,

along with data from historical experience, testing and

engineering judgment, to describe the hazards and potential

impact severity. For example, the strength of an explosion or

fire may be described and associated with potential damages 

5-39
5-40
(by overpressure or heat) to people and/or property. Estimates

of the magnitude of the potential damage may be expressed in

terms of an impact area (or footprint) surrounding the location

of the accident.

To do so, a range of possible accident circumstances have to be

specified to allow a quantitative estimation. A further break

down of the hazards in various ways may be needed to make the

analysis tractable. For example, in Table 5-8, the hazards are

divided into those (explosion, fireball and toxic releases) that

may occur while the vehicle is in flight, versus those occurring

when the vehicle or its fragments impact the ground. The breakdown of consequences in Table 5-8 varies with time during the

launch phase. As time elapses after liftoff, the quantities of

propellants on-board will decrease, thereby affecting their

potential hazards. This was discussed in detail in Section 5.2.4

for explosion hazards.

Risk Analysis is finally used to describe (for a particular

activity) both the probabilities of accidents and the possible

damages or losses associated with them, accounting for

uncertainties in the occurrence of the accidents and in the

circumstances surrounding them. For example, there are

uncertainties as to what accident is likely to occur at a

particular location and how many people would be present at that

location at the time of the accident. A set of circumstances is

defined (scenario) and their probability is estimated. For each

set, the results of the Failure Analysis (frequency of an

accident) and Hazard Analysis (area of damage) are combined to

estimate an expected damage (e.g., a number of people affected

with a particular frequency per year or per event). The overall

outcome of the analysis is a probability distribution function

(PDF) for the potential damages that can be associated with a

particular hazardous activity. An expected value for potential

damage (e.g., casualty expectation, Ec) is often calculated from

that probability distribution.

Such expected casualty values have been estimated in an

approximate manner for ELV-type vehicles, but only for a few

specific scenarios involving inert debris hazards as shown in

Table 5-8, namely:

• inert debris risks during the first 10-70 sec of

launch, with and without a Flight Termination

System.(22)

• inert debris risks during pre-orbital operation,

with and without a Flight Termination System.

5-41
In Table 5-7, note that for the scenarios involving explosion,

fire and toxic hazards, only a qualitative description of the

potential off-range impacts is given because either their

probabilities or magnitudes have not been quantified. These

descriptions are given as footnotes in Table 5-8, to summarize

key considerations in understanding these impacts and of their

determining factors.

5.7 PERSPECTIVES ON THE MAGNITUDE OF THE HAZARDS ASSOCIATED

WITH ELV PROPELLANTS

In the previous sections, the major hazards associated with ELV

propellants were discussed. There are a number of hazards

(explosions, debris, fires, toxic vapor clouds) each of which

depend on a number of parameters such as propellant properties,

quantity, mode of release, etc. Clearly, these hazards are very

complex and multi-dimensional. In this section, a few reference

points are provided to place these hazards in perspective

compared to more familiar hazards. Only a partial perspective is

provided because:

(a) the focus here is on the magnitudes of these

hazards and not on their probabilities or

likelihood of occurrence. This is addressed in

Chs. 9, 10, Vol. 3, where a more complete

discussion of public risk perspectives is provided.

(b) the comparison with other hazards is presented in a

very simplified fashion, focusing only on selected

dimensions of the hazards.

In simple terms, concern with ELV propellant hazards can be

attributed to the following factors:

(1) rocket propellants are highly energetic fuels and

most are inherently hazardous;

(2) large quantities of propellants are involved in

space launch operations; and

(3) launch operations are inherently complex and have

many potential failure modes.

The following discussion places these concerns in their proper

perspective.

First, propellants such as liquid hydrogen, liquid oxygen and RP1 have been used extensively in the chemical industry. They have

been processed, transported and stored for several decades with

a remarkable safety record. Also, the chemical industry uses (on

a daily basis) chemicals which are even more hazardous than ELV

propellants, such as acetylene and ethylene oxide (which are

5-42
extremely explosive) and hydrogen chloride and hydrogen cyanide

(which are extremely toxic).

Selected key properties which affect the hazard potential of such

chemicals are listed in Appendix B and in Table 5-9. Note that

the range of propellant properties are sometimes exceeded by

other chemicals. For example, the flammability limits of

acetylene and ethylene oxide are wider than those of hydrogen.

In addition, these two chemicals can react autocatalytically

without the need for an oxidizer, if initiated by heat, pressure

or shock. On the other hand, hydrogen requires oxygen to react.

Generally, the broader the flammability range, the easier it is

to create a fire or an explosion. Thus, these two chemicals are

more likely to ignite than hydrogen.

Second, the quantities of chemicals used in industry are often

greater than those of propellants in ELV operations. This is

illustrated in Table 5-10 which provides data for various space

vehicles and for the storage and transportation of fairly common

fuels such as LNG, LPG and gasoline. For each case, the table

gives the total weight, heat of combustion per unit mass, and the

total chemical energy. It also would have been desirable to

provide the explosive (TNT) yield for each case. However, this

would require the definition of a pertinent accident scenario for

each (as was done in Sec. 5.2.4) and the estimation of a

reasonable yield.

In view of the lack of such data, instead the total chemical

energy is used as a rough indication of the magnitude of the

potential hazard which is reasonable for propellants and fuels.

In terms of total chemical energy alone, three typical launch

vehicles are approximately:

• equivalent in order of magnitude to a gasoline truck or a

rail tank car of LPG.

• one order of magnitude smaller than a pressurized LPG

sphere.

• two orders of magnitude smaller than standard cryogenic

tanks of LNG and LPG.

• three orders of magnitude smaller than an LNG ship.

Third, although ELV launch operations are inherently more

intricate and complex than conventional chemical and transport

operations, the safety precautions for ELV operations are far

greater than those for other more common activities. For

example, launch sites are separated significantly from population

centers while chemical plants and fuel tank farms are located

within cities.

5-43
5-44
5-45
An additional perspective on the magnitude of the hazards of ELV

propellants relative to other fuels and chemicals can be obtained

by comparing their respective past accident data. This is

presented below for explosion accidents.

Data summarized in Table 5-11 involve major chemical process and

transportation activities where the explosive yield was 40,000

pounds of TNT or greater. The table provides a brief description

of each accident, identifies the chemical involved, the

approximate quantity released (pounds) and the TNT equivalent

weight (reported by the accident investigators based on the

observed damage at the location of the accident). The TNT

equivalent weights ranged from 40,000 to 125,000 pounds, which is

roughly the same order of magnitude as that estimated

conservatively for worst case propellant accidents in Table 5-3.

Unfortunately, similar historical data on space vehicle accidents

may be restricted or classified and are not readily available in

the open literature. The data found in the open literature are

shown in Table 5-12 for large SRM explosions. No comparable data

were found for liquid propellants. The reported TNT equivalent

weights range from 9 to 42,000 pounds, a range lower than yields

from industrial/transportation accidents and lower than the

estimates for worst case propellant accidents in Table 5-3.

Although the historical data and comparisons presented above are

limited in scope and depth, they still suggest that the hazards

anticipated from ELV propellants can be considered to be

qualitatively similar in type and magnitude to those associated

with comparable chemicals and fuels commonly used in chemical

processing and transportation activities.

5-46
5-47
5-48
REFERENCES TO CHAPTER 5

1. "Hazards of Chemical Rockets and Propellants," published

by the Chemical Propulsion Information Agency, John

Hopkins University, APL, Laurel, MD, September 1984.

2. Willoughby, A.B. et al. "Liquid Propellant Explosive

Hazards -Project PYRO," Vol. I, TR-68-92 and Vol. II, TR69-80, December 1968.

3. Elwell, R.B., et al. "Project SOPHY - Solid Propellant

Hazards Program," Technical Report AFRPL-TR-67-211, Vol.

I and II, August 1967.

4. "Explosives Safety Standards," AFR 127-100, Change 2,

January 1985.

5. "Ammunition and Explosives Safety Standards," DOD 6055.9 -

 STD, July 1984.

5a. "Space Propulsion Hazard Analysis Manual" (SPHAM) prepared

for the Air Force Astronautics Laboratory.

6. Kincaid, J.F. "The Determination of the Propensity for

Detonation of High-Performance Propellants," A84-12984.

7. Ullian, Louis J. "Detonability of Large Solid Rocket

Motors," ESM/SEM Report #84-1, 10 August 1984.

8. Swisdak, M.M. et al. "Solid Rocket Booster Command

Destruct System Hazard Study," NSWC-TR-85-344; TR-85-346;

TR-85-348; TR-85-350; TR-85-352, October 1985.

9. Overbeck, K.B., R. D. Daniels and J. R. Westlake, "Model

Concept and Development for VBLAST, the WSMC Blast

Prediction Model," Report No. 83-3119- 1, J. H. Wiggins

Co., Redondo Beach, CA, Oct. 1983.

10. Riehl, W.A. "STS Blast Hazards Analysis." Preliminary

Briefing (AA/OSTS) MSFC, Alabama. April 1979.

11. Baeker, J.B., "Space Shuttle Range Safety Hazard

Analysis," TR No. 81-1329 to NASA/KSC, July, 1981.

12. Kokinakis, W. and R. Rudolph. "An Assessment of the

Current State-of-the- Art of Incapacitation by Air Blast,"

Minutes of the Twentieth Explosives Safety Seminar, August

1982.

5-49
13. Delta 392X Range Safety Flight Mechanics Destruct

Analysis," MDC-H3398, May 1987, (see Table A-2, Delta

3924).

14. "Programmatic Environmental Assessment of Commercial

Expendable Launch Vehicle Programs," US DOT, February 1986

(updated from FEIS for NASA, Office of Space Science

Launch Vehicle and Propulsion Programs, 1973).

14a. "Atmospheric Transport and Diffusion Modelling," CPIA

Publication 433, published by the Chemical Propulsion

Information Agency, Johns Hopkins University, APL, laurel,

MD. This Document contains the proceedings of a Safety

and Environmental Workshop held 11-13 June 1985.

15. Van Ulden, A.P. (1974), "On Spreading of a Heavy Gas

Released Near the Ground," First Intl. Loss Prevention

Symposium, The Haue/Delft, Elsevier, Amsterdam, p. 221-

226.

16. Britter, R. (1979), "The Spread of Negatively Buoyant

Plume in a Calm Environment," Atmospheric Environment, 13,

9, p. 1241-1247.

17. Colenbrander, G.W., "A Mathematical Model for the

Transient Behavior of Dense Vapor Clouds," Loss Prevention

and Safety Promotion in the Process Industries, 3rd Intl.

Symposium, Basel, Switzerland 1980, p. 15/1104.

18. Pasquill, F. (1974), Atmospheric Diffusion, Ellis Horwood

Limited.

19. Gifford, F.A. (1975), "Relative Atmospheric Diffusion of

Smoke Puffs," Journal of Meteorology, 14, p. 410.

20. Gugan, G. "Unconfined Vapor Cloud Explosions" Publisher:

Institute of Chemical Engs., Rugby, Warks, England, 1979.

20a. "Emergency and Continuous Exposure Levels for Selected

Airborne Contaiminants," Volume V, the Committee on

Toxicology, Board on Toxicology and Environmental Health

Hazards, Commission on Life Sciences, National Research

Council, National Academy Press, Wash. DC, 1985.

21. Drake, E. M. and N.A. Moussa, "The Assessment of Crash

Fire Hazard of Liquid Hydrogen Fueled Aircraft," Arthur

D. Little Report for NASA/Lewis Research Center, NASA CR165526, February 1982.

22. "Commercial Space Launch Determination -ESMC," RTI Draft

Report for DOT/OCST, Dec. 1987.

5-50
10/2/95 rev

6. ORBITAL COLLISION HAZARDS

6.1 ORBITING SPACE OBJECTS

It is important to estimate the hazards of on-orbit collisions

between space objects because the US may be liable for any damage

to a foreign country, or satellite caused by a US spacecraft.

The latest NASA Satellite Situation Report lists 1,702 spacecraft

in orbit and 5,130 large debris such as spent rocket stages and

payload shrouds.(4) Expanding the count to include trackable

debris, the tally was 18,145 cataloged space objects as of June

30, 1987. Of these, 5,763 are from the US and 11,603 from the

USSR. Of the total, approximately 7,000 are still in orbit (the

rest have decayed and re-entered). Radar-trackable objects in

space (i.e., larger than about 10 cm across) are monitored and

cataloged by both the US Space Command (USSPACECOM).

Considerably more objects and debris too small to be trackable

are in orbit, as indicated in Figure 6-1.(1) Measurements using

the USSPACECOM's Perimeter Acquisition Radar Attack

Characterization System (PARCS), which is sensitive to objects of

about 1 cm in size, yields the debris population shown in Figures

6-2 and 6-3. The tracked population has increased steadily since

the early 1970's, as shown by a comparison of the number of

cataloged space objects between 1976 and 1986. 

During this period the tracked population has increased from 4100

to 4700 objects, compared with an increase of 25 percent in

launch activity over the same period. This reflects the dynamic

nature existing between new and decaying objects in space. (see

Ch.7)

The 1986 Satellite Catalog (SATCAT) listed 16,660 entries,

including all satellites launched in the last 30 years, their

stages and trackable debris. However, only about 6000 of these

objects are still in orbit, and about 44 percent of them

originated from major on-orbit break ups (see Sec. 6.3.2).(4b, c)

Satellites are currently being launched into space at a rate of

approximately 150-200 per year.(5) Eight countries presently

possess space launch capability and over 100 nation-states

participate in international satellite communication programs.(5-6)

The rate of new objects cataloged is higher than the number of

payloads because it includes debris. There were 983, 843 and 458

new objects cataloged during 1985, 1986 and 1987, respectively.

More than 3,600 payloads have been launched into space since

1957, but only 342 satellites were operational as of Sept., 1987,

of which US operates 133, the USSR 148 and 13 other countries and

international organizations, 61. Nearly half of this total are

6-1
6-2
6-3
6-4
military satellites. By aggregate satellite mass, the Soviets

account for 2/3 of the total.(4b, 33) The total mass now in Earth

orbit exceeds 500 tons; each year about 800 additional tons are

launched.(2) Active payloads comprise only 5 percent of all

objects in space. The other 95 percent, including dead payloads,

expendable launch stages and debris fragments are also monitored

in case they pose re-entry hazards (Ch. 7). The mass/number

balance of space objects decaying and re-entering Earth's

atmosphere vs. those in long lived "deep space" orbits (periods

longer than 225 min) and the projected annual influx of decaying

space objects will also be discussed in Chapter 7.(2)

The orbital collision hazards are under active consideration by

several national agencies (NASA, DOD, DOS, DOT, DOC) and

international organizations. 

The "Unispace 82" conference acknowledged the growing threat to

space activities posed by accidental collisions in orbit. The

magnitude of the current and projected collision hazards for lowEarth orbit (LEO) and geosynchronous orbits (GEO) is shown in

Figures 6-2 and 6-3.(1-3)

Several international agreements have been proposed, and are

being considered to govern the orbital operation of satellites,

disposal of inactive spacecraft and management of space debris.

These agreements are limited primarily to the control of

commercial communications satellites in geostationary orbits

(GEO). Such agreements are motivated primarily by the need to

prevent radio frequency interference between neighboring

satellites, rather than to insure that collisions between

satellites will not occur, given their relatively low spatial

density. Depending on their orbital altitude and other

parameters (inclination, eccentricity), mean orbital collision

times for satellites range from a few years to as long as 1000

years. However, since the population of space objects is

increasing rapidly in LEO and GEO orbits of interest, and since

on-orbit debris increase even more rapidly, crisis proportions

could be reached after the year 2000 unless debris management

policies and procedures are adopted soon. Already, in 1979, the

Japanese satellite ECS-1 was lost by a collision in space with

the third stage of its own launch vehicle, causing a multimillion

dollar loss.

Recent measurements and observations of satellite debris have

indicated that the untracked man-made debris population in nearEarth and deep space orbits (of 1cm sizes in near-Earth and up to

20 cm in deep-space and GEO orbits) far exceeds the number of

USSPACECOM-tracked fragments. These would augment the near-Earth

amount of tracked debris by a factor of 10 and the debris

orbiting in deep space by 25-50 percent. The collision hazards

6-5
increase proportionately.(23) (see Secs 6.2 and 6.3) Although the

tracked population of debris is increasing linearly (by 250-300

objects per year), not exponentially as previously predicted, it

already has exceeded the natural meteoroid background 

(Fig. 6-4).(1-3)

6-6
Untracked smaller debris appear to dominate collision encounters.

Little data on the man-made debris flux are available on debris

less than 4 centimeters in size (Fig.6-1). Objects below this

size cannot be detected by Space Command's deep space tracking

detection systems. GEODDS (The Ground-Based Electro-Optical Deep

Space Surveillance System) however, is an expanding global

network of tracking sensors which is continually being upgraded

to aid in monitoring space assets.(13)

Space hazards of interest to this analysis include:

- Low Earth Orbit (LEO) Collisions (Secs. 6.4.1 and 6.4.2):

• Collisions between two active spacecraft in LEO between

200 km and 4000 km (120 miles and 2400 miles).

• Collisions with both man-made and natural (meteoroids)

objects in the near-Earth orbits. The hazard from manmade debris increases with time while the debris of the

natural environment remains at a near constant level

(Figures 6-2, 6-4).

- Geosynchronous Earth Orbit (GEO) Collisions (Secs. 6.4.3 to

6.4.5):

• Collisions between active spacecraft and inactive

spacecraft remaining in a geosynchronous orbit. This

GEO "ring" is narrow in latitude and altitude bands,

but spread over 360° in longitude (Fig.6-5). 

6-7
The collisions may result from the accumulation of

inactive spacecraft in the most desirable GEO orbits

for communication satellites.

• Collisions between two active spacecraft in

geostationary orbit. These collisions can be prevented

if collision avoidance procedures are invoked by ground

control or by judicious orbital slot allocation.

• Collisions between active spacecraft and spent orbital

transfer stages in GTO or other debris in GTO and GEO.

The probability of collision with objects in geotransfer orbit (GTO) is relatively small due to the

short dwell and transit time of geo-transfer objects in

the geosynchronous band (about 3% of their period).

When considering objects large enough to damage most spacecraft,

artificial debris, whose sources are discussed in Sec. 6.3,

constitute the dominant threat.(2,3) Collisions involving

artificial and meteoritic debris possess these differing

characteristics:

1) Collision hazards are proportional to the debris

population densities, relative orbital velocities between

colliding objects and the cross sectional area of the

orbiting spacecraft.

2) Large debris consist primarily of artificial objects,

while small debris are dominated by natural meteoroids.

3) Meteoritic debris remain at a relatively constant

level, while the spatial density of man-made debris is

increasing with time.

4) Artificial debris populate circular orbits with rather

low relative velocities, while meteoritic debris orbits are

elliptical with larger relative velocities at collision.

The average velocity of meteorites relative to spacecraft is

roughly twice as large as that of man-made objects, namely

14 km/s vs. 7 km/sec. However, cometary debris move in

elliptical and sometimes retrograde orbits and can therefore

reach 40-70 km/sec. relative impact velocities.

6.2 SPACE LAW AND SPACE DEBRIS ISSUES

6.2.1 The Regulatory Framework for Orbit Allocation and Space

Debris

Major international agencies that establish and implement space

law, as it applies to communication and remote sensing

satellites, include:

• United Nations Committee on the Peaceful Uses of Outer

6-8
Space (COPUOS)

• International Telecommunication Union (ITU)

• International Telecommunications Satellite Organization

(INTELSAT)

• International Maritime Satellite Organization

(INMARSAT)

COPUOS is the foremost entity of these agencies since the major

space treaties in effect today have been negotiated under its

auspices. The ITU is the principal agency that deals with

regulatory matters pertaining to satellite communications. It

receives support from several other organizations, namely:

• The International Radio Consultative Committee (IRCC)

• The International Frequency Registration Board (FRB)

• The International Telecommunications Satellite

Organization (INTELSAT)

Of these organizations, the IRCC is the most likely to be

involved with the problem of satellite collisions. Specific

groups have been established within the IRCC to study special

subjects, primarily in the areas of space communications and

interference problems. INTELSAT is dedicated to the

construction, deployment and operation of commercial

telecommunication satellites.

A majority of nation-states must first endorse international

treaties and regulations, in order for them to become effective.

The implementation of such treaties requires all member states to

abide by the dictates of the majority. Therefore, any proposal

pertaining to on-orbit collision risk reduction and orbital

debris management would require several years for discussion,

consideration and ratification in an international forum.

Presently, only communication satellites are assigned orbital and

frequency windows through international agreements. Other

commercial, research and military missions go through a process

of orbital parameter optimization prior to mission approval to

avoid collisions during their useful life. These are simply

registered with the UN by the launching state. USSPACECOM can

identify space object fragmentation events and infer their

probable cause: for example, if orbiting satellites cross in

space and time disappear and the crossover point becomes strewn

with debris, a mutual collision can be inferred. It is difficult

to assign liability and to determine whether a collision

encounter on-orbit was accidental or intentional. The National

Ranges, as well as NASA and the Satellite Surveillance Center

(SSC) within USSPACECOM, usually perform COLA (COLlision

Avoidance at launch) to determine safe launch windows and COMBO

(COmputation of Miss Between Orbits) screening runs for proposed

missions to check the proposed orbits against cataloged orbits.

A "point of closest approach" (PCA) is computed. If a risk

6-9
exists, orbital maneuvering capability or orbital parameter

changes are provided. Hence, preplanning of missions avoids

collisions with known and tracked space objects. While COLA is

run routinely prior to launch, COMBO runs are complex and costly,

so that orbital safety screening has been done only for select US

Government missions. Smaller debris which cannot be radar

tracked pose unpredictable hazards. "Rules of the road" for

satellite close approaches are currently being considered to

avoid international conflicts in space.(28-30)

6.2.2 Orbital Debris Issues

An assessment of collision hazards in space requires a study of

collision probabilities between all objects in space including

those of natural origin (i.e., meteoroids) as well as man-made

objects (satellite and space debris). Orbital debris consist of:

spent spacecraft, used rocket stages, separation devices, shrouds

and fragments from accidental or deliberate explosions and

collisions.(1-3) A major concern for future space activities is

the possibility of generating a debris belt as a result of

cumulative collisions between orbiting objects.(1-14) Several

models, discussed below, have been developed to estimate

quantitative collision hazards for spacecraft in both low earth

orbit (LEO) and geostationary orbit (GEO) regimes.(15-20) Each of

these models relates the collision hazard to the orbital

population density and to the relative object velocity.

Estimates of collision probabilities between spacecraft and

debris in LEO and GEO show that, at present, this hazard is still

small (1 in 1000 and 1 in 100,000 per year in orbit,

respectively), but increasing rapidly (Figs. 6-2, 6-3). The

threat of losing on-orbit satellites through collisions with

other inactive satellites or orbiting debris is not yet critical,

but is becoming increasingly serious. The more crowded regions

of space which are optimal for man-rated systems (like the Space

Station), larger satellites or those used for communications,

remote sensing, navigation and surveillance missions are of most

concern.

Proposed space debris management options under consideration

include the following:(4,13,24,31)

• provide impact hardened shielding to new satellites, as

well as added orbital maneuvering capability to avoid

collisions;

• require that extra fuel be provided to satellites

inserted into more crowded space orbits to enable their

transfer into either higher and longer lived "parking"

orbits, or into lower decaying "disposal" orbits at

the end of their life. International cooperation and

agreement is needed to define such parking and disposal

orbits;

• undertake "space salvaging" operations to retrieve and

6-10
remove dead payloads from more crowded orbits. This

"celestial trash can" could be ejected from the Solar

System, injected into a Sun bound orbit or fitted with

rockets for controlled re-entry to Earth. The latter

would allow "disposal" by atmospheric burn-up, but

would increase re-entry hazards (Ch. 7).

6.3 ORIGIN OF ORBITING DEBRIS

6.3.1 Hypervelocity Collisions

Hypervelocity collisions in orbit can generate a significant

number of debris particles which are too small to be observed,

yet sufficiently large to inflict damage to any unhardened

spacecraft. Uncertainty about the population of unobserved

debris particles is the most important factor limiting an

accurate assessment of space collision hazards (Figures 6-3,6-4).

Ground based tests of hypervelocity impacts indicate that a

single high speed collision in space could produce between 10,000

and 1,000,000 pieces of debris. Table 6-1 provides estimates of

the number of debris objects which could result from collisions

between different size objects (7). 

6-11
Verification of the results of high speed collisions in space is

hampered by the difficulty in observing the small particles.

Given the present tracking capability, it is difficult to

differentiate between a fragmentation caused by a hypervelocity

collision or an explosion.(4) There have been no confirmed

instances of satellite damage due to high speed collisions with

debris in space to date.(4) The subject of collision by-products

is closely tied to the generation of the so-called "debris belt"

which could result from cumulative collisions. While such a

catastrophe would cause severe problems for future space

ventures, it is not considered a likely consequence for many

years to come.

6.3.2 Explosions and Spacecraft Breakups

Explosions and breakups of spent propulsion stages and spacecraft

on-orbit (either spontaneous or collisional) are a major source

of space debris (Figs. 6-6, 6-7 and 6-8). More than 90 known

break ups have occurred in orbit, as of January, 1986.(2,3,7,13,14,21,22)

For the 39 satellites known to have fragmented in orbit, 15% of

the events are propulsion related, 40% were deliberate and the

rest are due to unknown causes. Explosions, both inadvertent and

intentional, represent the largest single source of space debris

and account for approximately 60 percent of the tracked space

objects. These are almost equally divided among non-operational

payloads and remaining mission related expendable objects, such

as rocket stages, shrouds, etc. Debris originating in one

collision or explosion event will cluster in orbital parameters

(inclination, eccentricity) so that locally, the probability of

impacting an orbiter is much higher (Fig. 6-8).

As of July 1982, 49 percent of the cataloged population had

originated from a total of 44 break ups. In November 1986, an

Ariane 3rd stage, launched nine months earlier, exploded and

created a cloud of debris in polar orbit, centered at 490 mi.

altitude, but spread as low as 270 mi. and as high as 840 mi.

Ariane 3rd stages are known to have exploded on orbit at least 3

times before this, as indicated by SPACECOM tracking data. On

orbit explosions also have been associated with second and upper

stages along with casings from Proton, Ariane, Delta, Titan,

Atlas and Atlas/Centaur spent stages. There have been ten Delta

2

nd stage explosions in orbit prior to 1981, but none since 1982

(see below).

The increase in LEO hazard level caused by the explosions of

several US ELV second stages in the early 80's (see Sec. 6-2) is

less pronounced at elevations of 600 to 1200 km than in the 300

km range because the relative debris level is lower at these

altitudes. It is estimated that for an explosion which produces 

6-12
6-13
6-14
500 fragments, the time between collisions involving one of these

fragments would be about 50,000 years.

Since 1986 steps have been taken to stop such explosions by

venting all residual fuel in jettisoned 2nd and 3rd stages (i.e.,

fuel depletion burn). This residual fuel tended to explode upon

thermal cycling and overpressurization due to solar heating,

especially for sun-synchronous orbits. A recent change in

operating procedures requires residual liquid fuel of spent

second stages (and upper stages, if liquid fueled) to be vented

to prevent and control on-orbit explosion generated debris.

However, Ariane upper and transfer stages have exploded on-orbit 

6-15
as recently as 1986 and 1987 since ESA has yet to adopt a venting

policy.

Ground simulated Atlas explosions, used as calibrations tests for

fragmentation, produced about 1300 fragments. On September 20,

1987, the Soviet satellite Cosmos 1769 (suspected to be nuclear

powered) was intentionally destroyed on-orbit producing a cloud

of debris at about 210 mi. altitude and 65o orbital inclination.

Reference 25 lists past satellite breakups and the number of

cataloged objects generated by the breakups. Extrapolating the

number of on-orbit explosions and break ups, the SPACECOM catalog

could expand by up to a factor of 10 in the next 20 years.

6.3.3 Orbiting Nuclear Payloads

Special on-orbit hazards are posed by the increasing number of

nuclear power sources, both active reactors and passive fuel

cells.(13,24) Therefore, approval of nuclear missions is subject

to more rigorous risk assessments, planning and review by an

Interagency Nuclear Safety Review Panel (INSRP). There are about

50 potentially hazardous satellites in orbit today, carrying over

1.3 tons of nuclear fuel, much in the form of long life toxic

isotopes. These pose both on-orbit collision and re-entry

hazards (see Ch. 7). The 48 radio-thermal generators (RTG) and

fuel cores orbiting today are in the most crowded LEO region at

about 1000 km altitude. Both US and Soviet satellites have

exploded or spawned debris in this belt. However, since 90% of

the Soviet nuclear material in RORSAT satellites has been

intentionally ejected into higher orbits at 900-1000 km at 65o

inclination, the hazards to population due to re-entry or

possible ground impact have been removed. This procedure is

intended to increase the orbital lifetime to more than 1,000

years to allow sufficient time for the radioactivity to decay.

The eventual retrieval and elimination of these materials is

possible by sending them, for example, into escape orbits or into

the Sun. Hypervelocity collisions with nuclear satellites and

their fragments could endanger, contaminate and disable both

manned and unmanned spacecraft with perigees well below 1000 km.

