BY ORDER OF THE SECRETARY 

OF THE AIR FORCE

AIR FORCE INSTRUCTION 91-217

18 FEBRUARY 2010

Safety

SPACE SAFETY AND MISHAP 

PREVENTION PROGRAM 

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available on the e-Publishing website at 

www.e-publishing.af.mil for downloading or ordering.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: HQ AFSC/SES Certified by: AF/SED

(William C. Redmond)

Pages: 92

This instruction implements Air Force Policy Directive (AFPD) 91-2, Safety Programs, and the 

relevant safety portions of Department of Defense Directive (DoDD) 3100.10, Space Policy, 

DoDD 3200.11, Major Range and Test Facility Base, DoD Instruction (DoDI) 3100.12, Space 

Support, and in conjunction with Air Force Instruction (AFI) 91-202, The US Air Force Mishap 

Prevention Program, provides guidance for implementing a space safety mishap prevention 

program. It provides guidance to develop comprehensive space safety mishap prevention 

programs for existing and future space systems. This instruction also contains the minimum risk 

probability parameters required for safe space operations and testing. It applies to all Active 

Duty, Air Force Reserve and Air National Guard units that design, develop, modify, evaluate, 

test or operate existing and future Air Force (AF) space systems (operational, test and 

experimental), AF space support systems, or use or operate AF launch facilities or ranges. 

Ensure that all records created as a result of processes prescribed in this publication are 

maintained in accordance with AFMAN 33-363, Management of Records, and disposed of in 

accordance with the Air Force Records Disposition Schedule (RDS) located at 

https://www.my.af.mil/gcss-af61a/afrims/afrims/. The use of the name or mark of any specific 

manufacturer, commercial product, commodity, or service in this publication does not imply 

endorsement by the Air Force. Any organization may supplement this publication which must be 

reviewed and approved by the Office of Primary Responsibility (OPR). Major commands 

(MAJCOMs), field operating agencies (FOAs) and direct reporting units (DRUs) must send one 

copy of their proposed supplement to the OPR at HQ Air Force Safety Center, Space Safety 

Division (AFSC/SES). Other organizations send one copy of each proposed supplement to the 

next higher headquarters. Refer recommended changes and questions about this publication to 

the OPR using the AF Form 847, Recommendation for Change of Publication; route AF Form 
2 AFI91-217 18 FEBRUARY 2010

847s from the field through the appropriate chain of command to HQ AFSC/SES, 9700 G Street 

SE, Bldg 24499, Kirtland AFB NM 87117-5670 or AFSC.CSS. pubfmmgt@kirtland.af.mil.

Chapter 1—SPACE SAFETY PROGRAM 5

1.1. Scope. ..................................................................................................................... 5

Chapter 2—- SPACE SYSTEM SAFETY, RISK ACCEPTANCE, AND WAIVER AUTHORITY15

2.1. System Safety. ....................................................................................................... 15

2.2. Life Cycle Phases. .................................................................................................. 15

2.3. Program Manager and Operator Roles and Responsibilities. ................................ 18

2.4. Risk Acceptance, Non-Compliances and Waiver Authority. ................................ 18

2.5. Waivers .................................................................................................................. 19

Chapter 3—SYSTEM DEVELOPMENT 21

3.1. Development Risk. ................................................................................................. 21

3.2. Waiver and Approval Authority. ........................................................................... 21

3.3. General Design Considerations. ............................................................................. 22

3.4. Integrated Space Effects. ....................................................................................... 23

3.5. Testing. .................................................................................................................. 24

3.6. Configuration Control and Management. .............................................................. 25

3.7. System Safety Management Plan and the Software Safety Plan. .......................... 25

3.8. Software and Hardware Installations. .................................................................... 26

3.9. Test/Operational Performance Reviews. ............................................................... 26

Chapter 4—LAUNCH, SYSTEM DEPLOYMENT, AND REENTRY 27

4.1. System Deployment. .............................................................................................. 27

4.2. Safety Responsibilities. .......................................................................................... 27

4.3. Transportation. ....................................................................................................... 27

4.4. Ground Based Equipment Assembly and Checkout. ............................................. 27

4.5. Pre-launch Safety. .................................................................................................. 28

4.6. Launch Safety. ....................................................................................................... 28

4.7. Launch Vehicle EOL Requirements ...................................................................... 31

4.8. Reentry Safety ........................................................................................................ 32

4.9. Waiver and Approval Authority. ........................................................................... 34

4.10. Additional Range, Launch, and RV Guidance. ...................................................... 35
AFI91-217 18 FEBRUARY 2010 3

Chapter 5—-ORBITAL SAFETY 36

5.1. Orbital Safety Program. ......................................................................................... 36

5.2. On-Orbit Risk. ....................................................................................................... 37

5.3. Waiver and Approval Authority. ........................................................................... 38

5.4. Orbital Mishaps and Anomalies. ............................................................................ 38

5.5. Orbital Mishap Prevention. .................................................................................... 39

5.6. Orbits. .................................................................................................................... 40

Figure 5.1. High Interest Earth Orbits ...................................................................................... 40

5.7. Space Environmental Hazards. .............................................................................. 41

Figure 5.2. Van Allen Belts relative to GPS and GEO orbits .................................................. 42

5.8. Space Debris. ......................................................................................................... 42

5.9. Conjunction Assessment. ....................................................................................... 49

5.10. Collision Avoidance. ............................................................................................. 49

5.11. End-of-Life Actions. .............................................................................................. 51

Figure 5.3. Operating, Storage and Disposal Regions/Orbits. ................................................. 53

5.12. Recovery Procedures. ............................................................................................ 57

5.13. Near Earth Objects. ................................................................................................ 57

Chapter 6—-SAFETY OF SPACE CONTROL SYSTEMS 59

6.1. Space Control Systems. ......................................................................................... 59

6.2. Safety Program. ..................................................................................................... 59

6.3. Other Space Systems. ............................................................................................ 59

6.4. Risk Responsibility Phases. ................................................................................... 59

6.5. Waiver and Approval Authority. ........................................................................... 60

Chapter 7—HIGH ALTITUDE OPERATIONS SAFETY 62

7.1. High Altitude Operations. ...................................................................................... 62

7.2. Platforms. ............................................................................................................... 62

7.3. Payloads. ................................................................................................................ 62

7.4. High Altitude Environment. ................................................................................... 62

Chapter 8—-SAFETY OF DIRECTED ENERGY/KINETIC SYSTEMS 63

8.1. Directed Energy Systems. ...................................................................................... 63

8.2. Kinetic Energy Systems. ........................................................................................ 63

Chapter 9—FUTURE FOR SPACE SAFETY PROGRAMS 64
4 AFI91-217 18 FEBRUARY 2010

9.1. Updates. ................................................................................................................. 64

9.2. Forms ..................................................................................................................... 64

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 65

Attachment 2—SPACE DEBRIS ASSESSMENT REPORT 83

Attachment 3—END-OF-LIFE PLAN 89
AFI91-217 18 FEBRUARY 2010 5

Chapter 1

SPACE SAFETY PROGRAM

1.1. Scope. This document implements space safety, mishap prevention and mission 

effectiveness guidance for AF space systems. More specifically, Chapter 1 is applicable to all 

space systems and through all system life cycle phases.

1.1.1. Purpose. The Air Force operates responsibly with due regard for the safety of the 

general public, AF personnel, space support personnel and public (non-commercial 

launch system operator-owned) resources. This document provides overarching space 

safety, mishap prevention and mission effectiveness guidance for acquisition, testing, and 

operations of terrestrial, launch, orbital and kinetic/directed energy space systems.

1.1.2. Applicability. This instruction is applicable to all AF organizations and personnel 

that develop, test, or operate any space system or who provide launch/range services for 

space systems. This includes space systems under development, research and 

development systems, experimental systems, systems undergoing testing, and operational 

systems. Personnel assigned to non-AF organizations are exempt, except as stated 

through other agreements. This instruction is applicable to the entire mission if the Air 

Force is the lead, launching, manufacturing or operating agency, or if the Air Force is 

providing funding for the mission without regard to the method of procurement or 

agreement.

1.1.2.1. Mission Partner Responsibilities. When partnered with non-AF organizations 

(for personnel, funding or resources in-kind), AF organizations and personnel will 

ensure their activities are compatible with AF space safety guidance. Prior to 

embarking upon a mission partnership, Memorandums of Agreement (MOAs) will be 

established between all participating organizations outlining each organization‘s 

responsibilities and requirements with regards to space safety.

1.1.3. Terminology. The term "appropriate wing commander" is used throughout this 

instruction since risk responsibilities may overlap different organizations and is the 

responsibility of all involved organizations to ensure adequate protection to the general 

public, manned spacecraft and active spacecraft. Therefore, MAJCOMs will identify the 

specific "appropriate wing commander" in their supplements to this instruction and will 

specify when safety responsibility transfers between organizations.

1.2. Space Safety. Space Safety is a dynamic process designed to improve operational 

effectiveness by preventing close calls, mishaps, and provide for mission assurance 

throughout the life cycle of a space system. It also includes launch/range safety, orbital 

safety, space control safety, System Safety, integrated effects of combined systems, software 

safety, risk management, and mishap investigations and reporting. The goal is to enhance 

mission effectiveness and success by proactively preventing mishaps and close calls.

1.2.1. Space Mishaps. Space mishaps are any unplanned events involving space systems 

that result in personnel injury, system damage/destruction or mission capability 

loss/delay. Note: For reporting purposes, it also includes near misses, close calls and 

high accident potential (HAP) events. See AFI 91-204, Safety Investigations and Reports
6 AFI91-217 18 FEBRUARY 2010

or AFMAN 91-222, Space Safety Investigations and Reports for specific reporting 

requirements.

1.2.2. Mission Assurance and Space Safety. Space safety provides for mission assurance 

by appropriately managing risks and increasing system availability. Note: Space safety 

is only one aspect of mission assurance for space systems. There are other aspects of 

mission assurance that are beyond the scope of space safety and this document.

1.2.3. Space Mishap Prevention. Space mishap prevention is a continuous process that 

begins at the initiation of the concept development phase of the program and continues 

through the program's end-of-life (EOL), and includes reentry and recovery activities for 

applicable programs. Risk management will be practiced throughout all phases of a 

space system‘s lifetime.

1.2.3.1. Consistent with national security requirements and in accordance with 

(IAW) DoDD 3100.10, ―All DoD activities to, in, through, or from space, or aimed 

above the horizon with the potential to inadvertently and adversely affect satellites or 

humans in space, shall be conducted in a safe and responsible manner that protects 

space systems, their mission effectiveness, and humans in space, consistent with U.S. 

Space Command, as appropriate, for predictive avoidance or deconfliction with U.S., 

friendly, and other space operations.‖ Note: ―All DoD activities‖ is construed to 

include all operations on a DoD range, to include commercial and civil operations. 

All deconfliction activities that affect space systems will be coordinated with the Joint 

Space Operations Center (JSpOC).

1.2.3.2. Readiness and Mishap Prevention. A readiness process should be employed 

to measure the effectiveness of prevention steps with supporting metrics. This 

process should determine if the appropriate steps have been taken to provide a 

reasonable expectation of preventing mishaps. This includes the establishment of 

System Safety Groups IAW AFI 91-202, The US Air Force Mishap Prevention 

Program, ensuring maximum safety training level and availability, and outlining the 

qualifications of space safety investigators.

1.2.4. System Safety. System Safety is the application of engineering and management 

principles, criteria and techniques throughout all phases of the system life cycle to 

optimize safety within the constraints of operational effectiveness, time and cost. System 

Safety enhances the utility and effectiveness of space systems. It is thus critical that 

System Safety be employed throughout the space system‘s life cycle.

1.2.5. Reporting. The cornerstone of mishap prevention is understanding failures and 

close calls, and taking action to prevent future occurrences. In order to prevent future 

mishaps and close calls, it is in the Air Force‘s interest to document and share lessons 

learned in a timely fashion with other DoD, federal, and commercial space entities. 

Pursuant to AF and federal regulations, and consistent with handling procedures for 

classified material and contractor proprietary data, lessons learned will be shared in order 

to enhance safety in all aspects of space operations. Note: Due to the limitations on the 

use of proprietary data, personnel involved in safety investigations should ensure that 

information is indeed proprietary as this limits the use of lessons learned. The Air Force 

Safety Automated System (AFSAS) is authorized to contain proprietary information.
AFI91-217 18 FEBRUARY 2010 7

1.2.5.1. All mishaps/events, close calls, near-misses, and HAP events meeting 

reporting requirements of AFI 91-204 and AFMAN 91-222 will be reported using 

AFSAS. Contact MAJCOM/SE and HQ AFSC/SES for documenting classified space 

mishaps.

1.2.5.2. MAJCOMs will forward lessons learned to HQ AFSC/SES for tracking. 

When lessons-learned module for AFSAS is implemented, the MAJCOMs will enter 

lessons learned directly. The data will be shared within DoD safety channels and 

with other federal safety organizations pursuant to DoDI 6055.07, Accident 

Investigation, Reporting, and Record Keeping and other interagency agreements.

1.3. Space Safety Council (SSC). The SSC will assist the AF Chief of Safety (CoS) in 

fulfilling oversight responsibilities through effective governance and management. The SSC 

shall: recommend DoD/federal and commercial space safety policy, prepare and monitor 

DoD/federal and commercial space safety directives or instructions concerning safety issues; 

promote space safety initiatives for both DoD/federal and commercial space flight; maximize 

collaboration with organizational Safety Offices; discuss space safety related System Safety 

issues; and provide for an independent assessment of overall program safety. This council, 

co-chaired by HQ AFSC/SES and HQ AFSPC/SEC, is composed of the Chiefs of Safety, or 

their representatives, from each MAJCOM HQ, appropriate Wings and Centers (including 

the Space and Missile System Center (SMC)), and other military/civil space agencies (NRO, 

AFRL, NASA, FAA). The SSC will be held bi-annually.

1.4. Space Safety Training. Assigned space safety personnel will be trained in all aspects 

of space safety to ensure mission effectiveness appropriate for the duties and missions of 

their assigned organization. HQ AFSC has several training courses that fall into two 

categories, prevention and investigation. MAJCOMs and wings will add other courses as 

appropriate for the mission and personnel assigned.

1.4.1. MAJCOM safety offices will help subordinate units develop space mishap 

prevention and investigation training courses as appropriate for assigned missions. This 

training should be tailored at the wing level and below for greater detail, hands-ontraining, and exercises.

1.4.2. Space Mishap Prevention Training. Mishap prevention courses shall address 

methods for mishap prevention in all phases of a system's life cycle (from initial concept 

development, design, acquisition, testing, integration, operations, through EOL). 

Although there are currently no mishap prevention courses tailored specifically for space 

safety, relevant courses include the CoS and System Safety courses offered by HQ 

AFSC.

1.4.2.1. The following topics should be covered during any space safety/mishap 

prevention training/course: the System Safety process; risk management; acquisition; 

testing; Command and Control (C2) of space forces; space situational awareness; 

safety of space control systems; launch safety; space environment; orbital safety; 

Conjunction Assessments (CA); Collision Avoidance (COLA); mission assurance for 

space systems; current and future space systems; high altitude operations relevant to 

space related topics; tactics, techniques and procedures; AF, DoD, and US 

government policies; and international laws and guidelines. The following areas

should also be emphasized due to increased relevance in space safety: organizational 
8 AFI91-217 18 FEBRUARY 2010

roles and responsibilities; Commander's intent; human factors; and mishap 

prevention/mission preservation metrics and normalizing procedures.

1.4.2.2. The following space-relevant mishap prevention courses are available:

1.4.2.2.1. Chief of Safety course. This course is used to teach personnel how to 

be an organizational Chief of Safety. This course covers Ground, Aviation, 

Weapons and Space Safety and is open to any current and newly assigned Chiefs 

of Safety. The HQ AFSC Space Safety Division provides space specific training 

during this course.

1.4.2.2.2. System Safety course. This course teaches safety aspects of system 

integration with emphasis on the design and development portion of a system‘s 

lifetime. This course is highly recommended for all space safety personnel. The 

relevant System Safety Management and/or System Safety Analysis course is 

mandatory for key (as determined by Numbered AF (NAF)/center/SE) System 

Safety personnel.

1.4.3. Investigation Training. Investigation courses concentrate on how to conduct a 

mishap investigation and how to produce required mishap reports. The Board Presidents 

Course (BPC), Mishap Investigation Non-Aviation (MINA) course and the Aviation 

Mishap Investigation Course (AMIC) are offered by HQ AFSC.

1.4.3.1. Space Mishap Investigation. The following topics should be covered during 

any space mishap investigation course: preservation of mishap data and material; 

System Safety; indemnification; International Traffic of Arms Regulation (ITAR); 

other treaties/international laws and guidelines; roles/responsibilities; Federal 

Aviation Administration (FAA) / Federal Communications Commission (FCC) / 

National Aeronautics and Space Administration (NASA) / National Transportation 

Safety Board MOAs/Memorandums of Understanding (MOU); purpose and processes 

of the Engineering Analysis Group; Engineering Review Board; timelines; prelaunch, launch, orbital and CA/COLA processes; anomaly investigations; space 

environment; AFMAN 91-222; safety of space control systems; and C2 for space 

forces. Additional emphasis will be placed upon the following topics due to the 

relevance to space investigations: ownership; mishap accountability; AF interest; 

contractor operations; high-visibility mishaps; proprietary information; Interim Safety 

Board (ISB) process; human factors; subsystems; data sources; impounded data; 

frozen ground system configurations/facilities; summary review of past space 

mishaps and varying investigation processes (e.g., telemetry only vs. hardware and 

telemetry). The following space-relevant investigation courses are available:

1.4.3.1.1. Board Presidents Course. The BPC is a course used to teach senior 

leaders how to be a Safety Investigation Board (SIB) President. The class is open 

to other personnel and ranks on a space available basis. This is a required course 

for assignment as Board President to a SIB. The HQ AFSC Space Safety 

Division provides space specific training during this course.

1.4.3.1.2. Mishap Investigation Non-Aviation course (or equivalent). The MINA 

course is used to train safety personnel the aspects of investigating mishaps. This 

is a required course for assignment to a SIB as the Investigating Officer or as a 
AFI91-217 18 FEBRUARY 2010 9

Single Investigating Officer.

1.4.3.1.3. Aviation Mishap Investigation Course (or equivalent). AMIC is used 

to train safety personnel the aspects of investigating mishaps. This course may be 

used as a supplement or replacement for the MINA or equivalent courses.

1.4.4. Space Safety Training for Space Safety Personnel. The following requirements 

apply to all space safety personnel. Unless otherwise noted, waivers to these 

requirements must be approved and documented by the MAJCOM Safety Office.

1.4.4.1. Each organization will ensure that assigned space safety personnel receive 

either formal training (i.e. course taught at HQ AFSC, under contract, or at another 

institution; e.g. MINA) or local training (i.e. training conducted at the Wing or lower 

level) in mishap prevention (a safety program management course or equivalent with 

space safety tailored material) and mishap investigation (MINA or equivalent course 

with space safety tailored material).

1.4.4.1.1. The MAJCOM Safety Office will determine if existing training at 

subordinate units is sufficient to meet the space safety local training requirements 

outlined in this document. The MAJCOM safety office is the waiver authority for 

formal training requirements.

1.4.4.1.2. The NAF/Center Safety Office will determine which space safety 

positions (other than the CoS) require formal training versus local training. 

Personnel assigned to a CoS position require formal training. Unless otherwise 

determined by the NAF/Center Safety Office, Wing level space safety personnel 

should be formally trained.

1.4.4.2. Supplemental training should be provided and tailored to local space safety 

requirements for greater applicability to the assigned missions.

1.4.4.3. Formal training will be accomplished within 120 days (or first available 

course(s)) of assignment to a space safety position and annually thereafter. Local 

training is sufficient for annual refresher training.

1.4.4.4. Local training will be accomplished within 120 days (or first available 

course(s)) of assignment to a space safety position and annually thereafter.

1.4.4.5. The following Space Safety positions/duties are required for organizations 

acquiring, testing or operating space systems:

1.4.4.5.1. Chief of Safety. A Chief of Safety is required for wing-level 

organizations that conduct operational space or space test missions. MAJCOM 

safety offices will determine which of their wing-level organizations (other than 

organizations that conduct operational space or space test missions) require a 

CoS.

1.4.4.5.2. Space Safety Officer (SSO). These positions include System Safety 

Manager, Space Control Safety Officer, Launch Safety Officer (LSO) and Orbital 

Safety Officer (OSO). These individuals will be trained in System Safety, and 

space mishap prevention and investigation within 120 days (or first available 

course).
10 AFI91-217 18 FEBRUARY 2010

1.4.4.5.2.1. The MINA course or equivalent is a suitable mishap investigation 

course. AMIC is recommended for LSOs with some knowledge of aircraft. 

NASA courses may be substituted for greater applicability if basic mishap 

prevention and investigation material is covered. As a general rule, System 

Wings not performing operations or operational test missions will require a 

System Safety Manager instead of a Chief of Safety. Note: These positions 

may include personnel assigned to pre-existing space safety positions.

1.4.4.5.2.2. As appropriate for the assigned mission, each wing (or 

equivalent) will have at least one SSO for each program. These individuals 

may be assigned to subordinate units. With approval from the NAF/Center 

Safety Office, these positions may be assigned as an additional duty. Multiple 

programs may be covered by the same SSO.

1.4.5. Space Safety Training for Operations Personnel. All space personnel, to include 

military, government civilians and contractors (required via Performance Work 

Statement/ Statement of Work or provided via government representative), will receive 

local initial (prior to operational certification) and annual space safety training (as 

outlined in sections 1.4.1 and 1.4.2) tailored for their assigned tasks and position.

1.4.5.1. Training for operations personnel should be provided by space safety 

personnel (e.g. unit SSO) or certified instructors familiar with the training material.

1.4.6. Units will establish risk management derived procedures to prevent mishaps while 

training on live operational systems.

1.5. Safety Office Responsibilities.

1.5.1. MAJCOM Responsibilities. Each MAJCOM will develop and administer a space 

safety program as appropriate to that MAJCOMs involvement with space systems. As a 

minimum, the MAJCOM Safety Office will:

1.5.1.1. Keep the MAJCOM/CC apprised of all issues related to space safety.

1.5.1.2. Implement mishap prevention policies, standards and procedures. The 

MAJCOM/SE will analyze all mishap reports to ensure proper safety investigations 

are accomplished in a timely manner per MAJCOM/CC direction, corrective actions 

are fully implemented, and that lessons learned are shared between the MAJCOMs 

and their subordinate units.

1.5.1.3. Develop metrics to measure the success of the mishap prevention program. 

This may consist of tracking anomalies or space safety related launch delays by likely 

causes, such as human error or equipment failure.

1.5.1.4. Assist subordinate units in developing local space safety programs and 

related training. Ensure that relevant training material is cross flowed between 

similar units and make training available to outside organizations and personnel, as 

appropriate.

1.5.1.4.1. Determine if existing training at subordinate units is sufficient to meet 

the space safety training requirements outlined in this document or if existing 

training should be supplemented.
AFI91-217 18 FEBRUARY 2010 11

1.5.1.5. Evaluate NAF/center/wing space safety programs.

1.5.1.6. Ensure a sufficient number of personnel (MAJCOM and below) are trained 

in space mishap prevention and space mishap investigation. At a minimum, each 

program will have a trained SSO. Each NAF/Center Safety Office will have at least 

one trained SSO, consistent with their assigned mission.

1.5.1.7. Identify and document individuals who are SIB trained and assignable for 

Class A mishaps.

1.5.1.8. By 1 April each year, update HQ AFSC/SES of all MAJCOM/CC approved 

and active waivers.

1.5.1.9. Establish MOAs with or on the behalf of non-AF organizations to ensure the 

needs, requirements, and policies of both organizations are understood and 

implemented. MOAs should also address which space safety policy will be used by 

AF personnel assigned to non-AF organizations.

1.5.1.10. For space systems on foreign soil, establish MOAs to address 

organizational roles and responsibilities in the event of a mishap. This will include, at 

a minimum, who will lead or participate in the investigation and their roles and 

responsibilities. The MOA will specify the information that (obtained by the 

investigation) can be shared for lessons learned purposes per the laws of the country 

owning the space asset. Follow the procedures of AFI 51-701, Negotiating, 

Concluding, Reporting, and Maintaining International Agreements, when preparing a 

MOA.

1.5.1.11. Testing. Ensure subordinate units develop and implement risk 

management-based processes for use throughout the system‘s testing life cycle. 

MAJCOMs will ensure test procedures for use on operational equipment are reviewed 

and approved at the appropriate level prior to test initiation.

1.5.1.12. Determine which operationally related safety issues need to be coordinated 

with Joint Functional Component Command for Space (JFCC-SPACE), 14 AF/SE 

and/or 14 AF/CC.

1.5.1.13. Assist the NAF/center in determining the scope of the duties for 

NAF/center assigned SSOs.

1.5.1.14. Establish ISB requirements.

1.5.1.15. (For MAJCOMs that test space systems) Develop and implement risk 

management based processes for use throughout the testing life cycle.

1.5.2. NAF/Center Responsibilities. Each NAF/center that develops, tests, or operates 

space systems will develop and administer local space safety guidance 

appropriate/specific for their organization. At a minimum, the NAF/Center Safety Office 

will:

1.5.2.1. Keep the NAF/center commander and the CDR JFCC-SPACE (coordinate 

with 14 AF/Director of Safety, as appropriate) apprised of all issues related to space 

safety.
12 AFI91-217 18 FEBRUARY 2010

1.5.2.2. Identify and document individuals who are SIB or Single Investigating 

Officer trained and assignable for mishap investigation duties.

1.5.2.3. Assist subordinate units in developing and tailoring space safety programs, 

procedures and training for greater applicability to their assigned missions.

1.5.2.4. Ensure subordinate units employ the appropriate level/authority of risk 

acceptance for all space safety related risk decisions.

1.5.2.5. Assist subordinate units in determining the appropriate number, scope of 

duties, and training for SSOs.

1.5.2.6. Ensure subordinate units standardize space safety related procedures, as 

appropriate for different programs. For example, COLA procedures for low thrust, 

high efficiency thrusters (e.g. Hall Effect thrusters) would most likely not be the same 

as higher thrust, lower efficiency thrusters (e.g. hydrazine thrusters on Defense 

Satellite Communications System III satellites). Standardized procedures only where 

appropriate for operational efficiency and mission effectiveness.

