10/2/95 rev 

EXECUTIVE SUMMARY 

This report, entitled "Hazard Analysis of Commercial Space 

Transportation," is devoted to the review and discussion of 

generic hazards associated with the ground, launch, orbital and 

re-entry phases of space operations. Since the DOT Office of 

Commercial Space Transportation (OCST) has been charged with 

protecting the public health and safety by the Commercial Space 

Act of 1984 (P.L. 98-575), it must promulgate and enforce 

appropriate safety criteria and regulatory requirements for 

licensing the emerging commercial space launch industry. This 

report was sponsored by OCST to identify and assess prospective 

safety hazards associated with commercial launch activities, the 

involved equipment, facilities, personnel, public property, 

people and environment. The report presents, organizes and 

evaluates the technical information available in the public 

domain, pertaining to the nature, severity and control of 

prospective hazards and public risk exposure levels arising from 

commercial space launch activities. The US Government spaceoperational experience and risk control practices established at 

its National Ranges serve as the basis for this review and 

analysis. 

The report consists of three self-contained, but complementary, 

volumes focusing on Space Transportation: I. Operations; II. 

Hazards; and III. Risk Analysis. This Executive Summary is 

attached to all 3 volumes, with the text describing that volume 

highlighted. 

Volume I: Space Transportation Operations provides the technical 

background and terminology, as well as the issues and regulatory 

context, for understanding commercial space launch activities and 

the associated hazards. Chapter 1, The Context for a Hazard 

Analysis of Commercial Space Activities, discusses the purpose, 

scope and organization of the report in light of current national 

space policy and the DOT/OCST regulatory mission. It also 

introduces some basic definitions and outlines the approach to a 

generic Hazard Analysis for future commercial space operations. 

Chapter 2, Range Operations, Controls and Safety, discusses the 

tracking and flight control systems, as well as the mission 

planning and approval process. The chapter describes the 

prelaunch ground safety and launch flight safety procedures 

developed and enforced at the National Ranges to ensure launch 

and mission success, personnel safety and to protect the public 

from the potential impacts of a launch accident. Chapter 3, 

Expendable Launch Vehicles (ELV) Characteristics, introduces the 

basic propulsion technology, configuration and capability for 

operational US launch vehicles (Titan, Delta, Atlas/Centaur, 

Scout) likely to be commercialized in the near term. ELV 

historical launch performance, operational reliability data and 
 

 

 

the bearing this record has on public safety issues are also 

discussed. Chapter 4, Launch and Orbital Operations, describes 

the phases of space operations, from ground preparation to 

launch, through orbital transfer, operation and re- entry. It 

also provides the reader with sufficient background to understand 

possible ELV and mission failures during launch, orbital 

maneuvers and orbit insertion and operation. 

Volume II : Space Transportation Hazards identifies and discusses 

the major and generic classes of hazards associated with each 

phase of space operations. Chapter 5, Pre-launch and Launch 

Hazards, identifies the types of hazards, such as explosions, 

fires, toxic vapors and debris, as a function of accident 

scenario and time after launch and defines their nature and 

severity indices. Further, a comparative perspective on 

potential ELV space launch accidents is provided by analogy to 

more common and socially accepted transportation and industrial 

accidents involving chemicals and fuels. Chapter 6 is devoted to 

Orbital Collision Hazards, shedding light on the Low Earth Orbit 

(LEO) and Geosynchronous Earth Orbit (GEO) space environment and 

the increasing threat of on orbit collisions to spacecraft. The 

sources and density of orbital debris are discussed and their 

implications for the probabilities of collisions involving 

operational satellites are quantified. Chapter 7 defines and 

reviews Re-Entry Hazards and their quantification by addressing 

the orbital lifetime and decay of space objects depending on 

their orbital characteristics, the behavior and survivability of 

space objects upon re-entering Earth's atmosphere and the 

uncertainties associated with predicting points of entry and 

ground impacts. 

Volume III: Space Transportation Risk Analysis introduces the 

methods and uses of Risk Analysis as they apply to the 

qualitative evaluation and quantitative assessment of public risk 

exposure from commercial space operations. Chapter 8 introduces 

the concepts of risk acceptability and relative risk and the 

tools of Risk Analysis Methodology developed for a broad range of 

industrial and regulatory purposes. These include: failure 

analysis methods (which focus on failure modes and failure 

chains); consequence analysis methods (which focus on the 

severity of possible consequences of failures); hazard analysis 

methods (focused on the identification and ranking of hazards); 

and integrated probabilistic risk analysis methods, such as Fault 

Tree Analysis, which quantify risk as the mathematical product of 

an event probability and its consequence magnitude. Chapter 9 

discusses the Applications of Risk Analysis to Space Launch 

Operations as used to date by the Government Agencies (NASA, DOD, 

DOE) concerned with assuring and maintaining high operability and 

safety standards for space launch operations. The chapter 

reviews the objectives, concepts, tools and uses of risk analyses 
 

conducted at the National Ranges by sponsoring agencies, in light 

of de-facto risk/safety goals, criteria and priorities. Finally, 

Chapter 10 provides an integrated Generic Risk Assessment of 

Representative Launch Scenarios background by reviewing the risk 

associated with typical ELV missions from current Range 

locations. Then the benefits of established Range Safety 

Controls are quantified, relative to their hypothetical absence, 

employing the framework of a simplified Community Damage (COMDAM) 

model in a typical Risk Matrix evaluation procedure. 
10/2/95 rev 

ACKNOWLEDGMENTS 

This report was initiated and sponsored by Norman Bowles, 

Associate Director of Licensing Programs in the Office of 

Commercial Space Transportation (OCST) at the US Department of 

Transportation (DOT), to gather and organize a wide range of 

materials relevant to the hazards of the emerging commercial 

space ventures, in order to assist OCST in its rulemaking and 

licensing decisions. The analysis focuses on the potential 

hazards of space launch activities of interest to the commercial 

space transportation industry, based on the US Government launch 

experience to date, the methods of analysis and operating 

procedures sucessfully used in managing launch risks. This 

research project was directed by Richard Robichaud of the DOT 

Transportation Systems Center (TSC). 

This text includes contributions and review comments from many 

people, who authored sections, contributed information, and 

rendered constructive criticism. Dr. Aviva Brecher, TSC, a 

specialist in space systems and hazard analysis, authored several 

chapters, contributed to others, edited and produced the report. 

Dr. Brecher built on initial efforts of Kevin Kolodzy of 

Dynatrend, along with Dr. John Stickler and William Hathaway of 

TSC, who reported on the topics of expendable launch vehicles, 

collisions in space and space launch hazards. As the scope of 

the report expanded, Dr. Jon Collins of ACTA Inc., a consulting 

firm known for its unique capabilities in rocket hazard and 

overflight analysis, contributed chapters on launch and orbital 

operations, Range Safety Controls and operation and hazard 

analysis of representative launch scenarios. Also, Dr. Albert 

Moussa of BlazeTech Inc., a company specializing in the analysis 

of fires and explosive hazards, authored the chapter on 

propellant hazards and Douglas Furciniti of UNISYS wrote the 

chapter on re-entry hazards. These individuals also contributed 

to the overall organization and general critique of this 

document. Robert A. Rudich of TSC and Douglas J. Furciniti of 

Dynatrend played a major role in compiling, editing and producing 

the present report. 

We are grateful to Loyd Parker of the Research Triangle 

Institute, who specializes in launch and Range Safety operations 

and analysis, for constructive comments and helping TSC obtain 

current information for this report. Norman Bowles is thanked 

for his vision, support, guidance and the review conducted by him 

and OCST staff members Ronald Gress, Giora Hadar and Dr. Richard 

Will. 

No acknowledgment would be complete without thanking those who 

supplied the data and information that provided substance to this 

report. Our thanks are extended to Lou Ullian, Chief Engineer 

for Safety of Eastern Space and Missile Center; Col. 

Niederhauser, Director of Safety, and his staff from the Western 

Space and Missile Center; Weston Wolff, Chief of Operations 
Control, and his staff at the White Sands Missile Range. We 

thank the management and technical staff of the General Dynamics 

Space Systems, Martin Marietta Denver Aerospace, McDonnell 

Douglas Astronautics Co., LTV Missiles and Electronics Group, 

AMROC, and Space Services Inc. for cooperation in supplying 

industrial information. 

We also wish to express our gratitude to Lana Agnew of Dynatrend 

for researching and obtaining reference materials, and to UNISYS 

staff for working long and hard in compiling text and assembling 

earlier drafts of the report. Of particular note is the 

editorial work, patience and skill exhibited by Robert A. Rudich, 

and by Jim Kelley during the many text revisions and integration. 

Our gratitude is also extended to A.L. Lavery and the rest of 

TSC's Safety and Security Systems staff for their support and 

assistance. 
1. THE CONTEXT FOR A HAZARD ANALYSIS OF COMMERCIAL SPACE 

ACTIVITIES 

10/2/95 rev 

1.1 POLICY AND MARKET CONTEXT 

A new set of realities, shaping space activities worldwide, must be 

considered in order to provide the context for the nature, scope 

and thrust of commercial space efforts in the US. An extensive set 

of recent Congressional legislation, studies and reports(1-8) has 

documented the rapidly changing climate for international 

cooperation and competition in space activities and the need for 

greater political and economic flexibility in providing access to 

and services for space exploration and exploitation, if the US is 

to maintain its leadership in space. The arena of space 

technology, infrastructure development and new space applications 

has expanded in recent years to include more developed and third 

world nations.(2,8) In 1986 alone, the USSR had 91 successful space 

launches vs. the US with 6 and 2 each for China, Japan and ESA 

(European Space Agency). The US is revising and reshaping its 

space policy and priorities. These changes are needed if it is to 

provide the national and international leadership and foster the 

stability to ensure that, following the initial space exploration 

and utilization phase, the promise of commercial space development 

becomes a reality.(3-7) This will enable the US aerospace industry 

to capitalize on its technical superiority for the benefit of 

mankind and economic pay-back. 

Both Congress and the Administration have proposed, enacted and 

promoted new space commercialization initiatives, most notably in 

privatizing remote sensing satellites and promoting the use of 

commercial expendable launch vehicles (ELV's) and launch services 

to place both government and commercial satellites into orbit.(6,7,9) 

In May 1983, the President issued a new policy for 

commercialization of ELV's and in February 1984, by Executive Order 

12465 ("Expendable Launch Vehicles in Space"), he designated the 

Department of Transportation (DOT) as the lead agency to facilitate 

and encourage commercial ELV activities and to license commercial 

space operations. 

The STS-Challenger disaster and ensuing ELV accidents have severely 

limited the US access to space and indirectly provided new 

opportunities and incentives to ELV manufacturers and to commercial 

payloads and launch services providers.(7,10) As a result, all 

government agencies involved in space activities have been 

instructed to enable, foster and implement the new commercial space 

policies and laws and to develop the supporting regulatory 

framework and technology infrastructure for greater private sector 

participation in space transportation and development efforts. 

1-1 
1.2 REGULATORY CONTEXT FOR COMMERCIAL SPACE OPERATIONS 

The Commercial Space Launch Act of October 30, 1984 (Public Law 98-

575) (the Act), assigned to the Secretary of Transportation the 

responsibility for carrying out the Act.(6) The purpose of this Act 

is: 

(1) to promote economic growth and entrepreneurial activity 

through utilization of the space environment for peaceful purposes; 

(2) to encourage the United States private sector to provide 

launch vehicles and associated launch services by simplifying and 

expediting the issue of commercial launch licenses, facilitating 

and encouraging the use of excess Government-developed space launch 

capabilities and transferring technology to the private sector ; 

(3) to designate an executive department to oversee and coordinate 

the conduct of commercial launch operations; to issue and transfer 

commercial launch licenses authorizing such activities; and to 

protect the public health and safety, safety of property, national 

security and foreign policy interests of the United States. 

In 1984, the Secretary of Transportation created the Office of 

Commercial Space Transportation (OCST) and delegated to it the 

Secretary's responsibilities. As stated in Section 8(a)(2) of the 

Act, the Secretary is charged with prescribing "requirements as are 

necessary to protect the public health and safety, safety of 

property, and national security and foreign policy interests of the 

United States." 

To carry out this responsibility, OCST established a program to 

develop safety and regulatory requirements for commercial space 

launch license applicants.(12) The Transportation Systems Center 

(TSC) is providing technical support to OCST to this end and has 

been assisting in the development of launch safety requirements 

based on the Preliminary Hazards Analysis embodied in this report. 

However, it must be made clear that the focus of OCST licensing and 

regulatory activities is primarily on public safety and not on 

mission success.(6,12) This unique perspective and mandate for DOT 

is and will be reflected in the OCST safety research, rule making 

and licensing activities. DOT will have to regulate not just 

commercial launch sites and commercial launches, but payloads 

launched aboard these vehicles. These include retrievable 

materials processing, re-entry systems, non-government research 

activities and many other, as yet unforeseen, commercial space 

systems. 

DOT/OCST will also license the construction and operation of new 

private launch Ranges, as well as any commercial Range Safety 

services.(12) OCST will also specify the certification requirements 

1-2 
for Range Safety personnel and launch services providers, that 

might impact the public safety. Under the Act, DOT must also issue 

licenses for any launch vehicle or operation on foreign territory 

by a US citizen or company. 

1.3 PURPOSE AND SCOPE OF REPORT: HAZARD ANALYSIS OR RISK 

ASSESSMENT 

This report presents the results of a technical review and analysis 

of literature and information in the public domain, conducted to 

identify and evaluate the prospective hazards to the public and the 

environment, and to assess risk exposure levels associated with 

commercial space activities. Included in the report is a review of 

the present status of US space technology and practices (Vol. 1), 

as they relate to the hazards associated with commercial space 

missions and their mitigation (Vol. 2). In this analysis, a 

commercial space mission is comprised of four phases: prelaunch, 

launch, orbital and re-entry (Table 1-1). For each mission phase 

the potential classes of hazards which pertain to the people, 

procedure, equipment, facility and environmental elements are 

identified. 

1-3 
These hazards have been identified and evaluated in light of 

DOT/OCST's mission, based on the review of existing literature and 

practice of space related risk analyses (Vol.3). 

The following definitions will aid the reader with the assimilation 

of information in this report. An extensive Glossary of terms has 

been provided (Appendix A) and a discussion of terminology and 

procedures is given in Chapter 8 (Vol. 3). 

An accident is defined as an undesirable event resulting from any 

phase of commercial ELV launch operations and space activities with 

the potential to cause injury or death to people, or damage to 

property. 

Risk assessment is the systematic examination of an actual or 

proposed system or operation, to identify and evaluate potentially 

hazardous events and their consequences. The principal purpose of 

such an analysis is to assist policy makers, regulators and 

managers in deciding on risk avoidance, risk reduction or 

mitigation strategies. It can lead to either confirming the 

continued acceptability of a system or operation from the safety 

point of view, or setting new risk acceptability and regulatory 

thresholds for the protection of public safety (see Ch. 8, Vol. 3). 

Although the terms Risk Assessment and Hazard Analysis are both 

used in this report in nearly synonymous fashion, the latter is 

part of the former. There are other closely related terms used in 

the literature in similar contexts: "Hazard" is often interchanged 

with "Risk", and "Analysis" for "Assessment", thus giving four 

common usage expressions, namely: risk assessment, risk analysis, 

hazard assessment and hazard analysis. 

i) An Analysis is typically a technical procedure following an 

established pattern; 

ii) An Assessment is the consideration of the results of analysis 

in a wider context to determine the significance of the analytical 

findings; 

iii) A Hazard is considered to be an existing property, condition, 

or situation, which has the potential to cause harm. For example, 

liquid hydrogen used as a rocket propellant is a hazard because of 

its chemical nature, and intrinsic flammability and explosiveness. 

iv) Risk is related to both the consequences of an accident (i.e., 

hazard potential being realized and causing harm) and its 

likelihood of occurrence (Ch. 8, Vol.3). Risk is mathematically 

expressed as the product of the probability of an accident and the 

magnitude of its consequence. Thus, the risk from a liquid 

hydrogen tank is the product of the probability that its 

containment will fail and the magnitude of the resulting explosion 

1-4 
and/or fire damage. Hence, people and property may be considered 

"at risk" from a nearby hazard. 

v) An Accident occurs when the hazard potential for damage is 

activated by a stimulus and results in damage to a given system, 

component or operation, or in injury to people. Other operational 

and technical definitions for terms used throughout the report are 

given in the Glossary (Appendix A). 

It must be kept in mind that a system or operation is considered to 

be "safe" when its risks are deemed economically, socially and 

politically acceptable, based on prevailing standards. These issues 

will be discussed and illustrated in detail in Vol. 3. 

1.4 APPROACH TO HAZARD ANALYSIS FOR COMMERCIAL SPACE OPERATIONS 

For over two decades, the US Government has been one of the world 

leaders in the development and exploration of outer space. In this 

role, the Government mission agencies (NASA and DOD) have developed 

and successfully implemented launch safety requirements in support 

of a wide variety of space missions (see Chs. 2 and 4 of Vol.1). 

Launch safety requirements have been established for both unmanned 

and manned space systems and operations, as well as for integration 

of specific payloads. As such, the standards presently in use at 

Government Ranges have evolved not only out of the need to protect 

the public safety and property, but also from the need to protect 

launch site personnel, facilities and on board astronauts; to 

ensure mission success; to evaluate launch vehicle performance; and 

to provide research results that would assist in expanding the 

national space exploration effort. 

Since the only currently available launch sites are National Ranges 

owned and operated by US Government agencies (DOD and NASA as first 

parties), the basic launch and system safety regulations now in 

place at these facilities will probably continue to be observed in 

the near future by any commercial launch vehicle provider or 

operator that requires access to and use of Government launch 

facilities (second party). Cost, access and time constraints may 

influence the viability of commercial launch operations on these 

Ranges, while vehicle reliability and safety will remain major 

concerns. Recognizing this situation, OCST has undertaken an 

effort to examine ELV safety standards, launch hazards and risk 

analysis methods to ensure the protection of public safety and 

property(12) (third party), as opposed to Government launch facility 

(first party) and ELV or satellite manufacturers and operators 

(second party) who enter User Agreements. 

As the initial effort in the development of a program to address 

the safety issues, this report focuses on the identification and 

evaluation of the safety hazards associated with ELV's and their 

1-5 
launch operations from established and available Government Ranges 

as well as new launch sites that may be developed and operated in 

the future by commercial entities, or in partnership with states 

and federal entities. 

Protecting the public health and safety as stated in the Act, 

requires that safety regulations be directed at preventing the 

occurrence of potentially hazardous accidents and at minimizing or 

mitigating the consequences of hazardous events. This will be 

accomplished by employing system safety concepts and risk 

assessment methodology to identify and resolve prospective safety 

hazards. The first step in applying system safety concepts is to 

define the commercial space launch hazards (preliminary hazard 

analysis, PHA). With the hazards defined, it is then possible to 

identify and rank those associated with each specific commercial 

space launch. Only after the hazards have been identified and 

satisfactorily assessed, will the goal of providing the public with 

the highest degree of safety practical have been accomplished. For 

the preliminary hazard analysis (PHA) presented in this report 

(Vol. 2), the operational commercial space launch phases have been 

defined as follows: 

1. Prelaunch; 2. Launch; 3. Orbit; 4. Re-entry 

For each of these life and operability phases of the commercial 

space launch process, it is possible to identify the generic 

classes of hazards that are associated with each phase (see Table 

1-1)and to define appropriate regulatory oversight. To identify 

these hazards, a clear understanding of the system and its 

operation is necessary, as well as an analysis of the relevant 

accident history for specific launch systems and subsystems 

during each phase of launch operation. An analysis of previous 

accidents is necessary, but not sufficient, for the identification 

of prospective hazards, since both vehicle configurations (see Ch. 

3, Vol. 1) and launch and Range Safety procedures (see Ch. 2, 

Vol.1) have improved with time. In 30 years of Government space 

launch activities and ELV operations to date, both the military and 

civilian sectors have had an excellent safety record and there have 

been no major accidents with reported public injuries. Therefore, 

the data base from which the hazards can be identified is limited, 

and known to be incomplete, with rare identical failures (see 

Ch.3). Furthermore, an examination of historical launch data can 

provide only a tentative list of probable causes and likely 

accident scenarios and may be incorrect for the purpose of 

projecting future performance. Special statistical methods may 

have to be used to account for "learning" from past failures in 

order to avoid repeating them (see Ch. 9, Vol.3).(7) Previous 

government ELV and space missions will, however, have to be used to 

generate a set of representative, expected, and projected 

commercial space launch missions (see Ch. 10, Vol.3). This 

1-6 
 

 

 

approach will allow us to examine and evaluate generic hazards 

associated with commercial space ELV missions (see Chs. 5-7, 

Vol.2). 

1.5 OVERVIEW OF THE REPORT ORGANIZATION 

This report is intended to inform and educate a broad readership on 

the generic sources and nature of hazards associated with space 

launch activities. Therefore, it is intended to provide both the 

necessary technical background and the specific hazard analysis 

methodology, in order to enable a non-technical reader to 

understand and appreciate the variety of technical issues involved. 

Volume 1: Space Transportation Operations provides the background 

on Range Operations (Ch. 2), current Expendable Launch Vehicles 

(Ch. 3), and Space Launch and Orbital Missions (Ch. 4). Chapter 2 

describes the Range Safety Control systems in place and established 

practices at the National Ranges. Chapter 3 introduces the basic 

technology, and typical proven and proposed configurations of ELV's 

likely to be used for commercial space missions in the near future. 

The historical reliability based on launch success/failure 

statistics for the major classes of operational ELV's in the US are 

also presented in Chapter 3. Chapter 4 describes the space launch 

and orbital operational phases. 

Volume 2: Space Transportation Hazards introduces the generic 

classes of hazards associated with the use of these ELV's in space 

launch operations. Chapter 5 discusses fires, explosions, toxic 

vapor clouds and debris impacts. 

A relative risk context is provided in Chapter 5 to enable the 

reader to judge launch hazards by comparison with other common 

industrial and transportation hazards. Chapter 6 discusses orbital 

collision hazards to satellites in low and geosynchronous Earth 

orbits. Chapter 7 reviews and evaluates those hazards to people 

and property associated with both controlled, and uncontrolled reentry of space objects. 

Volume 3: Space Transportation Risk Analysis deals with the 

analytical tools available to assess public risks (Ch.8), the 

modeling and application of such tools to space operations (Ch.9) 

and illustrates the specific risks associated with commercial ELV 

launches in the near future (Ch.10). 

Since DOT/OCST will sponsor and perform risk assessment/risk 

management research to support commercial space launch licensing 

reviews and awards, Chapter 8 defines and introduces the standard 

methods of Risk Assessment. Chapter 9 reviews the published 

technical risk assessments conducted for selected space 

applications, focusing specifically on when, how and why such risk 

1-7 
studies were conducted and on the software tools available for this 

purpose. 

Finally, in Chapter 10, an illustration of risk analysis is 

provided for representative ELV launch/mission scenarios which 

indicates how the public risk exposure from commercial space 

activities may be estimated, both with and without Range Safety 

controls in place. Also, a conceptual risk assessment and 

acceptability matrix is provided for comparing public risk levels 

associated with each phase of space launch operations. The 

benefits of Range Safety control systems and practices now enforced 

at Government Ranges as the key safeguards to manage and minimize 

the public risk exposure from future space activities to 

"acceptable" levels are made clear in Chapter 10. 

1-8 
REFERENCES TO CHAPTER 1 

1. "Civilian Space Policy and Applications," US Congress, Office 

of Technology Assessment, OTA-STI-178, June 1982. 

2. "International Cooperation and Competition in Civilian Space 

Activities," US Congress, OTA-ISC-240, July 1984. 

3. "Civilian Space Stations and the US Future in Space," OTA-STI241, Nov. 1984. 

4. "Commercialization of Land and Weather Satellites," US 

Congress, House Committee on Science and Technology, 1983. 

5. "Pioneering the Space Frontier," Report of the National 

Commission on Space, May 1986. 

6. (a) "Commercial Space Launch Act," (Report to accompany HR 

3942), US Congress, House Committee on Science and Technology, 

1984. 

(b) "The Expendable Launch Vehicle Commercialization Act," ibid., 

1986. 

(c) "The Land Remote - Sensing Commercialization Act of 1986," 

(Report to accompany HR 5155), ibid, 1984. 

7. "Space Issues", (Info Pack IP 371) and attached Issue Briefs: 

IB86121 "Space Launch Options after the Shuttle Accident," and IB 

87018 "Space Policy," prepared by the Congressional Research 

Service (CRS). 

8. "Space Activities of the United States, Soviet Union and Other 

Launching Countries: 1957-1986," by Marcia Smith, US Congress, CRS 

87-229 SPR (Feb. 1988). 

9. "Encouraging Business Ventures in Space Technologies," 

National Academy. of Public Administration Report for NASA, 1985. 

10. Report of the Presidential Commission on the Space Shuttle 

Challenger Accident, June 1986. 

11. "Space Stations and the Law: Selected Legal Issues," 

Background Paper, US Congress, OTA-BP-ISC-41, August 1986. 

12. (a) "Commercial Space Transportation; Licensing Process for 

Commercial Space Launch Activities; Notice of Policy and Request 

for Comments," 14 CFR Ch. III, Feb. 25, 1985 (FR 50, No. 37, p. 

7714 et seq.) 

(b) "Commercial Space Transportation; Licensing Regulations; 

Interim Final Rule and Request for Comments," 14 CFR Ch. iii, Feb. 

26, 1986 (FR 51, No. 38, p. 6871 et seq.) 

(c) "Commercial Space Transportation; Licensing Regulations; Final 

Rule," April 4, 1988 (FR 53, No. 64, p. 11004 et seq.) 

1-9 
10/2/95 rev 

2. RANGE OPERATIONS, CONTROLS AND SAFETY 

2.1 RANGE CHARACTERISTICS FOR SAFE OPERATION 

2.1.1 US Government Launch Sites 

The US Government has traditionally operated separate civilian 

and military space programs. NASA is the lead agency for 

civilian space activities, and assists as necessary, the 

Departments of Energy, Interior, Commerce, Transportation and 

Agriculture which also maintain space research and utilization 

programs. 

The US Space Command (US SPACECOM) coordinates all military space 

activities, but the three services also have operational Space 

Commands. DOD recently established a Consolidated Space Test 

Center (CSTC) under the Space and Missile Test Organization 

(SAMTO). A very recent DOD regulation governing military Range 

activities designated the Air Force as the lead agency for the 

tri-service conceptual Space Test Range at Onizuka AFB, in 

California, with a special focus on safety issues. 

The Eastern Test Range (ETR) is under the direction of the USAF 

Eastern Space and Missile Center (ESMC) at Patrick Air Force 

Base, Florida, and the Western Test Range (WTR) is under the 

direction of the USAF Western Space and Missile Center (WSMC) at 

Vandenberg Air Force Base, California. WTR launches are from 

Vandenberg Air Force Base; ETR launches are from the Cape 

Canaveral Air Force Station (CCAFS). NASA space missions are 

launched from the Florida Kennedy Space Center (KSC), also on 

Cape Canaveral and occasionally from WFF. 

The United States has a major launch site in Florida at Cape 

Kennedy (NASA) and CCAFS (DOD) for manned, lunar and planetary 

launches, and for launching satellites to geostationary orbit 

(primarily for weather and communications). It has another major 

West Coast launch site at Vandenberg Air Force Base (VAFB), 

California, for satellites (including weather, Earth resources, 

navigation and reconnaissance) which must go into polar orbits. 

A smaller launch site for small space payloads and for suborbital research rockets is the NASA/Goddard Space Flight Center 

(GSFC) Wallops Flight Facility (WFF) site at Wallops Island, 

Virginia. Sub-orbital launches and short-range vertical testing 

are accomplished at White Sands, New Mexico, from the White Sands 

Missile Range (WSMR). In addition, the US Government has 

conducted launches from a number of other CONUS and off-shore 

sites. 

Each of the National Ranges has unique capabilities related to 

its mission, siting and facilities, as well as specific 

requirements for the Range Users (see Vol. 3, Chs. 9, 10). The 

2-1 
safety philosophy of ground and Range operations is generally 

that of dealing with controlled, managed and acceptable risks. 

Procedures have been established to handle and store all 

materials (propellants, etc.) which may be a hazard, control and 

monitor electromagnetic emissions and govern transportation of 

materials to and from the facility.(4) The storage of propellants 

and explosives used in Expendable Launch Vehicles (ELV's) is 

controlled by quantity-distance criteria, as specified.(3) 

Failure modes and effects analyses (FMEA) are prepared, when 

necessary, for all potentially hazardous activities and devices 

(see Ch. 8). Quantitative risk analysis has rarely been used to 

establish launch and space operational risk because of the 

conservative philosophy of vehicle design, ground and launch 

procedures and the difficulty in developing realistic estimates 

of hazardous event probabilities and accident scenarios (see 

discussion in Vol 3, Chs. 9 and 10). 

Since there are currently no private commercial space launch 

range facilities in the US, we will describe the past and current 

practices at US Government Range facilities. It is assumed 

throughout this report that the level of operational safety at 

licensed commercial space facilities will be comparable or 

equivalent to the level of safety maintained at US Government 

Ranges. 

2.1.2 Ground Operations and Safety 

One of the principal responsibilities of the launch Range is to 

perform all of those tasks which eliminate, or at least 

acceptably minimize, the hazards from an expendable launch 

vehicle (ELV), both prior to and during the launch.(1-3) This is 

accomplished by establishing: 

(1) requirements and procedures for storage and handling of 

propellants, explosives, radioactive materials and toxics; 

(2) performance and reliability requirements for flight 

termination systems (FTS) on the vehicle; 

(3) a real-time tracking and control system at the Range; and 

(4) mission abort, vehicle destruct or flight termination 

criteria which are sufficient to provide the necessary 

protection to people both within (on- Range) and outside 

(down-Range) the boundaries of the launch facility. 

At each Range there is a hierarchy of regulations and 

requirements for Ground and Launch safety implementation (see 

also Chs. 6, 7, Vol. 2). Generally, the National Ranges take 

responsibility for the vehicle handling and safe operation from 

receipt until the time of orbital insertion. Safety issues 

associated with on-orbit impacts and re-entry from orbit are not 

normally the responsibility of the Range (see Chs. 6, 7, Vol. 2). 

2-2 
Control of public risks from jettisoned stages and hardware prior 

to orbital insertion are a Range responsibility. 

The following sections provide a general introduction to the 

various aspects of planning, ground operations and flight 

control, all with a specific emphasis on safety. Chapter 10 in 

Vol. 3 provides a more detailed discussion of launch hazards and 

their minimization by Range Safety controls. 

2.1.3 Range Safety Control System 

The NASA "Range Safety Handbook" states: "The flight safety 

goals are to contain the flight of all vehicles and preclude an 

impact which might endanger human life, cause damage to property 

or result in embarrassment to NASA or the US Government. 

Although the risk of such an impact can never be completely 

eliminated, the flight should be carefully planned to minimize 

the risks involved while enhancing the probability for attaining 

the mission objectives."(7) 

The real-time Range Safety (or Flight) Control System must 

accurately and reliably perform the following functions: 

(1) Continually monitor the launch vehicle performance and 

determine whether the vehicle is behaving normally or 

failing; 

(2) Track the vehicle and predict (in real-time) where the 

vehicle or pieces of the vehicle will impact in case of 

failure and if flight termination action is taken; 

(3) Determine if there is a need to delay or abort the launch or 

destruct the vehicle, based on a comparison of predetermined 

criteria with the current vehicle status; and 

(4) If necessary to protect the public, send a command to abort 

the mission either by vehicle destruct or engine shutdown 

(thrust termination). Note that the term "destruct" is used 

generically in this report to denote flight termination 

actions for Range Safety purposes. In reality, thrust (and 

the flight) can be terminated on command for some ELV's 

without vehicle destruction. 

Figure 2-1 describes pictorially the activities of the various 

elements of the Range Safety Control System. 

Vehicle performance is determined at all Ranges by visual 

observation (early in flight) and by real-time telemetry 

measurements of vehicle status as a back-up to the computed 

(wind-corrected) behavior of the instantaneous impact point 

(IIP), discussed below in more detail. The actual location of 

the vehicle is less important than where the vehicle and its 

debris will land in case of both normal operation, accidental 

failure, abort or destruct. Therefore, in tracking a vehicle, 

velocity data must be obtained either directly or by 

2-3 
differentiating successive measures of position. The most 

frequently used method of obtaining the velocity and position 

data has been the use of radar trackers, which measure the 

vehicle position in terms of azimuth, elevation and range 

relative to the tracker, expressed in a launch-pad centered 

reference coordinate system. Radars are also capable of 

2-4 
determining range rate, i.e., the rate at which a vehicle is 

moving toward or away from the radar. A single tracker near the 

launch pad can provide satisfactory information for two or more 

minutes of flight depending on the rate at which the launch 

vehicle is traveling away from the tracker. The quality/accuracy 

of the tracking data is often affected by several factors, two of 

which are: (1) multi-path of returned signals which occurs at 

low antenna elevation angles; and (2) the plume signal 

attenuation due to high temperature ionization caused by the 

solid rocket motor exhaust. Multiple radar trackers are used to 

minimize these problems and to provide redundant measurements, so 

that failure of a single tracker will not jeopardize the mission. 

Early in flight, when the launch vehicle is still close to the 

ground, the radar may not be able to track the vehicle. In this 

case, visual observation and telemetry may be the only means of 

determining whether there is a malfunction and whether the 

vehicle maintains the correct attitude. Position and velocity 

data, along with the predicted instantaneous impact point (IIP) 

are typically displayed in real-time in the Launch Control Center 

(LCC). 

Although not yet applied at the National Ranges, it is possible 

to use satellite information for determination of vehicle 

position and velocity. An electronics package on board the 

launch vehicle could collect information for calculating the 

range relative to several separately located navigation 

satellites and could be telemetered to a ground station, 

processed and converted into vehicle position and velocity. This 

will become practical when the Global Positioning System (GPS) 

satellites become operational. Some Ranges have used three or 

more geographically spaced telemetry antennas and associated 

computer equipment to infer the vehicle position and velocity 

from the Doppler phase shift of the received telemetry signals. 

The launch vehicle velocity and position information are 

generally used to compute an instantaneous impact point (IIP). 

The IIP is displayed on a screen or chart indicating where the 

vehicle will impact on the surface if flight were to be aborted 

at that instant. This impact point is usually computed, assuming 

no atmosphere, as a vacuum IIP (VIIP) which allows simpler and 

more rapid trajectory computation. Inclusion of atmospheric drag 

is generally not necessary to satisfy the objectives of the realtime Range Safety. However, a drag and wind correction is 

applied in some cases. 

Early in the flight the IIP advances slowly, but as the vehicle 

altitude, velocity and acceleration increase, the IIP change rate 

also increases. Very early in flight, the IIP change rate 

increases from zero to several miles per second. Later, it 

increases to tens of miles and then hundreds of miles per second. 

As the vehicle reaches orbital velocity, the IIP rate essentially 

goes to infinity because the vehicle will no longer come down. 

2-5 
The difference between the advance of the IIP and the present 

position (sub- vehicle point) (SVP) is illustrated in Figure 2-2. 

It is the advancing IIP that the Range Safety Officer (RSO) is 

usually observing during a launch. Prior to the launch, a map is 

prepared with lines drawn to represent the limits of excursion 

which, when exceeded, will dictate a command signal to terminate 

flight. A typical set of "destruct lines" is shown in 

Figure 2-3. 

The destruct lines are deliberately offset from land or populated 

areas to accommodate: (1) vehicle performance characteristics 

and wind effects; (2) the correction for using a vacuum instead 

of a drag- corrected impact point; (3) the scatter of vehicle 

debris; (4) the inaccuracies and safety-related tolerances of the 

vehicle tracking and monitoring system; and (5) the time delays 

between IIP impingement on a destruct line and the time at which 

flight termination actually takes place (i.e., human decision 

time lag). By proper selection of the destruct lines, debris can 

be prevented from impacting on or near inhabited areas.The 

ability of the system to accurately predict the ELV impact point 

diminishes as the vehicle advances into the flight and the IIP is 

moving more rapidly along the ground track. Consequently, the 

difficulties in performing the Range Safety Control function 

increase with time, particularly if there are land masses or 

population centers that must be protected near the ground path of 

the launch trajectory. Regardless of the flight time, the Range 

Control problem is always more difficult if the flight plan is 

designed to move close to or over a populated area. If a flight 

plan requires violation of a prudently designed abort line, a 

risk analysis is performed to determine if the risk is 

acceptable. If the risk is small enough, the Range Commander may 

choose to permit a launch without an abort line for portions of 

the flight (for further discussion see Vol. 3, Ch. 10). 

2.2 LAUNCH PLANNING 

The principal mission of Range Safety personnel is the protection 

of life and property both off and on-site at the launch facility. 

In keeping with that objective, the Range must not be negligent, 

nor impose undue restrictions on launch conditions, that could 

result in a high probability of a good vehicle being destroyed. 

Minimization of the probability of terminating a "good" flight, 

and simultaneous minimization of the potential risk due to a 

malfunctioning ELV, is accomplished through careful mission 

planning, preparation and approval prior to the launch. The 

planning is in two parts: (1) mission definition such that land 

overflights or other risky aspects of the launch are avoided 

and/or minimized; and (2) development of data which support the 

real-time decision and implementation of active control and 

destruct activities. These two aspects are discussed in the 

following subsections. 

2-6 
2-7 
2.2.1 Mission Planning 

Figure 2-4 contains a map showing the ground trace of a 

hypothetical launch from Vandenberg Air Force Base (VAFB) on an 

azimuth which causes overflight of islands south of the base, 

flight along the coast and overflight of a portion of Chile and 

Argentina (in fact, such azimuths are restricted, as discussed in 

Ch. 10). The greatest risk is in the immediate vicinity of the 

launch area and to any occupants of the nearby islands. Since 

the overflight of these islands is planned, abort lines cannot 

protect their inhabitants. Abort lines can protect the coast 

from vehicle overflight and debris impacts, in case of destruct. 

However, if the intended flight path is too close to the coast 

and the abort lines are too close to the planned flight path, 

there is the possibility that the IIP of a good, but slightly 

drifting, vehicle will cross the abort line and thus require a 

commanded destruct. The overflight of the tip of South America 

is not as serious a problem because the rate of advance of the 

IIP is so rapid and the vehicle altitude is so high at that point 

in flight that there is a much smaller possibility of any hazard 

to that region. A failure would have to occur within a specific 

time interval (a second or two of flight) in order for any 

resulting debris to impact the region (see Ch. 10 for a more indepth discussion of such risks). 

In addition to considering where the aborted or destroyed vehicle 

will land, one must also consider where the debris from normally 

jettisoned spent stages will impact. For example, the vehicle 

might fly safely over the islands, but drop an empty rocket 

casing on one of them. Mission planning must consider and avoid 

all of the hazards associated with normal launch operations, as 

well as other potential hazards associated with potential 

accidental failures for the particular launch plan. 

A Range user may request a particular trajectory to satisfy 

desired mission requirements (i.e., orbital inclination) or 

payload constraints. For example, a trajectory having a more 

easterly azimuth will enable the vehicle to put a heavier payload 

into orbit. If the launch vehicle is limited in lift capacity, 

the Range user may try to get the most favorable launch azimuth 

(in this case, eastern) in order to increase the amount of 

payload the vehicle can place into orbit. The Range Safety 

function in the mission planning stage is to limit the range of 

allowed launch azimuths to those which keep the risk to people on 

the ground at acceptably low levels. Another mission planning 

responsibility is to evaluate all other aspects of the planned 

launch, e.g., impact points of jettisoned stages, to assure the 

acceptability of the overall risk of the mission. 

There are situations where the conflict between safety 

requirements and mission objectives require special studies to 

determine risks and define tradeoffs. In these cases detailed 

2-8 
risk analyses are performed using models that consider the 

probability of the vehicle failing in a variety of modes and 

simulate the behavior of the missile during and after 

malfunction,including the effect of activating the flight 

termination system. 

Such risk analyses usually compute the land impact probability 

and associated casualty expectation (the average number of 

casualties expected per launch). Typically, missions with 

casualty expectations of less than one in a million are 

considered reasonably safe. If the risks are higher, the mission 

ordinarily comes under more scrutiny (see Chs. 9, 10 for more 

detailed discussion). 

One of the options for maintaining a low risk for a launch is to 

move the abort lines away from the populated areas and closer to 

the trace of the IIP for the nominal trajectory. While this 

decreases the overall launch risk, it increases the probability 

of aborting a good vehicle. Considering the very high value of 

many of the launch vehicles and their payloads, these tight abort 

lines put additional pressure on the Range Safety Officer (RSO) 

who must decide on an active destruct command. 

2-9 
Another option to minimize the risk of a normal, or failed, 

launch to the population surrounding the Range is to place much 

tighter constraints on the tolerable wind and other 

meteorological conditions at the time of the launch. 

2.2.2 Standard Procedures to Prepare for a Launch 

The National Ranges have provided standards and requirements for 

organizations desiring to launch vehicles from their facilities. 

For example, the United States Air Force has specific safety 

requirements issued for each of the Ranges under USAF control. 

These documents describe the safety policy and procedures and 

also define the data submittal and launch preparation 

requirements for the Range user.(1,2) The categories covered by 

these requirements include ground safety (handling of 

propellants, ordnance, noise, hazardous operations, toxics, 

etc.), flight analysis (vehicle trajectory, mission, etc.), 

flight termination systems (FTS), ground operations and flight 

operations. Included in the flight analysis portion are 

requirements for trajectory modeling and descriptions along with 

the dynamic characteristics of the vehicle during a malfunction 

turn.This information is used by Range personnel to construct the 

abort lines. Ref. 5 is an example of the equipment requirements 

to support typical missions from a National Range. 

2-10 
REFERENCES TO CHAPTER 2 

1. "Range Safety Requirements, Range Safety Regulation," ESMC 

Regulation 127-1, Dept. of the Air Force, Headquarters Eastern 

Space and Missile Center (AFSC), Patrick Air Force Base, Florida, 

July 30, 1984. 

2. "Range Safety Requirements, Range Safety Regulation," WSMC 

Regulation 127-1, Dept. of the Air Force, Headquarters Western 

Space and Missile Center (AFSC), Vandenberg Air Force Base, 

California, May 15 1985. 

3. Air Force Regulation (AFR) 127-100, Safety-Explosives Safety 

Standards (May, 1983; 2nd revision Jan., 1985). 

4. Hazards of Chemical Rockets and Propellants Handbook: Vol. 

I, General Safety Engineering Design Criteria; Vol. II, Solid 

Rocket Propellant Processing, Handling, Storage, and 

Transportation; Vol. III, Liquid Propellant Handling, Storage, 

and Transportation. CPIA 394, Vol. I, II, and III. Chemical 

Propulsion Information Agency, 8621 Georgia Ave, Silver Spring MD 

20910, September, 1984. 

5. "Missile Flight Control Operations Requirements," WSMC 

MFCOR, Dept. of the Air Force, Headquarters Western Space and 

Missile Center (AFSC), Vandenberg Air Force Base, California, 3 

January 1984. 

6. "Space Activities of the US, Soviet Union and other 

Launching Countries: 1957-1986", M.S. Smith, C.R.S. US Congress 

Report 87-229 SPR, Feb. 1987. 

7. "Range Safety Handbook", NASA GHB 1771.1, Sept. 1984. 

2-11 
6/20/95 rev 

3. EXPENDABLE LAUNCH VEHICLE (ELV) CHARACTERISTICS 

Currently under revision. 
 

 

10/2/95 rev 

4. LAUNCH AND ORBITAL OPERATIONS 1 

4.1 PHASES OF LAUNCH THROUGH ORBITAL OPERATION 

Launch and orbital operations can be divided into two or three 

phases: 

(1) the initial launch and boost phase which terminates when the 

vehicle obtains the velocity and altitude necessary to achieve 

Earth orbit; 

(2) the orbital transfer phase, during which properly timed 

firings of rocket motors move the satellite into the desired 

final orbit; and 

(3) depending upon the mission, return from orbit. Re-entry is 

further discussed in Vol. 2, Ch. 7. 

4.1.1 Launch Phase 

The prime objective during the launch phase is for the boost 

vehicle to overcome Earth's gravitational pull, rise through the 

atmosphere and overcome frictional heating. It must provide a 

satellite with an initial vertical and final orbital velocity 

(almost parallel to the surface of the Earth) using sustainer and 

upper rocket stages which will keep it in orbit. Depending on 

the latitude of the launch point, the desired orbital inclination 

and altitude, the initial orbit may not be the final orbit for 

the satellite. To change inclination the boost and higher stages 

of the ELV must rotate the attitude of the vehicle, so that it 

will be moving in the proper direction, and then pitch over to 

the orbital plane gradually as it gains velocity and altitude. 