6.4 ASSESSMENT OF COLLISION HAZARDS IN ORBIT

6.4.1 Collision Hazard in LEO

Low Earth Orbits generally include the altitude range of 200 km

to 4000 km. This region has the largest spatial density

(Number/km3 -see Fig.6-1) of space objects, with a maximum of

1.7 x 10-8 objects/km3 between 800 and 850 km and 2.5 x 10-8

objects/km3 between 950-1000 km altitude. This corresponds to a

mean time between collisions of 1/1800 years for a satellite with

a cross section of 100 m2, the size of the Soviet Mir Space 

6-16
Station (Fig. 6-3). Figure 6-9 shows the observed population of

satellites, as modified by the debris density. This density

exhibits two maxima, one near 800 km (480 miles) altitude and the

other near 1400 km (840 miles). The actual debris population is

likely to be considerably larger than that shown in Figures 6-6,

6-8 and 6-9. Decay of space objects, i.e., re-entry to Earth,

occurs primarily from low altitude orbits and results from

atmospheric drag which increases with the level of solar

activity. A typical orbital lifetime at 300 km is less than one

month; below 200 km, it is just a few days. These de-orbiting

spacecraft will re-enter Earth's atmosphere and contribute to reentry hazards (see Ch. 7).

6-17
If the worldwide satellite population continues to increase at

150-180 /year (as was the case for the past 5 years)(5) and all

these objects penetrated the maximum density altitude band (950-

1000 km), the LEO spatial density would still not be expected to

increase by a factor of 10 until between the years 2044 and 2100.

Many Earth satellites (83%) which reside in LEO decay in orbit

within a few days to several years. Solar flare and sunspot

activity cycles periodically "purge" these orbits (see Refs.

13,29 and Chs. 4,7).

Inactive satellites, jettisoned rocket motors and launch or break

up debris in LEO could undergo hypervelocity impacts (at

10km/second) with active satellites in circular orbits and with

others in elliptical orbits which traverse this altitude range.

Launch activity is an important factor contributing to space

hazards through the generation of man-made debris. Table 6-2

shows the number of space launches since 1980 and the projected

number of space launches anticipated in the next decade.(5,6,9) The

current annual USSR space activity amounts to about 105 launches

per year. The Soviet program accounts for roughly 95 % of the

total, largely because the useful on-orbit life of Soviet

satellites is much shorter than that of equivalent US spacecraft.

6-18
Figure 6-2 shows the relative flux distribution of meteorites and

man-made objects in LEO. The meteorite flux data were based on

indirect ground based measurements, including observation of

meteors burning up in the atmosphere. The man-made flux data

were taken from the 1986 Satellite Catalog of tracked space

debris.

6.4.2 Collision Probabilities in LEO

Collision probabilities are useful in assessing space hazards,

estimating collision hazards between operational spacecraft and

orbiting objects quantitatively and determining the likelihood of

satellite debris collisions.

Models developed for deriving probability estimates usually use

the following assumptions:

• Objects in orbit are randomly distributed and each

object is assigned an effective cross section.

• The collision cross section is usually the geometric

cross section of the satellite.

• Orbital planes within the debris population have random

distributions in the azimuthal coordinate.

Several models based on kinetic theory and celestial mechanics

provide estimates of collision hazards to operational spacecraft

in LEO.(11,16,20) The impact probability, per orbit or per crossing

a certain orbital torus, must be multiplied by the on-orbit

satellite lifetime (or the mission duration) and the cross

section of the object to estimate its overall collision risk.

Probability derivations are simplified if the object density is

assumed to have only an altitude dependence and all other

dependencies are replaced by averages. While the latter removes

the possibility of including angular orbital dependencies in the

solution, it nevertheless provides a reasonably accurate estimate

of the collision hazard.

One procedure used to determine the altitude dependent object

distribution is to define an Earth centered spherical grid,

consisting of surfaces of constant radius spaced every 50 km from

150 to 4000 km in altitude, and surfaces of constant polar angle

(latitude) spaced every 5 degrees.(8) The object density within

the above defined space cells is computed based on the percentage

of time an object spends in the 'spherical cell.' Figure 6-2 is

typical of the type of density distribution which results from

this model. The mean rate of collision probability, P, is

defined as,

6-19
where C(r,t) is the collision frequency equal to, 

C(r,t) = σeff·ρ(r,t)·v(r,t)

Where: ρ = object density

σeff = effective cross section

v = mean speed of object relative to debris

r = object distance from Earth's center

t = the elapsed time.

Applying this to the example of the Shuttle Orbiter at 300 km

altitude, with a debris distribution similar to that shown in

Figure 6-2, gives a predicted time between collisions

approximately equal to 25,000 years(8). These models estimate the

collision probability for a Shuttle Orbiter at 150-300 km

altitude to be roughly 1 in 25,000 years. The chance of an

orbiter colliding with debris in LEO, over its lifetime, is about

10-3 at present and may exceed 10-2 by the year 2000. The larger

collision risk for spacecraft which operate in the 600 to 1200 km

range of maximum debris population, is offset by the smaller

cross sections of operational spacecraft at these altitudes.

This result assumes a typical Shuttle cross sectional area of 

250 m2 and a relative impact velocity of 7 km/s. Man-made debris

of size 4 cm and smaller do not present a significant hazard to

LEO spacecraft with dimensions comparable to that of the Shuttle.

A future Space Station 100 m across in LEO at a 500-550 km

altitude, would have a mean life to collision of 170 years

without debris, but of only 41 years given the present debris

strewn near-Earth environment.

Inclusion of the latitude dependence in the probability estimate

yields similar results. Table 6-3 gives the predicted time

between collision as a function of orbital inclination with the

same LEO debris population used previously (see also Fig. 6-8).

Greater debris hazards are anticipated for spacecraft operating

at higher altitudes, particularly in the range from 600 to 1200

km where debris density is greatest (Fig.6-2). Table 6-4 gives

the estimated time between collisions for a small spacecraft, of

5 m2 collision cross section, with man-made debris assuming a

relative speed of 7 km/s. There is evidence that some spacecraft

in LEO have already collided with either natural or artificial

orbiting debris.

6-20
6-21
6.4.3 Collision Hazard in Geosynchronous Orbit (GEO)

Conceptually, the geosynchronous orbits can be visualized as a

spherical shell several kilometers thick located at an altitude

approximately 36,000 km above the Earth. Spacecraft in

geosynchronous orbit move with the rotating Earth at arbitrary

angles of inclination with respect to the equator. The

geostationary orbit represents a particular subclass of the

geosynchronous orbits in which objects move synchronously with

the rotating Earth, but with positions fixed relative to its

rotating coordinate system. The geostationary ring denotes a

particular region in geosynchronous space, of approximately

several hundred kilometers in width, encompassing these orbits.

The main characteristics of geosynchronous orbits are:

• Orbital period is equal to one sidereal day (1436.2

minutes or 24 hours).

• An infinite variety of orbits exist each with the same

average altitude as a geostationary orbit.

• Objects in orbit cross the equator twice each day with

average velocity of 3075 m/s.

• The equatorial crossing point of the object drifts

cyclically along the equator due to unbalanced Earth

gravity.

• Objects remain permanently in orbit (as in the

geostationary ring).

The main characteristics of geostationary orbits are:

• Altitude above Earth is 35,787 km (19323 nautical

miles) ± 50 km.

• Orbit is exactly circular over the Earth's equator 

(± 10 latitude).

• Orbital period is 1436.2 minutes or roughly 24 hours.

• Objects in orbit have an orbital velocity of 3075 m/s.

• Objects remain permanently in orbit, i.e., the decay

rate is very slow and secular, about 1 kilometer per

thousand years.

• Objects in orbit are subject to weak luni-solar and

Earth gravitational perturbations which result in slow

drift in east-west and north- south directions about

the two geo-stable points at 75.3°E and 104.7°W

longitude. This results in eventual clustering of

inactive satellites in these regions.

Semi-geosynchronous orbits (i.e., at half the GEO altitude with

12 hour periods) are also used for communication satellites.

Such highly elliptical "molnyia" (lightning) orbits are favored

by the Soviets because the satellite spends most of its time

above the Soviet Union moving slowly near apogee, but crosses 

6-22
rapidly over antipodal regions near perigee. Such orbits degrade

more rapidly due to atmospheric friction near perigee.

The largest concentration of operational spacecraft lies in the

geostationary belt and currently numbers over a hundred

spacecraft. Extinct satellites also continue to orbit in the

crowded GEO orbits, presenting a mounting collision damage hazard

to new communication satellites (Fig. 6-3). Some nations and

organizations have begun to move inactive satellites out of GEO

to prevent cluttering of the GEO ring. However, according to

Ref. 3 (Ch. 4), the removal of inactive satellites from GEO

stations at the end of their useful life is not yet a general

practice. The policy of using disposal orbits for defunct

satellites has recognized shortcomings which may introduce new

hazards to active payloads (e.g., the potential for misfire or

explosion, eventual migration of "removed" payloads to GEO due to

luni-solar perturbations and solar wind pressure, added cost for

stationkeeping and orbital maneuvering propellants and decreasing

reliability with life on- orbit.)

The peak spatial density (number per km3) of satellites at GEO

altitudes (35,750 to 35,800 km) is due to about 543 satellites,

of which only about 150 are geostationary. The others are in

either geosynchronous, or semi-geosynchronous highly elliptical

"molnyia" orbits. The corresponding spatial density value is

7.55 x 10-10 objects, still 2-3 orders of magnitude below that in

LEO.

The current geosynchronous population, as tracked by USSPACECOM,

consists of about 116 active communication satellites plus at

least as many uncontrolled objects drifting through the

geosynchronous corridor. The latter includes inactive satellites

and debris which drift around the Earth or oscillate about the

two geo-potential stable points. USSPACECOM can track an object

of the size of a soccer ball in GEO and of about ò 10 cm. in LEO

(Figs. 6-1, 6-4). Figure 6-10 shows the relative positions of

the commercial communication satellites in GEO. The number of

active GEO satellites over the past few years and the estimated

number of GEO launches in the coming decade is shown in Fig. 6-10

and Table 6-5.( 5,6)

Thus, collisions in GEO are restricted to object encounters at a

fixed altitude of approximately 36,000 km, actually an equatorial

torus of 10 in latitude and 35, 785 ±50 km altitude above the

Earth's equator. Such collisions can involve both man-made

objects and natural objects (meteoroids).

6-23
6-24
Estimated collision probabilities with debris in GEO are of the

order of 10-5 at present, but could reach 2x10-3 over the life of

the satellite, (i.e. 1 in 500) by the year 2000. Therefore, at

current GEO population levels, collision hazards do not appear to

be a major problem.(1-4,9,17) The collision hazards in GEO tend to

be lower than in LEO for the following reasons:

(1) the lower spatial density of GEO satellites, although

new communication satellites are increasingly crowding GEO

orbits( Fig. 6-2);

(2) the relative velocity difference between objects

orbiting in GEO is less than for LEO;

(3) most active spacecraft in GEO require accurate position

control and station-keeping above their Earth subpoint,

thereby reducing the likelihood of mutual collisions.

These considerations, however, are offset by the limited orbital

slots available in GEO and the steady increase in the number of

GEO satellites launched each year (Fig.6-10). Also, meteoroids

cross the GEO belt with high relative velocities, so their

background collision hazard remains at a level comparable with

that of LEO. An unknown factor is the amount of unmonitored

debris in GEO, because objects at such high altitude are more

difficult to detect and monitor with radar or optical telescopes.

6-25
A number of articles discuss the collision probabilities of

satellites in GEO.(10-20) In general, the collision probability is

a complicated function of orbital parameters, relative position,

velocity, projected areas of the spacecraft and time. The

collision probability, P, of satellite collisions assuming a

uniform distribution of space objects is, 

P = A·ρ·v·t

where: ρ= object density

A= projected area of the satellite

v= relative velocity of the target satellite

t= time interval associated with the (periodic)

satellite motion

Takahashi(15) and Chobotov(11,16) have developed models for

estimating collision probabilities for GEO satellites. Both

models use the above relation as the basis for derivation of

collision probabilities. Takahashi assumes the target satellite

stays within fixed longitude/latitude bounds by appropriate

station keeping. The satellite motion includes a small diurnal

oscillations superimposed on a steady longitudinal drift.

Maneuver corrections are applied every 15 days to maintain the

satellite within the fixed longitudinal bound.

The right hand side of Figure 6-5 illustrates the diurnal

oscillation/drift motions assumed by Takahashi. The satellite

orbital bounds were assumed to be 0.01o, 0.05o, and 2 km for the

longitude, latitude and altitude respectively.

If the orbital bounds for the diurnal motion are expressed in

terms of increments in longitude ∆ LON, latitude ∆ LAT and

altitude ∆ ALT, the collision probability in three dimensions per

orbit takes the form:

P = N·(2∏R)·L2·(∆LON·∆LAT·∆ALT)·(∆LON+(2/∏)·∆LAT+ ∆ALT/R)

where L is the satellite diameter. The incremental bounds ∆ LON,

∆ LAT and ∆ ALT are set by the magnitude of the diurnal motions

along the longitude, latitude, and radial coordinates which are

assumed to be equal to 0.01o, 0.05o and 2000 meters respectively.

If an additional factor of 1/10 is introduced to account for the

fact that collisions are only possible one out of every ten

diurnal periods due to the longitudinal drift, then with these

substitutions the above equation takes the form:

P = 9.51 x 10-9 x L2 per half day

This yields a satellite collision probability of 7 x 10-6 x L2 per

year. For satellites having dimensions typical for those used in

space communications, i.e., L=2 meters, the probability of

collisions in the geostationary orbit is extremely small. This

changes when large space structures are considered, such as

6-26
proposed satellite "farms," solar power satellites or orbiting

space platforms. For an orbiting satellite of dimensions

approaching 125 meters, the annual likelihood of a collision is

about one in ten. For a hypothetical satellite "farm" of

dimensions of 1000 meters, the expected frequency of collision

increases to approximately once every 52 days.

The Chobotov approach considers the collision probability between

geostationary satellites in circular orbits (in the equatorial

plane) and geosynchronous satellites moving in an orbital plane

with small inclination angle i and orbit eccentricity e. The

satellite density, ρ, is proportional to the relative dwell time

the satellite spends within a spatial volume defined by the

following "bounds":

Longitude bound = 2 ∏ R, Latitude bound = 2 R sin i,

Altitude bound = 2 R e,

where: R is the distance of satellite from Earth's center.

For a geostationary satellite of radius Rs, the probability of

collision, P, with another satellite in one revolution or a 24

hour period is on the order of P = 2.83 x 10-13 Rs2 per day.

For a population of over 200 satellites, assuming one satellite

every 2o longitude, each with radius of 50 meters, the

probability is 2.2 x 10-9 per day. Hence, the probability of a

collision between a satellite in a circular geostationary orbit

with other satellites in low inclination orbits is extremely

small.

This probability of a collision between a spacecraft and spent

GEO transfer stages is approximately two orders of magnitude less

than that between two active GEO spacecraft, because of to the

relatively small percent of the time (approximately 3%) that an

object in an elliptical GEO transfer orbit spends at

geosynchronous altitudes. The semi-geosynchronous ("molnyia")

orbits favored for Soviet communication satellites are highly

elliptical with low perigees and high relative near-Earth

velocities.

To summarize, the low typical spatial densities in GEO of 2.5 -

7.5x10-10 objects/km3, due to the roughly 550 objects which orbit

in the 35, 750 + 50 km bin, combined with lower relative

velocities in GEO and with typical station keeping capabilities,

the probability of on-orbit collision is negligible at present(24).

6.4.4 Gravitational Drift Forces in GEO

Secular gravitational forces play an important role in altering

the orbital characteristics of geosynchronous satellites.

Depending on the point of origin of these forces, their effect on

the orbit can be markedly different. These forces include the

6-27
gravitational forces associated with the Earth's oblateness and

the gravitational attraction of the Moon and Sun.(26)

The oblateness of the Earth (bulge in its in the equatorial

plane) produces longitudinal drift forces in the east-west

direction associated with the two geo-stable points located near

104.7oW and 75.3oE longitude. Without station-keeping capability,

these forces cause GEO satellites to move in elliptic orbits in

the longitudinal (and radial) direction with an oscillation

period of about 820 days. Figure 6-11 shows a pictorial view of

these drift oscillations.(27) The amplitude of excursion about

these geo-stable points depends on the initial orbital departure

from the geo-stable points, with the amplitude being zero for

orbital paths that happen to cross the equator at the geo-stable

points.

6-28
A second type of gravitational force is associated with the

gravitational attraction of the Moon and Sun, which generate

'drift' forces along the north-south direction. The latter

forces act to alter the inclination of the geosynchronous orbit

causing an initial change in orbital inclination of about 0.86o

per year. A maximum inclination of 15o is achieved in about 27

years at which point the inclination proceeds to decrease to zero

in another 27 years. Superimposed on the above cyclical motions

are small amplitude oscillations in the longitudinal and radial

directions. These diurnal oscillations are characterized by a

cyclic period of one (sidereal) day and have vastly smaller

amplitudes (a factor of 106 and 103, respectively) compared to the

longitudinal and radial motions described previously.

6.4.5 Collision Encounters in Geosynchronous Orbits

While slot allocation of GEO satellites generally attempts to

maintain a minimum separation of two degrees longitude, in

practice several satellites may share a common longitudinal

location. This has led to procedures developed by the United

States Air Force Satellite Control Facility (USAFSCF), recently

designated the Consolidated Space Test Center (CSTC), to monitor

all close approaches between primary communication satellites and

other trackable objects coming within 300 km of these satellites.

Predictions are made for all close approaches every seven days

and appropriate user agencies are notified when the separation

distance approaches 50 km. Collision avoidance maneuvers are

considered at 5-8 km separation and are implemented if near

simultaneous tracking of both space objects one to two days

before encounter (closest approach) verifies the predicted

positions of the satellites as accurate.

Typical data on geosynchronous orbit encounters over a 6 month

period show that for 21 satellites examined there were 120

predicted encounters within the 50 km minimum miss distance.(15-17)

Of these, several were in the 1-5 km range and required collision

avoidance actions. The mean distance of closest approach was 21

km with a standard deviation of 13 km. Collision probabilities

for these satellites were found to be up to two orders of

magnitude greater than would be expected based on average density

of objects in the geosynchronous corridor.

A total of six fragmentation incidents have occurred in the

geosynchronous corridor, which have been suggested by some to be

the possible result of actual collisions. In at least one of

these, the satellite broke up into smaller debris components.

The question arises as to the potential liability of satellite

owners and users for collision damage resulting when their

spacecraft becomes inactive, remains in GEO, and collides with an

active satellite. The accumulation of significant numbers of 

6-29
inactive satellites in GEO poses increasing collision hazards for

active satellites. Takahashi estimated this collision

probability using the same method previously applied (see Sec.

6.4.3) in the case of collisions between active satellites.

Inactive satellites are assumed to have motion perturbations

dictated by the Earth and by luni-solar gravitational/drift

forces. Diurnal oscillations caused by the Earth's gravitational

perturbations are superimposed on long-term (2-3 years) orbit

evolution about one of two geo-stable points located at 75oE and

105oW longitude. Figure 6-12 shows a sketch of the long-term

orbital evolution relative to Earth fixed coordinates. An

additional secular motion excursion occurs in the north-south

direction, causing a latitude variation of ±14.7o in a 54-year

period.

6-30
The collision probability is estimated by determining the

likelihood of collision in one sidereal day of a satellite

confined within geosynchronous bounds of 0.1o longitude, 7.35o

latitude and a 30 km altitude range. The effect of the secular

orbital oscillations is to reduce the collision probability by a

factor of 1/900. The estimated collision probability between an

active and 'N' abandoned satellites of dimension 'L' then

becomes:

P = 5.185 x 10-13 x N x L2 per half day.

This gives a probability of 6.0 x 10-6 per year for a collision

between an active satellite and an assumed total of 1000

abandoned satellites, each 4 meters diameter.

If the active satellite is assumed to be a large space platform

of 125 meters across, the probability of collision with an

estimated 1000 inactive satellites in one year increases to:

P = 730 x 5.185 x 10-13 x 1252 x 1000 = 0.00591 per year

Similarly, if a large solar power satellite with hypothetical

dimensions of 1000 meters will be stationed in GEO, the collision

probability in 1 year will become a sizeable 0.38 per year.

Hence, large GEO satellite clusters or platforms will have a high

probability for collisions, if the number of abandoned

communication satellites is allowed to approach 1000.

6-31
REFERENCES TO CHAPTER 6

1. Kessler, D.J. "Orbital Debris-Technical Issues",

presentation to the USAF Scientific Advisory Board on

Space Debris, Jan. 1987.

2. a)Johnson, N.L. "Space Background Environment Assessment",

Teledyne Brown Eng. Report for US Army Strategic Defense

Command, Sept. 1986, CS86- USASDC-0022.

b)"Special Report of the USAF Scientific Advisory Board Ad

Hoc Committee on Current & Potential Technology to Protect

AF Space Missions from Current and Future Debris-Draft,

1987. (Appendix: "History and Projections of Foreign

Satellite Mass to Earth Orbit".)

3. Johnson, N. L. and D.S. McKnight, "Artificial Space

Debris," (Orbit Book Co., Malabar, FL, 1987).

4. a)NORAD, "Satellite Catalog", December 1986;

b)USSPACECOM, Space Surveillance Center, "Satellite

Catalog," Dec. 31, 1987.

c)"What's Up in Space- Operational Satellites on the

Anniversary of Sputnik 1", F.A.S. report, September, 1987.

5. "Space Activities of the US, Soviet Union and Other

Launching Countries:1957-1986," M.S. Smith, Congressional

Research Service, Report 87-229 SPR, Feb. 1987.

6. "International Cooperation and Competition in Civilian

Space Activities," OTA-ISC-239, July 1985, OTA/US

Congress.

7. Fischer, N.H. and Reynolds, R.C., "Threat of Space

Debris", 1984 IEEE Trans. on Aerospace & El. Systs., pp.

397-406.

8. Reynolds, R.C., Fischer, N.H., and Rice, E.E., "Man-Made

Debris in Low Earth Orbit-A Threat to Future Space

Operations", Journal of Spacecraft and Rockets, Vol. 20,

No. 3, May/June 1983, pp. 279-285.

9. Suddeth, D.H., "Debris in the Geostationary Orbit Ring -

The Endless Shooting Gallery - The Necessity for a

Disposal Policy", Conference, 1986.

10. Kessler, D.J., "Orbital Debris Issues," Advances in Space

Research, Vol. 5, No. 2, 1985.

11. Chobotov, V.A., "Collision Hazard in Space," Astronautics

and Aeronautics, Vol. 17, No. 9, September 1980, pp. 38-

39.

6-32
12. Kessler, D.J., P.M. Landry, B.G. Cour-Palais and R.E.

Taylor, "Collision Avoidance in Space," IEEE Spectrum,

Vol. 17, No. 6, June 1980, pp. 37-41.

13. W.B. Wirin, "The Sky is Falling: Managing Space Objects,"

Proceedings, IAF 35th Congress, Coll. on. Cooperation in

Space, Intl. Inst. on Space Law, Oct. 1984, Lausanne,

Switzerland (NY, AIAA, 1984), p. 152.

14. J.A. Lovece, "The Impending Crisis of Space Debris,"

Astronomy, Aug. 1987, pp. 8-13.

15. Takahashi, K., "Collision Between Satellites in Stationary

Orbits," IEEE Transactions on Aerospace and Electronic

Systems, AES-17, No. 4, July 1981.

16. Chobotov, V.A., "On the Probability of Satellite

Collisions in Earth Orbit," The Aerospace Corporation,

TOR-0079(4071-07),.June 21, 1979.

17. a)Hechler, M. and Vander Ha, J., "Probability of

Collisions in the Geostationary Ring," Journal of

Spacecraft, Vol. l8, No. 4, July/August 1981.

b)Hechler,M., "Collision Probabilities at Geosynchronous

Altitudes," Adv. Space Res. Vol. 5, pp. 47-57, 1985.

18. Takahashi, K., "Applications of Space Development," XXXI

International Astronautical Congress, Tokyo, 1980.

19. Brooks, D.R., G.G. Gibson and T.D. Bess, "Predicting the

Probability that Earth-Orbiting Spacecraft will Collide

with Man-Made Objects in Space," Space Rescue & Safety,

Vol. 37, 1974, pp. 79-139 (AAS74-185).

20. Reynolds, R.C., Fischer, N.H., and Miller, L.A.,

"Collision Hazard Presented by Man-Made Debris Undergoing

Correlated Motion," Space Rescue & Safety, Vol. 58, 1982

(published in 1986, Univelt, San Diego, CA., pp. 11-30).

21. Howell, I.A., "The Challenge of Space Surveillance" in Sky

and Telescope, June 1987, pp. 584-588.

22. Su, S-Y and D.J. Kessler, "Contribution of Explosion and

Future Collision Fragments to the Orbital Debris Fragments

to the Orbital Debris Environment," Adv. Space Res. 5, pp.

25-34, 1985.

23. Taff, L.G., "Satellite Debris: Recent Measurements," J.

Spacecraft, Vol. 23, pp. 342-346, 1986.

24. Johnson, N.L., "Nuclear Power Supplies in Orbit," Space

Policy, Aug. 1987, pp. 223-233.

6-33
25. Gabbard, J., "History of Satellite Breakups in Space,"

Orbital Debris Workshop, Lyndon B. Johnson Space Center,

Houston, Texas, pp. 30-38, July 82.

26. Nacozy, P., "Inclined and Eccentric Geosynchronous

Satellite Orbits," AIAA Paper 82-1412, 1982.

27. Blitzer, L., "Effect of Ellipticity of the Equator on 24-

Hour Nearly Circular Satellite Orbits," Journal of

Geophysical Research, Vol. 67, January 1962.

28. "Space Station and the Law: Selected Legal Issues," OTA

Background Paper, Aug. 1986.

29. "Policy and Legal Issues Involved in the Commercialization

of Space," S. Prt. 98-102 US Congress, 1983.

30. Hosenball, S.N., "The Law Applicable to the Use of Space

for Commercial Activities," AIAA Paper 83-0253, 1983.

31. Schwetje , F.K. (USAF Chief of Space Law), "Space Law:

The Legal Aspects of Space Debris Control and Space

Salvage Operations"presented at Inter-American Bar Assoc.

Mtg, Buenos Aires, Argentina, May 1987.

32. "Satellite Situation Report," NASA/GSFC, Vol. 27, #3,Sept.

30, 1987; #2, June 30, 1987; and Vol.26, #4, Dec.31, 1986.

6-34
10/2/95 rev

7. RE-ENTRY HAZARDS

7.1 DEFINITION AND NATURE OF RE-ENTRY

Re-entry occurs when an orbiting spacecraft comes back into the

Earth's atmosphere.(1) Any object placed in Earth orbit will

eventually de-orbit and re-enter the atmosphere; this includes

launch and breakup debris of satellites and spent rocket stages.

Above 200 miles altitude, space is considered a perfect vacuum.(2)

In reality, space is never a perfect vacuum and regardless of the

orbital altitude of an object, it creates drag which eventually

degrades the satellite's orbit. The solar wind and solar flares

impinge on orbiting spacecraft and gravitational perturbations

(both terrestrial and luni-solar) modify the spacecraft orbit and

shorten its lifetime in space. The result is that spacecraft

tend to spiral slowly towards the Earth's surface. When objects

re-enter the atmosphere, their orbits decay rapidly and many of

them burn up prior to impacting the Earth's surface.

There are two different sets of conditions associated with either

controlled or uncontrolled de-orbit to consider when evaluating

risk from re-entering satellites and other space debris.(15,16)

Controlled de-orbit usually applies to manned and reusable

spacecraft which are designed to survive re-entry and be

recovered. In this situation, retrorockets are fired at a

scheduled time in order to place the vehicle into a transfer

orbit which intersects the surface of the Earth. If the Earth

had no atmosphere, the intercept point would be the intended

impact point. With the atmosphere, however, the vehicle

decelerates further and falls short of the predicted vacuum

impact point. The impact point still can be predicted reasonably

accurately under these conditions. Thus, the controlled de-orbit

can be planned so the spacecraft will impact near a predetermined

recovery point, minimizing the risk of inadvertent impacts on

ships or ground and sea structures.

There are three major sources of uncertainty associated with

predicting uncontrolled re-entry characteristics, namely: the

atmospheric conditions at the time an object begins to re-enter,

the time of actual impact with the Earth's surface and the area

in which the re-entering object will impact. These uncertainties

associated with uncontrolled re-entry increase proportionately

with the object's orbital altitude and on orbit lifetime.

When an object has been orbiting for a period of time, a number

of changes could have taken place over its lifetime. If the

spacecraft failed in some way before it reached final orbit, its

orbital parameters (inclination and eccentricity) could have

changed. It may have strayed from its planned orbital path,

failed to achieve final orbit or broken up in an explosion

7-1
causing pieces to disperse in different directions. All of these

failure modes have a direct impact on the variables (surface

area, mass, shape of fragments and orbital characteristics) used

in the prediction of re-entry hazards.

Small changes in orbital characteristics can drastically affect

the manner of an object's passage through the atmosphere. The

frictional heating and drag (deceleration) experienced in the

atmosphere have large effects on the object. Small deviations

from the predicted conditions of re-entry may result in large

differences in re-entry hazards and the associated casualty

expectation (see Section 7.6). These differences could be due to

further break up caused by the shock of entering the atmosphere

at high velocity, the burning and ablation (vaporization)

experienced during re-entry or changes in direction or velocity

due to the weather and wind conditions that slow re- entering

fragments differentially at lower altitudes.

7.2 ORBITAL DECAY

The basic concepts of energy and angular momentum (see Ch. 4) can

be used to answer most questions dealing with orbital and reentry trajectories. They are used to predict the initial reentry point and probable ground impact points. Orbiting

satellites control their positions in space by using small rocket

thrusters, thereby changing their velocity and direction. This

process is called "station-keeping" and requires rocket fuel and

special on board communications and control equipment.