1.5.3. Acquisition Organization Responsibilities. Organizations that acquire or upgrade 

space systems will coordinate with the NAF/Center Safety Office to implement a space 

safety program appropriate for their organization. At a minimum, the acquisition 

organization will ensure that:

1.5.3.1. The MAJCOM Safety Office and Headquarters Air Force Safety 

Center/Space Division (HQ AFSC/SES) are invited to participate in all System Safety 

Group meetings for each space program.

1.5.3.2. System Safety Managers are provided the opportunity to ensure space safety 

requirements are included in appropriate systems requirements documents for all 

space system acquisitions and upgrades.

1.5.4. Space Wing/Group and Test and Evaluation Wing/Group Safety Office 

Responsibilities. Organizations that test or operate space systems will implement a space 

safety program appropriate for their organization. At a minimum, the Safety Office will:

1.5.4.1. In coordination with the NAF/Center Safety Office, determine the number 

and scope of duties for assigned SSOs. Each program will have at least one trained 

SSO. With approval from the NAF/Center Safety Office, multiple programs may be 

covered by the same SSO.

1.5.4.1.1. Coordinate with the acquisition Center‘s Safety Office in determining 

the number and duties of System Safety Managers. Justify and document any 

System Safety Manager positions that are part time or an additional duty.

1.5.4.2. Supervise local space safety programs and training to ensure compliance 

with this and appropriate subordinate instructions.

1.5.4.3. Identify and document individuals who are ISB or Single Investigating 

Officer trained and assignable for Class C, D mishaps and E HAPs/events.

1.5.4.4. Ensure assigned units develop and implement risk management procedures 

to prevent mishaps while training on operational systems.
AFI91-217 18 FEBRUARY 2010 13

1.5.4.5. Ensure that assigned SSOs have unhindered access to the CoS or Wing 

CC/CV for reporting potential safety issues.

1.5.4.6. Approve, as applicable, CA/COLA processes used for all on-orbit assets that 

the wing has Tactical Control (TACON) over.

1.5.4.7. Manage the Range Safety Program for the Wing/Group Commander.

1.5.5. Air Force organizations should ensure that all appropriate reporting requirements 

(e.g. those required by AFI 10-series) as well as contractual mechanisms are outlined in 

agreements between the Air Force organization and mission partners.

1.6. Tenant and Geographically Separated Units (GSU). Tenant units and GSUs will 

have an established space safety program IAW the requirements of their parent organization 

and this document. Mishap reporting is the responsibility of the owning organization 

(organization that incurred the mishap) and wing or equivalent safety office. The host unit 

can provide assistance with reporting requirements.

1.7. Joint / DoD / Non-DoD Space Safety Guidelines. Organizations operating in a joint 

environment or with non-DoD agencies will develop MOAs/MOUs that specify the space 

safety guidelines to be used. It is the responsibility of the participating organizations to 

determine the lead agency and proper approval authority. Consult with NAF and 

MAJCOM/SE, as appropriate.

1.7.1. In the event that non-AF guidelines will be followed, a waiver of the pertinent AF 

guidelines is required from the appropriate OPR prior to development and operation of 

the space system.

1.7.2. Title 14, Code of Federal Regulations (CFR), Part 417, Launch Safety, delineates 

safety requirements for commercial launch operators, established by the FAA in 

conjunction with the DoD, that are fully compatible with DoD space safety guidance. It 

is the responsibility of the participating organizations‘ commanders to determine lead 

agency and proper approval authority. Consult with NAF and MAJCOM/SE as 

appropriate.

1.8. Human Factors. The proliferation of highly automated systems, increasingly complex 

weapon systems and rising demands for rapid and accurate responses to dynamic mission 

environment introduces significant changes in the role of humans and task demands imposed 

upon operators. The ability of the Air Force to successfully cope with these challenges 

carries important implications for safety and mission effectiveness. Consistent Human 

Systems Integration (HSI), which incorporates human factors engineering, manpower, safety 

and personnel to name a few considerations, is a necessary answer to the challenges of 

developing and fielding usable, effective and safe systems. The institution of a formal HSI 

program, IAW DoDI 5000.02, Operation of the Defense Acquisition System, and Under 

Secretary of Defense (AT&L) guidance, based upon operator usability requirements is 

necessary and can positively impact critical operational concerns such as mishap reduction, 

mission management and command and control decision support. Reference AFI 63-1201, 

Life Cycle Systems Engineering for specific requirements.

1.9. Personnel and Resource Protection. Consistent with Commercial Space Operations 

Support Agreements and other local agreements, space safety programs will be designed to 
14 AFI91-217 18 FEBRUARY 2010

protect AF personnel and the general public from accidental death, injury or occupational 

illness and protect AF systems, equipment, material and facilities in the launch area from 

damage or delayed operation as a result of space related operations.

1.9.1. Air Force personnel shall not enter into the safety clear zone of hazardous prelaunch operations, if a contractor is responsible for the conduct of the operation, unless 

special dispensation has been granted by the Wing Commander (or equivalent) or by the 

Chief of Safety, if so delegated.

1.9.2. When the Air Force enters into a contract or written agreement transferring use of 

a facility to another organization, the responsibility for personnel and resource protection 

is simultaneously transferred.

1.10. Mission Readiness. Due to the inherent hazards of rockets and launch operations, the 

pre-launch campaign will be conducted in a deliberate fashion, with formal milestones and 

reviews to ensure mission readiness and that adequate launch safety processes have been 

employed for the protection of the public and government resources. These include, at a 

minimum, dress rehearsals (consistent with contractual requirements), Flight Readiness 

Reviews (FRR), and Launch Readiness Reviews (LRR).

1.10.1. EOL disposal planning will be accomplished for all test, experimental, or 

operational orbital space systems that are not expected to immediately reenter after 

mission completion. See paragraph 5.8.2.3.2 for specific requirements.

1.10.2. Spacecraft at end of mission but with useful life will be placed in a mode of 

operation that minimizes the risk of debris generation, interference with other active 

spacecraft, and the inability to perform reentry or disposal maneuvers until such time that 

the spacecraft is reactivated or permanently disposed of.

1.10.3. At the end of the pre-launch phase and before initiating final countdown, a LRR 

will be conducted so that the Space Launch Commander is assured of the safety of the 

launch and the readiness of all personnel and systems involved.

1.11. Radiological Material. All space systems with radiological material, will comply 

with AFI 91-110, Nuclear Safety Review and Launch Approval for Space or Missile Use of 

Radioactive Material and Nuclear Systems, for specific mishap prevention requirements. 

Non-DoD systems with radiological material are subject to the Interagency Nuclear Safety 

Review Panel process.
AFI91-217 18 FEBRUARY 2010 15

Chapter 2

- SPACE SYSTEM SAFETY, RISK ACCEPTANCE, AND WAIVER AUTHORITY

2.1. System Safety. System Safety will be incorporated throughout all life cycle phases of 

space systems. Program managers will employ current government and military standard 

practices to establish their System Safety program, including the development and 

implementation of a System Engineering Plan (SEP), in all developmental and sustaining 

engineering activities. Reference AFI 63-1201 for further information.

2.1.1. Apply the System Safety process at all system levels and throughout each and every 

phase of the space system life cycle for space systems. Space systems or other elements or 

subsystems, will be designed and operated safely along with their internal and external 

interfaces. Since mishaps may occur or be caused in any phase of the system life cycle, each 

and every phase of the system life cycle, including orbital phase and EOL as well as launch, 

must be addressed using the System Safety process to eliminate or control hazards and 

manage mishap risks. Objectives of the System Safety process shall include preservation of 

mission capability, space systems, assets and forces. Losses of systems, mission degradation, 

cost and schedule impacts shall be considered. The intent is not to duplicate work performed 

by related or other functional disciplines, but to ensure it is done in a systematic manner that 

addresses and manages mishap risk.

2.1.2. The term System Safety is used to refer not only to a process, but to a system attribute 

or attributes (analogous to quality, reliability, performance, or life cycle cost) that varies 

inversely with mishap risk.

2.1.3. Consistent with acquisition guidance, System Safety Managers should ensure that:

2.1.3.1. System Safety is incorporated into the design of space systems, subsystems, and 

components.

2.1.3.2. Each phase of the system life cycle consider and manage hazard and mishap risk 

potential.

2.1.3.3. Per NSSAP 03-01 and other DoD directives and instructions, every acquisition 

strategy will include a Programmatic Environmental, Safety, and Health Evaluation 

(PESHE) for all space system acquisitions.

2.1.3.4. Application of safety fundamentals must begin with concept inception, and must 

cover all efforts across all lifecycle phases, to include sustainment and disposal, for all 

Air Force products and systems. These systems must exhibit and preserve attributes of 

operational safety, suitability, and effectiveness and mission assurance throughout their 

operational life.

2.1.4. The intent is not to duplicate work performed by related or other functional 

disciplines, but to ensure safety is considered and applied in a systematic and dedicated 

manner to manage hazard and mishap risk potential.

2.2. Life Cycle Phases. For the purposes of this instruction, space system life cycle phases are 

described below and are organized under system development, deployment and operations. This 

instruction uses and expands on the NSSAP phases. However, the NSSAP  ̳Build and 
16 AFI91-217 18 FEBRUARY 2010

Operations‘ phase is broken down into sub-phases due to the large number of space safety 

considerations. During each phase, the system will be reviewed by AF System Safety experts to 

ensure that adequate System Safety requirements and processes are incorporated into all 

documentation and activities in accordance with AFI 91-202, Mil-Std 882 and the Program's 

SEP.

2.2.1. System Development. System development begins with initial concept studies, 

includes many of the key acquisition processes and ends after production.

2.2.1.1. Concept Development Phase. Includes concept studies, trade studies, system 

architecture development, assessment of vulnerability and protection mitigation 

measures, technology development and maturity assessments, risk reduction, 

requirements development, preliminary system safety program plan and Test and 

Evaluation Master Plan development. Events that occur during the Concept 

Development Phase include the System Requirements Review and the System Design 

Review. During this phase, baseline development is mature enough to enter the formal 

acquisition process.

2.2.1.2. Preliminary Design Phase. The Preliminary Design phase includes activities to 

increase the confidence in system alternatives by assessing risk levels and projected 

performance at a detailed engineering level. During this phase, system alternatives are 

assessed for risk levels and projected performance at a detailed engineering level. 

Activities include efforts to mature technology, and baseline management and program 

definition. The acquisition/development agency will design systems to minimize hazards 

(including the generation of debris) during development, operations, and disposal of the 

system. This phase culminate in a Preliminary Design Review.

2.2.1.3. Complete Design Phase. This phase includes a baseline design and support 

concept of sufficient detail to support the Critical Design Review and Capability 

Production Document development.

2.2.1.4. Build Phase. (Part of the NSSAP build and Operations phase.) During the Build 

Phase, components are fabricated, tested and assembled into subsystems and systems 

which are tested as required. Testing for safety-critical components may include initial 

qualification and production acceptance tests. The products from this phase are systems 

and components ready for deployment.

2.2.2. Deployment. Deployment includes transportation of systems from the factory to 

operational units and assembly, checkout and certification of the system. Deployment 

contains the following sub-phases which fall under the NSSAP  ̳Build and Operations‘ phase:

Note: It is understood that the term  ̳deployment‘ when used in the context of operational 

systems (i.e. mobile systems) and spacecraft mechanisms (e.g. solar array deployment) have a 

different meaning than that used here. For the purposes of this document,  ̳deployment‘, as used 

in this chapter, is defined as above. 

2.2.2.1. Transportation Phase. The Transportation Phase is initiated when the system is 

loaded onto the first transportation equipment and ends when it has been unloaded from 

the last transportation equipment (not to include launch vehicles). Programs developing 

critical hardware and high value systems will produce transportation plans that address 

safety concerns.
AFI91-217 18 FEBRUARY 2010 17

2.2.2.2. Pre-Launch Phase (for systems operating to, through or from space). During the 

Pre-Launch Phase, ground systems are assembled and tested per established procedures 

and milestones. The appropriate commander or equivalent will review the results of 

assembly and test and certify the system for operation. The appropriate Wing 

Commander or equivalent will certify system (spacecraft, launch vehicle, and ground 

support systems) readiness for launch. The appropriate launch and/or test range Wing 

Commanders or equivalent will certify range and public safety readiness for launch.

2.2.2.3. Launch (for systems operating to, through or from space) Phase. The Launch 

Phase will not be initiated until after system and range readiness has been declared. 

Launch is initiated with the final manual command to launch (usually initiation of the 

final automated countdown sequence) and ends when the satellite or payload separates 

from all launch vehicle and upper stage components.

2.2.2.4. Early-Orbit Deployment and Checkout (for systems operating to, through or 

from space) Phase. This Phase is also known as Test and Checkout.

2.2.2.4.1. This phase is initiated when the last launch vehicle or upper stage 

component separates from the spacecraft or payload and ends when the in-space 

system is declared operational and Tactical Control (TACON) is transferred to the 

operational Space Wing.

2.2.2.4.2. Activities in this phase include orbit and attitude adjustments, 

satellite/payload reconfiguration for operations (e.g. deployment of solar panels and 

protective covers), and bus and payload system checkouts. This phase ends with 

operational readiness certification by the appropriate authority.

2.2.2.5. Assembly, Check-out and Verification of Space Ground Systems phase. This 

phase applies to space ground support systems such as ground command and telemetry 

antennas/equipment, space surveillance radars and optical systems. This encompasses 

the on-site assembly, subsystem and system testing and verification that the completed 

and installed system performs and meets its specifications. This phase may include 

Operational Test and Verification. This phase ends upon declaration that the installed 

system is operational.

2.2.3. Operations. Operations begins after operational readiness has been declared by the 

appropriate authority and normal system operations may begin. Operations ends when the 

system is permanently removed from space for systems that operate to, through or from 

space. Operations may last indefinitely depending on the disposal/end of life mode. 

Operations contains the following phases which fall under the NSSAP  ̳Build and 

Operations‘ phase:

2.2.3.1. Mission phase. The mission phase begins after operational readiness is declared. 

The operating entity may be different from the deployment entity. This phase ends when 

the system is no longer capable of adequately performing its intended or other assigned 

missions, as determined by the appropriate authority. For systems operating to, through 

or from space, this may occur when the minimum commodity quantities needed for 

approved disposal are reached.

2.2.3.2. Disposal/EOL Phase. The Disposal/EOL phase is initiated after the appropriate 

authority determines that the system no longer adequately performs its intended mission. 
18 AFI91-217 18 FEBRUARY 2010

Disposal/EOL for ground systems may include disassembly and removal, salvage, 

caretaker status or abandonment-in-place. In-space systems will be disposed of via 

reentry, other means of removal from space or moved to a sparsely populated disposal 

orbit and safed so that the disposed system minimizes the generation of debris and other 

hazards (see Chapter 5). The system operator is responsible for minimizing the residual 

hazards the system may subsequently pose.

2.3. Program Manager and Operator Roles and Responsibilities. Program Managers and 

Operators will apply System Safety during all system life cycle phases.

2.3.1. The appropriate Wing Commander or equivalent will ensure system safety be included 

and applied in all product or service contractual arrangements.

2.3.2. The appropriate Wing Commander or equivalent has the primary responsibility for 

ensuring System Safety is integral to the systems engineering process and will identify a 

government lead System Safety Manager to execute or oversee the system safety program.

2.3.3. Every space program, or group of small space programs, will develop a Programmatic 

Environmental, Safety, and Health Evaluation (PESHE) for Key Decision Point assessments 

IAW NSSAP 03-01. Program Managers will prepare a PESHE which identifies System 

Safety, environmental and occupational health risks, how these risks will be eliminated or 

managed, and how compliance will be achieved and maintained throughout the system life 

cycle.

2.3.4. Space systems and system upgrades that have completed their System Requirements 

Review prior to the implementation of this instruction will be exempt from those new 

requirements outlined in this document that cannot be met within the existing design. 

Consistent with cost effectiveness and mission requirements, any aspect of this instruction 

that can be met without a significant design change will be adhered to.

2.3.4.1. System Safety Managers will ensure that the space safety requirements outlined 

in this instruction are included in all system requirements documents. It is understood 

that mission requirements and cost effectiveness may result in non-compliance with parts 

of this instruction.

2.3.4.1.1. Prior to the next Key Decision Point of any system acquisition or upgrade, 

the PM will ensure that the acquisition safety office and operational Wing 

Commander (or equivalent) are provided with justifications for non-compliance with 

the space safety requirements in this instruction.

2.3.4.2. Acquisition and Operations personnel should consider Tactics, Techniques and 

Procedures (TTPs) in order to meet safety and mishap prevention requirements outlined 

in this document.

2.4. Risk Acceptance, Non-Compliances and Waiver Authority. The risk criteria discussed 

in this section applies to the relevant system safety or public safety addressed in subsequent 

chapters. (Reference AFI 91-202, Range Commanders Council Standards, and MAJCOM 

instructions/manuals for additional guidance on risk criteria.)

2.4.1. The organization‘s commander or equivalent is responsible for those risks that are 

within their authority and capability to mitigate or otherwise control. However, at all times 

and through all phases, a Wing Commander or equivalent will be assigned risk responsibility 
AFI91-217 18 FEBRUARY 2010 19

for a mission program. At no time during the system‘s life cycle phases will a program not 

have an organization designated as the risk responsible organization.

2.4.1.1. A Risk Responsibility Transition Plan will be developed by the acquisition 

organization and will be used to identify milestones or decision points in the transfer of 

risk responsibility from one organizational commander (or equivalent) to another. Risk 

responsibility should be clearly delineated prior to launch (system deployment for ground 

systems) to clearly outline each organization commander‘s (or equivalent) risk 

management responsibility. This plan must be approved by all applicable commanders 

(or equivalent) prior to implementation.

2.4.1.1.1. Each MAJCOM will determine the timing, required content and format for 

Risk Responsibility Transition Plans. As a minimum, the plan will delineate the risk 

responsible commander or equivalent for all life cycle phases to include overlapping 

responsibility, if appropriate. It should also include the risks associated with program 

versus flight.

2.4.2. Development. The System Wing Commander or equivalent and the acquisition chain 

of command (per AFI 91-202) are the approval authorities for all risk analyses that meet 

approved system safety risk management processes for space systems that have not been 

transferred to an operational wing commander or operational/test organization. System wing 

commanders or equivalent and operational wing commanders share approval authority for 

similar risk analyses for all follow-on operational support.

2.4.2.1. Risks to the public and personnel involved with a space system development will 

not exceed appropriate Occupational Safety and Health Administration and Air Force 

Occupational Safety, Fire Protection and Health standards.

2.4.3. Deployment/Launch. The operational Space Wing CC or his/her designee is the risk 

acceptance authority for all risk analyses that meet public and launch essential personnel 

safety risk criteria during launch. Public and launch essential personnel safety ends when the 

launch vehicle has achieved orbit (see Chapter 4).

2.4.3.1. Prior to launch (t = 0), all hazardous spacecraft, launch vehicle components, or 

systems will be sited IAW DoD 6055.09-STD, DoD Ammunition and Explosives Safety 

Standards, AFMAN 91-201, Explosives Safety Standards, Unified Facilities Criteria 

(UFC) 1-200-01, General Building Requirements, and UFC 3-600-01, Fire Protection 

Engineering for Facilities.

2.4.4. Operations/Disposal/End-of-Life. The appropriate space wing commander (or 

equivalent) is the approval authority for all risk analyses that meet system safety risk criteria. 

The NAF/CC or Center CC or equivalent is the approval authority for constellation 

management/EOL disposal decisions.

2.4.4.1. The lead organization‘s commander, or equivalent, for follow-on support 

activities (e.g. operational tests) is responsible for risk management of those activities.

2.5. Waivers

2.5.1. Reference subsequent chapters for waiver approval authorities.
20 AFI91-217 18 FEBRUARY 2010

2.5.2. Each safety office (MAJCOM, NAF, Center, Wing, etc.) will brief previously 

approved and active waivers to incoming commanders and Chiefs of Safety within 30 days of 

assignment.
AFI91-217 18 FEBRUARY 2010 21

Chapter 3

SYSTEM DEVELOPMENT

3.1. Development Risk. The following outlines risk responsibility for the development life 

cycle phases associated with launch, orbital and other space systems. Risk responsibility only 

applies to risks that are within the control of a particular agency/authority. During each of a 

program‘s life cycle phases, a program will have an organization designated as the risk 

responsible organization by that organization‘s commander. Because of overlapping 

responsibilities, responsibility for life cycle phases may overlap organizations. Risk measures 

and associated criteria will be developed by the organizational authority responsible for the 

assigned life cycle phase, but should be consistent with operational requirements, DoD, AF, 

RCC and standard practices in related industries. Use of RCC and industry standards is subject 

to the approval of the appropriate Wing Commander (or equivalent).

3.1.1. When accepting design risks, the acquiring organization will consider the impact to all 

aspects of a space system‘s life cycle. Design decisions...impact the operational safety of a 

system. Therefore, the acquisition organization will assess the impact (with the goal of 

minimizing the risk) to the operational (pre-launch, launch, on-orbit, reentry, and 

disposal/EOL) safety risk in each of the program‘s life cycle phases. Acquisition 

organizations will comply with all safety standards that address these ―downstream‖ risks, 

and will include the operational commander or equivalent receiving the system in all design 

risk acceptance decisions. The acquisition organization is also responsible for all of its 

follow-on support activities.

3.1.2. Standards for acceptable risks to personnel involved with space system development 

and operations will meet or exceed appropriate Occupational Safety and Health 

Administration and/or Air Force Occupational Safety, Fire Protection and Health standards.

3.1.3. Prior to construction and/or facility utilization, all facilities including launch pads 

housing spacecraft, launch vehicle components or systems that present an explosive hazard 

will be sited IAW Defense Federal Acquisition Regulation Supplement (DFARS) 252.223-

7002, Safety Precautions for Ammunition and Explosives, DoD 4145.26-M, DoD

Contractor’s Safety Manual for Ammunition and Explosives, DoD 6055.09-STD, DoD 

Ammunition and Explosives Safety Standards, and AFMAN 91-201.

3.1.4. Local System Safety Managers must be included, at a minimum, during all Key 

Decision Points to effectively manage the risks in each program for the appropriate Wing 

Commander or equivalent.

3.2. Waiver and Approval Authority. Consistent with AFI 91-202, MAJCOM guidance, and 

other agreements, the risk acceptance authorities are outlined below.

3.2.1. Normal Risk Approval.

3.2.1.1. The acquisition organization‘s commander or equivalent is responsible for risk 

management and acceptance involving design and operation of a space system 

throughout its life cycle when hazards causing the risks are controlled by engineering 

technical documentation.
22 AFI91-217 18 FEBRUARY 2010

3.2.1.2. The Air Force Civil Engineering Support Agency (AFCESA) is the waiver 

authority for all facility changes that do not meet the minimum requirements of UFC 1-

200-01 and UFC 3-600-01.

3.2.2. Approval for Exceeding Normal Risk Criteria. Consistent with MAJCOM guidance 

and other agreements, the wing commander is the waiver approval authority for risks 

exceeding normal risk criteria.

3.2.2.1. During any life cycle phase up through system deployment in the Build And 

Operations Phase, the Center Commander and 14 AF/CC (via 14 AF Director of Safety, 

if appropriate) will be notified of risks that exceed normal risk criteria by more than one 

order of magnitude (e.g., one in one million vs. ten in one million).

3.2.2.2. Risks exceeding normal risk criteria by two or more orders of magnitude (e.g., 

one in a one million vs. one hundred in one million) require NAF/CC and MAJCOM/CC 

approval.

3.2.2.3. The wing CoS will review all waiver requests requiring wing commander 

approval. The wing will document risk management decisions that exceed the accepted 

risk criteria. Subordinate units (wings, centers, NAFs, etc.) will provide the 

MAJCOM/SE copies of all waiver requests and approvals.

3.3. General Design Considerations. Consistent with National Space Policy and DoDD 

3100.10, System Safety Managers will ensure that the following considerations are included in 

all appropriate systems requirements documents:

3.3.1. Minimize space system vulnerability to space debris and other effects of the space 

environment, such as meteoroids, solar radiation, spacecraft charging, high energy cosmic 

radiation, solar flares and man-made debris.

3.3.2. Minimize generation of space debris. Note: The terms orbital debris and space debris 

are often used interchangeably. For the purposes of this document, orbital debris is space 

debris in orbit around another object. Debris mitigation guidelines are required for orbital 

space systems and recommended for space systems and launch vehicle components in deep 

space (i.e. not in orbit around a planet). Space debris generated in orbit (i.e. orbital debris) 

presents a far greater risk than debris generated in deep space.

3.3.2.1. All test, operational and failure modes will be designed to minimize non-mission 

debris generation. Spacecraft will be designed to minimize, contain or otherwise limit 

the size and number of generated debris that separates from a spacecraft. See section 5.8 

for specific details.

3.3.3. Minimize the possibility of catastrophic loss or mission degradation due to collisions 

with debris.

3.3.3.1. Consistent with cost-effectiveness and mission requirements, spacecraft and 

launch vehicle mitigation measures will include: reduce the cross-sectional area of the 

space system or components, protect critical subsystems through shielding/positioning 

within the spacecraft, improve system reliability, use the least risky redundancy/singlestring arrangement and plan for individual component failure modes that maximize 

remaining mission capability.
AFI91-217 18 FEBRUARY 2010 23

3.3.4. Minimize functional, electro-magnetic/optical or physical interference with other 

systems or personnel.

3.3.5. Programs will assess and limit the collision hazard posed by tether systems on other 

users of space and on the near-Earth environment.

3.3.6. Plan for disposal procedures (passivation) for launch vehicle components, upper 

stages, spacecraft and other payloads at the EOL to minimize the impact on future operations. 

See section 5.11.3 for specific details.

3.3.6.1. Minimize the possibility of accidental explosions by depleting stored energy 

sources during passivation.

3.3.6.2. Space systems will be designed to minimize or produce a predictable orbit 

perturbation from passivation activities.

3.3.6.3. Consistent with mission requirements and cost effectiveness, add grapple points 

to all spacecraft, kick motors and launch vehicle components to allow for post-mission 

orbit disposal or repositioning by spacecraft with grappling and orbit change capability.

3.3.7. Establish clear decision authorities for configuration control and management. Ensure 

configuration management plans in contracts are followed and effective for systems under 

development/upgrade.