The gradual programmed pitchover (called a gravity turn) is 

carefully designed so that the angle of attack (the angle between 

the axis of the vehicle and the vector of the aerodynamic forces) 

is kept as close to zero as possible. The gravity turn is 

preceded by a small pitchover maneuver called the "kick angle." 

If this is not accomplished, the aerodynamic loads on the vehicle 

will build up and overcome the guidance and control system, 

thereby producing a deviation from the planned flight path. If 

the angle of attack becomes too large, the airloads may overstress the vehicle and cause its structural failure. The 

aerodynamic force effects are proportional to one half of the 

product of the local atmospheric density and the vehicle velocity 

squared (called dynamic pressure or "q"). In some vehicles, 

failure can begin at less than 10 degrees angle of attack during 

1 The information in this chapter was developed using the references listed 

at the end of the chapter. This material is intended for readers with little or no 

background in either orbital mechanics or rocketry. Others can proceed directly to 

Chapter 5. 

4-1 
the "high q" portion of flight. A typical trajectory profile is 

shown in Figure 4-1. 

When the vehicle reaches a very high altitude, the atmospheric 

density becomes so low that the dynamic pressure is essentially 

zero regardless of the velocity. After this, the zero angle of 

attack is no longer required and different pitch attitudes and 

pitchover rates can be used. 

Control of all launch vehicles is maintained by gimballing 

(tilting) the engine nozzles or some equivalent way for changing 

the direction of the engine thrust. Launch vehicles must be 

controlled continuously because they are, without exception, 

aerodynamically unstable, i.e., a slight increase in angle of 

attack will cause the aerodynamic forces to attempt to increase 

the angle of attack even further. Severe wind shears during the 

early post-launch period of flight create difficulty for most 

vehicles, as the guidance and control systems must act to 

minimize the pitching or yawing due to abrupt angle-of-attack 

changes which they create. 

Most launch vehicles contain several stages. Thrust is initially 

provided by the lowest (and largest) boost stage. When the fuel 

for this first stage is consumed, the spent fuel casing is 

jettisoned to Earth, the remainder of the vehicle separates from 

it and the next stage is fired to continue the flight. 

Part of the preparation for any mission is the planning for the 

impact location of the spent stages (and other jettisoned 

equipment) in order to minimize the risk to people and property 

on the ground (see Ch. 2). 

Most of the current launch vehicles use solid rockets fastened to 

a central core vehicle which is usually a liquid propellant 

stage. These "strap-on" solid rocket motors (SRM's) augment the 

first stage thrust and are jettisoned when their propellant is 

consumed. 

4.1.2 Orbital Insertion and Orbital Operations 

It is not possible to describe the myriad of possible orbital 

parameters which may be desired or designed for different mission 

objectives. This discussion will only briefly cover the very 

simplest example. Consider the sequence of events illustrated in 

Figure 4-2. In the first illustration (a), a satellite (with a 

booster stage) is placed in a low "parking" orbit around the 

Earth. The rockets are fired in orbit and then shut off. The 

result of this orbital correction firing is the creation of a new 

elliptical "transfer" orbit which has an apogee (greatest 

distance from the Earth) which is at a higher altitude above the 

Earth than the original orbit (Figure 4-2(b)). If the satellite 

has no further propulsion, it will continue to follow this 

4-2 
4-3 
4-4 
elliptical orbit indefinitely, passing (ideally) through its 

initial perigee point once very revolution. If the objective is 

to reach a higher circular orbit, the built-in rockets (apogee 

kick motors, AKM) can be fired again (for a specified period of 

time) when the satellite reaches the apogee of the elliptical 

orbit, and the new orbit will be as shown in Figure 4-2(c). 

4.1.3 Orbital Decay and Re-entry 

Once out of the densest portion of the atmosphere, the ELV and 

its payload (satellite) has only very small drag forces acting 

upon it to reduce the satellite velocity. Consequently, the 

satellite will continue to orbit until reverse thrust (retropropulsion) is applied for a planned re-entry or decay forces 

eventually cause an uncontrolled re-entry. Controlled descent 

from an orbit reverses the firing sequence for orbit transfer. 

Rocket engines fire for a determined interval and angle and the 

vehicle/satellite now follows an elliptical orbit with apogee at 

the original orbital altitude and perigee at an altitude much 

closer to the Earth. If the perigee is within denser portions of 

the atmosphere, the vehicle/satellite will start to slow down 

gradually because of aerodynamic drag and descend to the Earth 

sooner due to orbital decay (see Vol. 2, Ch. 7). Aerodynamic 

heating is intense because of the very high vehicle velocity as 

it is coming out of orbit and the slow initial braking during reentry. Objects not designed to withstand this heat by protection 

from a heat and ablation shield generally break up and, often, 

vaporize altogether. Re-entry vehicles (RV's) similar to those 

provided for ICBM's have been proposed for recoverable payloads. 

Satellites which are placed in very low Earth orbit may not need 

any propulsion to return from orbit. Even at an altitude of 200 

miles, the very low density of air molecules still applies a 

small, but continuous drag force. These satellites will very 

slowly lose both velocity and orbital altitude and the decay will 

gradually increase until the object is traveling slow enough to 

re-enter the Earth's atmosphere. This unplanned re-entry is 

discussed further in Ch. 7. Figure 4-3 shows approximate orbital 

lifetimes for satellites in circular orbits. Orbital lifetime is 

a direct function of the mass to drag ratio of the satellite. 

This ratio is represented by the ballistic coefficient β which is 

equal to W/CDA; where W is the weight, CD is the drag coefficient 

of the body, and A is the cross-section area. The shaded area in 

the figure shows the range of lifetime in orbit for objects whose 

ballistic coefficients range from 10 to 300 lb/ft2

. The larger 

values of ballistic coefficient correspond to the longer 

lifetimes in the shaded region shown in Figure 4-3. 

If rocket engines are used to de-orbit, as proposed for 

recoverable payloads that use re-entry vehicles (RV's), the 

4-5 
4-6 
potential hazard from the re-entering spacecraft is controllable. 

However, the hazard from a decayed satellite re-entry is 

uncontrolled and usually cannot be predicted with any accuracy 

(see Ch. 7). 

4.2 BASIC ORBITAL CHARACTERISTICS 

A satellite stays in orbit because the centrifugal (outward) 

force equals the Earth's gravitational pull (inward). The 

centrifugal force is proportional to V2/R, where R is the distance 

from the center of the Earth to the satellite and V is the 

component of satellite velocity which is perpendicular to the 

radius R. The gravitational pull decreases with distance and is 

proportional to 1/R2. For low Earth orbits (LEO), the 

gravitational pull is stronger and, consequently, satellites must 

have a higher velocity to compensate and, thus, circumnavigate 

the globe much more rapidly. Figure 4-4 shows the relationship 

between orbital velocity and altitude above the surface of the 

Earth for circular orbits. Figure 4-5 gives the period (the time 

required to complete one circular orbit) as a function of 

altitude above the surface of the Earth. 

Not all orbits are circular; many are elliptical and are employed 

in orbital transfer and other mission applications. The perigee 

of an elliptical orbit is the minimum altitude of the orbit; the 

apogee is the maximum altitude (see Figure 4-6). The 

eccentricity is a measure of the ellipticity of the orbit. The 

formula for eccentricity is: 

e = ra p a p - r ÷ r + r (4-1)

where ra is the distance from the center of the Earth to the 

apogee altitude and rp is the distance from the center of the 

Earth to the perigee altitude. The apogee and perigee altitudes 

for a circular orbit are equal, hence a circular orbit has zero 

eccentricity. Elliptical orbits having the same perigee altitude 

as a circular orbit always have a longer period, with the period 

increasing with the eccentricity. 

The free flight path of a suborbital rocket or an expendable 

launch vehicle (ELV) is also elliptical. These vehicles, after 

completion of powered flight, follow a ballistic trajectory with 

an apogee above the surface of the Earth and a perigee which is 

below the surface of the Earth (see Figure 4-6). 

4-7 
4-8 
4-9 
4-10 
The concepts of energy and angular momentum are essential in 

understanding orbital mechanics. The total mechanical energy has 

two components, kinetic energy (K.E.) and potential energy 

(P.E.). As long as no additional force is being applied to the 

satellite (e.g., aerodynamic or rocket thrust), the total energy 

of the satellite remains constant, i.e., 

Total mechanical energy = K.E. + P.E. = constant (4-2) 

The kinetic energy is proportional to the square of the velocity 

of the satellite. Potential energy results from the combination 

of gravitational attraction and distance to the gravitational 

source. The total energy per unit mass, E, will remain constant 

throughout the orbit (circular or elliptical) unless a force 

impulse, such as rocket thrust or drag, is applied to the 

satellite. Thrust in the direction of the velocity vector will 

increase the energy and thrust or drag in the direction opposite 

to the velocity vector will decrease the energy. 

Hence, an orbiting satellite has both Kinetic Energy: KE = mv2

/2 

and Potential (Gravitational) Energy: GmM/r at its orbit 

altitude (r = R+h; where R is the Earth's radius, h is altitude 

above the Earth and M is the Earth's mass). The constant μ = GM 

in (ft/sec)3

 or (m/sec)3 is the constant product of the Universal 

Gravitational constant and Earth's mass. 

This simplifies the total energy per unit mass for an orbiting 

satellite to a specific mechanical energy: 

Es = E÷M = (KE + PE)÷ m = (v2÷2) - (μ÷r) = const. (4-3) 

If Es<0, the path is parabolic; if Es=0, the satellite is in a 

captive orbit (elliptical, or circular). If Es>0, the path is 

hyperbolic and the satellite will escape Earth's gravitational 

pull. The escape velocity is obtained from: 

(v 2 esc ÷ 2)-(μ ÷ r)= 0; v esc = 36,700 ft/sec or about 12 km/sec (4-

4) 

For launch velocities below vesc , the satellite will either 

return to Earth (suborbital injection velocities) and follow a 

ballistic (parabolic trajectory) or orbit in a circular or 

elliptical orbit with a speed (v) and period (P) determined as 

below in equation (4-5): 

P = (2∏r) ÷ v v = 

4-11 
4-12 
Two body gravitational interactions and no energy dissipation are 

assumed for the present discussion. The effects of solar wind, 

atmospheric drag and lung-solar perturbation on orbital 

parameters and decay are discussed in Ch. 7. Figure 4-7 shows 

the velocity vs. range for a rocket and payload. 

Since energy is conserved, it is now possible to visualize the 

exchange between potential and kinetic energy in an elliptical 

orbit. When the satellite is nearest to the Earth (perigee), the 

potential energy is least and the kinetic energy is at its peak. 

Hence the satellite reaches its highest velocity at the perigee 

and its lowest velocity at the apogee (where the potential energy 

is highest). 

The kinetic energy required for different orbits can be related 

to a characteristic velocity. The characteristic velocity is 

also the summation of all the velocity increments attained by 

propulsion to establish the desired orbit. Table 4-1 (from Ref. 

1) describes the characteristic velocities for a number of 

missions. 

4-13 
4-14 
Angular momentum is also a conserved quantity, so that without an 

external application of torque for a period of time, a spinning 

body will neither increase nor decrease its rate of spin. 

Satellite orbits have an angular momentum, which is about an axis 

through the center of the Earth. The orbital angular momentum, 

H, is given by: 

H = (R)x(v)x(cos θ) (4-6) 

where H is the angular momentum, R is the distance from the 

satellite to the center of the Earth and θ is the angle between 

the velocity vector and a line in the orbital plane which is 

perpendicular to the position vector (see Figure 4-8). The 

product "v x cos θ" can also be referred to as the tangential 

velocity. H is constant except when the satellite is accelerated 

or decelerated by thrust or drag. 

The equations for conservation of energy and angular momentum are 

necessary to analyze the dynamics of satellite orbits. The 

oblateness of the Earth requires some additional terms over those 

shown in Equation 4-3 for the potential energy expression, to 

obtain more accuracy in the orbital predictions; and the 

gravitational fields of the Moon and the Sun, in particular, 

should also be considered in increasing prediction accuracy. 

The plane of the orbit is defined by the longitude of the 

ascending node and its inclination. These are shown in 

Figure 4-9. The ascending node is the point where the projection 

of the satellite path crosses the celestial equator from south to 

north. The inclination is the angle formed by the plane of the 

orbit and the equator. It is measured counterclockwise from the 

eastern portion of the equator to the ascending node. Thus, 

satellites which orbit west to east (normal or prograde) have an 

inclination <90o

; orbits going east to west (retrograde) have an 

inclination >90o

. An alternate method sometimes used to 

designate retrograde inclination is to measure the angle 

clockwise from the western portion of the equator and state it as 

an Xo

 retrograde inclination (see Fig. 10-8). A third term often 

used to describe orbits is the right ascension (ê). This is the 

arc of the celestial equator measured eastward from the direction 

of the vernal equinox to the ascending node. 

The choice of orbit depends upon the mission of the satellite. 

ow Earth orbits (LEO) serve a variety of purposes and do not 

necessarily operate close to the plane of the equator. In fact, 

orbits with higher inclinations (near polar) provide the 

satellite the opportunity to cover a larger portion of the 

Earth's surface(see Figure 4-10). 

4-15 
4-16 
 

 

Communications satellites are generally placed in geosynchronous 

Earth orbits (GEO) where they complete one revolution of the 

Earth in 23 hours, 56 minutes and 4 seconds. A satellite in a 

geosynchronous orbit on the equatorial plane will appear 

stationary to observers standing on the equator. In order to 

have this day-long orbital period,2

 a satellite must be at an 

altitude of roughly 19,300 nautical miles above the surface of 

the Earth (5.6 Earth radii). The plane of the orbits of these 

satellites is either the same as the plane of the equator or at 

some relatively small inclination angle to the equator. Ideally, 

equatorial orbits can be achieved directly, with no mid-course 

2

 Our "solar day" of 24 hours corresponds to the Earth's apparent spin period 

but the Earth actually rotates approximately one and 1/365 turns in that time. One 

rotation of the Earth takes 23 hours, 56 minutes and 4 seconds. Time on a scale 

based on exactly one rotation of the Earth is referred to as sidereal time. One 24-

hour day of sidereal time is equivalent to 23 hours, 56 minutes and 4 seconds of 

solar time. 

4-17 
corrections, only by launches from the equator. Launches from 

points north and south of the equator have a minimum inclination 

which is related to the launch site latitude. Thus, equatorial 

orbits are normally achieved by maneuvers whereby the satellite 

is reoriented and a rocket motor is fired perpendicular to the 

plane of the current orbit to create a new orbit orientation (see 

Figure 4-11). 

4-18 
Since the orientation of the orbit is relatively motionless in 

space while the Earth turns inside it, the ground track of the 

orbit will recess (fall behind). The rate of recession is based 

on the number of degrees the Earth rotates while the satellite is 

completing one orbit. The northern-most and southern-most range 

of the ground track are equal to the inclination of the orbit. 

A typical ground track is shown in Figure 4-10. The width of the 

ground track, as seen by the satellite from orbit, is also called 

a "swath" or "footprint" of the satellite. 

There are external forces which perturb the otherwise stationary 

orbital plane and cause it to change orientation. The largest 

effects are caused by the oblateness of the Earth and the 

gravitational pull of both the Sun and the Moon, called lungsolar perturbations. Their relative importance varies with the 

altitude of the orbit. The relative effects in terms of 

acceleration (Earth gravitational units, or g's) for a satellite 

200 n mi. above the Earth are shown in Table 4-2. As the 

altitude of the orbit increases, the relative effect of the 

Earth's oblateness decreases and the Sun and the Moon's influence 

increases. 

4-19 
While the attraction of bodies other than the Earth can distort 

the orbit, the oblateness of the Earth will cause the plane of 

the orbit to precess around an axis through the pole of the 

Earth. The additional girth of the Earth around the equator 

(oblateness) produces a torque on the orbit and the result is a 

precessional motion not unlike that of a gyro or top. The 

precession rate can be defined as the number of degrees the line 

of nodes moves in one solar day. The nodal precession rate for 

circular orbits is shown in Figure 4-12. Note that the effect of 

the Earth's oblateness lessens with the altitude of the orbit and 

also with the inclination of the orbit. A polar orbit will not 

precess. 

The rotation of the Earth has an influence on the ability to 

launch satellites into desired final orbits. Looking down upon 

the North Pole, the Earth rotates counterclockwise. At the time 

of launch, the rocket already has a horizontal component of 

velocity which equals in magnitude the product of the Earth's 

rate of rotation and the distance to the axis through the poles 

of the Earth. If the ELV is launched in the direction of this 

velocity vector (eastward), it reaches orbital velocity easier 

than if it is launched in a westerly direction, in which case 

this surface velocity must be first overcome. (This effect 

varies with the latitude of the launch point. It is greatest at 

the equator and absent at the North or South Poles.) This factor 

is one influence on selection of a site for conducting launches. 

Therefore, in the United States, eastward launches of satellites 

into equatorial orbits from ETR, Florida augment the ELV thrust. 

More payload can be placed into orbit than from an identical 

launch made from, for example, Maine. The satellite launches 

from the West coast are almost always to the south to achieve 

polar (high inclination angle) orbits. Polar orbits are 

perpendicular to the velocity provided by the Earth's rotation, 

thus the rotation neither helps nor hinders the polar launch. 

However, the launch corridors used at both ETR and the West coast 

are chosen primarily for safety considerations. Launches 

eastward from ETR and southward from the West coast fly over 

water rather than inhabited territory and do not pose hazards to 

populated areas due to jettisoned stages or other debris. 

4-20 
4-21 
REFERENCES TO CHAPTER 4 

1. Hazard, Hap (edited by Heizz F. Gehlhaar and LT. Ronald G. 

Higden), U.S. Space Launch Systems (Rev. 2), Navy Space Systems 

Activity, Los Angeles, California, 1 July 1977. 

2. Bate, Roger R., Donald D. Mueller and Jerry E. White, 

Fundamentals of Astrodynamics, Dove Publications, New York, New 

York 1971. 

3. Cochran, Curtis D., Dennis M. Gorman and Joseph D. Dumoulin 

(Editors), Space Handbook, (2nd Rev.) Air University Press, 

Maxwell Air Force Base, Alabama, 1985. (AU-18) 

4. Thomson, William T., Introduction to Space Dynamics, John 

Wiley & Sons, New York, New York, 1961. 

5. White, J. Frederick (Editor), Flight Performance Handbook for 

Powered Flight Operations, Space Technology Laboratories (now 

TRW), Redondo Beach, California, 1962. 

4-22 
10/2/95 rev 

5. PRE-LAUNCH AND LAUNCH HAZARDS 

5.1 INTRODUCTION 

5.1.1 Background and Objectives 

A hazard is the existence of any property or condition which, 

when activated, can cause injury, death, or result in damage to 

property. Of interest to this study are launch-related hazards 

which could affect third parties, namely people or property not 

connected with ELV operations. Thus, hazards which have effects 

contained within the boundaries of the Range are not discussed 

explicitly in this context. 

A hazard potential exists because large quantities of liquid 

and/or solid propellants are part of the ELV and they could be 

unintentionally released in case of a launch accident. This 

hazard decreases with time into the flight because the quantities 

of on-board propellants decrease as they are consumed and the 

vehicle moves away from both the launch site and nearby populated 

areas. The exposure to launch accident hazards is greatest 

during the first few minutes after launch. 

The major generic hazards in the event of an accident involving 

propellants during pre-launch and launch operations are: 

1. Explosions: uncontrolled combustion of these 

propellants at a very fast rate per unit volume such that 

part of the chemical energy is converted to mechanical 

energy and part to heat. The mechanical energy is produced 

in the form of a blast wave with the potential of causing 

damage by crushing forces and winds (Sec. 5.2). 

2. Debris: vehicle fragments that may land upon 

structures or populated areas. Fragments may include 

burning propellants which could explode or burn upon landing 

thus posing additional hazards of types 1 and 3 (Sec. 5.3). 

3. Fires: uncontrolled combustion of the propellants at 

a slower rate than occurs in explosions, thus converting 

their chemical energy into heat only. The corresponding 

hazard is thermal radiation to people and property in the 

proximity of the fire (Sec. 5.4). 

4. Toxic Vapor Clouds: some hypergolic propellants (such 

as monomethylhydrazine, nitrogen tetroxide and Aerozine-50) 

are toxic and corrosive. If released in an accident, 

unreacted vapors and aerosols may be transported by 

prevailing winds in the form of clouds. Hydrazine vapors 

are colorless and become white when combined with 

atmospheric moisture; nitrogen tetroxide vapors are reddish 

brown. Such clouds may pose a health hazard to people and 

are potentially harmful to animals and vegetation (Sec.5.5). 

Other toxic propellants include fuming nitric acids, liquid 

5-1 
fluorine, anhydrous ammonia, nitromethane, ethylene oxide, 

chlorine trifluoride, chlorine, nitrogen trifluoride, 

hydrogen peroxide, hydrogen chloride and hydrogen cyanide. 

Hazards associated with noise, sonic boom and small quantity 

releases of toxic materials are not considered in the same 

severity category as the hazards listed above and are not 

addressed in this report. 

In a given accident, one or more of these hazards may occur and 

prevail in importance over the others, depending on the specific 

circumstances of the event such as: vehicle design, accident 

location, failure mode, propellant type, amount of propellant 

released, mode of release, environmental conditions and proximity 

of people and property. Sometimes, the occurrence of one hazard 

may preclude another because they compete for the same 

propellant. For example, when most of the propellant is consumed 

in a fire, a vapor cloud will not form. Other times, the hazards 

may be sequential -- such as the formation of toxic vapors in a 

fire or an explosion which may later pose a toxic vapor cloud 

hazard. The possible off-range impacts of launch accidents are 

illustrated in Sec.5.6. 

This chapter presents a generic discussion of the major types of 

hazards associated with the ground preparation and launch of 

ELV's namely: explosions, debris, fires and vapor clouds. The 

objective is to provide an overview of the mechanisms involved in 

these hazards, the types of analyses used and the damage 

criteria. The hazards are considered to be of very low 

likelihood. Their applicability to, and magnitude in, any launch 

operation should be established by detailed analyses of the 

specific circumstances in each case. Such analyses for typical 

launch operations are discussed in Ch. 10, Vol. 3. A second 

objective is to provide a perspective on launch hazards by 

comparison with industrial and transportation accidents. 

5.1.2 Major Information Resources on Rocket Propellant Hazards 

In order to assess public risk exposure derived from launch 

hazards, information must be drawn from reports of major 

experimental and theoretical studies of the behavior of 

accidentally released propellants and fuels.(1,3) These studies 

include test programs carried out by government agencies (NASA 

and DOD) where realistic accident scenarios were simulated on a 

large scale. Two notable test programs were projects PYRO(2) and 

SOPHY.(3) Both are summarized briefly below to illustrate the 

experimental basis for the information that follows in this 

chapter: 

1. Project PYRO tested the explosive yield and flammability of 

liquid propellants namely: 

5-2 
• hypergolics (Aerozine-50 & Nitrogen Tetroxide used as 

fuel and oxidizer in both the Titan and Delta vehicles) 

in mass ratio of 2.25/1, in several configurations and 

with total weights of up to 200 to 1000 lb (90 to 450 

kg); 

• Liquid Oxygen/RP-1 (used in the Atlas vehicle) in mass 

ratio of 2.25/1 and with a total weight of up to 25,000 

lb (11,000kg); 

• Liquid Oxygen - Liquid Hydrogen (used in the Centaur 

vehicle) in mass ratio of 5/1 and in total weights of 

up to 100,000lb(45,000kg); 

• Full-scale Saturn S-IV and a modified Titan I first 

stage. 

Also, three accident conditions were simulated to produce 

different types of mixing effects: 

• failure of an interior bulkhead separating fuel and 

oxidizer; 

• fall back of a space vehicle on the launch pad with 

complete tank rupture and subsequent ignition; 

• high velocity impact of a space vehicle after launch. 

2. Project SOPHY addressed the hazards associated with 

handling, transporting, testing and launching of solid 

propellants. Solid propellants were tested in various 

geometries, sizes and weights (the latter varied from a few 

hundred to half a million pounds). Shock initiation was produced 

with a TNT charge centered on the end face of the propellant. 

Air blast and fire ball data were collected and analyzed 

statistically to develop scaling relationships. The critical 

charge diameter required to sustain a detonation in a typical 

composite propellant was determined to be between 60 and 72 

inches. 

These two test programs and their results were discussed 

extensively in a Chemical Propulsion Information Agency (CPIA) 

publication entitled "Hazards of Chemical Rockets and 

Propellants".(1) The results were analyzed to identify and 

quantify the resulting hazards and to develop methodologies for 

use in hazard analysis. Their findings are drawn upon 

extensively without having reviewed in detail the original 

reports of project PYRO and SOPHY.(2,3) Other references of 

interest to such analyses are safety standards AFR 127-100(4) and 

DOD 6055.9-STD.(5) 

Against this background, we will present a generic discussion of 

the explosion, debris, fire and vapor cloud hazards associated 

with the accidental release of propellants. Hazard analyses of 

specific launch operations will also be discussed in Vol. 3, 

Chapters 9 and 10. 

5-3 
5.2 EXPLOSION HAZARDS 

Explosion of an ELV can occur accidentally, as with the Titan 34D 

event in April, 1986, or as a result of a destruct command using 

the flight termination system. In some cases, flight termination 

is accomplished simply by shutting off the fuel supply to liquid 

fuel engines. In this case, an explosion may not occur unless 

the intact vehicle and its remaining fuel impact the ground 

sharply. 

An explosion is a very rapid expansion of matter into a volume 

greater than its original volume. The cause of the expansion 

might be combustion, electrical discharge (such as lightning) or 

a purely mechanical process such as the bursting of a cylinder of 

compressed gas. The faster the energy is released, the more 

violent the explosion. 

Rocket motors are designed to burn their fuels and release their 

energy in a controlled combustion process called a deflagration, 

or simply, a flame. In a deflagration the reaction front is 

driven by diffusion mechanisms. At steady state, it proceeds in 

the material at a rate lower than the speed of sound. 

Under some conditions, the rate of energy release can increase 

significantly, leading to an explosion. The combustion process 

is then called a detonation. 

In a detonation the reaction front consists of a shock wave 

followed by a flame. The reaction front is driven by a shock 

compression mechanism. At steady state, it proceeds in the 

material at a rate faster than the speed of sound. 

There is a spectrum of reaction possibilities between steady 

state deflagrations and detonations, such as a fast deflagration 

and a weak detonation, with the potential of a transition from 

one reaction to another. The deflagration-to-detonation 

transition is referred to as DDT. A shock-to- detonation 

transition is also possible and is referred to as SDT.(6,7) 

For solid propellants (see Table 3-3, Vol. 1, Ch. 3), crosslinked double base hybrid materials (DOD Class/Division 1.1--old 

Class 7) were always considered in the past to represent a 

detonation hazard; most composite propellants (Class/Division 

1.3--old Class 2) were considered to represent a fire 

(deflagration) hazard. However, recent trends in rocket motor 

design include: more energetic composite propellants, higher 

solid loading densities, larger grain diameters and greater mass. 

The net effect is that composite propellants may also detonate 

inadvertently under the dynamic conditions of accidents. 

Although, they may require a larger initiation energy than 

5-4 
Class/Division 1.1 propellants and their detonation may not be 

self-sustaining, resulting in lower yields(7). 

A number of conditions influence the likelihood of solid 

propellant detonation:(6,7) 

• propellant toughness; 

• motor geometry, core configuration, diameter, length to 

diameter ratio, chamber pressure, case bonding 

technique and propellant residual strain; 

• propellant critical diameter and geometry; 

• propellant granular bed characteristics (pyrolysis and 

ignition) both thermally and mechanically induced, 

leading to faster combustion terminating in a 

detonation (DDT); 

• propellant response to shock (SDT); 

• propellant response to delayed reduced shock (referred 

to as XDT) 

• impact velocity and surface impacted (water, sand or 

concrete). 

A question of particular interest is whether activation of the 

destruct system is likely to detonate solid rocket boosters. 

This subject was studied recently by the Naval Surface Weapons 

Center (NSWC) for a filament wound graphite case material.(8) 

They tested: 

• linear shaped charge (LSC)/propellant case 

interactions; 

• detonability and shock sensitivity; 

• material response (breakage of propellant). 

They concluded that activation of LSC would not detonate the 

Solid Rocket Booster propellant. At most, a rapid burn is 

expected. 

For liquid propellants, the likelihood of detonation is 

influenced by chemical composition and conditions such as: 

• degree of fuel and oxidizer mixing and size of the 

mixture prior to initiation; 

• confinement of the products of combustion; 

• presence of obstructions or flow instability that 

generate turbulence and result in increased reaction 

areas. 

Such conditions are encountered in accidents to various degrees. 

Thus, it is usually very difficult to predict with certainty 

whether or not a detonation will occur. 

Still, overpressure can result if the reaction is fast enough, 

even though it is not an ideal, steady state detonation. The 

5-5 
main difference is in the near-field where a detonation generates 

a much higher overpressure. This difference decreases further 

away from the center of the explosion. The far-field is of 

particular importance to this study which focuses on potential 

damage to the public (third parties) off-range. Overpressure 

estimation methods are presented in the next section. 

5.2.1 Blast Waves 

Scaling laws are used to calculate characteristic properties of 

blast waves from explosions. With the aid of such laws, it is 

possible to present characteristics of the blast wave, for any 

yield, in a simple form. This is presented below for the case of 

air at constant temperature and pressure. 

Full-scale tests have shown that these relationships hold over a 

wide range of explosive weights (up to and including megatons). 

According to the scaling laws, if d1 is the distance from a 

reference explosion of W1 lb at which a specified hydrostatic 

overpressure or dynamic pressure is found, (Dynamic pressure q = 

1/2 pv2

, where p is air density and v is particle velocity), then 

for any explosion of W lb, these same pressures will occur at a 

distance, d, given by: 

d/d1 = (W/W1)1/3 (5-1) 

In other words, the pressures are functions of a unique variable 

(d/W1/3) called the scaled-distance or k-factor. 

Cube-root scaling can also be applied to the arrival time of the 

shock front, positive-phase duration and impulse; the distances 

concerned are also scaled according to the cube-root law (see 

Figure 5-1 for a definition of these terms). The relationships 

may be expressed in the form: t/t1 = i/i1 = d/d1 = (W/W1)1/3, where 

t represents arrival time or positive-phase duration, i is the 

impulse and the subscript 1 denotes the reference explosion W1. 

These relationships are well established and accepted in the 

literature. They form the basis of most explosion models, 

including that used in Chapter 10 of this report. 

It should be noted that the above relationships are for blast 

waves in free field, under ideal conditions. In a real, 

stratified atmosphere, shock focusing may occur producing higher 

overpressures than in free field. Such effects have been taken 

into account in a computer model named BLAST based on acoustic 

wave propagation. The model was developed by WSMC and has been 

verified experimentally.(9) 

5-6 
5-7 
5.2.2 TNT Equivalency Analysis 

It is conventional to express the magnitude of an explosion of a 

given material (e.g., solid or liquid propellant) in terms of an 

equivalent weight of TNT (symmetrical tri-nitrotoluene, a 

conventional ordnance explosive) required to produce essentially 

the same blast wave parameters. The TNT equivalent weight was 

selected because of the large amount of experimental data 

available on blast waves and damage produced by TNT explosions. 

A given material may have several TNT equivalent weights 

depending on the selected blast wave parameter, i.e., it may have 

an equivalent weight based on peak overpressure, another based on 

positive impulse, (see Glossary, App. A, or Figure 5-1), etc. 

Peak overpressure is more commonly used, however, to define TNT 

equivalence. TNT yield refers to the TNT equivalent weight 

expressed as a percent of the weight of the propellant. 

The TNT-equivalent analysis has a number of limitations that 

should be borne in mind to obtain valid comparisons. They are: 

• Not all the accidentally-released material is involved 

in the explosion: part of it may disperse without 

reacting and part may react at a different time or 

location from the explosion. Accordingly, measured TNT 

yields of liquid propellants were found to depend on 

the degree of fuel/oxidizer mixing prior to explosion 

initiation. This degree of mixing depends, in turn, on 

the rate of mixing (a function of vehicle design, 

failure mode and accident conditions) and its duration 

(a function of when ignition occurs). 

• Of the portion of released material that reacts in the 

explosion, part of it may detonate and part may 

deflagrate, with the latter contributing little energy 

to the blast. Predicting whether a detonation or 

deflagration (or any combination of them) will occur is 

a very complex subject, as discussed earlier. The 

outcome depends on the propellant properties and on the 

conditions of the accident. For example, with solid 

propellant fragments, an impact speed greater than 300 

ft/sec is likely to have sufficient energy to initiate 

the detonation of that fragment upon impact.(7) 

• Even for the portion of the released material that 

contributes directly to the blast energy, the blast 

characteristics are different from those of a TNT 

charge with an equivalent energy. Measured

overpressure amplitudes are generally lower and 

durations are longer because of a slower reaction rate 

for propellants than for TNT. This rate depends on 

5-8 
accident-specific conditions such as: strength of 

initiating source, degree of confinement and shape of 

propellant. 

Thus, the TNT yield of a material is not an absolute property 

such as density or molecular weight. Instead, it depends on the 

test conditions in which it is measured. Fortunately, the 

dependence of blast parameters on yield is low because of the 

cube-root exponent in the scaling law (Eq. 5-1). Hence, the 

prediction of a hazard distance (d) is not very sensitive to the 

employed yield (W). For example, if the yield is off by 50 

percent, the distance (at which a particular overpressure is 

reached) is off by only 15 percent. Thus, the TNT method of 

analysis has been used effectively over many years despite the 

limitations mentioned above. 

In 1978, NASA established an Explosive Equivalency Working Group 

to define potential failure scenarios which could lead to an 

explosion and to estimate the maximum credible explosive TNT 

equivalency for these explosions. The most complete 

documentation of the findings of this group is reportedly in a 

collection of briefing charts by W.A. Riehl et al.(10) The work 

performed by this group provided a basis for many subsequent 

studies,(11) many of which have quoted verbatim TNT equivalent 

values from Ref. 10. This is illustrated in Table 5-1, which is 

extracted from a study on shuttle safety.(11) A variety of failure 

modes and accident scenarios are identified for the external tank 

and the solid rocket motors; a maximum credible explosive 

equivalent (or TNT yield) is estimated for each case. Also, the 

range for these maximum credible TNT yields varies from: 

• 5 to 50% for LH2/LOX 

• 18 to 100 % for the solid rocket motors 

The lower bound for these yields is zero, since the propellants 

may react or burn without producing mechanical damage. 

Although the STS is not being considered for commercial space 

transportation, Table 5-1 is very useful to illustrate that the 

yield of a propellant system can vary depending on the failure 

mode. 

Recommended values for TNT equivalency of liquid propellants 

under selected worst case accident conditions are given in AFR 

127-100.(4) Since AFR 127- 100 addresses the circumstances in 

handling and storing propellants, it may not apply to launch 

operations. 

5-9 
5-10 
The values are presented in Table 5-2, where it should be noted 

that: 

• TNT yields for the same propellant vary depending on 

the accident conditions. While this variation is 

consistent with the concept of TNT yield (as discussed 

above), it is important to select the appropriate value 

for each set of accident conditions since the yield 

varies by up to a factor of seven. 

• Significant equivalent TNT yields are estimated under 

the most severe scenarios. These worst case scenarios 

are very unlikely, however. 

For illustration, the recommended TNT yield values are applied to 

three classes of ELV vehicles of interest: Atlas/Centaur, Delta 

and Titan. This is presented in Table 5-3, which shows the 

propellant composition, weight, TNT yield estimate and TNT 

equivalent weight for each vehicle. Note that : 

• for liquid propellants, the yield estimates are based 

on the recommended guidelines in AFR 127-100 which 

represent worst cases. Thus, they are inherently 

conservative. 

• For solid propellants, the yield estimates are taken 

from a compilation of SRM impact detonation history.(1) 

A range of values (varying over a factor of five) is 

given to cover a number of accident scenarios. 

TNT equivalent weights are obtained by multiplying each 

propellant weight by its yield. A range of TNT weights is 

obtained because of the uncertainties in the yields. Such

uncertainties are expected in view of the previous discussion of 

the various factors that affect TNT yield. In reality, the 

ranges vary from a lower bound of 0 (i.e., no blast) to the upper 

values (i.e., worst cases) in Table 5-3. To estimate a 

reasonable value within this range requires an accident-specific 

analysis, which is not attempted in this generic report. 

Finally, note that a hybrid propellant mix technology (liquid 

oxygen/solid polybutadiene fuel) proposed by AMROC, has been 

assigned a TNT equivalence of zero by the DOD Explosives Safety 

Board. 

5-11 
5-12 
5-13 
5.2.3 Damage Criteria 

Blast waves from accidental explosions can cause damage to people 

and property (structures) by subjecting them to transient 

crushing pressures and winds (which cause drag pressures due to 

the sheer force of the wind). Even though the interactions of 

the waves with the objects involve very complex phenomena, 

relatively simple concepts have been used quite effectively to 

correlate blast wave properties with damage to a variety of 

targets. The concept states that damage is primarily a function 

of either the peak overpressure, the impulse or some combination 

of these two factors. 

Guidelines for peak overpressures required to produce failures to 

structures such as shattering of glass windows and collapse of 

concrete walls are presented in Table 5-4.(1) Note that a very 

low pressure (force per unit area) is sufficient to cause damage, 

mainly due to the large area of such surfaces. Similar criteria 

are used in the hazard assessment model used in Vol. 3, Ch. 10 of 

this report. 

Criteria for injury of personnel standing in the open are given 

in Table 5-5.(1) They cover ear drum rupture and lung hemorrhage 

caused by overpressure and personnel blowdown caused by the 

impulse imparted by the blast wave, with the concomitant 

potential of injury due to bruises, lacerations and bone 

fractures. These data are presented in graphic form in Figure 5-

2 and Figure 5-3.(12) Note that: 

• The overpressure required to cause damage decreases (as 

expected) with the increase in the duration of the 

positive phase of the blast wave. 

• There is a significant variability in the 

susceptibility of people to such overpressure. Such 

variability can be accounted for statistically by 

raising overpressure thresholds to ensure higher levels 

of lethality. This should be done carefully to 

maintain a realistic approach to analysis. 

Finally, blast wave characteristics (Section 5.2.1) can be 

combined with the present damage criteria in order to estimate 

the extent of the damage (in feet) as a function of various 

equivalent weights of TNT. Typical results are shown in Figure 

5-4 for eardrum rupture, lung damage, etc. Similar data are 

used in the next section and in Ch. 10, Vol.3 to illustrate the 

assessment of both property damage and personnel injury over a 

range of accident conditions. 

5-14 
5-15 
5-16 
5-17 
5-18 
5-19 
5.2.4 Variation of Explosion Hazards with Time from 

Liftoff 

As noted, launch hazards decrease with time into the flight. 

This point is illustrated in this section for potential third 

party damage due to an accidental explosion of an ELV. The 

variations of other hazards with time are not discussed. 

Data are used for a typical Delta ELV system flight profile and 

propellant consumption rate as a function of time elapsed after 

liftoff.(13) However, qualitatively, the discussion applies 

equally well to other ELV systems. 

The outcome of an accident is usually determined by the specific 

circumstances present at the time and location of the accident. 

Usually, there are a number of variations for these circumstances 

which can lead to a number of outcomes. In this illustration, 

the analysis is simplified to focus on the effects of "time into 

flight." 

The calculations presented below are also based on a number of 

assumptions selected to make the analysis workable. For example, 

for the sake of simplicity, it is assumed that all of the 

propellants remaining on board will explode instantly (this 

corresponds to a worst case calculable explosion scenario). In 

reality, the situation is more complicated: 

• some of the propellant may explode initially, producing 

fragments that may explode later upon impact with the 

ground (secondary explosions); 

• some of the propellant may burn in a fireball; and 

• some of the hypergolic propellant may disperse in the 

environment without reacting, posing toxic risks or 

dispersing harmlessly. 

Another example of a simplifying assumption is to represent 

different circumstances occurring at various times into flight by 

simply changing the TNT yield. The yield is increased when the 

circumstances (such as failure mode, mixing rate or impact speed) 

favor a stronger explosion (as described in more detail below). 

Note that each scenario can be associated with a vehicle failure 

mode and is likely to occur with a particular probability value 

(Section 5.6). Thus, although the discussion below makes no 

explicit mention of probabilities, the predicted results are tied 

to a particular probability value. 

5-20 
Therefore, three key changes can be identified as time elapses 

from liftoff: the vehicle altitude (and down-range distance), 

the quantities of propellants remaining on board and the 

explosive potential of these propellants. These changes are 

illustrated in Figure 5-5 and are discussed below. 

5-21 
First, the vehicle altitude increases very rapidly with time into 

flight -- reaching roughly 20 nm. in the first 2 minutes, as 

illustrated by curve A in Figure 5-5, which shows a typical 

flight profile for a Delta mission.(13) Furthermore, the location 

of launch sites and the direction of launch are usually selected 

so the vehicle moves away from population centers. Thus, the 

"separation" distance between the vehicle and the communities 

potentially vulnerable, in case of a vehicle accident, increases 

with time. 

Second, as time elapses from liftoff, the quantity of propellants 

remaining on board decreases very rapidly due to their rapid 

consumption by the rocket booster and other engines. The total 

weight of all propellants remaining on board is illustrated by 

Curve B in Figure 5-5. Note that the total remaining propellant 

weight decreases by about 50% within 2 minutes from liftoff. 

Third, the explosive potential (or TNT yield) of a given quantity 

of propellant may change as time elapses from liftoff. As 

discussed earlier (Sec. 5.2.2), the TNT yield of a propellant in 

an accidental explosion depends on its properties, as well as on 

a variety of other factors, determined by the details of the 

accident scenario. Example of such factors include: the sizes 

of solid propellant fragments their impact speed, the rate and 

extent of mixing of liquid propellants, the degree of 

confinement, etc. In fact, the significance of TNT yields, how 

they are estimated and the pertinent ranges of values given in 

the published literature were discussed in Section 5.2.2. 

Determination of TNT yield at various times after liftoff 

requires an extensive analysis. First, identify the type of 

failures and accident scenarios that are likely to occur and 

second, estimate the yield for each scenario and each propellant 

system based on historical accident data, test data, experience 

and engineering judgment. Such an analysis was done for the 

Space Shuttle system by the Explosive Equivalency Working Group 

established by NASA in 1978, as discussed in Section 5.2.2. 

Ideally, the same type of analysis for each ELV type is needed to 

establish pertinent explosive yields were the accident to occur 

at various times from liftoff. However, for simplicity, another 

approach which is not as rigorous, but may suffice, is used to 

illustrate the explosive yield dependence on time from liftoff. 

Table 5-2 in Section 5.2.2 lists upper limits for TNT yields for 

ELV propellants reported in the literature. The lower bound for 

these yields is zero (%), since the propellants may react or burn 

without producing mechanical damage. The range of upper values 

for the Delta vehicle propellants are: 

5-22 
• 10 to 20% for RP-1/LOX (Stage I) 

• 5 to 10% for Aerozine-50/N2O4 (Stage II) 

• 14 to 100% for the solid rocket motors (Booster and 

Stage III) 

Note that each point within these ranges can be associated with 

a particular accident scenario which, in turn, may be associated 

with a specific time from liftoff. For example, when a vehicle 

(or its fragments) falls back on the pad soon after liftoff, the 

speed at ground impact is a key factor in determining the 

likelihood of detonating the solid propellants. It is known that 

an impact speed of 300 ft/sec is required to detonate solid 

propellants and produce significant yields. In order to reach 

such terminal speeds in free-fall, a vehicle would have to start 

at an altitude of approximately 1400 ft (assuming no drag). This 

altitude would be reached in about 12 seconds after liftoff. 

Thus, if the vehicle falls back onto the pad in the first 12 

seconds (or so), a low yield is anticipated, while if it falls 

back at a later time, a higher yield is anticipated. Following 

this reasoning, the yields corresponding to these two situations 

are assumed (for simplicity) to be the upper and lower values of 

the ranges listed above for the three propellant types in the 

Delta vehicle. Thus, the yields would be: 

• 10, 5 and 14% (respectively for the 3 types of 

propellants) in the first 0 to 12 sec after launch; 

• 20, 10 and 100%, respectively, at later times into 

flight. 

By multiplying these yields with the amount of propellants 

remaining on board, the potential explosive energy (in terms of 

equivalent pounds of TNT) is estimated as a function of time from 

liftoff as illustrated by Curve C in Figure 5-5. Note that the 

explosive potential starts at a low value (because of the low 

yield); then increases because of the increase in yield 

corresponding to higher impact speed; finally it decreases 

because of the decrease in the quantity of propellant remaining 

on board. 

