### STANDARD 321-07

RANGE SAFETY GROUP



### COMMON RISK CRITERIA STANDARDS FOR NATIONAL TEST RANGES

WHITE SANDS MISSILE RANGE REAGAN TEST SITE YUMA PROVING GROUND DUGWAY PROVING GROUND

ABERDEEN TEST CENTER NATIONAL TRAINING CENTER ELECTRONIC PROVING GROUND HIGH ENERGY LASER SYSTEMS TEST FACILITY

NAVAL AIR WARFARE CENTER WEAPONS DIVISION, PT. MUGU NAVAL AIR WARFARE CENTER WEAPONS DIVISION, CHINA LAKE NAVAL AIR WARFARE CENTER AIRCRA FT DIVISION, PATUXENT RIVER NAVAL UNDERSEA WARFARE CE NTER DIVISION, NEWPORT PACIFIC MISSILE RANGE FACILITY NAVAL UNDERSEA WARFARE CE NTER DIVISION, KEYPORT

30TH SPACE WING 45TH SPACE WING AIR FORCE FLIGHT TEST CENTER AIR ARMAMENT CENTER ARNOLD ENGINEERING DEVELOPMENT CENTER BARRY M. GOLDWATER RANGE

NATIONAL NUCLEAR SECURITY ADMINISTRATION ( NEVADA )

DISTRIBUTION A: APPROVED FOR PUBLIC RELEASE DISTRIBUTION IS UNLIMITEDThis page intentionally left blank.

### STANDARD 321-07

COMMON RISK CRITERIA STANDARDS FOR NATIONAL TEST RANGES

JUNE 2007

Prepared by

RANGE SAFETY GROUP RISK COMMITTEE

Published by

Secretariat Range Commanders Council U.S. Army White Sands Missile Range, New Mexico 88002-5110This page intentionally left blank.

### TABLE OF CONTENTS

LIST OF FIGURES ................................................................................................................ ....... iv

LIST OF TABLES................................................................................................................. ........ iv

CHANGES TO THIS EDITION .....................................................................................................v

FOREWORD ....................................................................................................................... ......... vii

PREFACE........................................................................................................................ .............. ix

ACRONYMS....................................................................................................................... .......... xi

CHAPTER 1: INTRODUCTION......................................................................................... 1-1 1.1 Purpose ............................................................................................................ 1-1 1.2 Scope ............................................................................................................... 1-1 1.3 Implementation................................................................................................ 1-1 1.4 Range Responsibilities .................................................................................... 1-2

CHAPTER 2: POLICIES AND PROCEDURES ............................................................... 2-1 2.1 General Policy and Goals ................................................................................ 2-1 2.2 Policy Objectives............................................................................................. 2-2 2.3 Risk Management Process............................................................................... 2-3 2.4 Risk Uncertainty.............................................................................................. 2-7

CHAPTER 3: ACCEPTABLE RISK CRITERIA.............................................................. 3-1 3.1 Performance Standards.................................................................................... 3-1 3.2 Personnel Protection........................................................................................ 3-2 3.3 Aircraft Protection .......................................................................................... 3-3 3.4 Ship Protection ................................................................................................ 3-4 3.5 Spacecraft Protection....................................................................................... 3-5 3.6 Catastrophic Risk Protection........................................................................... 3-6 3.7 Criteria Summary ............................................................................................ 3-8

REFERENCES

GLOSSARY

iiiLIST OF FIGURES

Figure 2-1. Risk management process.................................................................................... 2-4 Figure 3-1. Tolerable catastrophe risks for the general public. .............................................. 3-8

LIST OF TABLES

Table 3-1. Definitions Used to Defi ne Tolerable Catastrophic Risks................................... 3-7 Table 3-2. Summary of Co mmonality Criteria ..................................................................... 3-9

ivCHANGES TO THIS EDITION

This document is an updated version of RCC Document 321-02 (Common Risk Criteria for National Test Ranges: Inert Debris). Th e following subparagraphs contain a summary of changes. Note: the use of the word “supplem ent” used herein refers to the companion (supplemental) document to RCC Document 321.

a. Expanded Scope . The scope of the standard is expanded to include other flight hazards in addition to inert debris. It now addresses risks due to explosive debris, overpressure, and toxics. To accommoda te this change, the Risk Committee recommends that casualty, rather than fatali ty, be the primary meas ure of risk and has defined acceptable casualty risk criteria. Fatality risk criteria remain as a supplemental measure of risk for those range operations that are dominated by fatality risk.

b. New Hazard Thresholds . New hazard thresholds are defined to account for casualty risk. Debris fragment thre sholds are provided for blunt trauma injuries and chunky penetrating injuries, and overpressure th resholds are provided for unsheltered and sheltered people. In additi on, debris fragment thresholds for penetrating structures are updated to reflect the results of recent studies.

c. Aircraft Vulnerability Thresholds . The aircraft vulnerability thresholds are revised to remove the excess conservatism. The previ ous standard defined a single threshold for all types of aircraft. A se parate set of vulnerability models are defined for large commercial jet transports to represent the robustness of those aircraft more accurately.

d. Ship Probability of Impact . The probability of impact cr iteria for ships is revised to be more in line with United Nations In ternational Maritime Or ganization and current range practices.

e. Manned Spacecraft Protection . The manned spacecraft protection policies and criteria are revised to remove excess c onservatism and clear up inconsistencies in application. The probability of impact criterion is updated to reflect assumptions of space launch activity that are more realistic and to provide an equivalent level of protection as that afforded to mission e ssential personnel. As another means of reducing excess conservatism, an ellips oidal minimum miss-distance volume is provided as an alternative to the spherical miss-distance presented in the previous standard.

f. Catastrophic Risk Protection . This revision introduces th e subject of catastrophic risk protection. Some provisional, advisory criteria are provide d, as well as guidelines for analyzing and assessi ng catastrophic risk.

g. Implementation Guidelines . A new chapter (Chapter 4) was added to the document 321-07 supplement to provide implementation guidelines for applying the criteria to address aggregation and accumulation of ri sk from the various hazards, multiple

vphase/multiple launch missions, annual risk management, and catastrophic risk. It also provides guidance on determining the beginning and end of a mission for applying the per mission criteria.

h. Screening Criteria for Other Hazards . A new chapter (Chapter 8) was included in the 321-07 supplement to provide guidelines on screening criteria for casualty producing hazards such as Distant Focusing Overpr essure (DFO), toxi cs, and radiation.

i. Risk Management Process . The 8-step process for analyzing risk from inert debris is replaced with a more comprehensive overall range safety process that expands the concept to address hazards beyond just inert debris and includes the major activities required to conduct the entire risk management process. A checklist of factors and considerations was included to aid in proper execution of the process.

j. Modeling Considerations . Two new chapters are added to the supplement providing advisory requirements for modeling t ools (Chapter 3) and approaches and considerations for debris risk assessment model (Chapter 7)

viFOREWORD

The Risk and Lethality Commonality Team (RALCT) was formed in 1996. The RALCT was formed for reaching a consensus on reasona ble common standards for debris protection criteria and analytical methods. The initia l version, RCC 321-97, was very useful, but was limited in scope due to the complexity of the su bject and time constraints. This standard was updated in 1999 and again in 2002 to provide greater detail. In August 2004, the Range Commanders Council (RCC), Range Safety Gr oup (RSG) determined that RCC Document 321-02 (Common Risk Criteria for National Test Ranges, Subtitle: Inert Debris), should be updated and expanded for other flight safety hazards (in addition to inert debris) and consequences potentially generated by range operations.

The RALCT became a standing committee under the RCC Range Safety Group in 2004. It was renamed the “Risk Committee” (RC) in Fe bruary 2005 when work on this revision began in earnest. The Committee has updat ed RCC Document 321-02 to include:

a. Risk acceptability criteria and supporting rationale for additional flight safety hazards and consequences potentially generated by range operations. b. The major activities required to conduct the entire risk management process and considerations to address hazards beyond just inert debris.

c. Top-level requirements for computational m odels used to analyze the risks posed by inert and explosive debris. d. Updated hazard thresholds for inert and expl osive debris, as well as screening criteria for other hazards including toxics, distant focusing overpressure, and ionizing and non-ionizing radiation.

e. Factors and considerations for accepta ble debris risk assessment models.