3.3.8. Conduct tests of hardware components in as close to operational conditions as 

possible.

3.3.8.1. It is critical that the various interfaces between different components be tested 

thoroughly. The fully integrated spacecraft will be ground tested in an environment that 

most closely simulates its actual operating environment.

3.3.9. Document all high risk acceptance decisions, consistent with AF electronic records 

management processes.

3.3.10. Safety catastrophic systems will be designed to be dual-fault tolerant for catastrophic 

hazards. Exceptions to these requirements will be justified to the appropriate commanders 

(i.e., system and operational receiving wings) or equivalent by designing to minimum risk 

(using the System Safety order of precedence) using rigorous quantitative risk methods. All 

safety catastrophic systems will be designed to avoid:

3.3.10.1. Single component failure, common mode failure, human error, or design 

features which would cause a mishap of catastrophic severity.

3.3.10.2. Dual independent component failures, dual human errors, or a combination of a 

component failure and a human error involving safety catastrophic command and control 

functions, which could cause a mishap of catastrophic severity.

3.3.10.3. All systems determined to be safety catastrophic will be approved by the 

appropriate Wing.

3.4. Integrated Space Effects. Individual space systems and capabilities can be integrated to 

significantly increase their overall effectiveness.

3.4.1. Space forces, including acquisition strategies, need to mitigate the hazards/risks of 

fully integrated space capabilities on friendly space assets as well as to the user. Whether or 
24 AFI91-217 18 FEBRUARY 2010

not systems were originally designed to be integrated, integrating them may produce 

unintended consequences. Design to control and manage hazard and their associated risks 

due to integration.

3.4.2. Acquisition and operational strategies need to mitigate the hazards/risks of fully 

integrated space capabilities on friendly space assets. The consequences and risks of 

integrated space systems will be analyzed, controlled and accepted by the appropriate risk 

commanders or equivalent prior to implementation. Note: Space capabilities can deny, 

degrade, disrupt or destroy the enemy (intentional/unintentional) and friendly forces 

(unintentional).

3.4.3. Space Safety Offices should be included in planning to help manage risks and mishap 

prevention, tactics, techniques and procedures to properly advise their commanders (or 

equivalent) on risk acceptance.

3.5. Testing. The following requirements apply to both developmental and operational test and 

evaluation. MAJCOMs that test space systems will develop and implement risk management 

based processes for use throughout the testing life cycle. MAJCOMs will ensure test procedures 

intended for use on operational equipment are reviewed and approved prior to test initiation. 

MAJCOMs will ensure changes to test plans are approved at the proper level of authority.

3.5.1. Testing organizations will comply with the safety requirements specified in AFI 99-

103, Capabilities Based Test and Evaluation. Integrated testing is the preferred approach 

unless it can be shown that it adds unacceptable costs, delays, or technical risk. Safety 

review processes will not be compromised.

3.5.2. Conduct tests of hardware components in operationally relevant environments without 

compromising engineering integrity, safety, or security. It is critical that the various 

interfaces between different components be tested thoroughly. The fully integrated 

spacecraft will be tested on the ground in an environment that most clearly approximates the 

spacecraft‘s on-orbit operating environment. Launch vehicle/booster components shall be 

tested to demonstrate their capability to perform in their intended operating environments.

3.5.3. Document all test risk decisions, consistent with AF electronic records management 

processes.

3.5.4. Integrated Technical and Safety Reviews. Independent government technical and 

safety personnel will examine the technical and safety aspects of test and evaluation (T&E) 

plans that involve government resources prior to commencement of test activities. All test 

organizations must establish procedures for when and how these reviews will be 

accomplished.

3.5.4.1. Safety Review Board (SRB). The SRB assesses whether the T&E project's 

safety plan has identified and mitigated all health and safety hazards according to AFI 91-

301, Air Force Occupational and Environmental Safety, Fire Protection and Health 

(AFOSH) Program. SRB members must be technically qualified and independent of the 

test program. At the recommendation of the SRB, the Single Manager and all test 

organizations will accept (at the appropriate level established by the organizational 

commander or equivalent), eliminate or mitigate identified hazards. All test 

organizations will set up procedures for controlling and supervising tests consistent with 

the risk involved and according to local range safety criteria (see AFI 91-202). Mishap 
AFI91-217 18 FEBRUARY 2010 25

accountability must be clearly established according to AFI 91-204, prior to conducting 

tests. The SRB will review and assess the impact of hazards to other critical/high-value 

resources and operations.

3.6. Configuration Control and Management. Configuration Management (CM) is a 

management process for establishing and maintaining consistency of a product‘s performance, 

function, and physical attributes with its requirements, design, and operational information 

throughout its life cycle. Reference AFI 63-1201 for detailed guidance.

3.6.1. As part of the CM process, the system safety manager will review proposed changes 

to a product throughout the product's life cycle to identify changes to the product's overall 

safety baseline (this includes Engineering Change Proposals, requests for deviation, etc.). 

The proposed changes will be evaluated by identifying possible outcomes from where the 

proposed change is to be inserted into the system/program, and comparing the outcomes to 

previous analyses conducted during the original baseline design work.

3.6.2. The system safety manager will be a member of the Configuration Control Board 

(CCB) in order to monitor the configuration of the product and to capture configuration 

control lessons learned.

3.6.3. The system safety manager, as a member of the CCB, will identify and report risks 

associated with the proposed implementation of changes to the product‘s baseline to the 

CCB. The identified risks will be resolved and documented by the appropriate risk 

acceptance organizational commander or equivalent prior to CCB approval of the proposed 

change.

3.7. System Safety Management Plan and the Software Safety Plan. For Programs that 

incorporate safety critical software, the System Safety Management Plan (SSMP) shall require a 

software safety plan, either incorporated into the SSMP or as a stand-alone document. The 

software safety plan should correlate to the Software Engineering Plan (as the SSMP correlates 

to the System Engineering Plan), and should be initiated early in the project life cycle.

3.7.1. Software includes all programs and files used in mission operations that are stored or 

functions with ―0‖s and ―1‖s, to include but not limited to: space system operating software, 

mission dependent databases and mission upload files.

3.7.2. The Software Safety Plan must specify the software safety process for programs 

where software performs or influences safety-critical functions. The software safety plan 

should include information on System Safety integration into the overall program structure 

and software development life cycle.

3.7.3. As part of the design and development process, the software safety process should 

focus on the identification and tracking of initial software safety requirements, and those 

derived from system specific hazard analyses, and will include supporting software 

configuration control.

3.7.4. Criteria for software reviews should be part of the Software Safety Plan and conducted 

in conjunction with the System Safety analysis process (i.e., Preliminary Hazard Analysis, 

etc.) as part of the standard gateway products required for reviews.

3.7.5. Safety is an integral part of software testing. The System Safety Manager should be 

involved in the generation of inputs to safety-specific testing requirements (including 
26 AFI91-217 18 FEBRUARY 2010

requirements for initial validation & verification and regression testing), participation in test 

reviews, determination of acceptance criteria to meet safety objectives and requirements, and 

that procedures be established to avoid mishaps during testing.

3.7.6. Software upgrades and patches have the potential for causing degradation or total 

mission loss, and it is critical that safety analysis be conducted as part of the configuration 

control process. Such upgrades and patches must not only undergo a safety analysis, but 

should also be fully tested and validated prior to implementation onto flight hardware.

3.7.7. For reference, NASA-GB-8719.13, NASA Software Safety Guidebook, contains details 

on planning a software safety program.

3.8. Software and Hardware Installations. Software and hardware installations/updates have 

the potential for causing degradation or total mission loss. It is critical that System Safety be 

implemented during software design and testing. The Program Manager will ensure that:

3.8.1. New software and hardware is fully tested and validated prior to implementation.

3.8.2. Procedures are established to avoid mishaps during testing and installations.

3.9. Test/Operational Performance Reviews. For space systems and support equipment, 

performance reviews should be conducted after each major mission program event (e.g. preoperational testing, launch, test-and-checkout, mission operational milestones, integrated effects, 

EOL disposal, etc.) Thorough reviews enhance future system performance and mission 

assurance, and can contribute to mishap prevention. The size and scope of the review will be 

determined by individual programs. Trained space safety personnel will be invited to participate 

in all post test/operational performance reviews/assessments.

3.9.1. Safety programs should emphasize test program validation (to include procedures 

discipline, readiness reviews, and test execution risk management) and configuration control 

in order to minimize unintended events or failures.
AFI91-217 18 FEBRUARY 2010 27

Chapter 4

LAUNCH, SYSTEM DEPLOYMENT, AND REENTRY

4.1. System Deployment. This chapter outlines safety responsibilities and tasks for the space 

system deployment life cycle phase which includes: transportation from the factory to the launch 

site or operating location; assembly and checkout; for flight hardware, pre-launch/launch/earlyorbit deployment and checkout. It also includes: reentry safety responsibilities and requirements 

for launch vehicles/components; reentry launch vehicles/components, and reusable launch 

vehicles/components including their jettisoned components.

4.1.1. During these sub-phases, different aspects of safety may be the responsibilities of 

different commanders. For example, the protection of a program's equipment from the 

program's hazards may be the responsibility of the program's commander while the 

protection of the public from a program's ground and flight hazards may be the primary 

responsibility of the space launch commander. In most cases, this instruction will use the 

term ―appropriate wing commander‖ to refer to the commander having primary responsibility 

based on the locations, equipment, hazards and personnel involved.

4.2. Safety Responsibilities. The appropriate wing commander is responsible for ensuring safe 

operations and will protect the public from unacceptable risks.

4.2.1. The wing commander may prohibit, suspend or terminate any DoD, commercial, civil, 

government, or test/evaluation activity, if such activity would adversely affect other 

space/range users or violate accepted risk criteria, requirements for public health and safety 

or U.S. national security interests. The Wing Safety Office shall document all determinations 

made and forward to the MAJCOM Safety Office.

4.2.2. The MAJCOM will assign specific deployment responsibilities. Normally, the agency 

owning the program will be responsible for the safety of a program's hardware, personnel and 

facilities as long as the hazards do not extend outside of the assigned program facility 

boundaries. When the hazards could cross outside of these facility boundaries, the 

appropriate wing commander will ensure that adequate protection/mitigation is provided to 

protect other personnel/facilities/hardware.

4.3. Transportation. The transportation of high-value and/or hazardous space systems will be 

planned and executed to minimize hazards posed to the space system as well as hazards posed by 

the space system.

4.3.1. A transportation plan or equivalent document will be developed and approved by the 

responsible system wing commander (and coordinated by the receiving wing commander, if 

any) for transportation from the factory to the operational site or range. The transportation 

plan will address the following safety-related items: transportation configuration for safety 

critical items such as ordnance and pressure vessels, compliance with DOT regulations, 

documentation of planned and alternate routes and safe stop points, cargo environmental 

control and monitoring and escort/convoy requirements.

4.4. Ground Based Equipment Assembly and Checkout. Safety responsibility for this subphase is normally the responsibility of the wing commander acquiring the system. If the 

potential hazards from this sub-phase can extend beyond the boundaries of the involved facility, 
28 AFI91-217 18 FEBRUARY 2010

responsibilities may involve, or transfer to, the installation commander for the protection of other 

resources and personnel. After operational capability certification, safety responsibility transfers 

to the operational wing commander.

4.5. Pre-launch Safety. This section covers safety responsibilities for flight hardware, program 

operations and program facilities during activities at the launch base prior to launch countdown 

operations.

4.5.1. Pre-launch Operations. Due to the inherent hazards of rockets and launch operations, 

the pre-launch campaign will be conducted in a deliberate fashion, with formal milestones 

and reviews to ensure mission readiness and that adequate launch safety processes have been 

employed for the protection of the public and government resources. These include, at a 

minimum, dress rehearsals and readiness reviews to ensure the safety and readiness of all 

personnel and systems, for example Flight Readiness Reviews (FRR) and Launch Readiness 

Reviews (LRR).

4.5.2. Unless otherwise directed by MAJCOM guidance, an Interim Safety Board (ISB) 

President will be assigned prior to the final readiness review for all AF launches and 

launches of significant AF interest. The duties of the ISB President are identified in AFI 91-

204 and AFMAN 91-222. An ISB President will be available and on-standby prior to and 

during their assigned launch, until the successful spacecraft separation or other identified 

mission event. The Air Force will reserve the right to appoint an ISB for commercial 

launches originating at AF ranges.

4.6. Launch Safety. The following outlines risk responsibility for the respective mission flight 

phases associated with launches. It is the duty of all involved organizations to ensure adequate 

protection to the general public, manned spacecraft and space users is accomplished by 

coordinating appropriate transfer of responsibility. The management of flight phase risk is 

performed primarily using quantitative measures, although for some applications highly 

developed and documented qualitative measures may suffice. The measures and associated 

criteria are normally developed by high level organizations, committees or industries and 

documented in standards or published guidelines. In some cases, agreements with local 

governments or national guidelines may take precedence and require range compliance. The risk 

responsibility for the mission flight phases may overlap.

4.6.1. Launch Safety Officer. The Launch/Range shall have a Launch Safety Officer, with 

the appropriate training, to serve as the Space Safety Officer for the Launch/Range. Other 

launch range safety personnel shall undergo appropriate training (as determined by the 

MAJCOM safety office) for their assigned positions, which may or may not be designated a 

space safety position.

4.6.2. The appropriate wing commander is responsible for all flight risk to the general 

public, launch area personnel and other mission support personnel, commencing at liftoff, up 

through orbital insertion or until final impact of suborbital vehicles or jettisoned components. 

In addition, this commander is responsible for ensuring on-orbit spacecraft protection by 

implementing launch holds in the launch window.

4.6.3. Launch Operations Risk. Independent risk budgets for a mission will be developed 

when the phases of flight meet the guidelines specified in the Range Commander’s Council

(RCC) Standard 321. Risk management responsibility directly corresponds with mission 
AFI91-217 18 FEBRUARY 2010 29

command and control responsibility/authority. Launch and orbital risk management will 

apply quantitative risk analysis consistent with DoD, RCC, AF and industry standards and 

practices.

4.6.4. Launch Vehicle And Spacecraft Safety.

4.6.4.1. The SLCC‘s responsibility extends from launch through orbit insertion.

4.6.4.2. The acquisition organization is responsible from orbital insertion through early 

orbit testing and until the operational organization assumes TACON. The acquisition 

organization also has responsibility for follow-on support and any post-EOL activities 

(e.g. reentry recovery).

4.6.4.3. Consistent with other agreements, the operational organization is responsible for 

all operational risks after the successful completion of early orbit testing through EOL 

activities. Post EOL, the acquisition organization is accountable.

4.6.4.4. Reference section 5.2. for on-orbit risk criteria for launched objects.

4.6.5. Public and Launch Personnel Risk. The risk criteria listed below apply only to the 

mission flight phases associated with launch. Reference RCC 321 to determine if the risk 

criteria can be assigned to individual flight phases or should be considered appropriate for the 

entire flight of the mission.

4.6.5.1. The risk to the public will not exceed the criteria listed below for mission 

operations (to include launch processing, space and suborbital launches, and subsequent 

controlled reentry).

4.6.5.1.1. Public. The general public will not be exposed to a collective Expectation 

of Casualty (Ec) greater than 100 10-6(one-hundred in one million) for all hazards 

associated with a mission (reference RCC 321 for guidance on assigning mission 

risk).

4.6.5.1.1.1. When the risk from toxic hazards exists, the range must separately 

ensure the allowable level of risk does not exceed other range safety standards for 

toxic exposure limits for the general public, when appropriate mitigations are in 

place. This predetermined level of risk, less than 100 10-6, should account for 

each range‘s local population and population distribution, applicable national 

exposure guidelines and agreements with local government authorities.

4.6.5.1.2. Mission Essential Personnel will have a collective Ec less than 300 10-6

(three-hundred in one million) for all hazards associated with a mission. An 

appropriate allowable level for toxic risk should likewise be determined according to 

the factors stated below for public risk.

4.6.5.2. Space Wings will ensure that range users perform any other required risk 

analysis needed to adequately address public safety for all launches. The Space Wings 

will review and approve all risk analyses associated with each launch from the range.

4.6.6. Safe Separation – CA and COLA. The appropriate wing commander is responsible 

for precluding any activity that would adversely affect active or manned spacecraft, based on 

a pre-launch COLA process identified by the MAJCOM.
30 AFI91-217 18 FEBRUARY 2010

4.6.6.1. The COLA process will be developed based on assessments that account for 

launch vehicle flight from launch through orbit insertion plus the required number of 

revolutions of the launched objects. The COLA process will account for:

4.6.6.1.1. The type of orbit the vehicle or component is injected into, operating in or 

passing through, and;

4.6.6.1.2. Its altitude exceeding the manned spacecraft or space asset altitude by the 

appropriate miss distance, and;

4.6.6.1.3. Sufficient time for the launched objects to be cataloged in the Satellite 

Catalog. Launch objects include the launch vehicle, payload, jettisoned components 

and planned debris.

4.6.6.2. The Space Wings, in conjunction with the JSpOC, will protect on-orbit manned 

spacecraft and active satellites from collision with launched objects IAW DoDD 3100.10 

and MAJCOM requirements. Space wings will obtain CAs from the JSpOC to establish 

COLA holds in the launch windows to ensure safe separation criteria from manned and 

active orbital objects based on the risk criteria specified in the following paragraphs.

4.6.6.2.1. This CA/COLA process will be used for all launch vehicles, ballistic 

missions and propagated debris with an altitude capability equal to or greater than 

150 km.

4.6.6.2.2. A CA/COLA process will also be used for each launch vehicle component 

that does not immediately reenter after separation from the launch vehicle and/or 

spacecraft.

4.6.6.2.3. The CA/COLA process will be used prior to the planned launch to protect 

cataloged manned and active orbiting objects from collision with launched objects. 

This process includes the computation of launch times that would result in violating 

either the appropriate miss distance or probability of collision IAW RCC 321.

4.6.6.2.4. Safe Separation for launch (CA/COLA) will cover the period of time from 

when the launched objects achieve an altitude greater than 150 km, and until they are 

catalogued by the JSpOC and become part of the orbital CA process or until surface 

impact for suborbital launches.

4.6.6.2.5. If there is a deviation beyond the planned three-sigma trajectory, the 

launch wing is relieved of responsibility for any resulting collision with active or 

manned orbiting objects.

4.6.6.3. Safe Separation Criteria for Launch.

4.6.6.3.1. Manned Spacecraft. The risk to each on-orbit manned spacecraft from 

launched objects will not exceed a collision probability of 1 10-6(one in one million).

4.6.6.3.2. Active Satellites. The acceptable risk to active satellites from launched 

objects will be established by 14 AF, but should not exceed a collision probability of 

10 10-6(ten in one million).

4.6.6.3.3. Probability. Since CA and COLA based collision probability 

determinations require considerably higher fidelity range user data and can be costly, 
AFI91-217 18 FEBRUARY 2010 31

an acceptable alternative to the above criteria is to perform the assessment using more 

conservative miss distance volumes.

4.6.6.3.3.1. To mitigate the risk to manned spacecraft, either ellipsoidal miss 

distance volumes of 200 km in-track and 50 km cross-track and radially, or 

spherical volumes of 200 km may be used.

4.6.6.3.3.2. For active satellites, 14 AF shall provide the appropriate conjunction 

assessment data to the launch wings to establish launch hold periods. A spherical 

miss distance volume of 25 km may be used to determine the appropriate launch 

hold periods.

4.6.6.3.3.3. These criteria may be waived based on national need and operational 

considerations by a MAJCOM-approved authority.

4.6.6.4. The launching agency is responsible for the protection of manned spacecraft and 

active satellites from the end of the appropriate wing commander's (or equivalent) 

responsibility as defined above in paragraph 4.6.6.2 until separation of the last launch 

component, if there are additional orbital changes during this time.

4.6.7. The Space Wings will ensure each range user complies with safety requirements 

contained in MAJCOM, NAF/Center, and wing-level publications.

4.6.7.1. Commercial launches are subject to the requirements of other agencies, 

including, FAA/AST requirements for licensed launches. Use established agreements for 

ensuring safety compliance for FAA/AST licensed launches.

4.6.8. Control of Errant Vehicle Flight. All vehicles launched from or onto AF ranges will 

have a positive, Space Wing Commander approved, method of controlling erratic vehicle 

flight to meet the objective of managing risks to the public and foreign countries.

4.6.8.1. Range safety organizations will establish flight termination criteria and mission 

flight rules to ensure operations do not exceed acceptable public safety.

4.6.8.2. Range safety organizations, with wing commander approval, will establish and 

control hazardous launch areas and implement procedures to protect the public on land, 

on the sea, and in the air for each launch and launch vehicle using the range.

4.6.8.3. The Range shall coordinate with FAA to ensure timely notification of any 

expected air traffic hazard associated with range activities. In the event of a mishap, the 

Range shall immediately inform the FAA of the volume and duration of airspace where 

an aircraft hazard is predicted. Similarly, the Range shall coordinate with the US Coast 

Guard (USCG) to ensure timely notification of any associated ship traffic hazard and in 

the event of mishap, inform the USCG of the area and duration of navigable waters where 

a ship hazard is predicted.

4.6.8.4. Any launch vehicle component expected to reenter the atmosphere will comply 

with the risk budget management approach specified in RCC 321 and in this instruction.

4.7. Launch Vehicle EOL Requirements

4.7.1. Any launch vehicle component that has achieved orbital velocity will be passivated as 

outlined in paragraph 5.11.3. Waivers must be approved by the acquisition organization 

safety office and 14 AF/SE.
32 AFI91-217 18 FEBRUARY 2010

4.7.2. See section 5.11 for further EOL requirements.

4.8. Reentry Safety

4.8.1. The safety requirements and risk management responsibilities for the disposal of 

reentering satellites are discussed in Chapter 5. Reentry hazards posed by expended launch 

vehicles or other jettisoned components that have achieved orbit and are not actively 

controlled, but have a planned (not random) reentry will reenter the atmosphere in a 

predictable location, will be included in the analysis and risk budgets of the launch vehicle. 

Expended launch vehicle components that will be left in space and may later reenter 

uncontrolled, will be designed to maximize aerothermal demise to minimize reentry hazards.

4.8.2. General Responsibilities. The appropriate wing commander or equivalent is 

responsible for ensuring the safe reentry of expendable launch vehicles/components, reentry 

vehicles/components, and reusable launch vehicles/components, to include their jettisoned 

components.

4.8.2.1. This commander or equivalent is also responsible for all reentry risks to the 

general public, landing recovery area personnel and other mission support personnel at 

the de-orbit initiation event through final landing and the safing of the returning space 

vehicle.

4.8.2.2. For a controlled reentry vehicle, the appropriate wing commander or equivalent 

is responsible for preventing collisions with any cataloged orbiting objects from collision 

with the reentering vehicle by implementing reentry holds.

4.8.2.2.1. The reentry/recovery site commander or equivalent has the authority to 

approve or deny the initiation of de-orbit. This includes the planned nominal and 

contingency sites.

4.8.3. Reentry Risk. The mission flight safety risk responsibilities and requirements 

identified in section 4.2 also apply to reentry safety. Independent risk budgets will be 

developed when the launch and reentry phases of flight meet the criteria in the RCC Standard 

321. Risk management responsibility directly corresponds with mission command and 

control responsibility/authority. Reentry operations risk management will apply quantitative 

risk analysis consistent with DoD, RCC, AF and industry standards and practices.

4.8.3.1. Public Risk. The launching agency has public risk responsibility for reentry 

preparations and initiation unless other agreements delineate a different risk responsible 

organization. The public safety risk criteria listed below applies only to the mission 

flight phases associated with the reentry and/or recovery of a space vehicle, reusable 

launch vehicle or the flight of any other test or operation vehicle. RCC 321 should be 

consulted to determine if the risk criteria can be assigned to the individual flight phases 

or if it should be appropriate for the entire flight of the mission.

4.8.3.1.1. The risk to the public will not exceed the criteria listed below for mission 

operations. The appropriate wing commander may prohibit, suspend or terminate any 

DoD, commercial, civil, government, or any test/evaluation activity, if such an 

activity would adversely affect other space users or violate accepted risk criteria, 

requirements for public health and safety or any U.S. national security interest.

4.8.3.1.1.1. The general public will not be exposed to a collective Ec greater than 
AFI91-217 18 FEBRUARY 2010 33

100 10-6(one-hundred in one million) for all hazards associated with a mission 

(see RCC 321).

4.8.3.1.1.1.1. When the risk from toxic hazards exists, the range must 

separately ensure the allowable level of risk enforced does not exceed other 

standards for toxic exposure limits for the general public when appropriate 

mitigations are in place. This level of risk, less than 100 10-6, should account 

for each range‘s local population and population distribution, applicable 

national exposure guidelines and agreements with local government 

authorities.

4.8.3.2. Mission Essential Personnel Risks. Mission Essential Personnel will have a

collective Ec less than 300 10-6(three-hundred in one million) for all hazards associated 

with a mission. An appropriate allowable level for toxic risk should likewise be 

determined according to the factors stated in paragraph 4.8.3.1.1.1 above for public risk.

4.8.3.3. Additional Risk Analyses. The landing/recovery site will ensure that deorbiting/reentering vehicle owners perform any other required risk analysis required to 

adequately address public safety for all planned de-orbit/reentry events. The appropriate 

landing/recovery site will review and approve all risk analyses associated with each deorbit/reentry event onto the range. The approval authority for risks is outlined in section 

2.4.

4.8.3.4. The landing/recovery site commander or equivalent will ensure each launching 

agency complies with safety requirements contained in MAJCOM, NAF, Center, and 

Wing publications. Additionally, vehicle de-orbit/reentry events are subject to the 

requirements of other agencies, including the licensing and air traffic control 

requirements of the FAA.

4.8.3.5. Additional industry standards and codes may be used in conjunction with range 

safety standards. If a conflict between an industry standard and a range safety standard is 

discovered, a request for clarification will be submitted to Range Safety.

4.8.3.6. Safe Separation for Reentry Operations. The appropriate wing commander is 

responsible for precluding any activity that would adversely affect other space users, 

including manned spacecraft, based on a pre-reentry safe separation/COLA process 

specified by the MAJCOM. The safe separation/COLA process will be developed based 

on CAs that account for reentry vehicle flight and until the vehicle is below all orbiting 

objects. To prevent collisions, that would also compromise the reentry vehicle and affect 

public safety, the safe separation/COLA process will account for all orbital objects with a 

perigee at or below the de-orbit altitude of the reentry vehicle.