Using the potential explosive energy determined above, the 

overpressure field around the explosion point was estimated 

following the analysis outlined in Section 5.2.1. It was assumed 

that the entire vehicle will explode at altitude and as one mass 

(a more realistic assumption is a smaller explosion in flight, 

breaking up the vehicle in fragments that will explode upon 

ground impact). It was also assumed that any reflection or 

focusing of the shock wave would have a negligible effect on the 

overpressure field. 

5-23 
For these assumed explosion conditions, the "hazard" distances at 

which critical overpressures are reached are shown as a function 

of time in Figure 5-6. Three overpressure levels are used: 

• 1.5 psi, for collapse of light weight structures (Curve 

B) 

• 0.35 psi, for window breakage with a probability of 50% 

(Curve C) 

• 0.20 psi, for window breakage with a probability of 10% 

(Curve D) 

The vehicle altitude from Figure 5-5 is also shown as Curve A in 

Figure 5-6 for reference. 

5-24 
In Fig. 5-6, the hazard distances first increase with time, and 

then decrease -- following the behavior of the potential 

explosive energy profile which is shown in Fig. 5-5. 

Furthermore, Fig. 5-6 can be interpreted as follows: 

• in approximately the first 25 seconds, damage such as 

window breakage is possible in a distance of 

approximately 1 nm. from the launch pad (or the 

location of vehicle impact with ground). 

• at later times, key scenarios are: 

a- all the propellant explodes at the vehicle 

altitude. The potential mechanical damage at ground 

level is negligible (even if maximum yield is assumed) 

because of the high altitude of the vehicle and its the 

large separation from ground. 

b- the vehicle falls back to Earth as one piece and 

explodes. This is a very unlikely scenario since the 

vehicle will breakup under the aerodynamic forces 

produced by the fall. Even in such a worst case 

scenario, Figure 5-6 suggests that the maximum 

overpressure distance will be less than 1 nm. in the 

first 25 to 60 sec time frame; much smaller yet at 

later times because of the rapid consumption of 

propellants with time of flight. The location of the 

impact point will be governed by vehicle trajectory 

during the fall, which in turn depends on a number of 

factors as discussed in Section 5.3. 

c- the vehicle breaks up at altitude, producing 

fragments, some of which may detonate as they impact 

ground. The hazard of item b above is now distributed 

over a broader region determined by the impact points 

of the fragments. The overpressure hazard distances 

around each impact point will be smaller than in b 

above. They will depend on additional factor such as 

number and size of fragments and their rates of 

consumption during their fall. This is further 

discussed in Section 5.3. 

Off-range damage in any of the above cases will depend on the 

presence of population centers within a radius (of the explosion 

center) equal to the above distances (see Sec. 5.6). 

Generally, the hazard from propellant explosion decreases 

rapidly with time into flight, except for the first 10 to 25 

seconds. Activation of the Flight Termination System is likely 

to further reduce such explosion hazards by dispersing the 

5-25 
propellant. Typically, the FTS is not activated during the first 

8-12 seconds (depending on ELV, mission and site) in order to 

avoid damage to the pad facilities. This subject is discussed in 

more detail in Ch. 3, Vol. 1 and Ch. 10, Vol. 3.). 

5.3 DEBRIS HAZARDS 

A debris hazard exists even for a normal successful launch, 

primarily from jettisoned stages, shrouds and other components. 

These can be expected to impact within the impact limit 

boundaries of the flight corridor. The flight corridor is 

specified by applying safety considerations to the mission flight 

requirements, as discussed in Ch. 2, Vol. 1. Thus, hazards which 

cannot be eliminated are controlled. Since the launch facilities 

are located so that the vehicles will fly over largely 

uninhabited areas and oceans, the risks to third parties in 

normal operational situations are very low . 

A debris hazard also exists due to failure modes such as 

malfunction turns (from gradual to tumbling turns) and premature 

thrust termination (from an accidental subsystem failure, 

commanded thrust termination or commanded vehicle destruction). 

Debris may be created either from breakup of the vehicle due to 

excessive aerodynamic pressure or explosion (accidental or 

commanded destruct). Major issues in assessing debris hazards 

include: what is the number, weight and shape of fragments? 

Where will they land? What is their impact force upon landing? 

What is their impact in terms of structure penetration and 

lethality? 

Illustrative examples of debris data from selected space vehicle 

explosions and test data (occurring at or near ground level) are 

shown in Figure 5-7 and Figure 5-8. These figures show the total 

number and weight distributions of fragments (respectively) as a 

function of range (i.e., distance). These distances were 

determined by the forces of the explosions. 

Clearly, when a vehicle is in flight at significant altitude, the 

debris will land over a much larger area than in Figures 5-7 and 

5-8. The distribution of debris impacts is dependent upon the 

forces acting on the fragments. Initially, the velocity vector 

of the vehicle is of primary importance and this contribution is 

affected by the velocity vectors resulting from the turns, 

tumbling and/or explosions. Thereafter, the effects of the 

atmosphere on the fragments during free fall (which depend on 

wind and the fragment size, shape and mass) become important. 

These issues lead to uncertainties in the fragment impact 

distribution which can be attributed to four basic sources: 

(1) uncertainty in the vehicle state vector at vehicle 

breakup or destruct; 

5-26 
5-27 
5-28 
(2) uncertainty in any destruct velocity imparted to the 

fragment by a destruct system (or explosive failure); 

(3) uncertainty in the atmospheric environment during free 

fall; and 

(4) uncertainty in the fragment size, aerodynamic lift and 

drag. 

Furthermore, impacting launch vehicle fragments can be divided 

into four categories: 

(1) inert pieces of vehicle structure; 

(2) pieces of solid propellant (some of which may burn up 

during free fall); 

(3) vehicle structures which contain propellant (solid or 

liquid) that may continue to burn after landing (but are 

non-explosive). They pose the risk of starting secondary 

fires at the impact points; and 

(4) fragments which contain propellant and which can 

explode upon impact (if their impact velocity is greater 

than roughly 300 ft/s). 

The casualty area of an impacting fragment is the area about the 

fragment impact point within which a person would become a 

casualty. Casualties may result from a direct hit, from a 

bouncing fragment, from a collapsing structure resulting from an 

impact on a building or other shelter, from the overpressure 

pulse created by an explosive fragment, from a fire or toxic 

cloud produced by the fragment or some combination thereof. The 

hazard area is increased if a fragment has any significant 

horizontal velocity component at impact which could result in 

bouncing or other horizontal motion near ground level. 

Casualty area is also affected by the sheltering of people by 

structures. Structures may be divided into classes (for 

computational purposes) depending on the degree of protection 

they can afford. 

Clearly, estimating a casualty expectation is a complex 

computational problem. Different Ranges approach the problem in 

different ways depending on the needs of the Range. Computer 

models may be used, but the sophistication varies greatly from 

Range to Range. A computer model called LARA (Ref. 9) treats 

casualty areas analytically and is presented in other chapters 

(Vol. 2, Ch. 4, and Vol. 3, Ch. 10). 

5.4 FIRE HAZARDS 

The fire hazards of accidentally released solid and liquid 

propellants depend on the details of the accident scenario 

including: the thermodynamic state of the propellant, the amount 

5-29 
of the release, vehicle location and speed (on launch pad versus 

in flight), the presence of confining surfaces and ignition 

sources, etc. The major types of fires that can develop are: 

• Fireball: where burning occurs in a ball of fire that 

expands and rises in the air (due to buoyancy forces) 

until the propellant is consumed. 

• Pool fire: where a film of propellant is formed on the 

ground and burns with a flame attached to the film. 

• Vapor cloud fire: where ignition is delayed and vapors 

are carried away by prevailing winds, thus forming a 

flammable cloud that may ignite at a later time. 

• Various combinations of the above fires. 

These fires are discussed below. 

5.4.1 Fireballs 

Fireballs are produced when the propellant is quickly vaporized 

or atomized. These conditions include flash vaporization of 

pressurized liquids and releases during flight at high speed. 

The vapors or fine droplets can then rise under the effects of 

buoyancy as they burn in the fireball. 

The main damage mechanism is thermal radiation to people and 

property. Another damage mechanism is firebrands from burning 

solid propellants and hot debris which might start secondary 

fires where they land. A third damage mechanism is impact damage 

by vessel fragments which have been reported to travel large 

distances. Overpressure may also develop due to the initial high 

rate of energy release associated with vessel failure, but it is 

usually insignificant. 

The damage potential depends on key fireball parameters such as 

diameter, rise rate, duration and temperature or emissive power. 

These parameters have been quantified in several experimental and 

analytical studies.(1) In fact, the ball diameter was found to 

scale roughly with the 1/3 power of the weight of released 

propellant. 

The chemical composition of the products of combustion depend on 

the chemical composition of the propellants. The combustion 

products contain mainly water vapors and oxides of carbon and 

nitrogen. Thermal radiation emitted in the form of water vapor 

will be (partly) reduced by moisture absorption in the 

atmosphere. The transmitted radiation can impact people and 

structures. Table 5-6 shows critical radiation fluxes required 

to cause burn injury and start secondary fires (such as by 

igniting fuels placed inside and outside buildings). Note that 

as the exposure time increases, the required radiant flux 

decreases, as expected. 

5-30 
5-31 
5.4.2 Pool Fires 

Pool fires are produced when liquid propellants are accidentally 

spilled on the ground such as: 

• from a vehicle in pre-launch phase: this scenario is 

outside the scope of this study since its impact is not 

likely to extend outside the Range boundaries. 

• from ground operations such as propellant transport to 

the Range and storage, handling and transfer within the 

Range. In this case, the impact may occur outside the 

Range boundary. 

A spilled liquid will spread on the ground under the effect of 

gravity, filling small-scale crevices in a ground with surface 

roughness or large-scale depressions in an undulating terrain. 

While spreading, cryogenic propellants (such as liquid hydrogen 

and oxygen) will boil violently due to heat transfer from the 

relatively warm ground. A propellant at ambient temperature 

(such as RP-1) will evaporate more slowly. Some flash 

vaporization of cryogenic liquids will also occur because their 

vessels are usually maintained at slightly above atmospheric 

pressure. 

Ignition produces a pool fire with a flame base which spreads 

along with the liquid film and a flame height determined by the 

rate of evaporation and the rate of mixing of fuel and oxidizer. 

The overall character of such a pool fire is essentially a 

turbulent diffusion flame which may continue to expand on flat 

ground (or remains stationary if the liquid has accumulated in a 

depression area) until it runs out of fuel. 

The danger of pool fires consist of thermal radiation to people 

and property (as in the case of fireballs) and direct flame 

impingement on structures near the fire. 

5.4.3 Vapor Cloud Fires 

In the pool fire scenario described above, if: 

• the liquid pool does not ignite immediately after the 

release, because of lack of an ignition source; and 

• the released propellant has a high vapor pressure such 

as liquid hydrogen, oxygen, nitrogen, air or methane 

which boil due to heat transfer from the environment 

and not from a fire; 

5-32 
then, a large amount of vapor will be produced and transported by 

prevailing winds to form a vapor cloud. In this scenario, the 

resulting cloud is elongated in shape and is called a "plume". 

Its leading edge advances with the wind and its trailing edge is 

formed at the evaporating pool (the source of the vapors). As 

the leading edge moves further downwind, ambient air is entrained 

in the cloud, thus increasing its volume and decreasing the vapor 

concentration. This process is called atmospheric dispersion and 

is discussed further in the next section. 

If a flammable cloud encounters an ignition source, a fire will 

spread through the cloud, engulfing in flames whatever is 

contained in the cloud. This is referred to as a vapor cloud 

fire. Under some conditions (particularly the presence of 

obstructions or confinement in the cloud) overpressure can be 

produced, posing the added risk of mechanical damage. 

Alternatively, as the cloud disperses, the vapor concentration 

may drop below the flammable limit prior to encountering an 

ignition source. Thus, the hazard is dissipated without any 

adverse impact. 

5.5 TOXIC VAPOR CLOUDS 

The evaluation of the toxicity of any material is a very complex 

subject. Toxicity data are very sparse and questionable except 

for the common toxins. When available, they are usually for 

continuous exposures as one would find in a factory environment 

and not for the short exposures characteristic of launch 

operations. 

Still, the issue is of great interest because toxic materials may 

be released during ELV launches as combustion products, or in the 

event of an accident, as uncombusted propellants. The most 

notorious ones are hypergolic liquid propellants such as 

monomethyl hydrazine, Aerozine-50 and nitrogen tetroxide. 

Their chemical properties and toxic Threshold Limit Values (TLV) 

are listed in Appendix B along with other characteristics of 

interest. If such materials are released in the environment, 

they may be carried by the wind and travel windward as they 

disperse. This atmospheric dispersion is described below. 

5.5.1 Atmospheric Dispersion 

Over the years, the subject of atmospheric dispersion has been 

studied extensively in connection with air pollution studies from 

power plants and automotive vehicles. These studies addressed 

the case of continuous releases from normal operations where 

pollutant concentrations were monitored over long periods of 

time. 

5-33 
In this study, the interest is mainly in larger uncontrolled 

"instantaneous" releases (as would occur in an accident). Then, 

a large amount of potentially noxious vapor may be produced and 

transported by prevailing winds to form a vapor cloud. There are 

two main types of vapor clouds: 

• a "plume": an elongated cloud whose the leading edge 

travels with the wind, while the trailing edge remains 

stationary at the source of the vapors. Conditions 

which produce a plume are described in the preceding 

section; 

• a "puff": a more or less spherical cloud where both 

leading and trailing edges move together downwind. 

In reality, a combination of these two cloud geometries may 

occur, depending on accident conditions. 

As the cloud travels downwind, ambient air is entrained in the 

cloud; this increases its volume and decreases the vapor 

concentration. The process can be further complicated by 

chemical interactions among hypergolic vapors and between vapors 

and entrained air. 

Such cases of large "instantaneous" releases have also been 

studied experimentally. Large scale tests involving the spillage 

of large quantities of chemicals were carried out and 

concentrations were measured downwind. The most notable tests, 

carried out as part of national and international programs 

include:(21) 

(1) the liquefied natural gas (LNG) dispersion tests at the 

Naval Weapons Center, China Lake, California, for the 

US Department of Energy; 

(2) the ammonia spill tests at the above location for the 

Fertilizer Institute and the US Coast Guard; 

(3) the Porton Down tests in England involving the 

instantaneous release of Freon; 

(4) the heavy gas dispersion trials on behalf of the Health 

and Safety Executive of the British Government and 

other participants; and 

(5) the LNG spill tests conducted by Shell UK Ltd. at 

Maplin Sands, England. 

Based on such tests, it is recognized that cloud dispersion 

depends mainly on: 

5-34 
• ambient conditions such as wind, atmospheric stability 

and local terrain. 

• the buoyancy of the vapor cloud. It is important to 

determine whether the cloud is lighter or heavier than 

air because the former will disperse much faster than 

the latter. The presence of aerosols (fine droplets 

sprayed from the spilled liquid) increases the 

effective density of the cloud and modifies its 

dispersion characteristics. Also, cloud density may 

vary in space and time so that some portions may be 

lighter than air and others heavier. 

• the size and location of the release, i.e., whether it 

is on ground level (from an accident on the launch pad) 

or from an elevated altitude (from an accident in 

flight). 

There are several models in the literature describing the 

dispersion behavior of heavier-than-air gases under a wide range 

of conditions.(14 a, b, c) Models which discuss the dispersion of 

vapors released passively (as from a boiling pool of liquid) 

include Van Ulden,(15) Britter,(16) and Colenbrander.(17) There are 

also models in the air pollution literature dealing with release 

of neutral and positively buoyant vapors from stacks. 

In general, the dispersion of vapors in the far-field (after 

sufficient dilution) can be predicted with reasonable accuracy by 

the standard Gaussian models of Pasquill(18) and Gifford.(19) 

However, in the near-field, these models have to be modified to 

take into account the effects of initial gravitational spreading, 

jet mixing or the effects of aerosol evaporation.(20) 

5.5.2 Rocket Exhaust Products 

Most of the combustion products from rocket engines are harmless 

or unlikely to exist in concentrations which would affect the 

health and safety of third parties. These combustion products 

may include: 

• water and water vapors 

• nitrogen 

• hydrogen 

• carbon monoxide and dioxide 

• hydrogen chloride 

• aluminum oxide 

Of these combustion products, carbon monoxide and hydrogen 

chloride may be considered hazardous. Aluminum oxide is not 

toxic, but may contribute to certain lung diseases if exposure 

persists over time. The remaining combustion products are not 

5-35 
dangerous unless present in sufficient concentration to cause 

asphyxiation, which is not the case. Threshold Limit Values 

(TLV) for major combustion products are given in Table 5-7 for 

various exposure durations for both controlled (Range personnel) 

and uncontrolled (third party) populations. 

For illustration, Figure 5-9 shows results from a model using the 

NASA/MSFC (buoyant-rise, multilayer dispersion model of exhaust 

products) to compute peak instantaneous concentrations of 

hydrogen chloride as a function of downwind distances from the 

launch pad for sea breeze meteorological conditions and certain 

vehicle configurations. Also, Figure 5-9 shows the exposure 

criteria limit (as given in Table 5-7) for 10 minute-exposure of 

uncontrolled populations (third parties). Note that this limit 

is not exceeded at downwind distances of interest. In 1985, the 

Committee on Toxicology, Board on Toxicology and Environmental 

Health Hazards, Commission on Life Sciences, National Research 

Council published a document entitled "Emergency and Continuous 

Exposure Levels for Selected Airborne Contaminants," Volume V.(20a) 

This document updates recommendations for public exposure to the 

hydrazines and creates a new category, Short-term Public 

Emergency Guidance Levels (SPEGL's) for up to 24 hours for 

hydrazine propellants. The data in this document affects values 

for the uncontrolled population exposure to hydrazine shown in 

Table 5-7. 

5.5.3 Releases During Accident Conditions 

In the case of a near-pad explosion, all of the propellant is 

unlikely to be combusted. Thus, a vapor cloud containing vapors 

and aerosols of hydrazine, nitrogen tetroxide and hydrocarbon 

fuels might result. Other chemicals such as fuel additives and 

contaminants may also be present. These materials are toxic (see 

TLV values listed in Appendix B) and in high concentrations may 

cause adverse health effects, particularly if meteorological 

conditions at the time of the accident do not favor rapid 

dispersion to below toxic levels. 

The Titan 34 D explosion at WSMC of April 18, 1986, produced a 

vapor cloud containing toxic Aerozine-50 (Unsymmetric 

dimethylhydrazine and hydrazine blend) and nitrogen dioxide. 

There was no verified exposure of third parties to toxic 

concentrations exceeding established limits. However, reports 

indicate that doctors examined 74 people for possible exposure to 

the clouds and two were kept in the hospital for observation (see 

also Ch. 10). 

5-36 
5-37 
5-38 
Depending on their chemical properties (see Appendix B), 

accidentally released vapors may only be flammable (e.g., 

hydrogen) or also toxic (e.g., hydrazine and nitrogen tetroxide). 

The Threshold Limit Values (TLV) for exposure to various toxic 

propellants or their combustion products, shown in Table 5-7 and 

Appendix B, are on the order of 0.1-100 ppm, while typical 

flammability limits are on the order of 1-10% (i.e., 10,000-

100,000 ppm). Because the minimum vapor concentrations with 

toxic impacts are much below those required to sustain a flame, 

the potential size of a toxic cloud is much greater than that of 

a flammable cloud. Accordingly, for equal amounts of released 

propellants, the potential for toxic impacts is of greater 

concern than for fire damage. 

5.6 OFF-RANGE IMPACTS ASSOCIATED WITH ELV OPERATIONS 

This section presents a summary discussion of the potential offrange impacts associated with ELV operations (See Table 5-8). 

Potential ELV hazards were discussed in this chapter with no 

explicit mention of the associated probabilities. However, each 

hazard is tied to a particular probability value -- that of the 

occurrence of the enabling conditions. This fact should be 

remembered in assessing the significance of potential off-range 

impacts. The subject of assessing impacts from the perspective 

of both their magnitude and probability is referred to as Risk 

Analysis, and it, along with the various methods used to quantify 

risks, is discussed in detail in Chs. 8 and 9, Vol. 3. 

Illustrative examples of the application of Failure Analysis 

methods to space systems are given in Ch. 9, Vol 3. They are 

typically focused on a specific phase of launch operations and 

are rarely integrated, as is attempted (qualitatively) below. 

Examples of the results from such a preliminary hazard analysis 

are given in Table 5-8 for the main phases of ELV operations: 

pre-launch, launch and pre-orbital. As usually done, the failure 

types are classified in a manner compatible with the availability 

of data. For example, in Table 5-8, all failures leading to 

vehicle break up in flight,are lumped into one category for which 

a failure rate may be estimated based on historical data for each 

ELV. 

Hazard Analysis is then used to analyze the consequences of the 

types of accidents identified in Failure Analysis. These 

consequences include explosion, fire, toxic vapor clouds and 

inert debris. The principles of physics and chemistry are used, 

along with data from historical experience, testing and 

engineering judgment, to describe the hazards and potential 

impact severity. For example, the strength of an explosion or 

fire may be described and associated with potential damages 

5-39 
5-40 
(by overpressure or heat) to people and/or property. Estimates 

of the magnitude of the potential damage may be expressed in 

terms of an impact area (or footprint) surrounding the location 

of the accident. 

To do so, a range of possible accident circumstances have to be 

specified to allow a quantitative estimation. A further break 

down of the hazards in various ways may be needed to make the 

analysis tractable. For example, in Table 5-8, the hazards are 

divided into those (explosion, fireball and toxic releases) that 

may occur while the vehicle is in flight, versus those occurring 

when the vehicle or its fragments impact the ground. The breakdown of consequences in Table 5-8 varies with time during the 

launch phase. As time elapses after liftoff, the quantities of 

propellants on-board will decrease, thereby affecting their 

potential hazards. This was discussed in detail in Section 5.2.4 

for explosion hazards. 

Risk Analysis is finally used to describe (for a particular 

activity) both the probabilities of accidents and the possible 

damages or losses associated with them, accounting for 

uncertainties in the occurrence of the accidents and in the 

circumstances surrounding them. For example, there are 

uncertainties as to what accident is likely to occur at a 

particular location and how many people would be present at that 

location at the time of the accident. A set of circumstances is 

defined (scenario) and their probability is estimated. For each 

set, the results of the Failure Analysis (frequency of an 

accident) and Hazard Analysis (area of damage) are combined to 

estimate an expected damage (e.g., a number of people affected 

with a particular frequency per year or per event). The overall 

outcome of the analysis is a probability distribution function 

(PDF) for the potential damages that can be associated with a 

particular hazardous activity. An expected value for potential 

damage (e.g., casualty expectation, Ec) is often calculated from 

that probability distribution. 

Such expected casualty values have been estimated in an 

approximate manner for ELV-type vehicles, but only for a few 

specific scenarios involving inert debris hazards as shown in 

Table 5-8, namely: 

• inert debris risks during the first 10-70 sec of 

launch, with and without a Flight Termination 

System.(22) 

• inert debris risks during pre-orbital operation, 

with and without a Flight Termination System. 

5-41 
In Table 5-7, note that for the scenarios involving explosion, 

fire and toxic hazards, only a qualitative description of the 

potential off-range impacts is given because either their 

probabilities or magnitudes have not been quantified. These 

descriptions are given as footnotes in Table 5-8, to summarize 

key considerations in understanding these impacts and of their 

determining factors. 

5.7 PERSPECTIVES ON THE MAGNITUDE OF THE HAZARDS ASSOCIATED 

WITH ELV PROPELLANTS 

In the previous sections, the major hazards associated with ELV 

propellants were discussed. There are a number of hazards 

(explosions, debris, fires, toxic vapor clouds) each of which 

depend on a number of parameters such as propellant properties, 

quantity, mode of release, etc. Clearly, these hazards are very 

complex and multi-dimensional. In this section, a few reference 

points are provided to place these hazards in perspective 

compared to more familiar hazards. Only a partial perspective is 

provided because: 

(a) the focus here is on the magnitudes of these 

hazards and not on their probabilities or 

likelihood of occurrence. This is addressed in 

Chs. 9, 10, Vol. 3, where a more complete 

discussion of public risk perspectives is provided. 

(b) the comparison with other hazards is presented in a 

very simplified fashion, focusing only on selected 

dimensions of the hazards. 

In simple terms, concern with ELV propellant hazards can be 

attributed to the following factors: 

(1) rocket propellants are highly energetic fuels and 

most are inherently hazardous; 

(2) large quantities of propellants are involved in 

space launch operations; and 

(3) launch operations are inherently complex and have 

many potential failure modes. 

The following discussion places these concerns in their proper 

perspective. 

First, propellants such as liquid hydrogen, liquid oxygen and RP1 have been used extensively in the chemical industry. They have 

been processed, transported and stored for several decades with 

a remarkable safety record. Also, the chemical industry uses (on 

a daily basis) chemicals which are even more hazardous than ELV 

propellants, such as acetylene and ethylene oxide (which are 

5-42 
extremely explosive) and hydrogen chloride and hydrogen cyanide 

(which are extremely toxic). 

Selected key properties which affect the hazard potential of such 

chemicals are listed in Appendix B and in Table 5-9. Note that 

the range of propellant properties are sometimes exceeded by 

other chemicals. For example, the flammability limits of 

acetylene and ethylene oxide are wider than those of hydrogen. 

In addition, these two chemicals can react autocatalytically 

without the need for an oxidizer, if initiated by heat, pressure 

or shock. On the other hand, hydrogen requires oxygen to react. 

Generally, the broader the flammability range, the easier it is 

to create a fire or an explosion. Thus, these two chemicals are 

more likely to ignite than hydrogen. 

Second, the quantities of chemicals used in industry are often 

greater than those of propellants in ELV operations. This is 

illustrated in Table 5-10 which provides data for various space 

vehicles and for the storage and transportation of fairly common 

fuels such as LNG, LPG and gasoline. For each case, the table 

gives the total weight, heat of combustion per unit mass, and the 

total chemical energy. It also would have been desirable to 

provide the explosive (TNT) yield for each case. However, this 

would require the definition of a pertinent accident scenario for 

each (as was done in Sec. 5.2.4) and the estimation of a 

reasonable yield. 

In view of the lack of such data, instead the total chemical 

energy is used as a rough indication of the magnitude of the 

potential hazard which is reasonable for propellants and fuels. 

In terms of total chemical energy alone, three typical launch 

vehicles are approximately: 

• equivalent in order of magnitude to a gasoline truck or a 

rail tank car of LPG. 

• one order of magnitude smaller than a pressurized LPG 

sphere. 

• two orders of magnitude smaller than standard cryogenic 

tanks of LNG and LPG. 

• three orders of magnitude smaller than an LNG ship. 

Third, although ELV launch operations are inherently more 

intricate and complex than conventional chemical and transport 

operations, the safety precautions for ELV operations are far 

greater than those for other more common activities. For

example, launch sites are separated significantly from population 

centers while chemical plants and fuel tank farms are located 

within cities. 

5-43 
5-44 
5-45 
An additional perspective on the magnitude of the hazards of ELV 

propellants relative to other fuels and chemicals can be obtained 

by comparing their respective past accident data. This is 

presented below for explosion accidents. 

Data summarized in Table 5-11 involve major chemical process and 

transportation activities where the explosive yield was 40,000 

pounds of TNT or greater. The table provides a brief description 

of each accident, identifies the chemical involved, the 

approximate quantity released (pounds) and the TNT equivalent 

weight (reported by the accident investigators based on the 

observed damage at the location of the accident). The TNT 

equivalent weights ranged from 40,000 to 125,000 pounds, which is 

roughly the same order of magnitude as that estimated 

conservatively for worst case propellant accidents in Table 5-3. 

Unfortunately, similar historical data on space vehicle accidents 

may be restricted or classified and are not readily available in 

the open literature. The data found in the open literature are 

shown in Table 5-12 for large SRM explosions. No comparable data 

were found for liquid propellants. The reported TNT equivalent 

weights range from 9 to 42,000 pounds, a range lower than yields 

from industrial/transportation accidents and lower than the 

estimates for worst case propellant accidents in Table 5-3. 

Although the historical data and comparisons presented above are 

limited in scope and depth, they still suggest that the hazards 

anticipated from ELV propellants can be considered to be 

qualitatively similar in type and magnitude to those associated 

with comparable chemicals and fuels commonly used in chemical 

processing and transportation activities. 

5-46 
5-47 
5-48 
REFERENCES TO CHAPTER 5 

1. "Hazards of Chemical Rockets and Propellants," published 

by the Chemical Propulsion Information Agency, John 

Hopkins University, APL, Laurel, MD, September 1984. 

2. Willoughby, A.B. et al. "Liquid Propellant Explosive 

Hazards -Project PYRO," Vol. I, TR-68-92 and Vol. II, TR69-80, December 1968. 

3. Elwell, R.B., et al. "Project SOPHY - Solid Propellant 

Hazards Program," Technical Report AFRPL-TR-67-211, Vol. 

I and II, August 1967. 

4. "Explosives Safety Standards," AFR 127-100, Change 2, 

January 1985. 

5. "Ammunition and Explosives Safety Standards," DOD 6055.9 -

STD, July 1984. 

5a. "Space Propulsion Hazard Analysis Manual" (SPHAM) prepared 

for the Air Force Astronautics Laboratory. 

6. Kincaid, J.F. "The Determination of the Propensity for 

Detonation of High-Performance Propellants," A84-12984. 

7. Ullian, Louis J. "Detonability of Large Solid Rocket 

Motors," ESM/SEM Report #84-1, 10 August 1984. 

8. Swisdak, M.M. et al. "Solid Rocket Booster Command 

Destruct System Hazard Study," NSWC-TR-85-344; TR-85-346; 

TR-85-348; TR-85-350; TR-85-352, October 1985. 

9. Overbeck, K.B., R. D. Daniels and J. R. Westlake, "Model 

Concept and Development for VBLAST, the WSMC Blast 

Prediction Model," Report No. 83-3119- 1, J. H. Wiggins 

Co., Redondo Beach, CA, Oct. 1983. 

10. Riehl, W.A. "STS Blast Hazards Analysis." Preliminary 

Briefing (AA/OSTS) MSFC, Alabama. April 1979. 

11. Baeker, J.B., "Space Shuttle Range Safety Hazard 

Analysis," TR No. 81-1329 to NASA/KSC, July, 1981. 

12. Kokinakis, W. and R. Rudolph. "An Assessment of the 

Current State-of-the- Art of Incapacitation by Air Blast," 

Minutes of the Twentieth Explosives Safety Seminar, August 

1982. 

5-49 
13. Delta 392X Range Safety Flight Mechanics Destruct 

Analysis," MDC-H3398, May 1987, (see Table A-2, Delta 

3924). 

14. "Programmatic Environmental Assessment of Commercial 

Expendable Launch Vehicle Programs," US DOT, February 1986 

(updated from FEIS for NASA, Office of Space Science 

Launch Vehicle and Propulsion Programs, 1973). 

14a. "Atmospheric Transport and Diffusion Modelling," CPIA 

Publication 433, published by the Chemical Propulsion 

Information Agency, Johns Hopkins University, APL, laurel, 

MD. This Document contains the proceedings of a Safety 

and Environmental Workshop held 11-13 June 1985. 

15. Van Ulden, A.P. (1974), "On Spreading of a Heavy Gas 

Released Near the Ground," First Intl. Loss Prevention 

Symposium, The Haue/Delft, Elsevier, Amsterdam, p. 221-

226. 

16. Britter, R. (1979), "The Spread of Negatively Buoyant 

Plume in a Calm Environment," Atmospheric Environment, 13, 

9, p. 1241-1247. 

17. Colenbrander, G.W., "A Mathematical Model for the 

Transient Behavior of Dense Vapor Clouds," Loss Prevention 

and Safety Promotion in the Process Industries, 3rd Intl. 

Symposium, Basel, Switzerland 1980, p. 15/1104. 

18. Pasquill, F. (1974), Atmospheric Diffusion, Ellis Horwood 

Limited. 

19. Gifford, F.A. (1975), "Relative Atmospheric Diffusion of 

Smoke Puffs," Journal of Meteorology, 14, p. 410. 

20. Gugan, G. "Unconfined Vapor Cloud Explosions" Publisher: 

Institute of Chemical Engs., Rugby, Warks, England, 1979. 

20a. "Emergency and Continuous Exposure Levels for Selected 

Airborne Contaiminants," Volume V, the Committee on 

Toxicology, Board on Toxicology and Environmental Health 

Hazards, Commission on Life Sciences, National Research 

Council, National Academy Press, Wash. DC, 1985. 

21. Drake, E. M. and N.A. Moussa, "The Assessment of Crash 

Fire Hazard of Liquid Hydrogen Fueled Aircraft," Arthur 

D. Little Report for NASA/Lewis Research Center, NASA CR165526, February 1982. 

22. "Commercial Space Launch Determination -ESMC," RTI Draft 

Report for DOT/OCST, Dec. 1987. 

5-50 
10/2/95 rev 

6. ORBITAL COLLISION HAZARDS 

6.1 ORBITING SPACE OBJECTS 

It is important to estimate the hazards of on-orbit collisions 

between space objects because the US may be liable for any damage 

to a foreign country, or satellite caused by a US spacecraft. 

The latest NASA Satellite Situation Report lists 1,702 spacecraft 

in orbit and 5,130 large debris such as spent rocket stages and 

payload shrouds.(4) Expanding the count to include trackable 

debris, the tally was 18,145 cataloged space objects as of June 

30, 1987. Of these, 5,763 are from the US and 11,603 from the 

USSR. Of the total, approximately 7,000 are still in orbit (the 

rest have decayed and re-entered). Radar-trackable objects in 

space (i.e., larger than about 10 cm across) are monitored and 

cataloged by both the US Space Command (USSPACECOM). 

Considerably more objects and debris too small to be trackable 

are in orbit, as indicated in Figure 6-1.(1) Measurements using 

the USSPACECOM's Perimeter Acquisition Radar Attack 

Characterization System (PARCS), which is sensitive to objects of 

about 1 cm in size, yields the debris population shown in Figures 

6-2 and 6-3. The tracked population has increased steadily since 

the early 1970's, as shown by a comparison of the number of 

cataloged space objects between 1976 and 1986. 

During this period the tracked population has increased from 4100 

to 4700 objects, compared with an increase of 25 percent in 

launch activity over the same period. This reflects the dynamic 

nature existing between new and decaying objects in space. (see 

Ch.7) 

The 1986 Satellite Catalog (SATCAT) listed 16,660 entries, 

including all satellites launched in the last 30 years, their 

stages and trackable debris. However, only about 6000 of these 

objects are still in orbit, and about 44 percent of them 

originated from major on-orbit break ups (see Sec. 6.3.2).(4b, c) 

Satellites are currently being launched into space at a rate of 

approximately 150-200 per year.(5) Eight countries presently 

possess space launch capability and over 100 nation-states 

participate in international satellite communication programs.(5-6) 

The rate of new objects cataloged is higher than the number of 

payloads because it includes debris. There were 983, 843 and 458 

new objects cataloged during 1985, 1986 and 1987, respectively. 

More than 3,600 payloads have been launched into space since 

1957, but only 342 satellites were operational as of Sept., 1987, 

of which US operates 133, the USSR 148 and 13 other countries and 

international organizations, 61. Nearly half of this total are 

6-1 
6-2 
6-3 
6-4 
military satellites. By aggregate satellite mass, the Soviets 

account for 2/3 of the total.(4b, 33) The total mass now in Earth 

orbit exceeds 500 tons; each year about 800 additional tons are 

launched.(2) Active payloads comprise only 5 percent of all 

objects in space. The other 95 percent, including dead payloads, 

expendable launch stages and debris fragments are also monitored 

in case they pose re-entry hazards (Ch. 7). The mass/number 

balance of space objects decaying and re-entering Earth's 

atmosphere vs. those in long lived "deep space" orbits (periods 

longer than 225 min) and the projected annual influx of decaying 

space objects will also be discussed in Chapter 7.(2) 

The orbital collision hazards are under active consideration by 

several national agencies (NASA, DOD, DOS, DOT, DOC) and 

international organizations. 

The "Unispace 82" conference acknowledged the growing threat to 

space activities posed by accidental collisions in orbit. The 

magnitude of the current and projected collision hazards for lowEarth orbit (LEO) and geosynchronous orbits (GEO) is shown in 

Figures 6-2 and 6-3.(1-3) 

Several international agreements have been proposed, and are 

being considered to govern the orbital operation of satellites, 

disposal of inactive spacecraft and management of space debris. 

These agreements are limited primarily to the control of 

commercial communications satellites in geostationary orbits 

(GEO). Such agreements are motivated primarily by the need to 

prevent radio frequency interference between neighboring 

satellites, rather than to insure that collisions between 

satellites will not occur, given their relatively low spatial 

density. Depending on their orbital altitude and other 

parameters (inclination, eccentricity), mean orbital collision 

times for satellites range from a few years to as long as 1000 

years. However, since the population of space objects is 

increasing rapidly in LEO and GEO orbits of interest, and since 

on-orbit debris increase even more rapidly, crisis proportions 

could be reached after the year 2000 unless debris management 

policies and procedures are adopted soon. Already, in 1979, the 

Japanese satellite ECS-1 was lost by a collision in space with 

the third stage of its own launch vehicle, causing a multimillion 

dollar loss. 

Recent measurements and observations of satellite debris have 

indicated that the untracked man-made debris population in nearEarth and deep space orbits (of 1cm sizes in near-Earth and up to 

20 cm in deep-space and GEO orbits) far exceeds the number of 

USSPACECOM-tracked fragments. These would augment the near-Earth 

amount of tracked debris by a factor of 10 and the debris 

orbiting in deep space by 25-50 percent. The collision hazards 

6-5 
increase proportionately.(23) (see Secs 6.2 and 6.3) Although the 

tracked population of debris is increasing linearly (by 250-300 

objects per year), not exponentially as previously predicted, it 

already has exceeded the natural meteoroid background 

(Fig. 6-4).(1-3) 

6-6 
Untracked smaller debris appear to dominate collision encounters. 

Little data on the man-made debris flux are available on debris 

less than 4 centimeters in size (Fig.6-1). Objects below this 

size cannot be detected by Space Command's deep space tracking 

detection systems. GEODDS (The Ground-Based Electro-Optical Deep 

Space Surveillance System) however, is an expanding global 

network of tracking sensors which is continually being upgraded 

to aid in monitoring space assets.(13) 

Space hazards of interest to this analysis include: 

- Low Earth Orbit (LEO) Collisions (Secs. 6.4.1 and 6.4.2): 

• Collisions between two active spacecraft in LEO between 

200 km and 4000 km (120 miles and 2400 miles). 

• Collisions with both man-made and natural (meteoroids) 

objects in the near-Earth orbits. The hazard from manmade debris increases with time while the debris of the 

natural environment remains at a near constant level 

(Figures 6-2, 6-4). 

- Geosynchronous Earth Orbit (GEO) Collisions (Secs. 6.4.3 to 

6.4.5): 

• Collisions between active spacecraft and inactive 

spacecraft remaining in a geosynchronous orbit. This 

GEO "ring" is narrow in latitude and altitude bands, 

but spread over 360° in longitude (Fig.6-5). 

6-7 
The collisions may result from the accumulation of 

inactive spacecraft in the most desirable GEO orbits 

for communication satellites. 

• Collisions between two active spacecraft in 

geostationary orbit. These collisions can be prevented 

if collision avoidance procedures are invoked by ground 

control or by judicious orbital slot allocation. 

• Collisions between active spacecraft and spent orbital 

transfer stages in GTO or other debris in GTO and GEO. 

The probability of collision with objects in geotransfer orbit (GTO) is relatively small due to the 

short dwell and transit time of geo-transfer objects in 

the geosynchronous band (about 3% of their period). 

When considering objects large enough to damage most spacecraft, 

artificial debris, whose sources are discussed in Sec. 6.3, 

constitute the dominant threat.(2,3) Collisions involving 

artificial and meteoritic debris possess these differing 

characteristics: 

1) Collision hazards are proportional to the debris 

population densities, relative orbital velocities between 

colliding objects and the cross sectional area of the 

orbiting spacecraft. 

2) Large debris consist primarily of artificial objects, 

while small debris are dominated by natural meteoroids. 

3) Meteoritic debris remain at a relatively constant 

level, while the spatial density of man-made debris is 

increasing with time. 

4) Artificial debris populate circular orbits with rather 

low relative velocities, while meteoritic debris orbits are 

elliptical with larger relative velocities at collision. 

The average velocity of meteorites relative to spacecraft is 

roughly twice as large as that of man-made objects, namely 

14 km/s vs. 7 km/sec. However, cometary debris move in 

elliptical and sometimes retrograde orbits and can therefore 

reach 40-70 km/sec. relative impact velocities. 

6.2 SPACE LAW AND SPACE DEBRIS ISSUES 

6.2.1 The Regulatory Framework for Orbit Allocation and Space 

Debris 

Major international agencies that establish and implement space 

law, as it applies to communication and remote sensing 

satellites, include: 

• United Nations Committee on the Peaceful Uses of Outer 

6-8 
Space (COPUOS) 

• International Telecommunication Union (ITU) 

• International Telecommunications Satellite Organization 

(INTELSAT) 

• International Maritime Satellite Organization

(INMARSAT) 

COPUOS is the foremost entity of these agencies since the major 

space treaties in effect today have been negotiated under its 

auspices. The ITU is the principal agency that deals with 

regulatory matters pertaining to satellite communications. It

receives support from several other organizations, namely: 

• The International Radio Consultative Committee (IRCC) 

• The International Frequency Registration Board (FRB) 

• The International Telecommunications Satellite

Organization (INTELSAT) 

Of these organizations, the IRCC is the most likely to be 

involved with the problem of satellite collisions. Specific

groups have been established within the IRCC to study special 

subjects, primarily in the areas of space communications and 

interference problems. INTELSAT is dedicated to the

construction, deployment and operation of commercial

telecommunication satellites. 

A majority of nation-states must first endorse international 

treaties and regulations, in order for them to become effective. 

The implementation of such treaties requires all member states to 

abide by the dictates of the majority. Therefore, any proposal 

pertaining to on-orbit collision risk reduction and orbital 

debris management would require several years for discussion, 

consideration and ratification in an international forum. 

Presently, only communication satellites are assigned orbital and 

frequency windows through international agreements. Other

commercial, research and military missions go through a process 

of orbital parameter optimization prior to mission approval to 

avoid collisions during their useful life. These are simply 

registered with the UN by the launching state. USSPACECOM can 

identify space object fragmentation events and infer their 

probable cause: for example, if orbiting satellites cross in 

space and time disappear and the crossover point becomes strewn 

with debris, a mutual collision can be inferred. It is difficult 

to assign liability and to determine whether a collision

encounter on-orbit was accidental or intentional. The National 

Ranges, as well as NASA and the Satellite Surveillance Center 

(SSC) within USSPACECOM, usually perform COLA (COLlision

Avoidance at launch) to determine safe launch windows and COMBO 

(COmputation of Miss Between Orbits) screening runs for proposed 

missions to check the proposed orbits against cataloged orbits. 

A "point of closest approach" (PCA) is computed. If a risk 

6-9 
exists, orbital maneuvering capability or orbital parameter 

changes are provided. Hence, preplanning of missions avoids 

collisions with known and tracked space objects. While COLA is 

run routinely prior to launch, COMBO runs are complex and costly, 

so that orbital safety screening has been done only for select US 

Government missions. Smaller debris which cannot be radar 

tracked pose unpredictable hazards. "Rules of the road" for 

satellite close approaches are currently being considered to 

avoid international conflicts in space.(28-30) 

6.2.2 Orbital Debris Issues 

An assessment of collision hazards in space requires a study of 

collision probabilities between all objects in space including 

those of natural origin (i.e., meteoroids) as well as man-made 

objects (satellite and space debris). Orbital debris consist of: 

spent spacecraft, used rocket stages, separation devices, shrouds 

and fragments from accidental or deliberate explosions and 

collisions.(1-3) A major concern for future space activities is 

the possibility of generating a debris belt as a result of 

cumulative collisions between orbiting objects.(1-14) Several 

models, discussed below, have been developed to estimate 

quantitative collision hazards for spacecraft in both low earth 

orbit (LEO) and geostationary orbit (GEO) regimes.(15-20) Each of 

these models relates the collision hazard to the orbital 

population density and to the relative object velocity. 

Estimates of collision probabilities between spacecraft and 

debris in LEO and GEO show that, at present, this hazard is still 

small (1 in 1000 and 1 in 100,000 per year in orbit, 

respectively), but increasing rapidly (Figs. 6-2, 6-3). The 

threat of losing on-orbit satellites through collisions with 

other inactive satellites or orbiting debris is not yet critical, 

but is becoming increasingly serious. The more crowded regions 

of space which are optimal for man-rated systems (like the Space 

Station), larger satellites or those used for communications, 

remote sensing, navigation and surveillance missions are of most 

concern. 

