Streamlined Launch and Reentry License Requirements, 79566-79740 [2020-22042]
Download as PDF
<![CDATA[
79566
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Parts 401, 404, 413, 414, 415,
417, 420, 431, 433, 435, 437, 440, 450,
and 460
[Docket No.: FAA–2019–0229; Amdt. No(s).
401–9; 404–7, 413–12, 414–4, 415–7, 417–
6, 420–9, 431–7, 433–3, 435–5, 437–3, 440–
5, 450–2, and 460–3]
RIN 2120–AL17
Streamlined Launch and Reentry
License Requirements
FAA Aviation Administration
(FAA), Department of Transportation
(DOT).
ACTION: Final rule.
AGENCY:
This rule streamlines and
increases flexibility in the FAA’s
commercial space launch and reentry
regulations, and removes obsolete
requirements. It consolidates and
revises multiple regulatory parts and
applies a single set of licensing and
safety regulations across several types of
operations and vehicles. The rule
describes the requirements to obtain a
vehicle operator license, the safety
requirements, and the terms and
conditions of a vehicle operator license.
DATES:
Effective date: This rule is effective
March 10, 2021, except for amendatory
instructions 3, 11, 17, 20, 27, 44 and 54,
concerning §§ 401.5, 413.1, and 413.23,
the removal of parts 415, 417, 431, and
435, and instructions 68 and 73
amending §§ 440.3 and 460.45,
respectively, which are effective March
10, 2026.
Compliance: Affected parties,
however, are not required to comply
with the information collection
requirements in part 450 until the Office
of Management and Budget (OMB)
approves the collection and assigns a
control number under the Paperwork
Reduction Act of 1995. The FAA will
publish in the Federal Register a notice
of the control number assigned by the
Office of Management and Budget
(OMB) for these information collection
requirements.
ADDRESSES: For information on where to
obtain copies of rulemaking documents
and other information related to this
final rule, see ‘‘How To Obtain
Additional Information’’ in the
SUPPLEMENTARY INFORMATION section of
this document.
FOR FURTHER INFORMATION CONTACT: For
technical questions concerning this
action, contact Randy Repcheck, Office
of Commercial Space Transportation,
jbell on DSKJLSW7X2PROD with RULES2
SUMMARY:
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Federal Aviation Administration, 800
Independence Avenue SW, Washington,
DC 20591; telephone (202) 267–8760;
email Randy.Repcheck@faa.gov.
SUPPLEMENTARY INFORMATION:
Authority for This Rulemaking
The Commercial Space Launch Act of
1984, as amended and codified at 51
U.S.C. 50901–50923 (the Act),
authorizes the Secretary of
Transportation to oversee, license, and
regulate commercial launch and reentry
activities, and the operation of launch
and reentry sites within the United
States or as carried out by U.S. citizens.
Section 50905 directs the Secretary to
exercise this responsibility consistent
with public health and safety, safety of
property, and the national security and
foreign policy interests of the United
States. In addition, § 50903 requires the
Secretary to encourage, facilitate, and
promote commercial space launches
and reentries by the private sector. As
codified at 49 CFR 1.83(b), the Secretary
has delegated authority to carry out
these functions to the FAA
Administrator.
This rulemaking amends the FAA’s
launch and reentry requirements,
consolidating and revising multiple
regulatory parts to set forth a single set
of licensing and safety regulations
across several types of operations and
vehicles. It also streamlines the
commercial space regulations by, among
other things, replacing many
prescriptive regulations with
performance-based rules, and giving
industry greater flexibility to develop
means of compliance that maximize
their objectives while maintaining
public safety.
List of Abbreviations and Acronyms
Frequently Used in This Document
AC—Advisory Circular
CEC—Conditional expected casualty
EC—Expected casualty
ELOS determination—Equivalent-level-ofsafety determination
ELV—Expendable launch vehicle
FSA—Flight safety analysis
FSS—Flight safety system
RLV—Reusable launch vehicle
Table of Contents
I. Overview
II. Background
III. Discussion of the Rule
A. Safety Framework
B. Detailed Discussion of the Final Rule
1. Prescriptive vs Performance-Based
Regulations, ELOS, Safety Case
2. Part 450 Subpart A—General Discussion
a. Pre-Application Consultation
b. Application Process
c. Compliance Period for Legacy Licenses
(§ 450.1(b))
d. Definition and Scope of Launch (§ 450.3)
PO 00000
Frm 00002
Fmt 4701
Sfmt 4700
e. Safety Element Approval (Part 414)
f. Vehicle Operator License—Issuance,
Duration, Additional License Terms and
Conditions, Transfer, and Rights Not
Conferred (§§ 450.5 Through 450.13)
3. Part 450 Subpart B—Requirements To
Obtain a Vehicle Operator License
a. Incremental Review and Determinations
(§ 450.33)
b. Means of Compliance (§ 450.35)
c. Use of Safety Element Approval
(§ 450.39)
d. Policy Review (§ 450.41)
e. Payload Reviews (§ 450.43)
f. Safety Review and Approval (§ 450.45)
g. Environmental Review (§ 450.47)
4. Part 450 Subpart C—Safety
Requirements
a. Neighboring Operations Personnel
(§ 450.101(a) and (b))
b. High Consequence Event Protection
(§ 450.101(c))
c. Critical Asset and Critical Payload
Protection
d. Other Safety Criteria (§ 450.101(d), (e),
(f), and (g))
e. System Safety Program (§ 450.103)
f. Hazard Control Strategies (§ 450.107)
g. Hazard Control Strategy Determination
(§ 450.107(b))
h. Flight Abort (§ 450.108)
i. Flight Hazard Analysis (§ 450.109)
j. Physical Containment (§ 450.110)
k. Wind Weighting (§ 450.111)
l. Flight Safety Analysis (§§ 450.113 to
450.139)
m. Flight Safety Analysis Requirements—
Scope (§ 450.113)
n. Flight Safety Analysis Methods
(§ 450.115)
o. Trajectory Analysis for Normal Flight
(§ 450.117)
p. Trajectory Analysis for Malfunction
Flight (§ 450.119)
q. Debris Analysis (§ 450.121)
r. Population Exposure Analysis
(§ 450.123)
s. Probability of Failure Analysis
(§ 450.131)
t. Flight Hazard Area Analysis (§ 450.133)
u. Debris Risk Analysis (§ 450.135)
v. Far-Field Overpressure Blast Effect
Analysis, or Distant Focus Overpressure
(DFO) (§ 450.137)
w. Toxic Hazards (§§ 450.139 and 450.187)
x. Computing Systems (§ 450.141)
y. Safety-Critical Systems Design, Test, and
Documentation (§ 450.143)
z. Flight Safety Systems (§§ 450.143 and
450.145)
aa. Hybrid Vehicles
bb. Agreements and Airspace (§ 450.147)
cc. Safety-Critical Personnel Qualifications
(§ 450.149)
dd. Work Shift and Rest Requirements
(§ 450.151)
ee. Radio Frequency (§ 450.153)
ff. Readiness and Rehearsals (§ 450.155)
gg. Communications (§ 450.157)
hh. Pre-Flight Procedures (§ 450.159)
ii. Control of Hazard Areas (§ 450.161)
jj. Lightning Hazard Mitigation (§ 450.163)
kk. Flight Commit Criteria (§ 450.165)
ll. Tracking (§ 450.167)
mm. Launch and Reentry Collision
Avoidance Analysis Requirements
(§ 450.169)
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
nn. Safety at End of Launch (§ 450.171)
oo. Mishap (Definition, §§ 450.173 and
450.175)
pp. Unique Safety Policies, Requirements
and Practices (§ 450.177)
qq. Ground Safety (§ 450.179 to § 450.189)
5. Part 450 Subpart D—Terms and
Conditions of a Vehicle Operator License
a. Public Safety Responsibility,
Compliance With License, Financial
Responsibility, Human Spaceflight
Requirements (§§ 450.201 to 450.207)
b. Compliance Monitoring (§ 450.209)
c. Continuing Accuracy of License
Application; Application for
Modification of License (§ 450.211)
d. Pre-Flight Reporting (§ 450.213)
e. Post-Flight Reporting (§ 450.215)
f. Registration of Space Objects (§ 450.217)
6. Changes to Parts 401, 413, 414, 420, 433,
437, and 440
7. Miscellaneous Comments
8. Responses to Regulatory Impact Analysis
Comments
IV. Regulatory Notices and Analyses
A. Regulatory Evaluation
B. Regulatory Flexibility Act
C. International Trade Impact Assessment
D. Unfunded Mandates Assessment
E. Paperwork Reduction Act
F. International Compatibility
G. Environmental Analysis
V. Executive Order Determinations
A. Executive Order 13771, Reducing
Regulation and Controlling Regulatory
Costs
B. Executive Order 13132, Federalism
C. Executive Order 13211, Regulations
That Significantly Affect Energy Supply,
Distribution, or Use
VI. How To Obtain Additional Information
Rulemaking Documents
Comments Submitted to the Docket
Small Business Regulatory Enforcement
Fairness Act
I. Overview
jbell on DSKJLSW7X2PROD with RULES2
Overview of Final Rule
This rule amends 14 CFR parts 415,
417, 431, and 435 by consolidating,
updating, and streamlining all launch
and reentry regulations into a single part
450. After March 10, 2026, parts 415,
417, 431, and 435 will be removed. This
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
rule also revises multiple regulatory
parts to apply a single set of licensing
and safety regulations across several
types of operations and vehicles. In
addition, this rule replaces many
prescriptive regulations with
performance-based rules, giving
industry greater flexibility to develop
means of compliance that meet their
objectives while maintaining public
safety. Where possible, the FAA has
adopted performance standards, and
considered the prescriptive
requirements for placement in advisory
circulars (AC) that will identify possible
means of compliance, but not the only
means of compliance, with this rule.
The goal of this approach is to afford the
industry and the FAA the added
flexibility of using new methods to
better enable future innovative concepts
and operations. While some of the
provisions in this rule may increase the
risk to public safety compared to the
current regulations, such as the
provisions that apply to neighboring
operations personnel, the FAA has
ensured that the increased risk is
minimal and there is a corresponding
public interest benefit.
Part 450 accommodates all vehicle
operators, including hybrid vehicle
operators. The revisions include more
performance-based requirements,
alternatives to flight abort and flight
safety analysis (FSA) requirements
based on demonstrated reliability, use of
equivalent level of safety (ELOS) for the
measurement of a high consequence
event, and allowing application process
alternatives as agreed to by the FAA.
Part 450 is divided into subparts A
through D. Part 450 is organized by
sections that have both safety
requirements for what an operator must
do to be safe and application
requirements for what must be
submitted in an application. By
‘‘applicant,’’ the FAA intends to
PO 00000
Frm 00003
Fmt 4701
Sfmt 4700
79567
reference an applicant for either a
vehicle operator license, an incremental
approval, a payload determination, a
policy approval, or an environmental
determination. By ‘‘operator,’’ the FAA
intends to reference the holder of a
license, which is consistent with the
definition of ‘‘operator’’ in § 401.7.
This preamble will discuss in detail
the safety framework encapsulated in
part 450, part 450 requirements in
sequential order, followed by
corresponding and related changes to
other parts, and cost implications for
this rule.
i. Subpart A
Subpart A includes a general
discussion on the application process,
licensing scope and duration, and
compliance dates. Pre-application
consultation, which may include
discussion of any applicable flexibilities
in the application process, scope of
license, and means of compliance, is
required by part 413.
Figure 1 illustrates the licensing
process. The licensing process begins
with pre-application consultation,
which sets the stage for an applicant to
submit a license application. The
application evaluation consists of five
major components: (1) A policy review,
(2) a payload review, (3) a safety review,
(4) a determination of maximum
probable loss (MPL) for establishing
financial responsibility requirements,
and (5) an environmental review. The
license specifies the range of activities
the licensee may undertake along with
any limitations. Requirements after a
license is issued encompass the
licensee’s responsibility for public
safety and compliance with its license,
representations in the license
application, and FAA regulations. An
important component of this
compliance is the FAA’s authority to
perform safety inspections.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
In the final rule, the FAA does not
make any changes to the existing preapplication consultation provision,
except to update the term ‘‘safety
approval’’ to the newly adopted ‘‘safety
element approval.’’ The FAA makes this
change to delineate between the safety
approval portion of a license application
and a safety element approval that the
FAA grants under Part 414. This
distinction between terms will not affect
industry.
During the pre-application
consultation stage, an applicant will
work with the FAA to develop an
application and licensing process that
best fits its proposed operation. This
stage will focus on compliance planning
and positioning the applicant to prepare
an acceptable application, which will
increase the efficiency of the licensing
process. The length of pre-application
consultation will vary based on the
proposed operation. For example, preapplication consultations may be
lengthy when involving new launch
vehicles that are under development or
with operators inexperienced with the
FAA’s regulations. Alternatively, preapplication consultation with
experienced operators using proven
vehicles from established sites may be
considerably shorter.
During this stage, the FAA expects to
discuss the following topics with an
applicant: Entrance and exit criteria for
pre-application consultation, the
intended means of compliance to meet
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
the regulatory requirements in part 450,
the scope of the license, safety element
approvals, incremental review, review
period for license evaluation,
compliance expectations, and time
frames an operator is required to meet
to satisfy part 450. Some of the topics
allow for flexibility that can result in a
more efficient licensing process for both
the applicant and the FAA.
The rule allows an applicant and the
FAA flexibility to establish the scope of
the license. Determining the point at
which launch begins will be discussed
during pre-application consultation.
The applicant will describe to the FAA
its launch site and its intended concept
of operations leading up to a launch,
including any operations that are
hazardous to the public. Once the FAA
and the applicant have a mutual
understanding of the applicant’s
intended concept of operations, the
FAA will determine what constitutes
hazardous pre-flight operations and thus
the beginning of launch. The applicant
will then scope its application materials
based on this starting point.
In the Notice of Proposed Rulemaking
(NPRM), the FAA proposed to set the
scope of activity authorized by a vehicle
operator license by identifying the
beginning and end of launch and
reentry. The final rule provides
flexibility to scale the beginning of
launch to the operation. Specifically,
the FAA will identify the beginning and
end of launch on a case-by-case basis
PO 00000
Frm 00004
Fmt 4701
Sfmt 4700
and in consultation with an applicant.
The final rule does not adopt the
proposed default that hazardous ground
pre-flight operations commence when a
launch vehicle or its major components
arrive at a U.S. launch site. Instead, the
final rule identifies certain activities
that qualify as hazardous pre-flight
operations, including, but not limited
to, pressurizing or loading of
propellants into the vehicle or launch
system, operations involving a fueled
launch vehicle, the transfer of energy
necessary to initiate flight, or any
hazardous activity preparing the vehicle
for flight. This rule also clarifies that
hazardous pre-flight operations do not
include the period between the end of
the previous launch and launch vehicle
reuse when the vehicle is in a safe and
dormant state.
For the end of launch and reentry, the
FAA replaces each use of ‘‘vehicle
stage’’ in the proposed rule with
‘‘vehicle component’’ in the final rule.
The FAA adopts this change in
recognition that components other than
vehicle stages may return to Earth. Also,
the FAA now includes ‘‘impact or
landing’’ in the end of launch and
reentry sections in the scope of license
requirements to accommodate
increasing efforts to reuse components.
ii. Subpart B
Subpart B contains the requirements
to obtain a vehicle operator license. The
topics include incremental review and
determinations, means of compliance,
E:\FR\FM\10DER2.SGM
10DER2
ER10DE20.000</GPH>
jbell on DSKJLSW7X2PROD with RULES2
79568
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
policy review, payload review, safety
review and approval, and
environmental review. This rule retains
the key components of a license
application review: The policy review,
payload review, safety review, MPL
determination, and environmental
review. This rule continues to allow
operators to submit the payload, policy,
environmental, and financial
responsibility portions of its application
independently of each other.
The final rule will also allow an
applicant to submit an application for a
safety review in modules using an
incremental approach approved by the
FAA. The safety review is typically the
most complex part of the license
application and usually involves
submission of numerous documents. In
this rule, the FAA has concluded that a
structured approach agreed to during
pre-application consultation will reduce
regulatory uncertainty by allowing the
FAA to affirm at an early stage of
development that the proposed safety
measure or methodology meets the
FAA’s requirements. An applicant must
have its incremental review approach
approved by the FAA prior to
submitting its application so that the
FAA can ensure that the modules can be
reviewed independently and in a
workable order under an agreed time
frame.
The rule makes it easier for an
applicant to seek a safety element
approval in conjunction with its license
application. A safety element approval
is an FAA document containing the
FAA determination a safety element,
when used or employed within a
defined envelope, parameter, or
situation, will not jeopardize public
health and safety or safety of property.
A safety element includes a launch
vehicle, reentry vehicle, safety system,
process, service, or any identified
component thereof; and qualified and
trained personnel, performing a process
or function related to licensed activities
or vehicles. An applicant may also
leverage existing safety element
approvals by citing a safety element
approval in another license application,
thus streamlining the subsequent
licensing process.
After the final rule becomes effective
on March 10, 2021, operators holding an
active launch or reentry license, or who
have an accepted launch or reentry
license application within 90 days after
the effective date, may choose to operate
under parts 415 and 417 for expendable
launch vehicles (ELVs), part 431 for
reusable launch vehicles (RLVs), or part
435 for reentry vehicles, until five years
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
after the effective date of this rule.1 All
operators, including those exercising
this provision, must come into
compliance with this regulation’s
requirements for critical asset protection
and collision avoidance (COLA)
analysis beginning from the effective
date of this rule. Any operator may also
choose to operate under part 450 on the
effective date of this rule. Operators
conducting operations under parts 415,
417, 431 or 435 may submit requests for
license renewals such that their license
remains valid for up to five years after
the effective date of this rule. A license
renewal issued after the effective date of
this rule will be valid for no longer than
five years after the effective date of this
rule.2 All operators will need to comply
with all parts of this rule five years after
its effective date. Any operator may also
choose to operate under part 450 on the
effective date of this rule.
For an application for a license
modification submitted after this rule
becomes effective and within five years
of the effective date, the FAA will
determine the applicability of part 450
on a case-by-case basis. In determining
whether to apply part 450 in evaluating
a license modification under this
scenario in consultation with the
applicant, the FAA will consider the
extent and complexity of the
modification, whether the applicant
proposes to modify multiple parts of the
application, and if the application
requires significant reevaluation.
The final rule allows most time
frames to be determined during preapplication consultation, or during the
application review process. An operator
may propose alternative time frames for
any of the requirements listed in the
newly created Appendix A to part 404.
Compliance with the performance
requirements in this rule may be
demonstrated by using a means of
compliance that is accepted by the FAA.
Means of compliance may be
government standards, industry
consensus standards, or unique means
of compliance developed by an
individual applicant. During preapplication consultation, the FAA will
work with applicants on compliance
planning. The FAA will review the
submitted means of compliance to
determine whether they satisfy the
regulatory safety standard.
1 The FAA refers to these licenses as ‘‘legacy
licenses’’ throughout this preamble. After that time,
all operators must come into compliance with the
new regulations.
2 Operators holding a part 431 mission operator
license have a 2-year renewable period, operators
holding a part 435 reentry operator license have a
2-year renewable period, and operators holding a
part 415 launch operator license have a 5-year
renewable period.
PO 00000
Frm 00005
Fmt 4701
Sfmt 4700
79569
For five requirements, an applicant
must use a means of compliance the
FAA has accepted in advance of
submitting an application. Those
requirements for which an applicant
must use an accepted means of
compliance in advance are identified in
§ 450.35 and include FSA methods,
airborne toxic concentration and
duration thresholds for any toxic
hazards for flight, highly reliable flight
safety systems (FSS), lightning commit
criteria, and airborne toxic
concentration and duration thresholds
toxic hazard mitigation for ground
operations. For all other requirements,
an applicant may include an accepted
means of compliance or a means of
compliance the FAA has not yet
accepted as part of its application for
the FAA to review during application
evaluation. The FAA will publish any
publicly available means of compliance
that it accepts. In addition, an operator
may request that the FAA publish the
operator’s unique means of compliance,
once reviewed and accepted.
The FAA evaluates five major
components in an application for a
vehicle operator license. The FAA
adopts the proposed requirements for
the policy review without modification.
For the FAA to conduct a policy review,
an applicant must identify the launch or
reentry vehicle and its proposed flight
profile, and describe the vehicle by
characteristics that include individual
stages and their dimensions, the type
and amounts of all propellants, and
maximum thrust. The final rule clarifies
that a payload review is not required
when the proposed launch or reentry
vehicle will not carry a payload or when
the payload is owned or operated by the
U.S. Government. The FAA will
continue to conduct safety reviews to
determine whether an applicant is
capable of conducting a launch or
reentry without jeopardizing public
health and safety and safety of property
as specified in §§ 415.103, 431.31(a),
and 435.31. Finally, the FAA adopts
with revisions the proposed
requirements for environmental review.
The revisions include clarification on
the FAA requirements for an
Environmental Assessment (EA) and the
FAA’s responsibility to determine
whether a Categorical Exemption
(CATEX) applies, in accordance with
current regulations. The MPL
calculation and financial responsibility
requirements are discussed under
Subpart D.
iii. Subpart C
Subpart C addresses safety
requirements. In the final rule, the FAA
revises numerous sections under
E:\FR\FM\10DER2.SGM
10DER2
79570
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
subpart C in response to public
comments on the proposed rule, so that
the rule is more performance-based.
Subpart C includes regulations for key
areas of concern to Federal launch or
reentry sites that had not been covered
in previous FAA regulations (e.g., the
treatment of neighboring operations
personnel and critical assets, including
critical payloads). Throughout this
document, the terms ‘‘Federal launch or
reentry sites’’ and ‘‘Federal sites’’
replace the NPRM’s use of ‘‘Federal
launch range.’’
The FAA structured the rule to
facilitate elimination of duplication of
the requirements of Federal launch or
reentry sites by incorporating critical
asset protections, to avoid the need for
Federal sites to impose this
requirement. The rule also creates a
path for the FAA to determine that a
Federal launch or reentry site’s ground
safety processes, requirements, and
oversight are not inconsistent with the
Secretary’s statutory authority over
commercial space activities.
The safety criteria in § 450.101 (Safety
Criteria) set the public and property
safety criteria that must be met before an
operator may initiate the flight of a
launch or reentry vehicle.3 The
quantitative safety criteria continue to
be the linchpin requirement for flight
safety, which is fundamental for all
operators. There are quantitative risk
criteria for collective risk, individual
risk, and aircraft risk. The final rule
applies collective and individual risk
criteria to people on waterborne vessels,
enabling risk management techniques
that previously required a waiver. The
rule carves out neighboring operations
personnel on a launch or reentry site as
a separate category of the public subject
to different risk criteria. This rule also
adds risk criteria for the protection of
critical assets essential to the national
interests of the United States, including
a more stringent requirement for the
protection of critical payloads. The final
rule uses conditional risk management
3 The FAA changes the title of § 450.101 from
‘‘public safety criteria’’ in the NPRM to ‘‘safety
criteria’’ in the final rule. This is because the FAA
changed the definition of ‘‘public’’ in new § 401.7
of the final rule. In the NPRM, ‘‘public’’ was
defined to include ‘‘people and property that are
not involved in supporting the launch or reentry
and includes those people and property that may
be located within the launch or reentry site, such
as visitors, individuals providing goods or services
not related to launch or reentry processing or flight,
and any other operator and its personnel.’’ In the
final rule, the FAA removed references to property,
limiting the scope of the term ‘‘public’’ to people.
This was done to provide better clarity throughout
part 450 regarding the protection of people,
property, or both. Because § 450.101 includes
criteria for both people and property, the FAA
removes ‘‘public’’ from the title.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
to ensure (1) mitigations, such as flight
abort, will be implemented to protect
against high consequence events, and
(2) implementation of mitigations will
produce reasonable conditional risks.
The rule allows for neighboring
operations personnel to be protected as
members of the public, but to a less
stringent risk threshold as compared to
other members of the public. In the final
rule, the FAA adopts the proposed
requirements on neighboring operations
personnel in §§ 401.7, 440.3, 450.101(a)
and (b), and 450.137 (Far-field
Overpressure Blast Effect Analysis)
paragraph (c)(6), but removes the phase
‘‘as determined by the Federal or
licensed launch or reentry site operator’’
from the definition of ‘‘neighboring
operations personnel’’ in § 401.7.
Instead, the Federal or licensed site
operator will determine those persons
who are eligible for neighboring
operations personnel status in
coordination with the operators at the
site and in accordance with definition
in § 401.7. A site operator at a nonFederal site will have the option to
designate certain personnel as
neighboring operations personnel.
In the final rule, critical assets include
property, facilities, or infrastructure
necessary to maintain national security,
or assured access to space for national
priority missions. In the final rule, the
FAA does not adopt the proposed
requirement for operators to calculate
the risks to critical assets in preparing
a flight hazard analysis, debris analysis,
and debris risk analysis. The FAA
anticipates that it will perform all
critical asset and critical payload risk
assessments for commercial space
transportation operations involving nonFederal sites.
Under § 450.101(c) of the NPRM, the
FAA proposed to require an operator to
use flight abort as a hazard control
strategy if the consequence of any
reasonably foreseeable vehicle response
mode, in any one-second period of
flight, is greater than 1 × 10¥3 CEC for
uncontrolled areas. The FAA amends
the title of § 450.101(c) from ‘‘Flight
Abort’’ in the NPRM to ‘‘High
Consequence Event Protection’’ in the
final rule, because the final rule allows
an operator to use a method other than
flight abort in certain situations in
which the operator can show sufficient
protection against high consequence
events. The FAA retains the CEC
requirement as a quantitative criterion
that an applicant must use to measure
high consequence events, but revises the
final rule to allow ELOS for the CEC
requirement. The final rule also allows
options for how an applicant may
protect against a low likelihood, high
PO 00000
Frm 00006
Fmt 4701
Sfmt 4700
consequence event in uncontrolled
areas for each phase of flight, such as
using flight abort in accordance with
§ 450.108 (Flight Abort) or
demonstrating that CEC is below a
certain threshold without using flight
abort.
The FAA adopts with revisions the
proposal that an operator must
implement and document a system
safety program throughout the
operational lifecycle of a launch or
reentry system in § 450.103 (System
Safety Program). The system safety
program includes a safety organization,
hazard management, configuration
management and control, and post-flight
data review. In the final rule, the FAA
removes the proposed term
‘‘operational’’ to clarify that the
regulation applies to hazards throughout
the lifecycle of a launch or reentry
system—not just to operational hazards.
The FAA also does not adopt the
proposed requirement in § 450.105 to
conduct a preliminary safety
assessment, because that requirement
has been replaced with a requirement to
conduct a functional hazard analysis
under the Hazard Control Strategies
section in the final rule.
In the NPRM, the FAA proposed
under the Hazard Control Strategies
section (§§ 450.107 to 450.111) that, for
each phase of a vehicle’s flight, an
operator would not need to conduct a
flight hazard analysis for that phase of
flight if the public safety and safety of
property hazards identified in the
preliminary safety assessment could be
mitigated adequately to meet the
requirements of proposed § 450.101
using physical containment, wind
weighting, or flight abort. In the final
rule, the FAA concludes that an
operator must use one or more of the
hazard control strategies defined in
§§ 450.108 through 450.111 to meet the
safety criteria. The FAA also adds a new
paragraph to this section to address how
an operator determines its hazard
control strategy or strategies for any
phase of flight during a launch or
reentry.
The FAA adopts proposed § 450.108,
which is a consolidation and revision of
several proposed sections associated
with flight abort requirements in the
NPRM. As a result of this consolidation,
the FAA removes the flight abort related
requirements in §§ 450.123, 450.125,
450.127, and 450.129. The requirements
in these sections have been revised to be
performance-based standards included
in § 450.108(c), which addresses flight
safety limits objectives, and
§ 450.108(d), which addresses flight
safety limits constraints.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Section 450.109 (Flight Hazard
Analysis) details requirements for an
operator using a flight hazard analysis
as its hazard control strategy for one or
more phases of flight. A flight hazard
analysis must identify, describe, and
analyze all reasonably foreseeable
hazards to public safety and safety of
property resulting from the flight of a
launch or reentry vehicle, mitigate
hazards as appropriate, and validate and
verify the hazard mitigations. The FAA
revises the final rule to reflect that
performing a flight hazard analysis is
included as a hazard control strategy to
derive hazard controls for the flight, or
phase of flight, of a launch or reentry
vehicle.
Regardless of the hazard control
strategy chosen or mandated an operator
must conduct an FSA to demonstrate
quantitatively that a launch or reentry
meets the safety criteria for debris, farfield overpressure, and toxic hazards.
An operator may be required to conduct
additional analyses to use flight abort or
wind weighting hazard control
strategies. The FAA anticipates that an
operator will be required to conduct
some FSA for at least some phases of
flight, regardless of the hazard control
strategy chosen or mandated. For
example, an FSA must determine flight
hazard areas for any vehicle with
planned debris impacts capable of
causing a casualty.
The FAA revises the FSA
requirements in § 450.113 (Flight Safety
Analysis Requirements—Scope), which
establish the portions of flight for which
an operator would be required to
perform and document an FSA. An
operator must perform and document an
FSA for all phases of flight, unless
otherwise agreed to by the FAA. The
FAA may agree there is no need for an
FSA for certain phases of flight based on
demonstrated reliability for any launch
or reentry vehicle, instead of just for
hybrid vehicles as proposed in the
NPRM. The FAA expands this exception
because, conceivably, an operation
involving a vehicle other than a hybrid
could have an extensive and safe
enough flight history to demonstrate
compliance with the risk criteria in
§ 450.101 based on empirical data in
lieu of the traditional risk analysis.
An FSA generally consists of a set of
quantitative analyses used to determine
flight commit criteria, flight abort rules,
flight hazard areas, and other mitigation
measures, and to demonstrate
compliance with the safety criteria in
§ 450.101. In the NPRM, the FAA
proposed 15 sections associated with
FSA requirements in §§ 450.113 to
450.141. The final rule moves
requirements associated with flight
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
safety limits to § 450.108 and condenses
the remaining FSA requirements into 11
performance-based sections that cover
the scope of the analyses, general
methodology requirements, and specific
sections on normal trajectories,
malfunction trajectories, hazardous
debris characterization, population
exposure, probability of failure, flight
hazard areas, debris risks, and far-field
overpressure blast effects. The FAA
moved some of the proposed FSA
requirements such that an operator
could generally perform the analyses in
the order that they appear in the final
rule, if they choose.
The FAA revises the FSA sections to
be more performance-based than what
was proposed in the NPRM.
Specifically, the FAA revises the FSA
requirements to identify their
fundamental purpose, the essential
constraints, and the objectives in each
section. The FSA requirements in the
final rule are consistent with current
practice, but the rule articulates
important, often misunderstood, aspects
of flight analysis such as the creation of
hazard areas and other operating
constraints necessary to protect public
health and safety and safety of property.
Sections 450.139 (Toxic Hazards for
Flight) and 450.187 (Toxic Hazards
Mitigation for Ground Operations)
contain the requirements for toxic
release analysis. In the final rule, the
FAA adopts §§ 450.139 and 450.187
with some revisions. The FAA clarifies
that operators are not required to
perform a toxic release hazard analysis
for kerosene-based fuels unless directed
by the FAA. Also, the FAA revises the
requirements for performing toxic
containment.
In the NPRM, § 450.111 contained
computing systems and software
requirements. In the final rule, the FAA
revises and relocates the requirements
for computing systems and software to
§ 450.141 (Computing Systems and
Software). In response to comments, the
FAA revises the requirements of
§ 450.141 to be more performancebased, and levies requirements for
computing system safety items in
proportion to their criticality instead of
the item’s level of autonomy. The final
rule also requires independent
verification and validation for
computing system safety items that meet
the definition of ‘‘safety-critical’’ in
§ 401.7.
The requirements of § 450.143 (SafetyCritical System Design, Test, and
Documentation) apply to all safetycritical systems except highly reliable
FSS and safety-critical software items,
which are regulated by the requirements
in §§ 450.145 and 450.141 respectively.
PO 00000
Frm 00007
Fmt 4701
Sfmt 4700
79571
In the final rule, the FAA revises the
reference to FSS requirements in
§ 450.143(a); amends § 450.143(b) to
include other means of compliance and
broader safe design concepts; and
removes the term ‘‘vehicle’’ in
§ 450.143(c) because safety-critical
systems can be located off-vehicle. In
addition, the FAA amends the
application requirements in § 450.143(f)
to require that applicants describe the
method used to validate predicted
operating environments and any
standards used for each safety-critical
system.
Section 450.145 (Highly Reliable
Flight Safety System) contains the
requirements for certain FSS. The FAA
revises § 450.145 to apply to a highly
reliable FSS, which consists of any
onboard portion and if used, any
ground-based, space-based, or otherwise
not onboard portion of the system.
Conventional FSS with airborne flight
termination receivers and ground-based
command transmitter systems will have
both airborne and ground-based
subsystems. The final rule provides
additional flexibility for operations
where the CEC is between 1 × 10¥2 and
1 × 10¥3 and exempts the FSS for such
operations from the requirements of
§ 450.145; however, the FSS for such
operations must still meet the
requirements of § 450.143. The FAA
makes these changes to scope the FSS
design, testing, and analysis more
closely to potential consequence and
risk. These changes will reduce burden
on operators that have a lower potential
for causing high consequence events.
The FAA also removes the reliability
threshold required of an FSS for
operations where CEC is between 1 ×
10¥2 and 1 × 10¥3. The final rule
provides that an FSS required for
operations for which the CEC is between
1 × 10¥2 and 1 × 10¥3 must meet the
requirements of § 450.143.
Section 450.147 (Agreements)
requires a vehicle operator to have a
written agreement with any entity that
provides a service or use of property to
meet a requirement in part 450. In the
final rule, the FAA requires an operator
to enter into multiple agreements if the
operator works with multiple entities.
Also, operators will continue to be
required to enter into agreements with
the appropriate entities for launches and
reentries that cross airspace or impact
water not under U.S. jurisdiction.
Section 450.153 contains the
requirements for radio frequency. In the
NPRM, the FAA proposed that an
operator would be required to identify
each frequency, all allowable frequency
tolerances, and each frequency’s
intended use, operating power, and
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79572
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
source; and provide for the monitoring
of frequency usage and enforcement of
frequency allocations. In the final rule,
the FAA adopts the proposed
requirements with modifications to the
performance-based objectives central to
radio frequency management. Operators
will be required to ensure that radio
frequency does not adversely affect the
performance of FSS or safety-critical
systems, and to coordinate radio
frequency with local and Federal
authorities.
Section 450.157 contains the
requirements for communications. In
the NRPM, the FAA proposed that
personnel that have authority to issue
‘‘hold/resume,’’ ‘‘go/no go,’’ and abort
commands must monitor each common
intercom channel during countdown
and flight. The FAA does not adopt the
proposal because it was overly
prescriptive.
Section 450.161 (Control of Hazard
Areas) contains the control of hazard
areas. In the final rule, the FAA does not
remove the requirement for an operator
to verify that warnings have been issued
when the operator relies on another
party to publicize those warnings.
Instead, the FAA clarifies that the
requirement may be met by
demonstrating due diligence pursuant to
agreements that the operator has with
that party and notifying the FAA of any
deviations from the agreements by any
party. The FAA also adds an application
requirement for the applicant to give a
description of how the applicant will
provide for any publication of flight
hazard areas.
In the final rule, the FAA does not
adopt the four mishap categories
proposed in the NPRM. The FAA agrees
with commenters that the regulatory
requirements for the proposed mishap
classes, from most severe (Class 1) to
least severe (Class 4), were largely the
same, and concludes that the mishap
classes are not needed to achieve the
objective of consolidating mishaprelated terms and streamlining the
requirements to report, respond to, and
investigate mishaps. Instead, the FAA
combines the substantive criteria of
Mishap Classes 1–4 under the definition
of ‘‘mishap.’’ The revised definition in
the final rule describes events that
constitute a mishap. The requirements
to report, respond to, and investigate
mishaps are incumbent upon an
operator regardless of a mishap’s
severity.
Section 450.173 (Mishap Plan—
Reporting, Response, and Investigation
Requirements) contains the
requirements for the mishap plan. In the
final rule, the FAA does not adopt the
proposed requirement for a licensee to
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
cooperate with FAA and NTSB
investigations contained in the NPRM.
The FAA finds this requirement
duplicative of § 450.13, which states
that a vehicle operator license does not
relieve a licensee of its obligations to
comply with all applicable requirements
of law or regulation that may apply to
its activities. Also, the final rule
standardizes criteria for mishap plans
across all of 14 CFR Chapter III by
making § 450.173 applicable to launch
and reentry licensees, experimental
permittees, and site operators.
The FAA proposed to give license
applicants and licensees the option to
pre-coordinate testing activities with the
FAA. In the final rule, the FAA clarifies
that § 450.175 (Test-induced Damage)
will only apply to licensees or license
applicants who choose to apply for the
exception. The final rule also allows an
operator to coordinate the possibility of
test-induced damage prior to an
operation and exclude damage meeting
certain requirements from constituting a
mishap, thereby reducing unnecessary
reporting.
v. Subpart D
Subpart D addresses the terms and
conditions of a vehicle operator license.
This includes compliance monitoring
(§ 450.209), material changes and
continuing accuracy (§ 450.211), preflight reporting (§ 450.213), post-flight
reporting (§ 450.215), and registration of
space objects (§ 450.217). In the final
rule, the FAA adopts these sections as
proposed with the exception of
revisions to § 450.213 (Pre-flight
Reporting) as described below.
The final rule makes few changes to
the post-licensing requirements, for
which the final rule standardizes
requirements for all launches and
reentries from Federal sites and
commercial spaceports or exclusive use
launch sites. In line with the previous
requirements, operators will provide
information and comply with reported
collision avoidance closures. A Federal
agency will continue to provide
operators the appropriate launch or
reentry closures, but the rule allows the
possibility of some other entity’s
providing this service in the future. The
final rule offers operators flexibility, in
coordination with the FAA, to use
different timelines for the submission of
pre-flight and post-flight reports. The
FAA revises § 450.213(d) to allow an
operator the flexibility to identify an
appropriate time frame in coordination
with the FAA. The FAA also revises
§ 450.217(c) so that licensees will only
need to notify the FAA that they
removed an object from orbit if removal
PO 00000
Frm 00008
Fmt 4701
Sfmt 4700
occurs during or immediately after
licensed activities.
II. Background
This rulemaking arose from work by
the National Space Council that led to
President Donald J. Trump’s Space
Policy Directive-2 (SPD–2) in May 2018,
directing the U.S. Department of
Transportation to streamline the
regulations governing commercial space
launch and reentry licensing. The goals
of this streamlining include creating a
single licensing regime for all types of
commercial space flight launch and
reentry operations, and replacing
prescriptive requirements with
performance-based criteria. The final
rule is consistent with DOT’s
regulations under 49 CFR 5.5(e), which
instruct that regulations should be
technologically neutral, and, to the
extent feasible, should specify
performance objectives, rather than
prescribing specific conduct that
regulated entities must adopt.
On March 8, 2018, the FAA chartered
the Streamlined Launch and Reentry
Licensing Requirements Aviation
Rulemaking Committee (ARC) to
provide a forum for a broad range of
stakeholders from the aviation and
space communities to discuss
regulations to set forth procedures and
requirements for commercial space
transportation launch and reentry
licensing. The FAA tasked the ARC with
developing recommendations for a
performance-based regulatory approach
in which the regulations set forth the
safety objectives to be achieved while
providing the applicant flexibility to
produce tailored and innovative means
of compliance.
On April 30, 2018, the ARC submitted
its final recommendation report to the
FAA.4 The FAA addressed the
recommendations in more detail
throughout the NPRM. This final rule
incorporates recommendations provided
by the ARC.
On March 26, 2019, the FAA posted
on its website an NPRM titled ‘‘Launch
and Reentry Licensing Requirements’’
that would revise parts 401, 404, 413,
414, 415, 417, 420, 431, 433, 435, 437,
and 440, and create a new part 450. In
the NPRM, the FAA proposed to
streamline and increase flexibility in the
FAA’s commercial space launch and
reentry regulations, remove obsolete
requirements, consolidate and revise
multiple regulatory parts, and apply a
single set of licensing and safety
4 Streamlined Launch and Reentry Licensing
Requirements ARC, Recommendations Final Report
(April 30, 2008). The ARC Report is available for
reference in the docket (Docket FAA–2019–0229).
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
regulations across several types of
operations and vehicles.
On April 15, 2019, the FAA published
this NPRM in the Federal Register (85
FR 15296). The initial comment period
was 60-days from the date of
publication, ending on June 14, 2019.
In the ensuing month, commenters
submitted fifty-six requests for an
extension of the comment period to a
total of 120 days, or until August 13,
2019.
In response, on May 31, 2019, the
FAA published an extension of the
comment period on the NPRM (84 FR
25207), for an additional 45-days to July
30, 2019, to allow commenters more
time to analyze the proposed rule.
On June 14, 2019, the FAA posted to
the docket a response 5 to MLA Space,
LLC, which had requested that the FAA
reconvene the ARC to engage in
dialogue regarding the NPRM. In the
response, the FAA stated its belief that
engagement with industry in the form of
an ARC, a public meeting, or through a
special session of Commercial Space
Transportation Advisory Committee
(COMSTAC) would not be beneficial at
that point in the rulemaking process.
The FAA encouraged members of
industry to submit any questions
requesting clarification regarding the
NPRM to the docket.
On July 16, 2019, the FAA posted to
the docket the first of its responses 6 to
FAA–2019–0229–0088.
6 See FAA–2019–0229–0106.
jbell on DSKJLSW7X2PROD with RULES2
5 See
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
commenters’ questions requesting
clarification. Also on July 16, 2019, the
FAA posted a statement 7 to the docket
encouraging commenters to post any
further requests for clarification in the
docket as soon as possible. That
statement reasserted the FAA’s
judgment that further engagement with
industry through a public meeting to
have clarifying dialogue regarding the
NPRM would not be beneficial, but also
offered to entertain meetings in the
month of July 2019 with members of the
public who wished to provide to the
FAA their information bearing on the
proposed rule.
Subsequently, the FAA met with Blue
Origin,8 the Coalition for Deep Space
Exploration,9 Space Exploration
Technologies Corp. (SpaceX),10 Virgin
Galactic,11 and Virgin Orbit 12 to receive
their clarifying questions and a preview
of their comments on the NPRM.13
On July 22, 2019, the FAA published
a second extension of the comment
7 See
FAA–2019–0229–0107.
FAA–2019–0229–0127.
9 See FAA–2019–0229–0178.
10 See FAA–2019–0229–0129.
11 See FAA–2019–0229–0128.
12 See FAA–2019–0229–0126.
13 Since the information provided at these
meetings is already captured in these commenters’
clarifying questions or comments submitted to the
docket, the FAA gave these commenters the option
of not posting to the docket a summary of the
meeting, as required by the FAA’s Statement
Regarding Requests for Public Meetings (see FAA–
2019–0229–0107), as this would be a duplicative
effort.
8 See
PO 00000
Frm 00009
Fmt 4701
Sfmt 4700
79573
period to the NPRM (84 FR 35051). To
provide commenters with sufficient
time to review the FAA’s clarifications
in response to the commenter’s
questions, the FAA extended the
comment period to August 19, 2019.14
On August 16, 2019, the FAA posted
its response to the docket 15 to
commenters’ questions for clarification
received by July 12, 2020, and July 29,
2019.
On August 19, 2019, the comment
period closed, with a total of 155
submissions from 85 commenters, and
two submissions containing proprietary
information. Of these comments, 62
requested an extension of the comment
period, 10 requested to reconvene the
ARC, 29 requested a public meeting, 18
requested a Supplemental Notice of
Proposed Rulemaking (SNPRM), 18
contained clarifying questions for parts
of the NPRM, and 53 comments
contained substantive feedback
regarding the proposed rule. The FAA
discusses the adjudication of these
comments in more detail later in the
preamble.
III. Discussion of the Rule
A. Safety Framework
14 See
84 FR 35051.
FAA–2019–0229–0134 and FAA–2019–
0229–0135.
15 See
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
General. The final rule relies on a
safety framework that provides the
flexibility needed to accommodate
current and future launch and reentry
operations. The safety framework
encompasses both ground safety and
flight safety. Acceptable safety for
ground operations is achieved primarily
through a process-based hazard analysis
and certain prescribed hazard controls.
Acceptable safety for flight operations is
achieved through several elements
discussed further in this preamble
section. The FAA identifies specific
safety criteria and requirements in
§ 450.101 that must be met before a
launch or reentry can take place,
including collective risk, individual
risk, aircraft risk, risk to critical assets,
protection against high consequence
events, disposal of orbiting stages, risk
to people and property on orbit, and
notification of planned impacts.
System Safety Program. All operators
are required to have a system safety
program that establishes system safety
management principles for both ground
safety and flight safety throughout the
operational lifecycle of a launch or
reentry system. The system safety
program includes a safety organization,
hazard management, configuration
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
management and control, and post-flight
data review.
Hazard Control Strategies. To address
the wide variety of commercial launch
and reentry systems and operations
concepts, the final rule includes four
hazard control strategies. An operator
can use multiple hazard control
strategies during flight because different
strategies may be appropriate for
different phases of flight. Different
hazard control strategies may also be
appropriate during any one phase of
flight to protect different sets of people
and property. The hazard control
strategies are physical containment,
wind weighting, flight abort, and flight
hazard analysis.
• Physical containment would most
likely be used for low energy test flights,
when a launch vehicle does not have
sufficient energy for any hazards
associated with its flight to reach the
public or critical assets.
• Wind weighting is traditionally
used in the launch of unguided
suborbital launch vehicles, otherwise
known as sounding rockets, where the
operator adjusts launcher azimuth and
elevation settings to correct for the
effects of wind conditions at the time of
flight to provide impact locations for the
PO 00000
Frm 00010
Fmt 4701
Sfmt 4700
launch vehicle or its components that
will ensure compliance with the safety
criteria in § 450.101.
• Flight abort is the traditional safety
approach for expendable launch
vehicles, and is a process to limit or
restrict the hazards to public safety and
the safety of property presented by a
launch vehicle or reentry vehicle,
including any payload, while in flight
by initiating and accomplishing a
controlled ending to vehicle flight. With
the exception of phases of flight with
demonstrated reliability, flight abort is
mandated as a hazard control strategy if
the potential for a high consequence
event is above a certain threshold.
• Flight hazard analysis is the
traditional safety approach for reusable
launch vehicles, and is the most flexible
hazard control strategy because an
operator derives specific hazard controls
unique to its launch or reentry vehicle
system and operations concept. Flight
hazard analysis is mandated as a hazard
control strategy if the other three hazard
control strategies cannot mitigate the
safety hazards sufficient to meet the
safety criteria of § 450.101.
An operator determines the
appropriate hazard control strategy by
conducting a functional hazard analysis.
E:\FR\FM\10DER2.SGM
10DER2
ER10DE20.001</GPH>
jbell on DSKJLSW7X2PROD with RULES2
79574
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Flight Safety Analyses. Regardless of
the hazard control strategy chosen or
mandated, an operator is required to
conduct several FSA. These include
trajectory analyses for normal and
malfunction flight, a debris analysis, a
population exposure analysis, and a
probability of failure analysis. These
analyses provide input to a debris risk
analysis, a far-field overpressure blast
effects analysis, and a toxic hazard
analysis that together demonstrate
compliance with the safety criteria of
§ 450.101, and provide input to a flight
hazard area analysis.
Derived Hazard Controls. With
respect to flight operations, an operator
would derive several hazard controls by
conducting the FSA and, if necessary, a
flight hazard analysis. Because hazard
controls are derived from these
analyses, they are not specifically
addressed in part 450.
Prescribed Hazard Controls for
Computing Systems and Software and
Safety-Critical Hardware. Regardless of
the hazard controls derived from a flight
hazard analysis and FSA, the FAA
requires many other hazard controls.
The first set of hazard controls includes
requirements for computing systems
and software, safety-critical systems,
and highly reliable FSS.
Other Prescribed Hazard Controls.
The second set of hazard controls have
historically been necessary to achieve
acceptable flight safety. These include
requirements for (1) written agreements,
(2) safety-critical personnel
qualifications, (3) work shift and rest
requirements, (4) radio frequency
management, (5) readiness, (6)
communications, (7) pre-flight
procedures, (8) control of hazard areas,
(9) lightning hazard mitigation, (10)
flight commit criteria, (11) tracking, (12)
collision avoidance, (13) safety at the
end of launch, and (14) mishap plans.
Ground Safety. With respect to the
safety of ground operations, the safety
framework includes (1) coordination
with a site operator, (2) explosive siting,
(3) a ground hazard analysis, (4) toxic
hazard mitigations, and (5) prescribed
hazard controls addressing visitors,
countdown aborts, fire suppression, and
emergency procedures. These together
provide an acceptable set of public
safety considerations for ground
operations.
jbell on DSKJLSW7X2PROD with RULES2
B. Detailed Discussion of the Final Rule
1. Prescriptive vs Performance-Based
Regulations, ELOS, Safety Case
i. Prescriptive
The FAA sought in the NPRM to
propose changes that would convert
many of its prescriptive requirements to
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
more performance-based requirements
that would allow for different means of
compliance. The FAA received several
comments stating generally that the
proposed rule was still too prescriptive.
The Commercial Spaceflight Federation
(CSF) and SpaceX commented that some
of the proposed requirements would
unnecessarily drive applicants to a
burdensome equivalent level of safety
(ELOS) process as a default. Blue Origin
recommended broadly that the FAA
remove all prescriptive portions of the
proposed rule.16
The FAA agrees that some of the
requirements in proposed part 450 were
unnecessarily prescriptive, particularly
those for software and FSA. The FAA
has modified those requirements to
remove unnecessary prescriptiveness
and provide additional flexibility while
still preserving safety and providing
regulatory clarity. For many of the
requirements amended for this purpose
in the final rule, the prescriptive parts
of the proposal will be moved to a
corresponding AC as guidance on means
of compliance. Specific changes to the
requirements are discussed later in this
preamble.
Several commenters, including Blue
Origin, CSF, and SpaceX, also stated
that the FAA should base its new
requirements on parts 431 and 435 and
add details on how to comply through
guidance. CSF also stated that the FAA
ignored the draft regulatory text
provided by the ARC, which used parts
431 and 435 as a basis for updated rules.
The FAA disagrees that parts 431 and
435 should be used as the sole basis for
part 450. Part 431 depends on an
operator to use the system safety process
to derive hazard controls, which as
reflected in part 450, is appropriate for
some launch and reentry vehicle
systems and operations. However, as
also reflected in part 450, not all launch
and reentry vehicle systems and
operations require an operator to derive
hazard controls through the system
safety process. Specifically, physical
containment, wind weighting, and, most
importantly, flight abort are often
sufficient. Part 450 incorporates the
flexibility of part 431, but acknowledges
16 Blue Origin submitted to the rulemaking docket
a letter to Admiral James Ellis, Jr, USN (ret.),
Chairman, Users’ Advisory Group, National Space
Council, in which Blue Origin expressed concerns
with the NPRM. The letter encouraged Adm. Ellis
to communicate the concerns to the Administration
and the members of the National Space Council and
advise the Office of the Secretary of Transportation
and FAA to engage further with industry through
a public meeting to address concerns with the
NPRM and then to issue a supplemental NPRM that
achieves the goals of SPD–2. The FAA is construing
the contents of the letter as comments on the
proposals in the NPRM.
PO 00000
Frm 00011
Fmt 4701
Sfmt 4700
79575
the acceptability of other hazard control
strategies. Part 450 also builds on the
precedent set by part 431’s limits on the
foreseeable consequences of a failure in
terms of conditional expected casualties
and establishes a less stringent
threshold.17 Furthermore, the FAA
stated in the NPRM that it would not
specifically address the ARC’s proposed
regulatory text because that regulatory
text did not receive broad consensus
within the ARC.
One individual commenter noted that
streamlining was long overdue. Another
individual commenter noted that the
proposed rule is longer and more
complicated than the rule it proposes to
replace, and that past FAA approaches
led to codifying Federal launch and
reentry site requirements, which the
Federal sites subsequently changed such
that they no longer matched the FAA
requirements.
In response, the FAA notes that the
proposed regulation combined elements
from parts 415, 417, 431, and 435. Part
450 is shorter than parts 415 and 417
and more performance-based. Although
it is longer than parts 431 and 435, part
450 is more flexible and encompasses
more types of launch and reentry
operations. This final rule allows
operators to use a means of compliance
that will accommodate customized
operations, changing technologies, and
innovation.
ii. Equivalent Level of Safety (§ 450.37)
In the NPRM, the FAA proposed in
§ 450.37 (Equivalent Level of Safety)
that for all requirements in part 450,
except § 450.101, an applicant may
clearly and convincingly demonstrate
that an alternative approach provides an
equivalent level of safety (ELOS) to the
requirement.
In the final rule, the FAA revises
§ 450.37 so that only some portions of
§ 450.101—specifically § 450.101(a), (b),
(c)(1), (c)(3), (d), (e)(1), and (g)—are
excluded from eligibility for an ELOS
approach. This change allows an
applicant to propose an equivalent level
of safety to the orbital debris
requirement in § 450.101(e)(2) and the
notification of planned impacts
requirement in § 450.101(f). Most
significantly, this change also allows an
applicant to propose an equivalent level
of safety to the use of a CEC of 1 × 10¥3
17 Section 431.43(d) sets a limit for foreseeable
public consequences in terms of CEC, but only for
an unproven RLV. Section 431.43(d) provides an
unproven RLV may only be operated so that during
any portion of flight, the expected number of
casualties does not exceed 1 × 10¥4 given a vehicle
failure will occur at any time the instantaneous
impact point is over a populated area. This is in
greater detail in the high consequence event
protection section of the preamble.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79576
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
as the measure of a high consequence
event in § 450.101(c)(2). Section
450.101(c) is discussed more fully later
in this preamble.
Virgin Galactic commented that ELOS
determinations should be part of the
license application process. The FAA
agrees with the comment and
incorporates ELOS determinations into
the license application process. To
exercise this option, an applicant must
demonstrate, through technical
rationale, that the proposed alternative
provides a level of safety equivalent to
the requirement it would replace. The
FAA will evaluate the proposal during
the application evaluation.
CSF stated that, if the FAA adopted
the parts 431 and 435 framework, ELOS
would be unnecessary because the
ELOS process does not exist under those
regulations.18 Blue Origin urged the
FAA to consider the need for an ELOS
option in this rule.
In response to CSF’s comments, the
FAA acknowledges that, in theory, a
performance-based regulation like part
450 could function without an ELOS
provision, because, in concept, a
performance-based rule allows many
different means of compliance with the
required safety standard. The FAA
considered eliminating the ELOS
provision from the final rule, but
decided that eliminating the ELOS
provision would remove a useful
regulatory tool that provides flexibility.
Unlike means of compliance, which
demonstrate compliance with the
regulation, ELOS allows an applicant to
propose and demonstrate a method that
ensures an ELOS to the requirement, but
not necessarily compliance with the
requirement itself. The FAA has chosen
to retain the option of ELOS to allow
operators to propose unique processes
and procedures that this rule may not
have contemplated.
Blue Origin stated that it supports the
use of safety cases as a means to
establish an ELOS under proposed
§ 450.37. A safety case is a structured
argument, supported by a body of
evidence that provides a compelling,
comprehensive, and valid case that a
system is safe, for a given application in
a particular setting. Regarding process,
Blue Origin recommended requiring
only one layer of external-to-applicant
audit, and that the audit criteria be
transparently developed with industry
input to ensure understanding of the
scope of compliance with the ELOS
proposal process. Another individual
commenter stated that the FAA should
18 The FAA added equivalent level of safety
provisions to parts 431 and 435 in a 2018 final rule.
83 FR 28528 (June 20, 2018).
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
add a provision that would allow use of
an alternate process for obtaining a
license based on the use of a ‘‘safety
case’’ methodology. This methodology
would consist of voluntary audits of an
applicant’s safety and risk management
program, followed by development of a
safety case showing how the public
would be protected during licensed
activities.
The FAA finds that the proposed
regulation is flexible in allowing an
applicant to propose a means of
compliance. It also affords the
possibility of meeting most
requirements by demonstrating an
ELOS.19 An applicant may wish to use
a safety case to demonstrate that it is has
satisfied the ELOS standard; however,
the FAA declines to add prescriptive
audit requirements for its use. An
applicant could, but is not required to,
use a safety case to show that a certain
method satisfies an ELOS to a regulatory
requirement, excluding the
requirements of § 450.101(a), (b), (c)(1),
(c)(3), (d), (e)(1), and (g). A safety case
is not required to demonstrate ELOS. It
is one way to provide rationale for
ELOS. An applicant could use a safety
case or other justification for ELOS.
Virgin Galactic recommended that
safety cases be counted as an alternative
to CEC in § 450.101(c). The Boeing
Company (Boeing), Lockheed Martin
Corporation (Lockheed Martin),
Northrop Grumman Corporation
(Northrop Grumman), and United
Launch Alliance (ULA) sought
clarification as to why § 450.37 would
not apply to § 450.101. Similarly, Blue
Origin, CSF, SpaceX, and Virgin
Galactic commented that ELOS should
be allowed for § 450.101(c).
The FAA agrees with allowing ELOS
for § 450.101(c)(2). This allows an
operator to make a safety case or
provide some other justification for an
ELOS determination for an alternative
method to protect against a high
consequence event, such as safeguards
other than flight abort, or an alternative
to CEC as a measurement of the potential
for a high consequence event, such as a
risk profile, both of which are described
more in the preamble section discussing
§ 450.101(c). Section 450.101(a), (b),
(c)(1), (c)(3), (d), (e)(1), and (g) contain
the core safety requirements to protect
people and property on land, at sea, in
the air, and in space. Any proposed
non-compliance with these risk
requirements will require a waiver and
are not eligible for a demonstration of
ELOS. By contrast, all other flight safety
requirements in part 450 subpart C,
19 ELOS is not applicable to § 450.101(a), (b),
(c)(1), (c)(3), (d), (e)(1), and (g).
PO 00000
Frm 00012
Fmt 4701
Sfmt 4700
which can be demonstrated through
ELOS, support the achievement of these
underlying risk criteria. To use an
ELOS, an operator may demonstrate that
an alternative approach provides an
equivalent level of safety to a
requirement in accordance with
§ 450.37. A petition for waiver must be
submitted at least 60 days in advance
and address why granting the request
for relief is in the public interest and
will not jeopardize the public health
and safety, safety of property, and
national security and foreign policy
interests of the United States in
accordance with § 404.5.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA commented that
the FAA should accept a Federal launch
or reentry site’s safety processes as
providing an ELOS to the FAA’s own
safety standards without any additional
safety requirements.
The FAA disagrees. FAA regulations
apply to licensed launches and, in
accordance with § 450.45(b) (Safety
Review and Approval), the FAA will
accept any safety-related launch or
reentry service provided by a Federal
launch or reentry site or other Federal
entity by contract, if the FAA
determines that the launch or reentry
service satisfies part 450. Although it is
possible for the FAA to find that a
service provided by a Federal launch or
reentry site does not satisfy a
requirement in part 450 but does
provide an ELOS, the FAA needs to
make that determination on a case-bycase basis.
iii. ‘‘As agreed to by the Administrator’’
Throughout the NPRM, the FAA used
the clause ‘‘as agreed to by the
Administrator.’’ The term was used in
all time frame requirements, as well as
in proposed §§ 450.3(a) and (b)(1),
450.33, 450.101(c), 450.113(a)(5),
450.107(b)(2), 450.107(d), 450.147(c),
450.173(g), 450.213(a), and 450.215(b).
As stated in the proposal, this clause is
used to mean that an operator may
submit an alternative to the proposed
requirement to the FAA for review. The
FAA must agree to the operator’s
proposal for the operator to use the
alternative.
CSF and SpaceX commented that it
was unclear how the clause ‘‘as agreed
to by the Administrator’’ differed from
an ELOS determination. CSF and
SpaceX requested that the FAA describe
its expectations and capture any process
associated with this option in guidance.
CSF and SpaceX also recommended
adding ‘‘unless otherwise agreed to by
the Administrator’’ to the beginning of
proposed § 450.101(c).
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
The clause ‘‘as agreed to by the
Administrator’’ means that an operator
may submit an alternative to a
regulatory requirement. The FAA must
agree to the operator’s proposal for the
operator to use this alternative. Unlike
an ELOS determination, an applicant
need not demonstrate that this
alternative satisfies an ELOS to the
requirement. Each use of the term ‘‘as
agreed to by the Administrator’’
includes criteria or considerations by
which the FAA will agree to a different
approach than the regulatory
requirement. An applicant should look
to these criteria or considerations to
determine what the FAA would expect
from an applicant when providing an
alternative proposal.
For most of the requirements in part
450, an applicant may demonstrate an
equivalent level of safety if the
applicant is unable to meet a
requirement. In addition, an operator
may request a waiver to any
requirement. An ELOS may be
submitted in a license application and
must clearly and convincingly
demonstrate that an alternative
approach provides an equivalent level
of safety to the requirement. A petition
for waiver must be submitted 60 days in
advance and address why granting the
request for relief is in the public interest
and will not jeopardize the public
health and safety, safety of property,
and national security and foreign policy
interests of the United States.
For some requirements, the FAA
anticipated the need for additional
regulatory flexibility without the burden
of providing an equivalent level of
safety or applying for a separate waiver.
For those requirements, the FAA has
incorporated the clause ‘‘as agreed to by
the Administrator’’ to mean that an
operator may submit an alternative to
the proposed requirement to the FAA
for review. For each requirement where
the FAA has provided additional
flexibility by including the ‘‘as agreed to
by the Administrator’’ clause, the FAA
has also provided criteria that the
Administrator will consider in
determining whether to approve the
alternative approach, including safety
considerations when appropriate. For
example, an alternative time frame will
generally be accepted if it provides
sufficient time for the FAA to review the
submittal. These alternatives will
typically be agreed to in pre-application
consultation.
The FAA addresses the
recommendation from CSF and SpaceX
by including ELOS in § 450.101(c)(2).
The use of ELOS and ‘‘agreed to by the
Administrator’’ for § 450.101(c) is
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
discussed in more detail in the
preamble section addressing CEC.
iv. Time frames
In the NPRM, the FAA proposed to
allow an operator to propose different
time frames for certain regulatory
sections if ‘‘agreed to by the
Administrator’’. Blue Origin, CSF, and
SpaceX disagreed with this approach
and requested that the FAA remove any
requirement to submit such a request in
a specific time frame other than as soon
as the operator understands that a
different time frame is necessary. Virgin
Galactic recommended that alternate
time frames should be spelled out
within an operator’s license application
documents and suggested alternative
regulatory text.
The FAA disagrees with the approach
to remove specific time frames because
the time frames are designed to ensure
the FAA has sufficient time to conduct
its review and make the requisite public
health and safety, safety of property,
and national security and foreign policy
findings. The FAA notes that the time
frames proposed in the NPRM and
adopted in the final rule are default time
frames. An applicant can propose and
the FAA can accept an alternative time
frame. The FAA expects alternative time
frames to be proposed and accepted
during pre-application consultation or
during the application process so that
the agreed to time frames are then
reflected in the license once issued.
Time frames can be adjusted after a
license is issued through the license
modification process, as opposed to the
waiver process under the current
regulations. However, in most cases, the
FAA expects flexible time frames to be
negotiated for all the launches or
reentries under the license prior to the
first licensed activity.
v. Level of Rigor Based on Experience
An individual commenter stated
startup launch operators should not
operate under the same regimen as
experienced operators. This individual
stated that startup operators should be
subject to strict and precise regulations.
Similarly, another individual expressed
concern that the proposed rule would
apply performance-based requirements
to launch vehicles with no prior launch
history. SpinLaunch, Inc. (SpinLaunch)
commented that the correct regulatory
framework should consist of an
applicant’s demonstrating the necessary
skills and knowledge to perform safe
and accepted operations.
The FAA disagrees that startup
launch operators should operate under
a different regulatory regime than
experienced operators, and that
PO 00000
Frm 00013
Fmt 4701
Sfmt 4700
79577
performance-based requirements should
not apply to launch vehicles with no
prior launch history. Performance-based
requirements provide flexibility to all
operators. Means of compliance located
in ACs and other standards that have
been identified as accepted means of
compliance to part 450 provide detailed
guidance to those new operators that
have not yet established safety processes
and procedures. In response to
SpinLaunch’s comment, the final rule is
structured such that an applicant must
demonstrate to the FAA the necessary
skills and knowledge to perform safe
operations in its launch or reentry
license application.
2. Part 450 Subpart A—General
Discussion
a. Pre-Application Consultation
In the NPRM, the FAA proposed to
retain the requirement for preapplication consultation from § 413.5
(Pre-Application Consultation) because
the various flexibilities proposed in this
rule would benefit from pre-application
discussions. These include incremental
review, timelines, and the performancebased nature of the regulatory
requirements. In the final rule, the FAA
adopts the proposal with no changes to
the existing pre-application consultation
provision.
As proposed, this rule retains preapplication consultation for vehicle
operators seeking a license. The FAA
will also publish a pre-application
consultation Advisory Circular, which
will provide additional guidance but
will not establish new regulatory
requirements. Pre-application
consultation will continue to focus on
compliance planning and ensuring the
applicant can prepare an acceptable
application, which will increase the
efficiency of the licensing process. The
length of pre-application consultation
will vary based on the proposed
operation. For example, pre-application
consultations may be longer when
involving new launch vehicles that are
under development or with operators
inexperienced with FAA’s regulations.
Alternatively, pre-application
consultations with operators who
demonstrate knowledge of FAA
regulations and/or use proven vehicles
from established sites should be
considerably shorter. The FAA expects
to discuss the following topics with an
applicant during pre-application
consultation, to the extent they are
relevant to the applicant’s proposed
operation: Entrance and exit criteria for
pre-application consultation, the
intended means of compliance to meet
the regulatory requirements in part 450,
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79578
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
the scope of the license, safety element
approvals, incremental review, review
period for license evaluation,
compliance expectations, and time
frames an operator is required to meet
to satisfy part 450. Some of the topics
allow for flexibility that can result in a
more efficient licensing process for both
the applicant and the FAA.
The FAA will continue to consider
the following factors to determine if a
prospective applicant is ready to begin
pre-application consultation: Whether
the concept of operations is realistic and
whether the prospective applicant is
able to provide a program schedule that
includes definition of significant
milestones and a funding source or
sources. The regulatory requirements for
a launch and reentry license are the
same for all applicants; however, FAA
expects it will take longer for less
experienced operators to meet all of the
requirements. As currently required, to
exit pre-application consultation and
begin the license evaluation period, an
application must be complete enough in
accordance with § 413.11 (Acceptance
of an application). A complete enough
application must include enough
information for the FAA to start its
review. The FAA will screen an
application in its entirety or in modules
to determine whether it is complete
enough for the FAA to start its review.
The components of a vehicle operator
license application are listed in § 450.31
(General) and include a policy review,
a payload review, a safety review that
complies with Subpart C, an
environmental review, and information
necessary to satisfy the maximum
probable loss analysis required by part
440.
For the five sections listed in
§ 450.35(a), an applicant must use a
means of compliance that has been
accepted by the Administrator prior to
application acceptance. An applicant
may propose another standard or a
unique means of compliance for these
five sections before submitting its
application.20 Furthermore, many
requirements throughout the final rule
allow an operator to use an alternative
method if that method has been agreed
to by the Administrator. This allowance
maximizes flexibility and will reduce
the need for the applicant and the FAA
to use process waivers. During preapplication consultation, the FAA
anticipates that applicants will discuss
the means of compliance they plan to
use for the remaining sections of the
rule, and any alternative means they
plan to use for those sections that allow
alternative means of compliance. While
the FAA anticipates that this preapplication consultation will expedite
license review times and aid both FAA
and applicant, it is only required for the
sections listed in § 450.35(a).
The final rule has built-in flexibilities
for determining the beginning and end
of launch such that the launch is scoped
to an individual operator’s unique
circumstances. It is important that the
applicant and the FAA come to a
mutual understanding during preapplication consultation about the
beginning and end of launch for the
license. The beginning and end points
of a launch operation define the extent
of a number of requirements, including,
but not limited to, indemnification and
FAA oversight. Therefore, an applicant
should define the beginning and end of
its operation during pre-application
consultation, and should coordinate
with the FAA before finalizing and
submitting its application.21 In this way,
the applicant can ensure that the FAA
will evaluate the complete scope of its
proposed operation.
If an applicant is planning to seek a
safety element approval, the applicant
must continue to consult with the FAA
before submitting its application in
accordance with § 414.9 (PreApplication Consultation). Doing so will
help ensure that the FAA and the
applicant have a thorough
understanding of how the applicant will
comply with the regulatory
requirements surrounding a safety
element approval before submitting an
application. During pre-application
consultation, the FAA would expect an
applicant to be able to discuss, at a
minimum, the following information as
outlined in § 414.15: (1) How the
applicant will meet the applicable
requirements of part 450; (2) the
information required in § 414.13(b)(3),
(c)(2), and (c)(3); and (3) the sections of
the license application that support the
application for a safety element
approval.
If an applicant is proposing an
incremental review of its application,
the applicant must have its approach
approved by the FAA prior to
submitting its application, in
accordance with § 450.33 (Incremental
Review and Determinations).
Incremental review is intended
primarily to give additional flexibility to
the applicant, by allowing the applicant
to separate the safety review into
sections so that those sections can be
20 Further discussion on this topic is in the
preamble section for performance-based regulations
and means of compliance.
21 A discussion on what constitutes beginning
and end of launch is in the preamble section
discussing scope of launch.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
PO 00000
Frm 00014
Fmt 4701
Sfmt 4700
approved independently. In many ways,
the incremental review process is
similar to the independent payload
review or a safety element approval
process because it allows the applicant
to comply with the safety approval
portion of the regulation in modules or
sections rather than all at once. An
applicant considering the use of the
incremental review process should
indicate to the FAA during preapplication consultation which portions
of its application will be evaluated
under the incremental review process.
See the Incremental Review section of
this preamble for further discussion.
Finally, part 450 allows an operator to
propose alternative time frames for
certain requirements, which are listed in
Appendix A to part 404. If an operator
knows in advance of application
submittal that it will propose an
alternative time frame, the applicant
should raise this proposal during preapplication consultation. The FAA
would also be able to discuss during
pre-application consultation the FAA’s
expected review period to make its
determination on the proposed
alternative time frame. Flexible time
frames are discussed at length later in
this preamble.
The FAA received several comments
on the pre-application consultation
process. An individual commenter
stated that pre-application consultation
may not provide substantial benefits for
an existing program and suggested
allowing the FAA to request a preapplication consultation process with a
30-day completion timeline for any
‘‘material changes’’ to existing programs
deemed as posing a significant risk to
the safety of the vehicle. The commenter
also suggested the FAA could request
this process at least 60 days before the
integration of the launch vehicle. The
commenter stated that past performance
of space flights and aircraft should be
taken into consideration for the level of
rigor for the pre-application process.
The FAA will not attach a schedule to
pre-application consultation but agrees
with the commenter that a material
change can be discussed as part of preapplication consultation. The FAA
acknowledges that pre-application
consultation should be minimal for
experienced operators using proven
vehicles from established sites. This
type of abbreviated consultation period
for experienced operators would be
consistent with the pre-application
process prior to issuance of this final
rule. The FAA disagrees with a 30-day
completion timeline for pre-application
consultation for any material change to
existing programs. The FAA also
disagrees with the suggestion that the
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
FAA request pre-application
consultation at least 60 days before
integration of the launch vehicle or that
pre-application consultation be tied to
the flight safety risk of the vehicle.
These timelines and criteria may be
inadequate in some cases to prepare a
complete application properly; in
others, they might result in unnecessary
delays in addressing and implementing
critical safety changes. In addition, the
FAA will not tie pre-application
consultation to risk to the vehicle
because the FAA does not oversee risk
to the vehicle but rather risk to the
public.
Sierra Nevada noted that operators
could work with the FAA to develop a
program schedule and define
anticipated data submissions during
pre-application consultation. Sierra
Nevada noted that this use of the
consultation process was not
specifically codified in the proposed
regulations and recommended including
it expressly in an AC.
The FAA agrees and will include
guidance on application scheduling and
data submissions in the pre-application
consultation AC. The FAA considered
including more robust requirements for
pre-application consultation in the final
rule, however, the FAA concluded that
the current regulation both prepares the
applicant to submit a complete
application and the FAA to accept it,
while also providing flexibility to the
applicant to approach pre-application
consultation in a manner that best fits
the proposed operation.
jbell on DSKJLSW7X2PROD with RULES2
b. Application Process
In the NPRM, the FAA proposed to
clarify in § 413.1 (Scope of this Part)
that the term ‘‘application’’ means either
an application in its entirety or a
portion of an application for
incremental review. In § 413.21 (Denial
of a License or Permit Application), the
FAA proposed to remove ‘‘license’’ from
paragraph (c) so the regulation applied
to both license and permit applications.
In part 414 (Safety Element Approvals),
the FAA proposed to change the term
‘‘sufficiently complete’’ to ‘‘complete
enough,’’ as used in § 413.11
(Acceptance of an Application), because
the two terms both described the point
at which the FAA determined it had
sufficient information to accept an
application and begin its evaluation.
Finally, the FAA proposed to amend
§ 413.7 (Application Submission)
paragraph (a)(3) to allow an applicant
the option to submit its application by
email as a link to a secure server and
remove the requirement that an
application be in a format that cannot be
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
altered. In the final rule, the FAA adopts
these changes as proposed.
A joint set of comments submitted by
Boeing, Lockheed Martin, Northrop
Grumman, and ULA expressed support
for the proposal to allow the submission
of an application using physical
electronic storage.
In addition, the FAA received
suggested changes to the generic
application process. The American
Association of Airport Executives
(AAAE) and the Denver International
Airport commented on the need for
further engagement with stakeholders
during an operator’s application
process. These commenters said the
FAA should provide an opportunity for
affected stakeholders to provide input
on an operator’s application regarding
issues such as impacts to the National
Airspace System (NAS). Denver
International Airport stated that
stakeholders should be able to submit
comments on license applications.
The FAA does not agree that an
application should be open to a public
input process. The FAA issues a license
based on whether the applicant’s
proposal will not jeopardize public
health and safety, the safety of property,
and the national security and foreign
policy interests of the United States.
The FAA coordinates with government
or private entities as necessary to make
this determination. A broad public
input process outside the environmental
review process is unnecessary for the
FAA to make its licensing
determination. While commenters may
seek the opportunity to raise issues such
as non-safety impacts to the NAS or the
economic impact to land adjacent to a
launch, the FAA cannot consider such
issues in the licensing determination.
The NPRM specifically sought
comments on how the FAA could
standardize and better implement the
‘‘complete enough’’ application
standard. Sierra Nevada inquired
whether the FAA will still conduct a
complete enough review. Sierra Nevada
concurred with the FAA’s approach in
conducting complete enough reviews
but commented that the FAA should
specify a timeline for these reviews.
SpaceX commented that the FAA
should aim to conduct its complete
enough review within ten days of
receipt of submission and apply that
standard to submissions for continuing
accuracy, renewals, and modifications.
Furthermore, Sierra Nevada asserted
that the review should be included in
the FAA’s statutory 180-day review
period or a new, defined timeline. CSF
and SpaceX recommended that the
complete enough standard in current
§ 413.11 be expanded to apply to any
PO 00000
Frm 00015
Fmt 4701
Sfmt 4700
79579
application submission, including the
initial license application, continuing
accuracy submissions, and modification
submissions. CSF and SpaceX suggested
regulatory text changes to § 413.11 to
this end. Both commenters also
requested the FAA issue an AC that that
explains how the agency makes the
complete enough determination,
including a checklist comprising
regulatory sections that require
submissions. Virgin Galactic
recommended that what constitutes
‘‘complete enough’’ be agreed upon by
both the applicant and the FAA during
the pre-application consultation phase
and provided several changes to the
regulatory text.
The FAA will continue to use the
complete enough standard to determine
whether a license is sufficiently
complete to begin review. The FAA
endeavors to make these determinations
within 14 calendar days of receiving an
application. Limiting the FAA to ten
days, as suggested by SpaceX, may not
provide adequate time for review. The
FAA begins the calculation of the 180day statutory review period on the date
that it receives the information needed
to make the application complete
enough, regardless of how long it takes
to make that determination. The FAA
does not base this calculation on the
date it determines that the application is
complete enough. The complete enough
standard applies to any submission,
including those for license
modifications for consistency. The FAA
has applied this standard to
submissions for license modifications
and, when necessary, requested
additional information and
clarifications to allow it to proceed with
its evaluation. Section 450.211(c) states
that an application to modify a license
must be prepared and submitted in
accordance with part 413. Therefore,
§ 413.11 is applicable to an initial
license application submission and
license modification submissions and
does not need to be modified to apply
to any application submission. The FAA
will work closely with applicants on a
case-by-case basis to determine what
changes may be made without
invalidating the license. In accordance
with § 450.211(c), the licensee must
apply to the FAA for modification of the
license once a license has been issued,
except for the allowable changes
identified by the FAA. An operator may
propose an alternate method from part
413 to request a license modification.
This alternate method could include an
agreed-upon submittal schedule and
FAA review period.
It should be noted that § 450.211
(Continuing Accuracy of License
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79580
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Application; Application for
Modification of License) also covers
license modification submissions
related to continuing accuracy. The
FAA will provide an AC that includes
application checklists that an applicant
can choose to use to help guide
application submittal. However,
additional information may be needed
depending on the type of operation.
In response to Virgin Galactic’s
comments, the FAA agrees that dialogue
as to what constitutes ‘‘complete
enough’’ can be part of the preapplication consultation, but disagrees
that any change in the regulatory text is
required. One of the primary purposes
of pre-application consultation is to
provide the applicant guidance in
preparing its license application.
Although the FAA determines when an
application is complete enough to begin
its review, the FAA expects to develop
collaboratively agreed upon criteria
with an applicant for determining
‘‘complete enough’’ during preapplication consultation. By allowing
applicants and the FAA to negotiate
criteria for ‘‘complete-enough’’ during
pre-application, the FAA anticipates
applicants will be able to more
predictably track their progress toward
completing the application.
CSF and SpaceX also suggested that
the FAA provide a substantive response
to submittals within 30 days of
receiving the application. CSF also
suggested the FAA provide status
updates to an applicant every two
weeks.
The FAA already typically provides
written response to submittals within 30
days, often much sooner. In some
instances, however, the FAA requires
more than 30 days to draft a response,
especially for highly technical analyses.
The FAA also provides a substantive
response to an applicant in writing
whenever additional information is
required and, therefore, does not see a
compelling rationale for a requirement
to provide status updates on a
predetermined schedule. However, FAA
recognizes the concerns expressed by
operators regarding extended delays
between communications in certain
circumstances. While the FAA does not
believe establishing a specific time
period for communication to applicants
is a necessary component of its
regulatory framework, it also recognizes
the need for applicants to stay informed
and anticipates communicating with
applicants throughout the application
process, including procedural changes
to ensure applicants will be provided a
status update within 14 days of receipt
of an application.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
c. Compliance Period for Legacy
Licenses (§ 450.1(b))
In the NPRM, under proposed
§ 450.1(b) and subject to two exceptions,
the FAA would permit an operator to
conduct a launch or reentry pursuant to
a license issued by the FAA under parts
415,22 431, and 435 before the effective
date of the new part 450 or an
application accepted by the FAA before
the effective date of part 450. Even
though the operator could continue to
conduct operations under the
regulations in effect at the time of
license or application as referenced
above, the proposed requirements under
§§ 450.169 for collision avoidance
analysis (COLA) and 450.101(a)(4) and
(b)(4) for critical asset protection would
apply to all operators subject to the
FAA’s authority under 51 U.S.C. chapter
509 conducting launches after the
effective date of the new regulations.
The FAA would determine the
applicability of part 450 to an
application for a license modification
submitted after the effective date of the
part on a case-by-case basis based on the
extent and complexity of the
modification, whether the applicant
proposes to modify multiple parts of the
application, or if the application
requires significant reevaluation.
The FAA adopts § 450.1
(Applicability) with revisions. The FAA
does not adopt § 450.1(b) as proposed in
the NPRM. While the FAA adopts the
concept as proposed in § 450.1(b) in
parts 415, 417, 431, and 435, it also
makes corresponding changes to
§§ 413.23 and 415.3 to limit the
duration of all licenses issued or
renewed to no more than five years after
the effective date of part 450. The FAA
refers to these licenses as ‘‘legacy
licenses’’ throughout this preamble.
After that time, all operators must come
into compliance with the new
regulations. In the final rule, the FAA
makes numerous revisions to certain
regulations that apply to operators
conducting operations under parts 415,
417, 431, and 435. These revisions
include amending § 401.5 title to read
‘‘Definitions as Applied to Parts 415,
417, 431, 435,’’ adding new § 401.7 for
definitions, updating § 413.1, and
amending parts 415, 417, 431, 435, 440,
and 460 to reference compliance with
part 450.
The FAA notes that certain
definitions in § 401.5 apply to parts 415,
417, 431, and 435. Therefore, because
the FAA will allow operators that hold
an approved license at the time this rule
22 The FAA notes that an operator operating
under a license issued under part 415 would also
be subject to the requirements of part 417.
PO 00000
Frm 00016
Fmt 4701
Sfmt 4700
goes into effect, or an accepted license
application within 90 days after the
effective date of the final rule, to operate
under parts 415, 417, 431, and 435 for
up to five years, this rule preserves
§ 401.5 without change. Section 401.5
will be removed five years after the
effective date of the final rule.
The FAA adds § 401.7, which
contains the definitions that apply to
Chapter III other than parts 415, 417,
431, and 435, and which broadly
captures those changes proposed in
§ 401.5 in the NPRM. The FAA notes
that parts 415, 417, 431, and 435 and
§ 401.5 will be removed five years after
the effective date of the final rule.
Part 413 explains how to apply for a
license or experimental permit. In the
final rule, the FAA amends the table in
§ 413.1(b) to identify that the
requirements in parts 415, 417, 431, and
435 apply only to applicants whose
launch or reentry license has been
approved or license application has
been accepted by the FAA no later than
90 days after the effective date of the
final rule. As previously mentioned,
operators holding an approved launch
or reentry license, or who have an
accepted launch or reentry license
application may choose to continue to
operate under parts 415 and 417, part
431, and part 435, until five years after
the effective date of this rule. The FAA
also adds ‘‘Launch and Reentry License
Requirements’’ as a subject in the table
in § 413.1(b). Finally, the FAA adopts
the provision that the FAA may grant a
request to renew a license issued under
parts 415, 417, 431 or with a nonstandard duration in proposed
§ 450.1(b) and re-designates it as
§ 413.23(a)(2) in the final rule.
Specifically, the FAA may grant a
request to renew a under parts 415, 431,
and 435 with a non-standard duration
so as not to exceed five years after the
effective date of this rulemaking. The
FAA adds an applicability section to
parts 415, 431, and 435. These parts
apply to such licenses issued before the
effective date of the final rule and
licenses issued on or after the effective
date of the final rule if the FAA
accepted the application under § 413.11
no later than 90 days after the effective
date. All operators must comply with
the COLA and critical asset protection
requirements in part 450.
In the final rule, the FAA adds the
phrase ‘‘pursuant to a license issued
under part 415 of this chapter’’ to the
scope in § 417.1(a). The FAA also
removes § 417.1(e), which addresses
grandfathering that is no longer used
from when part 417 was first
established. For the same reason, the
FAA also removes the grandfathering
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
reference to paragraph (e) in § 417.1(f).
As a result of this amendment, the FAA
re-designates § 417.1(f) and (g) as
§ 417.1(e) and (f) in the final rule.
The FAA further revises §§ 417.11
and 431.73 in the final rule. The FAA
adds a paragraph stating that the
Administrator may determine that a
modification to a license issued under
these parts must comply with the
requirements in part 450. The
Administrator will base the
determination on the extent and
complexity of the modification, whether
the applicant proposes to modify
multiple parts of the application, or if
the application requires significant
evaluation.
The FAA revises § 440.3, which
addresses definitions. In the final rule,
§ 440.3 references the definitions
contained in §§ 401.5 and 401.7. The
reference to § 401.5 will be removed
from § 440.3 five years after the effective
date of the final rule.
Finally, the FAA revises § 460.45 to
identify which mishap definitions an
operator should apply in the description
of the safety record of the vehicle to
each space flight participant.
Specifically, § 460.45(d)(1) addresses
licenses issued under part 450. For
these licenses, the operator’s safety
record must cover events that meet
paragraphs (1), (4), (5), and (8) of the
definition of a ‘‘mishap’’ in § 401.7 that
occurred during and after vehicle
verification performed in accordance
with § 460.17. Section 460.45(d)(2)
addresses licenses issued under parts
415, 431, or 435. For these licenses, the
operator’s safety record must cover
launch and reentry accidents and
human space flight incidents as defined
by § 401.5. Section 460.45(d)(1) will be
re-designated to §§ 460.45(d) and
460.45(d)(2) will be removed from
§ 460.45 five years after the effective
date of the final rule.
Several commenters asked for clarity
on the FAA’s approach in § 450.1(b) to
legacy licenses issued under the current
regulations. CSF objected to requiring
renewals of licenses issued under the
current regulations to meet the
requirements of proposed part 450, as
this would result in significant cost and
regulatory burdens for the operator and
the FAA.
As previously noted, the FAA does
not adopt § 450.1(b) in the final rule.
However, the FAA implements the
concept as proposed in § 450.1(b) in
parts 415, 417, 431, and 435. In the final
rule, the FAA establishes a five-year
period after the effective date of this
rule. Operators holding either an active
license or an accepted license
application no later than 90 days after
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
the effective date of this rule may
operate under the applicable regulatory
provisions upon which the licensing
determination was made. In addition,
these operators may submit requests for
license renewals within that five-year
period and will be required to comply
with the regulations under which the
license determination was made.23 The
FAA has revised §§ 413.23 and 415.3 to
reflect that no license issued under parts
415, 431 or 435 will be renewed with an
expiration date that extends beyond the
five-year period. As such, applications
for renewal submitted near the end of
the five-year period will be valid only
for a short time. All operators will need
to comply with this rule in its entirety
five years after its effective date.
CSF noted that operators under
current parts 431 and 435 would need
to come into compliance with the
proposed part 450. Similarly, Virgin
Galactic requested that FAA allow
currently licensed operators to be
grandfathered into part 450 for vehicles
that cannot meet certain part 450
requirements as long as the current
public safety requirements are met.
Virgin Galactic stated that, unlike ELV
operators, RLV operators use their
vehicles repeatedly, and the FAA has
not shown why it is necessary for
current operators to undergo new
analyses and possible design changes.
Virgin Galactic noted that the FAA’s
aviation regulations allow for ‘‘true’’
grandfathering. Virgin Galactic
commented that if the FAA chooses not
to allow for ‘‘true’’ grandfathering, it
should work with each licensee during
pre-application consultation to
determine applicability of the new rule
to modifications to current licenses.
The FAA notes that as the final rule
is more performance-based than the rule
as proposed in the NPRM, many of the
current requirements would serve as a
means of compliance to meet the new
regulations. The FAA anticipates that
there would be few, if any, additional
requirements that will not be fulfilled
by previously submitted information.
The FAA will not allow operating under
parts 415, 417, 431, and 435 indefinitely
because the current rule is more
streamlined, performance-based, and
up-to-date than the previous
regulations. Therefore, the FAA will
require all operators to come into
compliance with the new rule five years
after the effective date. The FAA will
consult with existing licensees shortly
after the final rule is published to assist
23 As
noted, all operators are also required to
comply with the critical assets and COLA
provisions of part 450 beginning from the effective
date of this rule.
PO 00000
Frm 00017
Fmt 4701
Sfmt 4700
79581
operators with the transition to part 450
so they may take advantage of the
significant number of new flexibilities.
CSF objected to the lack of clarity on
grandfathering and recommended that
the FAA make clear that a licensee
approved under the current licensing
regime may continue to renew its
approvals, with no significant changes,
without having to apply under part 450.
License renewals without significant
changes may continue to be renewed,
but not to exceed the five-year
compliance period.
Operators currently holding an active,
valid license will have five years after
the effective date of this rule to come
into compliance with the entirety of part
450. If a license expires before the end
of this period, an applicant may seek a
renewal under the previous provisions
in parts 415, 417, 431, and 435, but the
renewal will only be valid for however
much time remains between the time of
issuance of the renewal and the end of
the five-year period.
Virgin Galactic recommended the
FAA hold a pre-application phase for all
current license holders to ensure that
licensees and the FAA are in agreement
as to whether the FAA would require
part 450 requirements or parts 415, 417,
431, and 435 requirements when an
operator requests to modify a legacy
license once part 450 becomes effective.
During the five-year compliance
period, an operator may need to modify
its legacy license. The provisions that
relate to modification are contained in
§§ 417.11 and 431.73. Whether or not
new license modifications need to
comply with part 450 is subject to
Administrator approval on a case-bycase basis, which can be determined
during consultation with the FAA
before the applicant requests the
modification. In making the
determination as to whether a license
modification is necessary to comply
with the new requirements, the
Administrator will consider the extent
and complexity of the modification,
whether the licensee would need to
modify multiple parts of the
application, or if the license requires
significant reevaluation. The FAA
encourages licensees to consult with the
FAA on transitioning to part 450 in
advance of the compliance period
deadline.
d. Definition and Scope of Launch
(§ 450.3)
In the NPRM, the FAA proposed to set
the scope of activity authorized by a
vehicle operator license by identifying
the beginning and end of launch in
E:\FR\FM\10DER2.SGM
10DER2
79582
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
§ 450.3 (Scope of Vehicle Operator
License).24
jbell on DSKJLSW7X2PROD with RULES2
i. Beginning of Launch
In § 450.3(b)(1) and (b)(2), the FAA
proposed that launch begins under a
license with the start of hazardous
activities that pose a threat to the public
at a U.S. launch site. The proposed rule
further stated that, unless agreed to by
the Administrator, those hazardous preflight ground operations would
commence when a launch vehicle or its
major components arrive at a U.S.
launch site. For a non-U.S. launch site,
the FAA proposed that launch begins at
ignition or first movement that initiates
flight.
In the final rule, the FAA adopts
proposed § 450.3(b)(1) and (b)(2) with
revisions. First, the FAA does not adopt
the proposed default that hazardous
ground pre-flight operations commence
when a launch vehicle or its major
components arrive at a U.S. launch site.
The final rule identifies certain
activities that qualify as hazardous preflight operations, including but not
limited to, pressurizing or loading of
propellants into the vehicle or launch
system, operations involving a fueled
launch vehicle, the transfer of energy
necessary to initiate flight, or any
hazardous activity preparing the vehicle
for flight. Second, this rule also clarifies
that hazardous pre-flight operations do
not include the period between the end
of the previous launch and launch
vehicle reuse when the vehicle is in a
safe and dormant state. Finally, this rule
adds language in § 450.3(a) that allows
the Administrator to agree to a scope of
license different from that laid out in
§ 450.3(b), as discussed later in this
document. An applicant wishing to
deviate from the scope of license
parameters laid out in § 450.3(b) would
discuss the deviation during preapplication consultation. The FAA
would only allow a deviation for unique
operations where the scope of license
continued to cover those hazardous
launch activities identified by statute.
CSF, SpaceX, and Virgin Galactic
suggested proposed § 450.3(b)(1) be
revised to remove reference to the
arrival of major components at a U.S.
launch site as beginning of launch.
Virgin Galactic noted that the beginning
of hazardous pre-flight ground
operations should be determined only
on a case-by-case basis and commented
that the arrival of components at a
launch site was an inappropriate
24 The FAA proposed to move the beginning and
end of launch and reentry language from the
definition of ‘‘launch’’ in § 401.5 to proposed
§ 450.3.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
prescriptive default limit chosen for
administrative convenience. CSF,
SpaceX, and Virgin Galactic also
requested that the FAA limit the
beginning of hazardous pre-flight
operations only to include potential
threats to the public over which no
other Federal regulatory agency has
jurisdiction.
The FAA agrees that the beginning of
pre-flight ground operations should be
determined on a case-by-case basis
because each operation is unique. The
FAA recognizes that with this flexibility
comes some ambiguity as to when
launch will begin for each unique
operation. The designation of when
launch begins is important for both
operators and the FAA. Among other
things, the financial responsibility
protections apply from beginning to end
of launch. Therefore, a clear
understanding of when launch begins is
essential for an operator to understand
fully its responsibilities under chapter
III and for the FAA to satisfy its
obligations, including the calculation of
maximum probable loss (MPL).
Because the proposed default
beginning of launch, phrased as ‘‘arrival
of major components at a U.S. launch
site,’’ is removed from § 450.3(b)(1) in
the final rule, an application
requirement is added to § 450.3(d) to
require an operator to identify the scope
of the license being sought in the
application, specifically pre- and postflight ground operations. The final rule
requires an applicant intending to
launch from a U.S. launch site to
identify pre- and post-flight ground
operations such that the FAA is able to
determine when the launch operation
would begin and end. This requirement
applies only to launches from a U.S.
launch site, as launches from a non-U.S
launch site begin at ignition or first
movement that initiates flight. The FAA
anticipates that an applicant would
identify hazardous pre- and post-flight
operations that are reasonably expected
to pose a risk to the public. During preapplication consultation, the applicant
is expected to describe to the FAA its
launch site and its intended concept of
operations leading up to a launch,
including any operations that are
potentially hazardous to the public.
Once the FAA and the applicant have a
clear, mutual understanding of the
applicant’s concept of operations, the
FAA and the applicant will agree on a
starting point for hazardous pre-flight
operations, and thus, the beginning of
launch. The applicant will provide that
information in its application and scope
its application materials based on this
starting point. The scope of the license
PO 00000
Frm 00018
Fmt 4701
Sfmt 4700
lends itself to the first module of an
incremental review.
The FAA also agrees that the arrival
of components at the launch site is an
unnecessarily prescriptive baseline that
may not constitute the threshold for
hazardous pre-flight operations for all
launches. Therefore, the FAA revises
§ 450.3(b)(1) to remove the reference to
arrival of components at a launch site.
Because the beginning of launch is an
important designation upon which
many licensee responsibilities rely, the
FAA has added to the regulatory text
certain activities that constitute
hazardous pre-flight operations. The list
of hazardous pre-flight operations added
to the final regulatory text is derived
from the preamble text in the NPRM
explaining the proposal.25 Hazardous
pre-flight operations include, but are not
limited to, pressurizing or loading of
propellants into the vehicle or launch
system, operations involving a fueled
launch vehicle, the transfer of energy
necessary to initiate flight, or any
hazardous activity preparing the vehicle
for flight. This list is not exhaustive, and
during pre-application consultation the
FAA or an applicant may identify an
activity not included in this list that
poses a hazard to the public and may
constitute the beginning of launch. The
FAA retains the ability to determine that
licensed oversight is unnecessary for
certain activities if the Administrator
determines that they do not jeopardize
public health and safety, safety of
property, and the national security and
foreign policy interests of the United
States.
The FAA further amends § 450.3(b)(1)
to indicate clearly that activities
occurring between launches of reusable
vehicles will not be considered
hazardous pre-flight activities if the
vehicle is in a safe and dormant state.
Generally, a launch system is in a safe
and dormant state when it is not
undergoing the pressurizing or loading
of propellants, a transfer of energy
necessary to initiate flight, operations
involving a fueled launch vehicle, or
any other hazardous activity preparing
the vehicle for flight. The NPRM
preamble discussed the exemption of
RLVs if a vehicle is in a safe and
dormant state.26
One commenter suggested the
definition of beginning of flight for
hybrid vehicles be changed to include
the first forward motion of the vehicle
with the intent for takeoff.
The FAA agrees that the beginning of
flight for a hybrid vehicle is the first
forward motion of the vehicle with the
25 See
26 See
E:\FR\FM\10DER2.SGM
84 FR at 15361.
84 FR at 15359.
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
intent to takeoff. However, the FAA will
continue to use ‘‘first movement that
initiates flight’’ to define beginning of
the flight phase of launch because it
better accommodates all vehicle types.
Regarding the FAA’s jurisdiction over
launch activities at a non-U.S. launch
site, CSF stated that proposed
§ 450.3(b)(2) could be problematic for
captive carry technologies for which an
operator must comply with the
oversight of foreign aviation authorities.
CSF suggested removing reference to
‘‘the first movement that initiates
flight.’’
The FAA does not adopt CSF’s
recommendation because the current
regulation is flexible enough to
accommodate all launch vehicle
technologies at non-U.S. sites, as well as
comprehensive enough to protect public
safety. Starting launch at ignition will
not capture the full flight of the captive
carry hybrid vehicle system. The FAA
regulates all of the components of a
hybrid vehicle system, including any
captive carry operations under a license;
however, as discussed earlier, the
flexibility in § 450.3(a) for the
Administrator to adjust the scope of
license applies to § 450.3(b)(2) as well.
In the case of a unique operation for
which hazardous activities begin later
than first movement or ignition, the
Administrator may agree to a different
beginning of launch for that operation.
Virgin Galactic recommended that the
FAA continue to avoid duplicating
oversight and memorialize that
commitment in its description of the
beginning of launch as starting when
hazardous pre-flight ground operations
commence at a U.S. launch site that
pose a threat to the public and over
which no other Federal regulatory
agency has jurisdiction.
The FAA has amended the regulation
to address duplicative oversight at
Federal launch or reentry sites in the
final rule. These changes are discussed
in the preamble section addressing
launch and rentries from a Federal
launch or reentry site. The FAA does
not agree with the comment that launch
under this chapter may only begin at a
site over which no other Federal agency
has jurisdiction. In fact, many sites,
such as Federal sites or launch sites colocated at airports, may be subject to the
jurisdiction of multiple Federal agencies
depending on the types of activities that
are conducted.
ii. End of Launch
In the NPRM, the FAA proposed to
amend the definition of end of launch
to remove reference to RLVs and ELVs.
Although it did not receive comment on
this proposal specifically, the FAA
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
makes the following additional changes
to the end of launch language: The
addition of ‘‘vehicle component’’ and
‘‘impact or landing’’ throughout to
ensure the definition captures a broader
variety of operations; and the addition
of ‘‘deployment’’ in § 450.3(b)(3) to
include operations for which a payload
remains on the vehicle. Under
§ 450.3(b)(3) and (c), the FAA replaces
each use of ‘‘vehicle stage’’ in the
proposed rule in recognition of the fact
that components other than vehicle
stages may return to Earth. Examples
include a discarded engine or payload
fairing. In addition, throughout
§ 450.3(b)(3) and (c), the FAA includes
‘‘impact or landing’’ in the end of
launch and reentry sections in the scope
of license requirements where the
proposal only referred to one or the
other or failed to reference either. With
the increasing efforts to reuse
components, including both impact and
landing throughout § 450.3(b)(3) and (c)
encompasses a broader range of
activities because landing includes a
soft vertical landing or runway landing
of a vehicle or component, whereas
impact is more accurate to describe a
hard landing of a stage or component.
Under § 450.3(b)(3)(ii), the FAA adds
that, for an orbital launch of a vehicle
with a reentry of the vehicle, launch
may also end ‘‘after vehicle component
impact or landing on Earth, after
activities necessary to return the vehicle
or component to a safe condition on the
ground after impact or landing.’’ This
additional language accommodates a
carrier vehicle landing after the
completion of the orbital part of the
launch.
CSF, SpaceX, and Virgin Galactic
expressed confusion regarding proposed
§ 450.3(b)(3), and requested clarity
regarding proposed § 450.3(b)(3)(iv),
including when reentry applies to
suborbital vehicles and end of launch.
The FAA introduced suborbital reentry
in its experimental permit final
rulemaking in 2007. In that rulemaking,
the FAA stated that:
A suborbital rocket may engage in reentry.
For most suborbital launches, whether the
flight entails a reentry will not matter from
a regulatory perspective. The FAA will
authorize the flight under a single license or
permit, implementing safety requirements
suitable to the safety issues involved.
Recognizing suborbital reentry matters for
two reasons. First, if a suborbital rocket is
flown from a foreign country by a foreign
entity into the United States, that entity may
require a reentry license or permit from the
FAA, depending on whether the planned
trajectory of the rocket includes flight in
outer space. Second, a permanent site that
supports the landing of suborbital rockets
may now be considered a reentry site
PO 00000
Frm 00019
Fmt 4701
Sfmt 4700
79583
depending, once again, on whether the
planned trajectory reaches outer space.27
The NPRM did not propose any
change to this framework, and no
change is made in the final rule.
Virgin Galactic commented that the
FAA should include specific parameters
for suborbital reentry. Virgin Galactic
also recommended additional regulatory
language specifying that, for a suborbital
reentry, reentry ends when each vehicle
has returned to Earth and has been
returned to a safe condition as defined
in the operator’s application documents.
As noted earlier, a suborbital reentry
requires flight into outer space.
This distinction does not change
when launch ends for a suborbital
vehicle because, whether a vehicle or
vehicle component impacts or lands on
Earth due to a launch or reentry, the
launch or reentry would end at the same
point in time; namely, after activities
necessary to return the vehicle or
vehicle component to a safe condition
on the ground after landing. (See
§ 450.3(b)(3)(iv) and (c)).
CSF and SpaceX suggested that orbital
launch without a reentry in proposed
§ 450.3(b)(3)(i) did not need to be
separately defined by the regulation,
stating that, regardless of the type of
launch, something always returns:
Boosters land or are disposed, upper
stages are disposed. CSF and SpaceX
further requested that the FAA not
distinguish between orbital and
suborbital vehicles for end of launch.
The FAA does not agree because the
distinctions in § 450.3(b)(3)(i) and (ii)
are necessary due to the FAA’s limited
authority on orbit. For a launch vehicle
that will eventually return to Earth as a
reentry vehicle, its on-orbit activities
after deployment of its payload or
payloads, or completion of the vehicle’s
first steady-state orbit if there is no
payload, are not licensed by the FAA. In
addition, the disposal of an upper stage
is not a reentry under 51 U.S.C. Chapter
509, because the upper stage does not
return to Earth substantially intact.
The FAA proposed in § 450.3(b)(3)(ii)
that for an orbital launch of a vehicle
with a reentry of the vehicle, launch
ends after deployment of all payloads,
upon completion of the vehicle’s first
steady-state orbit if there is no payload,
after vehicle component impact or
landing on Earth, after activities
necessary to return the vehicle or
component to a safe condition on the
ground after impact or landing, or after
activities necessary to return the site to
a safe condition, whichever occurs later.
The final rule changes ‘‘if there is no
payload’’ to ‘‘if there is no payload
27 See
E:\FR\FM\10DER2.SGM
72 FR 17001, 17002.
10DER2
79584
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
deployment’’ to clarify the FAA’s intent
on how to determine the end of launch
for a vehicle carrying no payload or
payloads that stay onboard a vehicle.
Both CSF and SpaceX proposed ‘‘end
of launch’’ should be defined on a caseby-case basis in pre-application
consultation and specified in the
license. The FAA disagrees, in part. The
FAA only regulates on a case-by-case
basis if the nature of an activity makes
it impossible for the FAA to promulgate
rules of general applicability. This need
has not arisen, as evidenced by decades
of FAA oversight of end-of-launch
activities. That said, because the
commercial space transportation
industry continues to innovate,
§ 450.3(a) gives the FAA the flexibility
to adjust the scope of license, including
end of launch, based on unique
circumstances as agreed to by the
Administrator. Unique circumstances
may include, but are not limited to,
unconventional technologies like
railguns that may use innovative launch
and reentry procedures requiring
adjustments to a scope of license.
Finally, CSF pointed out that in the
proposed rule, for hybrid vehicles, end
of launch did not mention the recovery
of carrier aircraft.
Section 450.3(b)(3) distinguishes
orbital vehicles with and without a
reentry, and suborbital vehicles with
and without a reentry. A separate
section for end of launch for hybrid
vehicles is unnecessary because the
same parameters apply to hybrids as
apply to non-hybrid vehicles regarding
end of launch. The FAA also
acknowledges that the end-of-launch
parameters do not mention the recovery
of a carrier aircraft. Again, it is
unnecessary to include this distinction
because, during launch, a carrier aircraft
is considered part of the launch
vehicle.28 Therefore, to the extent that
§ 450.3(b)(3) refers to activities
necessary to return the vehicle or
component to a safe condition on the
ground after impact or landing, this
reference will include returning the
carrier aircraft to a safe condition after
impact or landing.29
28 See Legal Interpretation to Pamela Meredith
from Mark W. Bury, Assistant Chief Counsel for
International Law, Legislation and Regulations
(Sept. 26, 2013); available at https://www.faa.gov/
about/office_org/headquarters_offices/agc/practice_
areas/regulations/interpretations/Data/interps/
2013/Meredith-ZuckertScoutt&Rasenberger%20%20(2013)%20Legal%20Interpretation.pdf.
29 See Legal Interpretation to Laura Montgomery
from Lorelei Peter, Assistant Chief Counsel for
Regulations (Dec. 10, 2019); available at https://
www.faa.gov/about/office_org/headquarters_
offices/agc/practice_areas/regulations/
interpretations/Data/interps/2019/MontgomeryGround%20Based%20Space%20Matters%20%202019%20Legal%20Interpretation.pdf.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Blue Origin asked how the FAA plans
to prevent disparate impacts of the
proposed rule on those operators at
multiuse facilities and at U.S. facilities.
While the meaning of disparate impacts
is unclear, the FAA construes the
commenter as asking how the FAA will
distinguish between launch and nonlaunch (e.g., manufacturing or
refurbishment of pre-flown stages)
activities at a launch site. Because
launch begins with the start of
hazardous pre-flight ground operations
that prepare a vehicle for flight, an
operator may manufacture or refurbish
launch vehicle components or perform
certain other activities on a launch site
without requiring an FAA authorization
during the time after the end of the
launch and before hazardous operations
begin for the next launch. This
treatment is consistent with existing
practice prior to this rule: a vehicle
operator could theoretically perform
non-launch related activities on a
launch site without needing a license as
long as those activities are not in the
scope of the license and do not pose a
risk to public safety.
The Airline Pilots Association (ALPA)
suggested the FAA define ‘‘family of
vehicles.’’
The FAA does not define ‘‘family of
vehicles’’ in this final rule because the
industry continues to innovate and it
would be premature to attempt to
classify all types of vehicle families for
the emerging and still-evolving
commercial space industry. As
discussed in the NPRM, launch
operators often define ‘‘family of
vehicles’’ themselves. Usually, the
vehicles have similar base operational
characteristics, but each member of the
family may be capable of different
performance characteristics.
AAAE and Denver International
Airport believed that operating at a
specific site should necessitate a
separate and thorough review from the
FAA, and that operators should not be
able to receive one license covering
multiple sites.
The FAA will perform a thorough and
complete review of all sites where a
vehicle is authorized to operate. An
applicant will not be able to add another
location to its license ‘‘with a lesser
review standard’’ as described by the
commenter. A licensee will have to
meet all applicable regulations for all
sites authorized in a license. Denver
International Airport cited 49 U.S.C
50904(d) to argue the FAA lacked
statutory authority to grant a vehicle
operator permission to operate from
multiple launch and/or reentry sites on
a single license. The FAA believes
Denver International Airport meant to
PO 00000
Frm 00020
Fmt 4701
Sfmt 4700
cite 51 U.S.C. 50904(d), which states
that the Secretary of Transportation (the
‘‘Secretary’’) shall ensure that only 1
license or permit is required from the
DOT to conduct activities, including
launch and reentry. The law does not
prohibit the FAA from issuing a license
that allows an operator to conduct an
approved operation from various sites.
Rather, section 50904(d) merely
prevents the FAA from requiring
multiple licenses for the same type of
activity for which a license or permit is
required under title 51 chapter 509.
e. Safety Element Approval (Part 414)
In the NPRM, the FAA proposed to
change the part 414 term from ‘‘safety
approval’’ to ‘‘safety element approval’’
to distinguish it from ‘‘safety approval’’
as used in parts 415, 431, 435, and 450.
Also, the NPRM proposed to modify
part 414 to streamline the process by
enabling applicants to request a safety
element approval in conjunction with a
license application. The final rule
adopts the changes as proposed.
Several commenters expressed
general support for the FAA’s proposed
regulations regarding safety element
approvals in part 414. Blue Origin
concurred with the FAA’s proposal and
anticipated many benefits to an
applicant’s ability to submit a separate
safety element approval. One individual
commented that more extensive use of
these approvals could increase operator
flexibility and significantly simplify the
licensing process for future launches.
Virgin Galactic recommended an
operator that already holds a license be
able to use previously submitted data to
apply for a safety element approval.
Virgin Galactic also noted that the
language in the first sentence of
proposed § 414.23 should be changed
from ‘‘safety approval’’ to ‘‘safety
element approval’’ to reflect the updated
terminology.
The FAA agrees that an operator that
already holds a license may use
previously submitted data to apply for
a safety element approval. Just as is the
case with a license application or
modification, an applicant can reference
previously submitted data in its safety
element approval application. The
applicant will need to specify clearly
what it is referencing and indicate the
referenced material is still valid. In
addition, the FAA has corrected ‘‘safety
approval’’ to ‘‘safety element approval’’
in §§ 414.23 and 414.3.
An individual commenter suggested a
new definition for safety element
approvals for hybrid vehicles. The
commenter suggested the definition
include a reference to hybrid vehicle
components that are critical to avoiding
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
or mitigating hazards to the public,
including vehicle characteristics.
The FAA does not agree that it should
add a separate definition of ‘‘safety
element approvals’’ specifically for
hybrid vehicles. The definition of
‘‘safety element approval’’ is broad
enough to encompass approvals for
hybrid and non-hybrid vehicle systems.
The definition already includes the
phrase ‘‘any identified component
thereof,’’ which includes a carrier
vehicle. The FAA agrees that it is
possible to craft a safety element
approval for the types of hazard control
strategies employed by hybrid vehicles.
The FAA notes that the definition of a
‘‘safety element’’ includes launch
vehicle, reentry vehicle, safety system,
process, service, or any identified
component thereof; or qualified and
trained personnel performing a process
or function related to licensed activities
or vehicles. This definition would allow
a hybrid operator to apply for a wide
range of safety element approvals.
Regarding process, a joint set of
comments submitted by Boeing,
Lockheed Martin, Northrop Grumman,
and ULA stated an operator should not
be required to apply to the FAA to
transfer a safety element approval under
proposed § 414.33 when the transfer is
due to a corporate transaction,
reorganization, or restructure that does
not affect the material content of the
original application.
The FAA will apply the same
standard for application, transfer, and
issuance of a safety element approval as
it does for a license. Name changes and
internal corporate restructuring do not
typically require a license transfer and
therefore will not require a safety
element approval transfer.
Microcosm, Inc. (Microcosm),
inquired as to how the FAA will issue
a safety element approval. The FAA will
issue a safety element approval applied
for concurrently with a part 450 license
in accordance with part 414.
f. Vehicle Operator License—Issuance,
Duration, Additional License Terms and
Conditions, Transfer, and Rights Not
Conferred (§§ 450.5 Through 450.13)
In the NPRM, the FAA proposed
requirements addressing the issuance,
duration, and transfer of a vehicle
operator license in proposed §§ 450.5
(Issuance of a Vehicle Operator
License), 450.7 (Duration of a Vehicle
Operator License), and 450.11 (Transfer
of a Vehicle Operator License),
respectively. The FAA also proposed
requirements addressing the addition
and modification of licensing terms in
proposed § 450.9 (Additional License
Terms of Conditions). Finally, the FAA
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
proposed requirements describing those
rights that would not be conferred by a
vehicle operator license in proposed
§ 450.13 (Rights Not Conferred by a
Vehicle Operator License). The FAA
proposed these rules to consolidate the
requirements for different types of
launch and reentry licenses in parts 415,
431, and 435 into a single vehicle
operator license.
AIA and Sierra Nevada commented
that the FAA should not be allowed to
make modifications to the terms and
conditions of a license except within a
limited time frame and subject to
specified procedures to ensure
reasonable notice and due process to the
vehicle operator. The FAA will not
adopt this recommendation and retains
the provision in § 450.9 that allows the
FAA to modify a vehicle operator
license at any time by modifying or
adding license terms and conditions to
ensure compliance with the Act and its
implementing regulations. This
provision was introduced in 1999 in 14
CFR 415.11 because the FAA recognized
that a particular licensee’s launch (or
reentry) may present unique
circumstances that were not covered by
the license terms and conditions in
place. Because such a modification
would be based on unique
circumstances, the FAA is unable to
specify a timeline as requested by the
commenter.
In the final rule, the FAA adopts these
requirements as proposed and adds
specificity to § 450.11 to indicate that
either the holder of a vehicle operator
license or the prospective transferee
may request a vehicle operator license
transfer, both the holder and
prospective transferee must agree to the
transfer, and the FAA will provide
written notice of its determination to the
person requesting the vehicle operator
license transfer. These additions mirror
the language used for the transfer of a
safety element approval and reflect
current practice.
The FAA did not receive any
comments on these proposed
requirements.
3. Part 450 Subpart B—Requirements To
Obtain a Vehicle Operator License
a. Incremental Review and
Determinations (§ 450.33)
In the NPRM, the FAA proposed to
amend part 413 and to include
provisions in part 450 to allow an
applicant the option for an incremental
review of all portions of its application.
This proposal was in response to the
ARC recommendations. Specifically, the
FAA proposed to amend § 413.15
(Review Period) to provide that the time
PO 00000
Frm 00021
Fmt 4701
Sfmt 4700
79585
frame for any incremental review and
determinations would be established
with an applicant on a case-by-case
basis during pre-application
consultation. As stated in the NPRM,
the FAA did not propose to reduce by
regulation the statutory review period of
180 days.
In the final rule, the FAA provides
clarification on the basis the
Administrator would consider when
approving an incremental approach.
In the NPRM, the FAA sought
comment on how a formal incremental
review process would account for the
statutory 180-day review period when
application increments or modules are
likely to be submitted and reviewed at
different times, other useful guidelines
for applicants crafting incremental
approaches, and any safety approval
sections that would be appropriate for
incremental review. The FAA did not
receive any comments with feasible
solutions on any of these topics.
Several commenters expressed
support for the FAA’s proposed
incremental review process, stating that
it would increase flexibility. Virgin
Galactic supported the FAA’s proposed
approach to incremental review and
commented that it aligned with many
other approval processes in other
divisions of the FAA.
Many commenters, including Leo
Aerospace, Microcosm, Sierra Nevada,
SpaceX, and Virgin Orbit asked about
the duration of incremental review
periods. Noting the FAA’s statutory
mandate to issue a license
determination not later than 180 days
after accepting an application,
commenters inquired whether each
module would be subject to this 180-day
review period. Several commenters,
including CSF and Sierra Nevada, stated
they interpret the 180-day statutory
requirement to mean that the sum total
of all module reviews must not exceed
180 days. Commenters noted that if
every module was subject to a 180-day
review, the process would be very timeintensive.
Until the FAA has more experience
with the incremental review process,
the FAA will review each module in
accordance with a schedule discussed
with the prospective applicant during
pre-application consultation. In
developing the incremental review
schedule, the FAA will consider the
interdependence of parts of the
evaluation and the sequence of their
submissions. The FAA makes these
criteria explicit in this rule in § 450.33
(Incremental Review and
E:\FR\FM\10DER2.SGM
10DER2
79586
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
Determinations) paragraphs (b)(1) and
(b)(2).30
Review of any modules prior to
submittal of an application in its
entirety will not initiate or be bound by
the statutory 180-day review period.
Rather, an agreed upon review period
will begin once the FAA has a complete
enough application in its entirety.
During pre-application consultation, an
applicant seeking an incremental review
may negotiate a time frame shorter than
the statutory 180-day review period. As
the FAA gains more experience with the
incremental review process, it may
develop guidance concerning expected
timelines for various sequences of
modular submissions.
Sierra Nevada commented that, if a
module is denied, proposed § 413.21
(Denial of a License or Permit
Application) should allow the FAA to
extend the review period by up to 60
days to consider a revised application.
The commenter noted it supports the
FAA’s practice of tolling the review
period in the case of a deficient
application as long as the applicant
understands the deficiency and what
must be submitted for the FAA to
continue its review. Leo Aerospace
inquired whether an application would
be considered accepted after the
incremental process is defined, or after
the last step of the incremental process
is completed, and asked how an
operator would be notified if its safety
review was accepted.
Sierra Nevada’s interpretation of
incremental review is incorrect because
a module cannot be denied under
§ 413.21. If the FAA determines a
module does not contain sufficient
information, the FAA and the applicant
will discuss amending the agreed upon
incremental review schedule to allow
time for the applicant to submit a
revised module. An applicant will be
notified in writing when its complete
application has been accepted.
Sierra Nevada noted the primary
concern with module time frames was
the transparency of the FAA’s license
application process and the ability for
operators to reduce operational risk
30 These criteria derived from the discussion in
the preamble to the NPRM on what an applicant
should consider when proposing an incremental
approach. In relevant part, the NPRM stated: ‘‘1.