4.8.3.6.1. Manned Spacecraft. The risk to each on-orbit manned spacecraft will not 

exceed a collision probability of 1 10-6(one in one million).

4.8.3.6.2. Active Satellites. The acceptable risk of reentering objects colliding with 

active satellites and other cataloged objects will be established by 14 AF, but should 

not exceed a collision probability of 10 10-6(ten in one million).

4.8.3.6.3. Probability. Since CA and COLA based collision probability 

determinations require considerably higher fidelity launch agency data and can be 
34 AFI91-217 18 FEBRUARY 2010

costly, an acceptable alternative is to perform the assessment using more conservative 

miss distance volumes.

4.8.3.6.3.1. To mitigate the risk to manned spacecraft, either ellipsoidal miss 

distance volumes of 200 km in-track and 50 km cross-track and radially or 

spherical volumes of 200 km may be used. For active satellites and other 

cataloged objects, a spherical miss distance volume of 25 km may be used to 

determine the appropriate de-orbit initiation hold periods. These criteria may be 

waived based on national need and operational considerations by a MAJCOMapproved authority.

4.8.4. Launching agency-authored anomaly/contingency response plans, as well as debris 

and object recovery plans (land, shallow water and deep water impacts), will be provided to 

the appropriate landing/recovery site prior to launch.

4.8.5. Control of Errant Vehicle Flight. The appropriate wing commander or equivalent 

responsible for reentry will ensure that an analysis is performed to determine if positive 

control is required for the reentry vehicle to meet the risk criteria for the public (see 4.8.3.1), 

including foreign country public. If it is determined that positive control is required, then 

Range Safety will approve the method of controlling erratic vehicle flight based on the 

requirements of RCC Standard 319 or equivalent.

4.8.5.1. Range/Wing Safety will develop flight termination criteria and mission flight 

rules to ensure operations do not exceed acceptable public safety requirements IAW 

MAJCOM directives. The Wing Commander will approve flight termination criteria and 

mission flight rules. Circumstances that necessitate the activation of the Flight 

Termination System (FTS) will be described in the de-orbit/reentry mission rules. The 

mission rules will be developed by Range Safety with inputs from the Mission Flight 

Control Officer and launching agency.

4.8.5.2. Range/Wing Safety, with wing commander approval, will establish and control 

hazardous launch areas and implement procedures to protect the public on land, on the 

sea, and in the air for each returning vehicle IAW MAJCOM directives.

4.8.5.3. The reentry and landing phases of RLV operations will meet the risk criteria 

specified in RCC 321.

4.8.5.4. A means of tracking reentering vehicles is required to ensure that reentry 

vehicles do not violate established reentry flight safety rules.

4.9. Waiver and Approval Authority. Consistent with AFI 91-202, MAJCOM guidance and 

other agreements, the risk acceptance authorities are outlined below.

4.9.1. Normal Risk Approval.

4.9.1.1. Launch. The Spacelift Commander (SLCC) is the approval authority for all risk 

analyses that meet normal launch risk criteria, except for risk analyses (which shall be 

coordinated with the launching agency) conducted by the acquisition Single Manager.

4.9.1.2. Reentry. The acquisition center commander / wing commander is the approval 

authority for all reentry risk analyses that meet normal risk criteria. The CDR JFCC 

SPACE is the approval authority for all reentry risk analyses that exceed normal risk 

criteria.
AFI91-217 18 FEBRUARY 2010 35

4.9.1.3. AFCESA is the waiver authority for all facility changes that do not meet the 

minimum requirements of UFC 1-200-01, and UFC 3-600-01.

4.9.2. Approval for Exceeding Normal Risk Criteria. Except as noted in paragraphs 4.9.1.2 

and 4.9.1.3, and consistent with MAJCOM guidance and other agreements, the wing 

commander is the waiver approval authority for risks exceeding normal risk criteria.

4.9.2.1. Subsequent to system testing, the NAF Commander and CDR JFCC SPACE (via 

14 AF Director of Safety, if appropriate), will be notified of risks that exceed normal risk 

criteria by more than one order of magnitude.

4.9.2.2. Risks exceeding normal risk criteria by two or more orders of magnitude (e.g., 

one in one million vs. one-hundred in one million) require MAJCOM/CC approval.

4.9.2.3. In the event of a commercial/civil launch from the range, use established 

interagency agreements for risk acceptance and waiver approval. The Code of Federal 

Regulations (CFR), Title 14, Part 417, Launch Safety, delineates safety requirements for 

commercial launch operators, established by the FAA in conjunction with the DoD, that 

are fully compatible with DoD space safety guidance.

4.9.2.4. The wing CoS will review all waiver requests requiring wing commander 

approval. The wing will document risk management decisions that exceed the accepted 

risk criteria. Subordinate units (wings, centers, NAFs, etc.) will provide the 

MAJCOM/SE copies of all waiver requests.

4.10. Additional Range, Launch, and RV Guidance. Reference RCC 321, AF Space 

Command Instruction (AFSPCI) 91-700, Range Safety Publication Series, AFSCPI 91-701, 

Launch Safety Program Policy, the AFSPC Manual (AFSPCMAN) 91-710, Range Safety User 

Requirements Manual, and AFSPCMAN 91-711, Launch Safety Requirements For Air Force 

Space Command Organizations, for additional range, launch, and RV guidance. Note: For the 

foreseeable future, most if not all AF launches will occur from AFSPC controlled ranges. AF 

organizations will use this instruction and AFSPC Space Safety guidance when operating from 

these ranges.
36 AFI91-217 18 FEBRUARY 2010

Chapter 5

-ORBITAL SAFETY

5.1. Orbital Safety Program. The high cost of orbital space systems, unique operational 

design and irrecoverable nature of orbital operations make mishap prevention a critical 

component of orbital space systems from the initial design phase through EOL disposal. An 

orbital safety program will be developed for any non-ballistic vehicle or payload designed to 

complete one or more revolutions in Earth orbit. The orbital safety program will span the 

development, testing and operation of these space systems, to include spacecraft design, on-orbit 

testing and operations, reentry, recovery and disposal. Ballistic/fractional orbit 

vehicles/payloads are covered in Chapter 4. This chapter addresses the AF and DoD satellites 

under the command of the JFCC (―Blue‖), satellite safety programs, to include any systems that 

reach an altitude high enough to pose significant risk of collision, debris generation or otherwise 

interfere with other active orbital space systems; all will comply with the requirements specified 

in this instruction.

5.1.1. All organizations with Satellite Control Authority or that test or operate any space 

system (including satellites, payloads and experimental systems) that is designed to complete 

one or more revolutions in Earth orbit, will establish an orbital safety program. All orbital 

space programs will include orbital safety program processes to ensure that their spacecraft 

and on orbit checkout and orbital operations:

5.1.1.1. Are designed to survive the space environment or current/projected threats 

throughout its mission lifetime. In addition, both the spacecraft and required support 

equipment (including any equipment that transmits/receives a signal or power into/from 

space) will be designed to operate during space environment events (e.g., solar 

maximum, meteor storms/showers). TTPs should be used to minimize the effects of 

hazards that are not cost effective to design against.

5.1.1.2. Minimize generation or reduce accumulation of space debris consistent with 

mission requirements and cost effectiveness in accordance with National Space Policy, 

DoDI 3100.12, other US government documents, and this instruction. See section 5.8 for 

specific requirements.

5.1.1.2.1. Any planned release of orbital debris must be approved by the Single 

Manager and higher authority when not IAW DoD policy or this instruction, and 

reported to the NAF/Center Satellite Control Authority‘s safety offices prior to design 

approval, mission planning and the initiation of the event.

5.1.1.3. Ensure spacecraft electromagnetic emissions do not unintentionally interfere 

with or degrade the operation of any on-board equipment, adjacent spacecraft or groundbased systems/capabilities.

5.1.1.4. Use an Operational Review Process (ORP) or similar approved processes to 

reduce the risk of on-orbit collisions and electromagnetic/optical interference.

5.1.1.4.1. In addition, the Satellite Control Authority is responsible for the protection 

of manned spacecraft and precluding any activity that would adversely affect other 

space users based on an on-orbit COLA process identified by the MAJCOM. The 
AFI91-217 18 FEBRUARY 2010 37

COLA process will be developed based on assessments that account for on orbit 

station keeping and other maneuvers conducted as part of the spacecraft‘s mission.

5.1.1.5. The orbital safety program includes activities associated with the disposal 

reentry of spacecraft. The orbital safety program also includes activities associated with 

the reentry and recovery (if required) of test objects, jettisoned spacecraft components 

and subsidiary payloads that reenter the atmosphere in a planned and controlled or 

uncontrolled manner. Unless otherwise designated and agreed to, the agency that owns 

and operates the planned reentry site, if any, is the lead agency for assuring safety during 

the reentry phase.

5.1.2. Units will provide dedicated Orbital Safety Officers (OSO) for each program Orbital 

Safety Officers should manage the Satellite Control Authority‘s orbital safety program to 

include:

5.1.2.1. Participate in all ORP and Operational Review Board or equivalent processes to 

surface trends and for space safety related issues.

5.1.2.2. Ensure routine test, operations and experimental procedures take no unnecessary 

risk, consistent with cost effectiveness and mission requirements.

5.1.2.3. Participate in both routine operations and spacecraft anomaly recovery actions in 

order to gain experience and help develop lessons learned to prevent future anomalies.

5.1.2.4. Tailor local space safety training for operations and operations-test personnel for 

greater applicability for assigned missions and operational/test conditions.

5.1.2.5. Assist operations/operations-test personnel in complying with space safety 

guidelines, including: EOL passivation and disposal and other applicable space safety 

requirements.

5.1.2.6. Monitor Crew Rest, training, system modifications and any other aspect of 

operations, so as to advise the unit commander on risks to the mission.

5.2. On-Orbit Risk. The appropriate wing commander, in conjunction with the NAF AOC, 

assumes the responsibility for the protection of manned spacecraft and active spacecraft from the 

separation of the last launch vehicle component through EOL disposal or reentry.

5.2.1. The risk criteria listed below form the basis for risk management criteria in all aspects 

of on orbit checkout and orbital operations. Each on orbit checkout and orbital operation will 

satisfy the following criteria for assessed risk unless higher risk levels are specifically 

accepted with documented waivers for the operation.

5.2.1.1. Accidental Explosions. For each spacecraft and launch vehicle orbital stage 

employed for a mission, the program shall demonstrate, via failure mode and effects 

analyses or equivalent analyses, that the integrated probability of explosion for all failure 

modes of each spacecraft and launch vehicle is less than 0.001 (excluding collisions).

5.2.1.2. Intentional Breakups. Immediately before a planned explosion or intentional 

collision, the probability of debris, orbital or ballistic, larger than 1 mm colliding with 

any operating spacecraft within 24 hours of the breakup shall be verified to not exceed 1 

10-6(one in one million).
38 AFI91-217 18 FEBRUARY 2010

5.2.1.3. Manned spacecraft shall be protected by not exceeding a probability of impact 

greater than 1 10-6per spacecraft, or criteria outlined by MAJCOM/SE in coordination 

with the JSpOC. A spacecraft is considered manned if it is currently occupied, or 

expected to be occupied, and includes spacecraft en route to, and in support of, manned 

missions.

5.2.1.4. Collisions with Active Satellites. The probability of collision with active 

satellites will be established by 14 AF, but should not exceed 10 x 10-6(ten in one 

million) for active satellites per object.

5.2.1.5. Collisions with Large Objects. For each spacecraft or launch vehicle component 

in or passing through LEO, the program shall demonstrate that, during the orbital lifetime 

of each spacecraft or launch vehicle component, the probability of accidental collision 

with space objects larger than 10 cm in diameter is less than 0.001.

5.2.1.6. Collisions with Small Objects. For each spacecraft or launch vehicle 

component, the program shall demonstrate that, during the mission of the space system, 

the probability of accidental collision with objects (including space debris and 

meteoroids) sufficient to prevent post-mission disposal, is less than 0.01.

5.3. Waiver and Approval Authority. Consistent with AFI 91-202, MAJCOM guidance and 

other agreements, the risk acceptance authorities are outlined below.

5.3.1. Normal Risk Approval.

5.3.1.1. Operations/End-of-Life. Except for reentry decisions, the space operations 

squadron commander (or equivalent) is the approval authority for all operations/EOL risk

analyses that meet normal risk criteria except for risk analyses conducted for the PM as a 

part of deployment or operational support.

5.3.1.1.1. Reentry. The wing commander is the approval authority for all reentry risk 

analyses that meet normal risk criteria. The CDR JFCC SPACE is the approval 

authority for all reentry risk analyses that exceed normal risk criteria.

5.3.2. Approval for Exceeding Normal Risk Criteria. Except as noted in paragraphs 

5.3.1.1.1 and consistent with MAJCOM guidance and other agreements, the wing 

commander is the waiver approval authority for risks exceeding normal risk criteria.

5.3.2.1. Subsequent to system testing, the NAF Commander and CDR JFCC SPACE (via 

14 AF Director of Safety, if appropriate), will be notified of risks that exceed normal risk 

criteria by more than one order of magnitude.

5.3.2.2. Risks exceeding normal risk criteria by two or more orders of magnitude (e.g., 

one in one million vs. one-hundred in one million) require MAJCOM/CC approval.

5.3.2.3. The wing CoS will review all waiver requests requiring wing commander 

approval. The wing will document risk management decisions that exceed the accepted 

risk criteria. Subordinate units (wings, centers, NAFs, etc.) will provide the 

MAJCOM/SE copies of all waiver requests.

5.4. Orbital Mishaps and Anomalies.
AFI91-217 18 FEBRUARY 2010 39

5.4.1. Orbital Mishaps. All mishaps that occur after successful separation from all launch 

vehicle components, including upper stages and transfer/kick motors, are considered orbital 

mishaps. Refer to AFMAN 91-222 for reporting and investigation requirements.

5.4.1.1. Mishaps occurring prior to the separation of the last launch vehicle components 

may be considered a launch mishap. The specific nature of the mishap may not be 

determined until after the investigation has begun.

5.4.1.2. Mishaps occurring subsequent to the time the spacecraft operating agency is 

capable of sending commands to the spacecraft, or such time as the spacecraft begins any 

automated command sequences, may be considered orbital mishaps. The specific nature 

of the mishap may not be determined until after the investigation is complete.

5.4.1.3. It is possible for an orbital mishap to occur while launch vehicle hardware is still 

attached to the spacecraft. It is also possible for a launch mishap to occur once the 

spacecraft is commandable but still attached to launch vehicle hardware. The specific 

nature of the mishap may not be determined until after the investigation is complete.

5.4.2. Anomalies. Anomalies are unexpected events that may or may not result in damage, 

injury, or mission impact, but do not reach the level of a reportable mishap. This may be due 

to a malfunction of the spacecraft, human factors, the space environment or a variety of other 

reasons. Investigate all spacecraft anomalies in accordance with AFMAN 91-222. While 

anomalies may not initially meet Class A - E mishap/event criteria, anomalies should be 

reported as Class E HAPs if preexisting full recovery procedures do not exist (i.e. full 

recovery is automated or checklist driven without additional planning or intervention).

5.4.2.1. Orbital Safety Officers will be notified within 8 hours of all mission impacting 

or emergency anomalies/incidents and within 72 hours of all other anomalies. OSOs will 

be invited to participate as a full member on all non-routine Anomaly Resolution Teams, 

Engineering Review Boards, Operational Review Boards or similar constructs.

5.4.2.2. Safing. Organizations testing or operating orbital spacecraft, payloads, or 

experiments will have a formal and approved (wing or equivalent level) safing process 

that limits/prevents further mission degradation or failure.

5.4.2.2.1. Depending on the severity of the anomaly, the tester/operator should 

consider maneuvering the spacecraft to non-operational orbit, although not 

necessarily in a final disposal orbit. For GEO spacecraft, this will be at least 235 km 

above or below GEO.

5.4.2.3. Reporting. To ensure proactive mishap prevention, the relevant findings (to 

include Smart Ops) and recommendations from any anomaly investigation (e.g., 

Operations Review Board, Commanders Directed Investigation, or Anomaly Resolution 

Process) will be reported through safety channels in accordance with AFI 91-204 and 

AFMAN 91-222, in addition to normal reporting channels.

5.5. Orbital Mishap Prevention. Given the general inaccessibility of on-orbit hardware and 

inability of full component replacement, mishap prevention for on-orbit assets requires 

significant planning during the design phase. As with normal mishap prevention programs, 

orbital mishap prevention starts with spacecraft design and on-orbit test/operations planning. 
40 AFI91-217 18 FEBRUARY 2010

Mishap prevention is, however, an on-going process that occurs throughout the space systems 

life cycle.

5.5.1. Satellite Control Authority responsibility for mishap prevention begins after orbital 

insertion and when the spacecraft is capable of receiving transmitted commands or executing 

pre-stored command sequences. At such time, there is a possibility of overlapping 

responsibility for mishap prevention with the launching agency. Thus, the appropriate 

Launch Wing and Satellite Control Authority organization must work closely with one 

another to ensure proper system integration of the spacecraft with the launch vehicle.

5.6. Orbits. To provide a context for the guidelines in this chapter, four high interest regions of 

space are identified below and shown in Figure 5.1. Compliance with orbital safety requirements 

is especially important in these regions of space due to the high use or unique operational 

advantages provided. Failure to adhere to operational and disposal requirements will adversely 

affect other users within that region. Regardless of a spacecrafts orbit, it is critical that all 

mission and disposal operations do not interfere with other users.

Figure 5.1. High Interest Earth Orbits

GEO

1 5°

1 5°

Earth

LEO

Z = ZGEO – 300 km

Z = ZGEO + 300 km

Z = ZGEO = 35786 km

Z = 25200 km

Z = 18400 km

Z = 20200 km Z = 2000 km

Semi-Synchronous

Orbits

Equator

Molniya (HEO)

~63°

5.6.1. Low Earth Orbit (LEO). The region of space that extends from approximately 150 to 

2000 km altitude.

5.6.2. Medium Earth Orbit (MEO). The region of space midway between LEO and 

Geostationary Orbit (GEO).

5.6.2.1. Semi-Synchronous Orbit (SSO). SSO is a subset of MEO. The region of space 

containing nearly circular 12-hour orbits. This region is the spherical shell surrounding 

the Earth between approximately 18400 to 25200 km.
AFI91-217 18 FEBRUARY 2010 41

5.6.3. Geosynchronous Orbit (GSO) and Geostationary Orbit (GEO). GSO is an orbit with 

a period equal to the sidereal day. Geostationary orbit is a circular geosynchronous orbit 

with a 35786 km altitude and 0o inclination. Note: Common practice is to refer to satellites 

in low inclination geosynchronous orbits as geostationary satellites, even if they are 

technically not stationary due to their non-zero inclination.

5.6.4. Highly Elliptical Orbit (HEO). HEO is an elliptic orbit characterized by a low perigee 

(typically at LEO altitudes) and a relatively high-altitude apogee (typically in/above GEO). 

These elongated orbits can have the advantage of long dwell times (~9-12 hour period) at a 

point in the sky during the approach to and descent from apogee. Molniya orbits, at 

approximately 63o inclination, are one example of a typical highly elliptical orbit.

5.7. Space Environmental Hazards. The space environment is the region of space in which 

spacecraft and orbital launch vehicle components can operate. The space environment 

composition and effects change with altitude, time and solar and cosmic activity. Space hazards 

to spacecraft fall into two general categories: debris and environmental hazards.

5.7.1. Space debris consists of both man-made and natural objects. Natural objects include 

meteoroids and associated dust and gas particulates. Man-made objects include anything 

from defunct space systems to solid rocket engine slag, insulation blankets and mission 

related debris. Regardless of origin, high velocity impacts can pose a significant if not fatal 

hazard to spacecraft. Minimizing the creation of this debris is of critical importance. See 

section 5.8 for specific requirements.

5.7.1.1. Orbital Safety programs will be established to prevent mishaps from space 

hazards. Once cataloged, the debris from man-made object from hostile or non-hostile (or 

intentional or non-intentional debris) does not necessarily change an Orbital Safety 

program‘s reaction to the debris. In the changing world of space and the introduction of 

defensive counterspace, there is the possibility of hostile attacks on space assets.

5.7.2. Space environmental hazards include, but are not limited to: microgravity, cosmic 

rays, charged particles, plasma and solar radiation.

5.7.2.1. The Earth‘s geomagnetic field is a tear-drop shaped magnetic field that largely 

protects the Earth from plasma and other charged particles impacts. Charged particles 

and plasmas can be a hazard to spacecraft either through direct impact or by becoming 

trapped within the two Van Allen radiation belts formed by the geomagnetic field. See 

Figure 5.2 for a depiction of the Van Allen Belts relative to spacecraft orbits. Note: The 

size and shape of the Van Allen Belts varies with geomagnetic and solar activity.

5.7.2.1.1. The inner Van Allen belt (~600 to 6000 km altitude) contains high 

concentrations of energetic protons and electrons trapped by the geomagnetic field.

5.7.2.1.2. The large outer radiation belt extends from an altitude of about 13000 to 

65000 km (2 to 10 Earth radii) above the Earth's surface, and has its greatest intensity 

between 14500 and 19000 km. The outer belt consists mainly of high energy 

electrons and various ions (e.g. O+ oxygen ions).

5.7.2.2. Space Environmental Effects on Space Systems. Solar cells, integrated circuits, 

and sensors can be damaged by radiation. In 1962, the Van Allen belts were temporarily 

amplified by a high-altitude nuclear explosion and several satellites ceased operation. 
42 AFI91-217 18 FEBRUARY 2010

Geomagnetic storms occasionally damage electronic components on spacecraft. 

Miniaturization and digitization of electronics and logic circuits have made satellites 

more vulnerable to radiation, as incoming ions may be as large as the circuit's charge. 

Electronics on satellites must be hardened against radiation to operate reliably. The 

Hubble Space Telescope, among other satellites, often has its sensors turned off when 

passing through regions of intense radiation. Spacecraft in all orbits are susceptible to 

environmental hazards to one degree or another. It is critical that spacecraft designs and 

experimental/test/operations plans account for the effects of the space environment.

Figure 5.2. Van Allen Belts relative to GPS and GEO orbits

5.8. Space Debris. Space debris poses a risk to continued reliable use of space-based services 

and operations and to the safety of persons and property in space and on Earth. The United 

States shall seek to minimize the creation of orbital debris by government and non-government 

operations in space in order to preserve the space environment for future generations.

5.8.1. In concert with DoD regulations, the AF will continue to follow the U.S. Government 

Orbital Debris Mitigation Standard Practices, consistent with mission requirements and cost 

effectiveness in the procurement and operation of spacecraft, launch services and the 

operation of tests and experiments in space.

5.8.1.1. Space Debris Management Objective. This instruction requires that all space 

systems and launch vehicles (or components), that are expected to achieve orbital 

velocity, manage (mitigate and control) potential space debris generation through an 

assessment of the system design and concept of operations through end-of-life disposal. 

Note: The long term goal of any space debris mitigation program is zero debris 

generation.
AFI91-217 18 FEBRUARY 2010 43

5.8.2. This instruction provides a life cycle approach to ensure that debris mitigation 

processes are incorporated into system development, operations, disposal, reentry, and 

recovery. Additionally, for space systems that cannot meet debris mitigation requirements 

due to mission constraints or cost effectiveness, this instruction describes the requirements 

and process for a debris risk assessment. Failure to incorporate debris management in the 

normal system design process could lead to generation of orbital debris and increased hazard 

to other orbital assets through collisions that would in turn generate additional debris. The 

increased hazard would require more costly and heavier designs to protect operational 

capabilities at the expense of mission lifetime. Failure to assess reentry risk adequately could 

lead to property damage and/or human causalities from uncontrolled random reentries.

5.8.2.1. Space Debris Mitigation Assessments. Space debris mitigation assessments are 

required to be performed during the initial planning stages of the development of any 

orbital space system.

5.8.2.1.1. The PM shall assess the mission for compliance with DoDI 3100.12, 

Strategic Command Instruction (SI) 505-4, Satellite Disposal Procedures, and this 

instruction for generation of space debris during all mission phases.

5.8.2.1.1.1. The PM will prepare and deliver the mission space debris 

assessments in the Space Debris Assessment Report (SDAR) per the format and 

content defined in Attachment 2 for all objects being launched into space by an 

AF organization. The attachment also outlines the SDAR delivery requirements.

5.8.2.1.2. Hazardous Material Planning. During the design process, PMs will 

document hazardous materials contained in the space system and will estimate and 

plan for the system‘s safe disposal.

5.8.2.1.3. Operational Spacecraft Debris Release. Programs are required to assess 

and minimize the amount of orbital debris released during launch and orbital 

operations. Ideally, no operational debris will be released during normal operations 

of a spacecraft.

5.8.2.1.4. Accidental Explosions. Programs are required to implement processes, 

procedures and measures for the prevention of accidental explosions during and after 

completion of mission operations.

5.8.2.1.5. Safe Operational Configuration. Programs are required to select a safe 

operational configuration to limit the probability of collisions with known large 

objects during a spacecraft‘s orbital lifetime.

5.8.2.1.5.1. Programs are required to assess and minimize the probability that a 

spacecraft will become a source of orbital debris through collisions with debris 

smaller than 1 cm in diameter that could cause loss of control and prevent safe 

post-mission disposal. Collision assessment and the corresponding 

mitigation/limitation will be documented in the SDAR.

5.8.2.2. Design Reviews, Plans, and Assessment.

5.8.2.2.1. Systems Development and Demonstration. Space system programs are 

required to conduct a space debris assessment from the start of the acquisition process 

and to ensure that mitigation requirements are identified for inclusion in contractually 
44 AFI91-217 18 FEBRUARY 2010

binding documents. Consistent with mission requirements and cost effectiveness, 

space system architectures shall encompass all pertinent debris mitigation 

requirements for spacecraft, launch vehicles, orbital stage(s), and objects released 

during normal operations.

5.8.2.2.1.1. If a requirement cannot be met because of an overriding conflict with 

mission requirements or prohibitive cost impact, this shall be specifically noted in 

the SDAR with the appropriate rationale and justification.

5.8.2.2.2. Mitigation plans and procedures are defined and documented during the 

program mission definition and conceptual design phases; relevant debris generation 

sources and/or processes are identified at the Preliminary Design Review (PDR) and 

resolved by the Critical Design Review (CDR). The SDAR addresses and documents 

the following:

5.8.2.2.2.1. The potential for debris generation during normal operations or 

malfunction conditions.