Therefore, it is possible, to some extent, to choose the initial

atmospheric re-entry point when dealing with controlled reentry.(3) However, few satellites have the ability, capacity or

life expectancy to provide the station-keeping capability towards

the end of their life.

All space objects that orbit the Earth do so because of the

various forces acting on them. These forces change the position

and velocity of the object relative to Earth in such a way that

their orbital characteristics become very predictable. The

Satellite Surveillance Center (SSC),US Space Command

(USSPACECOM), within the Cheyenne Mountain Complex in Colorado,

monitors each satellite's past and present positions and predicts

its future using these various orbital characteristics and

dynamic processes. To determine a satellite's position at any

given time, the computer uses an algorithm based on the laws of

Space Mechanics.(2,3,12) The computer can predict the orbital path

of the object with the object's historical position and velocity

information. The Space Surveillance Center (SSC) of the US Space

Command processes tracking and monitoring data obtained by the

Space Surveillance Network (SSN) to predict re-entries. Space

debris of the more than 90 satellite collisions or spontaneous 

7-2
break ups and 20 payload explosions in space have been documented

to date (see also Chapter 6).(4,5,8)

External perturbations due to the Earth's oblateness, the

gravitational tugs of the Sun and Moon, the solar plasma storms

and atmospheric friction cause long-term changes in the orbital

parameters of satellites. These forces also affect the on orbit

lifetime and re-entry. Theoretically, all forces acting on nearEarth satellites can affect a satellite's on orbit lifetime. The

effects of solar storms on the atmosphere and the oblateness of

the Earth have a much more significant effect than the

gravitational attractions of the Sun, Moon and the other planets.

NASA/Marshall scientists have taken these factors into account in

designing an orbital lifetime prediction program. This program,

called LIFTIM, uses a direct numerical integration of the time

rates of change due to atmospheric drag using a Gauss-Legendre

procedure in conjunction with the Jacchia atmosphere model.(6)

An orbiting object loses energy through friction with space

plasmas above the atmosphere so that it falls into a slightly

lower orbit and eventually spirals towards the Earth's surface.

As the object's potential energy, represented by its altitude, is

converted to kinetic energy, its orbital velocity increases. As

an object's orbital trajectory is brought closer to Earth, it

speeds up and outpaces others in higher orbits. Thus, a

satellite's orbital altitude decreases gradually while its

orbital speed increases. Once it enters the upper reaches of the

atmosphere, atmospheric drag will slow it down more rapidly and

eventually cause it to fall to Earth.(4)

Atmospheric drag, particularly near perigee, leads to the gradual

de-orbit and re-entry of satellites. Satellites in LEO with less

than 90 minute periods, corresponding to orbital altitudes of

100-200 nmi (or 185-370 km), re-enter within a couple of months.

Above about 245 nmi (455 km) orbital altitudes, orbital lifetimes

exceed several years. Above about 500 nmi (900 km) altitudes

orbital lifetimes can be as long as 500 years.(5) Figure 7-1(a &

b) illustrate Earth orbit lifetimes of satellites as a function

of drag and ballistic coefficients (see Section 7-3) for circular

(e=0) and elliptical orbits with a range of altitudes. For

elliptical orbits, the lower the perigee altitude, the higher is

the apogee decay rate (P) and the shorter the on-orbit lifetime.

7-3
7-4
7-5
The ballistic coefficient á is equal to W/CDA, where W is the

spacecraft weight, CD is the drag coefficient (which varies with

shape) and A is the projected frontal area of the re-entering

object. The more mass per unit area of the object, the greater

the ballistic coefficient and the less the object will be

consumed during its atmospheric crossing. The ballistic

coefficient of a piece of debris is an important variable in the

decay process as illustrated in Figure 7-1(a & b). A fragment

with a large area and low mass (e.g., aluminum foil) has a low á

and will decay much faster than a fragment with a small area and

a high mass (e.g., a ball bearing) and will have a shorter

orbital life. The combination of a variable atmosphere and

unknown ballistic coefficients of spacecraft and launch and

orbital debris make decay and re-entry prediction an inexact

science at best.(7)

An examination of 104 successful space launches of 1985 revealed

that the payloads from no less than 47 had re-entered within a

year of launch. As a rule of thumb, it is suggested that about

70 percent of the annual mass put into orbit re-enters the

atmosphere within 1 year of launch. Another 5 percent of the

original annual mass may be expected to re-enter within 5 years

from launch.(8) For example, from July 1 to October 1, 1987, of

the 121 objects which de-orbited, 53 were payloads launched in

that period.(17)

USSPACECOM's SSC currently tracks about 7000 cataloged objects

and may issue Tracking and Impact Prediction (TIP) messages which

predict re-entry times and points of impact for about 500 reentries each year. For example, in 1979-1980, 900 new objects

were cataloged, but the total tracked population decreased by

300. The satellites were "purged" during the solar sunspot

maximum which effectively increased the atmospheric density in

LEO, thus, increasing orbital decay rates. Atmospheric drag is

directly related to solar activity: High solar activity heats

the upper atmosphere, increasing the atmospheric density by more

than 10 times the average density at most satellite altitudes.

This exerts a greater braking force on satellites and causes an

above average number of objects to re-enter the atmosphere.(9)

Thus, satellites decay in much greater numbers near Sunspot

maximum than at a time of low solar activity (Figure 7-2).(10)

Hence, the 11 year sunspot cycle is a periodic natural "sink",

removing orbiting satellites from the near-Earth environment and

thereby increasing re-entry hazards.

7-6
During the past 5 years there have been an annual average of 548

decays from lower altitude orbits (i.e., about three satellites

re-entering every 2 days). Almost 83 percent of Earth satellites

reside in LEO orbits (see Chapter 6) with periods of less than

225 min (about 4 hrs) and are near term re-entry candidates (see

Figs.4-3 and 7-1). The total number of satellite decays per year

is shown in Figure 7-3. (11)

7-7
7.3 RE-ENTRY SURVIVABILITY

The information mentioned above would suffice to predict re-entry

and ground impact points for spacecraft only if no other

variables affected the re-entry process. In reality, the Earth's

atmosphere, which is very sparse at high altitudes, interacts

with the spacecraft. A vehicle approaching the Earth's

atmosphere from space possesses a large amount of kinetic energy,

due to its high relative velocity, and potential energy due to

its orbital altitude above the Earth. When it encounters the

7-8
atmosphere, a shock wave forms ahead of the vehicle, heating the

atmosphere in this region to very high temperatures. The high

temperatures due to friction with atmosphere reduce the vehicle's

velocity and convert the vehicle's potential energy into heat

absorbed by the object and its wake. If the vehicle slows down

quickly, the total amount of heat to be absorbed by the vehicle

is reduced. This explains the blunt (high drag) shape of reentering spacecraft in the pre-shuttle manned space program.

However, the total heat generated in the shock wave is still too

great to be absorbed by metals which heat up and melt.

Therefore, since it takes significantly more heat to vaporize

material than to heat or melt it, materials used in heat shields

were designed to ablate (vaporize) in the presence of the extreme

temperatures. The net effect is that ablative protection allows

objects to survive re-entry.

If the total energy of the spacecraft were converted to heat, it

would vaporize the vehicle. The survival of meteorites to ground

impact is proof that not all of the energy is converted into

heat, but enough is converted to cause surface ablation.

Actually, a large portion of the total energy is diverted away

from the vehicle. If the object conducted the heat away from the

forward surface and the total body could absorb the heat of reentry without breaking up, then the object would re-enter the

Earth's atmosphere and descend to Earth in a predictable way.(12)

Heat shields and special shaping of forward surfaces are used to

minimize frictional heating effects on the rockets and payloads

during space launches, to protect them from heat and control

ablation.

Surface heating effects depend on the vehicle's shape,

composition, altitude and velocity. For re-entry at small angles

of inclination when the vehicle deceleration rate is small, the

surface heating rate is correspondingly small. For re-entry at

large angles of inclination where the vehicle decelerates rapidly

in the atmosphere, the surface heating rate will be greater but

the time spent in the atmosphere will be shorter.(3)

Spacecraft which are not designed to survive re-entry generally

do not have ablative surfaces nor are they very stable

aerodynamically. The usual sequence of events in the re-entry

process is as follows:

1. As the vehicle starts to re-enter, heat is generated by the

shock wave and a portion is absorbed by the surface of the

structure. As the structure heats up thermal energy is

radiated out at a significantly lower rate than it is being

absorbed.

2. The heated structure weakens and when the aerodynamic forces

exceed its structural strength, it starts to come apart.

7-9
3. The heating process continues on the remaining parts of the

structure, repeatedly breaking it up into still smaller

pieces.

4. These structural pieces continue to heat up and eventually

melt and vaporize if there is sufficient temperature and

time exposure. Some structural elements can survive if they

are massive or were shielded from the heat by other parts of

the structure.

After the atmospheric re-entry point has been predicted, various

other conditions must be taken into account to predict a ground

impact point. Some of these conditions are orbital corrections

due to frictional heating, break up due to atmospheric shock,

drag and prevailing meteorological conditions. All of these

factors are important when assessing the hazards from reentering objects to people and property.(12)

7.4 RE-ENTRY IMPACT PREDICTION

The ground trace of an orbit is the path over which the satellite

orbits the Earth (see Figure 7-4). If there were a string

between the center of the Earth and a satellite, the course

marked by the intersection of the string with the surface of the

Earth would be the trace of the orbit. Depending on the orbit,

this ground trace could cover a large portion of the surface of

the Earth (see Figure 7-5). If a satellite is tracked on a

regular basis, it is possible to anticipate its approximate reentry time and make an approximate prediction of the impact

point. However, this does not give control over the position of

the impact point and impact prediction uncertainties are usually

rather large (on the order of 10's to 100's of miles).

One of the most critical factors in the re-entry process is the

ballistic coefficient of the object, as discussed above. The

ballistic coefficient is the ratio of gross weight to the drag

coefficient multiplied by the reference area (W/CDA). The

relationship between the ballistic coefficient and the orbital

lifetime is also linear, as illustrated in Figure 7-1(a & b).

Small particles tend to have shorter lifetimes at a given orbital

altitude than larger ones. This has been observed in the case of

solid rocket motor debris where measurements made shortly after

motor firings have shown a rapid increase in debris levels, but

relatively rapid decay of small debris.

A second indirect confirming observation is the shape of the

debris flux curve as a function of debris size.(13)

(See Chapter 6).

7-10
7-11
As a satellite re-enters the atmosphere it decelerates. As

discussed above, the deceleration rate is a function of many

variables: entry angle, lift to drag ratio (L/D), the ballistic

coefficient, the orbital parameters, the Earth's rotation and

oblateness, atmospheric density aberrations and winds. The entry

angle and ballistic coefficient affect the chance that a

satellite or debris object will survive re-entry and landing.

The satellite may skip due to the lift caused by the object's

angle of attack upon entering the atmosphere, each skip

7-12
associated with a change in velocity, speed and entry angle. As

discussed in Chapter 4, every orbit has an angle of inclination,

which along with the apogee and perigee, defines the trace of an

orbit. 

During re-entry the original orbital inclination of the satellite

remains relatively constant. This holds for the inclination

angle of pieces of the satellite that return separately as well

as pieces of a satellite which break up during re-entry. This

near consistency holds because the magnitude of the orbital

velocity in the inclination plane is very large. A vertical

(radial) change in velocity does not change the orbital angle of

inclination, but it changes the atmospheric entry angle (called

radiant). A change in the velocity component perpendicular to

the plane of the orbit may affect the angle of inclination, but

the magnitude of this change is minor compared to the magnitude

of the velocity in the orbital plane.

7.5 IMPACT DISPERSIONS

Most satellites to date have been inserted into orbit with little

or no consideration given to their eventual re-entry. The

primary reason for this is that re-entering satellites are not

likely to result in hazardous impacts given that 2/3 of the

Earth's surface area is covered by oceans. Most of the objects

which re-enter are likely to fragment and burn up in the upper

atmosphere and make only negligible changes in its chemical

composition. Even if an object does survive, only one third of

the Earth is land area and only a small portion of this land area

is densely populated, so the chance of hitting a populated land

area upon re-entry is relatively small.

There is no standard way of computing impact dispersions

currently. The calculations are two-fold. Estimates must be

made for the number of pieces which will survive re-entry and the

area over which each piece could cause damage, the "casualty

area." For each piece of debris that will survive re- entry, a

man-border area is added to the representative area of each

incoming piece (see Volume 3, Chapter 10). The representative

area is the maximum cross section area of the re-entering piece

of debris. The man-border allowance is usually a ten inch

addition in the radius to allow for the center of a person

standing outside the actual impact radius but close enough to be

hurt.(16) The splatter and rebound of fragments from hard ground

impact must also be considered in these calculations.

7.6 RE-ENTRY HAZARD ANALYSIS

Most re-entering satellites and space debris are not controlled

and the uncertainties of orbital decay are such that impact areas

cannot be determined. Re-entry risk estimation generally assumes

7-13
that the satellite can impact anywhere on Earth between the

maximum northern and southern latitudes associated with the

inclination of the orbit (see Figure 7-4).(16) Uncontrolled reentry may be due to launch failures when the spacecraft fails to

achieve final orbit, when the perigee/apogee kick motors

malfunction and retain the satellite in a degradable transfer

orbit or from second and upper stages jettisoned in orbit after

burn out.

The probability of a re-entering spacecraft and/or its fragments

landing within a particular latitude band depends on both the

orbital inclination and the latitude spread of the ground track.

Satellites in orbit spend disproportionately more time within the

1

o wide band near the maximum latitudes. This is due to the

change in direction of the satellite in this area, illustrated in

the orbital ground trace of Figure 7-5, and is clearly visible in

the probability distributions shown in Figure 7-6. In this

figure the sharp peaks for each angle of inclination occur in a

very small range around the latitude extremes. The probability

of impacting within a specified longitude range is assumed to be

uniform (equi-probability over 360o of longitude). A

corresponding bivariate probability density can be constructed

for the location of such random debris impact. This assumes that

the satellite or debris from the satellite survive the

aerodynamic heating of re-entry. Once the probability density for

ground impact has been established, the distribution of

population within the probable impact area must be considered, as

shown in Figure 7-7.(15) In this figure the population

distribution is combined for the northern and southern

hemispheres as a matter of convenience. Although the population

number and distribution has changed in the interim, the approach

used in Fig. 7-7 is still valid.(15) An orbiting object will spend

an equal amount of time, within a certain band width, on both the

north and south sides of the equator.

The casualty expectation is usually computed using the formula:

Ec=Pi x (Population Density) x Ac

Where Pi is the impact probability, the population density is the

number of inhabitants per unit area, and Ac is the casualty area

of the debris that survive to impact. Figure 7-8 presents an

updated world-wide (average) casualty expectation, as a function

of orbital inclination angle and debris impact casualty area.(19)

In the example shown, a satellite in an orbit inclined at 26O,

with debris having a casualty area of 100 sq. ft., will produce

"on the average" 1.2 x 10-4 casualties upon re-entry.(15,19) This

translates to one chance in 8333 of a casualty resulting from reentry of this satellite. This is due to the unpredictability of

the impact area during uncontrolled re-entry as opposed to the

localized casualty area during launch.

7-14
7-15
7-16
7-17
With no control over the time and location of re-entry, impact

could occur in any country between the latitudes of ± 26O.

(16,18)

Up to now, there have been no reported land impacts, damage

and/or casualties by re-entry debris.(20) Roughly 100 of the

approximately 3,100 objects resulting from 44 launches between

1956-1972 have survived re-entry and were recovered.(20)

Identified re-entry debris include such diverse items as: tank

pieces, nozzle pieces, small spherical gas tanks, plastic shrouds

and other fragments.(20)

Particular re-entry hazards to the public are posed by orbiting

nuclear payloads. Since 1961, both the US and the Soviet Union

have launched nuclear power cells into space (See Table 7-1).

While there have been no commercial payloads with nuclear

materials, it is important to discuss generic re-entry hazards of

this type. To date , such missions have required detailed risk

analysis and interagency review. However, the US has launched

passive, naturally decaying nuclear fuel cells, while the USSR

has orbited RORSAT satellites with active nuclear reactors at

relatively low altitudes in orbits which decay in a matter of

days to weeks. Twenty eight such Soviet nuclear satellites were

launched between 1967 and 1985, each carrying roughly 50 kg of

U

235. Of these, 26 have been transferred successfully into higher

altitude parking orbits (over 900 km) at their end of duty to

permit decay of radionuclides before re-entry. However, at least

six have failed and undergone uncontrolled re-entry and

atmospheric break up, one showering debris over N. Canada in 1978

and two others over the Indian Ocean in 1983 and 1987. In

contrast, the US nuclear fuel cells are designed to survive

atmospheric re-entry and impacts. Three radio-isotope thermal

generator (RTG) power supplies accidentally re-entered as a

result of launch and/or orbital insertion failures (in 1964,1968

and 1970); no undue public exposure to radioactivity resulted

from any of these.(14)

Although the possibility of a satellite landing in a populated

area is small, the hazards are real and in certain instances,

potentially very serious. Cosmos 954, the Soviet nuclear

satellite that scattered nuclear debris over Canada upon re-entry

and caused over $12 million in damages and cleanup costs is one

example of a potentially serious re-entry hazard.(21) Fortunately,

several other failed or deactivated Soviet RORSAT and US nuclear

satellites have returned over oceans (Table 7-1). Issues related

to re-entry hazards are currently under active re-examination and

are undergoing research. 

7-18
7-19
REFERENCES TO CHAPTER 7

1. a)Dictionary of Technical Terms for Aerospace Use, 1965

b)Hazard, Hap, "US Space Launch Systems," Navy Space Systems

(Report NSSA-R-20-72-2), 2nd Rev., 1977.

2. "Space Flight and Re-entry Trajectories," Proc.

International Symposium of International Academies of

Astronautics and IAF, Louveciennes, June 1961 (Springer -

Verlag, 1962).

3. Loh, W. H. T., Dynamics and Thermodynamics of Planetary

Entry, Prentice Hall, Inc., Englewood Cliffs, NJ, 1963.

4. a)Oberg, James E., "Eyes on the Sky," Air & Space, ,

April/May 1987.

b)Howell, J. A., "The Challenge of Space Surveillance," Sky

and Telescope, pp.584-588, June 1987.

5. Johnson, N. L. and D.S. McKnight, "Artificial Space Debris,"

(Orbit Book Co., Malabar, FL, 1987).

6. Alford, R.L., and J.J. Lin, "The Orbital Decay and Lifetime

(LIFTIM) Prediction Program," Northrop Services, Inc. for

NASA/Marshall, May 1974.

7. Kling, R., "Evolution of an On-Orbit Debris Cloud," Adv. in

Space Research, Vol.6, No.7, pp.99-108, 1986.

8. Appendix on "History and Projections of Foreign Satellite

Mass to Orbit," to Special Report of the USAF Scientific

Advisory Board, Ad Hoc Committee on Current and Potential

Technology to Protect AF Space Missions from Current and

Future Debris, 1987.

9. Kessler, D. J., "Orbital Debris Issues," NASA/Johnson Space

Center, Houston, TX 77058, Adv. in Space Research Vol.5, No.

2, pp.3-10, 1985.

10. Schnel, L., "Probability of Collisions of Artificial Bodies

in the Earth Environment," Adv in Space Research, Vol.5,

No.2, pp.21-24, 1985.

11. Johnson, N. L.,"Space Background Environment Assessment,"

Teledyne Brown Report CS86-USASDC-0022 for NASA/Johnson

Space Center and US Army Strategic Defense Command, Sept.

1986.

7-20
12. a)Loh, W. H. T., Re-entry and Planetary Entry Physics and

Technology / 1, Springer-Verlag New York Inc., NY, 1968.

b)De Lafontaine, J., "Orbital Decay in a Dynamic

Atmosphere,"UTIAS- 244, Toronto University, Canada, 1979.

c)Longuski, J.M., "Analytic Theory of Orbit Contraction and

Ballistic Entry into Planetary Atmospheres," for NASA

Langley Research Center, N 80-33448, by Jet Propulsion Lab,

(JPL 80-58), Sept. 1980.

13. Fischer, N. H. and Reynolds R. C., "Threat of Space Debris,"

Battelle Columbus Laboratories, 1984.

14. Johnson, N.L., "Nuclear Power Supplies in Orbit," Space

Policy, Aug 1986, pp.223-233.

15. Burruss, J.M., and O.A. Refling, "Implementation of a Safety

Policy Related to Random Re-entry Hazards," Aerospace

Corporation (Report No. TOR-0158(3301)-1), Nov. 1967.

16. a)Klapman, G., and J. Burruss, "Hazards Associated with

Random Re-entry of Satellites Decaying from Orbit,"

Aerospace Corporation (Report No. TOR-1001(2301)-1), 

March 1967.

b)Klapman, G., "Random Re-entry Hazard Calculations for

Titan IIIC (STC) Flight Plans VIID and VIIE," Aerospace

Corporation, Report No. TOR- 0059(6112-50)-5, June 1971.

c)Burrus, J.M., "Generalized Random Re-entry Hazard

Equations," Aerospace Corporation, Report No. TOR-0066(5301-

02)-1, Oct. 1971.

17. "NASA Satellite Situation Report," the July 1 to Sept. 30,

1987 Reporting Period, September 30, 1987.

18. "Titan CELV/IUS Range Safety Flight Plan Approval Request,"

Martin Marietta, CTI-88-1035, June 1986.

19. "Report of the Delta 181 Orbital Safety Review Committee,"

Dec. 1987.

20. "Convention on International Liability for Damage Caused by

Space Objects - Analysis and Background Data," May, 1972,

Staff Report 75-871, Senate Comm. Aeronautical and Space

Sciences, US Congress.

7-21
10/2/95 rev

 8. RISK ANALYSIS METHODOLOGY

8.1 WHAT IS RISK ANALYSIS?

Risk Analysis is the technical process and procedures for

identifying, characterizing, quantifying and evaluating hazards.

It is widely used in industry and by federal agencies to support

regulatory and resource allocation decisions. The analysis of

risk, also called Risk Assessment (see definitions of terms in

Ch.1 and in the Glossary, App. A), consists of two distinct

phases: a qualitative step of hazard identification,

characterization and ranking; and a quantitative risk evaluation

entailing estimation of the occurrence probabilities and the

consequences of hazardous events, including catastrophic ones.

Following the quantification of risk, appropriate Risk Management

options can be devised and considered, risk/benefit or cost

analysis may be undertaken and Risk Management policies may be

formulated and implemented. The main goals of Risk Management

are to prevent the occurrence of accidents by reducing the

probability of their occurrence (e.g., practice risk avoidance),

to reduce the impacts of uncontrollable accidents (e.g., prepare

and adopt emergency responses) and to transfer risk (e.g., via

insurance coverage). Most personnel safety and

operational/handling precautions and requirements at hazardous

facilities (and hardware design reviews and approval for plants

and critical equipment) are intended to prevent, reduce the

frequency or probability of occurrence of hazardous events and to

minimize their potential impacts.

Both normal operations and unforeseen conditions can lead to

accidents which cannot be prevented or controlled. In such

cases, the residual risk must be accepted and managed by

preparing emergency response procedures (e.g., evacuation and

medical response plans) to lessen the consequences of such

accidents. Deterministic and worst case scenario analyses are

often used to assess the scope and exposure impacts of improbable

hazardous events with high consequences.

Several recent reports have discussed the role of technical risk

assessment inputs to regulatory analysis and policy decision

making.(1-3) Since Risk Assessment is a field where safety and

loss prevention are the chief concerns, conservatism at various

steps in the analysis has often been adopted as a prudent

approach. Thus, conservative assumptions have been compounded

sometimes in setting unnecessarily stringent regulatory standards

and requirements. In practice, excessive conservatism and use of

"worst case" analysis has served as a basis for over-design of

critical facilities, and over-regulation of industry by setting

unnecessarily strict license and permit requirements.(4,5) Several

mission Agencies (such as DOD, NASA, DOE, EPA, USBM, OSHA, NIH,

8-1
NRC) have developed their own risk analysis tools to carry out

studies either in support of regulatory standards, criteria and

policies or to enable safe operations. For the past few years,

an Interagency Task Force for Risk Assessment, led by the NSF,

has been working on uniform standards, to the extent possible and

practical, for risk analysis methods and their use by federal

Agencies charged with protecting the safety and health of the

workers and the public. Some of these tools and approaches,

whether developed specifically for space applications (Ch.9) or

for licensing decisions (e.g., NRC regulations and studies),(8,15,16)

are transferable to DOT/OCST for regulation and oversight of

commercial launch activities.

Risk Assessment provides the information necessary for Risk

Management decisions. Risk Management, in a regulatory context,

requires the evaluation of the impact and effectiveness of safety

standards and regulations to impose additional controls or relax

existing ones.

8.2 RISK PERCEPTION AND RISK ACCEPTABILITY

Subjective judgment and documented societal bias against low

probability/high consequence events may influence the outcome of

a risk analysis. Perceptions of risk often differ from objective

measures and may distort or politicize Risk Management decisions

and their implementation. Public polls indicate that societal

perception of risk for certain unfamiliar or incorrectly

publicized activities is far out of proportion to the actual

damage or risk measure (by factors of 10-100 greater than reality

for motor, rail and aviation accidents, but by factors of >10,

000 for nuclear power and food coloring).(14) Risk conversion and

compensating factors must often be applied to determine risk

tolerance thresholds accurately to account for public bias

against unfamiliar (x 10), catastrophic (x 30), involuntary 

(x 100), immediate vs. delayed consequence (x 30) and the

uncontrollable (x 5-10) risk exposure.(17)

Different risk standards often apply in the workplace, in view of

voluntary risk exposure and indemnification for risk to exposed

workers; as opposed to public risk exposure where stricter

standards apply to involuntary exposure. The general guide to

work place risk standards is that occupational risk should be

small compared to natural sources of risk. Some industrial and

voluntary risks may be further decreased by strict enforcement or

adequate implementation of known risk management and risk

avoidance measures (e.g., wear seat belts, stop drinking alcohol

or smoking). Therefore, some of these risks are controllable by

the individual (e.g., do not fly, take the car to work or smoke),

while others are not (e.g., severe floods, earthquakes and

tsunamis).

8-2
Relative Risk Assessment is a common method of ranking risk

exposure levels which enables decision makers to define

acceptable risk thresholds and the range for unacceptably high

exposure that would require Risk Management resources for

reduction and prevention. As Figure 8-1 and Table 8-1

illustrate, there are de facto levels of socially tolerated

(acceptable) levels of risk for either voluntary or involuntary

exposure to a variety of hazardous factors and activities.

Although regulators often strive to assess absolute levels of

risk, the relative ranking of risks is an appropriate Risk

Management strategy for resource allocation towards regulatory

controls. Cost benefit analysis is often required to bring the

burdens of risk control strategies to socially acceptable levels.

Figure 8-1 and Tables 8-1 and 8-2 show estimated risk levels

associated with natural and other (occupational, transportation,

etc.) hazards that may lead to undesirable health effects and

casualties. They show that risk levels vary greatly by causes of

harm (chemical, mechanical, natural or man made), probability,

degree of control, duration of exposure to the consequence

(immediate, delayed, short or long-term), distribution

(geographical, localized) in time and space, benefit to society

vs. costs of risk reduction and consequence mitigation.

Table 8-1 shows the relative risk exposure to individuals as a

casualty probability from various natural and regulated causes.(19)

This table and its precursors in the literature(6,17) illustrate

that the public voluntarily assumes risk levels which are 100 to

1,000 times larger than involuntary exposures to natural hazards

and normal activities. These levels may be used as indicators of

socially acceptable risk thresholds to compare when new

regulatory standards are set. Note that risk exposure is

normalized both to the population exposed and to the duration of

the exposure. To compare the risk associated with each cause,

consistent units must be used, such as fatalities or dollar loss

per year, per 100,000 population, per event, per man year of

exposure, etc.

Issues related to acceptable risk thresholds for regulatory

purposes and for the public at large are often complex and

controversial.(1- 5,17,19) The typical approach to establish risk

acceptance criteria for involuntary risks to the public has been

that fatality rates from the activity of interest should never

exceed average death rates from natural causes (about 0.07 per

100,000 population, from all natural causes) and should be

further lessened by risk control measures to the extent feasible

and practical.(13)

The societal benefit and the cost trade-offs for risk reduction

are widely used guides to set and justify risk acceptability

limits. By comparing the risks and benefits associated with

certain regulated activities, fair, balanced and consistent 

8-3
8-4
8-5
limits for risk acceptability may be set and institutional

controls on risk may be established. Figure 8-1 is based on

Ref.9: Starr's 1969 risk benefit analysis, which, although later

challenged in the literature, illustrates several general trends

derived from an analysis of fatalities per person hour of

exposure to natural hazards and to hazardous human activities, in

terms of dollar-equivalent benefit to society. It appears that

voluntarily assumed risk levels are a factor of about 1,000

higher than involuntary risk exposure levels over the entire

range of benefits. Also, the acceptable risk curve appears to

vary as the cube power of the benefit, on this log-normal scale.

A typical regulatory risk threshold used to institute controls is

the one-in-a-million casualty probability.(17) Situations at this

threshold include: traveling 60 miles by car or 400 miles by air,

two weeks of skiing, 1.5 weeks of factory work, 3 hours of work

in a coal mine, smoking one cigarette, 1.5 minutes of rock

climbing and 20 minutes of being a man aged 60.

By analogy with other industries, in the case of space

operations, Range personnel and commercial launch service firms

may be considered voluntary risk takers, while the public at

large is involuntarily exposed to launch and overflight risks.