Application increments submitted at different times
should be not be dependent on other increments to
the extent practicable. 2. Application increments
should be submitted in a workable chronological
order. In other words, an applicant should not
submit an application increment before a separate
application increment on which it is dependent.
For example, the FAA would not expect to agree
to review a risk analysis before reviewing a debris
analysis or probability of failure analysis because
the risk analysis is directly dependent on the other
two analyses.’’ 84 FR at 15366.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
associated with the various time frames.
To that end, a number of commenters,
including Sierra Nevada, Leo
Aerospace, and SpaceX, requested the
FAA provide an outline of acceptance
and review timelines and example
timelines for incremental applications.
CSF and Sierra Nevada agreed with the
FAA’s proposal to establish the timeline
for incremental submissions in the preapplication phase but suggested the
FAA include in an AC its goal for
maximum review time frames for
particular modules. CSF and Sierra
Nevada recommended the AC include
the following time frames: 60 days for
policy approval; 30 days for payload
review; 60 days for safety approval; 5
days for environmental assessment; and
15 days for financial responsibility
assessment. CSF and Sierra Nevada
noted that the FAA’s review of the
environmental assessment should only
take 5 days because the FAA has had
insight into the contractor used to
conduct the environmental assessment,
and the FAA’s review should therefore
simply be a verification that the
applicant has submitted the final
product. CSF and Sierra Nevada
acknowledged that the financial
responsibility assessment could take
longer than 15 days for methods other
than obtaining insurance, but stated that
this possibility could be mitigated by
the FAA’s providing guidance that
addresses the type of information that a
licensee would need to submit to satisfy
FAA review under § 440.9(f).
Commenters suggested that time
frames for incremental review should be
based on the complexity of the review
and that they should be shorter than the
statutory limit for the review of a
complete application. Specifically,
Virgin Galactic commented time frames
should be based on the complexity of
the item being reviewed. Sierra Nevada
recommended modules be subject to a
shorter review time frame than full
application reviews and to define that
time frame in § 413.15. Sierra Nevada
stated the FAA should consider a
shorter timeline of 90 days for review of
a license application in order to meet
the direction in Space Policy Directive2 to streamline the review process.
The FAA declines to incorporate the
suggested time frame changes because
they will not provide adequate time for
the FAA to assess application materials
for completeness in all situations and
for all potential applications. The FAA
agrees that modules will likely be
reviewed faster than an entire
application, and that review times will
depend largely on complexity; however,
at this point it is premature to define
those time frames until FAA has more
PO 00000
Frm 00022
Fmt 4701
Sfmt 4700
experience with incremental reviews.
The FAA will not at this time adopt
maximum time frames, because each
evaluation is a unique review that must
be adjusted to each operation. The
FAA’s evaluation of the safety
implications of an application typically
requires the most effort and time,
usually far more than the 60 days
suggested by the commenters. The MPL
is derived from the safety analysis and
cannot be completed independently of
it. An environmental review must be
completed before a license can be
issued. Particularly for new operations,
the environmental process can be
lengthy, and the FAA advises applicants
to begin it early, even before a license
application is submitted. For example,
an applicant must submit a completed
environmental impact statement (EIS)
prepared by the FAA (or an FAAselected and managed consultant
contractor), FAA-approved
environmental assessment (EA),
categorical exclusion determination, or
written re-evaluation as part of its
application materials. The 180-day
statutory application review period is
not intended to encompass the time
needed for the applicant to develop the
necessary application materials,
including environmental
documentation. Five days may not be
enough time to evaluate an
environmental document, such as a
complex EA.
For conventional operations that do
not pose substantial policy-related
challenges, policy and payload reviews
can be conducted in less time than the
safety review. However, these reviews
are often performed concurrently with
the safety review so their completion
typically does not reduce the overall
time required to reach a license
determination. As the FAA gains more
experience with the incremental review
process, it may elect to update guidance
to reflect timelines that have
consistently proven effective.
Submitting an application
incrementally affords an applicant the
approval of various systems and
processes earlier than the current nonincremental review process. The FAA
expects that the central value of an
incremental approach is regulatory
certainty for components of the
application and flexibility for applicants
rather than a reduction in overall review
time. However, the FAA anticipates that
a determination of an accepted
application that utilizes safety element
approvals or approved modules will be
completed faster than a similar
application that does not use safety
element approvals or incremental
review.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
Sierra Nevada recommended that an
AC should also address the type of
information a licensee would need to
submit for the FAA’s financial
responsibility review. The financial
responsibility requirements contained
in part 440 are beyond the scope of this
rulemaking. However, the financial
responsibility requirements are
adequately addressed in Appendix A to
Part 440—Information Requirements for
Obtaining a Maximum Probable Loss
Determination for Licensed or Permitted
Activities. Virgin Galactic
recommended the FAA take into
account FAA AVS 31 Project Specific
Certification Plans to inform the
incremental review process in proposed
part 414. The FAA will discuss projectspecific information, including AVS
documents, during pre-application
consultation.
Virgin Galactic also inquired how the
operator would be notified when the
operator’s safety review has been
accepted or rejected. The FAA will
inform an applicant in writing as to
whether each module is accepted or
rejected.
b. Means of Compliance (§ 450.35)
In the NPRM, the FAA proposed that
an applicant would be required to use
an accepted means of compliance for
the following requirements: Highly
reliable FSS, FSA methods, lightning
flight commit criteria, and airborne
toxic concentration and duration
thresholds for both flight and ground
hazards. For these requirements, the
means of compliance would need to be
accepted by the FAA prior to the
submission of an application. For all
other performance-based requirements,
an applicant would be able to use a
means of compliance proposed in an
application.
While the final rule maintains that an
applicant must use an accepted means
of compliance in an application for
specified requirements, the FAA has
made amendments to the structure of
the regulatory text to identify more
clearly that the use of accepted means
of compliance is an application
requirement. This requirement is now
specified in § 450.35(a) of the final rule.
As stated above, for those five
sections now identified in § 450.35, an
applicant must use a means of
compliance in its application that has
been reviewed and accepted by the
Administrator. The FAA will not accept
an application that uses a means of
compliance that has not already been
accepted by the Administrator for any of
the five requirements listed in § 450.35.
31 AVS
is the FAA’s Office of Aviation Safety.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
The five requirements listed in § 450.35
are essential to public safety and
involve well-established and complex
methodologies, thresholds, or practices.
Because of the complex nature and
public safety impact of these
requirements, the FAA would be unable
to review unique means of compliance
for these five requirements during its
application evaluation within its review
time frame. Rather, an applicant could
choose to use an accepted means of
compliance in its evaluation, or could
submit a unique means of compliance
for review and acceptance prior to
submitting its application. Unique
means of compliance for the
requirements identified in § 450.35 may
require evaluation before they are
accepted as demonstrating fidelity and
safety, however this rule allows unique
means of compliance for these sections
to be submitted in advance of a license
application in order to provide
flexibility and enable innovative
concepts. For all other sections of part
450, an applicant may propose in its
application a means of compliance that
has not been previously accepted by the
Administrator, and the FAA will review
the means of compliance as part of its
application review process. It is worth
noting that an applicant who uses
means of compliance that have already
been accepted by the FAA in its license
application will likely experience a
more expeditious license review and
determination.
A means of compliance is one means,
but not the only means, by which a
requirement can be met and may be
used to demonstrate compliance with
any of the performance-based
requirements. For all performance-based
requirements other than those listed in
§ 450.35, an applicant may include a
unique means of compliance in an
application for the FAA to review
during the application evaluation. In the
NPRM docket,32 the FAA included a
table listing all publicly available means
of compliance for each proposed
performance-based requirement (the
‘‘Means of Compliance Table’’) in
subpart C that the FAA has accepted to
date. An applicant need not include the
entirety of an accepted means of
compliance standard in an application,
but may instead reference the accepted
means of compliance using identifying
features such as title and date or
version.
Several commenters interpreted the
NPRM as only allowing the means of
compliance listed in the Means of
Compliance Table. Conversely, the CSF
commented that applying means of
32 See
PO 00000
FAA–2019–0229–0018.
Frm 00023
Fmt 4701
Sfmt 4700
79587
compliance flexibility only to the
regulations cited in the Means of
Compliance Table would be too limited,
and should be expanded. The CSF also
requested that the FAA remove or
correct the preamble text to reflect that
any applicant can seek to add an
accepted means of compliance to the
Means of Compliance table. The CSF
specifically mentioned that the FAA
should allow flexible means of
compliance to meet the conditional
expected casualty calculation in
proposed § 450.101(c). SpaceX also
commented that the FAA should
expand the scope of flexible means of
compliance and specifically identified
proposed § 450.101(c).
The FAA emphasizes that any
requirement in part 450 can have one or
more means of compliance. The Means
of Compliance Table provides one way,
but not the only way, to meet the
requirements in part 450. The
conditional expected casualty
thresholds in proposed § 450.101(c)
were intended as safety criteria to
measure and protect against potential
high consequence events. In the final
rule, the FAA has clarified § 450.101(c)
to allow alternative demonstrations of
high consequence event mitigation. This
change is discussed in detail later in the
preamble. The FAA will review the
submitted means of compliance to
determine whether they satisfy the
regulatory safety standard. These means
of compliance may be government
standards, industry consensus
standards, or unique means of
compliance developed by an individual
applicant. For government standards or
means of compliance developed by a
consensus standards body, the FAA will
provide public notice of those accepted
means of compliance that it determines
satisfy the corresponding regulatory
requirement. The FAA will also review
unique means of compliance developed
by an individual applicant to determine
whether they satisfy the regulatory
requirement.
Once a means of compliance is
accepted by the FAA, it may be used to
demonstrate compliance with the
corresponding regulatory requirement.
An updated Means of Compliance Table
will be placed on the docket once the
final rule publishes. This updated table
identifies the means of compliance
accepted by the FAA at this time for the
corresponding regulation. This table
will be made available on the FAA
website and updated as additional
means of compliance are accepted by
the FAA. Unique individual operatordeveloped means of compliance will not
be included in the Means of Compliance
Table to protect proprietary information,
E:\FR\FM\10DER2.SGM
10DER2
79588
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
unless the operator that developed the
means of compliance requests that its
means of compliance be included.
CSF requested that the FAA clarify
that it would not require compliance
with an untailored RCC 319 33 in order
to demonstrate reliability. Blue Origin
commented that the preamble does not
address accepted means of compliance
as a standalone flexibility measure. CSF
and SpaceX commented that the
proposed rule risks being quickly
outdated and could discourage
innovation because it does not allow
tailoring of the requirements.
This rule does not require compliance
with an untailored RCC 319 in order to
demonstrate reliability; however, at this
time, RCC 319 is the only accepted
means of compliance for flight abort
with a highly reliable FSS under
§ 450.145. An applicant may propose a
tailored version of any accepted means
of compliance, including RCC 319. If an
applicant wishes to tailor RCC 319, the
applicant must propose its tailored
means of compliance as a unique means
of compliance in advance of its license
application. An applicant may include
any unique means of compliance as part
of its license application, other than
those sections identified in § 450.35(a)
that require a means of compliance to be
accepted prior to application submittal.
An applicant may also propose a unique
means of compliance to meet these
requirements in advance of its license
application.
An individual commenter
recommended that the FAA allow
tailoring and include a clause to attend
United States Air Force (USAF) tailoring
meetings as part of meeting parts 415
and 417 requirements. As noted earlier,
the FAA does allow tailoring. Part 450
will not change the FAA’s current
practice of attending tailoring meetings.
Virgin Galactic also recommended
that the current part 417 appendices and
range analyses continue to satisfy the
requirements in part 450, and that the
FAA complete its Launch Site Safety
Assessments (LSSAs) in order for
operators to know which Federal launch
or reentry site’s analyses and processes
the FAA would find acceptable as
means of compliance. ULA commented
that the rule should more clearly allow
work performed by another Federal
agency to meet FAA requirements.
33 The Range Commanders Council (RCC)
addresses the common concerns and needs of
operational ranges within the United States. It
works with other government departments and
agencies to establish various technical standards to
assist range users. RCC 319 provides for the safety
of people and missions during launch and flight
operations.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
The part 417 appendices that can be
used as an accepted means of
compliance to part 450 requirements are
listed in the Means of Compliance Table
in the docket. The FAA agrees that it
needs to determine and communicate to
the industry which Federal launch or
reentry site analyses and processes
satisfy part 450. As noted earlier, the
FAA will accept any safety-related
launch or reentry service provided by a
Federal launch or reentry site or other
Federal entity by contract, as long as the
FAA determines that the launch or
reentry service satisfies part 450.
The New Zealand Space Agency
(NZSA) and Virgin Galactic asked what
process and standards the Administrator
would employ for accepting means of
compliance. Virgin Galactic asked what
accepted means of compliance would be
and whether the Administrator would
use means of compliance that have not
been published. Virgin Galactic also
stated that means of compliance would
need to be published prior to any work
being performed that would require the
means of compliance. Northrup
Grumman supported the publication of
newly accepted means of compliance.
The FAA will provide public notice of
each publicly available means of
compliance that the Administrator has
accepted by posting the acceptance on
its website. This notification will
communicate to the public and the
industry that the FAA has accepted a
means of compliance or any revision to
an existing means of compliance. The
FAA will not post unique means of
compliance documents with proprietary
information submitted by applicants,
unless specifically authorized by the
applicant. The applicant may wish to
consider offering its unique means of
compliance to a consensus standards
body for inclusion as part of an
industry-developed consensus standard.
The final rule does not adopt proposed
§ 450.35(b), which stated that the FAA
would provide public notice of each
means of compliance that the
Administrator has accepted. The FAA
removes this requirement because it is
not a licensing requirement.
Proposed § 450.35(c) is amended and
renumbered as § 450.35(b). The
provision is renumbered because the
final rule removes the proposed
§ 450.35(b), as discussed previously. In
the final rule, § 450.35(b) allows a
person to submit a means of compliance
to the FAA for review outside the
licensing process. The means of
compliance must be submitted in a form
and manner acceptable to the
Administrator. The proposed rule
limited this provision to applicants,
whereas the final rule would allow any
PO 00000
Frm 00024
Fmt 4701
Sfmt 4700
person to request acceptance of a
proposed means of compliance. This is
because the FAA anticipates other
people or entities other than applicants
may wish to submit a proposed means
of compliance, such as operators that
plan to be applicants in the future, and
voluntary consensus standards bodies.
The FAA wants to enable this. Section
450.35(b) is limited to requests for
acceptance of a proposed means of
compliance outside a license
application, because the license
application process is already defined in
parts 413 and 450. Lastly, the FAA
changes the modifier in front of ‘‘means
of compliance’’ from ‘‘alternative’’ to
‘‘proposed.’’ The term ‘‘proposed’’ is
better suited to the types of means of
compliance the FAA would expect from
this provision.
The process the FAA employs to
accept a means of compliance will be
set forth in guidance. 34 When
submitting a unique means of
compliance, an applicant’s proposal
should identify the regulation that the
proposed means of compliance will
address and provide the rationale as to
why it demonstrates compliance with
the applicable regulation. When
reviewing a unique means of
compliance, the FAA will consider past
engineering practices, the technical
quality of the proposal to demonstrate
compliance with the part 450
regulations, the safety risk of the
proposal, best practice history, and
consultations with technical specialists
for additional guidance.
NZSA and Virgin Galactic asked how
the FAA would protect an operator’s
proprietary information when
publishing means of compliance. NZSA
recommended that the FAA retain the
ability to share, with consent of the
applicant, information about the means
of compliance used to issue a license
that may include proprietary
information.
As a general matter, the FAA does not
share proprietary data with the public.
The FAA will treat any proprietary data
linked to a unique means of compliance
in the same manner as it protects
proprietary data that an applicant uses
to support a license application.
An individual commenter suggested
the development of a Space Safety
Institute to develop industry consensus
standards. A consensus standards body,
any individual, or any organization
would be able to submit means of
compliance documentation to the FAA
for consideration and potential
acceptance. The FAA recommends that
in developing standards, a voluntary
34 See
E:\FR\FM\10DER2.SGM
AC 450.35–1, Means of Compliance.
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
consensus standards body consider the
processes outlined in OMB Circular A–
119.
jbell on DSKJLSW7X2PROD with RULES2
c. Use of Safety Element Approval
(§ 450.39)
In the NPRM, the FAA proposed
§ 450.39 (Use of Safety Element
Approval) to allow an applicant to use
any vehicle, safety system, process,
service, or personnel for which the FAA
has issued a safety element approval
under part 414 without the FAA’s
reevaluation of that safety element
during a license application evaluation
to the extent its use is within its
approved envelope. The proposed rule
would also change the part 414 term
from ‘‘safety approval’’ to ‘‘safety
element approval’’ to distinguish it from
‘‘safety approval’’ as used in parts 415,
431, and 435, and proposed part 450,
because these terms have different
meanings.
In the final rule, the FAA replaces the
word ‘‘envelope’’ with the word
‘‘scope.’’ ‘‘Scope’’ more accurately
captures ‘‘envelope, parameter, or
situation’’ as used in the definition of
‘‘safety element approval.’’ For
consistency, the same change is made in
§ 437.21.
d. Policy Review (§ 450.41)
In the NPRM, the FAA proposed to
remove the requirement that
applications include, for the purpose of
conducting a policy review, information
related to the structural, pneumatic,
propulsion, electrical, thermal,
guidance, and avionics systems used in
the launch vehicle and all propellants.
Instead, in order for the FAA to conduct
its policy review, the FAA proposed
that an applicant identify the launch or
reentry vehicle and its proposed flight
profile and describe the vehicle by
characteristics that include individual
stages, its dimensions, type and
amounts of all propellants, and
maximum thrust. In the final rule, the
FAA adopts § 450.41 (Policy Review
and Approval) as proposed.
Boeing, Lockheed Martin, Northrop
Grumman, Sierra Nevada, and ULA
suggested the FAA change the word
‘‘normal’’ in proposed § 450.41(e)(4)(iv)
to ‘‘nominal’’ to be consistent with
industry vernacular.
The FAA disagrees with this
suggestion because the FAA seeks a
range of possible impact areas in this
section, not a particular impact point
inferred by the use of ‘‘nominal.’’
Boeing, Lockheed Martin, Northrop
Grumman, and ULA recommended the
FAA add to § 450.41(b)(3) the phrase
‘‘but not limited to’’ in order to allow
the FAA to consult Federal agencies
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
other than the National Aeronautics and
Space Administration (NASA).
The FAA disagrees that the additional
language is needed to clarify that the
FAA may consult Federal agencies other
than NASA pursuant to § 450.41(b)(3).
The term ‘‘include’’ implies the phrase
‘‘but not limited to.’’
The FAA notes, consistent with
current practice, that if a launch or
reentry proposal would potentially
jeopardize U.S. national security or
foreign policy interests, or international
obligations of the United States, the
FAA may seek additional information
from an applicant in support of
interagency consultation to protect U.S.
Government interests.
An individual commenter
recommended the FAA require
licensees to comply with the Committee
on Space Research’s planetary
protection policy (COSPAR PPP) as a
means of ensuring that commercial
launches comply with the Outer Space
Treaty and of resolving existing gaps in
the statutory prohibition on obtrusive
advertising in outer space.
The FAA acknowledges the
commenter’s concerns, but the scope of
this rulemaking does not encompass
COSPAR’s PPP or the statutory
prohibition on obtrusive advertising.
e. Payload Reviews (§ 450.43)
In the NPRM, the FAA proposed to
consolidate payload review
requirements, remove the requirement
to identify the method of securing the
payload on an RLV, add application
requirements to assist the interagency
review, such as the identification of
approximate transit time to final orbit
and any encryption, clarify the FAA’s
relationship with other Federal agencies
for payload reviews, and modify the 60day notification requirements currently
found in §§ 415.55 and 431.53.
The FAA stated in the NPRM
preamble that, while it would review all
payloads to determine their effect on the
safety of launch, the FAA will not make
a determination on those aspects of
payloads that are subject to regulation
by the Federal Communications
Commission (FCC) or the Department of
Commerce or on payloads owned or
operated by the U.S. Government. In
addition, the proposed rule added
informational requirements that would
include the composition of the payload
and any hosted payloads, anticipated
life span of the payload in space, any
planned disposal, and any encryption
associated with data storage on the
payload and transmissions to or from
the payload. Finally, the NPRM
proposed to preserve the ability of
payload operators to request a payload
PO 00000
Frm 00025
Fmt 4701
Sfmt 4700
79589
review independent of a launch license
application. The FAA sought comments
on the approach of including more
requirements for a payload review in the
regulation in order to expedite payload
review application processing, but
received none.
In the final rule, the FAA adopts
§ 450.43 (Payload Review and
Determination) with revisions. The FAA
adds the term, ‘‘if applicable,’’ to
§§ 450.31(a)(3) and 450.43(a) to clarify
that a payload review is not always
required. The FAA notes that all
payloads include any hosted or
secondary payloads.
The Commercial Smallsat Spectrum
Management Association (CSSMA)
suggested that the FAA adopt a sixty
(60) day timeline for independent
payload review. CSSMA found little
incentive for a payload owner or
operator to use the independent payload
review process, absent a fixed timeline
for such payload reviews. CSSMA also
recommended language that would
render § 413.21(a) (Denial of a License
or Permit) applicable to independent
payload reviews.
The FAA declines to revise
§ 413.21(a) as suggested because the
payload review is a requirement to
obtain a launch or reentry license under
part 450. The FAA notes that a favorable
payload determination does not itself
constitute a license. As such, the
procedures set forth in § 413.21(a) do
not apply to payload reviews, whether
conducted independently of or in
conjunction with a license application.
The FAA also declines to incorporate
CSSMA’s suggested timeline for review.
The FAA has not specified a timeline to
complete payload reviews independent
of a license application because,
historically, payload owners or
operators have requested such reviews
for unique missions that have raised
novel concerns regarding public health
and safety, safety of property, or
national security or foreign policy
interests of the United States. Because
independent payload reviews often raise
complex issues and often require
extensive interagency consultation, the
FAA cannot anticipate a standard
timeline for payload reviews conducted
independently from a license
application. Accordingly, FAA will not
establish a standard timeline for such
reviews in its regulations. Applicants
are encouraged to discuss timelines to
review their particular proposals during
pre-application consultation.
NZSA requested the FAA include in
the final rule all legislative or regulatory
standards by which the FAA will assess
payloads at the application stage. NZSA
stated that doing so would give owners
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79590
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
of novel payloads and non-U.S.
operators regulatory certainty on the
standards they must meet to be
launched on a vehicle licensed by the
FAA. As one example of a rule that
would affect payload review but did not
appear in proposed § 450.41, NZSA
cited the prohibition on launching
payloads for ‘‘Obtrusive Space
Advertising.’’
The FAA declines to expand the bases
for issuing an unfavorable payload
determination beyond those set forth in
§ 450.43(a). It would not be practical to
list every law, regulation, and policy
that may possibly affect a proposed
payload under § 450.43. Rather,
applicants are required to complete a
pre-application consultation during
which the FAA can learn about the
proposed action and advise the
applicant on a path forward, including
any U.S. regulations, laws, or policies
that may impact its proposal. Payload
owners and operators may also use the
independent payload review process set
forth in § 450.43(d), which provides
greater regulatory certainty for novel
payloads.
Virgin Galactic suggested the FAA
treat payloads that stay within a vehicle
as additional equipment on the launch
vehicle, subject only to the safety
analysis required of any other piece of
equipment on board a launch vehicle.
Virgin Galactic commented that
requiring a payload review for items not
ejected from a launch vehicle places an
unnecessary burden on operators and
the FAA. Virgin Galactic also requested
clarification on seemingly contradictory
language in the NPRM preamble
regarding a payload placed in outer
space versus a payload that remained on
or within the vehicle.
The FAA disagrees with Virgin
Galactic’s suggestion. Payloads that (1)
stay within a vehicle, (2) do not contain
hazardous materials, or (3) have
previously been approved may require
less scrutiny but are still being placed
in outer space and therefore meet the 14
CFR 401.5 definition of ‘‘payload’’ and
require a payload review. Under 51
U.S.C. 50904(c), the FAA must verify
that all licenses, authorizations, and
permits required for a payload have
been obtained; and that the proposed
launch or reentry will not jeopardize
public health and safety, safety of
property, U.S. national security or
foreign policy interests, or international
obligations of the United States. The
FAA therefore declines to exclude from
the requirement to obtain a payload
review any payload that remains on the
vehicle.
Virgin Galactic recommended the
FAA amend proposed § 450.31(a)(3),
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
which seemed to require favorable
payload determinations for any launch
or reentry, noting that not all vehicles
carry payloads. Absent this amendment,
Virgin Galactic commented it would
need to seek a waiver for each nonpayload flight, creating an unnecessary
burden.
The FAA agrees that an applicant
does not need to seek a payload
determination if the proposed launch or
reentry will not involve a payload.
Therefore, the FAA revises
§ 450.31(a)(3) by adding the phrase, ‘‘if
applicable.’’
Space Logistics, LLC (Space Logistics)
urged the FAA to coordinate with other
Federal agencies before expanding its
payload review process in order to
avoid duplicating activities. Space
Logistics noted that the requirements to
describe encryption associated with a
payload’s data storage and
transmissions and to provide any
information deemed necessary by the
FAA under proposed § 450.43(i) were
open-ended and may duplicate
requirements of the FCC, NASA, the
National Oceanic and Atmospheric
Administration (NOAA), or Office of
Space Commerce (OSC).
The FAA agrees with Space
Logistics’s comment that Federal
agencies must continue to streamline
requirements applicable to commercial
space activities and work closely to
eliminate duplicative requirements and
minimize review times for policy and
payload issues. The FAA has engaged
its Federal partners in this rulemaking
process in order to minimize
duplication. For instance, the FAA
proposed to require that applicants
provide encryption data (in
§ 450.43(i)(1)(x)) in part to support the
Department of Defense (DOD) review of
payloads for impacts to national
security. Encryption information allows
the DOD to assess impacts on national
security due to potential cyber intrusion
or loss of vehicle control. Through its
interagency coordination, the FAA
endeavors not to request information
already provided to other Federal
agencies.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA suggested adding to
proposed § 450.43(a) a requirement for
FAA coordination with the applicable
Federal agency to ensure that the
payload will not interfere with or
impede launch, on-orbit operations, or
reentry of other approved missions. The
commenters stated this addition would
avoid adverse impacts to other
federally-approved missions or
operating systems.
Although the FAA agrees that
coordination with applicable Federal
PO 00000
Frm 00026
Fmt 4701
Sfmt 4700
agencies is important to ensure a
payload or payload class will not
interfere with agency operations, the
FAA disagrees that the recommended
addition to § 450.43(a) is necessary. The
interagency coordination required for
both payload and license application
review, coupled with the criteria set
forth in § 450.43(a)(1) and (a)(2),
adequately addresses the commenters’
concerns. Those provisions direct that
the FAA will issue a favorable payload
determination if (1) the applicant,
payload owner, or payload operator has
obtained all required licenses,
authorizations, and permits; and (2) the
launch or reentry of the payload would
not jeopardize public health and safety,
safety of property, U.S. national security
or foreign policy interests, or
international obligations of the United
States. The FAA notes, consistent with
current practice, that if a payload or
payload class presents a potential risk to
an agency’s asset or other mission, the
FAA may seek additional information
from an applicant on behalf of the
agency to protect U.S. Government
interests and assets consistent with
these two objectives. However, in light
of commenters’ concerns, the FAA is
working with the appropriate agencies
to increase transparency and support
the development of agency guidance on
the interagency consultation process
during a payload review. The FAA also
plans to publish its own guidance on
payload review, in the form of an
Advisory Circular, which will reference
NASA, DOD, or other agency guidance.
Insight into the interagency process will
help operators anticipate what questions
and concerns may arise during
interagency consultation, which may
vary depending on the operation, and
will allow operators to be better
prepared to address any potential issues
during payload review. To the extent
the commenters intended to address
space traffic management or access-tospace issues, such matters exceed the
scope of this rulemaking.
Boeing suggested the FAA refrain, in
proposed § 450.43(b)(2), from issuing a
determination on payload components
owned, sponsored, or operated by the
U.S. Government. Similarly, Boeing,
Lockheed Martin, Northrop Grumman,
and ULA recommended the FAA
exclude from the review requirement in
proposed § 450.31(a)(3) any payloads
that have undergone safety review or
received approval by another Federal
agency.
The FAA declines to exclude from
review under § 450.43(b) payloads that
are sponsored by the U.S. Government.
Section 450.43(b)(2) excludes payloads
owned or operated by the U.S.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Government. Payloads that are not
owned or operated by the U.S.
Government may not have undergone
the same scrutiny, and hence the FAA
review is warranted. The FAA also
disagrees with the recommended change
to § 450.31(a)(3). Although the FAA
does not make a determination on those
aspects of payloads that are subject to
regulation by other Federal agencies, the
FAA does review all payloads to
determine their effect on the safety of
launch, which may differ from the
purpose of another agency’s payload
review. As such, no change from the
proposal is made.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA recommended
adding to the agencies listed in
proposed § 450.43(e)(3) the FCC, NOAA,
and the National Telecommunications
and Information Administration. The
commenters also proposed adding to the
interagency consultation process set
forth in proposed § 450.43(e) a
requirement that the FAA consult with
Federal launch or reentry sites to
coordinate facility information for MPL
determination, and to coordinate
collision avoidance analysis with the
cognizant Federal agency, when the
launch or reentry activity is not on a
Federal launch or reentry site. The
commenters stated that operators should
not have to obtain and provide Federal
site facility information, which is often
sensitive and not available to
commercial operators.
The FAA disagrees that the
recommended addition to § 450.43(e)(3)
is necessary. The list of agencies that the
FAA consults with under § 450.43(e) is
not exhaustive and does not preclude
consultation with any other Federal
entity in order to ensure that a payload
meets the criteria set forth in § 450.43.
With respect to the recommendation for
the FAA to add the interagency
consultation process to its MPL
determination, current regulations
address coordination. In addition,
changes to part 440 are outside the
scope of the rulemaking. In accordance
with 14 CFR 440.7(b), the FAA consults
with Federal agencies that are involved
in, or whose personnel or property are
exposed to risk of damage or loss as a
result of, a licensed activity and obtains
any information needed to determine
financial responsibility requirements.
Similarly, collision avoidance analysis
is conducted wholly outside of the
payload review. Part 450 provides for
coordination of collision avoidance
analyses with the cognizant Federal
agency, though this coordination is
primarily conducted on a launch-bylaunch basis, and well after the payload
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
review process, which often occurs
during the application review process.
f. Safety Review and Approval
(§ 450.45)
i. Launch and Reentries From a Federal
Launch or Reentry Site (§ 450.45(b))
In the NPRM, to address concerns
regarding duplicative government
requirements at Federal launch or
reentry sites, the FAA proposed largely
performance-based requirements for
both ground and flight safety that an
operator could meet using Air Force and
NASA practices as means of
compliance. The FAA pointed out that
it issues a safety approval to a license
applicant proposing to launch from a
Federal launch or reentry site if the
applicant satisfies the requirements of
part 415, Subpart C (Safety Review and
Approval for Launch from a Federal
Launch Range), and has contracted with
the Federal site for the provision of
safety-related launch services and
property, as long as an FAA LSSA
shows that the site’s launch services and
launch property satisfy part 417. The
FAA did not refer to the LSSA process
in the regulatory text in proposed part
450. The FAA did propose, in § 450.45
(Safety Review and Approval) paragraph
(b), that the FAA would accept any
safety-related launch or reentry service
or property provided by a Federal
launch or reentry site or other Federal
entity by contract, as long as the FAA
determined that the launch or reentry
services or property provided satisfy
part 450.
The FAA adopts § 450.45(b) as
proposed, with one revision. The FAA
changes the reference to ‘‘Federal range’’
to ‘‘Federal launch or reentry site’’
throughout part 450, to include NASA
and DOD launch and reentry sites.
As discussed in the NPRM preamble,
the FAA assesses each Federal launch or
reentry site and determines if the
Federal site meets FAA safety
requirements. If the FAA assessed a
Federal launch or reentry site and found
that an applicable safety-related launch
service or property satisfies FAA
requirements, then the FAA treats the
Federal site’s launch service or property
as that of a launch operator’s, and there
is no need for further demonstration of
compliance to the FAA. The FAA
reassesses a site’s practices only when
the site changes its practice. The final
rule maintains the position discussed in
the NPRM, namely that these
performance-based regulations allow an
operator to use DOD and NASA
practices as a means of compliance. In
addition, this rule introduces a
provision that allows operators
PO 00000
Frm 00027
Fmt 4701
Sfmt 4700
79591
operating from certain Federal sites to
opt out of demonstrating compliance
with the FAA’s ground safety
requirements.
CSF and Space Florida submitted
comments indicating their
dissatisfaction with the NPRM’s
approach to reducing duplication
regarding launch from a Federal launch
or reentry site. ULA encouraged the
FAA to reduce duplication between the
FAA and Federal sites.
Northrop Grumman commented that
the FAA should accept the Federal
launch or reentry site safety processes as
satisfying FAA requirements because it
was reasonable to presume changes to
launch range regulations would
continue to provide for safe pre-flight
and flight operations on Federal launch
or reentry sites. Similarly, SpaceX stated
that part 450 or its supporting
documents should reference agreements
between the FAA and other Federal
entities, including the USAF, which
allow each agency to accept the analyses
and technical determinations of the
other. Blue Origin commented that it
looks forward to understanding the
contents of any agreements between the
ranges and the FAA.
Another individual commenter raised
similar concerns that the FAA’s
proposed licensing regulations do not
resolve long-standing issues with
duplicative and overlapping rules
burdening commercial launch operators
at the KSC and CCAFS. CSF stated that
duplicative or conflicting rules among
overlapping Federal jurisdictions create
a barrier to entry for small startups and
unnecessarily increase the cost of space
access to all users by forcing all
providers either to pass those costs on
to their customers (including the U.S.
Government) or to be denied the
availability of new capabilities due to
lack of bandwidth and resources. CSF
argued that this burden will drive
internationally-competed business to
other countries to avoid the cost or
schedule impacts arising from
duplicative, conflicting, and
overlapping sets of rule. CSF also
argued the FAA did not address the
overlapping jurisdiction of the FAA and
other Federal and State agencies (the
Occupational Safety and Health
Administration (OSHA), the
Environmental Protection Agency
(EPA), the Bureau of Alcohol, Tobacco,
Firearms and Explosives (ATF), and
their State and local equivalents) for
hazardous ground operations.
The FAA does not agree with the
comment that the FAA is duplicating
oversight with other agencies such as
OSHA, EPA, and ATF. Commercial
space activities may be subject to the
E:\FR\FM\10DER2.SGM
10DER2
79592
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
jurisdiction of multiple Federal agencies
depending on the types of activities that
are being conducted. OSHA, EPA, and
ATF may regulate or provide oversight
for different aspects of an operation
without duplicating FAA oversight. The
authority for protecting public health
and safety, safety of property, and
national security and foreign policy
interests of the United States during
commercial space launches and
reentries remains solely with the FAA.
In the interest of removing duplicative
authorities, CSF suggested the FAA
should acknowledge when other
agencies have jurisdiction over activities
and not duplicate that oversight. SpaceX
recommended that instead of the FAA’s
determining that the launch or reentry
services or property provided by a
Federal launch or reentry site or other
Federal entity satisfy part 450, the FAA
should just determine that the site
operations are in good standing.
In the final rule, an operator may meet
part 450’s performance-based
requirements using DOD and NASA
practices that have been accepted by the
FAA as a means of compliance. An
applicant would reference in its
application those DOD or NASA
requirements or procedures accepted as
means of compliance. The 2015
Commercial Space Launch
Competitiveness Act directed the
Secretary of Transportation to consult
with the Secretary of Defense,
Administrator of NASA, and other
agencies, as appropriate, to identify and
evaluate requirements imposed on
commercial space launch and reentry
operators to protect the public health
and safety, safety of property, national
security interests, and foreign policy
interests of the United States. It also
directed the Secretary of Transportation
to resolve any inconsistencies and
remove any outmoded or duplicative
Federal requirements or approvals
applicable to any commercial launch of
a launch vehicle or commercial reentry
of a reentry vehicle.35 The FAA has
worked closely with DOD and NASA in
developing part 450 to minimize any
need for a DOD or a NASA facility to
impose additional requirements.36 The
FAA will continue to work with DOD
and NASA in reviewing means of
35 Public Law 114–90—Nov. 25, 2015 U.S.
Commercial Space Launch Competitiveness Act.
36 Note that the John S. McCain National Defense
Authorization Act for Fiscal Year 2019 (NDAA)
includes a provision stating that the Secretary of
Defense may not impose any requirement on a
licensee or transferee that is duplicative of, or
overlaps in intent with, any requirement imposed
by the Secretary under 51 U.S.C. chapter 509,
unless imposing such a requirement is necessary to
avoid negative consequences for the national
security space program.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
compliance that involve these Federal
entities’ practices to ensure those
practices continue to satisfy the FAA’s
part 450 requirements. The FAA expects
that there will be few, if any, instances
in which DOD or NASA practices do not
satisfy part 450’s performance-based
requirements. In addition, part 450
should provide enough flexibility to
accommodate changes in DOD and
NASA practices in the future.
In addition to issuing performancebased requirements that an operator
could meet using DOD and NASA
practices as means of compliance, the
FAA has addressed concerns regarding
duplicative government requirements by
modifying its approach to ground safety
at certain Federal sites. For ground
safety, the Administrator may determine
that the Federal launch or reentry site’s
ground safety processes, requirements,
and oversight are not inconsistent with
the Secretary’s statutory authority over
commercial space activities. Therefore,
under § 450.179 (Ground Safety—
General) paragraph (b), an operator is
not required to comply with the ground
safety requirements of part 450 if:
(1) The launch or reentry is being
conducted from a Federal launch or
reentry site;
(2) The operator has contracted with
the Federal launch or reentry site for
ground safety services or oversight; and
(3) The Administrator has determined
that the Federal launch or reentry site’s
ground safety processes, requirements
and oversight are not inconsistent with
the Secretary’s statutory authority over
commercial space activities.
In making the determination to accept
the Federal site’s processes without
specific compliance with ground safety
regulations, under § 450.179(c), the
Administrator will consider the nature
and frequency of launch and reentry
activities conducted from the Federal
launch or reentry site, coordination
between the FAA and the Federal
launch or reentry site safety personnel,
and the Administrator’s knowledge of
the Federal site’s requirements. The
FAA will consider the nature and
frequency of the activity in order to
evaluate a site’s level of experience with
different types of launch and reentry
operations. An example of the ‘‘nature’’
of the launch and reentry activities
would be that a site’s experience with
non-toxic or non-explosive propellant
might not qualify the site for an
exemption from FAA ground safety
requirements involving toxic or
explosive materials. The FAA makes
this change to respond to the direction
of SPD–2, the National Space Council,
and the recommendation of the ARC to
address duplicative requirements across
PO 00000
Frm 00028
Fmt 4701
Sfmt 4700
Federal agencies for commercial space
licensing.
In the final rule, an operator need not
comply with the ground safety
requirements contained in §§ 450.181
(Coordination with a Site Operator)
through 450.189 (Ground Safety
Prescribed Hazard Controls) if the
conditions in § 450.179(b) are met. In
making this change, the FAA preserves
its statutory jurisdiction over those
ground safety activities that are part of
launch and reentry, but recognizes
certain Federal processes and
procedures as sufficient to meet the
FAA’s mandate.
For § 450.179(b) to apply, an operator
must conduct launch or reentry
activities from a Federal launch or
reentry site. The FAA limits the
applicability of this provision to certain
Federal sites, such as Kennedy Space
Center and Cape Canaveral Air Force
Station, because they have a long
history of conducting launches and
reentries in a manner consistent with
FAA regulations. In addition, an
operator must contract with the Federal
launch or reentry site for ground safety
services or oversight. The FAA would
require that the operator have a written
agreement with the Federal site to use
its ground safety services or oversight
and comply with its ground safety
processes and requirements. Finally, the
Administrator must have determined,
consistent with the considerations in
§ 450.179(c), that the Federal launch or
reentry site’s ground safety processes,
requirements, and oversight are not
inconsistent with the Secretary’s
statutory authority over commercial
space activities. In considering the site’s
ground safety record, the Administrator
will consider the extent and
sophistication of both its ground safety
procedures and the frequency with
which the site uses them during FAAlicensed activities.
In making the determination to accept
a Federal site’s ground safety
procedures, the Administrator generally
will accept only those sites that have a
regular cadence of both commercial and
government launches and highly
developed, well-understood processes
and procedures. In considering the
coordination between the FAA and the
Federal site safety personnel, the
Administrator generally will approve
only those sites with which the FAA has
a long-term working relationship
through the Common Standards
Working Group (CSWG). Familiarity
with a Federal site’s ground safety
practices and procedures is the only
means by which the FAA can ensure it
has met its statutory obligation to ensure
public health and safety, safety of
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
property, and national security and
foreign policy interests of the United
States. When the Administrator finds
that a site meets the conditions in
§ 450.179(b), the FAA will develop a
Memorandum of Agreement (MOA)
with the approved site and publish the
MOA on the FAA’s website. If these
conditions are met, then the operator
can seek FAA permission during preapplication consultation to comply only
with the ground safety regulations
imposed by the Federal site. The FAA
will publish, maintain, and update the
Federal launch and reentry site ground
safety MOAs on its website.
For Federal launch or reentry sites or
other Federal entities that do not satisfy
the conditions in § 450.179(b), the final
rule retains the LSSA-like process in
accordance with § 450.45(b). As noted
earlier, the FAA believes that because of
the performance-based nature of part
450, Federal launch or reentry sites will
typically satisfy most or all FAA
requirements.
ii. Radionuclides (§ 450.45(e)(6))
In the NPRM, the FAA proposed in
§ 450.45(e)(6) that the FAA would
evaluate the launch or reentry of any
radionuclide on a case-by-case basis,
and issue an approval if the FAA finds
that the launch or reentry is consistent
with public health and safety, safety of
property, and national security and
foreign policy interests of the United
States. For any radionuclide on a launch
or reentry vehicle, an applicant would
need to identify the type and quantity,
include a reference list of all
documentation addressing the safety of
its intended use, and describe all
approvals by the Nuclear Regulatory
Commission for pre-flight ground
operations.
SpaceX requested that the FAA clarify
the intent of this regulation, as this topic
is heavily regulated by other Federal
entities. In addition, SpaceX
recommended that the FAA defer to and
accept results from other Federal
entities when applicable, and stated that
processes for acceptance and deferral
should be provided in an AC.
As discussed in the NPRM preamble,
§ 450.45(e)(6) will address the potential
launch or reentry of radionuclides,
similar to current § 415.115(b), but with
the addition of reentries. It is the current
practice of the FAA to address novel
public safety issues on a case-by-case
basis because such proposals are so
rarely encountered in commercial space
transportation. When applicable, FAA
will work closely with other Federal
entities to avoid duplicative
requirements. Moving forward however,
the Presidential Memorandum on
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
79593
In the NPRM, the FAA proposed to
consolidate and clarify environmental
review requirements for launch and
reentry operators in a single section,
§ 450.47 (Environmental Review). In
addition, the FAA proposed to revise
§§ 420.15, 433.7, 433.9, and 437.21 to
conform to the changes in proposed
§ 450.47. These revisions codify the
environmental review process as
currently conducted, in accordance with
FAA Order 1051.F, in which applicants
for a launch or reentry license provide
the FAA with the information needed to
comply with the National
Environmental Policy Act (NEPA) and
other applicable environmental laws,
regulations, and Executive Orders.
In the final rule, the FAA adopts
§ 450.47 as proposed with revisions.
The FAA revises § 450.47(b) to
affirmatively state that an applicant
must prepare an Environmental
Assessment (EA), assume financial
responsibility for preparation of an
Environmental Impact Statement (EIS),
or provide information to support a
written re-evaluation of a previously
submitted EA or EIS, when directed by
the FAA. The FAA revised this section
to clarify that the FAA, not the
applicant, determines which
environmental documentation is
required by NEPA. If the FAA
determines that under NEPA an EIS is
required, the FAA will select a
contractor to prepare the EIS for the
license applicant who will pay the
contractor. The FAA also revised
§§ 420.15(b), 433.7(c), 437.21(b)(1)(iii),
and 450.47(c) to clarify that it is the
FAA’s responsibility to determine
whether a Categorical Exemption
(CATEX) applies under NEPA.
An applicant may provide data and
analysis to assist the FAA in
determining whether a CATEX could
apply (including whether an
extraordinary circumstance exists) to a
license action. Examples include
modifications that are administrative in
nature or involve minor facility siting,
construction, or maintenance actions. In
the final rule, the FAA revises
§§ 420.15(b), 433.7(c), 437.21(b)(1)(iii),
and 450.47(c) to state affirmatively that
it is the FAA’s responsibility to
determine whether a CATEX applies
rather than an applicant’s responsibility
to request a CATEX.
If a CATEX does not apply to the
proposed action, but it is not anticipated
to have significant environmental
effects, then NEPA requires the
preparation of an EA. When directed by
the FAA, an applicant must prepare an
EA with FAA oversight. When NEPA
requires an EIS for commercial space
actions, the FAA uses third-party
contracting to prepare the document.
That is, the FAA selects a contractor to
prepare the EIS, and the license
applicant pays the contractor. Finally, if
an EA or EIS was previously developed,
the FAA may require an applicant to
submit information to support a written
re-evaluation of the environmental
document by an FAA-selected
contractor to ensure the document’s
continued adequacy, accuracy, and
validity.38
This rule will not alter the current
environmental review requirements.
However, as explained in the NPRM
preamble, the consolidation of the
launch and reentry regulations
necessitates a consolidation of the
environmental review requirements.
CSF asked the FAA to explain why it
added the requirement that applicants
prepare EAs with FAA oversight,
assume financial responsibility for
preparation of an EIS, or submit a
written re-evaluation of a previously
submitted EA or EIS. CSF requested
clarification on the phrase ‘‘under FAA
oversight’’ in proposed § 450.47, versus
the current language in FAA Order
1050.1 that requires FAA approval of an
applicant-prepared EA. CSF requested
further that the FAA clarify when and
for what purpose the FAA might require
an applicant to prepare a written reevaluation of a previously-submitted EA
or EIS, noting that the costs and
schedule impacts of this requirement
are unclear.
As noted in the NPRM, the changes to
the regulatory text on environmental
review do not represent a substantive
change to past regulations or to current
practice. Section 450.47 reflects the
existing environmental review process
that §§ 415.201 and 415.203 broadly
described, in which applicants must
provide sufficient information to enable
the FAA to comply with NEPA. Section
450.47 replaces this general requirement
by identifying the specific documents
that the FAA may require applicants to
37 https://www.whitehouse.gov/presidentialactions/presidential-memorandum-launchspacecraft-containing-space-nuclear-systems/
(August, 2019).
38 FAA Order 1050.1, Environmental Impacts:
Policies and Procedures, provides a more detailed
description of the FAA’s policies and procedures
for NEPA and CEQ compliance.
Launch of Spacecraft Containing Space
Nuclear Systems 37 directs the Secretary
to issue public guidance for applicants
seeking a license for launch or reentry
of a space nuclear system. The FAA is
currently developing this guidance.
g. Environmental Review (§ 450.47)
PO 00000
Frm 00029
Fmt 4701
Sfmt 4700
E:\FR\FM\10DER2.SGM
10DER2
79594
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
provide and the process to prepare those
documents. The language added to
§ 450.47 reflects current practice and is
consistent with NEPA and FAA policy.
According to FAA Order 1050.1, unless
the FAA determines that a categorical
exclusion applies, the FAA may prepare
an EA, EIS, or written re-evaluation, or
direct an applicant to provide the
information as described in
§§ 450.47(b)(1), (2), and (3).39 In
response to CSF’s comment, the FAA
revises § 450.47(b), as well as
§§ 420.15(b), 433.7(b), and
437.21(b)(1)(ii), from the language
proposed in the NPRM to state expressly
that an applicant must provide the
documents set forth in paragraph (b)
‘‘when directed by the FAA.’’ The
modified text clarifies the applicant’s
responsibilities in accordance with FAA
Order 1050.1 (Paragraph 2–2–2). These
responsibilities are consistent with
current practice and will not increase
the cost, impact schedules, or alter the
burden under the previous regulations.
With respect to § 450.47(b)(1), ‘‘with
FAA oversight’’ means the FAA will
guide the work of an applicant or an
applicant’s contractor. In order to use an
applicant or contractor-prepared
document for compliance with NEPA or
other environmental requirements, the
FAA must evaluate and take
responsibility for the document. The
FAA’s oversight ensures that: (1) The
applicant’s potential conflict of interest
does not impair the objectivity of the
document; and (2) the EA meets the
requirements of FAA Order 1050.1. The
FAA may require an applicant to submit
information to support a written reevaluation of a previously prepared
environmental document (i.e., a draft or
final EA or EIS) to determine whether
the document remains valid or a new or
supplemental environmental document
is required. Applicants should work
closely with the FAA to determine the
documentation requirements of NEPA
and other applicable environmental
requirements.40 In response to CSF’s
comment, the FAA revises
§ 450.47(b)(3), as well as §§ 420.15(b),
433.7(b), and 437.21(b)(1)(ii), to clarify
that an applicant would submit
‘‘information to support’’ a written reevaluation of a previously submitted EA
or EIS, rather than the re-evaluation
document itself, as proposed. The
39 Currently, the FAA has not established
categorical exclusions for this program. However,
the FAA may propose new categorical exclusions
applicable to the program after the FAA’s
performance of NEPA reviews of proposed actions
finds that the actions, when implemented, do not
result in significant individual or cumulative
environmental effects.
40 See FAA Order 1050.1, Section 9–2.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
contractor selected by the FAA will use
the information provided by the
applicant to prepare the re-evaluation
document.
CSF commented that the FAA should
adopt, to the greatest extent possible,
NEPA documentation from other
Federal agencies or licensed site
operators.
The FAA notes that it may adopt, in
whole or in part, another Federal
agency’s draft or final EA, the EA
portion of another agency’s EA/
FONSI, 41 or EIS in accordance with
applicable regulations and authorities
implementing NEPA.42 Whenever
possible, the FAA will adopt the other
Federal agency’s NEPA documents to
support the issuance of launch and
reentry licenses. Further, the FAA
encourages early coordination with the
FAA to benefit applicants that are
seeking approvals from other Federal
agencies related to the FAA-issued
license (e.g., an applicant seeking
approval from a Federal agency to make
modifications on a Federal launch or
reentry site in anticipation of receiving
a launch license from the FAA). This
coordination will increase the
likelihood of a more efficient
environmental review process as the
applicant seeks different but related
approvals from multiple Federal
agencies. The applicant should consult
with the FAA early in the project’s
development phase, prior to the
development of the NEPA document, to
determine environmental review
responsibilities, and the appropriate
level of review, and to foster efficient
procedures to develop documentation to
meet the agencies’ legal requirements.
CSF also encouraged the FAA to
request appropriations to fund regional
or area EAs. This recommendation is
beyond the scope of this rulemaking.
The Aircraft Owners and Pilots
Association (AOPA) stated its concern
that, under the proposed regulations,
existing Special Use Airspace approvals
(SUAs) would be activated for purposes
that may not align with the original
environmental determinations that led
to approval of the SUAs. AOPA noted
that the environmental process for
establishing SUAs includes detailed
studies of the intended activity, its
frequency, and its effect on the public.
Many of the SUAs activated in support
of commercial space activity originally
underwent environmental review and
approval on the assumption that they
were supporting military or
41 Finding
of No Significant Impact.
CFR 1506.3 of the Council on Environmental
Quality (CEQ) Regulations and FAA Order 1050.1,
as of the publication date of this rule.
42 40
PO 00000
Frm 00030
Fmt 4701
Sfmt 4700
governmental activity, not commercial
civil space operators.
This rule will not affect the
environmental determination process
for establishing or altering SUAs.
Environmental review concerns
associated with the designation or
activation of SUAs are not the subject of
this rulemaking. The FAA notes that all
environmental impacts associated with
a proposed launch or reentry will be
addressed in the NEPA document
prepared for that activity.
AOPA urged the FAA to ensure that
the documentation for commercial
space operations is complete and
transparent so that the public can
understand and identify potential
impacts.
This rule will not alter the current
environmental review process, which
requires documentation of
environmental impacts. The FAA
remains responsible for complying with
NEPA and other applicable
environmental laws, regulations, and
Executive Orders prior to issuing a
launch or reentry license. The FAA
ensures transparency of the potential
environmental impacts by publishing all
draft and final EAs and EISs, and
associated Findings of No Significant
Impact and Records of Decisions.
CSF and Denver International Airport
requested clarification on how the
environmental reviews required under
NEPA would apply to multiple sites. In
accordance with applicable regulations
and authorities implementing NEPA,
the FAA’s decision-making process
must consider and disclose the potential
impacts of a proposed action and its
alternatives on the quality of the human
environment. This process includes
considering the impacts of launches
from multiple sites, which may be
covered in a single NEPA document
when appropriate. In some instances,
one single NEPA document may not be
possible and individual site-specific
NEPA documents could be developed.
The FAA is examining the use of
programmatic NEPA documents to
analyze the impacts of launches from
multiple sites. Under such an approach,
applicants could tier their individual,
site-specific NEPA analyses from the
programmatic document.43 The FAA
will conduct programmatic EA analyses
consistent with FAA Order 1050.1 and
CEQ regulations.
SpinLaunch stated the environmental
review process is lengthy, sometimes
taking as long as 2 years or more. To
facilitate the process, it recommended
(1) including the environmental review
within the statutory period, thereby
43 See
E:\FR\FM\10DER2.SGM
Order 1050.1, Section 3–2.
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
forcing an expedited process; and (2)
establishing limited environmental
approval for proposed activities (e.g.,
non-rocket launch systems) that do not
have the adverse environmental impacts
of a traditional rocket.
The FAA does not consider the 180day statutory review period to include
NEPA document preparation.
Specifically, the applicant must submit
a completed EIS prepared by the FAA
(or an FAA-selected and managed
consultant contractor) or an FAAapproved EA, categorical exclusion
determination from the FAA, or written
re-evaluation as part of its application
materials. The statutory application
review period is not intended to
encompass the time needed for the
applicant to develop the necessary
application materials, including
environmental documentation.
Regarding the commenter’s second
recommendation, the FAA is bound by
CEQ’s NEPA regulations. There are
three levels of NEPA review: CATEX,
EA, and EIS. Each of the three levels of
review is described in FAA Order
1050.1. The required level of review
depends on the nature of the
commercial space action. Applicants
should coordinate with the FAA early in
the application process to determine the
appropriate level of NEPA review based
on the potential for significant impact.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA jointly
recommended adding to proposed
§ 450.47(a) a statement requiring the
FAA to coordinate with other
government entities to assist the
applicant in completing EAs, in order to
alleviate the cost impact on operators
who currently have to negotiate
multiple sets of requirements by
Federal, State, and local governments.
The joint commenters also
recommended amending
§§ 420.15(b)(ii), 433.7(b)(2), and
450.47(b)(2) to allow EISs to be prepared
by an FAA-approved consultant
contractor, in addition to one selected
and managed by the FAA. The
commenters suggested these changes
would provide flexibility and allow an
operator to use qualified EIS contractors
at the State- or local-level as long as the
contractor meets the qualifications for
completing an EIS in accordance with
the law.
The FAA declines the suggested
regulatory text changes.
Section 1506.5(c) of the CEQ
Regulations for Implementing the
Provisions of NEPA and Appendix C of
FAA Order 1050.1 state that EISs must
be prepared by a contractor selected by
the lead agency to avoid a conflict of
interest.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Boeing, Lockheed Martin, Northrop
Grumman, and ULA recommended the
FAA craft an additional section to
proposed § 450.47 to address space
environmental impacts such as debris,
collision risk, and interference.
The FAA does not agree with this
recommendation. The applicability of
NEPA to space debris is outside the
scope of this rulemaking.
One individual commenter expressed
concern that the proposed part 450 may
cause companies to forgo environmental
considerations or somehow bypass
compliance requirements. The proposal
does not alter NEPA and will continue
to require potential licensees to comply
with all policies and procedures
implementing NEPA, as well as other
applicable environmental laws,
regulations, and Executive Orders
intended to protect the environment.
4. Part 450 Subpart C—Safety
Requirements
a. Neighboring Operations Personnel
(§ 450.101(a) and (b))
In the NPRM, the FAA proposed to
carve out separate individual and
collective risk criteria for neighboring
operations personnel. The proposal was
intended to reduce the need to clear or
evacuate other launch operator
personnel during a commercial launch
or reentry operation. Under the current
regulations, an operator may be required
to clear anywhere from a handful of
employees to over a thousand
employees from a neighboring site for a
significant portion of a day. To address
this issue, the NPRM proposed to define
‘‘public’’ and ‘‘neighboring operations
personnel’’ in § 401.5. Under the
proposal, neighboring operations
personnel would still be members of the
public, but would be subject to different
individual and collective risk criteria.
These proposed regulations were
intended to enable neighboring
operations personnel to remain within
safety clear zones and hazardous launch
areas during flight as long as their risk
did not exceed the newly designated
thresholds.
In the final rule, the FAA adopts the
proposal for neighboring operations
personnel in §§ 401.7, 440.3, 450.101(a)
and (b), and 450.137(c)(6). The FAA
revises the § 401.7 definition of
‘‘neighboring operations’’ by removing
the phrase ‘‘as determined by the
Federal or licensed launch or reentry
site operator’’ because the phrase is not
relevant to the definition of neighboring
operations personnel. The FAA also
revises § 450.133 (Flight Hazard Area
Analysis) paragraph (e)(2) to require that
an applicant provide the hypothetical
PO 00000
Frm 00031
Fmt 4701
Sfmt 4700
79595
location of any member of the public
that could be exposed to a probability of
casualty of 1 × 10¥5 or greater for
neighboring operations personnel, in
response to a comment to clarify
representative probability contours.
The FAA sought comment on the
proposed approach, as well as on
proposals (1) not to require that
neighboring operations personnel be
specially trained, (2) not to designate
ground operations hazard criteria for
neighboring operations personnel, and
(3) for the purpose of determining MPL,
to align the individual risk threshold for
neighboring operations personnel with
the threshold for losses to government
property and involved government
personnel. Many commenters agreed
with the FAA’s proposal to change the
risk threshold for neighboring
operations personnel, stating that a
higher risk threshold is necessary to
allow for co-processing of multiple
operations at a single facility. Despite
this general agreement, some
commenters disagreed with the specifics
of the proposal. Several commenters
pointed out that the FAA’s approach to
neighboring operations personnel differs
from the ARC recommendation to
exclude permanently badged personnel
and neighboring launch operations from
the definition of ‘‘public’’ but still to
employ mitigation measures for
uninvolved neighboring operations
personnel when a hazardous operation
or launch is scheduled.
Several commenters, including Blue
Origin, Boeing, CSF, Lockheed Martin,
Northrop Grumman, Space Florida,
SpaceX, ULA, and Virgin Orbit,
commented that neighboring operations
personnel should not be included as
members of the public. CSF stated that
neighboring operations personnel
should not be considered members of
the public because they have essential,
on-going requirements to conduct
neighboring space transportation
activities. CSF further stated that the
FAA has the flexibility to exclude
neighboring operations personnel from
its definition of ‘‘public.’’ Blue Origin
similarly stated that neighboring
operations personnel are more familiar
with the hazardous operations present
at a launch site and may have a
relationship or engagement with their
neighboring operators and, therefore,
should be treated differently from the
public who are completely uninvolved
and are not knowledgeable about launch
and reentry operations. Space Florida
also commented that employees of the
licensee who may be working on a test
program or a different launch or reentry
program are not members of the public
and raised the question whether the
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79596
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
FAA should have statutory authority
over launch essential personnel of a
neighboring operator for other launch,
reentry, or associated operations. Virgin
Orbit commented that it would be better
to include neighboring operations
personnel under launch personnel,
rather than requiring a new and possibly
burdensome expected casualty analysis.
The FAA agrees that neighboring
operations personnel are a unique
category of people because of their
essential, ongoing tasks. The FAA
disagrees, however, with commenters’
assertions that neighboring operations
personnel should be excluded from the
definition of ‘‘public’’ because of their
involvement in launch operations or the
tasks they are expected to perform. The
FAA has a statutory obligation to protect
the health and safety of members of the
public. Prior to this rulemaking, the
FAA defined public safety, for a
particular licensed launch, as the safety
of people and property that are not
involved in supporting the launch,
including those people and property
that may be located within the boundary
of a launch site, such as visitors,
individuals providing goods or services
not related to launch processing or
flight, and any other launch operator
and its personnel. The FAA’s definition
of ‘‘public’’ is derived from the
definition of ‘‘public safety’’ in § 401.5
and the definition of ‘‘public’’ in
§ 420.5.44
The FAA’s definition of ‘‘public’’
encompasses neighboring operations
personnel because they are not involved
in supporting the specific launch or
reentry they are neighboring. The FAA
agrees that neighboring operations
personnel are more familiar with the
hazardous operations present at a
launch site and may have a relationship
or engagement with their neighboring
operators, but the FAA does not find
that to be sufficient to exclude them
from the definition of ‘‘public.’’ It was
a factor, however, in the FAA’s decision
to apply a risk requirement to
neighboring operations personnel
different from the requirement applied
to other members of the public.
Although this rule includes neighboring
operations personnel in the definition of
‘‘public,’’ the FAA recognizes that
neighboring operations personnel are
aware of the inherent risks associated
with launch and reentry activities and
are likely trained and prepared to
respond to hazards present at these
sites. Because of these differences, as
well as their unique role in performing
44 Both of these definitions are being replaced by
the new, consolidated definition of ‘‘public’’ in
§ 401.7.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
safety, security, and critical tasks, the
FAA considers neighboring operations
personnel a separate category of public,
whose collective exposure to risk may
not exceed 2 × 10¥4 and for whom the
risk to any individual may not exceed
1 × 10¥5.
The FAA disagrees with Virgin Orbit’s
comment that neighboring operations
personnel should be included as launch
personnel so as to be exempted from
risk calculations and eliminate the
burden of the additional risk
calculation. Neighboring operations
personnel are not supporting the
licensed activity and are members of the
public; therefore, they must be protected
under the FAA’s statutory mandate. The
FAA acknowledges that this conclusion
requires risk analysis for the
neighboring operations personnel;
however, the FAA expects that this
analysis will involve little additional
effort because the operator already has
to perform a similar analysis for the
other members of the public and will
only need to account for the population
of neighboring operations personnel, if
any. For these reasons, the FAA adopts
the proposal without amendment.
In addition to comments
recommending that neighboring
operations personnel be excluded from
the definition of ‘‘public,’’ several
commenters had other
recommendations for the proposed
definition of ‘‘public.’’ CSF commented
that the proposal does not specify how
involved in a licensed operation a
person needs to be to fall outside public
risk protections. CSF also proposed that
the definition of ‘‘public’’ should allow
for a risk threshold for those who have
been briefed on the risks and hazards
and chosen to participate to the same
level as neighboring operations
personnel, and that historic NASA
operations have followed this model.
CSF further stated that the definition of
‘‘public’’ should not include persons
who have a passive involvement in the
licensed activity, such as invited guests
of the operator, customers, families of
astronauts, and other stakeholders with
a legitimate enough interest in the
launch or reentry activity to be on-site.
SpaceX echoed CSF’s comments on this
issue, and further suggested that the
definition of ‘‘public’’ should generally
include only those people who reside
and work outside the controlled areas of
a launch or reentry site. Blue Origin,
CSF, and SpaceX recommended
excluding invited guests of the launch
or reentry operator from the definition
of ‘‘public.’’
As discussed earlier, the FAA’s
definition of ‘‘public’’ was derived from
the definition of ‘‘public safety’’ in
PO 00000
Frm 00032
Fmt 4701
Sfmt 4700
§ 401.5 and the definition of ‘‘public’’ in
§ 420.5. Historically, the FAA has
considered ‘‘public’’ to include all
people and property that are not
involved in supporting a licensed or
permitted launch and in the final rule
extends the same definition to reentry.
While neighboring operations personnel
or invited guests 45 may accept a higher
level of background risk, they are not
involved in supporting the particular
licensed operation and this rule
continues the FAA’s longstanding
practice of protecting them as members
of the ‘‘public.’’ While the FAA expects
that certain members of the public may
be briefed and aware of hazards, the
FAA does not agree with CSF’s rationale
that being informed is a sufficient
condition for such persons to be treated
under the higher risk threshold for
neighboring operations personnel. In
addition to being informed of potential
hazards, neighboring operations
personnel are required to perform
safety, security, or critical tasks at the
neighboring site. The FAA finds that the
necessity of these tasks justifies the
minimal increase in risk to which
neighboring operations personnel are
exposed. Informed members of the
public do not meet this criterion and,
therefore, will continue to be protected
at the public threshold rather than the
higher threshold for neighboring
operations personnel.
The FAA considered potential
regulatory mechanisms for allowing
public stakeholders with a legitimate
enough interest in the launch or reentry
activity to be on-site as requested by
commenters. However, the FAA
identified certain statutory and
regulatory challenges with making these
changes as a part of this final rule.
Given the inherent risks associated with
commercial space activity, Congress
established a framework for liability
insurance and financial responsibility
that distinguishes individuals involved
in launch or reentry activities from third
parties. Section 50902 defines third
party as persons other than launch or
reentry participants.46 Section 50914
45 The FAA is not proposing a higher risk
threshold for invited guests or other consenting
members of the public at this time.
46 Specifically, in accordance with § 50902(26),
‘‘third party’’ means a person except—
(A) the United States Government or the
Government’s contractors or subcontractors
involved in launch services or reentry services;
(B) a licensee or transferee under this chapter;
(C) a licensee’s or transferee’s contractors,
subcontractors, or customers involved in launch
services or reentry services;
(D) the customer’s contractors or subcontractors
involved in launch services or reentry services; or
(E) crew, government astronauts, or space flight
participants.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
states that a licensee must obtain
liability insurance to protect launch or
reentry participants from third party
claims, based on maximum probable
loss calculations.47 Additionally,
section 50914(b) establishes a reciprocal
waiver of claims regime for applicable
parties whereby each party to the waiver
agrees to be responsible for personal
injury to, death of, or property damage
or loss sustained by it or its own
employees resulting from an activity
carried out under the applicable license.
This regime includes certain parties
waiving claims against the U.S.
Government.48 The FAA has codified
these requirements in the part 440
regulations.
While the FAA may waive certain risk
requirements in order to allow members
of the public to be present in hazard
areas during launch or reentry activities,
these individuals are third parties under
title 51 and will therefore be included
in maximum probable loss calculations.
This would likely increase insurance
costs, which would be borne by the
licensee. Additionally, these individuals
are not currently included in title 51’s
cross-waiver framework nor has the
FAA gone beyond the scope of title 51
in part 440 to expand the cross-waiver
framework to include them. As such,
their presence in hazard areas during
launch or reentry activities may increase
the liability of the United States (and
others involved in the launch who have
executed cross-waivers with the
operator) because of the increased
potential for third party claims. Finally,
any regulatory changes would need to
be effectuated in part 440 where the
FAA’s financial responsibility
requirements for commercial space
transportation are located; however, the
FAA did not contemplate substantial
changes to part 440 in this rulemaking.
Because of these challenges, the FAA
elects to proceed with a waiver regime
rather than a regulatory change at this
time.The FAA notes that operators may
request waivers to allow members of the
public to be present in areas where risk
requirements under part 450 would not
otherwise allow them to be during
47 Specifically, in accordance with § 50914(a)(4),
the insurance must protect the following, to the
extent of their potential liability for involvement in
launch services or reentry services, at no cost to the
Government:
(A) the Government.
(B) executive agencies and personnel, contractors,
and subcontractors of the Government.
(C) contractors, subcontractors, and customers of
the licensee or transferee.
(D) contractors and subcontractors of the
customer.
(E) space flight participants.
48 51 U.S.C. 50914(b)(2).
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
launch and reentry activities.49 Such
requests can serve a purpose of
encouraging, facilitating, or promoting
commercial space launches and
reentries by the private sector,
facilitating private sector involvement
in commercial space transportation
activity, and promoting public-private
partnerships. However, the FAA expects
operators to articulate more specifically
the reasons why allowing particular
individuals to be in areas they otherwise
would be prohibited from entering is in
the public interest. In considering such
waiver requests, the FAA would be
mindful of its role in protecting the
public and accounting for any
additional liability such a waiver would
impose on the U.S. Government. Some
factors that would affect the FAA’s
decision may include the number of
people an operator seeks to have present
and the strength of association between
those people and the launch or reentry
activity. Individuals that have an
employment or contractual arrangement
with the licensee, or are otherwise part
of the cross-waiver framework of the
license, may pose minimal, if any,
liability for the U.S. Government. This
could include high-level company
officials and U.S. Government officials.
Members of the public for whom a
waiver is requested should have a strong
connection to the launch, reentry, or
licensee; for example, future customers,
major investors, or invited press might
qualify.
The operator bears the burden of
providing adequate justification for this
relief through the waiver process. The
operator should include in its waiver
application an assessment of the risks to
the individuals covered by the
requested waiver,50 information on how
the operator will assume liability and
hold the U.S. Government harmless, and
the individuals’ association to the
launch, reentry, or licensee. The FAA
anticipates using its experience in
considering waivers to accommodate
the presence of additional members of
the public during commercial space
launch and reentry activities to inform
potential future rulemaking in this area.
The FAA also received several
comments on the proposed definition of
‘‘neighboring operations personnel.’’
49 Should the FAA grant such a waiver, any
individuals to whom the waiver applied would still
constitute third parties under title 51 U.S.C. 50902,
and operators would continue to be required to
obtain liability insurance or demonstrate financial
responsibility to cover third party claims as
required by 51 U.S.C. 50914 and 14 CFR part 440.
50 An operator may perform a risk analysis using
its own methods or the risk analyses identified in
part 450 in order to demonstrate the individual and
collective risks imposed on the individuals
identified in the waiver request.
PO 00000
Frm 00033
Fmt 4701
Sfmt 4700
79597
Blue Origin requested that the FAA
further define the term ‘‘critical tasks’’
referenced in the new definition to
include ‘‘tasks that are critical to normal
business operations.’’
The FAA does not agree that adding
Blue Origin’s definition of ‘‘critical
tasks’’ is necessary. In the absence of a
regulatory definition, the plain language
definition applies and is sufficient here.
In addition, the FAA gave context in the
preamble to the NPRM for the types of
activity that may qualify as ‘‘safety,
security, or critical tasks.’’ The plain
language definition maintains flexibility
to include various tasks as industry
practices evolve over time. These tasks
include maintaining the security of a
site or facility or performing critical
launch processing tasks such as
monitoring pressure vessels or testing
safety-critical systems of a launch
vehicle for an upcoming mission. These
tasks also include business operations
that cannot be reasonably conducted off
site, such as onsite hardware work as
well as data processing that must be
conducted in a secure facility.
Neighboring operations personnel do
not include individuals conducting
normal business operations that need
not be conducted in hazardous areas,
individuals in training for any job, or
individuals performing routine
activities such as administrative, office
building maintenance, human resource
functions, or janitorial work. This
flexibility accommodates practices like
those USAF and NASA follow at their
launch sites and is intended to allow
critical operations to proceed at
neighboring locations without
jeopardizing those operations. As
explained in the NPRM, neighboring
operations personnel are members of the
public. The FAA allows a slightly
increased risk to these personnel over
that permissible to other members of the
public. The FAA does not believe that
an increase in risk is justified for
reasons other than to facilitate
performing safety, security, or critical
tasks at the site. The FAA estimates that
the collective risk criteria in the final
rule for neighboring operations
personnel will enable, on average,
approximately forty additional
personnel to operatate in this capacity,
which the FAA believes will ensure that
neighboring operators can maintain
operations with minimum disruption.
Virgin Galactic commented that the
definition of ‘‘neighboring operations
personnel’’ should include all personnel
who have been properly trained to
respond to hazards present at a launch
or reentry site and who are notified of
hazardous operations occurring by other
licensed operators at that site. Virgin
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79598
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Galactic objected to including in the
definition a requirement that
neighboring operations personnel be
notified of the operation, stating that a
lack of notification should not exclude
individuals from qualifying as
neighboring operations personnel.
Similarly, ULA commented that the
requirement appeared to be mostly in
the definition, which ‘‘removes the
definition’s objectivity.’’
FAA disagrees with Virgin Galactic
that training and notification are
sufficient to justify the inclusion of
personnel in the neighboring operations
personnel category. Training alone does
not justify placing personnel at a raised
level of risk. Only those personnel
performing safety, security, or critical
tasks qualify as neighboring operations
personnel who may be subjected to a
higher risk threshold because of the
nature of those tasks, as discussed
previously and in the NPRM.
Furthermore, as explained in the NPRM,
requiring a licensee to ensure
neighboring operations personnel are
trained would be burdensome and is not
necessary to justify the increase in risk
allowed for workers performing safety,
security, or critical tasks.
The FAA does not agree with Virgin
Galactic and ULA that the definition of
‘‘neighboring operations personnel’’
imposes a regulatory requirement.
Rather, it enables neighboring
operations to continue by describing
which individuals qualify as
neighboring operations personnel.
Notification of an operation is a
precondition to qualify as neighboring
operations personnel. Personnel cannot
be designated as neighboring operations
personnel and be subject to the higher
risk thresholds, if they have not been
notified of the operation. For these
reasons, the FAA declines to accept
these particular changes to the proposed
definition.
A number of commenters focused on
which authority designates personnel as
neighboring operations personnel. Many
commenters, including CSF, Space
Florida, and SpaceX, noted their
agreement that the designation of
neighboring operations personnel
should be coordinated and determined
by the site operator, but urged the FAA
to remove its proposed neighboring
operations personnel risk thresholds
and instead allow site operators to
designate what mitigations would be
necessary to protect neighboring
operations personnel. CSF urged the
FAA generally to defer to Federal, State,
local, or private site owners and
operators as the sole decision-makers
responsible for determining which
personnel would be considered
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
essential to ongoing operations and
what hazard mitigation measures should
be observed.
Other commenters, including ULA
and Virgin Galactic, commented that the
FAA should designate neighboring
operations personnel. These
commenters argued that a site operator
should not determine who qualifies as
neighboring operations personnel,
because it would be tantamount to the
FAA’s reassigning its decision-making
authority on the matter. Sierra Nevada
recommended that the FAA collect the
neighboring operations personnel
information and calculate the risk on
behalf of the applicant so that the
proprietary nature of workforce
numbers can be maintained between
competitive companies. The Aerospace
Industry Association (AIA), Blue Origin,
Virgin Galactic, and other commenters
also raised concerns about how
proprietary data would be shared after
neighboring operations are designated.
Virgin Galactic commented that those
best suited to know which employees
are required for safety, security, or
critical tasks are the other launch
operators, not the site operator.
As previously described, the FAA
maintains that the separate risk
thresholds are the appropriate
protections for neighboring operations
personnel, and the FAA does not agree
with removing its proposed neighboring
operations personnel risk thresholds
and instead allowing site operators to
designate what mitigations would be
necessary to protect neighboring
operations personnel. The FAA does not
agree with ULA and Virgin Galactic that
the FAA or the launch operator should
determine what individuals are
appropriately classified as neighboring
operations personnel. Site operators are
in the best position to know what
operations occur on their sites and
which individuals are appropriately
designated as neighboring operations
personnel. The FAA expects that the
site operator (i.e., an operator of a
Federal site or FAA-licensed launch or
reentry site) would work with operators
of neighboring sites to identify these
personnel because the site operator is in
the best position to identify which
personnel are required to perform
safety, security, or critical tasks at the
launch site. The site operator has a
formal relationship with all operators on
its site and has an interest in enabling
continued and unimpeded operations
amongst its tenants. At Federal sites, the
site operator already fulfills this
function, and thus enabling neighboring
operations personnel does not impose
any additional costs on the site operator.
The designation of neighboring
PO 00000
Frm 00034
Fmt 4701
Sfmt 4700
operations personnel is optional for
FAA-licensed or exclusive use site
operators. The FAA will monitor a
launch site operator’s designation and
vehicle operator’s implementation of
neighboring operations personnel to
ensure the appropriateness of these
designations, thereby retaining its
authority to determine which
individuals are properly characterized
as neighboring operations personnel.
Further, site operators are best
positioned to adjudicate between
tenants, to coordinate acceptable
numbers of neighboring operations
personnel during licensed operations,
and to protect their tenants’ proprietary
information and furnish the necessary
information to the licensed operator.
The FAA expects that the coordination
of the necessary data transfer will be
collaborative between the licensed
operator, the site operator, and the
neighboring operators. Neighboring
operators have the option of removing
their personnel during the flight of a
neighboring flight or reentry. As
discussed above, neighboring operators
have the option of discussing with the
site operator which personnel they
believe need to remain present in order
to maintain safety, security, or other
critical tasks. The accommodation of
neighboring operations personnel
through the risk thresholds benefits the
launch or reentry operator by reducing
the possibility that their presence
without evacuation could result in a
violation of the public risk criteria. It
also benefits the neighboring operators
to allow safety, security, or critical tasks
to continue in cases where the site
operator might otherwise require
evacuation of personnel. Hence, the
FAA believes that generally, as is
current practice at Federal sites,
neighboring operations personnel can be
accommodated with little direct
intervention by the FAA.
Blue Origin, CSF, and SpaceX all
commented that the neighboring
operations personnel provisions should
apply to exclusive-use or private sites.
Blue Origin asked whether the FAA
intended to exclude such sites from its
proposal because, although these are
sites that the FAA does not license,
launch and reentry activities at these
sites can cause disruptions to nonlicensed neighboring activities, such as
developmental or test programs.
The FAA does not license exclusiveuse sites, but it does license launch and
reentry activities that occur at exclusiveuse sites. The FAA does not anticipate
that many exclusive-use sites would
have personnel within a launch or
reentry site, or an adjacent launch or
reentry site, that qualify as neighboring
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
operations personnel. Nevertheless, the
FAA may accept the designation of
neighboring operations personnel at an
exclusive-use site if they are designated
by the licensed vehicle operator that
operates the site. Such designations will
only apply to members of the public
located within the site or an adjacent
launch or reentry site who are not
associated with the specific hazardous
licensed or permitted operation being
conducted, but who are required to
perform safety, security, or critical tasks
at the site and are notified of the
operation. This approach is
accommodated by the proposed
regulations without change.
The FAA recognizes that there are
activities that currently take place at
launch sites that are not explicitly
associated with launch or reentry
operations. For example, payload
processing typically occurs at launch
sites. The Reagan Test Site at Kwajalein
also has facilities that are essential for
tracking objects in space. The U.S. Navy
has a presence at Cape Canaveral Air
Force Station (CCAFS). These activities
may sometimes require critical
personnel to remain on site during
neighboring launch activities to ensure
the continuation of operations. While
the FAA envisioned primarily
facilitating launch operations by
proposing a carve out for neighboring
operations personnel, it will allow other
personnel conducting non-licensed
activities on a launch or reentry site or
an adjacent launch or reentry site to
qualify as neighboring operations
personnel as long as they meet the
criteria enumerated in the definition.
ALPA and Space Florida questioned
whether the neighboring operations
personnel provisions would apply at
joint spaceport/airport facilities to allow
airport staff to stay in the hazard area or
clear zone based on risk assessments
during licensed space operations. In the
NPRM, the FAA took into account that
neighboring operations personnel are
more likely than the rest of the public
to be specially trained and prepared to
respond to hazards present at a launch
or reentry site. The USAF and NASA
definitions specify that these personnel
are either trained in mitigation
techniques or accompanied by a
properly trained escort. However, the
FAA did not require that neighboring
operations personnel be trained or
accompanied by a trained escort
because such a requirement would be
burdensome, and training is not
necessary to justify the slight increase in
risk allowed for workers performing
safety, security, or critical tasks.
Although in developing the NPRM, the
FAA did not contemplate airport
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
personnel at co-located sites as
neighboring operations personnel, the
proposed definition did not preclude
the possibility. In response to
commenters, the FAA finalizes the
definition of ‘‘neighboring operations
personnel’’ as proposed, and agrees that
the definition may include airport
personnel working at a launch site.
Many commenters expressed
concerns about the impact of
designating neighboring operations
personnel on the MPL calculation and
the associated financial responsibility
requirements. Northrup Grumman,
Sierra Nevada, SpaceX, and ULA all
commented that the inclusion of
neighboring operations personnel would
likely raise MPL, even at the proposed
lower threshold in the NPRM. CSF,
Space Florida, and SpaceX requested
that neighboring operations personnel
should be excluded from MPL
calculations via waivers of liability.
Section 50914(c) of title 51 of the U.S.
Code states that the Secretary of
Transportation shall determine the
maximum probable losses for which a
licensee must obtain liability insurance
or demonstrate financial responsibility.
This amount must include the
maximum probable loss from claims by,
in relevant part, third parties. 51 U.S.C.
50914(a)(1)(A). Neighboring operations
personnel are third parties under
chapter 509 of title 51.51 Therefore, the
FAA must include neighboring
operations personnel in its MPL
calculations.
The FAA agrees with the comments
that MPL calculations could be affected
by the designation of neighboring
operations personnel because the
proposed rule allowed more people to
stay inside the 1 × 10¥5 probability of
casualty hazard area. While the FAA
must include neighboring operations
personnel in the MPL calculation, it
does not expect the inclusion to affect
materially the MPL amount. This
expectation is based on the adoption in
the proposed rule, for the purpose of
determining MPL, of setting the
threshold for neighboring operations
personnel at the same threshold for
losses to government property and
involved government personnel. The
MPL will determine losses to property
51 ‘‘Third party’’ means a person except—(A) the
United States Government or the Government’s
contractors or subcontractors involved in launch
services or reentry services; (B) a licensee or
transferee under this chapter; (C) a licensee’s or
transferee’s contractors, subcontractors, or
customers involved in launch services or reentry
services; (D) the customer’s contractors or
subcontractors involved in launch services or
reentry services; or (E) crew, government
astronauts, or space flight participants. 51 U.S.C.
50902(26).
PO 00000
Frm 00035
Fmt 4701
Sfmt 4700
79599
and personnel of neighboring operators
that have a probability of occurrence of
no less than one in one hundred
thousand (1 × 10¥5), instead of the more
stringent requirement of one in ten
million (1 × 10¥7) used for other third
party losses. This threshold is
appropriate for neighboring operations
personnel because, unlike other third
parties, except for involved government
personnel, the presence of neighboring
operations personnel at a launch or
reentry site is necessary either for
security reasons or to avoid the
disruption of co-located activities at
neighboring sites. The MPL
methodology captures catastrophic
events that, while extremely unlikely,
still fall within the probability
threshold.
The FAA’s examination of past MPL
determinations gives it confidence that
these other events will generally drive
MPL amounts more than the limited
presence of neighboring operations
personnel.52 While additional insurance
costs are expected to be minimal, these
minimal cost burdens are more
appropriately placed on the launch or
reentry operator creating the hazards,
rather than the neighboring operator
who otherwise must halt its operation.
The FAA notes, however, that these
regulations do not prevent a launch
operator from entering into an
agreement with a neighboring operator
to recover costs as a result of any
increase in the required amount of third
party liability insurance due to the
presence of neighboring operations
personnel. Should a launch operator
choose to enter into such an agreement,
the launch operator would still be
required to purchase insurance to cover
all third parties, to include any
neighboring operations personnel, and
could seek reimbursement as a
secondary measure. Therefore, the FAA
adopts the proposal without
amendment.
52 For example, the third party MPL for an Atlas
541 launch from CCAFS is currently $164M, which
accounts for an event involving 30 third party
casualties based on the risk profile method. An
unlicensed government launch of the same vehicle
occurred with 12 people deemed neighboring
operations personnel that were located within the
1 × 10¥6 PC contour. If the conditions present
during that unlicensed launch were to occur under
part 450, then those 12 neighboring operations
personnel would be accounted for in the third party
MPL calculation at the 1 × 10¥5 probability
threshold (instead of the current standard 1 × 10¥7
threshold for third parties as explained in the
previous paragraph). The presence of the 12
neighboring operations personnel does not exceed
the event involving 30 third party casualties.
Therefore, it is unlikely that those 12 neighboring
operations personnel would lead to an increase in
the MPL for the Atlas 541 under part 450.
E:\FR\FM\10DER2.SGM
10DER2
79600
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
i. § 450.101(c)
In the NPRM, proposed § 450.101(c)
would require an operator to use flight
abort as a hazard control strategy if the
consequence of any reasonably
foreseeable vehicle response mode, in
any one-second period of flight, is
greater than 1 × 10¥3 CEC for
uncontrolled areas. The FAA further
proposed that the requirement would
apply to all phases of flight, unless
otherwise agreed to by the
Administrator based on the
demonstrated reliability of the launch or
reentry vehicle during that phase of
flight. Although not specifically spelled
out in the regulatory text, the FAA
explained in the preamble that
§ 450.101(c) was designed to ensure the
public was sufficiently protected against
low probability, high consequence
events using CEC as a measure of the
potential for high consequence events.
In the final rule, the FAA retains the
use of CEC as a quantitative criteria that
an applicant may use to measure the
potential for high consequence events.
However, as explained in the preamble
section addressing § 450.101(c)(2), the
FAA revises § 450.37(b) (Equivalent
Level of Safety) to allow an applicant to
propose an alternative way to measure
high consequence events other than by
CEC. The final rule also allows multiple
ways an applicant may protect against a
low probability, high consequence event
in uncontrolled areas for each phase of
flight in § 450.101(c)(1) through (3). As
discussed in more detail later in this
section, an operator sufficiently protects
against a high consequence event by (1)
using flight abort in accordance with
§ 450.108; (2) demonstrating that CEC is
below a certain threshold without any
FSS; or (3) demonstrating sufficient
vehicle reliability and in consideration
of CEC.54 The FAA changes the heading
of § 450.101(c) from ‘‘Flight Abort’’ in
the NPRM to ‘‘High Consequence Event
Protection’’ in the final rule because this
section allows an operator in certain
circumstances to use a method other
than flight abort to protect against high
consequence events.
Multiple commenters, including CSF,
Sierra Nevada, and SpaceX, stated that
the NPRM requirements in § 450.101(c)
were too prescriptive and objected to
the lack of an explicit provision
allowing an applicant to propose
another approach to address a high
consequence event, absent a waiver. The
FAA agrees that the final rule should
provide additional flexibility and
discusses those changes in more detail
later in this section.
Multiple commenters, including CSF
and Virgin Galactic, indicated that the
EC collective risk criteria alone should
be enough to establish the need for an
FSS, the reliability of the FSS, and
when an FSS would be required to be
activated to ensure public safety.55 The
53 In the final rule, flight abort is defined as the
process to limit or restrict the hazards to public
health and safety, and the safety of property,
presented by a launch vehicle or reentry vehicle,
including any payload, while in flight by initiating
and accomplishing a controlled ending to vehicle
flight. Flight abort is discussed more fully in the
discussion of § 450.108.
54 A CE value is calculated as the mean number
C
of casualties predicted to occur given a specified
failure mode in a given time interval with a
probability of 1.
55 As proposed, § 450.101(c) simply used CE to
C
determine whether flight abort would be required
as a hazard control strategy. Other proposed
regulations relied on CEC to establish FSS reliability
jbell on DSKJLSW7X2PROD with RULES2
b. High Consequence Event Protection
(§ 450.101(c))
In the NPRM, the FAA proposed to
expand the FAA’s use of consequence
criteria to protect the public from an
unlikely but catastrophic event.
Specifically, the FAA proposed to use
conditional expected casualties (CEC) as
the quantitative metric for: (1)
Determining the need for flight abort 53
as a hazard control strategy in proposed
§ 450.101(c); (2) setting reliability
standards for an FSS required by
§ 450.101(c) in proposed § 450.145(a);
and (3) determining when to initiate a
flight abort in proposed § 450.125(c)(1)
and (c)(2). The proposed use of CEC
represented the most significant change
in the NPRM because it introduced a
new safety criteria pertaining to low
probability, high consequence events
and provided a means by which an
operator could demonstrate that
expensive, highly reliable FSS design
and testing may be unnecessary to
protect public safety. As explained in
the NPRM, consequence can be
measured in terms of CEC without
regard to the probability of failure.
The FAA received extensive
comments on this proposal and, as a
result, has made significant changes in
the final rule to allow for additional
flexibility in measuring and mitigating
high consequence events. The following
subsections provide an overview of the
finalized CEC requirements in
§ 450.101(c), the FAA’s rationale for
making the change, and specific
responses to comments. The FAA notes
that this section of the preamble focuses
on CEC as a means to measure the
potential for high consequence events
under § 450.101(c). CEC will be
discussed further in the preamble
sections addressing §§ 450.108 (Flight
Abort) and 450.145 (Highly Reliable
Flight Safety System).
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
PO 00000
Frm 00036
Fmt 4701
Sfmt 4700
FAA finds that the use of collective risk
through analyses of EC and individual
risk through analysis of Probability of
Casualty (PC) is inherently inadequate to
establish sufficient protection against
low probability, high consequence
events during launch and reentry
operations. Whereas PC limits the
maximum risk to an individual and EC
limits the average outcome in terms of
casualties in a group of people, both PC
and EC are indifferent to the risk of
events that involve multiple casualties.
This indifference means that, if the risk
of a potential event that could result in
a high number of casualties is low
enough, the PC and EC criteria would
not act to prevent that event. As
explained in the NPRM, the purpose of
CEC is to protect the public from certain
high consequence events, regardless of
the probability of those events. Thus,
the final rule includes specific
provisions, such as in §§ 450.101,
450.108, and 450.145, to ensure
adequate protection against low
probability but high consequence events
during launch and reentry.
In addition, a conditional risk
assessment ensures adequate mitigation
measures are in place to protect against
a low probability, high consequence
event in circumstances in which EC and
Pc may not dictate the need for
mitigation. As explained in the NPRM,
unlike collective risk that determines
the expected casualties factoring in the
probability that a dangerous event will
occur, conditional risk determines the
expected casualties assuming the
dangerous event will occur.56 This
assumption means that using EC alone
may result in a lack of mitigations, such
as flight abort capability and
preparedness, for certain high
consequence events because the low
probability of occurrence would
translate into an EC below the 1 × 10¥4
limit. Conversely, using a conditional
risk assessment ensures that, if a high
consequence event is reasonably
foreseeable, such as an incorrect
azimuth at lift-off, then an operator will
have a mitigation in place to prevent
that event from producing catastrophic
results. This result is assured because
the decision to activate an FSS is always
made in response to a system failure in
the operational environment, as no
operator plans to implement a flight
abort unless the mission objectives
include an intentional test of the FSS.
and activation of FSS. These regulations and the
response to commenters’ concern with using CEC
for those purposes are discussed later in the
preamble.
56 See 84 FR at 15298.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
Calculating CEC ensures an operator
correctly recognizes certain system
failures that may have catastrophic
consequences and builds mitigations
into the system to account for those
failures. As such, an FSS is generally
activated in the following context: (1)
The vehicle is no longer performing
nominally; (2) the vehicle is outside the
limits of a useful mission; 57 and (3)
continued flight would increase public
risks in uncontrolled areas. Hence, the
risk to the public associated with the
decision to activate an FSS is inherently
conditioned on the fact that a system
failure has occurred. An operator would
only identify a system failure for low
probability, high consequence events if
the operator used a CEC-based analysis,
rather than an EC calculation, because a
CEC analysis assumes that the event will
occur. Therefore, relying on the
collective risk criteria alone would not
adequately protect against low
probability, high consequence events
that could result in multiple public
casualties.
The FAA received several comments
regarding the potential for various
launch operations to comply with the
proposed CEC thresholds in the NPRM.
Rocket Lab USA, Inc. (‘‘Rocket Lab’’)
commented that it would be ‘‘nearly
impossible’’ for any orbital launch
vehicle to meet the CEC thresholds
defined in the proposal and
recommended the use of cumulative
risk and individual risk metrics as
additional or alternative means of
determining the reliability required for
the flight abort system. Blue Origin also
stated that most, if not all operators,
including those operating smaller
suborbital launch vehicles in remote
locations, would be forced to implement
an FSS that complies with an
unmodified set of USAF requirements.
SpaceX recommended that the FAA
gather more detail on CEC for different
launch vehicles and trajectory profiles
to evaluate appropriate lower tiers of
reliability.
The FAA sponsored a series of tasks,
performed by ACTA, LLC (ACTA), to
investigate the potential conditional
risks associated with a wide array of
past and foreseeable future launch
operations using the best available
information and tools. The study 58
provided an independent evaluation of
the potential for the CEC-related
requirements in the NPRM to
57 Limits of a useful mission are defined in the
final rule as the trajectory data or other parameters
that bound the performance of a useful mission,
including flight azimuth limits. This concept is
discussed in greater detail in § 450.119.
58 The report can be found in docket number
FAA–2019–0229.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
necessitate changes to current practice
for more than a dozen missions
involving large, medium, and small
launch vehicles from a wide variety of
sites. The results of this study
demonstrate that the required reliability
of an FSS for relatively small rockets
depends greatly on the launch site.
Specifically, the ACTA study found that
a small ELV launched from Cape
Canaveral or Wallops Island would need
a highly reliable FSS compliant with
proposed § 450.145 to meet the NPRM
requirements, but that a less reliable
FSS, such as an FSS compliant with
proposed § 450.143, would suffice for
the same vehicle launched from more
remote locations, such as the Mahia
Peninsula and Kodiak Island. To the
extent that commenters suggested
proposed § 450.101(c) would require
currently licensed operators to use an
FSS, the ACTA study results indicate
that no changes would be required
under the final rule regarding the need
for an FSS for any currently licensed
launch vehicle launched from a Federal
launch or reentry site.59 The ACTA
study also indicates that, for operators
who currently employ an FSS to meet
the FAA’s public risk criteria, their
current practices regarding FSS
reliability and activation criteria would
be sufficient to demonstrate compliance
with the requirements in § 450.108.
A number of commenters asserted
that the proposed CEC requirements
would increase cost for operators,
particularly for current RLV operators.
CEC analysis is not mandatory. If an
operator chooses to use a § 450.145
compliant FSS, it does not need to do
the CEC analysis to establish if a
§ 450.145 compliant FSS is necessary or
if a § 450.143 compliant FSS would
suffice. A CEC analysis to establish
compliant Flight Safety Limits is
unnecessary if the operator chooses to
demonstrate compliance with
§ 450.108(c)(6).
59 The ACTA study made four notable
conclusions:
1. For two current launch vehicles launched from
outside the continential US, the 1 × 10¥3 CEC
threshold is not exceeded. Thus, part 450 will not
require an FSS for either of these two launches, yet
both are designed to employ an FSS (as required by
part 417).
2. For ten launch vehicles launched from within
the continential US9, the part 450 CEC requirements
are consistent with current practice, where part 417
requires the highly reliable FSS.
3. For two piloted launch vehicles, one would
require no changes, and the other would require no
FSS although a flight abort capability is currently
employed under part 431.
4. One current reentry poses CEC well above the
1 × 10¥2 threshold. Thus, under part 450 this
reentry operation would either need to be modified
to reduce the consequence of failure modes that
would result in an intact impact, or be granted a
waiver.
PO 00000
Frm 00037
Fmt 4701
Sfmt 4700
79601
The FAA does not agree that the cost
of a CEC analysis is prohibitively
expensive. The FAA provides estimates
in the final Regulatory Impact
Assessment of the costs of the CEC
analyses as well as estimates of cost
savings on those launches that will not
need an FSS.
The ACTA study calculated CEC for a
sample of licensed RLVs and the results
indicate that the final rule will not
require any changes regarding the FSS
robustness and FSS activation criteria
currently used for the operations at the
Mojave Air and Space Port. The ACTA
study results suggest that launches from
Spaceport America would not need to
use flight abort as a hazard control
strategy to meet the CEC requirements in
the final rule. Thus, the ACTA study
suggests the final rule could facilitate a
reduction in costs for RLV launches
from non-Federal launch sites for
current part 431 licenses that include
flight abort as a hazard control strategy.
Ultimately, the ACTA study indicates
that CEC will not drive a requirement for
flight abort for currently licensed RLVs
operating from non-Federal sites and is
therefore not expected to drive costs for
RLV operators. In the final Regulatory
Impact Analysis, the FAA discusses in
detail estimated voluntary costs to
perform CEC analyses as well as cost
savings that result when an FSS is not
required.
Several commenters, including CSF,
Rocket Lab, Sierra Nevada, SpaceX, and
an individual commenter, expressed a
need for clarification of acceptable
methodologies to compute CEC. CSF and
Sierra Nevada commented that there are
no publicly available methodologies or
background for conducting CEC
analysis. CSF noted that the CEC
analysis is computationally intensive
and approved risk analysis tools and
input data were not readily available.
SpaceX stated it needed guidance on
several specific technical issues on the
computation of CEC. Rocket Lab stated
that, without standardized methods and
input data, results would vary widely.
The FAA notes that CEC is inherent in
the calculation of EC for launch or
reentry operations. There are extensive
guidance documents available currently
that explain methodologies that can be
used to compute EC and, as a byproduct,
CEC as well.60 The FAA is aware of at
least one operator that has used these
guidelines to develop and implement its
own safety analysis tools to demonstrate
60 See e.g., the FAA Flight Safety Analysis
Handbook v 1.0, 2009 and the Range Commanders
Council Risk Committee of the Range Safety Group,
Common Risk Criteria for National Test Ranges—
Supplement, RCC 321–20, White Sands Missile
Range, New Mexico, 2020.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79602
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
compliance with the current public risk
criteria under part 417. Some tools have
already been modified to compute CEC
with only a few hours of effort. Even so,
the FAA remains dedicated to
improving the guidance materials
available to applicants and plans to
provide additional advisory materials to
explain acceptable safety analysis
methods, including those that address
any unique aspects of CEC
computations.
Sierra Nevada commented that CEC
analysis was not a widely accepted
practice, nor had it been subject to
rigorous testing, and it was not ready to
be implemented. In response, the FAA
notes that RCC 321 Standard and
Supplement has included conditional
risk standards and guidelines since
2010. Moreover, CEC analysis has been
used to help inform important decisions
regarding the safety of commercial space
transportation operations since 2016,
when the FAA first cited CEC as part of
a formal waiver evaluation.61 As noted
in the NPRM preamble, in granting
these waivers, the FAA has adopted the
conditional risk management approach,
noting that the predicted consequence
was below a threshold of 1 × 10¥2
CEC.62 The FAA further stated in the
preamble that measuring the
consequence from reasonably
foreseeable, albeit unlikely, failures is
an appropriate metric to assess prudent
mitigations of risks to public health and
safety and the safety of property. In
recent years, the USAF has also used
CEC analyses to establish appropriate
FSS activation criteria for launch
operations from both CCAFS and VAFB.
Most recently, the FAA considered the
results of CEC analyses in granting
waivers to the debris containment
requirements in § 417.213(a) and (d) that
enabled the SAOCOM–1B mission to be
conducted safely.
Several commenters, including CSF,
Sierra Nevada, and SpaceX,
recommended that the proposed CECrelated requirements be moved to a
guidance document as an accepted
means of compliance to a more
performance-based regulation to
preserve flexibility. CSF stated that, at a
minimum, the quantitative criteria
should be moved to a guidance
document.
The FAA considered replacing the
proposed quantitative CEC criteria with
a qualitative standard and moving the
quantitative criteria to a guidance
document as one acceptable means of
61 See Waiver of Debris Containment
Requirements for Launch. 81 FR 1470, 1470–1472
(January 12, 2016).
62 84 FR 15312.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
compliance. However, the FAA finds
that a qualitative approach to determine
the three key CEC-related issues (i.e., the
need for flight abort with a reliable FSS
as a hazard control strategy, the
reliability standards for any required
FSS, and the criteria for activation of an
FSS) would lack regulatory clarity
necessary to ensure a consistent level of
public protection, given the wide
variety of launch and reentry
operations. As noted by Rocket Lab and
other commenters, even the results of
quantitative high consequence event
assessments can vary significantly from
operator to operator without
standardized methods and input data.
Although quantitative CEC is retained
in the final rule, the FAA adds
flexibility in both the manner in which
a high consequence may be measured
and the manner in which an operator
can sufficiently protect against a high
consequence event. First, in the NPRM,
ELOS would not have been allowed for
the requirements in § 450.101. As noted
in the discussion of ELOS earlier in the
preamble, the FAA has revised § 450.37
in the final rule to allow operators to
use ELOS to measure a high
consequence event under
§ 450.101(c)(2). Second, § 450.101(c)(2)
permits an operator whose CEC is
greater than 1 × 10¥3 to propose
safeguards other than flight abort to
reduce the CEC below 1 × 10¥3. These
revisions are discussed in greater detail
later in this section.
Virgin Galactic recommended the
FAA provide a definition of CEC. In
addition, Virgin Galactic commented
that, in the NPRM preamble, CEC was
described using the phrase, ‘‘without
regard to the probability of failure,’’
which appeared to Virgin Galactic to
translate to ‘‘assume 100% failure
probability.’’ Virgin Galactic
recommended the FAA use the
terminology ‘‘assuming the failure will
occur’’ and clearly state the probability
of failure would be 1, if that was what
was intended.
The FAA does not agree that CEC
should be defined in the final rule.
Rather, the preamble and associated AC
(on High Consequence Event Protection)
discuss in detail what the requirement
entails and how to calculate CEC. A CEC
value is calculated as the mean number
of casualties predicted to occur given a
specified failure mode in a given time
interval with a probability of 1. As
previously mentioned, there are
extensive guidance documents currently
available that explain methodologies
that can be used to compute EC and, as
PO 00000
Frm 00038
Fmt 4701
Sfmt 4700
a byproduct, CEC as well.63 The term
‘‘high consequence’’ appears in
§ 417.107(a)(1)(ii), but the FAA chose
not to define this term formally at this
time to allow for operational flexibility.
High consequence events include
incidents that could involve multiple
casualties, massive toxic exposures,
extensive property or environmental
damage, or events that jeopardize the
national security or foreign policy
interests of the United States.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA provided
regulatory text recommendations for
§ 450.101(c) including removal of ‘‘flight
abort,’’ stating that a distinction needed
to be made from flight abort that was not
initiated based on threat to public
health and safety because not all abort
systems are considered FSS.
The FAA understands that the term
‘‘flight abort’’ has been used in other
U.S. Government contexts to mean
something different, but the FAA finds
that ‘‘flight abort’’ accurately describes
the required hazard mitigations while
remaining flexible as to implementation.
For these reasons, the FAA will not
amend the rule to remove the term
‘‘flight abort.’’ The final rule adopts the
proposed definition of flight abort in
§ 401.7, which means the process to
limit or restrict the hazards to public
health and safety, and the safety of
property, presented by a launch vehicle
or reentry vehicle, including any
payload, while in flight by initiating and
accomplishing a controlled ending to
vehicle flight. The final rule also adopts
in § 401.7 the proposed definition of
‘‘flight safety system,’’ which means a
system used to implement flight abort,
for which a human can be a part of an
FSS.
The FAA finds that the definition of
‘‘flight abort’’ is consistent with current
practice for licensed launches and
reentries. Most RLVs use some method
to achieve flight abort reliably, either in
the form of a pilot that can safely abort
flight using system controls or an
automated system to terminate thrust.
Traditional FSS for ELVs are comprised
of an onboard flight termination system,
a ground-based command and control
system, and tracking and telemetry
systems. Historically, the flight safety
crew monitoring the course of a vehicle
would send a command to self-destruct,
63 The FAA notes that CE is inherent in the
C
calculation of EC because the total EC for the
operation is the sum of all EC contributions from
each failure mode and failure time, and each EC
contribution for a failure mode and failure time is
the probability of failure multiplied by CEC.
Therefore, CEC for a given failure mode and failure
time can be found by dividing the EC contribution
by the probability of failure for that failure mode
and failure time.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
thus aborting the flight, if the vehicle
crossed flight safety limits and in doing
so threatened a protected area.
Redundant transceivers in the launch
vehicle would receive the destruct
command from the ground, set off
charges in the vehicle to destroy the
vehicle and disperse the propellants so
that an errant vehicle’s hazards would
not impact populated areas. While this
method of flight abort through ordnance
is conventional, the existing definition
in § 417.3 and the definition in the final
rule do not require an FSS to be
destructive.
In response to commenters’ concerns,
the FAA finds that the definitions of
‘‘flight abort’’ and ‘‘flight safety system’’
adopted in the final rule remove any
perceived confusion over the use of
these terms for the purpose of FAA
licensing under part 450.
ii. § 450.101(c)(1)
Section 450.101(c)(1) states that an
operator must protect against a high
consequence event in uncontrolled
areas for each phase of flight by using
flight abort as a hazard control strategy
in accordance with the requirements of
§ 450.108. The FAA has not included
the reference to the CEC threshold of
1 × 10¥3 in § 450.101(c)(1) because an
operator who uses flight abort in
accordance with § 450.108 has
demonstrated compliance with
§ 450.101(c)’s requirement to protect
against a high consequence event
without further inquiry into CEC beyond
the requirements in § 450.108(c). This
change is consistent with the concept
proposed in § 450.101(c) of the NPRM
that required an operator to use flight
abort with a reliable FSS 64 if CEC was
greater than 1 × 10¥3 for any phase of
flight. Under the proposal, if an operator
elected to use flight abort with an FSS
that met the reliability requirements in
§ 450.145, the FAA would not have
required the operator to calculate CEC
for the purposes of determining
compliance with proposed § 450.101(c)
because the operator opted into flight
abort as a hazard control strategy
irrespective of CEC.
As such, in the final rule, there is no
need to reference a CEC threshold in
§ 450.101(c)(1) because an operator who
elects to use flight abort as its hazard
control strategy and complies with
§ 450.108 does not need to calculate CEC
(beyond the requirements in
§ 450.108(c) discussed later in the
64 Proposed § 450.101(c) required an operator to
use fight abort with an FSS that met the reliability
requirements set forth in § 450.145. The reference
to reliability requirements for FSS has been moved
to § 450.108(b) and will be discussed in that section
of the preamble.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
preamble) to determine that it has
sufficiently protected against a high
consequence event. Rather, use of flight
abort consistent with the requirements
in § 450.108 by itself demonstrates
compliance with § 450.101(c).
As explained in the next two sections,
operators who do not elect to use flight
abort consistent with the requirements
of § 450.108 must demonstrate they can
protect against a high consequence
event by means other than flight abort.
If an operator cannot demonstrate
compliance with § 450.101(c)(2)—
including through ELOS—or (c)(3), the
operator would be required to rely on
§ 450.101(c)(1) as the only remaining
means to protect against a high
consequence event.
iii. § 450.101(c)(2)
In the final rule, § 450.101(c)(2) states
that an operator must protect against a
high consequence event in uncontrolled
areas for each phase of flight by
ensuring the consequence of any
reasonably foreseeable failure mode, in
any significant period of flight, is not
greater than 1 × 10¥3 CEC. As noted,
proposed § 450.101(c) would have
required an operator with a CEC greater
than 1 × 10¥3 to use flight abort with
an FSS that meets the reliability
requirements of proposed § 450.145
except for a single exception explained
in greater detail in the discussion of
§ 450.101(c)(3).
The FAA recognizes that flight abort
is not the only method to protect against
low probability, high consequence
events. Therefore, in the final rule,
§ 450.101(c)(2) allows an operator with
CEC greater than 1 × 10¥3 in any
significant period of flight to
demonstrate protection against a low
probability, high consequence event
through means other than flight abort.
This added flexibility in the final rule
allows operators to implement other
safeguards that sufficiently protect
against a high consequence event. For
example, one company included a
design feature in a system so that a
launch failure during downrange
overflight would result in break-up and
demise and thus mitigate the risk from
the potential for the capsule to survive
intact to impact.
In addition, although this provision
retains the quantitative CEC threshold
proposed in § 450.101(c), the FAA
provides additional flexibility by
modifying § 450.37 to allow applicants
to propose alternative approaches that
provide an equivalent level of safety,
which can be approved by the FAA
without a waiver. The FAA added this
flexibility because it is aware of
methods other than using CEC to
PO 00000
Frm 00039
Fmt 4701
Sfmt 4700
79603
measure high consequence events, such
as conditional risk profile. If an operator
chooses to propose an alternative means
of measuring a high consequence event,
the FAA would expect the alternative
means to account for the potential for
any event that would be expected to
produce multiple casualties,65 using a
method that demonstrates equivalent
level of safety to a CEC analysis. The
operator must ensure that the alternative
means accurately assesses that the
operation would not exceed an
acceptable threshold for high
consequence events. In order to
determine whether an alternative
threshold for high consequence events
is acceptable, the FAA will compare the
alternative measurement to the CEC
threshold. Alternatively, the applicant
would be expected to demonstrate that
either the consequence of any failure
during any significant period of flight is
at least an order of magnitude less than
the average results from a fixed-wing
general aviation aircraft fatal accident.66
For example, the Range Commanders
Council Document 321–17, ‘‘Common
Risk Criteria Standards for National Test
Ranges’’ (RCC 321) includes
catastrophic risk protection provisions
that use a ‘‘risk profile.’’ 67 In fact, the
FAA currently uses a modified risk
profile method to establish the
insurance requirements for certain
launch or reentry operations.68 The
65 High consequence events include incidents that
could involve multiple casualties, massive toxic
exposures, extensive property or environmental
damage, or events that jeopardize the national
security or foreign policy interests of the United
States.
66 The FAA computed this risk profile using
NTSB accident data between 1982 and 2019 for
fixed-wing aircraft operated under FAR parts 91,
135, and 137, excluding aircraft type certificated
under part 25.
67 RCC 321–17 defines a risk profile as ‘‘a plot
that shows the probability of N or more casualties
(vertical axis) as a function of the number of
casualties, N (horizontal axis),’’ such that the area
under a risk profile is equal to the EC. Unlike the
single valued EC, risk profiles illustrate whether the
collective risk is from a relatively low probability,
high consequence event or from more frequent,
smaller consequence outcomes.
68 See, e.g., the 2016 Report to Congress ‘‘FAA’s
Development of an Updated Maximum Probable
Loss Method’’ in response to Public Law 114–90,
Section 102. An MPL analysis must model each
accident scenario as a discrete event with discrete
results, e.g., no casualties, exactly one casualty, two
casualties, etc. Each accident scenario also has a
quantitative probability of occurrence. The MPL
analysis process involves simulation of many
thousands of discrete accident scenarios that cover
the parameter space of the problem (i.e., all
foreseeable accident scenarios for each and every
failure time and vehicle failure mode). The
predicted results of all foreseeable accident
scenarios are accumulated into a histogram and the
risk profile is computed as the complementary
cumulative distribution. For details, see Collins,
Brinkman, and Carbon paper ‘‘Determination of
E:\FR\FM\10DER2.SGM
Continued
10DER2
79604
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
FAA understands that risk profiles are
currently in use in other industries 69
and could be a useful means to quantify
the probability of high consequence
events associated with a wide variety of
hazardous operations. However, the
computation of a risk profile generally
entails significantly more effort than the
CEC evaluation because a risk profile
involves more sophisticated
computations and additional input data.
Specifically, the development of a risk
profile for a launch or reentry operation
would consist of an evaluation of the
absolute probability of each foreseeable
failure mode and the relative probability
of each outcome of each failure mode in
terms of the number of public casualties
that could result in uncontrolled areas.
The RCC 321 Supplement describes a
more simplified and conservative
method to screen for excessive
catastrophic risk, which the FAA finds
as another acceptable method to
measure high consequence events.70 In
contrast, a CEC analysis is independent
of the probability of each failure mode
and requires an assessment of only the
average outcome of each failure mode.
In addition, the FAA is publishing an
AC that describes how an applicant can
demonstrate compliance with
§ 450.101(c)(2) by showing that the
conditional risk profile for its proposed
launch or reentry mission is comparable
with the conditional risk profile
empirically derived from evidence from
a set of past fixed-wing general aviation
fatal accidents. Finally, the FAA
recognizes that industry may develop
new innovative and less burdensome
methods, and therefore the final rule
allows applicants to propose methods
other than CEC to measure high
consequence events.
In § 450.101(c)(2), the FAA replaces
the term ‘‘one-second period of flight’’
in proposed § 450.101(c) with
‘‘significant period of flight.’’ A period
of flight would be significant if it is long
enough for a mitigation, such as flight
abort, to decrease the public risks or
Maximum Probable Loss’’ presented at 2nd IAASS
conference in Chicago, May 2007.
69 For example, Santa Barbara County, California
(where Vandenberg AFB is located) uses risk
profiles as part of their management of public
casualty risks from activities that involve significant
quantities of hazardous materials as explained in
the County of Santa Barbara, Planning and
Development, Environmental Thresholds and
Guidelines Manual, October 2008. Several
European countries, including the UK and
Netherlands, use risk profiles as part of their
governance of a wide array of industries that pose
public risks.
70 For example, the catastrophic risk averse
pseudo-EC contribution from people in ships may
be computed using a standard EC computation but
replacing the number of casualties contributed by
type of ship, N, with N raised to an exponent of 1.5.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
consequences materially from any
reasonably foreseeable failure mode.
The FAA makes this change because it
recognizes that for some launch and
reentry concepts, such as relatively
slow-moving vehicles like balloons, a
‘‘significant’’ period of flight could
exceed one second. In addition, the
FAA foresees circumstances in which
an elevated CEC in a single second of
flight would not warrant additional
mitigation, such as when no additional
mitigation would improve public safety
meaningfully in terms of the public
risks and consequences. The preamble
discussion of § 450.108 contains further
explanation of what constitutes a
material decrease.
Finally, the final rule replaces the
phrase ‘‘any reasonably foreseeable
vehicle response mode’’ proposed in
§ 450.101(c) with ‘‘any reasonably
foreseeable failure mode’’ in
§ 450.101(c)(2) of the final rule. The
NPRM defined ‘‘vehicle response mode’’
as a mutually exclusive scenario that
characterizes foreseeable combinations
of vehicle trajectory and debris
generation. Thus, the NPRM would have
required an evaluation of CEC for each
foreseeable combination of vehicle
trajectory and debris generation. By
replacing the term ‘‘vehicle response
mode’’ (VRM) with ‘‘failure mode,’’ the
final rule is both less prescriptive and
consistent with the current
requirements.71
In the NPRM, the FAA defined a VRM
as a mutually exclusive scenario that
characterizes foreseeable combinations
of vehicle trajectory and debris
generation. As stated in the NPRM,
proposed § 450.101(c) would have
required, at a minimum, that an
operator compute the effective casualty
area and identify the population density
that would be impacted for each
reasonably foreseeable vehicle response
mode in any one-second period of flight
in terms of CEC. The NPRM further
explained that the casualty area,
population density, and predicted
consequence for each vehicle response
mode are intermediate quantities that
are necessary to demonstrate
compliance with the individual and
collective risk criteria currently; thus,
these new requirements would not
necessarily impart significant additional
burden on operators.
The draft AC 450.115–1 on High
Fidelity Flight Safety Analysis
published for comment in conjunction
with the NPRM further explained that
71 As part of the demonstration required under
§ 431.35(c), a part 431 applicant is required in
§ 431.35(d)(4) to identify and describe all safetycritical failure modes and their consequences.
PO 00000
Frm 00040
Fmt 4701
Sfmt 4700
‘‘VRMs are a combination of debris list
and failure modes’’ and provided a
description of typical failure modes for
launch and reentry systems, including
loss of thrust, engine explosion, attitude
control failure, structural failure,
separation failure, guidance or
navigation failure, etc. Because the final
rule replaces the term ‘‘vehicle response
mode’’ with ‘‘failure mode,’’ an operator
is no longer required to evaluate CEC for
each foreseeable combination of failure
mode and debris generation. Instead, an
operator is required to evaluate CEC for
each reasonably foreseeable failure
mode in any significant period of
flight.72
Boeing suggested changing the term
‘‘reasonably foreseeable’’ to ‘‘credible’’
vehicle response modes. The FAA does
not agree that the term ‘‘reasonably
foreseeable’’ should be replaced by the
term ‘‘credible’’ in this section. As
previously noted, the term ‘‘reasonably
foreseeable’’ is used in § 431.35 and
commonly used in system safety. In the
absence of a compelling reason to
change, the FAA prefers to continue to
use language consistent with previous
regulations instead of introducing a new
term at this time. Furthermore, the FAA
finds that the term ‘‘credible’’ is prone
to errors in judgment whereas the term
‘‘reasonably foreseeable’’ is more readily
discerned by analysis (e.g., fault trees).
iv. § 450.101(c)(3)
In the NPRM, in instances in which
CEC was greater than 1 × 10¥3, proposed
§ 450.101(c) provided relief from the use
of flight abort if the Administrator
agreed that flight abort was not
necessary based on the demonstrated
reliability of the launch or reentry
vehicle during a phase of flight. The
NPRM preamble cited the flight of a
certificated aircraft carrying a rocket to
a drop point as an example of a phase
of flight when the use of an FSS would
likely not be necessary, even though the
CEC could be above the threshold
because the aircraft would have
demonstrated reliability.