5.8.2.2.2.2. The potential for generating debris by collision with space debris 

(natural or human generated) or other space systems.

5.8.2.2.2.3. Post-mission retirement/disposal.

5.8.2.2.3. Debris management considerations shall be formulated in the Initial Space 

Debris Mitigation Strategy and Disposal Concept. These considerations will be 

documented and will serve as the basis for both the SDAR and the End-of-Life Plan 

(EOLP), respectively. This documentation will also serve as an integral part of the 

pre-systems acquisition/concept development process and support the preparation of 

the following documentation:

5.8.2.2.3.1. Acquisition Strategy; and

5.8.2.2.3.2. System Specification; and

5.8.2.2.3.3. PESHE; and

5.8.2.2.3.4. National Environmental Policy Act documentation.

5.8.2.2.4. Design Reviews. The debris management planning and implementation 

shall be reviewed and assessed at major design reviews. Debris management 

considerations in the Systems Development Phase will influence but not be limited to 

PESHE and the Systems Specification.

5.8.2.3. Operations, Sustainment, and Disposal.

5.8.2.3.1. Programs should develop appropriate orbital safety TTPs for operations 

and disposal.

5.8.2.3.2. End of Life Disposal. Programs shall develop appropriate disposal plans 

for orbital space systems to either to reenter the atmosphere safely or else be moved 

into a disposal orbit at the end of its useful where it will be less likely to interfere with 

operational spacecraft. Programs will provide an EOLP for the disposal of the space 

system at the end of its useful life. Effective disposal of nonfunctional space systems 

not only provides an immediate benefit by protecting operational spacecraft from 
AFI91-217 18 FEBRUARY 2010 45

accidental collisions with orbital debris, but also has the long-term benefit of reducing 

the probability of nonfunctioning objects colliding with one another and creating 

additional debris.

5.8.2.3.2.1. PMs shall prepare, update, and deliver an EOLP using a format and 

content outlined in Attachment 3 for the configuration of the space vehicles 

anticipated at EOL for all objects. The attachment also outlines the EOLP 

delivery requirements.

5.8.2.3.3. Programs shall develop appropriate reentry/recovery analysis, plans and 

procedures for:

5.8.2.3.3.1. Launch vehicle reentry into the atmosphere.

5.8.2.3.3.2. Informing the relevant air traffic and maritime traffic authorities of 

the reentry time and trajectory and the associated ground area for controlled 

reentry.

5.8.2.3.3.3. Reentry risk analyses for ground environmental pollution caused by 

radioactive substances, toxic substances, or any other environmental pollutants.

5.8.2.3.3.4. Debris surviving reentry recovery process.

5.8.2.3.4. During disposal, Space Surveillance Network (SSN) tracking data will be 

used to predict reentry of space systems due to the potential for damage or human 

casualties. The JSpOC tracks the space object in orbit and gives a 30 day notification 

of reentry.

5.8.2.4. Debris Management Controls.

5.8.2.4.1. Failures to meet debris mitigation requirements shall be documented in the 

SDAR and submitted to the Center (or equivalent) Chief Engineer for review; the 

center (or equivalent) Safety Office shall be copied on any non-compliances.

5.8.3. Assessment of Debris Released During Normal Operations. Programs will assess and 

limit the amount of launch vehicle and spacecraft debris released in normal operations. This 

requirement applies to all space systems in Earth orbit and is recommended for operations 

beyond Earth orbit.

5.8.3.1. In all operational orbit regimes, space systems will be designed not to release 

debris during normal operations. Where this is not feasible, any release of debris shall be 

minimized in number, area, and orbital lifetime.

5.8.3.2. Historically, debris has been released as an incidental part of normal space 

operations. This type of debris is referred to as operational or mission-related debris and 

includes such objects as sensor covers, tie-down straps, explosive bolt fragments, attitude 

control devices, and dual payload attachment fittings.

5.8.3.3. Programs will design space systems to avoid the creation of any operational or 

mission-related debris. If the release of debris is unavoidable, the release shall be done in 

a manner that limits the risk to other users of space. Note: Small debris, such as slag 

which is ejected during the burning of a solid rocket motor and liquids dispersed from a 

spacecraft, are exempt from these requirements.
46 AFI91-217 18 FEBRUARY 2010

5.8.3.3.1. Debris 1 mm in diameter (about 1 mg) and larger for LEO and 5 cm (about 

100 gm) and larger for GEO is a source of concern because these debris have 

sufficient energy to critically damage an operating spacecraft. Large debris can 

create a cloud of secondary debris fragments in the event of a collision with another 

resident space object.

5.8.3.3.2. Debris passing through LEO. For missions leaving debris in orbits passing 

through LEO, released debris with diameters of 1 mm or larger shall satisfy the 

following requirements:

5.8.3.3.2.1. All debris released during the deployment, operation, and disposal 

phases shall be limited to a maximum orbital lifetime of 25 years from date of 

release.

5.8.3.3.2.2. The total object-time product shall be no larger than 100 object-years 

per mission. The object-time product is the sum of all debris of the total time 

spent below 2000 km altitude during the orbital lifetime of each object.

5.8.3.3.3. Debris passing near GEO. For missions leaving debris in orbits with the 

potential of traversing the GEO orbital regime, released debris with diameters of 5 cm 

or greater shall be left in orbits which will ensure that within 25 years after release the 

apogee will no longer exceed GEO - 300 km (35486 km).

5.8.3.4. Brief Summary of Mitigation Measures Used. If a program does not fall within 

the above requirements, a number of mitigation measures may be taken. These include:

5.8.3.4.1. Releasing debris in orbits with lower perigee altitude to reduce orbital 

lifetime.

5.8.3.4.2. Designing debris with larger area-to-mass ratio to reduce orbital lifetime.

5.8.3.4.3. Releasing debris under conditions in which lunar and solar perturbations 

will reduce lifetime.

5.8.3.4.4. Limiting release of debris by making design changes, changing operational 

procedures, or confining debris to prevent release into the environment.

5.8.4. Assessment of Debris Generated by Explosions and Intentional Breakups. Programs 

will assess and limit the probability of accidental explosion during and after completion of 

mission operations.

5.8.4.1. Spacecraft and launch vehicle orbital stage explosions have been the primary 

contributor to the hazardous orbital debris environment. Some explosions have been 

accidental with onboard energy sources providing the energy such as residual propellants 

or pressurants left in orbital stages. However, some intentional breakups have occurred 

as tests or as a means of disposing of spacecraft.

5.8.4.2. In order to limit the risk to other space systems from accidental breakups after 

the completion of mission operations, all onboard sources of stored energy of a space 

system, such as residual propellants, batteries, high-pressure vessels, self-destructive 

devices, flywheels, and momentum wheels shall be depleted or safed when they are no 

longer required for mission operations or post-mission disposal. Depletion shall occur as 

soon as this operation does not pose an unacceptable risk to the payload.
AFI91-217 18 FEBRUARY 2010 47

5.8.4.3. Meeting this requirement necessitates reliable designs to prevent explosions 

during operations as well as after operations are completed.

5.8.4.4. Accidental Explosions. Accidental explosions of spent orbital stages have been 

the primary source of long-lived debris greater than 1 cm in diameter in LEO. The 

assessed source of energy for most of these events has been residual propellants, 

including liquid oxygen and hypergolic propellants. Several spacecraft breakups have 

been linked to battery failures. Accidental explosions, primarily related to propulsion 

system malfunctions, during orbital deployment or orbital operations have also been 

documented. However, historically these events have attracted greater attention and 

more extensive preventive measures.

5.8.4.4.1. Programs will assess and limit the probability of accidental spacecraft and 

launch vehicle orbital stage explosion during and after completion of deployment and 

mission operations. The acquisition organization for each spacecraft or launch 

vehicle will:

5.8.4.4.1.1. Demonstrate, via failure mode and effects analyses or equivalent 

analyses, that the integrated probability of explosion for all failure modes 

(excluding collisions) of each spacecraft and launch vehicle is less than 0.001 

(one-thousand in one-million). If the probability of accidental explosion exceeds 

this limit for either a spacecraft or orbital stage, design or operational 

countermeasures shall be implemented to reduce the probability below the limit.

5.8.4.4.1.2. Ensure that the design of all spacecraft and launch vehicle 

components will include the ability to deplete all onboard sources of stored 

energy and disconnect all energy generation sources when they are no longer 

required for mission operations or post-mission disposal or control. This process 

is known as passivation. Specific passivation requirements are outlined in 

paragraph 5.11.3.

5.8.4.5. Intentional Breakups. Intentional breakups have been used to reduce the amount 

of debris surviving the reentry of large space systems and in conjunction with on-orbit 

tests. Secondary debris can also be generated by the collision of breakup debris with 

large operational and non-operational resident space objects. This risk is mitigated by 

placing limits on the numbers and orbital lifetime of breakup debris large enough to cause 

significant subsequent breakups.

5.8.4.5.1. Programs will assess and limit the effect of intentional breakups of 

spacecraft and launch vehicle orbital stages on other users of space. Consistent with 

cost-effectiveness and mission objectives, organizations conducting intentional 

breakups or collisions of spacecraft or launch vehicles will ensure that:

5.8.4.5.1.1. Planned explosions or intentional collisions are conducted at an 

altitude such that for orbital debris fragments larger than 10 cm the object-time 

product does not exceed 100 object-years. No debris larger than 1 mm shall 

remain in Earth orbit longer than one year.

5.8.4.5.1.2. Immediately before a planned explosion or intentional collision, the 

probability of debris, orbital or ballistic, larger than 1 mm colliding with any 

operating spacecraft within 24 hours of the breakup will be verified to not exceed 
48 AFI91-217 18 FEBRUARY 2010

1 10-6.

5.8.4.6. To lower the risk associated with on-orbit breakups:

5.8.4.6.1. Lower the altitude at which the breakup occurs. This is by far the most 

effective response for reducing both the near-term and long-term risk to other users of 

space.

5.8.4.6.2. Lower the perigee altitude of the orbit of the breakup vehicle(s).

5.8.4.6.3. Adjust the time for performing the breakup to avoid spacecraft or large 

resident space object interactions with regions of high flux concentration.

5.8.4.6.4. Deplete propellants and other stored energy sources as soon as practical.

5.8.5. Assessment of Debris Generated by On-orbit Collisions. In developing the design and 

mission profile of a space system, a program will estimate and limit the probability of 

accidental collision with known resident space objects during the system's orbital lifetime. If 

reliable orbital data is available, avoidance maneuvers for spacecraft and coordination of 

launch windows may be considered if the collision risk is not considered negligible. 

Spacecraft design shall limit the probability of collision with small debris which could cause 

a loss of control, thus preventing post-mission disposal.

5.8.5.1. Debris can be generated by random on-orbit collisions during and after mission 

operations. At issue are both the direct generation of debris by collision between the 

space vehicle and another large object in orbit, and the indirect or potential generation of 

debris when collision with small debris damages the vehicle to prevent its disposal at 

EOM, making it more likely that the vehicle will be fragmented in a subsequent breakup.

5.8.5.2. While it remains intact, a spacecraft or launch vehicle component represents a 

small collision risk to other users of space; however, once it is fragmented by collision, 

the collision fragments present a risk to other users that may be orders of magnitude 

larger. Because of typically high collision velocities, debris objects much smaller than 

the spacecraft may cause severe fragmentation (referred to as a catastrophic collision). 

For purposes of evaluation, debris with a diameter of 10 cm and larger will be assumed to 

cause a catastrophic collision.

5.8.5.3. Catastrophic collisions during mission operations represent a direct source of 

debris. However, if a spacecraft or launch vehicle component fails to perform its planned 

post-mission disposal operations, it becomes a potential source of debris because a 

structure that is abandoned in orbit can subsequently experience catastrophic breakup by 

collision or explosion.

5.8.5.4. Programs will assess and limit the probability that the operating space system 

becomes a source of debris if it collides with orbital debris or meteoroids.

5.8.5.4.1. Limiting debris generated by collisions with large objects. For each space 

system in or passing through LEO, the program will demonstrate that, during the 

orbital lifetime of each space system, the probability of accidental collision with 

space objects larger than 10 cm in diameter is less than 0.001.

5.8.5.4.2. Limiting debris generated by collisions with small objects. For each 

spacecraft, the program or project shall demonstrate that, during the mission of the 
AFI91-217 18 FEBRUARY 2010 49

spacecraft, the probability of accidental collision with objects, including orbital debris 

and meteoroids, sufficient to prevent post-mission disposal is less than 0.01.

5.8.5.5. Brief Summary of Mitigation Measures Used.

5.8.5.5.1. If a spacecraft or launch vehicle component in LEO or passing through 

LEO has a high probability of colliding with large objects during its orbital lifetime, 

there are several mitigation measures that may be taken, to include the following 

courses of action:

5.8.5.5.1.1. Changing the planned mission orbit altitude to reduce the expected 

collision probability.

5.8.5.5.1.2. Changing the spacecraft design to reduce cross-sectional area and 

thereby reduce the expected collision probability.

5.8.5.5.1.3. Reducing the amount of time in orbit by selecting a lower disposal 

orbit.

5.8.5.5.2. There are many mitigation measures to reduce the probability that 

collisions with small debris will disable the spacecraft and prevent successful postmission disposal. These measures use the fact that the debris threat is directional (for 

orbital debris, highly directional) and that the directional distribution can be predicted 

with confidence.

5.8.5.5.2.1. Design responses to reduce failure probability include addition of 

component and/or structural shielding, rearrangement of components to let less 

sensitive components shield more sensitive components, use of redundant 

components or systems, and compartmentalizing to confine damage.

5.9. Conjunction Assessment. Through the JSpOC, JFCC SPACE is the lead agency for 

orbital conjunction assessments. All AF launch and orbital space systems will use JSpOC 

generated CA runs for official COLA risk decisions. Secondary CA determinations, outside 

JSpOC are authorized, but will not be used for official COLA risk decisions without Wing CC 

approval in coordination with the JSpOC.

5.9.1. Consistent with mission capabilities and resource availability, conjunction 

assessments will be conducted for all active spacecraft against all satellite catalog objects 

within JSpOC established threat thresholds. These thresholds are typically identified by a 

miss distance, but other criteria may be used, as appropriate.

5.9.1.1. Given resource constraints and consistent with established agreements, manned 

spacecraft and active US and allied spacecraft will be prioritized.

5.9.2. Each spacecraft operator, in coordination with the wing Safety Office, JFCC SPACE 

and 14 AF/SE, will develop thresholds (e.g. very low Delta-V (ΔV) maneuvers) within which 

no CA/COLA is required.

5.9.3. Spacecraft owner/operators, operating spacecraft using automated maneuver 

protocols, will work with JFCC SPACE, 14 AF/SE and the wing Safety Office (or 

equivalent) to develop appropriate CA/COLA procedures.

5.10. Collision Avoidance. In addition to damaging or destroying objects in space, collisions 

generate large quantities of hazardous debris that can lead to further collisions, potentially 
50 AFI91-217 18 FEBRUARY 2010

rendering some orbits unsafe for years. Thus, it is of critical importance that collisions involving 

orbiting objects are avoided. Ensure the probability of collision is weighed against the risk of 

shortening mission-life due to expenditure of fuel when making this maneuver decision.

5.10.1. An ORP approved COLA processes will be developed for both maneuverable and 

non-maneuverable active spacecraft.

5.10.1.1. MAJCOMs will establish notification processes for non-maneuverable 

spacecraft designed to alert cognizant officials of potentially unavoidable collisions prior 

to the event.

5.10.1.2. AF organizations will use an AFSPC approved Commercial and Foreign 

Entities (CFE) process (or substitute) for all CA issues with commercial or foreign 

spacecraft. This does not relieve AF organizations of reporting requirements outlined in 

this or other AF documents.

5.10.1.3. All COLA processes will identify risk acceptance levels for each program.

5.10.2. See section 4.6.6 for CA/COLA processes for launch vehicle components.

5.10.3. Regardless of whether or not a COLA maneuver is performed, all high risk COLA 

decision processes shall be documented for mishap prevention purposes.

5.10.3.1. Any COLA risk decision that is calculated to be a high or extremely high risk 

(per Operational Risk Management (ORM) risk assessment matrix) or any COLA risk 

decision that requires Satellite Control Authority Wing CC (or designated COLA 

approving official), will be reported in AFSAS as a Class E HAP or higher, consistent 

with AFMAN 91-222. Waivers to this requirement must be approved and documented by 

NAF/Center Safety Office and 14 AF/SE.

5.10.4. ―Smart Ops‖ or TTPs can be used for collision avoidance purposes.

5.10.5. The COLA process shall be used prior to any RV planned descent phase 

implementation (de-orbit burn) to protect against collision with the returning vehicle and 

shall compute the closest approach or collision probability of the descending vehicle.

5.10.5.1. The NAF/Center Safety Office is responsible for enforcing COLAs during 

reentry phase.

5.10.6. Automated maneuver protocols will employ risk management techniques that 

prevent unintended consequences. Failure modes will be designed to prevent collisions or 

debris generation events.

5.10.7. Noncompliance with approved COLA procedures will be reported to JFCC SPACE 

(via 14 AF/SE) and MAJCOM/SE.

5.10.8. Close Proximity Operations. Orbital operations involving the close proximity of two 

or more space objects require special consideration. Formation operations typically involve 

spacecraft that are specifically designed to operate in close proximity to one another. These 

operations may involve refueling or re-boosting of the  ̳recipient‘ space object. Rendezvous 

operations may also involve space objects that are  ̳unaware‘ of the other object(s).

5.10.8.1. Traditional CA procedures will not work for close proximity operations. ORP 

approved procedures will be developed for CA and close proximity operations. These 
AFI91-217 18 FEBRUARY 2010 51

procedures will be designed to avoid unintended spacecraft-spacecraft contact, 

unnecessary debris generation, or the contamination of sensitive equipment from 

spacecraft thruster firings or other off-gassing.

5.10.8.2. Objects designed for close proximity operations, will include failure modes that 

are designed to avoid collisions between the objects.

5.11. End-of-Life Actions. All spacecraft and launch vehicle components will be passivated 

and disposed of at EOL via methods outlined in this section.

5.11.1. Reliability of post-mission disposal operations. Programs will ensure that all postmission disposal operations are designed for a probability of success as follows:

5.11.1.1. For disposal maneuvers not associated with controlled reentry, the probability 

of success shall be no less than 0.90 at EOL.

5.11.1.2. For controlled reentry, the probability of success at the time of reentry burn 

shall be sufficiently high so as not to cause a violation of section 4.8.3 pertaining to 

limiting the risk of human casualty.

5.11.2. Disposal. All Air Force space systems, including research and development systems, 

will comply with the disposal requirements in SI 505-4, in addition to requirements outlined 

below. Waivers for research and development systems must be approved of by 

MAJCOM/SE and 14 AF/SE. See Figure 5.3 for disposal orbits described below. Note: Any 

MAJCOM approved waivers to the following disposal requirements must be justified and 

documented. A copy of the justification and approval will be sent to HQ AFSC/SES.

5.11.2.1. When determining disposal orbits, operators will account for spacecraft 

area/mass ratio and the effect of future orbital drift due to gravitational perturbations and 

other space environmental effects. Due to fuel gauging uncertainties near the end of 

mission, use a maneuver strategy that has the least risk of leaving the structure near an 

operational orbit regime.

5.11.2.1.1. The use of orbital transfer vehicles is authorized to be used to meet 

disposal orbit requirements if the orbital transfer vehicles are operational and on-orbit 

at the time of the EOL of the spacecraft/launch vehicle in question. The 

spacecraft/launch vehicle component must still meet the 25 year decay orbit rule, if 

applicable for the particular orbit.

5.11.2.1.2. Due to the long period variability of eccentric orbits, it is essential that the 

final disposal orbits be propagated for a minimum of 100 years to ensure that its orbit 

does not intersect (within 500 km) high density orbits (e.g. LEO or GEO).

5.11.2.2. Atmospheric Reentry. Limit the amount of debris that can survive atmospheric 

reentry when used as a means of removing space systems from orbit at the EOL. All 

reentries will meet the risk requirements of RCC 321. If drag augmentation devices are 

to be used to reduce the orbit lifetime, demonstrate that such devices will significantly 

reduce the area-time product of the system or that it will not cause the spacecraft or large 

debris to fragment if a collision occurs while the system is decaying from orbit. The 

disposal options described in the following paragraphs provide further guidance when 

destruction is not guaranteed.
52 AFI91-217 18 FEBRUARY 2010

5.11.2.2.1. Uncontrolled Reentry. If there is a significant amount of debris expected 

to survive uncontrolled reentry, reduce the risk by establishing procedures or designs 

to reduce the amount of debris reaching the Earth's surface.

5.11.2.2.2. Controlled (destructive) Reentry. For controlled reentry of an object 

intended to burn-up in the atmosphere, the selected trajectory shall ensure that no 

surviving debris impacts closer than 370 km from foreign landmasses, or is 50 km 

from the continental U.S., territories of the U.S., and the permanent ice pack of 

Antarctica.

5.11.2.2.3. Controlled (non-destructive) / Active Reentry. The selected trajectory of 

an object intended to survive reentry (e.g. reusable launch vehicles and spacecraft) 

will comply with all airspace control policies, procedures and requirements.

5.11.2.3. LEO. A spacecraft or launch vehicle component with a perigee below 2000 km 

shall be disposed of by one of three methods:

5.11.2.3.1. Atmospheric Reentry.

5.11.2.3.1.1. Leave the spacecraft or launch vehicle component in an orbit in 

which natural forces will lead to atmospheric reentry within 25 years after the end 

of mission but no more than 30 years after launch.

5.11.2.3.1.2. Maneuver the space system into a controlled de-orbit trajectory as 

soon as practical after completion of mission.

5.11.2.3.2. Disposal Orbit.

5.11.2.3.2.1. Maneuver the space system into an orbit with a perigee above 2000 

km and apogee below 18400 km.

5.11.2.3.2.1.1. For space systems in orbits below 1400 km, generally, the 

most energy-efficient means for disposal is via maneuver to an orbit from 

which natural decay will occur within 25 years of EOL and 30 years from 

launch.

5.11.2.3.2.1.2. For space systems in orbits between 1400 km and 2000 km, a 

maneuver to a storage orbit above 2000 km would likely be the best disposal 

option.

5.11.2.3.3. Direct Retrieval.

5.11.2.3.3.1. Retrieve the space system and remove it from orbit within 10 years 

after completion of mission.

5.11.2.4. Between LEO and MEO. A spacecraft or launch vehicle component with a 

perigee above LEO and apogee below MEO shall be disposed of by the following 

method:

5.11.2.4.1. Maneuver the space system into an orbit with a perigee altitude greater than 2000 km 

and apogee less than 18400 km.
AFI91-217 18 FEBRUARY 2010 53

Figure 5.3. Operating, Storage and Disposal Regions/Orbits.

Supersynchronous

Disposal Orbit

Subsynchronous

Disposal Orbit

Low Altitude

Disposal Orbit

Geostationary 35,786 km

Earth Orbit

MEO / Semi-Synch Orbit ~20,000 km

(GPS, Glonass)

Earth

Low Earth Orbit

2,000 km

Disposal 

Region

Disposal 

Region

Disposal 

Region

~150 km

Disposal 

Region

MEO / Semi-Synch Orbit 

(Galileo)

23,222 km

Semi-Synch

Disposal Orbit

25,200 km

34,800 km

36,100 km

22,000 km

20,700 km

18,400 km

2,000 km

5.11.2.5. MEO Navigation Orbits. Spacecraft or launch vehicle components between 

18400 km and 25200 km shall be disposed of by the following method:

5.11.2.5.1. Maneuver the space system to a stable orbit that has the following 

parameters:

5.11.2.5.1.1. An eccentricity less than or equal to 0.003; and

5.11.2.5.1.2. A perigee altitude above 2000 km and apogee altitude below 18400 

km; or
54 AFI91-217 18 FEBRUARY 2010

5.11.2.5.1.3. A perigee altitude above 25200 km or nearby operational region and 

apogee altitude below 34800 km.

5.11.2.6. Between MEO and GEO. A spacecraft or launch vehicle component with a 

perigee above MEO and apogee below GEO shall be disposed of by the following 

method:

5.11.2.6.1. Maneuver the space system to an orbit that has:

5.11.2.6.1.1. An eccentricity less than or equal to 0.003, and

5.11.2.6.1.2. A perigee altitude above 20700 km and apogee altitude below 

22000 km, or

5.11.2.6.1.3. A perigee altitude above 25200 km and apogee less than 34800 km.

5.11.2.7. GEO. A spacecraft or launch vehicle component in an orbit near GEO shall be 

disposed of by the following method:

5.11.2.7.1. Maneuver the space system to an orbit above GEO such that orbital 

perturbations will not cause the satellite to reenter the GEO region for a period of at 

least 100 years after disposal.

5.11.2.7.1.1. The minimum perigee altitude taking into account all orbital 

perturbations will be the greater of 36100 km or:

36086 km + CR  (1000  A/m)

where A/m: Aspect area [m2] to EOL mass [kg] ratio and CR is the spacecraft coefficient of 

reflectivity at EOL.

5.11.2.7.1.2. Orbits with modest eccentricities near GEO can be perturbed over 

long periods into more elliptical orbits with lower perigees. Therefore, the initial 

eccentricity of a GEO disposal orbit will be less than 0.005.

5.11.2.7.2. Use a maneuver strategy that results in a guaranteed minimum increase in 

the post-maneuver perigee after each subsequent burn.

5.11.2.8. HEO/Geosynchronous Transfer Orbits (GTO)/Molniya. A spacecraft or launch

vehicle component in a HEO, GTO or a Molniya orbit shall be disposed of by one of the 

following methods:

5.11.2.8.1. Atmospheric Reentry.

5.11.2.8.1.1. HEO/GTO. Maneuver the space system into an orbit in which 

natural forces will lead to atmospheric reentry within 25 years after the end of 

mission. This option is the preferred disposal option for HEO/GTO space 

systems.

5.11.2.8.1.2. Molniya. Maneuver the space system into an orbit in which natural 

forces will lead to atmospheric reentry within 25 years after the end of mission. 