Proposed space debris management options under consideration 

include the following:(4,13,24,31) 

• provide impact hardened shielding to new satellites, as 

well as added orbital maneuvering capability to avoid 

collisions; 

• require that extra fuel be provided to satellites 

inserted into more crowded space orbits to enable their 

transfer into either higher and longer lived "parking" 

orbits, or into lower decaying "disposal" orbits at 

the end of their life. International cooperation and 

agreement is needed to define such parking and disposal 

orbits; 

• undertake "space salvaging" operations to retrieve and 

6-10 
remove dead payloads from more crowded orbits. This 

"celestial trash can" could be ejected from the Solar 

System, injected into a Sun bound orbit or fitted with 

rockets for controlled re-entry to Earth. The latter 

would allow "disposal" by atmospheric burn-up, but 

would increase re-entry hazards (Ch. 7). 

6.3 ORIGIN OF ORBITING DEBRIS 

6.3.1 Hypervelocity Collisions 

Hypervelocity collisions in orbit can generate a significant 

number of debris particles which are too small to be observed, 

yet sufficiently large to inflict damage to any unhardened 

spacecraft. Uncertainty about the population of unobserved 

debris particles is the most important factor limiting an 

accurate assessment of space collision hazards (Figures 6-3,6-4). 

Ground based tests of hypervelocity impacts indicate that a 

single high speed collision in space could produce between 10,000 

and 1,000,000 pieces of debris. Table 6-1 provides estimates of 

the number of debris objects which could result from collisions 

between different size objects (7). 

6-11 
Verification of the results of high speed collisions in space is 

hampered by the difficulty in observing the small particles. 

Given the present tracking capability, it is difficult to 

differentiate between a fragmentation caused by a hypervelocity 

collision or an explosion.(4) There have been no confirmed 

instances of satellite damage due to high speed collisions with 

debris in space to date.(4) The subject of collision by-products 

is closely tied to the generation of the so-called "debris belt" 

which could result from cumulative collisions. While such a 

catastrophe would cause severe problems for future space 

ventures, it is not considered a likely consequence for many 

years to come. 

6.3.2 Explosions and Spacecraft Breakups 

Explosions and breakups of spent propulsion stages and spacecraft 

on-orbit (either spontaneous or collisional) are a major source 

of space debris (Figs. 6-6, 6-7 and 6-8). More than 90 known 

break ups have occurred in orbit, as of January, 1986.(2,3,7,13,14,21,22) 

For the 39 satellites known to have fragmented in orbit, 15% of 

the events are propulsion related, 40% were deliberate and the 

rest are due to unknown causes. Explosions, both inadvertent and 

intentional, represent the largest single source of space debris 

and account for approximately 60 percent of the tracked space 

objects. These are almost equally divided among non-operational 

payloads and remaining mission related expendable objects, such 

as rocket stages, shrouds, etc. Debris originating in one 

collision or explosion event will cluster in orbital parameters 

(inclination, eccentricity) so that locally, the probability of 

impacting an orbiter is much higher (Fig. 6-8). 

As of July 1982, 49 percent of the cataloged population had 

originated from a total of 44 break ups. In November 1986, an 

Ariane 3rd stage, launched nine months earlier, exploded and 

created a cloud of debris in polar orbit, centered at 490 mi. 

altitude, but spread as low as 270 mi. and as high as 840 mi. 

Ariane 3rd stages are known to have exploded on orbit at least 3 

times before this, as indicated by SPACECOM tracking data. On 

orbit explosions also have been associated with second and upper 

stages along with casings from Proton, Ariane, Delta, Titan, 

Atlas and Atlas/Centaur spent stages. There have been ten Delta 

2nd stage explosions in orbit prior to 1981, but none since 1982 

(see below). 

The increase in LEO hazard level caused by the explosions of 

several US ELV second stages in the early 80's (see Sec. 6-2) is 

less pronounced at elevations of 600 to 1200 km than in the 300 

km range because the relative debris level is lower at these 

altitudes. It is estimated that for an explosion which produces 

6-12 
6-13 
6-14 
500 fragments, the time between collisions involving one of these 

fragments would be about 50,000 years. 

Since 1986 steps have been taken to stop such explosions by 

venting all residual fuel in jettisoned 2nd and 3rd stages (i.e., 

fuel depletion burn). This residual fuel tended to explode upon 

thermal cycling and overpressurization due to solar heating, 

especially for sun-synchronous orbits. A recent change in 

operating procedures requires residual liquid fuel of spent 

second stages (and upper stages, if liquid fueled) to be vented 

to prevent and control on-orbit explosion generated debris. 

However, Ariane upper and transfer stages have exploded on-orbit 

6-15 
as recently as 1986 and 1987 since ESA has yet to adopt a venting 

policy. 

Ground simulated Atlas explosions, used as calibrations tests for 

fragmentation, produced about 1300 fragments. On September 20, 

1987, the Soviet satellite Cosmos 1769 (suspected to be nuclear 

powered) was intentionally destroyed on-orbit producing a cloud 

of debris at about 210 mi. altitude and 65o orbital inclination. 

Reference 25 lists past satellite breakups and the number of 

cataloged objects generated by the breakups. Extrapolating the 

number of on-orbit explosions and break ups, the SPACECOM catalog 

could expand by up to a factor of 10 in the next 20 years. 

6.3.3 Orbiting Nuclear Payloads 

Special on-orbit hazards are posed by the increasing number of 

nuclear power sources, both active reactors and passive fuel 

cells.(13,24) Therefore, approval of nuclear missions is subject 

to more rigorous risk assessments, planning and review by an 

Interagency Nuclear Safety Review Panel (INSRP). There are about 

50 potentially hazardous satellites in orbit today, carrying over 

1.3 tons of nuclear fuel, much in the form of long life toxic 

isotopes. These pose both on-orbit collision and re-entry 

hazards (see Ch. 7). The 48 radio-thermal generators (RTG) and 

fuel cores orbiting today are in the most crowded LEO region at 

about 1000 km altitude. Both US and Soviet satellites have 

exploded or spawned debris in this belt. However, since 90% of 

the Soviet nuclear material in RORSAT satellites has been 

intentionally ejected into higher orbits at 900-1000 km at 65o 

inclination, the hazards to population due to re-entry or 

possible ground impact have been removed. This procedure is 

intended to increase the orbital lifetime to more than 1,000 

years to allow sufficient time for the radioactivity to decay. 

The eventual retrieval and elimination of these materials is 

possible by sending them, for example, into escape orbits or into 

the Sun. Hypervelocity collisions with nuclear satellites and 

their fragments could endanger, contaminate and disable both 

manned and unmanned spacecraft with perigees well below 1000 km. 

6.4 ASSESSMENT OF COLLISION HAZARDS IN ORBIT 

6.4.1 Collision Hazard in LEO 

Low Earth Orbits generally include the altitude range of 200 km 

to 4000 km. This region has the largest spatial density 

(Number/km3

 -see Fig.6-1) of space objects, with a maximum of 

1.7 x 10-8 objects/km3 between 800 and 850 km and 2.5 x 10-8 

objects/km3 between 950-1000 km altitude. This corresponds to a 

mean time between collisions of 1/1800 years for a satellite with 

a cross section of 100 m2

, the size of the Soviet Mir Space 

6-16 
Station (Fig. 6-3). Figure 6-9 shows the observed population of 

satellites, as modified by the debris density. This density 

exhibits two maxima, one near 800 km (480 miles) altitude and the 

other near 1400 km (840 miles). The actual debris population is 

likely to be considerably larger than that shown in Figures 6-6, 

6-8 and 6-9. Decay of space objects, i.e., re-entry to Earth, 

occurs primarily from low altitude orbits and results from 

atmospheric drag which increases with the level of solar 

activity. A typical orbital lifetime at 300 km is less than one 

month; below 200 km, it is just a few days. These de-orbiting 

spacecraft will re-enter Earth's atmosphere and contribute to reentry hazards (see Ch. 7). 

6-17 
If the worldwide satellite population continues to increase at 

150-180 /year (as was the case for the past 5 years)(5) and all 

these objects penetrated the maximum density altitude band (950-

1000 km), the LEO spatial density would still not be expected to 

increase by a factor of 10 until between the years 2044 and 2100. 

Many Earth satellites (83%) which reside in LEO decay in orbit 

within a few days to several years. Solar flare and sunspot 

activity cycles periodically "purge" these orbits (see Refs. 

13,29 and Chs. 4,7). 

Inactive satellites, jettisoned rocket motors and launch or break 

up debris in LEO could undergo hypervelocity impacts (at 

10km/second) with active satellites in circular orbits and with 

others in elliptical orbits which traverse this altitude range. 

Launch activity is an important factor contributing to space 

hazards through the generation of man-made debris. Table 6-2 

shows the number of space launches since 1980 and the projected 

number of space launches anticipated in the next decade.(5,6,9) The 

current annual USSR space activity amounts to about 105 launches 

per year. The Soviet program accounts for roughly 95 % of the 

total, largely because the useful on-orbit life of Soviet 

satellites is much shorter than that of equivalent US spacecraft. 

6-18 
Figure 6-2 shows the relative flux distribution of meteorites and 

man-made objects in LEO. The meteorite flux data were based on 

indirect ground based measurements, including observation of 

meteors burning up in the atmosphere. The man-made flux data 

were taken from the 1986 Satellite Catalog of tracked space 

debris. 

6.4.2 Collision Probabilities in LEO 

Collision probabilities are useful in assessing space hazards, 

estimating collision hazards between operational spacecraft and 

orbiting objects quantitatively and determining the likelihood of 

satellite debris collisions. 

Models developed for deriving probability estimates usually use 

the following assumptions: 

• Objects in orbit are randomly distributed and each 

object is assigned an effective cross section. 

• The collision cross section is usually the geometric 

cross section of the satellite. 

• Orbital planes within the debris population have random 

distributions in the azimuthal coordinate. 

Several models based on kinetic theory and celestial mechanics 

provide estimates of collision hazards to operational spacecraft 

in LEO.(11,16,20) The impact probability, per orbit or per crossing 

a certain orbital torus, must be multiplied by the on-orbit 

satellite lifetime (or the mission duration) and the cross 

section of the object to estimate its overall collision risk. 

Probability derivations are simplified if the object density is 

assumed to have only an altitude dependence and all other 

dependencies are replaced by averages. While the latter removes 

the possibility of including angular orbital dependencies in the 

solution, it nevertheless provides a reasonably accurate estimate 

of the collision hazard. 

One procedure used to determine the altitude dependent object 

distribution is to define an Earth centered spherical grid, 

consisting of surfaces of constant radius spaced every 50 km from 

150 to 4000 km in altitude, and surfaces of constant polar angle 

(latitude) spaced every 5 degrees.(8) The object density within 

the above defined space cells is computed based on the percentage 

of time an object spends in the 'spherical cell.' Figure 6-2 is 

typical of the type of density distribution which results from 

this model. The mean rate of collision probability, P, is 

defined as, 

6-19 
where C(r,t) is the collision frequency equal to, 

C(r,t) = σeff·ρ(r,t)·v(r,t) 

Where: ρ = object density

σeff = effective cross section 

v = mean speed of object relative to debris 

r = object distance from Earth's center 

t = the elapsed time. 

Applying this to the example of the Shuttle Orbiter at 300 km 

altitude, with a debris distribution similar to that shown in 

Figure 6-2, gives a predicted time between collisions 

approximately equal to 25,000 years(8). These models estimate the 

collision probability for a Shuttle Orbiter at 150-300 km 

altitude to be roughly 1 in 25,000 years. The chance of an 

orbiter colliding with debris in LEO, over its lifetime, is about 

10-3 at present and may exceed 10-2 by the year 2000. The larger 

collision risk for spacecraft which operate in the 600 to 1200 km 

range of maximum debris population, is offset by the smaller 

cross sections of operational spacecraft at these altitudes. 

This result assumes a typical Shuttle cross sectional area of 

250 m2 and a relative impact velocity of 7 km/s. Man-made debris 

of size 4 cm and smaller do not present a significant hazard to 

LEO spacecraft with dimensions comparable to that of the Shuttle. 

A future Space Station 100 m across in LEO at a 500-550 km 

altitude, would have a mean life to collision of 170 years 

without debris, but of only 41 years given the present debris 

strewn near-Earth environment. 

Inclusion of the latitude dependence in the probability estimate 

yields similar results. Table 6-3 gives the predicted time 

between collision as a function of orbital inclination with the 

same LEO debris population used previously (see also Fig. 6-8). 

Greater debris hazards are anticipated for spacecraft operating 

at higher altitudes, particularly in the range from 600 to 1200 

km where debris density is greatest (Fig.6-2). Table 6-4 gives 

the estimated time between collisions for a small spacecraft, of 

5 m2

 collision cross section, with man-made debris assuming a 

relative speed of 7 km/s. There is evidence that some spacecraft 

in LEO have already collided with either natural or artificial 

orbiting debris. 

6-20 
6-21 
6.4.3 Collision Hazard in Geosynchronous Orbit (GEO) 

Conceptually, the geosynchronous orbits can be visualized as a 

spherical shell several kilometers thick located at an altitude 

approximately 36,000 km above the Earth. Spacecraft in 

geosynchronous orbit move with the rotating Earth at arbitrary 

angles of inclination with respect to the equator. The 

geostationary orbit represents a particular subclass of the 

geosynchronous orbits in which objects move synchronously with 

the rotating Earth, but with positions fixed relative to its 

rotating coordinate system. The geostationary ring denotes a 

particular region in geosynchronous space, of approximately 

several hundred kilometers in width, encompassing these orbits. 

The main characteristics of geosynchronous orbits are: 

• Orbital period is equal to one sidereal day (1436.2 

minutes or 24 hours). 

• An infinite variety of orbits exist each with the same 

average altitude as a geostationary orbit. 

• Objects in orbit cross the equator twice each day with 

average velocity of 3075 m/s. 

• The equatorial crossing point of the object drifts 

cyclically along the equator due to unbalanced Earth 

gravity. 

• Objects remain permanently in orbit (as in the 

geostationary ring). 

The main characteristics of geostationary orbits are: 

• Altitude above Earth is 35,787 km (19323 nautical 

miles) ± 50 km. 

• Orbit is exactly circular over the Earth's equator 

(± 10

 latitude). 

• Orbital period is 1436.2 minutes or roughly 24 hours. 

• Objects in orbit have an orbital velocity of 3075 m/s. 

• Objects remain permanently in orbit, i.e., the decay 

rate is very slow and secular, about 1 kilometer per 

thousand years. 

• Objects in orbit are subject to weak luni-solar and 

Earth gravitational perturbations which result in slow 

drift in east-west and north- south directions about 

the two geo-stable points at 75.3°E and 104.7°W 

longitude. This results in eventual clustering of 

inactive satellites in these regions. 

Semi-geosynchronous orbits (i.e., at half the GEO altitude with 

12 hour periods) are also used for communication satellites. 

Such highly elliptical "molnyia" (lightning) orbits are favored 

by the Soviets because the satellite spends most of its time 

above the Soviet Union moving slowly near apogee, but crosses 

6-22 
rapidly over antipodal regions near perigee. Such orbits degrade 

more rapidly due to atmospheric friction near perigee. 

The largest concentration of operational spacecraft lies in the 

geostationary belt and currently numbers over a hundred 

spacecraft. Extinct satellites also continue to orbit in the 

crowded GEO orbits, presenting a mounting collision damage hazard 

to new communication satellites (Fig. 6-3). Some nations and 

organizations have begun to move inactive satellites out of GEO 

to prevent cluttering of the GEO ring. However, according to 

Ref. 3 (Ch. 4), the removal of inactive satellites from GEO 

stations at the end of their useful life is not yet a general 

practice. The policy of using disposal orbits for defunct 

satellites has recognized shortcomings which may introduce new 

hazards to active payloads (e.g., the potential for misfire or 

explosion, eventual migration of "removed" payloads to GEO due to 

luni-solar perturbations and solar wind pressure, added cost for 

stationkeeping and orbital maneuvering propellants and decreasing 

reliability with life on- orbit.) 

The peak spatial density (number per km3

) of satellites at GEO 

altitudes (35,750 to 35,800 km) is due to about 543 satellites, 

of which only about 150 are geostationary. The others are in 

either geosynchronous, or semi-geosynchronous highly elliptical 

"molnyia" orbits. The corresponding spatial density value is 

7.55 x 10-10 objects, still 2-3 orders of magnitude below that in 

LEO. 

The current geosynchronous population, as tracked by USSPACECOM, 

consists of about 116 active communication satellites plus at 

least as many uncontrolled objects drifting through the 

geosynchronous corridor. The latter includes inactive satellites 

and debris which drift around the Earth or oscillate about the 

two geo-potential stable points. USSPACECOM can track an object 

of the size of a soccer ball in GEO and of about ò 10 cm. in LEO 

(Figs. 6-1, 6-4). Figure 6-10 shows the relative positions of 

the commercial communication satellites in GEO. The number of 

active GEO satellites over the past few years and the estimated 

number of GEO launches in the coming decade is shown in Fig. 6-10 

and Table 6-5.( 5,6) 

Thus, collisions in GEO are restricted to object encounters at a 

fixed altitude of approximately 36,000 km, actually an equatorial 

torus of 10

 in latitude and 35, 785 ±50 km altitude above the 

Earth's equator. Such collisions can involve both man-made 

objects and natural objects (meteoroids). 

6-23 
6-24 
Estimated collision probabilities with debris in GEO are of the 

order of 10-5 at present, but could reach 2x10-3 over the life of 

the satellite, (i.e. 1 in 500) by the year 2000. Therefore, at 

current GEO population levels, collision hazards do not appear to 

be a major problem.(1-4,9,17) The collision hazards in GEO tend to 

be lower than in LEO for the following reasons: 

(1) the lower spatial density of GEO satellites, although 

new communication satellites are increasingly crowding GEO 

orbits( Fig. 6-2); 

(2) the relative velocity difference between objects 

orbiting in GEO is less than for LEO; 

(3) most active spacecraft in GEO require accurate position 

control and station-keeping above their Earth subpoint, 

thereby reducing the likelihood of mutual collisions. 

These considerations, however, are offset by the limited orbital 

slots available in GEO and the steady increase in the number of 

GEO satellites launched each year (Fig.6-10). Also, meteoroids 

cross the GEO belt with high relative velocities, so their 

background collision hazard remains at a level comparable with 

that of LEO. An unknown factor is the amount of unmonitored 

debris in GEO, because objects at such high altitude are more 

difficult to detect and monitor with radar or optical telescopes. 

6-25 
A number of articles discuss the collision probabilities of 

satellites in GEO.(10-20) In general, the collision probability is 

a complicated function of orbital parameters, relative position, 

velocity, projected areas of the spacecraft and time. The 

collision probability, P, of satellite collisions assuming a 

uniform distribution of space objects is, 

P = A·ρ·v·t 

where: ρ= object density 

A= projected area of the satellite 

v= relative velocity of the target satellite 

t= time interval associated with the (periodic) 

satellite motion 

Takahashi(15) and Chobotov(11,16) have developed models for 

estimating collision probabilities for GEO satellites. Both 

models use the above relation as the basis for derivation of 

collision probabilities. Takahashi assumes the target satellite 

stays within fixed longitude/latitude bounds by appropriate 

station keeping. The satellite motion includes a small diurnal 

oscillations superimposed on a steady longitudinal drift. 

Maneuver corrections are applied every 15 days to maintain the 

satellite within the fixed longitudinal bound. 

The right hand side of Figure 6-5 illustrates the diurnal 

oscillation/drift motions assumed by Takahashi. The satellite 

orbital bounds were assumed to be 0.01o, 0.05o, and 2 km for the 

longitude, latitude and altitude respectively. 

If the orbital bounds for the diurnal motion are expressed in 

terms of increments in longitude Δ LON, latitude Δ LAT and 

altitude Δ ALT, the collision probability in three dimensions per 

orbit takes the form: 

P = N·(2∏R)·L2

·(ΔLON·ΔLAT·ΔALT)·(ΔLON+(2/∏)·ΔLAT+ ΔALT/R) 

where L is the satellite diameter. The incremental bounds Δ LON, 

Δ LAT and Δ ALT are set by the magnitude of the diurnal motions 

along the longitude, latitude, and radial coordinates which are 

assumed to be equal to 0.01o

, 0.05o and 2000 meters respectively. 

If an additional factor of 1/10 is introduced to account for the 

fact that collisions are only possible one out of every ten 

diurnal periods due to the longitudinal drift, then with these 

substitutions the above equation takes the form: 

P = 9.51 x 10-9 x L2

 per half day 

This yields a satellite collision probability of 7 x 10-6 x L2 per 

year. For satellites having dimensions typical for those used in 

space communications, i.e., L=2 meters, the probability of 

collisions in the geostationary orbit is extremely small. This 

changes when large space structures are considered, such as 

6-26 
proposed satellite "farms," solar power satellites or orbiting 

space platforms. For an orbiting satellite of dimensions 

approaching 125 meters, the annual likelihood of a collision is 

about one in ten. For a hypothetical satellite "farm" of 

dimensions of 1000 meters, the expected frequency of collision 

increases to approximately once every 52 days. 

The Chobotov approach considers the collision probability between 

geostationary satellites in circular orbits (in the equatorial 

plane) and geosynchronous satellites moving in an orbital plane 

with small inclination angle i and orbit eccentricity e. The 

satellite density, ρ, is proportional to the relative dwell time 

the satellite spends within a spatial volume defined by the 

following "bounds": 

Longitude bound = 2 ∏ R, Latitude bound = 2 R sin i, 

Altitude bound = 2 R e, 

where: R is the distance of satellite from Earth's center. 

For a geostationary satellite of radius Rs, the probability of 

collision, P, with another satellite in one revolution or a 24 

hour period is on the order of P = 2.83 x 10-13 Rs2 per day. 

For a population of over 200 satellites, assuming one satellite 

every 2o

 longitude, each with radius of 50 meters, the 

probability is 2.2 x 10-9 per day. Hence, the probability of a 

collision between a satellite in a circular geostationary orbit 

with other satellites in low inclination orbits is extremely 

small. 

This probability of a collision between a spacecraft and spent 

GEO transfer stages is approximately two orders of magnitude less 

than that between two active GEO spacecraft, because of to the 

relatively small percent of the time (approximately 3%) that an 

object in an elliptical GEO transfer orbit spends at 

geosynchronous altitudes. The semi-geosynchronous ("molnyia") 

orbits favored for Soviet communication satellites are highly 

elliptical with low perigees and high relative near-Earth 

velocities. 

To summarize, the low typical spatial densities in GEO of 2.5 -

7.5x10-10 objects/km3

, due to the roughly 550 objects which orbit 

in the 35, 750 + 50 km bin, combined with lower relative 

velocities in GEO and with typical station keeping capabilities, 

the probability of on-orbit collision is negligible at present(24). 

6.4.4 Gravitational Drift Forces in GEO 

Secular gravitational forces play an important role in altering 

the orbital characteristics of geosynchronous satellites. 

Depending on the point of origin of these forces, their effect on 

the orbit can be markedly different. These forces include the 

6-27 
gravitational forces associated with the Earth's oblateness and 

the gravitational attraction of the Moon and Sun.(26) 

The oblateness of the Earth (bulge in its in the equatorial 

plane) produces longitudinal drift forces in the east-west 

direction associated with the two geo-stable points located near 

104.7o

W and 75.3oE longitude. Without station-keeping capability, 

these forces cause GEO satellites to move in elliptic orbits in 

the longitudinal (and radial) direction with an oscillation 

period of about 820 days. Figure 6-11 shows a pictorial view of 

these drift oscillations.(27) The amplitude of excursion about 

these geo-stable points depends on the initial orbital departure 

from the geo-stable points, with the amplitude being zero for 

orbital paths that happen to cross the equator at the geo-stable 

points. 

6-28 
A second type of gravitational force is associated with the 

gravitational attraction of the Moon and Sun, which generate 

'drift' forces along the north-south direction. The latter 

forces act to alter the inclination of the geosynchronous orbit 

causing an initial change in orbital inclination of about 0.86o 

per year. A maximum inclination of 15o is achieved in about 27 

years at which point the inclination proceeds to decrease to zero 

in another 27 years. Superimposed on the above cyclical motions 

are small amplitude oscillations in the longitudinal and radial 

directions. These diurnal oscillations are characterized by a 

cyclic period of one (sidereal) day and have vastly smaller 

amplitudes (a factor of 106

 and 103, respectively) compared to the 

longitudinal and radial motions described previously. 

6.4.5 Collision Encounters in Geosynchronous Orbits 

While slot allocation of GEO satellites generally attempts to 

maintain a minimum separation of two degrees longitude, in 

practice several satellites may share a common longitudinal 

location. This has led to procedures developed by the United 

States Air Force Satellite Control Facility (USAFSCF), recently 

designated the Consolidated Space Test Center (CSTC), to monitor 

all close approaches between primary communication satellites and 

other trackable objects coming within 300 km of these satellites. 

Predictions are made for all close approaches every seven days 

and appropriate user agencies are notified when the separation 

distance approaches 50 km. Collision avoidance maneuvers are 

considered at 5-8 km separation and are implemented if near 

simultaneous tracking of both space objects one to two days 

before encounter (closest approach) verifies the predicted 

positions of the satellites as accurate. 

Typical data on geosynchronous orbit encounters over a 6 month 

period show that for 21 satellites examined there were 120 

predicted encounters within the 50 km minimum miss distance.(15-17) 

Of these, several were in the 1-5 km range and required collision 

avoidance actions. The mean distance of closest approach was 21 

km with a standard deviation of 13 km. Collision probabilities 

for these satellites were found to be up to two orders of 

magnitude greater than would be expected based on average density 

of objects in the geosynchronous corridor. 

A total of six fragmentation incidents have occurred in the 

geosynchronous corridor, which have been suggested by some to be 

the possible result of actual collisions. In at least one of 

these, the satellite broke up into smaller debris components. 

The question arises as to the potential liability of satellite 

owners and users for collision damage resulting when their 

spacecraft becomes inactive, remains in GEO, and collides with an 

active satellite. The accumulation of significant numbers of 

6-29 
inactive satellites in GEO poses increasing collision hazards for 

active satellites. Takahashi estimated this collision 

probability using the same method previously applied (see Sec. 

6.4.3) in the case of collisions between active satellites. 

Inactive satellites are assumed to have motion perturbations 

dictated by the Earth and by luni-solar gravitational/drift 

forces. Diurnal oscillations caused by the Earth's gravitational 

perturbations are superimposed on long-term (2-3 years) orbit 

evolution about one of two geo-stable points located at 75o

E and 

105o

W longitude. Figure 6-12 shows a sketch of the long-term 

orbital evolution relative to Earth fixed coordinates. An 

additional secular motion excursion occurs in the north-south 

direction, causing a latitude variation of ±14.7o

 in a 54-year 

period. 

6-30 
The collision probability is estimated by determining the 

likelihood of collision in one sidereal day of a satellite 

confined within geosynchronous bounds of 0.1o

 longitude, 7.35o 

latitude and a 30 km altitude range. The effect of the secular 

orbital oscillations is to reduce the collision probability by a 

factor of 1/900. The estimated collision probability between an 

active and 'N' abandoned satellites of dimension 'L' then 

becomes: 

P = 5.185 x 10-13 x N x L2

 per half day. 

This gives a probability of 6.0 x 10-6 per year for a collision 

between an active satellite and an assumed total of 1000 

abandoned satellites, each 4 meters diameter. 

If the active satellite is assumed to be a large space platform 

of 125 meters across, the probability of collision with an 

estimated 1000 inactive satellites in one year increases to: 

P = 730 x 5.185 x 10-13 x 1252

 x 1000 = 0.00591 per year 

Similarly, if a large solar power satellite with hypothetical 

dimensions of 1000 meters will be stationed in GEO, the collision 

probability in 1 year will become a sizeable 0.38 per year. 

Hence, large GEO satellite clusters or platforms will have a high 

probability for collisions, if the number of abandoned 

communication satellites is allowed to approach 1000. 

6-31 
REFERENCES TO CHAPTER 6 

1. Kessler, D.J. "Orbital Debris-Technical Issues", 

presentation to the USAF Scientific Advisory Board on 

Space Debris, Jan. 1987. 

2. a)Johnson, N.L. "Space Background Environment Assessment", 

Teledyne Brown Eng. Report for US Army Strategic Defense 

Command, Sept. 1986, CS86- USASDC-0022. 

b)"Special Report of the USAF Scientific Advisory Board Ad 

Hoc Committee on Current & Potential Technology to Protect 

AF Space Missions from Current and Future Debris-Draft, 

1987. (Appendix: "History and Projections of Foreign 

Satellite Mass to Earth Orbit".) 

3. Johnson, N. L. and D.S. McKnight, "Artificial Space 

Debris," (Orbit Book Co., Malabar, FL, 1987). 

4. a)NORAD, "Satellite Catalog", December 1986; 

b)USSPACECOM, Space Surveillance Center, "Satellite 

Catalog," Dec. 31, 1987. 

c)"What's Up in Space- Operational Satellites on the 

Anniversary of Sputnik 1", F.A.S. report, September, 1987. 

5. "Space Activities of the US, Soviet Union and Other 

Launching Countries:1957-1986," M.S. Smith, Congressional 

Research Service, Report 87-229 SPR, Feb. 1987. 

6. "International Cooperation and Competition in Civilian 

Space Activities," OTA-ISC-239, July 1985, OTA/US 

Congress. 

7. Fischer, N.H. and Reynolds, R.C., "Threat of Space 

Debris", 1984 IEEE Trans. on Aerospace & El. Systs., pp. 

397-406. 

8. Reynolds, R.C., Fischer, N.H., and Rice, E.E., "Man-Made 

Debris in Low Earth Orbit-A Threat to Future Space 

Operations", Journal of Spacecraft and Rockets, Vol. 20, 

No. 3, May/June 1983, pp. 279-285. 

9. Suddeth, D.H., "Debris in the Geostationary Orbit Ring -

The Endless Shooting Gallery - The Necessity for a 

Disposal Policy", Conference, 1986. 

10. Kessler, D.J., "Orbital Debris Issues," Advances in Space 

Research, Vol. 5, No. 2, 1985. 

11. Chobotov, V.A., "Collision Hazard in Space," Astronautics 

and Aeronautics, Vol. 17, No. 9, September 1980, pp. 38-

39. 

6-32 
12. Kessler, D.J., P.M. Landry, B.G. Cour-Palais and R.E. 

Taylor, "Collision Avoidance in Space," IEEE Spectrum, 

Vol. 17, No. 6, June 1980, pp. 37-41. 

13. W.B. Wirin, "The Sky is Falling: Managing Space Objects," 

Proceedings, IAF 35th Congress, Coll. on. Cooperation in 

Space, Intl. Inst. on Space Law, Oct. 1984, Lausanne, 

Switzerland (NY, AIAA, 1984), p. 152. 

14. J.A. Lovece, "The Impending Crisis of Space Debris," 

Astronomy, Aug. 1987, pp. 8-13. 

15. Takahashi, K., "Collision Between Satellites in Stationary 

Orbits," IEEE Transactions on Aerospace and Electronic 

Systems, AES-17, No. 4, July 1981. 

16. Chobotov, V.A., "On the Probability of Satellite 

Collisions in Earth Orbit," The Aerospace Corporation, 

TOR-0079(4071-07),.June 21, 1979. 

17. a)Hechler, M. and Vander Ha, J., "Probability of 

Collisions in the Geostationary Ring," Journal of 

Spacecraft, Vol. l8, No. 4, July/August 1981. 

b)Hechler,M., "Collision Probabilities at Geosynchronous 

Altitudes," Adv. Space Res. Vol. 5, pp. 47-57, 1985. 

18. Takahashi, K., "Applications of Space Development," XXXI 

International Astronautical Congress, Tokyo, 1980. 

19. Brooks, D.R., G.G. Gibson and T.D. Bess, "Predicting the 

Probability that Earth-Orbiting Spacecraft will Collide 

with Man-Made Objects in Space," Space Rescue & Safety, 

Vol. 37, 1974, pp. 79-139 (AAS74-185). 

20. Reynolds, R.C., Fischer, N.H., and Miller, L.A., 

"Collision Hazard Presented by Man-Made Debris Undergoing 

Correlated Motion," Space Rescue & Safety, Vol. 58, 1982 

(published in 1986, Univelt, San Diego, CA., pp. 11-30). 

21. Howell, I.A., "The Challenge of Space Surveillance" in Sky 

and Telescope, June 1987, pp. 584-588. 

22. Su, S-Y and D.J. Kessler, "Contribution of Explosion and 

Future Collision Fragments to the Orbital Debris Fragments 

to the Orbital Debris Environment," Adv. Space Res. 5, pp. 

25-34, 1985. 

23. Taff, L.G., "Satellite Debris: Recent Measurements," J. 

Spacecraft, Vol. 23, pp. 342-346, 1986. 

24. Johnson, N.L., "Nuclear Power Supplies in Orbit," Space 

Policy, Aug. 1987, pp. 223-233. 

6-33 
25. Gabbard, J., "History of Satellite Breakups in Space," 

Orbital Debris Workshop, Lyndon B. Johnson Space Center, 

Houston, Texas, pp. 30-38, July 82. 

26. Nacozy, P., "Inclined and Eccentric Geosynchronous 

Satellite Orbits," AIAA Paper 82-1412, 1982. 

27. Blitzer, L., "Effect of Ellipticity of the Equator on 24-

Hour Nearly Circular Satellite Orbits," Journal of 

Geophysical Research, Vol. 67, January 1962. 

28. "Space Station and the Law: Selected Legal Issues," OTA 

Background Paper, Aug. 1986. 

29. "Policy and Legal Issues Involved in the Commercialization 

of Space," S. Prt. 98-102 US Congress, 1983. 

30. Hosenball, S.N., "The Law Applicable to the Use of Space 

for Commercial Activities," AIAA Paper 83-0253, 1983. 

31. Schwetje , F.K. (USAF Chief of Space Law), "Space Law: 

The Legal Aspects of Space Debris Control and Space 

Salvage Operations"presented at Inter-American Bar Assoc. 

Mtg, Buenos Aires, Argentina, May 1987. 

32. "Satellite Situation Report," NASA/GSFC, Vol. 27, #3,Sept. 

30, 1987; #2, June 30, 1987; and Vol.26, #4, Dec.31, 1986. 

6-34 
10/2/95 rev 

7. RE-ENTRY HAZARDS 

7.1 DEFINITION AND NATURE OF RE-ENTRY 

Re-entry occurs when an orbiting spacecraft comes back into the 

Earth's atmosphere.(1) Any object placed in Earth orbit will 

eventually de-orbit and re-enter the atmosphere; this includes 

launch and breakup debris of satellites and spent rocket stages. 

Above 200 miles altitude, space is considered a perfect vacuum.(2) 

In reality, space is never a perfect vacuum and regardless of the 

orbital altitude of an object, it creates drag which eventually 

degrades the satellite's orbit. The solar wind and solar flares 

impinge on orbiting spacecraft and gravitational perturbations 

(both terrestrial and luni-solar) modify the spacecraft orbit and 

shorten its lifetime in space. The result is that spacecraft 

tend to spiral slowly towards the Earth's surface. When objects 

re-enter the atmosphere, their orbits decay rapidly and many of 

them burn up prior to impacting the Earth's surface. 

There are two different sets of conditions associated with either 

controlled or uncontrolled de-orbit to consider when evaluating 

risk from re-entering satellites and other space debris.(15,16) 

Controlled de-orbit usually applies to manned and reusable 

spacecraft which are designed to survive re-entry and be 

recovered. In this situation, retrorockets are fired at a 

scheduled time in order to place the vehicle into a transfer 

orbit which intersects the surface of the Earth. If the Earth 

had no atmosphere, the intercept point would be the intended 

impact point. With the atmosphere, however, the vehicle 

decelerates further and falls short of the predicted vacuum 

impact point. The impact point still can be predicted reasonably 

accurately under these conditions. Thus, the controlled de-orbit 

can be planned so the spacecraft will impact near a predetermined 

recovery point, minimizing the risk of inadvertent impacts on 

ships or ground and sea structures. 

There are three major sources of uncertainty associated with 

predicting uncontrolled re-entry characteristics, namely: the 

atmospheric conditions at the time an object begins to re-enter, 

the time of actual impact with the Earth's surface and the area 

in which the re-entering object will impact. These uncertainties 

associated with uncontrolled re-entry increase proportionately 

with the object's orbital altitude and on orbit lifetime. 

When an object has been orbiting for a period of time, a number 

of changes could have taken place over its lifetime. If the 

spacecraft failed in some way before it reached final orbit, its 

orbital parameters (inclination and eccentricity) could have 

changed. It may have strayed from its planned orbital path, 

failed to achieve final orbit or broken up in an explosion 

7-1 
causing pieces to disperse in different directions. All of these 

failure modes have a direct impact on the variables (surface 

area, mass, shape of fragments and orbital characteristics) used 

in the prediction of re-entry hazards. 

Small changes in orbital characteristics can drastically affect 

the manner of an object's passage through the atmosphere. The 

frictional heating and drag (deceleration) experienced in the 

atmosphere have large effects on the object. Small deviations 

from the predicted conditions of re-entry may result in large 

differences in re-entry hazards and the associated casualty 

expectation (see Section 7.6). These differences could be due to 

further break up caused by the shock of entering the atmosphere 

at high velocity, the burning and ablation (vaporization) 

experienced during re-entry or changes in direction or velocity 

due to the weather and wind conditions that slow re- entering 

fragments differentially at lower altitudes. 

7.2 ORBITAL DECAY 

The basic concepts of energy and angular momentum (see Ch. 4) can 

be used to answer most questions dealing with orbital and reentry trajectories. They are used to predict the initial reentry point and probable ground impact points. Orbiting 

satellites control their positions in space by using small rocket 

thrusters, thereby changing their velocity and direction. This 

process is called "station-keeping" and requires rocket fuel and 

special on board communications and control equipment. 

Therefore, it is possible, to some extent, to choose the initial 

atmospheric re-entry point when dealing with controlled reentry.(3) However, few satellites have the ability, capacity or 

life expectancy to provide the station-keeping capability towards 

the end of their life. 

All space objects that orbit the Earth do so because of the 

various forces acting on them. These forces change the position 

and velocity of the object relative to Earth in such a way that 

their orbital characteristics become very predictable. The 

Satellite Surveillance Center (SSC),US Space Command 

(USSPACECOM), within the Cheyenne Mountain Complex in Colorado, 

monitors each satellite's past and present positions and predicts 

its future using these various orbital characteristics and 

dynamic processes. To determine a satellite's position at any 

given time, the computer uses an algorithm based on the laws of 

Space Mechanics.(2,3,12) The computer can predict the orbital path 

of the object with the object's historical position and velocity 

information. The Space Surveillance Center (SSC) of the US Space 

Command processes tracking and monitoring data obtained by the 

Space Surveillance Network (SSN) to predict re-entries. Space 

debris of the more than 90 satellite collisions or spontaneous 

7-2 
break ups and 20 payload explosions in space have been documented 

to date (see also Chapter 6).(4,5,8) 

External perturbations due to the Earth's oblateness, the 

gravitational tugs of the Sun and Moon, the solar plasma storms 

and atmospheric friction cause long-term changes in the orbital 

parameters of satellites. These forces also affect the on orbit 

lifetime and re-entry. Theoretically, all forces acting on nearEarth satellites can affect a satellite's on orbit lifetime. The 

effects of solar storms on the atmosphere and the oblateness of 

the Earth have a much more significant effect than the 

gravitational attractions of the Sun, Moon and the other planets. 

NASA/Marshall scientists have taken these factors into account in 

designing an orbital lifetime prediction program. This program, 

called LIFTIM, uses a direct numerical integration of the time 

rates of change due to atmospheric drag using a Gauss-Legendre 

procedure in conjunction with the Jacchia atmosphere model.(6) 

An orbiting object loses energy through friction with space 

plasmas above the atmosphere so that it falls into a slightly 

lower orbit and eventually spirals towards the Earth's surface. 

As the object's potential energy, represented by its altitude, is 

converted to kinetic energy, its orbital velocity increases. As 

an object's orbital trajectory is brought closer to Earth, it 

speeds up and outpaces others in higher orbits. Thus, a 

satellite's orbital altitude decreases gradually while its 

orbital speed increases. Once it enters the upper reaches of the 

atmosphere, atmospheric drag will slow it down more rapidly and 

eventually cause it to fall to Earth.(4) 

Atmospheric drag, particularly near perigee, leads to the gradual 

de-orbit and re-entry of satellites. Satellites in LEO with less 

than 90 minute periods, corresponding to orbital altitudes of 

100-200 nmi (or 185-370 km), re-enter within a couple of months. 

Above about 245 nmi (455 km) orbital altitudes, orbital lifetimes 

exceed several years. Above about 500 nmi (900 km) altitudes 

orbital lifetimes can be as long as 500 years.(5) Figure 7-1(a & 

b) illustrate Earth orbit lifetimes of satellites as a function 

of drag and ballistic coefficients (see Section 7-3) for circular 

(e=0) and elliptical orbits with a range of altitudes. For 

elliptical orbits, the lower the perigee altitude, the higher is 

the apogee decay rate (P) and the shorter the on-orbit lifetime. 

7-3 
7-4 
7-5 
The ballistic coefficient á is equal to W/CDA, where W is the 

spacecraft weight, CD is the drag coefficient (which varies with 

shape) and A is the projected frontal area of the re-entering 

object. The more mass per unit area of the object, the greater 

the ballistic coefficient and the less the object will be 

consumed during its atmospheric crossing. The ballistic 

coefficient of a piece of debris is an important variable in the 

decay process as illustrated in Figure 7-1(a & b). A fragment 

with a large area and low mass (e.g., aluminum foil) has a low á 

and will decay much faster than a fragment with a small area and 

a high mass (e.g., a ball bearing) and will have a shorter 

orbital life. The combination of a variable atmosphere and 

unknown ballistic coefficients of spacecraft and launch and 

orbital debris make decay and re-entry prediction an inexact 

science at best.(7) 

An examination of 104 successful space launches of 1985 revealed 

that the payloads from no less than 47 had re-entered within a 

year of launch. As a rule of thumb, it is suggested that about 

70 percent of the annual mass put into orbit re-enters the 

atmosphere within 1 year of launch. Another 5 percent of the 

original annual mass may be expected to re-enter within 5 years 

from launch.(8) For example, from July 1 to October 1, 1987, of 

the 121 objects which de-orbited, 53 were payloads launched in 

that period.(17) 

USSPACECOM's SSC currently tracks about 7000 cataloged objects 

and may issue Tracking and Impact Prediction (TIP) messages which 

predict re-entry times and points of impact for about 500 reentries each year. For example, in 1979-1980, 900 new objects 

were cataloged, but the total tracked population decreased by 

300. The satellites were "purged" during the solar sunspot 

maximum which effectively increased the atmospheric density in 

LEO, thus, increasing orbital decay rates. Atmospheric drag is 

directly related to solar activity: High solar activity heats 

the upper atmosphere, increasing the atmospheric density by more 

than 10 times the average density at most satellite altitudes. 

This exerts a greater braking force on satellites and causes an 

above average number of objects to re-enter the atmosphere.(9) 

Thus, satellites decay in much greater numbers near Sunspot 

maximum than at a time of low solar activity (Figure 7-2).(10) 

Hence, the 11 year sunspot cycle is a periodic natural "sink", 

removing orbiting satellites from the near-Earth environment and 

thereby increasing re-entry hazards. 

7-6 
During the past 5 years there have been an annual average of 548 

decays from lower altitude orbits (i.e., about three satellites 

re-entering every 2 days). Almost 83 percent of Earth satellites 

reside in LEO orbits (see Chapter 6) with periods of less than 

225 min (about 4 hrs) and are near term re-entry candidates (see 

Figs.4-3 and 7-1). The total number of satellite decays per year 

is shown in Figure 7-3. (11) 

7-7 
7.3 RE-ENTRY SURVIVABILITY 

The information mentioned above would suffice to predict re-entry 

and ground impact points for spacecraft only if no other 

variables affected the re-entry process. In reality, the Earth's 

atmosphere, which is very sparse at high altitudes, interacts 

with the spacecraft. A vehicle approaching the Earth's 

atmosphere from space possesses a large amount of kinetic energy, 

due to its high relative velocity, and potential energy due to 

its orbital altitude above the Earth. When it encounters the 

7-8 
atmosphere, a shock wave forms ahead of the vehicle, heating the 

atmosphere in this region to very high temperatures. The high 

temperatures due to friction with atmosphere reduce the vehicle's 

velocity and convert the vehicle's potential energy into heat 

absorbed by the object and its wake. If the vehicle slows down 

quickly, the total amount of heat to be absorbed by the vehicle 

is reduced. This explains the blunt (high drag) shape of reentering spacecraft in the pre-shuttle manned space program. 

However, the total heat generated in the shock wave is still too 

great to be absorbed by metals which heat up and melt. 