While Range Safety and on-site Range personnel are highly trained

in risk avoidance and management, the public must be exposed to

only minimal risk from commercial launch activities.

There are clear but indirect public, economic and other societal

benefits derived from commercial space operations, including

efficient telephone and video communications, weather

forecasting, remote environmental sensing and crop data, better

drugs, advanced material fabrication, superior navigation

capability and other technology spin-offs. Based on the risk

comparability approach illustrated in Ch. 5 (Vol. 2) and the

Range Safety controls and practices (Chs. 2, Vol. 1 and 9, 10),

commercial launch activities appear to be well within the

socially acceptable risk limits at this time.

8.3 EXPECTED RISK VALUES AND RISK PROFILES

There are two fundamental components of Risk Analysis:

• Determination of the probability, Pi (or frequency of

occurrence, fi), of an undesirable event, Ei. The

probability of an event is its likelihood of occurrence

or recurrence. Sometimes the probability estimates are

generated from a detailed analysis of past experience

and historical data available; sometimes they are

judgmental estimates on the basis of an expert's view

8-6
of the situation or simply a best guess. This

quantification of event probabilities can be useful,

but the confidence in such estimates depends on the

quality of the data base on actual failures and the

methods used to determine event probabilities.

Probabilities have long been used in the analysis of

system reliability for complex equipment and facilities

and to anticipate and control various failure

scenarios.

• Evaluation of the consequence, Ci, of this hazardous

event: The choice of the type of consequence of

interest may affect the acceptability threshold and the

tolerance level for risk.

The analytical phase of a Risk Analysis generally consists of

three steps:(10) The triad: event (scenario), probability and

consequence is sometimes called the "Risk Triplet."

1. The qualitative step involves the selection of specific

hazardous reference events Ei (hazard identification)

or scenarios (chains of events) for quantitative

analysis.

2. The quantitative analysis requires the estimation of

the probability of these events, Pi.

3. The next quantification step is to estimate of the

consequences of these events, Ci.

The results of the analytical phase are used in the interpretive

phase in which the various contributors to risk are compared,

ranked and placed in perspective. This interpretive phase

consists of:

4. The calculation and graphic display of a Risk Profile

based on individual failure event risks. The process

is presented in Figure 8-2.

5. The calculation of a total expected risk value (R) by

summing individual event contributions to risk (Ri).

Naturally, all the calculations undertaken involve some

uncertainties, approximations and assumptions. Therefore,

uncertainties must be considered explicitly. Using expected

losses and the risk profile to evaluate the amount of investment

that is reasonable to control risks, alternative Risk Management

decisions involving avoidance (i.e. probability decrease) or

consequence mitigation can be evaluated in terms that are useful

to the decision maker.

8-7
8-8
Therefore, a sixth planning step usually included in Risk

Analysis is:

6. The identification of cost effective Risk Management

options, to be followed by:

7. Adoption of a Risk Management policy and

implementation.

The analytical phase yields results in the general form suggested

in Table 8-3. There are two useful ways to then interpret such

results: expected risk values, Ri, and risk profiles. Both

methods are employed for quantitative risk analysis.

8-9
Expected values are most useful when the consequences Ci are

measured in financial terms or other directly measurable units.

The expected risk value Ri (or expected loss) associated with

event Ei is the product of its probability Pi and consequence

values:

R i= PixCi

Thus, if the event occurs with probability 0.01 in a given year,

and if the associated loss is one million dollars, then the

expected loss is:

Ri= 0.01 x $1,000,000 = $10,000

Since this is the expected annual loss, the total expected loss

over 20 years (assuming constant $) would be roughly $200,000.

This assumes that the parameters do not vary significantly with

time and ignores the low probability of multiple losses over the

period. To obtain the total expected loss per year for a whole

set of possible events, simply sum the individual expected

losses:

Total Risk, RT = PiCi+P2C2+ . . +PNCN =

This expected risk value assumes that all events (Ei)

contributing to risk exposure have equal weight. Occasionally,

for risk decisions, value factors (weighting factors) are

assigned to each event contributing to risk. The relative values

of the terms associated with the different hazardous events give

a useful measure of their relative importance and the total risk

value can be interpreted as the average or "expected" level of

loss to be experienced over a period of time. One particular way

in which it is used is to compare it to the cost of eliminating

or reducing risk (i.e., as part of the Risk Management strategy)

in the context of cost/benefit analysis. Expected values of risk

(R) are of prime importance in both business and in regulatory

decision making under complex and uncertain situations.

Based on the definition of expected values, if event E2 has ten

times the consequences of event E1 but only one tenth the

likelihood, then the products R1 = P1C1 and R2 = P2C2 are equal.

That is, the events have the same expected level of risk. Thus,

expected risk levels provide a balance of probabilities and

consequences. In mathematical terms, the expected values may be 

8-10
similar, but the low probability, high consequence event may be

of greater concern.(11,12) For example, a company may be prepared

to sustain a steady level of relatively small losses or

accidents, but is concerned with guarding against truly

catastrophic events. This is the motivation behind Risk

Management, although, in all cases a range of consequences may be

of interest. Determining the point estimates for best and worst

case Ri will produce limiting values for the risk estimates and

yield a band of uncertainty in risk level.

A common way to interpret the values of probabilities and

consequences of different hazardous events is by means of a Risk

Profile. This displays the probability distribution for

accidents and the range of their severity as a function of

likelihood. If sufficient accident data exist, the cumulative

probability distribution function is used as a Risk Profile to

show the probability of damages at a given level or greater.

Figure 8-3 shows an example of a hypothetical Risk Profile for

commercial launch operations. A point (Pi, Ci) on the curve can

be interpreted to mean there is a probability, Pi, of an accident

with a consequence at least as large as Ci. Given a set of

ordered pairs (Pi, Ci) obtained during the analytic phase of a

risk study, the actual Risk Profile is computed using the laws of

probabilities and combinatorial analysis. For actual cases, the

risk profile is usually constructed by drawing the lowest

decreasing curve so that all the points with C ≤ Ci are on or

below it. The separate hazardous events with consequences Ci ≤ C

are combined into a single event with a probability equal to the

sum of their individual probability values (i.e., their

cumulative probability). Then, the ordinate value Pi in Figures

8-2 and 8-3 indicates the probability of an event, Ei, with a

consequence as large as or exceeding Ci (C ≥ Ci). The

acceptability ranges for risk must be determined and regulatory

risk targets must be set consistent with these acceptable risk

thresholds. These goals are often set according to ALAP (as low

as practical), BAT (best available technology), BPT (best

practical technology) or the cost of risk reduction.(17) The

relative risk reduction achieved by various controls is also

displayed on the Risk Profile to indicate the merit and

effectiveness of potential regulatory risk reduction measures.

8-11
The frequency or the probability of the undesirable event (launch accidents) is

plotted against the consequence magnitude of interest (potential public safety

impacts such as dollar loss for property damage, casualty, insurance claims). The

shape of the curve could be convex, rather than concave, or even discontinuous,

depending on the scale and the data points available. Shaded area denotes defacto acceptable risk levels or design/operation safety goals based on

established ELV launch practices at Government Ranges.

8.4 IDENTIFICATION OF HAZARDS, PROBABILITY ESTIMATION AND

CONSEQUENCE MODELING

Fault tree (or event tree) analysis has been successfully applied

in many technical fields to identify and logically order

scenarios leading to equipment breakdown, financial loss or other

system failures to be controlled (see section 8.7). Fault trees

8-12
have been applied occasionally to problems associated with space

launches, mission planning and approval (Chapters 9 and 10).

This results in an extensive set of analyses of the potential

launch failure events and consequences.

Consequences of observed or anticipated accidents are often

modeled by extrapolation from small scale tests, limited

observations, simulations and scoping calculations. The goal of

quantitative risk assessment is not only to identify and rank

hazards, but to analyze the low probability events of high

consequence. This can focus corrective action, improve

management of risk factors and optimize resource allocation.

These extreme events are feared most by both public and

regulators. They are often used as "worst case scenarios" or

extreme "catastrophic" failures that serve as the basis for

conservative design and regulatory requirements.(11,12) 

However, catastrophic failures are seldom observed. Therefore,

their probability of occurrence and consequences are uncertain

and difficult to quantify. The Three Mile Island nuclear reactor

accident was this type of rare event. It occurred after 500

reactor years without a significant accident, yet was

qualitatively anticipated and approximated. A severe earthquake

along the San Andreas Fault, with catastrophic impacts on the San

Francisco Bay area, is another example of an anticipated hazard

of low probability and high consequence that is difficult to

predict and control. Future levels of risk are usually predicted

by statistical analyses of relevant experience, although, a

complete time series and representative sampling of hazardous

events seldom exists. Predictions are often based on inference,

event reconstruction, interpretation and extrapolation, rather

than on observed events.(11) Because industry and regulators learn

to improve safety and reduce risk based on prior experience,

Bayesian statistics are sometimes used to reflect the decrease in

the probability/frequency of hazardous events when "learning"

improves the odds.(11,13) Alternative computational methods to

infer a risk profile envelope have been developed (e.g., trend

analysis) that include low probability, high consequence events,

when the high consequence results from a number of intermediate

events and the structure of such a composite event can be

analyzed and quantified.(12) However, such predicted or composite

risk profiles are often controversial, as is discussed in Chapter

9, which reviews the application of Risk Assessment methods to

space launch and orbiter systems and missions.

8.5 UNCERTAINTIES AND RELIABILITY

Risk Analysis is not an exact science. Despite this, it is

widely used to support regulatory and industrial decision making

and to allot resources. Risk analyses performed by different

analysts on the same issue may lead to different results. The

8-13
reason is that there are substantial uncertainties intrinsic to

risk assessments deriving from incomplete knowledge and

identification of potential failures, from incorrect modeling

assumptions used in the quantification of hazardous events or,

more likely, from the variability in the possible type, time,

place and circumstances of an accident. Different (and possibly

incomplete) data bases and assumed failure rates of components

may be used and thus lead to discrepancies in results. Different

statistical analyses of the same data base may be justified by

stated assumptions and lead to further discrepancies in results.

Furthermore, the choice of a certain risk analysis methodology

may influence, and even determine, the conclusions of the

analyses. Judgments by experts evaluating and ranking the

hazards, i.e. the Delphi approach, are often subjective. Hence,

the risk analysis process has inherent limitations and

uncertainties which must be taken into consideration in decision

making.

Tests to establish reliability of complex components or systems

are usually expensive, making a minimum of tests desirable. On

the other hand, true probabilities are based ideally on results

from very large samples. When only a few items are tested, the

results may not be truly representative. Tossing a normal coin

two or three times may result in heads each time. This may lead

to the erroneous assumption that the result will always be heads.

The next three tosses may all be heads again, all tails or

combinations of heads or tails. With more and more tests the

average probability of a head (or tail) will be found to approach

0.5. The problem then arises as to how much confidence can be

placed on past results to predict future performance. The term

confidence level is used for this purpose. Tables have been

prepared to indicate the relationships between test results,

reliability and confidence. One such table is shown below in

abbreviated form (Table 8-4).

Since there are residual uncertainties associated with the

quantification of risk, confidence limits must be placed both on

failure probabilities (usually 60%-90% brackets) to reflect this

uncertainty. A 60 percent confidence interval means that there

is a 60 percent chance that the actual failure rate falls within

the range of given estimates. A 90 percent confidence limit

means that there is a 90 percent chance that real events will

fall within an estimated range. Confidence limits are based on

observations: if no failures occurred in 1,000 trials, there are

still three failures possible in the next 1,000. If 10,000 tests

were successfully completed, that would statistically correspond

to a probability of three failures in 10,000 events with 95

percent confidence (i.e., a reliability of .9997). In addition,

there may be large uncertainties in the consequence estimate, so

that for any "best guess" point estimate, "worst case" and "best

case" limits are needed.

8-14
Most assemblies and systems actually do not have constant failure

rates, especially when the system does not have many components

that are similar or have similar characteristics, such as large

mechanical units. Instead of being exponential, the distribution

of failures may be Gaussian, Weibull, gamma or log normal. The

chief difference is in establishment of failure rates. Means of

improving reliability as indicated above remain the same. Table

8-4 is based on the simplest assumption of a binomial

distribution, where the outcome of any trial can be either

failure (F) or success (S), randomly occurring with the

probability of .5 (like tossing coins for Head/Tail outcomes).

8.6 RELIABILITY VERSUS SAFETY

Reliability Analysis often provides useful inputs to quantitative

safety analysis since failure rates (observed or design goals)

for safety critical components and subsystems permit the

evaluation and control of adverse safety impacts. Often, to 

8-15
ensure safe operation, safeguards are incorporated into system 

engineering design, such as: redundant features; manual overrides

for automatic components (valves, switches) which are safety

critical and special quality assurance, acceptability and

maintainability specifications. Space launch vehicles and

payloads have been traditionally provided with redundancy in the

in-flight destruct or other termination system and the flight

control and communications subsystems (see Chapter 2, Vol.1).

This ensures that a guidance failure or a failure in boost,

sustainer or upper rocket stages will not lead to undesirable

off-range risk exposure and that risk to the public will be

avoided and controlled by the Range Safety Officer's ability to

safely destroy the spacecraft on command.

Reliability data on components and subsystems are essential to

predicting performance. Table 8-5 shows as an example the

estimated probability that a certain number of failures will

occur in the next 20 tries for a hypothetical launch vehicle,

based on assumed operational performance reliability figures in

the range of historical values and on a skewed binomial

distribution. (See also Ch.3, Vol. 1 for published reliability

figures on commercial space vehicles.)

8-16
However, it must be noted that although reliability figures feed

safety analyses directly, a highly reliable system is not

necessarily safer. A key issue is the trade off between

reliability and safety: adding sensors and control systems to

detect malfunctions in a critical subsystem may enhance safety,

but decrease the overall reliability. A stick of dynamite is an

example of a highly reliable, but clearly unsafe object: when

triggered intentionally or unintentionally, it will explode

reliably. It is unsafe because of its high energy content, its

explosive potential and its low trigger threshold. Safeguards

may enhance handling safety, but decrease functional reliability.

In favor of the reliability of simplicity, some engineers would

trade the sophisticated injection pumps in modern rockets for

simple gravity fed ("big dumb") rockets.

Both human error and infrequent operational or accidental

failures, can lead to catastrophic accidents with a low

probability of occurrence and potentially high risk exposure.

Indeed, in the case of space launch systems and operations, it is

the low probability and high consequence event that would

dominate the public risk exposure. The likelihood of occurrence

and the public safety impacts of any accidental failure in such

highly reliable subsystems and systems must be quantitatively

assessed in order to appropriately define acceptable and expected

levels of risk, and to regulate commercial space activities via

the licensing process (see Chapters 9 and 10).

Table 8-6 shows the kind of basic component failure rates which

are used in probabilistic system failure computations. These

apply to all mechanical and electrical systems across industries.

Similarly, human error must often be factored into estimating

probabilities of systems breakdown, since operator error or

judgment errors in responding to minor failures can have major

consequences. Table 8-7 shows that high stress work conditions

lead to more frequent human error than routine functions and

operations. Human failure rates are typically higher than

equipment failure rates and may compound them because of improper

or incomplete operator training in recognizing critical

situations or because of panic/stress response to an accident.

Considerable attention has been paid to human/ machine interfaces

and to crisis training of personnel. The same considerations

should apply in analyzing a launch "go/no go" decision, or a

command destruct decision for a space system, as for a reactor

operator or a flight controller in a busy airport tower.

8-17
8-18
8.7 RISK ASSESSMENT METHODS

The adoption of an appropriate analytical technique is important

to any meaningful qualitative or quantitative failure and/or risk

analysis. Each risk quantification method discussed and

illustrated below has its own special merits, strengths,

weaknesses and an optimal domain of application (see Table 8-8).

Only if sufficient empirical and statistical data are available

is the probabilistic modeling of hazardous events justified. For

the very infrequent catastrophic event, a deterministic analysis

of consequences (i.e., scoping calculations to estimate the type

and magnitude of impacts assuming that the accident has

occurred) may be sufficient in order to consider possible risk

management (prevention and emergency response) and to estimate

the associated sensitivity to assumptions. Deterministic

consequence modeling of an unlikely catastrophic event is

acceptable and even necessary whenever accident statistical and

heuristic data available do not suffice to justify quantitative

estimates for its occurrence and observation based scoping

estimates for the magnitude of its consequences.

8-19
There are several inductive methods of risk analysis which assume

a particular failure mode or failure initiating event. The

effects on the system performance are then analyzed in order to

infer the propagation of failures (failure chains) and to assess

the sensitivity of the system operation to the postulated initial

failures (bottom to top). The methods listed below focus

primarily on hazard identification and on the probabilities of

occurrence of hazardous events:

Inductive risk analyses methods used in industry to determine

what failed states are possible include:

• The Preliminary Hazards Analysis (PHA) - This is the most

general and qualitative identification and listing of

potentially hazardous conditions, which is used to guide

design, or the definition of procedural safeguards for

controlling these. Often, PHA suffices to identify causal

failure chains, possible safeguards and risk prevention

options. 

The list of hazardous events to be prevented or controlled

can be developed into subevents. PHA is usually carried out

at an early stage of design and operations planning in order

to allow both design and operational controls to be

implemented in a cost-effective manner. Table 8-9 is an

example of a Preliminary Hazard Analysis list of

failures/malfunctions, used to identify safety critical

failures and hazardous conditions and consequences, used to

suggest risk control (prevention, reduction and avoidance)

strategies. The PHA technique has been used primarily in

the chemical and petroleum industries and in the design of

critical facilities.

The PHA, although chiefly an inductive method, can also be used

in deductive analysis since it is primarily a systematic and

hierarchical listing of failures, accidental events and

circumstances leading to potentially catastrophic or major

undesirable consequences. Such listing of failure events and

their enabling conditions simulates closely and is complementary

to a FTA (see below) since it permits the definition of hazardous

chains of events and affords insight in the initiating (i.e.,

causal) factors enabling failure. The unlikely adverse end event

can also be analyzed in terms of more probable subevents, down to

the common minor failures in the domain of daily occurrences.

8-20
8-21
• The Failure Mode and Effect Analysis (FMEA) - This is a more

detailed analytical procedure, which is used to identify

critical and non-critical failure modes. Single point

(component) failures which can lead to system break down are

thus identified and fixes, such as redundancies or

operational bypass, are designed into the systems to prevent

them. FMEA can be quantified if failure probabilities for

components can be used to derive the percentage of failures

by mode. Critical and non-critical effects are used for

managing risk and preparing emergency response plans.

• Failure Mode Effect and Criticality Analysis (FMECA) - This

type of analysis is a more detailed variant of FMEA. It is

used for system safety analysis, to enable detailed

assessment and ranking of critical malfunctions and

equipment failures and to devise assurances and controls to

limit the impacts of such failures (i.e. risk management

strategies). FMECA is usually a tabular listing of:

identified faults, their potential effects, existing or

required compensation and control procedures, and a summary

of findings.

• Fault Hazard Analysis (FHA) - This method is particularly

useful for inter-organizational projects that require

integration, tracking and accountability. It is typically

used for space systems when numerous contractors design,

test and certify various subsystems which must be integrated

into a payload or a final launch system. FHA forms display

in column format: the component identification by

subsystem; a failure probability; all possible failure

modes; the percent failures by mode; the effect of failures,

up to subsystem interfaces; the identification of upstream

components that initiate, command or control the failure and

any secondary failure factors or environmental conditions to

which the component is sensitive.

• Event Tree Analysis (ETA) - This approach is equivalent to

the qualitative part of Fault Tree Analysis (FTA, see below)

and is used to display the likely propagation of failures in

a system. Figure 8-4 is an example of an Event Tree which

is used to isolate a failure propagation sequence and

identify enabling conditions which can be controlled. Event

trees are used in FMEA, FMECA and FTA and require

identification of all failure initiating events. Figure 8-5

is an example of an event tree for commercial space

operational failures.

8-22
8-23
8-24
• Double Failure Matrix (DFM) - This method is used to

list single vs. double subsystem failures, only after

failure categorization by effects on the system have

been completed. Namely, Fault Categories I-IV

correspond to the severity of impacts on the system:

I. negligible, II. marginal, III. critical and IV.

catastrophic. Then, for each subsystem the component

failures and the corresponding fault categories are

listed in matrix form to determine how many ways a

certain hazard category can occur (single and multiple

failure modes). 

• Hazard and Operability Analysis (Haz-Op), or

Operability Hazard Analysis (OHA) - This is another

method of safety analysis widely applied in designing

complex chemical facilities.(10) This procedure

involves the examination of design, piping and

instrument diagrams (P&ID) and operation flow charts in

order to ask a "what if" question at each node. What

would happen if a deviation from normal operations and

design conditions occurs at this point (Figure 8-6)?

8-25
This method is equivalent to the FMEA analysis in the sense

that it permits identification of critical failure

initiators, single point failures, malfunction chains and

their effects on other parts of the system propagation of

failure. Design flaws that require safeguards to insure

operability (double valves, bypass redundance logic, manual

overrides, etc.) can thus be uncovered. This method is used

both in pre-design and post-design analyses to achieve

design verification, set acceptance criteria, meet

objectives in system operation, provide procedural

modifications to ensure safe operation and emplace

monitoring of safety critical items. A Haz-Op variant is

LAD (Loss Analysis Diagram), used to compare design options

and determine the risk acceptability levels or safety

margins in design. Similarly, contingency analysis is used

as a complementary risk analysis method to Haz-Op, in order

to manage risks, when loss of control or a critical accident

occurs.

In contrast to the above approaches, deductive risk analysis

methods require reasoning from the general to the specific: A

system failure is postulated and the subsystem failure modes

leading to it are analyzed and broken down to the terminal or

initiating failure event level ("top to bottom" or "top down"

approach). Most accident investigations are of this type and are

used to determine how a system failure can occur.(8) This

includes:

• The Fault Tree Analysis (FTA) Methodology for Hazard

Assessment - The FTA technique is a logical method for

display and analysis of the hierarchical linkage and

propagation of failure events leading to the adverse end

result, placed at the top of the "tree." Branches in this

logic tree represent alternative failure paths leading to

the stipulated end event and display interdependencies of

failures. A staged fault tree (Figure 8-7) allows the

definition of intermediate levels of the events and

conditions that are necessary or enable failures to

propagate to the top of the tree. The intermediate failure

events may, in turn, result from the aggregation of lower

level failures from system-level down to subsystems and

component failures. The bottom levels display the failure

initiating or tree terminal events. Critical factors and

interrupt modes for failure chains can be identified and

quantitatively examined. The nodes of the fault tree

represent logic AND or OR gates.

8-26
8-27
The AND gate represents the simultaneous occurrence of conditions

or events necessary to result in failure propagation up the tree.

An OR gate indicates that each individual failure event entering

is capable of leading to higher level failures. Careful

consideration must be given to the independence or mutual

interdependence of events entering a particular logic gate to

insure the correct use of joint and conditional probability

concepts. 

In the case of ELV launch or orbital failures, a fault tree may

be used to highlight single point (critical) failures and "common

cause" (not independent) failures which must be "designed out" by

redundancy or greater safety margins. Clever analysts use

"exclusive OR gates," by defining mutually exclusive sets of

failure events or aggregating lower level failure events into

complementary groups to facilitate estimation of probability at

each node of this event fault tree. FTA can be used both for

qualitative, and for quantitative analysis of hazards. However,

qualitative results must be combined with accurate failure rate

data in order to achieve meaningful quantitative results.

Assuming independence of failures, there are five "minimal cut

sets," i.e., intersection of events, whose probabilities are

added at OR gates (provided that individual failure probabilities

are very small so that probability products are negligible

compared to their sum), and multiplied at the AND gate.

E1 = T + E2 =

= T + (K2 + E3) =

= T + K2 + (S·E4) =

= T + K2 + S·(S1 + ES) =

= T + K2 + (S·S1) + S·(K1 + R) =

= T + K2 + (S·S1) + S·(K1 + S)·R

The minimal cut sets are T, K2, S·S1, S·K1 and S·R (two singles

and three doubles). The largest contribution to the

probabilities will come from the single point failures T and

K2 (critical failures), since the small probabilities of

occurrence for the individual failure events, S, S1, K1 and R,

the product of their probabilities will make a very small, and

possibly negligible, contribution to the final event

probability. Probabilities of simultaneous failures at AND

gates necessary for a higher level failure to occur, may be

multiplied in some approximations only if conditional

probabilities for interdependent failures are subtracted and

the correct dimensionality is preserved. Usually,

probabilities of independent events at OR gates are added, if

P<1. Correct dimensionality must be observed for all types of

logic gates.(8)

8-28
Each branch of a failure event tree must be quantified in a

consistent manner using either frequency units (1/time

dimensions, rate per year, per hour or per event) or normalized

dimensionless probabilities. By using observed or

projected/expected values for the frequency or probability of

various failure modes and by analyzing how they occur, the

likelihood of each hazardous event can be quantified. Risk is

the product of this probability (or frequency) by the

consequence magnitude of the undesirable event. The correct

probabilistic dependencies (conditional, joint, mutually

exclusive) for the occurrence of failure events of the lower

branches permit their quantitative aggregation at gates and up

the tree. References 1, 3, 7, 8 and 10 discuss and illustrate

the application, use and practice of FTA and other

Probabilistic Risk Analysis (PRA) methods, such as FMEA, in

industry and Government.

The NRC and DOE have made extensive use of PRA in analyzing,

licensing and regulating the operation of nuclear power plants;

in prioritizing generic nuclear industry, transportation and

waste disposal safety issues and in performing environmental

impact analyses.(14-16) DOD has also used PRA to develop and test

nuclear weapon systems. PRA is a comprehensive and integrated

analysis of failures capable of revealing their

interrelationship and their likelihood. Thus, in spite of its

uncertainties, high cost, effort and limitations, PRA has

proven useful to regulators of technological risk both to

highlight gaps in knowledge and areas of research need and in

directing the industry and regulatory efforts towards redress

of high leverage safety problems. PRA's have aided in

formulating safety goals, criteria and defining risk

acceptability levels and numerical compliance targets for

industry.

8-29
REFERENCES TO CHAPTER 8 

1. "A Review of Risk Assessment Methodologies" - Report by

the Congressional Research Service (CRS), Comm. on Sci.

and Technology, Comm. Print 98-929 (1983)

2. "Risk Assessment in the Federal Government: Managing the

Process," NAS (1983)

3. "Risk Assessment and Risk Management: Framework for

Decision making," EPA Policy Paper, 1984; also "Science,

Risk and Public Policy," W.D. Ruckelshaus, Science 221.

1026 (1983).

4. "The Perils of Prudence," A. L. Nichols and R. J.

Zeckhauser, in "Regulation," Nov/Dec 1986, p. 13 et ag.

5. "The Dangers of Caution: Conservatism in Assessment and

Management of Risk," A. L. Nichols & R. J. Zeckhauser, p.

5-582 in Advances in Appl. Micro- Economics, Vol. 4 on

"Risk, Uncertainty and the Value of Benefits and Costs."

6. "Product Safety Management and Engineering," Willie

Hammer, Prentice Hall Intl., 1980.

7. "System Safety Engineering and Management," H. E. Roland

and B. Moriarty, J. Wiley & Sons, 1983.

8. "Fault Tree Handbook," NUREG-0492, Jan. 1981, Vesely, W.,

et. al.

9. "Social Benefits vs. Technological Risk," Chauncey Starr,

Science 165, 1232 (Sept. 19, 1969).

10. "Hazard Identification and Quantification," H. Ozog and L.

M. Bendixen, Chemical Engineering Progress, April 1987, p.

55-64.

11. "Inferences from Alarming Events," J. W. Pratt and R. J.

Zeckhauser, J. Policy Analysis and Mgt., 1, 321 (1982).

12. "Computing Risk Profiles for Composite Low Probabilty High

Consequence Events," D. J. Heimann and T. S. Glickman,

Annals of Operations Res. (1987), 9, 545-560 (1987) in

"Statistical and Computational Issues in Probability

Modeling II, (eds. S. L. Albin and C. M. Harris).

13. "Review of RTG Utilization in Space Missions," Hearing,

House Comm. on Sci. & Tech., March 4, 1986 (Rept. # 97),

see Testimony and Appendices (esp. pp. 252, 280, et seq.).

8-30
14. "Risk Management Guide", G.J. Briscoe, EG&G, Idaho, for

DOE, DOE/SSDC-76- 45/11- Rev.1, Sept. 1982.

15. "Probabilistic Risk Assessment (PRA) Reference Document,"

NRC, NUREG- 1050-F, Sept. 1984.

16. "PRA Procedures Guide- A guide for the Performance of

Probabilistic risk assessments for Nuclear power plants,"

NRC, NUREG-CR-2300, 1981.

17. "An Anatomy of Risk," W.D. Rowe,J.Wiley and Sons, New

York, 1977; Second Ed., 1986.

18. "Methodologies for Hazard Analysis and Risk Assessment in

the Petroleum Refining and Storage Industry," Concawe,

Report 10-82, 1982.

19. "Regulatory Program of the US Government, April 1, 1986 -

March 31, 1987," Exec. Off. of the President, OMB, (p. xx,

T.2).

8-31
10/2/95 rev

9. APPLICATIONS OF RISK ANALYSIS TO SPACE LAUNCH

OPERATIONS

9.1 LAUNCH RISK ANALYSIS OBJECTIVES

Risk Analysis is not an end in itself, but rather a means to

accomplish other goals: the identification of hazards and the

assessment and quantification of risk provide insight to the

overall acceptability of a program, such a commercial space

launch campaign, from operational, regulatory or societal

viewpoints. If the associated risk level appears unacceptably

high to the public agency sponsoring or regulating the activity,

the analysis can provide information needed to control and reduce

the risk. The whole Range Safety Control process ( see Ch.2,

Vol.1) is predicated on risk avoidance, minimization of accident

impacts and the protection of population centers (see also Ch.