This document (RCC Document 321-07) is the basic document that defines consensus standards for the range risk management proce ss and risk criteria. The companion document, RCC Document 321-07 (Common Risk Criteria for National Test Ranges: Supplement), provides additional detailed information to assist in implementation of the standards in the basic document. The criteria in th is document should not be cons idered absolute ; rather, this document and its supplement is intended to provide guidance on defining acceptable risks for hazardous range operations and to assist the user in developing more consistent risk assessments.

This document represents the collective efforts of bot h government and contractor personnel and is the re sult of an extensive cooperative effort.

viiThis page intentionally left blank.

viiiPREFACE

This document presents the results of Task RS-46, Range Safety Group (RSG) in the Range Commanders Council (RCC). Planned and unplanned hazardous events generated by flight operations present a safety concern for all test ranges. Ea ch range has established its own set of criteria and analytical methods for protectin g personnel, facilities, ai rcraft, and other assets from hazardous operations. Although these separa te efforts have been very successful, the logical relationships among criter ia used at the test ranges and across different hazards are often difficult to comprehend. The consensus standards presented in this document are intended to:

a. Promote a uniform process among the ranges. b. Promote valid, repeatable risk assessments.

c. Foster innovation to sup port challenging missions. d. Nurture openness and trustworthiness among th e ranges, range users, and the public.

e. Simplify the scheduling process. f. Present common risk criteria that can redu ce cost for users of multiple test ranges.

The RCC gives special acknowledgement for production of this document to:

Mr. Corey Cather : Chairman, RSG Risk Committee 30th Space Wing, 30 SW/SELP 806 13th Street STE 3 Vandenberg AFB, CA 93437-5230

Phone: (805) 606-1662 DSN 276-1662 Fax: (805) 605-7227 DSN 275-7227 E-mail: corey.cather@vandenberg.af.mil

Acknowledgements also go to the many participating members of the Range Safety Group Risk Committee as shown on the following page.

Please direct any questions to:

Secretariat, Range Commanders Council ATTN: CSTE-DTC-WS-RCC 100 Headquarters Avenue White Sands Missile Range, New Mexico 88002-5110 Telephone: (505) 678-1107, DSN 258-1107 E-mail rcc@wsmr.army.mil

ixRANGE SAFETY GROUP RISK COMMITTEE PARTICIPANTS

RCC RSG RISK COMMITTEE MEMBERS

AFSPC/30th Space Wing - 30 SW AFSPC/45th Space Wing - 45 SW Air Armament Center Eglin Air Force Base - AAC Air Force Flight Test Center - AFFTC Naval Air Systems Command headquartered at Patuxent River, MD - NAVAIR Patuxent River. Naval Air Warfare Center Weapons Division - NAWCWD Pacific Missile Range Facility - PMRF U.S. Army Kwajalein Atoll/R eagan Test Site - USAKA/RTS White Sands Missile Range - WSMR Yuma Proving Ground - YPG

RCC RSG RISK COMMITTEE ASSOCIATE MEMBERS

Federal Aviation Administration - FAA/AST Missile Defense Agency; Safety, Quality a nd Mission Assurance Di rectorate - MDA/QS National Aeronautics and Space Administrati on Dryden Flight Research Center - NASA - DFRC National Aeronautics and Space Admi nistration Headquarters - NASA HQ National Aeronautics and Space Administ ration Kennedy Space Ce nter - NASA KSC National Aeronautics and Space Administrati on Wallops Flight Facility - NASA Wallops Sandia National Laboratories - SNL

RCC RSG RISK COMMITTEE SU PPORTING ORGANIZATIONS

3D Research Corporation - 3D Research ACTA, Inc. - ACTA Aerospace Corporation Air Force Space Command - AFSPC Analysis, Planning, Test Research, Inc. - APT Research Headquarters, Air Force Safety Center , Weapons Safety Division - HQ AFSC Research Triangle Institut e, International - RTI SRS Technologies System Test and Evaluation Planni ng and Analysis Lab - STEPAL TYBRIN Corporation

xACRONYMS

AFSPC Air Force Space Command AST Associate Administrator for Space Transportation (FAA) BMD Ballistic Missile Defense CFR Code of Federal Regulations COP Critical Operations Personnel DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction ER Eastern Range EPA Environmental Protection Agency FAA Federal Aviation Administration FTCA Federal Tort Claims Act FTS Flight Termination System GP General Public KSC Kennedy Space Center MEP Mission Essential Personnel MRTFB Major Range and Test Facility Base NASA National Aeronautics and Space Administration NAWC Naval Air Warfare Center RALCT Risk and Lethality Commonality Team RC Risk Committee RCC Range Commanders Council RSG Range Safety Group USAF United States Air Force USCG United States Coast Guard USC United States Code VAFB Vandenberg Air Force Base WR Western Range WSMR White Sands Missile Range

xiThis page intentionally left blank.

xii

### CHAPTER 1

INTRODUCTION

1.1 Purpose

This document provides a common set of ra nge safety policies, risk criteria, and guidelines for managing risk to people a nd assets during manned and unmanned flight operations, excluding aviation operations. It establishes the following:

a. Acceptable risk criteria for both the gene ral public (involuntary acceptance) and mission essential personnel (voluntary acceptance). b. Debris injury thresholds for unprotected people.

c. Debris hazard thresholds for aircraft and ships. d. Vulnerability models for large commercial transport aircraft.

1.2 Scope

The policies and criteria in this document are intended for use by members of the DoD national ranges and Major Range and Test Facility Base (MRTFB). These policies and criteria apply to launch and reentry hazards generate d by endoatmospheric and exoatmospheric range activities including both guided and unguided miss iles and missile intercepts, space launches, and reentry vehicles. This does not include aviation operations or UAV operations. The RCC Document 323-99 (Range Safety Criteria for Unmanned Air Vehicles) provides criteria for unmanned air vehicles.

1.3 Implementation

This document is an advisory document. It s content is based on the consensus positions held by the Risk Committee (RC) within the Ra nge Safety Group (RSG), which is made up of a broad cross section of the US range safety comm unity. Therefore, the co ntent of this document represents consensus standards. The organization of this documen t conveys some of the level of imperative associated with the content. Consensu s standards with the highest levels of priorities are generally provided in the main body of the doc ument, while the supplement contains lower levels of priority requirements, guidelines, and example methods. However, precise language is used in both this document and the supplement in an attempt to capture the intent of the RC as follows:

a. The words “must,” “shall,” and “will” i ndicate a requirement that is strongly recommended. Legitimate alternatives may exist, but each alternative either shall demonstrate an equivalent level of safety or be granted a waiver. b. "Should" indicates an advisory requirement or a highly de sirable procedure. When this standard uses "should," the committee intends that a range will achieve compliance to the maximum extent practical , but no waiver or e quivalent level of safety will be required.

c. "Can" and "may" permit a choice and express a guideline.

1-1In order for a range to effectively implement this document, the range should evaluate the contents of this document a nd incorporate it acco rdingly into its local regulations and requirements.

1.4 Range Responsibilities

Department of Defense Directive (D oD) Directive 3200.11, Major Range and Test Facility Base (MRTFB), assigns responsibility to each Range Commander for ensuring that all missions are conducted safely, consistent with oper ational requirements. Range flight operations typically involve some level of risk. Therefor e, an important aspect of the range safety responsibility is to ensure that the risk is properly managed within prescribed limits. To accomplish this, each Range Commander (or designee) must:

a. Establish risk management procedures (i ncluding hazard containment) to implement the risk management process described herein. b. Establish acceptable risk criteria appropr iate to each type of mission flown in consideration of the gui dance provided herein.

c. Accept any risks, including those that ex ceed the established risk criteria when warranted for a mission in consideration of the operational requir ements and national need. (1) Make such decisions based on a thor ough understanding of any additional risk that exceeds the risk criteria and the be nefits to be derived from taking the additional risk. (2) Ensure such decisions are documented in a formal waiver process (or equivalent), preferably in advance of the mission. d. Maintain related range policy and requirements documents.

e. Maintain records of risk assessments a nd waivers to established risk criteria. f. For a mission involving more than one range, coordinate with the other range(s) to clearly document safety responsibility fo r each phase of the mission develop and implement joint plans for controlling th e mission risk due to all planned and unplanned events.