Atmospheric reentry options for Molniya space systems in high density orbits 

should be favored over disposal orbits due to the collision hazards these highly 

elliptical orbits pose to sun-synchronous missions as well as their own active and 

disposal orbits. Note: For Molniya satellites, atmospheric reentry requires less 

energy than placement in a disposal orbit if EOL eccentricity is greater than 0.7.
AFI91-217 18 FEBRUARY 2010 55

5.11.2.8.2. Disposal Orbit.

5.11.2.8.2.1. Maneuver the space system such that it will achieve a stable orbit 

that has the following parameters:

5.11.2.8.2.1.1. A minimum perigee of 2500 km (HEO/GTO) / 3000 km 

(Molniya), and:

5.11.2.8.2.1.2. An apogee not between: 18400 km and 20700 km, 22000 km 

and 25200 km, or 34800 km and 36100 km.

5.11.2.8.2.1.2.1. Space systems whose inclination is not projected to come 

within 15o of GEO within 100 years are exempt from this requirement.

5.11.2.8.2.1.2.2. Launch vehicle components should reach GEO - 500 km, 

or lower, within 25 years after separation from the spacecraft.

5.11.2.9. Disposal of space systems in heliocentric or Earth-escape trajectories.

5.11.2.9.1. Place the spacecraft or launch vehicle component in a heliocentric orbit. 

Deconflict the planned disposal orbit with NASA Office of Safety and Mission 

Assurance.

5.11.2.10. Brief Summary of Mitigation Measures Used. For a program that elects to 

limit orbital lifetime using atmospheric drag and reentry, several options are available:

5.11.2.10.1. Lower the initial perigee altitude for the disposal orbit.

5.11.2.10.2. When deploying LEO spacecraft to altitudes above 700 km, utilize a 

lower altitude staging orbit, followed by spacecraft raising maneuvers, to accelerate 

the orbital decay of launch vehicle stages, particularly those with no re-start 

capability.

5.11.2.10.3. Increase the area-to-mass ratio for the structure using drag augmentation 

but be aware of the issues regarding collision potential with resident space objects.

5.11.2.10.4. For highly elliptical orbits, restrict the initial right ascension of 

ascending node of the orbit plane relative to the initial right ascension of the Sun so 

that the average perigee altitude is lowered naturally.

5.11.2.10.5. In order to increase the probability that the post-mission disposal 

maneuver will be successful, disposal systems should have a redundant capability.

5.11.3. Passivation. All spacecraft and launch vehicle components, to include research and 

development systems, will be passivated during final disposal. This procedure must 

eliminate all forms of stored energy and will disconnect all energy generation. Specific 

requirements are outlined in SI 505-4, section 8 and below. Waivers for research and 

development systems must be approved by 14 AF/SE and MAJCOM/SE. Note: All postpassivation orbital parameters will meet required disposal criteria outlined in section 5.11.2.

5.11.3.1. During space system design and development, the program or project shall 

identify sources or potential sources of stored energy and shall develop and implement a 

plan for minimizing these sources at EOL. Passivation procedures to be considered 

include, but are not limited to the following actions:
56 AFI91-217 18 FEBRUARY 2010

5.11.3.1.1. Burning residual propellants to depletion.

5.11.3.1.2. Venting propellant lines and tanks.

5.11.3.1.3. Venting pressurized systems.

5.11.3.1.4. Discharging batteries, other energy storage systems, and preventing 

recharging.

5.11.3.1.5. Depressurizing gas and liquid filled batteries.

5.11.3.1.6. Deactivating range safety systems.

5.11.3.1.7. De-energizing control moment gyroscopes.

5.11.3.2. Residual propellants and other fluids, such as pressurant, will be depleted as 

thoroughly as possible, either by depletion burns or venting, to prevent accidental breakups by over-pressurization or chemical reaction. At EOL, all fluid vessels and lines 

should be open to the space environment directly or indirectly.

5.11.3.2.1. To ensure that all disposal orbit parameters are met, the final disposal 

operation will account for any induced ΔV due to depletion burns/venting.

5.11.3.2.2. Depletion burns and venting shall be conducted in a manner which does 

not affect other space systems and which will not induce a fragmentation.

5.11.3.2.3. Leak-before-burst tank designs are beneficial but are not sufficient to 

prevent explosions in all scenarios. Therefore, such tanks must still be depressurized 

at the end of use.

5.11.3.2.4. Small amounts of trapped fluids could remain in tanks or lines after 

venting or depletion burning. Design and operational procedures shall be employed 

to minimize the amount of these trapped fluids.

5.11.3.2.5. Sealed heat pipes and passive nutation dampers need not be depressurized 

at EOL.

5.11.3.3. Batteries will be adequately designed and manufactured, both structurally and 

electrically, to prevent breakups. Pressure increase in battery cells and assemblies could 

be prevented by mechanical measures unless these measures cause an excessive reduction 

of mission assurance. At the end of operations, battery charging lines will be deactivated.

5.11.3.3.1. The complete discharge of batteries and their subsequent disconnection 

from charging circuits is preferred. If this is impractical, the batteries shall be left 

with a permanent electrical drain to prevent recharging. If permitted by design, 

pressurized batteries should be depressurized at EOL.

5.11.3.4. High-pressure vessels will be vented to a level guaranteeing that no break-ups 

can occur. Leak-before-burst designs are beneficial but are not sufficient to meet all 

passivation recommendations of propulsion and pressurization systems. Heat pipes may 

be left pressurized if the probability of rupture meets acceptable risk criteria.
AFI91-217 18 FEBRUARY 2010 57

5.11.3.5. Self-destruct systems shall be designed not to cause unintentional destruction 

due to inadvertent commands, thermal heating, or radio frequency interference. Selfdestruct systems will be designed not to cause unintentional destruction.

5.11.3.6. The removal of electrical energy inputs from rotational energy devices, such as 

a gyro, is usually sufficient to ensure the timely passivation of these units.

5.11.3.7. The program or project shall include a description of the passivation procedure 

in the SDAR and EOLP. This description shall not only identify the passivation actions 

to be employed for all sources of stored energy but also shall provide a notional timeline 

of when the actions will take place. For example, an orbital stage main propulsion 

system depletion burn may be scheduled 15 minutes after separation of the payload, 

followed by a sequenced venting of the propellant and pressurant tanks thereafter.

5.11.3.8. A passivation plan for post-mission disposal shall be developed as a part of 

both the SDAR and EOLP. This plan shall identify all passivation measures to include at 

a minimum spacecraft fuel depletion, propellant venting, disabling of battery charging 

systems, safing of bus and payloads, and any sources of stored energy that will remain.

5.11.4. MAJCOM/SE approval is required for all testing on spacecraft with limited ability 

(as determined by a trained Orbital Safety Officer) to meet disposal and passivation 

guidelines outlined above.

5.12. Recovery Procedures. Recovery of space objects that have reentered the atmosphere may 

provide useful information for future mishap prevention or enhance future spacecraft 

development. Typically, the applicable acquisition organization is responsible for AF owned 

objects/assets, and they will determine if recovery is required. Develop written recovery 

procedures that require notification to the State Department when recovery is contemplated in 

foreign territory since an international incident could be created if proper recovery processes are 

not followed. Coordinate all procedures with 14 AF/SE.

5.13. Near Earth Objects. Near Earth Objects (NEOs) are Sun-orbiting space debris, such as 

comets and asteroids that have orbits that either have or potentially have Earth-crossing orbits. 

These objects can impact the Earth causing massive amounts of damage and casualties. The 

debris associated with NEOs can also damage or destroy space systems. The annual Leonids 

meteor shower, produced by the comet Tempel-Tuttle, is one example of the hazards posed by 

NEOs to space systems. In 1993, the European Olympus F1 satellite was struck by a Perseid 

meteoroid, leading to its ultimate failure.

5.13.1. High altitude large meteor airbursts (i.e., bolides) occur several times a year and are 

usually detected by missile early warning satellites. An airburst over a sensitive site could be 

misconstrued as an act of war by nations lacking sophisticated early warning capabilities. 

Early warning data sharing agreements designed to prevent misinterpretations of airbursts 

should be considered when feasible.

5.13.2. High yield surface impacts and airbursts are very rare. However, due to the 

extremely catastrophic nature of these events, the overall risk is considered non-negligible. 

A surface impact or airburst would have a TNT equivalent explosive power between 10 

kilotons (1 kiloton is equal to one thousand tons of TNT) to 1,000,000 megatons (1 megaton 

is equivalent to 1 million tons of TNT).
58 AFI91-217 18 FEBRUARY 2010

5.13.3. Not all NEOs have been identified, and for those that have, their orbits may be 

poorly understood. Due to the mass and velocity of these objects, attempts at changing NEO 

orbits must take place years, if not decades in advance of any predicted impact. Highly 

accurate orbit determination is critical in order to mitigate this possibility.

5.13.4. NEOs pose a risk to both space systems and the general public. Consistent with 

resource availability and other DoD/Air Force requirements, Air Force space systems capable 

of detecting or tracking NEOs should implement procedures to do so and coordinate with the 

NASA NEO Program Office.
AFI91-217 18 FEBRUARY 2010 59

Chapter 6

-SAFETY OF SPACE CONTROL SYSTEMS

6.1. Space Control Systems. Space Control Systems include systems, such as the Space 

Surveillance Network, Command and Control Warning and Offensive and Defensive Counter 

Space Systems, have unique missions that don‘t directly support other space systems.

6.2. Safety Program. All organizations that test or operate space control systems will have a 

space safety program. Note: Consistent with MAJCOM guidelines, passive space systems are 

exempt from this requirement. However, the directed energy (DE) requirements specified in 

Chapter 7 still apply to DE systems attached to passive space systems (e.g. laser guide stars used 

for adaptive optics).

6.2.1. Consistent with guidance related to Environment, Safety, and Occupational Health 

hazard elimination or mitigation requirements, all space control systems will limit the 

unintended effects of the system on personnel, the environment, or on other ground, air or 

space systems.

6.2.1.1. Space control systems should take into account system interfaces, capabilities, 

and vulnerabilities in order to assess the risks of testing or operating these systems in 

isolation or in conjunction with other systems.

6.2.2. C2 systems are to be treated as weapons systems and as such require intensive 

evaluations for overall support to the warfighters.

6.2.3. Operators of these systems should take special care not to produced unintended effects 

when operating these systems. Reference SI 534-15, Risk Management and Radio 

Frequency Deconfliction for Space Control Activities for further information.

6.2.4. Safety programs should emphasize test program validation (to include procedures 

discipline, readiness reviews, and test execution risk management) and configuration control 

in order to minimize unintended events or failures.

6.3. Other Space Systems. Space systems that directly support more than one other space 

systems (e.g. Air Force Satellite Control Network) will have their own space safety program. 

This safety program will take into account system interfaces, capabilities, and vulnerabilities in 

order to assess the risks of testing or operating these systems. Note: Safety for systems that 

directly support only one other space system should be addressed within the scope of the 

supported system. These systems are considered ground support equipment for the larger, 

supported, space system.

6.4. Risk Responsibility Phases. The following outlines the risk responsibility for the mission 

program phases for space control Systems. Risk responsibility only applies to risks that are 

within the control of a particular agency/authority. The risk responsibility for the various 

program phases may overlap.

6.4.1. The acquisition organization is responsible for risk management from concept design 

through FOC. It is also responsible for risk management for all follow-on support activities.
60 AFI91-217 18 FEBRUARY 2010

6.4.2. The TACON organization is responsible for risk management during testing that leads 

to Initial Operational Capability (IOC) through end-of-mission disposal upon which time the 

risk management returns to the acquisition organization.

6.4.3. Space safety professionals of some programs may have additional responsibilities 

dealing with risk assessments to security measures, as directed by the MAJCOM.

6.4.4. Warning systems have unique operational risks.

6.4.4.1. The risks associated with the use of high power used in radars will be addressed 

by the space safety program.

6.4.4.2. Reducing the risk of and preventing mission down time is an important aspect on

warning systems. Use the same timeframes used by the controlling Air Operations 

Center to report down times that relate to safety.

6.4.4.3. The risk of sending erroneous warning information to the Integrated Tactical 

Warning and Assessment Center is critical; the risk of erroneous warnings getting to 

National Command Authority is catastrophic. Warning safety programs will ensure risk 

reduction methods are employed to prevent erroneous data being sent up command 

channels by reviewing all test procedures and changes to systems and procedures.

6.5. Waiver and Approval Authority. Consistent with AFI 91-202, MAJCOM guidance and 

other agreements, the risk acceptance authorities are outlined below.

6.5.1. Normal Risk Approval.

6.5.1.1. The acquisition organization‘s commander or equivalent is responsible for 

ensuring proper risk management and acceptance involving design and operation of a 

space system throughout its life cycle when hazards causing the risks are controlled by 

engineering technical documentation.

6.5.1.2. Operations/End-of-Life. Except for reentry decisions, the space operations 

squadron commander (or equivalent) is the approval authority for all operations/EOL risk 

analyses that meet normal risk criteria except for risk analyses conducted for the PM as a 

part of deployment or operational support.

6.5.1.3. AFCESA is the waiver authority for all facility changes that do not meet the 

minimum requirements of UFC 1-200-01, and UFC 3-600-01.

6.5.2. Approval for Exceeding Normal Risk Criteria. Except as noted in paragraph 6.5.1.3, 

and consistent with MAJCOM guidance and other agreements, the wing commander is the 

waiver approval authority for risks exceeding normal risk criteria.

6.5.2.1. During any life cycle phase up through system deployment in the Build And 

Operations Phase, the center Commander and CDR JFCC SPACE (via 14 AF Director of 

Safety, if appropriate) will be notified of risks that exceed normal risk criteria by more 

than one order of magnitude (e.g., one in one million vs. ten in one million).

6.5.2.2. Subsequent to system testing, the NAF Commander and CDR JFCC SPACE (via 

14 AF Director of Safety, if appropriate), will be notified of risks that exceed normal risk 

criteria by more than one order of magnitude.
AFI91-217 18 FEBRUARY 2010 61

6.5.2.3. Risks exceeding normal risk criteria by two or more orders of magnitude (e.g., 

one in one million vs. one-hundred in one million) require MAJCOM/CC approval.

6.5.2.4. The wing CoS will review all waiver requests requiring wing commander 

approval. The wing will document risk management decisions that exceed the accepted 

risk criteria. subordinate units (wings, centers, NAFs, etc.) will provide the 

MAJCOM/SE copies of all waiver requests.
62 AFI91-217 18 FEBRUARY 2010

Chapter 7

HIGH ALTITUDE OPERATIONS SAFETY

7.1. High Altitude Operations. Normally, High Altitude Operations is an Aviation Safety 

issue; however, there are unique similarities to on-orbit checkout and orbital operations safety. 

While there is no legal definition of high altitude, common usage identifies it as the region 

between 65,000 (~20 km) to 325,000 feet (~100 km).

7.2. Platforms. HAO systems should follow the Aviation Safety discipline for general safety

program guidance.

7.3. Payloads. Due to the similarity between payloads on spacecraft and HAO systems, 

mishaps involving HAO payloads should be examined for mishap prevention and lessons 

learned, by both space safety and aviation safety personnel.

7.4. High Altitude Environment. This environment, while not as hazardous as the space 

environment, still presents certain risks. Risks include high winds and ultraviolet radiation.

7.4.1. HAO systems and payloads should be designed to operate in this environment.
AFI91-217 18 FEBRUARY 2010 63

Chapter 8

-SAFETY OF DIRECTED ENERGY/KINETIC SYSTEMS

8.1. Directed Energy Systems. All Directed Energy systems that are designed to be aimed 

above the horizon will establish procedures to ensure coordination with the Directed Energy 

Clearinghouse (i.e., Laser Clearinghouse), local (installation) and MAJCOM Spectrum Office (to 

include the Joint Restricted Frequency List), as applicable, prior to the testing or operation of 

directed energy or radio frequency systems in/into/from space.

8.1.1. Coordination with Directed Energy Clearinghouse, operated by the JSpOC (Unified 

Space Vault), is required for all Class 3b and 4 lasers that project into or through space to 

verify that on-orbit objects are not adversely affected by the laser operation.

8.1.2. Reference DoDI O-3100.11, Illumination of Objects in Space by Lasers, SI 534-12, 

Laser Deconfliction Process, and AFI 91-401, Directed Energy Weapon Safety, for further 

directed energy safety guidance.

8.2. Kinetic Energy Systems. All kinetic systems will establish procedures to conduct 

Conjunction Assessments or Collision Avoidance, as applicable, prior to the testing or operation 

of these systems in/into/from space.

8.2.1. Reference the relevant AFI 91-1xx and AFI 91-2xx series of instructions for further 

weapons safety guidance.
64 AFI91-217 18 FEBRUARY 2010

Chapter 9

FUTURE FOR SPACE SAFETY PROGRAMS

9.1. Updates. AF space systems will continue to expand into new mission areas. These areas 

may include nuclear space power and propulsion, manned missions, joint-commercial operations 

and deep space missions (e.g. Clementine lunar probe). Expanded emphasis on Joint, Coalition 

and NEOs should be expected. Please forward inputs for this and other AF space safety 

documents to HQ AFSC/SESS or visit the Space Safety Community of Practice on the AF 

Knowledge Now portal.

9.2. Forms

9.2.1. No forms are prescribed in this publication.

FREDERICK F. ROGGERO

Major General, USAF

Chief of Safety
AFI91-217 18 FEBRUARY 2010 65

Attachment 1

GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION

References:

AFDD 2-2, Space Operations, 27 November 2006

AFPD 90-9, Operational Risk Management, 1 April 2000

AFPD 91-2, Safety Programs, 28 September 1993

AFPD 91-4, Directed Energy Weapons Safety, 11 July 2003

AFI 51-701, Negotiating, Concluding, Reporting, and Maintaining International Agreements, 6 

May 1994

AFI 63-124, Performance-Based Services Acquisition, 1 August 2005

AFI 63-1201, Life Cycle Systems Engineering, 23 July 2007

AFI 90-801, Environment, Safety and Occupational Health Councils, 25 March 2005

AFI 90-901, Operational Risk Management, 1 April 2000

AFI 91-110, Nuclear Safety Review and Launch Approval for Space or Missile Use of 

Radioactive Material and Nuclear Systems, 28 June 2002

AFI 91-202, The US Air Force Mishap Prevention Program, 1 August 1998

AFI 91-204, Safety Investigations and Reports, 24 September 2008

AFI 91-301, Air Force Occupational and Environmental Safety, Fire Protection, and Health 

(AFOSH) Program, 1 June 1996

AFI 91-401, Directed Energy Weapons Safety, 29 September 2008

AFMAN 91-201, Explosives Safety Standards, 18 October 2001

AFMAN 91-222, Space Safety Investigations and Reports, 9 August 2005

AFPAM 90-902, Operational Risk Management (ORM) Guidelines and Tools, 14 December 

2000

DFARS 252.223-7002, Safety Precautions for Ammunition and Explosives, May 1994

DoD 4145.2-M, DoD Contractor’s Safety Manual for Ammunition and Explosives, 13 March 

2008

DoD 6055.09-STD, DoD Ammunition and Explosives Safety Standards, 29 February 2008 

DoDD 3100.10, Space Policy, 9 July 1999

DoDD 3200.11, Major Range and Test Facility Base (MRTFB), 27 December 2007

DoDD 5000.01, The Defense Acquisition System, 12 May 2003

DoDD 5101.2, DoD Executive Agent for Space, 03 June 2003

DoDI O-3100.11, Illumination of Objects in Space by Lasers, 31 March 2000

DoDI 3100.12, Space Support, 14 September 2000
66 AFI91-217 18 FEBRUARY 2010

DoDI 5000.02, Operation of the Defense Acquisition System, 08 December 2008

DoDI 6055.07, Accident Investigation, Reporting, and Record Keeping, 3 October 2000

IEEE Std 1228-1994, IEEE Standard for Software Safety Plans

Inter-Agency Space Debris Coordination Committee Protection Manual, v3.3, 4 April 2004

Inter-Agency Space Debris Coordination Committee GTO – MEO – Molniya – Upper Stage 

Disposal, Final Report, 21 April 2004

Joint Publication 1-02, Department of Defense Dictionary of Military and Associated Terms, 12 

April 2001

MIL-STD-882D, Standard Practice for System Safety, 10 February 2000

NASA Procedural Requirements (NPR) 8715.5, NASA Range Safety Program, 8 July 2005

NPR 8715.6A, NASA Procedural Requirements for Limiting Orbital Debris, 19 February 2008

NASA Safety Standard 1740.14, Guidelines and Assessment Procedures for Limiting Orbital 

Debris, 1 August 1995

NASA-GB-8719.13, NASA Software Safety Guidebook, 31 March 2004

NASA-STD-8719.13B w/Change 1, NASA Software Safety Standard, 8 July 2004

NASA Technical Standard 8719.14, Process for Limiting Orbital Debris, 28 August 2007 

NASA Policy Directive 8010.3, Notification of Intent to Decommission or Terminate Operating 

Space Systems and Terminate Missions, 14 June 2004

Occupational Safety and Health Administration Standards, accessed 2 November 2007

Office of Management and Budget Circular No. A-119, Revised, Federal Participation in the 

Development and Use of Voluntary Consensus Standards and in Conformity Assessment 

Activities, 10 February 1998

Public Law 104-113, National Technology Transfer and Advancement Act of 1995, 7 March 

1996

RCC 321-07, Common Risk Criteria Standards For National Test Ranges, June 2007

RCC 321-07, Common Risk Criteria Standards For National Test Ranges: Supplement, June 

2007

Satellite Mission Operations Best Practices, accessed 26 September 2007

SI 505-04, Satellite Disposal Procedures, 21 April 2006

SI 534-12, Laser Deconfliction Process, 25 July 2007

SI 534-15, Risk Management and Radio Frequency Deconfliction for Space Control Activities, 

16 March 07

Space and Missile Systems Center Human Systems Integration (HSI) Policy, 12 February 2006

STRATCOM Directive 714-02, Satellite Communication (SATCOM) System Expert 

Responsibilities, 20 September 2005
AFI91-217 18 FEBRUARY 2010 67

Title 14, Code of Federal Regulations, Part 417, Launch Safety, current edition

Title 47, Code of Federal Regulations, Part 25, Satellite Communications, current edition

UFC 1-200-01, General Building Requirements, 27 November 2007 

UFC 3-600-01, Fire Protection Engineering for Facilities, 26 September 2006

United States Government Orbital Debris Mitigation Standard Practices, accessed 4 April 2007

U.S. National Space Policy, 31 August 2006

http://www.fas.org/spp/guide/europe/comm/olympus.htm

Abbreviations and Acronyms

AFRL—Air Force Research Laboratory

AFB— Air Force Base

AFSAS—Air Force Safety Automated System

AFSC—Air Force Safety Center

AIS—Abbreviated Injury System

AOC—Air Operations Center

BPC—Board Presidents Course

CA—Conjunction Assessment

CDR JFCC SPACE—Commander, Joint Functional Component Command for Space

COLA—Collision Avoidance

COS—Chief of Safety

CFE—Commercial and Foreign Entities

CFR—Code of Federal Regulations

ΔV—Delta V

DE—Directed Energy

DFARS—Defense Federal Acquisition Regulation Supplement

Ec—Expectation of Casualty

EOL—End of Life

EOLP—End-of-Life Plan

FAA—Federal Aviation Administration

FAA/AST—FAA Office of Commercial Space Transportation

FCC—Federal Communications Commission

FOC—Full Operational Capability

GBSS—Ground Based Space Systems
68 AFI91-217 18 FEBRUARY 2010

GEO—Geostationary Orbit

GSO—Geosynchronous Orbit

GTO—Geosynchronous Transfer Orbit

HAP—High Accident Potential

ISB—Interim Safety Board

ITAR—International Traffic of Arms Regulations

IV&V—Initial Validation & Verification

JSpOC—Joint Space Operations Center

LEO—Low Earth Orbit

LRR—Launch Readiness Review

MAJCOM—Major Command

MINA—Mishap Investigation Non-Aviation

MEO—Medium Earth Orbit

NAF—Numbered Air Force

NASA—National Aeronautics and Space Administration

NEO—Near-Earth Object

NPR—NASA Procedural Requirements

NTSB—National Transportation Safety Board

OPCON—Operational Control

ORM—Operational Risk Management

ORP—Operations Review Process

OSO—Orbital Safety Officer

PESHE—Programmatic Environment, Safety, and Occupational Health Evaluation

PM—Program Manager

RV—Reentry Vehicle

SCCS—Space Command And Control Systems

SDAR—Space Debris Assessment Report

SIB—Safety Investigation Board

SIDC—Space Innovation & Development Center

SLCC—Spacelift Commander

SMC—Space and Missile Systems Center

SRB—Safety Review Board
AFI91-217 18 FEBRUARY 2010 69

SSG—System Safety Group

SSMP—System Safety Management Plan

SSN—Space Surveillance Network

SSO—Space Safety Officer or Semi-Synchronous Orbit

TACON—Tactical Control

TTP—Tactics, Techniques, and Procedures

Terms:

Acceptable risk—A predetermined criterion or standard for a maximum risk ceiling which 

permits the evaluation of cost, national priority interests, and number of tests to be conducted.

Accumulated risk—See Aggregated Risk and Collective Risk. The combined collective risk to 

all individuals exposed to hazard through all phases of an operation. For the flight of an 

expendable orbital launch vehicle, risk will be accumulated from liftoff until the spacecraft and 

launch vehicles are cataloged or reenter. For the flight of a suborbital launch vehicle, risk will be 

accumulated from liftoff through the impact of all pieces of the launch vehicle, including the 

payload. For flight of a reusable launch vehicle, risk will be accumulated from liftoff through 

recovery for all components of the vehicle unless a separate risk budget can be identified for the 

reentry phase according to the conditions stated in RCC 321.

ACQUISITION ORGANIZATION—The organization responsible for acquiring either 

hardware or a service (e.g. launch service). For most Air Force launches this will usually be the 

Space and Missiles Systems Center.

Aggregated risk—See Accumulated Risk and Collective Risk. The accumulated risk due to all 

hazards associated with an operation. For a specified launch, aggregated risk includes, but is not 

limited to, the risk due to debris impact, toxic release, and distant focusing of blast overpressure.

AIR FORCE LAUNCH—Any launch operation conducted with significant oversight or insight 

by the AF and not subject to licensing requirements of 14 CFR Part 415. The AF may or may not 

be the space system owner. There may also be launches out of the range that are commercial 

launches.