While the final rule retains the
‘‘demonstrated reliability concept’’
proposed in the § 450.101(c) of the
72 As an example of the distinction between
‘‘vehicle response mode’’ in the NPRM and
‘‘reasonably foreseeable failure mode,’’ in the final
rule consider, a loss of thrust (LoT) failure mode.
Under the NPRM, LoT failure mode would need to
be accounted for by three VRMs: A LoT resulting
in an intact impact, a LoT resulting in aerodynamic
break-up, and a LoT resulting in explosion due to
FSS activation. Under the NPRM’s proposal, the
operator would have been required to compute CEC
for three VRMs associated with LoT, but under the
same circumstances the final rule will require only
one CEC for the LoT. The final rule CEC for LoT will
equal the average CEC for the three VRMs that the
NPRM would have required.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
NPRM, it has been revised and relocated
to § 450.101(c)(3). Section 450.101(c)(3)
of the final rule states that an operator
must protect against a high consequence
event in uncontrolled areas for each
phase of flight by establishing the
launch or reentry vehicle has sufficient
demonstrated reliability based on the
CEC during that phase of flight.
Because demonstrated reliability
provides an alternative to flight abort
when CEC is greater than 1 × 10¥3, it is
appropriate to assess it consistent with
the approach to flight abort and FSS
reliability, which depends on CEC with
a 1 × 10¥2 threshold.73 Notably, the
ARC recommended that the need for an
FSS should be determined by taking
into account population density, the
realm of reasonably foreseeable failures,
trajectory, size, and explosive
capabilities of the vehicle. CEC accounts
for all those factors. As such, the CEC
computed for a proposed operation is
inherent in determining whether the
vehicle has sufficient demonstrated
reliability to protect against a high
consequence event. This revision
informs operators on the approach the
FAA will take in determining whether
the launch or reentry vehicle has
sufficient demonstrated reliability to
protect against a high consequence
event.
More specifically, the FAA will use
the demonstrated reliability and average
ground consequence results from fatal
accidents involving U.S. civil aviation
aircraft with standard airworthiness
certificates to establish what constitutes
sufficient demonstrated reliability to
protect against a high consequence
event based on CEC. For example, a
carrier vehicle with a CEC near 1 × 10¥2
in a given phase of flight would need to
have demonstrated reliability during
that phase of flight on par with the
subset of fixed-wing general aviation
aircraft that empirically produce CEF 74
near 1 × 10¥2. However, the same
73 In the proposal and the final rule, the FAA uses
CEC not only as a basis to determine whether flight
abort is required but also as a basis to determine
the appropriate FSS requirements. As noted, FSS
requirements are discussed later in the preamble.
74 CE represents conditional expected fatalities
F
and is used to measure the mean number of
fatalities predicted to occur given an event with a
probability of 1. As noted in the NPRM, the FAA
found that about one ground fatality resulted on
average from one-hundred fatal accidents involving
US aircraft operated under part 91 between 1984
and 2013 based on NTSB data. A comparison of CEC
to CEF is appropriate here because the CEF values
cited here are empirical results from aviation
accidents, whereas the CEC values used here are the
results of physics-based computer simulations for
launch and reentry operations. In addition, the
differences between aviation and space operations
justify some margin in the tolerability of the
conditional risks predicted for space transportation
operations.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
carrier vehicle operated in a more
densely populated area could have a
CEC near 1 in a given phase of flight and
thus would need to have demonstrated
reliability during that phase of flight on
par with commercial transport aircraft
that empirically produce CEF near 1.75
This approach is consistent with the
longstanding and often cited principle
that launch and reentry should be no
more hazardous to the public than overflight of conventional aircraft, as
explained in the NPRM preamble.
The FAA received multiple comments
seeking clarification of the provision to
use demonstrated reliability as a means
to ensure a low probability, high
consequence event is sufficiently
mitigated. In the NPRM, the FAA noted
that ‘‘demonstrated reliability’’ in this
context refers to statistically valid
probability of failure estimates based on
the outcomes of all previous flights of
the vehicle or stage. For example, a
probability of failure analysis that
complies with § 450.131 will provide a
valid basis to establish the demonstrated
reliability of a launch or reentry vehicle
in a given phase of flight. That concept
is also applicable to § 450.101(c)(3) of
the final rule. Furthermore, the FAA
will consider the magnitude of the high
consequence event in determining what
level of reliability will be sufficient to
ensure that the high consequence event
is mitigated. One way to show that a
vehicle has demonstrated reliability
during a phase of flight is to show that
it has demonstrated reliability during
that phase of flight equivalent to a
specific aircraft type or an average
aircraft of similar size and performance
characteristics with a standard
airworthiness certificate.76 The FAA
notes an average aircraft of similar size
would have less uncertainty than a
specific type aircraft because there
would be more data collected for an
average aircraft, and thus the
demonstrated reliability of an average
aircraft could be more readily
characterized with a reasonable level of
confidence. Furthermore, both a specific
aircraft type and an average aircraft with
a standard airworthiness certificate
generally will not need additional flight
75 As noted in the NPRM, the FAA found that
about one ground fatality resulted on average from
a fatal accident involving US aircraft operated
under part 121 between 1984 and 2013 based on
NTSB data.
76 As discussed in the preamble section on Hybrid
Vehicles, the FAA agreed with a comment that the
FAA should not similarly find that an aircraft with
only an experimental airworthiness certificate
(EAC) would satisfy the demonstrated reliability
standard. An aircraft with an EAC may demonstrate
sufficient reliability through the use of a rigorous
flight test program or numerous flights without a
failure as defined in § 450.131.
PO 00000
Frm 00041
Fmt 4701
Sfmt 4700
79605
abort capability unless the addition of
the rocket substantially increased the
risk from a high consequence event.
However, aside from some carrier
aircraft used as a component of a launch
vehicle, no launch vehicle, including
U.S. government owned and operated
vehicles, to date has a significant
amount of historical flights to ensure
sufficient protection against a high
consequence event based on
demonstrated reliability in accordance
with § 450.101(c)(3).
c. Critical Asset and Critical Payload
Protection
Commercial space transportation
operations occur increasingly in close
proximity to critical assets. In order to
maintain the continuing functionality of
critical assets, the FAA proposed to
define ‘‘critical assets’’ in § 401.5
(§ 401.7 in the final rule) and add a
quantitative risk criterion (1 × 10¥3) for
the protection of critical assets during
launch or reentry activity under
§ 450.101 in the NPRM.
In the final rule, the FAA adopts the
‘‘critical asset’’ definition in § 401.7
with modification, as discussed below.
The FAA adopts the risk criterion as
proposed but removes the requirement
for operators to assess the risks to
critical assets in preparing a flight
hazard analysis (proposed
§ 450.109(a)(3)(ii)), debris analysis
(proposed § 450.121(c)(1) and (c)(2)),
debris risk analysis (§ 450.135), and
ground hazard analysis (§ 450.185(c)).
Instead, in accordance with
§ 450.101(a)(4)(iii) and (b)(4)(iii), either
the FAA or a Federal launch or reentry
site operator will determine whether the
proposed activity would expose critical
assets to a risk of loss of functionality
that exceeds the risk criterion in
§ 450.101(a)(4) or (b)(4) and convey any
necessary constraints to the operator.
The operator must receive confirmation
from the FAA or Federal launch or
reentry site operator that the risk to
critical assets satisfies the risk criterion
in § 450.101(a)(4) or (b)(4) prior to
launch or reentry. The FAA anticipates
that most critical assets for a given
launch site will be known when an
applicant begins pre-application
consultation. Current practice
demonstrates that the critical asset
evaluation can often be completed using
preliminary flight safety data (during
pre-application or during the license
evaluation), sufficient to show critical
assets risks are acceptable. Where the
prevailing weather conditions are
important to the critical asset risks, an
assessment is performed either close to
or on the day-of-launch.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79606
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
In the final rule, the FAA also
clarified in § 450.101(a)(4)(ii) and
(b)(4)(ii) the Federal procedure by
which critical assets will be identified.
To identify critical assets, the FAA will
consult with relevant Federal agencies,
and each agency will identify, for
purposes of part 450, any critical assets
that the agency owns or otherwise
depends on. The FAA will accept any
identification by the Secretary of
Defense that an asset is critical to
national security. For critical assets
identified by other relevant Federal
agencies, such as NASA, the FAA will
work with the agency to ensure its
identification of critical assets aligns
with the requirements of part 450.
The FAA also adds in § 450.165(a)(5)
(Flight Commit Criteria) a requirement
that operators’ flight commit criteria
include confirmation from the FAA that
the risk to critical assets satisfies the
requirements of § 450.101(a)(4) or (b)(4).
Lastly, the FAA sought comments in the
NPRM on its proposal to add to the final
rule a definition for ‘‘critical payload’’
and a requirement that the probability of
loss of functionality not exceed 1 × 10¥4
for each critical payload. The FAA
adopts the proposed definition and
requirement in the final rule.
In the final rule, the FAA adopts the
risk criterion proposed for critical assets
in the NPRM. The property protection
criteria in § 450.101(a)(4) and (b)(4) are
consistent with current practice at
Federal sites. Launch operations from
NASA-operated ranges are currently
subject to requirements that limit the
probability of debris impact to less than
or equal to 1 × 10¥3 for designated
assets. The USAF requirement in AFI
91–202 and the Guidance Memorandum
to AFSPCI 13–610 match those
proposed by the FAA. The FAA also
adopts its proposal to extend the
protection of critical assets to nonFederal launch or reentry sites because
the protection of critical assets is
necessary irrespective of the location of
the launch.
As proposed in the NPRM, a critical
asset is an asset that is essential to the
national interests of the United States.
The proposed definition noted that
critical assets include property,
facilities, or infrastructure necessary to
maintain national defense, or assured
access to space for national priority
missions.77 In the final rule, the FAA
replaces ‘‘necessary to maintain national
defense’’ with ‘‘necessary for national
security’’ to be more consistent with the
rest of 14 CFR Chapter III. The FAA also
adds that critical assets may include
77 ‘‘Property’’
includes launch vehicles, reentry
vehicles, and payloads.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
those necessary for high priority civil
space purposes, for clarity. An example
of this would be infrastructure
necessary to support launch and reentry
services to deliver cargo to and from the
International Space Station.
CSF and SpaceX noted that critical
assets are frequently located on or near
Federal launch or reentry sites, and that
the current practice at Federal launch or
reentry sites is to allow a site operator
or neighboring operator to waive the
critical asset requirement for its own
facilities. The commenters requested the
regulation provide a similar allowance
to reduce the frequency with which
operators would need to apply for
waivers. SpaceX recommended revising
the regulation to allow for the waiver of
an operator’s own designated critical
assets, as well as assets that may be
shared or used as common
infrastructure at a range.
The FAA acknowledges that critical
assets located on a launch site,
including the launch facility itself, may
be exposed to a risk of loss of
functionality that exceeds 1 × 10 ¥3
during launch activity. The FAA finds
that it would be burdensome to require
a waiver of the critical asset protection
requirement when a launch site
operated by the U.S. Government or
licensed by the FAA allows an operator
to use its facility for launch. Therefore,
the FAA revises § 450.101(b)(4) to not
apply the critical asset risk criteria to
property, facilities, or infrastructure
supporting the launch that are within
the public area distance, as defined in
part 420 Appendix E, Tables E1 and E2
or associated formulae, of the vehicle’s
launch point.78 Assets that fall within
this exception, located at
§ 450.101(b)(4)(v), are exempt from the
critical asset protection requirements in
§ 450.101(a)(4)(i) and (b)(4)(ii) for a
licensed launch.
Assets excepted from risk criteria are
determined by the required distance to
a public area specified in Table E–1 or
E–2 or associated formulae in Appendix
E to part 420, using the quantities of
propellants or other explosives on the
vehicle, including any payloads. These
distances are equivalent to Inhabited
Building Distances commonly observed
on Federal launch or reentry sites to
protect critical assets. The exception
limits consideration to quantities of
propellants on the vehicle, including
any payloads. Any critical assets within
this area that are not supporting the
activity would be subject to the risk
criteria. This exclusion would be
78 Part 420 defines public area distance as ‘‘the
minimum distance permitted between a public area
and an explosive hazard facility.’’
PO 00000
Frm 00042
Fmt 4701
Sfmt 4700
applicable from ignition or at the first
movement that initiates flight,
whichever occurs earlier, and end when
the launch ends.
The FAA received many comments on
the definition of ‘‘critical asset.’’ ULA
expressed support for the proposed
definition. A number of commenters,
including CSF and Sierra Nevada, asked
who will determine whether an asset is
‘‘critical’’ and how the determination
would be communicated to an
applicant. Virgin Galactic commented
that the proposed definition is vague
and did not provide enough information
to the operator to ensure protection of
critical assets because the definition
could potentially apply to all property
at a Federal site. Virgin Orbit
commented that the lack of clarity could
result in Federal agencies incorrectly
concluding their assets were protected.
CSF and SpaceX commented that there
was no limit on the number or location
of assets for which an operator would
need to perform a risk analysis. CSF and
SpaceX recommended the definition of
‘‘critical asset’’ be limited to U.S.
Government assets located on Federal
property that the Secretary of Defense or
Administrator of NASA determines to
be essential to the national interests of
the United States. Boeing, Lockheed
Martin, Northrop Grumman, and ULA
recommended critical assets be defined
as assets for which incapacitation or
destruction would have a very serious,
debilitating effect on national defense,
or assured access to space for national
priority missions. The commenters
noted this change would be consistent
with the definition in DCMA–MAN
3401–02, Defense Industrial Base
Critical Asset Identification and
Prioritization. Furthermore, the
commenters stated that classification as
a critical asset should be determined by
minimum criteria (not specified in the
comment) and an assessment by the
asset owner.
The FAA disagrees that the definition
of ‘‘critical asset’’ is vague or overbroad.
The proposed definition, along with the
examples provided in the NPRM
preamble, bound the scope of critical
assets appropriately and provide
sufficient clarity for operators. Only
those facilities, property, or
infrastructure that are necessary for
national security purposes, high priority
civil space purposes, or assured access
to space for national priority missions
will be deemed critical assets under
§ 401.7. Critical assets will also include
certain military, intelligence, and civil
payloads, including essential
infrastructure when directly supporting
the payload at the launch site. The FAA
provided several examples of critical
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
assets in the NPRM. Critical assets
include assets that, if incapacitated or
destroyed, would have a serious,
debilitating effect on national security
or assured access to space for national
security missions, but the FAA
disagrees that the additional words
proposed by the commenters add clarity
beyond the proposed definition.
Virgin Orbit’s concern that Federal
agency may assume incorrectly that a
critical asset was protected is alleviated
by the fact that critical assets will be
identified by Federal agencies that own
or otherwise depend on assets that are
essential to the national interests of the
United States. The FAA will work with
operators to identify any measures that
operators may need to undertake in
order to protect critical assets to the
level required by § 450.101(a)(4) or
(b)(4).
With respect to the concern that
Federal agencies might be inclined to
overestimate their assets as critical, the
FAA does not find that experience at
Federal launch or reentry sites warrants
such a concern. In fact, discussions with
safety officials at CCAFS indicate that
the risk to critical assets or critical
payloads has rarely exceeded the risk
thresholds adopted by the FAA. Federal
launch or reentry sites have not
excessively designated assets as critical,
nor have they imposed significant
restrictions on launch activity. When
approving the use of their sites for
launch activity, Federal sites consider
the potential of launch activities
endangering other facilities. Similarly,
other users of the site do not knowingly
put their assets at risk. The FAA
maintains that similar considerations
would hold at non-Federal sites. NonFederal launch or reentry site operators
will consider the siting and scheduling
of activities to avoid one user’s activity
threatening the assets of another user.
Occasionally, delays in one site user’s
activity may necessitate rescheduling
another user’s activity. Otherwise, a
new activity that was not anticipated
when siting decisions were made, such
as fly-back of a stage, is most likely to
expose a critical asset to risk exceeding
the criterion.
Only property, facilities, or
infrastructure located close to the
launch point might typically be
expected to exceed the criteria, and
those assets are generally associated
with the subject launch operation. As
discussed in this section, the FAA
revised § 450.101(a)(4) to eliminate the
need to seek waivers for assets located
within the immediate vicinity of a
launch point during the launch.
Although many of these assets may be
critical, meeting the critical asset
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
criteria would be impractical during a
launch from the particular launch point.
Hence, assets located within the public
area distance required by part 420
during a licensed launch are exempt
from the critical asset protection
requirements in § 450.101(a)(4)(i) and
(b)(4)(i). As such, the FAA anticipates
that operations exceeding the risk
criteria for critical assets will continue
to be few, resulting in minimal
restrictions on launch activity.
The FAA maintains that establishing
explicit risk criteria for protecting
critical assets in this final rule provides
a level of certainty. Launch and reentry
site operators will have a metric to
determine what activities are
appropriate for various locations on
their sites. Either the FAA or Federal
site will perform any necessary analysis,
and will provide written confirmation to
the operator that the criteria in
§ 450.101(a)(4) or (b)(4) have been met.
If the risk to critical assets posed by the
proposed activity exceeds the criteria in
§ 450.101(a)(4) or (b)(4), then the FAA
will work with asset owners and
operators to reach solutions that allow
operations without sacrificing safety to
the critical assets or mission objectives.
The FAA does not adopt the
suggestion by CSF and SpaceX to limit
critical assets to U.S. Government assets
located on Federal property that the
Secretary of Defense or the
Administrator of NASA determines to
be essential to the national interests of
the United States. Federal entities other
than the DOD and NASA might own or
otherwise depend on critical assets,
such as NOAA. Thus, it would be
inappropriate to assign the
determination of critical assets to only
these agencies. However, as noted
earlier, critical assets will be identified
by Federal agencies, such as DOD and
NASA, which own or otherwise depend
on assets that are essential to the
national interests of the United States,
and the FAA will accept any
identification by the Secretary of
Defense that an asset is critical to
national security. Note also that the
FAA does not limit the definition of
‘‘critical assets’’ to assets that are owned
or located on property owned by the
U.S. Government. As stated in the
NPRM, the FAA extended the protection
of critical assets to non-Federal launch
or reentry sites, which previously had
no regulatory assurance of protection
from loss of functionality of critical
assets. The FAA maintains the same
safety standards for critical assets for
launches that take place on a Federal
launch or reentry site as those that take
place on a non-Federal launch or
reentry site, some of which are dual use,
PO 00000
Frm 00043
Fmt 4701
Sfmt 4700
79607
supporting both commercial and
military operations. Similarly, as
explained in the NPRM the FAA will
deem any commercial property that
meets the definition set forth in § 401.7
a critical asset.
Blue Origin asked the FAA to provide
examples of critical infrastructure. The
FAA notes that in the past, the launch
complexes at CCAFS that support Atlas
V and Delta IV launches have been
designated as critical assets because
they support missions essential to the
interests of the United States.
An individual commenter
recommended the FAA define
categories of national security interests,
including cybersecurity, security
controls, and classification level.
Although these are important national
interests, they are not by themselves
critical assets, and the FAA does not
find it necessary to add categories of
national security interests.
Airlines for America (A4A)
recommended the FAA extend the
safety protections of critical assets to
include critical aviation infrastructure,
including airports. The FAA notes that
the definition of ‘‘critical asset’’ does
not preclude aviation infrastructure
from being a critical asset. More
generally, the definition of ‘‘critical
asset’’ can include non-space associated
assets, including those not located at or
adjacent to a launch or reentry site.
However, the criterion for loss of
functionality likely limits aviation
infrastructure assets from being subject
to protection.
Commenters were divided on the
need for critical asset protection. ULA
acknowledged the need for protection of
critical assets. Virgin Galactic
questioned whether the FAA’s proposed
critical asset requirements were within
the FAA’s statutory authority, as title 51
did not reference ‘‘national interests’’ or
‘‘national priority missions.’’ Blue
Origin acknowledged the FAA’s
statutory authority to protect property
and asked the FAA to explain how it
will interpret and implement this
authority. An individual commenter
stated only assets directly related to
national security should be given
heightened protection. CSF, Spaceport
Strategies, LLC (Spaceport Strategies),
and SpaceX commented that critical
assets were already protected by current
requirements at Federal launch and
reentry sites, rendering the FAA’s
regulations duplicative. SpaceX added
that NASA or DOD may not agree with
the FAA’s proposed critical asset
requirements, which may lead to further
duplication of requirements at Federal
sites.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79608
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
The FAA has the authority to protect
critical assets. The Commercial Space
Launch Act authorizes the DOT, and the
FAA by delegation, to protect public
health and safety, safety of property,
and national security and foreign policy
interests of the United States. In
carrying out its responsibility to protect
property, the FAA has established a
quantitative requirement to protect
assets that are essential to the national
interests of the United States. As noted
in the NPRM, national interests go
beyond national security and include
infrastructure such as that used to
support high priority NASA missions.
As noted earlier, an example of this
would be infrastructure necessary to
support launch and reentry services to
deliver cargo to and from the
International Space Station.
As CSF, Spaceport Strategies, and
SpaceX noted, the FAA’s critical asset
requirements codify current practice at
Federal launch or reentry sites, but also
extend the same regulatory protection
for launch or reentry activity at nonFederal launch or reentry sites.
Although critical assets are primarily
located on Federal launch or reentry
sites at this time, the FAA foresees
increased commercial space activity at
non-Federal sites that may result in the
presence of critical assets at those sites.
In licensing commercial launch or
reentry activities, the FAA safeguards
critical assets—which by definition are
essential to the national interests of the
United States—irrespective of their
location.
The FAA does not find the critical
asset requirements to be unnecessarily
duplicative of requirements at Federal
launch or reentry sites. As discussed in
the NPRM, the FAA proposed these
requirements to further the goal of
common standards for launches from
any U.S. launch or reentry site, Federal
or non-Federal. Inclusion of critical
asset protection in FAA regulations
aligns FAA licensing with Federal
launch or reentry site requirements and
removes duplication of effort. The FAA
closely coordinated the critical asset
requirements with the CSWG and its
interagency partners, including NASA
and DOD. As a result of this
coordination, the FAA anticipates that
the methodologies used by the Federal
launch or reentry sites will satisfy the
FAA’s requirements for critical asset
protection.
Many commenters, including AIA,
Blue Origin, Boeing, CSF, Lockheed
Martin, Northrop Grumman, Sierra
Nevada, SpaceX, Virgin Galactic, and
ULA raised concerns about how an
applicant would obtain the information
necessary to perform the proposed
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
critical asset analysis, including
proprietary or confidential information.
CSF and SpaceX noted the same data
should be provided to all operators to
ensure the fair and unbiased application
of this regulation. Sierra Nevada
recommended the FAA provide a
method of acceptable means of
compliance that does not require a
commercial company to contract with
DOD to complete this analysis.
Alternatively, Sierra Nevada
recommended the FAA provide the
analysis instead of the applicant. CSF
and SpaceX also recommended the FAA
publish an AC that would provide an
acceptable means for analyzing critical
assets, describe how the FAA would
obtain a definitive list of critical assets,
and how the FAA would provide
operators the data necessary to conduct
the analysis. Blue Origin stated that, by
requiring information that includes data
from other entities, the FAA would
become responsible for facilitating
acquisition of this data or would risk
implementing a requirement that would
not be possible to comply with or a
requirement that would establish a sole
source provider of a service.
The FAA acknowledges the practical
problems an applicant would likely
encounter in collecting the input data
necessary to identify and perform a risk
assessment for critical assets, especially
critical payloads. The FAA agrees with
Sierra Nevada that it would be better for
the U.S. Government to perform all
critical asset and critical payload risk
assessments necessary to ensure
operators comply with the risk criteria
in part 450. The FAA therefore removes
the requirement for operators to assess
the risks to critical assets in preparing
a flight hazard analysis, debris analysis,
and debris risk analysis. The FAA also
removes from § 450.185 (Ground Hazard
Analysis) the requirement that the
ground hazard analysis ensure that the
likelihood of any hazardous condition
that may cause damage to critical assets
is remote. The FAA notes that the input
data and analysis tools necessary to
perform a risk assessment for critical
assets are often a subset of those the
FAA uses to establish the MPL values.
The FAA will perform all critical asset
and critical payload risk assessments for
commercial space transportation
operations involving non-Federal sites.
Hence, operators should not bear
additional cost for the analyses
associated with critical assets.
Blue Origin asked how the FAA will
address overflight of critical assets. The
FAA notes that overflight of a critical
asset is possible if the safety criteria set
forth in § 450.101 are satisfied. Past
experience demonstrates that the critical
PO 00000
Frm 00044
Fmt 4701
Sfmt 4700
asset criteria in § 450.101 are satisfied
except in occasional cases involving
critical assets located within the same
launch site. Historically, the risk to
critical assets from overflight outside
the launch site is negligible.
Virgin Galactic asked how an operator
would have input on or dispute the
determination of a critical asset. The
FAA will discuss with operators any
concerns they may have about ensuring
protection of critical assets during their
licensed activities, but the FAA is not
proposing a formal dispute mechanism
to adjudicate its determination that an
asset is critical or threatened within the
risk criterion. Often, it might not be
possible to share such information due
to national security issues and
proprietary interests. The FAA notes,
however, that if the FAA denies an
application for a license based on its
determination that the proposed activity
exceeds the risk threshold for critical
assets, an applicant may request
reconsideration under § 413.21 or a
hearing in accordance with part 406 of
this chapter.
CSF asked how the FAA will manage
proprietary and national security
concerns among operators and assetowners. The FAA does not foresee a
need to share proprietary data with nonFederal entities because the Federal
Government will conduct the
assessment of critical asset risk on
behalf of the licensee. Based on
discussions with relevant Federal
agencies, it is also possible to perform
an assessment of critical assets without
disclosing the precise location or nature
of each asset, thereby eliminating the
need to share proprietary and national
security information. For example, the
USAF 45th Space Wing/Wing Safety
identifies what facilities are threatened
within the thresholds and shares that
information with the appropriate
tenants. The tenant can then inform the
USAF, or another entity performing the
analysis, that an asset is threatened
without divulging sensitive information
to any entity outside the U.S.
Government. The FAA will work with
the entities responsible for critical assets
to ensure any necessary coordination,
taking into account the need to protect
proprietary and confidential data.
Several commenters, including CSF,
SpaceX, and Virgin Galactic requested
clarification as to the meaning of ‘‘loss
of functionality’’ and how the FAA or
other entity would determine what
could result in the ‘‘loss of
functionality’’ of a critical asset. CSF
sought clarification on whether
infrastructure was ‘‘critical’’ if it was
needed to support full functionality of
a critical asset and on the standard for
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
determining whether an asset’s function
had been lost. It inquired whether it
would matter if the function could be
restored in a timely manner or met with
an alternative asset.
CSF and SpaceX also recommended
that ‘‘loss of functionality’’ be defined in
§ 401.7 as an asset designated critical by
the Secretary of Defense or
Administrator of NASA that (a) has been
rendered unable to support a specific
mission or program deemed critical to
the national interest; (b) for which the
loss of function will preclude the
assurance of a time-critical mission or
program unless promptly restored; or (c)
for which the asset’s function cannot be
restored by an accelerated recovery
strategy or replaced by an alternate
means of mission/program execution.
SpaceX and Virgin Galactic requested
the FAA include this new definition in
an SNPRM, along with a clear rationale
for the FAA’s proposed requirements for
protecting critical assets.
Under the final rule, the party
responsible for the critical asset would
determine what constitutes loss of
functionality. The FAA recognizes that
the threshold conditions that cause loss
of functionality will be different
depending on the type of asset and its
robustness. For example, infrastructure
is typically more robust than a payload
that may be more fragile. For this
reason, the FAA does not elect to
incorporate a specific standard for what
may constitute loss of functionality into
the final rule. Likewise, the FAA does
not find that it is useful to create a more
detailed definition of ‘‘loss of
functionality’’ but agrees that
considerations such as those suggested
by CSF and SpaceX (e.g., ability to
support missions critical to national
interests, or ability to repair or restore
function through alternative means in a
timely manner) would be relevant and
appropriate to determining loss of
functionality.
An individual commenter stated that
critical asset protection should not
compromise protection of the public
and neighboring operation personnel.
The commenter stated that an operator’s
required insurance should already cover
losses to critical assets.
The FAA notes that the critical asset
protection requirements will not
compromise the protection of the public
or neighboring operation personnel. The
FAA retains stringent requirements for
protecting the public, including
neighboring operations personnel,
which are independent of the
requirements protecting critical assets.
The FAA also disagrees with the
commenter that an operator’s financial
responsibility requirements are
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
adequate to protect critical assets. The
FAA is limited by statute to imposing
no more than $100 million in financial
responsibility to compensate for losses
to U.S. Government property. The value
of many critical assets easily exceeds
that limit, with some critical payloads
reportedly costing over a billion dollars.
More importantly, financial
compensation for a loss may not address
the delay before repairs or replacement,
during which time national security
might be jeopardized or the opportunity
to accomplish important national
interests missed.
The FAA sought comments on its
proposal to require a more stringent
criterion for critical assets of utmost
importance to the U.S., to be defined as
‘‘critical payloads’’ in § 401.7. The FAA
proposed to require that the probability
of loss of functionality for critical
payloads, including essential
infrastructure when directly supporting
the payload, not exceed 1 × 10¥4. In the
past, Federal launch or reentry sites
have, on occasion, applied a more
stringent requirement, limiting the
probability of debris impact caused by
launch or reentry hazards to less than or
equal to 1 × 10¥4 for national security
payloads, including essential
infrastructure when directly supporting
the payload at the launch site. The FAA
asked commenters to identify (1) the
impacts a 1 × 10¥4 risk criterion would
have on their operations if applied to
critical payloads; (2) whether a more
stringent risk criterion should be
imposed on any commercial payload;
and (3) potential additional costs and
benefits associated with applying a 1 ×
10¥4 risk criterion to critical payloads.
In the final rule, the FAA adopts the
risk criterion and definition as
discussed in the NPRM preamble, with
minor clarifications.
ULA supported the 1 × 10¥4 risk
criterion for critical payloads, stating
that given the time and expense
associated with replacing these assets, it
was essential they receive the greatest
protection possible. It further
commented that this risk criterion
should also apply to infrastructure and
booster hardware in direct support of
critical payloads, beginning when
booster hardware for that particular
critical payload was received and began
processing at the launch site. Under
ULA’s suggestion, at the completion of
the launch campaign, the risk criterion
should revert to 1 × 10¥4. Virgin
Galactic, however, commented that it
was not necessary to adopt a heightened
risk criteria for critical payloads. It saw
no benefit to the discussed 1 × 10¥4
requirement over the 1 × 10¥4
requirement. It also inquired whether
PO 00000
Frm 00045
Fmt 4701
Sfmt 4700
79609
the criterion would apply to payloads
on the vehicle of the operator that might
be subject to this new risk threshold. If
so, Virgin Galactic stated this would
constitute managing mission success.
Virgin Galactic also inquired whether
this risk criterion would apply to
payloads at neighboring launch sites. If
so, Virgin Galactic believes the FAA
must demonstrate need and a nexus to
statutorily obligated concerns. It further
stated that a more stringent criterion for
commercial payloads would place
undue burden on operators, potentially
requiring additional analyses or
redesign. Virgin Galactic noted that it
did not intend to carry critical payloads,
so impacts to its operations from this
requirement would be negligible.
In the final rule, the FAA defines a
critical payload as a payload and
essential infrastructure directly
supporting such a payload that is a
critical asset (1) that is so costly or
unique that it cannot be readily
replaced, or (2) for which the time frame
for its replacement would adversely
affect the national interests of the
United States. As noted in the NPRM, a
commercial payload that meets this
definition will be treated as a critical
payload. The critical payload protection
requirement does not apply to payloads
on the vehicle of the operator regulated
under part 450 but will apply to
payloads on neighboring launch sites.
The FAA agrees with ULA that the 1 ×
10¥3 risk criterion should apply to
essential infrastructure directly
supporting the critical payload, and
notes that it will likely apply to booster
hardware in direct support of the launch
of a critical payload. After a launch of
a critical payload, the infrastructure
supporting the launch will be critical
only if it is essential to the national
interests of the United States. The risk
criterion determines the protection
required for critical assets and payloads.
It is not necessary to specify in the
regulation that this requirement does
not apply during activities that do not
exceed the risk threshold.
The FAA disagrees with Virgin
Galactic that there is no benefit in
applying a 1 × 10¥4 risk criterion to
critical payloads. As explained in the
NPRM, during the interagency review
process, DOD requested that the FAA
consider specifying a more stringent
criterion for certain critical assets of
utmost importance. The FAA considers
a critical payload a type of critical asset.
The FAA finds it necessary to protect
payloads such as vital national security
payloads and high-priority NASA and
NOAA payloads. The NPRM noted that
a payload such as NASA’s Curiosity
rover would likely be afforded this
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79610
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
protection. In the final rule, the FAA
adopts this higher protection criterion to
safeguard those payloads of utmost
importance to the U.S. meriting a greater
degree of protection than other critical
assets. While the FAA is providing for
heightened protection for critical
payloads, it expects the protection to
have minimal effects on commercial
launch and reentry operations.
Currently there are few commercial
payloads that would rise to the level of
being considered critical payloads,
although the FAA recognizes that might
change in the future, if for instance,
DOD were to rely on a commercial
service for critical communication
support.
Virgin Galactic requested the FAA
adopt neither 1 × 10¥3 nor a more
stringent criterion. It argued the
proposed requirement contradicted the
requirement in 51 U.S.C. § 50901(a)(7)
that the FAA regulate only to the extent
necessary. Virgin Galactic stated the
FAA did not show why these
requirements were necessary, given that
Federal launch or reentry sites already
protect their own property.
Furthermore, Virgin Galactic
commented that the FAA would be
enforcing a more stringent, but
undisclosed criterion and argued the
proposed regulation was nontransparent and would deprive the
public of the opportunity to comment
on this criterion as required by the
Administrative Procedure Act. The
commenter asserted this undisclosed
criterion could prevent operators from
planning ahead and would create two
standards that might conflict.
As articulated in the NPRM, the FAA
finds it necessary to codify current
practice at Federal launch or reentry
sites to protect critical assets that are of
utmost importance to the U.S. and to
extend the same protections for launch
or reentry activity conducted at nonFederal sites. For launches from Federal
sites, this rule does not change current
practice; rather it incorporates that
practice in a regulation. This regulation
consolidates the FAA’s requirements for
protection of critical assets and critical
payloads in all commercial launch or
reentry operations, in accordance with
the FAA’s statutory authority. This rule
reduces the need for a Federal or nonFederal site operator to impose critical
asset protection requirements on
operators as a contractual condition for
the use of its facility. The FAA expects
that the instances in which a more
stringent criterion will be necessary will
be rare. Preserving the flexibility to
protect particularly vital assets at a more
stringent criterion in a license, as
proposed in the NPRM, is consistent
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
with current practice at Federal launch
and reentry sites and will reduce the
need for a Federal or non-Federal
launch site operator to impose a more
stringent criterion on operators through
contract.
CSF and SpaceX commented that the
FAA did not assess the cost burden on
industry for compliance with the critical
asset requirements. Virgin Orbit
commented that critical asset
calculations would require additional
analysis and resources.
In the final rule, the FAA’s removal of
the requirements for operators to assess
impacts to critical assets in flight
hazard, ground hazard, debris or debris
risk analyses assuages the commenters’
concerns for costs associated with
performing those analyses. As compared
to the proposal, there will be much
reduced administrative burden on the
operator. The FAA will coordinate as
necessary with critical assets owners,
and either the FAA or the Federal site
operator will provide written
confirmation to the operator that the
criteria in § 450.101(a)(4) or (b)(4) have
been met. If the FAA or Federal site
operator determines that the criteria
have not been met, either the FAA or
Federal site operator will work with the
operator to identify any measures that
operators may need to undertake in
order to protect critical assets to the
level required by § 450.101(a)(4) or
(b)(4).
An individual commenter stated that
the proposed regulation would require
companies to perform trade studies to
determine if additional controls would
be needed to reduce the likelihood of
critical asset loss of functionality. The
commenter requested the FAA require a
cost-benefit analysis to ensure that
upfront investment of controls to protect
critical assets would be less than the
cost of replacing that asset.
When determining whether an asset is
a critical asset, the cost of an asset is a
factor. However, ultimately an asset is
critical if it is essential to the national
interests of the United States. If it
cannot be replaced in a time frame that
satisfies those interests, the cost of the
asset is irrelevant. Furthermore, the
FAA does not find that most mitigations
will impose significant cost.
Virgin Galactic indicated the need for
FAA assistance in planning hazard
control strategies pursuant to proposed
§ 450.107(e)(2)(ii) 79 due to the secrecy
of some critical assets. If an operator is
79 As proposed, an applicant using physical
containment as a hazard control strategy would
have been required to describe the methods used to
ensure that flight hazard areas are cleared of the
public and critical assets. This requirement has
been relocated to § 459.110(c)(2) in the final rule.
PO 00000
Frm 00046
Fmt 4701
Sfmt 4700
using physical containment as a hazard
control strategy, the FAA or Federal
launch or reentry site operator will work
with the operator to ensure no critical
assets are within the flight hazard area.
The most likely mitigation is shifting
the launch point or, if the critical asset
is mobile, changing in the launch
schedule.
Sierra Nevada requested the FAA
conduct a publicly-available assessment
to determine if the proposed critical
asset protection requirements would
impact an operator’s MPL calculation.
CSF requested the FAA engage industry
on the topic of critical assets.
The FAA does not find that the
protection of critical assets will increase
MPL. The designation of an asset as
critical is unrelated to financial
responsibility. In performing its MPL
calculation for U.S. Government
property, the FAA ascertains the
financial responsibility required so that
the likelihood of exceeding losses to
government property involved in a
licensed activity (taken to mean such
property on a Federal launch or reentry
site) that are reasonably expected to
result from that activity does not exceed
1 × 10¥5; or, in the rarer situation in
which a critical asset might not be U.S.
Government property on a Federal
launch or reentry site, 1 × 10¥7. Critical
assets are protected to a less stringent 1
× 10¥3, or in the case of certain critical
payloads, 1 × 10¥4, and financial
responsibility and protection are not
directly related. If anything, the
requirement to protect critical assets has
the potential to lower MPL for U.S.
Government property because the
mitigation employed may well remove
the possibility that the asset can be
damaged even within the more stringent
MPL threshold. This would be the case
if, to avoid placing the critical asset at
risk a launch was rescheduled, its
trajectory adjusted, or the critical asset
was moved or physically protected. The
FAA finds that it is unlikely that a
mitigation employed to protect critical
assets will change the MPL for thirdparty liability.
d. Other Safety Criteria (§ 450.101(d),
(e), (f), and (g))
The FAA adopts the criteria in
§ 450.101(d), (e), (f), and (g) with no
changes. Section 450.101(d) addresses
disposal safety criteria, § 450.101(e) is
the requirement for the protection of
people and property on orbit,
§ 450.101(f) requires the notification of
planned impacts, and § 450.101(g)
addresses the validity of analyses.
The FAA received public comments
from Virgin Galactic on the notification
of planned impacts. Specifically, Virgin
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Galactic advised that a carrier aircraft
operating under an airworthiness
certificate should be exempt from
proposed § 450.101(f). This comment is
discussed in further detail in the
preamble section on hybrid vehicles.
The FAA will not exempt all hybrid
vehicle operators from the requirement
in § 450.101(f). If an operation has no
planned impacts from debris capable of
causing a casualty, then no notification
will be necessary to comply with
§ 450.101(f). The regulation is adopted
as proposed.
jbell on DSKJLSW7X2PROD with RULES2
e. System Safety Program (§ 450.103)
In the NPRM, the FAA proposed in
§ 450.103 that an operator must
implement and document a system
safety program throughout the
operational lifecycle of a launch or
reentry system. The system safety
program was proposed to include a
safety organization (§ 450.103(a)),
procedures to evaluate the operational
lifecycle of the launch or reentry system
(§ 450.103(b)), configuration
management and control (§ 450.103(c)),
and post-flight data review
(§ 450.103(d)).
In the final rule, the FAA adopts
proposed § 450.103 with revisions. The
FAA replaced the term ‘‘operational
lifecycle’’ in the introductory paragraph
of § 450.103 with simply ‘‘lifecycle’’ to
clarify that the regulation applies to
hazards throughout the lifecycle of a
launch or reentry system, not just
operational changes to the system. This
change is consistent with the statements
in the NPRM indicating that, due to the
complexity and variety of vehicle
concepts and operations, a system safety
program would be necessary to ensure
that an operator considers and addresses
all risks to public safety, which include
both design and operational changes to
a system.
i. Safety Organization
In the NPRM, the FAA proposed that
the system safety program would
require an operator to maintain and
document a safety organization that has
clearly defined lines of communication
and approval authority for all public
safety decisions, and that includes a
mission director and safety official. In
the final rule, the FAA adopts the
proposed rule with a revision. The FAA
removes ‘‘and document’’ from the
proposed requirement because the first
sentence in § 450.103 already requires a
system safety program to be
documented.
Proposed § 450.103(a)(1) stated that
for each launch or reentry, an operator
would be required to designate a
position responsible for the safe conduct
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
of all licensed activities and authorized
to provide final approval to proceed
with licensed activities. This position is
referred to as the mission director. In
the final rule, the FAA adopts
§ 450.103(a)(1) as proposed. The FAA
did not receive comments on this
section.
Proposed § 450.103(a)(2) stated that,
for each launch or reentry, an operator
would be required to designate a
position with direct access to the
mission director who would be
responsible for communicating potential
safety and noncompliance issues to the
mission director and would be
authorized to examine all aspects of the
operator’s ground and flight safety
operations, and to independently
monitor compliance with the operator’s
safety policies, safety procedures, and
licensing requirements. This position
would be referred to as a safety official.
The FAA noted in the NPRM preamble
that the absence of a safety official could
result in a lack of independent safety
oversight and a potential for a
breakdown in communications of
important safety-related information.
The FAA also noted that a safety
organization that included a safety
official was essential to public safety;
however, identifying that individual by
name was not necessary. In the final
rule, the FAA adopts § 450.103(a)(2) as
proposed. Thus, a safety official will
need to be in place prior to and
throughout any licensed activity.
Rocket Lab supported the proposed
safety organization documentation
requirements in proposed § 450.103(a),
noting the requirements would provide
improved flexibility for the industry and
support growth in operations, while
maintaining clear lines of
communication and independence in
safety decision making. Virgin Galactic
noted that it agreed with the FAA’s
approach not to require a specific
person be listed as the safety official.
Microcosm inquired if a specific named
safety official would be required for
each launch site for operators with
licensed activity at multiple sites, and
how far in advance that information
would need to be provided to the FAA.
The FAA notes that a safety official
must be named and in place prior to the
initiation of any licensed activity, and
an operator may use the same safety
official for multiple launch or reentry
sites. It may be difficult for a single
individual to serve as a safety official for
multiple sites if launch or reentry
activities were to occur close in time to
each other. In those instances, an
operator may choose to have multiple
safety officials. An operator needs to
provide the name of the safety official
PO 00000
Frm 00047
Fmt 4701
Sfmt 4700
79611
to the FAA only when requested. The
FAA may request the name of the
individual who will act as a safety
official as part of a compliance
monitoring action. As is current
practice, the FAA will coordinate in
advance with the operator prior to a
compliance monitoring action.
ALPA concurred with the
requirement for operators to develop a
general system safety program. It also
recommended that that embedding FAA
representatives within commercial
space companies would assist the
commercial space community in
growing robust system safety
procedures. The FAA notes that
embedding FAA representatives within
commercial space companies is outside
the scope of this rulemaking.
Proposed § 450.103(a)(3) requires the
mission director to ensure that all of the
safety official’s concerns are addressed.
In the final rule, the FAA adopts
§ 450.103(a)(3) as proposed. The FAA
did not receive any comments on this
section.
ii. Hazard Management
Proposed § 450.103(b) would have
required an operator to establish
procedures to evaluate the operational
lifecycle of the launch or reentry
system, including methods to review
and assess the validity of the proposed
preliminary safety assessment and any
flight hazard analysis throughout the
operational lifecycle of the launch or
reentry system, methods for updating
the preliminary safety assessment and
flight hazard analysis, and methods for
communicating and implementing the
updates throughout the organization.
For operators that would need to
conduct a flight hazard analysis, the
proposed rule would also require an
operator’s system safety program to
include a process for tracking hazards,
risks, mitigation and hazard control
measures, and verification activities.
In the final rule, the FAA adopts
proposed § 450.103(b) with revisions.
The FAA renames this section ‘‘Hazard
management’’ to be more descriptive
than the proposed name of
‘‘Procedures.’’ The FAA also does not
adopt the proposed requirement in
§ 450.103(b)(1) to conduct a preliminary
safety assessment because that
requirement has been replaced with the
requirement to conduct a hazard control
strategy determination in § 450.107(b) in
the final rule, as will be discussed later.
As noted, proposed § 450.103(b)(1)
would have required the system safety
program to include: (i) Methods to
review and assess the validity of the
preliminary safety assessment
throughout the operational lifecycle of
E:\FR\FM\10DER2.SGM
10DER2
79612
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
the launch or reentry system; (ii)
methods for updating the preliminary
safety assessment; and (iii) methods for
communicating and implementing the
updates throughout the organization.
For those operators required to conduct
a flight hazard analysis, proposed
§ 450.103(b)(2) would have required the
system safety program to include the
same methods for the flight hazard
analysis and a process for tracking
hazards, risks, mitigation and hazard
control measures, and verification
activities.
In the final rule, the FAA consolidates
the requirements in proposed
§ 450.103(b)(1) and (b)(2) into
§ 450.103(b)(1) of the final rule. Section
450.103(b)(1) requires a system safety
program to include methods to assess
the system to ensure the validity of the
hazard control strategy determination
and any flight hazard or FSA throughout
the lifecycle of the launch or reentry
system.80 The FAA added FSA to this
requirement because, as proposed in
§ 450.101(g) and adopted in the final
rule, any analysis used to demonstrate
compliance with § 450.101 must use
accurate data. This is consistent with
the proposal because proposed
§ 450.103(b)(1)(i) would have required
methods to review and assess the
validity of the preliminary safety
assessment, which would have included
components of FSA such as vehicle
response modes, public safety hazards
associated with vehicle response modes,
population exposed to hazards, and
CEC. As previously noted, the final rule
in § 450.103(b)(1) uses the term
‘‘lifecycle’’ by itself to clarify that the
regulation applies to hazards throughout
the lifecycle of a launch or reentry
system, not just operations hazards.
Proposed § 450.103(b)(1)(iii) and
(b)(2)(iii) would have required the
system safety program to include
methods for communicating and
implementing the updates throughout
the organization. In the final rule, the
FAA consolidates the requirements in
proposed § 450.103(b)(1)(iii) and
(b)(2)(iii) into § 450.103(b)(2) of the final
rule with a revision. The FAA changes
the term ‘‘the updates’’ to ‘‘any updates’’
to clarify the intent for
comprehensiveness.
80 Proposed § 450.103(b)(1)(ii) and (b)(2)(ii) would
have required the system safety program to include
methods for updating the preliminary safety
assessment and flight hazard analysis. In the final
rule, the FAA simplifies the regulatory text of
§ 450.103(b) in the final rule, which requires an
operator to implement methods to assess the system
to ensure the validity of the hazard control strategy
determination and any flight hazard or flight safety
analysis throughout the lifecycle of the launch or
reentry system. Updating the safety analyses is a
component of ensuring their validity.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Proposed § 450.103(b)(2)(iv) would
have required the system safety
program, for operators that must
conduct a flight hazard analysis, to
include a process for tracking hazards,
risks, mitigation and hazard control
measures, and verification activities.
The FAA adopts the language proposed
in § 450.103(b)(2)(iv) of the NPRM in
§ 450.103(b)(3) of the final rule with a
revision. The FAA deletes the terms
‘‘hazard control,’’ because it is
duplicative with the existing term
‘‘mitigation measures.’’
iii. Configuration Management and
Control
Proposed § 450.103(c) would have
required an operator to (1) employ a
process that tracks configurations of all
safety-critical systems and
documentation related to the operation;
(2) ensure the use of correct and
appropriate versions of systems and
documentation tracked under the
subsection; and (3) maintain records of
launch or reentry system configurations
and document versions used for each
licensed activity, as required by the
requirement for records in proposed
§ 450.219.
In the final rule, the FAA adopts
§ 450.103(c)(1) and (c)(2) as proposed
and revises § 450.103(c)(3) as discussed
later.
Blue Origin commented that tracking
and maintaining records of individual
configurations and associated
operations documentation for
completed operations does not, by itself,
enhance public safety. Blue Origin
believes that changes should be
evaluated for safety impact according to
a configuration management plan,
which is a deliverable under the current
regulations. Blue Origin stated that an
approved configuration management
plan, coupled with continued accuracy
of the application, should suffice
without additional requirements for
increased documentation and storage of
records.
The FAA agrees that tracking and
maintaining records for completed
operations in isolation does not directly
enhance public safety, but tracking and
maintaining records for completed
operations is an important component
of configuration management, which, as
a whole, does enhance public safety.
The FAA agrees with Blue Origin that
an approved configuration management
plan coupled with continued accuracy
of the application should suffice, but
does not agree that current requirements
are sufficient. Part 431 does not have
any requirements for configuration
management, and § 417.111(e) is more
general in its requirement to define the
PO 00000
Frm 00048
Fmt 4701
Sfmt 4700
launch operator’s process for managing
and controlling any change to a safetycritical system to ensure its reliability.
Section 450.103(c) adds necessary
detail.
Blue Origin also stated that proposed
§ 450.103(c) is repetitive of the
recordkeeping requirements in proposed
§ 450.219, making it unnecessary. Blue
Origin added that if the FAA were to
maintain the requirement, it should be
written in the context of safety-critical
systems, which would tie directly to
FAA’s responsibility to protect public
safety.
While the FAA considers § 450.103(c)
necessary, proposed § 450.103(c)(3)
could be perceived as repetitive.
Proposed § 450.103(c)(3) would have
required an operator to maintain records
of launch or reentry system
configurations and document versions
used for each licensed activity, as
required by § 450.219 (Records). Section
450.219 requires a licensee to maintain
for 3 years all records, data, and other
material necessary to verify that a
launch or reentry is conducted in
accordance with representations
contained in the licensee’s application,
the requirements of part 450 subparts C
and D, and the terms and conditions
contained in the license. The FAA
removes the reference to maintaining
records in § 450.103(c)(3) and revises
the provision to require an operator to
document the configurations and
versions identified in paragraph (c)(2)
for each licensed activity. This is a more
focused requirement than § 450.219 and
limits the documentation requirement
specifically to safety-critical systems,
consistent with Blue Origin’s
recommendation.
iv. Post-Flight Data Review
Proposed § 450.103(d) would have
required an operator to employ a
process for evaluating post-flight data to
(1) ensure consistency between the
assumptions used for the preliminary
safety assessment, any hazard or flight
safety analysis, and associated
mitigation and hazard control measures;
(2) resolve any identified
inconsistencies prior to the next flight of
the vehicle; (3) identify any anomaly
that may impact any flight hazard
analysis, FSA, or safety-critical system,
or would otherwise be material to
public health and safety and the safety
of property; and (4) address any
anomaly identified in (3) prior to the
next flight, including updates to any
flight hazard analysis, FSA, or safetycritical system. The FAA explained in
the NPRM that this requirement was
consistent with industry practice to
review post-flight data to address
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
vehicle reliability and mission success
and that this requirement imposes no
additional burden. The FAA sought
comment on whether proposed
§ 450.103(d) would change an operator’s
approach to reviewing post-flight data.
In the final rule, the FAA adopts
proposed § 450.103(d)(1), (d)(2), and
(d)(4) with revisions, and adopts
§ 450.103(d)(3) as proposed. Section
450.103(d)(1) was modified to replace
‘‘preliminary safety assessment’’ with
‘‘hazard control strategy determination’’
as discussed earlier. The FAA also
added the word ‘‘flight’’ in front
‘‘hazard or flight safety analysis’’ to
make clear that the requirement
addresses any flight hazard analysis or
FSA.
CSF, Rocket Lab, and Sierra Nevada
commented that proposed § 450.103(d)
should be deleted because it was overly
burdensome and inconsistent with the
directive to streamline the regulations.
The commenters stated that the
requirement would extend the industry
practice beyond the typical analysis for
reliability and mission success. Sierra
Nevada suggested that the section could
be re-written to address only post-flight
data of safety-critical systems.
As discussed in the NPRM, operator
review of post-flight data provides
valuable safety information on future
operations. The inconsistencies that
need to be resolved in this subsection
are only those that affect safety analyses
and associated mitigation and hazard
control measures, such as greater
population in the launch area than
modeled. The anomalies that need to be
addressed are only those that may
impact any flight hazard analysis, FSA,
or safety-critical system, or are
otherwise material to public health and
safety and the safety of property, such
as the momentary drop-out of an FSS.
Therefore, while the FAA revises
§ 450.103(d)(2) to narrow its
applicability, as discussed below, it
declines to remove proposed
§ 450.103(d)(2).
Blue Origin proposed a revision of
§ 450.103(d)(2) to specify ‘‘public
safety.’’ Virgin Galactic recommended
removing the word ‘‘any’’ in front of
‘‘identified inconsistencies,’’ and
recommended limiting applicable
inconsistencies to those that have an
effect on the safety criteria of § 450.101.
The FAA agrees that proposed
§ 450.103(d)(2) could be read to reach
more broadly than public safety, so the
FAA has revised the section to require
that an operator resolve any
inconsistencies ‘‘identified in paragraph
(d)(1) of this section’’ prior to the next
flight of the vehicle. This language
would explicitly limit the applicability
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
of the provision to the hazard control
strategy determination, and any hazard
or flight safety analyses and associated
mitigation and hazard control measures,
as opposed to mission success. The FAA
does not agree with Virgin Galactic’s
suggestion to limit applicable
inconsistencies to those that have an
effect on the safety criteria of § 450.101.
That change would imply that a
quantitative analysis is all that is
required. As discussed earlier in the
hazard management section, the hazard
control strategy determination and the
hazard and flight safety analyses must
be kept up to date throughout the
lifecycle of the launch and reentry
system, so inconsistencies need to be
addressed. The FAA also does not agree
with Virgin Galactic to remove the word
‘‘any’’ in front of ‘‘inconsistencies’’
because it would not change the scope
of the requirement, because
§ 450.103(d)(2) explicitly refers to the
analyses in § 450.103(d)(1).
Virgin Galactic recommended that
proposed § 450.103(d)(4)—which would
have required an operator to address
any anomaly identified in paragraph
(d)(3) prior to the next flight, including
updates to any flight hazard analysis,
FSA, or safety-critical system—be
revised to state the FAA should review
and provide a determination on an
operator’s post-flight data to approve the
operator’s ability to launch according to
schedule, rather than delaying until all
anomalies are resolved.
The FAA notes that proposed
§ 450.103(d)(4) would not have required
FAA approval of the methodology an
operator uses to address anomalies in
general or a specific anomaly in
particular. In order to avoid Virgin
Galactic’s interpretation that all
anomalies must be resolved prior to the
next flight, the FAA revised the final
rule to require an operator to address
any anomaly identified in paragraph
(d)(3) prior to the next flight as
necessary to ensure public safety. As
proposed, this would include updates to
any flight hazard analysis, FSA, or
safety-critical system. To ensure public
safety, the FAA would expect an
operator to reassess its safety analyses to
determine any potentially new public
safety hazards or increased risks to
known public safety hazards due to the
anomaly and, if necessary, determine
the need for any additional mitigation
strategies or updates to its safety
analyses.
v. Application Requirements
An applicant under proposed
§ 450.103(e) would have to submit (1) a
description of the applicant’s safety
organization, identifying the applicant’s
PO 00000
Frm 00049
Fmt 4701
Sfmt 4700
79613
lines of communication and approval
authority, both internally and
externally, for all public safety decisions
and the provision of public safety
services; and (2) a summary of the
processes and products identified in the
system safety program requirements.
In the final rule, the FAA adopts
§ 450.103(e) as proposed. The FAA did
not receive any comments on this
section.
f. Hazard Control Strategies (§ 450.107)
In the NPRM, the FAA proposed in
§ 450.107 that, for each phase of a
vehicle’s flight, an operator does not
need to conduct a flight hazard analysis
for that phase of flight if the public
safety hazards identified in the
preliminary safety assessment (PSA) can
be mitigated adequately to meet the
requirements of proposed § 450.101
using physical containment, wind
weighting, or flight abort, in accordance
with § 450.107(b), (c), and (d). If the
public safety hazards identified in the
PSA could not be adequately mitigated
using these methods, an operator would
be required to conduct a flight hazard
analysis in accordance with proposed
§ 450.109 to derive hazard controls for
that phase of flight.
The FAA has restructured § 450.107
in the final rule to require an operator
to use a functional hazard analysis to
make a hazard control strategy
determination. This requirement is
based on the requirements for the PSA
that was proposed, but not adopted, in
§ 450.105. In addition, the FAA has
removed from § 450.107 specific details
for each hazard control strategy
available to operators and instead
directs operators to §§ 450.108, 450.109,
450.110, and 450.111, which provide
requirements for flight abort,81 flight
hazard analysis, physical
containment,82 and wind weighting,
respectively.
Section 450.107 also characterizes
flight hazard analysis as a hazard
control strategy. Although a flight
hazard analysis is different from the
other hazard control strategies in that it
does not lay out specific hazard
controls, it does lay out a process by
which hazard controls can be derived.
The hazard controls that are derived
from the flight hazard analysis, like
those defined in the other three hazard
81 In the NPRM, the requirements for flight abort
had been scattered throughout proposed §§ 450.107,
450.123, 450.125, 450.127, 450.129, and 450.165.
Section 450.108 is discussed more fully later in the
preamble section titled Flight Abort.
82 The NPRM did not include a separate section
for physical containment. In the final rule, as will
be discussed later, the requirements from proposed
§ 450.107(b) are relocated to a new § 450.110
(Physical Containment).
E:\FR\FM\10DER2.SGM
10DER2
79614
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
control strategies, are then used as part
of the input to the FSA that is used to
show compliance with § 450.101(a), (b),
and (c). Therefore, because a flight
hazard analysis is a means by which an
operator derives the appropriate hazard
controls, the FAA has characterized it as
a hazard control strategy in this final
rule. As such, throughout the final rule,
a flight hazard analysis is listed with
physical containment, wind-weighting,
and flight abort as a hazard control
strategy.83 Further, § 450.107(c) retains
the proposed requirement that an
operator must conduct a flight hazard
analysis if the public safety hazards for
that phase of flight cannot be mitigated
adequately to meet the requirements of
§ 450.101 through physical
containment, wind weighting, or flight
abort.84
Lastly, the final rule fixes an error in
proposed § 450.107, which referenced
§ 450.101 in its entirety as being
relevant to the hazard control strategies,
even though certain requirements in
§ 450.101 regarding the disposal of
upper stages, protection of people and
property on orbit, and notification of
planned impacts, are not relevant to the
hazard control strategies defined in
§ 450.107. Section 450.107 refers instead
to § 450.101(a), (b), or (c).
The FAA adds paragraph (b) to
§ 450.107 to address how an operator
determines its hazard control strategy or
strategies for any phase of flight during
a launch or reentry. This paragraph is
based on and replaces a portion of the
preliminary safety assessment in
proposed § 450.105 of the NPRM.
Because an operator determines a
hazard control strategy or strategies
based on an assessment of potential
hazards, the requirements for such an
assessment are better suited for this
section. The next preamble section
discusses the revision to § 450.107(b)
more fully.
83 The FAA notes that, throughout the preamble,
it uses the phrase ‘‘as a hazard control strategy’’ to
modify physical containment, wind-weighting,
flight abort, and flight hazard analysis. For example,
in the preamble, the FAA refers to operators who
use ‘‘flight abort as a hazard control strategy.’’ In
such instances, the FAA means that flight abort is
being used as a hazard control strategy consistent
with the requirements in § 450.108. Likewise, when
an operator uses flight hazard analysis as a hazard
control strategy, the operator is conducting a flight
hazard analysis consistent with the requirements
set forth in § 450.109.
84 Although proposed § 450.107 was written in
the negative, stating that an operator was not
required to conduct a flight hazard analysis if the
public safety hazards identified in the preliminary
safety assessment for that phase of flight could be
mitigated adequately to meet the requirements of
§ 450.101 through physical containment, wind
weighting, or flight abort, the final rule has revised
this language to be more easily understood.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Proposed § 450.107(e) would have
required an applicant in its application
to describe its hazard control strategy
for each phase of flight. The application
requirements in the final rule, in
§ 450.107(d), similarly require an
applicant to provide a description of its
hazard control strategy or strategies for
each phase of flight. The FAA added the
phrase ‘‘or strategies’’ to reflect the fact
that an operator may use one or more
hazard control strategies for any given
phase of flight. In addition, because the
requirements for physical containment
have been relocated to § 450.110, the
FAA has likewise relocated the
application requirements for physical
containment proposed in § 450.107(e) to
§ 450.110(c).85 These requirements have
been adopted as proposed.
Lastly, § 450.107(d) in the final rule
requires an applicant to submit in its
application the results of its hazard
control strategy determination,
including all functional failures
identified under § 450.107(b)(1), the
identification systems, and a timeline of
all safety-critical events. These relate to
the hazard control strategy
determination, which is discussed in
the next section of this preamble.
The FAA received a few comments for
proposed § 450.107. One individual
commenter supported the additional
flexibility inherent in allowing an
operator to select its hazard control
strategy and noted that this flexibility
would help to reduce overall design
costs for the private enterprise. Virgin
Galactic requested that the FAA define
‘‘traditional hazard controls’’ and
provide opportunity for public comment
through the issuance of an SNPRM. Blue
Origin proposed that the FAA amend
proposed § 450.107(e)(2)(ii) to require
that an applicant describe the methods
used to ensure that risk to the public
and critical assets in flight hazard areas
meet allowable criteria. This latter
comment is discussed later in the
preamble section titled Physical
Containment.
To the extent that Virgin Galactic
commented that the term ‘‘traditional
hazard controls’’ should be defined and
comment allowed through publication
of an SNPRM, the FAA notes that the
NPRM stated that traditional hazard
controls included physical containment,
wind weighting, and flight abort.86
85 The proposed rule also required an applicant
using physical containment as a hazard control
strategy to demonstrate that the launch vehicle does
not have sufficient energy for any hazards
associated with its flight to reach outside the flight
hazard area developed in accordance with
§ 450.133, and to describe the methods used to
ensure that flight hazard areas are cleared of the
public and critical assets.
86 See 84 FR 15316 (footnote 62).
PO 00000
Frm 00050
Fmt 4701
Sfmt 4700
g. Hazard Control Strategy
Determination (§ 450.107(b))
In the NPRM, the FAA proposed in
§ 450.105 to require that every operator
conduct and document a PSA for the
flight of a launch or reentry vehicle to
identify potential public safety impacts
early in the design process. The FAA
intended the PSA to be a top-level
assessment of the potential public safety
impacts identifiable early in the design
process and broad enough that minor
changes in vehicle design or operations
would not have a significant impact on,
or invalidate the products produced by,
the PSA. As proposed, the PSA would
have required the operator to identify a
number of items, including: A
preliminary hazard list that documents
all hardware, operational, and design
causes of vehicle response modes that,
excluding mitigation, have the
capability to create a hazard to the
public; safety-critical systems; and a
timeline of all safety-critical events.87
An applicant would have been required
to submit the PSA result, including the
items identified above, in its application
for a license.
The final rule removes proposed
§ 450.105 in its entirety but relocates
certain items from the PSA section into
§ 450.107(b) as part of the hazard
control strategy determination. The final
rule replaces the requirement for a PSA
with a functional hazard analysis and
replaces the term ‘‘vehicle response
mode’’ with ‘‘reasonably foreseeable
hazardous events.’’ The FAA finds these
changes are less prescriptive and
burdensome on an operator, while
preserving the intended benefits and
level of safety of the proposed
requirements.
Blue Origin and Microcosm
commented that requiring operators to
develop a preliminary hazard list that
identifies all causes of hazards and
vehicle response modes for a PSA, prior
to analysis or testing of their vehicle
systems, was unreasonable. Blue Origin
stated it would be infeasible to
document in a preliminary hazard list
all hardware, operational, and design
causes of vehicle response modes
capable of causing a hazard to the
public at the preliminary design phase.
87 The operator would also have needed to
identify (1) vehicle response modes; (2) public
safety hazards associated with vehicle response
modes, including impacting inert and explosive
debris, toxic release, and far field blast
overpressure; (3) geographical areas where vehicle
response modes could jeopardize public safety; (4)
any population exposed to public safety hazards in
or near the identified geographical areas; and (5) the
CEC, unless otherwise agreed to by the
Administrator based on the demonstrated reliability
of the launch or reentry vehicle during any phase
of flight.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
The commenters noted that operators
identify potential hazards, but not all
causes of vehicle response modes, prior
to the detailed design phase. Blue
Origin added that identification of
causes was a continuous process that
evolves as hardware and operations
design matures, and recommended the
PSA be limited to analyzing and
identifying all functional failures that
could have the capability to create a
hazard to the public, rather than
analyzing the detailed design, which
may still be maturing. Blue Origin also
noted that early engagement with the
FAA through the pre-application
process, before a design is mature, was
beneficial to both parties.
The FAA concurs that the detailed
design may not be mature enough at a
preliminary stage such that an operator
could define all hardware, operational,
and design causes of vehicle response
modes with minimal changes
downstream in the development process
in a preliminary hazard list. Although
the preliminary hazard list would not
have been provided to the FAA until an
applicant submitted an application, the
FAA agrees with the commenters that
the proposed rule would have required
a launch or reentry operator to complete
the preliminary hazard list early in the
design process, to enable the operator to
then carry out its hazard control strategy
or strategies. This, as noted by Blue
Origin, would not have been practicable
as proposed. Accordingly, the FAA does
not adopt the proposed requirement for
an operator to identify a preliminary
hazard list. Instead, the FAA requires an
operator, in § 450.107(b), to determine
its hazard control strategy or strategies
for any phase of flight during a launch
or reentry, based on a functional hazard
analysis accounting for all functional
failures associated with reasonably
foreseeable hazardous events, safetycritical systems, and safety-critical
events. Even with this change, the FAA
also agrees with Blue Origin that this
approach will encourage operators to
engage early with the FAA, prior to the
design becoming mature.
In the final rule, the FAA eliminates
proposed § 450.105, but moves, with
some revision, the requirements in
proposed §§ 450.105(a)(6) through (a)(8)
into § 450.107(b). Section 450.107(b),
titled ‘‘Hazard Control Strategy
Determination,’’ requires that for any
phase of flight during a launch or
reentry, an operator must use a
functional hazard analysis to determine
a hazard control strategy or strategies
accounting for (1) all functional failures
associated with reasonably foreseeable
hazardous events that, excluding
mitigation, have the capability to create
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
a hazard to the public, (2) safety-critical
systems, and (3) a timeline of all safetycritical events.
In the NPRM, proposed
§ 450.105(a)(6) would have required a
preliminary hazard list documenting all
hardware, operational, and design
causes of vehicle response modes that,
excluding mitigation, have the
capability to create a hazard to the
public. The final rule requires an
operator to use a functional hazard
analysis that accounts for, among other
things, all functional failures associated
with reasonably foreseeable hazardous
events that, excluding mitigation, have
the capability to create a hazard to the
public. A functional failure is a
condition of a system, subsystem, or
component function derived by
assessing each function against multiple
potential failure modes during each
phase of the system’s mission. This
addresses Blue Origin’s concerns about
the preliminary hazard list because
identifying functional failures does not
require detailed design information that
may not be finalized at the stage of
design when a hazard control strategy is
being considered.
A functional hazard analysis is a
common system safety tool that, as
articulated in DOD’s MIL–STD–882E, is
used to identify and classify the system
functions and the safety consequences
of functional failure or malfunction.88 A
functional hazard analysis is a
foundational tool useful throughout the
lifecycle of the launch or reentry system
that helps drive the design and
development process at a preliminary
stage by identifying safety-critical
functions of which launch and reentry
vehicle developers should be cognizant
throughout the process to ensure public
safety. The requirement to perform a
functional hazard analysis instead of a
preliminary hazard list, as proposed in
§ 450.105, should reduce the burden on
operators, for the reasons cited by Blue
Origin.
The FAA finds that a functional
hazard analysis will preserve the
benefits of the preliminary safety
assessment proposed in the NPRM, but
reduce the burden on applicants by not
requiring detailed design information
that may not be finalized at the stage of
design when a hazard control strategy is
being considered. Like the PSA, a
functional hazard analysis should help
an operator identify specific information
relevant to public safety, scope the
analyses that must be conducted to
ensure that the launch or reentry
operation satisfies safety criteria,
88 Department of Defense, Standard Practice for
System Safety, MIL–STD–882E, May 11, 2012.
PO 00000
Frm 00051
Fmt 4701
Sfmt 4700
79615
identify the effect of design and
operational decisions on public safety,
and provide the operator with an
appropriate hazard control strategy for
its proposed operation.
Section 450.107(b)(1) in the final rule
requires an operator to use a functional
hazard analysis to determine a hazard
control strategy accounting for all
functional failures associated with
reasonably foreseeable hazardous events
that, excluding mitigation, have the
capability to create a hazard to the
public. As noted earlier, a functional
failure is a condition of a system,
subsystem, or component function
derived by assessing each function
against multiple potential failure modes
during each phase of the system’s
mission. The failure end-effect is the
resulting system behavior from each
functional failure. Failure end-effects
that result in impacts to public safety
should in turn identify the safetycritical systems and can be grouped to
identify the system hazards to the
public. Thus, the inability of a safetycritical system, subsystem, or
component to function as designed, or
to function erroneously, may potentially
result in a hazard to the public. It is
important to note that public exposure
to a hazard should only be accounted
for after determining the potential
hazards to the public. That is, limits to
public exposure can be a mitigation
when considering hazards at the overall
system or mission level, and thus not
considered when determining what
constitutes a hazard to the public (i.e.,
functional sources of the hazard) for the
purposes of § 450.107(b)(1).
The FAA does not retain in
§ 450.107(b) the items in proposed
§ 450.105(a)(1) through (a)(5) for an
operator to identify (1) vehicle response
modes, (2) public safety hazards
associated with vehicle response modes,
(3) geographical areas where vehicle
response modes could jeopardize public
safety, (4) any population exposed to
public safety hazards in or near the
identified geographical areas, and (5)
the CEC. These are addressed in the four
hazard control strategies and in FSA.
Finally, the FAA replaces the term
‘‘vehicle response mode’’ in the NPRM
with ‘‘reasonably foreseeable hazardous
events’’ in § 450.107(b)(1) in the final
rule. As explained in the preamble
section discussing § 450.101(c), the
NPRM defined ‘‘vehicle response mode’’
as a mutually-exclusive scenario that
characterizes foreseeable combinations
of vehicle trajectory and debris
generation. The final rule is less
prescriptive by requiring that an
operator account for reasonably
foreseeable hazardous events, instead of
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79616
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
each foreseeable combination of vehicle
trajectory and debris generation.
Accounting for reasonably foreseeable
hazardous events in a functional hazard
analysis is consistent with common
industry standards. This change also
means the FAA does not adopt the
proposed definition of ‘‘vehicle
response mode’’ in § 401.7.
Blue Origin also requested
clarification from the FAA on its
interpretation of the requirement
proposed in § 450.105(a)(8) to provide
‘‘a timeline of all safety-critical events.’’
Blue Origin noted that it interprets
‘‘safety’’ to mean meeting the collective
and individual risk requirements for
launch and reentry and, in essence,
suggested that the PSA should be
limited in scope based on the collective
risk criteria resulting from the FSA.
The FAA does not agree with Blue
Origin’s interpretation nor with its
suggestion that this requirement, now in
§ 450.107(b)(3) in the final rule, be
limited by the results of FSA. The FAA
will consider any event that occurs
during a phase of flight of a launch or
reentry vehicle that meets the definition
of ‘‘safety critical’’ in § 401.7 to be a
‘‘safety-critical event.’’
As noted earlier, proposed § 450.105
would have required that every operator
conduct and document a PSA for the
flight of a launch or reentry vehicle and
submit its results. Virgin Galactic
inquired as to when the PSA would be
due to the FAA, as well as the timeline
for the review. The final rule replaces
the requirement to conduct a PSA with
the requirement to conduct a functional
hazard analysis in § 450.107(b). The
application requirements for
§ 450.107(b) are in § 450.107(d) and are
due with the application, even though a
launch or reentry operator will conduct
the functional hazard analysis early in
the design phase, well before it applies
for a license. This approach is
consistent with Blue Origin’s
recommendation that the analysis be
limited to analyzing and identifying all
functional failures that could have the
capability to create a hazard to the
public, rather than analyzing the
detailed design, which may still be
maturing. As such, in the final rule an
applicant is required to provide the
results of the functional hazard analysis,
including all functional failures, the
identification of all safety-critical
systems, and a timeline of all safetycritical events.
h. Flight Abort (§ 450.108)
As discussed, if an operator cannot
ensure by means other than flight
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
abort 89 that it has sufficiently protected
against a high consequence event (as
measured by CEC), the only remaining
way to satisfy § 450.101(c) is to use
flight abort consistent with the
requirements in § 450.108.
In the NPRM, the FAA proposed to
address flight abort in several sections.
As proposed, to implement flight abort
as a hazard control strategy, an operator
would have been required to:
(1) Establish flight safety limits and gates
in accordance with proposed §§ 450.123
(Flight Safety Limits Analysis) and 450.125
(Gate Analysis);
(2) establish when an operator must abort
a flight following the loss of vehicle tracking
information with proposed § 450.127 (Data
Loss Flight Time and Planned Safe Flight
State Analyses);
(3) establish the mean elapsed time
between the violation of a flight abort rule
and the time when the FSS is capable of
aborting flight for use in establishing flight
safety limits in accordance with proposed
§ 450.129 (Time Delay Analysis);
(4) establish flight abort rules in
accordance with § 450.165(c) (Flight Abort
Rules); and
(5) employ an FSS in accordance with
§ 450.145 and software in accordance with
§ 450.111.
consequence events are possible but
would not be effectively mitigated by an
FSS. In addition, the flight abort rule
requirements proposed in § 450.165(c)
have been revised and relocated to
§ 450.108(f) to reflect the revisions to
the flight safety limits requirements.
The FAA also moves the reference to
FSS reliability from proposed
§ 450.101(c) to § 450.108(b).
The FAA will provide guidance to
illustrate how operators may
demonstrate compliance with these
requirements. The guidance will
encompass many of the traditional
means of developing flight safety limits,
but operators can develop other means
of demonstrating compliance with the
performance-based objectives and
constraints. As discussed in more detail
throughout this section of the preamble,
the revisions in the final rule allow for
greater flexibility for operators while
maintaining the same level of safety as
proposed in the NPRM.
i. FSS Thresholds Using CEC
Many of these requirements were
derived from existing requirements in
part 417 and retained a more
prescriptive approach to flight abort
than the final rule adopts.
Blue Origin, CSF, and SpaceX
commented that the FSA requirements
in proposed §§ 450.117 through 450.141
were too prescriptive and should be
replaced with a performance standard.
The commenters cited a lack of
flexibility and the use of an approach
directed at large orbital launches from
Federal launch or reentry sites.
In the final rule, the FAA consolidates
the requirements for flight abort in
§ 450.108 and revises the more
prescriptive requirements from the
proposal into a single performancebased regulation. As a result of this
consolidation, proposed §§ 450.123,
450.125, 450.127, and 450.129 are not
included in the final rule. The
requirements in these sections have
been revised to reflect the performancebased standards in § 450.108(c), which
establishes flight safety limits
objectives, and § 450.108(d), which
establishes flight safety limits
constraints. The FAA adds § 450.108(e)
in the final rule to relieve the operator
from the requirement to use flight abort
in certain situations in which high
In the NPRM, an operator required to
use flight abort under proposed
§ 450.101(c) was referred to proposed
§ 450.145 to determine the required
reliability of its FSS based on CEC.
Section 450.145(a)(1) proposed to
require an operator to employ an FSS
with design reliability of 0.999 at 95
percent confidence and commensurate
design, analysis, and testing if the
consequence of any vehicle response
mode is 1 × 10¥2 CEC or greater. This
is the reliability standard for a highly
reliable FSS under part 417. Section
450.145(a)(2) proposed to require that, if
the consequence of any vehicle response
mode is between 1 × 10¥2 and 1 × 10¥3
CEC for uncontrolled areas, an operator
must employ an FSS with a design
reliability of 0.975 at 95 percent
confidence and commensurate design,
analysis, and testing. The FAA
explained that, for operations for which
the consequence of a flight failure is
less, an FSS—while still being reliable—
may not need to be as highly reliable as
an FSS for a vehicle operating in an area
where the consequence of a flight failure
is higher.90
In the final rule, the CEC thresholds
for establishing the reliability or other
requirements for an FSS proposed in
§ 450.145(a) have been moved to
§ 450.108(b). The requirements for a
highly reliable FSS proposed in
89 As discussed, § 450.101(c)(2) and (c)(3) allow
an operator to demonstrate it can sufficiently
protect against a high consequence event through
other means that reduce CEC below 1 × 10¥3 or
through demonstrated reliability.
90 The FAA anticipated that this proposed
relaxation of the FSS reliability requirements would
be applicable to operations launching or reentering
in remote locations or for stages that do not overfly
population centers. 84 FR 15328.
PO 00000
Frm 00052
Fmt 4701
Sfmt 4700
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
§ 450.145(a)(1) remain in § 450.145.91
However, the requirements for an FSS
proposed in § 450.145(a)(2) have been
revised and relocated to § 450.143.92
Rocket Lab agreed with the concept of
quantifying consequence as a key metric
in determining the reliability of a flight
abort system. Other commenters were
critical of the proposed use of CEC
thresholds to set reliability standards for
any required FSS, particularly in
situations in which a lower reliability
FSS may be sufficient to protect the
public. For example, SpaceX
commented that the requirement in RCC
319 for an FSS with 0.999 at 95 percent
confidence reliability was overly
prescriptive for low-risk mission
profiles. CSF noted that, by ‘‘binning’’
the CEC of a vehicle and then
prescribing a fixed reliability
requirement for the FSS, risk of an
unmitigated (by FSS) CEC event was not
consistent. CSF commented that such an
approach requires the same FSS even
though the risk varies by an order of
magnitude between the extreme values.
Several other commenters, including
CSF and Sierra Nevada commented that
the FAA should not preclude applicants
from making a ‘‘safety case’’ to justify a
certain level of rigor for their FSS.
As noted in the discussion of
§ 450.101(c), the FAA has retained CEC
as the appropriate regulatory standard
for measuring high consequence events.
Likewise, for the reasons set forth in
that section of the preamble, the FAA
has retained the use of CEC in
§ 450.108(b) to determine the level of
reliability required for an FSS. However,
in response to comments, the FAA has
added flexibility for FSS that do not
need to meet the standard for highly
reliable FSS in proposed § 450.145(a)(1)
based on the CEC. The FAA notes that
an operator does not need to calculate
CEC for the purposes of determining
reliability under § 450.108(b) if it elects
to use a highly reliable FSS that meets
the requirements of § 450.145.
In the final rule, the FAA removes the
prescribed reliability threshold
proposed in § 450.145(a)(2) of the NPRM
for operations with a maximum CEC
value between 1 × 10¥2 and 1 × 10¥3.
Accordingly, an operator does not need
to employ an FSS with a design
reliability of 0.975 at 95 percent
confidence and commensurate design,
analysis, and testing. Rather, under
§ 450.108(b)(2), an operator must use an
91 The
reliability requirements for a highly
reliable FSS will be discussed later in the preamble
in the section pertaining to § 450.145.
92 The reliability requirements for an FSS that is
not required to meet the standard for highly reliable
FSS will be discussed later in the preamble in the
section pertaining to § 450.143.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
FSS that meets the requirements of
§ 450.143 if the consequence of any
reasonably foreseeable failure mode in
any significant period of flight is
between 1 × 10¥2 and 1 × 10¥3 CEC for
uncontrolled areas.
The requirements for the two types of
FSS, as well as the removal of the
proposed requirements, are discussed in
more detail later in this preamble in the
discussion of §§ 450.143 and 450.145.
ii. Flight Safety Limits Objectives
Proposed § 450.123(a) stated an FSA
must identify the location of
uncontrolled areas and establish flight
safety limits that define when an
operator must initiate flight abort to: (1)
Ensure compliance with the safety
criteria of § 450.101; and (2) prevent
debris capable of causing a casualty
from impacting in uncontrolled areas if
the vehicle is outside the limits of a
useful mission.
The introductory language of
§ 450.108(c) is a revision of proposed
§ 450.123(a).93 In the final rule,
§ 450.108(c), titled ‘‘Flight Safety Limits
Objectives,’’ requires an operator to
determine and use flight safety limits
that define when an operator must
initiate flight abort if the conditions
enumerated in § 450.108(c)(1) through
(c)(5) are met. Alternatively, an operator
could meet § 450.108(c)(6) to satisfy the
requirements of § 450.108(c)(2) and
(c)(4).
The following sections provide
additional detail on the performancebased flight safety limits objectives
derived from the more prescriptive
requirements proposed in the NPRM
and respond to public comments on the
proposals in the NPRM to the extent
they are relevant to compliance with the
final rule.
Section 450.108(c)(1)
Section 450.108(c)(1) requires that an
operator initiate flight abort to ensure
compliance with the safety criteria of
§ 450.101(a) and (b). The FAA proposed
a related requirement in § 450.123(a)(1),
which stated that an FSA must identify
the location of uncontrolled areas and
establish flight safety limits that define
when an operator must initiate flight
abort to ensure compliance with the
safety criteria of § 450.101. In the final
rule, § 450.108(c)(1) specifies the
relevant subparagraphs in § 450.101 to
93 The FAA has not included in the final rule the
language in § 450.123(a) that would have required
the operator to identify the location of uncontrolled
areas. The FAA finds it is unnecessary to specify
this language in the introductory paragraph of
§ 450.108(c) because an operator must identify the
location of uncontrolled areas to meet the objectives
of § 450.108(c)(2) through (6).
PO 00000
Frm 00053
Fmt 4701
Sfmt 4700
79617
which this requirement applies. The
FAA makes this change in the final rule
because the requirement in
§ 450.101(c)(1) is met through use of
flight abort as a hazard control strategy,
and § 450.101(d), (e), and (f) are not
relevant to flight abort.
Section 450.108(c)(2)
In the NPRM, proposed
§ 450.123(a)(2) required the operator to
prevent debris capable of causing a
casualty from impacting in uncontrolled
areas if the vehicle is outside the limits
of a useful mission. In the final rule,
§ 450.108(c)(2) requires that an operator
initiate flight abort to prevent continued
flight from increasing risk in
uncontrolled areas if the vehicle is
unable to achieve a useful mission.
Although proposed § 450.123(a)(2)
focused on debris impacts in
uncontrolled areas to define when an
operator must initiate flight abort,
§ 450.108(c)(2), as finalized,
acknowledges that debris impact is not
the only risk contributor that must be
accounted for in determining flight
safety limits. For example, a release of
toxic propellant following a debris
impact may also contribute to risk.
Therefore, in § 450.108(c)(2), an
operator must determine and use flight
safety limits to prevent continued flight
from increasing risk once a vehicle can
no longer achieve a useful mission. The
FAA recognizes that a vehicle may
deviate from the limits of a useful
mission during a period when hazard
containment through flight abort is not
possible. In this case, the requirement is
not to allow continued flight to increase
risk, though some risk from either flight
abort or continued flight may be
unavoidable.
For example, a vehicle may begin an
unplanned turn away from a nominal
trajectory while overflying an island.
Once the vehicle leaves the limits of a
useful mission, the operator should
initiate flight abort if continued flight
would result in an increase in risk.
Pursuant to § 450.108(c)(2), depending
on the risk to the public, it may be better
to withhold flight abort until the
hazards resulting from the abort would
not affect the island. However, if the
turn is towards a major population
center on the island, it may pose less of
a risk to the public to abort the flight as
soon as it leaves the limits of a useful
mission, even if it might result in a
hazard posed to less-dense populated
areas.
E:\FR\FM\10DER2.SGM
10DER2
79618
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
The concepts of ‘‘useful mission’’ and
‘‘limits of a useful mission’’ 94 are
discussed in greater detail in the
preamble section on FSA methods
(specifically, in § 450.119 (Trajectory
Analysis for Malfunction Flight)).
The FAA also notes that the
maximum extents of a gate,95
determined by the limits of a useful
mission in proposed § 450.125(c)(2), are
addressed by § 450.108(c)(2) in the final
rule, which requires flight abort to
prevent continued flight from increasing
risk in uncontrolled areas if the vehicle
is unable to achieve a useful mission.
Therefore, trajectories outside the limits
of a useful mission that intersect flight
safety limits that prevent increased risk
in uncontrolled areas must trigger flight
abort.
Virgin Galactic recommended that the
term ‘‘prevent’’ in proposed
§ 450.123(a)(2) be qualified, as it could
be taken to mean many probabilistic
values. Although proposed
§ 450.123(a)(2) has been removed from
the final rule, § 450.108(c) uses the term
‘‘prevent’’ in five places including
§ 450.108(c)(2). In § 450.108 (c)(2), (3),
(5), and (6), prevention is dependent on
the proper functioning of the FSS. There
is no expectation that these objectives
will be met if the FSS fails to function
properly. In § 450.108(c)(4), when the
reliability of the FSS is accounted for
pursuant to § 450.108(d)(5), prevention
is considered to be achieved.
Section 450.108(c)(3)
jbell on DSKJLSW7X2PROD with RULES2
As noted earlier, the FAA proposed in
§ 450.125 to establish the requirements
for a gate analysis. The FAA explained
that the primary purpose of gates is to
establish safe locations and conditions
to abort the flight prior to the vehicle
entering a region or condition where it
may endanger populated or other
protected areas if flight were to
continue. A gate should be placed
where a trajectory within the limits of
a useful mission intersects a flight safety
limit as long as that trajectory meets the
risk criteria in § 450.101. In response to
comments that the proposed gate
analysis requirements created confusion
and should be more performance-based,
§ 450.125 is not included in the final
rule.
94 A useful mission means a mission that can
attain one or more objectives. Limits of a useful
mission means the trajectory data or other
parameters that bound the performance of a useful
mission, including flight azimuth limits.
95 A gate is an opening in a flight safety limit
through which a vehicle may fly, provided the
vehicle meets certain pre-defined conditions such
that the vehicle performance indicates an ability to
continue safe flight. Gate analysis has been removed
from the final rule.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
In the final rule, the concept of gate
analysis in proposed § 450.125 is
captured in a more performance-based
manner in § 450.108(c)(3).96 Section
450.108(c)(3) requires that an operator
initiate flight abort to prevent the
vehicle from entering a period of
materially increased public exposure in
uncontrolled areas, including before
orbital insertion, if a critical vehicle
parameter is outside its pre-established
expected range or indicates an inability
to complete flight within the limits of a
useful mission. The FAA removes the
term ‘‘gate’’ in the final rule to allow
operators to use another method to
comply with the requirements.
Furthermore, the term ‘‘gate’’ can have
different meanings within the industry,
which can cause confusion. However,
although the term ‘‘gate’’ is not used in
the final rule, the FAA expects a similar
approach to a gate analysis will be used
by many operators and by Federal
launch or reentry sites. With the
removal of explicit gate requirements,
the term ‘‘tracking icon’’ is no longer
required, and the FAA therefore
removes the term from the final rule.
The FAA notes that a period of
materially increased public exposure
would include the beginning of a period
when the vehicle will overfly a major
landmass prior to orbital insertion (e.g.,
Europe, Africa, or South America).
Overflight of large islands with
substantial population may also
constitute a period of materially
increased public exposure, while
overflight of islands with small
populations or other areas of sparse
population will not constitute a period
of materially increased public exposure.
Consequence may be used to determine
if an exposed area should be considered
an area of materially increased public
exposure. Orbital insertion also results
in a material increase in public
exposure due to the possibility of a
random reentry from a vehicle that
cannot achieve a minimum safe orbit. A
vehicle intended for orbit that cannot
achieve a minimum safe orbit would
require flight abort under
§ 450.108(c)(3). The FAA will provide
guidance on what constitutes materially
increased public exposure.97
The FAA notes that, for purposes of
§ 450.108(c)(3), a ‘‘critical vehicle
parameter’’ is a parameter that
demonstrates the vehicle is capable of
completing safe flight through the
96 The performance-based requirement in
§ 450.108(c)(3) incorporates elements of proposed
§ 450.125(a), (b)(1), (b)(2), and (b)(4).
97 For example, a period of materially increased
public exposure would include any area where the
CEC from any on-trajectory failure mode is greater
than 1 × 10¥2.
PO 00000
Frm 00054
Fmt 4701
Sfmt 4700
upcoming phase of flight for which
population is exposed to hazardous
debris effects from reasonably
foreseeable failure modes. An example
of a critical vehicle parameter outside
its pre-established expected range is a
tank pressure that is higher than the
normal operating range and could lead
to a rupture. An example of a critical
vehicle parameter that indicates an
inability to complete flight within the
limits of a useful mission is an
acceleration that is too low and would
result in a vehicle failing to reach orbit.
The operator must select parameters and
their acceptable ranges that are
appropriate for the vehicle and mission,
with consideration of the ability to
measure and act on the parameters, and
describe in the application the
parameters that will be used and how
their ranges were determined, pursuant
to the application requirement in
§ 450.108(g)(3).
The intent of the gate analysis in
proposed § 450.125 was to prevent
unnecessarily exposing the public to
hazards from a mission that can no
longer be useful. Proposed § 450.125(a)
required that an FSA include a gate
analysis for an orbital launch or any
launch or reentry where one or more
trajectories that represent a useful
mission intersect a flight safety limit
that provides containment of debris
capable of causing a casualty. Gate
analysis was necessary if a vehicle on a
useful mission needed to fly in an area
where population could be exposed to
hazards in the event of a vehicle failure.
As long as a trajectory met the
individual and collective risk criteria of
§ 450.101(a)(1) and (a)(2) for a launch, or
(b)(1) and (b)(2) for a reentry, when
treated like a nominal trajectory with
normal trajectory dispersions, the flight
safety limit with which it intersected
would be removed (or ‘‘relaxed,’’ as
described in the NPRM),98 so flight of
the vehicle would not be aborted.
Alternatively, under proposed
§ 450.125(b)(1), the flight safety limit
could be replaced with a gate that
allowed continued flight as long as a
real-time measure of performance
indicated that the vehicle was able to
complete a useful mission.
Section 450.108(c)(3) achieves the
intent in proposed § 450.125(a) because
it codifies the goals achieved by gate
analysis but allows for alternative
approaches to achieve the same
objective. Similar to the gate analysis in
proposed § 450.125(a), the analysis in
§ 450.108(c)(3) is required when a
trajectory that represents a useful
98 See
E:\FR\FM\10DER2.SGM
84 FR 15386.
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
mission approaches an uncontrolled
area.
Proposed § 450.125(b)(1) required that
a gate analysis establish a relaxation of
the flight safety limits that allows
continued flight or a gate where a
decision will be made to abort the
launch or reentry or allow continued
flight. This proposed requirement is
addressed in § 450.108(c)(3) because it
also either allows continued flight
without a check of critical vehicle
parameters if the upcoming population
exposure is not materially increased, or
requires a check of critical vehicle
parameters before continued flight if the
upcoming population exposure is
materially increased. In this respect, the
final rule provides clarity on the point
at which the check of critical vehicle
parameters is required, whereas the
proposal was ambiguous on when a gate
would be required.
Proposed § 450.125(b)(2) stated that, if
a gate is established, a gate analysis
must include a measure of performance
at the gate that enables the flight abort
crew or autonomous FSS to determine
whether the vehicle is able to complete
a useful mission or abort the flight if it
is not. In the final rule, this requirement
is addressed in § 450.108(c)(3), which
states, ‘‘if a critical vehicle parameter is
outside its pre-established expected
range or indicates an inability to
complete flight within the limits of a
useful mission.’’ The pre-established
expected range of the critical vehicle
parameters are those values that do not
predict the vehicle will fail or exit the
limits of a useful mission, or simply
those that indicate the vehicle is
performing as intended. Accordingly, as
with gate analysis under the proposal,
the operator will establish the measure
of performance—referred to as the
critical vehicle parameter(s) and preestablished expected range(s) in the
final rule—that will determine whether
flight abort must be initiated.
Proposed § 450.125(b)(4) stated that a
gate analysis must establish, for an
orbital launch, a gate at the last
opportunity to determine whether the
vehicle’s flight is in compliance with
the flight abort rules and can make a
useful mission, and to abort the flight if
it is not. This requirement is addressed
by the § 450.108(c)(3) requirement that
critical vehicle parameters must be
checked before orbital insertion.
Therefore, § 450.108(c)(3) is a more
performance-based requirement that is
consistent with the proposed
§ 450.125(b)(4).
The FAA notes that certain concepts
in proposed § 450.125 are also captured
in § 450.108(c)(2), (c)(4), and (d)(7), as
discussed in the preamble associated
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
with those sections. The FAA finds that
the intent of the proposed gate analysis
requirements would be clearer if these
requirements are included as separate
flight safety limits objectives and
constraints because they can also be
applied outside of a traditional gate
analysis.
The FAA received several comments
on proposed § 450.125 focused on the
proposed definition of the term ‘‘gate,’’
the prescriptive nature of the
requirements for a gate analysis, and the
manner in which gates would be
applied. Boeing, Lockheed Martin,
Northrop Grumman, and ULA
commented that the gate analysis must
establish a relaxation of the flight safety
limits that allows continued flight or a
gate where a decision will be made to
abort the launch or reentry or allow
continued flight. The commenters
asserted that flight rules and placards
can constrain allowable trajectories, and
that it is appropriate to disapprove a
trajectory if the nominal trajectory is
beyond the flight safety limits. The FAA
declined to make the recommended
change because § 450.108(c)(3) allows a
nominal vehicle to overfly a populated
area, which is current practice. A flight
safety limit that intersects the nominal
trajectory trace can only be enforced if
the vehicle has experienced a
malfunction before reaching the limit.
These limits are common, such as gates
protecting downrange landmasses
before overflight.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA recommended
replacing ‘‘flight abort’’ with ‘‘flight
termination’’ to distinguish between a
flight abort for a reason unrelated to
public safety. The FAA did not adopt
this change because the term ‘‘flight
abort’’ is meant to encompass hazard
control strategies that may not include
destruction of a vehicle or termination
of thrust. For example, flight abort for a
captive carry mission may entail
aborting the mission and returning to
base or landing at a contingency site.
The FAA finds that the term ‘‘flight
termination’’ has connotations that are
inconsistent with the FAA’s intent.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA requested
clarification on the term ‘‘relaxation of
a flight safety limit’’ in the NPRM and
questioned whether it is appropriate for
an operator to relax a flight safety limit.
The FAA agrees that the proposed
language ‘‘relaxation of a flight safety
limit’’ lacked clarity and that the
regulation should be clear about when
a vehicle may overfly population
without a performance check. The final
rule removes terms related to relaxed
flight safety limits and states in
PO 00000
Frm 00055
Fmt 4701
Sfmt 4700
79619
§ 450.108(c)(3) that the critical vehicle
parameter check is required prior to
entering a period of materially increased
public exposure in uncontrolled areas,
including before orbital insertion. The
meaning of ‘‘materially increased public
exposure’’ is discussed earlier in this
section.
Rocket Lab inquired whether a gate
analysis is required for when a
trajectory intersects a flight safety limit,
if an operator was using flight abort only
as a hazard control strategy.
In the final rule, pursuant to
§ 450.108(c)(3), this performance check
is not necessary if the vehicle is not
approaching an area of materially
increased public exposure regardless of
how the operator develops flight safety
limits, as long as it meets requirements
in § 450.108(c) and (d). The FAA also
notes that if flight abort is not required
as a hazard control strategy to meet the
safety criteria of § 450.101, an operator
may still choose to use flight abort at its
discretion. Compliance with
§ 450.108(c)(3) is only required for an
operator required to use flight abort as
a hazard control strategy to meet the
safety criteria of § 450.101.
Section 450.108(c)(4)
As noted earlier, proposed
§ 450.125(c) would have required the
extent of any gate or relaxation of the
flight safety limits to be based on
normal trajectories, trajectories that may
achieve a useful mission, collective risk,
and consequence criteria. Section
450.108(c)(4) in the final rule is related
to proposed § 450.125(c)(1) and (c)(2) in
that it describes the consequence
requirements for flight safety limits;
however, it contains differences as
explained in this section of the
preamble.
In the final rule, § 450.108(c)(4)
requires that an operator initiate flight
abort to prevent conditional expected
casualties greater than 1 × 10¥2 in
uncontrolled areas due to flight abort or
due to flight outside the limits of a
useful mission from any reasonably
foreseeable off-trajectory failure mode
initiating in any significant period of
flight. The purpose of § 450.108(c)(4) is
to ensure that, when an operator cannot
develop flight safety limits that prevent
hazards from affecting uncontrolled
areas, the failure modes that result in
deviations from the planned trajectory
will not result in a high consequence
event if the vehicle is unable to achieve
a useful mission. This scenario can arise
when some public exposure must be
accepted to allow useful vehicles to
continue during a phase of flight when
flight abort is still used as a hazard
control strategy.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79620
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
This situation frequently occurs, for
example, on northeasterly missions
launched from the Eastern Range that
are permitted to overfly some portions
of Nova Scotia and Newfoundland on
trajectories within the limits of a useful
mission. If the vehicle fails after the
overflight has begun and reaches flight
safety limits protecting more westerly
portions of the uncontrolled areas from
flight outside the limits of a useful
mission, the consequence from flight
abort must meet the criteria in
§ 450.108(c)(4).
Proposed § 450.125(c)(1) and (c)(2)
included the consequence requirements
as a part of gate analysis. In the final
rule, the consequence requirements are
a standalone flight safety limits
objective in § 450.108(c)(4). The final
rule also makes several revisions. First,
the final rule expressly states flight
safety limits are required only to
prevent high consequence events in
uncontrolled areas. This concept was
implied in the NPRM because, per
proposed § 450.123(a)(2), flight safety
limits must prevent debris capable of
causing a casualty from impacting in
uncontrolled areas if the vehicle is
outside the limits of a useful mission.
The consequence criteria in proposed
§ 450.125(c)(1) and (c)(2) were
applicable to flight safety limits that did
not prevent debris from impacting in
uncontrolled areas following a gate or
relaxation in a flight safety limit
developed per § 450.123(a)(2).
Therefore, the proposed consequence
criteria only applied to uncontrolled
areas.
Second, the requirement in the final
rule applies in cases of flight abort and
in cases where the vehicle is outside the
limits of a useful mission. The
consequence criteria in proposed
§ 450.125(c)(1) and (c)(2) were only
applicable in cases of flight abort. If
only flight abort action were considered,
a high consequence event resulting from
other outcomes (intact impacts,
structural breakup, etc.) outside the
limits of a useful mission might not be
identified.
Vehicle failures within the limits of a
useful mission are excluded from the
consequence criteria in § 450.108(c)(4)
in the final rule because flight abort
cannot prevent a failure from affecting
uncontrolled areas that must be exposed
to allow a vehicle on a useful mission
to continue flight. For example, if a
vehicle begins an unplanned turn from
the nominal trajectory while overflying
uncontrolled areas and breaks up
aerodynamically before exiting the
limits of a useful mission, this failure
would not count against the
consequence criteria because the vehicle
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
was within the limits of a useful
mission when the outcome of the failure
occurred. Collective risk requirements
still apply in these scenarios and ensure
that the risk is met for any trajectory
that the operator declares as
representing a useful mission, pursuant
to § 450.108(d)(7).
Third, whereas proposed
§ 450.125(c)(1) and (c)(2) concerned the
consequence from flight abort ‘‘resulting
from any reasonable vehicle response
mode,’’ § 450.108(c)(4) concerns the
consequence from any ‘‘reasonably
foreseeable off-trajectory failure mode.’’
The replacement of ‘‘vehicle response
mode’’ with ‘‘failure mode’’ is discussed
in the preamble section on
§ 450.101(c)(2).99 The term ‘‘offtrajectory’’ was added to explain further
which types of failures must result in
the consequence criteria being met. Offtrajectory failures are those for which
the vehicle deviates from its intended
flight path—for example due to failures
of the guidance, navigation, or control
systems. Outcomes from on-trajectory
failures, such as an explosion or loss of
thrust along the intended flight path, are
not able to be fully mitigated by an FSS
because once the failure occurs the
hazard cannot be prevented from
affecting uncontrolled areas if the
failure occurred during a period in
which the uncontrolled areas were
exposed. At best, the hazard can be
reduced for some failure modes such as
a loss of thrust that may result in an
intact impact unless a destructive abort
that disperses propellants is
implemented. In this case, flight abort
may still be required to reduce risk per
§ 450.108(c)(2) since the vehicle is
unable to achieve a useful mission, but
the consequence criteria would not
apply.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA requested
clarification on the intent of the CEC
limits in proposed § 450.125(c)(1) and
(c)(2). In the final rule, the FAA retained
the CEC limits related to flight abort.
The intent of these limits is to ensure
that, when flight abort or a flight outside
the limits of a useful mission resulting
from an off-trajectory failure mode
produces debris capable of causing a
casualty, it nonetheless protects against
a high consequence event. In other
words, flight abort provides sufficient
protection against a high consequence
event when flight abort is implemented
to prevent the CEC from any reasonably
foreseeable off-trajectory failure mode
99 The FAA also notes that the term ‘‘in any onesecond period of flight’’ has been changed
throughout the final rule to the term ‘‘in any
significant period of flight,’’ as described in the
preamble section discussing § 450.101(c).
PO 00000
Frm 00056
Fmt 4701
Sfmt 4700
initiating in any significant period of
flight from exceeding 1 × 10¥2
casualties, even though the public in
uncontrolled areas might be exposed to
debris from a flight abort.
SpaceX asked if there were
restrictions to using flight safety limits
that met the risk requirements of
proposed § 450.101 but did not meet the
1 × 10¥2 CEC requirement.
Under § 450.108(c)(4), flight safety
limits must not allow CEC greater than
1 × 10¥2 unless the consequence
resulted from a vehicle within the limits
of a useful mission and therefore could
not be mitigated by flight abort without
aborting a vehicle on a useful mission,
or the consequence resulted from an ontrajectory failure mode.
An example of when the consequence
requirement would not apply is when a
vehicle on a normal trajectory suffers a
spontaneous breakup. This on-trajectory
event cannot be mitigated by flight abort
without terminating a useful vehicle
before it overflies uncontrolled areas.
An operator would not be required to
initiate flight abort under the final rule
for this scenario. An example of when
the consequence requirement would
apply is if a malfunction causes the
vehicle to depart from the limits of a
useful mission. If CEC is used to
measure high consequence events, the
flight safety limits must prevent the
consequence from such a failure mode
(i.e., a malfunction that causes the
vehicle to depart from the limits of a
useful mission) from exceeding 1 × 10¥2
CEC, whether produced by flight abort
or other reasonably foreseeable
outcomes (such as aerodynamic/
structural breakup, intact impact, etc.).
SpaceX requested guidance on how
an operator should balance EC and CEC
when designing flight safety limits and
expressed concern that EC may increase
as an operator attempts to reduce CEC.
SpaceX also recommended removing all
numerical values associated with CEC
and requiring the consequence of flight
abort at the flight safety limits to be
minimized.
Regarding the balance of EC and CEC,
the FAA notes that flight safety limits
must be designed to meet the EC and
CEC requirements as described in
§ 450.108(c)(1) and (c)(4), respectively.
If the flight safety limits must be
modified to reduce the CEC to
acceptable levels, EC must still be kept
within acceptable levels. The FAA does
not agree with the recommendation to
remove the numerical value associated
with the CEC requirement because this
could allow flight safety limits that
result in a high consequence through
flight abort or through flight abort
inaction. However, the final rule does
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
allow for methods of measuring
consequence other than CEC that
provide an equivalent level of safety
under § 450.37.
Section 450.108(c)(5)
Section 450.108(c)(5) requires that an
operator initiate flight abort to prevent
the vehicle state from reaching
identified conditions that are
anticipated to compromise the
capability of the FSS if further flight has
the potential to violate a flight safety
limit. For example, if a roll rate of a
particular magnitude would preclude
ground-based flight abort commands
from being received by the vehicle, a
flight safety limit should be developed
that triggers flight abort before the roll
rate reaches this value.
Section 450.108(c)(5) is related to the
flight abort rule in proposed
§ 450.165(c)(3)(ii), which required that
flight abort rules include that the FSS
must abort flight when the vehicle state
approaches conditions that are
anticipated to compromise the
capability of the FSS and further flight
has the potential to violate the FSS. In
the NPRM, the FAA did not include a
flight safety limit objective that
corresponded with the flight abort rule
in proposed § 450.165(c)(3)(ii). The FAA
adds this flight safety limit objective in
§ 450.108(c)(5). The flight abort rule in
proposed § 450.165(c)(3)(ii) is in
§ 450.108(f)(2)(ii) and is discussed
further under Flight Abort Rules in the
following paragraphs.
jbell on DSKJLSW7X2PROD with RULES2
Section 450.108(c)(6)
Section § 450.108(c)(6) states that, in
lieu of meeting § 450.108(c)(2) and
§ 450.108(c)(4), an operator may initiate
flight abort to prevent debris capable of
causing a casualty due to any hazard
from affecting uncontrolled areas using
an FSS that complies with § 450.145.
The FAA adds this regulation to clarify
that a CEC analysis is not required if an
FSS that complies with § 450.145
provides hazard containment. Hazard
containment is a means of achieving the
goals of § 450.108(c)(2) and (c)(4)
because, if an operator provides for
hazard containment, continued flight
will not increase risk in uncontrolled
areas and hazard containment would
prevent conditional expected casualties
greater than 1 × 10¥2 in uncontrolled
areas. This requirement is consistent
with the NPRM because if an operator
is able to contain hazards throughout
the period when flight abort is used, the
proposed consequence requirements in
§ 450.125(c)(1) and (c)(2) would not
apply since a gate analysis would not be
necessary.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
In developing the NPRM, the FAA
considered alternatives to a conditional
risk limit, including the current
approach employed in § 417.213.100 The
FAA rejected using the approach in
§ 417.213 as a requirement in part 450
because it is unnecessarily restrictive to
require designated impact limit lines to
bound the area where debris with a
ballistic coefficient of three pounds per
square foot or more is allowed to impact
if the FSS functions properly, as
evidenced by the need for the FAA to
grant waivers to allow innovative
missions to proceed safely, such as
return of boosters to the launch site.101
However, if an operator satisfies the
current requirements in § 417.213, it
would meet the requirement in
§ 450.108(c)(6). This strategy is not an
option when hazard containment is not
possible during a phase of flight when
flight abort must be used as a hazard
control strategy. For example, if an area
of overflight occurs on the nominal
trajectory during a phase of flight when
flight abort is still used as a hazard
control strategy, an operator cannot
claim containment during this phase
and must meet § 450.108(c)(2) and
(c)(4). The FAA notes that its approach
in § 450.108(c) to employing conditional
risk limits is consistent with a
recommendation made by the National
Academy of Sciences.102
Virgin Galactic recommended adding
an exclusion to the requirement for
flight safety limits in proposed
§ 450.123 for vehicles that already meet
100 The FAA currently requires in § 417.213 that
‘‘a flight safety analysis must identify the location
of populated or other protected areas, and establish
flight safety limits that define when an FSS must
terminate a launch vehicle’s flight to prevent the
hazardous effects of the resulting debris impacts
from reaching any populated or other protected area
and ensure that the launch satisfies the public risk
criteria.’’
101 See Waiver of Debris Containment
Requirements for Launch. 81 FR 1470, 1470–1472
(January 12, 2016).
102 In 2001, the National Research Council
published a report on ‘‘Streamlining Space Launch
Range Safety,’’ which included a recommendation
that ‘‘destruct lines and flight termination system
requirements should be defined and implemented
in a way that is directly traceable to accepted risk
standards.’’ See p. 44 of IBSN 0–309–51648–X
available at https://www.nap.edu/catalog/9790.html.
The flight safety limit requirements currently in
§ 417.213(d) are not directly traceable to accepted
risk standards in that they require the analysis to
‘‘establish designated impact limit lines to bound
the area where debris with a ballistic coefficient of
three or more is allowed to impact if the flight
safety system functions properly.’’ As noted earlier,
the approach in § 417.213 has been rejected because
it is unnecessarily restrictive, as evidenced by the
need for the FAA to grant waivers to allow
innovative missions to proceed safely, such as
return of boosters to the launch site. The FAA
found that those waivers did not jeopardize public
safety based on conditional risk analyses that are
inherent in methods the NAS referred to as
accepted risk standards.
PO 00000
Frm 00057
Fmt 4701
Sfmt 4700
79621
the public risk criteria, as flight safety
limits analysis amounts to an additional
layer of regulation that Virgin Galactic
believed was redundant and unneeded.
The FAA determined that a
clarification is required in response to
this recommendation. Pursuant to
§ 450.108(a), flight safety limits are only
required in phases of flight in which
flight abort is used as a hazard control
strategy to meet the safety criteria of
§ 450.101. The FAA does not agree that
meeting public risk criteria, or just
collective and individual risk, are the
only objectives of flight abort, as
explained in the preamble section on
CEC. The FAA finds it necessary to
include additional objectives for flight
abort in § 450.108(c) to protect public
safety adequately. Lastly, the preamble
section on CEC describes why a
conditional risk assessment is
appropriate to provide the public
protection from unlikely but
catastrophic events in the context of
launch and reentry operations.
iii. Flight Safety Limits Constraints
Section 450.108(d) in the final rule
describes flight safety limits constraints.
This subsection consolidates the flight
safety limits constraints in proposed
§§ 450.123 through 450.129.
Section 450.108(d)(1)
Proposed § 450.123(b)(1) required
flight safety limits to account for
temporal and geometric extents on the
Earth’s surface of any vehicle hazards
resulting from any planned or
unplanned event for all times during
flight.
In the final rule, § 450.108(d)(1)
requires that flight safety limits account
for temporal and geometric extents on
the Earth’s surface of any reasonably
foreseeable vehicle hazards under all
reasonably foreseeable conditions
during normal and malfunctioning
flight. The FAA adds ‘‘reasonably
foreseeable’’ before ‘‘vehicle hazards’’ to
be consistent with language elsewhere
in the regulation. As noted earlier,
‘‘reasonably foreseeable’’ is a term
commonly used in system safety. The
FAA also replaces ‘‘from any planned or
unplanned event for all times during
flight’’ in proposed § 450.123(b)(1) with
‘‘under all reasonably foreseeable
conditions during normal and
malfunctioning flight’’ in
§ 450.108(d)(1). This revision does not
result in a substantive change from the
proposal, but the FAA finds the revised
language to be clearer and consistent
with language elsewhere in the
regulation through use of the term
‘‘reasonably foreseeable conditions’’ in
place of the proposed ‘‘planned or
E:\FR\FM\10DER2.SGM
10DER2
79622
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
unplanned event.’’ This standard does
not hold the operator responsible for
unforeseeable events.
jbell on DSKJLSW7X2PROD with RULES2
Section 450.108(d)(2)
Section 450.108(d)(2) requires that
flight safety limits account for the
physics of hazard generation and
transport including uncertainty. This
articulation represents a revision of
proposed § 450.123(b)(2), which stated
flight safety limits must account for
potential contributions to debris impact
dispersions. The FAA finds the NPRM
language was unclear as to the scope of
the requirement. The NPRM would have
required an operator to consider how
factors like winds, imparted velocities,
and uncertainty in mass properties
affect where debris from a failed vehicle
may impact. However, direct debris
impacts are not the only hazards posed
by vehicle failures. For example, an
intact impact of a vehicle may lead to
a blast wave or release of toxic
propellant, both of which must be
considered when developing flight
safety limits. Hazard generation and
transport are factors that apply to all
hazards, unlike factors that only apply
to determining debris impact
dispersions. Hazard generation refers to
the process by which a vehicle becomes
a hazard, and transport is how the
hazard moves from the source to an
exposed person or asset. Simply
accounting for potential contributions to
debris impact dispersions would not
encompass all hazards, though debris
impact dispersions also need to be
accounted for under § 450.108(d)(2).
Blue Origin requested clarification of
the term ‘‘potential contributions’’ in
proposed § 450.123(b)(2). The FAA
notes the term ‘‘potential contributions’’
to debris impact dispersions are those
that influence the propagation of debris
following a vehicle breakup, such as
explosion-induced velocities, winds,
uncertainty in aerodynamic properties,
etc. The FAA further notes the term
‘‘potential contributions’’ does not
appear in the final rule. The FAA will
address development of debris impact
dispersions in guidance, similar to the
existing Flight Safety Analysis
Handbook.
Section 450.108(d)(3)
In the NPRM, the FAA proposed to
consolidate and update data loss flight
times and planned safe flight states
requirements in proposed § 450.127
(Data Loss Flight Time and Planned Safe
Flight State Analyses). As explained in
the proposal, data loss flight time
analysis is necessary to establish when
an operator must abort a flight following
the loss of vehicle tracking information.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
In the NPRM, the FAA explained that
data loss flight time would be the
shortest elapsed thrusting or gliding
time during which a vehicle flown with
an FSS can move from its trajectory to
a condition in which it is possible for
the vehicle to violate a flight safety
limit. Data loss flight times would have
been required from the initiation of
flight until the minimum elapsed
thrusting or gliding time was no greater
than the time it would take for a normal
vehicle to reach the final gate crossing
or the planned safe flight state.
Section 450.108(d)(3) revises the
prescriptive requirements in § 450.127
to require that flight safety limits
account for the potential to lose valid
data necessary to evaluate the flight
abort rules. Data is valid when it is of
sufficient quality to be used to make
flight abort decisions. Data used to make
flight abort decisions can be missing or
invalid for a number of reasons, but
resulting from an unplanned event, such
as disruption or loss of communication
pathways with ground-based or onboard
tracking sensors. Despite an operator’s
or launch site’s best efforts, the potential
to lose track data is a contingency for
which operators must plan.
Section 450.108(d)(3) requires an
operator to account for the potential to
lose valid data necessary to evaluate the
flight abort rules because the loss of
valid data does not absolve the operator
from attempting to meet the flight safety
limits requirements in § 450.108(c) and
(d). Section 450.108(d)(3) captures the
performance-based intent of proposed
§ 450.127 (Data Loss Flight Time and
Planned Safe Flight State Analyses). The
FAA finds that this revision allows for
the use of data loss flight times as a
means of satisfying § 450.108(d)(3), but
also allows operators to propose other
methods of meeting the requirement.
Microcosm and SpaceX requested
clarification of the intent for proposed
§ 450.127. The FAA notes that the
purpose of proposed § 450.127 was to
determine when flight abort is required
if track data used to evaluate the flight
abort rules is lost. If a vehicle is able to
reach a flight safety limit when track
data is lost, then a countdown begins
that would indicate, upon reaching zero,
that a flight safety limit may have been
reached. Under proposed
§ 450.165(c)(3)(iii), flight abort would
have to occur no later than when the
countdown reaches zero. Throughout
flight, the time for the countdown to
reach zero is the data loss flight time. If
reliable tracking sources are regained
before the countdown reaches zero, then
flight abort rule evaluation resumes and
the countdown resets. In Federal launch
PO 00000
Frm 00058
Fmt 4701
Sfmt 4700
site parlance, data loss flight times are
known as ‘‘green numbers.’’
In the NPRM, data loss flight times
would not be used if a vehicle’s tracking
icon has potentially passed a final gate
when the countdown reaches zero
because this could result in introducing
hazards in uncontrolled areas that the
gate protects. As described in proposed
§ 450.127(b)(1), there are no data loss
flight times when the minimum elapsed
thrusting or gliding time is greater than
the time it would take for a normal
vehicle to reach the final gate crossing,
to preclude abort from occurring after a
gate crossing.
Proposed § 450.127(c)(1) through
(c)(3) described other phases of flight
when data loss flight times would be
unnecessary. If a vehicle cannot reach a
flight safety limit, then a data loss flight
time cannot be computed and would be
unnecessary. It may seem futile to have
a flight safety limit that cannot be
reached, but for purposes of data loss
flight times a flight safety limit is
considered unreachable if the vehicle
cannot reach it starting from within
normal trajectory limits when track data
is lost. The flight safety limit may still
be reachable if the vehicle was outside
of normal trajectory limits at the time
data was lost. Therefore, these flight
safety limits may still have value.
Finally, in the NPRM, data loss flight
times would not be necessary in phases
of flight when an FSS is not required.
There may still be flight safety limits
during such phases if an operator
retains an FSS and active flight abort
rules even though they are not required.