1-2

### CHAPTER 2

POLICIES AND PROCEDURES

2.1 General Policy and Goals

In planning any operation, risk must be reduced to the extent that is practical in keeping with operational objectives. Safety should be balanced with operational objectives by cooperative interaction between the range and the range user. To maximize achievement of mission objectives within safety constraints, th e range user should cons ider overall risk along with other factors that affect mission acceptability. These factor s include criticality of mission objectives, protection of life a nd property, the potential for hi gh consequence mishaps, local political factors, and governing range or programmatic environmental requirements.

All ranges must strive to achieve complete containment of hazards resulting from both normal and malfunctioning flights. If a pl anned mission cannot be accomplished using a containment approach, a risk management appro ach may be authorized by the range Commander or the designated representative. The risk management approach should conform to the guidelines presented in this document or otherw ise demonstrate compliance with the objectives presented.

Range Commanders should never regard events such as injuries as being routine or permissible. No adverse consequences are routinely acceptable; however, the probability is finite that range mishaps producing adverse consequences may occur. The term “acceptable risks” used in this document can be properly interp reted as “tolerable risks.” These are risks the range Commander may tolerate to secure cert ain benefits from a range activity with the confidence that the risk is properly managed within prescribed limits.

Compliance with this document leads to defensible launch su pport and launch commit decisions. Employing a sound basis for accuracy and repeatability in risk assessments leads to consistent risk acceptance decisions, thereby fo stering public confidence that the ranges are operated with appropriate regard for safety. T hus, individuals living or working at or near a range may go about their daily liv es without concern for their pr oximity to range activities. Moreover, compliance with these guidelines pr ovides assurance that flights near or over communities by space boosters or weapon systems does not significantly increase the risk to these communities. These goals have led to the policy objectives provided here.

In defining objectives for risk assessment and risk management, the RCC goals are to:

a. Create a uniform process among the ranges that will achieve the stated risk management goals. b. Promote accurate, repeatable risk assessments by minimizing errors in estimating and ensuring their scientific validity.

c. Create a process that fosters innova tion to support challenging missions. d. Nurture openness and trustworthiness among the ranges, range users and the public.

2-12.2 Policy Objectives

2.2.1 General Public . The general public includes all peopl e located on and off base that are not essential to a specific missi on or nearby critical operation. This definition applies to all people regardless of whether they are in some mode of transportation (such as airplanes, ships, and busses) are within a structur e, or are unsheltered. The gene ral public should not be exposed, individually or collectively, to a risk level greater than th e background risk in comparable involuntary activities, and the risk of a catastrophic mishap should be mitigated.

In the above context, the RCC considers “co mparable involuntary activities” as those where the risk arises from manmade activities that:

a. Are subject to government regulations or are otherwise controlled by a government agency, and b. Are of vital interest to the US, and

c. Impose involuntary risk of serious injury or worse on the public.

2.2.2 Mission Essential Personnel (MEP) . A certain degree of risk is inherent in hazardous operations. The MEP Individuals should not be exposed, individually or collectively, to a risk level greater than that found in comparable high-ri sk occupations, and the risk of a catastrophic mishap should be mitigated.

2.2.3 Critical Operations Personnel (COP) . The COP individuals include persons not essential to the specific operation or launch cu rrently being conducted, bu t who are required to perform safety, security, or other critical tasks at the range. The critical operations range user (or manager) provides the number a nd justification of personnel requ ired to conduct the critical operations. The range safety personnel will a pprove or determine the number and location of COP individuals with the concurrence of the appropriate Decision Authority. The COP individuals should be in cluded in the same ri sk category as MEP pers onnel.

2.2.4 Catastrophe Potential an d Transportation Systems . People on aircraft, ships, and other modes of transportation and people on oil rigs and offshore platforms should be protected to a level commensurate with the background risk as sociated with those activities. The risk assessment should account for potential catastroph ic consequences to all exposed people and mitigations should be implemented to ensure that the risk from catastrophic events is consistent with the allowable risk given in paragraph 3.6.3 and paragraph 3.6.4

.
Scenario-specific information should be considered in providi ng protection against catastrophic consequences. Comb inations of factors that should be considered include the number of people who may be simultaneously inju red, the risk of damage to high value assets, the risk of a casualty, factors that may significan tly impair the range’s ability to perform its mission, and factors that may have nati onal or internati onal consequences.

Transportation systems include all modes of transportation such as airplanes, ships, trains, busses, and automobiles. People in tr ansportation systems must be categorized following the same rules that apply to unsheltered people and people in fixed shelters (i.e., mission essential personnel (MEP), critical operations personnel (COP), or general public (GP). Each

2-2individual in a transportation sy stem must be protected to th e level for his population category (MEP, COP, or GP). Collective risk must be assessed to include pe ople in transportation systems. The collective risk to people in trans portation systems must be added to the collective risk for unsheltered people and the collective risk for sheltere d people. The numerical value defining the acceptability of the total collective risk must be based on the population category. Additional protection, such as defined in paragraph 3.6 , must be applied to people in transportation systems in order to mini mize the potential for catastrophic risk.

2.2.5 Spacecraft . Orbiting manned spacecraft will be prot ected to a level equivalent to that provided to mission essential ai rcraft. When the planned mi ssions involve vehicles or propagated hazards with altitude capability gr eater than 150 km, ranges should coordinate with the 1st Space Control Squadron of the Ai r Force Space Command (AFSPC/1SPCS) for Conjunction Assessment if needed. In additi on, ranges should establish Collision Avoidance periods in the launch window if there are any ma nned spacecraft within 50 km of, or lower than, the 3-sigma altitude capability of the launch vehi cle, payloads, jettisoned objects or debris cloud boundary.

The Risk Committee recognizes that protection for criti cal unmanned space systems should also be provided; however, it is currently considered outs ide the scope of this safety standard. While DoD Directive (DoDD) 3100.10 stat es that DoD activitie s are to be conducted “...in a safe and responsible manner that prot ects space systems...,” it does not specify which DoD activity, the launching agency (range user) or the range, has the responsibility for assuring this protection. 1 Until responsibility is resolved by a ppropriate authorities, the Risk Committee recommends that the launching agencies and th e ranges continue their current practices.

2.2.6 Environment . As part of environmental documen tation preparation in compliance with federal and local regulations, la unch and flight test hazards sh ould be taken into account and mitigated as necessary. While safety is a fact or in environmental compliance, environmental protection and regulation is beyond the scope of this standard.

2.3 Risk Management Process

Risk management is a systematic and logica l process to identify hazards and control the risk they pose. This process should include th e following elements (phases) which are depicted in Figure 2-1 and identified as:

Phase Title Paragraph

I Mission Definition and Hazard Identification 2.3.1 II Risk Assessment 2.3.2 III Criteria Comparison and Risk Reduction 2.3.3 IV Risk Acceptance 2.3.4

1 Historically, protection of unmanned systems has been addressed as part of mission assurance by the launching agency but only for DoD missions or hi ghly valued NASA missions. In the co mmercial space industry the launching agency retains liability insurance to cover such potential mishaps and has historically not utilized conjunction assessments for mission assurance or asset protection purposes.

2-3PHASE I: Mission Definition and Hazard Identification PHASE II: Risk Assessment

PHASE IV: Risk Acceptance PHASE III: Criteria Comparison

& Risk Reduction Understand Risks, mission options, and conditions needed for safety Lessons for future flights Understanding of hazards and initial mission plan

M

o d

i f y

M

i s s i o

n t o

r e d u c e

r i s k s Understanding of risk drivers

Refine risk
assessment PHASE I: Mission Definition and Hazard Identification PHASE II: Risk Assessment

PHASE IV: Risk Acceptance PHASE III: Criteria Comparison

& Risk Reduction Understand Risks, mission options, and conditions needed for safety Lessons for future flights Understanding of hazards and initial mission plan

M

o d

i f y

M

i s s i o

n t o

r e d u c e

r i s k s Understanding of risk drivers

Refine risk
assessment

Figure 2-1. Risk management process.