AIR OPERATIONS CENTER or AIR FORCE AIR AND SPACE OPERATIONS 

CENTER (AOC)—The aerospace operations planning and execution focus point for the Joint 

Task Force and Numbered Air Force where centralized planning, direction, control, and 

coordination of aerospace operations occur for which the Commander Air Forces 

(COMMAFFOR)/Joint Force Air Component Commander has Operational Control (OPCON) 

and/or TACON of air and/or space forces to achieve operational/tactical effects and objectives.

anomaly resolution process—Any process used to resolve a spacecraft anomaly. Typically 

conducted by the operating/testing organization (squadron or equivalent level).

Apogee— The point in the orbit that is the farthest from the center of the Earth. The apogee 

altitude is the distance of the apogee point above the surface of the Earth.

AUTOMATED MANEUVER PROTOCOLS—Computer controlled processes which allow 

the spacecraft to determine and/or implement maneuvers, without human intervention.
70 AFI91-217 18 FEBRUARY 2010

Cataloged Objects—Items that have been entered into the AF Satellite Catalog. Some items 

may have re-entered after being cataloged.

CASUALTY—A serious injury or worse, including death, for a human. For the purposes of this 

standard, serious injury is defined as Abbreviated Injury Scale (AIS) Level 3.

COLLECTIVE RISK—See Accumulated Risk and Aggregated Risk. The total combined risk 

to all individuals within a category (for example, launch-essential personnel, general public) 

exposed to a particular hazard during a specific period of time or event; unless otherwise noted, 

the mean number of casualties predicted (Ec) to result from a given hazard. Collective risk is 

specified as either a per mission or per year value. The collective risk will include the 

aggregated and accumulated risk.

COLLISION AVOIDANCE—A process designed to prevent collisions between on-orbit 

tracked objects or to prevent collisions between on-orbit tracked objects and launched vehicles 

(including spent stages)/payloads by determining and implementing courses of action through 

careful analysis of validated conjunction assessments and satellite health and mission 

requirements; the process includes establishing launch wait periods in either the launch window 

or spacecraft maneuvering based on validated conjunction assessments and accounts for 

uncertainties in spatial dispersions, arrival time of orbiting objects and/or the launch 

vehicle/payload, and modeling accuracy. There are two different types of collision avoidance: 

safety collision avoidance and mission assurance collision avoidance.

COMMERCIAL LAUNCH—A commercial launch is a launch licensed by the FAA.

CONFIGURATION CONTROL—Process of approving or disapproving, and coordinating 

changes to configuration items after formal establishment of their configuration identification.

CONFIGURATION MANAGEMENT—Process of identifying and defining the configuration 

items in a system, controlling the release and change of these items throughout the system life 

cycle, recording and reporting the status of configuration items and change request, and verifying 

the completeness and correctness of configuration items.

CONJUNCTION ASSESSMENT—A process for determining the point and time of the closest 

approach of two tracked orbiting objects or between a tracked orbiting object and a launched 

vehicle (including spent stages) or payload; conjunction assessment is performed in association 

with a specified miss distance screening criteria or the corresponding probability of collision. 

Associated with the closest approach assessment are the closest approach distance, the times of 

launch and/or orbital maneuvering that would result in the closest approach and meeting the miss 

distance or collision probability criteria, and a probability of collision with accuracy given for 

the ephemeris of both objects.

CONTROLLED REENTRY—See Uncontrolled Reentry. A planned reentry for which the 

final atmospheric penetration time has been chosen through spacecraft maneuvering so as to 

either maximize the amount of spacecraft material that burns up in the atmosphere, limiting the 

potential for endangering the public, or to bring down a recoverable reentry vehicle (e.g. capsule) 

in a controlled manner that does not endanger the public. This is typically used to control the 

time and place of the disposal of space objects that are at the end of their mission life or for 

reentry capsules.
AFI91-217 18 FEBRUARY 2010 71

CRITICAL HARDWARE—Any hazardous or safety critical equipment or system; nonhazardous DoD high value items such as spacecraft, missiles, or any unique item identified by 

the DoD as critical; non-hazardous, high value hardware owned by range users (other than the 

DoD) may be identified as critical or non-critical by the Range User.

Critical operations personnel—See Launch Essential Personnel, Mission Essential Personnel

and Neighboring Operations Personnel. The minimum number of persons necessary to 

successfully and safely complete a launch operation and whose absence would jeopardize the 

completion of the operation.

DEBRIS—Any non-maneuverable/non-operational orbital space system or component.

DEBRIS CLOUD—Describes the initial collection of debris generated by an on-orbit collision 

or explosion. Represents a dense area of debris which is extremely hazardous to other spacecraft 

in the immediate area.

DEBRIS GENERATION—Release of objects from a spacecraft into the space environment. 

This generally occurs in an unpredictable and uncontrolled manner. Debris generation may be 

the result of a collision or an occurrence within the spacecraft. Mission related debris should be 

minimized or avoided altogether.

DEEP SPACE—Region of space where objects have an eccentricity > 1 (escape trajectory) with 

respect to the closest planetary body, but that they may have an eccentricity < 1 (orbit) with 

respect to the closest star.

DELTA V (ΔV)—Change in velocity. Used as a measure of required energy (i.e. fuel) used to 

maneuver an orbital space system from one orbit to another (or a reentry).

DESIGNATED APPROVING OFFICIAL—An individual with delegated approval authority. 

For matters concerning safety (e.g. SDAR approval), agreements delegating approval authority 

below that of CDR JFCC SPACE should be reviewed by the MAJCOM SE and 14 AF/SE, as 

appropriate.

DIRECTED ENERGY—An umbrella term covering technologies that relate to the production 

of a beam of concentrated electromagnetic energy or atomic or subatomic particles.

DIRECTED ENERGY CLEARING HOUSE—All DoD agencies and or contractors 

performing laser tests under contract to DoD have to go through laser clearing house procedures 

with the JSpOC prior to performing laser tests per DoDI O-3100.11.

DIRECTED ENERGY SYSTEMS—Systems that use the electromagnetic field to remotely 

place energy on an intended target.

ELECTROMAGNETIC INTERFERENCE (EMI)—Any electromagnetic disturbance that 

interrupts, obstructs, or otherwise degrades or limits the effective performance of electronics and 

electrical equipment. It can be induced intentionally, as in some forms of electronic warfare, or 

unintentionally, as a result of spurious emissions and responses, intermodulation products, and 

the like.

EXPECTATION OF CASUALTY—Risk associated with death or serious injury of a member 

of the general public (i.e. the consequence of failure).
72 AFI91-217 18 FEBRUARY 2010

END-OF-LIFE—Final stage of spacecraft lifetime. End result will be either recovery, reentry, 

spacecraft disposal (passivation), or catastrophic loss (due to on-board explosion/failure or 

collision with another object).

Failure modes—How a system or component might fail.

GEOSTATIONARY ORBIT— See Geosynchronous Orbit. A circular geosynchronous orbit 

with 0° inclination and an altitude of 35786 km above sea level.

Geosynchronous orbit—See Geostationary Orbit. An orbit with a period equal to the sidereal 

day. Typically, geosynchronous orbits have an inclination between ±15o of the equatorial plane.

Geosynchronous transfer orbit—A highly eccentric orbit with perigee normally within or near 

LEO altitudes and apogee near GEO altitude.

Hazard— Any real or potential condition that can cause injury, illness, or death to personnel; 

damage to or loss of a system, equipment or property; or damage to the environment.

hazardous launch areas—Safety clearance zones during launch operations with defined mishap 

probabilities, including the flight caution area, flight hazard area, vessel/boat exclusion area, and 

impact limit lines.

hazardous materials—Liquids, gases, or solids that may be toxic, reactive, or flammable or that 

may cause oxygen deficiency either singularly or in combination with other materials.

HIGH ACCIDENT POTENTIAL—An event or occurrence that could have led (in the 

determination of a space safety officer) to a mishap or other mission impacting event. The 

difference between a mishap and a HAP is often luck. Regardless, the mishap prevention is 

generally the same.

HUMAN FACTORS—A body of scientific facts about human characteristics. The term covers 

all biomedical and psychosocial considerations; it includes, but is not limited to, principles and 

applications in the areas of human engineering, personnel selection, training, life support, job 

performance aids, and human performance evaluation.

Inclination—The angle the orbit plane makes with the equatorial plane.

INTEGRATING Agency—The organization responsible for building/stacking the launch 

vehicle and integrating the spacecraft/satellite prior to launch. For AF missions, this is typically 

the launch wing or launch wing provider (e.g. United Launch Alliance).

KINETIC ENERGY—The energy due to the velocity of an object.

KINETIC ENERGY SYSTEMS—Systems that use the velocity, mass and/or explosives of an 

object to derive their intended effects.

LASER CLEARING HOUSE—See Directed Energy Clearing House.

LAUNCH ASSESSMENT—The process of determining closest approaches to active space 

objects (through one revolution) by a launch vehicle and its components during an available 

launch window. Also known as Pre-launch Screening.

launch essential personnel—See Critical Operations Personnel, Mission Essential Personnel

and Neighboring Operations Personnel. The minimum number of persons necessary to 
AFI91-217 18 FEBRUARY 2010 73

successfully and safely complete a launch operation and whose absence would jeopardize the 

completion of the operation.

Launch/Range Operator—The 30 SW and 45 SW own and operate the range whether the 

launch is military or commercial.

Launch Mishap—See Orbital Mishap and Pre-Launch. Mishaps that occur between the initial 

ignition of any stage of the rocket and up until the final piece of launch hardware separates from 

the spacecraft. This includes payloads that are not launched into the intended orbit.

Launch Operation—Operations occurring in the terminal countdown through sub-orbital flight 

or orbital insertion.

LAUNCH OPERATOR—A person or entity that conducts or proposes to conduct the launch of 

a launch vehicle for the purpose of inserting a spacecraft into orbit or delivering a payload to a 

specified ballistic location.

LAUNCH SUPPORT SYSTEMS—Launch support systems directly support launches. This 

includes, for example, range equipment including tracking radars operating in a launch support 

mode.

LAUNCH SYSTEM—Sum of all the parts of the system used to prepare and launch a launch 

vehicle.

launch vehicle—Any means of transportation used to place an object into Earth orbit or deep 

space. It also includes ballistic missiles.

LAUNCH VEHICLE COMPONENTS—All the parts of a launch vehicle except payload(s), to 

include upper stages and any apogee kick motors that separate from the spacecraft after 

operation.

Launch Vehicle Owner—The organization or person who owns or procured the space launch 

vehicle.

launch window—A period of time during which the flight of a launch vehicle may be initiated.

LAUNCHING AGENCY—The range user at AF ranges or equivalent organization at other 

locations.

LICENSED LAUNCH—See Non-Licensed Launch. An FAA licensed launched is indemnified 

by insurance up to a set amount and above which is indemnified by the government. The FAA 

issues a commercial space transportation license when they determine that a launch or reentry 

proposal will not jeopardize public health and safety, property, U.S. national security or foreign 

policy interests, or international obligations of the United States. The Air Force Launch 

Decision Authority has range safety responsibility for all launches being launched from Air 

Force ranges.

LOW EARTH orbit—An orbit between 150 km and 2000 km.

MANEUVER—Spacecraft operation that is designed to change the velocity (speed and 

direction) of a spacecraft using either an internal/integrated propulsion system or an externally 

attached booster system.
74 AFI91-217 18 FEBRUARY 2010

MANNED OBJECT—See Unmanned Object. Spacecraft that are currently occupied or are 

expected to be occupied in the future. Examples include the International Space Station, the 

Space Transportation System (i.e. space shuttle), and Progress supply vehicles.

Meteoroids—A solid object moving in interplanetary space, of a size considerably smaller than 

an asteroid and considerably larger than an atom or molecule. Meteoroid material is often 

associated with asteroid breakup or material released from comets.

MISHAP—An unplanned event or series of events resulting in death, injury, occupational 

illness, or damage to or loss of equipment or property or damage to the environment.

MISSILE—A type of rocket used to deliver a warhead. Typically has a ballistic trajectory.

MISSION ASSURANCE—An integrated engineering-level assessment of analysis, production, 

verification, validation, operation, maintenance, and problem resolution processes performed 

over the life cycle of a program by which an operator/user determines that there is an acceptable 

level of risk to employment of a system or end item to deliver an intended capability in an 

intended environment. The objective of the assurance process is to identify and mitigate design, 

production, test and operational deficiencies that could impact mission success.

MISSION DEGRADATION—A space system that cannot fully complete its assigned mission. 

Parts of the mission may be accomplished, but full mission accomplishment is not possible.

MISSION ESSENTIAL PERSONNEL—See Critical Operations Personnel, Launch Essential 

Personnel and Neighboring Operations Personnel. The minimum number of persons necessary 

to successfully and safely complete an operation and whose absence would jeopardize the 

completion of the operation. This includes persons required to perform emergency actions 

according to authorized directives, persons specifically authorized by the Wing Commander to 

perform scheduled activities, and person in training. The number of mission-essential personnel 

allowed within Safety Clearance Zones or Hazardous Launch Areas is determined by the Wing 

Commander and the Range User with Range Safety concurrence.

MISSION FAILURE—The inability of a space or ballistic system to complete its assigned 

mission.

MISSION RISK—The risk that the mission will fail or be significantly degraded in capability.

Near Earth Objects—Objects in the solar system (asteroids and comets) with orbits that 

regularly bring them close to the Earth and which are capable of striking the planet.

Neighboring Operations personnel—See Critical Operations Personnel, Launch Essential 

Personnel and Mission Essential Personnel. Individuals who are required to perform safety, 

security, or operationally critical tasks but are not associated with the specific/current operation 

or launch under consideration.

nominal vehicle—A properly performing launch vehicle whose instantaneous impact point does 

not deviate from the intended instantaneous impact point locus.

non—compliancE–A noticeable or marked departure from requirements, standards, or 

procedures; includes equivalent level of safety determinations (formally meets intent 

certifications), and waivers.

non-credible—An event determined to be so improbable that such an occurrence is virtually 

impossible, based on careful analysis of the potential hazard and mode of prevention such as 
AFI91-217 18 FEBRUARY 2010 75

permanent physical barriers and/or enforced separation distance; cost and convenience are not 

valid rationales for a determination of non-credible.

non-essential personnel—Those persons not deemed launch-essential or critical operations 

personnel; includes the general public, visitors, the media, and any persons who can be excluded 

from Safety Clearance Zones with no effect on the operation or parallel operations.

NON-LICENSED LAUNCH—See Licensed Launch. A launch not licensed by the FAA. This 

would typically be a civil or DoD launch. It is indemnified by the government. The Air Force 

Launch Decision Authority has range safety responsibility for all launches being launched from 

his/her range.

NON-NOMINAL FLIGHT—A launch vehicle that performs in an unexpected manner during 

flight.

OPERATIONAL CONTROL—Command authority that may be exercised by commanders at 

any echelon at or below the level of combatant command. Operational control is inherent in 

combatant command. Operational control includes authoritative direction over all aspects of 

military operations and joint training necessary to accomplish missions assigned to the 

command. OPCON does not include authoritative direction for logistics or matters of 

administration, discipline, internal organization, or unit training.

OPERATIONAL REVIEW PROCESS (ORP)—The panel, established in 10- series 

instructions, chaired by the responsible commander that approves system modifications, training, 

procedures, and database changes to operational equipment.

OPERATIONAL REVIEW BOARD—Established in 10- series instructions, this board is 

chaired by the responsible commander that reviews problems in operations of systems. This is 

especially important in space systems, as there are numerous system modifications and updates 

to training, procedures, and database to operational equipment.

OPERATIONAL EFFECTIVENESS—The overall degree of mission accomplishment of a 

system or end-item used by representative personnel in the environment planned or expected 

(e.g., natural, electronic, threat) for operational employment of the system or end-item 

considering organization, doctrine, tactics, information assurance, force protection, survivability, 

vulnerability, and threat (including countermeasures; initial nuclear weapons effects; and 

nuclear, biological, and chemical contamination threats).

OPERATIONS REVIEW PROCESS—A process of reviewing and approving procedures to 

be used when conducting tests or operations.

Orbital debris—See Space Debris. Non-controllable artificial objects, including derelict 

spacecraft and spent launch vehicle orbital stages, in planetary orbit which no longer serve a 

useful purpose. Sometimes referred to as Man Made Orbital Debris.

orbital insertion—The sequence of events in time and space, whereby an object achieves an 

altitude in excess of 150 km and sufficient velocity to complete at least one orbit of the Earth.

ORBITAL SUPPORT SYSTEMS—Space systems that directly support orbital space systems.

ORBITAL SPACE SYSTEMS—Term used to describe the hardware and activities associated 

with the design, development, testing and operation of any man-made object exceeding 100 km 

in altitude and achieving or exceeding planetary orbital velocity.
76 AFI91-217 18 FEBRUARY 2010

PASSIVATION—The process of removing stored energy from a space system at EOL which 

could result in an explosion or deflagration of the space system. This includes energy in the 

form of electrical, pressure, mechanical or chemical.

payload—See Satellite or Spacecraft. Refers either to the object(s) carried by a launch vehicle or 

the operational portion of a satellite/spacecraft (e.g. the main communications package on 

communications satellite). Once a satellite/spacecraft has separated from the launch vehicle, it 

should not be referred to as a payload.

Perigee—The point in the orbit that is nearest to the center of the Earth. The perigee altitude is 

the distance of the perigee point above the surface of the Earth.

populated area—An outdoor location, structure, or cluster of structures that may be occupied by 

people; sections of roadways and waterways that are frequented by automobile and boat traffic 

are populated areas; agricultural lands, if routinely occupied by field workers, are also populated 

areas.

PRE—LAUNCH–Space related activities occurring during ground handling, processing, and 

transportation operations just prior to ignition (lift-off) actions.

POST-MISSION—Describes the time period after a spacecraft has completed its mission and 

culminates with final passivation and disposal activities.

PROGRAM MANAGER—The designated individual with responsibility for and authority to 

accomplish program objectives for development, production, and sustainment to meet the user‘s 

operational needs. The PM shall be accountable for credible cost, schedule, and performance 

reporting to the Milestone Decision Authority.

Programmatic Environment, Safety, and Occupational Health Evaluation—The PESHE 

documents the status of Environment, Safety, and Occupational Health (ESOH) hazard 

identification, assessment, mitigation, verification, and residual risk assessment, and the National 

Environmental Policy Act (NEPA) compliance schedule. It describes the PM‘s strategy for 

integrating across the ESOH disciplines and into systems engineering using MIL-STD-882 

System Safety methodology, provides a repository for ESOH risk data, and provides a method 

for tracking progress.

protected area—Any area behind the impact limit lines.

public—See Critical Operations Personnel, Launch Essential Personnel and Neighboring 

Operations Personnel. For AF launches, this consists of all persons not in either the Launch 

Essential Personnel or Neighboring Operations Personnel categories. For commercial launches, 

this consists of all persons not in the Critical Operations Personnel category.

public safety—Safety involving risks to the general public of the US or foreign countries and/or 

their property (both on- and off-base); includes the safety of people and property that are not 

involved in supporting a launch along with those that may be within the boundary of a launch 

site.

radioactive material—Materials that generate, or are capable of generating, ionizing radiation 

including naturally occurring radioactive materials, by-product materials, source materials, 

special nuclear materials, fission products, materials containing induced or deposited 

radioactivity, and nuclear reactors.
AFI91-217 18 FEBRUARY 2010 77

Range Safety Critical Systems—Includes all airborne and ground subsystems of the flight 

safety system.

RANGE USER—Any individual or organization that conducts or supports any activity on 

resources (land, sea, or air) owned or controlled by an AF range. This includes such 

organizations as the DoD, US government agencies, civilian launch operators, foreign 

government agencies and other foreign entities that use AF range facilities and test equipment; 

conduct pre-launch and launch operations, including payloads to orbital insertion or impact; 

and/or require on-orbit or other related support.

REENTRY—The event occurring when a spacecraft or other object comes back into the 

sensible atmosphere after going to higher altitudes.

REUSABLE LAUNCH VEHICLE—A vehicle that is launched from a ground or aerial method 

of boosting into sub or space orbit that is intended after depositing a payload or other mission 

needs to return to point of launch or other designated location and then be reused following 

vehicle recertification.

risk—See Collective risk. A measure that takes into consideration both the probability of 

occurrence and the consequence of a hazard to a population or installation. Risk is measured in 

the same units as the consequence such as number of injuries, fatalities, or dollar loss. For 

Range Safety, risk is expressed as casualty expectation or shown in a risk profile.

risk analysis/STUDY—The analysis of systems (hardware, software, firmware, and procedures) 

to determine potential hazards that could result in loss of personnel, injury to personnel, loss or 

degradation of the system, or loss of life or injury to the public.

Risk Responsibility Transition Plan—A document used to outline the organization(s) 

responsible for risk management during a launch and subsequent orbital insertion of payload(s). 

It will be used to identify milestones or decision points in the transfer of risk responsibility from 

the launching agency to the subsequent test/operational organization(s). As appropriate, it will 

also outline management of overlapping risk responsibilities. This document can be as simple as 

a MOA between the pertinent organizations.

safe/SAFING—Placing an object in a condition that limits the possibility of new or further 

system or component failures. Typically unable to perform its mission when safed.

SAFE SEPARATION—The process that prevents collision and unplanned proximity close calls 

between space launch vehicles, active on-orbit satellites, manned spacecraft and on-orbit 

uncontrollable tracked objects. Activities associated with the safe separation process include, but 

are not limited to pre-launch conjunction assessment and screening; collision avoidance 

analysis and maneuvering; space situational awareness, high accident potential events, 

cataloging, and tracking; command and control of space systems and their effects; system 

hazards and risk reduction measures; and space controller (AOC) and operator practices and 

responsibilities. The operating standards for measuring/assessing safe separation include, but are 

not limited to criteria such as close approach/miss distances, docking and maneuvering safe 

distances, collision probability, close proximity/rendezvous safe distances, space traffic control 

wait periods, launch and reentry holds and safety notifications. The unplanned effects of groundbased directed energy and spacecraft electromagnetic emissions may have roots in poor 

separation planning and/or poor space effects planning.
78 AFI91-217 18 FEBRUARY 2010

Safety catastrophic—An operation, process, system, or component that controls or monitors 

equipment, operations, systems, or components to ensure personnel, launch area, and public 

safety; may be hazardous or non-hazardous.

SAFETY CRITICAL SOFTWARE—Software whose failure or malfunction may result in 

death or serious injury to people, loss or severe damage to property, environmental harm, or 

could cause permanent loss of mission.

SAFETY CRITICAL SYSTEM—Hardware or software system which, if it fails or 

malfunctions could cause a mishap of critical or catastrophic severity.

Safety Critical Computer System Function—A computer function containing operations that, 

if not performed, if performed out of sequence, or if performed incorrectly, may result in failed 

control functions which may contribute to a hazard.

Safety Critical Facility—A hazardous facility or a facility that is used to store, handle, or 

process systems determined to be safety critical by Range Safety.

Safety Critical Procedure—A designation for a particular type of procedure; a document 

containing steps in sequential order used to reliably process safety critical systems or conduct 

safety critical operations; non-hazardous safety critical procedures have no specific content 

requirements but do require safety review and approval.

SAFETY SIGNIFICANT ITEM—Hardware or software item which contributes to a safety 

critical function.

SATELLITE—See Payload or Spacecraft. An object that orbits another object known as a 

central body. Commonly, this term refers to unmanned spacecraft in orbit around the Earth.

SATELLITE CONTROL AUTHORITY—The authority to plan, schedule and perform 

satellite commanding.

Semisynchronous Orbit— The region of space containing nearly circular 12-hour orbits. This 

region is the spherical shell surrounding the Earth between approximately 18400 to 25200 km.

sensible atmosphere—The portion of the atmosphere where the dynamic pressure remains 

significant.

SEPARATION—Occurs when the last launch vehicle component (to include non-integrated 

apogee kick motors) physically separates from the spacecraft. Final separation would occur 

when both physical separation and any tethers are detached from the spacecraft.

SHALL—See Should and Will. Mandatory action.

Should—See Shall and Will. Recommend action.

SMART OPS—Operations/tests conducted by organizations that maximize mission capability 

and/or spacecraft lifetime through intelligent, risk-based decisions and actions. Smart Ops 

usually occur when operations/testing is faced with a previously unknown/unencountered 

situation. Operations/testing that unnecessarily expose a spacecraft to the same hazard may 

cease to be construed as Smart Ops unless alternatives are more risky or represent an 

unacceptable loss of mission capability.
AFI91-217 18 FEBRUARY 2010 79

SPACECRAFT—A man-made object either orbits a central body (planet or star) or is in an 

escape trajectory (eccentricity > 1) from that central body. This can include both satellites and 

interplanetary spacecraft.

SPACELIFT COMMANDER—The title of the Space Wing Commander (or their designated 

representative) on the day of launch.

SPACE ANOMALY—An on-orbit malfunction of a space system, or a deviation from what is 

expected with normal operations, that does not meet the criteria of a mishap. An anomaly will be 

initially investigated using the spacecraft anomaly resolution process until such time that it meets 

mishap criteria. When enough information is gathered to classify the event as a mishap, 

transition to a mishap investigation.

Space and Missile Systems Center—A direct reporting unit to AFSPC that develops and 

acquires space launch vehicles, spacecraft, and range systems for the AF.

SPACE ASSETS—Space assets include military and civil space systems, commercial and 

foreign entities, ground control elements, operators, and launch vehicles. These assets are 

unique in that they provide global persistence, perspective, and access unhindered by 

geographical or political boundaries. Military space assets are aligned under established military 

C2 processes, different from civil and CFE C2 processes. It is essential to integrate these 

separate processes for synergistic space effects.

SPACE COMMAND AND CONTROL SYSTEMS (SCCS)—Systems required providing 

telemetry, tracking, commanding, mission data dissemination, data processing, communication 

and ranging support for space vehicles. SCCS examples include the common user AF Satellite 

Control Network and other program-dedicated networks.

SPACE DEBRIS—See Meteoroids and Orbital Debris. General class of debris, including both 

meteoroids and orbital debris .

SPACE EXPERIMENTS—Space mission used to develop or prove new procedures and/or 

technologies.

SPACE FORCES—Space forces are military space assets and personnel utilized by the joint 

force, are normally organized as units, and are categorized by their impact on global or theater 

requirements. As such, there are global space forces and theater space forces. Global space 

forces support multiple theater and/or national objectives and are controlled by the Commander, 

United States Strategic Command. Theater space forces support individual theater requirements 

and generally fall under the control of the geographic combatant commander. Theater space 

forces are primarily focused on a single theater, with little or no direct impact outside the 

designated area of responsibility.