Loss of track data would not require
flight abort since the flight safety limits
themselves are unnecessary. This
approach would allow operators to be
conservative in the use of flight safety
limits in phases of flight when they are
unnecessary, with no threat of flight
abort from loss of track data.
Proposed § 450.127(b)(3) would have
permitted the real-time computation
and application of data loss flight times
during vehicle flight, in which case the
state vector just prior to loss of data
should be used as the nominal state
vector. The FAA finds that
§ 450.108(d)(3) provides the same level
of safety as the proposed requirement in
§ 450.127 and provides additional
flexibility. The FAA will provide
guidance on compliance with
§ 450.108(d)(3). The proposed
requirement in § 450.127 can be part of
a viable means of compliance with
§ 450.108(d)(3). An operator may
propose other means of compliance
with § 450.108(d)(3). Microcosm and
SpaceX requested clarification of the
intent for proposed § 450.127. The FAA
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
notes that the purpose of proposed
§ 450.127 was to determine when flight
abort is required if track data used to
evaluate the flight abort rules is lost.
jbell on DSKJLSW7X2PROD with RULES2
Section 450.108(d)(4)
Proposed § 450.129 (Time Delay
Analysis) would have required an
operator to perform a time delay
analysis to establish the mean elapsed
time between the violation of a flight
abort rule and the time when the FSS is
capable of aborting flight for the
purpose of establishing flight safety
limits. The time delay analysis would
have been required to determine a time
delay distribution that accounts for all
foreseeable sources of delay.
While proposed § 450.129 does not
appear in the final rule, the objective of
proposed § 450.129 is captured by
§ 450.108(d)(4). Section 450.108(d)(4)
requires that flight safety limits account
for the time delay, including
uncertainties, between the violation of a
flight abort rule and the time when the
FSS is expected to activate. The term in
the final rule ‘‘time delay including
uncertainties’’ is consistent in intent
with the NPRM language ‘‘mean elapsed
time’’ and ‘‘determine a time delay
distribution.’’
The time delay distribution in
proposed § 450.129 is distribution in a
statistical sense. The uncertainties
referred to in § 450.108(d)(4) are the
same as the time delay distribution
referred to in proposed § 450.129. To
meet § 450.108(d)(4), the operator must
consider the range of values that the
actual time delay could fall between.
While proposed § 450.129 stated that
the time delay analysis would be used
in establishing flight safety limits, the
final rule specifies that the time delay
is a constraint in developing flight
safety limits. Time delays are important
in a flight safety limits analysis because
the decision to abort flight must be
made in time to achieve the flight safety
limits objectives. This is not possible
unless the time delay between the
violation of a flight abort rule and the
time when the FSS is expected to
activate is known. The FAA finds that
including this requirement in the flight
safety limits constraints provides more
clarity regarding the relation between
this requirement and the flight safety
limits.
Section 450.108(d)(5)
Section 450.108(d)(5) requires an
operator to determine flight safety limits
that account for individual, collective,
and conditional risk evaluations both
for proper functioning of the FSS and
failure of the FSS. To satisfy this
requirement, an operator must account
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
for the reliability of the FSS under two
scenarios when determining whether
individual, collective, or conditional
risk requirements are met with the flight
safety limits objectives. The applicable
flight safety limits objectives are located
in § 450.108(c)(1), which addresses
individual and collective risk, and
§ 450.108(c)(4), which addresses
conditional risk. Although
§ 450.108(c)(2) is also associated with
risk, it is independent of the FSS
reliability because it is a comparison
between the risk if the FSS is activated
and the risk if it is not activated.
To comply with § 450.108(d)(5), first,
the FSS must be assumed to have a
reliability of one, meaning it is
presumed to function without error. The
risk evaluations using an FSS reliability
of one ensure that the criteria are met if
the FSS functions as intended. This
requirement is important because an
FSS failure should not be relied upon to
make flight safety limits compliant with
risk requirements. The decision to
implement a flight abort is a deliberate
safety intervention. The FAA wants to
be sure that the public is safe given any
deliberate safety intervention. This
objective is consistent with proposed
§ 450.125(c)(1) and (c)(2), which contain
requirements for consequence from
flight abort, implying that the flight
abort action occurs, and is also
consistent with current practice for all
risk evaluations.
Second, the risk evaluations must
consider the predicted reliability of the
FSS. Predicted reliability of the FSS is
important because even low
probabilities of FSS failures can have
significant impacts on risk. This
consideration is consistent with the
NPRM because FSS reliabilities are a
fundamental component of the viability
of flight abort as a hazard control
strategy, and it is expressly stated in the
final rule for clarity. Consideration of
the FSS reliability in risk evaluations is
also consistent with current practice.
The final rule allows an operator
flexibility to establish the design,
analysis, and testing of its FSS and the
conditions that require initiation of
flight abort as long as the CEC is no
greater than 1 × 10¥2 for any reasonably
foreseeable failure mode in any
significant period of flight that could
require the operator to initiate flight
abort, accounting for the reliability of
the FSS pursuant to § 450.108(d)(5).
Section 450.108(d)(6)
Proposed § 450.123(b)(3) would have
added a requirement to design flight
safety limits to avoid flight abort under
conditions that result in increased
collective risk to people in uncontrolled
PO 00000
Frm 00059
Fmt 4701
Sfmt 4700
79623
areas, compared to continued flight. In
the NPRM, the FAA explained that the
proposed requirement is equivalent to
the U.S. Government consensus
standard that a conditional risk
management process should be
implemented to ensure that mission
rules do not induce unacceptable
consequences when they are
implemented.
Section 450.108(d)(6) requires that
flight safety limits be designed to avoid
flight abort that results in increased
collective risk to the public in
uncontrolled areas, compared to
continued flight. This language is very
similar to proposed § 450.123(b)(3), with
one change. The FAA changes the term
‘‘people’’ in the proposed rule to ‘‘the
public’’ in the final rule because the
FAA regulates the safety of the public.
The term ‘‘people’’ could be construed
as meaning something broader than
‘‘public,’’ such as mission essential
personnel who may be in uncontrolled
areas.
Blue Origin stated that proposed
§§ 450.123(d), 450.125(b)(2), 450.125(c),
and 450.125(c)(3) were in conflict and
commented on the definition of a
‘‘useful mission.’’ Blue Origin explained
that, even though the intent was to meet
the public safety requirements in
proposed § 450.101, terminating a
vehicle that may not meet the definition
of a ‘‘useful mission’’ may result in an
increase in risk to the public, including
those on ships and aircraft, compared to
continued flight that may result in
reaching orbit. Blue Origin commented
that, if the limits were defined only with
respect to the risk criteria in proposed
§ 450.101, allowing the vehicle to
continue flight may result in a safer risk
profile.
The FAA agrees that the risk to the
public must not be increased by flight
abort. However, if a vehicle intended for
orbit is outside the limits of a useful
mission and approaching populated
uncontrolled areas, there is likely an
optimum location to abort the flight
without increasing risk. For launches
where the instantaneous impact point
(IIP) 103 approaches a landmass from the
ocean, aborting flight before the
resulting debris would encroach on the
landmass and dense coastal shipping
traffic would be compliant with
§ 450.108(d)(6). Current practice for
orbital launches from Federal launch
sites is to allow the vehicle to continue
to orbit if it can achieve a minimum safe
orbit and is within the limits of a useful
103 Section 401.5 has a long-standing definition of
IIP: ‘‘instantaneous impact point means an impact
point, following thrust termination of a launch
vehicle, calculated in the absence of atmospheric
drag effects.’’
E:\FR\FM\10DER2.SGM
10DER2
79624
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
mission in the IIP projection. This
practice is consistent with the
requirements in § 450.108. If an operator
proposes to allow a vehicle outside the
IIP limits of a useful mission to overfly
population to proceed to orbit, it must
demonstrate that this option presents
lower risk than aborting the flight before
the overflight begins.
The FAA agrees that a discrepancy
existed in the NPRM in proposed
§ 450.123(d) but is uncertain if this is
the conflict to which Blue Origin
referred. The proposed § 450.123(d)
referred to risk criteria in § 450.101, but
mistakenly omitted the requirement to
prevent debris capable of causing a
casualty from impacting in uncontrolled
areas if the vehicle is outside the limits
of a useful mission. The option to
determine the need for flight abort in
real time as described in proposed
§ 450.123(d) does not appear in the final
rule because it is just one means of
meeting the requirements for flight
safety limits. However, this does not
preclude an operator from determining
the need for flight abort entirely in realtime, as long as requirements in
§ 450.108 are met.
jbell on DSKJLSW7X2PROD with RULES2
Section 450.108(d)(7)
As noted in the section on flight
safety limits objectives, proposed
§ 450.125(c)(1) stated that flight safety
limits would be required to be gated or
relaxed where they intersect with a
normal trajectory if that trajectory
would meet the individual and
collective risk criteria of proposed
§ 450.101(a)(1) and (a)(2) or (b)(1) and
(b)(2) when treated like a nominal
trajectory with normal trajectory
dispersions. Proposed § 450.125(c)(2)
stated that flight safety limits may be
gated or relaxed where they intersect
with a trajectory within the limits of a
useful mission if that trajectory would
meet the individual and collective risk
criteria of proposed § 450.101(a)(1) and
(a)(2) or (b)(1) and (b)(2) when treated
like a nominal trajectory with normal
trajectory dispersions.
In the final rule, § 450.108(d)(7)
requires an operator to determine flight
safety limits that ensure that any
trajectory within the limits of a useful
mission that is permitted to be flown
without abort would meet the collective
risk criteria of § 450.101(a)(1) or (b)(1)
when analyzed as if it were the planned
mission pursuant to § 450.213(b)(2).104
104 As part of pre-flight planning, an operator
must submit to the FAA planned mission
information, including the vehicle, launch site,
planned flight path, staging and impact locations,
each payload delivery point, intended reentry or
landing sites including any contingency abort
location, and the location of any disposed launch
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
The relocation of requirements in
proposed § 450.125 to § 450.108(c)(2)
through (c)(4) and § 450.108(d)(7)
necessitated a revision to the language
in § 450.108(d)(7). Section 450.108(d)(7)
requires only that any trajectory within
the limits of a useful mission that is
permitted to be flown without abort
would meet the collective risk criteria of
§ 450.101(a)(1) or (b)(1) when analyzed
as if it were the planned mission
pursuant to § 450.213(b)(2). As stated in
the NPRM, the philosophy behind
proposed § 450.125(c)(2) was to allow a
non-normal flight to continue as long as
the mission does not pose an
unacceptable conditional risk given the
present trajectory. The intent of
§ 450.108(d)(7) is similar but is stated in
a different context than in the NPRM
and also revised for clarity. In the final
rule, the FAA removes the individual
risk criterion from the requirement
because the intent of the requirement
was not to potentially create flight
hazard areas along every azimuth within
the limits of a useful mission wherever
an individual risk contour exceeds 1 ×
10¥6.
The FAA found that the phrase
‘‘when analyzed as if it were the
planned mission pursuant to
§ 450.213(b)(2)’’ was more precise than
‘‘when treated like a nominal trajectory
with normal trajectory dispersions.’’ A
planned mission must be characterized
with uncertainties and assessed for risk
from planned events and reasonably
foreseeable failure modes; therefore,
trajectories must be within the limits of
a useful mission that are permitted to be
flown without abort, pursuant to
§ 450.108(d)(6).
Boeing, Lockheed Martin, Northrop
Grumman, and ULA recommended
replacing the terms ‘‘normal
trajectories’’ and ‘‘limits of a useful
mission trajectories’’ in proposed
§ 450.123(c) and § 450.125(c) with
‘‘nominal trajectories.’’ The FAA finds
that such a change would restrict
severely the allowable flight corridor of
vehicles that could achieve a potentially
useful mission by requiring that a
vehicle be on a nominal trajectory to
enter a period of materially increased
public exposure in uncontrolled areas.
As such, §§ 450.108(c)(3) and
450.108(d)(7) in the final rule allow
vehicles within the limits of a useful
mission to enter a period of materially
increased public exposure in
uncontrolled areas, provided the
trajectory meets the collective risk
requirement.
or reentry vehicle stage or component that is
deorbited.
PO 00000
Frm 00060
Fmt 4701
Sfmt 4700
iv. End of Flight Abort
The FAA adds § 450.108(e) in the
final rule, which states that a flight does
not need to be aborted to protect against
high consequence events in
uncontrolled areas beginning
immediately after critical vehicle
parameters are validated, if the vehicle
is able to achieve a useful mission and
certain conditions are met for the
remainder of flight. Specifically, the
conditions which must be present are:
(1) Flight abort would not materially
decrease the risk from a high
consequence event, and (2) there are no
key flight safety events. Section
450.108(e) relieves the operator from the
requirement to use flight abort in certain
situations in which high consequence
events are possible but would not be
effectively mitigated by an FSS. This
change responds to comments and
addresses a common occurrence during
a period of planned overflight of an
uncontrolled area before orbital
insertion.
Section 450.108(e) applies to a flight
beginning immediately after critical
vehicle parameters are validated, if the
vehicle is able to achieve a useful
mission. As discussed in the section on
flight safety limits objectives, ‘‘critical
vehicle parameters’’ are those
parameters that demonstrate the vehicle
is capable of completing safe flight
through the upcoming phase of flight
where population is exposed to
hazardous debris effects from
reasonably foreseeable failure modes.
Due to the wide variety of launch and
reentry vehicles that could be licensed,
there is a wide variety of vehicle
parameters that could be considered
critical in this context. For example,
recent state vector history data, as well
as vehicle health indicators such as
motor chamber pressure, generally will
qualify as critical vehicle parameters.
Section 450.108(e) only applies when
the following conditions are met. The
first condition is that flight abort would
not decrease the risk from a high
consequence event materially as
measured by CEC or other means
identified through ELOS. The FAA
expects that the requirement in
§ 450.108(e)(1) can be met by
implementation of the current practices
at the 45th SW, specifically, performing
a comparison of the CEC and EC in
uncontrolled areas with and without
flight abort from each reasonably
foreseeable failure mode in any
significant period of flight during the
subject phase of flight. If flight abort
would not reduce the CEC and EC
associated with each failure mode
materially, then this condition is met.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
A material decrease would exclude
any best estimate of the mean value that
is already two orders of magnitude or
more below the criteria in § 450.101(a)
and (b). As the best estimate approaches
the established limits in § 450.101(a)
and (b) on the mean predicted values, a
material decrease would be smaller,
including: (1) Any reduction that brings
the operation into compliance with
§ 450.101(a) and (b) limits, (2) any halforder of magnitude reduction in the best
estimate of the mean value of EC, or (3)
a reduction by an amount at least as
large as the coefficient of variation due
to uncertainty in the population
distribution. Section 450.108(e)(1) uses
the phrase ‘‘risk from a high
consequence event’’ deliberately so that
other measures of collective risk and
consequences, not just CEC and EC, can
be considered in evaluating compliance
with this requirement, absent a waiver.
The FAA will provide guidance on what
constitutes material decrease.
The second condition in § 450.108(e)
requires that there are no key flight
safety events for the remainder of flight.
The FAA currently has a formal
definition of the term ‘‘key flight-safety
event’’ in part 437 (Experimental
Permits). Section 437.3 states that key
flight-safety event means a permitted
flight activity that has an increased
probability of causing a launch accident
compared with other portions of flight.
In addition, § 437.59(a) states that, at a
minimum, a key flight-safety event
includes: (1) Ignition of any primary
rocket engine, (2) any staging event, or
(3) any envelope expansion. The current
description of key flight safety events in
the permit regulation conveys what the
FAA may consider a key flight safety
event in the context of part 450.
Section 401.7 of the final rule has
added a definition of ‘‘key flight safety
events’’ and states that a key flight
safety event means a flight activity that
has an increased probability of causing
a failure compared with other portions
of flight. The term key flight safety event
in the context of part 450 includes
events that could compromise any
safety-critical system, or otherwise
increase the risk from high consequence
events, such as events that subject a
safety-critical system to environments at
or near the maximum predicted
environment.
SpaceX commented that launches that
overfly major landmasses (e.g., Europe,
Africa, or South America) prior to
orbital insertion would violate the CEC
requirement in proposed § 450.101(c)
during overflight. SpaceX urged the
FAA to update the regulation to clarify
that an operator would not have to
perform a CEC analysis for the
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
’’overflight’’ phase of flight. SpaceX also
recommended that the CEC requirement
apply only to vehicle response modes
that are mitigated by the FSS.
The FAA acknowledges that some
launches that overfly major landmasses
prior to orbital insertion produce CEC
levels in excess of the 1 × 10¥2
threshold and that flight abort will not
mitigate the consequences associated
with those failure modes. The FAA
modifies the final rule to address such
circumstances by adopting requirements
proposed in the NPRM, such as
§ 450.125(c). Specifically, § 450.108(e)
identifies conditions that, if met,
demonstrate a high consequence event
is sufficiently mitigated. These
conditions are met generally by U.S.
launches that overfly downrange
landmasses prior to orbital insertion.
Thus, the final rule includes specific
provisions designed to allow the current
practice where some launches proceed
through a phase of flight, such as the
downrange overflight of a major
landmass just prior to orbital insertion,
without additional protections against
low probability, high consequence
events.
The FAA finds that meeting the
requirements in § 450.108(e)
demonstrates sufficient protection
against the probability of high
consequence events, even though the
CEC may exceed the 1 × 10¥3 or 1 ×
10¥2 thresholds during the subject
phase of flight. The use of collective risk
to determine acceptability of downrange
overflight is consistent with current
practice.
Blue Origin, CSF, and SpaceX
commented that flight abort may
actually increase risk during overflight
where vehicle hazards cannot be
contained. Even for vehicles that
implement an FSS with a reliability of
0.999 at 95 percent, it would still be
possible to fall into the highest risk bin
and not improve a risk posture
measured by CEC.
The FAA agrees with the commenters.
In the final rule in § 450.108(e), the FAA
sets conditions that demonstrate that a
high consequence event is sufficiently
mitigated, including if flight abort in
that phase of flight would not materially
decrease the risk from a high
consequence event.
vi. Flight Abort Rules
Proposed § 450.165(c) (Flight Commit
Criteria) contained the requirements for
flight abort rules. As explained in the
NPRM, an operator would identify the
conditions under which an FSS,
including the functions of any flight
abort crew, must abort the flight to
ensure compliance with § 450.101. An
PO 00000
Frm 00061
Fmt 4701
Sfmt 4700
79625
operator would be required to abort a
flight if a flight safety limit is violated
or if some condition exists that could
lead to a violation, such as a
compromised FSS or loss of data.
In the final rule, the FAA revised and
relocated the flight abort rules to
§ 450.108 consistent with the objective
of consolidating relevant flight abort
requirements into a single section in the
final rule. In § 450.108(f), an operator
must establish and observe flight abort
rules that govern the conduct of launch
and reentry.
Section 450.108(f)(1) requires that
vehicle data required to evaluate flight
abort rules must be available to the FSS
under all reasonably foreseeable
conditions during normal and
malfunctioning flight. A similar
requirement appeared in proposed
§ 450.165(c)(2), which required vehicle
data necessary to evaluate flight abort
rules to be available to the FSS across
the range of normal and malfunctioning
flight. The FAA adds ‘‘under all
reasonably foreseeable conditions’’ to
§ 450.108(f)(1) to acknowledge that
some conditions that prevent vehicle
data from being available to evaluate
flight abort rules might be unforeseeable
and therefore unpreventable through
planning and design.
Section 450.108(f)(2) describes when
the FSS must abort flight, similar to
proposed § 450.165(c)(3). Section
450.108(f)(2)(i) requires that the FSS
must abort flight when valid, real-time
data indicate the vehicle has violated
any flight safety limit developed
pursuant to this section. In the final
rule, the FAA revised the language from
proposed § 450.165(c)(3)(i) to add
‘‘developed pursuant to this section’’
because the flight safety limits
requirements now appear in the same
section as this flight abort rule.
As proposed in § 450.165(c)(3)(ii), the
flight abort rules would have required
the FSS to abort flight when the vehicle
state approaches conditions that are
anticipated to compromise the
capability of the FSS and further flight
has the potential to violate a flight safety
limit.
Blue Origin commented that, while it
is possible to write flight abort rules to
account for specific cases, there was not
currently a practical means of writing
general rules that would abort flight
when the vehicle state approaches
conditions that could result in a
compromise of the FSS for every
circumstance proposed in
§ 450.165(c)(3)(ii). It also commented
that the potential to violate a flight
safety limit is vague and outside the
capability of current generation
autonomous FSS. Blue Origin
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79626
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
recommended the rule be reworded as
‘‘the flight safety system must abort
flight when the vehicle state approaches
identified conditions from the system
safety analysis that are anticipated to
compromise the capability of the flight
safety system and the flight safety
system is required to contain the risk to
an acceptable level (as analyzed in the
flight safety analysis).’’
In the final rule, the revised
requirement in § 450.108(f)(2)(ii) adopts
Blue Origin’s recommendation to add
‘‘identified’’ before ‘‘conditions that are
anticipated to compromise the
capability of the flight safety system.’’
The FAA finds this addition reasonable
because it avoids requiring protections
against unknown conditions. As
revised, § 450.108(f)(2)(ii) requires that
the FSS must abort flight when the
vehicle state approaches identified
conditions that are anticipated to
compromise the capability of the FSS
and further flight has the potential to
violate a flight safety limit. This
requirement is used in conjunction with
the flight safety limits objective in
§ 450.108(c)(5).
The FAA declines to adopt Blue
Origin’s recommendation to limit this
requirement to the system safety
analysis because a system safety
analysis is not the only means to
identify these conditions. For example,
an FSS survivability analysis or a link
analysis for a command destruct
architecture may identify conditions
anticipated to compromise the
capability of the FSS. The FAA also
does not adopt Blue Origin’s
recommendation to change
§ 450.165(c)(3)(ii) by replacing ‘‘and
further flight has the potential to violate
a flight safety limit’’ with ‘‘and the flight
safety system is required to contain the
risk to an acceptable level (as analyzed
in the flight safety analysis).’’
The FAA finds an acceptable level of
risk might be interpreted as only
meeting collective and individual risk
requirements, while flight safety limits
must meet other requirements as
described in § 450.108 in the final rule.
The FAA recognizes that a real-time
determination of whether a particular
failure may evolve to reach a flight
safety limit is not possible. The operator
must determine in pre-flight analyses
(system safety analysis, link analysis,
etc.) which failure modes can
compromise the capability of the FSS.
The operator must then use FSA to
determine if those failure modes can
potentially violate a flight safety limit.
If it finds a failure mode that can
potentially violate a flight safety limit,
the operator must develop flight abort
rules that protect against those modes.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
If the ability to reach a flight safety limit
via a particular failure mode is
uncertain, the assumption should be
made that it is possible during any
phase of flight where flight abort is used
as a hazard control strategy. This
approach is consistent with acceptable
methods of compliance with proposed
§ 450.165(c)(3)(ii).
Section 450.108(f)(2)(iii) requires that
the FSS must abort flight in accordance
with methods used to satisfy
§ 450.108(d)(3) if tracking data is invalid
and further flight has the potential to
violate a flight safety limit. This
requirement is similar to proposed
§ 450.165(c)(3)(iii), which stated that the
FSS must incorporate data loss flight
times to abort flight at the first possible
violation of a flight safety limit, or
earlier, if valid tracking data is
insufficient for evaluating a minimum
set of flight abort rules required to
maintain compliance with proposed
§ 450.101.
As noted in the discussion of flight
abort constraints, the FAA has replaced
proposed § 450.127, which contained
requirements for a data loss flight time
analysis, with the more performancebased approach in § 450.108(d)(3).
Consistent with that change, the FAA
revises the language in proposed
§ 450.165(c)(3)(iii) in final
§ 450.108(f)(2)(iii). Data loss flight times
are not the only means of compliance
with the performance-based
requirement in § 450.108(d)(3) to
account for the potential to lose valid
data necessary to evaluate the flight
abort rules. The FAA also removes the
requirement to abort flight at the first
possible violation of a flight safety limit,
or earlier, if valid tracking data is
insufficient for evaluating a minimum
set of flight abort rules required to
maintain compliance with proposed
§ 450.101. This statement was
associated with implementation of data
loss flight times, but the performancebased requirement in § 450.108(d)(3)
will allow other methods of compliance
that may not be consistent in all cases
with the NPRM language in
§ 450.165(c)(3)(iii). The FAA will
provide guidance on compliance with
§§ 450.108(d)(3) and 450.108(f)(2)(iii).
The FAA also does not adopt the
proposed definition for ‘‘data loss flight
time’’ in § 401.7 in the final rule. The
relation between §§ 450.108(d)(3) and
450.108(f)(2)(iii) in the final rule is
substantively the same as that between
proposed §§ 450.127 and
450.165(c)(3)(iii).
The FAA removes proposed
§ 450.165(c)(1), which required that for
a vehicle that uses an FSS, the flight
abort rules must identify the conditions
PO 00000
Frm 00062
Fmt 4701
Sfmt 4700
under which the FSS, including the
functions of any flight abort crew, must
abort the flight. These included
proposed § 450.165(c)(1)(i), to ensure
compliance with proposed § 450.101,
and proposed § 450.165(c)(1)(ii), to
prevent debris capable of causing a
casualty from impacting in uncontrolled
areas if the vehicle is outside the limits
of a useful mission. The FAA finds this
requirement to be unnecessary, as flight
safety limits requirements and flight
abort rules requirements are clearly
stated in § 450.108(c) through (f). In
addition, in the final rule the FAA does
not adopt the proposed definition for
‘‘flight abort crew’’ in § 401.7 because
the term is no longer used in the final
rule.
Virgin Galactic commented that
proposed § 450.165(c)(ii) seems
unachievable for an operator with a
nominal trajectory that meets EC
requirements but can result in debris
outside of the controlled area. Virgin
Galactic recommended deleting the
requirement or excluding the
requirement if EC was met.
The FAA finds, based on the context
of the comment, that Virgin Galactic
meant to refer to proposed
§ 450.165(c)(1)(ii). The FAA
acknowledges that a mission that flies
over uncontrolled areas on the nominal
trajectory cannot always prevent debris
impacts on the uncontrolled area, but
the requirement only applies to vehicles
outside the limits of a useful mission. A
nominal vehicle is on a useful mission;
therefore, this requirement would not
apply to the scenario in Virgin
Galactic’s comment. In the final rule,
the intent of proposed § 450.165(c)(1)(ii)
is covered in § 450.108(f)(2)(i).
The FAA removes the requirement
proposed in § 450.165(c)(3)(iv) that a
flight may continue past any gate
established under proposed § 450.125
only if the parameters used to establish
the ability of the vehicle to complete a
useful mission are within limits. The
replacement of proposed § 450.125 with
performance-based requirements in
§ 450.108(c) and (d) makes this
requirement unnecessary.
SpinLaunch commented that the FAA
should simplify the proposed flight
safety limits analysis (§ 450.123), gate
analysis (§ 450.125), and time delay
analysis (§ 450.129) regulations by
stating that the safety analyses must
address certain goals and relying on a
training and evaluation structure to
assure applicants are knowledgeable
and capable of performing the analyses
in a manner that sufficiently addresses
those goals. The FAA revises the
requirements in proposed §§ 450.123,
450.125, and 450.129 to be more
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
performance-based. However, the FAA
does not agree that training applicants
to be capable of performing the subject
analyses is sufficient to ensure
compliance with the regulations.
jbell on DSKJLSW7X2PROD with RULES2
v. Application Requirements
Section 450.108(g) contains
application requirements for flight
abort. Section 450.108(g)(1) requires an
applicant to submit a description of the
methods used to demonstrate
compliance with § 450.108(c), including
descriptions of how each analysis
constraint in § 450.108(d) is satisfied in
accordance with § 450.115 (Flight Safety
Analysis Methods). This rule is similar
to proposed § 450.123(e)(1), which
required that an applicant submit in its
application a description of how each
flight safety limit would be computed,
including references to the safety
criteria of proposed § 450.101.105 The
intent of the requirement in the final
rule is similar to the proposal. However,
the reference to § 450.101 is excluded in
the final rule because not all flight
safety limits objectives in § 450.108(c)
refer directly to § 450.101.
Section 450.108(g)(2) requires that an
applicant must submit in its application
a description of how each flight safety
limit and flight abort rule is evaluated
and implemented during vehicle flight,
including the quantitative criteria that
will be used, a description of any
critical parameters, and how the values
required in § 450.108(c)(3) and
450.108(e) are identified. This provision
is derived from three requirements in
the NPRM. First, proposed
§ 450.123(e)(2) would have required an
applicant to submit representative flight
safety limits and associated parameters.
Second, proposed § 450.125(d)(2) would
have required an applicant to submit a
description of the measure of
performance used to determine whether
a vehicle would be allowed to cross a
gate without flight abort, the acceptable
ranges of the measure of performance,
and how these ranges were determined.
Third, proposed § 450.165(d)(2)(i)
would have required an applicant to
submit, for flight abort rules, a
description of each rule and the
parameters that would be used to
evaluate each rule.
As discussed earlier, the FAA has
removed §§ 450.123 and 450.125 from
the final rule and relocated the flight
abort rules from § 450.165 to reflect a
more performance-based approach to
flight abort and allow greater flexibility
105 Section 450.115 addresses the scope and level
of fidelity required for FSA methods. The level of
fidelity must demonstrate that any risk to the public
satisfies the safety criteria of § 450.101.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
than would have been possible under
the flight safety limits analysis and
traditional gate analysis proposed in the
NPRM. Accordingly, the application
requirements associated with those
sections have been combined in
§ 450.108(g)(2) in the final rule. This
approach improves organization and
increases flexibility with regard to how
an operator demonstrates compliance
with § 450.108.
Section 450.108(g)(3) requires an
applicant to submit a graphic depiction
or series of depictions of flight safety
limits for a representative mission,
together with the launch or landing
point, all uncontrolled area boundaries,
the nominal trajectory, extents of
normal flight, and limits of a useful
mission trajectories, with all trajectories
in the same projection as each of the
flight safety limits. This rule is similar
to proposed § 450.123(e)(4), which
required that an applicant submit a
graphic depiction or series of depictions
of representative flight safety limits, the
launch or landing point, all
uncontrolled area boundaries, and
vacuum IIP traces for the nominal
trajectory, extents of normal flight, and
limits of a useful mission trajectories.
The final rule clarifies that an
applicant will need only to submit flight
safety limits for a representative
mission. Also, the FAA finds that the
requirement for depictions of vacuum
IIP trajectories would not be appropriate
for flight safety limits in different
projections (such as present position)
and revises the final rule to require all
trajectories in the same projection as
each of the flight safety limits. This
change will not result in an increased
burden compared to the NPRM because
the applicant would have to depict the
trajectories in either case; the final rule
simply states explicitly that the
trajectories must be depicted in the
appropriate projection.
Section 450.108(g)(4) requires an
applicant to submit a description of the
vehicle data that will be available to
evaluate flight abort rules under all
reasonably foreseeable conditions
during normal and malfunctioning
flight. This section is similar to
proposed § 450.165(d)(2)(iii), which
required an applicant to submit a
description of the vehicle data that
would be available to evaluate flight
abort rules across the range of normal
and malfunctioning flight. In the final
rule, the FAA replaces ‘‘across the range
of normal and malfunctioning flight’’
with ‘‘under all reasonably foreseeable
conditions during normal and
malfunctioning flight’’ to be consistent
with language elsewhere in the
regulation. It results in no increased
PO 00000
Frm 00063
Fmt 4701
Sfmt 4700
79627
burden on the operator from the
application requirement proposed in the
NPRM.
Microcosm requested clarification of
proposed § 450.165(d)(2)(i) and (iii),
which would require that the applicant
submit, for flight abort rules, a
description of each rule, and the
parameters that would be used to
evaluate each rule; and a description of
the vehicle data that would be available
to evaluate flight abort rules across the
range of normal and malfunctioning
flight.
The FAA provides the following
examples in response to Microcosm’s
comment. An example of a flight abort
rule would be a line on the Earth’s
surface that, when crossed by an IIP (the
parameter), would trigger flight abort. In
this example, the vehicle data would be
position and velocity data necessary to
compute the IIP, as provided by external
(such as ground-based) or onboard
sensors. The operator should consider
the availability of this data during
normal and malfunctioning flight and
the effect on the operator’s ability to
evaluate the applicable flight abort
rule—which in this example is that
flight abort be initiated if the IIP crosses
the line on the Earth’s surface.
Another example would be an
altitude versus downrange distance
constraint. If the vehicle is outside of a
range of altitudes as a function of the
downrange distance, flight abort would
be triggered. The ranges of altitudes and
downrange distances are the parameters
in this example. In this example, the
vehicle data would be position data,
similarly reported by external or
onboard sensors.
Other examples of parameters used in
flight abort rules could be chamber
pressure, body rates, health and status
of critical systems, etc. In the final rule,
the requirements in proposed
§ 450.165(d)(2)(i) and (d)(2)(iii) are
addressed by § 450.108(g)(2) and
§ 450.108(g)(4), respectively.
i. Flight Hazard Analysis (§ 450.109)
In the NPRM, the FAA proposed in
§ 450.109 that, unless an operator uses
physical containment, wind weighting,
or flight abort as a hazard control
strategy, an operator would be required
to perform and document a flight hazard
analysis and continue to maintain it
throughout the lifecycle of the launch or
reentry system. As explained in the
NPRM, the use of a flight hazard
analysis to derive hazard controls would
provide flexibility that does not
currently exist under the prescriptive
requirements in part 417 and is broadly
consistent with the practice in parts 431
and 435.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79628
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
As proposed in § 450.109(a), the flight
hazard analysis would need to identify,
describe, and analyze all reasonably
foreseeable hazards to public safety and
safety of property resulting from the
flight of a launch or reentry vehicle.
Each flight hazard analysis would need
to: (1) Identify all reasonably foreseeable
hazards, and the corresponding vehicle
response mode for each hazard,
associated with the launch or reentry
system relevant to public safety and
safety of property; (2) assess each
hazard’s likelihood and severity; (3)
ensure that the risk associated with each
hazard would meet certain defined
criteria; (4) identify and describe the
risk elimination and mitigation
measures required to satisfy the criteria;
and (5) demonstrate that the risk
elimination and mitigation measures
would achieve the necessary risk levels
through validation and verification.
In the final rule, the FAA revises
§ 450.109 by adding a new applicability
paragraph (a) and by re-designating
proposed § 450.109(a) through (e) as
§ 450.109(b) through (f).106 The FAA
adds an applicability paragraph in
§ 450.109(a) that applies to the use of a
flight hazard analysis as a hazard
control strategy to derive hazard
controls for the flight, or phase of flight,
of a launch or reentry vehicle. Hazards
associated with computing systems and
software are further addressed in
§ 450.141. This revised language reflects
that performing a flight hazard analysis
is included as one of the hazard control
strategies in § 450.107(c) of the final
rule.
Proposed § 450.109 included several
provisions that required the flight
hazard analysis to address hazards to
property. For instance, the FAA
proposed in the introductory language
to § 450.109(a) that operators identify,
describe, and analyze all reasonably
foreseeable hazards to public safety and
safety of property. The FAA proposed in
§ 450.109(a)(1) that an operator identify
all reasonably foreseeable hazards, and
the corresponding vehicle response
mode for each hazard, associated with
the launch or reentry system relevant to
public safety and safety of property. The
FAA also proposed in § 450.109(a)(3)(ii)
that the likelihood of any hazardous
condition that may cause major damage
to public property or critical assets must
be remote.
Blue Origin and Virgin Galactic
commented on the property protection
requirements in proposed § 450.109.
106 The FAA changes the term ‘‘vehicle response
mode’’ in proposed § 450.109(a)(1) to ‘‘failure
mode,’’ consistent with similar changes throughout
the final rule as discussed in the conditional
expected casualty section of the preamble.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Blue Origin acknowledged the FAA’s
statutory authority to protect property
but noted that FAA regulations do not
define property nor the criteria for the
safety of property. Blue Origin also
expressed concern that the requirements
in § 450.109 extended to critical assets
and property located in controlled areas.
Blue Origin requested clarity on these
issues. Virgin Galactic commented that
the protection of property was a new
requirement and also expressed
concerns about the criteria requiring an
operator to mitigate the likelihood of
any hazardous condition that can cause
a major property damage to ‘‘remote.’’
In response, the FAA has not adopted
the requirement to identify, describe,
and analyze all reasonably foreseeable
hazards to property resulting from the
flight of a launch or reentry vehicle.
Although property protection is codified
in current licensing requirements for
reusable launch vehicles in § 431.35(c),
launch and reentry operators have not
in the past been required to account for
hazards to property due to flight.
However, the FAA retains in the final
rule specific requirements for critical
assets and property on orbit, which have
specific safety criteria in § 450.101 and
§ 450.169, respectively. The FAA notes
that the emergency response
requirements in § 450.173(d), which
address fire hazards, may also mitigate
hazards to property. The FAA may
address other property and property
hazards in a future rulemaking if launch
and reentry flight operations dictate
such a need.
Blue Origin also recommended
proposed § 450.109(a) be revised to
require that a flight hazard analysis
identify, describe, and analyze all
reasonably foreseeable hazards to public
safety and safety of critical assets and
safety of property resulting from the
flight of a launch or reentry vehicle.
The FAA declines to adopt this
recommended language because, as
discussed in the preamble section
dedicated to critical assets, the FAA will
determine whether an asset is critical in
consultation with the entity responsible
for the asset, and either the FAA or a
Federal launch or reentry site will
determine whether the proposed
activity would expose critical assets to
a risk of loss of functionality that
exceeds the risk criterion in
§ 450.101(a)(4) or (b)(4), and convey any
necessary constraints to the operator.
Virgin Galactic commented on
proposed § 450.109(a)(1)(i) through
(a)(1)(x) and noted the list of error
sources, or very similar, shows up in
four other locations: (1) § 437.55, (2) AC
431.35–2A, (3) FAA Flight Safety
Handbook, and (4) the AIAA Safety
PO 00000
Frm 00064
Fmt 4701
Sfmt 4700
Critical RLV guide. Virgin Galactic
noted that the wording differed slightly
from one source to another and
recommended that the FAA harmonize
the various lists. The FAA notes this
comment is outside the scope of this
rulemaking.
Proposed § 450.109(a)(3) stated that a
flight hazard analysis must ensure that
the risk associated with each hazard
would meet the following criteria: (1)
The likelihood of any hazardous
condition that may cause death or
serious injury to the public must be
extremely remote; and (2) the likelihood
of any hazardous condition that may
cause major damage to public property
or critical assets must be remote.
In the final rule, the FAA revises this
requirement to remove the property
protection requirement in proposed
§ 450.109(a)(3)(ii), as discussed earlier.
Section 450.109(b)(3) states that a flight
hazard analysis must ensure that the
likelihood of any hazardous condition
that may cause death or serious injury
to the public is extremely remote.
Proposed § 450.109(a)(5) stated a
flight hazard analysis must demonstrate
that the risk elimination and mitigation
measures would achieve the risk levels
of proposed § 450.109(a)(3) through
validation and verification. Verification
includes analysis, test, demonstration,
or inspection. The FAA adopts and redesignates proposed § 450.109(a)(5) as
§ 450.109(b)(5) in the final rule, with
one revision. In § 450.109(b)(5), the FAA
changes the term ‘‘demonstrate’’ in the
introductory paragraph to ‘‘document.’’
Virgin Galactic noted that the NPRM
used the term ‘‘demonstrate’’ as both
part of the introductory paragraph in
proposed § 450.109(a)(5) and as a
verification method in proposed
§ 450.109(a)(5)(iii). Virgin Galactic
commented that demonstration is a
standard verification method, and use of
the word in both places could drive
confusion. Virgin Galactic
recommended changing the term
‘‘demonstrate’’ in § 450.109(a)(5) to
‘‘verify and validate’’ to clarify that
demonstration is not the only method of
completing validation and verification.
The FAA agrees that the proposed
language could cause confusion, and
that demonstration is not the only
method of completing validation and
verification. The FAA changes
‘‘demonstrate’’ to ‘‘document’’ to avoid
that confusion. The FAA does not adopt
Virgin Galactic’s specific suggestion
because ‘‘verification’’ and ‘‘validation’’
are terms used later in the sentence, and
are defined in § 401.7.
Virgin Galactic commented on
proposed § 450.109(c) and
recommended that there be an exclusion
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
for vehicles that follow the same
standard trajectory each flight.
The FAA disagrees with Virgin
Galactic’s recommendation. Even if an
operator follows a stable trajectory,
vehicle design changes or other
operational changes may introduce new
hazards. An operator must confirm that
the flight hazard analysis is valid for
each mission in order to ensure that all
hazards are identified and mitigated to
an acceptable level. That said, the FAA
expects that operators with stable
vehicle designs and operations will
typically not have major updates to their
flight hazard analyses.
The FAA re-designates proposed
§ 450.109(d) as § 450.109(e) in the final
rule, and removes the term
‘‘operational’’ to reflect that an operator
must continually update the flight
hazard analysis throughout the lifecycle
of the launch or reentry system, rather
than just address operational changes.
As discussed in the preamble discussion
on the system safety program
(§ 450.103), design and operational
changes to a system can have an impact
on public safety.
Virgin Galactic commented that the
term ‘‘continually’’ in § 450.109(d) is
not defined and is vague. In addition,
Virgin Galactic noted that the
requirement appears to duplicate the
current continuing accuracy
requirements in part 413 and the
proposed continuing accuracy
requirements in proposed § 450.211.
Virgin Galactic recommends this
requirement be removed.
The FAA notes that, for the purposes
of the flight hazard analysis,
‘‘continually’’ means that the operator
must update the flight hazard analysis
as aspects of the mission change or as
new information is learned about an
operation, if potential impacts to the
analysis are identified. Although
somewhat redundant with the
requirement in § 450.211 for a licensee
to maintain the continuing accuracy of
representations in its application,
proposed § 450.109(d) (re-designated
§ 450.109(e) in the final rule) provides
the specific expectation that the flight
hazard analysis must be complete and
all hazards must be mitigated to an
acceptable level for every launch or
reentry.
SpinLaunch commented that the
requirements in proposed § 450.109(c)
and (d) were an onerous burden, and
that to achieve a regulatory framework
that can effectively and efficiently
oversee multi-site, multi-vehicle
operations, a shift away from the
traditional regulatory verification of
each component to a more practical
method would be necessary.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
SpinLaunch recommended that an
applicant just demonstrate knowledge
and skills to perform safe and accepted
operations.
Operators have a responsibility to
ensure that public safety analyses are
consistent with their proposed
operations and that all hazards are
mitigated to an acceptable level. This
practice is consistent with system safety
practices and current commercial space
regulations. The framework
recommended by SpinLaunch would
not achieve these public safety
outcomes because it is too broad and
lacks performance metrics.
In the final rule, the FAA redesignates proposed § 450.109(e) as
§ 450.109(f), (Application requirements).
Except for number re-designations, the
FAA adopts the requirements as
proposed.
j. Physical Containment (§ 450.110)
As discussed earlier, unlike other
hazard control strategies, the FAA did
not propose a separate section for the
physical containment hazard control
strategy in the NPRM. Rather, proposed
§ 450.107(b) simply contained the
requirements for physical containment
as a hazard control strategy. The FAA
proposed that, to use physical
containment as a hazard control
strategy, an operator would be required
to ensure that the launch vehicle does
not have sufficient energy for any
hazards associated with its flight to
reach outside the flight hazard area
developed in accordance with proposed
§ 450.133 (Flight Hazard Area Analysis),
and would be required to apply other
mitigation measures to ensure no public
exposure to hazards as agreed to by the
Administrator on a case-by-case basis.
In addition, proposed § 450.107(e)
included specific application
requirements for an operator using
physical containment as a hazard
control strategy; namely, that it must (1)
demonstrate that the launch vehicle
does not have sufficient energy for any
hazards associated with its flight to
reach outside the flight hazard area
developed in accordance with
§ 450.133, and (2) describe the methods
used to ensure that flight hazard areas
are cleared of the public and critical
assets.
In the final rule, the FAA places the
requirements for the physical
containment hazard control strategy in a
separate section, § 450.110. With one
exception, the proposed requirements
are unchanged in the final rule. The one
exception, as discussed next in response
to a comment, is that the FAA clarifies
that the hazard area must be clear of the
public and critical assets.
PO 00000
Frm 00065
Fmt 4701
Sfmt 4700
79629
As noted earlier in the discussion of
§ 450.107, Blue Origin commented that
the FAA amend proposed
§ 450.107(e)(2)(ii), which proposed to
require an applicant to describe the
methods used to ensure that flight
hazard areas are cleared of the public
and critical assets, and to require that an
applicant describe the methods used to
ensure that risk to the public and
critical assets in flight hazard areas meet
allowable criteria. Blue Origin pointed
out that critical assets cannot be cleared
from a flight hazard area. In addition,
Blue Origin stated that the proposed
definition of ‘‘flight hazard area’’ in
§ 401.5 already captured that the area
would be controlled to risk limits and
that can be achieved through methods
other than clearing the area.
The FAA disagrees with Blue Origin
that proposed § 450.107(e)(2)(ii), now
§ 450.110(c)(2), should be amended to
require an applicant to describe the
methods used to ensure that risk to the
public and critical assets in flight
hazard areas meet allowable criteria, as
opposed to ensuring that the area is
cleared of the public and critical assets.
Although Blue Origin is correct in
noting that the definition of ‘‘flight
hazard area’’ is not limited to clearing
the area,107 the physical containment
hazard control strategy is designed to be
a simple method of protecting public
safety by launching within an area that
is cleared of the public and critical
assets, and within an area that contains
hazards based on the potential energy of
the vehicle. The FAA modifies what
was proposed in § 450.107(b)(1) and
(b)(2), now § 450.110(b)(1) and (b)(2),
from what was proposed in the NPRM,
to clarify that the hazard area must be
clear of the public and critical assets.
The FAA also modifies the definition
of ‘‘flight hazard area’’ in § 401.7 to
change the language from ‘‘in order to
protect public health and safety and the
safety of property’’ to ‘‘in order to
ensure compliance with the safety
criteria in § 450.101.’’ The FAA makes
this change to tie flight hazard areas to
the safety criteria in § 450.101.
k. Wind Weighting (§ 450.111)
In the NPRM, the FAA proposed wind
weighting requirements in § 450.141. As
discussed earlier, the wind weighting
requirements have been moved to
§ 450.111 in order to group all hazard
control strategies together. Although the
FAA did not receive any comments on
this hazard control strategy, the FAA
107 The proposed definition of ‘‘flight hazard
area’’ in the NPRM was ‘‘any region of land, sea,
or air that must be surveyed, publicized, controlled,
or evacuated in order to protect public health and
safety and the safety of property.’’
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79630
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
has made a few changes in the final
rule.
In the applicability section, the FAA
specifies that an operator may use wind
weighting as a hazard control strategy to
meet the safety criteria of § 450.101 to
§ 450.101(a), (b), and (c), which address
launch risk criteria, reentry risk criteria,
and high consequence event protection.
The FAA makes this change because the
criteria in § 450.101(d), (e), (f), and (g)—
addressing disposal safety criteria, the
protection of people and property on
orbit, the notification of planned
impacts, and the validity of analyses,
respectively—are not relevant to wind
weighting. Therefore, an operator does
not need to demonstrate that wind
weighting satisfies these requirements.
In the NPRM, proposed § 450.141(b)
would require that for the flight of an
unguided suborbital launch vehicle that
uses a wind weighting safety system, the
launcher azimuth and elevation settings
must be wind weighted to correct for the
effects of wind conditions at the time of
flight to provide a safe impact location.
The FAA has replaced ‘‘to provide a safe
impact location’’ with ‘‘to provide
impact locations that will ensure
compliance with the safety criteria in
§ 450.101.’’ This change removes any
ambiguity as to the meaning of ‘‘safe
impact location.’’
Also in the NPRM, proposed
§ 450.141(b) would require that for the
flight of an unguided suborbital launch
vehicle that uses a wind weighting
safety system, an operator must use
launcher azimuth and elevation angle
settings that ensures the rocket will not
fly in an unintended direction given
wind uncertainties. The FAA has
replaced ‘‘given wind uncertainties’’
with ‘‘accounting for uncertainties in
vehicle and launcher design and
manufacturing, and atmospheric
uncertainties.’’ This change
acknowledges that the uncertainties that
affect an unguided suborbital launch
vehicle’s ability to fly in an unintended
direction are broader than just wind
uncertainties—they include
uncertainties in vehicle and launcher
design and manufacturing, and other
atmospheric uncertainties. The FAA
makes two grammatical changes to the
application requirements, which in the
final rule are in § 450.111(e). First, in
§ 450.111(e)(2), the FAA replaces ‘‘and
identify’’ with ‘‘including.’’ In
§ 450.111(e)(3), the FAA removes the
word ‘‘provide.’’
Lastly, similar to other sections in this
rule, the FAA removes the proposed
requirement for an applicant to provide
additional products that allow an
independent analysis as requested by
the Administrator because the
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
requirement was redundant with
§ 450.45(e)(7)(ii).
l. Flight Safety Analysis (§§ 450.113 to
450.139)
Regardless of the hazard control
strategy chosen or mandated, the FAA
anticipates that an operator will be
required to conduct an FSA for at least
some phases of flight. For example, an
FSA must determine flight hazard areas
for any vehicle with planned debris
impacts capable of causing a casualty.
Also, an FSA must quantitatively
demonstrate that a launch or reentry
meets the safety criteria for debris, farfield overpressure, and toxic hazards.
An operator may be required to conduct
additional analyses to use flight abort or
wind weighting hazard control
strategies.
Generally, an FSA consists of a set of
quantitative analyses used to determine
flight commit criteria, flight abort rules,
flight hazard areas, and other mitigation
measures and to demonstrate
compliance with the safety criteria in
§ 450.101. In the NPRM, the FAA
proposed 15 sections associated with
FSA requirements in §§ 450.113 through
450.141. The final rule moves
requirements associated with flight
safety limits to § 450.108, such that 11
interrelated sections remain component
parts of an FSA.
There are 11 performance-based
sections with FSA requirements that fall
into three groups. The first group,
§§ 450.113 and 450.115, provides
requirements on the scope and fidelity
of the analyses required by the
remaining nine sections. The second
group, which consists of five sections
from § 450.117 through § 450.131,
specifies the requirements for analyses
necessary to develop quantitative input
data used by the last four sections. The
last group consists of four sections that
specify quantitative risk analyses with
products necessary to evaluate
compliance with the safety criteria in
§ 450.101. All of the FSA sections must
use methods that comply with
§ 450.101(g) because they are essential
to demonstrating compliance with the
safety criteria in § 450.101.
To aid in holistically understanding
the substance of, and relationships
between, the FSA sections, the
following provides a brief overview,
before a more detailed discussion of
each FSA section. Section 450.113
specifies the overall scope of the
subsequent analyses in terms of the
period of flight for which the public
risks must be quantified. For example,
for an orbital launch, an FSA must
account for all phases of flight from
liftoff through orbital insertion and
PO 00000
Frm 00066
Fmt 4701
Sfmt 4700
through all component impacts or
landings. Section 450.115 specifies that
the operator’s analysis methods must
account for all reasonably foreseeable
events and failures of safety-critical
systems during nominal and nonnominal launch or reentry that could
jeopardize public health and safety, and
the safety of property. Section 450.115
also specifies that the operator’s
methods must have a level of fidelity
sufficient (1) to demonstrate compliance
with the safety criteria of § 450.101,
accounting for all known sources of
uncertainty, using means of compliance
accepted by the Administrator; and (2)
to identify the dominant source of each
type of public risk with a criterion in
§ 450.101(a) or (b) in terms of phase of
flight, source of hazard (such as toxic
exposure, inert, or explosive debris),
and failure mode. An operator must
comply with these foundational sections
when performing any of the separate
analyses that together comprise the
FSA.
Sections 450.117 and 450.119 specify
the constraints and objectives of
analyses sufficient to characterize the
trajectory of the vehicle during normal
and malfunction flight. Section 450.121
specifies the constraints and objectives
of an analysis sufficient to quantify the
physical, aerodynamic, and harmful
characteristics of hazardous debris,
including impact probability
distributions generated from normal and
malfunction flight. Section 450.123
specifies requirements to characterize
the population exposed to a significant
probability of impact by hazardous
debris, including the vulnerability of
people in various structure types.
Section 450.131 specifies requirements
for statistically valid estimates of the
probability of reasonably foreseeable
failures based on the outcomes of
previous flights. Depending on the type
of operation or the hazard control
strategy used, an operator may be
required to perform some or all of these
analyses in developing its FSA.
Finally, §§ 450.133, 450.135, 450.137,
and 450.139 specify the requirements
for quantitative risk analyses to
demonstrate that the risks to the public
from debris, far-field overpressure, and
toxic hazards are consistent with the
safety criteria in § 450.101. Generally,
the analyses conducted under
§§ 450.117 through 450.131 are used to
inform the analyses for these final
portions of the FSA. Flight commit
criteria, flight hazard areas, flight abort
rules, and other mitigation measures are
typically derived as necessary to
demonstrate compliance with the safety
criteria in § 450.101, and thus are
typical byproducts of the risk analyses
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
performed to satisfy the requirements in
§§ 450.133, 450.135, 450.137, and
450.139. The requirements for each of
the FSA sections are described in more
detail in the following sections.
jbell on DSKJLSW7X2PROD with RULES2
m. Flight Safety Analysis
Requirements—Scope (§ 450.113)
In the NPRM, proposed § 450.113
stated the scope and applicability of
FSA requirements. Proposed
§ 450.113(a), which covered scope,
stated an operator would be required to
perform and document an FSA: (1) For
orbital launch, from liftoff through
orbital insertion, and any component or
stage landings; (2) for suborbital launch,
from liftoff through final impact; (3) for
disposal, from the beginning of the
deorbit burn through final impact; (4)
for reentry, from the beginning of the
deorbit burn through landing; and (5)
for hybrid vehicles, for all phases of
flight, unless the Administrator
determines otherwise based on
demonstrated reliability. Proposed
§ 450.113(b), which covered
applicability, identified what sections
needed to be included in an FSA
depending on the type of operation or
hazard control strategy being used.
In the final rule, the FAA has
removed the proposed applicability
provision and adopted the scope
provisions with some changes and
reorganization. The FAA revised
§ 450.113(a) to state that an operator
must perform and document an FSA for
all phases of flight, except as specified
in § 450.113(b). The FAA also revised
§ 450.113 to add in paragraph (b) an
operator is not required to perform and
document an FSA for a phase of flight
if agreed to by the Administrator based
on demonstrated reliability. An operator
demonstrates reliability by using
operational and flight history to show
compliance with the risk criteria in
§ 450.101(a) and (b). Operational history
includes the flight time and/or cycles of
an aircraft, which may have an
airworthiness certificate, operating
under part 91, part 135 or part 121 as
an example. Flight history could be
represented by flight time accumulated
through a period of developmental and
flight tests of a vehicle that does not
have an airworthiness certificate.
Although the demonstrated reliability
language was limited to hybrid vehicles
in the proposed rule, the FAA is
providing additional flexibility by
expanding it to all vehicles. Some
vehicles other than hybrids could
conceivably have an extensive and safe
enough flight history to demonstrate
compliance with the risk criteria in
§ 450.101(a) and (b) based on empirical
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
data in lieu of the traditional risk
analysis.
In the final rule, the FAA modifies
§ 450.113(a)(1), which addresses orbital
launches, to clarify that an FSA covers
from liftoff through orbital insertion and
through ‘‘all component impacts or
landings’’ instead of proposed ‘‘any
component or stage landings or final
impacts.’’ Likewise, for the scope of an
FSA for suborbital launches, the FAA
changes § 450.113(a)(2) to ‘‘through all
component impacts or landings’’ instead
of proposed ‘‘through final impact.’’
These changes reflect the reality that
orbital and suborbital launch vehicles
often have multiple components that
can either impact the Earth or land
intact. An FSA should address all such
impacts or landings.
The FAA modifies § 450.113(a)(4) for
a similar reason. For the scope of a
reentry analysis, the FAA changes
§ 450.113(a)(4) to include ‘‘through all
component impacts or landings’’ instead
of proposed ‘‘through landing.’’ This
change reflects the reality that reentry
vehicles often have multiple
components that can either impact the
Earth or land intact.
The FAA modifies § 450.113(a)(3) and
(4) by replacing the term ‘‘the beginning
of the deorbit burn’’ with ‘‘the initiation
of the deorbit.’’ The FAA notes not all
deorbit operations will include a
‘‘burn.’’ The FAA notes that, for a
disposal, an operator could discontinue
the analysis prior to final impact and
demonstrate an equivalent level of
safety by presenting evidence of
complete demise due to aerothermal
heating. The scope of the FSA is
consistent with the risk criteria in
§ 450.101 and the long-standing
definition of ‘‘reentry’’ in § 401.7. The
FAA clarifies here that, for the purposes
of the FSA and risk criteria, the
initiation of the deorbit for a reentry or
disposal from orbit generally coincides
with the final health check prior to the
final command to commit the vehicle to
a perigee below 70 nautical miles.
The final rule removes the language
proposed in § 450.113(b) covering
applicability, because the reorganization
of the flight abort related sections means
that all FSA sections are applicable,
unless otherwise agreed to by the
Administrator based on demonstrated
reliability. Instead, § 450.113(b) in the
final rule addresses how an operator
demonstrates reliability, as discussed.
n. Flight Safety Analysis Methods
(§ 450.115)
In the NPRM, proposed § 450.115
outlined the methods for conducting
FSA. The FAA did not receive
PO 00000
Frm 00067
Fmt 4701
Sfmt 4700
79631
comments on this proposal unique to
this section.
In the final rule, the FAA adopts
§ 450.115 as proposed with one change.
The term ‘‘vehicle response mode’’ is
changed to ‘‘failure mode’’ to be
consistent with the changes to this term
made elsewhere in the final rule.
Consistent with the NPRM,
§ 450.115(c)(4) requires that an FSA
methodology must identify the evidence
for validation and verification required
by § 450.101(g), which addresses the
required accuracy and validity of data
and scientific principles. For example,
the ‘‘accounting for all known sources of
uncertainty’’ requirement specified in
§ 450.115(b)(1) must produce results
consistent with or more conservative
than the results available from previous
mishaps, tests, or other valid
benchmarks, such as higher-fidelity
methods.
o. Trajectory Analysis for Normal Flight
(§ 450.117)
In the NPRM, proposed § 450.117
(Trajectory Analysis for Normal Flight)
set requirements for an FSA for normal
trajectories. The proposed provision was
meant to distinguish between variability
in the intended trajectory and
uncertainties due to random sources of
dispersion such as winds and vehicle
performance. The FAA explained that
all FSAs depend on some form of
analysis of the trajectory under normal
conditions, otherwise known as a
normal trajectory. That is, a vehicle’s
trajectory when it performs as intended
and under normal conditions must be
understood to determine the effects of
malfunctions along its flight path.
Proposed § 450.117(a)(1) required an
FSA to include a trajectory analysis that
established, for any phase of flight
within the scope of proposed
§ 450.113(a), the limits of a launch or
reentry vehicle’s normal flight as
defined by the nominal trajectory, and
sets of trajectories sufficient to
characterize variability and uncertainty
during normal flight. First, proposed
§ 450.117(a)(1)(i) required a set of
trajectories to characterize vulnerability.
This set would be required to describe
how the intended trajectory could vary
due to the conditions known prior to
initiation of flight. Second, proposed
§ 450.117(a)(1)(ii) required a set of
trajectories to characterize uncertainty.
This set would be required to describe
how the actual trajectory could differ
from the intended trajectory due to
random uncertainties. The FAA also
proposed to require an FSA to include
a trajectory analysis establishing a fuel
exhaustion trajectory in proposed
§ 450.117(a)(2) and, for vehicles with an
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79632
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
FSS, trajectory data or parameters that
describe the limits of a useful mission
in proposed § 450.117(a)(3).
In the final rule, the FAA adopts
proposed § 450.117 with revisions. The
FAA makes clarifying changes for a
number of requirements regarding
trajectory analysis; removes and
relocates the fuel exhaustion trajectory
requirement to § 450.119; and removes
and relocates references to ‘‘limits of a
useful mission’’ to § 450.119. The FAA
also makes changes to remove
prescriptiveness in favor of more
performance-based language.
Boeing, Lockheed Martin, Northrop
Grumman, Sierra Nevada, and ULA
recommended changing the term
‘‘normal’’ flight to ‘‘nominal’’ flight in
numerous parts of proposed § 450.117.
The FAA does not agree with this
recommendation because both of these
terms are defined by the FAA and are
distinct. Section 401.7 defines
‘‘nominal’’ to mean, in reference to
launch vehicle performance, trajectory,
or stage impact point, a launch vehicle
flight for which all vehicle aerodynamic
parameters are as expected, all vehicle
internal and external systems perform as
planned, and there are no external
perturbing influences other than
atmospheric drag and gravity. Section
401.7 defines ‘‘normal flight’’ to mean
the flight of a properly performing
vehicle whose real-time vacuum IIP
does not deviate from the nominal
vacuum instantaneous impact point by
more than the sum of the wind effects
and the three-sigma guidance and
performance deviations in the uprange,
downrange, left-crossrange, or rightcrossrange directions. Thus, in simple
terms, a nominal trajectory is a single
trajectory that the vehicle would fly in
the absence of wind effects and
guidance and performance variability.
Section 401.7 defines ‘‘normal
trajectory’’ to mean ‘‘a trajectory that
describes normal flight.’’ The FAA
retains the definitions of these terms. It
is virtually impossible for flights to be
nominal such that all aerodynamic
parameters and systems are as expected
without the influence of any
uncertainties. To replace ‘‘normal’’ with
‘‘nominal’’ would substantively change
the meaning of the rule, as uncertainty
does not apply to a nominal trajectory.
Requiring normal flight trajectories is a
more permissive range of trajectories
than nominal flight and allows the rule
to be performance based within safe
parameters. The FAA retains the use of
the terms as proposed.
In the final rule, the FAA narrows the
scope of the set of trajectories to
characterize uncertainty due to random
uncertainties ‘‘in all parameters with a
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
significant influence on the vehicle’s
behavior through normal flight’’ in
§ 450.117(a)(2). Generally, the FAA
considers ‘‘a significant influence’’ to
include any parametric uncertainties
within three-sigma that affect the
crossrange IIP location or downrange IIP
rate by at least one percent because the
IIP location and rate is often a
convenient surrogate for the potential
impact locations of hazardous debris.
One percent is a typical threshold value
used in RCC 321–20 Standard and
Supplement. Thus, the final rule does
not intend for applicants to characterize
the influence of all random
uncertainties or variability, but only
those with a significant influence on the
potential impact locations for hazardous
debris.
The FAA removes the NPRM
requirements for a fuel exhaustion
trajectory in proposed § 450.117(a)(2)
and its associated application
requirement in proposed
§ 450.117(d)(3)(ii). The requirements for
this analysis are more appropriately
located in the malfunction flight section
because a fuel exhaustion trajectory is a
malfunction trajectory that results when
thrust termination does not occur as
planned. A fuel exhaustion trajectory is
not always required; however, such an
analysis could be necessary for certain
operations. For example, a fuel
exhaustion trajectory will be necessary
under the final rule § 450.119(a)(2) for a
return to launch site scenario. As a
result of this removal, the FAA
combines proposed § 450.117 paragraph
(a) with paragraph (a)(1) as a new
paragraph (a), and re-designates
proposed § 450.117(a)(1)(i) and (a)(1)(ii)
as § 450.117(a)(1) and (a)(2),
respectively.
The NPRM referenced the limits of a
useful mission in proposed
§ 450.117(a)(3). In the final rule, the
FAA moves all references to the limits
of a useful mission from § 450.117,
including proposed § 450.117(a)(3), to
§ 450.119 (Trajectory Analysis for
Malfunction Flight). The FAA finds that
the requirements associated with the
limits of a useful mission belong in the
malfunction flight section because
limits of a useful mission can exceed the
bounds of normal flight.
The FAA received several comments
on the proposed use of the term ‘‘limits
of a useful mission.’’ A summary of the
comments and FAA’s responses can be
found in the preamble section on
Trajectory Analysis for Malfunction
Flight.
The FAA adopts § 450.117(b) as
proposed. A final trajectory analysis
must use a six-degree of freedom
trajectory model to satisfy the
PO 00000
Frm 00068
Fmt 4701
Sfmt 4700
requirements of § 450.117(a). The FAA
did not receive comments on this
proposal.
Proposed § 450.117(c) would have
required a trajectory analysis to account
for all wind effects including profiles of
winds that are not less severe than the
worst wind conditions under which
flight might be attempted and for
uncertainty of the wind conditions. In
the final rule, the FAA revises the
requirement to state that a trajectory
analysis must account for ‘‘atmospheric
conditions that have an effect on the
trajectory’’ rather than ‘‘all wind
effects.’’ The FAA notes that the
revision captures the intent of (1) the
proposed requirement to account
specifically for wind effects under all
foreseeable conditions within the flight
commit criteria and consistent with the
flight abort rules, and (2) the proposed
requirement in § 450.117(a) to establish
sets of trajectories sufficient to
characterize variability and uncertainty
during normal flight.
The FAA recognizes that wind is the
primary atmospheric consideration for
most vehicles, but, for some (nontraditional) vehicles, other atmospheric
parameters such as density, humidity,
or temperature may affect trajectory and
be part of the flight commit criteria.
Although these other conditions would
have necessarily been accounted for in
the trajectory analysis for normal flight
as ‘‘uncertainties’’ in the introductory
language to § 450.117(a), the final rule
expressly refers to all atmospheric
conditions in § 450.117(c). The FAA
also notes that flight in the context of
this section refers to the period of
launch or reentry within the scope of
§ 450.113.
Boeing commented that it is
impossible to account for all wind
effects, as wind models were local and
limited in altitude. Boeing
recommended incorporating an altitude
limit of 60,000 feet, and modifying the
requirement to state, ‘‘a trajectory
analysis must account for launch and, if
different, reentry site wind effects, as
applicable, including profiles of winds
that are no less severe than the worst
wind conditions under which flight
might be attempted, and for uncertainty
in the wind conditions.’’
The FAA notes that the proposed
requirement concerning wind effects,
revised to ‘‘atmospheric effects’’ in the
final rule, specifies profiles under
which flight may be attempted based on
the launch commit criteria and flight
abort rules. The NPRM and the final
rule set performance level requirements
that avoid placing an arbitrary altitude
limit that may not encompass all the
conditions that may have an effect on a
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
normal trajectory. Accordingly, the final
rule requires a trajectory analysis to
account not for all wind effects, but
instead for atmospheric conditions that
have an effect on the trajectory,
including any uncertainty. Accounting
for atmospheric effects on the trajectory
will be addressed in guidance.
Blue Origin stated the requirements in
proposed § 450.117(b) through (d)(2)
amount to translating complex vehicle
trajectory models into verbiage for
delivery to FAA for licensing. Blue
Origin proposed revising the language to
specify vehicle state vector parameters
in terms of position, attitude, velocity,
thrust, and mass. In terms of a statistical
distribution of each parameter, Blue
Origin recommends providing a
covariance matrix describing vehicle
guidance and performance uncertainty
as meeting the intent of the requirement.
The FAA notes Blue Origin’s
recommendation to specify the vehicle’s
position and velocity during normal
flight using covariance matrices would
satisfy the requirement in
§ 450.117(a)(2) because that approach
was identified in Appendix A to part
417 under A417.7(g)(7)(xiii). The
approach in Appendix A to part 417
under A417.7(g)(7)(xiii) meets the
requirement in § 450.117(a)(2) because a
set of covariance matrices for the
vehicle position coordinates and
velocity component magnitudes are an
acceptable means to describe how the
actual trajectory could differ from the
intended trajectory due to random
uncertainties in all parameters with a
significant influence on the vehicle’s
behavior throughout normal flight.
However, the FAA recognizes that other
approaches, including a sufficiently
large 108 set of Monte Carlo sample
trajectories,109 may also satisfy the
requirement. The FAA does not intend
to prescribe a specific method to
characterize normal flight. Therefore,
the FAA declines Blue Origin’s
recommendation to revise the
requirement to specify vehicle state
vector and covariance parameters.
Instead, the final rule implements
performance-based trajectory analysis
requirements as proposed, such that an
applicant must submit a description of
the methods and input data used to
characterize the vehicle’s flight behavior
throughout normal flight.
The FAA proposed application
requirements for trajectory analysis for
normal flight in § 450.117(d). In the
final rule, the FAA adopts proposed
§ 450.117(d) with revisions.
Specifically, the FAA removes the
proposed requirement to describe the
methodology used to determine the
limits of a useful mission in
§ 450.117(d)(1). Instead, an equivalent
requirement appears in § 450.119(c)(2)
of the final rule. The FAA also removes
the items proposed in § 450.117(d)(1)(i)
through (d)(1)(iv) because they were
redundant with the performance-based
requirements that apply to all FSA in
accordance with § 450.115(c).110 The
FAA removes the prescriptive
requirements in § 450.117(d)(2)(ii)
through (d)(2)(iv) proposed in the
NPRM because these requirements are
captured with the final rule requirement
in § 450.117(d)(2), as explained later in
this preamble section. In addition, the
FAA re-designates proposed
§ 450.117(d)(2)(i) as (d)(3), and
450.117(d)(3) as (d)(4) with a minor
revision. The FAA removed proposed
§ 450.117(d)(4), which required an
applicant to submit additional products
that allow an independent analysis, as
requested by the Administrator, because
the requirement was redundant with
§ 450.45(e)(7)(ii).
In the NPRM, proposed
§ 450.117(d)(2) required an applicant to
submit a description of the input data
used to characterize the vehicle’s flight
behavior throughout normal flight and
limits of a useful mission. The proposal
would have required a description of
the wind input data, including
uncertainties (§ 450.117(d)(2)(ii)); a
description of the parameters with a
significant influence on the vehicle’s
behavior throughout normal flight,
including a quantitative description of
the nominal value for each significant
parameter throughout normal flight
(§ 450.117(d)(2)(iii)); and a description
of the random uncertainties with a
significant influence on the vehicle’s
behavior throughout normal flight,
including a quantitative description of
the statistical distribution for each
108 The FAA will determine what constitutes a
sufficiently large set of Monte Carlo trajectories
pursuant to the level fidelity of analysis
requirements in § 450.115(b).
109 Monte Carlo methods include computational
algorithms that, for example, repeatedly sample
from probability distributions that characterize
input parameters (such as the weight, thrust, and
drag of a vehicle) and perform physics-based (such
as Newton’s laws) simulations to obtain numerical
results (such as a set of trajectories that characterize
flight under normal or malfunction conditions).
110 Section 450.115(c) requires an applicant to
submit a description of the FSA methodology,
including identification of: (1) The scientific
principles and statistical methods used; (2) all
assumptions and their justifications; (3) the
rationale for the level of fidelity; (4) the evidence
for validation and verification required by
§ 450.101(g); (5) the extent that the benchmark
conditions are comparable to the foreseeable
conditions of the intended operations; and (6) the
extent that risk mitigations were accounted for in
the analyses.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
PO 00000
Frm 00069
Fmt 4701
Sfmt 4700
79633
significant parameter
(§ 450.117(d)(2)(iv)).
Commenters asserted these proposed
requirements were too prescriptive, and
the FAA agrees. The FAA revises
§ 450.117(d)(2) to require an applicant
to submit the quantitative input data,
including uncertainties, used to model
the vehicle’s normal flight in six degrees
of freedom. This revision in the final
rule captures the parameters of the
proposed requirements in
§ 450.117(d)(2)(ii) through (d)(2)(iv),
while allowing for more flexibility in
the application of the regulatory
requirements. Quantitative input data
used to model the vehicle’s normal
flight in six degrees of freedom includes
comprehensive sets of aerodynamic and
mass properties. Explanation and details
on how to comply with these
requirements will be included in
Advisory Circular 450.117–1,
‘‘Trajectory Analysis.’’
The FAA retains the requirement
proposed in § 450.117(d)(2)(i) and redesignates it as § 450.117(d)(3) in the
final rule. In addition, the FAA changes
the term ‘‘wind effects’’ to ‘‘atmospheric
effects’’ to be consistent with
§ 450.117(c) of the final rule.
The FAA revises proposed
§ 450.117(d)(3) as discussed in this
paragraph and re-designates it as
§ 450.117(d)(4) in the final rule. The
proposal required an applicant to
submit representative normal flight
trajectory analysis outputs, including
the position, velocity, and vacuum IIP,
for each second of flight. Blue Origin
commented that this requirement
created an unnecessary burden to
calculate vacuum IIP for potentially
hundreds or thousands of normal and
malfunction vehicle trajectories. Blue
Origin stated that vacuum IIP was not
representative of where vehicle hazards
may impact the Earth and believed this
requirement should only apply to the
nominal trajectory.
The FAA disagrees that the IIP
application requirement would have
created an unnecessary burden;
however, the final rule removes the
application requirement because
vacuum IIP can be readily computed if
necessary from the position and velocity
vectors, which are a part of the
application materials. In the final rule,
§ 450.117(d)(4) specifies that the
representative normal flight trajectory
analysis outputs include orientation of
the vehicle in addition to the position
and velocity data specified in the
proposal. The FAA notes that
orientation is inherent in any six-degree
of freedom trajectory model, as required
by both the proposed and final
§ 450.117(b). Orientation is important to
E:\FR\FM\10DER2.SGM
10DER2
79634
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
public safety when the induced
velocities have a preferred direction.
The FAA also removes the
requirement proposed in
§ 450.117(d)(3)(ii) that applies to fuel
exhaustion trajectory under otherwise
nominal conditions, because a fuel
exhaustion trajectory is merely one
specific type of malfunction trajectory
and is not necessarily required for all
applicants. For example, a fuel
exhaustion trajectory would be
necessary under the final rule for a
return to launch site scenario but not for
a typical unguided suborbital rocket.
The requirement in § 450.119(a)(2) of
the final rule is used to determine
whether an applicant must include a
fuel exhaustion trajectory.
p. Trajectory Analysis for Malfunction
Flight (§ 450.119)
In the NPRM, the FAA proposed
requirements associated with trajectory
analysis for malfunction flight in
§ 450.119. As stated in the NPRM, a
malfunction trajectory analysis is
necessary to determine how far a
vehicle can deviate from normal flight.
This analysis helps determine potential
impact points in the case of a
malfunction and is therefore a vital
input for the analyses needed to
demonstrate compliance with risk
criteria.
In the final rule, the FAA adopts
proposed § 450.119 with revisions. The
FAA removes, as unnecessary, proposed
§ 450.119(a)(1), which required that an
FSA include a trajectory analysis that
establishes the vehicle’s capability to
depart from normal flight, formally
defined in terms of IIP in § 401.7.
Proposed § 450.119(a)(2) is redesignated (a)(1) and requires that a
trajectory analysis establish the
vehicle’s deviation capability in the
event of a malfunction during flight.
The FAA adds a new requirement,
designated as § 450.119(a)(2), which
requires that an FSA must include a
trajectory analysis that establishes the
trajectory dispersion resulting from
reasonably foreseeable malfunctions.
This language retains the concept of
proposed § 450.119(a)(1), but revises the
regulatory language to allow for a
medium-fidelity FSA approach (e.g.,
corridor method) for which the vehicle
vacuum IIP during a malfunction is not
specified, as explained in the FAA’s
Flight Safety Analysis Handbook.111
More specifically, the proposed
requirement in § 450.119(a)(1) to
111 See Flight Safety Analysis Handbook, V1.0,
August 2009 (available at https://www.faa.gov/
about/office_org/headquarters_offices/ast/media/
Flight_Safety_Analysis_Handbook_final_9_
2011v1.pdf).
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
establish the vehicle’s capability to
depart from normal flight would have
required the analysis to account for the
IIP in modeling of a malfunction
trajectory because normal flight is
defined in terms of IIP. Thus, the
proposed requirement in § 450.119(a)(1)
would have foreclosed a valid mediumfidelity FSA approach. In the final rule,
§ 450.119(a)(1) and § 450.119(a)(2)
provide flexibility and permit at least
one approach that allows a simpler
computation of risk but still preserves
safety. Not all operations are eligible for
this corridor method, but it is valid
when the vehicle debris risks are due to
flight phases where the IIP is moving
steadily downrange, and when the
failure modes do not involve distorted
impact distributions.112 In the final rule,
the FAA amended the requirement to
allow this and other simplified methods
for those operations for which they may
be valid.
The FAA adds § 450.119(a)(3) in the
final rule. Section 450.119(a)(3) states
that an FSA must include a trajectory
analysis that establishes, for vehicles
using flight abort as a hazard control
strategy under § 450.108, trajectory data
or parameters that describe the limits of
a useful mission. This requirement was
found in § 450.117(a)(3) of the NPRM.
The FAA finds that trajectory analysis
requirements associated with the limits
of a useful mission belong in the
malfunction flight section because
presumably normal flight can attain the
one or more objectives within the flight
azimuth limits.
The requirement in § 450.119(a)(3) is
related to the requirement proposed in
§ 450.119(a)(1) because trajectories that
are outside of the normal envelope can
still be ‘‘useful,’’ even though they
involve a malfunction.113 The FAA
notes that an operator can elect to
designate the normal mission
trajectories as the limits of a useful
mission and meet the application
requirement to submit data that
describes the limits of a useful mission,
but this may result in the termination of
a flight that could still achieve a mission
objective.
The FAA received several comments
on the NPRM’s proposal to use the
‘‘limits of a useful mission’’ to inform
the development of flight safety limits
112 Distorted impact distributions are often caused
by actions taken in response to abort criteria.
113 Publicly available information indicates that
the flight of the Ariane 5 VA241 that occurred from
the Guiana Space Centre on January 25, 2018 may
be a potential empirical example. There the flight
path anomaly was evident from the beginning of
flight and the payloads were deployed into an
orbital inclination that was approximately 18
degrees from the intended orbit, yet the payloads
were still able to deliver useful data.
PO 00000
Frm 00070
Fmt 4701
Sfmt 4700
and when flight abort was necessary,
and to establish the width of a gate.
Microcosm requested that the FAA
define ‘‘a useful mission.’’ Boeing,
Lockheed Martin, Northrop Grumman,
and ULA recommended changing the
definition of ‘‘limits of a useful
mission’’ to mean the trajectory or other
parameters that bound performance of a
mission that can attain its primary
objective. Blue Origin disagreed with
the addition of ‘‘limits of a useful
mission’’ to the regulation and stated
that regulating what is considered a
useful mission was outside of the FAA’s
jurisdiction.
In the final rule, the FAA adopts a
new definition of a ‘‘useful mission’’ in
§ 401.7 and amends the proposed
definition of ‘‘limits of a useful
mission’’ to mean the trajectory data or
other parameters that bound the
performance of a useful mission,
including flight azimuth limits. A
‘‘useful mission’’ means a mission that
can attain one or more objectives and is
based on the definition of ‘‘limits of a
useful mission’’ proposed in the NPRM.
The definition of ‘‘limits of a useful
mission’’ adopted in the final rule
removes the language ‘‘describe the
limits of a mission that can attain the
primary objective’’ and replaces it with
‘‘bound the performance of a useful
mission,’’ consistent with the
commenters’ recommendation. In this
context, bounding the performance will
include flight azimuth limits and could
include limits on the altitude versus
distance downrange or other physicsbased limits depending on the nature of
the operation. The FAA makes these
changes because it recognizes that
pursuit of objectives other than the
primary objective may be considered a
useful mission. However, when all other
objectives can no longer be achieved the
FAA does not consider the collection of
data related to a failure in and of itself
to be a useful mission. This is because
mere failure data collection alone does
not justify continued risk to the public.
Therefore, the final rule states in
§ 450.119(a)(3) that the FAA does not
consider the collection of data related to
a failure to be a useful mission.
The FAA finds the requirements
associated with ‘‘useful mission’’ and
‘‘limits of a useful mission’’ are central
to the hazard control strategies. The
FAA is not attempting to regulate what
the operator or its customer considers a
useful mission. The FAA instead is
simply requiring that the applicant
identify which missions are useful so
that vehicles that fly outside of these
parameters erroneously are not
permitted to threaten the public. The
FAA finds it necessary to include a
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
requirement that would prevent a
launch or reentry vehicle from
continued flight that would increase
risk to the public if that vehicle can no
longer achieve an objective of the
operator, outside of the collection of
data related to a failure.
Blue Origin recommended replacing
‘‘limits of a useful mission’’ with ‘‘limits
to meet public risk criteria.’’ The FAA
does not agree with this
recommendation. As described in the
section on CEC, public risk criteria alone
are inadequate to establish the need for
an FSS, the reliability of the FSS, or the
timing of an FSS activation to ensure
public safety. Similarly, while some
might consider risk-based flight safety
limits as a reasonable approach to risk
management when a vehicle is on a
potentially useful mission, once a
malfunction results in a mission that
can no longer achieve an objective, then
hazard containment should be the goal
and flight abort must be used to protect
the public against high consequence
events. Application of the limits of a
useful mission benefits the operator
because flights with trajectories that are
outside of the normal envelope, but still
useful according to the operator, will be
permitted to continue without flight
abort as long as they comply with
§ 450.108(d)(7), including trajectories
that overfly the public. This was the
intent of proposed § 450.123(b)(6) in the
NPRM, and remains the intent of
§ 450.108(d)(7) in the final rule.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA commented that
limits of a useful mission were already
addressed in flight termination triggers,
and that proposed § 450.117(a)(3)
requiring trajectory data or parameters
that describe the limits of a useful
mission should be replaced with limits
that trigger flight termination.
The FAA declines to adopt this
recommendation because of the
relationship between the limits of a
useful mission and flight safety limits.
Pursuant to § 450.108(c)(2) in the final
rule (similar to proposed § 450.123(a)(2)
of the NPRM), flight safety limits define
when an operator must initiate flight
abort to prevent continued flight from
increasing public risk in uncontrolled
areas if the vehicle is unable to achieve
a useful mission. Under the final rule,
flight safety limits will be developed
after the limits of a useful mission are
identified. An operator can elect to
designate the normal mission
trajectories as the limits of a useful
mission and meet the application
requirement to submit data describing
the limits of a useful mission, but this
may result in the termination of a flight
that could still achieve a mission
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
objective. As an example, during an
operation for which a gate width was
determined using only a vehicle’s
normal trajectory envelope, a failure
before the gate resulted in the flight
nearly being terminated at the gate, even
though it went on to achieve the
mission’s primary objective. In that
instance, if the limits of a useful mission
data included flight azimuth limits, this
vehicle would have had more margin in
the form of a wider gate. Under the final
rule, if an operator decides that placing
a payload in any orbit or withholding
abort for crewed flights is more useful
than terminating a flight, it may declare
that flight is useful at any azimuth or
altitude and may fly the vehicle on any
trajectory that meets § 450.108(d)(7).
However, flight safety limits that
terminate flights that are no longer
useful should be placed so that they do
not increase risk compared to continued
flight, pursuant to § 450.108(d)(6).
The FAA found it necessary to move
all references to the limits of a useful
mission from § 450.117 to § 450.119
(Trajectory Analysis for Malfunction
Flight), including proposed
§ 450.117(a)(3). The FAA finds that the
requirements associated with the limits
of a useful mission belong in the
malfunction flight section because
limits of a useful mission can exceed the
bounds of normal flight.
In the NPRM, the FAA proposed in
§ 450.119(b) that a malfunction
trajectory analysis must account for
each cause of a malfunction flight,
including software and hardware
failures. For each cause of a malfunction
trajectory, the analysis would have been
required to characterize the foreseeable
trajectories resulting from a
malfunction. The proposal included six
items in § 450.119(b)(1) through (b)(6)
that would be required to be included
in the analysis.
In the final rule, the FAA adopts
proposed § 450.119(b) with revisions.
The FAA removes proposed
§ 450.119(b)(1) through (b)(3) because
they are no longer needed due to the
adoption of performance-based
standards and re-designates proposed
§ 450.119(b)(4) through (b)(6) as (b)(1)
through (b)(3). Also, the FAA revises the
introductory language in § 450.119(b) to
improve clarity and remove prescriptive
language.
Blue Origin commented that it was
not feasible to model a malfunction turn
trajectory for each software or hardware
cause, only for vehicle responses to the
cause as proposed in § 450.119(b). Blue
Origin recommended striking the
phrase, ‘‘for each cause of a malfunction
trajectory,’’ and instead indicate that a
malfunction trajectory analysis must
PO 00000
Frm 00071
Fmt 4701
Sfmt 4700
79635
characterize the foreseeable trajectories
resulting from a malfunction.
The FAA partially agrees with Blue
Origin’s recommendations. The FAA
deletes the proposed language in
§ 450.119(b), ‘‘for each cause of a
malfunction trajectory, the analysis
must characterize the foreseeable
trajectories resulting from a
malfunction,’’ but retains the phrase
‘‘for each cause of a malfunction flight’’
in the first sentence of § 450.119(b). The
FAA notes the analysis must account for
the probability of each set of trajectories
that characterize a type of malfunction
flight, and that probability must account
for each cause of a malfunction flight,
including software and hardware
failures, for every period of normal
flight.
The FAA notes that use of the phrase
‘‘for each type of malfunction’’ in
§ 450.119(b) of the final rule addresses
Blue Origin’s comment that it is not
feasible to model a malfunction turn
trajectory for each cause, but only for
vehicle responses to the cause. The term
‘‘each type of malfunction’’ refers to the
vehicle response to the cause and
multiple causes could result in a similar
vehicle response. For example, under
part 417 a malfunction turn analysis
would account for a series of ‘‘tumble
turns,’’ as enumerated in Appendix A to
part 417 under A417.9(d)(5), which
result in the launch vehicle rotating due
to a constant thrust vector offset angle.
The FAA recognizes that there could be
multiple causes for a constant thrust
vector offset, such as a jammed
mechanism, loss of electrical power, or
loss of hydraulic fluid pressure. Thus,
the probability of a tumble turn must
account for ‘‘each cause of a
malfunction flight, including software
and hardware failures,’’ in accordance
with § 450.119(b). Furthermore, the
FAA recognizes that multiple sets of
trajectories are necessary to characterize
the vehicle behavior in response to a
malfunction. An example is a
malfunction that results in a constant
thrust vector offset, because a range of
thrust vector offsets is reasonably
foreseeable (from very small angles that
would cause a slow departure from
normal flight up to the maximum
feasible thrust offset that would
typically result in a rapid tumble of the
vehicle). Thus, there is a natural
question regarding the appropriate
resolution of the malfunction trajectory
analysis. The intent of the requirements
in § 450.119 is to produce sets of
trajectories that are sufficient to
characterize the public risks posed by
each type of malfunction. Thus, the
final rule sets a performance standard in
§ 450.119(b) that the analysis for each
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79636
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
type of malfunction must have sufficient
temporal and spatial resolution to
establish flight safety limits, if any, and
individual risk contours that are smooth
and continuous.
In order to be less prescriptive, the
FAA further amends § 450.119(b) in
response to Blue Origin’s comment. The
NPRM proposed in § 450.119(b)(1)
through (b)(3) that the malfunction
trajectory analysis must account for (1)
all trajectory times during the thrusting
phases, or when the lift vector is
controlled, during flight; (2) the
duration, starting when a malfunction
begins to cause each flight deviation
throughout the thrusting phases of
flight; and (3) trajectory time intervals
between malfunction turn start times
that are sufficient to establish flight
safety limits, if any, and individual risk
contours that are smooth and
continuous. The FAA removes proposed
§ 450.119(b)(1) through (b)(3) and
consolidates these requirements into
§ 450.119(b). This revision sets more
performance-based requirements for the
scope and resolution of the malfunction
trajectory analysis to create flexibility in
demonstrating the trajectory dispersion
resulting from reasonably foreseeable
malfunctions. In the final rule,
§ 450.119(b) will require the analysis for
each type of malfunction to have
sufficient temporal and spatial
resolution to establish flight safety
limits, if any, and individual risk
contours that are smooth and
continuous.
In the NPRM, proposed
§ 450.119(b)(2) required that a
malfunction trajectory analysis account
for the duration, starting when a
malfunction begins to cause each flight
deviation throughout the thrusting
phases of flight. Virgin Galactic
commented that a malfunction turn
analysis would not apply to operations
for which a pilot is in control of a
winged vehicle because the pilots act as
an FSS.
The FAA is aware that having pilots
onboard and in control of a vehicle
during flight may mitigate the need for
certain malfunction analyses; however,
there may still be instances when pilots
may become incapacitated during flight.
In any such instances, a trajectory
analysis for malfunction flight would
still potentially be necessary to identify
impact points as an essential input for
risk analyses to demonstrate compliance
with risk criteria in § 450.101. The FAA
notes that flight simulators can facilitate
the development of representative
malfunction trajectory analysis outputs
in cases in which pilot responses have
a significant influence on the trajectory
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
dispersion resulting from reasonably
foreseeable malfunctions.
Virgin Galactic also recommended a
wording change to § 450.119(b)(2) to
define the duration as, ‘‘starting when a
malfunction begins . . . until such time
the effects of the malfunction are
mitigated.’’ As previously discussed, the
FAA does not adopt proposed
§ 450.119(b)(2) in the final rule.
However, the FAA notes in the final
rule, the combination of the requirement
for sufficient temporal resolution to
establish smooth and continuous
individual risk contours, along with the
requirement to account for the timing of
each malfunction trajectory’s
termination due to means other than
flight abort, including vehicle breakup,
ground impact, or orbital insertion,
provide a sufficient performance-based
specification to establish the duration of
the malfunction trajectory analysis. In
addition, the FAA finds that the
commenter’s suggestion that the
duration of the analysis continue only
‘‘until such time the effects of the
malfunction are mitigated’’ would not
analyze both the success and the failure
of the mitigation necessary to quantify
the risk and consequence in the event
that the FSS fails.
As a result of removing proposed
§ 450.119(b)(1) through (b)(3), the FAA
re-designates proposed § 450.119(b)(4)
as § 450.119(b)(1) in the final rule.
Proposed § 450.119(b)(4) required that a
trajectory analysis for malfunction flight
account for the relative probability of
occurrence of each malfunction turn for
which the vehicle is capable. In the final
rule, the FAA revises § 450.119(b)(1) to
reflect that the analysis must account for
the relative probability of occurrence of
each malfunction, and not specifically a
malfunction turn. The FAA views the
term ‘‘malfunction turn’’ as outdated.
The requirement in the final rule is
consistent with the proposal.
The FAA re-designates proposed
§ 450.119(b)(5) as § 450.119(b)(2) in the
final rule. The FAA also revises
§ 450.119(b)(2) to correct an omission of
the word ‘‘trajectory.’’ Furthermore, the
FAA adds ground impact and orbital
insertion as potential termination states.
The FAA found the exclusion of these
states in the NPRM to be a deficiency
that would have resulted in an
operator’s inability to meet regulatory
requirements for quantifying the risk
because malfunctions can result in
trajectories that result in ground impact
or orbital insertion, as well as vehicle
break-up, and those additional
outcomes can pose significant public
risks as well.
The FAA re-designates proposed
§ 450.119(b)(6) as § 450.119(b)(3) in the
PO 00000
Frm 00072
Fmt 4701
Sfmt 4700
final rule and revises the requirements.
Section 450.119(b)(3) requires that a
malfunction trajectory analysis account
for the parameters with a significant
influence on a vehicle’s flight behavior
from the time when a malfunction
begins to cause a flight deviation until
each malfunction trajectory will
terminate due to vehicle breakup,
ground impact, or orbital insertion. The
FAA adds the phrase ‘‘parameters with
a significant influence on vehicle’s
flight behavior’’ because the analysis
must account for these parameters to
characterize sufficiently the vehicle’s
flight behavior. This language was
proposed in the application
requirements in § 450.119(c)(2)(iii) and
has been added to paragraph (b)(3) in
the final rule. The FAA received no
comments on this language. The FAA
also clarifies that a malfunction
trajectory can terminate due to orbital
insertion, not just ground impact or
predicted structural failure (vehicle
breakup), as specified in the NPRM, for
the same reason that those outcomes
were added to § 450.119(b)(2). Finally,
the FAA replaces the proposed term
‘‘predicted structural failure’’ with the
term ‘‘vehicle break-up’’ in the final
rule. This change is consistent with the
terminology used in § 450.121 (Debris
Analysis).
Blue Origin commented that smooth
and continuous contours were not
typically feasible unless flight limits
were also included in the malfunction
turn analysis. Blue Origin also
recommended adding flight abort to the
list of vehicle end state conditions.
The FAA did not add flight abort to
the list of vehicle end state conditions
based on Blue Origin’s comment
because of the relationship between
trajectory analysis for malfunction flight
and risk analyses that produce risk
contours. Risk analyses must consider
outcomes of flight abort and FSS
inaction, whether through failure of the
FSS or because no flight abort rules
were violated, which could result in
vehicle breakup, ground impact, or
orbital insertion. If the trajectories for
malfunction flight were terminated
when flight abort was predicted, no
trajectory data would exist for cases
when the FSS failed. The rule ensures
that complete trajectory data exists to
account for flight abort action and
inaction in risk analyses. More
specifically, ending the malfunction
trajectories at the flight safety limits
conflicts with the requirement in
§ 450.108(d)(5) to account for proper
functioning of the FSS and failure of the
FSS in individual, collective, and
conditional risk evaluations. It was not
necessary to amend the rule according
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
to Blue Origin’s comment because flight
abort is already a necessary end case to
be analyzed when producing risk
contours in accordance with
§ 450.133(e)(2)(iii), which is a separate
analysis from producing trajectories for
malfunction flight.
Section 450.119(b)(4) explicitly
requires a malfunction trajectory
analysis to account for potential FSS
failure, if an FSS is used, because that
can also influence the termination
condition of a malfunction trajectory.
For example, if a malfunction trajectory
triggers a flight abort rule, potential
outcomes of the trajectory are abort
(through destruct, thrust termination, or
other method) or continued flight
resulting in aerodynamic breakup, intact
impact, or orbital insertion if the FSS
fails. The requirement in § 450.119(b)(4)
is consistent with the proposal because
both the proposed and final § 450.115(a)
explicitly require that an operator’s FSA
method must account for all failures of
safety-critical systems during nominal
and non-nominal launch or reentry that
could jeopardize public health and
safety and the safety of property.
Furthermore, any FSS required to
comply with § 450.143 or § 450.145
necessarily will meet the definition of a
safety-critical system. Therefore, the
proposed requirement § 450.123(a)
would have necessitated that the
malfunction trajectory analysis account
for the potential failure of the FSS.
In the NPRM, § 450.119(c) addressed
the application requirements associated
with trajectory analysis for malfunction
flight. In the final rule, the FAA adopts
the application requirements in
proposed § 450.119(c) with revisions.
The revisions include adding a new
§ 450.119(c)(2), re-designating proposed
§ 450.119(c)(2) through (c)(4), and
removing proposed § 450.119(c)(1)(i)
through (c)(1)(iv).
Proposed § 450.119(c)(1) required an
applicant to submit a description of the
methodology used to characterize the
vehicle’s flight behavior throughout
malfunction flight. In the final rule, the
FAA adopts the proposal and adds a
reference to the requirements in
§ 450.115(c), which sets the standards
for the methodologies used in the FSA.
Also, the FAA removes the items
proposed in § 450.119(c)(1)(i) through
(c)(1)(iv) because they were redundant
with the performance-based
requirements that apply to all FSA in
accordance with § 450.115(c).
In the final rule, a new § 450.119(c)(2)
requires an applicant to submit a
description of the methodology used to
determine the limits of a useful mission,
in accordance with § 450.115(c). This
requirement was proposed as
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
§ 450.117(d)(1) in the NPRM. Moving
this application requirement to
§ 450.119 is consistent with the
relocation of its associated analysis
requirement to § 450.119(a)(3). The FAA
re-designates proposed § 450.119(c)(2)
as § 450.119(c)(3) in the final rule. The
FAA captures the requirements of
proposed § 450.119(c)(2)(i) and (c)(2)(ii)
and relocates them in § 450.119(c)(3)(i)
and (c)(3)(ii).
The FAA re-designates proposed
§ 450.119(c)(2)(iii) as § 450.119(c)(3)(iii)
in the final rule and revises the final
§ 450.119(c)(3)(iii) to specify the need
for an applicant to submit a quantitative
description of the parameters, including
uncertainties, with significant influence
on the vehicle’s malfunction behavior
for each type of malfunction flight
characterized. Proposed
§ 450.119(c)(2)(iii) required an applicant
to submit a description of the input data
used to characterize the vehicle’s
malfunction flight behavior, including a
description of the parameters with a
significant influence on the vehicle’s
behavior throughout malfunction flight
for each type of malfunction flight
characterized. Proposed
§ 450.119(c)(2)(iii) also required a
quantitative description of the nominal
value for each significant parameter
throughout normal flight. The FAA
specifically replaces the proposed
requirements in § 450.119(c)(2)(iii) and
(c)(2)(iv) 114 with the requirement in
§ 450.119(c)(3)(iii) in the final rule. This
revision retains the intent of the
requirements proposed in the NPRM but
is more flexible in its application
because, although it still requires a
quantitative description, the regulation
permits something other than the
statistical distribution that would have
been required by the proposal.
The FAA re-designates proposed
§ 450.119(c)(3) as § 450.119(c)(4) in the
final rule. The FAA also removes the
need for the vacuum IIP for each second
of flight. The FAA makes this change in
response to Blue Origin’s comment on
computing vacuum IIP for a large
number of trajectories, as addressed in
the preamble section on § 450.117.
The FAA adopts the requirements in
§ 450.119(c)(4)(i) as proposed in
§ 450.119(c)(3)(i) in the NPRM. The
FAA received no comments on
proposed § 450.119(c)(3)(i). The FAA
adopts, with revisions, the requirements
114 Proposed § 450.119(c)(2)(iv) required an
applicant to submit a description of the random
uncertainties with a significant influence on the
vehicle’s behavior throughout malfunction flight for
each type of malfunction flight characterized,
including a quantitative description of the
statistical distribution for each significant
parameter.
PO 00000
Frm 00073
Fmt 4701
Sfmt 4700
79637
in § 450.119(c)(4)(ii) as proposed in
§ 450.119(c)(3)(ii) in the NPRM.
Proposed § 450.119(c)(3)(ii) required
submission of the probability of each
trajectory that characterizes a type of
malfunction flight. Blue Origin
commented that delivering probabilities
for each trajectory modelled was not
practical or useful for independent
assessment. Instead, Blue Origin
proposed revising the regulatory
language to require the applicant to
submit the probability of each set of
malfunction trajectories. The FAA
agrees with this comment and revises
§ 450.119(c)(4)(ii) in the final rule to
reflect Blue Origin’s recommendation.
In the final rule, § 450.119(c)(4)(iii)
requires an applicant to submit a
representative malfunction flight
trajectory analysis output, including the
position and velocity as a function of
flight time for a set of trajectories that
characterize the limits of a useful
mission as described in § 450.119(a)(3)
of this section. This requirement was
proposed as § 450.117(d)(3)(v) in the
NPRM. As discussed earlier, the FAA
moves the limits of a useful mission
requirement from proposed § 450.117 to
§ 450.119 in the final rule.
Lastly, similar to other sections in this
rule, the FAA removes the requirement
for an applicant to provide additional
products that allow an independent
analysis, as requested by the
Administrator. The FAA finds the
requirement redundant with
§ 450.45(e)(7)(ii). Blue Origin and the
CSF objected to proposed
§ 450.119(c)(4). Blue Origin strongly
disagreed that the FAA should be in the
business of recreating analysis
completed by operators. It submitted
that the FAA should vet the process
used by the operator to conduct the
analysis, along with the products of the
analysis, to determine whether approval
was warranted. Blue Origin further
stated that such independent recreation
of the analysis could lead to protracted
back and forth between an operator and
the FAA that was unnecessary if the
FAA had vetted the process used by the
operator to conduct the analysis. Blue
Origin proposed to delete this
requirement in order to limit the scope
to what was required to establish
confidence in the validity of an
operator’s analysis. CSF stated that the
FAA’s practice of recreating an
applicant’s analysis should be ended, as
it was expensive and burdensome. CSF
recommended that an AC should guide
and inform this analysis.
Virgin Galactic noted that numerous
regulations under part 450, including
proposed § 450.119(c)(4), call for
additional products that allow an
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79638
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
independent analysis, as requested by
the Administrator. Virgin Galactic stated
that ‘‘additional products’’ was neither
defined nor constrained, permitting the
FAA to request any information from
operators at any time. This would create
uncertainty regarding the kind of
products an applicant or operator would
need to prepare for the FAA. Virgin
Galactic recommended striking the
above references in their entirety. Virgin
Galactic commented that, based on prior
experience under part 431 with the FAA
requesting additional information, these
regulations may have a significant time
and monetary impact on an operator, if
implemented.
The FAA does not agree with the
commenters’ recommendation to delete
this requirement in its entirety from the
final rule. The goal is for the FAA to
evaluate, in an efficient and thorough
manner, the validity of an analysis,
along with the products of the analysis
submitted by an operator. The FAA
finds that at times it may be necessary
to conduct an independent analysis of
the process used by the operator in
order to ensure safety. Additional
product requests under part 431 may
have been more frequent due to a lack
of well-defined application
requirements. However, under part 450,
the FAA expects the application
requirements are sufficient and will
generally not request additional
products beyond those that are
necessary to protect public safety.
Furthermore, as noted in the NPRM, the
FAA has evaluated the validity of an
applicant’s proposed methods by
comparing the results to valid
benchmarks such as data from mishaps,
tests, or validated high-fidelity methods.
Once that has occurred, the FAA can
issue an operator’s license for a
repeatable operation at a specific site for
a specified range of trajectory azimuths.
Using published benchmarks, the
FAA intends to facilitate the validation
and verification of FSA methods to
alleviate some of the needs for the FAA
to perform independent analyses.
However, the FAA finds that relying on
an approved process alone is
insufficient when certain critical
variables may change that affect flight
safety or the MPL determination, or in
cases in which the operator proposes
launch or reentry operations that are so
unique that relevant benchmarks are
unavailable. Also, the FAA will
continue to verify flight operations for
new vehicles, for existing vehicles
conducting operations at new sites, for
vehicles flying a trajectory outside the
accepted range of trajectory azimuths,
and vehicles that have undergone
significant modifications to vehicle
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
design or flight safety critical systems.
Thus, the FAA foresees continuing to
perform independent analyses in certain
circumstances to assure that it has met
its statutory obligation to ensure public
health and safety and safety of property.
Although the FAA declines to remove
the ‘‘additional products’’ reference in
§ 450.45(e)(7)(ii) of the final rule, the
FAA does not include the redundant
references proposed in other sections.
‘‘Additional products’’ refers to data
that will allow the FAA to conduct an
independent safety analysis in support
of its application assessment and
licensing determination. It would be
impractical to list everything needed for
every independent analysis. As
explained in the NPRM, the FAA’s
decision to conduct an independent
analysis is usually reserved for new
vehicle concepts, new analysis methods,
or proposals involving unique public
safety cases. In all instances, the request
for information is bounded by the
regulatory requirements for obtaining a
license and the FAA’s need to ensure
compliance with the safety criteria. The
FAA adopts the requirement that an
applicant submit additional products to
facilitate an independent analysis, as
requested by the Administrator in
§ 450.45(e)(7)(ii).
q. Debris Analysis (§ 450.121)
The NPRM proposed in § 450.121 to
require a debris analysis that
characterized the debris generated for
each foreseeable vehicle response mode
as a function of vehicle flight time,
accounting for the effects of fuel burn
and any configuration changes. The
proposal required that the debris
analysis account for each foreseeable
cause of vehicle breakup, including any
breakup caused by an FSS activation or
by impact of an intact vehicle. As noted
in the NPRM, this would include debris
from a vehicle’s jettisoned components
and payloads because such debris could
cause a casualty due to impact with an
aircraft or waterborne vessel or could
pose a toxic or fire hazard.115 Under
proposed § 450.121(c), the debris
analysis would include inert, explosive,
and other hazardous vehicle debris from
both normal and malfunctioning flight
during launch or reentry.
In the final rule, the FAA adopts
proposed § 450.121 with revisions.
Specifically, the FAA preserves the
scope of the debris analysis from the
NPRM but consolidates, clarifies, and
increases the flexibility of the
regulations in this section. The final
rule’s revisions include (1) replacing the
requirement to characterize the debris
115 84
PO 00000
FR 15383.
Frm 00074
Fmt 4701
Sfmt 4700
from ‘‘each foreseeable vehicle response
mode’’ with ‘‘debris generated from
normal and malfunctioning vehicle
flight,’’ (2) relying upon a new
definition for ‘‘hazardous debris,’’ (3)
replacing ‘‘flight time’’ with ‘‘flight
sequence,’’ and (4) removing
prescriptive thresholds for various
debris hazards in favor of a
performance-based standard of ‘‘capable
of causing a casualty or loss of
functionality to a critical asset.’’ Each of
these changes is discussed in the
following paragraphs.
Proposed § 450.121(a) required that an
FSA include a debris analysis that
characterizes the debris generated for
each foreseeable vehicle response mode
as a function of vehicle flight time,
accounting for the effects of fuel burn
and any configuration changes. The
NPRM noted that an operator’s debris
list generally changes over time with
variations in the amount of available
propellant and the jettisoning of
hardware.
In the final rule, the FAA adopts
proposed § 450.121(a) with revisions.
The FAA replaces the proposed
requirement to characterize ‘‘the debris
generated for each foreseeable vehicle
response mode as a function of vehicle
flight time, accounting for the effects of
fuel burn and any configuration
changes’’ with a more flexible and
performance-based requirement to
characterize ‘‘the hazardous debris
generated from normal and
malfunctioning vehicle flight as a
function of vehicle flight sequence.’’
Several commenters suggested
changing the term ‘‘foreseeable’’ vehicle
response modes in § 450.121(a) of the
NPRM to ‘‘credible’’ vehicle response
modes. The commenters stated that
credibility was determined during the
system safety analysis, and that the
debris analysis should not have to
include extremely improbable, noncredible failure modes.
The FAA does not agree that the term
‘‘foreseeable’’ should be replaced by the
term ‘‘credible’’ in this section or
throughout the final rule. The term
‘‘foreseeable’’ is used in § 431.35 and
also commonly used in system safety;
therefore, the FAA is not changing these
references. The FAA finds that the term
‘‘credible’’ is unacceptably prone to
errors in judgment whereas the term
‘‘foreseeable’’ is more readily discerned
by analysis (e.g., fault trees). With
regard to § 450.121(a) of the final rule,
the FAA adopts the more flexible and
performance-based requirement
recommended by the commenters to
characterize the hazardous debris
generated from normal and
malfunctioning vehicle flight as a
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
function of vehicle flight sequence.
With the removal of the reference to
‘‘each foreseeable vehicle response
mode’’ in § 450.121(a), the final rule
standard for the scope is set by the
language in § 450.115(a), specifically by
the reference to reasonably foreseeable
events. In addition, the resolution of the
failure modes accounted for in the
debris analysis is set by the level of
fidelity necessary to comply with
§ 450.115(b). The FAA also notes that,
in the context of § 450.121, reasonably
foreseeable events that can generate
hazardous debris during malfunctioning
vehicle flight generally include engine/
motor explosion, exceeding structural
limits due to aerodynamic loads, inertial
loads, aerothermal heating, and
activation of a flight termination system.
In reference to the use of the term
‘‘hazardous debris’’ in § 450.121(a), the
final rule in § 401.7 includes a
definition of this term. Hazardous debris
means any object or substance capable
of causing a casualty or loss of
functionality to a critical asset.
Hazardous debris includes inert debris
and explosive debris such as an intact
vehicle, vehicle fragments, any detached
vehicle component, whether intact or in
fragments, payload, and any planned
jettisoned bodies. This definition is
based on proposed § 450.121(c)(1),
which required a debris analysis to
identify all inert debris that could cause
a casualty or loss of functionality of a
critical asset. The FAA clarifies that the
clause ‘‘whether intact or in fragments’’
applies to the payload and jettisoned
bodies as well.
The final rule’s definition of
‘‘hazardous debris’’ facilitated
streamlining in proposed §§ 450.113
through 450.139. For example, the term
hazardous debris in § 450.121(a)
establishes a performance-based
threshold, which resulted in the
elimination of the prescriptive debris
thresholds proposed in § 450.121(c)(1)(i)
through (v).116 Section 450.121(a)
retains the essential performance
standards in proposed § 450.121(c)(1)
and (c)(2) (i.e., that the analysis must
identify all inert and explosive debris
capable of causing a casualty or loss of
functionality to a critical asset), and
allows operators to propose impact
vulnerability models appropriate for the
116 As proposed, an operator would have been
required to include all debris that could impact a
human being with a mean expected kinetic energy
at impact greater than or equal to 11 ft-lbs; impact
a human being with a mean impact kinetic energy
per unit area at impact greater than or equal to 34
ft-lb/in2; cause a casualty due to impact with an
aircraft; cause a casualty due to impact with a
waterborne vessel; or pose a toxic or fire hazard.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
materials used in their licensed
operations.
For example, recent research and
development sponsored by the FAA
demonstrates that the threshold kinetic
energy capable of causing a casualty
from a collision with a rigid object is
substantially lower than for a collision
with an object made of certain
composite materials.117 The FAA will
provide an AC with valid debris impact
thresholds, such as those proposed in
§ 450.121(c)(1)(i) and (ii). Thus, in the
final rule, § 450.121(a) uses the
definition of ‘‘hazardous debris’’ in a
way that will enable those debris impact
thresholds to be updated as appropriate
based on future research and
development. In addition, the definition
of ‘‘hazardous debris’’ is used in
§ 450.121(a) in a way that replaces the
relatively verbose requirement in
proposed § 450.121(c) that ‘‘a debris
analysis must account for all inert,
explosive, and other hazardous vehicle,
vehicle component, and payload debris
foreseeable from normal and
malfunctioning vehicle flight.’’
In summary, the final rule uses the
performance-based definition of
‘‘hazardous debris’’ that currently
equates to the same debris thresholds as
proposed in the NPRM because
‘‘hazardous debris’’ means any object or
substance capable of causing a casualty,
including people in aircraft or
waterborne vessels or loss of
functionality to a critical asset. Thus, by
relying on the definition of ‘‘hazardous
debris,’’ the final rule retains the
standard in proposed § 450.121(c) of
debris capable of causing a casualty or
loss of functionality to a critical asset
and allows operators to propose impact
vulnerability models appropriate for the
materials used in their vehicle.
In the final rule, the FAA replaces the
term ‘‘flight time’’ in § 450.121(a) with
the more flexible term ‘‘flight sequence’’
because it is a better independent
variable. For example, during a reentry
operation, the transitions between
phases of flight, which generally
produce substantially different
hazardous debris, such as prior to and
after peak aero-thermal heating, can
occur at widely variable flight times.
117 ‘‘The crash test results and subsequent
analysis strongly suggest that RCC-based thresholds
are overly conservative because they do not
accurately represent the collision dynamics of
elastically-deformable sUAS with larger contact
areas in comparison to the metallic debris analysis
methods for high speed missiles on the national test
ranges.’’ Final Report for the FAA UAS Center of
Excellence Task A4; UAS Ground Collision Severity
Evaluation Revision 2, Arterburn et al, 2017. https://
www.assureuas.org/projects/deliverables/a4/
ASSURE_A4_Final_Report_UAS_Ground_
Collision_Severity_Evaluation.pdf.
PO 00000
Frm 00075
Fmt 4701
Sfmt 4700
79639
Also, imparted velocities due to breakup typically correlate with propellant
load better than flight time does.
Therefore, the final rule uses ‘‘flight
sequence’’ as a less prescriptive and
more accurate independent variable.
The FAA notes that the term
‘‘sequence’’ is used in the common
meaning of the word, which is a series
of related things or events, or the order
in which things or events follow each
other. The phrase ‘‘as a function of
vehicle flight sequence’’ would
naturally include ‘‘accounting for the
effects of fuel burn and any
configuration changes,’’ so the final rule
deletes those elements of the proposed
requirement as redundant.
In § 450.121(b) of the NPRM, the FAA
proposed to require that the debris
analysis account for each foreseeable
cause of vehicle breakup, including any
breakup caused by FSS activation, and
for impact of an intact vehicle.
Consistent with § 450.133(a)(4), this
proposal included debris from a
vehicle’s jettisoned components and
payloads because such debris could
cause a casualty due to impact with an
aircraft or waterborne vessel or could
pose a toxic or fire hazard.118
Section 450.121(b) retains the
requirement that a debris analysis
account for each reasonably foreseeable
cause of vehicle breakup and intact
impact. As explained in the NPRM, this
would include ‘‘engine or motor
explosion, or exceeding structural limits
due to aerodynamic loads, inertial
loads, or aerothermal heating.’’ 119
In addition, the final rule requires an
operator to account for vehicle
structural characteristics and materials
and energetic effects during break-up or
at impact. Although these items would
be necessary considerations in any
debris analysis, the FAA has added
them expressly in § 450.121(b). The
requirement to account for energetic
effects in § 450.121(b)(3) is consistent
with the requirement in proposed
§ 450.135(d)(3)(iii) which addresses
‘‘indirect or secondary effects such as
bounce, splatter, skip, slide, or
ricochet.’’ 120 Moreover, accounting for
the fundamental physical phenomena
identified in § 450.121(b)(2) of the final
rule would logically be necessary to
comply with the requirement in
118 The preamble to the NPRM stated that ‘‘this
proposal would include debris from a vehicle’s
jettisoned components and payloads because such
debris could cause a casualty due to impact with
an aircraft or waterborne vessel or could pose a
toxic or fire hazard,’’ but the proposed regulatory
text did not include that specific language.
119 84 FR 15383.
120 This language in proposed § 450.135(d)(3)(iii)
is removed in the final rule, as discussed in the
preamble associated with that section.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79640
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
proposed § 450.135(d) to ‘‘model the
casualty area, and compute the
predicted consequences of each
reasonably foreseeable vehicle response
mode.’’ As explained in the NPRM, ‘‘the
casualty area and consequence analysis
would be required to account for all
relevant debris fragment
characteristics.’’ The characteristics of
all relevant debris fragments, such as
the size and kinetic energy at impact,
depend on the three fundamental
physical phenomena identified in the
final rule.
As noted earlier, the NPRM proposed
to require in § 450.121(c) that a debris
analysis account for all inert, explosive,
and other hazardous vehicle, vehicle
component, and payload debris
foreseeable from normal and
malfunctioning vehicle flight. The
NPRM also specified a set of items for
which a debris analysis would be
required to account, at a minimum.
These items included highly specific
and prescriptive debris thresholds
requirements. With the addition of the
hazardous debris definition, § 450.121
no longer requires a specific subsection
establishing debris thresholds.
In the final rule, new § 450.121(c)
contains requirements associated with
the propagation of debris that are
relocated from the proposed debris risk
analysis requirements in § 450.135(b).
Specifically, a debris analysis must
compute statistically valid debris
impact probability distributions. The
propagation of debris from each
predicted breakup location to impact
must account for all foreseeable forces
that can influence any debris impact
location, and all foreseeable sources of
impact dispersion, including, at a
minimum: The uncertainties in
atmospheric conditions; debris
aerodynamic parameters, including
uncertainties; pre-breakup position and
velocity, including uncertainties; and
breakup-imparted velocities, including
uncertainties. The FAA notes that a
quantitative description of the physical,
aerodynamic, and harmful
characteristics of hazardous debris is a
prerequisite to compute statistically
valid debris impact probability
distributions and to quantify the risks to
the public.
The propagation of debris is a
physics-based analysis that predicts
where debris impacts will occur given a
debris event while the vehicle is in
flight, such as jettison of a vehicle stage
or an explosion. The FAA moves the
requirements in proposed § 450.135(b)
to § 450.121(c) because the computation
of statistically-valid debris impact
distributions naturally depends on the
nature of the debris and the trajectory
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
analysis products from §§ 450.117 and
450.119. Similarly, the final rule
requirements in § 450.121(c) are nearly
identical to those in proposed
§ 450.135(b), except that the final rule
removes the term ‘‘including
uncertainties’’ from the regulation. The
FAA finds inclusion of this term to be
superfluous, as accounting for
foreseeable sources of impact dispersion
naturally includes the uncertainties in
the debris aerodynamic parameters, prebreakup state vectors, and breakupimparted velocities. The FAA notes that
the debris analysis must compute
statistically valid debris impact
probability distributions of all
hazardous debris to be consistent with
the scope identified in § 450.121(a).
Virgin Galactic recommended that the
FAA allow operators to provide their
own assessments of casualty causing
debris. The FAA agrees that the specific
impact vulnerability thresholds
specified in the NPRM were overly
prescriptive and potentially overly
conservative for some non-rigid debris
impacts. Thus, the final rule removes
these proposed requirements in
§ 450.121(c) entirely.