The initial goal of the risk management a pproach is to contain the hazards and isolate them from populated areas wherever practical. An alternative to hazard isolation is to define hazard containment areas so as to minimize the population exposed or be able to evacuate persons not associated with the hazard-generating event. This is in accordance with the primary policy that no hazardous condition is acceptable if mission objectives can be attained from a safer approach, methodology, or position, i.e ., minimizing the hazards and conducting the mission as safely as reasonably possible. When hazards cannot be contained or minimized to an insignificant level, then assessments that are mo re detailed are performed to determine if the remaining risk is acceptable. An additional benef it of hazard containment is that this process is typically less costly than risk assessments and can be evaluated relatively quickly with straightforward assumptions and with less required data.

2.3.1 Phase I: Mission Definition and Hazard Identification . Phase I is the “problem definition” step of the process. Information is assembled to identify mission characteristics, objectives, and constraints. Potential hazard source s must be identified by evaluating the system to be flown and the range safety constraints. Information sources typically include:

a. Range safety data packages. b. System description documents.

c. Mission essential and critical ope rations personnel locations. d. Surrounding population data to include public and commercial facilities and public and commercial transportation assets (incl uding aircraft corridor s and shipping lanes).

e. Seasonal meteorological data. f. The range safety system used.

g. Lessons learned on similar missions.

2-4Further details of information sources are in Ch apter 2 and Chapter 7 of the supplement to this document. The output of this step provides a basi s for hazard analysis an d risk assessment, and for use in evaluating options for mitigating risk s in ways that will minimize adverse mission impact.

2.3.2 Phase II: Risk Assessment . This step provides information needed to determine whether further risk reduction measures are necessary. Ri sk levels for identified hazards are expressed using qualitative and quantitative methods. This step produces basic measures of the risks posed by hazards. These hazards include inert, explosiv e, and flammable debris dispersions, explosive overpressure fields, exposure to toxic substances, and exposur e to ionizing and non-ionizing radiation. In some cases, this step will prov ide sufficient information to support the decisionmaking without further analysis.

A valid risk assessment must account for all potential hazards posed by the range activity to personnel, facilities, and other assets. The assessment must be based on accurate data, scientific principles, and an a pplication of appropriate mathematics. The assessment must be consistent with the range safety control that is planned for the mission. Valid calculations to assess risk can be made using the methods presen ted in the supplement. These typically produce conservative estimates; i.e., they produce a scientif ically plausible result that characteristically overestimates risk given existing uncertainties. In all cases, the anal yst is responsible for ensuring that the application of the methods in the supplement produces reasonable results. This assessment leads to mitigation measures needed to protect individuals and groups of people; this topic is discussed more fully in Chapter 3

.
In general, risk is expressed as the produc t of the probability of occurrence of an event and the consequences of that event. Total ri sk is the combination of the products, over all possible events, of the probability of each event and its associated consequence. The probability of an event is always between zero and one; howev er, the consequences of that event can be any value. Risk can be relatively hi gh if the probability is high, or the consequence is great, or a combination of the two.

Simple risk models are often employed to make an initial determination of risk. They are also used when the identified ha zards are known to result in low risks and the analyst is assured that the estimated risk is conservative. For exam ple, simple models can be used when only inert debris occurs and the debris is fairly limited in size and weight, with re latively low values of kinetic energy or ballistic coefficients, and shelte rs would provide protection from debris. These models are generally less costly, minimi ze schedule impacts, and have the following characteristics:

a. Simplified application of input parameters and assumptions. b. Simplified measures of population estimation utilized.

c. A basic injury model and associated casualty areas. d. Conservative assumptions of debris fragmentation and survivability.

2-5If the resulting risk estimate is conser vative and well within acceptable limits, then models that are more costly and time consuming, more complex, or of higher fidelity, will not be

necessary.

When the identified hazards are significan t or the initial risk estimate shows that acceptance criteria are, or may be, exceeded, then more complex risk models are typically used. Use of these models may be more costly, be time consuming to execute, and require a higher fidelity and more sophisticated application of in put data and assumptions. The assessment may require detailed population and sheltering models , more complex human vulnerability models, and more realistic debris fragmentation and su rvivability models. This may require input parameters and assumptions to be supported by em pirical evidence or expe rt elicitation. The complex risk assessment models are typically us ed when significant size debris or explosive debris impacts are present that could compro mise shelters and the associated population.

2.3.3 Phase III: Criteria Comparison and Risk Reduction . Risk measures are compared with criteria to determine the need or desirability for risk reduction. If the risk is initially unacceptable, measures should be considered to elim inate or mitigate it. Elimination is achieved by design or system changes that remove the hazard source; such as replacing a hazardous material with a non-hazardous one or moving a traj ectory to achieve containment. Mitigation is achieved by reducing the consequences of an event or the probability of an event happening. For example, increasing system reliability of a la unch vehicle or test ar ticle will increase the probability of success, thereby lowering risk. Al ternatively, designing a mission to avoid flight over densely populated areas will decrease consequences of casualties and thereby reduce the risk. Mitigation measures may include elements in the operation plan that reduce risk and are consistent with operational obj ectives, flight termination systems, containment policies, evacuation, sheltering, and other meas ures to protect asse ts from the hazards. Flight termination criteria should be optimized by balancing the risk given a failure and termination against the risk given a failure and no flight termination. To evaluate the effectiveness of mitigation measures, risk must be reassessed assuming they have been implemented. These risk reduction procedures should be followed until risk levels are as low as reasonably practical.

2.3.4 Phase IV: Risk Acceptance . Presentations to the decision authority must be sufficient to support an informed decision. The presentations should include all range-mandated risk control measures, residual risks, measures of catastroph ic loss potential ( such as maximum collective risk given a flight termination action, maximu m collective risk given failure of a flight termination system, and risk profiles), key analysis assumptions, and the protective measures that have been considered and implemented. The decision authority must approve proposed mission rules and should compare the operati onal risk to the criteria define d in this document and to other applicable mission requirements. When local agreements are in place and the range has adequately communicated the cont ent and rationale of RCC Document 321 to the representatives of local government, local agreem ents should govern. This shall not be interpreted as overriding any Federal or state laws or regulations. Th e three-tiered hierarchy of requirements is:

a. Federal and state laws and regulations. b. Local agreements.

c. RCC Document 321.

2-6In general, higher-risk operations require a higher level of approval. The Range Commander may tolerate risk levels within criteria given herein to secure certain benefits from a range activity with the confidence that the risk is properly managed and consistent with “best practices.” The outcome of these presentations to the decision authority is the acceptance of operational risks by a properly informed decision authority. This acceptance includes a determination that the residual operational risk is within tolerable limits. By doing so, it avers/ justifies that the proposed conditions for allowing the operation to be initi ated and the rules to allow the mission to continue to completion comply with “best practices” for ensuring that risk falls within accepted levels.

The terms of this acceptance and required implementation conditions must be documented. The responsible safety office shoul d document a risk assessment to demonstrate compliance with the risk management policy applied.

2.4 Risk Uncertainty

The RSG Risk Committee recognizes that there is significant uncertainty in the computed risks of rocket launches. Ni nety percent confidence bounds desc ribing the uncertainty in the computed risk can have a range of several orde rs of magnitude. For this reason, uncertainty cannot be ignored. On the other hand, most of the current risk computation tools are not at a level where they compute uncertainty or where the uncertainty results can be trusted. This is a significant area to be addressed, but the schedule of the current RCC Document 321 standard did not allow for the considerable time required for the launch risk community to produce adequate modeling approaches that can respond to uncertainty requirements in risk acceptability. For this reason, this standard does not include uncertainty in the risk acceptability requirements, but it is understood that uncertainty will be addressed in future versions. In the meantime, the Risk Committee encourages the community to develop uncer tainty models that can eventually be used with risk acceptability standards th at require the use of uncertainty.

2-7This page intentionally left blank.

2-8

### CHAPTER 3

ACCEPTABLE RISK CRITERIA

This chapter defines acceptable risk criteria for people, aircraft, ships, and spacecraft that may be exposed to hazards associated with ra nge flight operations. Hazard thresholds for people, aircraft, and ships are provid ed in Chapter 6 of the supplement.