10). Risk values related to space-launch activities may be

generally categorized in two ways: (1) the probability of

vehicle failure, including all possible failure modes, that could

lead to debris impact events and their probabilities; and (2)

consequence estimation, i.e., expected casualties or damage. The

probability of debris impacts generally means that at least one

object impacts in a specific area. The casualty estimation

generally used is one of two types: (1) the probability of

casualty, defined as the probability of one or more persons

sustaining an injury; or (2) the expected number of casualties,

defined as the number of persons expected to sustain an injury as

a result of at least one object impact in a specific area. These

concepts have also been discussed and illustrated in the context

of Range Safety destruct actions (Ch. 2, Vol.1 and Ch. 10 ) and

re-entry hazards (Ch. 7, Vol.2).

The following is a list of general uses and applications of Risk

Analysis in the context of space mission planning, approval and

implementation:

• A risk study can serve as a tool in the total decision

making process for the Range or the sponsoring organization.

• Excessive risk may reveal the need for a Flight Termination

System (FTS) or other program restrictions (e.g., restrict

land overflight or launch azimuths).(29,32)

• Results are a tool to help underwriters price commercial

space insurance.

• Results may indicate the requirement that an existing or

pre-designed FTS or other critical ELV system be redesigned,

if such a redesign can significantly reduce 

9-1
these risk levels via greater safety margins or introducing

redundancies.(33)

• Results may indicate the need for evacuation of Range

personnel, enforcement of roadblocks, restricted sea lanes

or airspace, movement of critical equipment, callup/purchase of additional real estate or justification for

currently controlled land.(2 b)

• Results might show the necessity to modify the support plans

for other Range support elements permitted within the

evacuated area, i.e., manned optical tracking sites.

• Results can be used in the development of ELV flight safety

operational support plans to include procedures, destruct

criteria and whole vehicle versus destruct case (many

fragments) impact decisions.(10,11)

• Results can be used to alert the Range or Sponsor management

to excessive on-site or public risk exposure levels for

given launches or total programs. It is then the decision

of management on which course to proceed.(17)

• Results might identify launch scenarios and patterns that

require mission operational procedure changes or hardware

redesign/modification to allow the selection of less

hazardous options, based on cost/benefit or operational

constraints and priorities.(18)

• Results may indicate the need to construct new facilities in

cases where it is not acceptable to use existing

facilities.(20)

• Results might reveal the need and advantage of providing

positive protection for nonevacuated personnel (shelters,

barricades, bunkers, blockhouses, etc.) and critical

equipment required in the evacuated area.(20)

• Results can be used to establish and define limiting

criteria which may be used both quantitatively and

qualitatively. Impacts of single launches or cumulative

impacts of space launch programs can be compared in this

manner.(19,32)

• Risk studies can provide documented evidence that specific

hazards were considered in an objective and rational manner

in developing operation plans.(8-13)

9-2
• "Risks to launch" results identify the reliability of the

Range support equipment and personnel and can be used for

the following purposes:(19,32)

a. Identify high risk from inadequate Range support

elements and, therefore, assist in increasing total

reliability and reducing hazards involved in launching.

b. Increase Range operational safety and supportability.

c. Increase Range capability and attractiveness to

potential users.

A general method that satisfies all possible analytical problems

related to space operations does not exist, as discussed in 

Ch. 8. Historically, the National Ranges have developed their

own computer programs for risk studies and analyses, as

appropriate to specific tests, launch vehicle systems or Range

operation problems. Although no standardization exists at

present between the Ranges regarding methodology, computer

programs and analytical tools (mainly because of different siting

and demographics, but also because of specialized uses of each

Range), the major types and elements of space risk analysis do

recur. Moreover, there are technology transfer and

standardization efforts in progress at ESMC and WSMC. A typical

Risk Analysis requires five basic categories of data:

1. Systems failure modes and their probabilities.

2. Impact probabilities and distributions resulting from

failures or normal launches.

3. A measure of lethality of impacting debris.

4. Location and nature of population and structures placed

at risk by the mission.

5. Launch plans, subject to Ground Safety and Range Safety

constraints.

Various elements of these categories may be considered in

development of a Risk Analysis for a space launch vehicle,

mission and/or operation.

The end result of a Risk Analysis for a specific launch and

orbital mission is valid only to the degree of reliability and

completeness of the inputs and their applicability to a given

launch vehicle or site. A result valid for one Range may be

meaningless for another, because flight corridors, destruct

criteria and impact limit lines are designed to be site-specific

and are tied to the launch azimuth. Risk Analysis results may

have orders of magnitude uncertainties, since they generally

reflect compounded uncertainties in both initial and boundary

conditions, i.e., in assumptions, modeling simplifications,

approximations and possible errors of omission in the anticipated

9-3
failure modes and times. Risk studies, as applied to date to

space operations, have been used as aids in the decision-making

process in conjunction with other factors (proven Range

capability, experience, precedent, national interests and

priorities, etc.). Therefore, there are no general, uniform and

firmly established acceptable risk levels for space operations,(1)

although policy decisions and risk acceptability guidelines have

often been based on matrix-type risk assessments (Ch. 10).(3-6)

Several mission agencies have developed such matrix-type risk

classification, ranking and evaluation procedures, which

facilitate the objective definition of acceptable and

unacceptable ranges of risk. The formal DOD risk matrix for

space launches is illustrated in Ch.10.(5) The DOD qualitative

hazard probability classification ranges from Level A (frequent),

B (probable ), C (occasional), D (remote), to E (improbable).

Similarly, the consequence severity categories, which account for

damage, injuries or both are: I, catastrophic; II, critical;

III, marginal; and IV, negligible. Hazard analyses attempt to

rank failures and accidents in a two-dimensional

probability/consequence matrix and assign a hazard index to each

accident accordingly (e.g. 1A, 2E, 4D). Then these can be judged

acceptable, undesirable or unacceptable according to suggested

criteria.(3) The logic flow of a general risk assessment

procedure, as it typically applies to DOD space operations, is

shown in Figure 9-1.(16)

NASA has, however, established explicit launch safety criteria

and numerical risk acceptability goals, as detailed in Sec.

9.2.(7) NASA uses a mishap (or accident) severity classification

consisting of three hybrid categories: A - causes death, damage

exceeding $500,000 or destruction of space hardware and/or

spacecraft; B - causes permanent disability to one or more

people, damage valued at $250,000-500,000; C - causes only

occupational injuries and/or < $250,000 damage.(7a-c) NASA has

traditionally required Safety Assessment Reports (SAR) for all

missions that may deviate from proven safety procedures and set

safety criteria and standards.

DOE has also developed and used extensively risk ranking matrix

methodologies, that combine and trade off the frequency and the

severity of an event. However, the severity of consequence

classes, A, B and C from worst to least, differ by loss type

fatalities, property loss, or environmental pollution effects).

The accident frequency scale ranges from probable (1-100 years

return period), to reasonably probable (100-10,000 years), remote

10 thousands to ten million year) and to extremely remote beyond

this return period for the accident or event.

9-4
9-5
Note that the probability of an event corresponding to a 100

years return period is 10-2 per year. The matrix risk ranking

scheme permits first order (probable and severe) risks to be

defined, down to fourth order (remote - C, or extremely remote -B

events).(37)

9.1.1 System Failure Modes and Probabilities

Launch Vehicle physical data used may include:

• Propellants

• Explosive/fuel chemical properties

• Fragmentation characteristics

• Mass

• Shape

• Ballistic coefficients

• Flight dynamics

• Flight Termination System (FTS)

• Guidance and control

• Stage burn times and separation characteristics

• Lethality of debris, as represented by the Lethal Area

The failure modes and associated probability of failure are

required if other than a normal launch is addressed.(9,10)

Estimates for failure mode probabilities are typically based upon

knowledge of the vehicle's critical systems and expert assessment

of their reliability combined with historical data, when

available.(8-11,17,18) The single point (critical) failure systems,

such as the FTS, are designed, tested and certified to very high

reliability standards: at WSMR the FTS reliability quoted for a

non- redundant FTS required for a typical sub-orbital research or

sounding rocket system is .997 at a 95% confidence level.

However, higher reliabilities with failure probabilities of 10-6

apply to redundant FTS systems required for large ELV's.

Typically, FTS designs are required to be "single fault tolerant"

i.e., redundant.(6)

The total probability of an ELV operational failure includes

contributions from all foreseeable failure modes which can lead

to either thrust termination or malfunction turns. The

occurrence of failures during a critical time interval, such as

the boost phase or stage separation, permits the estimation of

failure rates versus time into flight. Illustrative figures for

the two major failure modes for Titan 34D as a function of time

into flight are given in Table 9-1. These figures are based on

an analysis of past launch performance data for the Titan family

of vehicles, corrected for learning, i.e., the improvements in

manufacturing, assembly and operational procedures which take

place after a failure is diagnosed, analyzed and fixed.(38,39)

9-6
9.1.2 Impact Probabilities

The regions or areas exposed to launch operations or accident

hazards must be identified (see Ch. 4). These may be subdivided

into smaller sections, critical locations of people or buildings

that are specified for subsequent risk calculations. All risk

analyses require estimates of the probabilities of

debris/fragments from failed vehicle impacting within hazardous

distances of personnel or structures in the region.(17,23) The

probability of an impact, Pi, for a public area requires

consideration of all failure chains which could endanger it and

always implies an FTS failure whose probability is Pf, given that

a critical vehicle failure of probability Pv has occurred.

The design and engineering associated with the development of a

system is geared to produce a properly functioning vehicle. As

a consequence, there are generally no data defining vehicle

performance characteristics after a critical failure has

occurred, except environment definition and vehicle response

scenarios assumed. These data are required for meaningful risk

assessment. To provide such data, several computer models

discussed below in Sec. 9.2 have been developed to simulate

9-7
vehicle responses after a given gross failure mode has

occurred.(19) These computer models are used as part of the

computational process for generating debris impact probability

density functions. These models combine, statistically and

dynamically, well defined vehicle data with expert engineering

estimates to predict vehicle performance after a failure occurs

(e.g., Table 9-1). Sometimes failures that occurred during

design verification and system tests can be used to infer inflight failure behavior. Also, Mishap Reports, which are based

on failure diagnostics and accident investigations, help to

refine these computer programs or their external data files with

field data.(33,34) Failures possible during each launch and flight

phase must be considered separately, in order to isolate those

with the potential for public safety impacts.

9.1.3 Debris Lethality

An important aspect of the vehicle data problem that must be

addressed prior to performing risk calculations is to determine

what occurs after vehicle failure and fragmentation (whether on

command or spontaneous) leading to ground impact. The number of

fragments, their sizes and shapes will ultimately define the

hazard and casualty area for a given vehicle or fragment impact

(Table 9, Ref. 37b). Debris are characterized by their size,

mass, area and ballistic coefficient to determine if they survive

re-entry and their terminal velocity at ground impact. The data

items which are often developed for this part of the problem

include: an impact energy distribution budget, secondary

explosive energies available (if any) at impact, secondary

fragments which may result from impact (splatter effect) and

ricochet probabilities and characteristics.(20,22) Also, the

likelihood, severity and extent of toxic vapor clouds, pool fires

and blasts are used to calculate hazard areas for the various

hazard mechanisms (see also Ch. 5, Vol. 2 and Ch. 10).

9.1.4 The Meaning of Casualty Expectation

The quantity most frequently employed to evaluate the risk

associated with the testing and operation of a space launch

system is called casualty expectation, Ec. This quantity

corresponds to the expected or mean number of casualties or

injuries if an ELV is launched according to a specific mission

plan. The specific approach to compute casualty expectation is

adapted by the National Ranges to fit their specific problems and

launch situations.(17-23) In general, Ec is obtained by considering

the following quantities:

• The area, A, in which debris impacts can occur,

partitioned into Ai subsets of areas.

9-8
• The fragment impact probability density (Pi) on Ai

produced by a given system failure.

• The hazard area, AHi, associated with an impact on Ai,

is the effective casualty (lethal) area for an

impacting piece of debris.

• Ni, the number of people in Ai at risk from debris

impacts.

• V, vulnerability, i.e., the likelihood that a structure

(hardened or not) within AHi can be penetrated by

debris or that a person can be injured as the result of

impact. This is only explicitly factored when

estimating risk to off-shore oil platforms and on-site

facilities.(17,20)

These quantities are then used in an equation of the form

The Ec estimate, as a measure of risk for a given test, is often

calculated by summing the risk over the hazard area for the test

with each element of the sum. These are weighted according to

the probability, as a function of time after launch, of the i-th

failure mode which may require destruct or lead to vehicle

fragmentation (Table 9-2). It must be noted that Ec is not the

probability of a casualty, because it can be >1 in special cases.

For illustration of the difference, in case of one accident per

1,000 with an average of 5 casualties per accident, Ec is

5/1,000, but the probability of a casualty is 1/1,000.

9-9
9-10
9.1.5 Population/Structures Data

The major purpose of a launch risk analysis is to determine the

magnitude of hazards to personnel and structures posed by a

launch and/or total program. Public risk exposure is of concern

primarily near the launch site and during the first minute after

launch, when, if the vehicle fails, it may veer towards populated

areas protected by impact limit lines. The FTS must also fail (a

double failure must occur) in order to violate the destruct

limits designed to protect the public. The probabilities of such

double failures are typically very low, on the order of 10-6 to 

10-8.

(37) Locations of buildings and structures and the

distribution of population throughout the area must be known, as

well as other facts, including:

• Sheltering capability of occupied structures, i.e., the

ability to withstand debris impact and protect against

overpressures from explosions or impact kinetic energy

conversion;

• Frequently, population distributions may be functions

of the time of day or week and may be significant in

risk tradeoff studies;

• Risk levels can be directly affected and controlled to

some extent by population control, sheltering, Range

clearance or by preventing people from entering these

areas (e.g., road-blocks).

Based on such an analysis combined with mission profile

constraints, the Impact Limit Lines (ILL) beyond which the

vehicle and its fragments should not impact are determined for

each launch to protect population and structures. Infringement

of the ILL warrants a positive destruct action (see Ch.2, Vol.1).

9.1.6 Launch and Mission Planning

The actual implementation of operational plans under launch

conditions ultimately determines the actual risk exposure levels

on and off-site.(11-13,18) Integral to the analysis are the

constraints posed by the following:

• Launch area/Range geometry and siting

• Nominal flight trajectories/profiles

• Launch/release points

9-11
• Impact limit lines, whether based on risk to

population/facilities or balanced risk criteria.

• FTS and destruct criteria

• Wind/weather restrictions

• Instrumentation for ground tracking and sensing onboard the vehicle

• Essential support personnel requirements.

The Range Safety Group (or its equivalent) typically reviews and

approves launch plans, imposes and implements destruct lines and

other safeguards, such as NOTAMs (Notice to Airmen), Air Space

Danger Area notifications and radio-frequency monitoring (see

Ch.2, Vol 1).

The launch (normal and failure) scenarios are modeled and

possible system failure modes are superimposed against the

proposed nominal flight plan. Hazards and risk resulting from

all known or hypothetical failures are summed in the overall Ec

for the launch. A range of values (risk envelope) rather than a

single probability or casualty expectation value is determined.

The hazard to third parties is dependent upon the vehicle

configuration, flight path, launch location, weather and many

other factors ( see Ch.5, Vol.2). It should be possible to

tabulate casualty expectations and impact probabilities for a

particular range, vehicle and typical flight path, but this

information is not easily available in the public domain

presently.

9.2 LAUNCH RISK ANALYSIS TOOLS.

9.2.1 Pre-launch Safety Requirements.

Any contractor or launch vehicle manufacturer using a National

Range must comply with extensive safety requirements,(4-6) and

submit sufficient data regarding the mission trajectory and

vehicle performance to support the mission safety evaluation,

operational planning and approval.(8-12) A Blast Danger Area around

the ELV on the launch pad and a Launch danger Area (a circle

centered on the pad with tangents extended along the launch

trajectory) are prescribed for each ELV depending on its type,

configuration, amount of propellants and their toxicity, TNT

equivalents, explosive fragment velocities anticipated in case of

an accident, typical weather conditions and plume models of the

launch area.

The list of safety documents that a Range User must comply with

is a comprehensive set of Ground and Range Safety requirements

(5-7,16). The scope of the effort involved to apply them 

9-12
to mission analysis and approval is well illustrated in a four

volume Integrated Accident Risk Assessment Report (IARAR), which

includes quality assurance and certification of critical

components and subsystems, electro-explosives, hazardous

propellants and chemical information, vehicle description and

payload/system safety checks.(8) In the case of man-rated space

systems, like the Shuttle, the customary safety requirements and

the lengthy lead time required for mission planning and approval

become even more cumbersome.(29-32) More typical are the mission

approval documentation submitted to the Range, such as the Flight

Plan Approval and Flight Termination reports illustrated by Refs.

10-13 and 15.

A Flight Safety Plan and supporting data must be supplied by the

User to the National Range, prior to mission approval and

operational planning.(36) Each launch is evaluated based on:

• Range User data submission requirements from the hazard

analysis view point;(18,22)

• launch vehicle analyses to determine all significant

failure modes and their corresponding probability of

occurrence (FMEA's and Reliability Analyses);(9a,b)

• the vehicle trajectory, under significant failure mode

conditions, which is analyzed to derive the impact

probability density functions for intact, structurally

failed and destructed options;(11-13)

• the vehicle casualty area based upon anticipated

(modeled) conditions at the time of impact;(10,13)

• computed casualty expectations given the specific

launch and mission profile, population data near the

Range and along the ground track.(10,15) Shelters may be

provided, or evacuation policies adopted, in addition

to restricting the airspace along the launch corridor

and notifying the air and shipping communities (NOTAM)

to avoid and/or minimize risks;

• an Accident Risk Assessment Report (ARAR) prepared to

identify hazards of concern, causes, controls and

verification procedures for implementing such

controls.(8)

The ESMC and WSMC Range Safety Requirements specify the data

submissions expected from Range Users to enable hazard

assessments prior to granting launch approval, including:

• determination of significant failure modes and

derivation of impact probability density

functions(PDF);

9-14
• evaluation of casualty area based on vehicle break-up

analysis;

• computation of dwell times over land; impact

probabilities; casualty expectations based on land

area, geography and population densities;

• sample calculations and documentation.

Missions involving nuclear power packs or payloads must qualify

based on very stringent safety criteria and are approved only

after review by an Interagency Nuclear Safety Review Panel

(INSRP). Detailed risk assessments have been performed by NASA,

DOE, DOD and their contractors for the INSRP prior being allowed

to launch satellites with nuclear power sources such as

Radioisotope Thermal Generators (RTG) on-board the STS.(25-28)

9.2.2 Risk Models and Safety Criteria Used at National

Ranges.

The Range Safety Group, Range Commanders Council (RSG/RCC) has

reviewed a number of the computer models used by five of National

Ranges (including the White Sands Missile Range - WSMR, Western

Space and Missile Center - WSMC, the Pacific Missile Test Center

- PMTC, US Army Kwajalein Atoll - USAKA, and the Armament

Development Test Center - ADTC) to assess launch-related risks to

on-Range personnel and the public.(1) Different models and

computer codes are used at the Eastern (ESMC) and Western (WSMC)

Test Ranges, and at the NASA/GSFC Wallops Island Launch Facility

(WFF) because launch vehicles, mission objectives and site

specifics vary.(7,18,19)

The evaluation of launch associated hazards is based on Range

destruct criteria designed to minimize risk exposure to on and

off-Range population and facilities. Computer models are used to

simulate missions for optimization and approval or run in real

time for Range Safety Control Officers to monitor flight

performance.

The DOD Ranges do not have published requirements for acceptable

levels of public risks, presumably because national security

interests can take precedence in testing new launch systems and

launching defense payloads and spacecraft. Since launch risk

exposure to the public is primarily controlled in real-time by

the Range Safety personnel rather than the Range User, the

residual and uncontrollable hazards to the public are re-entry

hazards due to failures to achieve proper orbit and premature reentry of the payload.

9-15
The NASA/WFF Flight Safety Plan, compares the risks associated

with a specific mission to "acceptable risk criteria," such that:

• casualty expectation ≤10-7 for planned or accidental

impact and re-entry of any part of the launch vehicle

over any land mass, sea or airspace;

• probability of impact with potential damage to private

property ≤10- 3 (unless an SAR is prepared and approved

or a waiver is obtained);

• probability of impact with flight support aircraft (for

meteorological monitoring, or tracking support of ≤10-6

(note that other aircraft are excluded by NOTAM and

airspace restrictions);

• probability of impact with ships and boats within the

impact area (inside a 50 mile radius from the launch

points) of ≤10-5. (Some Ranges observe a 20mi.

radius;(37b) Wallops Flight Facility surveys out to 100

miles.(40))

From 1961 to 1983, Wallops has experienced 14 launch failures out

of over 10,000 sub-orbital launches of sounding rockets,

resulting in an observed land impact probability of 2.8 x 10-3.

Of these, only three impacted outside the launch site area (i.e.,

P = 6 x 10-4). Assuming an average population density of 64 per

sq mi., the casualty expectation based on this observed vehicle

failure rate is 8 x 10-9. Similarly, for debris dispersal over

water, a ship traffic density of 2.6 x 10-5 per sq. nmi per day

was used, resulting in an expected 3.7 x 10-7 probability of a

sustainer impacting a ship. For comparison, Wallops threshold

ship-impact probability criteria are ≤10-5, corresponding to 20x

increased allowance for ship impact.

Range Safety Reports, Safety Analysis Reports (SAR's) and other

such probabilistic Hazard Analyses must be prepared by Range

Users for Mission Approval at most National Ranges whenever a new

launch vehicle configuration (e.g., a Titan with an IUS or

Centaur upper stage), an unusually hazardous payload (e.g., a

nuclear powered spacecraft) or a trajectory with land overflight

are involved (i.e., whenever "deviations" from approved safe

procedures, vehicles and programs are filed). Similar reports

are needed for US-sponsored launches from foreign territories.

Either the User submits the data for the Range to carry out its

own hazard analyses or the User prepares such a document on

request.(6)

Safety Assessment Reports (SAR's) were typically prepared by NASA

GSFC/Wallops Flight Facility (WFF) for sub-orbital launches from

foreign territory. Two references are representative of the

9-16
types of launch hazards of concern and the NASA approach to risk

assessment: The SAR for Project CONDOR involved launches in 1983

from Punta Lobos, Peru, using Taurus-Orion, Terrier Malemutes,

Nike-Orion, Black Brants and similar sub-orbital vehicles to

launch retrievable atmospheric sounding research payloads.(7e-g)

Range Safety Guidelines minimize post-launch risks to the public

by imposing a number of restrictions: e.g., no land over-flight

corridors are selected if it is possible to have launches and

flight paths over water. However, for land-locked launch sites

such as WSMR, strict overflight criteria restrict both land and

airspace corridors to on-Range and Extended Range areas.(2) There

are no intentional off-Range land impacts permitted for any

normally jettisoned booster and sustainer casings and sufficient

safety margins are provided within the destruct corridor to avoid

impacts on population centers by accidentally or intentionally

generated debris. For WSMR launches, typical observed limits on

risk to nearby population centers are land impact probabilities

of < 10-5 on-range and < 10-7 off-range, resulting in casualty

expectations of < 10-7 to 10-9.

Models, run sequentially or in parallel, are designed to compute

risks based on estimating both the probabilities and consequences

of launch failures as a function of time into the mission.

Inputs and external data bases include data on mission profile,

launch vehicle specifics (e.g., solid or liquid rockets, stages,

configuration), local weather conditions and the surrounding

population distribution. Given a mission profile, orbital

insertion parameters and desired final orbit, the risks will vary

in time and space (see Ch. 10). Therefore, a launch trajectory

optimization is performed by the Range for each proposed launch,

subject to risk minimization and mission objective constraints.

The debris impact probabilities and lethality are then estimated

for each launch considering the geographic setting, normal

jettisons, failure debris and demographic data to define destruct

lines to confine and/or minimize potential public risk of

casualty or property damage.

The National Ranges use either a circular or an elliptical

footprint dispersion model to analyze vacuum and wind-modified

instantaneous impact points (IIP) from both normal stages

jettisoned during launch and launch debris (failure or

destruct).(1) The debris dispersal estimates generally assume

bivariate Gaussian dispersion distributions.(19,21) Risk contours

are estimated as impact probabilities or casualties expected per

unit area centered on the II (nominal impact points) or on a

specific site (land, community or Range) of interest. All these

models are similar in approach, but quite site-specific in the

use of databases, which depend on Range location and on the

geographic area and associated population distribution at risk.

The models may be run either as simulation to assist in analyzing

9-17
and selecting launch options, or can be run in real-time, to

monitor a launch operation.

The information and risk computation logic flow depicted in Figs.

9-2, 9-3 are used in a computer program developed to calculate

relative risks to population centers along the flight corridor

ground-track, namely the LARA - Launch Risk Analysis program and

its later upgrades.(19,21) The LARA program is in use at WSMC and

PMTC and is being introduced at ESMC. Figure 9-4 shows a sample

real-time debris footprint display monitored by Range Safety

Officers at WSMC during each launch operation. It is based on

computed and wind-corrected trajectory and LARA impact patterns

moving with the tracked vehicle and their position relative to

the fixed, prescribed destruct and impact limit lines. If the

failed vehicle encroaches these lines, a destruct decision must

be made or withheld according to clearly formulated destruct

criteria.

9-18
9-19
9-20
Since WSMR is a land-based Range, safety considerations are

particularly important in authorizing tests that might endanger

the public. Computer models in use at the Range support premission simulations of normal and failed flights, as well as

real-time tracking and destruct decisions based on vacuum and

drag corrected IIPs. The library of risk computation and utility

codes used by Range Safety include: SAFETY.SITE (generates

scaled maps of the range and tracking installations), SAFETY.DMA

(converts maps to desired coordinate scale), SAFETY.GIP (predicts

both vacuum and drag corrected impact coordinates) and several

other external modules for population data and impact point

prediction. The WSMR Hazard Analysis method and its application

to launches of sub-orbital vehicles with recoverable payloads was

illustrated in a 1986 study.(2b) Other risk analyses have been

performed for specific tests and launch vehicles based on

tailored models using the vehicle characteristics and launch

geometry.

WSMC has an extensive array of software developed to assist in

evaluating hazards to facilities and population centers and

devising appropriate risk control options.(19-21) These include:

LARA, CONDEC (Conditional Casualty Expectation), RBAC (Risk Based

Destruct Criteria), ACE (which combines CONDEC and RBAC to

compute casualty expectation along arbitrary destruct lines),

SLCRSK and LCCRSK (which compute probabilities and expected

magnitude of damage to the reinforced launch control center and

to other VAFB facilities, such as SLC-6, for certain launch

azimuths).(20) Other special purpose models are: BLAST, to assess

explosion shock wave far-field impacts; SABER, to evaluate

supersonic boom effects; REEDM, for hot toxic gas predictions and

a series of cold spill toxic prediction algorithms for toxic

releases.

ESMC has its own library of codes used to support launches as

pre-flight simulations and real-time monitoring and display.

These include: BLST, similar to BLAST above; COLA, a collision

avoidance program used to ensure that a proposed launch will not

jeopardize any satellite in orbit; RAID, the major real-time

Range Safety program which displays the ELV position and II based

on tracking data; RSAC and RSTR, which provide plots in sitecentered coordinates; REED, used for launch and post launch

environmental analysis of exhaust cloud effects; RIPP, an

interactive impact point and destruct line plot and RSIP (Range

Safety Impact Predictor), which computes impact position

parameters along the trajectory with and without wind data.

Other codes are used to assess the fate of an errant ELV, such as

RSPFT (Range Safety Powered Flight and Turns) and RSTT (Range

Safety Tumble Trajectory), to predict malfunction behavior for

each vehicle type and nominal trajectory; and RSMR, which

9-21
computes the maximum pad-to-impact range for a vehicle and its

debris. External modules are used to update wind corrections

(RSRK, for Range Safety Radiosonde Data) and assess risks to

ocean traffic (RSSP or Range Safety Ship Hit Probability).

For any developmental vehicle, safety assessments must precede

flight testing and launch approval. For example, the new

commercial launch vehicle Conestoga has been flight tested

recently; Conestoga failure modes and rates were based on

previous experience with the Aries rocket and the Minuteman I

second stage motor, which were reconfigured as the Conestoga.

Special attention was given to the possibility of impact and

damage to off-shore oil platforms in the Gulf Area, given the

flight path, ground track and safety corridor for Conestoga under

a range of plausible vehicle failure scenarios and weather

conditions.(36) However, because of redesign of the Conestoga,

some of the safety assessments are being re-evaluated for

launches from WFF.

The hazard models used by NORAD and AFSC to estimate far-field

public risk exposure (i.e., for assessing the probability that a

failed vehicle, re-entering second stage or debris will impact in

CONUS and/or foreign countries and cause damage and casualties)

were originally developed by the Aerospace Corporation.(34,35) These

re-entry risks for second and upper stages and for low-orbit

payloads appear, typically, to be several orders of magnitude

larger than launch and orbit insertion risks (see Ch.7, Vol.2)

because they integrate world-wide casualty expectation. Impact

probabilities and casualty expectations for a specific country

are much smaller and proportional to their area and population

contribution to the integral.