In the NPRM, § 450.121(d) provided
the debris analysis application
requirements. In the final rule, the FAA
relocates and revises proposed
§ 450.121(d)(1), which was a
requirement to submit a description of
the debris analysis methodology, to
§ 450.121(d)(2). The FAA re-designates
and revises proposed § 450.121(d)(2) as
§ 450.121(d)(1) in the final rule. In the
NPRM, proposed § 450.121(d)(2)
required an operator submit a
description of all vehicle breakup
modes and the development of debris
lists. In the final rule, the re-designated
§ 450.121(d)(1) makes use of the formal
definition of ‘‘hazardous debris,’’
requiring a description of all scenarios
that can lead to hazardous debris.
In the final rule, § 450.121(d)(2) and
(d)(3) require an operator to submit a
description of the methods used to
perform the vehicle impact and breakup
analysis in accordance with
§ 450.115(c), which is consistent with
similar changes in other FSA sections.
The final rule also moves the
requirements relevant to the debris
propagation analysis from proposed
§ 450.135(e)(2) and (e)(5) to
§ 450.121(d)(3) and (d)(4).
The FAA re-designates and revises
proposed § 450.121(d)(3) as
§ 450.121(d)(5). In the NPRM, proposed
§ 450.121(d)(3) required an applicant to
submit all debris fragment lists
necessary to describe the physical,
aerodynamic, and harmful
characteristics of each debris fragment
PO 00000
Frm 00076
Fmt 4701
Sfmt 4700
or fragment class quantitatively. Section
450.121(d)(5) of the final rule requires a
quantitative description of the physical,
aerodynamic, and harmful
characteristics of hazardous debris. The
FAA finds that ‘‘quantitative
description’’ will allow alternative
approaches for the applicant to
demonstrate compliance with this
section.
Virgin Galactic stated the proposal
would introduce additional workload to
the company. Virgin Galactic raised
concern that proposed § 450.121
introduced requirements for waterborne
vessels that were not referenced in other
parts of the rule. The NPRM proposed,
and the final rule requires in
§ 450.133(b), that a flight hazard area
analysis must determine waterborne
vessel hazard areas. Also, the NPRM
preamble explained that the
requirement includes people on ships in
the collective risk computation (see
proposed § 450.101(a)(1) and (b)(1)), and
thus explicitly allows the application of
risk management principles to protect
people on waterborne vessels. The FAA
finds that the scope of the FSA
requirements in the final rule are
consistent with current practice and
will not introduce additional workload.
Virgin Galactic stated that the FAA
should quantify the debris that could
cause a casualty on a waterborne vessel.
The FAA notes that it provided
guidance on debris thresholds for
waterborne vessels in Table 10 of the
draft AC on High-Fidelity FSA
published with the NPRM.
r. Population Exposure Analysis
(§ 450.123)
In the NPRM, the exposure model
requirements were addressed in the
debris risk analysis section in proposed
§ 450.135(c) and (d) because a complete
risk analysis must account for the
distribution of people and how those
people may be sheltered. The FAA
received numerous comments stating
the proposed requirements were too
prescriptive. The FAA agrees and has
revised the requirements to be more
performance-based.
In the final rule, the FAA revises the
exposure model requirements and
moves them from proposed § 450.135(c)
and (d) to § 450.123 (Population
Exposure Analysis). The FAA moves the
population exposure analysis
requirements out of the proposed debris
risk analysis section because this
analysis informs other sections of the
FSA. A population exposure analysis
must also be used to provide input to
other public risk analyses to address
toxic hazards and far-field overpressure
blast effects, if any. This change does
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
not an expand the scope of the final rule
beyond what was proposed in the
NPRM because the NPRM identified the
need for population exposure input to
address toxic hazards for flight and farfield overpressure blast effects.121 The
rationale for the final rule requirements
remains the same as proposed in the
NPRM: An exposure model provides
critical input data on the geographical
location of people and critical assets at
various times when the launch or
reentry operation could occur. While
the rationale remains the same, the FAA
makes two changes in § 450.123.
Consistent with the change discussed in
the critical assets section of the
preamble, the FAA removes the
requirement for an operator to
characterize the distribution and
vulnerability of critical assets. The FAA
also revises the population exposure
analysis to require that input data must
account for the vulnerability of people
to hazardous debris effects. The FAA
will issue a Population Exposure
Assessment AC to describe a possible
means of compliance.
Section 450.123(a) requires that an
FSA must account for the distribution of
people for the entire region where there
is a significant probability of impact of
hazardous debris. This final rule is
consistent with the requirement in
proposed § 450.135(c)(1) that the
population exposure data would be
required to include the entire region
where there is a significant probability
of impact of hazardous debris. The
definition of ‘‘hazardous debris’’ in
§ 401.7 informs the scope of this
requirement. In § 450.123(a), the
standard of ‘‘significant’’ means that the
scope of the population exposure
analysis is bounded by what is
necessary to demonstrate compliance
with the risk criteria in § 450.101(a) and
(b), consistent with the scope
requirements set in §§ 450.113 and
450.115.
Section 450.123(b) sets constraints on
the population exposure analysis
consistent with proposed § 450.135(c)(2)
through (c)(7). Specifically, § 450.123(b)
requires that the exposure analysis must
characterize the distribution of people
both geographically and temporally;
account for the distribution of people
among structures and vehicle types; and
121 Specifically, in § 450.139(f) the FAA proposed
to require an applicant submit (ii) the population
density in receptor locations that are identified by
toxic dispersion modeling as toxic hazard areas;
and (iv) the identity of the population database
used. Also, in § 450.137(c)(1) the FAA proposed to
require an applicant submit a description of the
population centers, terrain, building types, and
window characteristics used as input to the far-field
overpressure analysis.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
use reliable, accurate, and timely source
data.
Section 450.123(b)(1) relocates the
requirements in proposed
§ 450.135(c)(2), but removes the term
‘‘vulnerability’’ and the reference to
critical assets, as discussed earlier.122
The final rule removes proposed
§ 450.135(c)(4), which would have
required the exposure model to have
sufficient temporal and spatial
resolution that a uniform distribution of
people within each defined region can
be treated as a single average set of
characteristics without degrading the
accuracy of any debris analysis output.
By removing this requirement, an
operator may demonstrate compliance
with § 450.123(b) in the manner set
forth in proposed § 450.135(c)(4), but
also has flexibility to demonstrate
compliance through other means.
Section 450.123(b)(2) replaces the
more prescriptive requirements in
proposed § 450.135(c)(3) by removing
the requirement that, in accounting for
the distribution of people among
structures and vehicle types, an
exposure analysis includes ‘‘a resolution
consistent with the characteristic size of
the impact probability distributions for
relevant fragment groups.’’ The language
removed from the final rule remains a
valid means for an operator to
demonstrate compliance with
§ 450.123(b)(2) in the final rule.
Section 450.123(b)(3) replaces the
more prescriptive requirements in
proposed § 450.135(c)(5) and (c)(6) so
that an exposure analysis must use
reliable, accurate, and timely source
data.
Section 450.123(b)(4) consolidates
and replaces the requirements to
account for the vulnerability of people
to hazardous debris effects that were
proposed in § 450.135(d)(3)(i) and (ii),
as well as proposed in § 450.137(b)(4).
In the final rule, the FAA removes the
requirement in proposed § 450.135(c)(7)
altogether. Proposed § 450.135(c)(7) is
redundant in conjunction with the
requirements in § 450.115(b), which
specify the necessary fidelity of any
FSA, and the requirement in
§ 450.101(g) that an operator must use
accurate data and scientific principles
and the analysis must be statistically
valid.
The FAA moves and revises the
application requirements in proposed
§ 450.135(e)(3) as § 450.123(c)(1) in the
122 However, the proposed requirement in
§ 450.135(c)(4) to characterize the vulnerability of
people both geographically and temporally is
effectively preserved in the final rule requirement
in § 450.123(b)(4) to account for vulnerability of
people to hazardous debris effects in the population
exposure analysis.
PO 00000
Frm 00077
Fmt 4701
Sfmt 4700
79641
final rule. The FAA revises the final
§ 450.123(c)(1), which requires an
applicant to submit a description of the
FSA methodology, to reference
§ 450.115(c). As previously noted, the
population exposure analysis must also
be used to provide input to other public
risk analyses to address toxic hazards
and far-field overpressure blast effects,
if any. Section 450.123(c)(2) requires an
applicant to submit complete
population exposure data, in tabular
form, which is a more concise statement
equivalent to proposed § 450.135(e)(4).
In the final rule, the FAA specifies that
the complete population exposure data
must be in tabular form and deletes the
requirement that the description of the
exposure input data include, for each
population center, a geographic
definition and the distribution of
population among shelter types as a
function of time of day, week, month, or
year. The population exposure data
provided under § 450.123(c)(2) may
reflect some or all of the information
described in proposed § 450.135(e)(4).
s. Probability of Failure Analysis
(§ 450.131)
In the NPRM, proposed § 450.131
covered probability of failure analysis
requirements for all launch and reentry
vehicles. In the final rule, the FAA
adopts proposed § 450.131 with minor
revisions codifying current practices
and eliminating the proposed classes of
mishaps referenced in § 450.131.
Section 450.131(a) proposed that for
each hazard and phase of flight, an FSA
for a launch or reentry would be
required to account for vehicle failure
probability. The probability of failure
would be required to be consistent for
all hazards and phases of flight. For a
vehicle stage with fewer than two
flights, the failure probability estimate
would be required to account for the
outcome of all previous flights of
vehicles developed and launched or
reentered in similar circumstances. For
a vehicle or vehicle stage with two or
more flights, vehicle failure probability
estimates would be required to account
for the outcomes of all previous flights
of the vehicle or vehicle stage in a
statistically valid manner. The outcomes
of all previous flights of the vehicle or
vehicle stage would be required to
account for data on any partial failure
and anomalies, including Class 3 and
Class 4 mishaps, as defined in proposed
§ 401.5. The FAA adopts § 450.131(a) as
proposed with a minor change to the
language pertaining to mishaps to reflect
revisions to the definition of ‘‘mishap’’
in § 401.7. The FAA notes that the final
rule replaced the term ‘‘partial failures’’
with ‘‘mishap’’ in § 450.131(a)(2)
E:\FR\FM\10DER2.SGM
10DER2
79642
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
because the proposed language
referenced both anomalies and mishaps,
and ‘‘partial failure’’ is redundant since
any partial failure could qualify as an
anomaly or a mishap under § 401.7,
depending on the nature of the failure.
Virgin Galactic commented that the
proposed requirements to gather and
account for anomaly data in the
probability of failure analysis
introduced additional workload
compared to the current regulation. It
recommended the FAA adopt a
performance-based standard in an
SNPRM.
The FAA does not agree that this
requirement results in additional
workload from current regulations. The
FAA notes that the final rule
requirement in § 450.101(g) is relevant
here because it requires that a method
must produce results consistent with, or
more conservative than, the results
available from previous mishaps, tests,
or other valid benchmarks, such as
higher-fidelity methods.123 Hence, an
operator has the option to use a more
conservative approach to avoid any
unnecessary additional workload. For
example, an operator can assume one
more failure than the actual outcomes of
all previous flights of the vehicle or
vehicle stage. Therefore, the FAA does
not find that the requirements in the
final rule constitute additional workload
compared to current regulations.
Boeing requested clarification on
what is meant by a ‘‘consistent’’
probability of failure in this section. The
FAA clarifies that the vehicle or vehicle
stage probability of failure must be
consistent internally with outcomes of
previous flights, as described in
§ 450.131(a)(1) and (a)(2). Furthermore,
the probability of failure input data
must be consistent for all phases of
flight and hazards. In this context,
‘‘consistent’’ does not mean identical
and does not preclude an operator from
varying the probability of failure within
statistical confidence limits for the same
event in different contexts, in order to
bias an analysis towards a conservative
outcome.124 The probability of failure
input data should be reasonably
conservative and consistent across
phases of flight and for various hazards
given the uncertainty in each
probability of failure.
A hypothetical example is a proposed
launch of a two-stage launch vehicle
123 Because the FSA is necessary to demonstrate
compliance with the risk criteria in § 450.101, the
requirements set forth in that section regarding the
validity of analysis apply to all parts of the FSA.
124 Section 450.115(b)(1) requires an operator to
demonstrate that any risk to the public satisfies the
safety criteria of § 450.101 accounting for all known
sources of uncertainty.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
from both CCAFS and Vandenberg Air
Force Base (VAFB). In this case, the
best-available data indicates the mean
conditional probability of a failure
during first stage and second stages of
flight are both 50 percent, with plus or
minus 10 percent uncertainty at a
minimal level of confidence (e.g., 60
percent lower and upper bound
confidence limits at 40 percent and 60
percent based on the binomial
distribution).
Given the fact that the public
exposure to hazardous debris effects for
launches from VAFB is relatively high
during stage one, and the opposite is
true for launches from CCAFS, a
consistent and reasonably conservative
probability of failure analysis would use
a 60–40 split in the conditional
probability of failure during stage one
and stage two flight for launches from
VAFB, but a 40–60 split in the
conditional probability of failure during
stage one and stage two flight for
launches from CCAFS. Furthermore, the
conditional probability of a failure
applied to different hazards, such as
debris and toxics, must be consistent
with each other. More details on means
of compliance are provided in the High
Fidelity FSA Methods AC published
with this rule, and a future AC on
probability of failure.
Leo Aerospace asked if the FAA
would consider a balloon platform to be
a stage.
The FAA will discuss project-specific
information, including whether a
balloon platform is part of a launch
vehicle stage, during pre-application
consultation.
Boeing, Blue Origin, and Sierra
Nevada commented on the lack of
availability of previous flight
information for vehicles not operated or
owned by the applicant.
The FAA responded to this comment
in the FAA’s ‘‘Responses to the Public’s
Clarifying Questions Received by July
12, 2019,’’ 125 which is posted in the
docket. An operator should use the bestavailable data, which in many cases
would be limited to publicly available
data. The FAA will also provide data
and guidance on failure mode and phase
of flight allocations in the High Fidelity
FSA Methods AC, which will be
finalized with this rule.
In the final rule, the FAA replaces all
references to Class 3 and Class 4
mishaps in § 450.131 with the term
‘‘mishap.’’ As previously noted, the
FAA eliminates the proposed classes of
mishaps in the revised definition of
mishap in § 401.7 of the final rule.
125 See
PO 00000
FAA–2019–02290–0134.
Frm 00078
Fmt 4701
Sfmt 4700
In the NPRM, the FAA proposed that,
for FSA purposes, a failure occurs when
a vehicle does not complete any phase
of normal flight or when any anomalous
condition exhibits the potential for a
stage or its debris to impact the Earth or
reenter the atmosphere outside the
normal trajectory envelope during the
mission or any future mission of similar
vehicle capability. It further stated that
Class 1 or Class 2 mishaps would
constitute failures.
Blue Origin commented that defining
failure as not completing any phase of
normal flight is ‘‘overly punitive’’ as
proposed in § 450.131(b). Operators may
define secondary mission objectives for
research and development purposes
that, if not achieved, do impact mission
success but do not impact safety. Blue
Origin proposed deleting the language
‘‘when a vehicle does not complete any
phase of normal flight or’’ and anchor
the definition in impacts outside the
normal envelope. Virgin Galactic
recommended that the FAA should only
account for failures, partial failures, and
anomalies that affect public safety. Blue
Origin also commented that including
anomalies that might impact a future
mission conflicts with the causal logic
that an anomaly experienced on a given
mission will be subject to corrective
actions prior to the next mission.
The FAA understands the concerns
raised by the commenters but finds it
unnecessary to change the regulatory
text to address these concerns. An
operator may adjust its final failure
probability estimates to account for
various extenuating circumstances, as
will be described in a future Probability
of Failure Analysis AC. For example,
the probability of failure may be
adjusted based on extenuating
circumstances with justification (e.g., if
the failure is not public safety related or
if corrective actions implemented after a
failure were demonstrated to be
successful). If an operator makes any
adjustments to the final failure
probability estimates to account for
various extenuating circumstances, it
can update its FSA in accordance with
§ 450.103(d).
The FAA notes that, for FSA
purposes, the vehicle failure probability
accounts for any failure of the launch or
reentry system because of the way
failure is defined in § 450.131(b).
Specifically, for FSA purposes, a failure
occurs when a vehicle does not
complete any phase of normal flight or
when any anomalous condition exhibits
the potential for a stage or its debris to
impact the Earth or reenter the
atmosphere outside the normal
trajectory envelope during the mission
or any future mission of similar vehicle
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
capability. Therefore, in the context of
FSA, any failure of the launch or reentry
system, including pilot error, that
produced vehicle failure as defined in
§ 450.131(b) must be taken into
account.126
Proposed § 450.131(c) defined
‘‘previous flight’’ by stating that the
flight of a launch vehicle begins at a
time when a launch vehicle normally or
inadvertently lifts off from a launch
platform and the flight of a reentry
vehicle or deorbiting upper stage begins
at a time when a vehicle attempts to
initiate a deorbit. The FAA adopts
§ 450.131(c)(1) as proposed with a
minor change. The FAA strikes the
words ‘‘normally or inadvertently’’ as
redundant, since any lift off, whether
normal or inadvertent, would count as
a flight under the proposed and final
rule requirements in § 450.131(c)(1).
Boeing, Lockheed Martin, Northrop
Grumman, ULA, and Virgin Galactic
requested explanation on whether the
proposed requirement in § 450.131(c)
would apply to hybrid vehicles.
In the final rule, the FAA revises the
regulatory text in response to these
comments. The FAA changes ‘‘launch
platform’’ to ‘‘surface of the Earth’’ as
the point at which flight begins for a
probability of failure analysis. This
change reflects the fact that various
types of vehicles, such as hybrids, do
not lift off from launch platforms. The
probability of failure analysis must
account for the probability of failure
during all phases of flight to ensure
public safety, including captive carry,
unless the exception in § 450.113(b)
applies to that phase of flight. For
example, an aircraft crash with a rocket
attached can present much higher risks
to the public from an explosion, toxic
release, or inert impact, than the risks
posed by an aircraft crash without a
rocket attached.
For the purposes of § 450.131(c)(1)
and (c)(2), a previous flight may include
flights conducted outside FAA licensed
activity, such as amateur, permitted,
U.S. government, or foreign launches,
reentries, or flights. For the purposes of
§ 450.131(c)(1) and (c)(2), a previous
flight may include FAA-licensed
activity, such as the Falcon 9 launch
vehicle anomaly which destroyed the
vehicle and its AMOS–6 payload,127 if
the outcome exhibited the potential for
a stage or its debris to impact the Earth
or reenter the atmosphere outside the
normal trajectory envelope during the
mission or any future mission of similar
vehicle capability. The FAA also
126 The SpaceShipTwo accident on October 31,
2014, is an example of this situation.
127 On September 1, 2016.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
changes the word ‘‘deorbit’’ to ‘‘reentry’’
to accommodate a reentry that starts on
a suborbital trajectory.
In the NPRM, § 450.131(d) proposed
to require that a vehicle probability of
failure be distributed across flight times
and vehicle response modes. The
distribution would be consistent with
the data available from all previous
flights of vehicles developed and
launched or reentered in similar
circumstances and data from previous
flights of vehicles, stages, or
components developed and launched or
reentered by the subject vehicle
developer or operator. As proposed, the
data could include previous experience
involving, among other things, a similar
level of experience of the vehicle
operation and development team
members.
The FAA adopts § 450.131(d) with
revisions. Specifically, the FAA changes
‘‘flight time’’ to ‘‘flight phase.’’ ‘‘Flight
phase’’ gives applicants more flexibility
in their analysis because it is less
specific than ‘‘flight time.’’ The FAA
also changes ‘‘vehicle response mode’’
to ‘‘failure mode,’’ consistent with
similar changes throughout the final
rule. Finally, the FAA replaces the
phrase ‘‘launched or reentered’’ in
§ 450.131(d)(2) to ‘‘launched, reentered,
flown, or tested.’’ This change will
enable the probability of failure
allocation across flight phases and
failure modes to account for data from
previous flights of vehicles, stages, or
components by the subject vehicle
developer or operator that did not
qualify as launch or reentry operations,
such as drop tests or glide flights. The
FAA also revises ‘‘flight phases’’ and
‘‘failure modes’’ to be plural in the final
rule. This amended language is a minor
grammatical change and is consistent
with the intent of the proposed
requirement.
Virgin Galactic commented that the
FAA should not employ a subjective
measure of ‘‘level of experience’’ and
requested this language be stricken.
The FAA asserts that this measure is
not subjective. The High Fidelity FSA
Methods draft AC contained specific
quantitative thresholds that have been
used for many years as guidelines to
distinguish new versus experienced
developers for the purposes of
probability of failure analyses. Because
the quantitative thresholds are in
guidance, the FAA may consider other
quantitative thresholds as appropriate.
Furthermore, the data available from
previous flights of ELVs developed by
experienced and inexperienced
operators demonstrates a statistically
significant difference between the
relative frequency of failures during the
PO 00000
Frm 00079
Fmt 4701
Sfmt 4700
79643
first and second phases of flight.
Therefore, because the required input
data may involve a similar level of
experience of the vehicle operation and
development team members, the final
rule in § 450.131(d)(2)(iii) retains that
consideration.
The FAA adopts the observed and
conditional failure rate requirements in
§ 450.131(e) as proposed and the
application requirements in § 450.131(f)
with revisions. Section 450.131(f)(1) to
require methods used in probability of
failure analysis be in accordance with
§ 450.115(c) because that section sets
out the requirements for FSA
methodologies. In § 450.131(f)(2), the
FAA changes the term ‘‘vehicle
response mode’’ to ‘‘failure mode,’’
which is consistent with similar
changes throughout this final rule.
t. Flight Hazard Area Analysis
(§ 450.133)
In § 450.133, the NPRM proposed
general requirements for the flight
hazard area analysis as well as
requirements specific to waterborne
vessel hazard areas, land hazard areas,
airspace hazard volumes, and the
license application. In the final rule, the
FAA adopts § 450.133 with revisions.
The revisions include changing terms
proposed in the NPRM and removing
redundant requirements.
Proposed § 450.133(a) stated that an
FSA would be required to include a
flight hazard area analysis that identifies
any region of land, sea, or air that would
be required to be surveyed, publicized,
controlled, or evacuated in order to
control the risk to the public. A flight
hazard area analysis would be required
to account for all reasonably foreseeable
vehicle response modes during nominal
and non-nominal flight that could result
in a casualty. The NPRM specified six
items that would be required to be
included in a flight hazard area analysis,
at a minimum.
The FAA adopts § 450.133(a) with
revisions. The FAA moves the
requirement in § 450.133(a) that a flight
hazard area analysis must account for
all reasonably foreseeable vehicle
response modes during nominal and
non-nominal flight that could result in
a casualty to § 450.133(a)(1). This text is
also revised, as discussed below. The
replacement of ‘‘vehicle response
modes’’ with ‘‘failure modes’’ was
discussed in the preamble section on
§ 450.101(c)(2).
In § 450.133(a)(1), the FAA proposed
that the flight hazard analysis must
account for the regions of land, sea, and
air potentially exposed to debris impact
resulting from normal flight events and
from debris hazards resulting from any
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79644
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
potential malfunction. The FAA revises
proposed § 450.133(a)(1) by adding the
term ‘‘hazardous debris’’ as discussed in
the preamble section for § 450.121
(Debris Analysis). As defined,
hazardous debris includes any object or
substance capable of causing a casualty
or loss of functionality to a critical asset,
such as an intact vehicle, vehicle
fragments, any detached vehicle
component, whether intact or in
fragments, payload, and any planned
jettison bodies. The FAA also replaces
‘‘vehicle response mode’’ with ‘‘failure
modes’’ for consistency throughout the
final rule.
In § 401.7, the FAA modifies the
definition of ‘‘flight hazard area’’ as
applied to part 450. The NPRM
proposed that flight hazard area means
any region of land, sea, or air that must
be surveyed, publicized, controlled, or
evacuated in order to ‘‘protect public
health and safety and the safety of
property.’’ This language was
inconsistent with the language in
§ 450.133. As such, in the final rule, the
definition has been revised in § 401.7
for consistency to state that a flight
hazard area is any region of land, sea,
or air that must be surveyed, publicized,
controlled, or evacuated in order to
‘‘ensure compliance with the safety
criteria in § 450.101.’’
Boeing, Lockheed Martin, Northrop
Grumman, and ULA suggested replacing
‘‘all reasonably foreseeable’’ with
‘‘credible’’ because credibility is
established in the system safety
analysis. As discussed previously, the
FAA does not agree with the
recommendation because the term
credible is prone to errors in judgment
whereas the term foreseeable is more
readily discerned by analysis (e.g., fault
trees). The final rule moves the term
‘‘reasonably foreseeable’’ from proposed
§ 450.133(a) to § 450.133(a)(1), where it
more appropriately modifies the
language in § 450.133(a)(1) that specifies
the analysis must account for the
regions of land, sea, and air potentially
exposed to hazardous debris generated
during normal flight events and all
reasonably foreseeable failure modes.
The FAA adopts § 450.133(a)(2) with
a minor correction. The FAA replaces
‘‘control risk to any hazard’’ in the
NPRM with ‘‘control risk from any
hazard’’ in the final rule.
In § 450.133(a)(3), the FAA proposed
that the analysis account for the limits
of a launch or reentry vehicle’s normal
flight, including winds that were no less
severe than the worst wind conditions
under which flight might be attempted
and uncertainty in the wind conditions.
The FAA adopts § 450.133(a)(3) with
revisions. The FAA changes ‘‘wind
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
conditions’’ to ‘‘atmospheric
conditions’’ because in some cases, such
as far-field overpressure blast and toxics
analyses, the temperature profile is an
atmospheric condition that may also be
stipulated as part of the flight commit
criteria (in addition to the wind profile).
This change does not create any
additional burden to the operator
because the proposed and final
requirements in § 450.135(e)(1) and
§ 450.165(b)(2) already require an
operator to account for and identify the
conditions immediately prior to
enabling the flight of a launch vehicle
or the reentry of a reentry vehicle that
are necessary to demonstrate
compliance with the safety criteria in
§ 450.101, such as the atmospheric
conditions and any meteorological
conditions. The final rule in
§ 450.133(a)(3) clarifies that all
atmospheric conditions are
considerations when the operator
establishes the worst conditions under
which flight might be attempted.
In § 450.133(a)(4), the FAA proposed
that the analysis account for the debris
identified for each foreseeable cause of
breakup, and any planned jettison of
debris, launch or reentry vehicle
components, or payload. The FAA
adopts § 450.133(a)(4) with a revision.
For reasons previously discussed, the
FAA replaces this section with ‘‘all
hazardous debris,’’ which uses the term
defined in § 401.7 of the final rule. This
revision does not change the intent of
the requirement.
In § 450.133(a)(5), the FAA proposed
that the analysis account for all
foreseeable sources of debris dispersion
during freefall, including wind effects,
guidance and control, velocity imparted
by breakup or jettison, lift, and drag
forces. The FAA adopts § 450.133(a)(5)
with revisions. In the final rule, the
analysis must account for sources of
debris dispersion in accordance with
§ 450.121(c). The FAA makes this
revision to avoid replication of
requirements between §§ 450.133(a)(5)
and 450.121(c) and to ensure
consistency in the FSA.
AOPA commented that the FAA
should provide the public an
authoritative source of flight hazard area
information as well as guidance on
various flight hazard area analysis
methodology. The FAA is working on
the NOTAM/Aeronautical Information
Service (AIS) Modernization effort,
which will redesign the current
NOTAM management information
system with a single technology gateway
for entering, processing, and retrieving
all NOTAM data, making it easier for all
users of the airspace to access safetycritical information. The FAA finds that
PO 00000
Frm 00080
Fmt 4701
Sfmt 4700
the issue raised by AOPA is best
addressed by the NOTAM/AIS
Modernization effort rather than this
rulemaking. Industry can provide input
on this effort through the Aeronautical
Information Systems Coalition.
Information regarding temporary flight
restrictions (TFR) can be found at:
https://tfr.faa.gov/tfr2/list.html and is
searchable by the type of TFR being
implemented. The FAA plans to
complete the NOTAM/AIS
Modernization effort by late 2022. In
addition, an acceptable flight hazard
area analysis methodology is addressed
in the High Fidelity FSA AC.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA also provided
suggested regulatory text that stated the
airspace hazard volume was only
necessary for airspace up to 60,000 feet
mean sea level. The FAA agrees that the
analysis only needs to account for
reasonably expected air traffic in a given
region, but, in order to account for
operations in different regions, does not
change the text to a specific altitude.
The FAA adopts § 450.133(b), (c), and
(d) as proposed. Section § 450.133(b)(1),
(c)(1), and (d)(1) state that flight hazard
areas must be determined as necessary
to contain, with 97 percent probability
of containment, all debris resulting from
normal flight events capable of causing
a casualty to any person located on
land, sea, or air. In the NPRM, the FAA
explained that proposed § 450.133(b)(1),
(c)(1), and (d)(1) would align FAA
regulations with practices at the Federal
launch or reentry sites by allowing
operators to reduce or otherwise
optimize the size of the regions for
warnings of potential hazardous debris
resulting from normal flight events.
Virgin Galactic stated that, given the
currently available information and
tools regarding debris, the 97 percent
probability of containment requirement
in proposed § 450.133(b)(1), (c)(1), and
(d)(1) would result in inflated hazard
area determinations. Boeing, Lockheed
Martin, Northrop Grumman, and ULA
commented on proposed § 450.133(b)(1)
and suggested it reference current 3sigma standards. Boeing stated that,
given the new limitation on debris,
changing from 99.7 percent to 97
percent containment appeared less safe.
The final rule retains the 97 percent
containment requirement proposed in
the NPRM. The FAA notes that the
comments demonstrate a difference of
opinion in the industry regarding the
appropriate probability of containment
requirement for flight hazard areas, with
Virgin Galactic claiming the proposal
would result in inflated hazard area
determinations, as opposed to the other
commenters calling for more stringent
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
hazard area requirements to maintain
public safety. The FAA finds the 97
percent containment requirement strikes
an appropriate balance, particularly
when coupled with the requirement to
include the collective risk contribution
from people in waterborne vessels in the
public risk criteria in § 450.101. As
noted in the NPRM, the FAA adopts
flight hazard area regulations for
waterborne vessels consistent with past
waivers that the FAA granted to ensure
they align with current practices at the
Federal launch ranges, where most
commercial launches take place
currently. Recent experience from
commercial and U.S. Government
launch and reentry operations
demonstrates that the requirements
adopted eliminate unnecessary launch
delays while ensuring that the overall
level of safety provided to the public
remains consistent with the public risk
criteria in § 450.101. The FAA notes that
the application of a risk management
approach to ensure the safety of people
in waterborne vessels is consistent with
recommendations made by the National
Academy of Sciences.128 The FAA finds
that public safety is not compromised
by changing 99.7 percent containment
to 97 percent containment because the
overall public risk criteria must also be
met, irrespective of the size of the
hazard areas. From a policy perspective,
the final rule approach to protect people
in waterborne vessels achieves the goal
of common standards for launches from
any U.S. launch site, Federal or nonFederal. Both industry and the National
Space Council have urged government
agencies involved in the launch and
reentry of vehicles by commercial
operators to work towards common
standards.
Boeing also requested clarification on
how containment boxes for nominal
impacts can use the same standard as
hazard areas intended to contain debris
in the much less likely event of a
failure. The FAA notes that planned
hazardous debris impacts must use a
probability of 1 in the analysis in
accordance with § 450.133(a)(6), while
hazardous debris impacts due to a
failure will have a probability applied as
determined from the § 450.131
probability of failure analysis.
The FAA adopts § 450.133(b)(2),
(c)(2), and (d)(2) as proposed. These
sections use probability of impact
128 In 2001, the NRC published a report on
‘‘Streamlining Space Launch Range Safety,’’ which
included a recommendation that ‘‘safety procedures
based on risk avoidance should be replaced with
procedures consistent with the risk management
philosophy specified by EWR 127–1.’’ See p. 44 of
IBSN 0–309–51648–X available at https://
www.nap.edu/catalog/9790.html.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
contours or probability of casualty
contours to meet the risk requirements
in § 450.101 for sea, land, and air.
Blue Origin commented that the
intent of these requirements seems to be
to establish hazard areas for normal
operations and mishaps, but the
requirements do not explicitly state that
the risk criteria applies to malfunction
trajectories. Blue Origin proposed that
the FAA should specify that risk
contours should be conducted for
malfunction trajectories.
The FAA notes the proposed
requirement in § 450.133(a) that a flight
hazard area analysis must account for
all reasonably foreseeable vehicle
response modes during nominal and
non-nominal flight that could result in
a casualty also specified that the risk
contours required in proposed
§ 450.133(e)(2)(iii) through (v) must
account for malfunction trajectories.
However, the FAA revises the
requirement to state in § 450.133(a)(1)
that the flight hazard area analysis must
account for the regions of land, sea, and
air potentially exposed to hazardous
debris generated during normal flight
events and ‘‘all reasonably foreseeable
failure modes,’’ which includes
malfunction trajectories. In addition, the
FAA revises the risk contour
requirement in § 450.133(e)(2)(iii),
which is explained below in the
discussion on that requirement. The
FAA notes that the High-Fidelity FSA
Methods AC describes one acceptable
methodology for flight hazard areas,
which accounts for malfunction
trajectories.
Virgin Galactic commented that
requirements for waterborne vessels
should also be in § 450.101. The FAA
notes that the operator must meet
individual and collective risk
requirements, as stated in § 450.101.
People on waterborne vessels are
included in the collective and
individual risk calculations. However,
as explained in the NPRM, operators
have the option to use the current
approach in part 417 as a means of
compliance, which requires surveillance
to ensure no ship is exposed to more
than 1 × 10¥5 probability of impact,
because that will be generally sufficient
to ensure compliance with § 450.101.
In § 450.133(e)(1), the FAA proposed
that the applicant submit a description
of the methodology to be used in the
flight hazard area analysis including all
assumptions and justifications for the
assumptions, vulnerability models,
analysis methods, and input data. In the
final rule, the FAA revises this
requirement by adding that the analysis
must be done in accordance with
§ 450.115(c) to avoid replication of
PO 00000
Frm 00081
Fmt 4701
Sfmt 4700
79645
requirements and ensure consistency
throughout subpart C of part 450.
In § 450.133(e)(1)(i), the FAA
proposed that an applicant provide
input wind data and justification in the
application. The FAA did not adopt this
proposal in the final rule. Rather, the
FAA deletes proposed § 450.133(e)(1)(i)
because this application requirement is
covered in § 450.117(c). Section
450.117(c) accounts for all atmospheric
conditions that have an effect on the
trajectory, including worst case
atmospheric profile conditions under
which flight might be attempted.
In § 450.133(e)(2), the FAA proposed
that an applicant submit tabular data
and graphs of the results of the flight
hazard area analysis, including in
§ 450.133(e)(2)(iv) and (v) the following:
if applicable, representative 1 × 10¥5
and 1 × 10¥6 probability of impact
contours for all debris capable of
causing a casualty to persons on a
waterborne vessel regardless of location;
and representative 1 × 10¥6 and 1 ×
10¥7 probability of impact contours for
all debris capable of causing a casualty
to persons on an aircraft regardless of
location.129
Blue Origin commented that, by
requiring 1 × 10¥6 and 1 × 10¥7 risk
contours for waterborne vessels and
aircraft, respectively, the FAA was
extending application requirements
beyond those either currently codified
in part 400 or proposed in part 450.
The FAA notes that, as stated in the
NPRM preamble, these contours are
necessary for the applicant to
demonstrate to the FAA sufficient
computational resolution and analysis
fidelity for the results that are critical to
public safety. Thus, the FAA declines to
adopt the recommended change. For
these reasons, the FAA adopts
§ 450.133(e)(2)(iv) and (e)(2)(v) as
proposed.
In § 450.133(e)(2)(iii), the FAA
proposed that an applicant would be
required to submit representative
individual probability of casualty
contours regardless of location.
Virgin Galactic requested clarification
on the meaning of the term ‘‘regardless
of location.’’ Based on the context in
proposed § 450.133(a), which required
the flight hazard area analysis to
identify any region of land, sea, or air
that must be surveyed, publicized,
controlled, or evacuated in order to
control the risk to the public, the term
‘‘regardless of location’’ referred to
whether the contours are on land, sea,
129 The FAA received no comments on
§ 450.133(e)(2)(i) and (ii) and adopts
§ 450.133(e)(2)(i) as proposed and § 450.133(e)(2)(ii)
a revision include a cross-reference to the hazard
area publication requirement in § 450.161.
E:\FR\FM\10DER2.SGM
10DER2
79646
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
or air. In the final rule, the FAA changes
the term ‘‘regardless of location’’ to ‘‘for
all locations specified in paragraph (a)’’
for more specificity. The FAA further
specifies that ‘‘representative
probability of casualty contours’’ must
account for both neighboring operations
personnel (at the 1 × 10¥5 probability of
casualty level) and other members of the
public (at the 1 × 10¥6 probability of
casualty level). Hence, the requirement
in § 450.133(e)(2)(iii) of the final rule
specifies that representative individual
probability of casualty contours include
tabular data and graphs showing the
hypothetical location of any member of
the public that could be exposed to a
probability of casualty of 1 × 10¥5 or
greater for neighboring operations
personnel, and 1 × 10¥6 or greater for
other members of the public, given all
foreseeable conditions within the flight
commit criteria.
The FAA adds this explicit language
to the application requirement to reflect
what is necessary to demonstrate
compliance with the substantive
requirements for flight hazard area
analysis as proposed in the NPRM and
as set forth in the final rule.
Specifically, the substantive
requirements proposed in
§ 450.133(b)(2) and (c)(2), which
required an operator to determine the
areas of water and land where the
individual probability of casualty for
any person on a vessel or on land would
exceed the criterion in § 450.101(a)(2) or
(b)(2), would necessarily have required
a demonstration consistent with the
revised application requirements.
u. Debris Risk Analysis (§ 450.135)
In the NPRM, the FAA proposed to
require that a debris risk analysis be
performed to determine whether the
individual and collective risk of public
casualties meet the safety criteria in
§ 450.101. The debris risk analysis
would be required to compute
statistically-valid debris impact
probability distributions using the input
data produced by FSAs required in
proposed §§ 450.117 through 450.133.
In the final rule, the FAA adopts
§ 450.135 with revisions.
Proposed § 450.135(a) stated that a
debris risk analysis would be required
to demonstrate compliance with safety
criteria in proposed § 450.101, either
prior to the day of the operation, by
accounting for all foreseeable conditions
within the flight commit criteria or
during the countdown using the best
available input data. The FAA adopts
§ 450.135(a) with revisions. Specifically,
the FAA adds in § 450.135(a)(2) that the
‘‘best available input data’’ used during
the countdown must include any
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
applicable ‘‘flight commit criteria and
flight abort rules’’ if such controls are
necessary to ensure compliance with the
public risks as required in proposed and
final § 450.165(b).
There is no additional burden on the
operator due to the updated language in
§ 450.135(a)(2), because this
requirement is consistent with the
proposed requirements in
§§ 450.135(e)(1) and 450.165(b)(2). An
operator is required to account for and
identify the conditions immediately
prior to enabling the flight of a launch
vehicle or the reentry of a reentry
vehicle that are necessary to
demonstrate compliance with the safety
criteria in § 450.101, such as the
atmospheric conditions and any other
commit criteria. The final rule in
§ 450.135(a)(2) now explicitly
acknowledges that a valid debris risk
analysis must account for any
applicable flight commit criteria and
flight abort rules when the operator
establishes if the present conditions
produce public risks consistent with the
safety criteria in § 450.101.
In § 450.135(b), the FAA proposed
performance-based requirements to
address the physical phenomena that
influence the propagation of debris,
which the analysis would be required to
account for to compute the probability
of impact of debris on people and
critical assets. In the final rule, the FAA
adopts and moves these requirements
with revisions to § 450.121(c), as
discussed in the section of this
preamble on Debris Analysis. There
were two reasons for moving the
proposed propagation of debris
requirements in § 450.135(b) to
§ 450.121(c). First, the computation of
valid impact probability distributions is
relevant to more than the debris risk
analyses; for example, valid impact
probability distributions are necessary
for the development of flight hazard
areas and the yield-probability pairs
used as input to the far-field
overpressure analysis. Second, although
the relationships between the FSA
sections are complex and
interdependencies exist, the FAA
sought to lay out the FSA requirements
in a sequential order.
In § 450.135(c), the FAA proposed the
features of a valid population exposure
analysis. In the final rule, the FAA
adopts and moves these requirements
with revisions to § 450.123, as discussed
in the preamble associated with that
section. As noted, the FAA moved the
population exposure analysis
requirements out of the proposed debris
risk analysis section because a
population exposure analysis must also
be used to provide input to other public
PO 00000
Frm 00082
Fmt 4701
Sfmt 4700
risk analyses to address toxic hazards
and far-field overpressure blast effects,
if any. As discussed earlier, this is not
an expansion of the scope because the
NPRM identified the need for
population exposure input to address
toxic hazards for flight and far-field
overpressure blast effects.
In proposed § 450.135(d), the FAA set
forth the features of a valid casualty area
and consequence analysis. Proposed
§ 450.135(d) stated that a debris risk
analysis would be required to model the
casualty area and compute the predicted
consequences of each reasonably
foreseeable vehicle response mode in
any one-second period of flight in terms
of CEC. The NPRM also specified that
the contents of a casualty area and
consequence analysis must account for,
at a minimum, the items proposed in
§ 450.135(d)(1) through (d)(3).130
In the final rule, the FAA revises and
re-designates the requirements proposed
in § 450.135(d) to § 450.135(b). In
addition, the FAA replaces the term
‘‘vehicle response mode’’ with ‘‘failure
mode,’’ consistent with similar changes
made throughout the final rule and
discussed further in § 450.101(c)(2) of
this preamble. The FAA also replaces
the term ‘‘one-second period of flight’’
with ‘‘significant period of flight,’’ as
discussed in the preamble section
associated with high consequence event
protection.
In the NPRM, the FAA included a
definition of ‘‘casualty area’’ in § 401.5,
defined as the area surrounding each
potential debris or vehicle impact point
where serious injuries, or worse, can
occur. The FAA adopts this definition
as proposed.
SpaceX commented the FAA should
modify proposed § 450.135(d) to require
that the casualty area and consequence
analysis not only account for the items
in proposed § 450.135(d)(1) through
(d)(3) but also model them
conservatively. The FAA notes that the
term ‘‘account for’’ already includes
using conservative data or assumptions
for all inputs and results of an analysis,
pursuant to § 450.101(g). Thus, this
change would be redundant.
As previously discussed, the
requirements for debris propagation in
§ 450.135(b) have been relocated in the
final rule to § 450.121(c). As a result, the
FAA adds a requirement in
§ 450.135(b)(2) that a casualty area and
consequence analysis must account for
130 The FAA received no comments on
§ 450.135(d)(1), which requires the casualty and
consequence analysis to account for all relevant
debris fragment characteristics and the
characteristics of a representative person exposed to
any potential hazard. The FAA adopts this
requirement without change.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
statistically-valid debris impact
probability distributions. This
requirement is derived from the
requirements in proposed § 450.135(b).
The FAA notes that without
statistically-valid impact probability
distributions it would be impossible to
compute the predicted consequences of
each reasonably foreseeable failure
mode in any significant period of flight
in terms of conditional expected
casualties, as required in proposed
§ 450.135(d) and § 450.135(b) of the
final rule, because the consequence of
any failure depends on the
characteristics of the debris (such as the
casualty area) predicted to impact
exposed populations. Thus, the FAA
finds the final rule is consistent with the
NPRM in requiring this information as
part of a debris risk analysis.
In the NPRM, the FAA proposed to
require that the casualty area and
consequence analysis account for any
direct impacts of debris fragments,
intact impact, or indirect impact effects,
in proposed § 450.135(d)(2). It also
proposed that the analysis account for
the vulnerability of people and critical
assets to debris impacts including all
hazard sources, such as the potential for
any toxic or explosive energy releases,
in proposed § 450.135(d)(3)(ii) and
indirect or secondary effects such as
bounce, splatter, skip, slide or ricochet,
including accounting for terrain, in
proposed § 450.135(d)(3)(iii).
In the final rule, the FAA consolidates
the three proposed requirements into
§ 450.135(b)(3). Section 450.135(b)(3)
more simply states that the analysis
must account for ‘‘any impact or effects
of hazardous debris,’’ because the new
definition of ‘‘hazardous debris’’ in
§ 401.7 reflects the scope of the NPRM
requirements. In the final rule, the use
of the defined term ‘‘hazardous debris’’
in § 450.135(b)(3) replaces the
requirement in proposed
§ 450.135(d)(3)(ii) to account for all
hazard sources, such as the potential for
any toxic or explosive energy releases.
It also replaces the requirement in
proposed § 450.135(d)(2) to account for
any direct impacts of debris fragments,
intact impact, or indirect impact effects.
Also, the final rule uses the phrase ‘‘any
impact or effects’’ of hazardous debris to
replace the proposed requirements to
account for any direct or indirect effects,
including indirect or secondary effects
such as bounce, splatter, skip, slide, or
ricochet, including accounting for
terrain. The FAA’s use of the defined
term hazardous debris, discussed
previously, allows for consistency
throughout the final rule with regard to
the scope of the FSA requirements. This
revision does not change the scope of
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
79647
the proposed requirements because the
definition includes the concept of all
hazard sources and the direct impacts of
debris fragments, intact impact, or
indirect impact effects.
In the NPRM, the FAA required in
proposed § 450.135(d)(3) that the
analysis account for the vulnerability of
people and critical assets to debris
impacts. In the final rule, the FAA
moves proposed § 450.135(d)(3) as
§ 450.135(b)(4) and strikes the reference
to critical assets, as explained in the
preamble section on critical assets. The
FAA also re-designates and adopts
proposed § 450.135(d)(3)(i) as
§ 450.135(b)(4)(i) in the final rule. As
discussed, the proposed requirements in
§ 450.135(d)(3)(ii) and (d)(3)(iii) are
captured in § 450.135(b)(3) in the final
rule.
In the NPRM, the FAA proposed in
§ 450.135(d)(3)(iv) that the analysis
must account for the effect of wind on
debris impact vector and toxic releases.
In the final rule, the FAA re-designates
proposed § 450.135(d)(3)(iv) as
§ 450.135(b)(4)(ii). The FAA also revises
the requirement so that the analysis
must account for the effect of
atmospheric conditions on debris
impact and effects known to influence
the vulnerability of people to hazardous
debris impacts. For example, wind can
typically have a pronounced effect on
the debris impact vector as illustrated in
the FAA FSA Handbook. In addition,
other atmospheric conditions, such as
the presence of a temperature inversion
can have a significant effect on the
vulnerability of people to toxic
releases.131
The change from the proposed
§ 450.135(d)(3)(iv) implemented in the
final rule in § 450.135(b)(4)(ii) does not
create any additional burden to the
operator because this requirement is
consistent with the proposed
requirements in §§ 450.135(e)(1) and
450.165(b)(2). An operator is required to
account for and identify the conditions
immediately prior to enabling the flight
of a launch vehicle or the reentry of a
reentry vehicle that are necessary to
demonstrate compliance with the safety
criteria in § 450.101, such as the
atmospheric conditions and any
meteorological conditions. Furthermore,
given the proposed requirement in
§ 450.135(d)(vi) to account for the
uncertainty in fragment impact
parameters in assessing the
vulnerability of people to debris
impacts, an operator already would
have contemplated the need to account
for the effect of atmospheric conditions
on debris impact effects now explicitly
required under § 450.135(b)(4)(ii).
In the NPRM, proposed
§ 450.135(d)(3)(vi) specified that the
analysis account for uncertainty in
fragment impact parameters. In the final
rule, the FAA re-designates proposed
§ 450.135(d)(3)(vi) as § 450.135(b)(4)(iv).
The FAA also requires in the final rule
that the analysis account for uncertainty
in the input data, such as fragment
impact parameters. Although the
uncertainty in fragment impact
parameters typically has a pronounced
effect, it is conceivable that
uncertainties in the input data more
generally could affect the vulnerability
of people to hazardous debris effects.
The FAA finds these changes consistent
with the proposed and final
requirements in § 450.115(b)(1) that an
operator’s FSA method must have a
level of fidelity sufficient to account for
all known sources of uncertainty.132
In the NPRM, proposed § 450.135(e)
listed the application requirements
associated with the debris risk analysis,
including the casualty area and
consequence analysis. Proposed
§ 450.135(e)(1) required an applicant to
submit a description of the methods
used to compute the parameters
required to demonstrate compliance
with the safety criteria in proposed
§ 450.101, including a description of
how the operator would account for the
conditions immediately prior to
enabling the flight of a launch vehicle
or the reentry of a reentry vehicle, such
as the final trajectory, atmospheric
conditions, and the exposure of people
and critical assets.
In the final rule, the FAA redesignates and adopts proposed
§ 450.135(e)(1) as § 450.135(c)(1) with
revisions. The FAA removes the
proposed requirement to submit a
description of the methods ‘‘used to
compute the parameters’’ required to
demonstrate compliance with the safety
criteria in § 450.101. Instead, the FAA
replaces this requirement with a
requirement to submit a description of
the methods used to demonstrate
compliance with the safety criteria in
§ 450.101, in accordance with
§ 450.115(c). This change is consistent
with other FSA sections. Also, the FAA
strikes the reference to critical assets as
explained in the preamble section
associated with critical assets.
131 The FAA re-designates and adopts proposed
§ 450.135(d)(3)(v) as § 450.135(b)(4)(iii) without
substantive changes in the final rule. The FAA
received no specific comments on the proposed
requirement.
132 The FAA re-designates and adopts proposed
§ 450.135(d)(3)(vii) as § 450.135(b)(4)(v) without
substantive change in the final rule. The FAA
received no specific comments on the proposed
requirement.
PO 00000
Frm 00083
Fmt 4701
Sfmt 4700
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79648
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
In the NPRM, the application
requirements in § 450.135(e)(2)
addressed the methods used to compute
debris impact distributions. In the final
rule, the FAA moves proposed
§ 450.135(e)(2) to § 450.121(d)(3).
Proposed § 450.135(e)(3) and (e)(4)
addressed population exposure data. In
the final rule, those requirements are
moved to § 450.123(c). These changes
are described in the preamble sections
associated with those sections.133
The FAA moves the application
requirements in proposed
§ 450.135(e)(8)(i) through (iii) regarding
the collective and individual debris risk
outputs to § 450.135(c)(5)(i) through (iii)
and removes the proposed requirement
to report critical asset results in
§ 450.135(e)(8)(iv), as discussed further
in the critical asset section of this
preamble.
The FAA revises and re-designates the
application requirements in proposed
§ 450.135(e)(9) on the collective and
individual debris risk outputs as
§ 450.135(c)(6). The FAA replaces the
term ‘‘vehicle response mode’’ with
‘‘failure mode.’’ This revision is
consistent with changes throughout the
final rule. The FAA also changes the
term ‘‘one-second interval’’ to
‘‘significant period,’’ as explained in the
preamble section on CEC.
SpaceX commented that it was not
clear why proposed § 450.135(e)(8) and
(9) would require debris risk analysis to
include both representative conditions
and the worst foreseeable conditions,
arguing that if the worst foreseeable
conditions meet requirements, then
representative conditions are of no
consequence. The FAA responds that,
for the purposes of § 450.135(c)(5) and
(c)(6), worst foreseeable conditions
means those conditions that produce the
highest individual, collective, and
conditional risks under which the
operator would initiate the launch or
reentry. An operator can submit the
same debris risk analysis results for
representative conditions and the worst
foreseeable conditions in cases where
there is no difference between
representative conditions and the worst
foreseeable conditions that are
significant to public safety.
However, the FAA foresees the
potential for situations where the
differences between the representative
conditions and the worst foreseeable
conditions would require additional
operational mitigations. An example
would be running the debris risk
133 The FAA adopts without change and redesignates proposed § 450.135(e)(5) through (e)(7)
as § 450.135(c)(2) through (c)(4) in the final rule.
The FAA received no specific comments on these
proposals.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
analysis using input data for
atmospheric conditions that lead to
risks just below the limits set in
§ 450.101 (i.e., worst foreseeable
conditions) and running the debris risk
analysis using more typical atmospheric
conditions that produce risks clearly
below the limits. Under the worst
foreseeable conditions, the collective
risk results for people on land could be
such that the operator would need to
perform additional surveillance of areas
to ensure the absence of waterborne
vessels, whereas under representative
conditions such surveillance would not
be necessary to ensure compliance with
collective risk limits in § 450.101(a)(1)
and (b)(1). The FAA does not anticipate
that there will be significant additional
burden in providing the analysis for
representative conditions.
v. Far-Field Overpressure Blast Effect
Analysis, or Distant Focus Overpressure
(DFO) (§ 450.137)
In the NPRM, § 450.137 proposed
requirements for far-field overpressure
blast effects analysis. Proposed
§ 450.137(a) required that a far-field
overpressure blast effect analysis
demonstrate compliance with safety
criteria in proposed § 450.101 either
prior to the day of the operation,
accounting for all foreseeable conditions
within the flight commit criteria, or
during the countdown using the best
available input data. In the final rule,
the FAA adopts § 450.137(a) with one
revision.
The final rule in § 450.137(a)(2)
specifies that far-field overpressure
analysis performed during the
countdown using the best available
input data must also include flight
commit criteria and flight abort rules.
The FAA notes that the best available
input data specified in proposed
§ 450.137(a)(2) would naturally include
flight commit criteria and flight abort
rules because those would generally
have a significant influence on the
public risks posed by hazardous debris
effects. Hence, the phrase ‘‘including
flight commit criteria and flight abort
rules’’ is consistent with the
requirement for a debris risk analysis in
§ 450.135(a)(2).
Virgin Galactic commented that
§ 450.137(a)(1) appeared to require an
FSA the day before launch for the
portion of its launches involving its
carrier aircraft’s captive carriage of the
spaceship. Virgin Galactic expressed a
concern about the operational impact
and additional workload of a day of
launch analysis. Microcosm requested
clarification on whether the regulations
required a day of launch analysis if
meteorological conditions did not
PO 00000
Frm 00084
Fmt 4701
Sfmt 4700
present an environment conducive to
far-field overpressure.
Section 450.137(a)(1) does not require
a full FSA the day before launch.
Instead, § 450.137(a) requires the farfield overpressure blast effect analysis
be performed either as a ‘‘screening’’
analysis prior to the day of the
operation, accounting for all foreseeable
conditions within the flight commit
criteria, or during the countdown using
the best available input data. The
requirement in § 450.137(a)(1) does not
have a time constraint for when the
‘‘screening analysis’’ must be
completed. In response to Microcosm’s
comment, the FAA notes that, in order
to determine that local meteorological
conditions do not present an
environment conducive to far-field
overpressure, an operator would
necessarily be required to perform an
analysis under § 450.137(a)(1). As such,
§ 450.137(a)(1), as proposed and
adopted without change, allows an
operator to demonstrate that a far-field
overpressure analysis need not be
performed during the countdown if the
flight commit criteria are sufficient to
ensure compliance with § 450.101.
In the NPRM, the FAA proposed
requirements associated with analysis
constraints in § 450.137(b) that set
required performance outcomes and the
specific factors that a far-field
overpressure blast effect analysis must
consider. Blue Origin commented that
the proposed requirements in
§ 450.137(b) were prescriptive. The FAA
agrees that the proposal was
unnecessarily specific in § 450.137(b)(3)
through (5) and revises these
requirements.
In the NPRM, § 450.137(b)(3)
proposed that the analysis account for
the explosive capability of the vehicle at
impact and at altitude, and potential
explosions resulting from debris
impacts, including the potential for
mixing of liquid propellants. In the final
rule, the FAA revises the language in
proposed § 450.137(b)(3) and relocates it
to § 450.137(b)(1) to reflect the order in
which the FAA expects the analysis will
be conducted. As rewritten,
§ 450.137(b)(1) in the final rule requires
the analysis to account for the explosive
capability of the vehicle and hazardous
debris at impact and at altitude. As
discussed previously, the FAA uses the
definition for ‘‘hazardous debris’’ to
reflect the scope of the NPRM
requirements. The final rule also
removes the phrase ‘‘potential for
mixing of liquid propellant’’ because it
is redundant with ‘‘explosive
capability,’’ which is already included
in the requirement. The FAA has also
removed reference to solid propellant
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
impacts because they are part of the
explosive capability.
In the NPRM, proposed
§ 450.137(b)(1) required that the
analysis account for the potential for
distant focus overpressure or
overpressure enhancement given
current meteorological conditions and
terrain characteristics. In the final rule,
the FAA re-designates proposed
§ 450.137(b)(1) as § 450.137(b)(2). The
FAA also requires in § 450.137(b)(2) that
the analysis must account for the
influence of meteorological conditions
and terrain characteristics. The FAA
notes meteorological conditions are
known to have a potentially substantial
influence on the propagation and
attenuation of blast waves with peak
incident overpressures at or below 1.0
psi. In the final rule, the FAA removes
the reference to current meteorological
conditions in proposed § 450.137(b)(1)
to reflect that an applicant may use a
screening analysis pursuant to
§ 450.137(a)(1) to demonstrate
additional analysis is not required by
accounting for all foreseeable conditions
within the flight commit criteria.
In the NPRM, proposed
§ 450.137(b)(2) required that the
analysis account for the potential for
broken windows due to peak incident
overpressures below 1.0 psi and related
casualties. In the final rule, the FAA redesignates proposed § 450.137(b)(2) as
§ 450.137(b)(3) and adds the essential
elements from proposed § 450.137(b)(4)
through (b)(6). Those sections contained
unnecessary details regarding shelter
types, time of day, characteristics of
potentially affected windows including
size, location, glazing material, and
characteristics of potential glass shards.
Section 450.137(b)(3) removes these
details and captures the concept of the
requirements proposed in
§ 450.137(b)(4) through (b)(6) by adding
language to reflect that the potential for
broken windows due to peak incident
overpressures below 1.0 psi and related
casualties must ‘‘be based on the
characteristics of exposed windows and
the population’s susceptibility to injury,
with considerations including, at a
minimum, shelter types, window types,
and the time of day of the proposed
operation.’’
Blue Origin commented that the
constraints could be accomplished by
an analysis tool available only to the
government. The FAA disagrees that the
far-field overpressure analyses can only
be accomplished using a tool available
to the U.S. government. Currently
available materials contain a detailed
technical description of a valid
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
approach.134 Furthermore, the FAA
confirms that the analysis tool in use by
the U.S. government has been used by
the U.S. commercial space
transportation industry at non-Federal
sites as well.
The FAA adopts § 450.137(c) with
only two minor modifications. In the
NPRM, § 450.137(c)(6) explicitly
identified that an applicant would be
required to submit the analysis results
given foreseeable meteorological
conditions, yields, and population
exposures.
In the final rule, § 450.137(c)(6)
requires that the application include the
individual risk data given foreseeable
conditions. The FAA also revises
§ 450.137(c)(7) in this manner. The FAA
notes generally that the same elements
of the foreseeable conditions listed in
the NPRM influence the results of the
far-field overpressure blast effects
analysis. Thus, the reworded final rule
maintains the same scope and intent of
the NPRM application requirements.
The FAA adds this language because the
proposal was unnecessarily limited.
w. Toxic Hazards (§§ 450.139 and
450.187)
In the NPRM, the FAA proposed to
consolidate requirements for toxic
release analysis into two performancebased regulations: §§ 450.139 (Toxic
Hazards for Flight) and 450.187 (Toxic
Hazards Mitigation for Ground
Operations). Although the two proposed
sections contained a number of
similarities, the FAA divided them into
two sections because ground operations
and flight operations had different
proposed criteria to establish an
acceptable level of public safety.
Proposed §§ 450.139(a) and 450.187(a)
made the sections applicable to any
launch or reentry vehicle, including all
vehicle components and payloads, that
use toxic propellants or other toxic
chemicals.
Virgin Galactic requested that the
FAA create an exception to §§ 450.139
and 450.187 for carrier aircraft on
hybrid systems that already possess a
standard airworthiness certificate or
experimental airworthiness certificate
134 A valid approach is described in ‘‘Safety
Design for Space Operations,’’ Allahdadi, Firooz A.,
Isabelle Rongier, Tommaso Sgobba, Paul D. Wilde
(Eds.), ‘‘Safety Design for Space Operations,’’
Sponsored by The International Association for the
Advancement of Space Safety, published by
Elsevier, Watham, MA, 2013. The only three topics
not addressed in that reference (updated explosive
impact yield models, launch availability analyses
based on past measurements of meteorological
conditions, and satisfaction of license application
requirements) are addressed in AC 450.137 ‘‘Distant
Focusing Overpressure Risk Analysis Supplemental
Topics,’’ which is planned to be published after this
final rule.
PO 00000
Frm 00085
Fmt 4701
Sfmt 4700
79649
from FAA, as these aircraft most
commonly carry jet fuel. Virgin Galactic
commented that, although jet fuel may
be considered a toxic substance, it is
carried by thousands of aircraft every
day and thus performing a toxic release
hazard analysis for jet fuel would not
have a material effect on public safety.
The FAA acknowledges that,
historically, no toxic release hazard
analysis has been required for kerosenebased fuels, such as jet fuel, and agrees
that such an analysis would be
unnecessary in most instances.
Therefore, in the final rule, the FAA
revises the applicability language in
§§ 450.139(a) and 450.187(a) to create an
exception from the toxic release hazard
analysis for kerosene-based fuels unless
the Administrator determines that an
analysis is necessary to protect the
public safety. The FAA anticipates that
such an analysis will be required for
uses of kerosene-based fuels that are
novel or inconsistent with standard
industry practices. The FAA will work
with operators during pre-application
consultation to identify any kerosenebased propellants requiring a toxic
release hazard analysis under
§§ 450.139 or 450.187.
Proposed § 450.139(b) required an
operator to conduct a toxic release
hazard analysis and manage the risk of
casualties from exposure to toxic release
either through containing hazards in
accordance with proposed § 450.139(d)
or by performing a toxic risk
assessment, under proposed
§ 450.139(e), that protects the public
consistent with the safety criteria
proposed in § 450.101. Furthermore,
proposed § 450.139(b)(3) required an
operator to establish flight commit
criteria based on the results of its toxic
release hazard analysis, containment
analysis, or toxic risk assessment for any
necessary evacuation of the public from
any toxic hazard area. The FAA adopts
§ 450.139(b) as proposed.
In the NPRM, paragraph (b) was
inadvertently omitted from the
regulatory text to § 450.187; however,
the preamble discussed that proposed
§ 450.187(b) would, like proposed
§ 450.139(b), require an operator to
manage the risk of casualties from
exposure to toxic release by either
containing the hazards or performing a
toxic risk assessment. The preamble
stated that for ground operations, an
operator using a toxic risk assessment
must demonstrate compliance with
proposed § 450.109(a)(3), rather than
§ 450.185(c).135 The FAA adds
paragraph (b) to § 450.187 in the final
rule. As discussed later in this section,
135 84
E:\FR\FM\10DER2.SGM
FR 15395.
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79650
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
the FAA revises the toxic risk
assessment criteria for ground
operations by replacing the reference to
proposed § 450.109(b)(3) with a
reference to § 450.185(c). The FAA also
revises § 450.139(b)(3) to refer to ‘‘toxic
containment,’’ rather than a ‘‘toxic
containment analysis,’’ as this term does
not appear in the regulation.
Proposed §§ 450.139(c) and
450.187(b) set forth the requirements for
toxic release hazard analysis. The FAA
adopts the substance of those provisions
in the final rule, but re-designates
proposed § 450.187(b) as § 450.187(c), to
account for the addition of new
§ 450.187(b).
As noted, §§ 450.139(b) and
450.187(b) in the final rule require an
operator to manage the risk of casualties
that could arise from the exposure to
toxic release through toxic containment
or by using a toxic risk assessment.
Toxic containment, as proposed in
§§ 450.139(d) and 450.187(c), required
an operator to manage the risk of
casualty from the exposure to toxic
release either by evacuating, or being
prepared to evacuate, the public from a
toxic hazard area, or by employing
meteorological constraints. In either
scenario—evacuation or employment of
meteorological constraints—the operator
would be required to demonstrate that
an average member of the public would
not be exposed to greater than one
percent conditional individual
probability of casualty in the event of a
worst-case release or maximum credible
release scenario. The FAA received a
formal comment from NASA during the
interagency review on proposed
§ 450.139(d) and § 450.187(c). The FAA
revised these provisions in the final rule
consistent with the updated definition
of toxic hazard area described below.
Specifically, § 450.139(d)(1) and
§ 450.187(c)(1) require an operator using
toxic containment to manage the risk of
casualty from the exposure to toxic
release either by evacuating, or being
prepared to evacuate, the public from
any toxic hazard area. These revisions
are consistent with current practice. The
FAA also re-designates proposed
§ 450.187(c) as § 450.187(d) to account
for the addition of new § 450.187(b).
The FAA proposed to define ‘‘toxic
hazard area’’ in § 401.5 (§ 401.7 in the
final rule) as ‘‘a region on the Earth’s
surface where toxic concentrations and
durations may be greater than approved
toxic thresholds for acute casualty, in
the event of a release during launch or
reentry.’’
In the final rule, the FAA revises the
proposed definition of ‘‘toxic hazard
area’’ to include the language from
proposed §§ 450.139(d) and 450.187(c)
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
regarding the ‘‘a worst-case toxic or
maximum credible release scenario.’’
Thus, in the final rule, a ‘‘toxic hazard
area’’ means ‘‘a region on the Earth’s
surface where toxic concentrations and
durations may be greater than accepted
toxic thresholds for acute casualty in the
event of a worst-case toxic or maximum
credible release scenario during launch
or reentry.’’ The FAA revises this
definition to ensure that the toxic
hazard area is consistent whether the
operator performs a toxic risk
assessment or toxic containment. The
revised definition of ‘‘toxic hazard area’’
is consistent with the approach taken in
current regulation in Appendix I to part
417 under I417.5(c), which directly
links the toxic concentration thresholds
to the size of the toxic hazard area. The
FAA anticipates that the toxic
concentration thresholds used in an
accepted means of compliance for
§§ 450.139 and 450.187 will generally
be consistent with those in Appendix I
to part 417 under I417.5(c).
The final rule’s requirements for a
toxic risk assessment under § 450.139(e)
are unchanged from the proposal. A
toxic risk assessment must meet the
safety criteria of § 450.101 and account
for: Airborne concentration and
duration thresholds of toxic propellants
or other chemicals; physical phenomena
expected to influence any toxic
concentration and duration; the toxic
hazard area and the meteorological
conditions involved; and all members of
the public that may be exposed to the
toxic release.
In the final rule, § 450.187(e), which
contains the requirements for a toxic
risk assessment for ground operations,
includes one revision from the proposal.
As mentioned, proposed § 450.187(d)
required an operator using toxic risk
assessment to manage the risk from any
toxic release hazard and demonstrate
compliance with the criteria in
§ 450.109(a)(3). The FAA replaces the
reference to proposed § 450.109(a)(3)
with a reference to § 450.185(c) because
the flight hazard analysis risk criteria
were removed from § 450.109. The
standard in § 450.185(c) is the same as
in proposed § 450.109(a)(3); therefore,
there is no substantive change in the
criteria. As a result, an operator
complies with the requirements for a
toxic risk assessment by demonstrating
no more than an extremely remote
likelihood of toxic exposure causing
death or serious injury to the public,
using toxic concentration and duration
thresholds accepted by the
Administrator as a means of
compliance.
In the final rule, the FAA amends the
application requirements proposed in
PO 00000
Frm 00086
Fmt 4701
Sfmt 4700
§§ 450.139(f) and 450.187(e). Although
proposed §§ 450.139(d) and 450.187(c)
detailed the two ways in which an
operator could perform toxic
containment, the NPRM did not specify
how an operator would demonstrate
compliance with the toxic containment
requirements in their application. In the
final rule, the FAA adds an application
requirement for toxic containment, in
§§ 450.139(f)(8)(i) and 450.187(f)(8),
which reflects the substantive
requirements for performing toxic
containment. That is, if toxic
containment is selected, the applicant
must identify the evacuation plans or
meteorological constraints and
associated launch commit criteria or
ground hazard controls that it will
employ to ensure that the public will
not be within a toxic area in the event
of a worst-case or maximum credible
release scenario. The FAA notes that an
applicant will need to submit the
information required by this subsection
in order to demonstrate compliance
with the substantive requirements for
toxic containment in §§ 450.139(d) and
450.187(c).
The FAA revises the application
requirements, in §§ 450.139(f)(8)(ii) and
450.187(f)(9), to reflect the substantive
requirements of toxic risk assessment. If
a toxic risk assessment is performed,
then the applicant must account for the
public that may be exposed to airborne
concentrations above the toxic
concentration and duration thresholds,
describe any risk mitigations applied in
the toxic risk assessment, describe the
population exposure input data used in
accordance with § 450.123 (Population
Exposure Analysis), and demonstrate
compliance with the applicable public
risk criteria (for flight, the risk criteria
in § 450.101; for ground operations, the
risk criteria in § 450.185(c)). Lastly, the
FAA replaced the term ‘‘population
density’’ with ‘‘population
characteristics’’ in § 450.139(f)(8)(ii)(2)
and § 450.187(f)(9)(ii) because
characteristics other than density (e.g.,
vulnerability of population) would be
relevant to assessing potential effects of
toxic release, as indicated by the
Population Exposure Analysis criteria in
§ 450.123.
Blue Origin commented that toxic risk
analysis tools were not currently
available to operators, and that, unless
the FAA facilitated access to these tools,
a sole-source provider of this service
may arise. One individual commenter
asked what dispersion models were
acceptable to the FAA and commented
that the FAA should provide specific
examples of allowable and acceptable
toxic release and dispersion mitigations.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
The FAA disagrees that the tools
needed to analyze risks associated with
a potential release of toxic substances
during launch or reentry are not
currently available to operators.
However, the FAA will issue an AC
entitled, ‘‘Toxic Hazards for Flight,’’
that will provide guidance and
examples of publicly available tools for
conducting the required toxic release
hazard analyses, as well as a toxic risk
assessment and toxic containment. This
guidance will include information on:
• Determining the airborne toxic
concentration threshold or level of
concern (LOC) for each toxic propellant
or toxic combustion by-product;
• Determining the worst-case quantity
of any toxic release that might occur
during the proposed flight of a launch
vehicle, or that might occur in the event
of a flight mishap;
• Determining the worst-case quantity
of any toxic release that might occur
during normal launch processing, and
that might occur in the event of a
mishap during launch processing;
• Characterizing the terrain, as a
precursor for modeling the atmospheric
transport of a toxic release from its
source to downwind receptor locations;
• Determining the meteorological
conditions for the atmospheric transport
of any toxic release from its source to
downwind receptor locations;
• Performing air quality dispersion
modeling to predict concentrations at
selected downwind receptor locations
(by characterizing the atmospheric
processes that disperse a toxic substance
emitted by a source); and
• Determining the population density
in receptor locations that could
potentially be identified by air quality
dispersion modeling as toxic hazard
areas.136
jbell on DSKJLSW7X2PROD with RULES2
x. Computing Systems (§ 450.141)
In the NPRM, the FAA proposed in
§ 450.111 (Computing Systems and
Software) to require operators to
develop a process that identifies and
assesses hazards to public safety and the
safety of property arising from
computing systems and software.
Operators would have needed to
identify all safety-critical functions
associated with its computing systems
and software and to classify software
based on degree of autonomy. In the
NPRM, software safety requirements
would have increased in rigor with the
rise in the degree of autonomy of the
software. Conversely, software safety
requirements would have decreased in
136 SpaceX made a comment referencing an
agreements subsection of § 450.139(b), but no such
subsection existed in the NPRM.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
rigor with reductions in the software’s
degree of autonomy.
In the final rule, the FAA revises
proposed § 450.111 and re-designates it
as § 450.141 (Computing Systems).
Although the scope of the requirements
for operators under § 450.141 does not
differ substantially from the proposed
version, the FAA replaces prescriptive
requirements with performance-based
standards and provides increased
flexibility for operators to demonstrate
compliance with § 450.141. The final
rule levies requirements for computing
system safety items in proportion to
their criticality rather than their
autonomy; requires independent
verification and validation for safetycritical computing system safety items;
and retains the NPRM’s focus on
development and testing processes
instead of direct inspection of software
by the FAA. The FAA removed the
term, ‘‘software,’’ from the section
heading since ‘‘computing systems’’
would include software. The FAA also
removes the definition of ‘‘control
entity’’ proposed in § 401.5 because the
term is no longer used in the final rule.
A number of commenters stated the
requirements proposed in § 450.111
were overly prescriptive or difficult to
meet. SpaceX stated that the proposed
software process would be more
burdensome and costly for applicants
than it had been under current
regulations and would prevent
applicants from utilizing safer methods
to construct a safety case. Blue Origin
and SpaceX argued the proposed
requirement would hinder technological
advances that could improve safety.
Blue Origin stated the proposal
threatened innovation towards lower
cost, higher quality, and safer software
approaches, but did not specify the
approaches that would be impeded by
the NPRM. Rocket Lab similarly
asserted that the proposal would hinder
the development of software for FSS,
the automation of which is currently a
major area for innovation. Rocket Lab
commented that the proposal did not
allow flexibility to use other means of
functional system safety from equivalent
industries or government standards, and
that the requirements would become
quickly outdated as software
technologies and best practices evolve.
CSF also viewed the proposal as highly
prescriptive and uneconomical for the
FAA or for industry.
CSF and SpaceX specifically rejected
the degree of autonomy approach
proposed in § 450.111, noting that
human involvement did not always
produce a safer system. CSF suggested
the FAA scale the levels of rigor based
on hazard effects and architectural
PO 00000
Frm 00087
Fmt 4701
Sfmt 4700
79651
mitigations. Virgin Galactic stated that
software need not be categorized by
levels of consequence and degrees of
control if the software development
process was linked to a system safety
program.
The FAA agrees that some of the
requirements proposed in § 450.111
were too prescriptive, potentially overly
burdensome, and could have the effect
of discouraging technological
innovation to improve safety.137 The
FAA also agrees with the commenters’
discussion of the limitations of
autonomy as a criterion for level of
rigor. In the final rule, the FAA revises
the requirements for computing
systems, which are now located in
§ 450.141 to address the commenters’
concerns. Section 450.141 scales level of
rigor for computing system
requirements based on system-level
criticality rather than on degree of
autonomy, and is designed to parallel
the requirements of computing system
safety responses to the existing
regulations. The existing regulations
require plans for software development
and validation and verification plans
but remain silent on the acceptable
content of those plans. The final rule
requirements are designed to align with
current software safety submissions.
The FAA also removes prescriptive
requirements from § 450.141, as detailed
in the following paragraphs, to increase
flexibility in application to current and
future computing system designs.
Section 450.141 requires the
identification and assessment of the
public safety-related computing system
requirements, functions, and data items,
in order to streamline the evaluation of
computing system safety. The final rule
retains the requirement proposed in
§ 450.111 to identify and assess the
public safety implications of computing
systems, which derives from the current
requirements in §§ 417.123(a) and
431.35(c) to perform this assessment as
part of a system safety process. The
explicit identification of the public
safety related aspects of computing
systems enables a reduction in the scope
of FAA’s evaluation compared to the
current regulations.
In the final rule, § 450.141(a) requires
an operator to identify computing
system safety items, meaning any
software or data that implements a
capability that could present a hazard to
137 As an example, the FAA acknowledges the
commenter’s concerns in particular with regard to
the requirements to document a process for
identifying hazards arising from software; to meet
software testing standards and hazard analyses
based on levels of autonomy; and to detail the
functionality of all software having no safety
impact.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79652
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
the public, and the criticality of each
computing system safety item,
commensurate with its degree of control
over hazards to the public and the
severity of those hazards. For purposes
of this section, a computing system
safety item is any item that is a
computing system or software that has
some degree of control over hazards to
the public; a computing system that is
either a cause of or a mitigation for a
hazard that can affect the public.
Computing system safety items include
not only software, but also software
elements, including data, and interfaces
that present or control risks to the
public (e.g., software/hardware
interfaces, and software/human
interfaces). The FAA uses the term
‘‘computing system safety item’’ in
order to provide a clean interface
between software safety, which controls
risks due to flaws in logic, and system
safety, which controls risk. Software
runs on hardware in response to
commands and inputs, so a computing
system safety item is often more than
just software. ‘‘Level of criticality’’ here
means the combination of a computing
system safety item’s importance in the
causal chain for a given hazard, which
is commensurate to its degree of control,
and the severity of that hazard.
Computing system safety items that are
more influential on a causal chain for a
hazard of a given severity would be
subject to a proportionally higher level
of rigor in development and testing. The
degree of control may be evident in (1)
a system’s tolerance to a given
computing system fault, (2) the
computing system’s autonomy in
causing or preventing a hazard, (3) the
number and characteristics of other
system faults or failures required for the
hazard to manifest itself, or (4) some
other measure devised by the applicant.
The requirement proposed in
§ 450.111(c) to allocate development
process rigor according to degree of
autonomy has been replaced with the
requirement in § 450.141(a)(2) to use
system-level criticality to set the
minimum level of rigor in developing
and testing each computing system
safety item. The FAA agrees with the
comments received on the shortcomings
of allocation by degree of autonomy and
the recommendation to use a system
safety approach to computing system
safety. System safety allocates level of
rigor according to the criticality of each
item in the system, and the revised
regulation aligns software and
computing system level of rigor
allocation with system safety’s level of
rigor allocation, erasing a difference
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
between the two safety analyses.138 For
some systems, system-level criticality
and degree of autonomy will produce
the same or similar allocations of rigor
in computing system development. An
applicant can propose to use degree of
autonomy as a proxy for system-level
criticality based on that similarity, as it
is an industry standard method of
determining level of rigor allocation.
This revision achieves the objective
stated in the NPRM of tailoring safety
requirements based on criticality but
eliminates the prescriptive criticality
levels proposed in the NPRM. The
criticality of each computing system or
function must be assessed at the system
level so the applicant can clearly
demonstrate to the FAA how the system
uses computing systems and the
influence of each computing system
safety item on public safety.
Section 450.141(b) requires an
operator to develop safety requirements
for each computing system safety item.
A safety requirement specifies the
implementation of one or more public
safety-related functions, capabilities, or
attributes in a computing system safety
item. The FAA notes that it uses the
phrase ‘‘safety requirements’’ in the
final rule differently than it did in the
NPRM. In the NPRM, ‘‘software safety
requirements’’ referred to regulatory
requirements for software. In § 450.141
of the final rule, ‘‘safety requirements’’
means computing system requirements
that specify computing system attributes
or functionality that have public safety
significance. Identification of this subset
of computing system requirements
related to public safety is essential to
focus an operator’s safety efforts on
those parts of the computing system
safety item that have public safety
consequences. It will also streamline the
scope and depth of data required of
applicants and the FAA’s evaluation
process relative to current requirements,
to the same extent as proposed
§ 450.111.
Section 450.141(b)(1) requires an
operator to identify and evaluate safety
requirements for each computing system
safety item. Safety requirements are the
subset of requirements that define
features, capabilities, or behaviors that
have public safety implications. This
identification and evaluation process
may identify new computing system
safety items if safety requirements are
138 Since the approach in proposed § 450.111 of
using degrees of autonomy was largely informed by
MIL–STD–882E, this revised approach in § 450.141
of the final rule will reduce confusion and error
caused by translating between different allocation
schemes already adopted by other industry
standards. This will also improve the rule’s
resilience to future changes to standards.
PO 00000
Frm 00088
Fmt 4701
Sfmt 4700
identified for items that did not
previously have known safety
requirements.
Section 450.141(b)(2) requires an
operator to ensure the safety
requirements are complete and correct.
A computing system requirement set is
complete if it contains all of the
requirements necessary to specify all of
the functions and attributes needed for
the computing system to perform its
required tasks. A computing system
requirement is correct if it specifies the
correct functionality or attributes for the
item to perform its intended systemlevel functions. This can be
accomplished as part of an applicant’s
normal software and computing system
requirement review process. The FAA
does not require the applicant to
conduct a separate public safety-specific
review, provided the applicant’s
computing system requirement review
process accomplishes the intent of
§ 450.141(b)(2).
Section 450.141(b)(3) requires an
operator to implement each safety
requirement. That is, the safety
requirements reviewed in accordance
with § 450.141(b)(2) must be built into
the system for verification in
§ 450.141(b)(4). Requirements are
normally implemented by operators,
and no special implementation process
is required for safety requirements.
Section 450.141(b)(4) requires that the
applicant verify and validate the
implementation of each safety
requirement using a method appropriate
for the level of criticality of the
computing system safety item.
Computing system requirements are
normally verified and validated by a
combination of testing, analysis, and
inspection. The NPRM proposed to
require specific testing and verification
methods that have not been retained in
the final rule due to the removal of
specific criticality levels for software.
The final rule allows sufficient
flexibility for operators to implement
methods and levels of rigor appropriate
for their operations. For example, a
development process that traces from
computing system requirements to
verification and validation evidence is
necessary but may not be the only
process for adequate verification and
validation; a process that traces from
verification and validation tests to the
intended computing system
functionality may be more appropriate
for third-party products. Operators may
use many different processes that
accomplish traceability as long as the
process demonstrates that the
verification and validation evidence is
sufficient to verify and validate all of
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
the computing system safety
requirements.
Section 450.141(b)(4) further specifies
that, for each computing system safety
item that meets the definition of ‘‘safety
critical’’ in § 401.7, verification and
validation must include testing by a test
team independent of the development
division or organization. As defined in
§ 401.7, a safety-critical item means a
system, subsystem, component,
condition, event, operation, process, or
item, whose proper recognition, control,
performance, or tolerance, is essential to
ensuring public safety. A safety-critical
computing system safety item is a
computing system safety item of which
proper recognition, control,
performance, or tolerance is essential to
ensuring public safety. As described in
the NPRM, the FAA uses the term
‘‘independent’’ to designate a
verification and validation group that
has substantial and credible
independence from the development
team. This independent group has a
separate personnel structure through at
least senior leadership, operates under
distinct performance, technical,
schedule, and incentive pressures, and
has the latitude to develop and test
requirements independently. This
independent verification and validation
group can be a third party or an inhouse group but in either case must
have the technical, managerial,
schedule, and incentive
independence 139 to carry out its
functions without undue pressure from
the development team. The requirement
for independent verification and
validation of safety-critical computing
system safety items is broadly aligned
with current practices for verification
and validation. Specifically, the
minimum expectation is that safetycritical computing systems, such as
autonomous FSS, are subjected to a
level of verification and validation rigor
that can only be achieved by verification
and validation staff that are
independent of the development
organization.
The requirement in proposed
§ 450.111(b) to identify all safety-critical
functions involving software is revised
and included in § 450.141(b) of the final
rule. Section 450.141(b) requires the
applicant to identify all safety
requirements performed by computing
system safety items, check that the
safety requirements are complete and
correct, implement the safety
139 Incentive independence means that the
independent verification and validation group is
rewarded based on some metric other than schedule
or throughput, so that the schedule or throughput
demands that drive error rates upward do not also
drive testing thoroughness downward.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
requirements, and verify and validate
their implementation including
independent verification and validation
for safety-critical computing system
safety items. These regulatory
requirements have the net effect of
identifying all safety-critical functions
involving computing systems, since
safety requirements necessarily include
all safety-critical functions, capabilities,
and attributes of computing systems.
Section 450.141(c) requires operators
to implement and document a
development process for computing
system safety items identified in
§ 450.141(a) appropriate for the level of
criticality of the computing system
safety item. The requirement to
implement and document such a
development process for all computing
system safety items is substantially
similar to both existing rules and the
requirements proposed in § 450.111,
except in the final rule the requirement
is no longer contained in separate
subsections for each level of autonomy
(proposed § 450.111(d) through (g)). As
explained in the NPRM preamble, the
FAA needs to understand the
computing system development
processes used for each computing
system safety item, relative to its effect
on public safety, in order to assess
computing system safety. The final rule
calls for a development ‘‘process,’’
rather than a ‘‘plan,’’ that achieves the
same objectives key to a development
plan but affords applicants greater
flexibility to structure their processes as
needed to satisfy § 450.141(c). Operators
need not employ a separate
development process for each
computing system item. However, the
development process must be
appropriate to the level of criticality of
each computing system safety item to
which it is applied, and must satisfy the
criteria listed in § 450.141(c), at a
minimum.
In order to demonstrate that a
development process is appropriate to
the level of criticality of each computing
system safety item, an operator would
need to identify the tasks associated
with each safety item, along with its
processes for reviewing, verifying, and
validating computing system safety
requirements. Section 450.141(c)(1)
requires a development process to
define responsibilities for each task
associated with a computing system
safety item. This requirement derives
from the requirement proposed in
§ 450.111(d)(5) for a software
development plan; in order to be
acceptable, the development process
must assign responsibilities for its
execution. This requirement intends to
ensure that development tasks for
PO 00000
Frm 00089
Fmt 4701
Sfmt 4700
79653
computing system safety items are
carried out by defined personnel in the
organization, though not necessarily
individuals by name.
Under § 450.141(c)(2), a development
process must include processes for
internal review and approval, including
review that evaluates the
implementation of all safety
requirements, such that no person
approves their own work. This is
consistent with proposed
§ 450.111(d)(4), which required
independent verification and validation,
and proposed § 450.111(d)(5)(i), which
required coding standards. Neither of
those requirements could be met in
absence of a review and approval
process that meets § 450.141(c)(2) of the
final rule, since acceptable performance
of those tasks inherently includes
review and approval by a person
independent of those who did the work.
Software and computing system
development is a complex set of actions,
and some subsets of those actions are
milestones that require review and
approval. This requirement means that
those reviews and approvals must have
some degree of independence such that
no person approves their own work, and
requires that the minimum set of
reviews and approvals contains reviews
of the implementation of safety
requirements. This association is
defined by generation, such as code
written to implement a safety
requirement, or by interaction, such as
code that must function in order for a
safety requirement to be met. Code
reviews conducted to meet this
requirement need not be single events
but may be modularized in a manner
similar to the code itself as long as
comprehensive understanding is
communicated between modular
reviews. Computing system
development efforts that use pre-commit
and post-commit reviews to conduct a
modularized code review process could
meet § 450.141(c)(2). The intent is that
code developed to implement safety
requirements should be checked by at
least one independent technical
reviewer prior to its release.
Section 450.141(c)(3) requires the
operator to ensure that development
personnel are trained, qualified, and
capable of performing their roles. This
is consistent with § 450.111(d)(5)(i) of
the NPRM, which required coding
standards, which are an implicit part of
the training of development personnel.
The final rule makes this implicit
requirement in the NPRM explicit.
Personnel responsible for public safety
tasks must have training and experience
that enables them to discharge their
responsibilities effectively. In its
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79654
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
application review, the FAA does not
intend to verify the qualifications of
individual development personnel, but
rather to verify that the operator has a
process in place to put appropriatelytrained and experienced personnel in
public safety roles.
Section 450.141(c)(4) requires a
development process to define
processes that trace requirements to
verification and validation evidence.
This requirement is a performance
criterion that was implicit in the
proposed § 450.111(d)(5) software
development plan; FAA is making this
criterion explicit and performancebased in the final rule to address
commenters’ concerns. Traceability
from computing system requirement to
verification and validation evidence
significantly streamlines computing
system safety evaluations by connecting
the requirements that define a
computing system’s capabilities to
evidence of their implementation.
Importantly, this requirement applies to
all requirements for computing system
safety items, as a lack of rigor
inmanaging requirements on any
computing system safety item is an
opportunity for undocumented or
unintended computing system safety
requirements to be introduced into the
system.
Section 450.141(c)(5) requires a
development process to define
processes for configuration management
that specify the content of each released
version of a computing system safety
item. This requirement is a
performance-based version of proposed
§ 450.111(d)(5)(ii), which required
configuration control. Configuration
management at this level of performance
is the baseline expectation for any
computing system safety item because a
known configuration with a known
history is required to provide
adequately for safety. The revised
requirement contains the performance
criteria that were implicit in the NPRM.
Section 450.141(c)(6) requires a
development process to define
processes for testing that verify and
validate all safety requirements to the
extent required by § 450.141(b)(4). This
means that safety requirements must be
tested in a manner consistent with their
level of criticality. The FAA removed a
prescriptive requirement proposed in
the NPRM for testing on flight-like
hardware 140 to increase flexibility. The
FAA requires verification and validation
140 For each level of criticality in proposed
450.111(d) through (g), the FAA proposed that the
software component’s safety-critical functions must
be tested on flight-like hardware, which must
include nominal operation and fault responses for
all safety-critical functions.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
that is appropriate for the level of
criticality of the computing system
safety item, and allows the operator to
define the levels of criticality that are
appropriate for its operations. The
operator must determine, and the FAA
will verify, which of the operator’s
levels of criticality affect public safety
and which of the computing systems
described in the proposed operation are
in each of those public safety levels.
Operators must then define verification
and validation procedures to test
computing system safety items in
appropriately representative
environments.
Section 450.141(c)(7) requires a
development process to define reuse
policies that verify and validate the
safety requirements for reused
computing system safety items. This
requirement was retained from
proposed § 450.111(d)(5)(v), which
similarly required an operator to
develop and implement software
development plans, to include
descriptions of a policy on software
reuse. In essence, the applicant is
required to have processes in place to
understand the safety implications of
any computing system safety item
developed for a different project or
purpose.
Section 450.141(c)(8) requires a
development process to define thirdparty product use policies that verify
and validate the safety requirements for
any third-party product. This
requirement was retained from
proposed § 450.111(d)(5)(iv), which
required an operator to develop and
implement software development plans,
to include a description of a policy on
use of any commercial-off-the-shelf
software. The FAA replaces the term
‘‘commercial-off-the-shelf software’’ in
the proposal with ‘‘third-party product’’
because commercial software is not the
only kind of third-party computing
system that an applicant could use;
government-off-the-shelf and free, open
source products need strategies for safe
use, and the policy does not need to
vary based on the nature of the third
party. The important characteristic is
that the computing system was not
developed by the applicant, so FAA
now uses ‘‘third-party’’ to describe it.
The final rule sets performance criteria
for this requirement with the addition of
the phrase ‘‘that verify and validate the
safety requirements in any third-party
product.’’ This means that the safety
requirements implemented by thirdparty products must be subjected to
verification and validation just like
applicant-developed computing system
safety items.
PO 00000
Frm 00090
Fmt 4701
Sfmt 4700
Section 450.141(d) contains the
application requirements for this
section. Each of the first five
requirements in paragraph (d) mirrors a
key aspect of computing system safety,
allowing the applicant and FAA to
understand the rigor of development in
terms of public safety. This structure is
meant to reflect the typical formats of
computing system safety data
submissions received by the FAA to
date. The regulation requires an
applicant to describe the computing
system safety items, identify the safety
requirements implemented by each
computing system safety item, provide
the development processes that
generated them, provide evidence that
the development process was followed,
and provide data verifying the correct
implementation of the safety
requirements. These application
requirements need not be met in
separate documents.
The application requirements of
§ 450.141(d) essentially replicate those
proposed in § 450.111(h), except that
the revised regulation allows greater
latitude to implement development
processes that achieve the same goals by
different means. An example of such an
alternative process would be a formal
mathematical proof that the code will
function only as designed and that the
design meets all of its requirements. A
formal proof is preferable to an iterative
development and testing process,
whenever practical, because a formal
proof demonstrates that every possible
action that a computing system system
can take is safe whereas iterative
development can only approximate that
demonstration. A formal proof would
have required waivers under proposed
§ 450.111 but will not under § 450.141.
Several commenters recommended
that hazards associated with computing
systems and software be addressed
through other sections in part 450,
rather than in a dedicated section on
computing systems and software. CSF,
SpaceX, Virgin Galactic, and Virgin
Orbit stated that hazards associated with
computing systems and software should
be addressed through the system safety
requirements for flight hazard analyses,
proposed § 450.109. CSF commented
that a computing system was just one of
many critical subsystems integrated into
a larger complex system, that all
systems and subsystems should be
analyzed and controlled for hazards,
and that the fact that a particular system
may contain software should be
irrelevant to top level performancebased safety requirements. Blue Origin
and CSF recommended that the
requirements for safety-critical systems
in § 450.143 be used for software
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
systems. SpaceX recommended that
hazard analyses be limited to
demonstrating one fault tolerance for
safety-critical functions, including
tolerance to faults in any inputs to the
functions (e.g., data loss, data
corruption) and any downstream
hardware or software effects required for
public safety (e.g., effecting thrust
termination).
The FAA will retain a separate section
for computing system requirements in
the final rule. As stated in the NPRM
preamble, the FAA consolidated the
computing system safety requirements
applicable to launch or reentry
operations under a single section in
§ 450.141 of the final rule to address
software, firmware, and data, and the
way they operate in computing systems.
The FAA based this approach on a
determination that software safety
cannot be evaluated outside of the
computing system in which it operates.
Software and computing systems are
decision engines that, like humans,
control other vehicle systems that can
present hazards to the public and
therefore merit analysis of their control
logic. Although computing systems and
software must be factored into an
operator’s system safety process and
hazard control strategies, the FAA has
determined that computing systems
warrant separate consideration due to
distinct characteristics that make them
uniquely ill-suited to most traditional
system safety methods.
Software assurance is often a more
appropriate mitigation strategy than
fault tolerance for software faults. The
FAA anticipates that any emergent
method for system safety analysis that
handles software and computing
systems well will meet § 450.141
because such a method would
necessarily produce the essential
elements of computing system safety
embodied in the regulation. That is,
§ 450.141 applies equally well to
dedicated computing system safety
analyses and to system safety analyses
that handle computing systems in an
integrated manner.
Furthermore, although computing
systems can be ‘‘safety critical,’’ as
defined in § 401.7, the FAA declines to
apply the requirements set forth in
§ 450.143 regarding safety-critical
system design, test, and documentation
to computing systems because those
requirements do not adequately address
the idiosyncrasies of computing
systems. For example, § 450.143(b) in
the final rule requires an operator to
design safety-critical systems to be faulttolerant, fail safe, damage-tolerant, or
otherwise designed such that no fault
can lead to increased risk to the public
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
beyond nominal safety-critical system
operation. Fault tolerance is not
achievable for many software faults.
Similarly, the predicted environments
are defined and evaluated very
differently for software than for other
safety-critical systems under § 450.143.
The predicted operating environment
for computing systems is defined in
computing system requirements, but
those requirements are derived from the
mathematical relationships that the
software must embody, so the
requirement to provide predicted
environments for computing systems is
indistinguishable from providing the
computing system requirements and
design documentation for computing
systems.
Blue Origin, CSF, Sierra Nevada,
Virgin Galactic, and Virgin Orbit
commented that any prescription in the
regulation should be moved to an AC as
a means of compliance. Virgin Galactic
commented that guidance material
should be based on industry standard
development assurance processes. CSF
suggested that ACs reference industry
standards and to refer to new or existing
FAA ACs, such as AC 20–115C, AC 20–
152, AC 20–153, AC 20–170, and AC
20–174, to provide a detailed means of
compliance to performance-based
regulations for computing systems.
As discussed, the FAA has revised the
proposed requirements to be less
prescriptive in the final rule. The FAA
regulates software assurance only to the
extent that it is used as a mitigation
strategy for computing system hazards.
The FAA plans to issue guidance that
will provide further clarity on the
requirements in § 450.141, including the
integration of existing software
assurance standards, such as the
referenced ACs, with computing system
safety processes. The FAA considers
these changes in the final rule to be
consistent with the comments received.
Blue Origin, CSF, Rocket Lab, SpaceX,
and Virgin Galactic commented that the
requirements in proposed § 450.111 did
not integrate well with most industry
applications and best practices. CSF and
SpaceX commented that the methods
prescribed by the proposal were
incompatible with proven industry
standards such as ISO 26262 141 and
DO–178C.142
141 ISO 26262 is an adaptation of the Functional
Safety standard IEC 61508 for Automotive Electric/
Electronic Systems. ISO 26262 defines functional
safety for automotive equipment applicable
throughout the lifecycle of all automotive electronic
and electrical safety-related systems.
142 DO–178C, Software Considerations in
Airborne Systems and Equipment Certification, is
the primary document by which the certification
authorities such as FAA, EASA, and Transport
PO 00000
Frm 00091
Fmt 4701
Sfmt 4700
79655
The FAA revises the regulation in a
way that aligns better with the system
safety process and replaces the
prescriptive requirements identified by
commenters with performance-based
metrics. The final rule also aligns better
with industry standards, including ISO
26262 and DO–178C. Virgin Galactic
noted similarities between proposed
§ 450.111 and existing standards, and
this similarity is intentional as the FAA
was attempting to codify those parts of
industry standards that were well suited
to standardization. The final rule bears
less similarity to existing standards,
instead specifying the goals of those
standards as requirements in § 450.141.
The FAA has revised the computing
systems and software safety
requirements to contain the minimum
set of performance requirements
necessary to address the public safety
implications of a given operation. The
FAA also removed many prescriptive
requirements from the regulation. This
revision allows for more flexibility and
thus consistency with industry
standards.
CSF, SpaceX, and Virgin Galactic
commented that the proposed rule was
not comprehensive enough and was
missing items such as aeronautical
databases, integrated modular avionics,
regression testing, and other details.
Blue Origin, CSF, and SpaceX stated
that the proposal failed to address
object-oriented technology, model-based
development, machine learning, tool
qualification, load control, formal
methods, robust protection and
partitioning, integrated modular
avionics, and integration with the
system process.
As discussed, the final rule has been
revised to remove prescriptiveness and
increase flexibility. Therefore, because
such prescription was removed from the
final rule, the FAA does not find the
changes recommended by these
comments to be necessary. The FAA
will address items like aeronautical
databases, integrated modular avionics,
regression testing, and other details in
guidance documents. These items will
be addressed by § 450.141(c), which
implements safety requirements for
these and all other computing system
safety items.
An individual commenter suggested
that all hardware dependent on software
be vertically integrated and signal proof
to protect against issues posed by cyber
Canada approve all commercial software-based
aerospace systems. The FAA approved AC 20–115C
July 2013, making DO–178C a recognized
‘‘acceptable means, but not the only means, for
showing compliance with the applicable
airworthiness regulations for the software aspects of
airborne systems and equipment certification.’’
E:\FR\FM\10DER2.SGM
10DER2
79656
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
security or signal interference. The FAA
does not believe a change to the
regulations is necessary. Issues posed by
cyber security or signal interference that
could pose a threat to public safety are
adequately addressed by the hazard
identification and mitigation
requirements in § 450.141.
SpinLaunch recommended that the
proposed set of software requirements,
compliance plans, and test data be
replaced with the requirement either to
submit a software plan and sample
results or to demonstrate the capability
of the software to perform as required.
The requirement that an operator
either submit a software plan and
sample results or demonstrate the
capability of the software would not
protect public safety adequately for
three reasons. First, a software plan is
insufficient without evidence of its
execution. Section 450.141 requires an
operator to document a development
process for all computing system safety
items and provide evidence of its
execution. Second, the minimum set of
sample results that would be sufficient
to verify protection of the public is the
set that meets the requirements in
§ 450.141(b)(4) for verification of public
safety-related functionality. Third, an
adequate demonstration of software
capability necessarily will include the
level of testing specified by § 450.141.
For these reasons, the FAA does not see
a distinction between § 450.141 and
either the submission of a software plan
and sample results or a demonstration
of software capability.
y. Safety-Critical Systems Design, Test,
and Documentation (§ 450.143)
jbell on DSKJLSW7X2PROD with RULES2
In the NPRM, the FAA proposed
standalone performance-based
requirements for safety-critical systems
in § 450.143. The proposed
requirements covered fault tolerance,
qualification testing, acceptance of
hardware, and lifecycle management for
all safety-critical systems including
FSS.143 In the NPRM, the FAA noted
that applicants using an FSS of any
reliability threshold would be required
to meet the proposed § 450.143 safetycritical system design, test, and
143 As noted in the NPRM, an FSS is an integral
tool to protect public health and safety and the
safety of property from hazards presented by a
vehicle in flight. An FSS allows an operator to
exercise positive control of a launch or reentry
vehicle, enabling an operator to destroy the vehicle,
terminate thrust, or otherwise achieve flight abort.
A highly reliable FSS that controls the ending of
vehicle flight according to properly established
rules nearly ensures containment of hazards within
acceptable limits. For that reason, the FAA
considers an FSS a safety-critical system. See 84 FR
15326.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
documentation requirements.144 In
addition, under proposed § 450.143(a),
operators required to use an FSS under
§ 450.101(c) would be required to meet
the standards in § 450.145.
The FAA also proposed to revise the
definition of ‘‘safety critical’’ in § 401.5.
As proposed, ‘‘safety critical’’ retained
the longstanding definition of being
something ‘‘essential to safe
performance or operation,’’ and the
proposed definition further explained
that a safety-critical system, subsystem,
component, condition, event, operation,
process, or item, is one whose proper
recognition, control, performance, or
tolerance, is essential to ensuring public
safety. The FAA proposed to remove
language in the existing definition
stating that something is ‘‘safety
critical’’ if it creates a safety hazard or
provides protection from a safety
hazard, because that language is
redundant.
In the final rule, the FAA adopts
§ 450.143 with some revisions discussed
later in this section. The FAA also
adopts the proposed definition of
‘‘safety critical’’ without substantive
change and relocates it to § 401.7. Based
on the change to the definition of
‘‘public’’ in the final rule, the FAA
changes the reference to ‘‘public safety’’
in the definition of ‘‘safety critical’’ to
‘‘public safety and the safety of
property.’’
Blue Origin, CSF, and one individual
commented that the term ‘‘safety
critical’’ was ambiguous in light of the
proposed revision to § 401.5.
A system is safety critical if its
performance is essential to safe
performance or operation. If the failure
of a system can create a hazard to the
public, then the system is a safetycritical system. Section 450.143 would
apply to a safety-critical system unless
an operator demonstrates through its
flight hazard analysis that the likelihood
of any hazardous condition associated
with the system that may cause death or
serious injury to the public is extremely
remote, pursuant to § 450.109(b)(3). Due
to the inherent risk to the public, an
operator must demonstrate the
reliability of a safety-critical system by
meeting the requirements of
§ 450.143.145
The applicant’s identification and
proper management of safety-critical
systems is fundamental to mitigating
potential hazards and ensuring public
144 See
84 FR 15329.
addition to § 450.143, requirements in the
final rule that apply to safety-critical systems are
also found in §§ 450.45(e)(3)(ii)(C), 450.103(c)(1),
450.103(d)(4), 450.107(b)(2), and 450.107(d)(1)(ii).
These requirements are discussed within those
sections.
145 In
PO 00000
Frm 00092
Fmt 4701
Sfmt 4700
safety, and the FAA will work with an
applicant if it believes the applicant has
failed to identify all safety-critical
systems. The potential failure of safetycritical systems is integral to the FSA,
and the vulnerabilities of safety-critical
systems must be accounted for in the
flight commit criteria, hazard analyses,
lightning protection criteria,
management of radio frequency to
prevent interference, and
communications plans.
Virgin Galactic commented that the
requirements of § 450.143 are costly,
time-consuming, burdensome, and
contrary to the Commercial Space
Launch Act requirement to only regulate
to the extent necessary. Virgin Galactic
requested that an applicant not be
mandated to comply with § 450.143 if it
can provide proof that a safety-critical
system meets the safety criteria.
The FAA acknowledges that, under
certain circumstances, an operator could
demonstrate that a safety-critical system
would not need to have the robust
design and testing required of § 450.143.
The FAA considered relieving an
operator from the requirements in
§ 450.143 if the safety criteria in
§ 450.101 were met. However, the FAA
found that use of the safety criteria for
this purpose is not appropriate because
whereas the requirements in § 450.143
apply to safety critical systems—which,
as defined, can be a system, subsystem,
component, condition, event, operation,
process, or item—the safety criteria in
§ 450.101 measure the effects of the
failure modes of the vehicle as a whole,
as analyzed in the FSA. Therefore,
demonstrating compliance with the
safety criteria in § 450.101 is not
sufficient to relieve an operator from the
requirements in § 450.143, because that
alternative would relieve the operator
from analyzing the vehicle’s discrete
systems, subsystems, components,
conditions, events, operations,
processes, and items. The FAA finds
that analysis at this more discrete level
is necessary to ensure safety of the
public.
The FAA finds that a more
appropriate method to provide
flexibility and be responsive to Virgin
Galactic’s concern is to rely on the flight
hazard analysis in § 450.109.
Specifically, the FAA revises
§ 450.143(a) to exclude safety-critical
systems for which an operator
demonstrates through its flight hazard
analysis that the likelihood of any
hazardous condition specifically
associated with the system that may
cause death or serious injury to the
public is extremely remote, pursuant to
§ 450.109(b)(3). As explained in the
preamble section associated with
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
§ 450.109, the flight hazard analysis
focuses on the reasonably foreseeable
hazards to public safety resulting from
the flight of a launch or reentry vehicle.
In performing the flight hazard analysis,
the operator is required in
§ 450.109(b)(1)(ii) to identify reasonably
foreseeable hazards and corresponding
failure modes relevant to public safety
resulting from system, subsystem, and
component failures or faults. Therefore,
unlike the safety criteria in § 450.101,
the flight hazard analysis explicitly
requires the operator to examine the
hazards associated with the discrete
systems, subsystems, and components
of the vehicle.
Thus, to provide increased flexibility
without reducing safety, the final rule
excludes certain safety-critical systems
from the requirements of § 450.143 if an
operator demonstrates through its flight
hazard analysis that the likelihood of
any hazardous condition specifically
associated with the system that may
cause death or serious injury to the
public is extremely remote, pursuant to
§ 450.109(b)(3). That is, the operator
must show that specific requirements in
§ 450.143, which ensure that the system
will function reliably, are not entirely
necessary to mitigate the hazards
specifically associated with the system
to an extremely remote level.
For example, an operator’s launch
vehicle may have a number of systems
whose failure could potentially cause
hazardous debris to impact the public.
If an operator chooses to launch in a
sparsely populated area and limit
propellant loading to minimize risk to
the public to an extremely remote level
despite the failure of one or more safetycritical systems, then those systems
would not need to be designed or tested
to the level set forth in § 450.143. The
operator must show that the exception
in § 450.143(a)(2) applies for a particular
safety-critical system through its flight
hazard analysis. If the operator cannot
show that all hazards involving the
system are sufficiently mitigated to an
extremely remote level despite a failure
of that system, then that system must
meet the design and testing
requirements in § 450.143.
However, the FAA anticipates that
certain systems will not qualify for the
exception in § 450.143(a)(2).
Specifically, safety critical systems that
prevent hazards from reaching the
public given other system failures
would likely be required to meet
§ 450.143. This is also true of systems
that create hazards to the public that are
not otherwise mitigated by other hazard
controls. The FAA anticipates that it is
unlikely that an operator would be able
to demonstrate that the hazards
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
associated with these systems meet the
‘‘extremely remote’’ standard in
§ 450.109(b)(3) without subjecting them
to the reliability requirements in
§ 450.143. Furthermore, FSS required by
§ 450.108(b)(2) must meet § 450.143
without exception.
The FAA also revises § 450.143(a) and
removes the proposed requirement that
all FSS required by § 450.101(c) must
meet §§ 450.143 and 450.145. Instead,
§ 450.143(a) requires all safety-critical
systems except for the highly reliable
FSS required by § 450.108(b)(1) to meet
the requirements in § 450.143. As
discussed in the flight abort section of
this preamble, an FSS required by
§ 450.108(b)(2) must comply only with
§ 450.143 rather than meeting the
additional requirements proposed in
§ 450.145. Likewise, an operator who
chooses to use flight abort as a hazard
control strategy for reasons other than
protecting against a high consequence
event under § 450.101(c)(1) must also
satisfy the requirements of § 450.143 for
its FSS. For reasons explained later in
this section, highly reliable FSS under
§ 450.145 do not need to comply with
the general safety-critical systems
requirements of § 450.143 as was
proposed in the NPRM.
The FAA proposed in § 450.143(b) to
require that all safety-critical systems
follow reliable design principles.
Specifically, an operator would be
required to design those systems to be
fault-tolerant so that no single credible
fault could lead to increased risk to the
public.
Both Sierra Nevada and Virgin
Galactic commented that requiring fault
tolerance would be so burdensome to
the applicant that several current
operators would not be able to meet the
requirement for systems on existing
vehicles. Sierra Nevada commented that
using fault tolerance as a catch-all
hazard control can add risk in certain
cases, and the determination regarding
whether something is fault-tolerant is
not straightforward.
Fault tolerance 146 is the idea that a
system must be designed so that it is
able to perform its function in the event
of a failure of one or more of its
components. In a fault-tolerant design of
a safety-critical system, no single
credible fault should be capable of
increasing the risk to public safety
beyond that of a nominal operation.
Although the FAA proposed fault
146 Typically, a fault-tolerant design applies
redundancy or a system of safety barriers to ensure
the system can function, though perhaps with
reduced performance. An example of a faulttolerant design is an aircraft with multiple engines
that can continue flying even if one of the engines
fails.
PO 00000
Frm 00093
Fmt 4701
Sfmt 4700
79657
tolerance for the design of safety-critical
systems in the regulatory text, the FAA
intended to accept other methods of
safety design, including fail-safe 147 and
damage-tolerant 148 systems like primary
structures that generally cannot be
redundant. This broader view of safe
design allows an operator to factor
planned operational restrictions, testing,
and inspection into the design to
demonstrate that a system is broadly
fault-tolerant.
The FAA acknowledges that its
articulation of a fault-tolerant design
requirement in the proposed regulation
did not accurately reflect the FAA’s
statements in the NPRM preamble
allowing other methods of safe design,
like fail-safe systems, damage-tolerant
systems, or other designs for graceful
degradation.149 A system that is
designed to be fail-safe or degrade
gracefully, whether it functions at a
reduced level or fails completely, does
so in a way that protects people and
property from injury or damage, or
generally prevents a more serious failure
event. Such design is desirable, and was
intended to be captured in the FAA’s
design requirements for safety-critical
systems. In the final rule, the FAA
amends § 450.143(b) to state only that
safety-critical systems must be designed
such that no credible fault can lead to
increased risk to the public beyond
nominal safety-critical system
operation. The final rule gives the
operator flexibility to achieve this
requirement through a design that is
fault-tolerant, fail-safe, damage-tolerant,
or any other solution.
The FAA views design for reduced
risk as a necessary characteristic of any
reliable system. The FAA recognizes
there may be other acceptable design
principles that protect the public
adequately from or in spite of a credible
fault. In the final rule, the FAA removed
the word ‘‘single’’ from § 450.143(b) to
clarify that some design concepts may
allow faults, but that the faults should
not lead to increased risk to the public.
The FAA also removed ‘‘safety’’ from
§ 450.143(b) because ensuring no
increased risk to the public necessarily
addresses public safety. An applicant
147 A fail-safe design is a system that can fail in
a controlled way, such that the failure will still
ensure public safety, like elevator brakes held open
by the tension of the elevator cable such that, if the
cable snaps, the brakes engage and stop the elevator
from falling.
148 Damage-tolerant design allows for robust
design, or design to fail gracefully, for systems like
a vehicle hull that cannot be redundant or fail-safe.
Fault-tolerant, fail-safe, and damage-tolerant
designs are all design concepts meant to prevent
credible faults or prevent increased risk to the
public if failures do occur.
149 84 FR 15325–15326.
E:\FR\FM\10DER2.SGM
10DER2
79658
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
may demonstrate that no credible fault
can lead to increased risk through
analysis, identification of possible
failure modes, implementation of
redundant systems or other mitigation
measures, and verification that the
mitigation measures will not fail
simultaneously.
Safety-critical systems requirements
necessitate testing that accounts for the
operating environment the system will
encounter. For that reason, the FAA
proposed to define ‘‘operating
environment’’ in § 401.5 (§ 401.7 in the
final rule) as ‘‘an environment that a
launch or reentry vehicle component
will experience during its lifecycle.’’
The proposed definition further stated
that operating environments include
shock, vibration, thermal cycle,
acceleration, humidity, and thermal
vacuum.
In the final rule, the FAA adopts the
proposed definition with additional
language indicating that operating
environments also include other
environments relevant to system or
material degradation. As stated in the
NPRM, the list of examples in the
definition is not exhaustive, and the
additional language in the final rule
establishes a standard for operators to
consider in assessing relevant
environmental factors when qualifying
an FSS or other safety-critical system
design through testing and analysis.
In addition to meeting the design
requirements of § 450.143(b), the FAA
proposed qualification testing 150
requirements in § 450.143(c) that
required, in part, that an operator
demonstrate the design of the vehicle’s
safety-critical systems functionally at
conditions beyond its predicted
operating environment. An operator
must select environmental test levels
that ensure the design is sufficiently
stressed to demonstrate that system
performance is not degraded due to
design tolerances, manufacturing
variances, or uncertainties in the
environment. Qualification testing will
demonstrate margin over all operating
and non-operating environments to
which the flight unit can be exposed,
including margin over all component
150 Qualification testing is an assessment of a
prototype or other structural article to verify the
structural integrity of a design. Generally,
functional demonstration of the design’s
qualification at operating environments involves
testing the design under a number of different
environmental factors to stress the design, with a
multiplying factor applied to the expected
environmental testing limit. This qualification
testing is conducted for temperatures, tensile loads,
handling shocks, and other expected environmental
stressors relevant to system or material degradation.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
acceptance tests. Valid qualification
testing environments should—
• Account for material variation,
because all materials have properties
that have a variance from nominal
values.
• Account for manufacturing
variation, because the functionality of a
system is not only dictated by the
quality of materials used, but also the
quality of the manufacturing processes
employed.
• Account for environmental
variation, because environmental
predictions can have a great deal of
uncertainty, particularly early in a
program.
• Demonstrate margin against failure,
because safety-critical systems often fail
in complex and unpredictable ways.
The FAA also proposed requirements
for acceptance 151 of hardware in
§ 450.143(d) that required, in part, an
operator to demonstrate any safetycritical system functionally while
exposed to its predicted operating
environment with margin to
demonstrate that it is free of defects, free
of integration and workmanship errors,
and ready for operational use.
Acceptance testing on flight units
should uncover critical workmanship
errors, and damaged, weak, or out-ofspecification components before they
fail in flight. Because this testing is done
on flight units, valid acceptance testing
should avoid over-testing safety-critical
components. This avoidance is
accomplished by testing significantly
under qualification levels and
durations, but still over nominal
operation levels and durations. The
FAA adopts these requirements as
proposed, with minor editorial
corrections.
Lastly, the FAA proposed
requirements pertaining to the lifecycle
of safety-critical systems in § 450.143(e),
which required an operator to monitor
the flight environments experienced by
safety-critical system components to the
extent necessary to validate the
predicted operating environment.152
151 Unlike qualification testing that is performed
on qualification units, acceptance testing or other
functional demonstration of acceptance required by
§ 450.143(d) is performance testing conducted on
the actual hardware to be used on a vehicle after
the completion of the manufacturing process.
Generally, acceptance tests are performed on each
article of the safety-critical flight hardware to verify
that it is free of defects, free of integration and
workmanship errors, and ready for operational use.
Acceptance testing includes testing for defects,
along with environmental testing similar to the
qualification testing described earlier.
152 Applicants must account for environments
that any safety-critical system is expected to
encounter throughout the lifecycle of the system in
accordance with § 450.143(e), including storage,
transportation, installation, and flight, which
PO 00000
Frm 00094
Fmt 4701
Sfmt 4700
In the final rule, the FAA makes one
minor revision to § 450.143(c), (d), and
(e). In each of those subsections, the
FAA has changed the term ‘‘operating
environment’’ to ‘‘operating
environments’’ because all systems will
experience multiple operating
environments. As stated in the NPRM
preamble,153 applicants must account
for all operating environments that any
safety-critical system is expected to
encounter throughout the lifecycle of
the system in accordance with
§ 450.143(e), including storage,
transportation, installation, and flight,
which generally are built into
qualification and acceptance testing
levels. Other than this minor revision,
the FAA adopts these subsections as
proposed. Note also that in the means of
compliance table released with the
NPRM, the FAA identified SMC–S–016,
‘‘Test Requirements For Launch, UpperStage and Space Vehicles,’’ as an
acceptable means of compliance with
§ 450.143. SMC–S–016 is an Air Force
standard that defines environmental test
requirements for launch vehicles,
upper-stage vehicles, space vehicles,
and their subsystems and units. The
FAA maintains that the environmental
test levels in that standard are
acceptable for safety-critical systems
under § 450.143, except, as noted in the
means of compliance table,
protoqualification testing testing found
in 4.2.3 and B.1.3–4, and
protoqualification by similarity in
4.10.1.154
As noted earlier, FSS required
pursuant to § 450.108(b)(2), when the
consequence of any reasonably
foreseeable failure mode in any
significant period of flight is between 1
× 10¥2 and 1 × 10¥3 CEC for
uncontrolled areas, must satisfy the
requirements in § 450.143. This
approach is consistent with the NPRM,
which required all safety-critical
systems including all FSS to satisfy the
general requirements in § 450.143. For
the reasons explained more fully in the
next section, the final rule does not
adopt the additional requirements for
such an FSS that were proposed in
§ 450.145(a)(2), which would have
required the FSS to have a design
reliability of 0.975 at 95 percent
confidence and commensurate design,
analysis, and testing. The FAA no
generally are built into qualification and acceptance
testing levels.