There are two major components of the risk acceptability criteria: a set of performance standards for establishing and implementing appropr iate risk criteria at a range, followed by a set of quantitative standards. The quantitative risk criteria contained in this chapter prescribe limits on a per mission and an annual basis. Chapte r 4 of the supplement provides guidelines for establishing a risk budget for complex missions, such as those that involve multiple launches or distinct phases of flight. Chap ter 4 also provides guidelines for implementation of these criteria, including annual risk management, catastrophe aver sion, as well as protecti on of ships, aircraft, and manned spacecraft.

3.1 Performance Standards

Each range must:

a. Assess the risk to all people from launch and reentry activities in terms of hazard severity and mishap probability. Note: Hazardous operations that can be contained within a controlled area may not require a risk assessment. b. Estimate 2 the expected casualties associated w ith each activity that falls within the scope of this document. Additional risk measurements may be useful for range operations that are dominated by fatality to ensure fatality risks do not exceed acceptable limits.

c. Document its measure(s) of risk and risk acceptability policy in local requirements and policy documentation. d. Maintain documentation to demonstrate that its risk measures provide a complete and accurate assessment of the risks, to include documentation needed to demonstrate that its risk measures: (1) Clearly convey the risk for decision makers. (2) Are consistent with the measures used by other sc ientific or regulatory communities involved in “comparable invo luntary activities” (as described in paragraph 2.2.1 ).

e. Estimate the risk on a per mission basis, ex cept under special c onditions where risk management on an annual basis is justified as described below. f. Periodically conduct a formal re view to ensure that its act ivities and its mission risk acceptability policy are consistent with the annual risk accep tability criteria.

2 The overall process is a risk assessment, but a particular value (i.e. a point es timate) is referred to as an estimate.

3-13.2 Personnel Protection

3.2.1 General Public

.

a. Individual Risk Criteria . Individuals must not be expos ed to a probability of casualty greater than 1E-6 for any single mission 3 . If fatality risks are also incorporated into the risk management process, then individuals must not be exposed to a probability of fatality greater than 0.1E-6 (1E-7) for any single mission.

b. Collective Risk Criteria . Collective risk for the general public must not exceed a casualty expectation of 100E-6 (1E-4) for any single mission 3 . If annual risk is measured, collective risk for the gene ral public should not exceed a casualty expectation of 3000E-6 (3E-3) on an annual basis 4 . Risk management using only an annual measure of collective risk is only justified for range op erations that occur frequently and pose low 5 risk on a per mission basis. If fatality risks are also incorporated into the risk ma nagement process, then the co llective risk for the general public must not exceed 30E-6 (3E-5) expect ed fatalities for any single mission. If risk management using only annual risks is justified, and fatality risks are also incorporated into the risk ma nagement process, then the co llective risk for the general public must not exceed 1000E-6 (1E-3) e xpected fatalities on an annual basis.

c. Catastrophic Risk Criteria. Catastrophic risk for the general public 6 should not exceed the provisional 7 criteria outlined in paragraph 3.6.3

.

3.2.2 Mission Essential and Crit ical Operations Personnel

.

a. Individual Risk Criteria . Individual mission essen tial and individual critical operations personnel must not be exposed to a probability of casualty greater than 10E-6 (1E-5) for any single mission. If fata lity risks are also incorporated into the risk management process, then individual mission essential and critical operations personnel must not be exposed to a probability of fatality greater than 1E-6 for any single mission.

b. Collective Risk Criteria . Collective risk for mission e ssential and critical operations personnel must not exceed a casualty exp ectation of 300E-6 (3E-4) for any single mission. If annual risk is measured, collec tive risk for mission e ssential and critical operations personnel must not exceed a cas ualty expectation of 30000E-6 (3E-2) on an annual basis 1 . Risk management using only an a nnual measure of collective risk is

3 If a flight operation creates a toxic risk, then the range must separately ensure the allowable level of risk enforced by them does not exceed other standards for toxic exposure limits for the general public when appropriate mitigations are in place. Chapter 8 of the Supplement pr ovides an approach for impl ementing this requirement.

4 Chapter 4 of the supplement provides guidelines to assist in the implementation of annual risk management.

5 In this context, “low risk” means approximately two orders of magnitude below the per flight criteria for collective and individual risks.

6 This includes people in any transportation system, such as ships and aircraft, as described in Chapter 4 of the supplement.

7 The Risk Committee intends to investigate this further and the criteria are subject to change in the future.

3-2only justified for range operations th at occur frequently and pose low 4 risk on a per mission basis. If fatality risks are also incorporated into the risk management process, then collective risk for mission essential and critical operations personnel must not exceed an expected number of fatalities of 300E-6 (3E-4) for any single mission. If risk management using only a nnual risks is justified, and fatality risks are also incorporated into the risk manage ment process, then the collective risk for mission essential and critical oper ations personnel should not exceed 10000E-6 (1E-2) expected fatalities on an annual basis.

c. Catastrophic Risk Criteria . Catastrophic risk for mission essential and critical operations personnel should not exceed th e provisional criteria outlined in paragraph 3.6.4

.

3.3 Aircraft Protection 8

3.3.1 Non-Mission Aircraft Criteria.

a. Non-Mission Aircraft Hazard Volumes . Non-mission aircraft will be restricted 9 from hazard volumes of airspace where the cumula tive probability of impact of debris capable of causing a casualty on an aircraft 10 exceeds 0.1E-6 (1E-7) for all nonmission aircraft. As an alternative to pr otecting against a probability of impact, nonmission aircraft will be restricted from h azard volumes that exceed the individual risk criteria given in 3.2.1a and the catastrophe criterion given in 3.6.3

. 11

b. Non-Mission Aircraft Risk Criteria . The individual and colle ctive risks posed to the general public in any aircraft must comply with the criteria given in 3.2.1

.

3.3.2 Mission Essential Aircraft Criteria.

a. Mission Essential Aircraft Hazard Volumes . Mission essential aircraft will be restricted 9 from hazard volumes of airspace wh ere the cumulative probability of impact of debris capable of causing a casualty on an aircraft exceeds 1E-6 for all mission essential aircraft. As an alternativ e to protecting agains t a probability of

8 Chapter 4 of the supplement provides important guidelines on the proper implementation of aircraft protection

measures. 9 In this context restricted from means that the range will (1) ensure that appropriate warnings/restrictions are issued through the FAA, and (2) not proceed with the hazardous activity if the range ha s knowledge that any aircraft hazard volume is violated.

10 Chapter 6 of the supplement provides threshold values to help define such debris.

11 The supplement explains how hazard areas can be defined using probability of impact values and demonstrate compliance with 3.3.1.2. A range may prefer to use other methods that demonstrate compliance with the individual and collective risk criteria. In any case, the individual and collective risk criteria requirements always apply to all people, regardless of transportation mode.

3-3impact, mission essential aircraft will be re stricted from hazard volumes that exceed the individual risk criteria given in 3.2.1a and the catastrophe criterion given in 3.6.4

. 12

b. Mission Essential Aircraft Risk Criteria . The individual and co llective risks posed to mission essential personnel in any aircraft must comply with the criteria given in 3.2.2

.

3.3.3. Aircraft Hazard Volumes for Planned Debris Releases . The range must confirm that Notices to Airmen are issued that encompass th e volume and duration nece ssary to protect from each planned debris release 13 capable of causing an aircraft accident. 14

3.3.4. Mishap Response . The range must coordinate with the FAA to ensure timely notification 15 of any expected air traffic hazard associated with range activities. In the event of a mishap, the range must immediately inform th e FAA of the volume and duration of airspace where an aircraft hazard is predicted.

3.4 Ship Protection 16

The term "ship" includes boats and watercraft of all sizes.

3.4.1 Non-Mission Ship Criteria

.

a. Non-Mission Ship Hazard Areas . Non-mission ships will be restricted 17 from hazard areas where the probability of impact of debris capable of causing a casualty 18 exceeds 10E-6 (1E-5) for non-mission ships. Non-mission ships should also be restricted from hazard areas where the cumu lative probability of impact of debris capable of causing a catastrophic accident 19 exceeds 1E-6 for all non-mission ships.