Overflight risks are also a modeling and operational planning

concern for Range Safety: some trajectories may traverse Japan,

Australia, Africa and South America (see Ch.10 also). Table 9-2

summarizes extant risk results, namely the probabilities of land

impacts and projected casualties for typical ELV's on allowed

azimuths for ESMC launches over water.(37) These flights must

protect the "African Gate" during overflight(see also Ch.10).

This performance gate defines the maximum cross-range deviations

from the nominal overflight trajectory which may be tolerated

without termination action. These are well within the destruct

limits to better protect populated areas at risk in case of

abnormal vehicle performance.

To place the criteria and goals for public risk exposure per

space launch in perspective, it is instructive to compare them

with other common, but voluntarily assumed or socially accepted

transportation risks (see also Ch.5, Vol.2 and Ch.8). Ref. 29,

published prior to the 1986 Challenger accident, estimated the

9-22
casualty probability per flight for commercial air carriers to be

6.6 x 10-5 (based on 1972-74 data) vs. 1-3 x 10-5 for the Space

Shuttle (to compare respective risks from an STS failure with and

without a destruct system on-board). For comparison, the 1982-84

transportation accident statistics give fatality rates per 100

million passenger-miles of .02 for inter-city buses, .04 for

airlines and .07 for railroads. These values correspond to a

casualty probabilities of 2-7 x 10-10 per mile. This probability

must be converted to units of interest to space operations (per

launch event or per year) and then further normalized to the

exposed population and the area at risk. Further,

utility/benefit considerations must be brought to bear for a

meaningful comparison of public transportation with space

transportation risks. 

9-23
REFERENCES FOR CHAPTER 9

1. a)"Risk Analysis Techniques," Range Safety Group/ Range

Commanders Council (RSG/RCC), Document 315-79, 1979

b)"Unguided Rocket Safety," RSG/RCC Technical Report, March

1982.

2. a)"White Sands Missile Range (WSMR) User's Handbook," 2

Vols., 1987.

b)W.C. Wolff, "Black Brant Hazard Analysis," WSMR Report,

Jan. 1986.

3. "Systems Safety Program for Space and Missile Systems", MILSTD-1574A (USAF), Aug. 1979, Rev. 1985.

4. "Use, Management and Operation of DOD Major Ranges and Test

Facilities," DOD Directive 3200.11.

5. a)"Military Standard System Safety Program Requirements,"

MIL-STD-882B, March 1983, and "System Safety Program

Requirements for Space Systems and Their Facilities," MILSTD-882B-1, 1986. (Draft)

b)"Investigating and Reporting Air Force Mishaps," AFR 

127-4, January 1984.

6. a)"Range Safety Manual," USAF/AFETRM 127-1, 1972;

b)"Range Safety Requirements, Range Safety Regulations,"

WSMCR 127-1, May 1985.;

c)"Eastern Space and Missile Center-Range Safety," ESMCR

127-1, July 1984;

7. a)"Range Safety Policies and Criteria", NASA/GSFC-WFF GMI

1771.1, Rev. 1, 1979;

b)"Range Safety", GHB 1771.1, NASA/GSFC, September 1984;

and "Issuance Information Sheet on Range Safety;"

c)"Range Users Safety Handbook," WHB 1771.1, NASA/WFF, March

1979;

d)"NASA Safety Manual," NASA NHB 1700.1;

e)"Safety Assessment Report (SAR) for Project CONDOR,"

NASA/GSFC-WFF, 1983;

f)"SAR for Project COPE," NASA/GSFC-WFF, 1984;

g)"Risk Assessment for Black Brant X from Poker Flats, AL.

and Malemute from Fort Yukon, Al.," NASA/GSFC, 1983.

8. "Titan IV Integrated Accident Risk Assessment Report (IARAR)

- Phase II", Martin Marietta (MCR-85-2514), 4 Vols., Jan.

1987.

9-24
9. a)"Failure Mode and Effect Analysis Report for Delta II",

MDC H3324, July 1987, McDonnell Douglas Astronautics Co.,

for USAF MLV/GPS Program .

b)"Delta II Reliability and Maintainability Allocations,

Assessment and Analysis Report," MDC H3058 A, March 1987,

MDAC for USAF MLV/GPS Program.

10. a)"Delta Range Safety Land Impact Probability Study for the

S-17 Spacecraft Mission," Douglas Aircraft Co., Report SM43503 (for NASA), July 16, 1963.

b)"Analysis of Delta Impact and Kill Probability Prediction

Probabilities, (Including 2nd Stage Failure Mode and Effect

Analysis)," Booz-Allen Applied Research, Report 862-3-41-1,

Feb. 1966.

11. "Delta 181 Range Safety Flight Termination Report," MDC

H3161, Sept 1987, MDAC for NASA.

12. a)"Flight Plan Approval Package for Delta II," MDC H2747,

June 1987, MDAC for USAF MLV.

b)"Titan CELV/IUS Range Safety Flight Plan Approval

Request," Martin Marietta, June 1986.

13. "Delta 392X Range Safety Flight Mechanics Destruct

Analysis," McDonnell Douglas Astronautics Co., Report MDCM3398, May 1987.

14. a)"Report of Delta 178/GOES-G Mission Failure Investigation

Board," Vols. 1&2, Final NASA Report, July 1986.

b)"Delta 178 Investigation Report," MDC H2505, MDAC for

NASA, Aug. 1986.

15. "Missile System Ground Safety Approval for DSV-3P-11E/E

Delta Launch Vehicles," McDonnell Douglas Astronautics Co.,

Report MDC-G9455, April 1982.

16. "Explosives Safety Standards," AFR 27-100, Rev. 2, 1985.

17. a)Bugno, W.T., D.M. Benn, J.D. Collins and J.M. Hudson,

"Missile Overflight Risks and Platform Design," (ASME,

Petroleum Division, R. Welch, ed.), Drilling and Production

Technology Symposium, 1986, pp. 57-61;

b)Benn, D.M., " A Brief Survey of Risk Management in DOD

Safety and Related Areas," PRC/ Omnitek , March 1987.

18. "Range Safety and Range Planning Trajectory Data for the AC68/F-8 Atlas G/Centaur Fltsatcom Follow on Mission", General

Dynamics, Report GDSS-SP-87- 010, May 1987.

19. Collins, J.D., "Risk Analysis Methodologies Developed for

the U.S. Department of Defense," Journal of Reliability

Engineering 1, #1, Jan 1988.

9-25
20. Harnitcheck, J.J., and J.D. Collins, "Risk Analysis of Titan

Launches over SLC 6," for WSMC/VAFB, May 1987.

21. a)Baeker, J.B., J.D. Collins, Haber, J.M., "Launch Risk

Analysis", Spacecraft & Rockets, vol 14 No. 12, Dec 1977,

pp. 733-738.

b)Baeker, J.B., "Launch Risk Analysis Program (LARA): Part

I- Specification," J.H.Wiggins Co., 1975.

22. McMunn, J.C., J.D. Collins and B. Brown, "A Hazards Model

for Exploding Solid Propellant Rockets," Journal of

Spacecraft and Rockets, 6, Dec. 1969, pp. 1423-1429.

23. Collins, J.D., M. Jameson and J.L. Lanz, "Real-Time Debris

Patterns for Ballistic Missile Launches," Journal of

Spacecraft and Rockets, 13, May 1976, pp. 310-315.

24. Rice, E.E., R.S. Deming, A.L. Friedlander and C.C. Priest,

"Preliminary Risk Benefit Assessment for Nuclear Waste

Disposal in Space," Earth Oriented Applic. Sp. Technol., 3,

1983, pp. 127-137.

25. "Preliminary Risk Assessment for Nuclear Waste Disposal in

Space," NASA CR 162028, Batelle for NASA/ Marshall, Feb.

1982.

26. "Space Shuttle Data for Nuclear Safety Analysis," NASA/ JSC

16087, Sept. 1979.

27. Weatherwax, R.K., and E.W. Colglazier," Review of Shuttle/

Centaur Failure Probabilities for Space Nuclear Mission

Applications,"AFWL-TR-83-61, Dec. 1983

28. "Review of RTG Utilization in Space Missions," Congressional

Hearing, House Comm. on Sci. and Tech., March 4, 1986.

29. Baeker, J.B., "Space Shuttle Range Safety Hazards Analysis,"

NASA/JSC TR81-1329, J.H. Wiggins Co., July 1981.

30. Hudson, J.M., "Development of STS/Centaur Failure

Probabilities: Liftoff to Centaur Separation," NASA/JSC TR

82-1404, By J.H. Wiggins Co., Feb. 1982.

31. Hudson, J.M., "Development of STS Failure Probabilities,

MECO to Payload Separation," NASA/JSC TR 70-1359, J.H.

Wiggins Co., 1979.

32. "Report of the STS Flight Termination Criteria Evaluation

Committee," WSMC Report, June 2, 1986(restricted).

9-26
33. a)"Report of the Presidential Commission of the Space

Shuttle Challenger Accident," June 6, 1987. 

b)"Investigation of the Challenger Accident," US Congress,

House Comm. Sci.and Tech., Rep. 99-1016, Oct. 1986.

34. "Implementation of a Safety Policy Related to Random Reentry of Satellites Decaying from Orbit," AF 04 (695)-100 1,

Mar. 1967.

35. "Random Re-entry Hazard Calculations for Titan IIIC Flight

Plans VIID and VIIE," TOR-0059 (6112-50)-5, June 1971.

36. "Range Safety Report for the Conestoga I Sub-Orbital Launch

Vehicle," Space Vector Corp., 1982.

37. Briscoe, G.J., "Risk Management Guide," E G & G, Idaho, for

DOE, DOE/SSDC-76-45/11, Rev.1, September 1982.

37. a)Parker, L.C. and R.M. Montgomery, "An Evaluation of the -

Department of Transportation Responsibilities for Commercial

Launches from a National Range," Research Triangle Institute

Report (RTI) to DOT, Sept. 1986.

b)"ESMC Baseline Assessment," RTI Draft Report to DOT, May

1988.

38. Heubach, W.F. and L.L.Philipson: a) "Investigation of LARA

Failure Rate Methodology," J.H.Wiggins Co. for USAF/WSMC,

September 1985, TR 85-3135; b) "Investigation of

Approximations and Assumptions in New LARA Failure Rate

Methodology," NTS Eng. for USAF/WSMC, September 1986, TR 86-

3147.02.

39. Baeker, J.B., "Failure Rate Methodology Implementation and

Titan 34D Failure Rate Assessment," NTS for USAF/WSMC,

1987, TR 87-3154.

40. Oral Communication from WFF to OCST, May 2, 1988.

9-27
10/2/95 rev

10. A GENERIC RISK ASSESSMENT OF REPRESENTATIVE LAUNCH

SCENARIOS

10.1 INTRODUCTION

Since the beginning of US space launch operations in the 1950's,

there have been no launch operation accidents that have produced

any general public casualties outside any of the Government

Launch facilities. There has been some damage to some Range

facilities and structures used to support the launches, but

little damage to public property outside the perimeter of the

launch sites. Considering the fact that there have been

unavoidable failures during thirty years of new rocketry and

spacecraft testing and streamlining of launch operations, it is

evident that the Range Safety Control process and systems in

place have prevented and controlled the risk from launch

accidents that could have lead to potentially significant claims

against the Government.

This proven track record of success for the Range Safety Control

systems and practices at the National Ranges may cast doubt on

the need to discuss the public risk exposure levels and the

potential for third party liability claims. It is worthwhile,

however, to discuss the consequences of ELV launch failures in

the absence of the Range Safety Control system since proposed

commercial space launches could originate at new launch sites

(perhaps an island site or an ocean platform); use novel,

untested or reconfigured tracking and control systems; and not

require an FTS of high reliability on-board ELV's. This approach

will permit an assessment of the extent of potential damage

and/or casualties that can be avoided by the established Range

Control Systems and safety practices (see also Ch.2, Vol.1, and

Ch.9). While much of the qualitative hazards analysis of launchrelated accidents has been given previously in Ch.5, Vol.2, the

intent of this chapter is to provide a coherent, self-contained

discussion of generic public risk associated with commercial

launch operations for existing ELV's which weighs the

consequences of each accident by its probability of occurrence in

a Risk Matrix according to the methods and tools illustrated in

Chs. 8 and 9.

10.2 RISKS DURING DIFFERENT PHASES OF A TYPICAL MISSION

10.2.1 Pre-Launch Hazards

During the preparation of a vehicle for launch, the chief hazards

derive from the storage and handling of propellants and

explosives. The Ground Safety procedures applied to stored

explosives and propellants that can explode are similar to those

used in the transportation and handling of these same materials

off-site. The protective measures include quantity-distance 

10-1
requirements, so that parties uninvolved with the launch cannot

be affected by any accident. In addition, other structural

protection (e.g., hardened concrete) and emergency preparedness

measures are used to contain toxic or corrosive materials within

the boundaries of the Range in case of an accident on the pad

(see also Ch.5, Vol.2).(1,12) 

Accidents occurring prior to launch can result in on pad

explosions, potential destruction of the vehicle and damage to

facilities within range of the blast wave as well as dispersion

of debris in the vicinity of the pad. The types of accidents

depend upon the nature of the propellants, as discussed in Ch.5.

In the case of cryogenic propellants, liquid oxygen alone will

cause fires and explosive conditions; if used in association with

liquid hydrogen, it can lead to very explosive conditions. Under

somewhat ideal conditions, the TNT equivalence of a hydrogenoxygen propellant explosion can be as much as 60 percent of their

weight, while that of an RP-1-oxygen explosion can be 20 percent

of the weight of the propellants (see Ch.5, Vol.2).(1)

An accident in handling storable hypergolic propellants could

produce a toxic cloud, liable to move as a plume and disperse

beyond the boundaries of the facility. The risk to the public

will then depend upon the concentration of population in the path

of this toxic plume and on the ability to evacuate or protect the

population at risk until the cloud is dispersed. It is obviously

advantageous if the winds generally blow away from populated

areas. There are also specific safety requirements and risks

associated with ground support equipment. The design and use of

this equipment must incorporate safety considerations.

10.2.2 Launch Hazards

Generally, the on-board destruct system is not activated early in

flight (during the first 10 seconds or so) until the failed

vehicle clears the Range. This protects Range personnel and

facilities from a command explosion. Failures during the very

early portion of launch and ascent to orbit can be divided into

two categories: propulsion and guidance/control. Lighting, wind

and other meteorological hazards (e.g., temperature inversions)

must be considered prior to launch countdown.

Propulsion failures produce a loss of thrust and the inability of

the vehicle to ascend. Depending on its altitude and speed when

thrust ceases, the vehicle can fall back intact or break up under

aerodynamic stresses. If the vehicle falls back, the

consequences are similar to those of an explosion on the ground.

The exception is when intact solid rocket motors impact the

ground at a velocity exceeding approximately 300 fps. In that

case, the explosive yield may be significantly increased. If

there are liquid fuels (hydrogen-oxygen), there is also potential

10-2
for a large explosion, much higher overpressures and more damage

to structures at the launch facility. It could also create

higher overpressures off the facility which could break windows

and possibly do minor structural damage to residential and

commercial buildings (see Ch.5, Vol.2).

Solid rocket motor (SRM) failures can be due to a burn-through of

the motor casing or damage or burn-through of the motor nozzle.

In a motor burn- through there is a loss of chamber pressure and

an opening is created in the side of the case, frequently

resulting in structural breakup. The nozzle burn-through may

affect both the magnitude and the direction of thrust. There is

no way to halt the burning of a solid rocket once initiated.

Hence, an SRM failure almost inevitably puts the entire launch

vehicle and mission at risk. When there are several strapped-on

SRM boosters, as is commonly the case, the probability of a

failure of this type is increased, since any one of these failing

can lead to mission loss.

The purpose of the Range Safety Control system is to destroy,

halt or neutralize the thrust of an errant vehicle before its

debris can be dispersed off-Range and become capable of causing

damage or loss of life. Without a flight termination system

(FTS), the debris could land on a population center and,

depending upon the type of debris (inert or burning propellant),

cause considerable damage. The destruct system generally is

activated either on command or spontaneously (ISDS - the

inadvertent separation destruct system is activated automatically

in case of a stage separation failure) at or soon after the time

of failure. In flight destruction limits vehicle debris

dispersion and enables dispersion of propellants, thus reducing

the possibility of secondary explosions upon ground impact. The

destruct systems on vehicles having cryogenics are designed to

minimize the mixing of the propellants, i.e., holes are opened on

the opposite ends of the fuel tanks. This contrasts with

vehicles with liquid storable propellants (e.g., Aerozine-50 and

N2O4) where the destruct system is designed to promote the mixing

and consumption of the propellant. Solid rocket destruct systems

usually consist of linear shaped charges running along the length

of the rocket which open up the side of the casing like a clam

shell. This causes an abrupt loss of pressure and thrust. It

may, however, produce many pieces of debris in the form of

burning chunks of propellant and fragments of the motor casing

and engines.

The Titan 34D accident on April 18, 1986, about 8 seconds after

launch, is an example of a propulsion failure which caused

considerable and costly damage to the VAFB facility.(2) In this

case, the solid rocket case failed and the vehicle fragmented and

spread burning propellant over the launch site. Typical debris

velocities were 100 to 300 fps. This Titan 34D failure was the 

10-3
result of a burn-through of one of the rocket motor casings. The

explosion, which occurred at an 800 ft. altitude, was not a

detonation, where there is almost instant burning of propellant

accompanied by a significant air blast, but a deflagration, where

most of the propellant was not consumed in the explosion, but

formed a cloud of flying burning debris. Some of the burning

propellant still encased in a section of the rocket motor did

appear to explode upon impact. The evidence was a flash of light

recorded by a camera, although the camera was not directed at the

point of impact. A series of small craters were also observed

after the accident. It is believed that some of these craters

were formed by violent burning in the soft soil (sand) rather

than by explosions. Films do show rebound of propellant chunks

and shattering upon the rebound. This type of behavior was also

observed in earlier Minuteman failures.

In addition to complete loss of control, there are three other

early flight guidance and control failures that have been

observed with launch vehicles over the life span of the space

program: failure to pitch over, pitching over but flying in the

wrong direction (i.e., failure to roll prior to the pitchover

maneuver) and having the wrong trajectory programmed into the

guidance computer. The likelihood of these circumstances depends

upon the type of guidance and control used during the early

portion of flight. The types are open or closed loop (i.e., no

feedback corrections) and programmer or guidance controlled. In

the case of vehicles which use programming and open-loop guidance

during the first portion of flight, failure to roll and pitch is

possible, although relatively unlikely, based on historical

flight data. If the vehicle fails to pitchover, it rises

vertically until it is destroyed. As it gains altitude, the

destruct debris can spread over an increasingly larger area.

Consequently, most Ranges watch for the pitchover and if it does

not occur before a specified time, they destroy the vehicle

before its debris pattern can pose significant risk to structures

and people outside the launch facility or the region anticipated

to be a hazard zone, where restrictions on airspace and ship

traffic apply. Failure to halt the vehicle within this time can

produce a significant risk to those not associated with launch

operations.

With open-loop Stage 1 guidance, a launch in the wrong direction

can occur due to improper programming or improper roll of the

vehicle during its vertical rise. This circumstance, although

considered improbable, can be very hazardous. If the Range does

not halt the flight immediately, the vehicle could overfly

populated regions. Then, even if the vehicle is normal in every

other respect, it could drop jettisoned stages on populated

areas, creating the potential for damage, injury and loss of

life. The detection of improper launch azimuth is usually

accomplished visually because radar tracking may not be effective

very early in flight. Consequently, in making the decision to 

10-4
halt the flight, the Range must rely on visual observers to relay

information about pitchover and azimuth, with possible timedelays.

With vehicles which are inertially guided from liftoff, failure

in pitchover or roll is unlikely. It is possible, but extremely

unlikely, that an inertially guided vehicle could have the wrong

set of guidance constants, i.e., the wrong trajectory, stored in

its guidance computer. To the observer this will appear the same

as an improper roll (flight azimuth).

If a solid rocket loses thrust or has a change of direction of

the thrust vector, the vehicle control system will try to

compensate with the remaining engines. The result will be an

aberrant corkscrewing behavior until the control system is

totally overwhelmed, and then a tumble. With atmospheric forces

present, the stages should break apart by this time.

Generally, rapid hard-over tumbles of failing vehicles do not

cause the vehicle to move significantly cross-range off the

intended path of flight. It is the gradual turn that is of

greater concern to the Range Safety Officer. If the vehicle

turns slowly, it can move a significant distance cross-Range.

This type of failure is rare and difficult to rationalize with

most flight-tested ELV systems, but the unexpected must be

anticipated. An example of the unexpected is the behavior of the

solid rockets from the Space Shuttle after the failure of the

Challenger.(3) They were supposed to tumble and not offer much of

a dispersal hazard. Instead they turned very little and had to

be destroyed before they could become a threat to a populated

area.

Of greatest concern to Range Safety Control during the steep

ascent phase, is the capability of the vehicle to wander offcourse immediately following a malfunction. The Range Safety

Control system must be able to respond before debris becomes a

hazard. Consequently the design of the destruct lines must take

into consideration: (1) the delay between decision and destruct;

(2) the highest rate that the vehicle can move its IIP toward a

protected area; (3) the effect of the winds; and (4) the

contribution of any explosion to the scatter of debris.

During the early boost phase the vehicle experiences its greatest

aerodynamic loads and heating. As the vehicle accelerates, the

dynamic pressure (1/2 pv2) increases until the decrease in

density (p) due to higher altitude overcomes the effect of

increasing velocity (v). During the period of high airloads the

vehicle is more vulnerable structurally and likely to break apart

if it has a high angle of attack or begins to turn abruptly. The

Space Shuttle, for example, with its complex configuration and

lifting surfaces, is so sensitive during this period that the

liquid propelled main engines are throttled down to keep the 

10-5
dynamic pressure within specified limits. One of the major fears

during this phase is an abrupt change in wind velocity during

ascent (a wind shear). This causes a rapid change in angle of

attack and requires rapid and appropriate response by the control

system.

The potential for damage to ground sites from a launch vehicle

generally decreases with time into flight since fuel is consumed

as the vehicle gains altitude (see Fig.5-6 in Ch.5, Vol.2). If

it breaks up or is destroyed at a higher altitude, the liquid

fuels are more likely to be dispersed and lead to lower

concentrations on the ground. In addition, if there are solid

propellants, they will have been partially consumed during the

flight period prior to the failure and will continue to burn in

free fall after the breakup.

Meteorological conditions contribute to the potential for offsite damage. Temperature inversions and wind shears can cause

shock waves, which normally turn upward, to turn down and

possibly focus at locations distant from the launch site.(4) This

results in significantly higher overpressures locally, than the

overpressures from shockwaves moving in a normal adiabatic

atmosphere (an atmosphere where the temperature decreases with

increasing altitude). Another meteorological influence is the

wind, which can deflect falling debris towards populated areas.

Very early in flight, when the vehicle is still close to the

ground, there is less opportunity for debris to be scattered.

The debris fall within a footprint which is affected by the range

of ballistic coefficients of the pieces, the wind speed and

direction, velocity contributions due to explosion and random

lift (see also Ch.2, Vol.1 and Ch.7, Vol. 2). To understand the

make-up of the debris footprint, first observe the "centerline"

as shown in Figure 10-1.(5) This centerline represents the spread

of debris impact and drag effects when there is no uncertainty

due to wind, lift, etc.

Debris which are very dense and have a high ballistic coefficient

(β) are not as affected by drag and will tend to land closer to

the vacuum IIP. High ballistic coefficients can be associated

with pumps, other compact metal equipment, etc. Panels or pieces

of motor and rocket skin offer a high drag relative to their mass

(a low ballistic coefficient) and consequently slow down much

more rapidly in the atmosphere. After slowing down they tend to

fall and drift with the wind. This effect is also shown in the

figure. A piece of debris with a very low ballistic coefficient

( β=1) is shown to stop its forward flight almost immediately and

drift to impact in the direction of the wind. Pieces having

intermediate value ballistic coefficients show a combination of

effects and fall along a centerline. From a lethality

standpoint, the pieces having a higher ballistic coefficient

impact at a higher velocity and can cause more damage (depending

10-6
upon their size). The debris will not necessarily impact along

the centerline. The velocity impulses at breakup, the wind and

tumbling behavior all contribute to uncertainties about the

impact point. This is illustrated in Figure 10-2.

When all of the factors affecting debris transport and dispersal

to impact are considered at once, the effect is a pattern as

shown in Figure 10-3. The boundaries of the debris dispersion

footprint are not precise but rather represent a contour which

contains, say, 95 percent of the debris. Thus, when considering

the hazard to structures or people on the ground, one must

consider the hazard area for debris impacts in the terms of a

pattern which is dynamic. It grows rapidly as the vehicle gains

altitude, as illustrated in Figure 10-4 for a vehicle launched

from Vandenberg Air Force Base. Note the geography and the fact

that part of the debris pattern dwells over land for a

significant period of time. The time interval that the debris

impact pattern dwells over land depends upon the direction and

strength of the wind. 

If the wind, as in this case, is blowing very hard from the

southwest, the low ballistic coefficient portion of the pattern

will tend to stay over the land. If the wind is blowing from the

northeast, the pattern will move very rapidly out to sea. This

10-7
10-8
10-9
10-10
demonstrates the very important role of wind in evaluating risks

of a launch. Depending on prevailing meteorological conditions,

including clouds, visibility, atmospheric electricity,

temperature and wind conditions, a launch may be postponed until

adverse conditions subside. The bulge in the center of the

growing debris pattern in Figure 10-4 is due to debris which have

velocities imparted to them from an explosion (spontaneous or

destruct action). The upper-right-hand portion of the debris

pattern consists of debris which have a high drag to weight

ratio, slow down quickly and are carried by the wind, which, in

this case, is blowing from the west. Notice how the debris

pattern stretches as the vehicle increases in altitude. This

effect continues until the vehicle reaches an altitude where

aerodynamic drag no longer has an effect on dispersion. 

For all launches, the boosters, sustainers and other expendable

equipment are always jettisoned and fall back to the Earth.

Therefore, in planning a mission, care must be taken to keep

these objects from impacting on land, offshore oil platforms,

aircraft and shipping lanes. The impact locations are normally

quite predictable, so risks can be avoided or minimized.

As mentioned earlier, during the entire history of the space and

missile programs at VAFB and Cape Canaveral/Cape Kennedy, no

errant launch vehicle has ever been allowed to wander over a

populated area near the launch site and deposit debris upon it.

 As a consequence there have been no claims, damages or

casualties. This is a convincing argument in the support of

continued safe launch and mission planning and approval

procedures, reinforced by a reliable Range Safety Control system.

10.2.3 Pre-Orbital Hazards

After jettison of the booster stage and, in some cases, the solid

rockets, the remaining core vehicle usually contains only liquid

propellants and is at a fairly high altitude. If a failure

occurs and no destruct action takes place, the vehicle may fall

and remain largely intact till ground impact. Depending upon the

initial altitude, the airloads during the fall may become

sufficient to contribute to the vehicle breakup. If this occurs,

the propellants will most likely be dispersed and the only hazard

will be from impacting "inert" debris. In the unlikely event

that the tanks do remain intact, some explosion may occur at

impact. If the propellants are hypergolic, as in the case of the

Titan, there may be considerable burning and a cloud appearing in

the impact area. In this latter case, the damage from debris

impact will probably be less than the hazard from the toxic

propellants. When an altitude is reached where the vehicle

stages can no longer remain intact because of airloads and

heating, the only hazard will be due to impacting debris.

10-11
If a destruct or thrust termination system is used to halt

ascent, as is usually the case, the propellants will be dispersed

and should offer very little threat to people on the ground. A

product of the destruct action will be inert debris, which could

present a hazard at ground impact (for fire, explosion and toxic

hazards, see Ch.5, Vol 2).

During the boost trajectory of almost any space vehicle from any

US National Range, the IIP will at some time pass over occupied

land. For Titan 3 launches due east from Cape Canaveral, the IIP

will begin to pass over Africa at t = 475 seconds, and leave

Africa 3 seconds later. For some southerly launches from

Vandenberg Air Force Base, the IIP can pass over southern

Argentina and Chile. Activation of the destruct system is of no

value at this point because it poses risks of land impact. It is

often better to let the failing vehicle continue with the hope

that it will clear the land area and impact in the ocean. The

threat from either launch condition is relatively small because

in both cases the IIP is traveling very fast over land areas

(hundreds of miles per second). If, for example, the failure

rate of the Titan 3 were uniformly 0.000075 failures per second

(historical launch failure probability of .036 divided by 480

sec. of burn operation) and the time required for the IIP to

cross Africa is 3.2 seconds (see Figure 10-5), then the

probability of failing and causing debris to fall on Africa is

3.2 times 7.5 x 10-5 or 2.4 x 10-4 (one chance in approx. 4200).

If the combined cross section of debris which survive to land

impact is on the order of 1000 sq. ft.,and the average density of

population which can be harmed by the debris is 50 per square

statute mile (according to Ref. 5, this figure is higher than the

average of the population densities of Zambia, Angola and

Zimbabwe), then the average number of casualties per launch due

to an African impact is:

Ec =(failure rate)x(dwell time over land)x(debris "casualty

area")x(population density)

= 7.5 x 10-5 x 3.2 x 1000 x (50/52802) = 4 x 10-7

This corresponds to less than one chance in a million of a

casualty per launch. Whereas Range Safety Control systems can

act very positively to restrict and prevent debris from falling

on populated areas earlier in flight, there is no effective risk

control when the flight plan calls for a direct land overflight,

such as the one discussed above. Consequently the casualty

expectation of 8x10-7 is the same with or without a flight

termination system on-board the ELV.