153 84 FR 15323.
154 Protoqualification is used when test hardware
is planned to be used for flight, generally for
designs that will have limited production. Tests
conducted to demonstrate satisfaction of design
requirements use reduced margins, supplemented
with other analyses and tests.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
longer finds this reliability value
necessary because, as a commenter
noted, it was unnecessarily
prescriptive.155 Moreover, as discussed
in the NPRM, there are no established
standards to demonstrate the 0.975
reliability number, other than a single
string FSS that otherwise meets the
requirements of RCC 319.
Instead, the FAA requires
§ 450.108(b)(2) FSS to meet the
requirements in § 450.143. This
regulatory approach should support
ongoing innovation in the development
of FSS. As noted in the NPRM, the
commercial space transportation
industry has continued to mature and
operators have proposed FSS
alternatives. These alternative
approaches include fail-safe single
string systems that trade off mission
assurance and redundancy, other failsafe consequence mitigation systems,
and dual-purpose systems such as FSS
that reuse the output of safety-critical
GPS components for primary navigation
avionics. The FAA is publishing a
‘‘Safety-Critical Systems’’ AC to provide
an acceptable means of compliance with
§ 450.143. However, the FAA does not
claim that an FSS approved under
§ 450.143 necessarily has a reliability of
0.975. Although some standard in the
future may be able to establish a
reliability of 0.975 at 95 percent
confidence, that standard does not exist
today. FSS are discussed more fully in
the next section of this preamble.
The FAA amends the proposed
application requirements in § 450.143(f)
for safety-critical systems to require that
applicants describe the methods used to
validate the predicted operating
environments. In order to comply with
§ 450.143(e)(2)(i), applicants must
validate the predicted operating
environments for their safety-critical
systems. However, the NPRM
inadvertently omitted the corresponding
application requirement from proposed
§ 450.143(f). This change results in no
additional burden as an operator would
have to demonstrate compliance with
the substantive provision by providing
this information.
The FAA also adds new
§ 450.143(f)(7) to the application
155 CSF commented that by binning the CE of a
C
vehicle and then prescribing a fixed reliability
requirement for the FSS, the risk of an unmitigated
CEC event is not consistent because the binning
requires the same FSS even though the risk varies
by an order of magnitude. Although the FAA does
not agree with CSF’s solution to move the entire
concept of CEC into an Advisory Circular, as
discussed earlier, the FAA does agree that it is
unnecessary to establish a fixed reliability number
for all § 450.108(b)(2) flight FSS required for
operations with CECs that could be an order of
magnitude apart.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
requirements, which requires an
applicant to describe the standards used
in each phase of a safety-critical
system’s lifecycle. This addition is
consistent with current practice and
will not increase the burden on
operators, because an operator would
likely provide this information to
support its finding that a safety-critical
system is designed such that no credible
fault can lead to increased risk to the
public beyond nominal safety-critical
system operation. In addition, this
description of standards is necessary to
help identify previous flights of a
vehicle developed and launched or
reentered in similar circumstances, as
required under § 450.131(d)(1).
Virgin Galactic asked how the
requirements of § 450.143 would apply
to safety-critical systems that have been
licensed previously. Virgin Galactic
generally objected to proposed
§ 450.143, arguing its requirements were
similar to aircraft certification rules and
would be appropriate for a more mature
industry. Virgin Galactic requested an
exclusion from proposed § 450.143 for
hybrid vehicles that have been issued an
experimental airworthiness certificate
by the FAA and operate as aircraft.
As discussed in the preamble section
on Hybrid Vehicles, the FAA does not
agree that an airworthiness certificate
issued by the FAA should automatically
exempt a vehicle used in a launch or
reentry from the safety-critical system
requirements in § 450.143. An applicant
may make an ELOS case for a
component of a launch vehicle, such as
a carrier aircraft, if it holds a
airworthiness certificate with an
acceptable flight test history. Section
450.143 is flexible and broad enough
that the FAA is not aware of any
currently licensed vehicles or operators
in formal pre-application consultation
that would not meet the new
requirements. For example, operators
licensed under parts 431 or 435 use a
system safety process to verify and
validate the reliability and mitigation of
hazards for any safety-critical system.
The treatment of safety-critical systems
under part 431 and 435 provides an
ELOS to the safety-critical systems
requirements in § 450.143. Flight Safety
Systems (§§ 450.143 and 450.145)
z. Flight Safety Systems (§§ 450.143 and
450.145)
As previously discussed, proposed
§ 450.101(c) would have required an
operator to use flight abort with an FSS
that meets the requirements of § 450.145
if the consequence of any reasonably
foreseeable vehicle response mode, in
any one-second period of flight, was
PO 00000
Frm 00095
Fmt 4701
Sfmt 4700
79659
greater than 1 × 10¥3 CEC for
uncontrolled areas.156
As proposed in § 450.145(a)(1), if the
consequence of any vehicle response
mode was 1 × 10¥2 CEC or greater for
uncontrolled areas, an operator would
have been required to employ an FSS
with design reliability of 0.999 at 95
percent confidence and commensurate
design, analysis, and testing. The FAA
noted that RCC 319 is the only
government standard that would meet
the requirement for a design reliability
of 0.999 at 95 percent confidence and
commensurate design, analysis, and
testing.
Proposed § 450.145(a)(2) required
that, if the consequence of any vehicle
response mode was between 1 × 10¥2
and 1 × 10¥3 CEC for uncontrolled
areas, an operator would have been
required to employ an FSS with a
design reliability of 0.975 at 95 percent
confidence and commensurate design,
analysis, and testing. In the NPRM, the
FAA acknowledged that, although no
standard exists for an FSS with this
design reliability, it expected individual
applicants to create their own FSS
requirements based on RCC 319 and
have them approved as an accepted
means of compliance by the FAA prior
to application submittal.157 The FAA
anticipated the industry would develop
voluntary consensus standards for FSS,
particularly for those FSS that are only
required to have a design reliability of
0.975 at 95 percent confidence.
The FAA explained the proposed
lower reliability by noting that, for
operations in which the consequence of
a flight failure is lower, the FSS, while
still being reliable, may not need to be
as highly reliable as an FSS for a vehicle
operating in an area where the
consequence of a flight failure is higher.
As such, in order to make regulations
adaptable to innovative operations
while maintaining appropriate levels of
safety, the FAA proposed to allow an
FSS with less demonstrated design
reliability for operations with lower
potential consequences. In the final
rule, the FAA removes the proposed
requirement for an FSS with design
reliability of 0.975 at 95 percent
confidence, as will be discussed later in
this preamble section.
In the final rule, the FAA has
maintained the proposed requirement
156 As explained in the section of the preamble on
high consequence events, this proposed
requirement would have applied to all phases of
flight unless otherwise agreed to by the
Administrator based on the demonstrated reliability
of the launch or reentry vehicle during that phase
of flight.
157 The FAA indicated that this approach would
be akin to ‘‘tailoring’’ RCC 319, which is current
practice at Federal launch ranges.
E:\FR\FM\10DER2.SGM
10DER2
79660
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
for an operator to employ an FSS with
design reliability of 0.999 at 95 percent
confidence and commensurate design,
analysis, and testing if the consequence
of any reasonably foreseeable failure
mode in any significant period of flight
is greater than 1 × 10¥2 CEC in
uncontrolled areas.158 Operators
currently meet this requirement for
launches conducted under legacy
regulations by tailoring RCC 319, and an
operator could submit a tailored version
of RCC 319 to the FAA as a means of
compliance for § 450.145(b).
In the final rule, the FAA has revised
the section heading for § 450.145 from
‘‘Flight safety system’’ to ‘‘Highly
reliable flight safety system’’ because it
now contains only those requirements
for an FSS required by § 450.108(b)(1)
when the consequence of any
reasonably foreseeable failure mode in
any significant period of flight is greater
than 1 × 10¥2 CEC in uncontrolled
areas. The FAA has also reorganized the
section and moved the reliability
requirements in proposed § 450.145(a)
to § 450.145(b) with revisions.
While the design reliability required
for a highly reliable FSS remains 0.999
at 95 percent confidence and
commensurate design, analysis, and
testing, the FAA has specified in
§ 450.145(b)(1) of the final rule that this
reliability applies to the portion of the
FSS onboard the vehicle. In addition, if
a portion of an operator’s FSS is groundbased, space-based, or otherwise not
onboard the vehicle, the FAA has
specified in § 450.145(b)(2) of the final
rule that it must have the same
reliability as the onboard portion; that
is, 0.999 at 95 percent confidence and
commensurate design, analysis, and
testing. Although not all FSS have a
ground portion, this requirement
reflects past and current practice for
launches from both Federal and nonFederal sites, in which the ground
portion of an FSS and the airborne
portion of an FSS are independently
designed, tested, and operated to
rigorous standards. This independence
ensures that the appropriate command
is sent by the ground-based system with
a high reliability, and received and
acted upon with high reliability by the
onboard portion of the system, to result
in the desired termination action.
The reference in § 450.145(a) to an
FSS ‘‘on the launch or reentry vehicle’’
did not reflect the FAA’s intention
158 As previously explained, the FAA has
replaced the term ‘‘vehicle response mode’’ with
‘‘failure mode’’ and the term ‘‘one-second period of
flight’’ with ‘‘significant period of flight,’’
throughout the final rule. The basis for these
changes is discussed in the preamble section on
flight abort.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
accurately, as stated in the NPRM, to
include FSS not onboard the vehicle in
the design reliability requirements in
§ 450.145.159 Conventional FSS with
onboard flight termination receivers and
not-onboard command transmitter
systems will have both onboard and notonboard subsystems. Many current
autonomous FSS only have onboard
systems. As discussed previously, the
final rule requires both onboard and
not-onboard FSS systems independently
to demonstrate 0.999 at 95 percent
reliability. This requirement is because
FSS with both onboard and not onboard
systems that individually meet 0.999 at
95 percent reliability could have a
combined reliability as low as 0.998 at
95 percent confidence, whereas FSS
with only onboard systems would be
required to have a reliability of at least
0.999 at 95 percent confidence. To
ensure that FSS all meet the same
standard required to protect public
safety, the final rule requires that
onboard systems and not onboard
independently meet the 0.999 at 95
percent confidence level of reliability.
The collective FSS design reliability
requirement is not specifically stated in
the final rule since the onboard FSS and
not-onboard FSS design reliability
requirements are independently defined
in § 450.145 and the overall FSS design
reliability is dependent on the type of
FSS employed.160
For § 450.108(b)(1) FSS that must
meet the requirements of § 450.145,
unless alternative methods are accepted
by the Administrator, the FAA has
identified RCC 319 as an existing means
of compliance to demonstrate FSS
reliability. This standard is currently
used by applicants that employ
traditional flight abort under part 417.
The FAA expects to continue the
current practice of working with
applicants to tailor RCC 319 in order to
comply with § 450.145. A tailored RCC
319 that is used as a means of
compliance for § 450.145(b) must be
submitted to the FAA for acceptance
159 In the NPRM, the FAA stated that the
reliability standard in proposed § 450.145(a)(1)
would be consistent with various sections of part
417, in particular § 417.309(b)(2), that require major
FSS component systems, such as onboard flight
termination systems and ground-based command
control systems, to be tested to demonstrate 0.999
design reliability at 95 percent confidence. The
FAA further noted that this reliability threshold
would have to be demonstrated for the operation of
the entire system, including any systems located
on-board the launch or reentry vehicle, any groundbased systems, and any other component or support
systems. 84 FR 15328.
160 As discussed earlier in the preamble, if the
consequence of any vehicle response mode is less
than 1 × 10¥3, the FAA will not require an FSS or
mandate its reliability if an operator chooses to use
one.
PO 00000
Frm 00096
Fmt 4701
Sfmt 4700
prior to being included in a license
application.
As noted in the previous preamble
section, the FAA has removed the
additional requirements proposed in
§ 450.145(a)(2), and is relying on
requirements in § 450.143 to ensure that
an FSS required by § 450.108(b)(2) is
sufficiently reliable. As with the NPRM,
the final rule reduces the burden on
operators that have a lower potential for
causing high consequence events. This
change maintains the intent of the
proposal to protect against high
consequence events using a means
different from the traditional highly
reliable FSS.
As noted in the previous section, the
Safety-Critical Systems AC will provide
an approach to compliance with
§ 450.143 that modifies the provisions
in RCC 319. The approach uses a menu
of potential options that, when met,
would demonstrate that an operator has
met § 450.143. The AC will provide
combinations of various tailored RCC
319 requirements that the FAA has
determined demonstrate compliance
with § 450.143. Some of the tailored
requirements include:
• Reducing the random vibration and
thermal cycle qualification test margins
to a level and duration that remains
above acceptance test levels;
• Reducing the number of required
qualification test units;
• Reducing the minimum required
sample size for ordnance lot acceptance
testing and ordnance qualification
testing;
• Allowing qualification by similarity
with deviations to RCC 319 qualification
by similarity criteria;
• Reducing the required number of
thermal cycles for component level
qualification thermal cycle test
requirements;
• Reducing the radio frequency link
margin requirements for traditional
commanded FSS;
• Allowing single string fail-safe FSS;
• Reducing electronic piece parts
requirements; and
• Allowing use of vehicle
components or systems for FSS use such
as vehicle power source or flight
computer.
An operator could work with the FAA
to determine what combination of
options would satisfy § 450.143 for
specific FSS. In addition, an operator
could develop its own combination of
tailored RCC requirements to
demonstrate compliance, or could elect
to use a different means of compliance
outside of the RCC 319 requirements.
An operator may demonstrate
compliance with § 450.143 through
other means that adequately establish
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
design, qualification testing, and
acceptance testing. As mentioned
earlier, the environmental test levels in
SMC–S–016 are acceptable for safetycritical systems under § 450.143,
including some FSS components, except
protoqualification testing found in 4.2.3
and B.1.3–4, and protoqualification by
similarity in 4.10.1.
Lastly, the FAA also makes minor
changes to the application requirements
in § 450.145. In the NPRM, § 450.145(d)
stated that an FSS includes any FSS
located onboard a launch or reentry
vehicle; any ground based command
control system; any support system,
including telemetry subsystems and
tracking subsystems, necessary to
support a flight abort decision; and the
functions of any personnel who operate
the FSS hardware or software. This
provision has been moved to the
definition of ‘‘flight safety system’’ and
deleted from § 450.145(d).161
The FAA received several comments
on the limited means of compliance
available to demonstrate compliance
with the FSS reliability requirements.
Blue Origin commented that the
industry had only been given one means
of compliance for both tiers of FSS
reliability. Blue Origin also commented
that the proposal indicated the only
accepted means of complying with
§ 450.145 would be an untailored RCC
319. Blue Origin and CSF suggested that
there exist other industry and
government standards that should be
accepted means of compliance with the
reliability requirements of § 450.145.
Blue Origin and Microcosm stated that
a tailored RCC 319 or SMC–S–016
should also be an accepted means of
compliance. SpaceX commented that
RCC 319 was an acceptable standard,
but only if the document may be
tailored for each operator.
The FAA clarifies that RCC 319 is a
means of compliance the FAA has
identified to date that ensures
compliance with § 450.145, but RCC 319
is not the only possible means of
compliance that the FAA will consider.
The performance-based nature of
§ 450.145 allows an operator to submit
its own unique means of compliance to
161 In the final rule, the definition of FSS is ‘‘a
system used to implement flight abort. A flight
safety system includes any flight safety system
located onboard a launch or reentry vehicle; any
ground based command control system; any
support system, including telemetry subsystems
and tracking subsystems, necessary to support a
flight abort decision; and the functions of any
personnel who operate the flight safety system
hardware or software.’’ In the NRPM, the definition
also included that a human can be a part of an FSS.
The FAA removed this sentence from the definition
because ‘‘the functions of any personnel who
operate the flight safety system’’ covers this
circumstance.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
the FAA. An applicant may propose a
tailored version of RCC 319 prior to
submitting its application as a unique
means of compliance to be accepted by
the Administrator. As discussed earlier,
the Safety-Critical Systems AC will
provide guidance to operators on how to
comply with the requirements for
§ 450.108(b)(2) FSS. This approach uses
RCC 319 as one starting point. The AC
will also refer to SMC–S–016, as
discussed earlier. The FAA notes that,
unlike for highly reliable FSS required
to meet § 450.145, for an FSS required
by § 450.108(b)(2) an operator is not
required to have a means of compliance
with § 450.143 accepted in advance of
application submittal. However, it
would be advisable for an operator to
consult with the FAA early in its
program’s development on the approach
to compliance with § 450.143, whether
for an FSS or other safety-critical
systems.
The performance-based nature of
§§ 450.143 and 450.145 also allows an
industry consensus standards body to
submit a proposed means of compliance
to the FAA for general use. This process
is discussed in more detail in the Means
of Compliance section of the preamble.
Applicants are encouraged to work with
the FAA in pre-application consultation
to discuss potential unique means of
compliance. For example, for
§ 450.108(b)(1) FSS, an applicant could
work with the FAA during preapplication consultation to tailor RCC
319 to the operation while still ensuring
compliance with § 450.145. The FAA
will review the documents tailored to
vehicle programs and mission-specific
applications as unique means of
compliance for a given license.
Blue Origin, CSF, and Virgin Galactic
expressed concern that a vehicle that
did not require an FSS under parts 431
or 435 might require one under part 450.
The FAA disagrees. This rule maintains
the level of safety required under parts
415, 417, 431, and 435 for FSS.
Furthermore, as discussed in the High
Consequence Event Protection section of
this preamble, the ACTA study results
indicate that no changes would be
required under the final rule regarding
the need for an FSS for any currently
licensed launch vehicle launched from
a Federal or commercial launch or
reentry site. Therefore, the FAA does
not expect to require an FSS under part
450 for any launch vehicle that would
not have been required to have an FSS
under parts 431 and 435.
CSF commented that the NPRM’s
proposed structure for requiring flight
abort was overly prescriptive and would
not give an operator flexibility to define
the type of FSS to implement. CSF
PO 00000
Frm 00097
Fmt 4701
Sfmt 4700
79661
recommended requiring operators to
make a safety case and moving CEC and
the reliability requirements for FSS of
the NPRM to an AC.
The FAA disagrees that a safety case
should take the place of discrete CEC
thresholds and the requirements for FSS
in §§ 450.143 and 450.145. Although a
safety case is a potential approach to
applying for an ELOS determination for
many of the regulatory requirements,
the FAA does not believe that requiring
a safety case, by itself, provides
sufficient regulatory clarity as to what is
expected of a launch or reentry operator
to obtain and maintain a license.
Blue Origin commented that the
means of compliance for FSS
requirements in the NPRM was unclear,
particularly for systems not on the
launch vehicle such as tracking systems,
ground systems, and flight abort crew.
As examples, Blue Origin mentioned
RCC 324 162 and EWR 127–1 163 for
tracking systems, AFSPCI 91–701 164 for
ground systems, and AF 13–602 165 for
flight abort crew.
As discussed above, § 450.145(b) has
been amended to address more clearly
the part of the FSS onboard the vehicle
and the part not onboard the vehicle,
such as ground-based and space-based
systems. In addition, this preamble
addresses means of compliance for FSS
requirements specifically, as well as
means of compliance used to meet the
requirements of part 450 more generally.
As discussed previously, an untailored
RCC 319–19 is currently the only means
of compliance the FAA has reviewed
and accepted to meet the § 450.145 FSS
requirements; however, the FAA
anticipates operators will provide
unique tailored versions of RCC 319–19
to the FAA for acceptance under part
450. In addition, RCC 324 is an
acceptable means of compliance for the
airborne tracking sources such as CBand transponders used with ground
based command systems and for GPS
receivers and inertial measurement
units used as airborne tracking data
sources. EWR 127–1 is not a current
means of compliance for tracking
systems because it is out of date.
AFSPCI 91–701 is an acceptable means
of compliance for FSS-related ground
systems. Lastly, AFI 13–602 is an
acceptable means of compliance for
flight abort crew.
162 RCC 324–01 Global Positioning and Inertial
Measurements Range Safety Tracking Systems’
Commonality Standard.
163 Eastern and Western Range (EWR) 127–1
Range Safety Requirements.
164 AFSPCI 91–701, Launch and Range Safety
Program Policy and Requirements.
165 AFI 13–602 Ready Spacecrew Program
Training.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79662
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Blue Origin noted that proposed
§ 450.143 appeared to be appropriately
performance-based and applicable to all
safety-critical systems, including
software. Except for § 450.108(b)(1) FSS
and software, the FAA agrees with Blue
Origin that § 450.143 is appropriately
performance-based and applicable to all
safety-critical systems. The
requirements in § 450.143 are not
sufficient for § 450.108(b)(1) FSS
because those systems require a higher
reliability due to the potential for high
consequence events, as measured by
CEC. As discussed earlier, the unique
hazards due to software have a separate
set of requirements in § 450.141.
Otherwise, § 450.143 is sufficient for
safety-critical systems and FSS that do
not fall under § 450.145 because it
includes performance standards for
design, testing, and lifecycle
management. Note that § 450.143 covers
a § 450.108(b)(2) FSS that an operator
uses to comply with the high
consequence protection requirements of
§ 450.101(c), as well as an FSS that an
operator uses when it chooses flight
abort as a hazard control strategy under
§ 450.107, notwithstanding § 450.101(c).
The requirements are the same for either
FSS because, although the potential for
a high consequence event is less of a
concern in the latter case, each FSS is
critical to meeting the collective,
individual, aircraft, and critical asset
risk criteria in § 450.101(a) and (b).
Blue Origin sought clarification as to
whether an operator would need to
comply with the software requirements
of RCC 319 under the requirements
proposed for § 450.145, in addition to
the software requirements under
§ 450.141. An operator is not required to
comply with the software requirements
of RCC 319 under the requirements for
§ 450.145. Section 450.141 applies to
any software or data that implements a
capability that, by intended operation,
unintended operation, or non-operation,
can present a hazard to the public.
Section 450.141 applies to FSS under
either § 450.108(b)(1) or (b)(2). An
operator is not required to meet RCC
319 in order to satisfy § 450.141, but
RCC 319 is an acceptable means of
demonstrating compliance with
§ 450.141.
Blue Origin and CSF commented that
the NPRM’s assertion that to get a 0.999
design reliability at 95 percent
confidence by testing at predicted
environment levels, an operator would
have to test 2,995 units was incorrect
because it did not take into account the
dual redundant string architecture
traditionally implemented for an FSS.
The FAA concurs that its statement in
the NPRM was an oversimplification
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
that did not describe typical FSS
component testing adequately. FSS
testing generally consists of testing a
certain number of units of an individual
component to determine its reliability
and confidence level, and that testing is
part of determining the overall FSS
system reliability. The FAA maintains
that, for most operators, testing a few
units at greater than expected operating
environments is significantly less
burdensome than testing many units at
expected operating environments.
Operating environments include shock,
vibration, thermal cycle, acceleration,
humidity, and thermal vacuum, or other
environments relevant to system or
material degradation. The opportunity
for operators to submit new means of
compliance to be accepted by the
Administrator prior to application
submission will allow applicants to
propose their own means of compliance
if they believe that another method of
FSS design reliability, testing, and
analysis is less burdensome than a
means of compliance currently accepted
by the FAA.
Microcosm asked if all orbital
operators launching from the United
States would be required to have a 0.999
design reliability FSS in accordance
with proposed § 450.145. The FAA does
not expect that all orbital operators
launching from the U.S. will have
operations with a potential consequence
of a reasonably foreseeable failure mode
in any significant period of flight that is
greater than 1 × 10¥2 CEC in
uncontrolled areas. The FAA notes that,
as described in reference to the high
consequence event protection
requirements of § 450.101(c), operators
will be required to have an FSS if the
consequence of any reasonably
foreseeable failure mode in any
significant period of flight is greater
than 1 × 10¥3 CEC in uncontrolled
areas, and, as proposed, that FSS will
need to have the high design reliability
of 0.999 at 95 percent confidence if the
consequence of any reasonably
foreseeable failure mode in any
significant period of flight is greater
than 1 × 10¥2 CEC in uncontrolled
areas. However, the FAA has removed
the additional requirements proposed in
§ 450.145(a)(2) in the final rule if the
consequence of any reasonably
foreseeable failure mode is between 1 ×
10¥2 and 1 × 10¥3 CEC, and in that
scenario will only require an operator to
use an FSS that complies with
§ 450.143.
SpaceX commented that RCC 319,
section 1.10, allowed previously
approved components and systems to be
grandfathered such that they not be
required to meet subsequent versions of
PO 00000
Frm 00098
Fmt 4701
Sfmt 4700
RCC 319 unless certain criteria apply.
SpaceX suggested that this approach be
taken by the FAA in accepting
previously tailored documents. SpaceX
further recommended allowing such
grandfathered acceptance of different
standards such as AFSPCMAN 91–710.
The FAA’s current practice is to
accept FSS that have been approved
under a standard such as AFSPCMAN
91–710 and RCC 319 even after updated
versions of those standards are released.
Licensing under part 450 should be
consistent with that practice; a licensee
should be able to renew its license
without changes to its FSS simply
because a standard that was used as a
means of compliance has evolved with
time. There would be exceptions,
however, if a significant flaw was
discovered in the earlier version of the
standard.
SpaceX also commented on proposed
§ 450.145(d)(3), which stated that an
applicant must submit any analyses and
detailed analysis reports of all FSS
subsystems necessary to demonstrate
the reliability and confidence levels
required by proposed § 450.145. SpaceX
pointed out that while other government
requirements, such as RCC 319, provide
guidance on what analyses and reports
are necessary, the proposed rule was
unclear as to what specific analyses and
reports are necessary.
As noted earlier, RCC 319 is an
accepted means of compliance for
§ 450.145. An FSS design, testing, and
analysis process that complies with the
analysis requirements for RCC 319, or
other accepted means of compliance,
will satisfy the FSS analysis
requirements of § 450.145.
Rocket Lab requested clarification as
to whether the FSS design reliability is
for hardware components only, and how
to apply reliability requirements to
safety systems that include software.
The FAA notes that design reliability is
for hardware only. The computing
system safety requirements in § 450.141
do not provide an estimated reliability,
but instead establish process controls
that prevent or mitigate computing
system faults.
The International Space Safety
Foundation commented that FSS is the
only system of a launcher for which the
operational experience did not provide
reliability significant data, because the
system was ready but rarely operated.
The FAA concurs with the comment
that there is a lack of operational
experience with FSS as far as
terminating vehicles. However,
operational parameters are captured
throughout flights, whether the result is
termination or not, and this data verifies
many of the expected operating modes.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Also, reliability is gained from design
and thorough test programs, as well as
review of post-flight data.
The International Space Safety
Foundation also commented that to base
the approval of a safety-critical system
on reliability predictions was not
advisable considering the key role
played by software, which cannot be
taken into account in the reliability
prediction. The International Space
Safety Foundation recommended that
the FAA should instead define fault
tolerance requirements for the FSS, and
specific software and computing system
requirements in addition to generic
software development processes.
The FAA disagrees, noting that FSS
reliability is also based on design
architecture, component selection, and
testing that accounts for fault tolerance
and the overall system. Recognizing that
there are some difficulties in
establishing reliability standards below
a design reliability of 0.999 at 95
percent confidence and commensurate
design, analysis, and testing, the FAA
removes the proposed additional
requirements for § 450.108(b)(2) FSS
and instead relies solely on § 450.143
for design, testing, and monitoring
requirements. In addition, recognizing
the importance of computing systems to
system reliability and public safety, the
FAA proposed, and is including in the
final rule robust computing system
requirements in § 450.141. Computing
system requirements are further
discussed in the preamble section on
Computing Systems and Software.
The International Space Safety
Foundation recommended that the FAA
set up a multidisciplinary team of
design and operation experts to draw a
strategy for the definition of FSS design
performance requirements, and for
addressing the above issues. The FAA
believes that standards for FSS should
continue to evolve and that industry
should be significantly involved in their
development. An industry-led
development of a voluntary consensus
standard or standards addressing
design, analysis, or testing of FSS would
be particularly beneficial. These
standards could become new acceptable
means of compliance with FAA
regulations.
jbell on DSKJLSW7X2PROD with RULES2
aa. Hybrid Vehicles
In the NPRM, the FAA proposed one
set of requirements for all vehicle types
without distinction between traditional
and hybrid vehicles. Hybrid vehicles are
launch or reentry vehicles that have
some characteristics of aircraft and other
characteristics of traditional launch or
reentry vehicles.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
The FAA acknowledges that hybrid
operations differ from traditional rocket
launches. Part 450 has been revised to
accommodate better all vehicle
operators, including hybrid vehicle
operators. The accommodations include
more performance-based requirements,
alternatives to flight abort, FSA
requirements based on demonstrated
reliability, use of equivalent level of
safety, and allowing application process
alternatives as agreed to by the
Administrator. The regulations allow
currently licensed hybrid vehicle
operators to continue to use a flight
hazard analysis as a hazard control
strategy. However, one or more hazard
control strategies may be required to
meet the safety criteria in § 450.101.
The FAA received numerous
comments from industry regarding
safety requirements for hybrid vehicles,
hybrid configurations, component
systems, and related operations. The
FAA addresses the hybrid vehicle
comments that would be applicable to
other operators in the applicable topic
area sections of this preamble. This
section of the preamble addresses the
comments that are specific to hybrid
operations, such as aircraft certification,
piloted vehicles, part 91 applicability,
and space support vehicles.
Two commenters stated that the
applicability of hybrid systems should
be clarified and consolidated in a
separate section of the regulation. An
individual commenter recommended
that the preamble material include a
discussion of how the regulations would
be applied to hybrid configurations
since their characteristics and
operations are significantly different
from the more traditional RLV or ELV
vertical launch systems.
The FAA notes that the final rule
provides flexible performance-based
regulations that work for all vehicle
types, including hybrid vehicles and
other innovative architectures. Like all
operators, an operator of a hybrid
launch or reentry vehicle must choose
one or more hazard control strategies for
each phase of flight in accordance with
§ 450.107. The FAA anticipates that
hybrid vehicle operators will elect to
use a flight hazard analysis as their
hazard control strategy for at least some
phases of flight because the flight
hazard analysis is most similar to the
existing system safety process in part
431.
An individual commenter stated that
for hybrid vehicles, flying qualities
should be identified as safety critical
and as a safety element eligible for a
safety element approval.
The FAA will work with operators
during pre-application consultation and
PO 00000
Frm 00099
Fmt 4701
Sfmt 4700
79663
throughout the application review to
understand a specific operation to
determine what systems are safety
critical as defined in § 401.7. All launch
vehicles, reentry vehicles, safety
systems, processes, services, or
personnel are eligible for safety element
approvals. The FAA will consider safety
element approvals on a case-by-case
basis for hybrid vehicles. This concept
is discussed in the Safety Element
Approval section of the preamble.
An individual commenter
recommended that the FAA consider
other demonstrated measures of
reliability for carrier aircraft to estimate
the public risk, such as ‘‘attributed
reliability’’ and ‘‘validated reliability.’’
In the final rule, the FAA uses the
term ‘‘demonstrated reliability’’ in
§§ 450.101(c)(3) and 450.113(b). The use
of this phrase in § 450.101(c)(3) allows
an operator to protect against a high
consequence event in uncontrolled
areas for each phase of flight by
establishing the launch or reentry
vehicle has sufficient demonstrated
reliability as agreed to by the
Administrator based on CEC criteria
during that phase of flight. The use of
this phrase in § 450.113(b) provides an
exception for an operator from
performing and documenting an FSA for
a phase of flight, if agreed to by the
Administrator, based on demonstrated
reliability. These requirements are
discussed in more detail in the High
Consequence Event Protection and FSA
preamble sections, respectively.
As discussed in the Conditional
Expected Casualties section of this
preamble and in the NPRM,
demonstrated reliability refers to
statistically valid probability of failure
estimates based on the outcomes of all
previous flights of the vehicle or stage
in accordance with § 450.131, which is
discussed later in the preamble. The
draft High Fidelity FSA Methods AC,166
published with the NPRM, described
acceptable methods, including Bayesian
and binomial methods, to calculate
demonstrated reliability and
demonstrate compliance with § 450.131.
As discussed in the draft AC, the prior
estimate for the probability of failure
during a captive carry phase of flight
could be based on a different flight
history database 167 compared to
traditional ELVs. For example, the prior
estimate for the probability of failure
during a captive carry phase of flight
could be based on the flight history of
aircraft that also used certain proven or
166 See
FAA–2019–0229–0019.
specifically, a different set of outcomes
of all previous flights of vehicles developed and
launched or reentered in similar circumstances.
167 More
E:\FR\FM\10DER2.SGM
10DER2
79664
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
industry standard design,
manufacturing, or quality methods.
Similarly, if a carrier vehicle were based
on or modified from a type certificated
commercial aircraft or used certified
aircraft components, then the carrier
vehicle could be considered a derived
vehicle.168 In this example, the
certification results and operational
history for the unmodified components
of the aircraft would be accounted for in
the calculation of the demonstrated
reliability. Under a performance-based
regulation, an applicant is free to
propose a unique means of compliance
with other methods to calculate
demonstrated reliability. The FAA will
consider other methods to calculate
demonstrated reliability for hybrid
vehicles such as binomial methods
consistent with Appendix A to part 417
under A417.25(b)(5), and other methods
used in the past for launch and reentry
vehicles.
The FAA notes that other vehicle
characteristics, such as flying qualities,
do not lend themselves to analysis with
statistical reliability measures. For
example, acceptable flying qualities in
one portion of the envelope do not
necessarily predict good flying qualities
throughout the full operational
envelope, and small aerodynamic
modifications or changes to the flight
control system can lead to
disproportionally large and potentially
hazardous changes in flying qualities. In
these cases, the FAA would consider
flight test results using proven flight test
techniques and data analysis methods as
validated reliability.
An individual commenter urged the
FAA to consider more than just the fact
that a vehicle holds an airworthiness
certificate as evidence of demonstrated
reliability.
The FAA agrees that possession of an
airworthiness certificate alone does not
guarantee that a vehicle or operation
will have a level of reliability sufficient
to meet the part 450 public safety
requirements. The FAA considers other
factors to determine reliability. The
168 A derived vehicle is a term used when
analyzing a new variant of a known rocket. A
derived vehicle should be alike in substance or
essentials considering the following factors that can
influence the probability of failure: (1) The
development and integration processes of the
vehicle, including the extent of testing; (2) the
design and manufacture of safety-critical systems,
including but not limited to the structure (including
the payload faring), propulsion, guidance, control,
and navigation; (3) all aspects of the environment
experienced by the vehicles, stages, and
components that can affect performance and
reliability, including but not limited to
aerodynamic, thermal, acoustic, vibration, and
inertial environments; (4) vehicle performance in
terms of payload capability, maximum dynamic
pressure, and maximum velocity.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
FAA will consider the aircraft’s original
certification, its current certification,
and any modifications introduced
through issuance of supplemental type
certificates. For example, a transport
category aircraft that has held a standard
airworthiness certificate and then been
recertified to a restricted or
experimental category. Any
modifications to the aircraft design
certification may affect the aircraft’s
reliability for the purposes of part 450,
and the FAA therefore will take these
modifications into consideration. An
understanding of an aircraft’s past and
current operating environments and its
maintenance history are also relevant to
the current reliability estimate.
In addition, the FAA may consider
other factors outside of certification,
such as a rigorous flight test program.
Some launch operators have or are
developing new, purpose-built launch
vehicles that may serve as a component
of a hybrid launch or may be designed
as rocket-powered aircraft and
transitioned to licensed launch
operations following flight testing.
These operators may hold experimental
airworthiness certificates for testing
design concepts and aircraft operating
techniques. Experimental airworthiness
certificates may also be offered as part
of a hybrid operator’s application to
establish the vehicle’s demonstrated
reliability. The FAA’s Office of
Commercial Space Transportation will
continue to coordinate with the FAA’s
Aviation Safety organization on
issuance of an experimental
airworthiness certificate and the
vehicle’s developmental program to
understand its demonstrated reliability.
The FAA will also consider each
crewmember’s level of pilot certification
and flight experience, as well as the
recency of that experience as evidence
of demonstrated reliability of the launch
or reentry system.169 While part 460
requires flight crew to hold at least a
private pilot certificate with an
instrument rating, operators using flight
crew with higher levels of certification,
operationally related flight experience,
and recent flight experience and
training can demonstrate higher
reliability. For example, a crewmember
holding commercial and airline
transport pilot certificates have more
flight experience and have been tested
169 For FSA purposes, the vehicle failure
probability accounts for any failure of the launch
or reentry system because of the way failure is
defined in § 450.131(b). In the context of FSA, any
failure of the launch or reentry system, including
pilot error, that produced vehicle failure as defined
in § 450.131(b) must be accounted for to establish
the demonstrated reliability. Therefore, the FAA
would consider the pilot experience and training in
making a demonstrated reliability determination.
PO 00000
Frm 00100
Fmt 4701
Sfmt 4700
to a higher level of proficiency than a
crewmember who holds a private pilot
certificate. In addition, crewmembers
with operationally related flight
experience will have an understanding
of the decision-making required for
high-altitude flight and airspeed
regimes, and the recent flight experience
and training of all crewmembers is
recognized as foundational to ensuring
a safe operating environment of an
aircraft or launch vehicle.
An individual commenter stated that
the phase of a hybrid vehicle operation
in which the carrier vehicle is alone
would be required to take into account
any potential aggressive maneuvers the
vehicle may have to make to clear a justreleased rocket. The commenter further
stated that a civil airworthiness
certificate may not be adequate to cover
the risks posed to the public by these
unusual maneuvers.
The FAA agrees that the entirety of a
launch or reentry operation must be
analyzed for hybrid operations. The
FAA notes that once a rocket is released,
the carrier vehicle remains in the launch
phase until all components of the
launch system have impacted or landed
on the earth and been rendered safe.
Therefore, any maneuvers the carrier
vehicle makes after a rocket is released
but before both components have
impacted or landed and been returned
to a safe condition will occur under the
license and be assessed consistent with
the requirements of part 450.
Virgin Galactic expressed concerns
that rather than streamlining the
requirements to create performancebased standards, the FAA is combining
its requirements for ELVs and hybrid
RLVs so that each type of operator might
be subject to inappropriate or
ambiguous requirements. Virgin
Galactic commented that it appreciated
the flexibility that some of the new
regulations would provide but noted
that others seem too vague.
The FAA finds the final rule provides
sufficient flexibility for hybrid vehicles.
The performance-based regulations in
the final rule allow operators like Virgin
Galactic to propose an alternate
approach by demonstrating an
equivalent level of safety or use a
unique means of compliance. To retain
the maximum flexibility to adjust to
dynamic industry changes, the FAA will
continue to offer operators the choice to
request ELOS determinations. In
addition, 51 U.S.C. 50905(b)(3) allows
the Secretary to waive a requirement in
the public interest and will not
jeopardize public health and safety,
safety of property, and national security
and foreign policy interests of the
United States. Rather than explicitly
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
reference hybrid vehicles, the final rule
provides the flexibilities to all operators,
including operators of hybrid vehicles
and other innovative concepts.
Virgin Galactic also stated that the
intent of the requirement should be
publicly articulated in the regulations
and not reside in the preamble. The
FAA notes both the preamble and the
regulations are publicly available. The
intent behind the regulations correctly
resides in the preamble because the
regulations contain only the regulatory
requirements by which regulated
entities are bound. The preamble
provides further explanation as to why
the FAA has elected to adopt the
regulatory requirements in order to
provide transparency and further
elaborate on the agency’s intent.
An individual commenter stated that
hybrid configurations, carrier aircraft
flying alone, and reentry vehicles using
aerodynamic controls should follow
controller instructions and abide by the
general operating and flight rules of
aviation found in 14 CFR part 91. The
individual commented that hybrid
launch vehicles with pilot-in-the-loop
control systems spend much more time
than RLV and ELV systems in restricted
airspace and overflying populated areas
and that this requires hybrid
configurations to have the capability to
operate safely in a controlled airspace
environment like other aircraft.
The FAA agrees and notes that
applicants may elect to mitigate hazards
to the public by proposing applicable
sections of part 91 to demonstrate
compliance with specific requirements
in part 450. However, all components of
a hybrid vehicle operate solely under a
license when the intent of flight is to
conduct a launch or reentry.
Virgin Galactic stated that the FAA
should have a narrowly tailored CEC
exemption from the flight abort
requirements of proposed §§ 450.101(c)
and 450.145 for piloted aircraft because
the pilot would already provide an FSS
with abort capability. Virgin Galactic
further stated that a carrier aircraft in a
hybrid system that operated safely
under its experimental airworthiness
certificate should not be subjected to the
CEC requirement in proposed
§ 450.101(c).
The FAA does not agree with Virgin
Galactic’s comment to include an
exemption from demonstrating
protection against a high consequence
event for a piloted carrier vehicle
because the operation of such a vehicle
may result in a high consequence event.
As discussed earlier in this preamble,
operators must protect against a high
consequence event because such an
event could result in a large number of
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
casualties. The FAA notes that the final
rule allows an operator to seek an ELOS
determination for § 450.101(c)(2).
However, an exemption for all piloted
carrier vehicles would not be
appropriate for launch or reentry
vehicle systems that have not yet been
evaluated. Hence, an applicant can use
another method of measuring the
potential for a high consequence event
that demonstrates an equivalent level of
safety in accordance with § 450.37.
Reusable vehicles and other innovative
architectures may be required by
§ 450.101(c) to have a method to achieve
flight abort reliably to mitigate flight
risks and consequences fully, either in
the form of a pilot that can safely abort
flight using system controls or a more
traditional FSS. A pilot may provide
protection against a high consequence
event. The FAA may consider a pilot to
be an FSS performing a flight abort if
the pilot can initiate and accomplish a
controlled ending to vehicle flight
reliably to limit or restrict the hazards
to public health and safety, and the
safety of property. Under the provision
in § 450.101(c)(3), the flight of a carrier
vehicle carrying a rocket to a drop point
could be an example of sufficient
protection against a high consequence
event, even if the CEC were above the 1
× 10¥3 threshold, if the carrier vehicle
has sufficient demonstrated reliability.
Demonstrated reliability and other
flexibilities are discussed more fully in
the High Consequence Protection
section of this preamble.
Virgin Galactic noted that a carrier
aircraft operating under an
airworthiness certificate should be
exempt from proposed § 450.101(f),
which, for any launch, reentry, or
disposal, requires an operator to notify
the public of any region of land, sea, or
air that contains, with 97 percent
probability of containment, all debris
resulting from normal flight events
capable of causing a casualty. Virgin
Galactic stated that the requirement was
unclear because it discussed debris
resulting from normal flight events.
Virgin Galactic requested further
clarification on the purpose of public
notification if the proposed requirement
was intended to address returning
vehicles that remain intact and on a
nominal trajectory to the intended
reentry site. Virgin Galactic
recommended that, if this regulation
was intended to apply to jettisoning of
orbital rocket stages and the return/
disposal of upper stages, it should state
as much.
The FAA agrees that returning
vehicles on a normal trajectory do not
constitute ‘‘debris’’ as the term is used
in § 450.101(f). However, the FAA will
PO 00000
Frm 00101
Fmt 4701
Sfmt 4700
79665
not exempt all hybrid vehicle operators
from the requirement in § 450.101(f)
because future hybrid operators could
possibly generate debris capable of
causing a casualty from normal vehicle
flight. If an operation has no planned
impacts from debris capable of causing
a casualty, then no notification will be
necessary to comply with § 450.101(f).
Several commenters, including ALPA,
Starfighters, and Virgin Galactic,
submitted comments regarding the
applicability of FSA requirements for
hybrid vehicles under proposed
§ 450.113(a)(5). Virgin Galactic noted
that, for the captive carry phase of a
hybrid vehicle mission, the FAA should
exempt operators from performing an
FSA for a piloted aircraft that operated
in accordance with aviation regulations.
Virgin Galactic stated the FAA should
include such an exemption because the
pilot would already provide abort
capability as an FSS. Starfighters
commented that an FSA should be
required only for the air-release launch
phase of a hybrid vehicle mission, not
the earlier captive-carry phase, which
might be many miles away from the
actual release point. However, ALPA
stated that the FAA should require an
FSA for all phases of flight until
sufficient quantitative data for hybrid
commercial space vehicles becomes
available for analysis and to conduct a
regulatory process to standardize
airworthiness requirements for hybrid
commercial space vehicles. An
individual commenter noted
airworthiness certificates issued by the
FAA are part of a safety analysis but are
not conclusive evidence of
demonstrated reliability for the purpose
of proposed § 450.113(a)(5). ALPA noted
that flight test results using proven
flight test techniques and data analysis
methods should serve to validate
reliability of hybrid vehicles’ carrier
aircraft under proposed § 450.113(a)(5),
without requiring documentation and
statistical analysis of all previous
flights.
In the final rule, the FAA is not
providing a blanket exemption to the
FSA requirements for hybrid operations.
The final rule removes § 450.113(a)(5)
but maintains the flexibility proposed in
the NPRM to enable an operator of a
hybrid vehicle with a high level of
demonstrated reliability to be exempt
from performing some FSAs for some
phases of flight without seeking a
waiver. The FAA will work with hybrid
vehicle applicants during preapplication consultation on how to
comply with FSA, CEC, and FSS
requirements utilizing the flexibilities
that may be applicable depending on
the applicant’s vehicle and concept of
E:\FR\FM\10DER2.SGM
10DER2
79666
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
operations. For example, the FAA might
determine the quantitative FSA
requirements for those portions of an
operation for which the vehicle operates
similarly to a civil aviation aircraft
governed by civil aviation regulations
are unnecessary because the vehicle has
demonstrated reliability for operations
using a certificated aircraft or a valid
airworthiness certificate with an
acceptable flight test history.
The FAA expands the flexibility for
hybrid vehicles in proposed
§ 450.113(a)(5) to all vehicle operators
in the final rule in § 450.113, as
discussed in more detail in the
preamble section for FSA Requirements
Scope and Applicability. The FAA finds
this flexibility should be available to all
operators if agreed to by the
Administrator based on demonstrated
reliability. This wider availability will
provide a common regulatory construct
across different operators to identify the
phases of flight for which FSA must be
performed. Based on current licensed
operations, the FAA anticipates that
initially only carrier vehicles that have
an airworthiness certificate and
extensive flight history would be able to
meet the demonstrated reliability
standard. Aside from some carrier
aircraft used as a component of a launch
vehicle, no existing launch vehicle has
enough history to ensure sufficient
protection against a high consequence
event based on demonstrated reliability
in accordance with § 450.101(c) or
enough empirical evidence to
demonstrate compliance with the public
risk criteria in § 450.101(a) or (b).170
Virgin Galactic asked about the
applicability of the rule for hybrid
vehicles, including certain operational
exemptions. Virgin Galactic commented
that the safety-critical system
requirements in § 450.143 should not
apply to hybrid carrier aircraft that
operate under an FAA-issued license
and hold an airworthiness certificate
issued by the FAA. Virgin Galactic
noted the requirements of this section
were akin to aircraft certification, which
are spelled out in the applicable parts of
14 CFR Chapter 1 that have been
developed over decades as the aviation
170 The L–1011 carrier vehicle used for Pegasus
launches is an example of a carrier aircraft with
enough empirical evidence to demonstrate
compliance with the public risk criteria in
§ 450.101(a) or (b). Using flight history to
demonstrate compliance with the risk criteria in
§ 450.101(a) and (b) is relatively simple, given a
statistically significant number of flights relative to
the expected casualty limit of 1 × 10¥4. As
discussed elsewhere in the preamble, the FAA
notes that the operator must also perform a system
safety analysis to demonstrate that any
modifications made to the carrier vehicle introduce
only hazards to the public that are extremely
remote.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
industry matured. Virgin Galactic stated
that the commercial space industry is
not at the state of maturity as
commercial aviation, and applying these
similar ‘‘certification’’ requirements is
contrary to the requirement in the
Commercial Space Launch Act to
promote the commercial space launch
industry and only regulate to the extent
necessary.
The FAA does not agree that carrier
vehicles operating under an FAA-issued
license with an airworthiness certificate
issued by the FAA should be exempt
from the safety-critical system
requirements in § 450.143. While
airworthiness certification likely
indicates increased reliability because a
certificated aircraft has satisfied many
separate FAA regulations, the
satisfaction of those regulations does not
alone demonstrate that the carrier
vehicle will meet the applicable
requirements under chapter III.
However, an applicant may make a
safety case supporting an equivalent
level of safety for a component of a
launch system if it holds a valid
airworthiness certificate with an
acceptable flight test history. In the final
rule, § 450.143 includes the
requirements for all safety-critical
system components and eliminates the
ambiguity that existed in the part 431
regulations regarding required testing of
safety-critical systems. Section
450.143(e)(3) also requires a summary of
the analysis detailing how applicants
arrived at the predicted operating
environment and duration for all
qualification and acceptance testing.
Such a summary is current practice, and
§ 450.143(e) makes this requirement
explicit for all vehicles. In response to
Virgin Galactic’s comments regarding
the relative maturity of commercial
aviation versus the commercial space
industry and the appropriate approach
to regulating the commercial space
industry, the FAA believes that the
performance-based requirements of the
final rule fulfill statutory mandates and
are appropriate for the commercial
space industry’s capabilities now and as
they will evolve in the future.
An individual commenter stated that
the carrier aircraft portion of their
launch system would also be capable of
conducting operations as a space
support vehicle (SSV). The commenter
sought clarification as to whether part
450 would require adjustment to be
consistent with new SSV operations.
SSVs and SSV flight are defined in
section 50902 of title 51. Requirements
to conduct the flight of a space support
vehicle would be promulgated pursuant
to Section 44737, and are beyond the
scope of this rulemaking.
PO 00000
Frm 00102
Fmt 4701
Sfmt 4700
bb. Agreements and Airspace
(§ 450.147)
In the NPRM, the FAA proposed to
streamline the existing requirements for
agreements by removing specific
requirements for a variety of agreements
and procedures and allowing an
operator to determine what agreements
would be needed for its particular
operation. As proposed in § 450.147, a
vehicle operator would be required to
have written agreements with any entity
that provides a service or use of
property to meet a requirement in part
450. The regulation identified various
entities for which agreements may be
required including a Federal launch
range operator, a licensed launch or
reentry site operator, any party that
provides access to or use of property
and services required to support a safe
launch or reentry under part 450, the
U.S. Coast Guard, and the FAA.
In the final rule, the FAA adopts the
proposal with one minor change. The
FAA has replaced the words ‘‘Federal
launch range’’ in § 450.147(a)(1) with
‘‘Federal launch or reentry site’’ to
encompass all Federal sites used for
licensed activities.
AAAE asked whether proposed
§ 450.147(a)(1) would require
agreements with alternative or
contingent landing sites and requested
that the FAA expressly require such
agreements to ensure that they are
included in the licensing and launch
preparation process. In § 450.147(a)(1),
the FAA requires agreements with any
entity that provides access to property
required to support a safe launch or
reentry. Contingency abort locations are
taken into consideration by the
applicant as part of its public safety
analyses and by the FAA in its
environmental review. Because
contingency abort locations necessarily
involve planned access to property, the
FAA will not revise the regulation to
expressly require agreements with
alternative or contingent landing sites.
The language in § 450.147(a)(1) is
sufficient to ensure agreements are in
place for all planned locations. The
FAA will not require such agreements
for emergency landing sites or other
locations that are being considered, but
have not been finalized by the
operator.171
171 The FAA notes that it has distinguished
emergency abort landing sites from planned
contingency abort sites in other rulemakings. For
example, in the Commercial Space Transportation
Reusable Launch Vehicle and Reentry Licensing
Regulations final rule, § 431.23 required an operator
to identify contingency abort sites in its application.
The FAA stated that contingency abort sites are preplanned, and their potential use may be identified
as part of an application in order to meet mission
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Section 450.147(a)(3) requires
operators to have written agreements
with FAA’s Air Traffic Organization
(ATO) or foreign air navigation service
providers (ANSP) to establish
procedures for the issuance of a Notices
to Airmen (NOTAM) prior to a launch
or reentry.
AOPA recommended that the FAA
establish procedures for the issuance of
a Notices to Airmen (NOTAM) at least
72 hours prior to a launch or reentry to
forewarn the public about activation of
different airspace.
It would not be appropriate within
this commercial space rulemaking to
impose a requirement on the FAA ATO
or a foreign ANSP to issue NOTAMs
within a particular time frame. Each
ANSP is responsible for the safe and
efficient use of its airspace and can be
expected to provide notification
consistent with its obligations. As such,
notification requirements necessary to
protect the public, including any
minimum times for notification, should
be determined as part of the agreement
development process with the FAA
ATO or foreign ANSP.
Section 450.147(a)(4) requires an
operator to enter into such agreements
with emergency response providers,
including local government authorities,
as necessary to satisfy the requirements
of § 450.173 (Mishap plan—reporting,
response, and investigation
requirements).
SpaceX recommended that proposed
§ 450.147(a)(4) exclude government
installations where responsibilities and
mutual aid protocol rendered separate
agreements with local authorities
unnecessary. SpaceX believes this
addition would manage expectations
where multiple Federal entities may
have overlapping jurisdiction for
addressing mishap response.
Because § 450.173(d)(5) requires an
operator to implement agreements with
government authorities and emergency
responders ‘‘as necessary’’ to satisfy the
requirements of § 450.173, no change to
the proposed language in § 450.147(a)(4)
is required. An operator that is
launching from a Federal launch site is
not required to execute agreements with
local authorities if the Federal site
already has the necessary coordination
in place to satisfy the requirements in
§ 450.173.
Section 450.147(b) requires that
agreements clearly delineate the roles
and responsibilities of each party to
support the safe launch or reentry under
risk criteria and, therefore, are separate and distinct
from emergency abort landing situations that may
potentially be anywhere. 65 FR 56617, 56635
(November 20, 2000).
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
part 450. SpaceX suggested adding
language to require parties to delineate
roles and responsibilities ‘‘within their
jurisdiction.’’ Indeed, an entity may
only enter into an agreement to the
extent they are authorized, but the FAA
disagrees that this language is needed in
the regulation.
Section 450.147(d) requires operators
to describe each agreement submitted in
accordance with the section.
SpaceX asked the FAA to clarify in a
guidance document the intent of
proposed § 450.147(d) and allow
operators to provide other acceptable
documentation (e.g., business processes
like the Universal Documentation
System) to avoid literal interpretations
of requirements. To comply with this
requirement, the operator will
enumerate those services that the site
operator is providing through various
agreements. The FAA may request a
specific agreement that the site operator
has established to provide such a
service. As long as each agreement
required by this section meets the
criteria set forth in § 450.147, the
operator may choose the format of the
agreement. Therefore, the FAA adopts
the proposed rule without change.
Virgin Galactic asked whether an
agreement would be required with local
authorities to ensure that the area is
cleared of the public and critical assets
if an operator cannot meet conditional
risk factor criteria for an uncontrollable
area of land. The FAA notes that
conditional risk does not trigger the
need for an agreement with a local
authority. Instead, it is related to the
need for an FSS. However, such an
agreement might be a means of
mitigating conditional risk, potentially
to a degree at which the operator does
not need to employ an FSS.
A number of commenters expressed
concern that the NPRM did not require
that airspace efficiency be taken into
consideration as part of a launch or
reentry operation. AAAE, A4A, ACI,
ALPA, AOPA, CAA, NATCA, RAA, and
Southwest Airlines recommended the
FAA incorporate airspace efficiency
consideration into the licensing process
to minimize negative operational and
financial impacts for airlines,
passengers, cargo shippers, and the
public that will result from this
rulemaking. A4A, AAAE, and
Southwest Airlines advocated increased
transparency and collaboration with
airspace stakeholders in developing
agreements pursuant to proposed
§ 450.147. A4A, AAAE, ACI, ALPA,
AOPA, CAA, NATCA, and RAA
recommended the FAA ensure the
safety requirements for commercial
space operations, particularly those
PO 00000
Frm 00103
Fmt 4701
Sfmt 4700
79667
addressing risks to other aviation users,
are commensurate with the expectations
of the flying public. AOPA
recommended the FAA prioritize
funding and implementation of the
Aeronautical Information Management
Modernization program, which would
provide real-time airspace information.
A4A, AAAE, ACI, and AOPA
recommended the FAA incorporate and
implement various recommendations
from the Airspace Access Priorities ARC
and Spaceport Categorization ARC.
The FAA acknowledges the
commenters’ concerns regarding
airspace efficiency, but these issues are
not within the scope of this rulemaking.
Operational oversight and management
of airspace impacts are managed at the
FAA Air Traffic Control System
Command Center. As noted in the Flight
Hazard Area Analysis section of this
preamble, FAA is working to address
this issue through the Airspace Access
ARC and other initiatives.
cc. Safety-Critical Personnel
Qualifications (§ 450.149)
In the NPRM, the FAA proposed to
remove the certification requirements
found in §§ 417.105, 417.311, and
415.113 and replace them with
performance-based requirements in
proposed § 450.149 (Safety-Critical
Personnel Qualifications). Section
450.149(a) would require an operator to
ensure safety-critical personnel are
trained, qualified, and capable of
performing their safety-critical tasks,
and that their training is current. Under
proposed § 450.149, an applicant would
be required to identify in the
application all safety-critical tasks and
internal requirements or standards for
personnel to meet prior to performing
the identified tasks. The application
would be required to identify internal
training and currency requirements,
completion standards, or any other
means of demonstrating compliance
with the requirements of proposed
§ 450.149. The applicant would also be
required to describe the process for
tracking training currency.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA recommended that
the FAA require that safety-critical
personnel comply with the Federal
Drug-Free Workplace requirements set
forth in 14 CFR 120. These commenters
noted that the Federal Drug-Free
Workplace requirements apply to
government contractors, but commercial
operators are only subject to company
policy, which may not address the use
of drugs and alcohol. The FAA did not
propose to require drug and alcohol
testing and finds that such a
requirement would exceed the scope of
E:\FR\FM\10DER2.SGM
10DER2
79668
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
this rulemaking. The FAA may consider
proposing such action in a future
rulemaking.
The FAA received a comment from
Blue Origin supporting the changes to
the safety-critical personnel
qualifications requirements. In the final
rule, the FAA adopts § 450.149 as
proposed.
dd. Work Shift and Rest Requirements
(§ 450.151)
In the NPRM, the FAA proposed to
combine the rest requirements of
§§ 417.113(f) and 431.43(c)(4) into
§ 450.151 (Work Shift and Rest
Requirements), which would require an
applicant to document and implement
rest requirements that ensure safetycritical personnel are physically and
mentally capable of performing assigned
tasks. These requirements would apply
to operations of all launch and reentry
vehicles and would allow operators
flexibility to employ rest rules that fit
their particular operations. Section
450.151(b)(1) would require an
operator’s rest rules to include the
duration of each work shift and the
process for extending this shift,
including the maximum allowable
length of any extension. An operator’s
rest rules would be required to include
the number of consecutive work shift
days allowed before rest is required.
Section 450.151(b)(3) would also require
an operator’s rest rules to include the
minimum rest period required between
each work shift, including the period of
rest required immediately before the
flight countdown work shift. Applicants
would be required to submit their rest
rules during the license application. In
the final rule, the FAA adopts § 450.151
as proposed.
The FAA received seven comments
on its proposed work shift and rest
requirements. Blue Origin, Rocket Lab,
Virgin Galactic, and an individual
commenter agreed with FAA’s proposed
requirements permitting greater
flexibility in ensuring sufficient rest for
safety-critical personnel. Rocket Lab
commented that the proposed approach
would enable operators to develop work
shift and rest requirements that are
appropriate for the individual operating
conditions, environment, and
mitigations that exist.
Virgin Galactic requested the FAA
provide further guidance of what would
satisfy proposed § 450.151 beyond the
example of § 431.43(c)(4). Section
431.43(c)(4) or the crew rest
requirements of AFSPCMAN 91–710 are
two possible, but not the only, means of
compliance with § 450.151.
ALPA opposed the performance-based
approach to work shift and rest
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
requirements, stating that prescriptive
duty limits were necessary to reduce the
likelihood of human error related to
fatigue. ALPA indicated the proposed
rule made it possible for a commercial
space operator ‘‘to set unrealistic crew
rest requirements for cost management
(doing more with less) instead of
safety.’’ ALPA recommended the FAA
adopt the rest rules contained in
§ 437.51.
The FAA elected a performance-based
requirement over a prescriptive one akin
to § 437.51 in order to allow operators
to develop requirements that are suited
to their particular operations. In
addition, prescriptive requirements fail
to account for the various factors that
can affect crew rest, such as the time of
day of an operation, length of pre-flight
operations, and travel to and from the
launch or reentry site. The performancebased requirement set forth in § 450.151
allows operators to take into account
such factors affecting crew rest and
adopt mitigations and procedures
unique to each launch operation. The
FAA also disagrees that § 450.151 will
enable operators to set unrealistic crew
rest requirements in the interest of
cutting costs. Although operators can
develop rest rules that fit their
operations, operators must demonstrate
in their application that their rest rules
ensure safety-critical personnel are
physically and mentally capable of
performing assigned tasks. The FAA
will evaluate the rest rules during
review of the license application, and, if
accepted, they will become part of the
license. The FAA finds that no change
to the proposed regulation is warranted.
ALPA and Blue Origin stated the
commercial space operator should be
responsible for monitoring compliance
with work shift and rest requirements.
Blue Origin noted the companies should
be responsible for monitoring
compliance after the FAA accepts an
operator’s rules through the application
and approval process. Rocket Lab
commented that a specific requirement
for operators to monitor compliance
with work shift and rest requirements
was unnecessary as the regulation
explicitly required that the rest rules
implemented ensure safety-critical
personnel are physically and mentally
capable of performing all assigned tasks.
Operators are expected to monitor
compliance with their approved crew
rest rules so that personnel are fit to
perform safety-critical tasks and to
provide records of compliance with
those rules, as required by § 450.219(a),
where requested by the FAA. The FAA
finds that a specific requirement for
operators to monitor compliance with
work shift and rest requirements is
PO 00000
Frm 00104
Fmt 4701
Sfmt 4700
unnecessary. The rest requirements in
§ 450.151(b) ensure safety-critical
personnel are physically and mentally
capable of performing all tasks. It is up
to the company to monitor compliance
with its work shift and rest rules to
ensure personnel are mentally and
physically capable of performing safetycritical tasks. An operator must comply
with the rest rules accepted by the FAA
as part of the license because it must
comply with the representations in its
application. Therefore, even absent an
express requirement, an operator must
monitor compliance with its rest rules
in order to ensure that the objectives of
§ 450.151 are met and that the operator
does not act contrary to its application.
Blue Origin asked the FAA to clarify
the time period to which the rest rules
apply in finalizing the rest requirements
and the scope of license rule (§ 450.3).
Blue Origin suggested the rest
requirements should only apply during
the period an action could present a
distinct impact to safety, akin to how
NASA closely monitors astronauts’ rest/
work periods but does not mandate
crew rest requirements for aerospace
employees in manufacturing plants or
NASA mission control staff.
Although the FAA declines to limit
the scope of § 450.151 as Blue Origin
recommends, the FAA clarifies that
§ 450.151 is intended to ensure safetycritical personnel are prepared to
perform tasks that have an inherent
impact on public safety. Operators must
document and implement rest rules to
ensure that safety-critical personnel
have received adequate rest before they
perform any safety-critical task.
Operators would not be able to ensure
that personnel are physically and
mentally prepared to perform safetycritical tasks if the rest rules set forth in
§ 450.151 applied only during activities
that could distinctly affect safety (i.e.,
during safety-critical tasks). For
example, the rest rules apply to safetycritical tasks such as end to end testing
and safety-critical hardware installation
that may occur before hazardous preflight operations trigger the start of
launch. Operators must therefore
comply with § 450.151 for the duration
of their license. The regulation is
flexible enough that an operator can
develop rules that treat different parts of
launch activity differently. The FAA
finds that no change to the regulation is
warranted.
Blue Origin suggested removing the
definition of ‘‘vehicle safety operations
personnel,’’ as it has caused confusion
in the industry. The FAA agrees and
does not adopt the definition.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA asserted the
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
requirements proposed in § 450.151(b)
reflect a relaxation of work rule
standards compared to the current FAA
and range policies. They further noted
other DOT-regulated industries have
explicit rest criteria and recommended
that the FAA publish the acceptable
criteria rather than having operators
negotiate the hours deemed safe.
The requirements proposed in
§ 450.151(b) are not a relaxation of work
rule standards compared to current FAA
and range policies because, as
previously stated, two of the ways an
operator can show compliance with
§ 450.151 are to meet current FAA rules
(§ 431.43(c)(4)) or AFSPCMAN 91–710,
and the FAA retains oversight to
determine that an operator’s rules
achieve the standard.
As previously stated, the FAA will
issue an AC on a means of compliance
for § 450.151. The crew rest
requirements previously set forth in part
431 and the current crew rest
requirements in AFSPCMAN 91–710
will satisfy § 450.151.
ee. Radio Frequency (§ 450.153)
In the NPRM, the FAA proposed that,
for any radio frequency used, an
operator would be required to: (1)
Identify each frequency, all allowable
frequency tolerances, and each
frequency’s intended use, operating
power, and source; (2) provide for the
monitoring of frequency usage and
enforcement of frequency allocations;
and (3) coordinate use of radio
frequencies with any site operator and
local and Federal authorities. Proposed
§ 450.153(b) contained application
requirements and required an applicant
to submit procedures or other means to
demonstrate compliance with the radio
frequency requirements.
Blue Origin, SpaceX, and Sierra
Nevada commented the proposed
requirements were duplicative of
Federal Communications Commission
(FCC) licensing requirements and,
according to Blue Origin, were an
unnecessary burden on operators. Blue
Origin explained that operators
coordinate frequency management
through the FCC licensing process,
which is robust in its technical review
of transmitter capabilities. Blue Origin
also noted FCC licenses are public
information that the FAA can verify.
Sierra Nevada suggested the regulation
should either require only that the
applicant demonstrate it has
coordinated with the FCC or be omitted
altogether.
The FAA agrees that the proposed
requirements in § 450.153(a)(1) and
(a)(2) are duplicative of FCC
requirements for radiating systems and
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
overly burdensome. The FCC requires in
Section 308(b) of the Communications
Act of 1934, as amended, all the items
in proposed § 450.153(a)(1) and (a)(2) as
part of an FCC license for radiating
systems that an operator must obtain to
operate radiating equipment as part of a
launch. The purpose of radio frequency
management, as stated in the NPRM,172
is to mitigate hazards associated with
radio frequency usage including
interference that could adversely affect
the FSS or any safety-critical system of
a vehicle, including RLVs and reentry
vehicles. The intent of proposed
§ 450.153 (a)(1) and (a)(2) was to ensure
radio transmissions would not interfere
with commanded flight termination
systems and would be compatible with
the receiving system on the vehicle. The
FAA finds that operators can identify
and mitigate hazards affecting FSS or
safety-critical systems effectively
without duplicating information
required by the FCC. In the final rule,
the FAA amends § 450.153(a) by
replacing (a)(1) and (a)(2) with the
performance-based objective central to
§ 450.153 that requires operators to
ensure radio frequency interference
does not adversely affect performance of
any FSS or safety-critical system.
Proposed § 450.153(a)(3) is redesignated as (a)(2) and continues to
require operators to coordinate use of
radio frequencies with any site operator
and any local and Federal authorities,
including any State, tribal, or territorial
authorities.
Blue Origin commented that proposed
§ 450.153 added to the burden
previously placed on operators under
part 431, which ought to be included in
the FAA’s cost analysis. Blue Origin
explained an applicant would be
required to submit to FAA the
substantive content of a frequency
management plan and submit
procedures to demonstrate compliance
with that plan. Blue Origin pointed out
that under part 431, the FAA did not
require operators to prove they acquired
FCC licenses for a mission or that they
coordinated the use of radio
frequencies.
As previously explained, the FAA has
removed the duplicative provisions
from § 450.153, which would have
amounted to a greater burden on
operators than has previously been
required under part 431. As such, in the
final rule, § 450.153 requires no more of
operators than what part 431 required
for analysis of hazards associated with
licensed activities, creating no
additional cost to operators.
172 84
PO 00000
FR 15334, footnote 98.
Frm 00105
Fmt 4701
Sfmt 4700
79669
Blue Origin recommended proposed
§ 450.153 be removed since applicants
were already required to address and
mitigate hazards associated with
frequency coordination or radiation
exposure or power limits as part of their
hazard analysis. Blue Origin added that,
for launches at Federal launch or
reentry sites, proposed § 450.153 would
duplicate much of the information
submitted to the Federal site, whose
frequency management office typically
works with range scheduling to regulate
radiation and power limits to prevent
exceeding radiation exposure and power
limits while on the pad and harming the
vehicle or payload. For operations that
do not occur on Federal sites, Blue
Origin indicated an operator would
proceed as under the current part 431 by
identifying hazards and mitigation
measures required to meet the public
safety limits. According to Blue Origin,
operators should incorporate hazards
associated with this issue in their
hazard analysis, including identifying
mitigation issues.
The FAA disagrees that § 450.153 is
unnecessary or duplicative of hazard
analysis requirements. As stated in the
NPRM, the FAA has determined that the
public safety risks posed by radio
frequency interference warrant specific
attention apart from the general
requirement that operators identify and
mitigate hazards associated with
licensed activity. To the extent Federal
launch or reentry site procedures
provide for coordination of radio
frequencies used, an operator may rely
on those procedures to demonstrate
compliance with § 450.153. The FAA
does not prescribe the manner in which
an operator ensures that radio frequency
interference does not adversely affect a
vehicle’s FSS or any safety-critical
system. The FAA merely requires that
operators set forth in their applications
a means of complying with § 450.153 so
that the FAA can ensure that radio
interference issues are appropriately
addressed.
In an effort to streamline radio
frequency requirements, SpaceX
recommended the FAA revise proposed
§ 450.153(a)(2) to require that operators
ensure frequency utilization according
to frequency authorization parameters.
SpaceX also recommended the FAA
revise proposed § 450.153(b) to require
coordination with site operators and
local and Federal authorities only for
launches that do not occur on a Federal
launch or reentry site with existing
radio frequency policies and
procedures.
The FAA disagrees that any frequency
authorization parameters issued by the
FCC, which are geared toward managing
E:\FR\FM\10DER2.SGM
10DER2
79670
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
frequency use and operation, would be
sufficient to assess hazards to public
safety posed by radio frequency
interference, which are properly within
the FAA’s purview. As previously
discussed, the FAA has removed the
prescriptive requirements that it
deemed duplicative of FCC
requirements in proposed § 450.153(a)
and replaces them with a central
performance-based objective. The FAA
declines to accept SpaceX’s suggestion
to amend § 450.153(b). The coordination
required by § 450.153(b) allows an
operator to operate a command
transmitter at a frequency and power
that ensures a flight termination system
signal can be successfully transmitted,
and thereby prevent harmful radio
interference, in the interest of public
safety. The FAA declines to remove the
requirement that all operators
coordinate use of radio frequencies with
any site operator and local and Federal
authorities in order to protect the public
and public property, because such
coordination is necessary to prevent
radio interference that could affect
public safety. Users of Federal launch or
reentry sites may use Federal site
procedures for radio frequency to
demonstrate compliance with § 450.153.
Virgin Galactic asked if an operator
could contract a third party to meet the
frequency management requirements.
The FAA does not prescribe the
means by which an operator complies
with § 450.153. An operator could
therefore enter into an agreement in
accordance with § 450.147 to have a
third party, such as a spaceport or
Federal launch or reentry site, satisfy
the radio frequency management
requirements contained in § 450.153.
As noted, the FAA adopts § 450.153
(Radio Frequency Management) with
revisions. The FAA replaces paragraphs
(a)(1) and (a)(2) with performance-based
objectives central to radio frequency
management. Operators will be required
to ensure that radio frequency does not
adversely affect the performance of FSS
or safety-critical systems and to
coordinate use of radio frequencies with
any site operator and local and Federal
authorities.
jbell on DSKJLSW7X2PROD with RULES2
ff. Readiness and Rehearsals (§ 450.155)
In the NPRM, the FAA proposed an
operator would be required to document
and implement procedures to assess
readiness to proceed with the flight of
a launch or reentry vehicle. As part of
the application requirements, proposed
§ 450.155(b)(2) would require an
applicant to describe the criteria for
establishing readiness to proceed with
the flight of a launch or reentry vehicle.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Rocket Lab expressed support for the
proposed requirements as reducing the
risk of unintended consequences that
resulted from stringent time
requirements. SpaceX recommended
that the FAA clarify its intent for flight
commit criteria in proposed
§ 450.155(b)(2) to ensure that mission
success is not a factor by having
applicants describe the criteria ‘‘to
ensure public safety’’ for establishing
readiness to proceed with the flight of
a launch or reentry vehicle.
The FAA agrees that a change to the
proposed regulatory language would
clarify the scope of the requirement.
Therefore, the FAA revises
§ 450.155(b)(2) by adding the phrase ‘‘so
that public safety is maintained’’ to the
end of the paragraph. The FAA did not
adopt the language recommended by
SpaceX because the requirement calls
for criteria that establish readiness to
proceed with flight or reentry while
ensuring public safety. The FAA’s
revision maintains the emphasis on
developing criteria to determine
readiness to proceed with launch or
reentry, and clarifies that the operator
need only identify those criteria that
affect public safety.
gg. Communications (§ 450.157)
In the NPRM, the FAA proposed to
preserve the substantive
communications requirements from
parts 417 and 431 but eliminate the
requirement to implement a
communications plan. Proposed
§ 450.157(a) would require an operator
to define the authority of personnel to
issue ‘‘hold/resume,’’ ‘‘go/no go,’’ and
abort commands, assign communication
networks so those personnel have direct
access to real-time safety-critical
information, ensure those personnel
monitor each common intercom channel
during countdown and flight, and
implement a protocol for using defined
radio telephone communications
terminology. Proposed § 450.157(c)
would also require an operator during
each countdown to record all safetycritical communications network
channels that are used for voice, video,
or data transmissions to support safetycritical systems. This requirement is
substantially the same requirement in
§§ 417.111(l)(5)(vii) and 431.41. In the
final rule, with the exception of
proposed § 450.157(a)(3) as discussed
later in this preamble section, the FAA
adopts § 450.157 as proposed.
As explained in the NPRM, operators
would not need to submit their
communication procedures during the
application process as those procedures
generally are not mature at that time.
The FAA will verify compliance with
PO 00000
Frm 00106
Fmt 4701
Sfmt 4700
§ 450.157 during inspections.173 The
inspections will be consistent with
current practice, in which FAA
inspectors often review the operator’s
final communications procedures.
Given that operators do not need to
demonstrate compliance with § 450.157
at the application stage, operators may
be required to revise their
communication procedures to resolve
issues identified during compliance
monitoring.
The FAA received three comments
addressing the communications
requirements proposed in § 450.157.
AAAE recommended the FAA require
procedures and protocols on how the
operator would communicate with
contingency or alternative landing sites,
and emergency responders. AAAE also
suggested the FAA consider providing
these same stakeholders with the ability
to monitor countdown and
communications channels, just as
operators would be required to provide
the FAA with such access under
proposed § 450.209.
The FAA finds no additional
requirements are necessary, as the
accident investigation and agreement
requirements address AAAE’s concerns.
Operators must include emergency
response procedures in their mishap
plans pursuant to § 450.173, which
could, in many instances include
communication procedures with
emergency response service providers.
In addition, operators must enter into
and implement any necessary
agreements with local authorities and
emergency response services, such as
first responders. Any other stakeholder,
such as a contingency abort site, may
request to monitor channels as part of
its agreement with the operator, but the
FAA does not find it necessary for safety
to mandate this type of monitoring in all
situations.
Sierra Nevada commented that the
requirement to monitor each common
intercom channel is excessive and
would decrease the safety of an
operation. It noted that, for operators
with multiple channels (e.g., more than
10), monitoring each channel would
serve to decrease the overall situational
awareness of the controller. Sierra
Nevada recommended the FAA revise
proposed § 450.157(a)(3) to require that
personnel monitor only the applicable
intercom channels during countdown
and flight.
The FAA agrees with Sierra Nevada’s
recommendation and removes
§ 450.157(a)(3). The persons responsible
for the launch need to maintain
situational awareness and have all
173 84
E:\FR\FM\10DER2.SGM
FR 15337.
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
safety-critical information in order to
make decisions that affect public safety.
In cases in which there are multiple
channels, all channels do not have to be
monitored at the same time. It is
common practice to turn down or turn
off channels in order to listen to a
channel that has critical information.
Each person identified in paragraph
(a)(1) of this section is not required to
listen actively at all times. Operator
personnel other than those listed in
(a)(1) may listen to channels as
necessary to relay critical information to
the personnel listed in (a)(1).
Boeing, Lockheed Martin, Northrop
Grumman, and ULA recommended the
FAA qualify the requirement to record
safety-critical communications channels
in § 450.157(c) as ‘‘subject to records
retention requirements of § 450.219.’’
The FAA agrees that an operator must
record all safety-critical channels and
retain them for the time periods
specified in § 450.219, but does not
agree that a change to the regulatory text
is necessary.
hh. Pre-Flight Procedures (§ 450.159)
In the NPRM, the FAA proposed to
streamline countdown procedures and
requirements. Specifically, the FAA
proposed not to include in part 450 the
requirements for safety directives or
safety notebooks in § 431.37(a)(2) and
for a countdown plan in § 417.111(l), as
well as the requirement to file such
plans, because there are many methods
of documenting pre-flight procedures
that do not involve a plan or notebook.
In addition, the FAA proposed a
performance-based requirement in
which an operator who needs to
implement pre-flight procedures would
verify that all flight commit criteria are
satisfied before flight and ensure the
operator is capable of returning the
vehicle to a safe state after a countdown
abort or delay. In the final rule, the FAA
adopts § 450.159 (Pre-flight Procedures)
as proposed.
Virgin Galactic commented that, if the
FAA knows which events must take
place as a part of a countdown, it should
require them in proposed
§ 450.159(a)(1). Virgin Galactic
recommended the FAA require
operators to identify the sequence of
events that must take place to initiate
flight in order to verify that flight
commit criteria are satisfied.
Flight commit criteria involve much
more than the launch sequence of
events, including interdependent
conditions such as meteorological
conditions, lightning protection
equipment measurements, and status of
safety system components. Therefore,
the requirements of § 450.159 cannot be
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
satisfied by merely having operators
identify the launch sequence of events.
Furthermore, the FAA does not think a
prescriptive requirement listing which
events must take place as part of a
countdown is necessary to ensure
safety. Rather, this section takes a
performance based approach that
focuses more comprehensively on
verification of flight commit criteria and
the operator’s ability to ensure that it
can return the vehicle to a safe state
after a countdown abort or delay. The
FAA notes that the requirements for the
flight commit criteria itself are clearly
provided in § 450.165(b).
ii. Control of Hazard Areas (§ 450.161)
In the NPRM, the FAA proposed that
an operator would be required to
publicize, survey, and evacuate each
flight hazard area before initiating flight
or reentry to the extent necessary to
ensure compliance with proposed
§ 450.101. Proposed § 450.161(a) did not
change the need for surveillance relative
to the current requirements in parts 417
and 431 174 for people on land or aircraft
because an operator must continue to
ensure all regions where any individual
member of the public would be exposed
to more than 1 × 10¥6 PC (probability
of casualty) are evacuated. However, the
FAA proposed to revise the requirement
to evacuate and monitor areas where a
waterborne vessel would be exposed to
greater than 1 × 10¥5 PI (probability of
impact) currently required by Appendix
B to part 417 under B417.5(a). The
NPRM allowed an operator to include
people in waterborne vessels in
collective risk computations, rather than
clearing a waterborne vessel from a
hazard area because the vessel is
exposed to 1 × 10¥5 PI. The NPRM
proposal to include people on ships in
the collective risk computation in
§ 450.101(a)(1) and (b)(1) would allow
the application of risk management
principles to protect people on
waterborne vessels. In the final rule, the
FAA adopts § 450.161 with revisions. It
updates § 450.161 to be consistent with
the language in flight hazard area
analysis section, § 450.133, and adds an
application requirement for a
description of how the applicant will
provide for any publication of flight
hazard areas.
174 Part 417 requirements for establishing and
surveying hazard areas for ELVs are found in
§§ 417.205, 417.223, and part 417 appendix B. Part
431 does not set explicit requirements for
surveillance but both §§ 417.107(b)(2) and
431.35(b)(1)(ii) require that an operator ensure all
members of the public are cleared of all regions,
whether land, sea, or air, where an individual
would be exposed to more than 1 × 10¥6 PC.
PO 00000
Frm 00107
Fmt 4701
Sfmt 4700
79671
The FAA changes the title of this
section from ‘‘Surveillance and
Publication of Hazard Areas’’ to
‘‘Control of Hazard Areas’’ to describe
the contents of this section fully, as the
requirements cover more than
surveillance and publication. The FAA
also changed the proposed wording in
§ 450.161(a) from ‘‘publicize, survey,
and evacuate’’ to ‘‘survey, publicize,
control or evacuate’’ to match the
language in § 450.133(a), which
describes flight hazard area analysis.
The term ‘‘control’’ is used to describe
the overall management of hazard areas,
including control of entry and exit
points such as roadblocks and security
checkpoints. The FAA also adds
language in § 450.161(a) that references
the flight hazard area requirements in
§ 450.133, which requires an applicant
to identify the flight hazard areas it
needs to control.
The FAA notes that the requirements
in § 450.161 are consistent with the
recommendations made by the National
Academy of Sciences National Research
Council.175 An applicant could apply
conservative estimates of the ship traffic
and vulnerability to demonstrate
acceptable public risks. However, as
explained in the NPRM, the operators
still have the option to use the current
approach in part 417, where
surveillance is required to ensure no
ship is exposed to more than 1 × 10¥5
PI, because that would be sufficient to
ensure compliance with § 450.101.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA proposed that the
phrase ‘‘unless otherwise assigned
through agreement with a launch or
reentry facility’’ be added to proposed
§ 450.161(a) for clarification. Virgin
Galactic also recommended that this
requirement be handled through Letters
of Agreement. Although the operator
may contract with another party for the
provision of services to meet this
requirement, the licensee remains
responsible for complying with the
requirement. As such, the FAA does not
agree that this recommended addition is
necessary.
SpinLaunch commented that the goals
of the NOTAM required under proposed
§ 450.161 can be addressed through area
designations on Sectional Aeronautical
Charts, controlled airspace designation,
and coordination with Air Traffic
Control. The FAA is responsible for the
175 In 2001, the National Research Council
published a report on ‘‘Streamlining Space Launch
Range Safety,’’ which included a recommendation
that ‘‘safety procedures based on risk avoidance
should be replaced with procedures consistent with
the risk management philosophy specified by EWR
127–1.’’ See p. 44 of IBSN 0–309–51648–X available
at https://www.nap.edu/catalog/9790.html.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79672
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
management of the NAS and establishes
the regulations, processes, and
procedures for restricting airspace
including airspace restrictions for
commercial space activity. Under
§ 450.147, when an operator enters into
a letter of agreement with the FAA, the
airspace needed to accomplish the
proposed operation safely is notionally
identified and air traffic control
coordination procedures are established
accordingly. The FAA did not propose
changes to airspace management
regulations or processes, so
SpinLaunch’s comment is beyond the
scope of this rulemaking.
AOPA commented that airspace
hazard volumes are not communicated
in a standardized manner today, nor are
pilots educated on what to do with this
information. AOPA further commented
that a publicly accessible, authoritative
source for launch information would
greatly increase awareness and mitigate
adverse impacts caused by short notice
announcements of launches. The
commenter also suggested that
prospective users of the system should
be part of this capability’s development
process.
As discussed more fully in the
preamble section associated with Flight
Hazard Area Analysis, the FAA finds
that the issue raised by AOPA is best
addressed by the NOTAM/AIM
Modernization effort rather than this
rulemaking.
Boeing commented that, currently,
not all areas that are publicized are also
surveyed, controlled, and evacuated.
Boeing stated that the need to survey
and evacuate should be scalable and
dependent upon the risk magnitude and
area, remoteness of the hazard areas,
capabilities for monitoring, and overall
risk/benefit tradeoff. The FAA does not
believe a change to the proposed rule is
necessary to address these concerns.
The requirement to survey, publicize,
control, and evacuate each flight hazard
area is scalable, as these measures are
required ‘‘to the extent necessary to
ensure compliance with § 450.101.’’
This reference to § 450.101 means that
the need to control the hazard areas is
dependent on the public risk criteria, as
well as the inputs and assumptions used
in the FSA.
Sierra Nevada commented that
§ 450.161 would be an increase in
regulatory burden due to surveillance
over a large area being cost-prohibitive
and nearly impossible to implement for
smaller companies. Sierra Nevada
recommended that operators only be
required to ensure NOTAMs and
Notices to Mariners are in place prior to
operation, and should not bear
consequences if the public breaches
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
those areas. Sierra Nevada also asked
how an operator could reasonably
survey an aircraft hazard area over a
large area of ocean.
The FAA disagrees with this comment
and notes that this requirement codifies
current practice. The FAA further notes
that the only change to current
practice—the inclusion of people on
ships in collective risk—actually
decreases regulatory burden for
waterborne vessel hazard areas. An
operator is no longer required to
evacuate and monitor areas where a
waterborne vessel would be exposed to
greater than 1 × 10¥5 PI. In issuing its
first waiver of the existing requirement
in § 417.107(b)(3),176 the FAA explained
that successful application of the public
risk management for the protection of
people in waterborne vessels has the
potential for reducing launch costs by
reducing delays due to ship traffic in
warning areas while maintaining a high
level of public safety. For example, prior
to the waiver of § 417.107(b)(3), a
launch from Cape Canaveral Air Force
Station was delayed, in order to meet
the requirements of § 417.107(b)(3), by
the presence of a tug boat towing a large
barge inside the ship hazard area. The
final rule addresses Sierra Nevada’s
concerns regarding surveillance of a
large portion of ocean by including
people on ships in the collective risk
criterion. Furthermore, the FAA notes
that this requirement could be met a
number of ways, including through an
operator agreement with a Federal
launch or reentry site or the FAA.
Virgin Galactic asked whether it is
necessary to require an operator to meet
the EC criteria if the operator is using a
flight hazard area, thus ensuring no
member of the public is in the area. The
FAA addressed this issue during the
public comment period in ‘‘Responses
to the Public’s Clarifying Questions
Received by July 12, 2019.’’ An EC
analysis is still required even if launch
hazards are contained over regions of
land, sea, or air that are completely void
of members of the public because the
systems necessary to achieve such
containment, such as an FSS, may fail.
If an FSS fails, debris may fall outside
of hazard areas where members of the
public are present. The EC analysis
ensures that the potential failure of
those systems is accounted for when
calculating risk to the public.
In the NPRM, proposed § 450.161(b)
would have required an operator to
perform surveillance sufficient to verify
or update the assumptions, input data,
and results of the FSA. The NPRM
176 See Waivers of Ship Protection Probability of
Impact Requirement, 81 FR 28930 (May 10, 2016).
PO 00000
Frm 00108
Fmt 4701
Sfmt 4700
preamble stated that, given that there
are numerous assumptions and input
data that are critical to the validity of
the FSA, this requirement could have a
variety of surveillance implications
beyond the surveillance necessary to
ensure the public exposure at the time
of the operation is consistent with the
assumptions and input data for the FSA.
As described in the NPRM preamble, an
example would be that an FSA could
assume that a jettisoned stage remains
intact to impact or breaks up into pieces
that are not all capable of causing
casualties to people on the ground but
could still be capable of causing
casualties to people in a particularly
vulnerable class of aircraft, such as
helicopters.
In the final rule, the FAA maintains
the requirement that an operator employ
some type of surveillance (e.g.,
telemetry data, or remote sensors such
as a camera or radar) to verify that the
jettisoned stage behaves in a manner
consistent with the FSA if that behavior
is germane to the size of the aircraft
hazard area. The FAA clarifies that if an
FSA includes conservative assumptions
and inputs, or a sensitivity analysis to
demonstrate that the assumptions
regarding break-up of a jettisoned stage
are not germane to the size of the
aircraft hazard area, the operator will
only be required under § 450.161(b) to
demonstrate surveillance sufficient to
verify the accuracy of the FSA. If the
assumptions and inputs are sufficiently
conservative, this contingency could
mean an operator does not need to
employ surveillance at all.
Blue Origin provided suggested text
for § 450.161(b) related to vehicle
tracking rather than surveillance. The
FAA declines to adopt this change
because vehicle tracking requirements
in § 450.167 (Tracking) are distinct from
the requirement to surveil the flight
hazard areas in § 450.161. The
requirements and comments regarding
vehicle tracking are discussed in the
preamble section associated with
§ 450.167.
CSF, Sierra Nevada, and SpaceX also
commented that if a member of the
public or another Federal agency
chooses to breach a hazard area and put
itself at risk, the operator should not
bear the consequences. Many
commenters identified this possibility
as a problem in the case of a hazard area
violation that occurs after the decision
to commit to a reentry.
The FAA understands the unique
challenges of reentry operations with
respect to the control of hazard areas
because of the long time lag between the
commitment to reenter and the planned
or potential unplanned vehicle presence
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
in a hazard area. The FAA will work
with operators during the license
application process in applying this
requirement to ensure verification
procedures protect the public
adequately for each unique operation.
In the NPRM, proposed § 450.161(c)
would require an applicant to publicize
warnings for each flight hazard area,
except for regions of land, sea, or air
under the control of the vehicle or site
operator or other entity by agreement. If
the operator relies on another entity to
publicize these warnings, the proposed
rule required the operator to verify that
the warnings have been issued. CSF and
SpaceX commented that operators
would have very little ability to ensure
and enforce closures when launching
from a Federal launch or reentry site or
if the hazard area falls within a foreign
country’s airspace.
The FAA agrees with these comments.
To address this issue, the FAA changes
the language in proposed § 450.161(c)
from ‘‘verify that the warnings have
been issued’’ to ‘‘determine whether the
warnings have been issued’’ in
§ 450.161(c)(1) in the final rule. The
FAA recognizes that an operator would
be unable to meet the proposed
regulation to verify the warnings have
been issued if the foreign Air Navigation
Service Provider (ANSP) fails to
publicize the warnings. The FAA also
adds in § 450.161(c)(2) of the final rule
that the operator must notify the FAA if
the warnings have not been issued so
that the FAA can determine if the
launch or reentry can be conducted in
a manner that protects the public
sufficiently, and that this notification
must provide sufficient information to
enable the FAA to issue warnings to
U.S. aircraft. An involved party could
determine whether the warnings have
been issued pursuant to the agreements
the operator has with, for example, a
Federal launch or reentry site or a
foreign government. In cases in which a
foreign ANSP does not issue the
warnings in a timely manner, the
operator must notify the FAA in
accordance with a means of compliance
accepted by the FAA. The means of
compliance will describe information
that the operators should communicate
to the FAA to (1) show due diligence in
the fulfillment of their requirements in
accordance with agreements in place,
and (2) enable FAA to issue warnings to
U.S. aircraft. The FAA finds that the
final rule requirement in § 450.161(c)(2)
is responsive to the comment that
operators have very little ability to
enforce closures when launching from a
Federal launch or reentry site or if the
hazard area falls within a foreign
country’s airspace.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
The FAA proposed in § 450.161(d)(1)
that an applicant must submit a
description of how the applicant will
provide for day-of-flight surveillance of
flight hazard areas, if necessary, to
ensure that the presence of any member
of the public in or near a flight hazard
area is consistent with flight commit
criteria developed for each launch or
reentry as required by § 450.165(b). In
the final rule, the FAA adds in
§ 450.161(d)(1) that the applicant must
also provide for day-of-flight control of
flight hazard areas. The FAA notes that
the nature of any surveillance (in terms
of extent and frequency) necessary to
ensure conditions consistent with flight
commit criteria is naturally linked to the
level of control an operator can exercise
to limit access to a flight hazard area.
In § 450.161(d)(2), the FAA adds as an
application requirement that the
applicant must submit a description of
how they will provide for any
publication of flight hazard areas
necessary to meet the requirements of
§ 450.161(c). This application
requirement is necessary for the FAA to
evaluate compliance with the
requirements of § 450.161(c), including
verifying whether the warnings have
been issued.
jj. Lightning Hazard Mitigation
(§ 450.163)
In the NPRM, the FAA proposed to
require operators to mitigate natural and
triggered lightning by (1) implementing
flight commit criteria that avoid and
mitigate the potential for intercepting or
initiating lightning strike or
encountering discharge; (2) using a
vehicle designed to continue safe flight
if struck by lightning or encountering a
nearby discharge; or (3) ensuring
satisfaction of the safety criteria set forth
in proposed § 450.101 in the event of a
lightning strike on the vehicle.
In the final rule, the FAA adopts
§ 450.163 (Lightning Hazard Mitigation)
with modification. It revises § 450.163
to remove paragraphs (a)(3) and (b)(3). It
adds the modifier ‘‘direct’’ to ‘‘lightning
strike’’ in paragraph (a)(1), to match the
application requirement in paragraph
(b)(1). The FAA also modifies
§ 450.163(a)(2) in response to a
comment as described below.
Blue Origin commented that proposed
§ 450.163(a)(3) diverged from the
preamble to § 450.163 and the rest of the
proposed rule, which clearly convey
that satisfaction of the safety criteria in
proposed § 450.101 was not optional.
An operator would be required to satisfy
proposed § 450.101 regardless of
whether it chooses to implement flight
commit criteria or utilize a lightningresistant vehicle.
PO 00000
Frm 00109
Fmt 4701
Sfmt 4700
79673
The FAA agrees with Blue Origin’s
comment and revises § 450.163(a) by
removing proposed § 450.163(a)(3).
Proposed § 450.163(a)(3) was intended
to cover an operator’s use of physical
containment as a hazard control strategy
when damage to a vehicle caused by a
lightning strike would not impact the
safety of the launch. The FAA has found
this section to be unnecessary because
lightning would not be a concern for an
operator using physical containment as
a hazard control strategy since, by
definition, the launch vehicle does not
have sufficient energy for any hazards
associated with its flight to reach
outside the flight hazard area.
Blue Origin requested that the FAA
define ‘‘continue safe flight’’ in
proposed § 450.163(a)(2). In response,
the FAA modifies § 450.163(a)(2) to
require the operator to use a vehicle
designed to protect safety-critical
systems in the event of a direct lightning
strike or nearby discharge. Thus, the
final rule requirement in § 450.163(a)(2)
mirrors the proposed application
requirement in § 450.163(b)(2) to submit
documentation providing evidence that
the vehicle is designed to protect safetycritical systems against the effects of a
direct lightning strike or nearby
discharge.
Virgin Galactic expressed concern for
the amount of time it would take
operators to redesign their vehicles to
satisfy proposed § 450.163(a)(2) and
asked that the FAA ‘‘grandfather’’
currently licensed operators out of this
requirement. The FAA notes that
§ 450.163(a) provides two ways for an
operator to mitigate natural and
triggered lightning and does not
mandate a lightning-related design
change. The decision to pursue flight
commit criteria versus a lightningresistant vehicle rests with the operator.
The performance-based standards set
forth in § 450.163 will be accompanied
by AC 450.163–1 ‘‘Lighting Hazard
Mitigation’’ in the future, which will
contain one, but not the only, acceptable
means of compliance for § 450.163(a)(1).
The AC will include references to
NASA–STD–4010, as well as relevant
standards for the design of a vehicle to
withstand the direct and indirect effects
of a lightning discharge. Commenters
largely supported this approach. Blue
Origin noted that, while the Lightning
Flight Commit Criteria adopted by the
FAA have successfully prevented
lightning attachment to vehicles in the
past, operators may demonstrate that the
avoidance criteria can be satisfied with
their specific mission profile and
vehicle design. Aerospace Corporation
echoed support for enabling operators to
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79674
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
develop new methods and evaluations
for lighting avoidance and mitigation.
Regarding proposed § 450.163(a)(1),
two commenters expressed concern that
the FAA, in adopting only NASA–STD–
4010 as an accepted means of
compliance for now, may not accept
unique means of compliance in the
future. The Aerospace Corporation and
Weather Modification International
argued the FAA should adopt prelaunch
in situ measurement of electric fields as
a means of demonstrating compliance
with § 450.163, noting that NASA–STD–
4010 is imperfect because it relies
exclusively on observable ground data.
The FAA considered using direct
measurement of the electric field within
a cloud as an option for compliance
with § 450.163. However, the ambient
electrostatic field within and near
electrified clouds can vary rapidly in
both space and time because of the
charge separation and redistribution
processes inside and around the clouds,
and because lightning can rearrange this
charge abruptly over distances of many
kilometers. Because no measuring
technique today can be applied
everywhere simultaneously and it is
difficult to prove that electric field
measurements taken near the flight path
at an earlier time will remain valid at
the time of launch or landing, this
option is not viable on its own.
The FAA agrees that the optimal
standards for avoiding and mitigating
natural and triggered lightning may be
achieved through technological
advancement in the future. Currently,
NASA–STD–4010 is the only standard
of which the FAA is aware that will
satisfy the requirements of
§ 450.163(a)(1). However, ongoing
research efforts could soon allow for
modifications of the NASA’s Lightning
Launch Commit Criteria, providing
additional means of compliance. As
stated in the NPRM, the FAA anticipates
that industry will develop and submit
new standards to the FAA to serve as
unique means of compliance under
§ 450.35(b).
The FAA also acknowledges the
suggestion of Weather Modification
International that the FAA take the lead
in developing a definitive set of
lightning standards. The FAA has
traditionally relied upon the Lightning
Advisory Panel, with its technical
expertise in mitigating lightning
hazards, to develop lightning standards.
The FAA relied upon the lightning
standards recommended by the
Lightning Advisory Panel in developing
the lightning requirements in part 417.
Given the performance-based nature of
this rule, the FAA is not prescribing a
particular standard for mitigating
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
lightning hazards, but instead will allow
applicants to develop their own means
of complying with § 450.163. The FAA
notes, however, that the means of
compliance identified, NASA–STD–
4010, was developed by the Lightning
Advisory Panel, and thus, would
achieve the same result that the
commenter requests.
Blue Origin commented that, to the
extent the FAA looks to aircraft
lightning protection standards (e.g., AC
20–136B, AC 20–107B) to determine the
appropriate industry standards
applicable to § 450.163(a)(2), the agency
should adopt only those standards
clearly applicable to space vehicles. The
commenter added that the use of SAE
recommended practices would create an
undue burden on applicants since the
SAE protection rules apply to transport
aircraft, which require a much higher
level of safety than that prescribed by
part 450.
The FAA agrees that only those
aircraft standards which are appropriate
to apply to space vehicles should be
used to assess compliance with
§ 450.163(a)(2).
kk. Flight Commit Criteria (§ 450.165)
In the NPRM, the FAA proposed in
§ 450.165 that an operator establish and
observe flight safety rules in order to
initiate flight. The proposed rule also
required an operator to establish and
observe flight abort rules in order to end
flight. Proposed § 450.165 would require
that an operator’s flight safety rules
include flight commit criteria
identifying each condition necessary to
satisfy proposed § 450.101 prior to
initiating flight. These flight commit
criteria would include: (1) Surveillance;
(2) monitoring of meteorological
conditions; (3) implementing window
closures for the purpose of collision
avoidance; (4) monitoring the status of
any FSS; and (5) any other hazard
controls derived from system safety,
computing system safety, or FSA.
In the final rule, the FAA adopts
proposed § 450.165 with revisions. The
FAA moves the flight abort rules
proposed in § 450.165(c) to § 450.108.
The discussion of the revisions related
to abort rules in proposed § 450.165 is
in the Flight Abort Rules section of the
preamble. The FAA combines proposed
§ 450.165(a) and (b) into a single
paragraph (a) to reflect that this section
now only relates to flight commit
criteria.
In addition, the FAA adds a
requirement that the flight commit
criteria must include confirmation from
the FAA that the risk to critical assets
satisfies the requirements of
§ 450.101(a)(4) or (b)(4). This
PO 00000
Frm 00110
Fmt 4701
Sfmt 4700
requirement is consistent with the
changes to the critical asset
requirements discussed earlier in the
preamble and ensures that a flight is not
initiated if it does not meet the risk
criteria. The FAA will work with the
applicant to create a streamlined
process to achieve this confirmation.
The FAA anticipates that it will
generally be able to provide this
confirmation well before the actual
flight countdown.
Sierra Nevada commented that the
use of the term ‘‘surveillance’’ may be
broader than the FAA intended. The
FAA discusses surveillance in the
preamble section for Control of Hazard
Areas (§ 450.161).
ll. Tracking (§ 450.167)
In the NPRM, the FAA proposed
vehicle tracking requirements, including
that an operator would be required to
measure and record in real time the
position and velocity of the vehicle. The
system used to track the vehicle would
be required to provide data to determine
the actual impact locations of all stages
and components, and to obtain vehicle
performance data for comparison with
the pre-flight performance predictions.
The FAA intended the proposed
requirements to capture current
practice. As explained in the NPRM,
tracking data sufficient to identify the
location of any vehicle impacts
following an unplanned event are
necessary to ensure a proper response to
an emergency.177
CSF, SpaceX, SpinLaunch, and Virgin
Orbit commented that the proposed
language in § 450.167(a) could be
interpreted as tracking stages and
components all the way down to the
earth or body of water. CSF also sought
clarity regarding the intent of the
requirement to ‘‘provide data to
determine the actual impact locations of
all stages and components,’’ and
whether this requirement would mean
that operators must predict the expected
impact locations or actual impact
locations. To clarify this point, CSF,
SpaceX, and Virgin Orbit suggested
using the phrase ‘‘predict the expected
impact locations’’ rather than
‘‘determine the actual impact
locations.’’ The FAA concurs and
adopts the recommended change in the
final rule. The change more accurately
reflects the intent of the requirement.
Blue Origin commented that RCC 321
requirements to coordinate with the
FAA to ensure timely notification of any
expected air traffic hazard do not
actually mention vehicle tracking, and
that it may be possible to provide
177 See
E:\FR\FM\10DER2.SGM
84 FR 15344.
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
notification of traffic hazards without
the need for tracking (such as a straight
up suborbital trajectory 178).
Tracking data is an important element
of current practice used to ensure the
safety of people in aircraft. In the past,
tracking vehicles was inherently a part
of flight abort and an important means
to ensure safety in the event of a mishap
in which hazardous debris falls outside
of designated hazard areas. During
launch or reentry operations that lack
the ability to inform the FAA rapidly of
the volume and duration of airspace for
which an aircraft hazard is predicted
following a mishap, the FAA must close
inordinately large regions of airspace to
provide a sufficient level of safety to
aircraft flying in regions where
hazardous debris could fall in the event
of a break-up. Although RCC 321 does
not call for tracking per se, the FAA
finds tracking essential to the safe and
efficient integration of launch and
reentry operations into the NAS. For
example, the Columbia accident in
2003 179 demonstrated that there is often
a significant period of time between a
vehicle break-up and when hazardous
debris reaches aircraft altitudes. The
time between vehicle break-up and
when hazardous debris reaches aircraft
altitudes enables the FAA to close a
minimum amount of airspace while
ensuring a high level of safety for
aircraft flying in regions where
hazardous debris could fall in the event
of a break-up. As explained in the
NPRM preamble, tracking data are
generally necessary to ensure a proper
response to an emergency, facilitate
flight abort, obtain vehicle performance
data for comparison with the preflight
performance predictions in accordance
with § 450.103(d), and facilitate safe and
efficient integration of launch and
reentry operations into the NAS.
Therefore, the final rule is consistent
with the NPRM and current practice.
CSF, Leo Aerospace, Microcosm,
Sierra Nevada, and SpaceX commented
that the proposed language regarding
tracking was too broad and would seem
to require an operator to track pieces of
debris to impact during an off-nominal
event. As clarified by the FAA during
the public comment period in ‘‘Answers
to Clarifying Questions Received by
June 28, 2019’’ and ‘‘Answers to
Clarifying Questions Received by July
178 A straight up suborbital trajectory is a nearly
vertical suborbital trajectory. ‘‘Suborbital trajectory’’
is defined in § 401.5 as the intentional flight path
of a launch vehicle, reentry vehicle, or any portion
thereof, whose vacuum instantaneous impact point
does not leave the surface of the Earth.
179 See Report of Columbia Accident Investigation
Board at https://www.nasa.gov/columbia/home/
CAIB_Vol1.html.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
29, 2019,’’ the term ‘‘all stages and
components’’ does not mean that all
debris must be tracked to the ground
after a vehicle breakup.
CSF and SpaceX suggested adding the
word ‘‘nominal’’ to this requirement
when referring to flight tracking. The
FAA declines to adopt this change
because it is important to track during
off-nominal trajectories as well,
including during normal flight and for
off-trajectory malfunctions at least until
flight abort is initiated or vehicle breakup occurs. Tracking data can enable an
appropriate response to an off-nominal
situation, such as where to evacuate the
public to protect against predicted toxic
fumes or where to apply fire
suppression resources.
Blue Origin, CSF, and SpaceX
commented that real time telemetry is
often not possible for the entire mission,
such as when a vehicle passes over the
horizon or during a reentry blackout
period. The FAA concurs with the
commenters that real time telemetry is
not always possible. In the past, there
were times during reentry that the
presence of plasma typically blocked
vehicle-to-ground communications.
More recently, space-based tracking and
communications have made it feasible
to overcome reentry plasma and over
the horizon limitations. However, the
final rule does not require operators to
use space-based tracking and
communications to meet § 450.167
unless it is necessary to protect public
safety, safety of property, and national
security and foreign interests of the
United States. The FAA does not
currently foresee any licensed launch or
reentry activity that will require the use
of space-based tracking to protect public
safety, safety of property, and national
security and foreign interests of the
United States. Furthermore, ‘‘real time’’
does not mean ‘‘zero lag time.’’ The
tracking must be sufficient to meet the
requirements in § 450.167(a) to predict
the expected impact locations and
obtain vehicle performance data for
comparison with pre-flight predictions.
The FAA would not hold an operator
accountable if there was some lag for
reasons outside of the operator’s control.
The FAA believes that this leeway
answers Blue Origin’s recommendation
that tracking requirements be limited to
phases of launch or reentry vehicle
flight identified in § 450.113(a), since
on-orbit tracking is not practical.
mm. Launch and Reentry Collision
Avoidance Analysis Requirements
(§ 450.169)
In the NPRM, the FAA proposed to
update the information required for
launch collision avoidance (LCOLA)
PO 00000
Frm 00111
Fmt 4701
Sfmt 4700
79675
and expand the analysis requirements to
determine launch and reentry window
closures, including updated protections
for human spaceflight and additional
closures to protect active payloads and
prevent orbital debris generation. The
FAA proposed that all operators would
be required to come into compliance
with the LCOLA requirements by the
effective date of the rulemaking.
In the final rule, the FAA adopts
§ 450.169 with revisions. The finalized
LCOLA rules better align with the
existing processes used at Federal sites,
provide adequate orbital safety
measures for launch and reentry
operations, and incorporate updated
options for collision avoidance analysis.
The FAA maintains that all operators
must come into compliance with the
LCOLA requirements by the effective
date of this rule. The FAA adds the
words ‘‘are met’’ to § 450.169(b) to fix a
typographical error in the NPRM.
For an orbital or suborbital launch or
reentry, § 450.169(a) requires an
operator to establish window closures
needed to ensure that the launch or
reentry vehicle, any jettisoned
components, or payloads, meet the
identified requirements with respect to
orbiting objects, not including objects
being launched or reentered as part of
the same launch or reentry activity (e.g.,
dual manifested payloads). In
performing a launch or reentry collision
avoidance analysis against inhabitable
objects, an operator may choose to
stipulate an ellipsoidal separation
distance, a spherical separation
distance, or satisfy the probability of
collision threshold (1 × 10¥6). Collision
avoidance analyses must also account
for other orbital objects, such as
spacecraft, and tracked debris. For these
uninhabitable active objects, operators
must satisfy either a less restrictive
probability of collision threshold (1 ×
10¥5) or a spherical separation distance
of 25 km. As discussed more fully later,
in response to comments, the FAA
revises § 450.169(a)(3), which covers all
other known orbital debris, so that
operators must maintain either a
spherical separation distance of 2.5 km
or a less restrictive probability of
collision threshold (1 × 10¥5) from
orbital debris that is medium or large in
size (radar cross section greater than
0.1m2), as identified by the FAA or
another Federal Government entity.
The FAA also received a number of
comments to proposed § 450.169(d),
which identified when LCOLA analysis
would not be required. This section was
not a new requirement, but a
consolidation of the existing
regulations, § 417.231(d) and Appendix
C to part 417 under C417.11. As
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79676
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
proposed, an LCOLA analysis would not
be required if the maximum altitude
attainable by a launch operator’s
suborbital launch vehicle and any
released debris is less than 150 km. The
proposed requirement stated that the
maximum altitude attainable is an
optimized trajectory, assuming
maximum performance within 99.7
percent confidence bounds, extended
through fuel exhaustion of each stage, to
achieve a maximum altitude.
SpaceX opposed the requirement that
LCOLA exclusions (launch and reentry
window closures) be based on fuel
depletion trajectories or the maximum
attainable altitude of a launch vehicle.
SpaceX commented that both bases
exceeded the scope of past requirements
and requested that LCOLA exclusions
be based exclusively on the maximum
performance case. SpaceX also
recommended the FAA delete proposed
§ 450.169(d) due to unclear technical or
public safety benefits. Blue Origin
recommended that fuel exhaustion from
each stage be excluded from proposed
§ 450.169(d) because remaining fuel will
always be required to land RLVs.
The FAA disagrees with the
recommendation to remove
§ 450.169(d). The FAA notes that,
without this subsection, operators
would need to conduct LCOLA analyses
for all launches, regardless of altitude.
The FAA has determined that no
LCOLA analysis is needed for missions
that do not exceed 150 km in altitude
because orbital objects below this level
are exceedingly sparse and usually are
not present for long durations.
Furthermore, launch operators currently
do not provide trajectories for stages or
objects that do not exceed 150 km. As
such, it is appropriate to specify in the
regulation when the LCOLA analysis is
not required.
The FAA agrees, however, that the
language proposed in § 450.169(d) did
not reflect current practice and could
prove impracticable. The requirement
for accomplishing LCOLA for all objects
launched over 150 km was complicated
by existing regulatory language on
maximum altitude calculations. LCOLA
is accomplished using only the nominal
trajectory provided by the launch or
reentry operator. No screening is
accomplished using maximum possible
altitudes because there is no planned
trajectory to screen, and the FAA did
not intend for operators to develop
alternate trajectories. Therefore, the
FAA revises § 450.169(d) so that no
LCOLA is required if the object’s
maximum planned altitude is less than
150 km.
Similarly, the FAA revises
§ 450.169(b)(1) to require LCOLA
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
analysis only for the entire segment of
flight of a suborbital launch vehicle
above 150 km. The FAA agrees with
SpaceX’s comment that requiring
operators to conduct LCOLA analyses
below 150 km is unnecessary and would
prove burdensome. This revision is
consistent with the requirements for
orbital vehicles and acknowledges that
only the portions of flight above 150 km
are screened in either case.
Virgin Galactic recommended that
proposed § 450.169(d) be retitled,
‘‘Applicability.’’ SpaceX recommended
the regulation refer to a ‘‘body’’ or
‘‘object,’’ rather than ‘‘suborbital’’ or
‘‘debris.’’ The FAA agrees with Virgin
Galactic and SpaceX that these terms
and the title could be clearer and more
consistent with current usage. The FAA
retitles § 450.169(d) ‘‘Exception,’’ which
more accurately describes this
subsection, and substitutes ‘‘object’’ in
place of suborbital vehicle in
§ 450.169(d).
Regarding requirements proposed in
§ 450.169(a) and (b), the FAA received
numerous comments questioning the
need for a 200 km keep-away distance
for human spaceflight and the absence
of probability of collision screening for
debris. Numerous commenters also
recommended a narrower trajectory data
requirement for suborbital launches.
An individual commenter stated that
a spherical separation distance of 200
km from inhabitable objects, as set forth
in proposed § 450.169(a)(1)(ii) and
(a)(1)(iii), may not be appropriate due to
advances in spaceflight systems such as
autonomous flight termination systems
(AFTS) and autonomous flight systems
(AFS). The commenter recommended
the FAA allow the 200-km limit to be
tailored depending on the reaction time
of the flight termination system. The
commenter also suggested the 200-km
limit could be tailored if the launch
vehicle contains a traffic collision
avoidance system (TCAS) (akin to what
aircraft use to avoid planes) that can
reasonably avoid nearby crewed
vehicles.
The FAA disagrees that a spherical
separation distance of less than 200 km
is appropriate for inhabitable objects.
No termination systems are currently
used in orbit, and termination systems
are not likely to be viable safety
measures in orbit. The 200 km safety
standoff distance is only for orbital
spaceflight protection; it is not a
separation standard for airspace
integration. An orbital termination
system would increase the danger to
human spaceflight and increase the
orbital debris population. Safety and
efficiency must be accomplished with a
screening prior to launch. Launch
PO 00000
Frm 00112
Fmt 4701
Sfmt 4700
vehicles do not have TCAS-like
operations and are not expected to
acquire such capabilities.
SpaceX asked the FAA to explain why
§ 450.169(a)(3) requires operators to
screen orbital debris greater than 10 cm2
against a spherical miss distance of 2.5
km, rather than meet a probability of
collision threshold, as the FAA allows
for inhabitable objects and active
payloads. SpaceX stated that the
requirement to maintain a spherical
miss distance, without the option to
evaluate probability of collision, is more
restrictive than current requirements
and inconsistent with USAF practices.
SpaceX argued there should be an
option to waive miss distance less than
2.5 km if probability of collision is
sufficiently low, as is done for active
payloads.
The FAA agrees with SpaceX that
probability of collision could be used
for medium and large orbital debris
because those objects are routinely welltracked and have valid orbital
covariances available. This option
would provide for higher fidelity
screening of collisions that could
produce significant amounts of orbital
debris. As such, the FAA revises
§ 450.169(a)(3) to allow operators to
screen for orbital debris identified by
the FAA or other Federal Government
entity using either a spherical
separation distance of 2.5 km or a less
restrictive probability of collision
threshold (1 × 10¥5). The use of
probability of collision will require
realistic covariance data on both the
launching object and the screened
orbital object to produce meaningful
results. Operators who do not provide
realistic covariance will be required to
have the launch or reentry screened
with stand-off distance. The probability
of collision threshold required for debris
is the same as that required for active
payloads in § 450.169(a)(2), which
mirrors current USAF requirements.
The USAF requirements for debris
screening use the same probability of
collision as a high-fidelity analysis in
place of both 25 km and 2.5 km standoff
screening. The FAA slightly relaxed the
debris screening size requirement to
include only medium (0.1 m2 to 1 m2)
and large objects (greater than 1 m2) in
order to provide for accurate use of
probability of collision analysis.
Medium and large debris objects are
well-tracked, and the U.S. Government
maintains accurate covariance on these
objects. This requirement achieves the
objectives stated in the NPRM of
avoiding conjunction analysis with
micro-debris, while preventing the
generation of space debris since these
objects are well-tracked and capable of
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
creating significant amounts of
persistent space debris in the event of a
collision.
In proposed § 450.169(f), the FAA
would require an operator to prepare a
collision avoidance analysis worksheet
for each launch or reentry using a
standardized format that contains the
input data required by Appendix A to
part 450. Proposed § 450.169(f)(1) would
require an operator to file the input data
with a Federal entity identified by the
FAA and with the FAA at least 15 days
before the first attempt at the flight of a
launch vehicle or the reentry of a
reentry vehicle or in a different time
frame in accordance with proposed
§ 404.15. Proposed § 450.169(f)(2) would
require an operator to obtain a collision
avoidance analysis performed by a
Federal entity identified by the FAA 6
hours before the beginning of a launch
or reentry window.
CSF and SpaceX requested the FAA
alter proposed § 450.169(f)(1) to require
operators to file input data 7 days before
launch or reentry rather than 15 days.
The commenters stated the 15-day
requirement conflicts with current
processes at Federal launch or reentry
sites, which allow submissions 7 to 10
days before launch or reentry. CSF and
SpaceX stated that 7 days prior to
launch has proven sufficient to produce
screening results by 6 hours before
launch. CSF and SpaceX also indicated
that the requirement to obtain final
results 6 hours before launch was
inconsistent with current practice. The
Federal entity performing LCOLA
screenings delivers the final data hours
before launch. CSF and SpaceX
recommended adding a clause to
proposed § 450.169(f)(2) allowing
trajectory data to be delivered within
timelines agreed to by the launch
operator and the entity performing the
screening. Alternatively, SpaceX
recommended the FAA either require
the data be submitted 3 hours before
launch in § 450.169(f)(2), as currently
practiced by the USAF, or allow
operators flexibility to obtain LCOLA
data ‘‘within’’ 6 hours of the launch or
reentry window beginning, but no later
than 3 hours before launch.