12 The supplement explains how hazard areas can be defined using probability of impact values and demonstrate compliance with 3.3.2.2. A range may prefer to use other methods that demonstrate compliance with the individual and collective risk criteria. In any case, the individual and collective risk criteria requirements always apply to all people, regardless of transportation mode.

13 Planned debris releases includes intercept debris, jettis ons stages, nozzle covers, fairings, inter-stage hardware,

etc.
14 Federal law (49 CFR 830.2) defines an aircraft accident as “an occurrence associated with the operation of an aircraft which takes place between the time any person boards the aircraft with the inten tion of flight and all such persons have disembarked, and in which any person suffers death or serious injury, or in which the aircraft receives substantial damage.” As described in the glossary, federal law also defines death, serious injury, and substantial damage for the purposes of accident reporting.

15 This may be accomplished through preflight analyses and coordination as described in Chapter 4 of the supplement.

16 Chapter 4 of the supplement provides important guidelines on the proper implementation of ship protection

measures. 17 In this context restricted from means that the range will (1) ensure that appropri ate warnings/restrictions are issued through the USCG or other appropriate authorities, and (2) not proceed with the hazardous activity if it has knowledge that any ship hazard area is violated.

18 This includes any debris capable of pr oducing a casualty to an unsheltered person.

19 In the absence of valid ship vulnerability modeling, this includes any debris capable of deck penetration as described in Chapters 4 and 6 the supplement to this standard.

3-4As an alternative to protec ting against a probability of impact, non-mission ships will be restricted from hazard areas that exceed the individual risk criteria given in 3.2.1a and the catastrophe criterion given in 3.6.3

.

b. Non-Mission Ship Risk Criteria . The individual and collective risks posed to the general public in any ship must comply with the criteria given in paragraph 3.2.1

.
3.4.2 Mission Essential Ship Criteria

.

a. Mission Essential Ship Hazard Areas . Mission essential ships will restricted 17 from hazard areas where the probability of impact of debris capable of causing a casualty exceeds 100E-6 (1E-4) for mission essential ships. Mission essential ships should also be restricted from hazard areas where the cumulative probability of impact of debris capable of causing a catastrophic acc ident exceeds 1E-5 for all mission ships. As an alternative to protecting against a pr obability of impact, mission essential ships will be restricted from hazard areas that ex ceed the individual risk criteria given in paragraph 3.2.1a and the catastrophe criter ion given in paragraph 3.6.4

.

b. Mission Essential Ship Risk Criteria . The individual and colle ctive risk posed to the mission essential personnel in any ship must comply w ith the criteria given in paragraph 3.2.2

.
3.4.3 Ship Hazard Areas for Debris Releases . The range must confirm that notices to mariners are issued that encompass the area and duration necessary to protect from each planned debris impact capable of causing a ship accident.

3.4.4 Mishap Response . The range must coordinate with the USCG or other appropriate authorities to ensure timely notification of any ship traffic hazard associated with range activities. In the event of a mishap, the range must promptly inform the appropriate authority(s) of the area and duration of navigable wate rs where a ship hazard is predicted.

3.5 Spacecraft Protection

Manned spacecraft shall be protected by: (1) not exceeding a probability of impact greater than 1E-6 per spacecraft, or (2) ensuri ng an ellipsoidal miss-distance of 200 km in-track and 50 km cross track and radially, or (3) ensu ring a spherical miss-di stance of 200 km. A spacecraft is considered manned if it is currentl y occupied, or expected to be occupied, and includes spacecraft en route to, a nd in support of, manned missions.

For objects (including launch vehicle, payloa d, jettisoned components, or planned debris) launched into a sustainable orbit, the duration of the conjunction assessment required for manned spacecraft protection shall be applied from launch through orbit insertion plus an analyst defined number of revolutions to account for (1) the type orbit the vehicle or component is injected into, operating in, or passing through, (2 ) its altitude exceeding the ma nned spacecraft altitude by the appropriate miss-distance, and (3) a sufficient time for the obj ect to be catalogued. Prior coordination with 1 st SPCS may allow an earlier time for th e object to be catalogued and thereby result in a shorter du ration for the conjunction assessment required to be performed for the

3-5launch range. Besides the launc h vehicle and payload, conjuncti on assessments must include all components jettisoned during the launch and intentionally propagated debris.

The vulnerability of the spacec raft must be accounted for in the risk assessment and the minimum debris size ascertained from the spacecr aft operator whenever practicable. Otherwise, the spacecraft should be considered vulnerable to the current minimum debris size of 1mm or greater.

3.6 Catastrophic Risk Protection

Catastrophic risk criteria ar e designed to protect against scenarios involving numerous casualties. The following provisi onal catastrophic ri sk criteria are sugg ested guidelines to supplement the collective and individual risk criteria given in paragraph 3.2 . Catastrophic risk assessments are especially useful for pre-flight analyses intended to evaluate and mitigate potentially catastrophic outcomes.

3.6.1 General . Missions must be permitted only when the catastrophic risks are consistent with the policy objectives given in paragraph 2.2

.
3.6.2 Ship and Aircraft Hazard Areas . If ships and aircraft are excluded from the hazard areas designed to protect against excessive proba bility of impact limits provided in paragraph 3.3 and paragraph 3.4 in accordance with the gui delines set in Chapter 4 of the supplement, then the catastrophic risks to ships and aircraft are c onsistent with the polic y objectives given in paragraph 2.2

.

3.6.3 General Public Criteria . Catastrophic risks for the gene ral public should not exceed the following provisional criteria:

(Eqn 3-1) 4 5.1 10

− ≤× NP
where
P is the cumulative probability of all events capable of causing N or more casualties.
N

is number of casualties, based on th e occupant load as defined in Table 3-1

. 10 -4 is the maximum acceptable expected casualties as defined in 3.2.1b

.
Figure 3-1 shows the relationship between P and N for the general public that satisfies this criterion.

3-6TABLE 3-1. DEFINITIONS USED TO DEFINE TOLERABLE CATAST ROPHIC RISKS

Population Type Catastrophic Outcome Occupant Load ( N

)

Public Aircraft An occurrence resulting in multiple fatalities 20 , usually with the loss of the airplane 21 Maximum occupancy

Mission Essential or Critical Aircraft An occurrence resulting in multiple fatalities, usually with the loss of the airplane Expected occupancy

Public Ship An occurrence resulting in multiple casualties, usually with loss of the ship Maximum occupancy

Mission Essential or Critical Ship An occurrence resulting in multiple casualties, usually with loss of the ship Expected occupancy

Public Land Vehicle An occurrence resulting in multiple casualties, usually with loss of the vehicle Maximum occupancy

Mission Essential or Critical Land Vehicle An occurrence resulting in multiple casualties, usually with loss of the vehicle Expected occupancy

Public Train An occurrence resulting in multiple casualties, usually with loss of the train Maximum occupancy

Mission Essential or Critical Train An occurrence resulting in multiple casualties, usually with loss of the train Expected occupancy

Public Gatherings 22 An occurrence resulting in multiple casualties Maximum credible

occupancy Mission Essential or Critical Personnel Gathering An occurrence resulting in multiple casualties Expected occupancy

20 FAA also has a formal definition for "severe consequence:" forced landing (which is also formally defined), loss of aircraft while occupants are on-board, serious injuries (as formally defined), or fatalities

21 FAA Advisory Circular 39-8

22 Public gathering places subject to catastrophic accident s include any locations wher e population concentrations may occur, such as schools, ho spitals, stadiums, beaches, etc.

3-7yhe ProbabilitAllowable Catastrop

Number of Exposed People

Figure 3-1. Tolerable catastrophe risks for the general public.

3.6.4 Mission Essential and Critical Operations Personnel Criteria . Catastrophic risks for mission essential and critical operations pe rsonnel should not exceed the following provisional criteria:

(Eqn 3-2) 4 5.1 103

− ×≤× NP

where
P is the cumulative probability of all events capable of causing N or more casualties. N is number of casualties, based on the occupant load as defined in Table 3-1

. 3 x 10 -4 is the maximum acceptable expected casualties as defined in 3.2.2b

.