The potential for damage from the impact is based on the area of

falling debris (in this case estimated to be 1000 ft.2) and the

likelihood of impacting a structure of value. With a population 

10-12
density of less than 50 per square mile, the density of such

structures is rather low. As an example, assume the surviving

debris consist of four pieces, each having a cross-section of 250

ft.2, and the average structure is 600 ft.2 with, on the average,

one person per structure. (This is an attempt to account for

both residential and commercial structures very conservatively.)

A structure will be hit if any edge is hit by the debris. This

is pictured in Figure 10-6.

The effective area of impact is therefore a combination of the

structure area and the debris cross-sectional area. In this case

the effective impact area becomes approximately 3400 ft.2. The

probability of any impact on a structure becomes:

Pi =(failure rate)x(dwell time)x(effective impact

area)x(structural density)x(no. of fragments)

= 7.5 x 10-5 x 3.2 x 3400 x (50/52802) x 4 = 5.5 x 10-6.

10-13
Thus, in this example the probability of hitting and damaging a

structure is approximately 1 in 100,000. If a monetary value or

range thereof, were assigned to the structures at risk, then the

expected loss could be tied to both the severity and extent of

damage (the consequence) and to the very low probability of its

occurrence.

A similar analysis can be performed for launches from Vandenberg

Air Force Base (see Figure 10-7) when the IIP passes over the

southern portion of South America.

According to Ref. 7 and to Figures 10-8 and 10-9, an ELV would

have to violate current azimuth restrictions in order to overfly

South America (although some flights may overfly Antarctica or

Australia at much greater altitudes). The dwell or transit time

over Chile and Argentina will be no more than 1.4 seconds. If

all other parameters of the casualty expectation and impact

probability equations are assumed to be the same, then the Ec and

the Pi will be less than those over Africa by the ratio of

1.4/3.2.

10-14
10-15
10-16
Thus, very approximately, the casualty expectation for overflight

over the southern region of South America will be 1.75 x 10-7 and

the impact probability on a dwelling or commercial structure will

be 2.3 x 10-6.

On-orbit collision hazards, once the satellite has been properly

inserted into final orbit, have been discussed in detail in Ch.

7. Similarly, orbital decay and re-entry hazards for satellites

and spent rocket stages have been addressed in Ch. 8. Although

they contribute to the overall space mission- related hazards,

they will not be discussed any further here.

10.3 LAUNCH SITE RISK CONSTRAINTS

The location of the launch facility has a significant impact on

the options for launch missions. Launches to the east always

benefit from the west to east rotation of the Earth.

Consequently, equatorial orbits (0o inclination) are best

achieved by launching from facilities which are near the equator

and have a broad ocean area to the east of the launch site.

Figures 10-8 and 10-9 above, show the acceptable and restricted

azimuths for launches from the USAF Eastern and Western Test

Ranges.(6) It becomes apparent that ETR is best suited for

launches into equatorial orbits and WTR is best suited for

achieving polar orbits.

Launches at ETR can also have inclinations other than 0o. If a

vehicle is launched at an azimuth of 45o from true north, an

orbit with an inclination angle of approximately 47o will result.

A satellite in an orbit inclined at 47o would cover a groundtrack

over the region of the Earth between ±47o latitude. From a risk

standpoint, as the launch azimuth decreases, the locus of IIP

moves closer to the East coast of the US. and Canada. There is

also considerably more overflight of countries in the Eastern

Hemisphere, with potential political and international

repercussions for a space launch accident.

The lowest risk to populated areas is almost always associated

with missions where the launch azimuth is perpendicular to the

coastline and the wind blows in the direction of the launch.

This situation is experienced with many launches at the Eastern

Test Range (from Cape Kennedy or Cape Canaveral). Launches into

polar orbit from Vandenberg Air Force Base have a southerly

launch azimuth, which is perpendicular to the coast at the launch

site, but then moves parallel to the coast as the California

coastline becomes more aligned north to south. Prevailing winds

in the region of the Vandenberg launch site tend to be more

onshore and this must be accounted for in establishing destruct

lines for Range Safety Control.

10-17
10.4 VARIATION OF RISK DUE TO MISSION PROFILE, LAUNCH VEHICLE

AND PAYLOAD

10.4.1 Relative Risks of Missions

Missions can be broadly categorized in terms of their orbital

parameters: inclination, eccentricity, perigee and apogee

altitude. The risks associated with different final orbit

inclinations are those associated with the initial launch azimuth

necessary to support the sequence of boost and transfer

operations needed to achieve the desired final orbit inclination.

The risks associated with launch azimuth and site constraints are

discussed in Section 10.3. Satellites will re-enter within a few

years due to orbital decay from Low Earth Orbits (LEO), but will

not from geosynchronous orbits (GEO) (See Ch. 8). Thus

geosynchronous orbits offer considerably less risk from the reentry hazard. The ELV launching a satellite into a

geosynchronous orbit must carry more propellant in the initial

orbiting vehicle and more stages. The additional propellant in

the upper stage (up to a factor of 3) may increase the hazard by

a proportionate fraction (percent) for launch accidents on or

near the ground. Moreover, insertion of a payload into GEO

involves more orbital maneuvers, more stages and a greater fuel

load, hence greater overall risk of failing hardware and mission

failure. For example, payload delivery to GEO orbit, as shown in

Figure 10-12, involves firing an apogee kick motor (AKM) and a

perigee kick motor (PKM).

10-18
However, even if the mission fails to insert the payload into the

correct final orbit, public hazards may not increase unless a

highly elliptical transfer orbit leads to early uncontrolled reentry of upper stages and payload or an on-orbit explosion

creates collision hazards for GEO and LEO operational satellites.

However, for accidents at high altitude when the vehicle is near

orbital, the vehicle with a geosynchronous orbit destination will

have less inert debris and the propellant will probably be

consumed before ground impact. Hence, in this case, the Low

Earth Orbit vehicle will have a larger casualty area and offer a

somewhat greater overall risk. In general, the changes in risk

level due to the mission profile are relatively small, with the

exception of missions requiring restricted azimuths or riskier

staging and orbital maneuvers for achieving the mission

objective.

10.4.2 Hazardous Characteristics of Typical ELV's

Two ELV's, Atlas/Centaur and Titan III, are the primary subjects

of this discussion, although the Delta is also discussed briefly.

They offer a broad range of payload lift capacity, they are the

largest of the currently available vehicles and they present a

variety of propulsion types and representative associated

hazards. Furthermore, a hazard analysis for two plausible

accident scenarios, based on a typical Delta vehicle and flight

profile as a function of time after launch and down-range and

altitude evolution, was presented earlier in Figs. 5-5, 5-6 of

Ch.5, Vol.2.

10.4.2.1 Titan - The basic Titan III is illustrated in Ch. 5,

Figure 5-4. Its central core vehicle consists of two liquid fuel

stages, a Transtage and a payload. Two solid rockets (zero

stage) are attached to the first core stage and these fire at

liftoff and continue until their fuel is consumed. The first

core stage is ignited near the end of the solid rocket burn

(about 108 seconds after lift-off). After the solid rocket fuel

is depleted and the first stage ignites, the empty solid motors

are jettisoned (approximately 116 seconds after liftoff). The

first stage continues to burn until approximately 273 seconds

after liftoff, when its fuel is depleted and the stage is

jettisoned. The fairing around the payload is also jettisoned at

this time to reduce the weight that will have to be accelerated

by the core second stage engine. The fairing is used to reduce

the drag and protect the payload during ascent in the atmosphere.

At the time of jettison, the vehicle is at an altitude of 400,000

feet (130 km) and is essentially out of the atmosphere. The

second core stage fires up immediately and thrusts for 216

seconds. The Transtage has a restartable rocket motor used for 

10-19
orbital maneuvers. Various upper stages can be added for mission

and payload flexibility.

During a normal mission, the only risks offered by the Titan are

from vehicle hardware which is jettisoned. The impact locations

and the approximate locus of IIP for launches from Cape Canaveral

are shown in the map in Figure 10-5. The Stage 1 engine covers

are not shown there, but are dropped off during the zero-stage

solid rocket motor phase of flight. This particular launch

trajectory is intended to have a minimum inclination angle in

order to support transfer to a geosynchronous orbit.

The impact locations and the approximate locus of IIP for a Titan

launch from Vandenberg Air Force Base are shown in the map in

Figure 10-7. The requirements for "polar" orbits may not

actually need fly over of the poles, but rather very high

inclination angles, such as 70o. In addition, launches with

inclination angles lower than 90o from VAFB can have larger

payloads. Consequently, launches from VAFB may have a range of

launch azimuths, as indicated in Figure 10-7, depending on the

minimum orbital plane inclination angle.

The liquid fuels which propel the core vehicle and Transtage of

the Titan are non-cryogenic and storable: Aerozine-50 and

nitrogen tetroxide used in the core vehicle are highly toxic, if

released by accidental venting or a spill (see Appendix B and

Ch.5, Vol.2). Pre-launch and launch hazards are controlled by

handling and storage regulations and by specifying optimal

weather conditions for launch which permit toxic vapors and plume

dispersal in case of an accident. If the vehicle is destroyed,

these hypergolic propellants do not react as energetically as

cryogenic propellants. The spontaneous ignition does not allow

them to mix before igniting and, consequently, they burn, but

have no significant explosion. However, there was an exception:

On March 16, 1982, a Titan II, which is basically the first two

core stages of the Titan 3, blew up in its silo at Little Rock

Air Force Base near Damascus, Arkansas. A very significant

explosion resulted which destroyed the entire facility. The

magnitude of the explosion was ascribed to the confinement

provided by the silo, which did not permit the propellants to

scatter while burning. On the other hand, tests of the destruct

system of the Titan have generally indicated that the unconfined

burning propellants have very little explosive energy.

The more pressing problem with Titan liquid propellants is their

toxicity and corrosivity. The destruction of the vehicle may

produce a white and reddish-brown (Aerozine-50 and N2O4) cloud

which is very toxic and also very harmful to vegetation.

In addition to the liquid propellants, the Titan has strap-on

solid propellant motors (similar to the Space Shuttle). The

10-20
emissions from these engines also contain contaminants which, in

high concentrations, can be detrimental to agriculture. The main

hazard associated with the solid rockets is their explosiveness,

the resulting overpressure and the spread of burning debris.

Unlike liquid rockets, solid rockets, once ignited, cannot be

shut down without being destroyed. Destruct action will always

produce a conflagration and dispersion of burning debris. An

impact test of an intact Titan solid rocket booster in 1967

indicated that the resulting explosion would be equivalent to TNT

having a weight of 7.5 percent of the weight of the propellant in

the rocket.(7) Some individuals in the explosive safety field

believe, that under the right circumstances, this equivalent

yield could be doubled. Others have the opinion that, without

impact at a significant velocity, the stage will have no TNT

equivalence (see also Ch.5, Vol.2, for a discussion of yield

uncertainties).

10.4.2.2 Atlas/Centaur - The Atlas/Centaur is illustrated in

Figure 5-7. It is basically a two-stage vehicle consisting of an

Atlas first stage and a Centaur upper stage. The Atlas is a

liquid oxygen (cryogenic) and RP-1 (hydrocarbon) powered vehicle

while the Centaur upper stage is powered by liquid oxygen and

liquid hydrogen. Neither vehicle offers a toxic threat, but both

are volatile, particularly the hydrogen/oxygen Centaur stage. The

primary hazards are blast overpressure and debris from a

potential explosion.

At lift-off, the Atlas has thrust provided by three rocket

engines. After 155 seconds of flight, the two outer engines

(called the boosters) are shut down and jettisoned on rails (3

seconds later). The remaining sustainer engine, which is

designed to be more efficient at higher altitudes, continues

until all of the fuel has been consumed. During sustainer

operation, equipment which served a purpose during the operation

within the atmosphere is also jettisoned. Once the sustainer

engine is shut down, the Atlas stage is jettisoned, the Centaur

engines are ignited and the flight continues. The Centaur has

two burn periods, the first to place the Centaur and payload into

orbit and the second to put the Centaur and payload into a

transfer orbit. The Centaur is separated from the payload while

in the transfer orbit. A solid propellant rocket (Apogee Kick

Motor or AKM) on the payload may provide the final thrust to

place the payload in the geosynchronous orbit; other payloads may

use a liquid fueled motor for final GEO emplacement.

The same two missions which were discussed for the Titan are

considered, one producing a low polar orbit and the other

producing a high equatorial orbit (geosynchronous). The

Atlas/Centaur is a smaller vehicle than Titan and can place about

40 percent of the Titan payload in a geosynchronous orbit.

Figures 10-10 and 10-11 show the IIP loci for Atlas/Centaur

10-21
10-22
10-23
missions from ESMC and WSMC during the pre-orbital phase. During

a normal mission, the only hazards associated with the

Atlas/Centaur launch are from the jettisoned spent stages, whose

impact locations are shown in the figures.

The sequence of orbital events for an Atlas/Centaur FLTSATCOM

mission is shown above in Figure 10-12.(3) This is a mission very

similar to any other Atlas/Centaur geosynchronous mission,

although in this particular case, there is no initial parking

orbit. The vehicle, after becoming orbital, continues to

accelerate directly into the transfer orbit. Note from Figure

10-12 that the Apogee Kick Motor burn also provides the plane

change necessary to achieve an equatorial geosynchronous final

orbit.

The hazard potential for the Atlas/Centaur launch will decrease

with time into mission as the vehicle and payload gain altitude

and propellant is consumed (see Figs. 5-5 and 5-6 in Ch.5,

illustrating the risk vs. time for a Delta vehicle). The RP-1

propellant will not be absorbed into the atmosphere, but it will

become more widely dispersed as the vehicle reaches a higher

altitude. Note that RP-1 fuel is not toxic or corrosive in the

same sense as hypergolic liquid propellants.

Fewer pieces of debris are expected from an Atlas/Centaur

destruct than for a Titan. This is because of its smaller size

and it uses only liquid rocket engines. However, the structure

of the Atlas is more fragile than that of the Titan and will most

likely break into more pieces than the Titan core vehicle. The

very thin Atlas skin pieces will probably scatter more in the

wind than the Titan pieces and, consequently, the low ballistic

coefficient portion of the Atlas debris pattern will show greater

dispersion. In this case, greater dispersion does not mean

greater risk to ground objects since Atlas debris are lighter and

smaller.

If a failure occurs during the Centaur sustainer burn phase of

the flight and no destruct action takes place, the vehicle may

remain somewhat intact, depending upon its altitude at that time

and on the nature of the failure. Normally, the airloads during

the fall will cause vehicle breakup. If this occurs, the

propellants will be dispersed and the only hazard will be from

impacting "inert" debris. If the tanks were to remain intact,

some explosion might occur at ground impacts. However, it is

very unlikely that the tanks will remain intact under high

airloads given their structural vulnerability.

The principal hazard anticipated is damage from impacting debris.

If the vehicle is destroyed by a destruct command, there will be 

10-24
more numerous pieces of debris, but the vehicle will not have

been allowed to wander over a possibly populated area.

For launches of geosynchronous satellites from Cape Canaveral,

the IIP will move over Africa late in pre-orbital flight, as

described for the Titan in Section 10.2.3. The previous

discussion of debris impact hazards to Africa and South America

is also applicable to Atlas/Centaur, except that it will have

less massive debris and the risks may be reduced by as much as a

factor of two.

10.4.2.3 Delta - The Delta launch vehicle offers the variety of

propellants and components of both the Titan and the

Atlas/Centaur vehicles. The Delta has strap-on solid propellant

boosters (Castor 4 for Stage 0), a core booster stage (Stage 1)

which uses cryogenic liquid oxygen and RP-1, an upper stage

(Stage 2) which uses liquid storable propellants (Aerozine-50 and

N2O4) and a Stage 3 which has a solid rocket motor. The Delta has

been launched in a variety of configurations with different

numbers of solid rocket boosters and different upper stages. For

example, the enhanced Delta configuration, illustrated in Ch.4,

Vol.1, has the capability to place 5,500 lbs. of payload into a

Low Earth Orbit and 2,800 lbs. of payload in a Geosynchronous

Transfer Orbit. The hazards from a typical Delta launch failure

have been discussed qualitatively and illustrated quantitatively

in Ch.5, Vol.2. 

From a comparative risk standpoint, most of the elements of the

Delta are on a smaller scale, but there are more of them: there

is considerably less hypergolic propellant than on the Titan (

see Ch.4 and App. B); there are solid boosters as on the Titan,

but they are much smaller and more numerous; there is also less

cryogenic propellant in the vehicle than the Atlas/Centaur and

there is no explosive and combustible liquid hydrogen fuel. A

strap-down inertial guidance system provides guidance throughout

booster and upper stage flight. The Delta was considered the

most reliable ELV by NASA with an overall failure rate of 6.7

percent, due to 12 failures out of 181 launches; only four launch

failures required destruct action. Only six failures led to reentry of various stages and payload and only one of the six led

to ground impact, but no damage was reported (see Table 3-5, Cap.

3, Vol. 1). A discussion of ELV reliability and the implications

for public safety from the historical launch statistics were also

discussed in Ch.3, Vol.1) The most recent launch accident (Delta

178, on May 3, 1986, at Cape Canaveral) occurred 71 seconds after

launch when the main engine was prematurely shut-off by an

electrical short, the vehicle tumbled out of control and had to

be destroyed by Range Safety (see Ref.to Mishap Report, Ch.9).

The NOAA weather satellite GOES-G payload was destroyed; no

damage or injury resulted from debris.

10-25
10.4.3 Payload Contributions to Launch and Mission Risk

The payload can contribute to overall launch and mission hazards

in several ways:

(1) The payload can initiate a malfunction in the launch

vehicle by causing a failure (e.g., electrical short or

surge) or an explosion during launch which could affect

the rest of the vehicle. Generally, the payload is

unlikely to cause a launch vehicle failure.

(2) The payload could contribute to the amount of the

hazardous material resulting from the accident.

Normally this would be in the form of propellant, but

if a nuclear heat source is considered, the debris from

an accident could present a significant radioactive

hazard (see Chs. 7 and 8).

(3) The payload could re-enter and impact on land along

with other destruct debris, in case of a launch failure

that requires destruct action.

Any payload-related hazards to the public will have to be

identified, examined, quantified and managed to tolerable levels

as part of the DOT/ OCST licensing safety audit (see Ch.1,

Vol.1). 

10.5 BENEFITS OF RANGE SAFETY CONTROL

10.5.1 Range Safety Control System Reliability

Range Safety Control systems have played a very important role in

the success of the space program. Combined with an outstanding

Risk Prevention and Control program, their success has been such

that there have been no casualties resulting from in-flight

launch vehicle failures. As mentioned in Ch. 4, this is due to

both mission planning and to the design standards and performance

reliability of the Flight Termination Systems (FTS). The USAF

design goal for FTS hardware reliability is .999 at a 95%

confidence level for WSMC and ESMC, whereas the WSMR design goal

for sub-orbital ELV's is .997 to the same confidence level (see

Ch.8 and Ch.9 discussions of reliability vs. safety).

Performance testing and verification of the FTS reliability

depends on the number of such failures, environmental stress

during testing or accident and on other accident specifics. The

reliability that has been achieved is due in part to the

redundancies built into both the ground and airborne components

of the systems. There are no published figures on the

operational reliability of Range Safety systems, but with

hundreds of vehicles destroyed with no system failures, one could

conclude that the probability of system failure is less than 1 in

1000.

10-26
10.5.2 Loss and Casualty Potential When Range Safety Controls

Are Not Used

The following is intended to discuss worst case loss situations

for space launches, assuming that vehicles are launched and fail

over communities and that Range Safety Controls ( chiefly a

Flight Termination System provided on-board the ELV, as described

in Ch.2, Vol.1) are not in place. A computer model, Community

Damage (COMDAM), was developed for this special purpose. The

concept for this model is shown in Figure 10-13.

10-27
The model is deterministic, not probabilistic (see Ch. 8), i.e.,

given a catastrophic ELV failure and the absence of a destruct

system, it examines the nature and severity of possible

consequences of interest, namely a conditional casualty

expectation. In reality, implementation of Range Safety

restricts launch azimuths as well as decreasing the likelihood of

any accident that could have public impacts (see Ch.9).

The launch vehicle is assumed to overfly and fail above a

community located in the vicinity of the Range. This model might

apply to evaluating damage from debris impacting in the vicinity

of a Range, say, to Santa Barbara or the Channel Islands near

WSMC, or to Miami Beach near ESMC, or to Albuquerque near WSMR.

These scenarios are obviously unrealistic because launch vehicles

are neither allowed to overfly populated areas nor allowed to

proceed without certified Flight Termination Systems. On the

other hand, COMDAM may afford insight into the potential of

unconstrained launch operations for accidental casualty and

property loss.

For simplicity, the hypothetical community at risk is laid out as

a square, with several types of structures spaced evenly over the

area within the community boundaries. The ELV is assumed to fail

and break into pieces spontaneously due to aerodynamic stress.

These fragments must be classified according to their ballistic

coefficient and explosiveness (if solid propellant). The debris

can be dispersed by scattering (lift/drag) effects and velocity

impulses which may be imparted to the debris at the time of an

explosive in-flight failure. If a piece of debris impacts the

ground and explodes, the overpressure (P) and impulse (I) are

computed on all of the adjoining structures (see also Ch.5,

Vol.2). The explosive damage to each structure is computed using

the formula D = a(Pb)(Ic), where D is the percent damage and the

coefficients a, b and c are unique for each different structure

class and were developed from data gathered from explosive

accidents.(9,10) If the structure is calculated to be more than

sixty percent damaged, it is assumed that it must be totally

replaced and, thus, equivalent to being 100% damaged. The dollar

loss is obtained by multiplying percent damage times the average

building value.

For damage due to inert (non-explosive) debris, kinetic energy

thresholds are set. If the kinetic energy of an impact fragment

did not exceed a pre-specified level, it is assumed not to

penetrate the structure and cause any damage. If it did exceed

the threshold, the damage to the structure is assumed to be the

ratio of the area of the fragment to the projected area of the

structure. Casualty expectations, EC, were computed using the

model developed in Ref. 13.

10-28
The flow diagram for this specifically adopted analytical

procedure is shown in Figure 10-14. These algorithms and logic

can be programmed and used to estimate the approximate expected

losses and casualties similar to those discussed above. One of

the reasons for developing such an unrealistic worst-case

consequence model was to show several effects, such as:

1) the change in total losses as a function of the time of

launch vehicle failure:

2) the effect of the distance from the point of launch on

the population center at risk; and

3) the influence of exploding debris.

The COMDAM numbers must be treated as approximate at best, and

illustrative only, since no specific community has been

considered and the consequences of accidents can vary

significantly even under essentially the same conditions. The

financial (dollar loss) consequence estimates consider only

damage, and not business interruption costs.

It should be noted that the above model accounts for structural

damage produced by:

1- direct impact of inert fragments

2- blasts triggered by the explosion of burning fragments

upon impact with ground.

Damage mechanisms not included in the model are:

a- fires initiated by burning fragments upon impact with

ground (e.g., brush fires, gas main explosions and

fires).

b- vapor clouds produced by burnt/unburned propellants.

c- blast and fire ball produced in the air at the instant

of vehicle breakup.

This COMDAM model does not predict what would occur

realistically, but rather what is the worst that could happen.

With the addition of launch azimuth restrictions enforced to

avoid land overflight, the provision of a highly reliable FTS onboard the ELV and an effective ground-based Range Safety Control

network, such public damage and casualties as a consequence of

launch accidents become highly unlikely.

10-29
10-30
10.5.3 Comparison of Risk Acceptability

MIL-STD-882B provides only qualitative definitions of the

severity and frequency of accidents for the purpose of risk

assessment.(12) These definitions are reproduced in Tables 10-1

and 10-2, since they could be used to demonstrate the relative

acceptability of risks from launch vehicles both with and without

Range Safety Controls in place.

Although these qualitative definitions apply to military systems

including space system certification, acceptance and failure risk

analysis, they can also be applied to hazard assessment for

commercial launches.

Tables 10-3 and 10-4 give two examples from MIL-STD-882B for risk

acceptability, in the form of a hazard risk assessment matrix.(12)

The next step is to find the risk associated with ELV launches in

the hazard frequency/acceptability format exhibited in the

previous four tables. When a vehicle (e.g., Titan, Atlas/Centaur

or Delta) is not under Range Safety Control, there is potential

for catastrophe if the vehicle fails fairly early in flight near

or over a community. Since all prospective commercial launch

vehicles have a historical launch failure frequency of more than

4 percent (range from 4 to 14 percent) (see Ch. 3, Vol 1), this

must be considered an "occasional event." With the Range Safety

Control System in place, there is potential for catastrophe only

when this system fails to perform its function. Given the proven

reliability of modern Range Safety Control systems, the

occurrence of a accidental failure with major public safety

impacts must be considered improbable or remote.

As the vehicle progresses from launch toward achieving orbit, the

associated risk to the public is reduced, as discussed in Section

10.2.3. At this stage the Range Safety System provides little or

no benefit, because the debris produced from high altitude

destruct action will be similar to that without destruct and

there is no way to restrict the impact location of the debris.

Consequently, both with and without a Range Safety Control

System, the risk to the public is approximately the same in the

pre-orbital and orbital stage, a marginal hazard with a remote

probability of occurrence. In returning from orbit (uncontrolled

re-entry), there is no possibility of Range Safety Control and

the public risk is again marginal, with a remote probability of

debris causing any casualties.

10-31
10-32
10-33
These conclusions about the relative public risks associated with

ELV launches are summarized in Table 10-5 using the definitions

of hazard, frequency and acceptability as specified in MIL-STD882B.(12)

The conclusion is that a Range Safety Control Systems must be in

place so that normal, though relatively low probability, launch

failures become tolerable and permissible from the point-of-view

of public safety.

Figure 10-15, reproduced from Ref 14, is a Public Launch Hazard

Event Tree based on ESMC launch experience, but it also applies

conceptually to the other National Ranges. It shows that a long

chain of failure events must take place to expose the public to

launch or overflight hazards. Conditional probabilities and

branching of events are also indicated. This type of analysis

will be applied to evaluate the safety risks associated with

specific ELV's, launch sites and missions.

10-34
10-35
REFERENCES TO CHAPTER 10

1. "Explosive Safety Standard," AFR 127-100, Headquarters,

United States Air Force, Washington, D.C., May 20, 1983.

2. a) "Titan Analysis Unable to Show Cause of Insulation

Separation from Casing," Av. Week and Space

Technology, July 7, 1986.

b) "Titan Accident Disrupts Military Space Program,"

Science 232, 702, May 9, 1986.

c) "Air Force Determines Potential Cause of Titan

Explosion," Science 233, 78 July 18, 1986.

d) "Titan Solid Booster Failure Caused Vandenberg

Accident," Av. Week and Space Technology, p. 24, May 5,

1986.

3. Report of the Presidential Commission on the Space Shuttle

Challenger Accident, June 6, 1986, Washington, D.C.

4. Baecker, James B., William F. Heubach and J. Richard

Westlake, "Blast Overpressure Window Breakage and Casualty

Modeling," Report No. 85-3119-2, J. H. Wiggins Co., Redondo

Beach, California, September 1985.

5. Collins, Jon D., Moroni Jameson Jr. and J.L. Jantz, "RealTime Debris Patterns for Ballistic Missile Launches,"

Journal of Spacecraft and Rockets, 13, No. 5, May 1976, pp.

310-315.

6. Espenshade, Edward B. Jr. and Joel L. Morrison, Goode's

World Atlas, 17th Edition, Rand McNally and Corp., New York,

1986.

7. Hazard, Hap (edited by Heizz F. Gehlhaar and Lt. Ronald G.

Higden), US Space Launch Systems (Rev. 2), Navy Space

Systems Activity, Los Angeles, California, July 1, 1977.

8. Vorwerk, Robert F. and Frederick Weals, "624A Solid

Propellant Motor Impact Test," Technical Progress Report No.

381, NOTS TP3674, US Naval Ordinance Test Station, China

Lake, California, October 1964.

9. "Range Safety and Range Planning Trajectory Data for the AC68/F-8 Atlas G/Centaur FLTSATCOM Follow-On Mission," Report

No. GDSS-SP-87-010, General Dynamics Space Systems Division,

San Diego, California, May 1987.

10-36
10. Tancreto, J.E., "Risk Quantification - Part I - Structural

Damage: State of the Art," TM No. 51-81-02, US Naval Civil

Engineering Laboratory, Pt. Hueneme, California, January

1981.

11. Harnitchek, John J. and Jon D. Collins, "Risk Analysis of

Titan Launches Over SLC 6," Federal Electric Corporation,

Vandenberg Air Force Base, California, March 31, 1987.

12. "Military Standard, System Safety Program Requirements,"

MIL-STD-882B, US Dept. of Defense, March 30, 1983.

13. Baeker, J.B., J.D. Collins and J.M. Haber, "Launch Risk

Analysis," Journal of Spacecraft and Rockets, 14, pp. 733-

738, Dec. 1977.

14. "Baseline Assessment - ESMC," RTI Draft Report for DOT/OCST,

May 1988.

10-37
10/2/95 rev

APPENDIX A

GLOSSARY AND DEFINITION OF TERMS

Many documents have been referenced to obtain the definitions of

terms that are used in this document. In most cases, the

definitions from the referenced documents have been used

directly, while others have been modified to more fully apply to

the text herein, and where appropriate, some have been developed

by the authors.