Therefore, since it takes significantly more heat to vaporize 

material than to heat or melt it, materials used in heat shields 

were designed to ablate (vaporize) in the presence of the extreme 

temperatures. The net effect is that ablative protection allows 

objects to survive re-entry. 

If the total energy of the spacecraft were converted to heat, it 

would vaporize the vehicle. The survival of meteorites to ground 

impact is proof that not all of the energy is converted into 

heat, but enough is converted to cause surface ablation. 

Actually, a large portion of the total energy is diverted away 

from the vehicle. If the object conducted the heat away from the 

forward surface and the total body could absorb the heat of reentry without breaking up, then the object would re-enter the 

Earth's atmosphere and descend to Earth in a predictable way.(12) 

Heat shields and special shaping of forward surfaces are used to 

minimize frictional heating effects on the rockets and payloads 

during space launches, to protect them from heat and control 

ablation. 

Surface heating effects depend on the vehicle's shape, 

composition, altitude and velocity. For re-entry at small angles 

of inclination when the vehicle deceleration rate is small, the 

surface heating rate is correspondingly small. For re-entry at 

large angles of inclination where the vehicle decelerates rapidly 

in the atmosphere, the surface heating rate will be greater but 

the time spent in the atmosphere will be shorter.(3) 

Spacecraft which are not designed to survive re-entry generally 

do not have ablative surfaces nor are they very stable 

aerodynamically. The usual sequence of events in the re-entry 

process is as follows: 

1. As the vehicle starts to re-enter, heat is generated by the 

shock wave and a portion is absorbed by the surface of the 

structure. As the structure heats up thermal energy is 

radiated out at a significantly lower rate than it is being 

absorbed. 

2. The heated structure weakens and when the aerodynamic forces 

exceed its structural strength, it starts to come apart. 

7-9 
3. The heating process continues on the remaining parts of the 

structure, repeatedly breaking it up into still smaller 

pieces. 

4. These structural pieces continue to heat up and eventually 

melt and vaporize if there is sufficient temperature and 

time exposure. Some structural elements can survive if they 

are massive or were shielded from the heat by other parts of 

the structure. 

After the atmospheric re-entry point has been predicted, various 

other conditions must be taken into account to predict a ground 

impact point. Some of these conditions are orbital corrections 

due to frictional heating, break up due to atmospheric shock, 

drag and prevailing meteorological conditions. All of these 

factors are important when assessing the hazards from reentering objects to people and property.(12) 

7.4 RE-ENTRY IMPACT PREDICTION 

The ground trace of an orbit is the path over which the satellite 

orbits the Earth (see Figure 7-4). If there were a string 

between the center of the Earth and a satellite, the course 

marked by the intersection of the string with the surface of the 

Earth would be the trace of the orbit. Depending on the orbit, 

this ground trace could cover a large portion of the surface of 

the Earth (see Figure 7-5). If a satellite is tracked on a 

regular basis, it is possible to anticipate its approximate reentry time and make an approximate prediction of the impact 

point. However, this does not give control over the position of 

the impact point and impact prediction uncertainties are usually 

rather large (on the order of 10's to 100's of miles). 

One of the most critical factors in the re-entry process is the 

ballistic coefficient of the object, as discussed above. The 

ballistic coefficient is the ratio of gross weight to the drag 

coefficient multiplied by the reference area (W/CDA). The 

relationship between the ballistic coefficient and the orbital 

lifetime is also linear, as illustrated in Figure 7-1(a & b). 

Small particles tend to have shorter lifetimes at a given orbital 

altitude than larger ones. This has been observed in the case of 

solid rocket motor debris where measurements made shortly after 

motor firings have shown a rapid increase in debris levels, but 

relatively rapid decay of small debris. 

A second indirect confirming observation is the shape of the 

debris flux curve as a function of debris size.(13) 

(See Chapter 6). 

7-10 
7-11 
As a satellite re-enters the atmosphere it decelerates. As 

discussed above, the deceleration rate is a function of many 

variables: entry angle, lift to drag ratio (L/D), the ballistic 

coefficient, the orbital parameters, the Earth's rotation and 

oblateness, atmospheric density aberrations and winds. The entry 

angle and ballistic coefficient affect the chance that a 

satellite or debris object will survive re-entry and landing. 

The satellite may skip due to the lift caused by the object's 

angle of attack upon entering the atmosphere, each skip 

7-12 
associated with a change in velocity, speed and entry angle. As 

discussed in Chapter 4, every orbit has an angle of inclination, 

which along with the apogee and perigee, defines the trace of an 

orbit. 

During re-entry the original orbital inclination of the satellite 

remains relatively constant. This holds for the inclination 

angle of pieces of the satellite that return separately as well 

as pieces of a satellite which break up during re-entry. This 

near consistency holds because the magnitude of the orbital 

velocity in the inclination plane is very large. A vertical 

(radial) change in velocity does not change the orbital angle of 

inclination, but it changes the atmospheric entry angle (called 

radiant). A change in the velocity component perpendicular to 

the plane of the orbit may affect the angle of inclination, but 

the magnitude of this change is minor compared to the magnitude 

of the velocity in the orbital plane. 

7.5 IMPACT DISPERSIONS 

Most satellites to date have been inserted into orbit with little 

or no consideration given to their eventual re-entry. The 

primary reason for this is that re-entering satellites are not 

likely to result in hazardous impacts given that 2/3 of the 

Earth's surface area is covered by oceans. Most of the objects 

which re-enter are likely to fragment and burn up in the upper 

atmosphere and make only negligible changes in its chemical 

composition. Even if an object does survive, only one third of 

the Earth is land area and only a small portion of this land area 

is densely populated, so the chance of hitting a populated land 

area upon re-entry is relatively small. 

There is no standard way of computing impact dispersions 

currently. The calculations are two-fold. Estimates must be 

made for the number of pieces which will survive re-entry and the 

area over which each piece could cause damage, the "casualty 

area." For each piece of debris that will survive re- entry, a 

man-border area is added to the representative area of each 

incoming piece (see Volume 3, Chapter 10). The representative 

area is the maximum cross section area of the re-entering piece 

of debris. The man-border allowance is usually a ten inch 

addition in the radius to allow for the center of a person 

standing outside the actual impact radius but close enough to be 

hurt.(16) The splatter and rebound of fragments from hard ground 

impact must also be considered in these calculations. 

7.6 RE-ENTRY HAZARD ANALYSIS 

Most re-entering satellites and space debris are not controlled 

and the uncertainties of orbital decay are such that impact areas 

cannot be determined. Re-entry risk estimation generally assumes 

7-13 
that the satellite can impact anywhere on Earth between the 

maximum northern and southern latitudes associated with the 

inclination of the orbit (see Figure 7-4).(16) Uncontrolled reentry may be due to launch failures when the spacecraft fails to 

achieve final orbit, when the perigee/apogee kick motors 

malfunction and retain the satellite in a degradable transfer 

orbit or from second and upper stages jettisoned in orbit after 

burn out. 

The probability of a re-entering spacecraft and/or its fragments 

landing within a particular latitude band depends on both the 

orbital inclination and the latitude spread of the ground track. 

Satellites in orbit spend disproportionately more time within the 

1o wide band near the maximum latitudes. This is due to the 

change in direction of the satellite in this area, illustrated in 

the orbital ground trace of Figure 7-5, and is clearly visible in 

the probability distributions shown in Figure 7-6. In this 

figure the sharp peaks for each angle of inclination occur in a 

very small range around the latitude extremes. The probability 

of impacting within a specified longitude range is assumed to be 

uniform (equi-probability over 360o

 of longitude). A 

corresponding bivariate probability density can be constructed 

for the location of such random debris impact. This assumes that 

the satellite or debris from the satellite survive the 

aerodynamic heating of re-entry. Once the probability density for 

ground impact has been established, the distribution of 

population within the probable impact area must be considered, as 

shown in Figure 7-7.(15) In this figure the population 

distribution is combined for the northern and southern 

hemispheres as a matter of convenience. Although the population 

number and distribution has changed in the interim, the approach 

used in Fig. 7-7 is still valid.(15) An orbiting object will spend 

an equal amount of time, within a certain band width, on both the 

north and south sides of the equator. 

The casualty expectation is usually computed using the formula: 

Ec=Pi x (Population Density) x Ac 

Where Pi is the impact probability, the population density is the 

number of inhabitants per unit area, and Ac is the casualty area 

of the debris that survive to impact. Figure 7-8 presents an 

updated world-wide (average) casualty expectation, as a function 

of orbital inclination angle and debris impact casualty area.(19) 

In the example shown, a satellite in an orbit inclined at 26O, 

with debris having a casualty area of 100 sq. ft., will produce 

"on the average" 1.2 x 10-4 casualties upon re-entry.(15,19) This 

translates to one chance in 8333 of a casualty resulting from reentry of this satellite. This is due to the unpredictability of 

the impact area during uncontrolled re-entry as opposed to the 

localized casualty area during launch. 

7-14 
7-15 
7-16 
7-17 
With no control over the time and location of re-entry, impact 

(16,18) could occur in any country between the latitudes of ± 26O. 

Up to now, there have been no reported land impacts, damage 

and/or casualties by re-entry debris.(20) Roughly 100 of the 

approximately 3,100 objects resulting from 44 launches between 

1956-1972 have survived re-entry and were recovered.(20) 

Identified re-entry debris include such diverse items as: tank 

pieces, nozzle pieces, small spherical gas tanks, plastic shrouds 

and other fragments.(20) 

Particular re-entry hazards to the public are posed by orbiting 

nuclear payloads. Since 1961, both the US and the Soviet Union 

have launched nuclear power cells into space (See Table 7-1). 

While there have been no commercial payloads with nuclear 

materials, it is important to discuss generic re-entry hazards of 

this type. To date , such missions have required detailed risk 

analysis and interagency review. However, the US has launched 

passive, naturally decaying nuclear fuel cells, while the USSR 

has orbited RORSAT satellites with active nuclear reactors at 

relatively low altitudes in orbits which decay in a matter of 

days to weeks. Twenty eight such Soviet nuclear satellites were 

launched between 1967 and 1985, each carrying roughly 50 kg of 

U235. Of these, 26 have been transferred successfully into higher 

altitude parking orbits (over 900 km) at their end of duty to 

permit decay of radionuclides before re-entry. However, at least 

six have failed and undergone uncontrolled re-entry and 

atmospheric break up, one showering debris over N. Canada in 1978 

and two others over the Indian Ocean in 1983 and 1987. In 

contrast, the US nuclear fuel cells are designed to survive 

atmospheric re-entry and impacts. Three radio-isotope thermal 

generator (RTG) power supplies accidentally re-entered as a 

result of launch and/or orbital insertion failures (in 1964,1968 

and 1970); no undue public exposure to radioactivity resulted 

from any of these.(14) 

Although the possibility of a satellite landing in a populated 

area is small, the hazards are real and in certain instances, 

potentially very serious. Cosmos 954, the Soviet nuclear 

satellite that scattered nuclear debris over Canada upon re-entry 

and caused over $12 million in damages and cleanup costs is one 

example of a potentially serious re-entry hazard.(21) Fortunately, 

several other failed or deactivated Soviet RORSAT and US nuclear 

satellites have returned over oceans (Table 7-1). Issues related 

to re-entry hazards are currently under active re-examination and 

are undergoing research. 

7-18 
7-19 
REFERENCES TO CHAPTER 7 

1. a)Dictionary of Technical Terms for Aerospace Use, 1965 

b)Hazard, Hap, "US Space Launch Systems," Navy Space Systems 

(Report NSSA-R-20-72-2), 2nd Rev., 1977. 

2. "Space Flight and Re-entry Trajectories," Proc. 

International Symposium of International Academies of 

Astronautics and IAF, Louveciennes, June 1961 (Springer -

Verlag, 1962). 

3. Loh, W. H. T., Dynamics and Thermodynamics of Planetary 

Entry, Prentice Hall, Inc., Englewood Cliffs, NJ, 1963. 

4. a)Oberg, James E., "Eyes on the Sky," Air & Space, , 

April/May 1987. 

b)Howell, J. A., "The Challenge of Space Surveillance," Sky 

and Telescope, pp.584-588, June 1987. 

5. Johnson, N. L. and D.S. McKnight, "Artificial Space Debris," 

(Orbit Book Co., Malabar, FL, 1987). 

6. Alford, R.L., and J.J. Lin, "The Orbital Decay and Lifetime 

(LIFTIM) Prediction Program," Northrop Services, Inc. for 

NASA/Marshall, May 1974. 

7. Kling, R., "Evolution of an On-Orbit Debris Cloud," Adv. in 

Space Research, Vol.6, No.7, pp.99-108, 1986. 

8. Appendix on "History and Projections of Foreign Satellite 

Mass to Orbit," to Special Report of the USAF Scientific 

Advisory Board, Ad Hoc Committee on Current and Potential 

Technology to Protect AF Space Missions from Current and 

Future Debris, 1987. 

9. Kessler, D. J., "Orbital Debris Issues," NASA/Johnson Space 

Center, Houston, TX 77058, Adv. in Space Research Vol.5, No. 

2, pp.3-10, 1985. 

10. Schnel, L., "Probability of Collisions of Artificial Bodies 

in the Earth Environment," Adv in Space Research, Vol.5, 

No.2, pp.21-24, 1985. 

11. Johnson, N. L.,"Space Background Environment Assessment," 

Teledyne Brown Report CS86-USASDC-0022 for NASA/Johnson 

Space Center and US Army Strategic Defense Command, Sept. 

1986. 

7-20 
12. a)Loh, W. H. T., Re-entry and Planetary Entry Physics and 

Technology / 1, Springer-Verlag New York Inc., NY, 1968. 

b)De Lafontaine, J., "Orbital Decay in a Dynamic 

Atmosphere,"UTIAS- 244, Toronto University, Canada, 1979. 

c)Longuski, J.M., "Analytic Theory of Orbit Contraction and 

Ballistic Entry into Planetary Atmospheres," for NASA 

Langley Research Center, N 80-33448, by Jet Propulsion Lab, 

(JPL 80-58), Sept. 1980. 

13. Fischer, N. H. and Reynolds R. C., "Threat of Space Debris," 

Battelle Columbus Laboratories, 1984. 

14. Johnson, N.L., "Nuclear Power Supplies in Orbit," Space 

Policy, Aug 1986, pp.223-233. 

15. Burruss, J.M., and O.A. Refling, "Implementation of a Safety 

Policy Related to Random Re-entry Hazards," Aerospace 

Corporation (Report No. TOR-0158(3301)-1), Nov. 1967. 

16. a)Klapman, G., and J. Burruss, "Hazards Associated with 

Random Re-entry of Satellites Decaying from Orbit," 

Aerospace Corporation (Report No. TOR-1001(2301)-1), 

March 1967. 

b)Klapman, G., "Random Re-entry Hazard Calculations for 

Titan IIIC (STC) Flight Plans VIID and VIIE," Aerospace 

Corporation, Report No. TOR- 0059(6112-50)-5, June 1971. 

c)Burrus, J.M., "Generalized Random Re-entry Hazard 

Equations," Aerospace Corporation, Report No. TOR-0066(5301-

02)-1, Oct. 1971. 

17. "NASA Satellite Situation Report," the July 1 to Sept. 30, 

1987 Reporting Period, September 30, 1987. 

18. "Titan CELV/IUS Range Safety Flight Plan Approval Request," 

Martin Marietta, CTI-88-1035, June 1986. 

19. "Report of the Delta 181 Orbital Safety Review Committee," 

Dec. 1987. 

20. "Convention on International Liability for Damage Caused by 

Space Objects - Analysis and Background Data," May, 1972, 

Staff Report 75-871, Senate Comm. Aeronautical and Space 

Sciences, US Congress. 

7-21 
10/2/95 rev

 8. RISK ANALYSIS METHODOLOGY 

8.1 WHAT IS RISK ANALYSIS? 

Risk Analysis is the technical process and procedures for 

identifying, characterizing, quantifying and evaluating hazards. 

It is widely used in industry and by federal agencies to support 

regulatory and resource allocation decisions. The analysis of 

risk, also called Risk Assessment (see definitions of terms in 

Ch.1 and in the Glossary, App. A), consists of two distinct 

phases: a qualitative step of hazard identification, 

characterization and ranking; and a quantitative risk evaluation 

entailing estimation of the occurrence probabilities and the 

consequences of hazardous events, including catastrophic ones. 

Following the quantification of risk, appropriate Risk Management 

options can be devised and considered, risk/benefit or cost 

analysis may be undertaken and Risk Management policies may be 

formulated and implemented. The main goals of Risk Management 

are to prevent the occurrence of accidents by reducing the 

probability of their occurrence (e.g., practice risk avoidance), 

to reduce the impacts of uncontrollable accidents (e.g., prepare 

and adopt emergency responses) and to transfer risk (e.g., via 

insurance coverage). Most personnel safety and 

operational/handling precautions and requirements at hazardous 

facilities (and hardware design reviews and approval for plants 

and critical equipment) are intended to prevent, reduce the 

frequency or probability of occurrence of hazardous events and to 

minimize their potential impacts. 

Both normal operations and unforeseen conditions can lead to 

accidents which cannot be prevented or controlled. In such 

cases, the residual risk must be accepted and managed by 

preparing emergency response procedures (e.g., evacuation and 

medical response plans) to lessen the consequences of such 

accidents. Deterministic and worst case scenario analyses are 

often used to assess the scope and exposure impacts of improbable 

hazardous events with high consequences. 

Several recent reports have discussed the role of technical risk 

assessment inputs to regulatory analysis and policy decision 

making.(1-3) Since Risk Assessment is a field where safety and 

loss prevention are the chief concerns, conservatism at various 

steps in the analysis has often been adopted as a prudent 

approach. Thus, conservative assumptions have been compounded 

sometimes in setting unnecessarily stringent regulatory standards 

and requirements. In practice, excessive conservatism and use of 

"worst case" analysis has served as a basis for over-design of 

critical facilities, and over-regulation of industry by setting 

unnecessarily strict license and permit requirements.(4,5) Several 

mission Agencies (such as DOD, NASA, DOE, EPA, USBM, OSHA, NIH, 

8-1 
NRC) have developed their own risk analysis tools to carry out 

studies either in support of regulatory standards, criteria and 

policies or to enable safe operations. For the past few years, 

an Interagency Task Force for Risk Assessment, led by the NSF, 

has been working on uniform standards, to the extent possible and 

practical, for risk analysis methods and their use by federal 

Agencies charged with protecting the safety and health of the 

workers and the public. Some of these tools and approaches, 

whether developed specifically for space applications (Ch.9) or 

for licensing decisions (e.g., NRC regulations and studies),(8,15,16) 

are transferable to DOT/OCST for regulation and oversight of 

commercial launch activities. 

Risk Assessment provides the information necessary for Risk 

Management decisions. Risk Management, in a regulatory context, 

requires the evaluation of the impact and effectiveness of safety 

standards and regulations to impose additional controls or relax 

existing ones. 

8.2 RISK PERCEPTION AND RISK ACCEPTABILITY 

Subjective judgment and documented societal bias against low 

probability/high consequence events may influence the outcome of 

a risk analysis. Perceptions of risk often differ from objective 

measures and may distort or politicize Risk Management decisions 

and their implementation. Public polls indicate that societal 

perception of risk for certain unfamiliar or incorrectly 

publicized activities is far out of proportion to the actual 

damage or risk measure (by factors of 10-100 greater than reality 

for motor, rail and aviation accidents, but by factors of >10, 

000 for nuclear power and food coloring).(14) Risk conversion and 

compensating factors must often be applied to determine risk 

tolerance thresholds accurately to account for public bias 

against unfamiliar (x 10), catastrophic (x 30), involuntary 

(x 100), immediate vs. delayed consequence (x 30) and the 

uncontrollable (x 5-10) risk exposure.(17) 

Different risk standards often apply in the workplace, in view of 

voluntary risk exposure and indemnification for risk to exposed 

workers; as opposed to public risk exposure where stricter 

standards apply to involuntary exposure. The general guide to 

work place risk standards is that occupational risk should be 

small compared to natural sources of risk. Some industrial and 

voluntary risks may be further decreased by strict enforcement or 

adequate implementation of known risk management and risk 

avoidance measures (e.g., wear seat belts, stop drinking alcohol 

or smoking). Therefore, some of these risks are controllable by 

the individual (e.g., do not fly, take the car to work or smoke), 

while others are not (e.g., severe floods, earthquakes and 

tsunamis). 

8-2 
Relative Risk Assessment is a common method of ranking risk 

exposure levels which enables decision makers to define 

acceptable risk thresholds and the range for unacceptably high 

exposure that would require Risk Management resources for 

reduction and prevention. As Figure 8-1 and Table 8-1 

illustrate, there are de facto levels of socially tolerated 

(acceptable) levels of risk for either voluntary or involuntary 

exposure to a variety of hazardous factors and activities. 

Although regulators often strive to assess absolute levels of 

risk, the relative ranking of risks is an appropriate Risk 

Management strategy for resource allocation towards regulatory 

controls. Cost benefit analysis is often required to bring the 

burdens of risk control strategies to socially acceptable levels. 

Figure 8-1 and Tables 8-1 and 8-2 show estimated risk levels 

associated with natural and other (occupational, transportation, 

etc.) hazards that may lead to undesirable health effects and 

casualties. They show that risk levels vary greatly by causes of 

harm (chemical, mechanical, natural or man made), probability, 

degree of control, duration of exposure to the consequence 

(immediate, delayed, short or long-term), distribution 

(geographical, localized) in time and space, benefit to society 

vs. costs of risk reduction and consequence mitigation. 

Table 8-1 shows the relative risk exposure to individuals as a 

casualty probability from various natural and regulated causes.(19) 

This table and its precursors in the literature(6,17) illustrate 

that the public voluntarily assumes risk levels which are 100 to 

1,000 times larger than involuntary exposures to natural hazards 

and normal activities. These levels may be used as indicators of 

socially acceptable risk thresholds to compare when new 

regulatory standards are set. Note that risk exposure is 

normalized both to the population exposed and to the duration of 

the exposure. To compare the risk associated with each cause, 

consistent units must be used, such as fatalities or dollar loss 

per year, per 100,000 population, per event, per man year of 

exposure, etc. 

Issues related to acceptable risk thresholds for regulatory 

purposes and for the public at large are often complex and 

controversial.(1- 5,17,19) The typical approach to establish risk 

acceptance criteria for involuntary risks to the public has been 

that fatality rates from the activity of interest should never 

exceed average death rates from natural causes (about 0.07 per 

100,000 population, from all natural causes) and should be 

further lessened by risk control measures to the extent feasible 

and practical.(13) 

The societal benefit and the cost trade-offs for risk reduction 

are widely used guides to set and justify risk acceptability 

limits. By comparing the risks and benefits associated with 

certain regulated activities, fair, balanced and consistent 

8-3 
8-4 
8-5 
limits for risk acceptability may be set and institutional 

controls on risk may be established. Figure 8-1 is based on 

Ref.9: Starr's 1969 risk benefit analysis, which, although later 

challenged in the literature, illustrates several general trends 

derived from an analysis of fatalities per person hour of 

exposure to natural hazards and to hazardous human activities, in 

terms of dollar-equivalent benefit to society. It appears that 

voluntarily assumed risk levels are a factor of about 1,000 

higher than involuntary risk exposure levels over the entire 

range of benefits. Also, the acceptable risk curve appears to 

vary as the cube power of the benefit, on this log-normal scale. 

A typical regulatory risk threshold used to institute controls is 

the one-in-a-million casualty probability.(17) Situations at this 

threshold include: traveling 60 miles by car or 400 miles by air, 

two weeks of skiing, 1.5 weeks of factory work, 3 hours of work 

in a coal mine, smoking one cigarette, 1.5 minutes of rock 

climbing and 20 minutes of being a man aged 60. 

By analogy with other industries, in the case of space 

operations, Range personnel and commercial launch service firms 

may be considered voluntary risk takers, while the public at 

large is involuntarily exposed to launch and overflight risks. 

While Range Safety and on-site Range personnel are highly trained 

in risk avoidance and management, the public must be exposed to 

only minimal risk from commercial launch activities. 

There are clear but indirect public, economic and other societal 

benefits derived from commercial space operations, including 

efficient telephone and video communications, weather 

forecasting, remote environmental sensing and crop data, better 

drugs, advanced material fabrication, superior navigation 

capability and other technology spin-offs. Based on the risk 

comparability approach illustrated in Ch. 5 (Vol. 2) and the 

Range Safety controls and practices (Chs. 2, Vol. 1 and 9, 10), 

commercial launch activities appear to be well within the 

socially acceptable risk limits at this time. 

8.3 EXPECTED RISK VALUES AND RISK PROFILES 

There are two fundamental components of Risk Analysis: 

• Determination of the probability, Pi (or frequency of 

occurrence, fi), of an undesirable event, Ei. The 

probability of an event is its likelihood of occurrence 

or recurrence. Sometimes the probability estimates are 

generated from a detailed analysis of past experience 

and historical data available; sometimes they are 

judgmental estimates on the basis of an expert's view 

8-6 
of the situation or simply a best guess. This 

quantification of event probabilities can be useful, 

but the confidence in such estimates depends on the 

quality of the data base on actual failures and the 

methods used to determine event probabilities. 

Probabilities have long been used in the analysis of 

system reliability for complex equipment and facilities 

and to anticipate and control various failure 

scenarios. 

• Evaluation of the consequence, Ci, of this hazardous 

event: The choice of the type of consequence of 

interest may affect the acceptability threshold and the 

tolerance level for risk. 

The analytical phase of a Risk Analysis generally consists of 

three steps:(10) The triad: event (scenario), probability and 

consequence is sometimes called the "Risk Triplet." 

1. The qualitative step involves the selection of specific 

hazardous reference events Ei (hazard identification) 

or scenarios (chains of events) for quantitative 

analysis. 

2. The quantitative analysis requires the estimation of 

the probability of these events, Pi. 

3. The next quantification step is to estimate of the 

consequences of these events, Ci. 

The results of the analytical phase are used in the interpretive 

phase in which the various contributors to risk are compared, 

ranked and placed in perspective. This interpretive phase 

consists of: 

4. The calculation and graphic display of a Risk Profile 

based on individual failure event risks. The process 

is presented in Figure 8-2. 

5. The calculation of a total expected risk value (R) by 

summing individual event contributions to risk (Ri). 

Naturally, all the calculations undertaken involve some 

uncertainties, approximations and assumptions. Therefore, 

uncertainties must be considered explicitly. Using expected 

losses and the risk profile to evaluate the amount of investment 

that is reasonable to control risks, alternative Risk Management 

decisions involving avoidance (i.e. probability decrease) or 

consequence mitigation can be evaluated in terms that are useful 

to the decision maker. 

8-7 
8-8 
Therefore, a sixth planning step usually included in Risk 

Analysis is: 

6. The identification of cost effective Risk Management 

options, to be followed by: 

7. Adoption of a Risk Management policy and 

implementation. 

The analytical phase yields results in the general form suggested 

in Table 8-3. There are two useful ways to then interpret such 

results: expected risk values, Ri, and risk profiles. Both 

methods are employed for quantitative risk analysis. 

8-9 
Expected values are most useful when the consequences Ci are 

measured in financial terms or other directly measurable units. 

The expected risk value Ri (or expected loss) associated with 

event Ei is the product of its probability Pi and consequence 

values: 

R i= PixCi 

Thus, if the event occurs with probability 0.01 in a given year, 

and if the associated loss is one million dollars, then the 

expected loss is: 

Ri= 0.01 x $1,000,000 = $10,000 

Since this is the expected annual loss, the total expected loss 

over 20 years (assuming constant $) would be roughly $200,000. 

This assumes that the parameters do not vary significantly with 

time and ignores the low probability of multiple losses over the 

period. To obtain the total expected loss per year for a whole 

set of possible events, simply sum the individual expected 

losses: 

Total Risk, RT = PiCi+P2C2+ . . +PNCN = 

This expected risk value assumes that all events (Ei) 

contributing to risk exposure have equal weight. Occasionally, 

for risk decisions, value factors (weighting factors) are 

assigned to each event contributing to risk. The relative values 

of the terms associated with the different hazardous events give 

a useful measure of their relative importance and the total risk 

value can be interpreted as the average or "expected" level of 

loss to be experienced over a period of time. One particular way 

in which it is used is to compare it to the cost of eliminating 

or reducing risk (i.e., as part of the Risk Management strategy) 

in the context of cost/benefit analysis. Expected values of risk 

(R) are of prime importance in both business and in regulatory 

decision making under complex and uncertain situations. 

Based on the definition of expected values, if event E2 has ten 

times the consequences of event E1 but only one tenth the 

likelihood, then the products R1 = P1C1 and R2 = P2C2 are equal. 

That is, the events have the same expected level of risk. Thus, 

expected risk levels provide a balance of probabilities and 

consequences. In mathematical terms, the expected values may be 

8-10 
similar, but the low probability, high consequence event may be 

of greater concern.(11,12) For example, a company may be prepared 

to sustain a steady level of relatively small losses or 

accidents, but is concerned with guarding against truly 

catastrophic events. This is the motivation behind Risk 

Management, although, in all cases a range of consequences may be 

of interest. Determining the point estimates for best and worst 

case Ri will produce limiting values for the risk estimates and 

yield a band of uncertainty in risk level. 

A common way to interpret the values of probabilities and 

consequences of different hazardous events is by means of a Risk 

Profile. This displays the probability distribution for 

accidents and the range of their severity as a function of 

likelihood. If sufficient accident data exist, the cumulative 

probability distribution function is used as a Risk Profile to 

show the probability of damages at a given level or greater. 

Figure 8-3 shows an example of a hypothetical Risk Profile for 

commercial launch operations. A point (Pi, Ci) on the curve can 

be interpreted to mean there is a probability, Pi, of an accident 

with a consequence at least as large as Ci. Given a set of 

ordered pairs (Pi, Ci) obtained during the analytic phase of a 

risk study, the actual Risk Profile is computed using the laws of 

probabilities and combinatorial analysis. For actual cases, the 

risk profile is usually constructed by drawing the lowest 

decreasing curve so that all the points with C ≤ Ci are on or 

below it. The separate hazardous events with consequences Ci ≤ C 

are combined into a single event with a probability equal to the 

sum of their individual probability values (i.e., their 

cumulative probability). Then, the ordinate value Pi in Figures 

8-2 and 8-3 indicates the probability of an event, Ei, with a 

consequence as large as or exceeding Ci (C ≥ Ci). The 

acceptability ranges for risk must be determined and regulatory 

risk targets must be set consistent with these acceptable risk 

thresholds. These goals are often set according to ALAP (as low 

as practical), BAT (best available technology), BPT (best 

practical technology) or the cost of risk reduction.(17) The 

relative risk reduction achieved by various controls is also 

displayed on the Risk Profile to indicate the merit and 

effectiveness of potential regulatory risk reduction measures. 

8-11 
The frequency or the probability of the undesirable event (launch accidents) is 

plotted against the consequence magnitude of interest (potential public safety 

impacts such as dollar loss for property damage, casualty, insurance claims). The 

shape of the curve could be convex, rather than concave, or even discontinuous, 

depending on the scale and the data points available. Shaded area denotes defacto acceptable risk levels or design/operation safety goals based on 

established ELV launch practices at Government Ranges. 

8.4 IDENTIFICATION OF HAZARDS, PROBABILITY ESTIMATION AND 

CONSEQUENCE MODELING 

Fault tree (or event tree) analysis has been successfully applied 

in many technical fields to identify and logically order 

scenarios leading to equipment breakdown, financial loss or other 

system failures to be controlled (see section 8.7). Fault trees 

8-12 
have been applied occasionally to problems associated with space 

launches, mission planning and approval (Chapters 9 and 10). 

This results in an extensive set of analyses of the potential 

launch failure events and consequences. 

Consequences of observed or anticipated accidents are often 

modeled by extrapolation from small scale tests, limited 

observations, simulations and scoping calculations. The goal of 

quantitative risk assessment is not only to identify and rank 

hazards, but to analyze the low probability events of high 

consequence. This can focus corrective action, improve 

management of risk factors and optimize resource allocation. 

These extreme events are feared most by both public and 

regulators. They are often used as "worst case scenarios" or 

extreme "catastrophic" failures that serve as the basis for 

conservative design and regulatory requirements.(11,12) 

However, catastrophic failures are seldom observed. Therefore, 

their probability of occurrence and consequences are uncertain 

and difficult to quantify. The Three Mile Island nuclear reactor 

accident was this type of rare event. It occurred after 500 

reactor years without a significant accident, yet was 

qualitatively anticipated and approximated. A severe earthquake 

along the San Andreas Fault, with catastrophic impacts on the San 

Francisco Bay area, is another example of an anticipated hazard 

of low probability and high consequence that is difficult to 

predict and control. Future levels of risk are usually predicted 

by statistical analyses of relevant experience, although, a 

complete time series and representative sampling of hazardous 

events seldom exists. Predictions are often based on inference, 

event reconstruction, interpretation and extrapolation, rather 

than on observed events.(11) Because industry and regulators learn 

to improve safety and reduce risk based on prior experience, 

Bayesian statistics are sometimes used to reflect the decrease in 

the probability/frequency of hazardous events when "learning" 

improves the odds.(11,13) Alternative computational methods to 

infer a risk profile envelope have been developed (e.g., trend 

analysis) that include low probability, high consequence events, 

when the high consequence results from a number of intermediate 

events and the structure of such a composite event can be 

analyzed and quantified.(12) However, such predicted or composite 

risk profiles are often controversial, as is discussed in Chapter 

9, which reviews the application of Risk Assessment methods to 

space launch and orbiter systems and missions. 

8.5 UNCERTAINTIES AND RELIABILITY 

Risk Analysis is not an exact science. Despite this, it is 

widely used to support regulatory and industrial decision making 

and to allot resources. Risk analyses performed by different 

analysts on the same issue may lead to different results. The 

8-13 
reason is that there are substantial uncertainties intrinsic to 

risk assessments deriving from incomplete knowledge and 

identification of potential failures, from incorrect modeling 

assumptions used in the quantification of hazardous events or, 

more likely, from the variability in the possible type, time, 

place and circumstances of an accident. Different (and possibly 

incomplete) data bases and assumed failure rates of components 

may be used and thus lead to discrepancies in results. Different 

statistical analyses of the same data base may be justified by 

stated assumptions and lead to further discrepancies in results. 

Furthermore, the choice of a certain risk analysis methodology 

may influence, and even determine, the conclusions of the 

analyses. Judgments by experts evaluating and ranking the 

hazards, i.e. the Delphi approach, are often subjective. Hence, 

the risk analysis process has inherent limitations and 

uncertainties which must be taken into consideration in decision 

making. 

Tests to establish reliability of complex components or systems 

are usually expensive, making a minimum of tests desirable. On 

the other hand, true probabilities are based ideally on results 

from very large samples. When only a few items are tested, the 

results may not be truly representative. Tossing a normal coin 

two or three times may result in heads each time. This may lead 

to the erroneous assumption that the result will always be heads. 

The next three tosses may all be heads again, all tails or 

combinations of heads or tails. With more and more tests the 

average probability of a head (or tail) will be found to approach 

0.5. The problem then arises as to how much confidence can be 

placed on past results to predict future performance. The term 

confidence level is used for this purpose. Tables have been 

prepared to indicate the relationships between test results, 

reliability and confidence. One such table is shown below in 

abbreviated form (Table 8-4). 

Since there are residual uncertainties associated with the 

quantification of risk, confidence limits must be placed both on 

failure probabilities (usually 60%-90% brackets) to reflect this 

uncertainty. A 60 percent confidence interval means that there 

is a 60 percent chance that the actual failure rate falls within 

the range of given estimates. A 90 percent confidence limit 

means that there is a 90 percent chance that real events will 

fall within an estimated range. Confidence limits are based on 

observations: if no failures occurred in 1,000 trials, there are 

still three failures possible in the next 1,000. If 10,000 tests 

were successfully completed, that would statistically correspond 

to a probability of three failures in 10,000 events with 95 

percent confidence (i.e., a reliability of .9997). In addition, 

there may be large uncertainties in the consequence estimate, so 

that for any "best guess" point estimate, "worst case" and "best 

case" limits are needed. 

8-14 
Most assemblies and systems actually do not have constant failure 

rates, especially when the system does not have many components 

that are similar or have similar characteristics, such as large 

mechanical units. Instead of being exponential, the distribution 

of failures may be Gaussian, Weibull, gamma or log normal. The 

chief difference is in establishment of failure rates. Means of 

improving reliability as indicated above remain the same. Table 

8-4 is based on the simplest assumption of a binomial 

distribution, where the outcome of any trial can be either 

failure (F) or success (S), randomly occurring with the 

probability of .5 (like tossing coins for Head/Tail outcomes). 

8.6 RELIABILITY VERSUS SAFETY 

Reliability Analysis often provides useful inputs to quantitative 

safety analysis since failure rates (observed or design goals) 

for safety critical components and subsystems permit the 

evaluation and control of adverse safety impacts. Often, to 

8-15 
ensure safe operation, safeguards are incorporated into system 

engineering design, such as: redundant features; manual overrides 

for automatic components (valves, switches) which are safety 

critical and special quality assurance, acceptability and 

maintainability specifications. Space launch vehicles and 

payloads have been traditionally provided with redundancy in the 

in-flight destruct or other termination system and the flight 

control and communications subsystems (see Chapter 2, Vol.1). 

This ensures that a guidance failure or a failure in boost, 

sustainer or upper rocket stages will not lead to undesirable 

off-range risk exposure and that risk to the public will be 

avoided and controlled by the Range Safety Officer's ability to 

safely destroy the spacecraft on command. 

Reliability data on components and subsystems are essential to 

predicting performance. Table 8-5 shows as an example the 

estimated probability that a certain number of failures will 

occur in the next 20 tries for a hypothetical launch vehicle, 

based on assumed operational performance reliability figures in 

the range of historical values and on a skewed binomial 

distribution. (See also Ch.3, Vol. 1 for published reliability 

figures on commercial space vehicles.) 

8-16 
However, it must be noted that although reliability figures feed 

safety analyses directly, a highly reliable system is not 

necessarily safer. A key issue is the trade off between 

reliability and safety: adding sensors and control systems to 

detect malfunctions in a critical subsystem may enhance safety, 

but decrease the overall reliability. A stick of dynamite is an 

example of a highly reliable, but clearly unsafe object: when 

triggered intentionally or unintentionally, it will explode 

reliably. It is unsafe because of its high energy content, its 

explosive potential and its low trigger threshold. Safeguards 

may enhance handling safety, but decrease functional reliability. 

In favor of the reliability of simplicity, some engineers would 

trade the sophisticated injection pumps in modern rockets for 

simple gravity fed ("big dumb") rockets. 

Both human error and infrequent operational or accidental 

failures, can lead to catastrophic accidents with a low 

probability of occurrence and potentially high risk exposure. 

Indeed, in the case of space launch systems and operations, it is 

the low probability and high consequence event that would 

dominate the public risk exposure. The likelihood of occurrence 

and the public safety impacts of any accidental failure in such 

highly reliable subsystems and systems must be quantitatively 

assessed in order to appropriately define acceptable and expected 

levels of risk, and to regulate commercial space activities via 

the licensing process (see Chapters 9 and 10). 

Table 8-6 shows the kind of basic component failure rates which 

are used in probabilistic system failure computations. These 

apply to all mechanical and electrical systems across industries. 

Similarly, human error must often be factored into estimating 

probabilities of systems breakdown, since operator error or 

judgment errors in responding to minor failures can have major 

consequences. Table 8-7 shows that high stress work conditions 

lead to more frequent human error than routine functions and 

operations. Human failure rates are typically higher than 

equipment failure rates and may compound them because of improper 

or incomplete operator training in recognizing critical 

situations or because of panic/stress response to an accident. 

Considerable attention has been paid to human/ machine interfaces 

and to crisis training of personnel. The same considerations 

should apply in analyzing a launch "go/no go" decision, or a 

command destruct decision for a space system, as for a reactor 

operator or a flight controller in a busy airport tower. 

8-17 
8-18 
8.7 RISK ASSESSMENT METHODS 

The adoption of an appropriate analytical technique is important 

to any meaningful qualitative or quantitative failure and/or risk 

analysis. Each risk quantification method discussed and 

illustrated below has its own special merits, strengths, 

weaknesses and an optimal domain of application (see Table 8-8). 

Only if sufficient empirical and statistical data are available 

is the probabilistic modeling of hazardous events justified. For 

the very infrequent catastrophic event, a deterministic analysis 

of consequences (i.e., scoping calculations to estimate the type 

and magnitude of impacts assuming that the accident has 

occurred) may be sufficient in order to consider possible risk 

management (prevention and emergency response) and to estimate 

the associated sensitivity to assumptions. Deterministic 

consequence modeling of an unlikely catastrophic event is 

acceptable and even necessary whenever accident statistical and 

heuristic data available do not suffice to justify quantitative 

estimates for its occurrence and observation based scoping 

estimates for the magnitude of its consequences. 

8-19 
 

There are several inductive methods of risk analysis which assume 

a particular failure mode or failure initiating event. The 

effects on the system performance are then analyzed in order to 

infer the propagation of failures (failure chains) and to assess 

the sensitivity of the system operation to the postulated initial 

failures (bottom to top). The methods listed below focus 

primarily on hazard identification and on the probabilities of 

occurrence of hazardous events: 

Inductive risk analyses methods used in industry to determine 

what failed states are possible include: 

• The Preliminary Hazards Analysis (PHA) - This is the most 

general and qualitative identification and listing of 

potentially hazardous conditions, which is used to guide 

design, or the definition of procedural safeguards for 

controlling these. Often, PHA suffices to identify causal 

failure chains, possible safeguards and risk prevention 

options. 

The list of hazardous events to be prevented or controlled 

can be developed into subevents. PHA is usually carried out 

at an early stage of design and operations planning in order 

to allow both design and operational controls to be 

implemented in a cost-effective manner. Table 8-9 is an 

example of a Preliminary Hazard Analysis list of 

failures/malfunctions, used to identify safety critical 

failures and hazardous conditions and consequences, used to 

suggest risk control (prevention, reduction and avoidance) 

strategies. The PHA technique has been used primarily in 

the chemical and petroleum industries and in the design of 

critical facilities. 

The PHA, although chiefly an inductive method, can also be used 

in deductive analysis since it is primarily a systematic and 

hierarchical listing of failures, accidental events and 

circumstances leading to potentially catastrophic or major 

undesirable consequences. Such listing of failure events and 

their enabling conditions simulates closely and is complementary 

to a FTA (see below) since it permits the definition of hazardous 

chains of events and affords insight in the initiating (i.e., 

causal) factors enabling failure. The unlikely adverse end event 

can also be analyzed in terms of more probable subevents, down to 

the common minor failures in the domain of daily occurrences. 

8-20 
8-21 
• The Failure Mode and Effect Analysis (FMEA) - This is a more 

detailed analytical procedure, which is used to identify 

critical and non-critical failure modes. Single point 

(component) failures which can lead to system break down are 

thus identified and fixes, such as redundancies or 

operational bypass, are designed into the systems to prevent 

them. FMEA can be quantified if failure probabilities for 

components can be used to derive the percentage of failures 

by mode. Critical and non-critical effects are used for 

managing risk and preparing emergency response plans. 

• Failure Mode Effect and Criticality Analysis (FMECA) - This 

type of analysis is a more detailed variant of FMEA. It is 

used for system safety analysis, to enable detailed 

assessment and ranking of critical malfunctions and 

equipment failures and to devise assurances and controls to 

limit the impacts of such failures (i.e. risk management 

strategies). FMECA is usually a tabular listing of: 

identified faults, their potential effects, existing or 

required compensation and control procedures, and a summary 

of findings. 

• Fault Hazard Analysis (FHA) - This method is particularly 

useful for inter-organizational projects that require 

integration, tracking and accountability. It is typically 

used for space systems when numerous contractors design, 

test and certify various subsystems which must be integrated 

into a payload or a final launch system. FHA forms display 

in column format: the component identification by 

subsystem; a failure probability; all possible failure 

modes; the percent failures by mode; the effect of failures, 

up to subsystem interfaces; the identification of upstream 

components that initiate, command or control the failure and 

any secondary failure factors or environmental conditions to 

which the component is sensitive. 

• Event Tree Analysis (ETA) - This approach is equivalent to 

the qualitative part of Fault Tree Analysis (FTA, see below) 

and is used to display the likely propagation of failures in 

a system. Figure 8-4 is an example of an Event Tree which 

is used to isolate a failure propagation sequence and 

identify enabling conditions which can be controlled. Event 

trees are used in FMEA, FMECA and FTA and require 

identification of all failure initiating events. Figure 8-5 

is an example of an event tree for commercial space 

operational failures. 