3.7 Criteria Summary

Table 3-2 below summarizes the criteria defined by this document. All of the criteria are considered mandatory requirements except those hi ghlighted by an asterisk, which are advisory requirements that may be considered mandatory under certain circumstan ces (as explained in Chapter 4 of the Supplement to this document.

3-8TABLE 3-2. SUMMARY OF COMMONALITY CRITERIA

General Public Mission Essential and Critical Operations Personnel

Max. Acceptable Undesired Event Max. Acceptable Undesired Event

1E-6 b Individual Probability of Casualty 10E-6 Individual Probability of Casualty

100E-6 b Expected Casualties 300E-6 Expected Casualties

0.1E-6 a Individual Probability of Fatality 1E-6 a Individual Probability of Fatality

30E-6 a Expected Fatalities 300E-6 a Expected Fatalities

0.1E-6 Probability of Aircraft Impact 1E-6 Probability of Aircraft Impact

10E-6 Probability of Ship Impact 100E-6 Probability of Ship Impact Per Mission

- - - - - - 1E-6 Manned Spacecraft

3000E-6 Expected Casualties 30000E-6 Expected Casualties Annual 1000E-6 a Expected Fatalities 10000E-6 a Expected Fatalities

a Advisory Requirements.

b If a flight operation creates a toxic risk, then the range must separately ensure the allowable level of risk enforced by them does not exceed other standards for toxic exposure limits for the general public when appropriate mitigations are in place. Chapter 8 of the Supplement provides an approach for implementing this requirement.

3-9This page intentionally left blank.

3-10REFERENCES

a. United States Code 10USC Armed Forces 28USC Part IV Judiciary and J udicial Procedures, Particular Proceedings (Federal Tort Claims Act) 29USC Labor (Occupational Safety and Health Act)

b. Department of Defense DoD Directive 3100.10 Space Policy DoD Instruction 3100.12 Space Support DoD Directive 3200.11 Major Range and Test Facility Base DoD Directive 4715.1 Environmental Security DoD Instruction 6055.1 DoD Safety and Occupational Health Program

c. Department of the Army AR 385-10 The Army Safety Program FM 100-14 Risk Management

d. Department of the Air Force AFI 90-901 Operational Risk Management AFPD 91-2 Safety Programs AFPD 63-12 Assurance of Occ upational Safety, Suitability, and Effectiveness AFPAM 90-902 Operational Risk Management Guidelines and Tools

e. Department of the Navy OPNAVINST 3900.39B Operatio nal Risk Management NPR 8715 NASA Procedural Requirements: Range Safety

f. Range Commanders Council RCC 316-98 Laser Range Safety RCC 319-99 Flight Terminati on Systems Commonality Standard RCC 323-99 Range Safety Criteria for Unmanned Air Vehicles

g. Environmental Protection Agency EPA 100-B-00-002 Risk Characterization HandbookThis page intentionally left blank.GLOSSARY

3-sigma: Three times the standard deviation, ty pically referenced to the mean value.

Abbreviated Injury Scale (AIS): An anatomically based, cons ensus derived, global severity scoring system that classifies each injury in every body region according to its relative importance on a 6 point ordinal scale.

Acceptable risk: A predetermined criterion or sta ndard for a maximum risk ceiling which permits the evaluation of cost, na tional priority interests, and nu mber of tests to be conducted.

Accumulated risk: The combined collective risk to al l individuals exposed to a particular hazard through all phases of an operation. Guidance Information is as follows:

• For the flight of an expendable orbital la unch vehicle, risk should be accumulated from liftoff through orbital insertion.

• For the flight of a suborbital launch vehicl e, risk should be accumulated from liftoff through the impact of all pieces of the launch vehicle, including the payload.

Aggregated risk : The accumulated risk due to all haza rds associated with a flight. Guidance Information is that, for a specified launch, aggregated risk includes, but is not limited to, the risk due to debris impact, toxic release, a nd distant focusing of blast overpressure.

As Low As Reasonably Practicable (ALARP): That level of risk which can be lowered further only by an increment in resource expenditure that cannot be justified by the resulting decrementin risk. Often identified or verified by formal or subjective application of cost-benefit or multiattribute utility theory.

Background Risk: risks voluntarily accepted in the course of normal activities

.
Best practice: There are two definitions:

• A management idea which asse rts that there is a technique, method, process, activity, incentive (or reward), that is more effec tive at delivering a particular outcome than any other technique, method, process, etc. The idea is that with proper processes, checks, and testing, a project can be roll ed out and completed with fewer problems and unforeseen complications.

• An acceptable level of effort that repres ents the best choice available given the circumstances.

Casualty : A serious injury or worse, including d eath, for a human. For the purposes of this standard, serious injury is defi ned as Abbreviated Injury Scale (AIS) Level 3 or greater except where prior general practice at the range has been to protect to a lesser level of injury than AIS level 3, such as eardrum protection.

Casualty expectation: See Expected CasualtiesCatastrophe: Any event that produces a large numbers of casualties or has a severe impact on continued range operations.

Clearance Zone: An area or volume from which objects at risk (people, ships, aircraft, etc.) are to be restricted or eliminated in order to control the risks.

Collective risk: The total risk to all individuals exposed to any hazard from an operation. Unless otherwise noted, colle ctive risk is the mean number of casualties (E C ) predicted to result from all hazards associated with an operation. Co llective risk is specifie d as either for a mission or per year. The collective risk should include the aggregated and accumulated risk.

Collision Avoidance (COLA): The process of determining and implementing a course of action to avoid potential on-orbit colli sions with manned objects or with other specified orbiting objects. The process includes the determination of wait periods in either the launch window or spacecraft thrust firings based on validated co njunction assessments or risk analyses and accounts for uncertainties in spatial dispersions a nd arrival time of the orbiting objects and/or launch vehicle.

Conjunction Assessment (CA): The process of determining the point of closest approach of two orbiting objects, or between a launch vehicle and an orbiting object, in association with a specified miss-distance screening criteria or the corresponding probability of collision. Associated with the closest approach assessment is the closest approach distance, the times of launch or orbital firing that woul d result in the closest approac h, and meeting the miss-distance or collision probability criteria.

Conservatism: As used in risk analysis conserva tive modeling, conservatism is a set of modeling assumptions that overs tates the risk by overstating event probabilities, hazard probabilities, or consequences. Conservatism refers to the degree of overstating risk.

Containment: The launch safety strategy/process of minimizing risk to the maximum extent practical by keeping hazardous operations within defined hazard areas th at are unpopulated or where the population is controlle d and adequate protection can be provided to highly valued

resources; to stop, hold, or surround a hazard.

Critical operations personnel : Critical Operations Personnel include persons not essential to the specific operation or laun ch currently being conducted, bu t who are required to perform safety, security, or other critical tasks at the range. To be treated as Critical Operations Personnel they must be notified of a neighboring hazar dous operation and either trained in mitigation techniques or accompanied by a properly trained escort. Critical Operations Personnel do not include individuals in training for any job or individuals perfo rming routine activities such as administrative, maintenance, or janitorial. Critical Operations Personnel may occupy safety clearance zones and hazardous launch areas and may not need to be evacuated with the general public. Critical Operations Personnel should be included in the same risk category as Mission Essential Personnel.Decision Authority: The Range Commander or senior official designated by the Range Commander to make risk deci sions on his or her behalf.

Distant focusing: An atmospheric phenomenon that ca n produce greatly enhanced overpressure due to sonic velocity gradients with respect to altitude.

Endoatmospheric: Within the Earth’s atmosphere; genera lly considered to be those altitudes below 100 km.

Exoatmospheric: Outside the Earth’s atmosphere; generally considered to be those altitudes above 100 km.

Expected casualties: The mean number of casualties pred icted to occur as a result of an operation if the operation were to be repeated many times. This risk is expressed with the following notation: 1E-7 = 10 -7 = 1 in ten million.

Expected fatalities: The mean number of fatalities predic ted to occur as a result of an operation if the operation were to be repeated many times . This risk is expressed with the following notation: 1E-7 = 10 -7 = 1 in ten million.

Fatal injury: any injury that results in d eath within 30 days of the accident.

Fragmentation: The break up of an in-flight vehicle in to fragments (components of the vehicle, pieces of the structure, chunks of solid propellant , miscellaneous hardware, etc.) due to explosive loads, aerodynamic and inertial lo ads, activation of a flight termination system, intercept with another vehicle, or impact on a surface.