Space Launch Squadron—An AFSPC unit that provides oversight of AF space launch 

operations at the Eastern and Western ranges.

SPACE MISHAP—Any unplanned event involving space systems that results in personnel 

injury, system damage/destruction or mission capability loss/delay. For reporting purposes, it 

also includes near misses, close calls and high accident potential events.

SPACE OBJECT—Any object above the Earth‘s atmosphere. Includes spacecraft, debris, and 

natural phenomena, amongst other objects.
80 AFI91-217 18 FEBRUARY 2010

SPACE PERSONNEL—Personnel designing, developing, integrating, testing, processing, 

launching, or operating any space system or component of a space system.

SPACE RANGE—A range with the explicit intent of launching orbital and sub-orbital space 

vehicles and the specific purpose of protecting the public from the impact of a failed launch. 

Space range systems include telemetry, tracking and control, and flight termination systems used 

to protect the public.

Space Safety—Space Safety is a dynamic process designed to improve operational effectiveness 

by preventing close calls, mishaps, and provide for mission assurance throughout the life cycle of 

a space system. It also encompasses System Safety, integrated effects of combined systems, 

software safety, risk management and mishap investigations.

SPACE SAFETY OFFICER—Personnel assigned to a space mishap prevention or mishap 

investigation course. SSO positions include System Safety Manager, Space Control Safety 

Officer, Launch Safety Officer and Orbital Safety Officer.

SPACE SYSTEMS—All the devices and organizations forming the space network. These 

consist of: launch vehicles; launch ranges; launch and range support equipment and systems; 

spacecraft; ground and airborne stations; and data links among spacecraft, mission, and user 

terminals. Space systems refer to the equipment required for space operations, and these systems 

are comprised of nodes and links. There are three types of nodes: space, airborne, and terrestrial. 

Space nodes include satellites, space stations, or reusable space transportation systems like the 

space shuttle. Airborne nodes are primarily aircraft weapon systems that leverage space 

capabilities. Terrestrial nodes include any land or sea equipment that receives, processes, or uses 

data derived from space capabilities. Information conduits called links tie these nodes together. 

These links also are classified into two types: control and mission. Space operators use control 

links to operate space systems. Space systems disseminate data on mission links, which enable 

force multiplication.

SPACE TESTS—Limited scope mission used to develop or prove new procedures, capabilities 

and/or technologies.

SPACE VEHICLE—Devices, manned and unmanned, designed to be placed into an orbit about 

the Earth or into a trajectory toward another celestial body. This definition differentiates 

between vehicles that remain in space (included) and vehicles that are suborbital (excluded).

SPACE WING COMMANDER—Commander of a wing that acquires, operates, or supports 

space systems.

SPACECRAFT—See Satellite and Payload. An object designed to perform some function in 

space. This includes satellites and manned objects in space. This term can also be used while 

the object is still on the ground. This does NOT include launch vehicle components that have 

separated from the spacecraft.

suborbital—An object trajectory that does not complete a complete orbit.

SUBORBITAL LAUNCH VEHICLE—A launch vehicle that is not designed to achieve orbit.

SUBSYNCHRONOUS ORBIT—Westward drifting orbit that lies below geosynchronous orbit. 

Typical orbit for geosynchronous spacecraft drifting west to operational or test station.
AFI91-217 18 FEBRUARY 2010 81

SUPERSYNCHRONOUS ORBIT—Eastward drifting orbit that lies above geosynchronous 

orbit. This is the typical disposal region for geosynchronous spacecrafts that have reached the 

end of their operational lifetime.

SYSTEM SAFETY—The application of engineering and management principles, criteria, and 

techniques throughout all phases of the system life cycle to optimize safety within the constraints 

of operational effectiveness, time, and cost.

SYSTEM SAFETY GROUP—A group of key personnel formed to ensure the effectiveness 

and oversee a program‘s system safety program IAW AFI 91-202. SSGs are required for all 

Acquisition Category 1 and for all aircraft unless waived by the MAJCOM. AFI 91-202 

describes the membership and functions of the SSG.

TACTICAL CONTROL—Command authority over assigned or attached forces or commands 

or military capability made available for tasking that is limited to the detailed direction and 

control of movements or maneuvers within the operational area necessary to accomplish 

assigned missions or tasks. TACON is inherent in OPCON and may be delegated to and 

exercised by commanders at any echelon at or below the level of combatant command. Satellite 

Control Authority is inherent in TACON but may be delegated.

TELEMETRY—Remote measurement and reporting of spacecraft information of interest.

Space control systems—Includes space systems with unique missions that either don‘t directly 

support other space systems (e.g. space control systems), or that support multiple independent 

on-orbit systems (e.g. AFSCN). Space control systems can be located anywhere on the Earth‘s 

surface or in the atmosphere above the surface.

TESTS—The trial of a new, relatively unproven space system. The launch of a new launch 

vehicle counts as a launch vehicle test while the launch of a test spacecraft on a proven launch 

vehicle would count as a test for the orbital portion of the mission, but not the launch, unless the 

test spacecraft somehow affects the launch vehicle performance.

TETHER SYSTEM—A rope-like restraint to attach two or more objects in space. Used to 

maintain a relatively close distance between objects without physical contact between the 

objects. Electrical power and telemetry are often transferred using tethers.

TRANSFER ORBIT—The pre-planned orbit that moves a spacecraft from one orbit to another. 

Usually occurs during launch to move a spacecraft to its final orbit.

Uncontrolled reentry—See Controlled Reentry. A random reentry in which the 

spacecraft/object reenters the atmosphere where the surface impact point can not sufficiently be 

determined, or influenced by the operator, prior to reentry. This is the typical reentry method for 

debris and spacecraft in decay orbits where the final reentry point and time is underdetermined 

due to uncertainty in atmospheric density conditions due to the extended time period between 

disposal and reentry.

UNIQUE SPACE SUPPORT EQUIPMENT—Systems, equipment and facilities required for 

supporting other space systems. Includes launch and orbital space support systems.

UNMANNED OBJECT— See Manned Object. A spacecraft that is neither currently occupied 

nor expected to be occupied in the future.
82 AFI91-217 18 FEBRUARY 2010

UPPER STAGE—Typically the last portion of a launch vehicle used to deliver a spacecraft into 

orbit. Some spacecraft may also have an apogee kick motor beyond the upper stage that will 

actually be the last portion of the launch system to separate from the spacecraft.

VEHICLE—Any space-related object with its own propulsion system. Includes rockets, 

satellites and other spacecraft.

Western Range—Part of the National Launch Range facilities, operated by the 30 SW. The 

range includes the operational launch and base support facilities located at Vandenberg AFB and 

those radar tracking sites and ground stations located on sites up range and downrange along the 

Pacific Coast, including United States Navy facilities at Point Mugu.

WILL—See Shall and Should. Mandatory action.
AFI91-217 18 FEBRUARY 2010 83

Attachment 2

SPACE DEBRIS ASSESSMENT REPORT

A2.1. Delivery Requirements The SDAR shall be delivered in accordance with the 

requirements specified below. The normal schedule is:

A2.1.1. PDR Draft SDAR: 30 days prior to the program PDR for the spacecraft or 

equivalent program/project development milestone. This draft is submitted to the PM, who 

will make distribution to the Chief Engineer and Safety Office, and any other offices as 

needed. The purpose of preparing the report early in the design and development process is 

to ensure that orbital debris issues are identified early when resolutions are least costly to 

implement. Any orbital debris mitigation compliance issues not resolved by PDR shall be 

addressed and resolved no later than the CDR or equivalent program/project development 

milestone.

A2.1.2. CDR Draft SDAR: 45 days prior to the program or project CDR for the spacecraft 

or equivalent program/project development milestone. This Draft is submitted by the PM to 

the Chief Engineer and Safety Office who will make distribution as with the PDR DRAFT 

SDAR. The purpose of the CDR Draft is to update and clarify the issues and changes to the 

PDR Draft. Any noncompliance that remains prior to beginning the launch approval process 

will require formal risk acceptance by the CDR JFCC SPACE (or designated approving 

official).

A2.1.3. FINAL SDAR: shall be submitted to the CDR JFCC SPACE (or designated 

approving official) for approval and signature prior to the beginning of the launch approval 

process. Formal acceptance of the risk associated with any noncompliance remaining in the 

SDAR shall accompany the delivery of the Final SDAR. Each SDAR delivered will be 

reviewed by the center (or equivalent) Safety Office and by JFCC SPACE. The CDR JFCC 

SPACE (or designated approving official) will be the final approving authority for the 

SDAR.

A2.2. Format Each SDAR shall follow the format shown in Table A2.1 below and, at a 

minimum, include the content indicated. Note that space debris mitigation requirements for the 

spacecraft and launch vehicle shall be addressed in separate SDAR sections (Sections 2 through 

8 and Sections 9 through 14, respectively) to promote the ease of preparing the assessment 

report. The draft SDAR may be submitted in electronic form only. Programs are encouraged to 

use existing program documentation for mission and spacecraft descriptions.

Table A2.1. SDAR Format.

Cover and Front Matter

Cover showing the document version and date of delivery

Inside cover signed by (at a minimum): document preparer(s), program management, and the 

Chief Engineer and safety office reviewers.

Statement of any restrictions on the data in the SDAR such as proprietary, ITAR, or export 

controls. If the document does not contain any restrictions, then a statement to that effect shall be 

included. If the document does contain restricted information, the restricted information shall be 
84 AFI91-217 18 FEBRUARY 2010

summarized and marked clearly on the page(s) where it occurs and on the cover.

Document history page showing each version of the report. Reviews of the previous versions by 

the Chief Engineer or safety office shall be included on this page.

Section 1: Program Management and Mission Overview

Identification of the program sponsoring the mission and the PM

Identification of any mission partners‘ participation in the program and a summary of the AF‘s 

responsibility under the governing agreement(s)

Schedule of mission design and development milestones through proposed launch date, including 

spacecraft PDR and CDR (or equivalent) dates

Summary table indicating compliance or noncompliance with each debris mitigation 

requirements of DoDI 3100.12 and this instruction

Brief description of the mission

Identification of the anticipated launch vehicle and launch site

Identification of the proposed launch date and mission duration

Description of the launch and deployment profile, including all parking, transfer, and operational 

orbits with apogee, perigee, and inclination

Identification of all spacecraft, launch vehicle orbital stages, and all other released objects (> 1 

mm in diameter), including their orbital parameters following insertion of the spacecraft into a 

mission orbit or into an Earth escape orbit

Identification of any interaction or potential physical interference with other operational 

spacecraft

Section 2: Spacecraft Description

Physical description of the spacecraft, including spacecraft bus, payload instrumentation, and all 

appendages, such as solar arrays, antennas, and instrument or attitude control booms

Detailed illustration of the entire spacecraft in the mission operation configuration with clear 

overall dimensional markings and marked internal component locations

Total spacecraft mass at launch, including all propellants and fluids

Dry mass of spacecraft at launch, excluding solid rocket motor propellants

Description of all propulsion systems (cold gas, monopropellant, bipropellant, electric, nuclear)

Identification, including mass and pressure, of all fluids (liquids and gases) planned to be on

board and a description of the fluid loading plan or strategies, excluding fluids in sealed heat 

pipes

Description of all fluid systems, including size, type, and qualifications of fluid containers such 

as propellant and pressurization tanks

Description of all active and/or passive attitude control systems with an indication of the normal 

attitude of the spacecraft with respect to the velocity vector
AFI91-217 18 FEBRUARY 2010 85

Description of any range safety or other pyrotechnic devices

Description of the electrical generation and storage system

Identification of any other sources of stored energy not noted above

Identification of any radioactive materials on board

Section 3: Assessment of Spacecraft Debris Released during Normal Operations

Identification of any object (>1 mm) expected to be released from the spacecraft any time after 

launch, including object dimensions, mass, and material

Rationale/necessity for release of each object

Time of release of each object, relative to launch time

Release velocity of each object with respect to spacecraft

Expected orbital parameters (apogee, perigee, and inclination) of each object after release

Calculated orbital lifetime of each object, including time spent in Low Earth Orbit 

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.3.1 and section 5.8.3 of 

this instruction

Section 4: Assessment of Spacecraft Potential for Explosions and Intentional Breakups

Identification of all potential causes of spacecraft breakup during deployment and mission 

operations

Summary of failure modes and effects analyses of all credible failure modes that may lead to an 

accidental explosion

Detailed plan for any designed spacecraft breakup, including explosions and intentional 

collisions

List of components that shall be passivated at EOL. List shall include method of passivation and 

amount that cannot be passivated.

Rationale for all items that shall be passivated but are not designed to be passivated

Assessment of spacecraft compliance with DoDI 3100.12 section 6.3.2 and section 5.8.4 of this 

instruction

Section 5: Assessment of Spacecraft Potential for On-Orbit Collisions

Calculation of spacecraft probability of collision with known space objects larger than 10 cm in 

diameter during the orbital lifetime of the spacecraft

Identification of all systems or components required to accomplish any post-mission disposal 

operation, including passivation and maneuvering

Calculation of spacecraft probability of collision with space objects, including orbital debris and 

meteoroids, of sufficient size to prevent post-mission disposal

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.3.3 and section 5.8.5 of 

this instruction 
86 AFI91-217 18 FEBRUARY 2010

Section 6: Assessment of Spacecraft Post-mission EOLPs and Procedures

Description of spacecraft disposal option selected

Plan for any spacecraft maneuvers required to accomplish post-mission disposal

Calculation of area-to-mass ratio after post-mission disposal, if the controlled reentry option is 

not selected

Assessment of spacecraft compliance with DoDI 3100.12 paragraphs 6.3.2.2 and 6.4 and section 

5.11 of this instruction

Section 7: Assessment of Spacecraft Reentry Hazards

Detailed description of spacecraft components by size, mass, material, and shape, if the 

atmospheric reentry option is selected

Summary of objects expected to survive an uncontrolled reentry using NASA Debris Assessment 

Software (DAS), NASA Object Reentry Survival Analysis Tool (ORSAT) or comparable 

software

Calculation of probability of human casualty for the expected year of uncontrolled reentry and 

the spacecraft orbital inclination

If appropriate, preliminary plan for spacecraft controlled reentry

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.4 and section 5.11 of this 

instruction

Section 8: Assessment for Tether Missions

Type of tether; e.g., momentum or electrodynamic

Description of tether system, including (1) tether length, diameter, materials, and design (single 

strand, ribbon, multistrand mesh), at a minimum and (2) end-mass size and mass

Determination of minimum size of object that will cause the tether to be severed

Tether mission plan, including duration and post-mission disposal

Probability of tether colliding with large space objects

Probability of tether being severed during mission or after post-mission disposal

Maximum orbital lifetime of a severed tether fragment

Assessment of compliance with DoDI 3100.12 paragraph 6.3.3 and section 5.8.5 of this 

instruction

Section 9: Launch Vehicle Description

Identification of launch vehicle to be used

Identification of any non-basic upper stages to be used

Identification of any launch vehicle stage that will be inserted into Earth orbit and left there

Dry mass of each orbital stage after spacecraft deployment

Detailed illustration of each orbital stage with clear dimensional markings and marked internal 
AFI91-217 18 FEBRUARY 2010 87

component locations

Section 10: Assessment of Launch Vehicle Debris Released during Normal Operations

Identification of any object greater than 1 mm that will be released into Earth orbit from any 

stage, including, but not limited to, dual payload attachment fittings and stage separation devices

Rationale/necessity for release of each object

Time of release of each object, relative to launch time

Release velocity of each object with respect to orbital stage

Expected orbital parameters (apogee, perigee, and inclination) of each object after release

Calculated orbital lifetime of each object, including time spent in LEO

Assessment of launch vehicle compliance with DoDI 3100.12 paragraph 6.3.1 and section 5.8.3 

of this instruction

Section 11: Assessment of Launch Vehicle Potential for Explosions and Intentional 

Breakups

Identification of all potential causes of launch vehicle orbital stage breakup during all operations

Summary of failure modes and effects analyses of all credible failure modes which may lead to 

an orbital stage accidental explosion

Detailed plan for any designed orbital stage breakup, including explosions and intentional 

collisions

Detailed plan, under normal EOL conditions and deployment malfunction scenario, for 

passivating (depleting all energy sources) each orbital stage, including the burning or release of 

all propellants and fluids

Assessment of launch vehicle compliance with DoDI 3100.12 paragraph 6.3.1 and section 5.8.3 

of this instruction

Section 12: Assessment of Launch Vehicle Potential for On-orbit Collisions

Calculation of each orbital stage probability of collision with known space objects larger than 10 

cm in diameter during the orbital lifetime of the stage

Assessment of launch vehicle compliance with DoDI 3100.12 paragraph 6.3.3 and section 5.8.5 

of this instruction

Section 13: Assessment of Launch Vehicle Post-mission EOLPs and Procedures

Description of orbital stage disposal option selected

Plan for any orbital stage maneuvers required to accomplish disposal after end of orbital stage 

mission

Calculation of area-to-mass ratio after completion of all orbital stage operations, including 

disposal maneuvers, if the controlled reentry option is not selected

Procedure for executing orbital stage disposal plan, including timeline from final shutdown of 

each orbital stage to completion of passivation and disposal operations
88 AFI91-217 18 FEBRUARY 2010

Demonstration of reliability of orbital stage disposal operations

Assessment of launch vehicle compliance with DoDI 3100.12 paragraph 6.4 and section 5.11 of 

this instruction

Section 14: Assessment of Launch Vehicle Reentry Hazards

[Note: if a reentry hazard assessment has already been performed for an orbital stage, simply 

refer to that report and make any necessary adjustments for orbital inclination and year of 

reentry]

Detailed description of launch vehicle components by size, mass, material, and shape, if the 

atmospheric reentry option is selected

Summary of objects expected to survive an uncontrolled reentry using NASA DAS, NASA 

ORSAT, or comparable software

Calculation of probability of human casualty for the expected year of uncontrolled reentry and 

the orbital stage inclination

If appropriate, preliminary plan for launch vehicle controlled reentry

Assessment of launch vehicle compliance with DoDI 3100.12 paragraph 6.4.1. and sections 4.8.3 

and 5.11 of this instruction

A2.3. Review Each SDAR delivered will be reviewed by the Center Chief Engineer in 

coordination with the Center Safety Office. After the review, results (with corrective actions) 

will be provided to the PM.
AFI91-217 18 FEBRUARY 2010 89

Attachment 3

END-OF-LIFE PLAN

The End-of-Life Plan shall be a living document that evolves with the program. Note: the level 

of detail required prior to launch is limited and is intended to be complete only as the EOL 

approaches. 

A3.1. Delivery Requirements Disposal plans shall be delivered in accordance with the 

requirements specified below. The nominal schedule is:

A3.1.1. Preliminary EOLP: 45 days prior to the program CDR for the spacecraft or 

equivalent program/project development milestone. This draft is submitted to the PM, who 

will make distribution to the Chief Engineer and Safety Office, and any other offices as 

needed. The purpose of preparing the plan early in the operational development process is to 

ensure that EOL issues are identified early when resolutions are least costly to implement.

A3.1.2. Prelaunch EOLP: 30 days prior to the launch of the mission. The prelaunch EOLP 

shall be submitted by the PM to the Center Chief Engineer for review and subsequent 

submission to CDR JFCC SPACE (or designated approving official) for approval and 

signature prior to beginning the launch approval process. Formal acceptance of the risk 

associated with any noncompliance remaining in the EOLP shall be included in the approval 

process.

A3.1.3. Updates to the EOLP (titled: ―[date] Update to the EOLP‖): to be made at the major 

program operational milestones identified in the EOLP.

A3.1.4. Final EOLP: shall be delivered at 3 months prior to the expected implementation of 

the EOLP for spacecraft decommissioning/disposal.

Each EOLP delivered will be reviewed by Center (or equivalent) Chief Engineer and Safety 

Office. CDR JFCC SPACE (or designated approving official) will be the final approving 

authority for the EOLP. The draft EOLP may be submitted in electronic form only. Signed 

EOLP shall be delivered in both electronic and paper copies. Note that programs are encouraged 

to use existing program documentation and the SDAR for mission and spacecraft descriptions 

and identification of the EOL decommissioning issues. A copy of the Final SDAR shall be 

included in the delivery of the Final EOLP.

A3.2. Contents of EOLP Table A3.1 below parenthetically identifies the data needed prior to 

launch and additional data needed during EOLP updates; the required assessments shall reflect 

achieved operational orbit parameters and on-orbit state of the spacecraft.

Table A3.1. Contents of EOLP.

Cover and Front Matter (all data is needed prior to launch)

Cover showing the document version and date of delivery.

Inside cover showing the signatures on that report. This shall include as a minimum: document 

preparer(s), program management, and the Chief Engineer and safety office reviewers.

Statement of any restrictions on the data in the EOLP such as proprietary, ITAR, or export 

controls. If the document does not contain any restrictions, then a statement to that effect shall be 
90 AFI91-217 18 FEBRUARY 2010

included. If the document does contain restricted information, the restricted information shall be 

summarized and marked clearly on the page(s) where it occurs and on the cover.

Document history page showing each version of the report. Reviews of the previous versions by 

the Chief Engineer or safety office shall be included on this page.

Section 1: Program Management and Mission Overview (data needed prior to launch)

Identification of the Program sponsoring the mission and the PM

Schedule of mission operational milestones from launch through EOL

Summary table indicating compliance or noncompliance with each debris mitigation 

requirements of DoDI 3100.12 and this instruction

Brief description of the mission (single paragraph)

Description of operational orbits with apogee, perigee, and inclination (data added during 

operations)

Chronology of management reviews of the EOLP to include changes in spacecraft operability 

which may affect the ability to passivate and dispose per the plan in Section 6 of the EOLP

Section 2: Spacecraft Description (data needed prior to launch)

The SDAR Section 2 contains a full description of the spacecraft. Since the SDAR remains a 

reference, it does not need to be repeated here. 

Table of the following onboard the spacecraft at time of issue of EOLP version, expected at 

commencement of passivation, and expected at completion of passivation.

o Fluids

o Pyrotechnic devices

o Electrical generation and storage system

o Identification of any other sources of stored energy not noted above

o Any radioactive materials

List of changes in the propulsion systems and energy systems which have occurred since launch. 

Include a detailed illustration of the entire spacecraft in the EOL configuration with clear 

dimensional markings and marked internal component locations (data added during operations)

Total mass of post-passivation spacecraft, including all propellants and fluids

Status of the major systems on board the spacecraft, including any changes in redundancy 

Section 3: Assessment of Spacecraft Debris Released During and After Passivation (data 

needed prior to launch, reference SDAR Section 3)

Identification of any solid object (>1 mm) expected to be released during passivation

Identification of all objects (>1 mm) expected to be released (including fluids)

Rationale/necessity for release of each object

Time of release of each object, relative to passivation 

Release velocity of each object with respect to spacecraft
AFI91-217 18 FEBRUARY 2010 91

Expected orbital parameters (apogee, perigee, and inclination) of each object after release

Calculated orbital lifetime of each object, including time spent in LEO

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.3.1 and section 5.8.3 of 

this instruction

Section 4: Assessment of Spacecraft Potential for Explosions and Intentional Breakups

(data needed prior to launch, reference SDAR Section 4)

Identification of all potential causes of spacecraft breakup during passivation and post 

passivation

Summary of remaining failure modes and effects analyses of all credible failure modes which 

may lead to an accidental explosion during passivation and after passivation.

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.3.2 and section 5.8.4 of 

this instruction

Section 5: Assessment of Spacecraft Potential for On-orbit Collisions (data needed prior to 

launch, reference SDAR Section 5)

Identification of all systems or components required to accomplish any post-mission disposal 

operation, including passivation and maneuvering

Evaluation of the vulnerability of systems required for post-mission disposal to impacts by space 

objects smaller than 10 cm in diameter

Assessment of EOL spacecraft compliance with DoDI 3100.12 paragraph 6.3.3 (data added 

during operations) and section 5.8.5 of this instruction

Calculation of spacecraft probability of collision with space objects larger than 10 cm in 

diameter during the orbital lifetime of the spacecraft after passivation

Assessment of EOL spacecraft compliance with DoDI 3100.12 paragraph 6.3.3 (data added 

during operations) and section 5.8.5 of this instruction

Section 6: Assessment of Spacecraft Post-mission EOLP and Procedures (data needed prior 

to launch, reference SDAR Section 6)

Demonstration of reliability of post-mission disposal operations

Description of spacecraft disposal option selected

Plan for any spacecraft maneuvers required to accomplish post-mission disposal

Calculation of area-to-mass ratio after post-mission disposal, if the controlled reentry option is 

not selected

Procedure for executing post-mission disposal plan

Detailed plan for passivating (depleting all energy sources) the spacecraft, including the burning 

or release of all propellants and fluids, the discharge of batteries, the disabling of charging 

circuits, and the de-energizing of rotational energy sources

Assessment of spacecraft compliance with DoDI 3100.12 paragraphs 6.3.2.2 and 6.4; and section 

5.11 of this instruction
92 AFI91-217 18 FEBRUARY 2010

Section 7: Assessment of Spacecraft Reentry Hazards (reference SDAR Section 7, all data 

added during operations)

Detailed description of spacecraft components by size, mass, material, and shape, if the 

atmospheric reentry option is selected

Summary of objects expected to survive an uncontrolled reentry, specifying software tool(s) used 

for the analysis

Calculation of probability of human casualty for the expected year of uncontrolled reentry and 

the spacecraft orbital inclination

If appropriate, preliminary plan for spacecraft controlled reentry

Assessment of spacecraft compliance with DoDI 3100.12 paragraph 6.4 and section 5.11 of this 

instruction

Section 8: Assessment for Tether Missions (all data added during operations)

Description of tether system, including (1) tether length, diameter, materials, and design (single 

strand, ribbon, multi-strand mesh) at a minimum and (2) end-mass size and mass remaining at 

EOL

Assessment of compliance with DoDI 3100.12 and section 5.8.5 of this instruction

EOLP Addendum: Final SDAR

For the Final EOLP, a copy of the final SDAR shall be included for reference.

A3.3. Review Each EOL plan delivered will be reviewed by the Chief Engineer and Safety 

Office. After the review, results (with corrective actions) will be provided to the PM.