8-22 
8-23 
8-24 
• Double Failure Matrix (DFM) - This method is used to 

list single vs. double subsystem failures, only after 

failure categorization by effects on the system have 

been completed. Namely, Fault Categories I-IV 

correspond to the severity of impacts on the system: 

I. negligible, II. marginal, III. critical and IV. 

catastrophic. Then, for each subsystem the component 

failures and the corresponding fault categories are 

listed in matrix form to determine how many ways a 

certain hazard category can occur (single and multiple 

failure modes). 

• Hazard and Operability Analysis (Haz-Op), or 

Operability Hazard Analysis (OHA) - This is another 

method of safety analysis widely applied in designing 

complex chemical facilities.(10) This procedure 

involves the examination of design, piping and 

instrument diagrams (P&ID) and operation flow charts in 

order to ask a "what if" question at each node. What 

would happen if a deviation from normal operations and 

design conditions occurs at this point (Figure 8-6)? 

8-25 
 

This method is equivalent to the FMEA analysis in the sense 

that it permits identification of critical failure 

initiators, single point failures, malfunction chains and 

their effects on other parts of the system propagation of 

failure. Design flaws that require safeguards to insure 

operability (double valves, bypass redundance logic, manual 

overrides, etc.) can thus be uncovered. This method is used 

both in pre-design and post-design analyses to achieve 

design verification, set acceptance criteria, meet 

objectives in system operation, provide procedural 

modifications to ensure safe operation and emplace 

monitoring of safety critical items. A Haz-Op variant is 

LAD (Loss Analysis Diagram), used to compare design options 

and determine the risk acceptability levels or safety 

margins in design. Similarly, contingency analysis is used 

as a complementary risk analysis method to Haz-Op, in order 

to manage risks, when loss of control or a critical accident 

occurs. 

In contrast to the above approaches, deductive risk analysis 

methods require reasoning from the general to the specific: A 

system failure is postulated and the subsystem failure modes 

leading to it are analyzed and broken down to the terminal or 

initiating failure event level ("top to bottom" or "top down" 

approach). Most accident investigations are of this type and are 

used to determine how a system failure can occur.(8) This 

includes: 

• The Fault Tree Analysis (FTA) Methodology for Hazard 

Assessment - The FTA technique is a logical method for 

display and analysis of the hierarchical linkage and 

propagation of failure events leading to the adverse end 

result, placed at the top of the "tree." Branches in this 

logic tree represent alternative failure paths leading to 

the stipulated end event and display interdependencies of 

failures. A staged fault tree (Figure 8-7) allows the 

definition of intermediate levels of the events and 

conditions that are necessary or enable failures to 

propagate to the top of the tree. The intermediate failure 

events may, in turn, result from the aggregation of lower 

level failures from system-level down to subsystems and 

component failures. The bottom levels display the failure 

initiating or tree terminal events. Critical factors and 

interrupt modes for failure chains can be identified and 

quantitatively examined. The nodes of the fault tree 

represent logic AND or OR gates. 

8-26 
8-27 
The AND gate represents the simultaneous occurrence of conditions 

or events necessary to result in failure propagation up the tree. 

An OR gate indicates that each individual failure event entering 

is capable of leading to higher level failures. Careful 

consideration must be given to the independence or mutual 

interdependence of events entering a particular logic gate to 

insure the correct use of joint and conditional probability 

concepts. 

In the case of ELV launch or orbital failures, a fault tree may 

be used to highlight single point (critical) failures and "common 

cause" (not independent) failures which must be "designed out" by 

redundancy or greater safety margins. Clever analysts use 

"exclusive OR gates," by defining mutually exclusive sets of 

failure events or aggregating lower level failure events into 

complementary groups to facilitate estimation of probability at 

each node of this event fault tree. FTA can be used both for 

qualitative, and for quantitative analysis of hazards. However, 

qualitative results must be combined with accurate failure rate 

data in order to achieve meaningful quantitative results. 

Assuming independence of failures, there are five "minimal cut 

sets," i.e., intersection of events, whose probabilities are 

added at OR gates (provided that individual failure probabilities 

are very small so that probability products are negligible 

compared to their sum), and multiplied at the AND gate. 

E1 = T + E2 = 

= T + (K2 + E3) = 

= T + K2 + (S·E4) = 

= T + K2 + S·(S1 + ES) = 

= T + K2 + (S·S1) + S·(K1 + R) = 

= T + K2 + (S·S1) + S·(K1 + S)·R 

The minimal cut sets are T, K2, S·S1, S·K1 and S·R (two singles 

and three doubles). The largest contribution to the 

probabilities will come from the single point failures T and 

K2 (critical failures), since the small probabilities of 

occurrence for the individual failure events, S, S1, K1 and R, 

the product of their probabilities will make a very small, and 

possibly negligible, contribution to the final event 

probability. Probabilities of simultaneous failures at AND 

gates necessary for a higher level failure to occur, may be 

multiplied in some approximations only if conditional 

probabilities for interdependent failures are subtracted and 

the correct dimensionality is preserved. Usually, 

probabilities of independent events at OR gates are added, if 

P<1. Correct dimensionality must be observed for all types of 

logic gates.(8) 

8-28 
Each branch of a failure event tree must be quantified in a 

consistent manner using either frequency units (1/time 

dimensions, rate per year, per hour or per event) or normalized 

dimensionless probabilities. By using observed or 

projected/expected values for the frequency or probability of 

various failure modes and by analyzing how they occur, the 

likelihood of each hazardous event can be quantified. Risk is 

the product of this probability (or frequency) by the 

consequence magnitude of the undesirable event. The correct 

probabilistic dependencies (conditional, joint, mutually 

exclusive) for the occurrence of failure events of the lower 

branches permit their quantitative aggregation at gates and up 

the tree. References 1, 3, 7, 8 and 10 discuss and illustrate 

the application, use and practice of FTA and other 

Probabilistic Risk Analysis (PRA) methods, such as FMEA, in 

industry and Government. 

The NRC and DOE have made extensive use of PRA in analyzing, 

licensing and regulating the operation of nuclear power plants; 

in prioritizing generic nuclear industry, transportation and 

waste disposal safety issues and in performing environmental 

impact analyses.(14-16) DOD has also used PRA to develop and test 

nuclear weapon systems. PRA is a comprehensive and integrated 

analysis of failures capable of revealing their 

interrelationship and their likelihood. Thus, in spite of its 

uncertainties, high cost, effort and limitations, PRA has 

proven useful to regulators of technological risk both to 

highlight gaps in knowledge and areas of research need and in 

directing the industry and regulatory efforts towards redress 

of high leverage safety problems. PRA's have aided in 

formulating safety goals, criteria and defining risk 

acceptability levels and numerical compliance targets for 

industry. 

8-29 
REFERENCES TO CHAPTER 8 

1. "A Review of Risk Assessment Methodologies" - Report by 

the Congressional Research Service (CRS), Comm. on Sci. 

and Technology, Comm. Print 98-929 (1983) 

2. "Risk Assessment in the Federal Government: Managing the 

Process," NAS (1983) 

3. "Risk Assessment and Risk Management: Framework for 

Decision making," EPA Policy Paper, 1984; also "Science, 

Risk and Public Policy," W.D. Ruckelshaus, Science 221. 

1026 (1983). 

4. "The Perils of Prudence," A. L. Nichols and R. J. 

Zeckhauser, in "Regulation," Nov/Dec 1986, p. 13 et ag. 

5. "The Dangers of Caution: Conservatism in Assessment and 

Management of Risk," A. L. Nichols & R. J. Zeckhauser, p. 

5-582 in Advances in Appl. Micro- Economics, Vol. 4 on 

"Risk, Uncertainty and the Value of Benefits and Costs." 

6. "Product Safety Management and Engineering," Willie 

Hammer, Prentice Hall Intl., 1980. 

7. "System Safety Engineering and Management," H. E. Roland 

and B. Moriarty, J. Wiley & Sons, 1983. 

8. "Fault Tree Handbook," NUREG-0492, Jan. 1981, Vesely, W., 

et. al. 

9. "Social Benefits vs. Technological Risk," Chauncey Starr, 

Science 165, 1232 (Sept. 19, 1969). 

10. "Hazard Identification and Quantification," H. Ozog and L. 

M. Bendixen, Chemical Engineering Progress, April 1987, p. 

55-64. 

11. "Inferences from Alarming Events," J. W. Pratt and R. J. 

Zeckhauser, J. Policy Analysis and Mgt., 1, 321 (1982). 

12. "Computing Risk Profiles for Composite Low Probabilty High 

Consequence Events," D. J. Heimann and T. S. Glickman, 

Annals of Operations Res. (1987), 9, 545-560 (1987) in 

"Statistical and Computational Issues in Probability 

Modeling II, (eds. S. L. Albin and C. M. Harris). 

13. "Review of RTG Utilization in Space Missions," Hearing, 

House Comm. on Sci. & Tech., March 4, 1986 (Rept. # 97), 

see Testimony and Appendices (esp. pp. 252, 280, et seq.). 

8-30 
14. "Risk Management Guide", G.J. Briscoe, EG&G, Idaho, for 

DOE, DOE/SSDC-76- 45/11- Rev.1, Sept. 1982. 

15. "Probabilistic Risk Assessment (PRA) Reference Document," 

NRC, NUREG- 1050-F, Sept. 1984. 

16. "PRA Procedures Guide- A guide for the Performance of 

Probabilistic risk assessments for Nuclear power plants," 

NRC, NUREG-CR-2300, 1981. 

17. "An Anatomy of Risk," W.D. Rowe,J.Wiley and Sons, New 

York, 1977; Second Ed., 1986. 

18. "Methodologies for Hazard Analysis and Risk Assessment in 

the Petroleum Refining and Storage Industry," Concawe, 

Report 10-82, 1982. 

19. "Regulatory Program of the US Government, April 1, 1986 -

March 31, 1987," Exec. Off. of the President, OMB, (p. xx, 

T.2). 

8-31 
10/2/95 rev 

9. APPLICATIONS OF RISK ANALYSIS TO SPACE LAUNCH

OPERATIONS 

9.1 LAUNCH RISK ANALYSIS OBJECTIVES 

Risk Analysis is not an end in itself, but rather a means to 

accomplish other goals: the identification of hazards and the 

assessment and quantification of risk provide insight to the 

overall acceptability of a program, such a commercial space 

launch campaign, from operational, regulatory or societal 

viewpoints. If the associated risk level appears unacceptably 

high to the public agency sponsoring or regulating the activity, 

the analysis can provide information needed to control and reduce 

the risk. The whole Range Safety Control process ( see Ch.2, 

Vol.1) is predicated on risk avoidance, minimization of accident 

impacts and the protection of population centers (see also Ch. 

10). Risk values related to space-launch activities may be 

generally categorized in two ways: (1) the probability of 

vehicle failure, including all possible failure modes, that could 

lead to debris impact events and their probabilities; and (2) 

consequence estimation, i.e., expected casualties or damage. The 

probability of debris impacts generally means that at least one 

object impacts in a specific area. The casualty estimation 

generally used is one of two types: (1) the probability of 

casualty, defined as the probability of one or more persons 

sustaining an injury; or (2) the expected number of casualties, 

defined as the number of persons expected to sustain an injury as 

a result of at least one object impact in a specific area. These 

concepts have also been discussed and illustrated in the context 

of Range Safety destruct actions (Ch. 2, Vol.1 and Ch. 10 ) and 

re-entry hazards (Ch. 7, Vol.2). 

The following is a list of general uses and applications of Risk 

Analysis in the context of space mission planning, approval and 

implementation: 

• A risk study can serve as a tool in the total decision 

making process for the Range or the sponsoring organization. 

• Excessive risk may reveal the need for a Flight Termination 

System (FTS) or other program restrictions (e.g., restrict 

land overflight or launch azimuths).(29,32) 

• Results are a tool to help underwriters price commercial 

space insurance. 

• Results may indicate the requirement that an existing or 

pre-designed FTS or other critical ELV system be redesigned, 

if such a redesign can significantly reduce 

9-1 
these risk levels via greater safety margins or introducing 

redundancies.(33) 

• Results may indicate the need for evacuation of Range 

personnel, enforcement of roadblocks, restricted sea lanes 

or airspace, movement of critical equipment, callup/purchase of additional real estate or justification for 

currently controlled land.(2 b) 

• Results might show the necessity to modify the support plans 

for other Range support elements permitted within the 

evacuated area, i.e., manned optical tracking sites. 

• Results can be used in the development of ELV flight safety 

operational support plans to include procedures, destruct 

criteria and whole vehicle versus destruct case (many 

fragments) impact decisions.(10,11) 

• Results can be used to alert the Range or Sponsor management 

to excessive on-site or public risk exposure levels for 

given launches or total programs. It is then the decision 

of management on which course to proceed.(17) 

• Results might identify launch scenarios and patterns that 

require mission operational procedure changes or hardware 

redesign/modification to allow the selection of less 

hazardous options, based on cost/benefit or operational 

constraints and priorities.(18) 

• Results may indicate the need to construct new facilities in 

cases where it is not acceptable to use existing 

facilities.(20) 

• Results might reveal the need and advantage of providing 

positive protection for nonevacuated personnel (shelters, 

barricades, bunkers, blockhouses, etc.) and critical 

equipment required in the evacuated area.(20) 

• Results can be used to establish and define limiting 

criteria which may be used both quantitatively and 

qualitatively. Impacts of single launches or cumulative 

impacts of space launch programs can be compared in this 

manner. (19,32)

• Risk studies can provide documented evidence that specific 

hazards were considered in an objective and rational manner 

in developing operation plans.(8-13) 

9-2 
• "Risks to launch" results identify the reliability of the 

Range support equipment and personnel and can be used for 

the following purposes:(19,32) 

a. Identify high risk from inadequate Range support 

elements and, therefore, assist in increasing total 

reliability and reducing hazards involved in launching. 

b. Increase Range operational safety and supportability. 

c. Increase Range capability and attractiveness to 

potential users. 

A general method that satisfies all possible analytical problems 

related to space operations does not exist, as discussed in 

Ch. 8. Historically, the National Ranges have developed their 

own computer programs for risk studies and analyses, as 

appropriate to specific tests, launch vehicle systems or Range 

operation problems. Although no standardization exists at 

present between the Ranges regarding methodology, computer 

programs and analytical tools (mainly because of different siting 

and demographics, but also because of specialized uses of each 

Range), the major types and elements of space risk analysis do 

recur. Moreover, there are technology transfer and

standardization efforts in progress at ESMC and WSMC. A typical 

Risk Analysis requires five basic categories of data: 

1. Systems failure modes and their probabilities. 

2. Impact probabilities and distributions resulting from 

failures or normal launches. 

3. A measure of lethality of impacting debris. 

4. Location and nature of population and structures placed 

at risk by the mission. 

5. Launch plans, subject to Ground Safety and Range Safety 

constraints. 

Various elements of these categories may be considered in 

development of a Risk Analysis for a space launch vehicle, 

mission and/or operation. 

The end result of a Risk Analysis for a specific launch and 

orbital mission is valid only to the degree of reliability and 

completeness of the inputs and their applicability to a given 

launch vehicle or site. A result valid for one Range may be 

meaningless for another, because flight corridors, destruct 

criteria and impact limit lines are designed to be site-specific 

and are tied to the launch azimuth. Risk Analysis results may 

have orders of magnitude uncertainties, since they generally 

reflect compounded uncertainties in both initial and boundary 

conditions, i.e., in assumptions, modeling simplifications, 

approximations and possible errors of omission in the anticipated 

9-3 
failure modes and times. Risk studies, as applied to date to 

space operations, have been used as aids in the decision-making 

process in conjunction with other factors (proven Range 

capability, experience, precedent, national interests and 

priorities, etc.). Therefore, there are no general, uniform and 

firmly established acceptable risk levels for space operations,(1) 

although policy decisions and risk acceptability guidelines have 

often been based on matrix-type risk assessments (Ch. 10).(3-6) 

Several mission agencies have developed such matrix-type risk 

classification, ranking and evaluation procedures, which 

facilitate the objective definition of acceptable and 

unacceptable ranges of risk. The formal DOD risk matrix for 

space launches is illustrated in Ch.10.(5) The DOD qualitative 

hazard probability classification ranges from Level A (frequent), 

B (probable ), C (occasional), D (remote), to E (improbable). 

Similarly, the consequence severity categories, which account for 

damage, injuries or both are: I, catastrophic; II, critical; 

III, marginal; and IV, negligible. Hazard analyses attempt to 

rank failures and accidents in a two-dimensional 

probability/consequence matrix and assign a hazard index to each 

accident accordingly (e.g. 1A, 2E, 4D). Then these can be judged 

acceptable, undesirable or unacceptable according to suggested 

criteria.(3) The logic flow of a general risk assessment 

procedure, as it typically applies to DOD space operations, is 

shown in Figure 9-1.(16) 

NASA has, however, established explicit launch safety criteria 

and numerical risk acceptability goals, as detailed in Sec. 

9.2.(7) NASA uses a mishap (or accident) severity classification 

consisting of three hybrid categories: A - causes death, damage 

exceeding $500,000 or destruction of space hardware and/or 

spacecraft; B - causes permanent disability to one or more 

people, damage valued at $250,000-500,000; C - causes only 

occupational injuries and/or < $250,000 damage.(7a-c) NASA has 

traditionally required Safety Assessment Reports (SAR) for all 

missions that may deviate from proven safety procedures and set 

safety criteria and standards. 

DOE has also developed and used extensively risk ranking matrix 

methodologies, that combine and trade off the frequency and the 

severity of an event. However, the severity of consequence 

classes, A, B and C from worst to least, differ by loss type 

fatalities, property loss, or environmental pollution effects). 

The accident frequency scale ranges from probable (1-100 years 

return period), to reasonably probable (100-10,000 years), remote 

10 thousands to ten million year) and to extremely remote beyond 

this return period for the accident or event. 

9-4 
9-5 
Note that the probability of an event corresponding to a 100 

years return period is 10-2 per year. The matrix risk ranking 

scheme permits first order (probable and severe) risks to be 

defined, down to fourth order (remote - C, or extremely remote -B 

events).(37) 

9.1.1 System Failure Modes and Probabilities 

Launch Vehicle physical data used may include: 

• Propellants 

• Explosive/fuel chemical properties 

• Fragmentation characteristics 

• Mass 

• Shape 

• Ballistic coefficients 

• Flight dynamics 

• Flight Termination System (FTS) 

• Guidance and control 

• Stage burn times and separation characteristics 

• Lethality of debris, as represented by the Lethal Area 

The failure modes and associated probability of failure are 

required if other than a normal launch is addressed.(9,10) 

Estimates for failure mode probabilities are typically based upon 

knowledge of the vehicle's critical systems and expert assessment 

of their reliability combined with historical data, when 

available.(8-11,17,18) The single point (critical) failure systems, 

such as the FTS, are designed, tested and certified to very high 

reliability standards: at WSMR the FTS reliability quoted for a 

non- redundant FTS required for a typical sub-orbital research or 

sounding rocket system is .997 at a 95% confidence level. 

However, higher reliabilities with failure probabilities of 10-6 

apply to redundant FTS systems required for large ELV's. 

Typically, FTS designs are required to be "single fault tolerant" 

i.e., redundant.(6) 

The total probability of an ELV operational failure includes 

contributions from all foreseeable failure modes which can lead 

to either thrust termination or malfunction turns. The 

occurrence of failures during a critical time interval, such as 

the boost phase or stage separation, permits the estimation of 

failure rates versus time into flight. Illustrative figures for 

the two major failure modes for Titan 34D as a function of time 

into flight are given in Table 9-1. These figures are based on 

an analysis of past launch performance data for the Titan family 

of vehicles, corrected for learning, i.e., the improvements in 

manufacturing, assembly and operational procedures which take 

place after a failure is diagnosed, analyzed and fixed.(38,39) 

9-6 
9.1.2 Impact Probabilities 

The regions or areas exposed to launch operations or accident 

hazards must be identified (see Ch. 4). These may be subdivided 

into smaller sections, critical locations of people or buildings 

that are specified for subsequent risk calculations. All risk 

analyses require estimates of the probabilities of 

debris/fragments from failed vehicle impacting within hazardous 

distances of personnel or structures in the region.(17,23) The 

probability of an impact, Pi, for a public area requires 

consideration of all failure chains which could endanger it and 

always implies an FTS failure whose probability is Pf, given that 

a critical vehicle failure of probability Pv has occurred. 

The design and engineering associated with the development of a 

system is geared to produce a properly functioning vehicle. As 

a consequence, there are generally no data defining vehicle 

performance characteristics after a critical failure has 

occurred, except environment definition and vehicle response 

scenarios assumed. These data are required for meaningful risk 

assessment. To provide such data, several computer models 

discussed below in Sec. 9.2 have been developed to simulate 

9-7 
vehicle responses after a given gross failure mode has 

occurred.(19) These computer models are used as part of the 

computational process for generating debris impact probability 

density functions. These models combine, statistically and 

dynamically, well defined vehicle data with expert engineering 

estimates to predict vehicle performance after a failure occurs 

(e.g., Table 9-1). Sometimes failures that occurred during 

design verification and system tests can be used to infer inflight failure behavior. Also, Mishap Reports, which are based 

on failure diagnostics and accident investigations, help to 

refine these computer programs or their external data files with 

field data.(33,34) Failures possible during each launch and flight 

phase must be considered separately, in order to isolate those 

with the potential for public safety impacts. 

9.1.3 Debris Lethality 

An important aspect of the vehicle data problem that must be 

addressed prior to performing risk calculations is to determine 

what occurs after vehicle failure and fragmentation (whether on 

command or spontaneous) leading to ground impact. The number of 

fragments, their sizes and shapes will ultimately define the 

hazard and casualty area for a given vehicle or fragment impact 

(Table 9, Ref. 37b). Debris are characterized by their size, 

mass, area and ballistic coefficient to determine if they survive 

re-entry and their terminal velocity at ground impact. The data 

items which are often developed for this part of the problem 

include: an impact energy distribution budget, secondary 

explosive energies available (if any) at impact, secondary 

fragments which may result from impact (splatter effect) and 

ricochet probabilities and characteristics.(20,22) Also, the 

likelihood, severity and extent of toxic vapor clouds, pool fires 

and blasts are used to calculate hazard areas for the various 

hazard mechanisms (see also Ch. 5, Vol. 2 and Ch. 10). 

9.1.4 The Meaning of Casualty Expectation 

The quantity most frequently employed to evaluate the risk 

associated with the testing and operation of a space launch 

system is called casualty expectation, Ec. This quantity 

corresponds to the expected or mean number of casualties or 

injuries if an ELV is launched according to a specific mission 

plan. The specific approach to compute casualty expectation is 

adapted by the National Ranges to fit their specific problems and 

launch situations.(17-23) In general, Ec is obtained by considering 

the following quantities: 

• The area, A, in which debris impacts can occur, 

partitioned into Ai subsets of areas. 

9-8 
• The fragment impact probability density (Pi) on Ai 

produced by a given system failure. 

• The hazard area, AHi, associated with an impact on Ai, 

is the effective casualty (lethal) area for an 

impacting piece of debris. 

• Ni, the number of people in Ai at risk from debris 

impacts. 

• V, vulnerability, i.e., the likelihood that a structure 

(hardened or not) within AHi can be penetrated by 

debris or that a person can be injured as the result of 

impact. This is only explicitly factored when 

estimating risk to off-shore oil platforms and on-site 

facilities.(17,20) 

These quantities are then used in an equation of the form 

The Ec estimate, as a measure of risk for a given test, is often 

calculated by summing the risk over the hazard area for the test 

with each element of the sum. These are weighted according to 

the probability, as a function of time after launch, of the i-th 

failure mode which may require destruct or lead to vehicle 

fragmentation (Table 9-2). It must be noted that Ec is not the 

probability of a casualty, because it can be >1 in special cases. 

For illustration of the difference, in case of one accident per 

1,000 with an average of 5 casualties per accident, Ec is 

5/1,000, but the probability of a casualty is 1/1,000. 

9-9 
9-10 
9.1.5 Population/Structures Data 

The major purpose of a launch risk analysis is to determine the 

magnitude of hazards to personnel and structures posed by a 

launch and/or total program. Public risk exposure is of concern 

primarily near the launch site and during the first minute after 

launch, when, if the vehicle fails, it may veer towards populated 

areas protected by impact limit lines. The FTS must also fail (a 

double failure must occur) in order to violate the destruct 

limits designed to protect the public. The probabilities of such 

double failures are typically very low, on the order of 10-6 to 

10-8.(37) Locations of buildings and structures and the 

distribution of population throughout the area must be known, as 

well as other facts, including: 

• Sheltering capability of occupied structures, i.e., the 

ability to withstand debris impact and protect against 

overpressures from explosions or impact kinetic energy 

conversion; 

• Frequently, population distributions may be functions 

of the time of day or week and may be significant in 

risk tradeoff studies; 

• Risk levels can be directly affected and controlled to 

some extent by population control, sheltering, Range 

clearance or by preventing people from entering these 

areas (e.g., road-blocks). 

Based on such an analysis combined with mission profile 

constraints, the Impact Limit Lines (ILL) beyond which the 

vehicle and its fragments should not impact are determined for 

each launch to protect population and structures. Infringement 

of the ILL warrants a positive destruct action (see Ch.2, Vol.1). 

9.1.6 Launch and Mission Planning 

The actual implementation of operational plans under launch 

conditions ultimately determines the actual risk exposure levels 

on and off-site.(11-13,18) Integral to the analysis are the 

constraints posed by the following: 

• Launch area/Range geometry and siting 

• Nominal flight trajectories/profiles 

• Launch/release points 

9-11 
• Impact limit lines, whether based on risk to 

population/facilities or balanced risk criteria. 

• FTS and destruct criteria 

• Wind/weather restrictions 

• Instrumentation for ground tracking and sensing onboard the vehicle 

• Essential support personnel requirements. 

The Range Safety Group (or its equivalent) typically reviews and 

approves launch plans, imposes and implements destruct lines and 

other safeguards, such as NOTAMs (Notice to Airmen), Air Space 

Danger Area notifications and radio-frequency monitoring (see 

Ch.2, Vol 1). 

The launch (normal and failure) scenarios are modeled and 

possible system failure modes are superimposed against the 

proposed nominal flight plan. Hazards and risk resulting from 

all known or hypothetical failures are summed in the overall Ec 

for the launch. A range of values (risk envelope) rather than a 

single probability or casualty expectation value is determined. 

The hazard to third parties is dependent upon the vehicle 

configuration, flight path, launch location, weather and many 

other factors ( see Ch.5, Vol.2). It should be possible to 

tabulate casualty expectations and impact probabilities for a 

particular range, vehicle and typical flight path, but this 

information is not easily available in the public domain 

presently. 

9.2 LAUNCH RISK ANALYSIS TOOLS. 

9.2.1 Pre-launch Safety Requirements. 

Any contractor or launch vehicle manufacturer using a National 

Range must comply with extensive safety requirements,(4-6) and 

submit sufficient data regarding the mission trajectory and 

vehicle performance to support the mission safety evaluation, 

operational planning and approval.(8-12) A Blast Danger Area around 

the ELV on the launch pad and a Launch danger Area (a circle 

centered on the pad with tangents extended along the launch 

trajectory) are prescribed for each ELV depending on its type, 

configuration, amount of propellants and their toxicity, TNT 

equivalents, explosive fragment velocities anticipated in case of 

an accident, typical weather conditions and plume models of the 

launch area. 

The list of safety documents that a Range User must comply with 

is a comprehensive set of Ground and Range Safety requirements 

(5-7,16). The scope of the effort involved to apply them 

9-12 
to mission analysis and approval is well illustrated in a four 

volume Integrated Accident Risk Assessment Report (IARAR), which 

includes quality assurance and certification of critical 

components and subsystems, electro-explosives, hazardous 

propellants and chemical information, vehicle description and 

payload/system safety checks.(8) In the case of man-rated space 

systems, like the Shuttle, the customary safety requirements and 

the lengthy lead time required for mission planning and approval 

become even more cumbersome.(29-32) More typical are the mission 

approval documentation submitted to the Range, such as the Flight 

Plan Approval and Flight Termination reports illustrated by Refs. 

10-13 and 15. 

A Flight Safety Plan and supporting data must be supplied by the 

User to the National Range, prior to mission approval and 

operational planning.(36) Each launch is evaluated based on: 

• Range User data submission requirements from the hazard 

analysis view point;(18,22) 

• launch vehicle analyses to determine all significant 

failure modes and their corresponding probability of 

occurrence (FMEA's and Reliability Analyses);(9a,b) 

• the vehicle trajectory, under significant failure mode 

conditions, which is analyzed to derive the impact 

probability density functions for intact, structurally 

failed and destructed options;(11-13) 

• the vehicle casualty area based upon anticipated 

(modeled) conditions at the time of impact;(10,13) 

• computed casualty expectations given the specific 

launch and mission profile, population data near the 

Range and along the ground track.(10,15) Shelters may be 

provided, or evacuation policies adopted, in addition 

to restricting the airspace along the launch corridor 

and notifying the air and shipping communities (NOTAM) 

to avoid and/or minimize risks; 

• an Accident Risk Assessment Report (ARAR) prepared to 

identify hazards of concern, causes, controls and 

verification procedures for implementing such 

controls.(8) 

The ESMC and WSMC Range Safety Requirements specify the data 

submissions expected from Range Users to enable hazard 

assessments prior to granting launch approval, including: 

• determination of significant failure modes and 

derivation of impact probability density

functions(PDF); 

9-14 
• evaluation of casualty area based on vehicle break-up 

analysis; 

• computation of dwell times over land; impact 

probabilities; casualty expectations based on land 

area, geography and population densities; 

• sample calculations and documentation. 

Missions involving nuclear power packs or payloads must qualify 

based on very stringent safety criteria and are approved only 

after review by an Interagency Nuclear Safety Review Panel 

(INSRP). Detailed risk assessments have been performed by NASA, 

DOE, DOD and their contractors for the INSRP prior being allowed 

to launch satellites with nuclear power sources such as 

Radioisotope Thermal Generators (RTG) on-board the STS.(25-28) 

9.2.2 Risk Models and Safety Criteria Used at National 

Ranges. 

The Range Safety Group, Range Commanders Council (RSG/RCC) has 

reviewed a number of the computer models used by five of National 

Ranges (including the White Sands Missile Range - WSMR, Western 

Space and Missile Center - WSMC, the Pacific Missile Test Center 

- PMTC, US Army Kwajalein Atoll - USAKA, and the Armament 

Development Test Center - ADTC) to assess launch-related risks to 

on-Range personnel and the public.(1) Different models and 

computer codes are used at the Eastern (ESMC) and Western (WSMC) 

Test Ranges, and at the NASA/GSFC Wallops Island Launch Facility 

(WFF) because launch vehicles, mission objectives and site 

specifics vary.(7,18,19) 

The evaluation of launch associated hazards is based on Range 

destruct criteria designed to minimize risk exposure to on and 

off-Range population and facilities. Computer models are used to 

simulate missions for optimization and approval or run in real 

time for Range Safety Control Officers to monitor flight 

performance. 

The DOD Ranges do not have published requirements for acceptable 

levels of public risks, presumably because national security 

interests can take precedence in testing new launch systems and 

launching defense payloads and spacecraft. Since launch risk 

exposure to the public is primarily controlled in real-time by 

the Range Safety personnel rather than the Range User, the 

residual and uncontrollable hazards to the public are re-entry 

hazards due to failures to achieve proper orbit and premature reentry of the payload. 

9-15 
The NASA/WFF Flight Safety Plan, compares the risks associated 

with a specific mission to "acceptable risk criteria," such that: 

• casualty expectation ≤10-7 for planned or accidental 

impact and re-entry of any part of the launch vehicle 

over any land mass, sea or airspace; 

• probability of impact with potential damage to private 

property ≤10- 3 (unless an SAR is prepared and approved 

or a waiver is obtained); 

• probability of impact with flight support aircraft (for 

meteorological monitoring, or tracking support of ≤10-6 

(note that other aircraft are excluded by NOTAM and 

airspace restrictions); 

• probability of impact with ships and boats within the 

impact area (inside a 50 mile radius from the launch 

points) of ≤10-5. (Some Ranges observe a 20mi. 

radius;(37b) Wallops Flight Facility surveys out to 100 

miles.(40)) 

From 1961 to 1983, Wallops has experienced 14 launch failures out 

of over 10,000 sub-orbital launches of sounding rockets, 

resulting in an observed land impact probability of 2.8 x 10-3. 

Of these, only three impacted outside the launch site area (i.e., 

P = 6 x 10-4). Assuming an average population density of 64 per 

sq mi., the casualty expectation based on this observed vehicle 

failure rate is 8 x 10-9. Similarly, for debris dispersal over 

water, a ship traffic density of 2.6 x 10-5 per sq. nmi per day 

was used, resulting in an expected 3.7 x 10-7 probability of a 

sustainer impacting a ship. For comparison, Wallops threshold 

ship-impact probability criteria are ≤10-5, corresponding to 20x 

increased allowance for ship impact. 

Range Safety Reports, Safety Analysis Reports (SAR's) and other 

such probabilistic Hazard Analyses must be prepared by Range 

Users for Mission Approval at most National Ranges whenever a new 

launch vehicle configuration (e.g., a Titan with an IUS or 

Centaur upper stage), an unusually hazardous payload (e.g., a 

nuclear powered spacecraft) or a trajectory with land overflight 

are involved (i.e., whenever "deviations" from approved safe 

procedures, vehicles and programs are filed). Similar reports 

are needed for US-sponsored launches from foreign territories. 

Either the User submits the data for the Range to carry out its 

own hazard analyses or the User prepares such a document on 

request.(6) 

Safety Assessment Reports (SAR's) were typically prepared by NASA 

GSFC/Wallops Flight Facility (WFF) for sub-orbital launches from 

foreign territory. Two references are representative of the 

9-16 
types of launch hazards of concern and the NASA approach to risk 

assessment: The SAR for Project CONDOR involved launches in 1983 

from Punta Lobos, Peru, using Taurus-Orion, Terrier Malemutes, 

Nike-Orion, Black Brants and similar sub-orbital vehicles to 

launch retrievable atmospheric sounding research payloads.(7e-g) 

Range Safety Guidelines minimize post-launch risks to the public 

by imposing a number of restrictions: e.g., no land over-flight 

corridors are selected if it is possible to have launches and 

flight paths over water. However, for land-locked launch sites 

such as WSMR, strict overflight criteria restrict both land and 

airspace corridors to on-Range and Extended Range areas.(2) There 

are no intentional off-Range land impacts permitted for any 

normally jettisoned booster and sustainer casings and sufficient 

safety margins are provided within the destruct corridor to avoid 

impacts on population centers by accidentally or intentionally 

generated debris. For WSMR launches, typical observed limits on 

risk to nearby population centers are land impact probabilities 

of < 10-5 on-range and < 10-7 off-range, resulting in casualty 

expectations of < 10-7 to 10-9. 

Models, run sequentially or in parallel, are designed to compute 

risks based on estimating both the probabilities and consequences 

of launch failures as a function of time into the mission. 

Inputs and external data bases include data on mission profile, 

launch vehicle specifics (e.g., solid or liquid rockets, stages, 

configuration), local weather conditions and the surrounding 

population distribution. Given a mission profile, orbital 

insertion parameters and desired final orbit, the risks will vary 

in time and space (see Ch. 10). Therefore, a launch trajectory 

optimization is performed by the Range for each proposed launch, 

subject to risk minimization and mission objective constraints. 

The debris impact probabilities and lethality are then estimated 

for each launch considering the geographic setting, normal 

jettisons, failure debris and demographic data to define destruct 

lines to confine and/or minimize potential public risk of 

casualty or property damage. 

The National Ranges use either a circular or an elliptical 

footprint dispersion model to analyze vacuum and wind-modified 

instantaneous impact points (IIP) from both normal stages 

jettisoned during launch and launch debris (failure or 

destruct).(1) The debris dispersal estimates generally assume 

bivariate Gaussian dispersion distributions.(19,21) Risk contours 

are estimated as impact probabilities or casualties expected per 

unit area centered on the II (nominal impact points) or on a 

specific site (land, community or Range) of interest. All these 

models are similar in approach, but quite site-specific in the 

use of databases, which depend on Range location and on the 

geographic area and associated population distribution at risk. 

The models may be run either as simulation to assist in analyzing 

9-17 
and selecting launch options, or can be run in real-time, to 

monitor a launch operation. 

The information and risk computation logic flow depicted in Figs. 

9-2, 9-3 are used in a computer program developed to calculate 

relative risks to population centers along the flight corridor 

ground-track, namely the LARA - Launch Risk Analysis program and 

its later upgrades.(19,21) The LARA program is in use at WSMC and 

PMTC and is being introduced at ESMC. Figure 9-4 shows a sample 

real-time debris footprint display monitored by Range Safety 

Officers at WSMC during each launch operation. It is based on 

computed and wind-corrected trajectory and LARA impact patterns 

moving with the tracked vehicle and their position relative to 

the fixed, prescribed destruct and impact limit lines. If the 

failed vehicle encroaches these lines, a destruct decision must 

be made or withheld according to clearly formulated destruct 

criteria. 

9-18 
9-19 
9-20 
Since WSMR is a land-based Range, safety considerations are 

particularly important in authorizing tests that might endanger 

the public. Computer models in use at the Range support premission simulations of normal and failed flights, as well as 

real-time tracking and destruct decisions based on vacuum and 

drag corrected IIPs. The library of risk computation and utility 

codes used by Range Safety include: SAFETY.SITE (generates 

scaled maps of the range and tracking installations), SAFETY.DMA 

(converts maps to desired coordinate scale), SAFETY.GIP (predicts 

both vacuum and drag corrected impact coordinates) and several 

other external modules for population data and impact point 

prediction. The WSMR Hazard Analysis method and its application 

to launches of sub-orbital vehicles with recoverable payloads was 

illustrated in a 1986 study.(2b) Other risk analyses have been 

performed for specific tests and launch vehicles based on 

tailored models using the vehicle characteristics and launch 

geometry. 

WSMC has an extensive array of software developed to assist in 

evaluating hazards to facilities and population centers and 

devising appropriate risk control options.(19-21) These include: 

LARA, CONDEC (Conditional Casualty Expectation), RBAC (Risk Based 

Destruct Criteria), ACE (which combines CONDEC and RBAC to 

compute casualty expectation along arbitrary destruct lines), 

SLCRSK and LCCRSK (which compute probabilities and expected 

magnitude of damage to the reinforced launch control center and 

to other VAFB facilities, such as SLC-6, for certain launch 

azimuths).(20) Other special purpose models are: BLAST, to assess 

explosion shock wave far-field impacts; SABER, to evaluate 

supersonic boom effects; REEDM, for hot toxic gas predictions and 

a series of cold spill toxic prediction algorithms for toxic 

releases. 

ESMC has its own library of codes used to support launches as 

pre-flight simulations and real-time monitoring and display. 

These include: BLST, similar to BLAST above; COLA, a collision 

avoidance program used to ensure that a proposed launch will not 

jeopardize any satellite in orbit; RAID, the major real-time 

Range Safety program which displays the ELV position and II based 

on tracking data; RSAC and RSTR, which provide plots in sitecentered coordinates; REED, used for launch and post launch 

environmental analysis of exhaust cloud effects; RIPP, an 

interactive impact point and destruct line plot and RSIP (Range 

Safety Impact Predictor), which computes impact position 

parameters along the trajectory with and without wind data. 

Other codes are used to assess the fate of an errant ELV, such as 

RSPFT (Range Safety Powered Flight and Turns) and RSTT (Range 

Safety Tumble Trajectory), to predict malfunction behavior for 

each vehicle type and nominal trajectory; and RSMR, which 

9-21 
computes the maximum pad-to-impact range for a vehicle and its 

debris. External modules are used to update wind corrections 

(RSRK, for Range Safety Radiosonde Data) and assess risks to 

ocean traffic (RSSP or Range Safety Ship Hit Probability). 

For any developmental vehicle, safety assessments must precede 

flight testing and launch approval. For example, the new 

commercial launch vehicle Conestoga has been flight tested 

recently; Conestoga failure modes and rates were based on 

previous experience with the Aries rocket and the Minuteman I 

second stage motor, which were reconfigured as the Conestoga. 

Special attention was given to the possibility of impact and 

damage to off-shore oil platforms in the Gulf Area, given the 

flight path, ground track and safety corridor for Conestoga under 

a range of plausible vehicle failure scenarios and weather 

conditions.(36) However, because of redesign of the Conestoga, 

some of the safety assessments are being re-evaluated for 

launches from WFF. 

The hazard models used by NORAD and AFSC to estimate far-field 

public risk exposure (i.e., for assessing the probability that a 

failed vehicle, re-entering second stage or debris will impact in 

CONUS and/or foreign countries and cause damage and casualties) 

were originally developed by the Aerospace Corporation.(34,35) These 

re-entry risks for second and upper stages and for low-orbit 

payloads appear, typically, to be several orders of magnitude 

larger than launch and orbit insertion risks (see Ch.7, Vol.2) 

because they integrate world-wide casualty expectation. Impact 

probabilities and casualty expectations for a specific country 

are much smaller and proportional to their area and population 

contribution to the integral. 

Overflight risks are also a modeling and operational planning 

concern for Range Safety: some trajectories may traverse Japan, 

Australia, Africa and South America (see Ch.10 also). Table 9-2 

summarizes extant risk results, namely the probabilities of land 

impacts and projected casualties for typical ELV's on allowed 

azimuths for ESMC launches over water.(37) These flights must 

protect the "African Gate" during overflight(see also Ch.10). 

This performance gate defines the maximum cross-range deviations 

from the nominal overflight trajectory which may be tolerated 

without termination action. These are well within the destruct 

limits to better protect populated areas at risk in case of 

abnormal vehicle performance. 

To place the criteria and goals for public risk exposure per 

space launch in perspective, it is instructive to compare them 

with other common, but voluntarily assumed or socially accepted 

transportation risks (see also Ch.5, Vol.2 and Ch.8). Ref. 29, 

published prior to the 1986 Challenger accident, estimated the 

9-22 
casualty probability per flight for commercial air carriers to be 

6.6 x 10-5 (based on 1972-74 data) vs. 1-3 x 10-5 for the Space 

Shuttle (to compare respective risks from an STS failure with and 

without a destruct system on-board). For comparison, the 1982-84 

transportation accident statistics give fatality rates per 100 

million passenger-miles of .02 for inter-city buses, .04 for 

airlines and .07 for railroads. These values correspond to a 

casualty probabilities of 2-7 x 10-10 per mile. This probability 

must be converted to units of interest to space operations (per 

launch event or per year) and then further normalized to the 

exposed population and the area at risk. Further, 

utility/benefit considerations must be brought to bear for a 

meaningful comparison of public transportation with space 

transportation risks. 

9-23 
REFERENCES FOR CHAPTER 9 

1. a)"Risk Analysis Techniques," Range Safety Group/ Range 

Commanders Council (RSG/RCC), Document 315-79, 1979 

b)"Unguided Rocket Safety," RSG/RCC Technical Report, March 

1982. 

2. a)"White Sands Missile Range (WSMR) User's Handbook," 2 

Vols., 1987. 

b)W.C. Wolff, "Black Brant Hazard Analysis," WSMR Report, 

Jan. 1986. 

3. "Systems Safety Program for Space and Missile Systems", MILSTD-1574A (USAF), Aug. 1979, Rev. 1985. 

4. "Use, Management and Operation of DOD Major Ranges and Test 

Facilities," DOD Directive 3200.11. 

5. a)"Military Standard System Safety Program Requirements," 

MIL-STD-882B, March 1983, and "System Safety Program 

Requirements for Space Systems and Their Facilities," MILSTD-882B-1, 1986. (Draft) 

b)"Investigating and Reporting Air Force Mishaps," AFR 

127-4, January 1984. 

6. a)"Range Safety Manual," USAF/AFETRM 127-1, 1972; 

b)"Range Safety Requirements, Range Safety Regulations," 

WSMCR 127-1, May 1985.; 

c)"Eastern Space and Missile Center-Range Safety," ESMCR 

127-1, July 1984; 

7. a)"Range Safety Policies and Criteria", NASA/GSFC-WFF GMI 

1771.1, Rev. 1, 1979; 

b)"Range Safety", GHB 1771.1, NASA/GSFC, September 1984; 

and "Issuance Information Sheet on Range Safety;" 

c)"Range Users Safety Handbook," WHB 1771.1, NASA/WFF, March 

1979; 

d)"NASA Safety Manual," NASA NHB 1700.1; 

e)"Safety Assessment Report (SAR) for Project CONDOR," 

NASA/GSFC-WFF, 1983; 

f)"SAR for Project COPE," NASA/GSFC-WFF, 1984; 

g)"Risk Assessment for Black Brant X from Poker Flats, AL. 

and Malemute from Fort Yukon, Al.," NASA/GSFC, 1983. 