The referenced documents are as follows:

1. AFETRM 127-1, Sept. 1972

2. MIL-STD-882, March 30, 1984

3. WSMCR 127-1, May 15, 1985

4. ESMCR 127-1, July 30, 1984

5. NASA GHB 1771.1, Sept. 14, 1984

6. Federal Register, Vol. 51, No. 38, Part 401.5

7. Public Law 98-575, Oct. 30, 1984

8. UMTA System Safety Glossary, June,1986

9. The Aerospace Age Dictionary, 1965

10. The Dictionary of Space Technology, by J.A. Angelo Jr., 

1982

11. CPIA 394, Sept. 1984

A-1
ACCIDENT (MISHAP) - An unplanned and undesirable event

that results in injury; death (casualty) or damage to

facilities, equipment, the launch vehicle or public

property.

ANALYSIS - Technical procedure, following a prescribed

pattern.

ASSESSMENT - Consideration of the results of an analysis

in a broader context to determine and evaluate their

significance.

AEROZINE-50 ( A-50) - A liquid propellant fuel; a mixture

of 50% (by weight) hydrazine and 50% asymmetrical

dimethylhydrazine.

AVERAGE FAILURE RATE - Frequency of failure averaged over

the time interval of operation (or the number of duty

cycles) for a component, system or subsystem.

BLAST - Brief and rapid movement of air or fluid away from

a center of outward pressure, as in an explosion; the

pressure accompanying this movement.

CASUALTY EXPECTATION - The probability of a casualty for

a probable (or credible) accident scenario under

consideration

CREDIBLE CONDITION - A condition that can occur and is

reasonably likely to occur.

CREDIBLE ACCIDENT - A probable, possible and/or plausible

accident scenario, or sequence of failure events which can

lead to the occurrence of accidents.

CREDIBLE FAILURE - A failure mode which can be foreseen as

possible and probable.

CRITICAL DIAMETER - The diameter of a confined or

unconfined material below which an explosive reaction will

not propagate when subjected to induced shock.

CRITICAL FUNCTION - As applied to nuclear and space launch

systems, those functions which apply directly to, or

control, mission success or failure (e.g., functions that

enable, pre-arm, arm, unlock, release or guide).

CRYOGEN - A liquid which boils at temperatures of less

than about 114°K (- 254.4°F) at atmospheric pressure, e.g.,

hydrogen, helium, nitrogen, oxygen, air or methane.

A-2
DAMAGE - A loss, negative outcome or undesirable impact of

an accident. May refer to equipment, property, monetary or

production loss.

DEFLAGRATE - Burn at a rapid rate, but below the speed of

sound in the unreacted medium.

DELPHI ANALYSIS - A method of risk assessment which

requires experts' opinions and consensus-building; term

derives from the ancient Greek Delphi oracle which could

predict the future.

DETONATION - An exothermic reaction that propagates with

such speed that the rate of advance of the reaction zone

into the unreacted material exceeds the velocity of sound in

the unreacted material. The rate of advance of the reaction

zone is termed detonation velocity. When this rate of

advance attains a value that will continue without

diminution through the unreacted material, it is termed the

stable detonation velocity. When the detonation velocity is

equal to or greater than the stable detonation velocity of

the explosive, the reaction is termed a "high order"

detonation. When it is lower, the reaction is termed a "low

order" detonation.

DEVIATION - An alternate method of compliance with the

intent of satisfying specific requirements. A procedure

differing from established norms and practices.

DYNAMIC PRESSURE - The air pressure which results from the

mass air flow (or wind) behind the shock front of a blast

wave. It is equal to the product of half the density of the

air through which the blast wave passed and the square of

the particle (or wind) velocity behind the shock front as it

impinges on the object or structure.

EQUIVALENT WEIGHT (EW) - The amount of a standard

explosive which, when detonated, will produce a blast effect

comparable to that which results at the same distance from

the detonation or explosion of a given amount of material

whose performance is being evaluated. It is usually

expressed as a percentage of the total weight of all

reactive materials contained in the item or system. It is

conventional to use TNT for comparison.

EVENT - A specific occurrence that is defined by a time

and location.

EXPECTED LOSS - The probable loss or damage/casualty level

for the accident scenario under consideration.

A-3
EXPENDABLE LAUNCH VEHICLE (ELV) - A launch vehicle

(configuration of rocket motors) intended to be used only

once, because the majority of its components are expected to

be destroyed or discarded after the launch, during orbit

insertion and/or re-entry.

EXPLOSION - A rapid expansion of matter into a volume

greater than its original one, accompanied (in air) by loud

sounds.

EXPLOSIVE - Any chemical compound or mechanical mixture

which, when subjected to heat, impact, friction, detonation

or other suitable initiation, undergoes a very rapid

chemical change with the production of large volumes of

highly heated gases which exert pressures in the surrounding

medium. The term applies to materials that either detonate

or deflagrate.

FAILURE - A condition of a component, subsystem or system

in which the intended design or specified operation is not

met.

FAILURE ANALYSIS - The process by which the cause, effect,

responsibility and cost of an accident is determined and

reported. A method to identify the types of faults or

malfunctions that may occur and lead to accidents.

FAILURE MODE - A specific failure for a critical

component, subsystem or system which can be foreseen or

identified .

FAILURE MODE AND EFFECT ANALYSIS (FMEA) - An inductive

procedure in which potential malfunctions are identified and

then analyzed as to their possible effects.

FAULT TREE ANALYSIS (FTA) - A deductive analysis procedure

which graphically presents all possible sequences of

failures and chains of events which can result in the final

undesired event (accident) at the top of the tree; used to

determine possible and most probable causes.

FIREBALL - A more or less spherical ball of flames

produced by the instantaneous release, evaporation and

ignition of propellants. Generally, the fireball expands

and rises in the atmosphere until the propellant is

consumed.

FIREBRAND - A projected burning or hot fragment whose

thermal energy is transferred to a receptor.

A-4
FLAMMABLE LIMITS - The upper and lower vapor

concentrations of fuel to air which will ignite and burn

(i.e., deflagrate) in the presence of external ignition

sources; often referred to as the explosive range, although

they are not identical.

FLASH EVAPORATION - The changing of a liquid propellant

into a gas when the external pressure is released during the

rupture of a vessel.

FLIGHT - That period of time beginning with engine

ignition and continuing until earth impact for suborbital or

orbital trajectories, or indefinitely for deep space

trajectories.

FLIGHT AZIMUTH - The angular direction of the launch and

flight trajectory of a launch vehicle measured in degrees

from true north.

FLIGHT CORRIDOR - Two-dimensional area on Earth's surface

(ground track) above which a launch vehicle can fly safely.

FLIGHT PATH - The path traversed through the atmosphere or

through space by a launch vehicle or spacecraft.

FLIGHT PLAN - Description of the proposed launch and its

events, including description and definition of payload

orbit.

FLIGHT SAFETY - Protection of the public health and safety

and safety of property during the flight of the launch

vehicle and its payload.

FLIGHT TERMINATION SYSTEM (FTS) - Explosive or other

disabling equipment installed in the ELV stages plus

associated ground equipment for tracking and terminating the

flight should it become necessary in order to protect people

and property on the ground from a malfunctioning ELV. Also

called Flight Safety Control System. A Thrust Termination

System is a special type of FTS which shuts down the

propulsion system.

GEO - Geosynchronous or Geostationary Earth orbit;

equatorial, high altitude Earth orbits in which a satellite

rotates with Earth's spin period, thus appearing stationary

with respect to its sub-Earth point.

A-5
GROUND TRACK - The projection of a spacecraft launch,

flight and orbital trajectory onto the surface of the Earth,

traced by the motion of its sub- Earth point. 

HAZARD - Any existing or potential condition that can

cause injury or death, that leads to risk of damage to or

loss of equipment or property. Also; A source of potential

damage or harm, in case of an accident.

HAZARD ANALYSIS - An analysis performed to identify

hazardous conditions for the purpose of their elimination or

control.

HAZARD MANAGEMENT - An element of the system safety

management function that evaluates the safety effects of

potential hazards by considering acceptance, control or

elimination of such hazards.

HAZARDOUS CONDITION - A situation where, because of the

nature of the equipment, facilities, personnel, environment

or operation being performed, there is a potential for an

accident. For example, hazardous conditions may exist:

1. During propellant transfer to or from the ELV, whenever

work is in progress on a rocket containing propellant and

whenever a solid propellant motor is in a propulsive state.

2. During installation, electrical connection, testing and

handling of ordinance items also, while ordinance items are

electrically connected in the missile.

3. Whenever vehicle pressurization systems fail to satisfy

safety factors.

4. Whenever any toxic or flammable materials are used for

any purpose in ELV handling areas.

5. Any time that electrical storms are within five miles

of the launch complex.

HAZARDOUS EVENT - An accidental occurrence that endangers

people or property 

HAZARDOUS EVENT PROBABILITY - The likelihood, expressed in

quantitative terms, that a hazardous event will occur. Both

units of frequency, (1/ time) and probability

(dimensionless), can be used. See also next entry.

A-6
HAZARD PROBABILITY - The probability that a hazard will

occur during the planned life or operation of the system. 

Hazard probability may also be expressed in qualitative

terms using a relative ranking system, such as:

A. Frequent

B. Probable

C. Occasional

D. Remote

E. Improbable

F. Impossible

HAZARD SEVERITY - A qualitative measure of the potential

consequences that could be caused by a specific hazard in

case of an accident. An example of a hazard severity

ranking system is:

A. Catastrophic

B. Critical

C. Marginal

D. Negligible

HYPERGOLIC - Term applied to the self ignition of a fuel

and an oxidizer upon mixing with each other without a spark

or other external aid.

IGNITION TEMPERATURE - The mean temperature at which a

combustible material can be ignited and will continue to

burn when the ignition source is removed. 

 The ignition temperature for any one substance will vary

with its particle size, confinement, moisture content and

ambient temperature.

IMPACT AREA - An area surrounding an approved impact point

for vehicle stages under normal operation or for destructed

vehicle debris. The extent and configuration of the area is

based upon the vehicle or stage dispersion characteristics.

IMPACT LIMIT LINE - A predetermined line defining a limit

beyond which a failed ELV or its jettisoned spent stages

will not be allowed to impact on the ground, in order to

protect people or property.

IMPULSE - Blast wave parameter denoting the integral of

pressure over pulse duration. It may be positive or

negative depending on whether the pressure is above or below

ambient.

A-7
LAUNCH - Release a powered rocket/spacecraft from a

specially designed launch pad or platform.

LAUNCH ABORT - Premature and abrupt termination of a

launch operation because of a potential or diagnosed failure

of the launch system or noncompliance with the launch safety

requirements.

LAUNCH ACTIVITY - The preparation, test or execution of

launch; the operation of a launch site or both.

LAUNCH AZIMUTH - The horizontal angular direction

initially taken by a launch vehicle at lift-off, measured

clockwise in degrees from true north (see flight azimuth).

LAUNCH COMPLEX - The facility, usually fenced, which

contains the ELV launch facilities including: the launch

pad and servicing structures, the blockhouse or control

building, propellant transfer equipment, support buildings

(e.g., vehicle assembly building, VAB) required to support a

launch.

LAUNCH CONTROL CENTER (LCC) - The facility from which

launch operations are conducted and monitored.

LAUNCH CONTROL OFFICER - The individual who supervises and

coordinates activities in the launch complex during

prelaunch and post-launch. Also called Range Safety Officer

(RSO).

LAUNCH OPERATION - Site, personnel, procedures, equipment

and vehicles, which are collectively used for launch

preparation or launch of a launch vehicle.

LAUNCH PROPERTY - Propellants, launch vehicles and

components thereof and other physical items constructed for,

or used in, the preparation or launch of a launch vehicle.

LAUNCH RANGE - A finite area along the path of a launch

vehicle beginning at a launch site and ending at a point

where the vehicle impacts on Earth, achieves orbit or

reaches escape velocity. Includes instrumentation

throughout that area used to monitor the flight of the

launch vehicle for safety and other purposes.

LAUNCH SAFETY - Protection of personnel, safety of

property on the ground and of the public health and safety

during and after a launch operation.

A-8
LAUNCH SERVICES - Activities involved in the preparation

of a launch vehicle and its payload (including assembly,

test, integration and environmental protection) for launch

and the conduct of a launch.

LAUNCH SITE - The geographical location from which a

launch takes place, as defined in any license issued or

transferred by DOT. Includes all facilities located on a

launch site which are necessary to conduct a launch. See

also Launch Complex.

LAUNCH SITE OPERATOR - A sponsoring or contractor

organization (government or commercial) which has the

demonstrated capability to satisfactorily conduct a launch

operation safely from a particular launch site.

LAUNCH VEHICLE - Any rocket propulsion or similarly

capable vehicle constructed for the purpose of inserting a

payload in a ballistic or orbital trajectory.

LICENSEE - The person or organization authorized by a

license to conduct specified commercial launch activities

and who is responsible for conducting such activities in

conformance with applicable DOT regulatory requirements.

LIQUEFIED GASES - Substances which are gases at ambient

conditions of temperature and pressure that have been

converted to liquids under controlled pressure and

temperature.

LOW EARTH ORBIT (LEO) - Orbital altitudes up to about

1,000 km. (see Ch. 6, Vol.2).

LOWER FLAMMABLE LIMIT (LFL) - The lowest concentration, by

percent of volume, of a gas or vapor in the atmosphere at

normal temperatures and pressures at which the gas or vapor

will ignite and sustain combustion.

MISHAP - An unplanned event or series of undesirable

events that result in death, injury, damage or loss of

equipment and/or property. (See also ACCIDENT)

MISSION - The objective to be accomplished by a proposed

launch and the general plan for achieving that objective,

namely launch azimuth, site, orbital parameters, vehicle

configuration, design, etc.

ORBIT INCLINATION - The angle between the plane of a

particular orbit and the equator.

A-9
ORBITAL INJECTION - The sequence of operations, in time

and space, whereby a vehicle achieves a combination of

velocity and position so that its payload is placed into the

desired Earth orbit.

ORBITAL VELOCITY - The velocity at which the centrifugal

force created by the launch vehicle's motion around the

Earth equals the Earth's gravity; at this point the vehicle

will orbit the Earth until some other force is applied.

OBLATENESS - The deviation of the Earth's shape from a

perfect sphere (flattened poles, bulging equator).

OVERPRESSURE - Blast wave parameter denoting the peak

pressure rise over ambient.

PASCAL - Unit of pressure. 1kPa = 1000 Pa. 1 atmosphere

= 101 kPa

POOL FIRE - A fuel film formed on the ground and burning

in a turbulent diffusion flame located above the film.

PRELIMINARY HAZARD ANALYSIS (PHA) - A qualitative listing

and ranking of hazards of interest.

PROPELLANTS - Balanced mixtures of fuel and oxidizer

designed to produce large volumes of hot gases at

controlled, predetermined rates, once the burning reaction

is initiated.

PSI - Pounds per square inch, a unit of pressure. 1

atmosphere = 14.7 psi.

RESIDUAL RISK - Risk exposure levels which cannot be

further reduced or eliminated by risk mitigation

(management) strategies and must be accepted.

RISK - The potential for an undesirable consequence to

arise from an accident occurring during a hazardous

activity. Technically, Risk (R) is the product of the

probability (p) or frequency (f) of occurrence and its

consequence (C) (the severity of its impact).

A-10
RISK ANALYSIS - A detailed examination of systems and

operations which involves both the estimation of the

expected frequency or probability of adverse events and the

severity (magnitude) of their consequence expressed in units

of interest (property damage, casualties, down time,

production or business losses). Risk analysis requires;

first the identification and characterization of hazards

(qualitative analysis); then a quantification and ranking of

hazards in terms of the likelihood of their occurrence,

severity of their consequence or their expected risk figure.

RISK ASSESSMENT- Evaluation of analytical results of Risk

Analysis in a broader context. 

RISK SCREENING - The ordered ranking of hazards so that

acceptable risk thresholds can be defined and intolerable

risk levels that require reduction and management resources

can be identified.

RISK MANAGEMENT - The process used to form decisions that

control risk (reduce, eliminate or accept) based on system

safety analysis. The set of policy and operational control

options that must be introduced in order to avoid, reduce

and eliminate risks. Risk management may focus on either

prevention and diminished probability of occurrence of

hazardous events or on controlling the impacts of such

events by emergency preparedness and response planning. 

Risk management options are usually selected based on costbenefit analyses.

SAFETY ASSESSMENT REPORT (SAR) - A comprehensive

evaluation of the safety risks being assumed prior to test

or operation of the system. It identifies all safety

features of the system, as well as the design and procedural

hazards present and specific controls to be adopted.

SAFETY - A reasonable degree of freedom from those

conditions that can cause injury, death to personnel, damage

or loss of equipment or property; freedom from danger.

SAFETY CRITICAL - A designation placed on a system,

subsystem, element, component, device or function denoting

that satisfactory operation of such is mandatory to ensure a

safe operation. Such a designation dictates incorporation

of special safety design considerations and features. Any

condition, event, operation, process, equipment or system

with a potential for major injury or damage.

A-11
SAFETY OPERATIONS - Collectively the personnel, equipment,

facilities, documented plans, procedures and any other

resource needed for safe preparation and launch of a launch

vehicle and its payload.

SHOCK WAVE - A relatively thin region of discontinuity

which can propagate through fluids and solids and across

which properties (pressure, velocity, density and

temperature) change very rapidly.

SOLID PROPELLANTS - Solid propellants act as

monopropellants. Homogeneous propellants are true solid

monopropellants; each molecule contains both fuel and oxygen

(e.g., nitrocellulose-containing compounds). Composite

propellants are physical (not chemical) mixtures of a finely

ground oxidizer in a matrix of plastic, resinous or

elastomeric fuel (e.g., ammonium perchlorate in a resin

binder).

SYSTEM - A composite, at any level of complexity, of

personnel, procedures, materials, tools, equipment,

facilities and software. The elements of this composite

entity are used together in the intended operational or

support environment to perform a given task or achieve a

specific production, support or mission requirement.

SYSTEM SAFETY - The application of engineering and

management principles, criteria and techniques to optimize

safety within the constraints of operational effectiveness,

time and cost throughout all phases of the system life

cycle.

SYSTEM SAFETY MANAGEMENT - The element that defines the

system safety program requirements and ensures the planning,

implementation and accomplishment of system safety tasks and

activities.

SUBORBITAL LAUNCH - A launch during which the vehicle does

not achieve orbital velocity and, therefore, falls back to

the Earth's surface following a ballistic trajectory after

the completion of powered flight.

SUBORBITAL TRAJECTORY - The ballistic path a launch

vehicle follows during a suborbital launch.

THERMAL RADIATION - Thermal energy emitted by hot surfaces

or gases by virtue of their temperatures.

THRESHOLD LIMIT VALUE (TLV) - The lowest concentration

level of a toxic substance at which toxic effects may

develop.

A-12
TNT EQUIVALENT YIELD - Energy release in an explosion

inferred from measurements of the characteristics of blast

waves generated by the explosion.

TRAJECTORY - A series of points in three dimensional space

relative to time that describes the exact position of the

vehicle at any time with respect to Earth's surface.

UPPER FLAMMABLE LIMIT (UFL) - The highest concentration,

by percent of volume, of a gas or vapor in the atmosphere at

normal temperatures and pressures at which the gas or vapor

will ignite and sustain combustion.

VOLATILE - A substance that has a high vapor pressure

(i.e., it will readily vaporize) at a low temperature.

A-13
10/2/95 rev

APPENDIX B

FUEL PROPERTIES AND CHARACTERISTICS

(from CPIA Publication 394, "Hazards of Chemical Rockets and

Propellants", by John Hopkins University, Applied Physics

Laboratory, Laurel, MD, Sept. 1984)

B-1
NAME: LH2 — Liquid Hydrogen

MILITARY HAZARD CLASSIFICATION: Group III

DOT CLASSIFICATION: Flammable Liquified gas

QUANTITY PER VEHICLE: 3,400 lb (Centaur)

APPLICATION: Centaur

PROPERTIES AND CHARACTERISTICS

COMPOSITION: 99.79% para-hydrogen and

0.21% ortho-hydrogen.

APPEARANCE: High purity Liquid Hydrogen

is transparent and

colorless.

STABILITY: Liquid Hydrogen is

chemically stable. 

Physically stable only when

stored under suitable

conditions.

FREEZING POINT: -435°F

BOILING POINT: -423°F

DENSITY: 0.59 lb/gal. at -423°F

CRITICAL PRESSURE: 188 PSIA

CRITICAL TEMPERATURE: -400°F

ODOR: None

HAZARDS

PHYSIOLOGICAL: Human contact with liquid

hydrogen or uninsulated

lines can result in severe

frost bite. Hydrogen gas

acts as a simple asphyxiant

that can be breathed in high

concentrations without

producing systematic

effects. However, if the

concentration is high enough

to significantly reduce the

B-2
amount of oxygen in the air,

the effects of oxygen

deprivation will be

produced.

EXPLOSION: Unconfined hydrogen-air

mixtures generally burn

rapidly without detonation. 

However, in confined areas

or when ignition is caused

by a shock source or small

explosive charge, the

mixture can detonate.

An explosion hazard can

exist if liquid hydrogen is

contaminated with solid

oxygen or solidified oxygen

enriched air.

THRESHOLD LIMIT VALUE: None

B-3
NAME: LOX-Liquid Oxygen

MILITARY HAZARD CLASSIFICATION: II

MILITARY STORAGE COMPATIBILITY: LIQ-A

DOT CLASSIFICATION: Non-Flammable Liquid

QUANTITY PER VEHICLE: 146,300 lb (an additional

15,300 lb)

APPLICATION: First Stage Oxidizer

PROPERTIES AND CHARACTERISTICS

COMPOSITION: 99.5% oxygen

APPEARANCE: Light blue transparent

liquid. Boils vigorously at

ambient conditions.

STABILITY: Liquid oxygen is chemically

stable, is not shock

sensitive and will not

decompose.

FREEZING POINT: -361°F

BOILING POINT: 297°F

DENSITY: 9.53 lb/gal. at -297.4°F

CRITICAL PRESSURE: 737 PSIA

CRITICAL TEMPERATURE: -181°F

ODOR: None

HAZARDS

PHYSIOLOGICAL: Human contact with liquid

oxygen or uninsulated lines

can result in severe frost

bite. Oxygen gas will not

cause toxic effects. 

Gaseous oxygen from the

liquid is absorbed by

clothing and any ignition

source may cause flare

burning.

B-4
EXPLOSION: When mixed with liquid

oxygen, all materials that

burn represent explosive

hazards.

THRESHOLD LIMIT VALUE: None

B-5
NAME: TEA (Triethyl aluminum) TEB

(Triethyl boron)

MILITARY HAZARD CLASSIFICATION: III

MILITARY STORAGE COMPATIBILITY: LIQ-C

DOT CLASSIFICATION: Flammable Liquid

QUANTITY PER VEHICLE: 0.17 lb

APPLICATION: TEA in first stage main

engine

TEA/TEB in vernier engines

PROPERTIES AND CHARACTERISTICS

COMPOSITION: 100% TEA in main engine

15% TEA, 85% TEB in vernier

engines

APPEARANCE: Colorless liquid

STABILITY: TEA reacts violently with

water and organic and

inorganic acids. TEB reacts

violently with oxygen.

TEA TEB

FREEZING POINT: -52°F -134°F

BOILING POINT: +381°F +203°F

DENSITY: 52 lb/cu. ft 43 lb/cu. ft

at 70°F

FLASH POINT: Ignites spontaneously in air

at room temperature.

ODOR: Combustion products have

pungent ammonia-like odor.

HAZARDS

PHYSIOLOGICAL: TEA and TEB will destroy

living tissue on contact.

Combustion products are

highly toxic.

B-6
FLAMMABILITY: TEA and TEB ignites

spontaneously in air at room

temperature.

THRESHOLD LIMIT VALUE: Zero

B-7
NAME: Nitrogen Tetroxide

MILITARY HAZARD CLASSIFICATION: I

MILITARY STORAGE COMPATIBILITY: LIQ-A

DOT CLASSIFICATION: Poison Liquid A

QUANTITY PER VEHICLE: 6,228 lb

APPLICATION: Second stage oxidizer

PROPERTIES AND CHARACTERISTICS

COMPOSITION: 99.5% N204

APPEARANCE: Reddish-brown liquid with

yellowish to reddish-brown

fumes.

STABILITY: N204 is very stable at room

temperature. At +302°F it

begins to dissociate into

nitric oxide and oxygen, but

upon cooling it reforms into

N204.

FREEZING POINT: +11.8°F

BOILING POINT: +70.1°F

DENSITY: 12.1 lb/cu. gal. at 68°F

CRITICAL TEMPERATURE: 1,469 psia

CRITICAL PRESSURE: +316.8°F

FLASH POINT: None

ODOR: Characteristic irritating,

pungent and acid-like odor.

HAZARDS

PHYSIOLOGICAL: N204 liquid is corrosive and

can cause severe burns of

the skin and eyes unless it

is immediately removed. 

Inhalation of N204 vapors is

B-8
normally the most serious

hazard.

SYMPTOMS OF POISONING: Irritation of the eyes and

throat, cough, tightness of

the chest, and nausea - are

slight and may not be

noticed. Then hours

afterward, severe symptoms

begin; their onset may be

sudden and precipitated by

exertion. Coughing, a

feeling of constriction in

the chest, and difficult

breathing are typical.

FLAMMABILITY: N204 is a corrosive agent

whose corrosiveness is

enhanced in the presence of

water. It is not sensitive

to shock, heat, or

detonation. It is not

flammable in air but will

support combustion.

THRESHOLD LIMIT VALUE: 3 ppm for N02

2.5 ppm for N204

At no time will personnel be

subjected to any

concentration greater than

TLV.

B-9
NAME: RP-1

MILITARY HAZARD CLASSIFICATION: I

MILITARY STORAGE COMPATIBILITY: LIQ-C

DOT CLASSIFICATION: Flammable Liquid

QUANTITY PER VEHICLE: 67,000 lb (an additional

11,000 lb.)

APPLICATION: RP-1 is a thermally stable

kerosene having a very high

energy content. It is used

for first stage fuel.

PROPERTIES AND CHARACTERISTICS

COMPOSITION: Hydrocarbon

APPEARANCE: Clear liquid ranging in

color from water-white to a

pale yellow.

STABILITY: A mixture of RP-1 and liquid

oxygen forms a gel which may

explode upon being subjected

to impact or shock.

FREEZING POINT: -40°F Max.

BOILING POINT: 350° to 525°F

DENSITY: 49.95 to 50.82 lb/ft3 at

60°F

FLASH POINT: 110°F

ODOR: Strong, kerosene-like

HAZARDS

PHYSIOLOGICAL: Inhaling vapors may cause

headache, dizziness or

nausea. Continuous contact

with the skin can cause

irritation.

EXPLOSION: A mixture of vapor and air

is dangerous and should be

considered as an explosive

B-10
mixture.

THRESHOLD LIMIT VALUE: 500 PPM in air.

At no time will personnel be

subjected to any

concentration greater than

the threshold limit value

(TLV).

B-11
NAME: Aerozine 50

MILITARY HAZARD CLASSIFICATION: III

MILITARY STORAGE COMPATIBILITY: LIQ-C

DOT CLASSIFICATION: Flammable Liquid

QUANTITY PER VEHICLE: 3,892 lb

APPLICATION: Second-stage fuel

PROPERTIES AND CHARACTERISTICS

COMPOSITION: Mixture of 50% UDMH and 50%

hydrazine

APPEARANCE: Clear, colorless liquid

STABILITY: A-50 is thermally stable and

is not shock or friction

sensitive.

FREEZING POINT: +18.8°F

BOILING POINT: +158.2°F

DENSITY: 56.1 lb/cu. ft at 77°F

FLASH POINT: +104°F

CRITICAL TEMPERATURE: +634°F

CRITICAL PRESSURE: 1,696 psia

ODOR: Ammonia gas

HAZARDS

PHYSIOLOGICAL: The liquid can be absorbed

through the skin; the vapors

can be inhaled. Exposure

may cause irritation of the

mucous membranes of the

eyes, respiratory passages,

lungs,and gastro-intestinal

tract. Direct skin contact

can cause severe burns.

B-12
MMH and UDMH are convulsant

agents, irritants to the

respiratory tract and eyes

and may irritate the skin. 

They are absorbed by the

skin, oral and inhalation

routes. Hydrazine fuels

form carcinogenic

nitrosamine compounds. 

Also, ACGIH has listed the

hydrazines as "Suspected

Human Carcinogens."

EXPLOSIVE: Liquid is flammable and

reacts violently with acids

and oxidizing agents.

THRESHOLD LIMIT VALUE: 0.5 ppm in air.

At no time will personnel be

subjected to any

concentration greater than

the TLV.

B-13
NAME: Oronite Extreme Pressure

Additive

MILITARY HAZARD CLASSIFICATION: None

MILITARY STORAGE COMPATIBILITY: None

DOT CLASSIFICATION: Flammable Liquid

QUANTITY PER VEHICLE: 5.96 lb

APPLICATION: First-stage booster engine

lubricant.

PROPERTIES AND CHARACTERISTICS

COMPOSITION: Phosphorus, zinc, sulphur,

calcium

APPEARANCE: Transparent, light orange

oil

STABILITY: Stable at controlled storage

temperature below +100°F

FREEZING POINT: +17°F

BOILING POINT: Not Available

DENSITY: 67.8 lb/cu. ft at 60°F

FLASH POINT: +340°F

ODOR: Foul, sulphur-like smell

HAZARDS

PHYSIOLOGICAL: None. Inhaling vapors is

unpleasant.

EXPLOSION: A mixture of additive and

liquid oxygen forms a gel

which may explode upon being

subjected to impact or

shock; however, such contact

does not normally occur. A

mixture of additive and fuel

is normal in the lubrication

system and is not hazardous.

THRESHOLD LIMIT VALUE: None

B-14