The FAA partially agrees with CSF’s
and SpaceX’s recommended changes to
the timelines established in
§ 450.169(f)(1) and (f)(2). For launch or
reentry operations that have
successfully developed an internal
process that results in repeatable
LCOLA data submission, the FAA
recognizes that 7 days prior to launch is
an adequate time for Federal entities to
process the LCOLA data based on recent
LCOLA submissions reviewed for the
last year. The FAA revises
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
§ 450.169(f)(1) to require that most
operators submit LCOLA data at least 7
days in advance of launch or reentry.
However, the FAA disagrees that a
shorter time frame would be appropriate
for operators that have not yet
conducted launch or reentry activities.
The FAA has repeatedly noted that
LCOLA data submitted from first-time
launch or reentry operators often require
significant reiterative work to achieve
an acceptable submission. As such, the
FAA will require operators that have not
yet received conjunctive assessments to
submit LCOLA data at least 15 days in
advance of launch or reentry. This
approach is similar to that of the USAF,
which requires entities that have not yet
received conjunctive assessments to
submit LCOLA data 30 days in advance
of launch. The FAA revises
§ 450.169(f)(1)(i) to require that entities
that have not yet received conjunctive
assessments to submit LCOLA data at
least 15 days in advance of launch. All
other operators must submit LCOLA
data at least 7 days in advance of
launch.
The FAA agrees that the requirement
to receive results within 6 hours before
beginning of the launch or reentry
window could be reduced to 3 hours.
Later delivery will produce LCOLA
results that are timelier and therefore
more accurate for orbital safety
purposes. Therefore, the FAA revises
§ 450.169(f)(2) to alter delivery to 3
hours before beginning of the launch or
reentry window.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA commented that
much of proposed § 450.169(a) focused
on analysis that was not applicable to
operators since applicants do not have
the data and tools to perform LCOLA
analysis, but merely provide inputs and
implement operational windows based
on closures provided. The commenters
advocated for a streamlined commercial
process for licensed launches or
reentries that do not occur at a Federal
launch or reentry site, in which the FAA
would take the applicant’s trajectory
inputs to the Federal agency responsible
for LCOLA analysis and establish stayout windows. The commenters argued a
standardized process would eliminate
the need for multiple applicants to
establish interfaces and procedures with
an agency that rarely deals with
commercial (space transportation)
entities.
The FAA declines to streamline the
LCOLA process further by removing the
analysis requirements of § 450.169(a),
such that applicants only need to
provide data and abide by results.
Transparency in LCOLA analysis
provides confidence and understanding
PO 00000
Frm 00113
Fmt 4701
Sfmt 4700
79677
of the LCOLA process for launch,
reentry, and payload, for operators as
well as the public.
The same commenters noted that the
FAA could act as a go-between entity for
all operators in a similar manner to
Federal sites’ processes. The FAA agrees
that operators could use the FAA or the
Federal sites as conduits to the LCOLA
processing entity and recognizes that
this flexibility remains in the final rule
language. This type of activity is
appropriately coordinated during the
launch operator or reentry operator preapplication discussions. The FAA
disagrees with requiring the FAA to act
as a pass-through because the FAA
believes that removing launch operators
from direct contact with the USAF 18th
Space Control Squadron could have
unintended negative consequences. For
instance, an early orbit breakup
emergency may require prompt
exchange of data between launch
operators and on-orbit support services
providers using processes already tested
during LCOLA development and adding
a pass-through element could hamper or
slow analysis, notifications, and
potential mitigation actions. Moreover,
the FAA does not place orbital safety
analysts on duty during launch or
reentry operations. To adequately
support the passthrough, the FAA
would need to establish launch support
teams and exercise the team in advance
of emergency operations.
Blue Origin and SpaceX
recommended the FAA allow LCOLA
analyses to be conducted by nonFederal entities. Blue Origin
recommended that proposed
§ 450.169(e) require LCOLA analyses be
obtained from Federal entities, unless
otherwise agreed to by the
Administrator. SpaceX recommended
proposed § 450.169(f) allow operators to
file input data and obtain LCOLA
analyses from approved third parties, as
opposed to Federal entities. SpaceX
argued the FAA should foster a
competitive market and allow flexibility
in using commercial services as
commercial entities enter the space
situational awareness (SSA) market and
aim to provide the same services as
Federal entities. Virgin Galactic asked if
the FAA anticipated a cost associated
with obtaining the analysis from the
Federal entity.
The FAA declines to remove the
reference to Federal entities in
§ 450.169. Although commercial entities
are developing space traffic support
services that could eventually provide
adequate safety for launch collision
avoidance, to date, only Federal entities
have full access to the authoritative
catalog maintained by the DOD. Rather
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79678
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
than remove this clause, the FAA adds
the phrase, ‘‘or another entity agreed to
by the Administrator,’’ to § 450.169(e) in
order to provide flexibility should the
space traffic authority and framework
change over time. The Administrator
may allow another entity to provide this
service based on a demonstration that
the data includes a complete and
accurate catalogue of all identifiable
objects in the relevant space
environment. Currently, the DOD is the
only entity that meets this criterion. In
response to Virgin Galactic’s question
regarding cost, the current LCOLA
analysis from the U.S. Government is
provided free of charge.
SpaceX recommended the FAA defer
to or allow operators to use the LCOLA
processes and standards of Federal
launch or reentry sites for launches from
Federal sites as means of compliance.
SpaceX argues that doing so would
minimize confusion regarding the
applicable standards and procedures at
different operating sites. SpaceX also
suggested that § 450.169(e) be revised to
state that operators may use Federal
launch or reentry site services with
existing policies and processes to ensure
acceptable compliance.
The FAA declines to defer to the
Federal launch or reentry sites. The
FAA and Federal sites have different
waiver requirements and processes. The
FAA finds the language as proposed in
the NPRM is adequate when coupled
with the existing waiver process and
equivalent level of safety process. In
addition, the FAA notes that launches
from non-Federal sites are not required
to follow Federal site practices, and
using a single FAA standard minimizes
confusion both on and off Federal
launch or reentry sites.
Citing the discrepancy between the
proposed collision avoidance analysis
and current USAF practice, CSF stated
the proposed rule attempted to ‘‘fix’’
parts of the licensing process that were
not broken.
The FAA disagrees that the collision
avoidance analysis process is
incompatible with the current USAF
practice. The procedures for launch
collision avoidance under §§ 417.107,
417.231, 417.31, and 417.43 did not
reflect current practice as they excluded
any probability of collision, referenced
outdated processes and agencies, and
required outdated adjustments to
closures. The updated LCOLA process is
compatible with USAF practices where
appropriate (e.g., LCOLA timelines,
screening options for human spaceflight
protection, and active payload
protection), noting that the FAA
regulation must also guide operations of
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
launch and reentry operations at nonFederal sites.
nn. Safety at End of Launch (§ 450.171)
In the NPRM, the FAA proposed in
§ 450.171 (Safety at End of Launch)
requirements for the prevention of
creating orbital debris, with which an
applicant would be required to
demonstrate compliance in its
application.
In the final rule, the FAA adopts
§ 450.171 as proposed. The FAA did not
receive comments on these proposed
requirements.
oo. Mishap (Definition, §§ 450.173 and
450.175)
i. Mishap Definition
In the NPRM, the FAA proposed to
consolidate the definitions of ‘‘Mishap,’’
‘‘Launch Accident,’’ ‘‘Launch Incident,’’
‘‘Reentry Accident,’’ ‘‘Reentry
Incident,’’ ‘‘Human Spaceflight
Incident,’’ and ‘‘Launch Site Accident’’
under the definition of ‘‘Mishap’’ in
§ 401.5. The FAA proposed four mishap
categories, from most severe (Class 1) to
least severe (Class 4).
In the final rule, the FAA does not
adopt the proposed classification
system. Instead, the FAA combines the
substantive criteria of Mishap Classes 1
through 4 under the definition of
‘‘mishap’’ in § 401.7. The revised
definition describes events that
constitute a mishap in a straightforward
manner that better corresponds to
regulatory requirements. The FAA
incorporates additional changes to the
final rule as discussed in the following
paragraphs.
Numerous commenters from industry
expressed confusion about the types of
activities that would fall under each
class. The commenters questioned the
necessity of classifying mishaps based
on severity since the regulatory
requirements were largely the same for
all mishaps.
The FAA reviewed the regulatory
requirements associated with each of
the proposed mishap classes and agrees
there were no significant differences
among the regulatory requirements for
each class. The requirements to report,
respond to, and investigate mishaps are
incumbent upon an operator regardless
of a mishap’s severity. Mishap classes
are not needed to achieve the objective
of consolidating mishap-related terms
and streamlining the requirements to
report, respond to, and investigate
mishaps. Accordingly, the FAA removes
the proposed classification system.
Except as discussed later in this
preamble, the criteria proposed under
each mishap class have been
consolidated under ‘‘mishap’’ in § 401.7.
PO 00000
Frm 00114
Fmt 4701
Sfmt 4700
In the NPRM, the FAA proposed that
a Class 1 mishap would include any
event resulting in (1) a fatality or serious
injury (as defined in 49 CFR 830.2)
resulting from licensed or permitted
activity to any person who is not
associated with the licensed or
permitted activity, or (2) a fatality or
serious injury to any space flight
participant, crew, or government
astronaut. This proposal was consistent
with longstanding definitions of
‘‘launch accident’’ and ‘‘reentry
accident’’ in § 401.5.
A fatality or serious injury to a person
associated with licensed or permitted
activity constitutes a mishap under
§ 401.5, rather than a launch or reentry
accident. The FAA proposed to
incorporate each of the mishap-related
terms found in § 401.5 under the
definition of ‘‘mishap.’’ 180 As such,
save for the removal of the $25,000
monetary threshold, all events that meet
the current accident, incident, and
mishap definitions would continue to
be mishaps under the consolidated
definition.181 In combining the mishaprelated terms, the FAA inadvertently
excluded from the proposed definition a
fatality or serious injury to persons
associated with licensed or permitted
activity, which has been covered by the
term ‘‘mishap’’ in § 401.5. The FAA did
not intend to depart from current
practice by excluding these serious
events from the definition, as evidenced
by the NPRM preamble. In revising the
definition of ‘‘mishap,’’ the FAA stated
its intent to streamline and clarify
existing definitions, eliminate the
monetary threshold, and consolidate the
accident and incident investigation
sections of parts 417, 420, 431, 435, 437
into one section applicable to all
licenses, permits, and vehicles.182 In
proposing to consolidate existing
definitions, the FAA did not propose to
narrow the scope of activities deemed a
mishap. In the final rule, the FAA
revises the definition of ‘‘mishap’’ to
include any fatality or serious injury
resulting from licensed or permitted
activity, irrespective of the person’s
involvement in the launch activity.
The FAA consolidates under
paragraph (1) of the definition those
criteria proposed for Mishap Class 1 and
the previous definition of ‘‘mishap’’ in
§ 401.5. This revision is consistent with
the mishap reporting requirements
180 84 FR 15351 (‘‘The proposed mishap
classification system would streamline and clarify
the current accident, incident, and mishap
definitions to create four mishap categories
organized by severity, from most severe (Class 1) to
least severe (Class 4).’’).
181 84 FR 15352.
182 84 FR 15351.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
under § 450.173(c)(1) for the occurrence
of a fatality or serious injury during
FAA-authorized activities. The FAA
removes the phrase ‘‘including ground
activities at a launch or reentry site’’
from the criterion addressing fatality or
serious injury because the phrase
‘‘events associated with a licensed or
permitted activity’’ adequately covers
such activities.
In the final rule, the FAA redesignates criterion (1) of proposed
Mishap Class 2 as paragraph (2) of the
definition, which applied to the
malfunction of an FSS or safety-critical
system. The FAA notes that it removed
the term ‘‘flight safety system’’ from
paragraph (2) because an FSS is a safetycritical system.
Paragraph (7) of the definition
consolidates two criteria proposed
under Class 3 and 4 for permanent loss
of a vehicle during licensed and
permitted activity, respectively. Since
the FAA is discarding the mishap
classification system, there is no longer
a need to differentiate loss of a launch
or reentry vehicle during licensed
versus permitted activity. Nor does the
FAA intend to differentiate loss of a
‘‘vehicle’’ from loss of a ‘‘launch or
reentry vehicle.’’
The FAA proposed to replace the
clause, ‘‘failure to complete a launch or
reentry as planned,’’ in the previous
definition of ‘‘mishap’’ in § 401.5, with
the clause, ‘‘failure to achieve mission
objectives.’’ AIA, Sierra Nevada, and
SpaceX objected to this criterion,
arguing that failure to achieve mission
objectives related to mission assurance
and exceeded the FAA’s authority to
ensure public safety.
Based on industry comments, the
FAA reverts to the original phrase,
‘‘failure to complete a launch or reentry
as planned,’’ but adds a citation to a
regulatory requirement that narrows the
scope of this criterion. Failure to
complete a launch or reentry according
to the parameters provided by the
operator under the pre-flight reporting
requirements of § 450.213(b) 183 will
constitute a mishap. This criterion more
accurately reflects the scope of activities
that the FAA deems to be a mishap and
alleviates the commenters’ concerns
about mission assurance.
The FAA removes from the final rule
all references to the proposed mishap
183 As discussed later in the preamble,
§ 450.213(b)(2) requires a licensee to submit
planned mission information, including the vehicle,
launch site, planned flight path, staging and impact
locations, each payload delivery point, intended
reentry or landing sites including any contingency
abort location, and the location of any disposed
launch or reentry vehicle stage or component that
is deorbited.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
classes. The FAA revises § 450.131(a)(2)
to clarify that a probability of failure
analysis must account for data on any
mishap and anomaly. While the NPRM
stated that the probability analysis must
account for all partial failures and
anomalies, ‘‘including Class 3 and Class
4 mishaps,’’ the language implied that it
would also apply to Class 1 and Class
2 mishaps—the more severe events. The
FAA replaces the mishap classes
referenced in § 450.173(a) with the term,
‘‘mishap.’’ Finally, the FAA replaces the
mishap classes referenced in
§ 450.219(b) with a reference to the
portion of the mishap definition that
corresponds to the proposed
requirement: Events listed in paragraphs
(1) through (5) and (8).
The removal of the mishap classes
dispenses with commenters’ requests for
clarification or guidance in ACs on
applying and differentiating the
proposed mishap classes.
The final rule adds three changes to
sections that cross-reference the mishaprelated terms that the FAA proposed to
replace with the revised mishap
definition: §§ 420.61(b), 437.87(b), and
460.45(d). The FAA replaces the term
‘‘launch or launch site accident’’ in
§ 420.61(b) with a reference to the
portions of the mishap definition that
replace these terms: Paragraphs (1), (5),
and (8). The FAA also replaces the word
‘‘shall’’ with the word ‘‘must’’ in
§ 420.61 because ‘‘shall’’ is no longer
used in FAA regulations. Similarly, in
§ 437.87(b), the FAA replaces the
phrase, ‘‘launch or reentry accident or
incident,’’ with a reference to
corresponding portions of the mishap
definition in paragraphs (1) through (3),
(5), and (8). As noted in the section of
this preamble discussing the
compliance period for legacy licenses
(§ 450.1(b)), the FAA revises § 460.45(d)
to require part 415, 431, and 435
licensees to apply the mishap-related
definitions in § 401.5, and part 450
licensees to apply the definitions in
§ 401.7 when describing the safety
record of the vehicle to space flight
participants. Specifically, § 460.45(d)(1)
requires that part 450 licensees identify
events that meet paragraphs (1), (4), (5),
and (8) of the definition of a mishap in
§ 401.7, which occur during and after
vehicle verification performed in
accordance with § 460.17.
The FAA also revises § 420.59 to
identify the portions of the mishap
definition applicable to launch site
operators licensed under part 420. Not
all of the events described under the
definition of ‘‘mishap’’ apply to part 420
licenses, which do not authorize launch
or reentry activities, though the NPRM
did not state this fact expressly. Nor did
PO 00000
Frm 00115
Fmt 4701
Sfmt 4700
79679
the FAA intend the revised definition of
‘‘mishap’’ to expand the scope of the
previous ‘‘launch site accident’’
definition under part 420. The FAA
therefore revises § 420.59(a) to state that
a licensee must report, respond to, and
investigate mishaps that meet paragraph
(1) or (5) of the definition of ‘‘mishap’’
in § 401.7. The FAA specified in the
final rule that part 420 licensees must
prepare mishap plans that meet
§ 450.173(b) through (f), including
allocation of roles and responsibilities
between the launch operator and site
operator for reporting, responding to,
and investigating any mishap during
ground activities at the site, to specify
the scope of the mishap plan more
accurately. The FAA also deletes the
word ‘‘response’’ in § 420.59(a) since
§ 450.173 and the rest of § 420.59 refer
to a ‘‘mishap plan,’’ not a ‘‘mishap
response plan.’’
AIA and Virgin Galactic commented
that the term ‘‘failure of a safety
organization’’ in the ‘‘mishap’’
definition was unclear. The FAA notes
this term previously appeared under
‘‘launch incident’’ and ‘‘reentry
incident’’ in § 401.5. ‘‘Failure of a safety
organization’’ occurs when an operator
fails to complete an action expected or
required by the safety organization, or
when the organization stops functioning
normally, such that it creates a public
safety risk. For example, the FAA would
consider an operator’s failure to follow
existing safety processes or procedures,
thereby placing the public at risk, a
failure of a safety organization.
Additional examples include (1) the
failure of operator personnel to
communicate a hold condition upon a
violation of launch commit criteria, (2)
a safety official failing to report
potential safety matters to the mission
director, or (3) the failure of an
organization to recognize and mitigate a
hazard, resulting in a public safety risk.
No change was made to the regulation
based on this comment.
SpaceX and Virgin Galactic sought
clarification on the meaning of ‘‘high
risk’’ of causing serious or fatal injury
and ‘‘substantial damage’’ to property.
SpaceX requested examples of high risk
versus non-high risk events. AIA asked
how the FAA would determine whether
an event rises to the level of ‘‘high risk.’’
Virgin Galactic recommended ‘‘high
risk’’ be defined in § 401.5 as an event
that would have caused a casualty had
one or more humans been present.
The FAA has used ‘‘high risk’’ of
causing serious or fatal injury to define
‘‘human space flight incident’’ in
§ 401.5. As stated in the FAA’s
‘‘Answers to Clarifying Questions
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79680
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Received by June 28, 2019,’’ 184 the FAA
would consider any off-nominal event
during pre-flight or flight operations
that posed a high probability of fatality
or serious injury to spaceflight
participants, crew, government
astronauts, or the public, to be ‘‘high
risk.’’ The FAA stated in the NPRM that
it would determine on a case-by-case
basis whether damage to property not
associated with the licensed activity is
‘‘substantial damage,’’ based on such
factors as direct replacement cost, repair
cost, and the property’s intended use
and functionality. When making a
substantial damage determination, the
FAA will include damage caused by
debris impacts, toxic plumes, and fires
ignited by the vehicle or its debris. The
FAA provided, as an example, structural
damage to public property exceeding 50
percent of its market value, such as a
failed launch attempt with debris
impacts outside a defined hazard area
resulting in a post-impact fire and loss
of a residential structure. The FAA will
evaluate unplanned damage to property
associated with a licensed or permitted
activity on the same bases. Examples
might include a major repair or
replacement of launch facilities due to
an unsuccessful launch attempt,
including processing facilities, launch
pads, or propellant tanks, based on cost
of repair or replacement or loss of use.
Similar to the NTSB’s definition of
‘‘substantial damage’’ (49 CFR 830.2),
under paragraph (6) of the ‘‘mishap’’
definition in § 401.7, the FAA may
deem any damage that adversely affects
the structural strength, performance, or
flight characteristics of a launch or
reentry vehicle which normally require
major repair or replacement of the
affected component, to be substantial.
The FAA declines Virgin Galactic’s
suggested definition of ‘‘high risk’’
because the suggested standard is too
narrow and would exclude serious
injury short of fatality. As noted above,
the FAA would consider any offnominal event during pre-flight or flight
operations that pose a high probability
of fatality or serious injury to spaceflight
participants, crew, government
astronauts, or the public, to be high risk.
The FAA intends ‘‘high risk’’ to cover
events akin to a near miss or close-call.
This approach is consistent with USAF
and NASA practices. Virgin Galactic’s
suggestion would prove impracticable,
requiring near certainty that a casualty
would have occurred.
Virgin Galactic recommended the
FAA prescribe a timeline and specific
process for determining whether ‘‘high
risk’’ or ‘‘substantial damage’’ occurred.
184 See
FAA–2019–0229–0106.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Virgin Galactic suggested the FAA
develop such a process and incorporate
it elsewhere in the regulations, not in
the definition of ‘‘mishap.’’ Virgin
Galactic argued the FAA should have no
more than 14 days to make these
determinations in order to minimize
operational impacts.
It would not be appropriate to limit
the time frame or implement procedures
to determine whether an event posed a
high risk of causing serious or fatal
injury or resulted in substantial damage
to property. Although the FAA will
begin to evaluate a mishap upon
receiving notice and details of the event,
the rate at which the FAA can make
these determinations will necessarily
depend on the attendant circumstances
and information supplied by the
licensee. Moreover, the FAA retains the
ability to modify its determination upon
receipt of new information about the
mishap.
SpaceX recommended the FAA
remove ‘‘government astronauts’’ from
the ‘‘mishap’’ definition because, unlike
the uninvolved public, those
individuals accept risk by virtue of their
informed involvement in a vehicle’s
flight. Acceptance of risk does not
preclude a fatality or serious injury from
being considered a mishap. The FAA
removes the references to space flight
participants, government astronauts,
and crew from the ‘‘mishap’’ definition
to make it clear that the FAA will deem
any fatality or serious injury associated
with licensed or permitted activity a
mishap irrespective of whether persons
are involved in the licensed activity.
SpaceX recommended the Class 2
definition be limited to events ‘‘during
a licensed or permitted activity,’’ rather
than events ‘‘associated with’’ licensed
or permitted activity. The commenter
offered no rationale for temporally
limiting the criteria now described in
paragraphs (2) through (5) of the
‘‘mishap’’ definition, and the FAA sees
no reason to do so. The FAA would only
deem a mishap those events that are
within the scope of the FAA’s statutory
authority. No change to the regulation is
made based on this comment.
Sierra Nevada commented that
treating the impact of a vehicle,
payload, or components thereof
‘‘outside the designated area’’ as a
mishap was overly prescriptive and
unrealistic. Sierra Nevada commented
that since hazard areas are generated as
probability contours, not contours of
total containment, debris could
realistically exist outside the hazard
area that would not warrant segregation
in the event of a breakup scenario.
Sierra Nevada also recommended
removing from proposed § 450.173(d)
PO 00000
Frm 00116
Fmt 4701
Sfmt 4700
the requirement to report vehicle or
debris impact points outside the hazard
area to the FAA, which it claimed was
burdensome, cost prohibitive, and
unreasonable.
The criterion cited by Sierra Nevada,
now captured in paragraph (8) of the
mishap definition, does not require
licensees to track every possible piece of
debris in an off-nominal scenario, but
rather only debris that presents a hazard
to the public. The proposed criterion
closely followed the definitions of
‘‘launch accident’’ and ‘‘reentry
accident’’ in § 401.5, but used ‘‘hazard
area’’ in lieu of ‘‘impact limit lines’’ and
‘‘designated’’ landing or reentry site, to
be consistent with the hazard analysis
framework set forth in part 450. To
clarify the scope of this mishap
criterion, the FAA replaces the term
‘‘vehicle or debris’’ in paragraph (8)
with the term ‘‘hazardous debris,’’
which is defined in § 401.7. Thus, this
criterion applies to the impact of
hazardous debris (i.e., debris capable of
causing a casualty or loss of
functionality to a critical asset) outside
the planned landing site or hazard area.
The occurrence of debris outside the
hazard area that does not meet the
definition of ‘‘hazardous debris’’ in
§ 401.7 is not a mishap.
The FAA similarly revises
§ 450.173(c)(3)(iv) to require that
operators identify ‘‘hazardous debris’’
impact points as part of a preliminary
mishap report, so that the FAA can
assess potential public safety risks. The
FAA makes this change to be consistent
with the new definition of ‘‘hazardous
debris,’’ and it is consistent with the
intent of the proposed regulation. The
FAA also replaces the term ‘‘impact
area’’ with the term ‘‘designated hazard
area’’ to be consistent with the
terminology used in the mishap
definition. This revision does not
change the scope of the requirement
from the NPRM; the FAA only requires
an operator to report the hazardous
debris impact locations, not all debris
impact locations. Use of the term
‘‘hazard area’’ is also consistent with
requirements for an operator to establish
‘‘hazard areas’’ under part 450 to protect
the public from hazards associated with
their operations.
The requirement to track and report
hazardous debris is reasonable, given
that operators must employ vehicle
tracking for normal flight, and
hazardous debris falling outside the
designated area poses a serious risk to
public safety. In the event of a vehicle
breakup, operators should be able to
approximate any hazardous debris
impacts in relation to the designated
landing site or hazard area based on the
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
vehicle’s last-known state vector or
other tracking resources required for
normal flight.
ii. Mishap Plan (§ 450.173)
In the NPRM, the FAA proposed to
consolidate mishap planning, reporting,
response, and investigation
requirements under proposed § 450.173.
The FAA also proposed to revise
§§ 420.59 and 437.41 to require an
applicant to submit a mishap plan that
meets the requirements of § 450.173.
Proposed § 450.173(c) required an
operator to report to and cooperate with
FAA and NTSB investigations and
designate one or more points of contact
for the FAA and NTSB. Proposed
§ 450.173(d) required operators to notify
the FAA of mishaps and submit a
preliminary report within certain time
frames. Proposed § 450.173(f) required
that, in the event of a mishap, an
operator must investigate the root
causes of the mishap and report
investigation results to the FAA.
Virgin Galactic broadly expressed
support for the proposed rule. Boeing,
Lockheed Martin, Northrop Grumman,
and ULA recommended adding to
proposed § 450.173(f) a requirement for
licensees to support any NTSB or
government agency-led mishap
investigation and to cooperate with any
other government investigative agencies.
The FAA declines to incorporate the
suggested addition. Upon review of the
NPRM and comments received, the FAA
determines that the requirement
originally proposed in § 450.173(c)
regarding NTSB and FAA cooperation is
unnecessary. Section 450.13 (Rights Not
Conferred by a Vehicle Operator
License) plainly states that issuance of
a license does not relieve a licensee of
its obligation to comply with all
applicable requirements of law or
regulation. The duty of operators to
comply with lawful investigations,
whether conducted by the FAA or
another entity with investigative
authority, exists irrespective of the
language proposed in § 450.173(c).
Accordingly, the FAA removes
proposed § 450.173(c) from the final
rule. For the same reason, the FAA also
removes paragraph (b)(2) from proposed
§ 420.59 (Mishap Plan). Operators
remain responsible for reporting
investigation results to the FAA under
§ 450.173(e).
Sierra Nevada asked whether
licensees must coordinate with the FAA
and NTSB for all mishaps. For the
reasons stated above, the FAA removed
the requirement proposed in
§ 450.173(c).
The National Fire Protection
Association (NFPA) recommended the
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
FAA revise proposed § 450.173(e),
which contained emergency response
requirements, to require a level of safety
based on its spaceport fire safety and
emergency response standards. The
FAA supports the development of
industry consensus standards for fire
safety and emergency response, but
disagrees that it would be appropriate to
prescribe such a code or standard in this
performance-based rule.
In addition to removing proposed
§ 450.173(c), the FAA replaces the term
‘‘vehicle and debris impact points,
including those outside a planned
landing or impact area’’ in proposed
§ 450.173(d)(3)(iv) with the term
‘‘hazardous debris impact points,
including those outside a planned
landing site or designated hazard area’’
in § 450.173(c)(3)(iv).185 This change is
consistent with changes previously
discussed in the preamble. Lastly, the
FAA revises the emergency response
requirements in § 450.173(d)(1) to
include the term ‘‘property’’ because, as
discussed in this preamble, the FAA
removed the reference to ‘‘property’’
from the definition of ‘‘public’’ in
§ 401.7. The FAA adopts the rest of this
section of the proposed rule without
change.
iii. Test-Induced Damage (§ 450.175)
In the NPRM, the FAA proposed to
give license applicants and licensees the
option to pre-coordinate testing
activities with the FAA. This precoordination would take place during
FAA-licensed activities to prevent the
FAA from labeling test failures or
associated damage as mishaps.
In the final rule, the FAA adopts
§ 450.175 with a modification. Section
450.175 will only apply to licensees or
license applicants seeking this
exception. The FAA will consider test
failures and damage covered by this
section, including damage to ground
support equipment, ground support
systems, and flight hardware, as testinduced damage and not a mishap, so
long as the failure falls within the precoordinated scope and FAA-approved
testing profile. Any mishap resulting in
a serious injury or fatality, damage to
property not associated with the
licensed activity, or hazardous debris
leaving the pre-defined hazard area, will
be treated as a mishap and not testinduced damage, and will be subject to
the reporting, response, and
investigation requirements of § 450.173.
Several commenters expressed
confusion about the effect of proposed
185 The FAA removes proposed § 450.173(c) from
the final rule and re-designates § 450.173(d) through
(h) as § 450.173(c) through (g).
PO 00000
Frm 00117
Fmt 4701
Sfmt 4700
79681
§ 450.175 on the part 450 licensing
process. Boeing, Leo Aerospace,
Lockheed Martin, Northrop Grumman,
and ULA asked how test-induced
damage would impact the licensing
process. Boeing also commented that all
planned test operations within the
scope of a license should be assessed for
public risk during the application
process. Blue Origin asked what type of
test is contemplated by ‘‘test-induced
damage,’’ and if it would include tests
conducted at a launch site with colocated test facilities, as opposed to
integrated vehicle tests that traditionally
happen at a launch site. Sierra Nevada
and Microcosm commented that testing
was outside the FAA’s jurisdiction, and
the proposed regulation should only
apply to damage induced by a test
performed under a license.
The test-induced damage exception
set forth in § 450.175 only applies to
license applicants or licensees seeking a
mishap exception for test activities
conducted during licensed activities.
The test-induced damage exception is
optional. To clarify that the test-induced
damage exception is optional, the FAA
adds paragraph (a) (Applicability),
which states that § 450.175 only applies
to license applicants or licensees who
choose to pre-coordinate and apply for
an optional test-induced damage
exception. The FAA also replaces the
word ‘‘operator’’ with the term ‘‘license
applicants or licensees’’ to clarify that
this provision is only available through
the part 450 licensing process.
Experimental permittees under part 437,
by contrast, cannot seek to precoordinate test-induced damage with
the FAA.
The exception does not apply to test
activities that are not associated with
FAA-licensed activities, nor to any
activities outside FAA jurisdiction. The
information submitted by the applicant
will define the scope and type of test
activities considered for test-induced
damage. The FAA confirms that all
planned test operations occurring
during the scope of a license will be
assessed for public safety risks. As
stated in the FAA’s ‘‘Answers to
Clarifying Questions Received by June
28, 2019,’’ test-induced damage refers to
damage expected to occur as part of a
licensed activity approved by the FAA
prior to the operation. An applicant
must identify expected outcomes and
potential risks associated with the
proposed test activity. The FAA expects
an applicant to identify potential failure
outcomes and their consequences or
risks, and plan for them appropriately.
In order to except damage from
becoming a mishap, the applicant needs
to identify that potential damage to the
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79682
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
FAA. Unanticipated test damage may be
excepted if it results from activities
conducted within the scope of the FAA
approval, and does not result in any of
the events listed in § 450.175(b)(2).
To seek an exception, an applicant
must submit the information listed in
§ 450.175(c) to the FAA in advance with
sufficient time to evaluate the proposal.
Although the FAA anticipates the
amount of time required to evaluate an
applicant’s proposal will be minimal,
the scope of review required will vary
based on the proposed test activities and
completeness of information provided.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA recommended
without explanation that the subheading
for proposed § 450.175(a) be changed to,
‘‘Coordination of risk of test-induced
damage.’’ The FAA declines to
incorporate this recommendation, as it
does not accurately describe the
coordination set forth in § 450.175. The
possibility of test-induced damage is
assumed under § 450.175. Identification
of potential risks associated with a
testing activity is but one of the items
applicants must submit to seek an
exception under this section. The FAA
agrees, however, that the proposed text
was unclear, as the heading used the
term, ‘‘anticipated,’’ which does not
appear in § 450.175. Accordingly, the
FAA revises the subheading for
§ 450.175(b) to clarify that operators
would be coordinating ‘‘potential,’’
rather than ‘‘anticipated,’’ test-induced
damage.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA also recommended,
without explanation, that applicants be
required to coordinate test-induced
damage with any affected third parties
or public authorities, in addition to the
FAA. The FAA declines to incorporate
this recommendation. Section 450.175
provides a process for license applicants
and licensees to pre-coordinate with the
FAA test-induced damage that would
otherwise fall under the FAA’s
definition of ‘‘mishap.’’ The FAA is the
only entity with whom coordination
will be needed to seek exception from
the FAA’s ‘‘mishap’’ definition. It
should be noted, however, that precoordination of test-induced damage
under this section will not affect the
duty of licensees to comply with all
other requirements of their license, and
with all other applicable laws and
regulations.
In reference to what is now
§ 450.175(b)(2), Boeing recommended
the FAA take into consideration insight
gleaned from near-misses, noting that
while a test may not have resulted in
damage, the same anomaly could induce
significant damage in a similar
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
operational sequence. The FAA
acknowledges the commenter’s concern
for the net effect of unreported
anomalies but finds it unnecessary to
change the regulatory text. Section
450.175 provides an exception to the
‘‘mishap’’ definition. Test-induced
damage that exceeds the scope of FAAapproved activities will be treated as a
mishap. It is possible for an anomaly to
occur during pre-coordinated test
activities. Any condition during
licensed or permitted activity (including
pre-coordinated test activity) that
deviates from what is standard, normal,
or expected during verification or
operation of a system, process, facility,
or equipment is an anomaly under
§ 401.7. Given that § 450.215 (Post-flight
Reporting) requires operators to identify
anomalies and corrective actions taken
in response in their post-flight report,
the FAA finds it will have notice of the
‘‘near-miss’’ anomalies referenced by
the commenter.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA recommended that
proposed § 450.175(c) be made
consistent with ground hazard analysis
requirements in proposed § 450.185 or
be deleted altogether. The FAA
disagrees with this comment because
the requirements of § 450.185 apply to
the entire launch and reentry vehicle
lifecycle, and are therefore much more
comprehensive than the information
requirements for test-induced damage.
Imposing ground hazard analysis
requirements would place an undue
burden on applicants seeking a testinduced damage exception. Moreover,
the test-induced paradigm is intended
for the testing of a specific system,
function, or component during licensed
activities. As stated in the NPRM, the
test-induced damage exception is not
available for the operation of an entire
vehicle, but rather the testing of specific
components and systems. Lastly, unlike
the ground hazard analysis
requirements, the information
requirements of § 450.175(c) only apply
to applicants seeking a mishap
exception for damage resulting from
specific test activities taking place
within a defined time-period, as
coordinated with and approved by the
FAA.
pp. Unique Safety Policies,
Requirements and Practices (§ 450.177)
In the NPRM, the FAA proposed
requirements under § 450.177 for
operators to implement unique policies,
requirements, and practices needed to
protect the public health and safety,
safety of property, and the national
security and foreign policy interests of
the United States. Proposed § 450.177(a)
PO 00000
Frm 00118
Fmt 4701
Sfmt 4700
would require an operator to review
operations, system designs, analysis,
and testing, and to identify any unique
launch or reentry hazards not otherwise
addressed by proposed part 450.
Proposed § 450.177(b) would provide
that the FAA may identify and impose
a unique policy, requirement, or
practice, as needed, to protect the public
health and safety, safety of property,
and the national security and foreign
policy interests of the United States.
In the final rule, the FAA adopts
§ 450.177 (Unique Safety Policies,
Requirements and Practices) with two
revisions. For the reasons discussed
below, the FAA removes the references
to property protection and national
security and foreign policy interests of
the United States, and adds ‘‘safety’’ to
the section title.
CSF, Sierra Nevada, and Spaceport
Strategies commented that proposed
§ 450.177(b) expanded regulatory
uncertainty by allowing the FAA to
impose new requirements when needed
to protect public health and safety,
safety of property, and national security
or U.S. foreign policy interests. CSF
noted that part 417 previously allowed
the FAA to impose new requirements
when needed ‘‘to protect the public.’’
CSF and Sierra Nevada commented that
proposed § 450.177(b) expanded the
FAA’s ability to impose requirements on
an operator outside of regulatory
process even if the operator met all
other criteria. The commenters
suggested that the ability to impose
unknown requirements as a result of
innovation will adversely impact costs
and could have a chilling effect on
innovation and investments in U.S.
space industries if the FAA’s discretion
under proposed § 450.177 was
unbounded. They further contended
that the proposed requirement would
give the FAA discretion to impose new
requirements ‘‘as-needed’’ and result in
no cost savings. CSF also expressed
concern that such requirements could
be inequitably imposed on a singular
licensee or disparately among licensees
developing similar technologies or
operational approaches. CSF
recommended the FAA be required to
collaborate with the operator or with
industry before requiring a unique
policy, rule, or practice. CSF and Sierra
Nevada recommended the rule be
bounded to limit the scope and timeline
for the FAA to impose restrictions, and
give applicants due process.
The FAA agrees that it is unnecessary
to include hazards to the national
security and foreign policy interests of
the United States under this section
because those considerations are
adequately covered under policy and
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
payload reviews in part 450. In the final
rule, the FAA removes ‘‘national
security and foreign policy interests of
the United States’’ from § 450.177(b)
and (c)(2).
In the final rule, the FAA also
removes ‘‘safety of property’’ from
§ 450.177(b) and (c). As explained in
other parts of this preamble, the FAA is
retaining in the final rule only specific
requirements for property protection
(e.g. critical assets, property on orbit),
which have specific safety criteria.
Operators may be required to mitigate
hazards to property through emergency
response requirements in § 450.173(d),
but otherwise, the FAA declines to
impose a more specific property
protection requirement at this time.
Removal of the references to property
protection and national security and
foreign policy interests largely
dispenses with the commenters’
concerns that § 450.177 would expand
the scope of § 417.127. Although the
final rule retains the provision in
§ 450.177(b) regarding FAA’s ability to
impose a unique requirement, policy, or
practice needed to protect public health
and safety, the FAA does not foresee a
substantive change for operators from
§ 417.127, which provides that FAA
may impose such unique requirements
as needed to protect the public.
The FAA’s authority to impose a
unique requirement, policy, or practice
is bounded, as it is in § 417.127, by the
FAA’s statutory authority to protect
public health and safety. The FAA
understands the concern expressed by
Spaceport Strategies and others that the
imposition of unique policies,
requirements, or practices deemed
necessary by the FAA to protect public
health and safety has the potential to
impose additional costs on the operator.
However, given the rarity of the FAA’s
invocation of § 417.127, and the
prosperity of today’s commercial space
industry under part 417, the FAA does
not foresee any additional costs to
operators or a chilling of innovation
resulting from § 450.177.
Moreover, as discussed in the NPRM
preamble, the necessity for § 450.177 is
the same as that for § 417.127: The FAA
expects that advances in technology and
implementation of innovations by
launch and reentry operators will likely
introduce new and unforeseen safety
challenges. These advances and
innovations can present regulatory
challenges that are unforeseen in
existing regulations. In this case, the
FAA must work with operators on a
case-by-case basis to identify and
mitigate those unique hazards posed to
public health and safety, which are not
addressed by part 450. The FAA expects
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
the need for the use of this provision to
be rare, as has the need to use § 417.127,
due to the comprehensiveness and
performance-based nature of part 450. In
the rare instance that it is used, the FAA
will work with the operator to reach a
mutually satisfactory solution that
allows the activity while protecting
public health and safety, but the FAA
declines to require collaboration in the
regulation, as CSF suggests.
qq. Ground Safety (§ 450.179 to
§ 450.189)
i. Ground Safety General (§ 450.179)
In the NPRM, the FAA proposed that
an operator would be required to protect
the public from the adverse effects of
hazardous operations and systems
associated with preparing a launch
vehicle for flight, returning a launch or
reentry vehicle to a safe condition after
flight, or after an aborted launch
attempt, and returning a site to a safe
condition.
In the final rule, the FAA adopts
§ 450.179 with revisions.186 This final
rule moves proposed subsections (b)
and (c) to § 450.179(a)(1) through (3)
and adds new subsections (b) and (c).
These additions are discussed in more
detail in the preamble section
addressing Launch and Reentries from a
Federal Launch or Reentry Site.
ii. Coordination With a Licensed
Launch or Reentry Site Operator
(§ 450.181)
In the NPRM, the FAA proposed that
an operator would be required to
coordinate with site operators as both
entities have public safety obligations
during ground operations. Operators
would be required to coordinate with
site operators to ensure that access to
public sites is controlled and prevent
unsafe interference of ground hazards.
For a launch or reentry conducted from
or to an FAA licensed site, an operator
would be required to coordinate mishap
reporting, response, and investigations
with the site operator for any mishap
during ground activities at the site.
In the final rule, the FAA adopts
§ 450.181 as proposed with two
exceptions. In § 450.181(a)(3), the
ground hazard areas must be
coordinated with a site operator during
the designation of those ground hazard
186 Proposed § 450.179 required an operator at a
U.S. launch or landing site to protect the public
from adverse effects of hazardous operations and
systems. The FAA changed ‘‘protect the public’’ to
‘‘protect the public and property’’ in the final rule.
This change is because, as discussed earlier in this
preamble, property was removed from the
definition of ‘‘public.’’ Thus, ‘‘property’’ was added
to this section to keep the requirement equivalent
to what was proposed.
PO 00000
Frm 00119
Fmt 4701
Sfmt 4700
79683
areas. In the final rule, the FAA changes
the language used to describe this
coordination to ‘‘[t]he designation of
any ground hazard area that affects the
operations of a launch or reentry site is
coordinated with the Federal or licensed
launch or reentry site operator.’’ This
amended language is a minor
grammatical change and is consistent
with the intent of the proposed
requirement. In addition, proposed
§ 450.181(a)(4) required an operator to
coordinate with a site operator to
ensure, in part, prompt and effective
response in the event of a mishap that
could impact ‘‘public safety.’’ In the
final rule, the FAA changes this
phrasing to require that a prompt and
effective response ‘‘is undertaken’’ in
the event of a mishap that could impact
‘‘the safety of the public and property.’’
The FAA changes ‘‘public safety’’ to
‘‘the safety of the public and property’’
in the final rule because, as discussed
earlier in this preamble, property was
removed from the definition of
‘‘public.’’ Thus, the FAA makes this
wording change to keep the requirement
equivalent to what was proposed. The
FAA adds ‘‘is undertaken’’ as a minor
grammatical change that is consistent
with the intent of the proposed
requirement.
Sierra Nevada commented that
proposed § 450.181 seems to be
duplicative of proposed § 450.147
(Agreements) and thus should be
removed. While agreements made with
a Federal or licensed site operator may
satisfy the requirements of § 450.181,
the FAA finds the requirement to
coordinate with a site operator specifies
what coordination must be in place to
prevent unsafe interference among users
of a site and ensure clear lines of
responsibility for related aspects of
public safety. The FAA concurs that an
applicant may be able to show
compliance with both requirements by
providing an agreement that shows
compliance with the specific criteria in
§ 450.181. However, the two
requirements are different and
intentionally separate. Specifically,
§ 450.181 provides additional detail
about coordination that is necessary for
public safety because improperly
coordinated neighboring operations that
occur on or near the launch site have
the ability to create hazards to the
public. In addition, the agreement
required by § 450.147 is not an
application deliverable, whereas
§ 450.181 requires an application
deliverable. Accordingly, the FAA
adopts both §§ 450.181 and 450.147.
Denver International Airport
commented that, although it supported
the proposed requirements for
E:\FR\FM\10DER2.SGM
10DER2
79684
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
coordination with site operators, these
requirements were too narrow to keep
site operators and surrounding
communities properly informed. Denver
International Airport also commented
that operators should be required to
coordinate on launch and reentry
activities and mishaps with a wider
group of interested and affected
stakeholders, including first responders
and local governments. Similarly,
AAAE proposed that licensed operators
be required to notify contingent landing
sites and nearby airports of safety
hazards, including providing them with
the ground safety hazard analysis.
AAAE suggested such notifications
could be accomplished as part of the
notifications required in proposed
§ 450.147 or as part of a broader public
disclosure.
The FAA notes that the notification
requirements in § 420.57 require
licensed site operators to notify local
officials and adjacent landowners of
flight schedules. In addition, § 450.147
requires vehicle operators to have
agreements with any sites or services
that are necessary to meet the safety
requirements for a license. These
requirements serve to notify the
necessary entities about licensed
operations. Including notification
requirements beyond those in §§ 420.57
and 450.147 is outside the needs of this
rulemaking to protect public health and
safety, safety of property, and national
security and foreign policy interests of
the United States.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA recommended the
FAA revise proposed § 450.181(a)(3) to
require only that coordination ensure
that any ground hazard areas are
identified. The FAA does not find the
commenters’ recommendation sufficient
to protect public safety and avoid
adverse impacts on neighboring space
operations. The vehicle operator must
take an active role in ensuring the site
operator is aware of ground hazard areas
and how they may impact other site
operations.
jbell on DSKJLSW7X2PROD with RULES2
iii. Explosive Site Plan (§ 450.183)
In the NPRM, the FAA proposed to
require an applicant to include an
explosive site plan as part of its vehicle
operator license application for a launch
or reentry from or to a site exclusive to
its own use. This plan would be
required to demonstrate compliance
with the explosive siting requirements
in part 420.
In the final rule, the FAA adopts
§ 450.183 (Explosive Site Plan) as
proposed. The FAA received no
comments on this section.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
iv. Ground Hazard Analysis (§ 450.185)
In the NPRM, the FAA proposed an
operator would be required to complete
a ground hazard analysis that would
include an assessment of the launch or
reentry vehicle, the launch or reentry
integrated systems, ground support
equipment, and other site hardware. In
its analysis, an applicant must identify
hazards; include a risk assessment; and
identify and describe mitigations,
controls, and provisions for hazard
control verification and validation.
Although the analysis might incorporate
aspects of employee safety and mission
assurance, an applicant would only be
required to identify the hazards that
affect the public and describe how those
hazards are mitigated.
In the final rule, the FAA adopts
§ 450.185 as proposed, with minor edits
to remove the reference to ‘‘public
property’’ because ‘‘property’’ has been
removed from the final rule’s definition
of ‘‘public,’’ as discussed in the
preamble section for Neighboring
Operations Personnel. Instead, the FAA
refers to ‘‘property not associated with
the launch or reentry.’’
In response to the proposed
requirements, NFPA suggested its own
standards as guidance for complying
with proposed §§ 450.179, 450.185, and
450.189. Space Florida also commented
that the FAA did not provide clear
guidance on what standards would be
acceptable and how the agency would
judge the sufficiency of the ground
hazard analysis. Space Florida did not
recommend a specific change to
proposed § 450.185.
In response to NFPA’s comment, the
FAA notes that applicants are free to
explore the use of any industry standard
to demonstrate compliance with these
sections. If the industry standard has
not already been accepted by the FAA,
the FAA would review the proposed
standard as part of an applicant’s
application. NFPA is also welcome to
submit its standards to the FAA for
acceptance at any time.
In response to Space Florida, the FAA
recommends that the applicant identify
proposed standards and common
practices during pre-application
consultation to reach an agreement with
the FAA on their applicability for
proposed operations. For items that may
deviate from current standards and
practices, the FAA may seek additional
justification or analysis to determine
whether ground hazards pose a risk to
public safety.
Virgin Galactic asked the FAA to
retain the ground safety analysis
practices used under part 431 and not
to impose proposed § 450.185. Virgin
PO 00000
Frm 00120
Fmt 4701
Sfmt 4700
Galactic also asked that existing launch
vehicles be ‘‘grandfathered.’’ Finally,
Virgin Galactic commented that
conducting a ground hazard analysis
would place a cost burden on hybrid
vehicle operators and asked the FAA to
outline its reasoning for imposing the
requirement on hybrid operators.
The FAA discusses Virgin Galactic’s
question regarding cost burden in the
preamble section addressing Responses
to Regulatory Impact Analysis
Comments. Part 431 does not have an
explicit ground safety requirement, and
as a result it is often difficult for
applicants to ascertain how to meet the
safety standard for pre-flight operations.
Concurrently, the ground safety
requirements in part 417 are overly
prescriptive and onerous. The ground
hazard analysis requirements in part
450 strike a balance between the two
parts, providing additional guidance to
applicants, while at the same time
preserving flexibility.
An operation that was licensed prior
to the effective date of this rulemaking
will be permitted to continue under its
license for five years from the effective
date or when the license expires if the
operator does not seek a renewal. For
further discussion, please see the
preamble section on Legacy Licenses.
All regulated operators, including
hybrid launch or reentry systems
operators, will need to prepare a ground
hazard analysis to ensure public safety
is protected. Hybrid launch or reentry
vehicles may still pose a risk to the
public; therefore, the FAA imposes its
ground hazard analysis requirements on
hybrid launch vehicles in order to
identify and mitigate those risks. Some
launch or reentry systems will have very
limited ground hazards, and thus the
ground hazard analysis will be similarly
limited. An operator would not need its
ground hazard analysis to include
carrier aircraft activities that do not
constitute launch or reentry.187
Boeing, Lockheed Martin, Northrop,
and the ULA recommended the FAA
modify proposed § 450.185(a) by adding
that a ground hazard analysis must
identify system and operation hazards
posed by the vehicle ‘‘and any of its
components.’’ The FAA does not adopt
this change because any requirement
levied on the vehicle also necessarily
includes the vehicle’s components.
CSF, Sierra Nevada, and Space
Florida recommended that the FAA
consider an alternative regulatory
approach giving site operators more
187 Such activities may include, for example,
activities conducted by a carrier aircraft without a
rocket attached when the carrier aircraft plus rocket
constitutes the launch vehicle.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
authority over ground safety.
Specifically, CSF and Sierra Nevada
recommended that the FAA consider an
alternative regulatory approach that
would give the responsibility for
assessing and controlling ground safety
and hazards mitigations to the site
operator.
Historically, the launch or reentry
operator has been responsible for
ground safety and, as reflected in the
NPRM, the FAA determined that this
allocation of responsibility was
appropriate given that the operator has
the most comprehensive understanding
of the parameters of the licensed
activity. The FAA expects that the
launch or reentry operator will work
closely with the site operator to ensure
all requirements are met. Accordingly,
the FAA retains the proposed language
in the final rule.
v. Ground Safety Prescribed Hazard
Controls (§ 450.189)
In the NPRM, the FAA proposed that
an operator would be required to
implement certain prescribed hazard
controls during the ground operations
period of launch or reentry. These
prescribed hazard controls would
require that an operator document how
it would protect members of the public
who enter areas under the operator’s
control, and mitigate hazards created by
a countdown abort. They would also
require the operator to establish plans
for controlling fires and emergency
procedures. In the final rule, the FAA
adopts § 450.189 as proposed.
AAAE suggested licensed operators be
required to notify nearby airports and
contingent landing sites of potential
safety hazards and their controls,
including those described under this
section and proposed § 450.185. The
notification requirements in § 420.57
require licensed site operators to notify
local officials and adjacent landowners
of flight schedules. In addition,
§ 450.147 requires vehicle operators to
have agreements with any sites or
services that are necessary to meet the
safety requirements for a license. These
requirements serve to notify the
necessary entities about licensed
operations.
jbell on DSKJLSW7X2PROD with RULES2
5. Part 450 Subpart D—Terms and
Conditions of a Vehicle Operator
License
a. Public Safety Responsibility,
Compliance With License, Financial
Responsibility, Human Spaceflight
Requirements (§§ 450.201 to 450.207)
In the NPRM, the FAA proposed
requirements addressing how a licensee
is responsible for ensuring public safety
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
and safety of property during the
conduct of a licensed launch or reentry
in proposed § 450.201, how a licensee
would be required to comply with a
license in proposed § 450.203
(Compliance with License), with
financial responsibility requirements of
part 440 in proposed § 450.205
(Financial Responsibility
Requirements), and with human
spaceflight requirements in part 460 in
proposed § 450.207 (Human Spaceflight
Requirements).
In the final rule, the FAA adopts the
requirements as proposed. The FAA
received no comments on these
proposals.
b. Compliance Monitoring (§ 450.209)
In the NPRM, the FAA proposed to
combine the compliance monitoring
requirements of §§ 417.23 and 431.83 in
§ 450.209. The FAA also proposed to
allow an operator the option to provide
the FAA with means other than a
console for monitoring the
communication and countdown
channels. The compliance monitoring
requirements of proposed § 450.209
would apply to all launch and reentry
operations. Finally, proposed § 450.209
codified the FAA practice for
conducting compliance monitoring of
part 435 operations. In final rule, the
FAA adopts § 450.209 as proposed.
Virgin Galactic expressed concern
regarding proposed § 450.209(b), which
stated a licensee must provide the FAA
with the capability to communicate
with the mission director. Virgin
Galactic suggested replacement
language that gave the operator the
responsibility for assigning a radio
communications point-of-contact for the
FAA during operations. The FAA does
not adopt this suggestion because the
FAA must have direct contact with the
mission director during licensed
operations to ensure any risk to public
safety during ongoing operations is
immediately addressed. It will continue
to be FAA practice not to contact the
mission director unless there is an
immediate and urgent risk to public
safety.
The FAA also deletes § 450.209(c)
because it imposed a requirement only
on the FAA and was unnecessary legacy
language.
c. Continuing Accuracy of License
Application; Application for
Modification of License (§ 450.211)
In the NPRM, the FAA proposed to
preserve the continuing accuracy
requirements in §§ 417.11 and 431.73,
and consolidate them in proposed
§ 450.211. In addition, the FAA
proposed to allow an applicant to
PO 00000
Frm 00121
Fmt 4701
Sfmt 4700
79685
request approval of an alternate method
for requesting license modifications
during the application process.
In the final rule, the FAA adopts
§ 450.211 as proposed with only a minor
revision to split the second requirement
in proposed § 450.211(a) into a new
§ 450.211(b). Accordingly, proposed
§ 450.211(b) and (c) were renumbered to
become § 450.211(c) and (d) in the final
rule, respectively.
CSF and SpaceX suggested that the
FAA could update § 413.17(a) to clarify
that it would agree to a modification to
an existing license when the FAA
accepts and approves a continuing
accuracy submission. CSF requested
that the FAA clarify its use of these
terms in an AC.
Virgin Galactic noted that operators
may have separate definitions for
continuing accuracy and license
modifications. Virgin Galactic proposed
what it believed to be simpler
requirements for continuing accuracy
updates and license modifications,
which in Virgin Galactic’s experience
aligned with how the FAA has
processed Virgin Galactic’s license and
license application updates over the
past three years. Specifically, Virgin
Galactic recommended that proposed
§ 450.211(a)(1) be rewritten to change
the requirement so that after a license
has been issued, a licensee would be
required to apply to the FAA for
modification of the license if the
licensee proposes to make changes that
affect the license, as issued by the FAA.
It also proposed to add the term
‘‘continuing accuracy updates’’ for
changes that a licensee proposes that do
not affect the license but do affect the
license application. Virgin Galactic
maintained that this approach would
provide schedule assurance for
operators, as license modification
usually involves time-intensive
coordination between the FAA and an
operator.
Sierra Nevada commented that
general edits to the listed documents
should not trigger the requirement of
continuing accuracy, as such a
requirement would create an extremely
burdensome amount of document
overhead an applicant would be
required to maintain that is not
necessary for maintaining public safety.
The FAA does not agree that the
suggested changes are necessary;
however, the FAA has split the two
requirements in § 450.211(a) so that the
application for modification of license is
in § 450.211(b) for added clarity. The
regulation states that a licensee is
responsible for the continuing accuracy
of representations contained in its
application. A license modification is
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79686
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
required only if the licensee proposes to
conduct a launch or reentry in a manner
not authorized by the license; or, if any
representation contained in the license
application that is material to public
health and safety or the safety of
property is no longer accurate and
complete, or does not reflect the
licensee’s procedures governing the
actual conduct of a launch or reentry.
For representations that do not meet
either of these criteria, such as
administrative information, § 450.211(b)
continues to require an applicant to
inform the FAA of the change in order
to ensure the representations made in
the application are accurate.
The NPRM preamble identified the
following as areas that constitute a
material change: Reuse, after an earlier
launch or reentry, of safety-critical
systems or components, requiring
refurbishment, re-qualification testing,
and re-acceptance testing. Virgin
Galactic believed performing
refurbishment and pre-flight testing of
reusable safety-critical systems or
components would not constitute a
material change that affects public
safety. Both vehicles of a hybrid RLV
launch system are reused, and pre-flight
testing and refurbishment are performed
prior to each mission. Virgin Galactic
recommended this reuse language be
stricken from the preamble because it is
not a material change to public safety.
The FAA clarifies that normal preflight testing and refurbishment that are
evaluated and accepted during a license
application are not considered a
material change. The FAA further
clarifies that only pre-flight testing and
refurbishment that is not evaluated
during a licensing process will be
considered a material change. As
discussed above, a material change is a
change that affects public safety that has
not been evaluated and authorized by
the FAA during the licensing process.
Virgin Orbit commented that some of
the changes noted in preamble, such as
retesting a valve or changing a safety
officer, should not require a
modification to a license. Virgin Orbit
recommended that what constituted a
material change should be based on how
the change affected public safety
elements contained within the FSA and
PSA. Virgin Orbit further recommended
that the FAA allow operators to
determine how the areas that
constituted a material change as
identified in the preamble affected the
public safety elements.
As noted earlier, a material change is
a change that affects public safety that
has not been evaluated and authorized
by the FAA during the licensing
process. These changes may go beyond
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
just the FSA and any PSA 188 as
suggested by Virgin Orbit. All public
safety requirements in part 450 are
applicable. The FAA does agree with
Virgin Orbit that the burden lies on the
operator to determine what constitutes a
material change. The FAA notes,
however, that an operator should
consult with the FAA regarding those
changes for which an operator is unsure
whether the change is material or not.
Virgin Orbit requested a definition of
a ‘‘minor’’ change. It further requested
that minor changes would not require a
full 180-day review period, and that the
regulation define a maximum review
time for minor changes. The FAA does
not distinguish between major and
minor changes, only those changes that
will or will not have a material impact
on public safety. Categorizing all
potential changes that have a material
impact on public safety into only two
categories is problematic due to the
variety of potential changes. The FAA
does agree, however, that not all
requests for modification would require
extensive review. Although the statutory
180-day review period does not apply to
modifications, the FAA makes every
effort to act upon all requests for
modifications in a timely manner. The
FAA is able to respond quickly if a
change is indeed minor.
d. Pre-Flight Reporting (§ 450.213)
In the NPRM, the FAA proposed to
require a licensee to provide the FAA
with the following information prior to
each launch or reentry: Mission-specific
information, FSA products, FSS test
data, data required by the FAA to
conduct a collision avoidance analysis,
and a launch or reentry schedule.
In the final rule, the FAA adopts
§ 450.213 with four revisions. First, in
§ 450.213(d)(2), the FAA replaces the
term ‘‘flight information’’ with ‘‘planned
mission information’’ because the
information required includes launch
site information, and the term ‘‘planned
mission information’’ is used in the
final § 450.208(d)(6). Second, the FAA
revises § 450.213(d) to allow an operator
the flexibility to identify an appropriate
time frame in coordination with the
FAA. Third, in § 450.213(e) the FAA
removes the reference to the time frames
to submit LCOLA data, which the FAA
has revised in the final rule, so that
§ 450.213(e) simply requires operators to
submit LCOLA data in accordance with
§ 450.169(f). Lastly, the FAA replaces
‘‘operator’’ with ‘‘licensee’’ throughout
the section to be consistent with the rest
188 As discussed earlier, the FAA removed the
requirement for a PSA from the final rule.
PO 00000
Frm 00122
Fmt 4701
Sfmt 4700
of subpart D. The FAA makes similar
changes in § 450.450.215.
Boeing, Lockheed Martin, Northrop
Grumman, and ULA commented that
they appreciated the streamlining of
pre-flight reporting. CSF recommended
that the FAA allow the submittal of test
reports in accordance with proposed
§ 450.213(d) less than 30 days before
flight. SpinLaunch also stated that the
proposed § 450.213(d) requirement to
submit test reports 30 days prior to
launch was too burdensome.
The FAA agrees that not all test
reports for the FSS, such as end-to-end
tests and pre-flight tests, can be
delivered 30 days before flight. The
FAA therefore revises § 450.213(d) to
allow an operator the flexibility to
identify an appropriate time frame in
coordination with the FAA. The FAA
discusses this flexibility in more detail
in the preamble section on Time
Frames.
AAAE noted that, under proposed
§ 450.213(f), launch schedules would be
required to be provided to the FAA in
advance. AAAE recommended that
these schedules, including any changes
to the schedule, should also be
distributed to nearby airports (within at
least five nautical miles of the launch
site or along the vehicle’s trajectory),
contingent landing sites, and any
emergency responders supporting the
launch operation.
The FAA declines to adopt this
recommendation. Section 450.147
requires that an operator establish
written agreements with any entity that
provides a service that meets a
requirement. The FAA notes that these
written agreements will include any
agreements necessary to ensure the
safety of airspace. The FAA has drafted
§ 450.147 to be as performance-based as
possible; therefore, the specificity
recommended by AAAE is unnecessary.
That said, the FAA agrees that such
notifications would usually be required.
CSF noted that proposed § 450.213
would require that the licensee provide
payload details to the FAA 60 days in
advance of a launch or reentry. CSF
commented that operators often cannot
meet that time frame due to changes in
manifests for passive or minor payloads
that occur inside of 60 days before
flight. Proposed § 404.15 would not
allow an operator to request that the
time frame for payload notification be
changed unless it knew more than 60
days in advance of flight that the
manifest was going to change. CSF
considered the proposal inflexible and
requested that FAA allow proposed
§ 404.15 be made more flexible. The
FAA disagrees with the comment, as
§ 404.15 currently allows for an
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
applicant to request the FAA to relax
the 60-day pre-flight reporting
requirement for payload information.
e. Post-Flight Reporting (§ 450.215)
In the NPRM, the FAA proposed an
operator be required to provide the
actual trajectory flown by the vehicle
and, for an unguided suborbital launch
vehicle, the actual impact location of all
impacting stages and impacting
components, if requested by the FAA. In
the final rule, the FAA adopts § 450.215
as proposed.
SpaceX generally agreed with the
provisions of proposed § 450.215 but
suggested that the FAA remove
proposed § 450.215(b)(4) because it
contended that post-flight auditing was
already an option for the FAA and that
the specific reference to a potential
request for a flown trajectory was
redundant and unnecessary. Although
the FAA agrees with SpaceX that the
FAA can request these data as part of its
inspection, the FAA finds that the
explicit reference in the regulatory text
is necessary to ensure compliance. The
FAA included this requirement in the
proposed rule because some operators
failed to provide flown trajectory
information when the FAA requested it
as part of an inspection or post-flight
review. The FAA will only ask for flown
trajectory data when necessary to verify
models and assess vehicle performance.
jbell on DSKJLSW7X2PROD with RULES2
f. Registration of Space Objects
(§ 450.217)
In the NPRM, the FAA consolidated
and updated the requirements for
registration of space objects in proposed
§ 450.217. The FAA proposed to remove
the caveat excluding foreign payloads
and to add the requirement to notify the
FAA when removing objects placed in
orbit. The FAA noted that it is the
responsibility of the U.S. Government to
register objects and launch operator data
is used to make relevant decisions on
what to register. Proposed § 450.217(c)
retained § 431.85’s requirement that an
operator notify the FAA when it
removes a space object.
In the final rule, the FAA adopts
§ 450.217 as proposed.
NZSA asked if operators would have
to report the reentry of an object due to
atmospheric reentry, presumably much
later than launch. NZSA supported the
requirement of information on foreignowned space objects to determine who
would register the objects, which NZSA
also requires. NZSA recommended the
FAA clarify whether removal would
relate only to active removal or if it
would include passive deorbiting.
NZSA viewed the latter to be in
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
79687
alignment with the terms of the
Registration Convention.189
The FAA did not intend the
requirement to notify the FAA of objects
removed from orbit to cover eventual
decays through atmospheric reentry.
NZSA is correct that the Registration
Convention requires the notification of
objects removed from space. Yet, the
FAA does not believe there is a need to
require launch operators to track the
orbital status of all objects previously
launched in perpetuity.
incident,’’ ‘‘launch accident,’’ ‘‘launch
incident,’’ ‘‘public safety,’’ ‘‘reentry
accident,’’ ‘‘reentry incident,’’ and
‘‘vehicle safety operations personnel.’’
In the final rule, the FAA does not
make any immediate changes to § 401.5.
Instead, § 401.5 will remain in effect for
five years after the effective date of this
final rule, and its definitions will be
applied to parts 415, 417, 431, and 435.
After five years, § 401.5 will be removed
from part 401 and all operators will use
the definitions in the new § 401.7.
6. Changes to Parts 401, 413, 414, 420,
433, 437, and 440
ii. § 401.7
In the final rule, existing and
proposed definitions from § 401.5 are
adopted as new § 401.7 (Definitions)
specifically applicable to part 450
requirements, with the exception of the
following proposed definitions: ‘‘control
entity,’’ ‘‘data loss flight time,’’ ‘‘doseresponse relationship,’’ ‘‘flight abort
crew,’’ ‘‘gate,’’ ‘‘mishap, class 1,’’
‘‘mishap, class 2,’’ ‘‘mishap, class 3’’,
‘‘mishap, class 4,’’ ‘‘tracking icon,’’ and
‘‘vehicle response modes.’’ In addition,
§ 401.7 does not contain the definitions
for ‘‘Federal launch range’’ and ‘‘launch
site safety assessment’’ that exist in
§ 401.5. These definitions are not
adopted because they are no longer used
in the regulations. Section 401.7 will
apply to all of Chapter III except parts
415, 417, 431, 435, and 440, where
§ 401.5 will continue to apply until five
years after the effective date of this rule.
The FAA notes that the proposed
definition of ‘‘probability of casualty’’
uses the phrase ‘‘serious injury or
worse.’’ Consistent with current practice
for launch and reentry safety analyses,
as well as other DOT modal
administrations, the FAA maintains that
the use of the Abbreviated Injury Scale
(AIS) Level 3 or greater (of the
Association for the Advancement of
Automotive Medicine) is appropriate for
describing a medical condition
sufficiently to allow modeling of
casualties for purposes of determining
whether a launch or reentry satisfies the
public risk criteria. For additional
information regarding casualty
modeling, the FAA refers the reader to
the preamble of a previous
rulemaking.190
The FAA adds new definitions for
‘‘critical payload,’’ ‘‘hazardous debris,’’
‘‘key flight safety event,’’ and ‘‘useful
mission,’’ which were not proposed in
the NPRM. These definitions and the
rationale to remove, adopt, or amend
them are discussed in the relevant topic
sections of this preamble.
Sierra Nevada suggested including a
specific reference to ground safety for
Part 401—Organization and Definitions
i. § 401.5
In the NPRM, the FAA proposed new
and amended definitions to § 401.5
(Definitions). The new proposed
definitions in proposed § 401.5 were:
‘‘anomaly,’’ ‘‘casualty area,’’ ‘‘command
control system,’’ ‘‘control entity,’’
‘‘countdown,’’ ‘‘critical asset,’’
‘‘crossrange,’’ ‘‘data loss flight time,’’
‘‘deorbit,’’ ‘‘disposal,’’ ‘‘dose-response
relationship,’’ ‘‘downrange,’’ ‘‘effective
casualty area,’’ ‘‘expected casualty,’’
‘‘explosive debris,’’ ‘‘flight abort,’’
‘‘flight abort crew,’’ ‘‘flight abort rules,’’
‘‘flight hazard area,’’ ‘‘flight safety
limit,’’ ‘‘gate,’’ ‘‘hazard control,’’
‘‘launch or reentry system,’’ ‘‘launch
window,’’ ‘‘liftoff,’’ ‘‘limits of a useful
mission,’’ ‘‘mishap, class 1,’’ ‘‘mishap,
class 2,’’ ‘‘mishap, class 3’’, ‘‘mishap,
class 4,’’ ‘‘neighboring operations
personnel,’’ ‘‘normal flight,’’ ‘‘normal
trajectory,’’ ‘‘operating environment,’’
‘‘operation hazard,’’ ‘‘orbital insertion,’’
‘‘physical containment,’’ ‘‘probability of
casualty,’’ ‘‘public,’’ ‘‘reentry window,’’
‘‘service life,’’ ‘‘software function,’’
‘‘sub-vehicle point,’’ ‘‘system hazard,’’
‘‘toxic hazard area,’’ ‘‘tracking icon,’’
‘‘uncontrolled area,’’ ‘‘unguided
suborbital launch vehicle,’’ ‘‘uprange,’’
and ‘‘vehicle response modes,’’ ‘‘wind
weighting safety system,’’ and ‘‘window
closure.’’
The amended definitions in proposed
§ 401.5 were ‘‘contingency abort,’’
‘‘flight safety system,’’ ‘‘instantaneous
impact point,’’ ‘‘launch,’’ ‘‘mishap,’’
‘‘reenter; reentry,’’ ‘‘safety critical,’’ and
‘‘State and United States’’. These new
and revised definitions were necessary
additions to accompany the proposed
part 450 requirements.
The FAA also proposed to remove a
number of definitions from § 401.5 that
were no longer used in the regulations:
‘‘emergency abort,’’ ‘‘human space flight
189 Convention on Registration of Objects
Launched into Outer Space provides that the
United Nations maintains a registry of objects left
in space by on data provided by the launching state.
PO 00000
Frm 00123
Fmt 4701
Sfmt 4700
190 See
E:\FR\FM\10DER2.SGM
67 FR 49464 (July 30, 2002).
10DER2
79688
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
the public in the definition of ‘‘reentry.’’
The FAA declines to adopt this
suggestion because public safety is the
core of the FAA’s statutory mission, and
including additional reference to public
safety for the definition of ‘‘reentry’’ is
unnecessary.
Part 413—Application Procedures
In the NPRM, to enable incremental
application submission and review, the
FAA proposed to modify § 413.1 to
clarify the term ‘‘application’’ to mean
either an application in its entirety, or
a portion of an application for
incremental review and determination
in accordance with proposed § 450.33.
In the final rule, the FAA adopts the
provision as proposed. This decision is
further discussed in the Incremental
Review section of the preamble. The
FAA did not receive any comments on
this part.
In the NPRM, the FAA proposed to
revise the table in § 413.1 by replacing
parts 415, 417, 431, and 435, with part
450. The FAA adopts the proposed table
with revisions as discussed in the
preamble section for Compliance Period
for Legacy Licenses.
In the NPRM, the FAA proposed to
amend § 413.7(a)(3) to allow an
applicant the option to submit its
application by email as a link to a
secure server and removed the
requirement that an application be in a
format that cannot be altered. The FAA
adopts § 413.7(a)(3) as proposed and
this decision is further discussed in the
Application Process section of the
preamble.
In the NPRM, the FAA proposed to
revise § 413.11(a) by removing the
reference to initiate a review ‘‘required
to make a decision about the license or
permit.’’ This revision would enable
incremental application submission and
review. In the final rule, the FAA adopts
the change as proposed.
In the NPRM, the FAA proposed a
change to § 413.15 to allow the FAA to
establish a time frame for any
incremental review with an applicant
on a case-by-case basis during preapplication consultation. In the final
rule, the FAA adopts this change with
a revision. The FAA revises the explicit
time frames in § 413.15 to reference the
time frames specified in 51 U.S.C.
50905(a)(1) and 50906(a) so that a future
rulemaking will not be required if the
time frames are modified in the statute.
This decision is further discussed in the
Incremental Review section of the
preamble.
In the NPRM, the FAA proposed to
correct the section heading of § 413.21
to reflect the content of the section, and
to correct § 413.21(c) to reference both
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
license and permit applications. The
FAA adopts these changes as proposed.
In the NPRM, the FAA included
license and permit renewals in the
flexible time frames table in Appendix
A to Part 404. The FAA inadvertently
omitted making the same change in the
corresponding regulatory text in
§ 413.21. The FAA adopts the change as
proposed, and revises § 413.21 to allow
flexible time frames for license and
permit renewals. This decision is
further discussed in the Time Frames
section of the preamble.
In the NPRM, the FAA proposed
conforming changes in part 413 where
a part 414 safety approval is referenced,
to change those references to ‘‘safety
element approval.’’ The FAA adopts the
changes as proposed. This decision is
further discussed in the Safety Element
Approval section of the preamble.
Part 414—Safety Element Approvals
In the NPRM, the FAA proposed to
change the part 414 term ‘‘safety
approval’’ to ‘‘safety element approval,’’
to distinguish it from the term ‘‘safety
approval’’ as used in parts 415, 431, and
435, and proposed part 450. Also, the
FAA proposed to modify part 414 to
enable applicants to request a safety
element approval in conjunction with a
license application in accordance with
proposed part 450.
In the final rule, the FAA adopts the
changes as proposed with minor
editorial corrections. The FAA did not
receive any comments on this part.
Part 420—License To Operate a Launch
Site
In the NPRM, the FAA proposed
multiple changes in part 420.
Specifically, the FAA proposed changes
in §§ 420.5, 420.15, 420.51, 420.57,
420.59, and 420.61 to align with
requirements in part 450.
In § 420.5, the FAA proposed to
remove the definitions of
‘‘instantaneous impact point,’’ ‘‘launch
site accident,’’ and ‘‘public’’ from
§ 420.5. The FAA did not receive
comments on these changes and adopts
them as proposed.
In § 420.15(b), the FAA proposed to
revise the environmental review
requirements under part 420 to match
the environmental review requirements
proposed in § 450.47. As discussed in
the Environmental Review section of
this preamble, the FAA adopts this
change as proposed, with revisions that
affirmatively state the responsibilities of
the FAA and an applicant in accordance
with FAA Order 1050.1.
The FAA proposed a minor edit to
§ 420.51, and proposed to allow
PO 00000
Frm 00124
Fmt 4701
Sfmt 4700
alternate time frames in § 420.57. The
FAA adopts these changes as proposed.
In § 420.59, the FAA proposed
changing the heading from ‘‘Launch Site
Accident Investigation Plan’’ to
‘‘Mishap Plan,’’ and modifying the
requirements for Mishap Plans to match
the requirements for ‘‘mishap plans’’ in
§ 450.173. As discussed in the Mishap
section of this preamble, the FAA
revises § 420.59(a) to state that the
requirements of this section only apply
in the event of a mishap that meets
paragraph (a)(1) or (a)(5) of the
definition of ‘‘mishap’’ in § 401.7 and
removes the requirement for the
licensee to cooperate with an FAA or
NTSB investigations of a mishap for
launches launched from the launch site.
Lastly, in § 420.61(b), the FAA
replaces the word ‘‘shall’’ with the word
‘‘must,’’ and replaces the term ‘‘launch
or launch site accident’’ with a reference
to the portions of the ‘‘mishap’’
definition that replace this term:
paragraphs (1), (5), and (8). As
explained in the Mishap section of this
preamble, the NPRM inadvertently
omitted these changes necessitated by
the revised definition of ‘‘mishap’’ in
§ 401.7.
Part 433—License To Operate a Reentry
Site
In the NPRM, the FAA proposed
changes to the environmental
requirements in § 433.7 to align them
with the environmental requirements in
proposed § 450.47 and removed and
reserved § 433.9.
In the final rule, the FAA adopts the
proposed requirements in § 433.7 with
revisions to align with the revisions in
§ 450.47. The revisions are discussed in
the Environmental Review section of the
preamble. The FAA also adopts the
proposal to remove and reserve § 433.9.
The FAA did not receive any comments
on these proposals.
Part 437—Experimental Permits
In the NPRM, the FAA proposed the
following changes to part 437
(Experimental Permits).
• First, the FAA proposed to remove
the definition of ‘‘anomaly’’ from
§ 437.3 and include a modified version
in proposed § 401.5.
• Second, the FAA proposed to
modify the environmental requirements
in § 437.21(b)(1) to match the
environmental requirements proposed
in § 450.47.
• Third, the FAA proposed to change
the name of ‘‘safety approval’’ to ‘‘safety
element approval’’ in § 437.21.
• Fourth, the FAA proposed to
modify the mishap plan requirements in
§ 437.41 to require that they meet the
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
requirements of proposed § 450.173 and
remove and reserve the requirements in
§ 437.75.
• Fifth, the FAA proposed to change
the requirements in § 437.65 for
collision avoidance to match proposed
§ 450.169.
• Finally, the FAA proposed allowing
for alternate time frames for pre-flight
reporting in § 437.89.
In the final rule, the FAA adopts the
proposed requirements with the
following exceptions. The FAA revises
the environmental requirements in
§ 437.21 to align with § 450.47, and
replaces the word ‘‘envelope’’ with the
word ‘‘scope.’’ ‘‘Scope’’ more accurately
captures ‘‘envelope, parameter, or
situation’’ as used in the definition of
‘‘safety element approval.’’ The
rationale for this revision is discussed in
the Environmental Review section of the
preamble. The FAA also aligns the
recordkeeping requirements in
§ 437.87(b) for an event that meets
paragraph (a)(1) through (a)(3), (a)(5), or
(b)(3) of the definition of ‘‘mishap’’ in
§ 401.7, for which a permittee must
preserve all records related to the
mishap event. The FAA removes the
definition of ‘‘anomaly’’ from § 437.3
and includes a revised definition of
‘‘anomaly’’ in § 401.7 instead of in
§ 401.5 as proposed. The FAA also
amends the language in § 437.87(b) to
state that records must be retained until
completion of any Federal investigation
and the FAA advises the permittee that
the records need no longer be retained.
These changes will clarify the records
retention requirements and ensure
consistency with part 450. The changes
do not modify the scope of the
requirements. The FAA did not receive
any comments on this portion of the
proposed rule.
jbell on DSKJLSW7X2PROD with RULES2
Part 440—Financial Responsibility
In the NPRM, the FAA proposed to
modify § 440.15 to allow for alternate
time frames. The FAA also proposed to
modify the definition of ‘‘maximum
probable loss’’ in § 440.3 to exclude
neighboring operations losses from
losses to third parties that are
reasonably expected to result from a
licensed or permitted activity and that
have a probability of occurrence of no
less than one in ten million (1 × 10¥8),
and to include those losses to
neighboring operations personnel that
have a probability of occurrence of no
less than one in one hundred thousand
(1 × 10¥5).
In the final rule, the FAA adopts these
changes as proposed. The FAA did not
receive any comments on this proposal.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
7. Miscellaneous Comments
i. General Support/Opposition
Several commenters generally
supported the proposed rule as a muchneeded effort to consolidate and update
the licensing process in a way that
would foster innovation and growth of
the space industry. Individual
commenters supported streamlined
licensing as a way for space startups to
enter the industry.
The FAA also received comments
stating the NPRM fell short in
streamlining rules and procedures, as
directed by SPD–2. The FAA received
comments that the proposed rules made
obtaining launch licenses too difficult or
expensive for small companies because
they require legal or technical experts
for small, low-risk launches. An
individual commenter asserted the FAA
should ease restrictions for space
startups. Another individual commenter
stated the NPRM added administrative
requirements that the FAA would not be
able to manage. Virgin Galactic
requested that the safety, efficiency, and
clarity of the current regulatory regime
for suborbital, reusable vehicles be
maintained in any new rulemaking.
Individual commenters asserted the
NPRM did not contain adequate
standards to evaluate the adverse effects
of licensed activities on public safety
and the environment. The Center for a
Sustainable Coast (Center) stated the
FAA should require applicants to
analyze risks to private or public
property, including infrastructure and
natural resources. Without such a
requirement, the Center and other
commenters argued the proposed rule
would make it easier to launch over
residential areas, environmental
preserves, or other areas presenting a
high risk of harm to persons, property,
and natural resources. The FAA also
received comments raising concerns
about Camden Spaceport, citing the
proposed rule’s lack of noise
limitations, emissions requirements,
and attention to the effects on the
environment and residential areas.
The FAA notes that the commenters
did not recommend specific changes to
the proposed rule, nor did they provide
cost data to substantiate the economic
concern for small companies. As such,
the FAA cannot provide a specific
response to these comments but notes
its general disagreement with the claim
that the new rule will make it too
difficult or expensive for small
companies to secure commercial space
launch and reentry licenses from the
FAA. In fact, publicly available means
of compliance will assist small
companies in entering the market by
PO 00000
Frm 00125
Fmt 4701
Sfmt 4700
79689
providing multiple options for
complying with the regulations.
Similarly, the FAA disagrees that it
would be necessary or feasible to create
an exception in the licensing process for
‘‘space startups.’’
The FAA disagrees further that the
administrative requirements to be
placed on the FAA will prove
impracticable to administer. The final
rule upholds the FAA’s responsibility to
protect public safety and safety of
property. In addition, the final rule
makes no change to the FAA’s
assessment of environmental impacts.
As such, the FAA disagrees that the
final rule will enable operators to secure
licenses for launches or reentries that do
not satisfy the FAA’s public safety or
environmental review criteria.
Finally, commenters’ concerns
regarding Camden Spaceport are beyond
the scope of this rulemaking.
ii. Miscellaneous Comments
Starfighters Aerospace asked if all
present restrictions on compensation or
hire would be removed for licenses and
certificates developed collaboratively
between AVS and AST.
The FAA notes that this rule will not
change any current practice or
regulation regarding compensation or
hire restrictions under aviation
regulations. Changes to compensation or
hire are outside the scope of this
rulemaking.
An individual commenter stated that
the FAA should have incorporated the
proposed regulatory text the ARC
included at the end of its report, or,
alternatively, the FAA should reconvene
the SLR2 ARC. Two individuals
commented that the FAA did not
provide sufficient public engagement for
this rule. SpaceX and two individuals
commented that the proposed rule did
not adequately address stakeholder
concerns. Several commenters,
including SpaceX and Virgin Orbit,
requested a public meeting.
As noted in the NPRM, the FAA does
not address the ARC’s recommended
regulatory text because the
recommended text did not receive broad
consensus within the ARC. The FAA
also disagrees that commenters did not
have sufficient opportunity to comment
on the NPRM. Although the FAA did
not hold a public meeting, as some
commenters requested, the FAA
accepted written questions seeking
clarification on the NPRM and, upon
publication of the FAA’s responses to
those questions, extended the comment
period to allow commenters sufficient
time to review the FAA’s clarifications.
Similarly, while the FAA did not
reconvene the SLR2 ARC, the FAA
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79690
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
relied heavily upon the
recommendations of the ARC, in
addition to industry and other public
comments, in promulgating this rule.
Relativity Space commented that the
NPRM preamble and proposed rule
diverged from stakeholder expectations
and appeared contradictory. Sierra
Nevada requested that the FAA identify
in the docket any contractor support
used to develop and draft the NPRM.
The FAA generally disagrees that the
preamble contradicted the proposed
regulation, but notes that, as explained
herein, the FAA has revised particular
provisions that commenters specifically
identified as unclear or impracticable.
The question of contractor support is
irrelevant to this rule or its
promulgation by the FAA.
CSF and SpaceX commented that the
FAA should revise § 440.15(c) so that
operators would not need to submit
proof of insurance, as required by
§ 440.9, more than once if the insurance
policy covered multiple licensed
activities.
CSF, Rocket Lab, and SpaceX
requested the FAA revise
§ 440.15(c)(1)(iv) through (c)(1)(vi) to
allow use of electronic signatures, in
lieu of original signatures, for each party
to the required waiver of claims.
Denver International Airport asked
the FAA to broaden the scope of
financial responsibility required by part
440 to include employees, site
operators, neighboring communities,
and other stakeholders.
Boeing and Northrop Grumman
recommended the FAA add to § 404.5(b)
a requirement that petitions for waivers
specify the duration or specific mission
for which petitioner seeks relief, noting
the FAA should not assume a waiver
applies to the entire license.
The FAA notes that the previous four
issues raised by the commenters are all
beyond the scope of this rule because
they contained comments on areas of
the commercial space transportation
regulations that were not part of the
proposal.
CSF commented that the NPRM was
anti-competitive and discouraged
operations from U.S. Government
ranges, thereby favoring operators
located elsewhere, including outside the
United States.
The FAA notes that CSF does not
explain why it thinks the rule will
discourage operations from U.S.
Government ranges and favor operators
located elsewhere, including outside the
United States. Based on applications
received by the FAA, the locations of
operations are ultimately determined by
the scale and complexity of operations,
including the size and type of launch
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
vehicle, resource inputs, infrastructure
requirements, and payload
considerations. The net cost savings
provided by this rule do not
significantly change the relative costs of
operating from U.S. Government ranges
in favor of locations elsewhere given
these considerations of scale and
complexity of operations. In addition,
U.S. companies need a license from the
FAA for a commercial space launch
regardless of where the launch occurs—
this rule does not change that.
Currently, and prior to this rule, U.S.
companies operate at locations outside
of U.S. Government ranges in remote
locations and abroad, such as New
Zealand.
iii. Advisory Circulars (ACs)
CSF, Sierra Nevada, Space Florida,
SpaceX, and two individuals (including
Congressman Steven M. Palazzo)
commented that the FAA had failed to
provide sufficient accompanying
guidance documents and ACs to allow
industry to provide meaningful input on
the proposed regulations. CSF and
SpaceX both commented that the FAA’s
approach to publish many ACs with the
final rule did not allow industry to
consider the proposed rules and the
draft ACs as a complete package. Virgin
Galactic recommended that the FAA
release updated ACs and guidelines to
coincide with the new rule’s going into
effect, or allow a grace period for
applicants and currently licensed
operators to be compliant.
The FAA acknowledges the
commenters’ concerns, but disagrees
that the lack of draft ACs, which are
necessarily rooted in the text of
regulations, prevented commenters from
substantively commenting on the
proposed rule. The preamble and table
of accepted means of compliance
provided sufficient detail to support the
proposal. The ACs will be non-binding
guidance documents designed to
provide specific examples of means of
compliance and recognized practices
without prescribing regulatory
requirements. The public and interested
parties will have an opportunity to
provide comment on the ACs.
As noted under the performancebased regulations discussion, CSF and
SpaceX stated that some of the proposed
rules may be performance-based, but it
was difficult to make that determination
without reviewing the accompanying
ACs. Space Florida commented that
there was an absence of performance
criteria and guidance providing
acceptable approaches.
The FAA does not agree that the
absence of additional draft ACs
prevented members of the public from
PO 00000
Frm 00126
Fmt 4701
Sfmt 4700
understanding the performance-based
requirements as proposed. The
proposed requirements, along with
discussions in the preamble, provided
ample notice to the public. An AC
would provide one means, but not the
only means, of meeting any particular
requirement.
iv. Designated Engineering
Representative Model
Blue Origin recommended the
Designated Engineering Representative
(DER) model to determine compliance
with the FAA’s launch and reentry
regulations.
Delegating the agency’s authority to
make engineering compliance findings
to qualified individuals (DERs) in the
context of licensing commercial space
transportation is beyond the scope of
this rulemaking. The FAA may consider
such a recommendation in the future.
v. Request for SNPRM
The FAA received a number of
comments requesting that the FAA issue
an SNPRM. Denver International
Airport commented that the FAA
should wait to issue this rule until
Congress adopts the Space Frontier Act,
and then, if required, issue an SNPRM.
One individual commenter asked the
FAA to restart the rulemaking process
and work closely with industry and the
ARC to produce a final rule that would
meet industry needs and would comply
with the Commercial Space Launch Act
and SPD–2.
The FAA disagrees that the final rule
is inconsistent with either the
Commercial Space Launch Act or SPD–
2. Through this rule, the FAA
streamlines the licensing process for
commercial launch and reentry
operations, and replaces many
prescriptive requirements with
performance-based criteria, as directed
by SPD–2. To forego rulemaking until
Congress passes additional legislation
on commercial space operations, as
Denver International Airport suggested,
would contravene the President’s policy
directive.
The FAA finds no circumstances that
would justify a second round of notice
and comment or SNPRM. The FAA
provided ample opportunity for
members of the public to submit
comments and supporting evidence to
the administrative record, as shown by
the large volume of substantive, diverse
comments received. The FAA also
provided two sets of written responses
to clarifying questions, and extended
the comment period following
publication of those responses.
Although the FAA has adjusted and
revised parts of the NPRM in light of the
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
comments received and interagency
review, the final rule does not
materially differ from the proposed rule
such that an SNPRM would have been
warranted. Nor does the FAA view the
presence of the circumstances that
might otherwise necessitate publishing
an SNPRM (e.g., availability of new
studies or experiments affecting the
agency’s analysis; supervening legal
developments that significantly affect
the rulemaking; or any other important
change to the agency’s analytical
framework in the rulemaking).
jbell on DSKJLSW7X2PROD with RULES2
vi. Airspace
The FAA received a number of
comments on the effect of space
operations on the NAS. A4A, AAAE,
ACI, ALPA, AOPA, CAA, NATCA, and
RAA recommended the FAA implement
tools to integrate commercial space
activities safely and expeditiously into
the NAS and to harmonize the
regulatory regime governing aviation
and commercial space. These
commenters argue that greater
communication and coordination with
NAS users was needed to reduce delays
and obstacles faced by both industries
(e.g., coordinated vehicle surveillance,
traffic management, and hazard
mitigation plans).
The same commenters recommended
the FAA incorporate into the rule the
recommendations of the ongoing
Airspace Access ARC. AOPA stated the
COMSTAC and SLR2 ARC should have
included general aviation
representation.
A4A and Southwest Airlines asked
that aviation stakeholders be given an
opportunity to identify potential NAS
impacts during the licensing process.
A4A, AAAE, ACI, ALPA, CAA, NATCA,
and RAA recommended the FAA
require licensees to identify and
mitigate negative operational and
financial impacts to NAS users resulting
from licensed activities. A4A added that
hazard mitigation plans and the FAA’s
accepted means of compliance should
be subject to public comment, or
otherwise allow NAS users the
opportunity to identify airspace and
ground safety risks.
The FAA did not propose any changes
for the protection of aircraft other than
the aircraft risk criteria proposed in
§ 450.101(a)(3). As such, these
comments are beyond the scope of this
rule. Recommendations from the
Airspace Access ARC, which included
commercial space and aviation industry
representatives, may inform future
actions addressing aircraft protection.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
8. Responses to Regulatory Impact
Analysis Comments
i. Compliance Period for Legacy
Licenses
CSF commented that if the FAA
required holders of licenses issued
under current regulations to seek
renewals under part 450, operators and
the FAA would experience significant
additional cost and regulatory burdens
because currently licensed operators
under parts 431 and 435 would have to
come into compliance with certain
additional requirements in part 450.
Blue Origin also expressed concern that,
without grandfathering, there would be
a cost to transition a license to part 450.
Blue Origin pointed out that, according
to the NPRM, upon license renewal, an
existing operation would have to
comply with part 450. Blue Origin
disagreed with the FAA’s conclusion
that operators would not have great
difficulty transitioning existing
programs to part 450. It cited, in
particular, proposed CEC and associated
requirements in proposed § 450.145.
The FAA notes that any request to
renew a current license submitted after
the effective date of the rule will result
in a license valid for no more than five
years after the effective date of this rule.
However, upon the effective date, the
operator will be required to come into
compliance with COLA and critical
asset requirements. The FAA does not
estimate additional costs for those two
requirements because the operator will
provide the same information the
operator currently provides, and the
U.S. Government will perform the
necessary analyses, as discussed in the
preamble sections for Critical Asset and
COLA.
After five years from the effective date
of the final rule, all vehicle operators
must be in compliance with part 450,
but information previously submitted to
the FAA in obtaining a license under
parts 417 and 431 may be referenced as
means of compliance to meet the
requirements of part 450. Concerns over
costs of proposed CEC and FSS
requirements in § 450.145 are discussed
in the remainder of this section. There
may be costs to transition licenses
following the 5-year period after the
rule’s effective date. However, as
mentioned previously, the FAA
anticipates few, if any, additional
requirements that could not be fulfilled
by referencing previous submittals.
ii. § 450.47 Environmental Review
Several commenters stated that the
proposed requirements would impose
added costs for which the FAA did not
account. Space Florida expressed
PO 00000
Frm 00127
Fmt 4701
Sfmt 4700
79691
concern that the FAA may determine
that new or supplemental
environmental analyses would be
necessary for operators opting for a
single vehicle license with vehicle and
site flexibility. The commenter was
concerned that such analyses would be
required before the determination to add
multiple vehicle configurations,
operational parameters, or launch site
locations to an operator’s single license.
Spaceport Strategies also expressed
concern that the FAA had not analyzed
the cost to launch operators or to launch
site operators for additional or
redundant environmental reviews that
the FAA would likely require of an
operator under the new rule in order for
an operator to obtain a single license
covering multiple launch or reentry
sites or multiple vehicle configurations
and flight operations. Spaceport
Strategies noted that the added costs of
repetitive or redundant environmental
reviews would cause unquantified cost
impacts on licensees, including State
and local launch site license applicants.
CSF stated that applicants using the
licensing option to include multiple
sites under one license may be
vulnerable to time and cost uncertainty
resulting from these environmental
review requirements.
The FAA does not agree that the final
rule will impose additional costs
beyond what is currently required of
applicants for environmental reviews,
including applications for a single
vehicle license or licenses that include
multiple sites, as the final rule codifies
current practice. NEPA requires that an
environmental review be completed for
each site covered by the FAA license.
As such, the final rule makes no change
to the existing requirement that
applicants submit information allowing
the FAA to fulfill its responsibility
under NEPA to assess the
environmental impacts associated with
the proposed activities, at each site
where the licensed activities will occur.
An applicant must submit these
materials to allow the FAA to conduct
site-specific reviews regardless of
whether multiple sites or vehicles are
covered under one license or several
licenses. This could be accomplished by
including multiple sites into one NEPA
document, or separating them into
individual NEPA documents.
Spaceport Strategies commented that
the FAA did not consider the offsetting
costs of environmental reviews for the
new vehicles and launch sites for which
cost savings were assessed. The FAA
notes it did not include offsetting costs
for new vehicles and launch sites
because the same costs for
environmental reviews will be imposed
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79692
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
under the current regulations. There
will be no change in costs.
Spaceport Strategies commented that
the FAA’s re-write of environmental
review requirements was more than a
simple ‘‘consolidation’’ as reported in
the Preliminary Regulatory Impact
Assessment. The commenter stated that
the proposed requirements had
unquantified cost impacts upon
licensees, including State and local
launch site license applicants, for the
additive costs of repetitive or redundant
environmental reviews.
As discussed in the Environmental
Review section of this preamble, the
final rule codifies existing
environmental review requirements.
The commenter did not identify the
environmental reviews it deems
repetitive or redundant. However, the
FAA confirms that in codifying existing
practice, the final rule will not impose
additional costs for environmental
review.
Spaceport Strategies commented that
licensees would face significant costs to
redo environmental analyses for
previously studied and permitted sites.
As an example, the commenter referred
to Space Florida’s being required to
spend almost $239,000 for another
environmental assessment for its
Launch Site Operator License for
horizontal launch at the former Shuttle
Landing Facility, when NASA had
completed two previous environmental
assessments on the same facility.
The FAA notes this rule will impose
no additional environmental reviews
nor require a redo of an environmental
assessment if an operator’s operation
remains within the scope of the original
assessment. However, consistent with
NEPA, an operator will be required to
do additional environmental reviews if
the scope of its operation has changed.
Spaceport Strategies commented that
the FAA did not address environmental
review regulations derived from
practices and policies being codified
into rules as potential federalism issues
with the State and local jurisdictions
that operate the part 420-licensed sites.
The commenter stated that the FAA also
did not consider that some, if not all, of
the local and State authorities are small
governmental entities for purposes of
the Regulatory Flexibility Act.
The FAA determines that this rule
codifies existing requirements in FAA
Order 1050.1 and will not affect the
applicability of NEPA or any other
Federal environmental law to nonFederal launch or reentry sites.
Therefore, the FAA finds that the final
rule will not have an additional cost
impact on small governmental
jurisdictions.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
iii. § 450.101(a)(b) Neighboring
Operations
Virgin Orbit believed the costs of the
additional EC analysis to use in
determination of neighboring operations
personnel would be $10,000. As
discussed in the preamble section for
Neighboring Operations Personnel, the
FAA acknowledges that this
requirement will require additional
analysis; however, the FAA expects that
this analysis will involve minor
additional effort because the operator
already has to perform a similar analysis
for the public and will only need to
account for the population of
neighboring operations personnel, if
any.
Blue Origin expressed concern that
the FAA might implement a
requirement for which compliance
would be impossible, or would lead to
the creation of a sole source provider for
a service necessary to demonstrate
compliance, if the FAA does not explain
how the transfer of neighboring
operations personnel population data
would take place. Sierra Nevada
expressed concern regarding an
applicant’s ability to perform
calculations to determine which
neighboring operations personnel could
remain on a launch site, because the
applicant would need to get accurate
data regarding the populations and
locations of neighboring operations.
Sierra Nevada pointed out that, because
data could be on personnel performing
operations for competing companies,
the data could be proprietary or
sensitive. Sierra Nevada suggested the
FAA could perform this function to
guard the proprietary nature of the data.
In the final rule, the FAA notes that
the Federal or licensed site operator will
determine those personnel who are
eligible for neighboring operations
personnel status in coordination with
the launch operators, because the site
operator is in the best position to
identify which personnel are required to
perform safety, security, or critical tasks
at the launch site. Further, as previously
discussed, both the launch or reentry
operator and the neighboring site
operator benefit from this treatment of
neighboring operations personnel.
Spaceport Strategies faults the FAA
for not comparing the estimated
marginal productivity improvement
created by allowing certain personnel of
neighboring operators to remain at work
during nearby operations with adverse
schedule and competitiveness losses if
the FAA did not adopt the alternative
approaches suggested by the ARC and
CSF.
PO 00000
Frm 00128
Fmt 4701
Sfmt 4700
The alternative chosen by the FAA
provides cost savings compared to the
current regulations, and the FAA
believes that this approach is consistent
with the intent of SPD–2. The FAA
acknowledges that other approaches
exist, and considered three alternatives
that are discussed in the Regulatory
Flexibility Act section of this preamble.
Spaceport Strategies commented that
the labor categories used to calculate
neighboring operations personnel
savings (engineers and technicians) did
not align with the restricted categories
of work functions allowed to remain
(such as personnel required for safety,
security, or critical tasks), indicating
that the FAA’s savings estimates may
not actually be realized.
The FAA received input from
licensed operators on the labor
categories that might be allowed to
remain on the launch site and, based on
that input, is confident that these are
reasonable labor categories.
iv. § 450.101(a) Incorporate Waterborne
Vessels Into Collective Risk Criteria
To incorporate waterborne vessels
into collective risk assessment, Virgin
Orbit requested the FAA and other
regulators work with launch service
providers by providing databases on
global marine traffic. Virgin Orbit also
requested guidance on debris size/
fragment velocities that would result in
injury to marine traffic, in an appendix
or AC. Virgin Orbit asserted that this
requirement is not found in the existing
regulations, and estimated that the
additional cost to analyze and document
the effort would be approximately
$20,000 per launch, which would
become significant costs for a large
number of launches.
The FAA does not agree that there
will be additional costs of any
significance from the requirement to
incorporate waterborne vessels into
collective risk criteria. The operator can
continue its current practice and
demonstrate compliance in accordance
with the RCC 321–20 Supplement. The
FAA does not find a need to provide
databases on global marine traffic
because there are several public sources
of data on ship traffic available through
the internet which aggregate near realtime Automatic Identification System
(AIS) 191 data from satellites and ground
stations. The FAA notes that all vessels
over 300 tons on an international
voyage, all domestic vessels over 500
tons, and all passenger carriers, are
191 AIS is a standardized maritime navigation
safety communications system that provides vessel
information automatically to appropriately
equipped shore stations, other ships, and aircraft.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
required to operate ‘‘Class A’’ AIS
transponders, broadcasting continuallyupdated data, such as identity, position,
course, speed, ship characteristics,
cargo, and voyage information, to other
vessels and the shore. The United States
Coast Guard requires AIS Class A
transponders on all U.S. vessels engaged
in commercial service that are (1) selfpropelled and over 65 feet in length, or
(2) towing vessels of 26 feet or more in
length and more than 600 horsepower.
The USCG also requires AIS Class B
transponders on smaller vessels, such as
fishing industry vessels.192 Detection of
smaller vessels, which tend to remain
close to shore, can be accomplished
without AIS by fixed ground-based and
ship-board radar, as well as surveillance
aircraft. The FAA will publish an AC on
population exposure analyses that
includes details about available
databases that provide valid data on
ship traffic, including near real-time
ship traffic useful for EC analyses. The
forthcoming RCC 321 Supplement will
also include this information.
The ship probability of impact
contours (PI) and individual risk
contours are already required and
computed based on current practice to
establish ship hazard areas. The FAA
Office of Commercial Space
Transportation will facilitate access to
the ship traffic densities so that the EC
contribution from ships can be
computed with a spreadsheet.
v. § 450.101(a)(3) Aircraft Risk
Virgin Orbit commented on the
proposed requirement for an operator to
establish aircraft hazard areas necessary
to ensure the probability of impact with
debris capable of causing a casualty for
aircraft does not exceed 1 × 10¥6. To
incorporate airborne vessels into the
collective risk assessment, Virgin Orbit
requested FAA databases on civil and
general aircraft, predicted air traffic, and
debris size and velocities that would
result in aircraft casualties in order to
comply with this requirement. Virgin
Orbit stated guidance on debris size and
fragment velocities could be added in an
appendix or AC. Virgin Orbit indicated
that this is a new requirement relative
to the existing regulations and estimated
that the additional cost to analyze and
document the effort would be $20,000
per launch. While not significant by
itself, Virgin Orbit stated that the
additional cost for a large number of
launches becomes significant.
The FAA does not agree that this is
a new requirement. Current part 431
regulations require an operator to
192 USGC regulations regarding AIS are given in
33 CFR 164.46.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
demonstrate that the risk level to an
individual does not exceed 1 × 10¥6
probability of casualty per mission. The
part 431 requirement is equivalent to
the corresponding part 450 requirement,
which requires that the probability of
impact with debris capable of causing a
casualty for aircraft does not exceed 1 ×
10¥6. Because people in aircraft are not
excluded from the part 431 requirement,
part 450 is not adding a new
requirement to demonstrate risk level
for aircraft. In addition, § 417.107(b)(4)
is identical to the requirement in
§ 450.101(a)(3). Part 450 does not
require a collective risk assessment for
aircraft, so aircraft traffic densities, data
on civil and general aircraft, and
predicted air traffic, are not necessary.
vi. § 450.101(a)(4) Critical Assets
Blue Origin commented that because
operators on non-Federal launch or
reentry sites would be required to
comply with USAF Federal site
requirements, the FAA would need
either to confirm it had considered
private and licensed spaceports in its
cost assessment and that those operators
would not need to complete any critical
asset analyses, or to confirm they were
not included. The commenter also
stated that it was possible the new
requirement would impose costs for
operators not at Federal sites.
Spaceport Florida voiced concern
about the creation of a new category of
property designated as a ‘‘critical asset,’’
which would be required to be
protected against ‘‘loss of functionality’’
by prescribed risk criteria limiting each
designated asset’s exposure to launch or
reentry hazards. The commenter
indicated concerns about extraordinary
analysis requirements, unknown costs,
and program risks asking what limits
the types and numbers of assets that
may be designated by multiple parties
within proximity to a licensed launch
activity.
Spaceport Strategies commented that
the FAA had not conducted certain
analyses. These included analyzing the
cost to a licensee to perform a risk
assessment on each FAA-identified
critical asset to be incorporated into a
flight safety risk analysis, analyzing the
cost to identify critical assets to be
evaluated as a property at risk, and
analyzing operator time to process
waivers required for an operator’s own
critical assets or for an asset that may be
at risk for a particular critical licensed
activity. Spaceport Strategies expressed
concern that the proposed requirements
duplicated existing standards imposed
by NASA and the USAF, and noted that
there was only brief mention of this
newly proposed requirement in the
PO 00000
Frm 00129
Fmt 4701
Sfmt 4700
79693
FAA’s Preliminary Regulatory Impact
Analysis, which identified no costs
associated with its implementation. As
proposed, this requirement would apply
to all licensed launches and reentries
wherever they may occur, at any site in
the United States. The commenter noted
that in the Baseline Analysis of the cost
impacts and cost savings of proposed
§ 450.101, the FAA claimed no cost
impact for a new requirement that
clearly would add cost burden to every
licensee, as well as to the FAA itself.
The FAA notes that under the final
rule the U.S. Government will perform
the identification and analysis of critical
assets. The FAA expects these costs to
be relatively small. The Federal launch
or reentry site will perform the analysis
for launch or reentry operations from
Federal sites, and the FAA will perform
the analysis for operations from nonFederal launch or reentry sites.
Therefore, operators should incur no
costs for determination of critical assets.
vii. § 450.101(c) High Consequence
Event Protection
Spaceport Strategies stated that the
proposed requirement to use the CEC
analysis tool would be prohibitively
expensive—even technologically
infeasible—to use, and faulted the
Preliminary Regulatory Impact Analysis
for not including these costs. The
commenter also criticized the FAA for
not including the costs for operators to
learn the skills or contract for the
analysis. In addition, they stated that
the FAA did not include its cost to hire
in-house personnel or contractor skills
to validate that the operator’s analysis
justifies not needing an FSS.
CSF found the CEC to be a new and
costly calculation that may require
significant resources, including possible
reliance on contracts for expensive
modeling capabilities. The commenter
feared that meeting the CEC may result
in substantial increase in cost to those
operators currently able to show
compliance. Based on its understanding
of the proposed rule, CSF concluded
that the majority, if not all, of the
operators would be captured by
proposed § 450.145(a)(1) and would be
required to implement an FSS of the
highest reliability. CSF disagreed with
the FAA’s estimated FSS cost savings
and indicated there would be cost
increases.
Virgin Orbit stated that CEC, as a new
requirement, would be burdensome to
implement and would require changes
to its in-house algorithm to compute
flight corridors with associated EC.
According to Virgin Orbit, this new
burden would impact timelines for
future launches and would have
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79694
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
significant costs to implement. The
commenter recommended CEC be
included as one method to determine
whether an FSS was needed and not as
a required calculation. The commenter
further noted that CEC, as proposed,
would be better suited in an AC. Blue
Origin described the proposed CEC as a
complicated analysis with debatable
accuracy. Several commenters disagreed
with the FAA’s conclusion that this new
‘‘consequence risk’’ methodology
aligned with current practices.
Rocket Lab explained that, because
proposed CEC disregarded demonstrated
reliability and experience, it appeared
almost impossible for any orbital launch
vehicle to meet the prescribed CEC
thresholds. Preliminary calculations
suggested that the majority of orbital
launch vehicle operators would be
directed toward a flight abort system of
the highest prescribed reliability.
The FAA does not agree that the cost
to use CEC is prohibitive or that Virgin
Orbit will be required to make
significant changes to its in-house
algorithm. Additional costs associated
with modifications of analysis tools,
adjustments to data development,
additional analysis runtime, and
interpretation of the results as detailed
below, should not be significant.
The modification of existing analysis
tools is expected to take only a few
hours. As explained earlier, CEC is
inherent in the calculation of total
casualty expectation. If the capability to
output the CEC values is not already part
of the calculation tool, adding the
output of this value for each scenario
should require no more than a few
hours of effort. This estimate is included
in the Regulatory Impact Analysis for
those operators who choose to do the
analysis.
Because the CEC metric is more
sensitive to the input data and to
numerical sampling approaches than
the collective EC metric, more rigor
needs to be applied to the analysis or
more uncertainty accepted in the result.
Some data development may need to be
of higher fidelity and more computation
samples run to achieve a statistically
meaningful answer. Therefore, the FAA
finds there will be additional cost to
perform the analysis. To comply with
§ 450.101(c), the operator first calculates
the CEC, assuming no FSS is present, to
determine whether flight abort with an
FSS meeting the requirements of
§ 450.108(b) is needed. These
calculations will incur 5 percent of the
debris analysis costs.193 These estimates
193 Debris cost analysis is estimated to cost
$50,000.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
are included in the Regulatory Impact
Analysis.
Applicants using an FSS can use
hazard containment or analysis of CEC
as key criteria in the determination of
flight safety limits. The cost to interpret
CEC results for flight safety limit
development is expected (after the
debris analysis is run) to reduce the
costs nominally compared to existing
containment approaches.
Using its CEC tool, ACTA, under
contract to the FAA, has identified
several launches in the launch forecast
that will not need an FSS. The
Regulatory Impact Analysis includes
more information on these launches, as
well as an updated estimate of cost
savings anticipated because these
launches will not need an FSS.
The FAA notes that any operator that
agrees to have a § 450.145-compliant
FSS does not have to do a CEC analysis
to determine the required reliability
level of the FSS. However, a CEC
analysis may still be needed to
determine the flight safety limits. As
discussed in the High Consequence
Event Protection preamble section, the
final rule now has a number of
flexibilities in § 450.101(c).
Nevertheless, an operator could opt to
use the flight safety limits approach in
current § 417.213 as a means of
compliance with § 450.108(5), and thus
avoid any costs associated with CEC
analysis.
viii. System Safety Program, Post-Flight
Data Review, Post-Flight Reporting
CSF disagreed with the FAA’s
rationale that any added burden of this
section would be minimal because
industry practice was to review postflight data for reliability and mission
success. CSF maintained that the
proposed post-flight data requirement
extended beyond industry practice. The
commenter also stated that it was not
clear whether the process for evaluating
post-flight data would be subject to FAA
review and approval, which would
create an even larger burden. Sierra
Nevada also commented that the
proposed requirements extended
beyond the industry practice of
reviewing post-flight data for reliability
and mission success, to requiring an
operator to develop and employ a
process for evaluating post-flight data to
ensure consistency between the
assumptions used for preliminary safety
assessment, any flight hazard or FSA,
and associated mitigation and control
measures. Rocket Lab and Sierra Nevada
stated the proposed § 450.103(d) would
require the operator to address any
anomaly identified and resolve
inconsistencies prior to the next flight of
PO 00000
Frm 00130
Fmt 4701
Sfmt 4700
the vehicle. Rocket Lab pointed out that
this was overly burdensome.
The FAA disagrees with the
commenters. The FAA is only
concerned with ensuring consistency
between the assumptions used for any
safety analysis and associated mitigation
and hazard control measures. It is
industry practice to review post-flight
data to address vehicle reliability and
mission success.
The FAA further notes that current
regulations already require that any
representation contained in the license
application that is material to public
health and safety or the safety of
property be kept accurate and complete,
therefore any additional burden from
§ 450.103(d) will be minimal. Currently,
operators review the post-flight data
because it provides valuable
information on future operations. At a
minimum, in the final rule,
§ 450.103(d)(1) will require that an
operator employ a process for evaluating
post-flight data to ensure consistency
between the assumptions used for the
hazard control strategy determination,
any hazard or FSA, and associated
mitigation and hazard control measures.
With respect to § 450.103(d), the FAA
will evaluate the post-flight data review
process during the application
evaluation. Applicants will not be
required to provide information
obtained from the post-flight data
review to the FAA unless specifically
requested to do so during the
compliance monitoring process. The
FAA finds that it has always been the
operator’s responsibility to ensure the
accuracy of the relevant safety analyses.
Operators must review flight data in
order to ensure that the operation is
conducted as predicted, and to inform
necessary safety analysis changes for
future flights.
Section 450.215 will continue to
require licensees to submit a post-flight
report no later than 90 days after an
operation if there are any anomalies in
the flight environment material to
public health and safety and the safety
of property, and if there is a need for
associated corrective actions. This
practice is currently required by
§ 417.25(c). While RLV operators
licensed under part 431 are not
currently required to submit a postflight report, they are required to ensure
that all assumptions and representations
made in their application that are
material to public health and safety or
the safety of property are kept accurate
and complete, in accordance with
§§ 413.7 and 431.73(b)(2). As such, the
FAA expects the added burden to be
minimal because launch and reentry
operators regularly track anomalies and
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
implement corrective actions for
mission assurance, continuing license
accuracy, and safety purposes. The FAA
is normally made aware of any
anomalies and corrective actions that
are material to public health and safety
through its inspection program.
ix. § 450.141 (Proposed § 450.111)
Computing Systems and Software
Systems
Several commenters expressed
concern that the NPRM proposed a
prescriptive approach to the software
hazard, which would impose a
significant burden on operators to meet
all of the proposed requirements and
structure.
An individual commenter estimated
that changing the review process and
structure of software would require a
substantial new effort and add costs of
over $40,000 per launch. Blue Origin
faulted the FAA for proposing overly
prescriptive regulations governing how
the operator would design and test
software. Blue Origin also contended
that the prescriptive proposed
requirements did not integrate well with
most industry applications and best
practices and failed to address critical
aspects of safety sufficiently for
aeronautical databases, complex
distributed software systems, new
techniques, and machine learning. Blue
Origin indicated that these would
threaten progress being made towards
safer, lower cost and higher quality
software approaches. CSF maintained
that the requirements of proposed
§ 450.111 prescribing how the operator
would design and test software, and
providing only one way to demonstrate
that software was safe, failed to allow
development of new technologies that
could lead to safer solutions, and would
greatly increase costs. Leo Aerospace
stated that the testing requirements of
proposed § 450.111(d)(2) and (f)(1) were
so prescriptive that they would be costprohibitive.
In the final rule, the FAA revises
§ 450.111 to mirror the typical structure
of computing system safety application
data submissions and adds flexibility in
the means of compliance for key aspects
of safe computing system development.
The FAA notes that these revisions
address the key aspects of commenters’
concerns. The final rule on computing
and software systems, now located in
§ 450.141, aggregates the requirements
in proposed § 450.111 into performancebased objectives set in the context of the
appropriateness of each element for the
system as a whole. This aggregation
removes any prescriptive requirements
and replaces them with the
performance-based objectives. The
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
performance-based objectives are the
elements of software development and
testing processes that enable an
understanding of the public safety
implications of each software
component, and the objectives are
structured to mirror typical software
safety application data submissions to
minimize or eliminate the need to adapt
existing software safety processes to fit
the new regulations. The final
performance-based objectives expand
the range of software safety approaches
that could meet the regulation to enable
more innovation while keeping the
compliance burden at or below the level
proposed in the NPRM.
x. Proposed § 450.113(a)(5) Flight
Safety Analysis Requirements
Virgin Galactic commented that its
launch system had an FSS in the form
of its pilot, rendering the need for
‘‘demonstrated reliability’’ unnecessary.
In addition, unlike the ELVs addressed
by part 417, Virgin Galactic’s launch
system does not have a large effective
casualty area, which raised the question
of whether the risks truly justified the
costs of the proposed requirement,
particularly to small businesses.
Under this rule, currently licensed
hybrid systems will not have to do an
FSA for phases of flight that have a
flight history to demonstrate reliability
based on operational and flight history
in lieu of a traditional risk analysis. This
allowance is discussed in greater detail
in the Hybrid Vehicles section of the
preamble.
xi. § 450.115 Flight Safety Analysis
Methods
CSF commented that prescriptive FSA
requirements are inappropriate for some
vehicles and operations. An applicant
would have to propose an alternative
method of compliance or submit a
waiver request, resulting in an increase
in the amount of work. The lack of toolavailability might also cause some
applicants to incur costs of performing
these analyses themselves. CSF noted
these costs had not been included in the
cost analysis. The FAA agrees that
prescriptive requirements are not
appropriate and revises the
requirements to be more performancebased.
x. Independent Analyses
CSF stated that the NPRM’s Flight
Safety Analysis sections (proposed
§§ 450.119 and 450.135) include
multiple references to an applicant
submitting any additional products that
allow an independent analysis as
requested by the Administrator. CSF
stated that this behavior of recreating an
PO 00000
Frm 00131
Fmt 4701
Sfmt 4700
79695
applicant’s analysis was already an
expensive and burdensome aspect of the
current rules that should be ended. A
couple of commenters provided
estimates of additional hours of work
that might be required to conduct
independent analyses.
As mentioned previously, the goal is
for the FAA to evaluate, in an efficient
and thorough manner, the validity of the
analysis. The FAA finds that conducting
an independent analysis is typically the
most efficient and thorough means to
verify compliance with the FSA
requirements for novel launch or reentry
operations or operators that propose to
use substantially new FSA methods.
Furthermore, the FAA plans to provide
benchmarks for comparison purposes
that operators can reference to as part of
the validation and verification of their
analysis methods.
Therefore, the FAA does not
anticipate this rule will impose an
additional cost burden for independent
analyses because conducting
independent analyses is current
practice.
xi. § 450.135 Debris Risk Analysis
An individual commenter indicated
that the proposed rule would add
significant work in additional debris
risk analysis beyond what the operator
was doing to comply with the current
regulations. The commenter specified
that the proposed rule would add
requirements on explosive debris, toxic
release effects from the debris,
accounting for sheltering of individual
from buildings and vehicles, a casualty
mode that included ricochet fragments,
and impacts to critical assets. It would
also add reporting requirements for the
top ten impacted population centers and
the need to perform conditional
probability calculations in the FSA.