8. "Titan IV Integrated Accident Risk Assessment Report (IARAR) 

- Phase II", Martin Marietta (MCR-85-2514), 4 Vols., Jan. 

1987. 

9-24 
9. a)"Failure Mode and Effect Analysis Report for Delta II", 

MDC H3324, July 1987, McDonnell Douglas Astronautics Co., 

for USAF MLV/GPS Program . 

b)"Delta II Reliability and Maintainability Allocations, 

Assessment and Analysis Report," MDC H3058 A, March 1987, 

MDAC for USAF MLV/GPS Program. 

10. a)"Delta Range Safety Land Impact Probability Study for the 

S-17 Spacecraft Mission," Douglas Aircraft Co., Report SM43503 (for NASA), July 16, 1963. 

b)"Analysis of Delta Impact and Kill Probability Prediction 

Probabilities, (Including 2nd Stage Failure Mode and Effect 

Analysis)," Booz-Allen Applied Research, Report 862-3-41-1, 

Feb. 1966. 

11. "Delta 181 Range Safety Flight Termination Report," MDC 

H3161, Sept 1987, MDAC for NASA. 

12. a)"Flight Plan Approval Package for Delta II," MDC H2747, 

June 1987, MDAC for USAF MLV. 

b)"Titan CELV/IUS Range Safety Flight Plan Approval 

Request," Martin Marietta, June 1986. 

13. "Delta 392X Range Safety Flight Mechanics Destruct 

Analysis," McDonnell Douglas Astronautics Co., Report MDCM3398, May 1987. 

14. a)"Report of Delta 178/GOES-G Mission Failure Investigation 

Board," Vols. 1&2, Final NASA Report, July 1986. 

b)"Delta 178 Investigation Report," MDC H2505, MDAC for 

NASA, Aug. 1986. 

15. "Missile System Ground Safety Approval for DSV-3P-11E/E 

Delta Launch Vehicles," McDonnell Douglas Astronautics Co., 

Report MDC-G9455, April 1982. 

16. "Explosives Safety Standards," AFR 27-100, Rev. 2, 1985. 

17. a)Bugno, W.T., D.M. Benn, J.D. Collins and J.M. Hudson, 

"Missile Overflight Risks and Platform Design," (ASME, 

Petroleum Division, R. Welch, ed.), Drilling and Production 

Technology Symposium, 1986, pp. 57-61; 

b)Benn, D.M., " A Brief Survey of Risk Management in DOD 

Safety and Related Areas," PRC/ Omnitek , March 1987. 

18. "Range Safety and Range Planning Trajectory Data for the AC68/F-8 Atlas G/Centaur Fltsatcom Follow on Mission", General 

Dynamics, Report GDSS-SP-87- 010, May 1987. 

19. Collins, J.D., "Risk Analysis Methodologies Developed for 

the U.S. Department of Defense," Journal of Reliability 

Engineering 1, #1, Jan 1988. 

9-25 
20. Harnitcheck, J.J., and J.D. Collins, "Risk Analysis of Titan 

Launches over SLC 6," for WSMC/VAFB, May 1987. 

21. a)Baeker, J.B., J.D. Collins, Haber, J.M., "Launch Risk 

Analysis", Spacecraft & Rockets, vol 14 No. 12, Dec 1977, 

pp. 733-738. 

b)Baeker, J.B., "Launch Risk Analysis Program (LARA): Part 

I- Specification," J.H.Wiggins Co., 1975. 

22. McMunn, J.C., J.D. Collins and B. Brown, "A Hazards Model 

for Exploding Solid Propellant Rockets," Journal of 

Spacecraft and Rockets, 6, Dec. 1969, pp. 1423-1429. 

23. Collins, J.D., M. Jameson and J.L. Lanz, "Real-Time Debris 

Patterns for Ballistic Missile Launches," Journal of 

Spacecraft and Rockets, 13, May 1976, pp. 310-315. 

24. Rice, E.E., R.S. Deming, A.L. Friedlander and C.C. Priest, 

"Preliminary Risk Benefit Assessment for Nuclear Waste 

Disposal in Space," Earth Oriented Applic. Sp. Technol., 3, 

1983, pp. 127-137. 

25. "Preliminary Risk Assessment for Nuclear Waste Disposal in 

Space," NASA CR 162028, Batelle for NASA/ Marshall, Feb. 

1982. 

26. "Space Shuttle Data for Nuclear Safety Analysis," NASA/ JSC 

16087, Sept. 1979. 

27. Weatherwax, R.K., and E.W. Colglazier," Review of Shuttle/ 

Centaur Failure Probabilities for Space Nuclear Mission 

Applications,"AFWL-TR-83-61, Dec. 1983 

28. "Review of RTG Utilization in Space Missions," Congressional 

Hearing, House Comm. on Sci. and Tech., March 4, 1986. 

29. Baeker, J.B., "Space Shuttle Range Safety Hazards Analysis," 

NASA/JSC TR81-1329, J.H. Wiggins Co., July 1981. 

30. Hudson, J.M., "Development of STS/Centaur Failure 

Probabilities: Liftoff to Centaur Separation," NASA/JSC TR 

82-1404, By J.H. Wiggins Co., Feb. 1982. 

31. Hudson, J.M., "Development of STS Failure Probabilities, 

MECO to Payload Separation," NASA/JSC TR 70-1359, J.H. 

Wiggins Co., 1979. 

32. "Report of the STS Flight Termination Criteria Evaluation 

Committee," WSMC Report, June 2, 1986(restricted). 

9-26 
33. a)"Report of the Presidential Commission of the Space 

Shuttle Challenger Accident," June 6, 1987. 

b)"Investigation of the Challenger Accident," US Congress, 

House Comm. Sci.and Tech., Rep. 99-1016, Oct. 1986. 

34. "Implementation of a Safety Policy Related to Random Reentry of Satellites Decaying from Orbit," AF 04 (695)-100 1, 

Mar. 1967. 

35. "Random Re-entry Hazard Calculations for Titan IIIC Flight 

Plans VIID and VIIE," TOR-0059 (6112-50)-5, June 1971. 

36. "Range Safety Report for the Conestoga I Sub-Orbital Launch 

Vehicle," Space Vector Corp., 1982. 

37. Briscoe, G.J., "Risk Management Guide," E G & G, Idaho, for 

DOE, DOE/SSDC-76-45/11, Rev.1, September 1982. 

37. a)Parker, L.C. and R.M. Montgomery, "An Evaluation of the -

Department of Transportation Responsibilities for Commercial 

Launches from a National Range," Research Triangle Institute 

Report (RTI) to DOT, Sept. 1986. 

b)"ESMC Baseline Assessment," RTI Draft Report to DOT, May 

1988. 

38. Heubach, W.F. and L.L.Philipson: a) "Investigation of LARA 

Failure Rate Methodology," J.H.Wiggins Co. for USAF/WSMC, 

September 1985, TR 85-3135; b) "Investigation of 

Approximations and Assumptions in New LARA Failure Rate 

Methodology," NTS Eng. for USAF/WSMC, September 1986, TR 86-

3147.02. 

39. Baeker, J.B., "Failure Rate Methodology Implementation and 

Titan 34D Failure Rate Assessment," NTS for USAF/WSMC, 

1987, TR 87-3154. 

40. Oral Communication from WFF to OCST, May 2, 1988. 

9-27 
10/2/95 rev 

10. A GENERIC RISK ASSESSMENT OF REPRESENTATIVE LAUNCH 

SCENARIOS 

10.1 INTRODUCTION 

Since the beginning of US space launch operations in the 1950's, 

there have been no launch operation accidents that have produced 

any general public casualties outside any of the Government 

Launch facilities. There has been some damage to some Range 

facilities and structures used to support the launches, but 

little damage to public property outside the perimeter of the 

launch sites. Considering the fact that there have been 

unavoidable failures during thirty years of new rocketry and 

spacecraft testing and streamlining of launch operations, it is 

evident that the Range Safety Control process and systems in 

place have prevented and controlled the risk from launch 

accidents that could have lead to potentially significant claims 

against the Government. 

This proven track record of success for the Range Safety Control 

systems and practices at the National Ranges may cast doubt on 

the need to discuss the public risk exposure levels and the 

potential for third party liability claims. It is worthwhile, 

however, to discuss the consequences of ELV launch failures in 

the absence of the Range Safety Control system since proposed 

commercial space launches could originate at new launch sites 

(perhaps an island site or an ocean platform); use novel, 

untested or reconfigured tracking and control systems; and not 

require an FTS of high reliability on-board ELV's. This approach 

will permit an assessment of the extent of potential damage 

and/or casualties that can be avoided by the established Range 

Control Systems and safety practices (see also Ch.2, Vol.1, and 

Ch.9). While much of the qualitative hazards analysis of launchrelated accidents has been given previously in Ch.5, Vol.2, the 

intent of this chapter is to provide a coherent, self-contained 

discussion of generic public risk associated with commercial 

launch operations for existing ELV's which weighs the 

consequences of each accident by its probability of occurrence in 

a Risk Matrix according to the methods and tools illustrated in 

Chs. 8 and 9. 

10.2 RISKS DURING DIFFERENT PHASES OF A TYPICAL MISSION 

10.2.1 Pre-Launch Hazards 

During the preparation of a vehicle for launch, the chief hazards 

derive from the storage and handling of propellants and 

explosives. The Ground Safety procedures applied to stored 

explosives and propellants that can explode are similar to those 

used in the transportation and handling of these same materials 

off-site. The protective measures include quantity-distance 

10-1 
requirements, so that parties uninvolved with the launch cannot 

be affected by any accident. In addition, other structural 

protection (e.g., hardened concrete) and emergency preparedness 

measures are used to contain toxic or corrosive materials within 

the boundaries of the Range in case of an accident on the pad 

(see also Ch.5, Vol.2).(1,12) 

Accidents occurring prior to launch can result in on pad 

explosions, potential destruction of the vehicle and damage to 

facilities within range of the blast wave as well as dispersion 

of debris in the vicinity of the pad. The types of accidents 

depend upon the nature of the propellants, as discussed in Ch.5. 

In the case of cryogenic propellants, liquid oxygen alone will 

cause fires and explosive conditions; if used in association with 

liquid hydrogen, it can lead to very explosive conditions. Under 

somewhat ideal conditions, the TNT equivalence of a hydrogenoxygen propellant explosion can be as much as 60 percent of their 

weight, while that of an RP-1-oxygen explosion can be 20 percent 

of the weight of the propellants (see Ch.5, Vol.2).(1) 

An accident in handling storable hypergolic propellants could 

produce a toxic cloud, liable to move as a plume and disperse 

beyond the boundaries of the facility. The risk to the public 

will then depend upon the concentration of population in the path 

of this toxic plume and on the ability to evacuate or protect the 

population at risk until the cloud is dispersed. It is obviously 

advantageous if the winds generally blow away from populated 

areas. There are also specific safety requirements and risks 

associated with ground support equipment. The design and use of 

this equipment must incorporate safety considerations. 

10.2.2 Launch Hazards 

Generally, the on-board destruct system is not activated early in 

flight (during the first 10 seconds or so) until the failed 

vehicle clears the Range. This protects Range personnel and 

facilities from a command explosion. Failures during the very 

early portion of launch and ascent to orbit can be divided into 

two categories: propulsion and guidance/control. Lighting, wind 

and other meteorological hazards (e.g., temperature inversions) 

must be considered prior to launch countdown. 

Propulsion failures produce a loss of thrust and the inability of 

the vehicle to ascend. Depending on its altitude and speed when 

thrust ceases, the vehicle can fall back intact or break up under 

aerodynamic stresses. If the vehicle falls back, the 

consequences are similar to those of an explosion on the ground. 

The exception is when intact solid rocket motors impact the 

ground at a velocity exceeding approximately 300 fps. In that 

case, the explosive yield may be significantly increased. If 

there are liquid fuels (hydrogen-oxygen), there is also potential 

10-2 
for a large explosion, much higher overpressures and more damage 

to structures at the launch facility. It could also create 

higher overpressures off the facility which could break windows 

and possibly do minor structural damage to residential and 

commercial buildings (see Ch.5, Vol.2). 

Solid rocket motor (SRM) failures can be due to a burn-through of 

the motor casing or damage or burn-through of the motor nozzle. 

In a motor burn- through there is a loss of chamber pressure and 

an opening is created in the side of the case, frequently 

resulting in structural breakup. The nozzle burn-through may 

affect both the magnitude and the direction of thrust. There is 

no way to halt the burning of a solid rocket once initiated. 

Hence, an SRM failure almost inevitably puts the entire launch 

vehicle and mission at risk. When there are several strapped-on 

SRM boosters, as is commonly the case, the probability of a 

failure of this type is increased, since any one of these failing 

can lead to mission loss. 

The purpose of the Range Safety Control system is to destroy, 

halt or neutralize the thrust of an errant vehicle before its 

debris can be dispersed off-Range and become capable of causing 

damage or loss of life. Without a flight termination system 

(FTS), the debris could land on a population center and, 

depending upon the type of debris (inert or burning propellant), 

cause considerable damage. The destruct system generally is 

activated either on command or spontaneously (ISDS - the 

inadvertent separation destruct system is activated automatically 

in case of a stage separation failure) at or soon after the time 

of failure. In flight destruction limits vehicle debris 

dispersion and enables dispersion of propellants, thus reducing 

the possibility of secondary explosions upon ground impact. The 

destruct systems on vehicles having cryogenics are designed to 

minimize the mixing of the propellants, i.e., holes are opened on 

the opposite ends of the fuel tanks. This contrasts with 

vehicles with liquid storable propellants (e.g., Aerozine-50 and 

N2O4) where the destruct system is designed to promote the mixing 

and consumption of the propellant. Solid rocket destruct systems 

usually consist of linear shaped charges running along the length 

of the rocket which open up the side of the casing like a clam 

shell. This causes an abrupt loss of pressure and thrust. It 

may, however, produce many pieces of debris in the form of 

burning chunks of propellant and fragments of the motor casing 

and engines. 

The Titan 34D accident on April 18, 1986, about 8 seconds after 

launch, is an example of a propulsion failure which caused 

considerable and costly damage to the VAFB facility.(2) In this 

case, the solid rocket case failed and the vehicle fragmented and 

spread burning propellant over the launch site. Typical debris 

velocities were 100 to 300 fps. This Titan 34D failure was the 

10-3 
result of a burn-through of one of the rocket motor casings. The 

explosion, which occurred at an 800 ft. altitude, was not a 

detonation, where there is almost instant burning of propellant 

accompanied by a significant air blast, but a deflagration, where 

most of the propellant was not consumed in the explosion, but 

formed a cloud of flying burning debris. Some of the burning 

propellant still encased in a section of the rocket motor did 

appear to explode upon impact. The evidence was a flash of light 

recorded by a camera, although the camera was not directed at the 

point of impact. A series of small craters were also observed 

after the accident. It is believed that some of these craters 

were formed by violent burning in the soft soil (sand) rather 

than by explosions. Films do show rebound of propellant chunks 

and shattering upon the rebound. This type of behavior was also 

observed in earlier Minuteman failures. 

In addition to complete loss of control, there are three other 

early flight guidance and control failures that have been 

observed with launch vehicles over the life span of the space 

program: failure to pitch over, pitching over but flying in the 

wrong direction (i.e., failure to roll prior to the pitchover 

maneuver) and having the wrong trajectory programmed into the 

guidance computer. The likelihood of these circumstances depends 

upon the type of guidance and control used during the early 

portion of flight. The types are open or closed loop (i.e., no 

feedback corrections) and programmer or guidance controlled. In 

the case of vehicles which use programming and open-loop guidance 

during the first portion of flight, failure to roll and pitch is 

possible, although relatively unlikely, based on historical 

flight data. If the vehicle fails to pitchover, it rises 

vertically until it is destroyed. As it gains altitude, the 

destruct debris can spread over an increasingly larger area. 

Consequently, most Ranges watch for the pitchover and if it does 

not occur before a specified time, they destroy the vehicle 

before its debris pattern can pose significant risk to structures 

and people outside the launch facility or the region anticipated 

to be a hazard zone, where restrictions on airspace and ship 

traffic apply. Failure to halt the vehicle within this time can 

produce a significant risk to those not associated with launch 

operations. 

With open-loop Stage 1 guidance, a launch in the wrong direction 

can occur due to improper programming or improper roll of the 

vehicle during its vertical rise. This circumstance, although 

considered improbable, can be very hazardous. If the Range does 

not halt the flight immediately, the vehicle could overfly 

populated regions. Then, even if the vehicle is normal in every 

other respect, it could drop jettisoned stages on populated 

areas, creating the potential for damage, injury and loss of 

life. The detection of improper launch azimuth is usually 

accomplished visually because radar tracking may not be effective 

very early in flight. Consequently, in making the decision to 

10-4 
halt the flight, the Range must rely on visual observers to relay 

information about pitchover and azimuth, with possible timedelays. 

With vehicles which are inertially guided from liftoff, failure 

in pitchover or roll is unlikely. It is possible, but extremely 

unlikely, that an inertially guided vehicle could have the wrong 

set of guidance constants, i.e., the wrong trajectory, stored in 

its guidance computer. To the observer this will appear the same 

as an improper roll (flight azimuth). 

If a solid rocket loses thrust or has a change of direction of 

the thrust vector, the vehicle control system will try to 

compensate with the remaining engines. The result will be an 

aberrant corkscrewing behavior until the control system is 

totally overwhelmed, and then a tumble. With atmospheric forces 

present, the stages should break apart by this time. 

Generally, rapid hard-over tumbles of failing vehicles do not 

cause the vehicle to move significantly cross-range off the 

intended path of flight. It is the gradual turn that is of 

greater concern to the Range Safety Officer. If the vehicle 

turns slowly, it can move a significant distance cross-Range. 

This type of failure is rare and difficult to rationalize with 

most flight-tested ELV systems, but the unexpected must be 

anticipated. An example of the unexpected is the behavior of the 

solid rockets from the Space Shuttle after the failure of the 

Challenger.(3) They were supposed to tumble and not offer much of 

a dispersal hazard. Instead they turned very little and had to 

be destroyed before they could become a threat to a populated 

area. 

Of greatest concern to Range Safety Control during the steep 

ascent phase, is the capability of the vehicle to wander offcourse immediately following a malfunction. The Range Safety 

Control system must be able to respond before debris becomes a 

hazard. Consequently the design of the destruct lines must take 

into consideration: (1) the delay between decision and destruct; 

(2) the highest rate that the vehicle can move its IIP toward a 

protected area; (3) the effect of the winds; and (4) the 

contribution of any explosion to the scatter of debris. 

During the early boost phase the vehicle experiences its greatest 

aerodynamic loads and heating. As the vehicle accelerates, the 

dynamic pressure (1/2 pv2

) increases until the decrease in 

density (p) due to higher altitude overcomes the effect of 

increasing velocity (v). During the period of high airloads the 

vehicle is more vulnerable structurally and likely to break apart 

if it has a high angle of attack or begins to turn abruptly. The 

Space Shuttle, for example, with its complex configuration and 

lifting surfaces, is so sensitive during this period that the 

liquid propelled main engines are throttled down to keep the 

10-5 
dynamic pressure within specified limits. One of the major fears 

during this phase is an abrupt change in wind velocity during 

ascent (a wind shear). This causes a rapid change in angle of 

attack and requires rapid and appropriate response by the control 

system. 

The potential for damage to ground sites from a launch vehicle 

generally decreases with time into flight since fuel is consumed 

as the vehicle gains altitude (see Fig.5-6 in Ch.5, Vol.2). If 

it breaks up or is destroyed at a higher altitude, the liquid 

fuels are more likely to be dispersed and lead to lower 

concentrations on the ground. In addition, if there are solid 

propellants, they will have been partially consumed during the 

flight period prior to the failure and will continue to burn in 

free fall after the breakup. 

Meteorological conditions contribute to the potential for offsite damage. Temperature inversions and wind shears can cause 

shock waves, which normally turn upward, to turn down and 

possibly focus at locations distant from the launch site.(4) This 

results in significantly higher overpressures locally, than the 

overpressures from shockwaves moving in a normal adiabatic 

atmosphere (an atmosphere where the temperature decreases with 

increasing altitude). Another meteorological influence is the 

wind, which can deflect falling debris towards populated areas. 

Very early in flight, when the vehicle is still close to the 

ground, there is less opportunity for debris to be scattered. 

The debris fall within a footprint which is affected by the range 

of ballistic coefficients of the pieces, the wind speed and 

direction, velocity contributions due to explosion and random 

lift (see also Ch.2, Vol.1 and Ch.7, Vol. 2). To understand the 

make-up of the debris footprint, first observe the "centerline" 

as shown in Figure 10-1.(5) This centerline represents the spread 

of debris impact and drag effects when there is no uncertainty 

due to wind, lift, etc. 

Debris which are very dense and have a high ballistic coefficient 

(β) are not as affected by drag and will tend to land closer to 

the vacuum IIP. High ballistic coefficients can be associated 

with pumps, other compact metal equipment, etc. Panels or pieces 

of motor and rocket skin offer a high drag relative to their mass 

(a low ballistic coefficient) and consequently slow down much 

more rapidly in the atmosphere. After slowing down they tend to 

fall and drift with the wind. This effect is also shown in the 

figure. A piece of debris with a very low ballistic coefficient 

( β=1) is shown to stop its forward flight almost immediately and 

drift to impact in the direction of the wind. Pieces having 

intermediate value ballistic coefficients show a combination of 

effects and fall along a centerline. From a lethality 

standpoint, the pieces having a higher ballistic coefficient 

impact at a higher velocity and can cause more damage (depending 

10-6 
upon their size). The debris will not necessarily impact along 

the centerline. The velocity impulses at breakup, the wind and 

tumbling behavior all contribute to uncertainties about the 

impact point. This is illustrated in Figure 10-2. 

When all of the factors affecting debris transport and dispersal 

to impact are considered at once, the effect is a pattern as 

shown in Figure 10-3. The boundaries of the debris dispersion 

footprint are not precise but rather represent a contour which 

contains, say, 95 percent of the debris. Thus, when considering 

the hazard to structures or people on the ground, one must 

consider the hazard area for debris impacts in the terms of a 

pattern which is dynamic. It grows rapidly as the vehicle gains 

altitude, as illustrated in Figure 10-4 for a vehicle launched 

from Vandenberg Air Force Base. Note the geography and the fact 

that part of the debris pattern dwells over land for a 

significant period of time. The time interval that the debris 

impact pattern dwells over land depends upon the direction and 

strength of the wind. 

If the wind, as in this case, is blowing very hard from the 

southwest, the low ballistic coefficient portion of the pattern 

will tend to stay over the land. If the wind is blowing from the 

northeast, the pattern will move very rapidly out to sea. This 

10-7 
10-8 
10-9 
10-10 
demonstrates the very important role of wind in evaluating risks 

of a launch. Depending on prevailing meteorological conditions, 

including clouds, visibility, atmospheric electricity, 

temperature and wind conditions, a launch may be postponed until 

adverse conditions subside. The bulge in the center of the 

growing debris pattern in Figure 10-4 is due to debris which have 

velocities imparted to them from an explosion (spontaneous or 

destruct action). The upper-right-hand portion of the debris 

pattern consists of debris which have a high drag to weight 

ratio, slow down quickly and are carried by the wind, which, in 

this case, is blowing from the west. Notice how the debris 

pattern stretches as the vehicle increases in altitude. This 

effect continues until the vehicle reaches an altitude where 

aerodynamic drag no longer has an effect on dispersion. 

For all launches, the boosters, sustainers and other expendable 

equipment are always jettisoned and fall back to the Earth. 

Therefore, in planning a mission, care must be taken to keep 

these objects from impacting on land, offshore oil platforms, 

aircraft and shipping lanes. The impact locations are normally 

quite predictable, so risks can be avoided or minimized. 

As mentioned earlier, during the entire history of the space and 

missile programs at VAFB and Cape Canaveral/Cape Kennedy, no 

errant launch vehicle has ever been allowed to wander over a 

populated area near the launch site and deposit debris upon it.

 As a consequence there have been no claims, damages or 

casualties. This is a convincing argument in the support of 

continued safe launch and mission planning and approval 

procedures, reinforced by a reliable Range Safety Control system. 

10.2.3 Pre-Orbital Hazards 

After jettison of the booster stage and, in some cases, the solid 

rockets, the remaining core vehicle usually contains only liquid 

propellants and is at a fairly high altitude. If a failure 

occurs and no destruct action takes place, the vehicle may fall 

and remain largely intact till ground impact. Depending upon the 

initial altitude, the airloads during the fall may become 

sufficient to contribute to the vehicle breakup. If this occurs, 

the propellants will most likely be dispersed and the only hazard 

will be from impacting "inert" debris. In the unlikely event 

that the tanks do remain intact, some explosion may occur at 

impact. If the propellants are hypergolic, as in the case of the 

Titan, there may be considerable burning and a cloud appearing in 

the impact area. In this latter case, the damage from debris 

impact will probably be less than the hazard from the toxic 

propellants. When an altitude is reached where the vehicle 

stages can no longer remain intact because of airloads and 

heating, the only hazard will be due to impacting debris. 

10-11 
If a destruct or thrust termination system is used to halt 

ascent, as is usually the case, the propellants will be dispersed 

and should offer very little threat to people on the ground. A 

product of the destruct action will be inert debris, which could 

present a hazard at ground impact (for fire, explosion and toxic 

hazards, see Ch.5, Vol 2). 

During the boost trajectory of almost any space vehicle from any 

US National Range, the IIP will at some time pass over occupied 

land. For Titan 3 launches due east from Cape Canaveral, the IIP 

will begin to pass over Africa at t = 475 seconds, and leave 

Africa 3 seconds later. For some southerly launches from 

Vandenberg Air Force Base, the IIP can pass over southern 

Argentina and Chile. Activation of the destruct system is of no 

value at this point because it poses risks of land impact. It is 

often better to let the failing vehicle continue with the hope 

that it will clear the land area and impact in the ocean. The 

threat from either launch condition is relatively small because 

in both cases the IIP is traveling very fast over land areas 

(hundreds of miles per second). If, for example, the failure 

rate of the Titan 3 were uniformly 0.000075 failures per second 

(historical launch failure probability of .036 divided by 480 

sec. of burn operation) and the time required for the IIP to 

cross Africa is 3.2 seconds (see Figure 10-5), then the 

probability of failing and causing debris to fall on Africa is 

3.2 times 7.5 x 10-5 or 2.4 x 10-4 (one chance in approx. 4200). 

If the combined cross section of debris which survive to land 

impact is on the order of 1000 sq. ft.,and the average density of 

population which can be harmed by the debris is 50 per square 

statute mile (according to Ref. 5, this figure is higher than the 

average of the population densities of Zambia, Angola and 

Zimbabwe), then the average number of casualties per launch due 

to an African impact is: 

Ec =(failure rate)x(dwell time over land)x(debris "casualty 

area")x(population density) 

= 7.5 x 10-5 x 3.2 x 1000 x (50/52802

) = 4 x 10-7 

This corresponds to less than one chance in a million of a 

casualty per launch. Whereas Range Safety Control systems can 

act very positively to restrict and prevent debris from falling 

on populated areas earlier in flight, there is no effective risk 

control when the flight plan calls for a direct land overflight, 

such as the one discussed above. Consequently the casualty 

expectation of 8x10-7 is the same with or without a flight 

termination system on-board the ELV. 

The potential for damage from the impact is based on the area of 

falling debris (in this case estimated to be 1000 ft.2

) and the 

likelihood of impacting a structure of value. With a population 

10-12 
density of less than 50 per square mile, the density of such 

structures is rather low. As an example, assume the surviving 

debris consist of four pieces, each having a cross-section of 250 

ft.2

, and the average structure is 600 ft.2 with, on the average, 

one person per structure. (This is an attempt to account for 

both residential and commercial structures very conservatively.) 

A structure will be hit if any edge is hit by the debris. This 

is pictured in Figure 10-6. 

The effective area of impact is therefore a combination of the 

structure area and the debris cross-sectional area. In this case 

the effective impact area becomes approximately 3400 ft.2. The 

probability of any impact on a structure becomes: 

Pi =(failure rate)x(dwell time)x(effective impact 

area)x(structural density)x(no. of fragments) 

= 7.5 x 10-5 x 3.2 x 3400 x (50/52802

) x 4 = 5.5 x 10-6. 

10-13 
Thus, in this example the probability of hitting and damaging a 

structure is approximately 1 in 100,000. If a monetary value or 

range thereof, were assigned to the structures at risk, then the 

expected loss could be tied to both the severity and extent of 

damage (the consequence) and to the very low probability of its 

occurrence. 

A similar analysis can be performed for launches from Vandenberg 

Air Force Base (see Figure 10-7) when the IIP passes over the 

southern portion of South America. 

According to Ref. 7 and to Figures 10-8 and 10-9, an ELV would 

have to violate current azimuth restrictions in order to overfly 

South America (although some flights may overfly Antarctica or 

Australia at much greater altitudes). The dwell or transit time 

over Chile and Argentina will be no more than 1.4 seconds. If 

all other parameters of the casualty expectation and impact 

probability equations are assumed to be the same, then the Ec and 

the Pi will be less than those over Africa by the ratio of 

1.4/3.2. 

10-14 
10-15 
10-16 
Thus, very approximately, the casualty expectation for overflight 

over the southern region of South America will be 1.75 x 10-7 and 

the impact probability on a dwelling or commercial structure will 

be 2.3 x 10-6. 

On-orbit collision hazards, once the satellite has been properly 

inserted into final orbit, have been discussed in detail in Ch. 

7. Similarly, orbital decay and re-entry hazards for satellites 

and spent rocket stages have been addressed in Ch. 8. Although 

they contribute to the overall space mission- related hazards, 

they will not be discussed any further here. 

10.3 LAUNCH SITE RISK CONSTRAINTS 

The location of the launch facility has a significant impact on 

the options for launch missions. Launches to the east always 

benefit from the west to east rotation of the Earth. 

Consequently, equatorial orbits (0o inclination) are best 

achieved by launching from facilities which are near the equator 

and have a broad ocean area to the east of the launch site. 

Figures 10-8 and 10-9 above, show the acceptable and restricted 

azimuths for launches from the USAF Eastern and Western Test 

Ranges.(6) It becomes apparent that ETR is best suited for 

launches into equatorial orbits and WTR is best suited for 

achieving polar orbits. 

Launches at ETR can also have inclinations other than 0o

. If a 

vehicle is launched at an azimuth of 45o

 from true north, an 

orbit with an inclination angle of approximately 47o will result. 

A satellite in an orbit inclined at 47o would cover a groundtrack 

over the region of the Earth between ±47o

 latitude. From a risk 

standpoint, as the launch azimuth decreases, the locus of IIP 

moves closer to the East coast of the US. and Canada. There is 

also considerably more overflight of countries in the Eastern 

Hemisphere, with potential political and international 

repercussions for a space launch accident. 

The lowest risk to populated areas is almost always associated 

with missions where the launch azimuth is perpendicular to the 

coastline and the wind blows in the direction of the launch. 

This situation is experienced with many launches at the Eastern 

Test Range (from Cape Kennedy or Cape Canaveral). Launches into 

polar orbit from Vandenberg Air Force Base have a southerly 

launch azimuth, which is perpendicular to the coast at the launch 

site, but then moves parallel to the coast as the California 

coastline becomes more aligned north to south. Prevailing winds 

in the region of the Vandenberg launch site tend to be more 

onshore and this must be accounted for in establishing destruct 

lines for Range Safety Control. 

10-17 
10.4 VARIATION OF RISK DUE TO MISSION PROFILE, LAUNCH VEHICLE 

AND PAYLOAD 

10.4.1 Relative Risks of Missions 

Missions can be broadly categorized in terms of their orbital 

parameters: inclination, eccentricity, perigee and apogee 

altitude. The risks associated with different final orbit 

inclinations are those associated with the initial launch azimuth 

necessary to support the sequence of boost and transfer 

operations needed to achieve the desired final orbit inclination. 

The risks associated with launch azimuth and site constraints are 

discussed in Section 10.3. Satellites will re-enter within a few 

years due to orbital decay from Low Earth Orbits (LEO), but will 

not from geosynchronous orbits (GEO) (See Ch. 8). Thus 

geosynchronous orbits offer considerably less risk from the reentry hazard. The ELV launching a satellite into a 

geosynchronous orbit must carry more propellant in the initial 

orbiting vehicle and more stages. The additional propellant in 

the upper stage (up to a factor of 3) may increase the hazard by 

a proportionate fraction (percent) for launch accidents on or 

near the ground. Moreover, insertion of a payload into GEO 

involves more orbital maneuvers, more stages and a greater fuel 

load, hence greater overall risk of failing hardware and mission 

failure. For example, payload delivery to GEO orbit, as shown in 

Figure 10-12, involves firing an apogee kick motor (AKM) and a 

perigee kick motor (PKM). 

10-18 
However, even if the mission fails to insert the payload into the 

correct final orbit, public hazards may not increase unless a 

highly elliptical transfer orbit leads to early uncontrolled reentry of upper stages and payload or an on-orbit explosion 

creates collision hazards for GEO and LEO operational satellites. 

However, for accidents at high altitude when the vehicle is near 

orbital, the vehicle with a geosynchronous orbit destination will 

have less inert debris and the propellant will probably be 

consumed before ground impact. Hence, in this case, the Low 

Earth Orbit vehicle will have a larger casualty area and offer a 

somewhat greater overall risk. In general, the changes in risk 

level due to the mission profile are relatively small, with the 

exception of missions requiring restricted azimuths or riskier 

staging and orbital maneuvers for achieving the mission 

objective. 

10.4.2 Hazardous Characteristics of Typical ELV's 

Two ELV's, Atlas/Centaur and Titan III, are the primary subjects 

of this discussion, although the Delta is also discussed briefly. 

They offer a broad range of payload lift capacity, they are the 

largest of the currently available vehicles and they present a 

variety of propulsion types and representative associated 

hazards. Furthermore, a hazard analysis for two plausible 

accident scenarios, based on a typical Delta vehicle and flight 

profile as a function of time after launch and down-range and 

altitude evolution, was presented earlier in Figs. 5-5, 5-6 of 

Ch.5, Vol.2. 

10.4.2.1 Titan - The basic Titan III is illustrated in Ch. 5, 

Figure 5-4. Its central core vehicle consists of two liquid fuel 

stages, a Transtage and a payload. Two solid rockets (zero 

stage) are attached to the first core stage and these fire at 

liftoff and continue until their fuel is consumed. The first 

core stage is ignited near the end of the solid rocket burn 

(about 108 seconds after lift-off). After the solid rocket fuel 

is depleted and the first stage ignites, the empty solid motors 

are jettisoned (approximately 116 seconds after liftoff). The 

first stage continues to burn until approximately 273 seconds 

after liftoff, when its fuel is depleted and the stage is 

jettisoned. The fairing around the payload is also jettisoned at 

this time to reduce the weight that will have to be accelerated 

by the core second stage engine. The fairing is used to reduce 

the drag and protect the payload during ascent in the atmosphere. 

At the time of jettison, the vehicle is at an altitude of 400,000 

feet (130 km) and is essentially out of the atmosphere. The 

second core stage fires up immediately and thrusts for 216 

seconds. The Transtage has a restartable rocket motor used for 

10-19 
orbital maneuvers. Various upper stages can be added for mission 

and payload flexibility. 

During a normal mission, the only risks offered by the Titan are 

from vehicle hardware which is jettisoned. The impact locations 

and the approximate locus of IIP for launches from Cape Canaveral 

are shown in the map in Figure 10-5. The Stage 1 engine covers 

are not shown there, but are dropped off during the zero-stage 

solid rocket motor phase of flight. This particular launch 

trajectory is intended to have a minimum inclination angle in 

order to support transfer to a geosynchronous orbit. 

The impact locations and the approximate locus of IIP for a Titan 

launch from Vandenberg Air Force Base are shown in the map in 

Figure 10-7. The requirements for "polar" orbits may not 

actually need fly over of the poles, but rather very high 

inclination angles, such as 70o

. In addition, launches with 

inclination angles lower than 90o

 from VAFB can have larger 

payloads. Consequently, launches from VAFB may have a range of 

launch azimuths, as indicated in Figure 10-7, depending on the 

minimum orbital plane inclination angle. 

The liquid fuels which propel the core vehicle and Transtage of 

the Titan are non-cryogenic and storable: Aerozine-50 and 

nitrogen tetroxide used in the core vehicle are highly toxic, if 

released by accidental venting or a spill (see Appendix B and 

Ch.5, Vol.2). Pre-launch and launch hazards are controlled by 

handling and storage regulations and by specifying optimal 

weather conditions for launch which permit toxic vapors and plume 

dispersal in case of an accident. If the vehicle is destroyed, 

these hypergolic propellants do not react as energetically as 

cryogenic propellants. The spontaneous ignition does not allow 

them to mix before igniting and, consequently, they burn, but 

have no significant explosion. However, there was an exception: 

On March 16, 1982, a Titan II, which is basically the first two 

core stages of the Titan 3, blew up in its silo at Little Rock 

Air Force Base near Damascus, Arkansas. A very significant 

explosion resulted which destroyed the entire facility. The 

magnitude of the explosion was ascribed to the confinement 

provided by the silo, which did not permit the propellants to 

scatter while burning. On the other hand, tests of the destruct 

system of the Titan have generally indicated that the unconfined 

burning propellants have very little explosive energy. 

The more pressing problem with Titan liquid propellants is their 

toxicity and corrosivity. The destruction of the vehicle may 

produce a white and reddish-brown (Aerozine-50 and N2O4) cloud 

which is very toxic and also very harmful to vegetation. 

In addition to the liquid propellants, the Titan has strap-on 

solid propellant motors (similar to the Space Shuttle). The 

10-20 
emissions from these engines also contain contaminants which, in 

high concentrations, can be detrimental to agriculture. The main 

hazard associated with the solid rockets is their explosiveness, 

the resulting overpressure and the spread of burning debris. 

Unlike liquid rockets, solid rockets, once ignited, cannot be 

shut down without being destroyed. Destruct action will always 

produce a conflagration and dispersion of burning debris. An 

impact test of an intact Titan solid rocket booster in 1967 

indicated that the resulting explosion would be equivalent to TNT 

having a weight of 7.5 percent of the weight of the propellant in 

the rocket.(7) Some individuals in the explosive safety field 

believe, that under the right circumstances, this equivalent 

yield could be doubled. Others have the opinion that, without 

impact at a significant velocity, the stage will have no TNT 

equivalence (see also Ch.5, Vol.2, for a discussion of yield 

uncertainties). 

10.4.2.2 Atlas/Centaur - The Atlas/Centaur is illustrated in 

Figure 5-7. It is basically a two-stage vehicle consisting of an 

Atlas first stage and a Centaur upper stage. The Atlas is a 

liquid oxygen (cryogenic) and RP-1 (hydrocarbon) powered vehicle 

while the Centaur upper stage is powered by liquid oxygen and 

liquid hydrogen. Neither vehicle offers a toxic threat, but both 

are volatile, particularly the hydrogen/oxygen Centaur stage. The 

primary hazards are blast overpressure and debris from a 

potential explosion. 

At lift-off, the Atlas has thrust provided by three rocket 

engines. After 155 seconds of flight, the two outer engines 

(called the boosters) are shut down and jettisoned on rails (3 

seconds later). The remaining sustainer engine, which is 

designed to be more efficient at higher altitudes, continues 

until all of the fuel has been consumed. During sustainer 

operation, equipment which served a purpose during the operation 

within the atmosphere is also jettisoned. Once the sustainer 

engine is shut down, the Atlas stage is jettisoned, the Centaur 

engines are ignited and the flight continues. The Centaur has 

two burn periods, the first to place the Centaur and payload into 

orbit and the second to put the Centaur and payload into a 

transfer orbit. The Centaur is separated from the payload while 

in the transfer orbit. A solid propellant rocket (Apogee Kick 

Motor or AKM) on the payload may provide the final thrust to 

place the payload in the geosynchronous orbit; other payloads may 

use a liquid fueled motor for final GEO emplacement. 

The same two missions which were discussed for the Titan are 

considered, one producing a low polar orbit and the other 

producing a high equatorial orbit (geosynchronous). The 

Atlas/Centaur is a smaller vehicle than Titan and can place about 

40 percent of the Titan payload in a geosynchronous orbit. 

Figures 10-10 and 10-11 show the IIP loci for Atlas/Centaur 

10-21 
10-22 
10-23 
missions from ESMC and WSMC during the pre-orbital phase. During 

a normal mission, the only hazards associated with the 

Atlas/Centaur launch are from the jettisoned spent stages, whose 

impact locations are shown in the figures. 

The sequence of orbital events for an Atlas/Centaur FLTSATCOM 

mission is shown above in Figure 10-12.(3) This is a mission very 

similar to any other Atlas/Centaur geosynchronous mission, 

although in this particular case, there is no initial parking 

orbit. The vehicle, after becoming orbital, continues to 

accelerate directly into the transfer orbit. Note from Figure 

10-12 that the Apogee Kick Motor burn also provides the plane 

change necessary to achieve an equatorial geosynchronous final 

orbit. 

The hazard potential for the Atlas/Centaur launch will decrease 

with time into mission as the vehicle and payload gain altitude 

and propellant is consumed (see Figs. 5-5 and 5-6 in Ch.5, 

illustrating the risk vs. time for a Delta vehicle). The RP-1 

propellant will not be absorbed into the atmosphere, but it will 

become more widely dispersed as the vehicle reaches a higher 

altitude. Note that RP-1 fuel is not toxic or corrosive in the 

same sense as hypergolic liquid propellants. 

Fewer pieces of debris are expected from an Atlas/Centaur 

destruct than for a Titan. This is because of its smaller size 

and it uses only liquid rocket engines. However, the structure 

of the Atlas is more fragile than that of the Titan and will most 

likely break into more pieces than the Titan core vehicle. The 

very thin Atlas skin pieces will probably scatter more in the 

wind than the Titan pieces and, consequently, the low ballistic 

coefficient portion of the Atlas debris pattern will show greater 

dispersion. In this case, greater dispersion does not mean 

greater risk to ground objects since Atlas debris are lighter and 

smaller. 

If a failure occurs during the Centaur sustainer burn phase of 

the flight and no destruct action takes place, the vehicle may 

remain somewhat intact, depending upon its altitude at that time 

and on the nature of the failure. Normally, the airloads during 

the fall will cause vehicle breakup. If this occurs, the 

propellants will be dispersed and the only hazard will be from 

impacting "inert" debris. If the tanks were to remain intact, 

some explosion might occur at ground impacts. However, it is 

very unlikely that the tanks will remain intact under high 

airloads given their structural vulnerability. 

The principal hazard anticipated is damage from impacting debris. 

If the vehicle is destroyed by a destruct command, there will be 

10-24 
more numerous pieces of debris, but the vehicle will not have 

been allowed to wander over a possibly populated area. 

For launches of geosynchronous satellites from Cape Canaveral, 

the IIP will move over Africa late in pre-orbital flight, as 

described for the Titan in Section 10.2.3. The previous 

discussion of debris impact hazards to Africa and South America 

is also applicable to Atlas/Centaur, except that it will have 

less massive debris and the risks may be reduced by as much as a 

factor of two. 

10.4.2.3 Delta - The Delta launch vehicle offers the variety of 

propellants and components of both the Titan and the 

Atlas/Centaur vehicles. The Delta has strap-on solid propellant 

boosters (Castor 4 for Stage 0), a core booster stage (Stage 1) 

which uses cryogenic liquid oxygen and RP-1, an upper stage 

(Stage 2) which uses liquid storable propellants (Aerozine-50 and 

N2O4) and a Stage 3 which has a solid rocket motor. The Delta has 

been launched in a variety of configurations with different 

numbers of solid rocket boosters and different upper stages. For 

example, the enhanced Delta configuration, illustrated in Ch.4, 

Vol.1, has the capability to place 5,500 lbs. of payload into a 

Low Earth Orbit and 2,800 lbs. of payload in a Geosynchronous 

Transfer Orbit. The hazards from a typical Delta launch failure 

have been discussed qualitatively and illustrated quantitatively 

in Ch.5, Vol.2. 

From a comparative risk standpoint, most of the elements of the 

Delta are on a smaller scale, but there are more of them: there 

is considerably less hypergolic propellant than on the Titan ( 

see Ch.4 and App. B); there are solid boosters as on the Titan, 

but they are much smaller and more numerous; there is also less 

cryogenic propellant in the vehicle than the Atlas/Centaur and 

there is no explosive and combustible liquid hydrogen fuel. A 

strap-down inertial guidance system provides guidance throughout 

booster and upper stage flight. The Delta was considered the 

most reliable ELV by NASA with an overall failure rate of 6.7 

percent, due to 12 failures out of 181 launches; only four launch 

failures required destruct action. Only six failures led to reentry of various stages and payload and only one of the six led 

to ground impact, but no damage was reported (see Table 3-5, Cap. 