Federal Tort Claims Act : A statute that limits federal sove reign immunity and allows recovery in federal court for tort damages caused by fede ral employees, but only if the law of the state where the injury occurre d would hold a private person liable for the injury 28 USCA 2671-2680. Also FTCA. ]

Fidelity: The accuracy of the representation when compared to the real world.

Flight Termination System (FTS): The airborne portion of the F light Safety System. A flight termination system ends the flight of a vehicle an d consists of the entire system on an airborne vehicle used to receive, decode, and execute th e ground signals. It incl udes all wiring, power systems, and methods or devices (including inadverten t separation destruct systems) used to terminate flight.

General Public: People who are not declared/identif ied as mission essential personnel or critical operations personnel. This includes the public plus range personnel not essential to a mission, visitors, press, and personnel/d ependents living on the base/facility.

Hazard: Any real or potential condition that can cause injury, illness, or death of personnel, or damage to or loss of equipment or property.Hazard threshold: The lowest level at which advers e outcomes are expected to appear.

Hazard area: A geographical or geometrical surface area that is susceptible to a hazard from a planned event or unplanned malfunction.

Hazard volume: A geographical or geometrical volume of airspace that is susceptible to a hazard from a planned event or unplanned malfunction.

Hazardous operation: Those activities, which, by their na ture, expose personnel or property to dangers not normally, experien ced in day-to-day actions.

Impact: The impingement of a fragment on a surf ace, a structure, a person, or a vehicle.

Inadvertent Separation Destruct System (ISDS): a specialized form of ADS located on vehicle components that automati cally activates when inadverten t separation of the component from the main vehicle is sensed. There is often a built-in delay in cluded, in hope that the separated component will be suffi ciently displaced at charge activ ation to preclude damage to the main vehicle.

Individual risk: Individual risk is the risk that a pe rson will suffer a consequence. Unless otherwise noted, individual risk is expressed as the pr obability that an i ndividual will become a casualty due to all hazards (P C ) from an operation at a specific location. Guidance Information is that:

• If each person in a group is subject to the sa me individual risk, then the collective risk may be computed as the individual risk multiplied by the number of people in the

group.

• In the context of this document, individual risk refers to the probability that the exposed individual will become a casualty as a result of all hazards from a mission.

Informed decision: The “informed decision” principle is used in tort claims against the U.S. Government. The Federal Tort Claims Act (FTC A) enjoins the U.S. court system from secondguessing decisions made by properly authorized government officials in determining the acceptability of operational risks. A key test under the FTCA requires that the decision-making official be fully advised and informed of the know n risks. Failure to fully advise the decisionmaking authority of known risks can result in liability of the U.S. Government or its officials.

Involuntary activity: No choice was made by the person affected which placed them in a position of increased risk; or the ac tivity participated in or the item used was one that is generally done or used by more than 99% of the population. Examples: bathing, using coins, or drinking glasses.

Manned spacecraft: a spacecraft that is either currently occupied or intended to be occupied. Includes spacecraft en route to, and in support of, manned missions.Mishap: An unplanned event or series of events resu lting in death, injury, occupational illness, or damage to or loss of equipment or property or damage to the environment.

Mission: A flight test or operation. It may include multiple vehicles or all phases of the flight beginning with liftoff/launch. See the supplemen t Section 4.2.4 for details on defining a mission for risk assessment.

Mission essential: Those persons and assets necessary to safely and successfully complete a specific hazardous operation or launch.

Mission rules : Rules that define safety constraints and conditions and esta blish the boundaries within which the safety team operates. The l ead safety organization de velops the mission rules and briefs the range user to en sure a complete understanding of the intent and application of them. Mission rules are documented and b ecome part of the range safety plan.

Overpressure: The pressure caused by an explos ion over and above normal atmospheric pressure. It can be significantly affected by the atmospheric conditi ons, particularly the temperature and wind profiles.

Probability of casualty: The likelihood that a person will suffer a serious injury or worse, including a fatal injury, from a hazardous event. This risk is expressed with the following notation: 1E-7 = 10 -7 = 1 in ten million.

Probability of fatality: The likelihood that a person will die from a hazardous event. This risk is expressed with the following notation: 1E-7 = 10 -7 = 1 in ten million.

Prudent person: See Reasonable Person

Range Safety System (RSS): The ground-based portion of the Flight Safety System. An integrated system of hardware, software, and human operators which is necessary to provide mission safety support. Includes instrumentati on and communication infrastructure needed to fulfill safety’s flight control responsibility. See also Flight Safety System and Flight Termination System

Reasonable care: As a test of liability for negligen ce, the degree of care that a prudent and competent person engaged in the same line of bu siness or endeavor would exercise under similar circumstances - Also termed due care; ordi nary care; adequate care; proper care.

Reasonable person: A hypothetical person used as a legal st andard, especially to determine if someone acted with negligence. The reasonabl e person acts sensibly, does things without serious delay, and takes proper but not excessive precautions. Also termed Reasonable Man or Prudent Person

.
Reentry: The event occurring when a spacecraft or ot her object comes back into the sensible atmosphere after going to higher altitudes.Risk: Risk is a measure that accounts for both the probability of occurrence and the consequence of a hazard to a population or installa tion. Unless otherwise noted, risk to people is measured in casualties and expressed as individual risk or collective risk.

Risk analysis: A study of potential risk under a given set of conditions . Risk Analysis is an activity that includes the complete array of tasks from data gath ering, identification of hazards, estimation of associated risks, and verification of results. Risk management: Risk management is a systematic and logical process to identify hazards and control the risk they pose.

Risk profile: A plot that shows the probability of an accident causing a given number of casualties (vertical axis) vs. the num ber of casualties (horiz ontal axis). The area under the plot is a measure of the casualty expect ation. When a catas trophe-averse function is plotted on the same graph, the presence or absence of catastrophic risk is indicated.

Safety: Relative protection from adverse consequences.

Serious injury: Any injury that meets one or more of the following:

• Requires hospitalization for more than 48 hour s, commencing within 7 days from the date the injury was received.

• Results in a fracture of any bone (except simple fractures of fingers, toes, or nose).

• Causes severe hemorrhages, nerve, muscle, or tendon damage.

• Involves any internal organ.

• Involves second degree or third degree burns, or any burns affecting more than 5 percent of the body surface.

Ship Accident: A “ship accident” occurs if the vessel is involved in an accident that results in loss of life, personal injury that requires medical treatment beyond first aid, or complete loss of the vessel. This definition is c onsistent with the level of protection afforded people involved in a “boat accident” as define d in current regulations.

Sigma: Standard deviation.

Substantial damage: Relating to aircraft vulnerability m eans damage or failure that adversely affects the structural strength, performance, or f light characteristics of the aircraft, and that would normally require major repair or replacement of the affected component.

Toxic substance: A chemical or mixture that may pres ent an unreasonable risk of injury to health or the environment.

Toxics: A Generic term for the toxic propellant s and combustion by-products resulting from a nominal launch vehicle flight or catastrophic launch abort.Uncertainty: The absence of perfectly detailed knowledge. Uncert ainty includes incertitude (the exact value is unknown) and variability (the value is changing). Uncertainty may also include other forms such as vagueness, ambigu ity, and fuzziness (in the sense of borderline cases).

Variability: Observed differences attributable to true heterogeneity or diversity. Variability is the result of natural random pr ocesses and is usually not reducible by further measurement or study (although it can be better characterized ).

Verification: refers to the set of activities that ensure that software correctly implements a specific function. The verification process determ ines whether a computer simulation code for a particular problem accurately represents the soluti ons of the mathematical model. Evidence is collected to ascertain whether the numerical mo del is being solved correctly. This process ensures that sound software-quality practices are used and the soft ware codes themselves are free of defects and errors. It also ch ecks that the code is correctly solving the mathematical equations in the algorithms and verifies that the time and space steps or zones chosen for the mathematical model are sufficiently resolved.

Voluntary activity: The person affected made a choice that placed them in an increased position of risk compared to the rest of the population. This includes career and job choices. Examples include repetitive motion injuries, recreational boating, etc.