3, Vol. 1). A discussion of ELV reliability and the implications 

for public safety from the historical launch statistics were also 

discussed in Ch.3, Vol.1) The most recent launch accident (Delta 

178, on May 3, 1986, at Cape Canaveral) occurred 71 seconds after 

launch when the main engine was prematurely shut-off by an 

electrical short, the vehicle tumbled out of control and had to 

be destroyed by Range Safety (see Ref.to Mishap Report, Ch.9). 

The NOAA weather satellite GOES-G payload was destroyed; no 

damage or injury resulted from debris. 

10-25 
10.4.3 Payload Contributions to Launch and Mission Risk 

The payload can contribute to overall launch and mission hazards 

in several ways: 

(1) The payload can initiate a malfunction in the launch 

vehicle by causing a failure (e.g., electrical short or 

surge) or an explosion during launch which could affect 

the rest of the vehicle. Generally, the payload is 

unlikely to cause a launch vehicle failure. 

(2) The payload could contribute to the amount of the 

hazardous material resulting from the accident. 

Normally this would be in the form of propellant, but 

if a nuclear heat source is considered, the debris from 

an accident could present a significant radioactive 

hazard (see Chs. 7 and 8). 

(3) The payload could re-enter and impact on land along 

with other destruct debris, in case of a launch failure 

that requires destruct action. 

Any payload-related hazards to the public will have to be 

identified, examined, quantified and managed to tolerable levels 

as part of the DOT/ OCST licensing safety audit (see Ch.1, 

Vol.1). 

10.5 BENEFITS OF RANGE SAFETY CONTROL 

10.5.1 Range Safety Control System Reliability 

Range Safety Control systems have played a very important role in 

the success of the space program. Combined with an outstanding 

Risk Prevention and Control program, their success has been such 

that there have been no casualties resulting from in-flight 

launch vehicle failures. As mentioned in Ch. 4, this is due to 

both mission planning and to the design standards and performance 

reliability of the Flight Termination Systems (FTS). The USAF 

design goal for FTS hardware reliability is .999 at a 95% 

confidence level for WSMC and ESMC, whereas the WSMR design goal 

for sub-orbital ELV's is .997 to the same confidence level (see 

Ch.8 and Ch.9 discussions of reliability vs. safety). 

Performance testing and verification of the FTS reliability 

depends on the number of such failures, environmental stress 

during testing or accident and on other accident specifics. The 

reliability that has been achieved is due in part to the 

redundancies built into both the ground and airborne components 

of the systems. There are no published figures on the 

operational reliability of Range Safety systems, but with 

hundreds of vehicles destroyed with no system failures, one could 

conclude that the probability of system failure is less than 1 in 

1000. 

10-26 
10.5.2 Loss and Casualty Potential When Range Safety Controls 

Are Not Used 

The following is intended to discuss worst case loss situations 

for space launches, assuming that vehicles are launched and fail 

over communities and that Range Safety Controls ( chiefly a 

Flight Termination System provided on-board the ELV, as described 

in Ch.2, Vol.1) are not in place. A computer model, Community 

Damage (COMDAM), was developed for this special purpose. The 

concept for this model is shown in Figure 10-13. 

10-27 
The model is deterministic, not probabilistic (see Ch. 8), i.e., 

given a catastrophic ELV failure and the absence of a destruct 

system, it examines the nature and severity of possible 

consequences of interest, namely a conditional casualty 

expectation. In reality, implementation of Range Safety 

restricts launch azimuths as well as decreasing the likelihood of 

any accident that could have public impacts (see Ch.9). 

The launch vehicle is assumed to overfly and fail above a 

community located in the vicinity of the Range. This model might 

apply to evaluating damage from debris impacting in the vicinity 

of a Range, say, to Santa Barbara or the Channel Islands near 

WSMC, or to Miami Beach near ESMC, or to Albuquerque near WSMR. 

These scenarios are obviously unrealistic because launch vehicles 

are neither allowed to overfly populated areas nor allowed to 

proceed without certified Flight Termination Systems. On the 

other hand, COMDAM may afford insight into the potential of 

unconstrained launch operations for accidental casualty and 

property loss. 

For simplicity, the hypothetical community at risk is laid out as 

a square, with several types of structures spaced evenly over the 

area within the community boundaries. The ELV is assumed to fail 

and break into pieces spontaneously due to aerodynamic stress. 

These fragments must be classified according to their ballistic 

coefficient and explosiveness (if solid propellant). The debris 

can be dispersed by scattering (lift/drag) effects and velocity 

impulses which may be imparted to the debris at the time of an 

explosive in-flight failure. If a piece of debris impacts the 

ground and explodes, the overpressure (P) and impulse (I) are 

computed on all of the adjoining structures (see also Ch.5, 

Vol.2). The explosive damage to each structure is computed using 

the formula D = a(Pb

)(Ic), where D is the percent damage and the 

coefficients a, b and c are unique for each different structure 

class and were developed from data gathered from explosive 

accidents.(9,10) If the structure is calculated to be more than 

sixty percent damaged, it is assumed that it must be totally 

replaced and, thus, equivalent to being 100% damaged. The dollar 

loss is obtained by multiplying percent damage times the average 

building value. 

For damage due to inert (non-explosive) debris, kinetic energy 

thresholds are set. If the kinetic energy of an impact fragment 

did not exceed a pre-specified level, it is assumed not to 

penetrate the structure and cause any damage. If it did exceed 

the threshold, the damage to the structure is assumed to be the 

ratio of the area of the fragment to the projected area of the 

structure. Casualty expectations, EC, were computed using the 

model developed in Ref. 13. 

10-28 
The flow diagram for this specifically adopted analytical 

procedure is shown in Figure 10-14. These algorithms and logic 

can be programmed and used to estimate the approximate expected 

losses and casualties similar to those discussed above. One of 

the reasons for developing such an unrealistic worst-case 

consequence model was to show several effects, such as: 

1) the change in total losses as a function of the time of 

launch vehicle failure: 

2) the effect of the distance from the point of launch on 

the population center at risk; and 

3) the influence of exploding debris. 

The COMDAM numbers must be treated as approximate at best, and 

illustrative only, since no specific community has been 

considered and the consequences of accidents can vary 

significantly even under essentially the same conditions. The 

financial (dollar loss) consequence estimates consider only 

damage, and not business interruption costs. 

It should be noted that the above model accounts for structural 

damage produced by: 

1- direct impact of inert fragments 

2- blasts triggered by the explosion of burning fragments 

upon impact with ground. 

Damage mechanisms not included in the model are: 

a- fires initiated by burning fragments upon impact with 

ground (e.g., brush fires, gas main explosions and 

fires). 

b- vapor clouds produced by burnt/unburned propellants. 

c- blast and fire ball produced in the air at the instant 

of vehicle breakup. 

This COMDAM model does not predict what would occur 

realistically, but rather what is the worst that could happen. 

With the addition of launch azimuth restrictions enforced to 

avoid land overflight, the provision of a highly reliable FTS onboard the ELV and an effective ground-based Range Safety Control 

network, such public damage and casualties as a consequence of 

launch accidents become highly unlikely. 

10-29 
10-30 
10.5.3 Comparison of Risk Acceptability 

MIL-STD-882B provides only qualitative definitions of the 

severity and frequency of accidents for the purpose of risk 

assessment.(12) These definitions are reproduced in Tables 10-1 

and 10-2, since they could be used to demonstrate the relative 

acceptability of risks from launch vehicles both with and without 

Range Safety Controls in place. 

Although these qualitative definitions apply to military systems 

including space system certification, acceptance and failure risk 

analysis, they can also be applied to hazard assessment for 

commercial launches. 

Tables 10-3 and 10-4 give two examples from MIL-STD-882B for risk 

acceptability, in the form of a hazard risk assessment matrix.(12) 

The next step is to find the risk associated with ELV launches in 

the hazard frequency/acceptability format exhibited in the 

previous four tables. When a vehicle (e.g., Titan, Atlas/Centaur 

or Delta) is not under Range Safety Control, there is potential 

for catastrophe if the vehicle fails fairly early in flight near 

or over a community. Since all prospective commercial launch 

vehicles have a historical launch failure frequency of more than 

4 percent (range from 4 to 14 percent) (see Ch. 3, Vol 1), this 

must be considered an "occasional event." With the Range Safety 

Control System in place, there is potential for catastrophe only 

when this system fails to perform its function. Given the proven 

reliability of modern Range Safety Control systems, the 

occurrence of a accidental failure with major public safety 

impacts must be considered improbable or remote. 

As the vehicle progresses from launch toward achieving orbit, the 

associated risk to the public is reduced, as discussed in Section 

10.2.3. At this stage the Range Safety System provides little or 

no benefit, because the debris produced from high altitude 

destruct action will be similar to that without destruct and 

there is no way to restrict the impact location of the debris. 

Consequently, both with and without a Range Safety Control 

System, the risk to the public is approximately the same in the 

pre-orbital and orbital stage, a marginal hazard with a remote 

probability of occurrence. In returning from orbit (uncontrolled 

re-entry), there is no possibility of Range Safety Control and 

the public risk is again marginal, with a remote probability of 

debris causing any casualties. 

10-31 
10-32 
10-33 
These conclusions about the relative public risks associated with 

ELV launches are summarized in Table 10-5 using the definitions 

of hazard, frequency and acceptability as specified in MIL-STD882B.(12) 

The conclusion is that a Range Safety Control Systems must be in 

place so that normal, though relatively low probability, launch 

failures become tolerable and permissible from the point-of-view 

of public safety. 

Figure 10-15, reproduced from Ref 14, is a Public Launch Hazard 

Event Tree based on ESMC launch experience, but it also applies 

conceptually to the other National Ranges. It shows that a long 

chain of failure events must take place to expose the public to 

launch or overflight hazards. Conditional probabilities and 

branching of events are also indicated. This type of analysis 

will be applied to evaluate the safety risks associated with 

specific ELV's, launch sites and missions. 

10-34 
10-35 
REFERENCES TO CHAPTER 10 

1. "Explosive Safety Standard," AFR 127-100, Headquarters, 

United States Air Force, Washington, D.C., May 20, 1983. 

2. a) "Titan Analysis Unable to Show Cause of Insulation 

Separation from Casing," Av. Week and Space 

Technology, July 7, 1986. 

b) "Titan Accident Disrupts Military Space Program," 

Science 232, 702, May 9, 1986. 

c) "Air Force Determines Potential Cause of Titan 

Explosion," Science 233, 78 July 18, 1986. 

d) "Titan Solid Booster Failure Caused Vandenberg 

Accident," Av. Week and Space Technology, p. 24, May 5, 

1986. 

3. Report of the Presidential Commission on the Space Shuttle 

Challenger Accident, June 6, 1986, Washington, D.C. 

4. Baecker, James B., William F. Heubach and J. Richard 

Westlake, "Blast Overpressure Window Breakage and Casualty 

Modeling," Report No. 85-3119-2, J. H. Wiggins Co., Redondo 

Beach, California, September 1985. 

5. Collins, Jon D., Moroni Jameson Jr. and J.L. Jantz, "RealTime Debris Patterns for Ballistic Missile Launches," 

Journal of Spacecraft and Rockets, 13, No. 5, May 1976, pp. 

310-315. 

6. Espenshade, Edward B. Jr. and Joel L. Morrison, Goode's 

World Atlas, 17th Edition, Rand McNally and Corp., New York, 

1986. 

7. Hazard, Hap (edited by Heizz F. Gehlhaar and Lt. Ronald G. 

Higden), US Space Launch Systems (Rev. 2), Navy Space 

Systems Activity, Los Angeles, California, July 1, 1977. 

8. Vorwerk, Robert F. and Frederick Weals, "624A Solid 

Propellant Motor Impact Test," Technical Progress Report No. 

381, NOTS TP3674, US Naval Ordinance Test Station, China 

Lake, California, October 1964. 

9. "Range Safety and Range Planning Trajectory Data for the AC68/F-8 Atlas G/Centaur FLTSATCOM Follow-On Mission," Report 

No. GDSS-SP-87-010, General Dynamics Space Systems Division, 

San Diego, California, May 1987. 

10-36 
10. Tancreto, J.E., "Risk Quantification - Part I - Structural 

Damage: State of the Art," TM No. 51-81-02, US Naval Civil 

Engineering Laboratory, Pt. Hueneme, California, January 

1981. 

11. Harnitchek, John J. and Jon D. Collins, "Risk Analysis of 

Titan Launches Over SLC 6," Federal Electric Corporation, 

Vandenberg Air Force Base, California, March 31, 1987. 

12. "Military Standard, System Safety Program Requirements," 

MIL-STD-882B, US Dept. of Defense, March 30, 1983. 

13. Baeker, J.B., J.D. Collins and J.M. Haber, "Launch Risk 

Analysis," Journal of Spacecraft and Rockets, 14, pp. 733-

738, Dec. 1977. 

14. "Baseline Assessment - ESMC," RTI Draft Report for DOT/OCST, 

May 1988. 

10-37 
10/2/95 rev 

APPENDIX A 

GLOSSARY AND DEFINITION OF TERMS 

Many documents have been referenced to obtain the definitions of 

terms that are used in this document. In most cases, the 

definitions from the referenced documents have been used 

directly, while others have been modified to more fully apply to 

the text herein, and where appropriate, some have been developed 

by the authors. 

The referenced documents are as follows: 

1. AFETRM 127-1, Sept. 1972 

2. MIL-STD-882, March 30, 1984 

3. WSMCR 127-1, May 15, 1985 

4. ESMCR 127-1, July 30, 1984 

5. NASA GHB 1771.1, Sept. 14, 1984 

6. Federal Register, Vol. 51, No. 38, Part 401.5 

7. Public Law 98-575, Oct. 30, 1984 

8. UMTA System Safety Glossary, June,1986 

9. The Aerospace Age Dictionary, 1965 

10. The Dictionary of Space Technology, by J.A. Angelo Jr., 

1982 

11. CPIA 394, Sept. 1984 

A-1 
ACCIDENT (MISHAP) - An unplanned and undesirable event 

that results in injury; death (casualty) or damage to 

facilities, equipment, the launch vehicle or public 

property. 

ANALYSIS - Technical procedure, following a prescribed 

pattern. 

ASSESSMENT - Consideration of the results of an analysis 

in a broader context to determine and evaluate their 

significance. 

AEROZINE-50 ( A-50) - A liquid propellant fuel; a mixture 

of 50% (by weight) hydrazine and 50% asymmetrical 

dimethylhydrazine. 

AVERAGE FAILURE RATE - Frequency of failure averaged over 

the time interval of operation (or the number of duty 

cycles) for a component, system or subsystem. 

BLAST - Brief and rapid movement of air or fluid away from 

a center of outward pressure, as in an explosion; the 

pressure accompanying this movement. 

CASUALTY EXPECTATION - The probability of a casualty for 

a probable (or credible) accident scenario under 

consideration 

CREDIBLE CONDITION - A condition that can occur and is 

reasonably likely to occur. 

CREDIBLE ACCIDENT - A probable, possible and/or plausible 

accident scenario, or sequence of failure events which can 

lead to the occurrence of accidents. 

CREDIBLE FAILURE - A failure mode which can be foreseen as 

possible and probable. 

CRITICAL DIAMETER - The diameter of a confined or 

unconfined material below which an explosive reaction will 

not propagate when subjected to induced shock. 

CRITICAL FUNCTION - As applied to nuclear and space launch 

systems, those functions which apply directly to, or 

control, mission success or failure (e.g., functions that 

enable, pre-arm, arm, unlock, release or guide). 

CRYOGEN - A liquid which boils at temperatures of less 

than about 114°K (- 254.4°F) at atmospheric pressure, e.g., 

hydrogen, helium, nitrogen, oxygen, air or methane. 

A-2 
DAMAGE - A loss, negative outcome or undesirable impact of 

an accident. May refer to equipment, property, monetary or 

production loss. 

DEFLAGRATE - Burn at a rapid rate, but below the speed of 

sound in the unreacted medium. 

DELPHI ANALYSIS - A method of risk assessment which 

requires experts' opinions and consensus-building; term 

derives from the ancient Greek Delphi oracle which could 

predict the future. 

DETONATION - An exothermic reaction that propagates with 

such speed that the rate of advance of the reaction zone 

into the unreacted material exceeds the velocity of sound in 

the unreacted material. The rate of advance of the reaction 

zone is termed detonation velocity. When this rate of 

advance attains a value that will continue without 

diminution through the unreacted material, it is termed the 

stable detonation velocity. When the detonation velocity is 

equal to or greater than the stable detonation velocity of 

the explosive, the reaction is termed a "high order" 

detonation. When it is lower, the reaction is termed a "low 

order" detonation. 

DEVIATION - An alternate method of compliance with the 

intent of satisfying specific requirements. A procedure 

differing from established norms and practices. 

DYNAMIC PRESSURE - The air pressure which results from the 

mass air flow (or wind) behind the shock front of a blast 

wave. It is equal to the product of half the density of the 

air through which the blast wave passed and the square of 

the particle (or wind) velocity behind the shock front as it 

impinges on the object or structure. 

EQUIVALENT WEIGHT (EW) - The amount of a standard 

explosive which, when detonated, will produce a blast effect 

comparable to that which results at the same distance from 

the detonation or explosion of a given amount of material 

whose performance is being evaluated. It is usually 

expressed as a percentage of the total weight of all 

reactive materials contained in the item or system. It is 

conventional to use TNT for comparison. 

EVENT - A specific occurrence that is defined by a time 

and location. 

EXPECTED LOSS - The probable loss or damage/casualty level 

for the accident scenario under consideration. 

A-3 
EXPENDABLE LAUNCH VEHICLE (ELV) - A launch vehicle 

(configuration of rocket motors) intended to be used only 

once, because the majority of its components are expected to 

be destroyed or discarded after the launch, during orbit 

insertion and/or re-entry. 

EXPLOSION - A rapid expansion of matter into a volume 

greater than its original one, accompanied (in air) by loud 

sounds. 

EXPLOSIVE - Any chemical compound or mechanical mixture 

which, when subjected to heat, impact, friction, detonation 

or other suitable initiation, undergoes a very rapid 

chemical change with the production of large volumes of 

highly heated gases which exert pressures in the surrounding 

medium. The term applies to materials that either detonate 

or deflagrate. 

FAILURE - A condition of a component, subsystem or system 

in which the intended design or specified operation is not 

met. 

FAILURE ANALYSIS - The process by which the cause, effect, 

responsibility and cost of an accident is determined and 

reported. A method to identify the types of faults or 

malfunctions that may occur and lead to accidents. 

FAILURE MODE - A specific failure for a critical 

component, subsystem or system which can be foreseen or 

identified . 

FAILURE MODE AND EFFECT ANALYSIS (FMEA) - An inductive 

procedure in which potential malfunctions are identified and 

then analyzed as to their possible effects. 

FAULT TREE ANALYSIS (FTA) - A deductive analysis procedure 

which graphically presents all possible sequences of 

failures and chains of events which can result in the final 

undesired event (accident) at the top of the tree; used to 

determine possible and most probable causes. 

FIREBALL - A more or less spherical ball of flames 

produced by the instantaneous release, evaporation and 

ignition of propellants. Generally, the fireball expands 

and rises in the atmosphere until the propellant is 

consumed. 

FIREBRAND - A projected burning or hot fragment whose 

thermal energy is transferred to a receptor. 

A-4 
FLAMMABLE LIMITS - The upper and lower vapor 

concentrations of fuel to air which will ignite and burn 

(i.e., deflagrate) in the presence of external ignition 

sources; often referred to as the explosive range, although 

they are not identical. 

FLASH EVAPORATION - The changing of a liquid propellant 

into a gas when the external pressure is released during the 

rupture of a vessel. 

FLIGHT - That period of time beginning with engine 

ignition and continuing until earth impact for suborbital or 

orbital trajectories, or indefinitely for deep space 

trajectories. 

FLIGHT AZIMUTH - The angular direction of the launch and 

flight trajectory of a launch vehicle measured in degrees 

from true north. 

FLIGHT CORRIDOR - Two-dimensional area on Earth's surface 

(ground track) above which a launch vehicle can fly safely. 

FLIGHT PATH - The path traversed through the atmosphere or 

through space by a launch vehicle or spacecraft. 

FLIGHT PLAN - Description of the proposed launch and its 

events, including description and definition of payload 

orbit. 

FLIGHT SAFETY - Protection of the public health and safety 

and safety of property during the flight of the launch 

vehicle and its payload. 

FLIGHT TERMINATION SYSTEM (FTS) - Explosive or other 

disabling equipment installed in the ELV stages plus 

associated ground equipment for tracking and terminating the 

flight should it become necessary in order to protect people 

and property on the ground from a malfunctioning ELV. Also 

called Flight Safety Control System. A Thrust Termination 

System is a special type of FTS which shuts down the 

propulsion system. 

GEO - Geosynchronous or Geostationary Earth orbit; 

equatorial, high altitude Earth orbits in which a satellite 

rotates with Earth's spin period, thus appearing stationary 

with respect to its sub-Earth point. 

A-5 
GROUND TRACK - The projection of a spacecraft launch, 

flight and orbital trajectory onto the surface of the Earth, 

traced by the motion of its sub- Earth point. 

HAZARD - Any existing or potential condition that can 

cause injury or death, that leads to risk of damage to or 

loss of equipment or property. Also; A source of potential 

damage or harm, in case of an accident. 

HAZARD ANALYSIS - An analysis performed to identify 

hazardous conditions for the purpose of their elimination or 

control. 

HAZARD MANAGEMENT - An element of the system safety 

management function that evaluates the safety effects of 

potential hazards by considering acceptance, control or 

elimination of such hazards. 

HAZARDOUS CONDITION - A situation where, because of the 

nature of the equipment, facilities, personnel, environment 

or operation being performed, there is a potential for an 

accident. For example, hazardous conditions may exist: 

1. During propellant transfer to or from the ELV, whenever 

work is in progress on a rocket containing propellant and 

whenever a solid propellant motor is in a propulsive state. 

2. During installation, electrical connection, testing and 

handling of ordinance items also, while ordinance items are 

electrically connected in the missile. 

3. Whenever vehicle pressurization systems fail to satisfy 

safety factors. 

4. Whenever any toxic or flammable materials are used for 

any purpose in ELV handling areas. 

5. Any time that electrical storms are within five miles 

of the launch complex. 

HAZARDOUS EVENT - An accidental occurrence that endangers 

people or property 

HAZARDOUS EVENT PROBABILITY - The likelihood, expressed in 

quantitative terms, that a hazardous event will occur. Both 

units of frequency, (1/ time) and probability 

(dimensionless), can be used. See also next entry. 

A-6 
HAZARD PROBABILITY - The probability that a hazard will 

occur during the planned life or operation of the system. 

Hazard probability may also be expressed in qualitative 

terms using a relative ranking system, such as: 

A. Frequent 

B. Probable 

C. Occasional 

D. Remote 

E. Improbable 

F. Impossible 

HAZARD SEVERITY - A qualitative measure of the potential 

consequences that could be caused by a specific hazard in 

case of an accident. An example of a hazard severity 

ranking system is: 

A. Catastrophic 

B. Critical 

C. Marginal 

D. Negligible 

HYPERGOLIC - Term applied to the self ignition of a fuel 

and an oxidizer upon mixing with each other without a spark 

or other external aid. 

IGNITION TEMPERATURE - The mean temperature at which a 

combustible material can be ignited and will continue to 

burn when the ignition source is removed. 

The ignition temperature for any one substance will vary 

with its particle size, confinement, moisture content and 

ambient temperature. 

IMPACT AREA - An area surrounding an approved impact point 

for vehicle stages under normal operation or for destructed 

vehicle debris. The extent and configuration of the area is 

based upon the vehicle or stage dispersion characteristics. 

IMPACT LIMIT LINE - A predetermined line defining a limit 

beyond which a failed ELV or its jettisoned spent stages 

will not be allowed to impact on the ground, in order to 

protect people or property. 

IMPULSE - Blast wave parameter denoting the integral of 

pressure over pulse duration. It may be positive or 

negative depending on whether the pressure is above or below 

ambient. 

A-7 
LAUNCH - Release a powered rocket/spacecraft from a 

specially designed launch pad or platform. 

LAUNCH ABORT - Premature and abrupt termination of a 

launch operation because of a potential or diagnosed failure 

of the launch system or noncompliance with the launch safety 

requirements. 

LAUNCH ACTIVITY - The preparation, test or execution of 

launch; the operation of a launch site or both. 

LAUNCH AZIMUTH - The horizontal angular direction 

initially taken by a launch vehicle at lift-off, measured 

clockwise in degrees from true north (see flight azimuth). 

LAUNCH COMPLEX - The facility, usually fenced, which 

contains the ELV launch facilities including: the launch 

pad and servicing structures, the blockhouse or control 

building, propellant transfer equipment, support buildings 

(e.g., vehicle assembly building, VAB) required to support a 

launch. 

LAUNCH CONTROL CENTER (LCC) - The facility from which 

launch operations are conducted and monitored. 

LAUNCH CONTROL OFFICER - The individual who supervises and 

coordinates activities in the launch complex during 

prelaunch and post-launch. Also called Range Safety Officer 

(RSO). 

LAUNCH OPERATION - Site, personnel, procedures, equipment 

and vehicles, which are collectively used for launch 

preparation or launch of a launch vehicle. 

LAUNCH PROPERTY - Propellants, launch vehicles and 

components thereof and other physical items constructed for, 

or used in, the preparation or launch of a launch vehicle. 

LAUNCH RANGE - A finite area along the path of a launch 

vehicle beginning at a launch site and ending at a point 

where the vehicle impacts on Earth, achieves orbit or 

reaches escape velocity. Includes instrumentation 

throughout that area used to monitor the flight of the 

launch vehicle for safety and other purposes. 

LAUNCH SAFETY - Protection of personnel, safety of 

property on the ground and of the public health and safety 

during and after a launch operation. 

A-8 
LAUNCH SERVICES - Activities involved in the preparation 

of a launch vehicle and its payload (including assembly, 

test, integration and environmental protection) for launch 

and the conduct of a launch. 

LAUNCH SITE - The geographical location from which a 

launch takes place, as defined in any license issued or 

transferred by DOT. Includes all facilities located on a 

launch site which are necessary to conduct a launch. See 

also Launch Complex. 

LAUNCH SITE OPERATOR - A sponsoring or contractor 

organization (government or commercial) which has the 

demonstrated capability to satisfactorily conduct a launch 

operation safely from a particular launch site. 

LAUNCH VEHICLE - Any rocket propulsion or similarly 

capable vehicle constructed for the purpose of inserting a 

payload in a ballistic or orbital trajectory. 

LICENSEE - The person or organization authorized by a 

license to conduct specified commercial launch activities 

and who is responsible for conducting such activities in 

conformance with applicable DOT regulatory requirements. 

LIQUEFIED GASES - Substances which are gases at ambient 

conditions of temperature and pressure that have been 

converted to liquids under controlled pressure and 

temperature. 

LOW EARTH ORBIT (LEO) - Orbital altitudes up to about 

1,000 km. (see Ch. 6, Vol.2). 

LOWER FLAMMABLE LIMIT (LFL) - The lowest concentration, by 

percent of volume, of a gas or vapor in the atmosphere at 

normal temperatures and pressures at which the gas or vapor 

will ignite and sustain combustion. 

MISHAP - An unplanned event or series of undesirable 

events that result in death, injury, damage or loss of 

equipment and/or property. (See also ACCIDENT) 

MISSION - The objective to be accomplished by a proposed 

launch and the general plan for achieving that objective, 

namely launch azimuth, site, orbital parameters, vehicle 

configuration, design, etc. 

ORBIT INCLINATION - The angle between the plane of a 

particular orbit and the equator. 

A-9 
ORBITAL INJECTION - The sequence of operations, in time 

and space, whereby a vehicle achieves a combination of 

velocity and position so that its payload is placed into the 

desired Earth orbit. 

ORBITAL VELOCITY - The velocity at which the centrifugal 

force created by the launch vehicle's motion around the 

Earth equals the Earth's gravity; at this point the vehicle 

will orbit the Earth until some other force is applied. 

OBLATENESS - The deviation of the Earth's shape from a 

perfect sphere (flattened poles, bulging equator). 

OVERPRESSURE - Blast wave parameter denoting the peak 

pressure rise over ambient. 

PASCAL - Unit of pressure. 1kPa = 1000 Pa. 1 atmosphere 

= 101 kPa 

POOL FIRE - A fuel film formed on the ground and burning 

in a turbulent diffusion flame located above the film. 

PRELIMINARY HAZARD ANALYSIS (PHA) - A qualitative listing 

and ranking of hazards of interest. 

PROPELLANTS - Balanced mixtures of fuel and oxidizer 

designed to produce large volumes of hot gases at 

controlled, predetermined rates, once the burning reaction 

is initiated. 

PSI - Pounds per square inch, a unit of pressure. 1 

atmosphere = 14.7 psi. 

RESIDUAL RISK - Risk exposure levels which cannot be 

further reduced or eliminated by risk mitigation 

(management) strategies and must be accepted. 

RISK - The potential for an undesirable consequence to 

arise from an accident occurring during a hazardous 

activity. Technically, Risk (R) is the product of the 

probability (p) or frequency (f) of occurrence and its 

consequence (C) (the severity of its impact). 

A-10 
RISK ANALYSIS - A detailed examination of systems and 

operations which involves both the estimation of the 

expected frequency or probability of adverse events and the 

severity (magnitude) of their consequence expressed in units 

of interest (property damage, casualties, down time, 

production or business losses). Risk analysis requires; 

first the identification and characterization of hazards 

(qualitative analysis); then a quantification and ranking of 

hazards in terms of the likelihood of their occurrence, 

severity of their consequence or their expected risk figure. 

RISK ASSESSMENT- Evaluation of analytical results of Risk 

Analysis in a broader context. 

RISK SCREENING - The ordered ranking of hazards so that 

acceptable risk thresholds can be defined and intolerable 

risk levels that require reduction and management resources 

can be identified. 

RISK MANAGEMENT - The process used to form decisions that 

control risk (reduce, eliminate or accept) based on system 

safety analysis. The set of policy and operational control 

options that must be introduced in order to avoid, reduce 

and eliminate risks. Risk management may focus on either 

prevention and diminished probability of occurrence of 

hazardous events or on controlling the impacts of such 

events by emergency preparedness and response planning. 

Risk management options are usually selected based on costbenefit analyses. 

SAFETY ASSESSMENT REPORT (SAR) - A comprehensive 

evaluation of the safety risks being assumed prior to test 

or operation of the system. It identifies all safety 

features of the system, as well as the design and procedural 

hazards present and specific controls to be adopted. 

SAFETY - A reasonable degree of freedom from those 

conditions that can cause injury, death to personnel, damage 

or loss of equipment or property; freedom from danger. 

SAFETY CRITICAL - A designation placed on a system, 

subsystem, element, component, device or function denoting 

that satisfactory operation of such is mandatory to ensure a 

safe operation. Such a designation dictates incorporation 

of special safety design considerations and features. Any 

condition, event, operation, process, equipment or system 

with a potential for major injury or damage. 

A-11 
SAFETY OPERATIONS - Collectively the personnel, equipment, 

facilities, documented plans, procedures and any other 

resource needed for safe preparation and launch of a launch 

vehicle and its payload. 

SHOCK WAVE - A relatively thin region of discontinuity 

which can propagate through fluids and solids and across 

which properties (pressure, velocity, density and 

temperature) change very rapidly. 

SOLID PROPELLANTS - Solid propellants act as 

monopropellants. Homogeneous propellants are true solid 

monopropellants; each molecule contains both fuel and oxygen 

(e.g., nitrocellulose-containing compounds). Composite 

propellants are physical (not chemical) mixtures of a finely 

ground oxidizer in a matrix of plastic, resinous or 

elastomeric fuel (e.g., ammonium perchlorate in a resin 

binder). 

SYSTEM - A composite, at any level of complexity, of 

personnel, procedures, materials, tools, equipment, 

facilities and software. The elements of this composite 

entity are used together in the intended operational or 

support environment to perform a given task or achieve a 

specific production, support or mission requirement. 

SYSTEM SAFETY - The application of engineering and 

management principles, criteria and techniques to optimize 

safety within the constraints of operational effectiveness, 

time and cost throughout all phases of the system life 

cycle. 

SYSTEM SAFETY MANAGEMENT - The element that defines the 

system safety program requirements and ensures the planning, 

implementation and accomplishment of system safety tasks and 

activities. 

SUBORBITAL LAUNCH - A launch during which the vehicle does 

not achieve orbital velocity and, therefore, falls back to 

the Earth's surface following a ballistic trajectory after 

the completion of powered flight. 

SUBORBITAL TRAJECTORY - The ballistic path a launch 

vehicle follows during a suborbital launch. 

THERMAL RADIATION - Thermal energy emitted by hot surfaces 

or gases by virtue of their temperatures. 

THRESHOLD LIMIT VALUE (TLV) - The lowest concentration 

level of a toxic substance at which toxic effects may 

develop. 

A-12 
TNT EQUIVALENT YIELD - Energy release in an explosion 

inferred from measurements of the characteristics of blast 

waves generated by the explosion. 

TRAJECTORY - A series of points in three dimensional space 

relative to time that describes the exact position of the 

vehicle at any time with respect to Earth's surface. 

UPPER FLAMMABLE LIMIT (UFL) - The highest concentration, 

by percent of volume, of a gas or vapor in the atmosphere at 

normal temperatures and pressures at which the gas or vapor 

will ignite and sustain combustion. 

VOLATILE - A substance that has a high vapor pressure 

(i.e., it will readily vaporize) at a low temperature. 

A-13 
10/2/95 rev 

APPENDIX B 

FUEL PROPERTIES AND CHARACTERISTICS 

(from CPIA Publication 394, "Hazards of Chemical Rockets and 

Propellants", by John Hopkins University, Applied Physics 

Laboratory, Laurel, MD, Sept. 1984) 

B-1 
NAME: LH2 — Liquid Hydrogen 

MILITARY HAZARD CLASSIFICATION: Group III 

DOT CLASSIFICATION: Flammable Liquified gas 

QUANTITY PER VEHICLE: 3,400 lb (Centaur) 

APPLICATION: Centaur 

PROPERTIES AND CHARACTERISTICS 

COMPOSITION: 99.79% para-hydrogen and 

0.21% ortho-hydrogen. 

APPEARANCE: High purity Liquid Hydrogen 

is transparent and 

colorless. 

STABILITY: Liquid Hydrogen is 

chemically stable. 

Physically stable only when 

stored under suitable 

conditions. 

FREEZING POINT: -435°F 

BOILING POINT: -423°F 

DENSITY: 0.59 lb/gal. at -423°F 

CRITICAL PRESSURE: 188 PSIA 

CRITICAL TEMPERATURE: -400°F 

ODOR: None 

HAZARDS 

PHYSIOLOGICAL: Human contact with liquid 

hydrogen or uninsulated 

lines can result in severe 

frost bite. Hydrogen gas 

acts as a simple asphyxiant 

that can be breathed in high 

concentrations without 

producing systematic 

effects. However, if the 

concentration is high enough 

to significantly reduce the 

B-2 
amount of oxygen in the air, 

the effects of oxygen 

deprivation will be 

produced. 

EXPLOSION: Unconfined hydrogen-air 

mixtures generally burn 

rapidly without detonation. 

However, in confined areas 

or when ignition is caused 

by a shock source or small 

explosive charge, the 

mixture can detonate. 

An explosion hazard can 

exist if liquid hydrogen is 

contaminated with solid 

oxygen or solidified oxygen 

enriched air. 

THRESHOLD LIMIT VALUE: None 

B-3 
NAME: LOX-Liquid Oxygen 

MILITARY HAZARD CLASSIFICATION: II 

MILITARY STORAGE COMPATIBILITY: LIQ-A 

DOT CLASSIFICATION: Non-Flammable Liquid 

QUANTITY PER VEHICLE: 146,300 lb (an additional 

15,300 lb) 

APPLICATION: First Stage Oxidizer 

PROPERTIES AND CHARACTERISTICS 

COMPOSITION: 99.5% oxygen 

APPEARANCE: Light blue transparent 

liquid. Boils vigorously at 

ambient conditions. 

STABILITY: Liquid oxygen is chemically 

stable, is not shock 

sensitive and will not 

decompose. 

FREEZING POINT: -361°F 

BOILING POINT: 297°F 

DENSITY: 9.53 lb/gal. at -297.4°F 

CRITICAL PRESSURE: 737 PSIA 

CRITICAL TEMPERATURE: -181°F 

ODOR: None 

HAZARDS 

PHYSIOLOGICAL: Human contact with liquid 

oxygen or uninsulated lines 

can result in severe frost 

bite. Oxygen gas will not 

cause toxic effects. 

Gaseous oxygen from the 

liquid is absorbed by 

clothing and any ignition 

source may cause flare 

burning. 

B-4 
EXPLOSION: When mixed with liquid 

oxygen, all materials that 

burn represent explosive 

hazards. 

THRESHOLD LIMIT VALUE: None 

B-5 
NAME: TEA (Triethyl aluminum) TEB 

(Triethyl boron) 

MILITARY HAZARD CLASSIFICATION: III 

MILITARY STORAGE COMPATIBILITY: LIQ-C 

DOT CLASSIFICATION: Flammable Liquid 

QUANTITY PER VEHICLE: 0.17 lb 

APPLICATION: TEA in first stage main 

engine 

TEA/TEB in vernier engines 

PROPERTIES AND CHARACTERISTICS 

COMPOSITION: 100% TEA in main engine 

15% TEA, 85% TEB in vernier 

engines 

APPEARANCE: Colorless liquid 

STABILITY: TEA reacts violently with 

water and organic and 

inorganic acids. TEB reacts 

violently with oxygen. 

TEA TEB 

FREEZING POINT: -52°F -134°F 

BOILING POINT: +381°F +203°F 

DENSITY: 52 lb/cu. ft 43 lb/cu. ft 

at 70°F 

FLASH POINT: Ignites spontaneously in air 

at room temperature. 

ODOR: Combustion products have 

pungent ammonia-like odor. 

HAZARDS 

PHYSIOLOGICAL: TEA and TEB will destroy 

living tissue on contact. 

Combustion products are 

highly toxic. 

B-6 
FLAMMABILITY: TEA and TEB ignites 

spontaneously in air at room 

temperature. 

THRESHOLD LIMIT VALUE: Zero 

B-7 
NAME: Nitrogen Tetroxide 

MILITARY HAZARD CLASSIFICATION: I 

MILITARY STORAGE COMPATIBILITY: LIQ-A 

DOT CLASSIFICATION: Poison Liquid A 

QUANTITY PER VEHICLE: 6,228 lb 

APPLICATION: Second stage oxidizer 

PROPERTIES AND CHARACTERISTICS 

COMPOSITION: 99.5% N204 

APPEARANCE: Reddish-brown liquid with 

yellowish to reddish-brown 

fumes. 

STABILITY: N204 is very stable at room 

temperature. At +302°F it 

begins to dissociate into 

nitric oxide and oxygen, but 

upon cooling it reforms into 

N204. 

FREEZING POINT: +11.8°F 

BOILING POINT: +70.1°F 

DENSITY: 12.1 lb/cu. gal. at 68°F 

CRITICAL TEMPERATURE: 1,469 psia 

CRITICAL PRESSURE: +316.8°F 

FLASH POINT: None 

ODOR: Characteristic irritating, 

pungent and acid-like odor. 

HAZARDS 

PHYSIOLOGICAL: N204 liquid is corrosive and 

can cause severe burns of 

the skin and eyes unless it 

is immediately removed. 

Inhalation of N204 vapors is 

B-8 
normally the most serious 

hazard. 

SYMPTOMS OF POISONING: Irritation of the eyes and 

throat, cough, tightness of 

the chest, and nausea - are 

slight and may not be 

noticed. Then hours 

afterward, severe symptoms 

begin; their onset may be 

sudden and precipitated by 

exertion. Coughing, a 

feeling of constriction in 

the chest, and difficult 

breathing are typical. 

FLAMMABILITY: N204 is a corrosive agent 

whose corrosiveness is 

enhanced in the presence of 

water. It is not sensitive 

to shock, heat, or 

detonation. It is not 

flammable in air but will 

support combustion. 

THRESHOLD LIMIT VALUE: 3 ppm for N02 

2.5 ppm for N204 

At no time will personnel be 

subjected to any 

concentration greater than 

TLV. 

B-9 
NAME: RP-1 

MILITARY HAZARD CLASSIFICATION: I 

MILITARY STORAGE COMPATIBILITY: LIQ-C 

DOT CLASSIFICATION: Flammable Liquid 

QUANTITY PER VEHICLE: 67,000 lb (an additional 

11,000 lb.) 

APPLICATION: RP-1 is a thermally stable 

kerosene having a very high 

energy content. It is used 

for first stage fuel. 

PROPERTIES AND CHARACTERISTICS 

COMPOSITION: Hydrocarbon 

APPEARANCE: Clear liquid ranging in 

color from water-white to a 

pale yellow. 

STABILITY: A mixture of RP-1 and liquid 

oxygen forms a gel which may 

explode upon being subjected 

to impact or shock. 

FREEZING POINT: -40°F Max. 

BOILING POINT: 350° to 525°F 

DENSITY: 49.95 to 50.82 lb/ft3 at 

60°F 

FLASH POINT: 110°F 

ODOR: Strong, kerosene-like 

HAZARDS 

PHYSIOLOGICAL: Inhaling vapors may cause 

headache, dizziness or 

nausea. Continuous contact 

with the skin can cause 

irritation. 

EXPLOSION: A mixture of vapor and air 

is dangerous and should be 

considered as an explosive 

B-10 
mixture. 

THRESHOLD LIMIT VALUE: 500 PPM in air. 

At no time will personnel be 

subjected to any 

concentration greater than 

the threshold limit value 

(TLV). 

B-11 
NAME: Aerozine 50 

MILITARY HAZARD CLASSIFICATION: III 

MILITARY STORAGE COMPATIBILITY: LIQ-C 

DOT CLASSIFICATION: Flammable Liquid 

QUANTITY PER VEHICLE: 3,892 lb 

APPLICATION: Second-stage fuel 

PROPERTIES AND CHARACTERISTICS 

COMPOSITION: Mixture of 50% UDMH and 50% 

hydrazine 

APPEARANCE: Clear, colorless liquid 

STABILITY: A-50 is thermally stable and 

is not shock or friction 

sensitive. 

FREEZING POINT: +18.8°F 

BOILING POINT: +158.2°F 

DENSITY: 56.1 lb/cu. ft at 77°F 

FLASH POINT: +104°F 

CRITICAL TEMPERATURE: +634°F 

CRITICAL PRESSURE: 1,696 psia 

ODOR: Ammonia gas 

HAZARDS 

PHYSIOLOGICAL: The liquid can be absorbed 

through the skin; the vapors 

can be inhaled. Exposure 

may cause irritation of the 

mucous membranes of the 

eyes, respiratory passages, 

lungs,and gastro-intestinal 

tract. Direct skin contact 

can cause severe burns. 

B-12 
MMH and UDMH are convulsant 

agents, irritants to the 

respiratory tract and eyes 

and may irritate the skin. 

They are absorbed by the 

skin, oral and inhalation 

routes. Hydrazine fuels 

form carcinogenic 

nitrosamine compounds. 

Also, ACGIH has listed the 

hydrazines as "Suspected 

Human Carcinogens." 

EXPLOSIVE: Liquid is flammable and 

reacts violently with acids 

and oxidizing agents. 

THRESHOLD LIMIT VALUE: 0.5 ppm in air. 

At no time will personnel be 

subjected to any 

concentration greater than 

the TLV. 

B-13 
NAME: Oronite Extreme Pressure 

Additive 

MILITARY HAZARD CLASSIFICATION: None 

MILITARY STORAGE COMPATIBILITY: None 

DOT CLASSIFICATION: Flammable Liquid 

QUANTITY PER VEHICLE: 5.96 lb 

APPLICATION: First-stage booster engine 

lubricant. 

PROPERTIES AND CHARACTERISTICS 

COMPOSITION: Phosphorus, zinc, sulphur, 

calcium 

APPEARANCE: Transparent, light orange 

oil 

STABILITY: Stable at controlled storage 

temperature below +100°F 

FREEZING POINT: +17°F 

BOILING POINT: Not Available 

DENSITY: 67.8 lb/cu. ft at 60°F 

FLASH POINT: +340°F 

ODOR: Foul, sulphur-like smell 

HAZARDS 

PHYSIOLOGICAL: None. Inhaling vapors is 

unpleasant. 

EXPLOSION: A mixture of additive and 

liquid oxygen forms a gel 

which may explode upon being 

subjected to impact or 

shock; however, such contact 

does not normally occur. A 

mixture of additive and fuel 

is normal in the lubrication 

system and is not hazardous. 

THRESHOLD LIMIT VALUE: None 

B-14