The FAA notes that an explosive
debris or toxic release effects analysis
will not be required if the vehicle does
not have explosive debris and toxics.
Explosive debris or toxic release effects
analysis are currently required for ELVs
under § 417.107(b)(1) and for RLVs
under § 431.35(b)(1)(ii), so the
requirement for those analyses under
part 450 would not impose additional
costs. The final rule requirements allow
operators to determine how to conduct
their debris risk analysis. For example,
an operator will not need to update the
debris risk analysis to account for
sheltering or ricochet if it uses a
conservative estimate of the casualty
area for people in the open pursuant to
§ 450.101(g). Under the final rule, the
FAA or Federal launch or reentry site
will do any critical asset risk
assessment. The cost of the CEC
E:\FR\FM\10DER2.SGM
10DER2
79696
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
assessment is addressed in the High
Consequence Event Protection preamble
section. Reporting the top ten
population centers is a minimal amount
of additional paperwork.
jbell on DSKJLSW7X2PROD with RULES2
xii. § 450.143 Safety-Critical System
Design, Test, and Documentation
An individual commenter expressed
concern that the proposed rule would
constrain the design by prescribing fault
tolerance where an operational
mitigation solution might exist, and
stated that this would result in a large
burden.
The FAA finds that industry
interpreted this regulation to be
burdensome due to a misunderstanding
of the breadth of possible means of
compliance to the ‘‘fault-tolerant’’
requirement in § 450.143(b). In the
NPRM, the FAA noted that while
redundancy was a currently prescribed
requirement for some safety-critical
components, the intent of this
requirement was to accept other
methods, including fail safety and
damage tolerance for systems like
primary structures that could not be
redundant. This flexibility permits
operational restrictions, testing, and
inspection to factor into the design to
demonstrate that a system is faulttolerant. The FAA resolves these
concerns by revising § 450.143(b) to
allow for other means of compliance.
xiii. § 450.145 Flight Safety System
Several commenters took issue with
the FAA’s assessment of cost savings
associated with the new approach to
FSS implementation. CSF disagreed
there would be cost savings and
expressed that the majority of operators
would be required to implement an FSS
of the highest reliability. CSF concluded
that the result would be significant
increases in cost and oversight burdens
to every operator not already operating
at a U.S. Federal site that has not yet
implemented a RCC 319–4-compliant
FSS. Rocket Lab stated that preliminary
calculations suggested that the majority
of orbital launch vehicle operators
would be directed toward a flight abort
system of the highest prescribed
reliability. Blue Origin stated that most,
if not all, operators (whether smaller
suborbital launch vehicles operating in
remote locations, or larger orbital
launch vehicles operating at Federal
sites) would be forced down a path of
implementing an FSS that must comply
with an unmodified set of prescriptive
USAF requirements. Spaceport
Strategies criticized the FAA’s analysis
of cost savings from launches not
requiring an FSS as being speculative
and not providing information on
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
whether the vehicles would fly from
existing or newly licensed or private
launch sites. It expressed that the
uncertainties made the projected
savings an overstatement.
The FAA disagrees that most, if not
all, operators will be required to
implement an FSS of the highest
reliability. For some launches, no FSS
may be required; for others, an FSS will
be required, but not of the highest
reliability. The FAA sponsored an
analysis performed by ACTA 194 using a
CEC model to evaluate selected 195
prospective launches and determine
those which would not need a FSS to be
in compliance with part 450. The FAA
then determined which of these
launches identified as not needing an
FSS under part 450 would be required
to employ an FSS under part 431 or
current practice. Based on cost input
received from industry on FSS costs, the
FAA then estimated cost savings due to
the fact that some launches would not
need an FSS under part 450, as
determined by the ACTA analysis. The
cost savings calculations are in the
Regulatory Impact Analysis.
xiv. § 450.161
Control of Hazard Areas
CSF stated that, in cases in which the
hazard area locations were in extremely
remote locations or significant distances
away from the launch and reentry site,
it was unreasonable for cost and
logistics reasons to expect that a
commercial company could provide
such surveillance. The FAA notes that
§ 450.161 only requires surveillance to
the extent necessary to ensure
compliance with § 450.101. Hence,
surveillance will be unnecessary in
extremely remote locations.
xv. § 450.167
Tracking
Sierra Nevada expressed that, as
written, the proposed rule seemed to
imply that tracking would be required
for every possible piece of debris in offnominal scenarios. Sierra Nevada noted
this would be burdensome, cost
194 ACTA, LLC is a risk management company
that evaluates safety hazards and risks from space
launch vehicle debris, blast, fire, and toxic gases.
The FAA sponsored ACTA to perform a series of
tasks to investigate the potential conditional risks
associated with past and foreseeable launch
operations. The study provided an independent
evaluation of the potential for the CEC related
requirements in the NPRM to necessitate changes to
current practice for more than a dozen missions
involving large, medium, and small launch vehicles
from a wide variety sites.
195 In selecting which launches to analyze, the
FAA analyzed those launches planned from remote
areas, suborbital and launches with a certain kind
of upper stage. This is because orbital launches that
are not from remote areas are going to exceed the
risk threshold of greater than 1 × 10¥3 conditional
expected casualties for uncontrolled areas.
PO 00000
Frm 00132
Fmt 4701
Sfmt 4700
prohibitive, and increase the risk to the
public. As clarified by the FAA in
‘‘Answers to Clarifying Questions
Received by June 28, 2019’’ and
‘‘Answers to Clarifying Questions
Received by July 29, 2019,’’ the term
‘‘all stages and components’’ does not
imply that all debris must be tracked to
the ground after a vehicle breakup. In
the final rule, the FAA replaces the
requirement to ‘‘determine the actual
impact locations’’ with the phrase,
‘‘predict the expected impact locations,’’
in § 450.167. Hence, the FAA finds the
final rule requirements are consistent
with current practice and thus incur no
additional costs.
xvi. § 450. 173 Mishap Plan—
Reporting, Response and Investigating
Requirements
Sierra Nevada recommended
removing the mishap plan requirement
to report debris impact points, including
those outside a planned landing or
impact area as proposed in
§ 450.173(d)(3)(iv), this requirement
would be burdensome, cost prohibitive,
and not reasonable. Sierra Nevada stated
that this burden would follow because
hazard areas are generated as probability
contours and not contours of total
containment. The commenter further
stated it was realistic that, in the event
of a breakup scenario, debris would
exist outside the hazard area but not at
a high enough probability to warrant
segregation.
The FAA notes that the requirement
to report hazardous debris impact points
is consistent with the current 5-day
reporting requirements for ELVs. It is
not the FAA’s intent to require tracking
and surveillance for every possible
piece of debris in off-nominal scenarios.
However, based on the vehicle’s lastknown state vector, an operator should
be able to calculate approximate
hazardous debris impact points,
including those points outside a
planned landing site or designated
hazard area. The FAA will consider an
event that results in hazardous debris
impact points outside a planned landing
site or designated hazard area as a
mishap. Considering the potential
increased risk to public safety resulting
from hazardous debris impacts outside
planned landing site or designated
hazard area, the FAA finds that this
requirement is reasonable and
necessary.
In addition to requiring submission of
a 5 day report in all mishap cases, there
might be some additional cost
associated with submitting debris
impact location data, which is not
currently required under part 431. Part
417 requires submission of this data
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
only for debris that lands outside the
impact limit lines.
The FAA does not agree that this
requirement will be costly or
unreasonable for the following reasons.
First, the requirement has been changed
to require that only hazardous debris be
reported. Second, operators currently
must employ vehicle tracking for
normal flight. In the event of a vehicle
breakup, operators should be able to
approximate any hazardous debris
impacts in relation to the designated
landing site or hazard area, based on the
vehicle’s last known state vector or
other tracking resources required for
normal flight. In other words, this
requirement will involve only minimal
costs because an operator can leverage
vehicle tracking data it already collects
in order to submit the debris impact
location data. In addition, the FAA
believes the operator will benefit from
reporting this debris.196
xvii. § 450.185 Ground Hazard
Analysis
Virgin Galactic commented that the
ground hazard analysis requirements
proposed in the NPRM would represent
new requirements and a new cost
burden, creating new work outside of its
existing license. Virgin Galactic
requested that the FAA determine
whether a ground hazard analysis
would be necessary for hybrid
operators, in accordance with the
Congressional direction that the FAA
regulate only to the extent necessary.
The FAA included estimated costs for
ground hazard analyses in the NPRM.
For the final rule, the FAA estimates
that 75 percent of operators will spend
no more than 80 hours on the ground
hazard and 25 percent of the operators
will spend no more than 160 hours
(non-recurring one time per license).
jbell on DSKJLSW7X2PROD with RULES2
IV. Regulatory Notices and Analyses
A. Regulatory Evaluation
Changes to Federal regulations must
undergo several economic analyses.
First, Executive Order 12866 and
Executive Order 13563 direct that each
Federal agency shall propose or adopt a
regulation only upon a reasoned
determination that the benefits of the
intended regulation justify its costs. In
addition, DOT rulemaking procedures
in Subpart B of 49 CFR part 5 instruct
DOT agencies to issue a regulation upon
a reasoned determination that benefits
exceed costs. Second, the Regulatory
Flexibility Act of 1980 (Pub. L. 96–354)
196 The debris data reported can be valuable in
assessing the current license representations to
allow for adjustments to expand launch availability
or enhance the safety of operations.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
requires agencies to analyze the
economic impact of regulatory changes
on small entities. Third, the Trade
Agreements Act (Pub. L. 96–39 as
amended) prohibits agencies from
setting standards that create
unnecessary obstacles to the foreign
commerce of the United States. In
developing U.S. standards, the Trade
Agreements Act requires agencies to
consider international standards and,
where appropriate, that they be the basis
of U.S. standards. Fourth, the Unfunded
Mandates Reform Act of 1995 (Pub. L.
104–4) requires agencies to prepare a
written assessment of the costs, benefits,
and other effects of proposed or final
rules that include a Federal mandate
likely to result in the expenditure by
State, local, or tribal governments, in the
aggregate, or by the private sector, of
$100 million or more annually (adjusted
for inflation with base year of 1995).
The FAA has provided a more detailed
Regulatory Impact Analysis of the
benefits and costs of this final rule in
the docket of this rulemaking. This
portion of the preamble summarizes the
findings of this analysis.
In conducting these analyses, FAA
has determined that this rule will
unleash economic benefits that will
outweigh its costs. This rule is a
significant regulatory action, as defined
in section 3(f) of Executive Order 12866,
as it raises novel policy issues. This rule
is also significant under DOT’s
administrative procedure rule on
rulemaking at 49 CFR 5.13 for the same
reason. The rule will have a significant
economic impact on a substantial
number of small entities. It will not
create unnecessary obstacles to the
foreign commerce of the United States,
and will not impose an unfunded
mandate on State, local, or tribal
governments, or on the private sector.
Changes to Regulatory Impact Analysis
Since the Proposed Rule
The FAA updates its analysis for
changes incorporated in the final rule
and additional information and data
identified during the comment period.
The following is a summary of these
changes (see the Regulatory Impact
Analysis available in the docket for
additional discussion and detail).
• Changes period of analysis from 5
to 10 years to capture the effects of a
five-year compliance period and
recurring impacts of the rule.
• Provides a range of net impacts
from low to high based on launch
forecast that includes base, low, and
high scenarios. The FAA uses the base
scenario as the primary estimate of the
net impacts of this rule.
PO 00000
Frm 00133
Fmt 4701
Sfmt 4700
79697
• Incorporates additional data to
update savings estimates for changes to
an FSS.
• Updates data and analysis of
neighboring operations (number of
personnel that evacuate) that decreased
savings.
• Updates wage data and adds/
clarifies small costs.
Statement of Need
In 2018, DOT was directed by the
National Space Council and SPD–2 to
streamline the regulations governing
commercial space launch and reentry
licensing. The purpose of the final rule
is to streamline and simplify the
licensing of launch and reentry
operations by relying on performancebased regulations rather than
prescriptive regulations. This action
consolidates and revises multiple
commercial space launch and reentry
regulations addressing licensing into a
single regulatory part that states safety
objectives to be achieved for the launch
of suborbital and orbital launch
vehicles, and the reentry of reentry
vehicles. This action also enables
flexible time frames, removes
unnecessarily burdensome ground
safety regulations, redefines when
launch begins to allow specified preflight operations prior to license
approval, and allows applicants to seek
a license to launch from multiple sites.
This rule is necessary to reduce the
need to file and process waivers,
improve clarity of the regulations, and
relieve unnecessary administrative and
cost burdens on industry and the FAA.
The intended effect of this action is to
make commercial space transportation
regulations more efficient and effective,
while maintaining public safety.
Affected Operators and Launches
At the time of writing based on FAA
license data, the FAA estimates this rule
will affect 12 operators that have an
active license or permit to conduct
launch or reentry operations. In
addition, the FAA estimates this rule
will affect approximately 672 to 800
launches over the next 10 years, with a
base or primary estimate of
approximately 737 launches.197 The
197 Based on historical launch data from the FAA
Office of Commercial Space Transportation and the
2020 FAA Aerospace Forecast (https://
www.faa.gov/data_research/aviation/aerospace_
forecasts/media/FY2020-40_FAA_Aerospace_
Forecast.pdf). See the Regulatory Impact Analysis
of this rule in the docket for more information. The
FAA acknowledges that there is uncertainty
estimating future launches over a 10-year period
since industry is expanding and planning for more
launches in the future given expected business and
economic conditions. In addition, historical data
E:\FR\FM\10DER2.SGM
Continued
10DER2
79698
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
FAA anticipates this rule will reduce
the costs of current and future launch
operations by removing current
prescriptive requirements that are often
burdensome to comply with or require
a waiver. The FAA expects these
changes will lead to more efficient
launch operations and have a positive
effect on expanding the number of
future launch and reentry operations.
Summary of Impacts
The FAA bases the analysis of this
rule on a launch forecast that includes
base, low, and high scenarios.
Accordingly, this analysis provides a
range of net impacts from low to high
based on these forecast scenarios. The
FAA uses the base scenario as the
primary estimate of the net impacts of
this rule.
For the primary estimate, over a 10year period of analysis, the rule will
result in present value net cost savings
to industry of about $53.9 million at a
seven percent discount rate with
annualized net cost savings of about
$7.7 million. At a three percent discount
rate, the 10-year present value net cost
savings to industry is about $68.3
million with annualized net cost savings
of about $8.0 million. The rule will also
result in net present value savings for
the FAA of about $1.7 million at a seven
percent discount rate over the same
period of analysis, with annualized net
cost savings of about $0.24 million. At
a three percent discount rate, the net
present value savings for the FAA is
about $2.3 million with annualized net
cost savings of about $0.27 million.
The largest quantified cost saving for
industry will result from eliminating or
modifying requirements for an FSS on
some launches: About $52.6 million in
present value savings over 10 years at a
seven percent discount rate or about
$66.6 million at a three percent discount
rate. As previously discussed, the FAA
will move from prescriptive FSS
requirements to performance-based
requirements. The rule will not require
all launch vehicles to have an FSS.
Launch vehicles that have a very low
probability of multiple casualties even if
vehicle control fails will not be required
to have as robust an FSS. In addition,
vehicles that have moderately low
probability of casualty, even if vehicle
control fails, will not be required to
have robust FSS.198 These performancebased requirements will reduce costs for
some vehicle operators, especially for
small vehicles or those operating in
remote locations.
The final rule will also generate
another important area of quantified
savings by providing a new definition of
‘‘neighboring operations personnel’’ and
establishing new criteria for neighboring
launch site personnel for the purposes
of risk and financial responsibility. The
change will allow affected operators to
reduce the number of personnel that
must evacuate and will enable
operations that are more concurrent by
accepting a small safety risk tradeoff.
The FAA has monetized the value of
this small increased safety risk as
summarized in the following tables. The
FAA estimates the present value of
these small increased safety risks to be
about $0.16 million discounted at seven
percent or about $0.2 million
discounted at three percent over ten
years.
The FAA estimates some small costs
to industry that will assist both industry
and the FAA in the implementation of
this final rule, such as providing
information to the FAA that other
agencies frequently request or
performing one-time updates of flight
safety limit analyses and ground hazard
analyses that will be used to determine
performance-based means of
compliance that provide future savings.
In addition, there may be additional
costs for the modification of existing
licenses to benefit from the cost saving
provisions of this final rule. The FAA
will also incur small costs for payload
review, flight hazard analysis, ground
hazard analysis, and the review of
modifications to existing licenses.
The following tables present a
summary of the primary, low, and high
estimates of the quantified savings,
costs, and the net impacts of the rule.
SUMMARY OF 10-YEAR QUANTIFIED SAVINGS, COSTS AND NET IMPACTS—BASE SCENARIO OR PRIMARY ESTIMATE
[Presented in thousands of dollars]
Industry
present value
(7%)
Impact
Industry
present value
(3%)
FAA
present value
(7%)
FAA
present value
(3%)
Cost Savings ............................................................................................
Costs ........................................................................................................
$54,634.8
¥733.3
$69,193.0
¥872.2
$1,864.2
¥162.7
$2,468.3
¥199.6
Net Cost Savings ..............................................................................
53,901.5
68,320.7
1,701.5
2,268.7
Annualized Net Cost Savings ...................................................
7,674.4
8,009.3
242.3
266.0
Increased Safety Risks ............................................................................
¥158.5
¥197.3
..........................
..........................
Net Cost Savings less Increased Safety Risks ................................
53,743.0
68,123.5
1,701.5
2,268.7
Annualized Net Cost Savings less Increased Safety Risks ......
7,651.8
7,986.1
242.3
266.0
Notes: In this and the following tables, the sum of individual items may not equal totals due to rounding. Negative signs used to indicate costs
and increased safety risks. Present value estimates provided at seven and three percent discount rates per OMB guidance.
SUMMARY OF 10-YEAR QUANTIFIED SAVINGS, COSTS AND NET IMPACTS—LOW SCENARIO
jbell on DSKJLSW7X2PROD with RULES2
[Presented in thousands of dollars]
Industry
present value
(7%)
Impact
Cost Savings ............................................................................................
has shown that there is uncertainty and variation
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Industry
present value
(3%)
$44,274.1
with the number of planned launches that result in
actual launches on annual basis.
PO 00000
Frm 00134
Fmt 4701
Sfmt 4700
FAA
present value
(7%)
$56,404.8
198 See
E:\FR\FM\10DER2.SGM
$1,850.3
FAA
present value
(3%)
$2,449.5
discussion in the FSS preamble section.
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
79699
SUMMARY OF 10-YEAR QUANTIFIED SAVINGS, COSTS AND NET IMPACTS—LOW SCENARIO—Continued
[Presented in thousands of dollars]
Industry
present value
(7%)
Impact
Industry
present value
(3%)
FAA
present value
(7%)
FAA
present value
(3%)
Costs ........................................................................................................
¥695.3
¥828.0
¥146.8
¥180.6
Net Cost Savings ..............................................................................
43,578.8
55,576.7
1,703.5
2,268.9
Annualized Net Cost Savings ...................................................
6,204.6
6,515.3
242.5
266.0
Increased Safety Risks ............................................................................
¥143.8
¥179.6
..........................
..........................
Net Cost Savings less Increased Safety Risks ................................
43,435.0
55,397.2
1,703.5
2,268.9
Annualized Net Cost Savings less Increased Safety Risks ......
6,184.2
6,494.2
242.5
266.0
SUMMARY OF 10-YEAR QUANTIFIED SAVINGS, COSTS AND NET IMPACTS—HIGH SCENARIO
[Presented in thousands of dollars]
Industry
present value
(7%)
Impact
Industry
present value
(3%)
FAA
present value
(7%)
FAA
present value
(3%)
Cost Savings ............................................................................................
Costs ........................................................................................................
$64,993.7
¥769.6
$81,979.8
¥914.8
$1,878.4
¥179.2
$2,487.5
¥219.4
Net Cost Savings ..............................................................................
64,224.1
81,065.0
1,699.3
2,268.1
Annualized Net Cost Savings ...................................................
9,144.1
9,503.3
241.9
265.9
Increased Safety Risks ............................................................................
¥172.5
¥214.3
..........................
..........................
Net Cost Savings less Increased Safety Risks ................................
64,051.6
80,850.7
1,699.3
2,268.1
Annualized Net Cost Savings less Increased Safety Risks ......
9,119.5
9,478.2
241.9
265.9
The following table summarizes
quantified impacts by provision
category for the primary estimate (see
the Regulatory Impact Analysis in the
docket for tables presenting low and
high estimates of quantified impacts by
provision category).
SUMMARY OF 10-YEAR QUANTIFIED SAVINGS, COSTS AND NET IMPACTS BY PROVISION BASE SCENARIO—PRIMARY
ESTIMATE
[Presented in thousands of dollars]
Industry
present value
(7%)
jbell on DSKJLSW7X2PROD with RULES2
Provision category/impact
Industry
present value
(3%)
FAA
present value
(7%)
FAA
present value
(3%)
Waiver Avoidance:
—Definition of ‘‘Launch’’ ...................................................................
—Waterborne Vessel Hazard Areas ................................................
—Waiver for 48 Hour Readiness .....................................................
System Safety Program—Safety Official .................................................
Duration of a Vehicle License .................................................................
Readiness—Elimination of pre-launch meeting 15 days prior ................
Flight Safety System—Not required for all launches ..............................
Flight Safety Analysis no longer required for hybrids .............................
Neighboring Operations * .........................................................................
Ground Hazard Analysis ..........................................................................
$23.7
47.5
29.7
28.4
36.6
860.7
52,618.2
34.4
873.6
81.9
$32.1
64.2
40.1
38.4
49.4
1,169.5
66,554.4
46.7
1,087.4
110.7
$7.5
14.9
9.3
33.3
76.1
155.9
1,453.9
4.4
..........................
108.8
$10.1
20.2
12.6
45.0
102.8
211.8
1,912.7
6.0
..........................
147.0
Total Cost Savings ...........................................................................
54,634.8
69,193.0
1,864.2
2,468.3
Payload Review and Determination ........................................................
Safety criteria ...........................................................................................
Flight Hazard Analysis .............................................................................
Flight Abort—Flight Safety Limits Constraint ..........................................
Flight Safety Limit Analysis .....................................................................
Far-field Overpressure Blast Effects Analysis .........................................
Safety-Critical System Design .................................................................
Ground Hazard Analysis ..........................................................................
¥52.5
¥55.3
¥56.9
58.5
¥114.0
¥2.9
¥19.3
¥42.4
¥71.2
¥64.1
¥68.0
79.0
¥143.3
¥3.9
¥26.1
¥57.3
¥54.0
..........................
¥15.9
..........................
..........................
..........................
..........................
¥19.8
¥73.4
..........................
¥19.0
..........................
..........................
..........................
..........................
¥26.8
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
PO 00000
Frm 00135
Fmt 4701
Sfmt 4700
E:\FR\FM\10DER2.SGM
10DER2
79700
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
SUMMARY OF 10-YEAR QUANTIFIED SAVINGS, COSTS AND NET IMPACTS BY PROVISION BASE SCENARIO—PRIMARY
ESTIMATE—Continued
[Presented in thousands of dollars]
Industry
present value
(7%)
Provision category/impact
Industry
present value
(3%)
FAA
present value
(7%)
FAA
present value
(3%)
Waivers for Neighboring Operations Personnel ......................................
Modification Costs for Existing Licenses .................................................
¥171.5
¥160.2
¥192.9
¥166.4
¥54.0
¥19.0
¥60.7
¥19.8
Total Costs .......................................................................................
¥733.3
¥872.2
¥162.7
¥199.6
Net Cost Savings ..............................................................................
53,901.5
68,320.7
1,701.5
2,268.7
Annualized Net Cost Savings ...................................................
7,674.4
8,009.3
242.3
266.0
Increased Safety Risks: Neighboring Operations * .................................
¥158.5
¥197.3
..........................
..........................
Net Cost Savings less Increased Safety Risks ................................
53,743.0
68,123.5
1,701.5
2,268.7
Annualized Net Cost Savings less Increased Safety Risks ......
7,651.8
7,986.1
242.3
266.0
Table notes: The sum of individual items may not equal totals due to rounding. Negative signs used to indicate costs and increased safety
risks in this table. Present value estimates are provided at seven and three percent discount rates per OMB guidance.
* Changes to Neighboring Operations requirements result in net savings are less increased safety risks.
The FAA also expects industry will
gain additional unquantified savings
and benefits from the final rule, because
the rule provides flexibility and
scalability through performance-based
requirements that will reduce the future
cost of innovation and improve the
efficiency and productivity of U.S.
commercial space transportation.
The following table summarizes some
of the changes that will result in
unquantified savings.
UNQUANTIFIED SAVINGS
Change
Savings
Time Frames ..................................
The rule revises time frames in parts 404, 413, 414, 415, 417, 420, 431, 437, and 440 that may be burdensome for some operators. This will increase flexibility by allowing an operator the option to propose alternative time frames that better suit its operations. Eligible time frames include preflight and post-flight reporting among others listed in Appendix A to Part 404—Alternative Time Frames.
The rule removes the requirement in part 414 to publish in the Federal Register the criteria upon which
safety element approvals were based. The purpose of this notification requirement was to make clear the
criteria and standards the FAA used to assess a safety element, particularly when no clear regulatory requirement existed and there could be other potential users of the safety approval. However, the FAA
finds that this requirement is unnecessary, and has potentially discouraged applications for safety element approvals due to concerns that proprietary data may be disclosed. The FAA anticipates that removing this requirement will lead to increased use of safety element approvals, reducing industry burden,
and potentially improving safety.
The rule provides the following mishap-related enhancements, which will better tailor mishap responses.
• Replaces current part 400 mishap related definitions with a consolidated mishap definition (streamlines and reduces confusion).
• Consolidates existing part 400 mishap/accident investigation and emergency response plan requirements into a single part (streamlines and reduces confusion).
• Exempts pre-coordinated test-induced property damage from being a mishap (removes need to consider test-induced property damages from mishap requirements and likely results in fewer investigations of minor mishaps).
• Eliminates the small $25,000 monetary threshold from the current mishap and accident investigation
requirements potentially reducing the number of mishaps investigated that do not pose a threat to
public safety. Minor damage that does not pose a threat to public safety can easily exceed the
$25,000 monetary threshold, triggering potentially costly and burdensome notification, reporting, and
investigation requirements.
• Clarifies that a mishap is triggered by hazardous debris falling outside a planned landing site or designated hazard area. As a result, non-hazardous debris, no matter where it falls, will not be considered a mishap potentially avoiding unnecessary notification, reporting, and investigation requirements.
The rule replaces part 417 toxic release hazard analysis requirements with performance-based regulations
that will provide flexibility for operators to comply with the required risk criteria in varied and innovative
ways for their ground operations.
The rule removes Appendix G to part 417, Natural and Triggered Lightning Flight Commit Criteria, and replaces it with the performance-based requirements. The current requirements are outdated, inflexible,
overly conservative, and not explicitly applicable to RLVs and reentry vehicles.
Safety Element Approval ...............
Mishaps ..........................................
jbell on DSKJLSW7X2PROD with RULES2
Toxics .............................................
Lightning protection requirement ...
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
PO 00000
Frm 00136
Fmt 4701
Sfmt 4700
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
jbell on DSKJLSW7X2PROD with RULES2
The FAA analyzed the impacts of this
rule based on the best available data at
the time of writing. The FAA
acknowledges that there are
uncertainties with the savings and costs
of this rule given the variety of
operators, locations of operations, and
the scale and complexity of operations.
In addition, there is uncertainty
regarding how operators holding an
active license, or who have an accepted
license application, will choose to
operate during the five-year compliance
period after the effective date of the rule
(i.e., choose to operate under part 450 or
operate under the legacy parts 415 and
417 for expendable launch vehicles, part
431 for reusable launch vehicles, and
part 435 for reentry vehicles). Lastly,
there is uncertainty in the range and
scope of future means of compliance,
since this rule replaces many
prescriptive regulations with
performance-based rules, giving
industry greater flexibility to develop
means of compliance that meet their
unique business objectives while
maintaining public safety. All of these
factors may result in variation of savings
and costs for individual operators
during and after the five-year
compliance period. As previously
discussed, the FAA will continue to
work with industry to identify
alternative means of compliance to
provide future savings and efficiencies
from this rule as industry continues to
evolve.
B. Regulatory Flexibility Act
The Regulatory Flexibility Act of 1980
(Pub. L. 96–354) (RFA) establishes ‘‘as a
principle of regulatory issuance that
agencies shall endeavor, consistent with
the objectives of the rule and of
applicable statutes, to fit regulatory and
informational requirements to the scale
of the businesses, organizations, and
governmental jurisdictions subject to
regulation. To achieve this principle,
agencies are required to solicit and
consider flexible regulatory proposals
and to explain the rationale for their
actions to assure that such proposals are
given serious consideration.’’ The RFA
covers a wide-range of small entities,
including small businesses, not-forprofit organizations, and small
governmental jurisdictions.
Agencies must perform a review to
determine whether a proposed or final
rule would have a significant economic
impact on a substantial number of small
entities. If the determination is that it
would, the agency must prepare a
regulatory flexibility analysis as
described in the RFA.
The FAA estimates this final rule will
have a significant economic impact on
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
a substantial number of small entities
and therefore has performed the
following Final Regulatory Flexibility
Analysis in accordance with section
604(a)(1)–(a)(6).
(1) A statement of the need for, and
objectives of, the rule.
The Department of Transportation
was directed by the National Space
Council in February 2018, and SPD–2 to
streamline the regulations governing
commercial space launch and reentry
licensing. The goal of the streamlining
rule is to create a single licensing regime
for expendable and reusable launch
vehicles and reentry vehicles.
The purpose of the final rule is to
streamline and simplify the licensing of
launch and reentry operations by
relying on performance-based
regulations rather than prescriptive
regulations. This action consolidates
and revises multiple commercial space
launch and reentry regulations
addressing licensing into a single
regulatory part that states safety
objectives to be achieved for the launch
of suborbital and orbital expendable and
reusable launch vehicles, and the
reentry of reentry vehicles. This action
also enables flexible time frames,
removes unnecessarily burdensome
ground safety regulations, redefines
when launch begins to allow specified
pre-flight operations prior to license
approval, and allows applicants to seek
a license to launch from multiple sites.
This rule is necessary to reduce the
need to file and process waivers,
improve clarity of the regulations, and
relieve administrative and cost burdens
on industry and the FAA. The intended
effect of this action is to make
commercial space transportation
regulations more efficient and effective,
while maintaining public safety.
(2) A statement of the significant
issues raised by the public comments in
response to the initial regulatory
flexibility analysis, a statement of the
assessment of the agency of such issues,
and a statement of any changes made in
the proposed rule as a result of such
comments.
Commenters indicated that the FAA
only identified two small entities that
will be affected by the rule and left out
numerous small entities that will be
affected. The FAA has reevaluated and
identified at least five small entities that
will be affected by the rule and
indicates this fact in the description of
small entities section in this Final
Regulatory Flexibility Analysis.
An individual commenter also noted
that beyond the small entities not
addressed in the analysis as noted
above, the FAA’s proposal would also
impact small companies that are
PO 00000
Frm 00137
Fmt 4701
Sfmt 4700
79701
subcontractors, suppliers, or service
providers to licensed launch or reentry
operators, both in regard to a particular
event and in the activities of
neighboring operations not involved in
a particular licensed or permitted event.
The FAA finds these subcontractors,
suppliers, or service providers to
licensed launch and reentry operators
are not directly impacted by the rule.
The RFA requires an agency to perform
a regulatory flexibility analysis of small
entity impacts only when a rule directly
regulates small entities. A commenter
indicated that small State or local
governmental jurisdictions might be
affected by the rule and these were not
mentioned by the FAA in the RFA. The
commenter appeared to be referring to
potential costs from environmental
review practices and policies now being
codified into rules. The FAA addresses
concerns related to potential costs from
this codification in the comment section
of this preamble and finds that the
potential costs are negligible.
An individual commenter claimed
several proposed new flight safety
requirements would impose complex
and costly risk analyses on small
entities, including the ‘‘consequence
protection’’ requirement, the ‘‘critical
assets’’ risk assessment requirement,
and flight software requirements. Also,
the commenter pointed out the
duplicative or conflicting rules among
overlapping Federal jurisdictions as
creating a barrier for small startups.
The FAA finds the costs of these
critical asset and consequence
protection requirements will be small or
nonexistent. Operators in remote
locations will likely be able to avoid the
higher costs of a highly reliable FSS by
demonstrating through a CEC analysis
that the launch in question will not
exceed a certain risk threshold. The
initial CEC analysis under § 450.101 that
is estimated to cost $2,500 may relieve
some operators from the expense of any
FSS. If a determination is made that an
FSS is necessary, further analysis under
§ 450.108 will be performed to
determine the flight safety limits needed
for the FSS. The FAA estimated the cost
of the additional analysis to account for
CEC in the flight safety limit is $10,000.
Of course, an operator could avoid these
analysis costs simply by choosing to use
a highly reliable FSS, but the FAA
assumes that an operator would not
perform these analyses if it expected
that it would still need the most highly
reliable FSS. The worst case would be
that the operator would incur $12,500 in
costs but still need an FSS, just not a
highly reliable FSS. The final rule also
allows an applicant to propose an
alternative to CEC that would measure
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79702
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
or mitigate the potential for a high
consequence event by use of other
safeguards.
The identification of critical assets
and the analysis to determine how to
protect the critical assets will be
performed by the ranges for launches
from Federal sites and by the FAA for
launches from non-Federal sites.
Therefore, small entities will not bear
these costs.
(3) The response of the agency to any
comments filed by the Chief Counsel for
Advocacy of the Small Business
Administration in response to the
proposed rule, and a detailed statement
of any change made to the proposed
rule in the final rule as a result of the
comments.
The Chief Counsel for Advocacy of
the Small Business Administration did
not file comments in response to the
proposed rule.
(4) A description of and an estimate
of the number of small entities to which
the rule will apply or an explanation of
why no such estimate is available.
The FAA identifies at least five
licensees that would qualify as small
businesses. The rule will have a large
effect in terms of cost savings on some
of these small businesses. In addition to
the five operators, there are two
licensees that will be affected by the
rule that may fall under the small
business threshold in terms of number
of employees, but they are subsidiaries
of large parent companies and therefore
are not considered small businesses.
(5) A description of the projected
reporting, recordkeeping, and other
compliance requirements of the rule,
including an estimate of the classes of
small entities that will be subject to the
requirement and the type of professional
skills necessary for preparation of the
report or record.
The rule will result in a reduction in
reporting requirements because there
will be fewer requests for waivers to
certain provisions, fewer requests to
modify licenses when a safety officer
changes, and fewer licenses having to be
issued because there will be extension
of RLV licenses up to five years. The
documentation accompanying a ground
hazard analysis for ELV operators will
be reduced due to change in launch
scope.
Some new requirements will result in
additional reporting. This reporting
includes the following:
(1) Paperwork associated with payload
review and determination, and safety criteria
analyses;
(2) Paperwork resulting from the flight
safety limits analysis and the far-field
overpressure blast effects analysis;
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
(3) Paperwork submitted by legacy license
who would like to waive the higher
conditional expected casualty level for
neighboring operations under the current
regulations, or the new ground safety
requirements for RLV operators; and
(4) Paperwork costs for those operators
who modify their licenses in the first five
years to comply with the new regulations.
The paperwork costs are discussed in
more detail in the Paperwork Reduction
Analysis section of this preamble.
(6) A description of the steps the
agency has taken to minimize the
significant economic impact on small
entities consistent with the stated
objectives of applicable statutes,
including a statement of the factual,
policy, and legal reasons for selecting
the alternative adopted in the final rule
and why each one of the other
significant alternatives to the rule
considered by the agency which affect
the impact on small entities was
rejected.
a. Factual, Policy, and Legal Reasons for
Selecting the Adopted Alternative
The Commercial Space Launch Act of
1984, as amended and re-codified at 51
U.S.C. 50901–50923 (the Act),
authorizes the Department of
Transportation, and the FAA through
delegation, to oversee, license, and
regulate commercial launch and reentry
activities, and the operation of launch
and reentry sites as carried out by U.S.
citizens or within the United States.
Section 50905 directs the FAA to
exercise this responsibility consistent
with public health and safety, safety of
property, and the national security and
foreign policy interests of the United
States. The FAA is authorized to
regulate only to the extent necessary to
protect the public health and safety,
safety of property, and national security
and foreign policy interests of the
United States. In addition, section
50903 requires that the FAA encourage,
facilitate, and promote commercial
space launches and reentries by the
private sector.
This rulemaking streamlines and
increases flexibility in the FAA’s
commercial space regulations. This
action consolidates and revises multiple
regulatory parts to apply a single set of
licensing and safety regulations across
several types of operations and vehicles.
It also replaces many prescriptive
regulations with performance-based
rules, giving industry greater flexibility
to develop means of compliance that
maximize their business objectives
while maintaining an equivalent level of
safety to the agency’s current
regulations. Because this rulemaking
amends the FAA’s launch and reentry
PO 00000
Frm 00138
Fmt 4701
Sfmt 4700
requirements, it falls under the
authority delegated by the Act.
b. Alternatives Considered
The FAA considered three
alternatives to the proposed rule. The
FAA restates these alternatives below.
The FAA did not receive comment
convincing it that any of these
alternatives would be better than the
rule it proposed and is now finalizing.
i. No Change to Current Regulations
This alternative was not chosen
because the current regulations are
outdated, prescriptive, and do not
adequately reflect industry current
practices or technology development.
The inefficiency of the licensing process
due to current regulations risks stifling
innovation and growth of the industry,
especially for small operators.
ii. Propose a More Process-Based
Regulatory Approach
With this alternative, the FAA would
have proposed less detailed regulations
that would have relied primarily on the
outcome of an operator’s system safety
process to protect public safety. The
FAA did not chose this alternative
because it would have lacked regulatory
clarity and hazard control flexibility.
System safety process is one method to
derive hazard controls; however, there
are other hazard control strategies that
are more appropriate for some
operations. Specifically, physical
containment, wind weighting, and, most
importantly, flight abort are often
sufficient. Part 450 incorporates the
flexibility of part 431, but acknowledges
the acceptability of other hazard control
strategies. Part 450 also builds on the
precedent set by part 431’s limits on the
foreseeable consequences of a failure in
terms of conditional expected casualties
and establishes a less stringent
threshold.With this final rule, the FAA
declines to adopt this alternative.
iii. Propose a Defined Modular
Application Process
With this alternative, the FAA would
have proposed similar safety
requirements but would have added a
more defined incremental or modular
application process. The final rule
enables an incremental application
process, but does not define one with
explicit modules and time frames. This
alternative was not chosen because the
FAA has no experience with an
incremental or modular application
process with which to base a rule. In
addition, a more defined incremental or
modular application process may be less
flexible and scalable and therefore more
burdensome to small operators.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
The FAA expects this final rule will
provide regulatory relief to small
entities from current prescriptive
requirements and result in net savings.
Accordingly, the FAA declines to adopt
this alternative.
c. Cost Savings to Small Entities
The following sections identifies key
provisions of the rule that minimize
impacts to and expand flexibilities for
small entities.
i. Readiness—Elimination of Pre-Launch
Meeting 15 Days Prior (§ 450.155)
ELV operators might save $4,683 per
avoided launch readiness meeting;
however, this assumes the average
number of people at each meeting
would be 25 and this might not apply
to a small business.
ii. Flight Safety System—Not Required
for All Launches (§ 450.145)
For launches for which an FSS would
not be required under the proposal, ELV
operators might save $100,000 to
$680,000 per launch and RLV operators
might save $20,000 per launch vehicle.
ELV operators might save between
$479,000 and $1.4 million in nonrecurring costs and RLV operators might
save approximately $375,000 for new
FSS designs by not having to incur all
the research, design, testing, materials,
and installation costs for an FSS. This
is likely to benefit small operators
launching from remote sites.
iii. Ground Hazard Analysis (§ 450.185)
An ELV operator might save
approximately $28,026 per application
by not having to do a ground hazard
analysis under this final rule.
d. Costs to Small Entities
The following sections identify
provisions of the rule that might result
in additional costs for small entities.
However, the rule provides a
compliance period of five years for
holders of current licenses at the
effective date of the final rule and those
who have an accepted application
within 90 days of the effective date of
the final rule. This will provide small
operators more time to comply with the
final rule and will reduce costs.
jbell on DSKJLSW7X2PROD with RULES2
i. Payload Review and Determination
(§ 450.43)
The final rule could cause small
operators to incur about $206 more per
launch than due to additional payload
review and determination costs.
ii. Flight Hazard Analysis (§ 450.107)
Operators who do not need FSS, and
choose to operate without one, will have
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
to perform a flight hazard analysis. RLV
operators currently do flight hazard
analyses, while ELV operators do not.
To save the costs of an FSS, an ELV
operator will have to use another hazard
control strategy which will likely be a
flight hazard analysis. In the regulatory
impact analysis, two small businesses
have to perform a flight hazard analysis.
However, the cost savings of not having
to have an FSS will far exceed the costs
of the flight hazard analysis.
iii. Flight Abort (§ 450.108(d)) Flight
Safety Limits Constraint
Some operators will choose to do a
CEC analysis voluntarily as part of the
flight safety limits analysis so they can
expand the area their flights can pass
through. These operators would only do
this additional analysis if they expected
the benefit to exceed the cost. The
estimated voluntary cost of $10,000 per
license could be incurred by small
businesses.
iv. Far-Field Overpressure Blast Effects
Analysis (§ 450.137)
Additional costs are $330 per
application.
v. Safety-Critical System Design
(§ 450.143)
Additional documentation costs are
$1,649 per application.
vi. Ground Hazard Analysis (§ 450.185)
RLV applicants might incur about
$7,254 more per application due to
having to perform ground hazard
analyses under the final rule.
As previously discussed, the FAA
provides a compliance period of five
years in the final rule for holders of
current licenses at the effective date of
the final rule and those who have an
accepted application within 90 days of
the effective date of the final rule. This
will give all businesses, including the
small operators, more time to comply
with the final rule. This will reduce the
burden on small entities.
C. International Trade Impact
Assessment
The Trade Agreements Act of 1979
(Pub. L. 96–39), as amended by the
Uruguay Round Agreements Act (Pub.
L. 103–465), prohibits Federal agencies
from establishing standards or engaging
in related activities that create
unnecessary obstacles to the foreign
commerce of the United States.
Pursuant to these Acts, the
establishment of standards is not
considered an unnecessary obstacle to
the foreign commerce of the United
States, if the standard has a legitimate
domestic objective, such as the
PO 00000
Frm 00139
Fmt 4701
Sfmt 4700
79703
protection of safety, and does not
operate in a manner that excludes
imports that meet this objective. The
statute also requires consideration of
international standards and, where
appropriate, that they serve as the basis
for U.S. standards. The FAA has
assessed the potential effect of this final
rule and determined that it will not
create unnecessary obstacles to the
foreign commerce of the United States.
D. Unfunded Mandates Assessment
Title II of the Unfunded Mandates
Reform Act of 1995 (Pub. L. 104–4)
requires each Federal agency to prepare
a written statement assessing the effects
of any Federal mandate in a proposed or
final agency rule that may result in an
expenditure of $100 million or more (in
1995 dollars) in any one year by State,
local, and tribal governments, in the
aggregate, or by the private sector; such
a mandate is deemed to be a ‘‘significant
regulatory action.’’ The threshold after
adjustment for inflation is $150 million
using the most current annual (2017)
Implicit Price Deflator for Gross
Domestic Product from the U.S. Bureau
of Economic Analysis. This final rule
does not contain such a mandate;
therefore, the requirements of Title II of
the Act do not apply.
E. Paperwork Reduction Act
The Paperwork Reduction Act of 1995
(44 U.S.C. 3507(d)) requires that the
FAA consider the impact of paperwork
and other information collection
burdens imposed on the public.
According to the 1995 amendments to
the Paperwork Reduction Act (5 CFR
1320.8(b)(2)(vi)), an agency may not
collect or sponsor the collection of
information, nor may it impose an
information collection requirement,
unless it displays a currently valid
Office of Management and Budget
(OMB) control number.
This action contains the following
proposed consolidation of two existing
information collection requirements,
previously approved under OMB
Control Numbers 2120–0608 and 2120–
0643, under a new OMB control
number. As required by the Paperwork
Reduction Act of 1995 (44 U.S.C.
3507(d)), the FAA will submit the
proposed information collection
requirements to OMB for its review. In
addition, the FAA has published a
separate notice of the proposed
requirements for public comment, and
has included the notice in the docket for
this rulemaking. The notice includes
instructions on how to submit
comments specifically to the proposed
information collection requirements.
Additional details on assumptions and
E:\FR\FM\10DER2.SGM
10DER2
79704
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
calculations used in this section are
presented in the Preliminary Regulatory
Impact Analysis available in the docket
of this rulemaking. The following
estimates are included in the total
savings and costs summarized in the
Regulatory Evaluation section and
considered in the Regulatory Flexibility
Determination section of this proposed
rule.
Because the FAA is allowing a five
year compliance period for existing
operators holding a license under parts
417, 431, or 435, OMB Control Numbers
2120–0608 and 2120–0643 will
continue to be renewed for five years.
After five years, all operators are
expected to comply with part 450 and
the new OMB number for collections.
Summary: The FAA proposes to
consolidate under a new part 450, the
requirements currently contained in
parts 415 and 417 for the launch of an
ELV, in part 431 for the launch and
reentry of an RLV, and in part 435 for
the reentry of a reentry vehicle other
than an RLV. The result of this effort
will be streamlined regulations designed
to be more flexible and scalable, with
reduced timelines and minimal
duplicative jurisdiction. The net result
will be reduced paperwork for
operators, although for some provisions
paperwork would increase.
Use: The information would be used
by FAA to evaluate the launch and
reentry operators’ applications and to
ensure safety.
Paperwork Impact to Industry
Respondents: The information
collection will potentially affect 12
operators based on available data at the
time of writing.
Annual Burden Estimate: Most
changes in part 450 will result in a
reduction in paperwork burden. The
paperwork associated with industry
requesting waivers to certain provisions
will be alleviated. Paperwork associated
with industry requesting license
modifications would also be reduced
because an operator will not have to
modify a license if the specific safety
official were to change. In addition,
with the extension of RLV licenses to up
to five years, it is likely that fewer
licenses will be issued, resulting in less
paperwork. Due to the change in launch
scope, the documentation
accompanying a ground hazard analysis
for ELV operators would be reduced.
Industry Cost Savings
The following table indicates the
frequency of responses, the estimated
time per response, the burdened wage
rate, annual hours, and the cost for each
cost saving provision. Response
frequency is provided for the estimated
number of waivers avoided (§ 450.3),
estimated reduction in annual number
of licenses modified (§ 450.103),
estimated reduction in annual license
renewals, and estimated annual number
of launches for which there would be a
reduction in ground hazard analysis
paperwork (§ 450.185). An estimated
time for each response is also indicated
below, as are burdened hourly wage
rates for the specific personnel
associated with each provision and
annual hours and total cost savings.
INDUSTRY PAPERWORK COST SAVINGS
Estimated
time per
response
(hours)
Response
frequency
Description
Industry
wage rate
Annual
hours
Cost
savings
Waiver Avoidance (§ 450.3) .................................................
System Safety Program—Safety Official (§ 450.103) ..........
Duration of a Vehicle License (§ 450.7) ..............................
Ground Hazard Analysis (§ 450.185) ...................................
17
5.6
1.2
1
20
24
126.5
340
$101.52
72.40
82.43
82.43
340
134.4
151.8
340
$34,518
9,731
12,513
28,026
Total Annual Savings ....................................................
24.8
........................
........................
966
84,788
Cost savings includes paperwork
related to waivers avoided due to the
definition of ‘‘launch,’’ waterborne
vessel protection, and removal of the 48hour readiness requirement.
Industry Paperwork Burden
Other changes will result in an
increase in paperwork burden. The
Payload Review and Determination
section (§ 450.43) adds requirements for
applicants to provide explosive
potential of payload materials, alone
and in combination with other materials
on the payload for launches, as well as
the appropriate transit time to final orbit
for payloads with significant transit
time after release from the vehicle. The
FAA is adding requirements for ground
hazard analysis (§ 450.185) for RLV
launches. The provisions that will lead
to additional paperwork burdens are
listed in the table below. The final rule
requires RLVs to submit information to
the FAA.
The table below indicates the
frequency of responses, estimated time
per response, burdened hourly wage
rate, annual hours, and the cost for each
provision that would add burden. An
estimated time per response is also
indicated below, as are burdened hourly
wage rates for the specific personnel
associated with each provision and
annual hours and total cost savings.
INDUSTRY PAPERWORK BURDEN
jbell on DSKJLSW7X2PROD with RULES2
Explosive Potential (§ 450.43) .............................................
Transit time (§ 450.43) .........................................................
Ground Hazard Analysis (§ 450.185) ...................................
Safety criteria (§ 450.101(c)) ................................................
Flight Hazard Analysis (§ 450.107) ......................................
Flight Abort (§ 450.108(d)) Flight Safety Limits Constraint
Flight Safety Limit Analysis (§ 450.123) ..............................
Far-field Overpressure Blast Effects Analysis (§ 450.137) ..
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Estimated
time per
response
(hours)
Response
frequency
Description
PO 00000
Frm 00140
82
82
2
4
2
2
12
3
Fmt 4701
Sfmt 4700
2
0.5
88
60.66
53
121
58
4
Industry
wage rate
$82.43
82.43
82.43
82.43
82.43
82.43
82.43
82.43
E:\FR\FM\10DER2.SGM
10DER2
Annual
hours
164
41.0
176
80.88
106.67
242.63
692
12
Cost
$13,519
3,380
14,508
6,667
8,793
20,000
57,042
989
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
79705
INDUSTRY PAPERWORK BURDEN—Continued
Estimated
time per
response
(hours)
Response
frequency
Description
Industry
wage rate
Annual
hours
Cost
Safety-Critical System Design .............................................
Waivers for Neighboring Operations Personnel ..................
Modification Costs for Existing Licenses .............................
Records set up, record, archive ..........................................
Records retrieve and present ..............................................
4
18.9
3
82
1
20
20
693
4
8
82.43
101.52
82.43
89.72
74.15
80
378
693
328
8
6,594
38,375
57,124
29,429
593
Total Cost Burden .........................................................
298
........................
........................
3,002
257,012
The following table summarizes the
industry total annual paperwork
savings, total annual paperwork burden
and the net annual paperwork savings.
INDUSTRY NET PAPERWORK SAVINGS
Description
Annual hours
Cost savings
Total Annual Savings ...............................................................................................................................................
Total Annual Burden ................................................................................................................................................
966
3,002
$84,787
257,012
Net Annual Burden ...........................................................................................................................................
2,036
172,225
Paperwork Burden to the Federal
Government
The following tables summarizes FAA
paperwork savings and burden. Similar
to industry burden savings, the FAA
receives burden relief from waivers
avoided due to the definition of
‘‘launch,’’ waterborne vessel protection,
and removal of the 48-hour readiness
requirement. Other provisions the FAA
receives relief from and provisions that
Estimated time
per response
(hours)
Description
will impose additional paperwork
burden to the FAA are detailed in the
tables below. See the Regulatory Impact
Analysis available in the docket for
more details on these estimates and
calculations.
FAA wage rate
Annual hours
Cost savings
FAA Paperwork Cost Savings
Waiver Avoidance (§ 450.3) .............................................................................
System Safety Program—Safety Official (§ 450.103) ......................................
Duration of a Vehicle License (§ 450.7) ..........................................................
Ground Safety (§ 450.185) ..............................................................................
7.5
24
253.5
439
$85.17
84.79
85.54
84.79
127.5
134.4
304.2
439
$10,859
11,396
26,021
37,223
Total Annual Savings ...............................................................................
........................
........................
1,005
85,499
FAA Paperwork Burden
Explosive Potential (§ 450.43) .........................................................................
Transit time (§ 450.43) .....................................................................................
Ground Safety (§ 450.185) ..............................................................................
Flight Hazard Analysis (§ 450.107) ..................................................................
Waivers for Neighboring Operations Personnel ..............................................
Modification Costs for Existing Licenses .........................................................
Records retrieve and present ..........................................................................
2.0
0.5
40
47
8
80
20
84.79
84.79
84.79
78.27
85.17
84.79
84.79
164
41
80
31
142
80
20
13,906
3,476
6,783
2,452
12,094
6,783
1,696
Total Annual Burden .................................................................................
........................
........................
558
47,191
FAA NET PAPERWORK SAVINGS
jbell on DSKJLSW7X2PROD with RULES2
Description
Annual hours
Cost savings
Total Annual Savings ...............................................................................................................................................
Total Annual Burden ................................................................................................................................................
1,005
558
$85,499
47,191
Net Annual Savings ..........................................................................................................................................
447
38,308
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
PO 00000
Frm 00141
Fmt 4701
Sfmt 4700
E:\FR\FM\10DER2.SGM
10DER2
79706
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
Individuals and organizations may
send comments on the information
collection requirement to the address
listed in the ADDRESSES section at the
beginning of this preamble by March 10,
2021. Comments also should be
submitted to the Office of Management
and Budget, Office of Information and
Regulatory Affairs, Attention: Desk
Officer for FAA, New Executive
Building, Room 10202, 725 17th Street
NW, Washington, DC 20053.
F. International Compatibility
In keeping with U.S. obligations
under the Convention on International
Civil Aviation, it is FAA policy to
conform to International Civil Aviation
Organization (ICAO) Standards and
Recommended Practices to the
maximum extent practicable. The FAA
has determined that there are no ICAO
Standards and Recommended Practices
that correspond to these proposed
regulations.
G. Environmental Analysis
FAA Order 1050.1 identifies FAA
actions that are categorically excluded
from preparation of an environmental
assessment or environmental impact
statement under the National
Environmental Policy Act in the
absence of extraordinary circumstances.
The FAA has determined this
rulemaking action qualifies for the
categorical exclusion identified in FAA
Order 1050.1 paragraph 5–6.6 and
involves no extraordinary
circumstances.
V. Executive Order Determinations
A. Executive Order 13771, Reducing
Regulation and Controlling Regulatory
Costs
This final rule is considered an E.O.
13771 deregulatory action. Details on
the estimated cost savings of this final
rule can be found in the rule’s economic
analysis.
jbell on DSKJLSW7X2PROD with RULES2
B. Executive Order 13132, Federalism
The FAA has analyzed this final rule
under the principles and criteria of
Executive Order 13132, ‘‘Federalism.’’
The agency determined that this action
will not have a substantial direct effect
on the States, or the relationship
between the Federal Government and
the States, or on the distribution of
power and responsibilities among the
various levels of government, and,
therefore, does not have federalism
implications.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
C. Executive Order 13211, Regulations
That Significantly Affect Energy Supply,
Distribution, or Use
The FAA analyzed this final rule
under Executive Order 13211, ‘‘Actions
Concerning Regulations that
Significantly Affect Energy Supply,
Distribution, or Use’’ (May 18, 2001).
The agency has determined that it is not
a ‘‘significant energy action’’ under the
executive order and it is not likely to
have a significant adverse effect on the
supply, distribution, or use of energy.
D. Executive Order 13609, International
Cooperation
Executive Order 13609, ‘‘Promoting
International Regulatory Cooperation,’’
promotes international regulatory
cooperation to meet shared challenges
involving health, safety, labor, security,
environmental, and other issues and to
reduce, eliminate, or prevent
unnecessary differences in regulatory
requirements. The FAA has analyzed
this action under the policies and
agency responsibilities of Executive
Order 13609, and has determined that
this action will not affect international
regulatory cooperation.
VI. How To Obtain Additional
Information
An electronic copy of a rulemaking
document may be obtained by using the
internet—
1. Search the Federal eRulemaking
Portal at https://www.regulations.gov;
2. Visit the FAA’s Regulations and
Policies web page at https://
www.faa.gov/regulations_policies/; or
3. Access the Government Printing
Office’s web page at https://
www.gpo.gov/fdsys/.
Copies may also be obtained by
sending a request (identified by notice,
amendment, or docket number of this
rulemaking) to the Federal Aviation
Administration, Office of Rulemaking,
ARM–1, 800 Independence Avenue SW,
Washington, DC 20591, or by calling
(202) 267–9677.
Comments Submitted to the Docket
Comments received may be viewed by
going to https://www.regulations.gov and
following the online instructions to
search the docket number for this
action. Anyone may search the
electronic form of all comments
received into any of the FAA’s dockets
by the name of the individual
submitting the comment (or signing the
comment, if submitted on behalf of an
association, business, labor union, etc.).
Frm 00142
Fmt 4701
Sfmt 4700
The Small Business Regulatory
Enforcement Fairness Act (SBREFA) of
1996 requires FAA to comply with
small entity requests for information or
advice about compliance with statutes
and regulations within its jurisdiction.
A small entity with questions regarding
this document, may contact its local
FAA official, or the person listed under
the FOR FURTHER INFORMATION CONTACT
heading at the beginning of the
preamble. To find out more about
SBREFA on the internet, visit https://
www.faa.gov/regulations_policies/
rulemaking/sbre_act/.
List of Subjects
14 CFR Part 401
Organization and functions
(Government agencies), Space
Transportation and exploration.
14 CFR Part 404
Administrative practice and
procedure, Space transportation and
exploration.
14 CFR Part 413
Confidential business information,
Space transportation and exploration.
14 CFR Part 414
Rulemaking Documents
PO 00000
Small Business Regulatory Enforcement
Fairness Act
Airspace, Aviation safety, Space
transportation and exploration.
14 CFR Part 415
Aviation safety, Environmental
protection, Space transportation and
exploration.
14 CFR Part 417
Aircraft, Aviation safety, Reporting
and recordkeeping requirements, Space
transportation and exploration.
14 CFR Part 420
Environmental protection, Reporting
and recordkeeping requirements, Space
transportation and exploration.
14 CFR Part 431
Aviation safety, Environmental
protection, Investigations, Reporting
and recordkeeping requirements, Space
transportation and exploration.
14 CFR Part 435
Aviation safety, Environmental
protection, Investigations, Reporting
and recordkeeping requirements, Space
transportation and exploration.
14 CFR Part 437
Aircraft, Aviation safety, Reporting
and recording keeping requirements,
Space transportation and exploration.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
14 CFR Part 440
Indemnity payments, Insurance,
Reporting and recordkeeping
requirements, Space transportation and
exploration.
14 CFR Part 450
Aircraft, Aviation safety,
Environmental protection,
Investigations, Reporting and
recordkeeping requirements, Space
transportation and exploration.
In consideration of the foregoing, the
Federal Aviation Administration
amends chapter III for commercial space
transportation rules of title 14, Code of
Federal Regulations as follows:
PART 401—ORGANIZATION AND
DEFINITIONS
1. The authority citation for part 401
continues to read as follows:
■
Authority: 51 U.S.C. 50101–50923.
2. Amend § 401.5 by revising the
introductory text to read as follows:
■
§ 401.5
Definitions.
For the purposes of parts 415, 417,
431, 435, 440, and 460 of this chapter,
the following definitions apply:
*
*
*
*
*
§ 401.5
[Removed and Reserved]
3. Effective March 10, 2026, remove
and reserve § 401.5.
■ 4. Add § 401.7 to read as follows:
■
jbell on DSKJLSW7X2PROD with RULES2
§ 401.7
Definitions.
For the purposes of this chapter
unless otherwise excepted, the
following definitions apply:
Act means 51 U.S.C Subtitle V,
Programs Targeting Commercial
Opportunities, chapter 509—
Commercial Space Launch Activities, 51
U.S.C. 50901–50923.
Anomaly means any condition during
licensed or permitted activity that
deviates from what is standard, normal,
or expected, during the verification or
operation of a system, subsystem,
process, facility, or support equipment.
Associate Administrator means the
Associate Administrator for Commercial
Space Transportation, Federal Aviation
Administration, or any person
designated by the Associate
Administrator to exercise the authority
or discharge the responsibilities of the
Associate Administrator.
Casualty means serious injury or
death.
Casualty area means the area
surrounding each potential debris or
vehicle impact point where serious
injuries, or worse, can occur.
Command control system means the
portion of a flight safety system that
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
includes all components needed to send
a flight abort control signal to the onboard portion of a flight safety system.
Contingency abort means a flight
abort with a landing at a planned
location that has been designated in
advance of vehicle flight.
Countdown means the timed
sequence of events that must take place
to initiate flight of a launch vehicle or
reentry of a reentry vehicle.
Crew means any employee or
independent contractor of a licensee,
transferee, or permittee, or of a
contractor or subcontractor of a licensee,
transferee, or permittee, who performs
activities in the course of that
employment or contract directly relating
to the launch, reentry, or other
operation of or in a launch vehicle or
reentry vehicle that carries human
beings. A crew consists of flight crew
and any remote operator.
Critical asset means an asset that is
essential to the national interests of the
United States. Critical assets include
property, facilities, or infrastructure
necessary for national security
purposes, high priority civil space
purposes, or assured access to space for
national priority missions.
Critical payload means a payload and
essential infrastructure directly
supporting such a payload that is a
critical asset that:
(1) Is so costly or unique that it cannot
be readily replaced; or
(2) The time frame for its replacement
would adversely affect the national
interests of the United States.
Crossrange means the distance
measured along a line whose direction
is either 90 degrees clockwise (right
crossrange) or counter-clockwise (left
crossrange) to the projection of a
vehicle’s planned nominal velocity
vector azimuth onto a horizontal plane
tangent to the ellipsoidal Earth model at
the vehicle’s sub-vehicle point. The
terms right crossrange and left
crossrange may also be used to indicate
direction.
Deorbit means the flight of a vehicle
that begins with the final command to
commit to a perigee below 70 nautical
miles (approximately 130 kilometers),
and ends when all vehicle components
come to rest on the Earth.
Disposal means the return or attempt
to return, purposefully, a launch vehicle
stage or component, not including a
reentry vehicle, from Earth orbit to
Earth, in a controlled manner.
Downrange means the distance
measured along a line whose direction
is parallel to the projection of a vehicle’s
planned nominal velocity vector
azimuth into a horizontal plane tangent
to the ellipsoidal Earth model at the
PO 00000
Frm 00143
Fmt 4701
Sfmt 4700
79707
vehicle sub-vehicle point. The term
downrange may also be used to indicate
direction.
Effective casualty area means the
aggregate casualty area of each piece of
debris created by a vehicle failure at a
particular point on its trajectory. The
effective casualty area for each piece of
debris is a modeling construct in which
the area within which 100 percent of the
population are assumed to be a casualty,
and outside of which 100 percent of the
population are assumed not to be a
casualty.
Equivalent level of safety means an
approximately equal level of safety as
determined by qualitative or
quantitative means.
Expected casualty means the mean
number of casualties predicted to occur
per flight operation if the operation
were repeated many times.
Expendable launch vehicle means a
launch vehicle whose propulsive stages
are flown only once.
Experimental permit or permit means
an authorization by the FAA to a person
to launch or reenter a reusable
suborbital rocket.
Explosive debris means solid
propellant fragments or other pieces of
a vehicle or payload that result from
breakup of the vehicle during flight and
that explode upon impact with the
Earth’s surface and cause overpressure.
Federal launch or reentry site means
a launch or reentry site, from which
launches routinely take place, that is
owned and operated by the government
of the United States.
Flight abort means the process to limit
or restrict the hazards to public safety,
and the safety of property, presented by
a launch vehicle or reentry vehicle,
including any payload, while in flight
by initiating and accomplishing a
controlled ending to vehicle flight.
Flight abort rules means the
conditions under which a flight safety
system must abort the flight to ensure
compliance with the safety criteria in
§ 450.101.
Flight crew means crew that is on
board a vehicle during a launch or
reentry.
Flight hazard area means any region
of land, sea, or air that must be
surveyed, publicized, controlled, or
evacuated to ensure compliance with
the safety criteria in § 450.101.
Flight safety limit means criteria to
ensure that public safety and critical
assets are protected from the flight of a
vehicle when a flight safety system
functions properly.
Flight safety system means a system
used to implement flight abort. A flight
safety system includes any flight safety
system located on board a launch or
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79708
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
reentry vehicle; any ground based
command control system; any support
system, including telemetry subsystems
and tracking subsystems, necessary to
support a flight abort decision; and the
functions of any personnel who operate
the flight safety system hardware or
software.
Hazard control means a preventative
measure or mitigation put in place for
systems or operations to reduce the
severity of a hazard or the likelihood of
the hazard occurring.
Hazardous debris means any object or
substance capable of causing a casualty
or loss of functionality to a critical asset.
Hazardous debris includes inert debris
and explosive debris such as an intact
vehicle, vehicle fragments, any detached
vehicle component whether intact or in
fragments, payload, and any planned
jettison bodies.
Hazardous materials means
hazardous materials as defined in 49
CFR 172.101.
Instantaneous impact point means a
predicted impact point, following thrust
termination of a vehicle.
Key flight safety event means a flight
activity that has an increased likelihood
of causing a failure compared with other
portions of flight.
Launch means to place or try to place
a launch vehicle or reentry vehicle and
any payload or human being from Earth
in a suborbital trajectory, in Earth orbit
in outer space, or otherwise in outer
space, including activities involved in
the preparation of a launch vehicle or
payload for launch, when those
activities take place at a launch site in
the United States.
Launch operator means a person who
conducts or who will conduct the
launch of a launch vehicle and any
payload.
Launch or reentry system means the
integrated set of subsystems, personnel,
products, and processes that, when
combined, carries out a launch or
reentry.
Launch site means the location on
Earth from which a launch takes place
(as defined in a license the Secretary
issues or transfers under this chapter)
and necessary facilities at that location.
Launch vehicle means a vehicle built
to operate in, or place a payload in,
outer space or a suborbital rocket.
Launch window means an approved
period of time during which the flight
of a launch vehicle may be initiated.
Liftoff means any motion of the
launch vehicle with intention to initiate
flight.
Limits of a useful mission means the
trajectory data or other parameters that
bound the performance of a useful
mission, including flight azimuth limits.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Mishap means any event, or series of
events associated with a licensed or
permitted activity resulting in any of the
following:
(1) A fatality or serious injury (as
defined in 49 CFR 830.2);
(2) A malfunction of a safety-critical
system;
(3) A failure of the licensee’s or
permittee’s safety organization, safety
operations, safety procedures;
(4) High risk, as determined by the
FAA, of causing a serious or fatal injury
to any space flight participant, crew,
government astronaut, or member of the
public;
(5) Substantial damage, as determined
by the FAA, to property not associated
with licensed or permitted activity;
(6) Unplanned substantial damage, as
determined by the FAA, to property
associated with licensed or permitted
activity;
(7) Unplanned permanent loss of a
launch or reentry vehicle during
licensed activity or permitted activity;
(8) The impact of hazardous debris
outside the planned landing site or
designated hazard area; or
(9) Failure to complete a launch or
reentry as planned as reported in
§ 450.213(b).
Neighboring operations personnel
means those members of the public
located within a launch or reentry site,
or an adjacent launch or reentry site,
who are not associated with a specific
hazardous licensed or permitted
operation currently being conducted,
but are required to perform safety,
security, or critical tasks at the site and
are notified of the operation.
Nominal means, in reference to
launch vehicle performance, trajectory,
or stage impact point, a launch vehicle
flight where all vehicle aerodynamic
parameters are as expected, all vehicle
internal and external systems perform
exactly as planned, and there are no
external perturbing influences other
than atmospheric drag and gravity.
Normal flight means the flight of a
properly performing vehicle whose realtime vacuum instantaneous impact
point does not deviate from the nominal
vacuum instantaneous impact point by
more than the sum of the wind effects
and the three-sigma guidance and
performance deviations in the uprange,
downrange, left-crossrange, or rightcrossrange directions.
Normal trajectory means a trajectory
that describes normal flight.
Operating environment means an
environment that a launch or reentry
vehicle component will experience
during its lifecycle. Operating
environments include shock, vibration,
thermal cycle, acceleration, humidity,
PO 00000
Frm 00144
Fmt 4701
Sfmt 4700
thermal vacuum, or other environments
relevant to system or material
degradation.
Operation hazard means a hazard
created by an operating environment or
by an unsafe act.
Operation of a launch site means the
conduct of approved safety operations at
a permanent site to support the
launching of vehicles and payloads.
Operation of a reentry site means the
conduct of safety operations at a
permanent site on Earth at which a
reentry vehicle and its payload, if any,
is intended to land.
Operator means a holder of a license
or permit under 51 U.S.C. Subtitle V,
chapter 509.
Orbital insertion means the point at
which a vehicle achieves a minimum
70-nautical mile perigee based on a
computation that accounts for drag.
Payload means an object that a person
undertakes to place in outer space by
means of a launch vehicle, including
components of the vehicle specifically
designed or adapted for that object.
Person means an individual or an
entity organized or existing under the
laws of a State or country.
Physical containment means a launch
vehicle does not have sufficient energy
for any hazards associated with its flight
to reach the public or critical assets.
Physical electronic storage means a
physical device that can store electronic
documents and files including but not
limited to an optical disc, a memory
card, a USB flash drive, or an external
hard drive.
Pilot means a flight crew member who
has the ability to control, in real time,
a launch or reentry vehicle’s flight path.
Populated area means—
(1) An outdoor location, structure, or
cluster of structures that may be
occupied by people;
(2) Sections of roadways and
waterways that are frequented by
automobile and boat traffic; or
(3) Agricultural lands, if routinely
occupied by field workers.
Probability of casualty means the
likelihood that a person will suffer a
serious injury or worse, including a fatal
injury, due to all hazards from an
operation at a specific location.
Public means, for a particular licensed
or permitted launch or reentry, people
that are not involved in supporting the
launch or reentry and includes those
people who may be located within the
launch or reentry site, such as visitors,
individuals providing goods or services
not related to launch or reentry
processing or flight, and any other
operator and its personnel.
Reenter; reentry means to return or
attempt to return, purposefully, a
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
reentry vehicle and its payload or
human being, if any, from Earth orbit or
from outer space to Earth.
Reentry operator means a person
responsible for conducting the reentry
of a reentry vehicle as specified in a
license issued by the FAA.
Reentry site means the location on
Earth where a reentry vehicle is
intended to return. It includes the area
within three standard deviations of the
intended landing point (the predicted
three-sigma footprint).
Reentry vehicle means a vehicle
designed to return from Earth orbit or
outer space to Earth substantially intact.
A reusable launch vehicle that is
designed to return from Earth orbit or
outer space to Earth substantially intact
is a reentry vehicle.
Reentry window means an approved
period of time during which the reentry
of a reentry vehicle may be initiated.
Remote operator means a crew
member who—
(1) Has the ability to control, in real
time, a launch or reentry vehicle’s flight
path; and
(2) Is not on board the controlled
vehicle.
Reusable launch vehicle (RLV) means
a launch vehicle that is designed to
return to Earth substantially intact and
therefore may be launched more than
one time or that contains vehicle stages
that may be recovered by a launch
operator for future use in the operation
of a substantially similar launch vehicle.
Risk means a measure that accounts
for both the probability of occurrence of
a hazardous event and the consequence
of that event to persons or property.
Safety critical means essential to safe
performance or operation. A safetycritical system, subsystem, component,
condition, event, operation, process, or
item, is one whose proper recognition,
control, performance, or tolerance, is
essential to ensuring public safety and
the safety of property.
Service life means, for a safety-critical
system component, the sum total of the
component’s storage life and operating
life.
Sigma means a single standard
deviation from a fixed value, such as a
mean.
Software function means a collection
of computer code that implements a
requirement or performs an action. This
includes firmware and operating
systems.
Space flight participant means an
individual, who is not crew, carried
aboard a launch vehicle or reentry
vehicle.
State and United States means, when
used in a geographical sense, the several
States, the District of Columbia, the
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Commonwealth of Puerto Rico,
American Samoa, the United States
Virgin Islands, Guam, and any other
commonwealth, territory, or possession
of the United States.
Suborbital rocket means a vehicle,
rocket-propelled in whole or in part,
intended for flight on a suborbital
trajectory, and the thrust of which is
greater than its lift for the majority of
the rocket-powered portion of its ascent.
Suborbital trajectory means the
intentional flight path of a launch
vehicle, reentry vehicle, or any portion
thereof, whose vacuum instantaneous
impact point does not leave the surface
of the Earth.
Sub-vehicle point means the location
on an ellipsoidal Earth model where the
normal to the ellipsoid passes through
the vehicle’s center of gravity.
System hazard means a hazard
associated with a system and generally
exists even when no operation is
occurring.
Tether system means a device that
contains launch vehicle hazards by
physically constraining a launch vehicle
in flight to a specified range from its
launch point. A tether system includes
all components, from the tether’s point
of attachment to the vehicle to a solid
base, that experience load during a
tethered launch.
Toxic hazard area means a region on
the Earth’s surface where toxic
concentrations and durations may be
greater than accepted toxic thresholds
for acute casualty, in the event of a
worst case release or maximum credible
release scenario during launch or
reentry.
Uncontrolled area is an area of land
not controlled by a launch or reentry
operator, a launch or reentry site
operator, an adjacent site operator, or
other entity by agreement.
Unguided suborbital launch vehicle
means a suborbital rocket that does not
contain active guidance or a directional
control system.
United States citizen means:
(1) Any individual who is a citizen of
the United States;
(2) Any corporation, partnership, joint
venture, association, or other entity
organized or existing under the laws of
the United States or any State; and
(3) Any corporation, partnership, joint
venture, association, or other entity
which is organized or exists under the
laws of a foreign nation, if the
controlling interest in such entity is
held by an individual or entity
described in paragraph (1) or (2) of this
definition. Controlling interest means
ownership of an amount of equity in
such entity sufficient to direct
management of the entity or to void
PO 00000
Frm 00145
Fmt 4701
Sfmt 4700
79709
transactions entered into by
management. Ownership of at least fiftyone percent of the equity in an entity by
persons described in paragraph (1) or (2)
of this definition creates a rebuttable
presumption that such interest is
controlling.
Uprange means the distance
measured along a line that is 180
degrees to the downrange direction.
Useful mission means a mission that
can attain one or more objectives.
Validation means an evaluation to
determine that each safety measure
derived from a system safety process is
correct, complete, consistent,
unambiguous, verifiable, and
technically feasible. Validation ensures
that the right safety measure is
implemented, and that the safety
measure is well understood.
Verification means an evaluation to
determine that safety measures derived
from a system safety process are
effective and have been properly
implemented. Verification provides
measurable evidence that a safety
measure reduces risk to acceptable
levels.
Wind weighting safety system means
equipment, procedures, analysis and
personnel functions used to determine
the launcher elevation and azimuth
settings that correct for wind effects that
an unguided suborbital launch vehicle
will experience during flight.
Window closure means a period of
time when launch or reentry is not
permitted in order to avoid a collision
with an object in orbit. A window
closure may occur within a launch or
reentry window, may delay the start of
a window, or terminate a window early.
PART 404—REGULATIONS AND
LICENSING REQUIREMENTS
5. The authority citation for part 404
continues to read as follows:
■
Authority: 51 U.S.C. 50901–50923.
■
6. Revise § 404.5 to read as follows:
§ 404.5
Filing a petition for waiver.
(a) A petition for waiver must be
submitted at least 60 days before the
proposed effective date of the waiver,
unless the Administrator agrees to a
different time frame in accordance with
§ 404.15.
(b) The petition for waiver must
include:
(1) The specific section or sections of
14 CFR chapter III from which the
petitioner seeks relief;
(2) The extent of the relief sought and
the reason the relief is being sought;
(3) The reason why granting the
request for relief is in the public interest
and will not jeopardize the public
E:\FR\FM\10DER2.SGM
10DER2
79710
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
health and safety, safety of property,
and national security and foreign policy
interests of the United States; and
(4) Any additional facts, views, and
data available to the petitioner to
support the waiver request.
■
7. Add § 404.15 to read as follows:
§ 404.15
Alternative Time Frames.
(a) General. Unless otherwise
approved by the Administrator, an
applicant, a licensee, a permittee, or a
safety element approval holder must
meet the time frames set forth in this
chapter.
(b) Request to change a time frame.
An applicant, a licensee, a permittee, or
a safety element approval holder may
file a written request to the FAA to
propose an alternative time frame to any
of the time frames included in the
chapter III sections listed in Appendix
A to part 404. The request must be—
(1) Emailed to ASTApplications@
faa.gov in accordance with § 413.7; or
(2) Mailed to the Federal Aviation
Administration, Associate
Administrator for Commercial Space
Transportation, Room 331, 800
Independence Avenue SW, Washington,
DC 20591. Attention: Alternative Time
Frame Request.
(c) Administrator review. The
Administrator will review and make a
decision or grant a request for an
alternative time frame as follows:
(1) The FAA will conduct its review
on a case-by-case basis, taking into
account the complexity of the request,
the timeliness of the request, and
whether the requested alternative allows
sufficient time for the FAA to conduct
its review and make the requisite public
health and safety, safety of property,
and national security and foreign policy
findings;
(2) The FAA will provide its decision
in writing; and
(3) The FAA may grant the request,
deny the request, or grant an alternative
time frame that differs from what was
requested.
■ 8. Add appendix A to part 404 the
read as follows:
Appendix A to Part 404—Alternative
Time Frames
A404.1 General
Alternative time frames. This appendix
lists the sections and corresponding
paragraphs in this chapter that provide the
eligible time frames for an applicant,
licensee, permittee, or safety element
approval holder, as applicable, to request an
alternative time frame.
TABLE A404.1—ELIGIBLE TIME FRAMES
Sections
Paragraphs
§ 404.5—Filing a petition for waiver ..............................................................................................................................
§ 413.23—License or permit renewal ............................................................................................................................
§ 414.31—Safety element approval renewal .................................................................................................................
§ 420.57—Notifications ..................................................................................................................................................
§ 437.89—Pre-flight reporting ........................................................................................................................................
§ 440.15—Demonstration of compliance .......................................................................................................................
§ 450.169—Launch and Reentry Collision Avoidance Analysis Requirements ............................................................
§ 450.213—Pre-flight reporting ......................................................................................................................................
§ 450.215—Post-flight reporting ....................................................................................................................................
§ 413.1
PART 413—APPLICATION
PROCEDURES
9. The authority citation for part 413
continues to read as follows:
■
Authority: 51 U.S.C. 50901–50923.
■
10. Revise § 413.1 to read as follows:
Scope of this part.
(a) This part explains how to apply for
a license or experimental permit. These
procedures apply to all applications for
obtaining a license or permit,
transferring a license, and renewing a
license or permit. In this part, the term
application means either an application
(a).
(a).
(a).
(d).
(a), (b).
(a)(1), (a)(2), (a)(3), (a)(4).
(f)(1).
(b), (c), (d), (e).
(a)
in its entirety, or a portion of an
application for incremental review and
determination in accordance with
§ 450.33 of this chapter.
(b) Use paragraphs (b)(1) through (7)
in the following table to locate specific
requirements:
Subject
(1)
(2)
(3)
(4)
(5)
(6)
(7)
Part
Obtaining a Launch License (only applications accepted before June 8, 2021) ..........................................................................
License to Operate a Launch Site .................................................................................................................................................
Launch and Reentry of a Reusable Launch Vehicle (RLV) (only applications accepted before June 8, 2021) ..........................
License to Operate a Reentry Site ................................................................................................................................................
Reentry of a Reentry Vehicle other than a Reusable Launch Vehicle (RLV) (only applications accepted before June 8, 2021)
Experimental Permits .....................................................................................................................................................................
Launch and Reentry License Requirements .................................................................................................................................
11. Effective March 10, 2026, futher
amend § 413.1 by revising paragraphs
■
(b)(1) through (4) and removing
paragraphs (b)(5) through (7).
The revisions read read as follows:
§ 413.1
*
Scope of this part.
*
*
(b) * * *
*
*
jbell on DSKJLSW7X2PROD with RULES2
Subject
(1)
(2)
(3)
(4)
Part
License to Operate a Launch Site .................................................................................................................................................
License to Operate a Reentry Site ................................................................................................................................................
Experimental Permits .....................................................................................................................................................................
Launch and Reentry License Requirements .................................................................................................................................
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
PO 00000
Frm 00146
Fmt 4701
415
420
431
433
435
437
450
Sfmt 4700
E:\FR\FM\10DER2.SGM
10DER2
420
433
437
450
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
12. Amend § 413.7 by revising the
section heading and paragraph (a)(3) to
read as follows:
■
§ 413.7
Application submission.
(a) * * *
(3) For an application submitted by
email, an applicant must send the
application as an email attachment, or
as a link to a secure server, to
ASTApplications@faa.gov. The
application and the email to which the
application is attached or linked must
also satisfy the following criteria:
(i) The email to which the application
is attached or linked must be sent from
an email address controlled by the
person who signed the application or by
an authorized representative of the
applicant;
(ii) The email must identify each
document that is included as an
attachment or that is stored on a secure
server; and
(iii) The electronic files must be datestamped and have version control
documentation.
*
*
*
*
*
■ 13. Amend § 413.11 by revising
paragraph (a) to read as follows:
§ 413.11
Acceptance of an application.
*
*
*
*
*
(a) The FAA accepts the application
and will initiate review; or
*
*
*
*
*
■ 14. Revise § 413.15 to read as follows:
jbell on DSKJLSW7X2PROD with RULES2
§ 413.15
Review period.
(a) Review period duration. Unless
otherwise specified in this chapter, the
FAA reviews and makes a license or
permit determination on an accepted
application in accordance with the time
frame specified in 51 U.S.C. 50905(a)(1).
The FAA will establish the time frame
for any incremental review and
determination with an applicant on a
case-by-case basis during preapplication consultation.
(b) Review period tolled. If an
accepted application does not provide
sufficient information to continue or
complete the reviews or evaluations
required by this chapter for a license,
permit, or incremental determination, or
an issue exists that would affect a
determination, the FAA notifies the
applicant, in writing, and informs the
applicant of any information required to
complete the application. If the FAA
cannot review an accepted application
because of lack of information or for any
other reason, the FAA will toll the
review period until the FAA receives
the information it needs or the applicant
resolves the issue.
(c) Notice. Except for applications
under incremental review and
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
determination in accordance with
§ 450.33, if the FAA does not make a
decision in accordance with the time
frame specified in 51 U.S.C. 50905(a)(1)
for an accepted license application or 51
U.S.C. 50906(a) for an accepted permit
application, the FAA informs the
applicant, in writing, of any outstanding
information needed to complete the
review, or of any issues that would
affect the decision.
■ 15. Amend § 413.21 by revising
pargraphs (b) and (c) to read as follows:
§ 413.21 Denial of a license or permit
application.
*
*
*
*
*
(b) If the FAA has denied an
application in its entirety, the applicant
may either—
(1) Attempt to correct any deficiencies
identified and ask the FAA to
reconsider the revised application, in
which case the FAA has 60 days or the
number of days remaining in the review
period, whichever is greater, within
which to reconsider the decision; or
(2) Request a hearing in accordance
with part 406 of this chapter, for the
purpose of showing why the application
should not be denied.
(c) An applicant whose application is
denied after reconsideration under
paragraph (b)(1) of this section may
request a hearing in accordance with
paragraph (b)(2) of this section.
■ 16. Amend § 413.23 by revising
paragraphs (a) and (d) to read as follows:
§ 413.23
License or permit renewal.
*
*
*
*
*
(a) Eligibility. (1) A licensee or
permittee may apply to renew its license
or permit by submitting to the FAA a
written application for renewal at least
90 days before the license expires or at
least 60 days before the permit expires,
unless the Administrator agrees to a
different time frame in accordance with
§ 404.15.
(2) A request to renew a licensed
under parts 415, 431, and 435 may be
granted with a non-standard duration so
as not to exceed March 10, 2026.
*
*
*
*
*
(d) Renewal of license or permit. After
the FAA finishes its reviews, the FAA
issues an order modifying the expiration
date of the license or permit. The FAA
may impose additional or revised terms
and conditions necessary to protect
public health and safety and the safety
of property and to protect U.S. national
security and foreign policy interests.
The renewal period for a license issued
under parts 415, 431, or 435 of this
chapter cannot extend beyond March
10, 2026.
*
*
*
*
*
PO 00000
Frm 00147
Fmt 4701
Sfmt 4700
79711
17. Effective March 10, 2026, § 413.23
is further amended by revising
paragraphs (a) and (d) to read as follows:
■
§ 413.23
License or permit renewal.
*
*
*
*
*
(a) Eligibility. A licensee or permittee
may apply to renew its license or permit
by submitting to the FAA a written
application for renewal at least 90 days
before the license expires or at least 60
days before the permit expires, unless
the Administrator agrees to a different
time frame in accordance with § 404.15.
*
*
*
*
*
(d) Renewal of license or permit. After
the FAA finishes its reviews, the FAA
issues an order modifying the expiration
date of the license or permit. The FAA
may impose additional or revised terms
and conditions necessary to protect
public health and safety and the safety
of property and to protect U.S. national
security and foreign policy interests.
*
*
*
*
*
■ 18. Revise part 414 to read as follows:
PART 414—SAFETY ELEMENT
APPROVALS
Sec.
Subpart A—General
414.1 Scope
414.3 Definitions.
414.5 Applicability.
414.7 Eligibility.
Subpart B—Application Procedures
414.9 Pre-application consultation.
414.11 Application.
414.13 Application separate from a vehicle
operator license application.
414.15 Application concurrent with vehicle
operator license application.
414.17 Confidentiality.
414.19 Processing the initial application.
414.21 Maintaining the continued accuracy
of the initial application.
Subpart C—Safety Element Approval
Review and Issuance
414.23 Technical criteria for reviewing a
safety element approval application.
414.25 Terms and conditions for issuing a
safety element approval; duration of a
safety element approval.
414.27 Maintaining the continued accuracy
of the safety element approval
application.
414.29 Safety element approval records.
414.31 Safety element approval renewal.
414.33 Safety element approval transfer.
414.35 Monitoring compliance with the
terms and conditions of a safety element
approval.
414.37 Modification, suspension, or
revocation of a safety element approval.
Subpart D—Appeal Procedures
414.41 Hearings in safety element approval
actions.
414.43 Submissions; oral presentations in
safety element approval actions.
E:\FR\FM\10DER2.SGM
10DER2
79712
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
414.45 Administrative law judge’s
recommended decision in safety element
approval actions.
Authority: 51 U.S.C. 50901–50923.
Subpart A—General
§ 414.1
Scope.
This part establishes procedures for
obtaining a safety element approval and
renewing and transferring an existing
safety element approval. Safety element
approvals issued under this part may be
used to support the application review
for one or more vehicle operator license
requests under other parts of this
chapter.
§ 414.3
Definitions.
Safety element. For purposes of this
part, a safety element is any one of the
items or persons (personnel) listed in
paragraphs (1) and (2) of the definition
of ‘‘safety element approval’’ in this
section.
Safety element approval. For
purposes of this part, a safety element
approval is an FAA document
containing the FAA determination that
one or more of the safety elements listed
in paragraphs (1) and (2) of this
definition, when used or employed
within a defined envelope, parameter,
or situation, will not jeopardize public
health and safety or safety of property.
A safety element approval may be
issued independent of a license, and
does not confer any authority to conduct
activities for which a license is required
under 14 CFR chapter III. A safety
element approval does not relieve its
holder of the duty to comply with all
applicable requirements of law or
regulation that may apply to the
holder’s activities.
(1) Launch vehicle, reentry vehicle,
safety system, process, service, or any
identified component thereof; or
(2) Qualified and trained personnel,
performing a process or function related
to licensed activities or vehicles.
§ 414.5
Applicability.
jbell on DSKJLSW7X2PROD with RULES2
This part applies to an applicant that
wants to obtain a safety element
approval for any of the safety elements
defined under this part and to persons
granted a safety element approval under
this part. Any person eligible under this
part may apply to become the holder of
a safety element approval.
§ 414.7
Eligibility.
(a) There is no citizenship
requirement to obtain a safety element
approval.
(b) You may be eligible for a safety
element approval if you are—
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
(1) A designer, manufacturer, or
operator of a launch or reentry vehicle
or component thereof;
(2) The designer or developer of a
safety system or process; or
(3) Personnel who perform safetycritical functions in conducting a
licensed launch or reentry.
(c) A safety element approval
applicant must have sufficient
knowledge and expertise to show that
the design and operation of the safety
element for which safety element
approval is sought qualify for a safety
element approval.
(d) Only the safety elements defined
under this part are eligible for a safety
element approval.
Subpart B—Application Procedures
§ 414.9
Pre-application consultation.
The applicant must consult with the
FAA before submitting an application.
Unless the applicant or the FAA
requests another form of consultation,
consultation is oral discussion with the
FAA about the application process and
the potential issues relevant to the
FAA’s safety element approval decision.
§ 414.11
Application.
An applicant may submit an
application for a safety element
approval in one of two ways:
(a) Separate from a vehicle operator
license application in accordance with
§ 414.13; or
(b) Concurrent with a vehicle operator
license application in accordance with
§ 414.15.
§ 414.13 Application separate from a
vehicle operator license application.
(a) An applicant must make an
application in writing and in English.
The applicant must file the application
with the Federal Aviation
Administration either by paper, by use
of physical electronic storage, or by
email in the following manner:
(1) For an application submitted on
paper, an applicant must send two
copies of the application to the Federal
Aviation Administration, Associate
Administrator for Commercial Space
Transportation, Room 331, 800
Independence Avenue SW, Washington,
DC 20591. Attention: Application
Review.
(2) For an application submitted by
use of physical electronic storage, the
applicant must either mail the
application to the address specified in
paragraph (a)(1) of this section or handdeliver the application to an authorized
FAA representative. The application
and the physical electronic storage
containing the application must also
satisfy all of the following criteria:
PO 00000
Frm 00148
Fmt 4701
Sfmt 4700
(i) The application must include a
cover letter that is printed on paper and
signed by the person who signed the
application or by an authorized
representative of the applicant;
(ii) The cover letter must identify each
document that is included on the
physical electronic storage; and
(iii) The physical electronic storage
must be in a format such that its
contents cannot be altered.
(3) For an application submitted by
email, an applicant must send the
application as an email attachment, or
as a link to a secure server, to
ASTApplications@faa.gov. The
application and the email to which the
application is attached must also satisfy
the following criteria:
(i) The email to which the application
is attached must be sent from an email
address controlled by the person who
signed the application or by an
authorized representative of the
applicant; and
(ii) The email must identify each
document that is included as an
attachment or that is stored on a secure
server; and
(iii) The electronic files must be datestamped and have version control
documentation.
(b) The application must identify the
following basic information:
(1) Name and address of the
applicant.
(2) Name, address, and telephone
number of any person to whom
inquiries and correspondence should be
directed.
(3) Safety element as defined under
this part for which the applicant seeks
a safety element approval.
(c) The application must contain the
following technical information:
(1) A Statement of Conformance letter,
describing the specific criteria the
applicant used to show the adequacy of
the safety element for which a safety
element approval is sought, and
showing how the safety element
complies with the specific criteria.
(2) The specific operating limits for
which the safety element approval is
sought.
(3) The following as applicable:
(i) Information and analyses required
under this chapter that may be
applicable to demonstrating safe
performance of the safety element for
which the safety element approval is
sought.
(ii) Engineering design and analyses
that show the adequacy of the proposed
safety element for its intended use, such
that the use in a licensed launch or
reentry will not jeopardize public health
or safety or the safety of property.
(iii) Relevant manufacturing
processes.
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(iv) Test and evaluation procedures.
(v) Test results.
(vi) Maintenance procedures.
(vii) Personnel qualifications and
training procedures.
(d) The application must be legibly
signed, dated, and certified as true,
complete, and accurate by one of the
following:
(1) For a corporation, an officer or
other individual authorized to act for
the corporation in licensing or safety
element approval matters.
(2) For a partnership or a sole
proprietorship, a general partner or
proprietor, respectively.
(3) For a joint venture, association, or
other entity, an officer or other
individual duly authorized to act for the
joint venture, association, or other entity
in licensing matters.
(e) Failure to comply with any of the
requirements set forth in this section is
sufficient basis for denial of a safety
element approval application.
§ 414.15 Application concurrent with
vehicle operator license application.
(a) An applicant for a vehicle operator
license may also identify one or more
sections of its application for which it
seeks to obtain a safety element
approval concurrently with a license.
An applicant applying for a safety
element approval concurrently with a
license must—
(1) Meet the applicable requirements
of part 450;
(2) Provide the information required
in § 414.13(b)(3) and (c)(2) and (3); and
(3) Specify the sections of the license
application that support the application
for a safety element approval.
(b) The scope of the safety element
approval will be limited to what the
application supports. The technical
criteria for reviewing a safety element
submitted as part of a vehicle operator
license application are limited to the
applicable requirements of part 450.
jbell on DSKJLSW7X2PROD with RULES2
§ 414.17
Confidentiality.
(a) To ensure confidentiality of data or
information in the application, the
applicant must—
(1) Send a written request with the
application that trade secrets or
proprietary commercial or financial data
be treated as confidential, and include
in the request the specific time frame
confidential treatment is required.
(2) Mark data or information that
require confidentiality with an
identifying legend, such as ‘‘Proprietary
Information,’’ ‘‘Proprietary Commercial
Information,’’ ‘‘Trade Secret,’’ or
‘‘Confidential Treatment Requested.’’
Where this marking proves
impracticable, attach a cover sheet that
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
contains the identifying legend to the
data or information for which
confidential treatment is sought.
(b) If the applicant requests
confidential treatment for previously
submitted data or information, the FAA
will honor that request to the extent
practicable in case of any prior
distribution of the data or information.
(c) Data or information for which
confidential treatment is requested or
data or information that qualifies for
exemption under section 552(b)(4) of
title 5, U.S.C., will not be disclosed to
the public unless the Associate
Administrator determines that
withholding the data or information is
contrary to the public or national
interest.
§ 414.19
Processing the initial application.
(a) The FAA will initially screen an
application to determine if the
application is complete enough for the
FAA to start the review.
(b) After completing the initial
screening, the FAA will inform the
applicant in writing of one of the
following:
(1) The FAA accepts the application
and will begin the reviews or
evaluations required for a safety element
approval determination under this part.
(2) The FAA rejects the application
because it is incomplete or indefinite,
making initiation of the reviews or
evaluations required for a safety element
approval determination under this part
inappropriate.
(c) The written notice will state the
reason(s) for rejection and corrective
actions necessary for the application to
be accepted. The FAA may return a
rejected application to the applicant or
may hold it until the applicant provides
more information.
(d) The applicant may withdraw,
amend, or supplement an application
any time before the FAA makes a final
determination on the safety element
approval application by making a
written request to the Associate
Administrator. If the applicant amends
or supplements the initial application,
the revised application must meet all
the applicable requirements under this
part.
§ 414.21 Maintaining the continued
accuracy of the initial application.
The applicant is responsible for the
continuing accuracy and completeness
of information provided to the FAA as
part of the safety element approval
application. If at any time after
submitting the application,
circumstances occur that cause the
information to no longer be accurate and
complete in any material respect, the
PO 00000
Frm 00149
Fmt 4701
Sfmt 4700
79713
applicant must submit a written
statement to the Associate
Administrator explaining the
circumstances and providing the new or
corrected information. The revised
application must meet all requirements
under § 414.13 or § 414.15.
Subpart C—Safety Element Approval
Review and Issuance
§ 414.23 Technical criteria for reviewing a
safety element approval application.
The FAA will determine whether a
safety element is eligible for and may be
issued a safety element approval. The
FAA will base its determination on
performance-based criteria, against
which it may assess the effect on public
health and safety and on safety of
property, in the following hierarchy:
(a) FAA or other appropriate Federal
regulations.
(b) Government-developed or adopted
standards.
(c) Industry consensus performancebased criteria or standard.
(d) Applicant-developed criteria.
Applicant-developed criteria are
performance standards customized by
the manufacturer that intends to
produce the system, system component,
or part. The applicant-developed criteria
must define—
(1) Design and minimum
performance;
(2) Quality assurance system
requirements;
(3) Production acceptance test
specifications; and
(4) Continued operational safety
monitoring system characteristics.
§ 414.25 Terms and conditions for issuing
a safety element approval; duration of a
safety element approval.
(a) The FAA will issue a safety
element approval to an applicant that
meets all the requirements under this
part.
(b) The scope of the safety element
approval will be limited by the scope of
the safety demonstration contained in
the application on which the FAA based
the decision to grant the safety element
approval.
(c) The FAA will determine specific
terms and conditions of a safety element
approval individually, limiting the
safety element approval to the scope for
which it was approved. The terms and
conditions will include reporting
requirements tailored to the individual
safety element approval.
(d) A safety element approval is valid
for five years and may be renewed.
E:\FR\FM\10DER2.SGM
10DER2
79714
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
§ 414.27 Maintaining the continued
accuracy of the safety element approval
application.
(a) The holder of a safety element
approval must ensure the continued
accuracy and completeness of
representations contained in the safety
element approval application, on which
the approval was issued, for the entire
term of the safety element approval.
(b) If any representation contained in
the application that is material to public
health and safety or safety of property
ceases to be accurate and complete, the
safety element approval holder must
prepare and submit a revised
application according to § 414.13 or
§ 414.15 under this part. The safety
element approval holder must point out
any part of the safety element approval
or the associated application that would
be changed or affected by a proposed
modification. The FAA will review and
make a determination on the revised
application under the terms of this part.
§ 414.29
Safety element approval records.
The holder of a safety element
approval must maintain all records
necessary to verify that the holder’s
activities are consistent with the
representations contained in the
application for which the approval was
issued for the duration of the safety
element approval plus one year.
jbell on DSKJLSW7X2PROD with RULES2
§ 414.31
Safety element approval renewal.
(a) Eligibility. A holder of a safety
element approval may apply to renew it
by sending the FAA a written
application at least 90 days before the
expiration date of the approval, unless
the Administrator agrees to a different
time frame in accordance with § 404.15.
(b) Application. (1) A safety element
approval renewal application must meet
all the requirements under § 414.13 or
§ 414.15.
(2) The application may incorporate
by reference information provided as
part of the application for the expiring
safety element approval or any
modification to that approval.
(3) Any proposed changes in the
conduct of a safety element for which
the FAA has issued a safety element
approval must be described and must
include any added information
necessary to support the fitness of the
proposed changes to meet the criteria
upon which the FAA evaluated the
safety element approval application.
(c) Review of application. The FAA
conducts the reviews required under
this part to determine whether the safety
element approval may be renewed. We
may incorporate by reference any
findings that are part of the record for
the expiring safety element approval.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
(d) Grant of safety element approval
renewal. If the FAA makes a favorable
safety element approval determination,
the FAA issues an order that amends the
expiration date of the safety element
approval or issues a new safety element
approval. The FAA may impose added
or revised terms and conditions
necessary to protect public health and
safety and the safety of property.
(e) Written notice. The FAA will
provide written notice to the applicant
of its determination on the safety
element approval renewal request.
(f) Denial of a safety element approval
renewal. If the FAA denies the renewal
application, the applicant may correct
any deficiency the FAA identified and
request a reconsideration of the revised
application. The applicant also has the
right to appeal a denial as set forth in
subpart D of this part.
§ 414.33
Safety element approval transfer.
(a) Only the FAA may approve a
transfer of a safety element approval.
(b) Either the holder of a safety
element approval or the prospective
transferee may request a safety element
approval transfer.
(c) Both the holder and prospective
transferee must agree to the transfer.
(d) The person requesting the transfer
must submit a safety element approval
application according to § 414.13 or
§ 414.15, must meet the applicable
requirements of this part, and may
incorporate by reference relevant
portions of the initial application.
(e) The FAA will approve a transfer of
a safety element approval only after all
the approvals and determinations
required under this chapter for a safety
element approval have been met. In
conducting reviews and issuing
approvals and determinations, the FAA
may incorporate by reference any
findings made part of the record to
support the initial safety element
approval determination. The FAA may
modify the terms and conditions of a
safety element approval to reflect any
changes necessary because of a safety
element approval transfer.
(f) The FAA will provide written
notice to the person requesting the
safety element approval transfer of our
determination.
§ 414.35 Monitoring compliance with the
terms and conditions of a safety element
approval.
Each holder of a safety element
approval must allow access by, and
cooperate with, Federal officers or
employees or other individuals
authorized by the Associate
Administrator to inspect manufacturing,
production, testing, or assembly
PO 00000
Frm 00150
Fmt 4701
Sfmt 4700
performed by a holder of a safety
element approval or its contractor. The
FAA may also inspect a safety element
approval process or service, including
training programs and personnel
qualifications.
§ 414.37 Modification, suspension, or
revocation of a safety element approval.
(a) The safety element approval
holder. The safety element approval
holder may submit an application to the
FAA to modify the terms and conditions
of the holder’s safety element approval.
The application must meet all the
applicable requirements under this part.
The FAA will review and make a
determination on the application using
the same procedures under this part
applicable to an initial safety element
approval application. If the FAA denies
the request to modify a safety element
approval, the holder may correct any
deficiency the FAA identified and
request reconsideration. The holder also
has the right to appeal a denial as set
forth in subpart D of this part.
(b) The FAA. If the FAA finds it is in
the interest of public health and safety,
safety of property, or if the safety
element approval holder fails to comply
with any applicable requirements of this
part, any terms and conditions of the
safety element approval, or any other
applicable requirement, the FAA may—
(1) Modify the terms and conditions
of the safety element approval; or
(2) Suspend or revoke the safety
element approval.
(c) Effective date. Unless otherwise
stated by the FAA, any modification,
suspension, or revocation of a safety
element approval under paragraph (b)—
(1) Takes effect immediately; and
(2) Continues in effect during any
reconsideration or appeal of such action
under this part.
(d) Notification and right to appeal. If
the FAA determines it is necessary to
modify, suspend, or revoke a safety
element approval, we will notify the
safety element approval holder in
writing. If the holder disagrees with the
FAA’s determination, the holder may
correct any deficiency the FAA
identified and request a reconsideration
of the determination. The applicant also
has the right to appeal the
determination as set forth in subpart D
of this part.
Subpart D—Appeal Procedures
§ 414.41 Hearings in safety element
approval actions.
(a) The FAA will give the safety
element approval applicant or holder, as
appropriate, written notice stating the
reason for issuing a denial or for
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
modifying, suspending, or revoking a
safety element approval under this part.
(b) A safety element approval
applicant or holder is entitled to a
determination on the record after an
opportunity for a hearing.
§ 414.43 Submissions; oral presentations
in safety element approval actions.
(a) Determinations in safety element
approval actions under this part will be
made on the basis of written
submissions unless the administrative
law judge, on petition or on their own
initiative, determines that an oral
presentation is required.
(b) Submissions must include a
detailed exposition of the evidence or
arguments supporting the petition.
(c) Petitions must be filed as soon as
practicable, but in no event more than
30 days after issuance of decision or
finding under § 414.37.
§ 414.45 Administrative law judge’s
recommended decision in safety element
approval actions.
(a) The Associate Administrator, who
will make the final decision on the
matter at issue, will review the
recommended decision of the
administrative law judge. The Associate
Administrator will make such final
decision within 30 days of issuance of
the recommended decision.
(b) The authority and responsibility to
review and decide rests solely with the
Associate Administrator and may not be
delegated.
22. Add § 415.2 to read as follows:
§ 415.2
Licenses issued under this part.
(a) Definitions. For the purposes of
this part, the definitions of § 401.5 of
this chapter apply.
(b) Compliance with part 450 of this
chapter. Operations under this part
must comply with launch and reentry
collision avoidance requirements in
§ 450.169 of this chapter and critical
asset protection requirements in
§§ 450.101(a)(4) and (b)(4) of this
chapter.
■ 23. Amend § 415.3 by adding
paragraph (c) to read as follows:
§ 415.3
Types of launch licenses.
*
*
*
*
*
(c) Notwithstanding the duration for a
license established in paragraphs (a) and
(b) of this section, no license issued
under this part will be valid after March
10, 2026.
■ 24. Amend § 415.35 by revising
paragraph (d) to read as follows:
§ 415.35
Acceptable flight risk.
PART 415—LAUNCH LICENSE
*
*
*
*
(d) Operation. A launch vehicle must
be operated in a manner that ensures
that flight risks meet the criteria of
paragraph (a) of this section and in
accordance with collision avoidance
requirements in § 450.169 and critical
asset protection requirements in
§ 450.101(a)(4) and (b)(4). An applicant
must identify all launch operations and
procedures that must be performed to
ensure acceptable flight risk.
19. The authority citation for part 415
continues to read as follows:
Appendix A to Part 415—[Removed
and Reserved]
■
*
25. Remove and reserve appendix A to
part 415.
■
Authority: 51 U.S.C. 50901–50923.
PART 415—[REMOVED AND
RESERVED]
PART 417—LAUNCH SAFETY
26. The authority citation for part 417
continues to read as follows:
20. Effective March 10, 2026, remove
and reserve part 415.
■ 21. Revise § 415.1 to read as follows:
■
§ 415.1
PART 417—[REMOVED AND
RESERVED]
■
jbell on DSKJLSW7X2PROD with RULES2
■
Applicability and scope.
(a) Applicability. This part applies to
the following:
(1) Licenses issued under this part
before June 8, 2021; and
(2) Licenses issued on or after June 8,
2021, if the FAA accepted the
application under § 413.11 of this
chapter before that date.
(b) Scope. This part prescribes
requirements for obtaining a license to
launch an expendable launch vehicle
and post-licensing requirements with
which a licensee must comply to remain
licensed. Requirements for preparing a
license application are in part 413 of
this subchapter.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
Authority: 51 U.S.C. 50901–50923.
27. Effective March 10, 2026, remove
and reserve part 417.
■ 28. Revise § 417.1 to read as follows:
■
§ 417.1
General information.
(a) Scope. This part sets forth—
(1) The responsibilities of a launch
operator conducting a licensed launch
of an expendable launch vehicle
pursuant to a license issued under part
415 of this chapter; and
(2) The requirements for maintaining
a launch license obtained under part
415 of this chapter. Parts 413 and 415
PO 00000
Frm 00151
Fmt 4701
Sfmt 4700
79715
of this chapter contain requirements for
preparing a license application to
conduct a launch, including information
reviewed by the FAA to conduct a
policy, safety, payload, and
environmental review, and a payload
determination
(b) Applicability. (1) The
administrative requirements for filing
material with the FAA in subpart A of
this part apply to all licensed launches
from a Federal launch range or a nonFederal launch site, except where noted.
(2) The safety requirements of
subparts B through E of this part apply
to all licensed launches of expendable
launch vehicles. See paragraph (d) of
this section for exceptions to this
provision.
(c) ‘‘Meets intent’’ certification. For a
licensed launch from a Federal launch
range, a launch operator need not
demonstrate to the FAA that an
alternative means of satisfying a
requirement of this part provides an
equivalent level of safety for a launch if
written evidence demonstrates that a
Federal launch range has, by the
effective date of this part, granted a
‘‘meets intent certification,’’ including
through ‘‘tailoring,’’ that applies to the
requirement and that launch. See
paragraph (e) of this section for
exceptions to this provision. Written
evidence includes:
(1) Range flight plan approval,
(2) Missile system pre-launch safety
package,
(3) Preliminary and final flight data
packages,
(4) A tailored version of EWR 127–1,
(5) Range email to the FAA stating
that the MIC was approved, or
(6) Operation approval.
(d) Waiver. For a licensed launch from
a Federal launch range, a requirement of
this part does not apply to a launch if
written evidence demonstrates that a
Federal launch range has, by the
effective date of this part, granted a
waiver that allows noncompliance with
the requirement for that launch. See
paragraph (e) of this section for
exceptions to this provision. Written
evidence includes:
(1) Range flight plan approval,
(2) Missile system pre-launch safety
package,
(3) Preliminary and final flight data
packages,
(4) A tailored version of EWR 127–1,
(5) Range email to the FAA stating
that the waiver was approved, or
(6) Operation approval.
(e) Exceptions to Federal launch
range meets intent certifications and
waivers. Even if a licensed launch from
a Federal launch range satisfies
paragraph (c) or (d) of this section for a
E:\FR\FM\10DER2.SGM
10DER2
79716
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
requirement of this part, the
requirement applies and a launch
operator must satisfy the requirement,
obtain FAA approval of any alternative,
or obtain FAA approval for any further
noncompliance if—
(1) The launch operator modifies the
launch vehicle’s operation or safety
characteristics;
(2) The launch operator uses the
launch vehicle, component, system, or
subsystem in a new application;
(3) The FAA or the launch operator
determines that a previously unforeseen
or newly discovered safety hazard exists
that is a source of significant risk to
public safety; or
(4) The Federal launch range
previously accepted a component,
system, or subsystem, but did not then
identify a noncompliance to a Federal
launch range requirement.
(f) Equivalent level of safety. The
requirements of this part apply to a
launch operator and the launch
operator’s launch unless the launch
operator clearly and convincingly
demonstrates that an alternative
approach provides an equivalent level
of safety.
§ 417.3
[Amended]
29. Amend § 417.3 by removing the
definitions for ‘‘conjunction on launch’’
and ‘‘launch wait’’.
■ 30. Amend § 417.11 by adding
paragraph (f) to read as follows:
■
§ 417.11 Continuing accuracy of license
application; application for modification of
license.
*
*
*
*
*
(f) The Administrator may determine
that a modification to a license issued
under this part must comply with the
requirements in part 450 of this chapter.
The Administrator will base the
determination on the extent and
complexity of the modification, whether
the applicant proposes to modify
multiple parts of the application, or if
the application requires significant
evaluation.
■ 31. Amend § 417.107 by adding
paragraph (b)(5), and removing and
reserving paragraph (e).
The addition reads as follows:
§ 417.107
Flight safety.
jbell on DSKJLSW7X2PROD with RULES2
*
*
*
*
*
(b) * * *
(5) A launch operator may initiate
flight of a launch vehicle only if all of
the risks to the public satisfy the criteria
in the critical asset protection
requirements in § 450.101(a)(4) and
(b)(4).
*
*
*
*
*
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
32. Amend § 417.113 by revising
paragraphs (c)(1) introductory text and
(c)(1)(iii) to read as follows:
■
§ 417.113
*
■
Launch safety rules.
*
*
*
*
*
(c) * * *
(1) The flight-commit criteria must
implement the flight safety analysis of
subpart C of this part and collision
avoidance requirements in § 450.169
and critical asset protection
requirements in § 450.101(a)(4) and
(b)(4). These must include criteria for:
*
*
*
*
*
(iii) Implementation of any launch
wait in the launch window for the
purpose of collision avoidance in
accordance with collision avoidance
requirements in § 450.169.
*
*
*
*
*
§ 417.121
[Amended]
32. Amend § 417.121 by removing and
reserving paragraph (c).
■
§ 417.231
■
[Removed and Reserved.]
33. Remove and reserve § 417.231.
Appendix A to Part 417—[Amended]
34. Amend appendix A to part 417 by
removing and reserving section
A417.31.
■ 35. Amend appendix C to part 417 by
revising paragraph (a) in section C417.1
and removing section C417.11.
The revision reads as follows:
■
Appendix C to Part 417—Flight Safety
Analysis Methodologies and Products
for an Unguided Suborbital Launch
Vehicle Flown With a Wind Weighting
Safety System
*
*
*
*
*
C417.1 General
(a) This appendix contains methodologies
for performing the flight safety analysis
required for the launch of an unguided
suborbital launch vehicle flown with a wind
weighting safety system, except for the
hazard area analysis required by § 417.107,
which is covered in appendix B of this part.
This appendix includes methodologies for a
trajectory analysis, wind weighting analysis,
debris analysis, and debris risk analysis.
*
*
*
*
*
PART 420—LICENSE TO OPERATE A
LAUNCH SITE
36. The authority citation for part 420
continues to read as follows:
■
Authority: 51 U.S.C. 50901–50923.
§ 420.5
[Amended]
37. Amend § 420.5 by removing the
definitions of ‘‘Instantaneous impact
point’’, ‘‘Launch site accident’’, and
‘‘Public’’.
■
PO 00000
Frm 00152
Fmt 4701
Sfmt 4700
38. Amend § 420.15 by revising
paragraph (b) to read as follows:
§ 420.15
Information requirements.
*
*
*
*
(b) Environmental. The FAA is
responsible for complying with the
procedures and policies of the National
Environmental Policy Act (NEPA) and
other applicable environmental laws,
regulations, and Executive Orders prior
to issuing a launch site license. An
applicant must provide the FAA with
information needed to comply with
such requirements. The FAA will
consider and document the potential
environmental effects associated with
issuing a launch site license.
(1) Environmental impact statement
or environmental assessment. When
directed by the FAA, an applicant
must—
(i) Prepare an Environmental
Assessment with FAA oversight;
(ii) Assume financial responsibility
for preparation of an Environmental
Impact Statement by an FAA-selected
and -managed consultant contractor; or
(iii) Submit information to support a
written re-evaluation of a previously
submitted Environmental Assessment or
Environmental Impact Statement when
requested by the FAA.
(2) Categorical exclusion. The FAA
may determine that a categorical
exclusion is appropriate upon receipt of
supporting information from an
applicant.
(3) Environmental information. An
application must include an approved
FAA Environmental Assessment,
Environmental Impact Statement,
categorical exclusion determination, or
written re-evaluation covering all
planned licensed activities in
compliance with NEPA and the Council
on Environmental Quality Regulations
for Implementing the Procedural
Provisions of NEPA.
*
*
*
*
*
■ 39. Revise § 420.51 to read as follows:
§ 420.51
Responsibilities—general.
A licensee must operate its launch
site in accordance with the
representations in its application.
■ 40. Amend § 420.57 by revising
paragraph (d) to read as follows:
§ 420.57
Notifications.
*
*
*
*
*
(d) At least 2 days prior to flight of a
launch vehicle, unless the
Administrator agrees to a different time
frame in accordance with § 404.15, the
licensee must notify local officials and
all owners of land adjacent to the
launch site of the flight schedule.
■ 41. Revise § 420.59 to read as follows:
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
§ 420.59
Mishap plan.
(a) General. A licensee must report,
respond to, and investigate any event
that meets either paragraph (1) or (5) of
the definition of ‘‘mishap’’ in § 401.7 of
this chapter. A licensee must submit a
mishap plan that meets the
requirements of § 450.173(b) through (f).
(b) Launch mishaps. A launch site
operator’s mishap plan must also
contain procedures for participating in
an investigation of a launch mishap for
launches launched from the launch site.
(c) Other agency procedures.
Emergency response and investigation
procedures developed in accordance
with 29 CFR 1910.119 and 40 CFR part
68 will satisfy the requirements of
§ 450.173(d) and (e) to the extent that
they include the elements required by
§ 450.173(d) and (e).
■ 42. Amend § 420.61 by revising
paragraph (b) to read as follows:
§ 420.61
Records.
*
*
*
*
*
(b) For any event that meets any of
paragraph (1), (5), or (8) of the definition
of ‘‘mishap’’ in § 401.7 of this chapter,
a licensee must preserve all records
related to the event. Records must be
retained until completion of any Federal
investigation and the FAA advises the
licensee that the records need not be
retained.
*
*
*
*
*
§ 431.2
Licenses issued under this part.
(a) Definitions. For the purposes of
this subpart, the definitions of § 401.5 of
this chapter apply.
(b) Compliance with part 450 of this
chapter. Operations under this part
must comply with launch and reentry
collision avoidance requirements in
§ 450.169 of this chapter and critical
asset protection requirements in
§ 450.101(a)(4) and (b)(4) of this chapter.
■ 47. Amend § 431.3 by adding
paragraph (c) to read as follows:
§ 431.3 Types of reusable launch vehicle
mission licenses.
*
*
*
*
*
(c) Duration of license.
Notwithstanding the duration for a
license established in paragraphs (a) and
(b) of this section, no license issued
under this part will be valid after March
10, 2026.
■ 48. Amend § 431.43 by revising
paragraph (a)(1) and removing and
reserving paragraph (c)(1).
The revision reads as follows:
§ 431.43 Reusable launch vehicle mission
operational requirements and restrictions.
PART 431—LAUNCH AND REENTRY
OF A REUSABLE LAUNCH VEHICLE
(RLV)
43. The authority citation for part 431
continue to read as follows:
■
Authority: 51 U.S.C. 50901–50923.
PART 431—[REMOVED AND
RESERVED]
(a) * * *
(1) That ensure RLV mission risks do
not exceed the criteria set forth in
§§ 431.35, 450.169, and in
§ 450.101(a)(4) and (b)(4) for nominal
and non-nominal operations;
*
*
*
*
*
■ 49. Amend § 431.73 by adding
paragraph (f) to read as follows:
Authority: 51 U.S.C. 50901–50923.
■
51. Revise § 433.7 to read as follows:
§ 433.7
Environmental.
(a) General. The FAA is responsible
for complying with the procedures and
policies of the National Environmental
Policy Act (NEPA) and other applicable
environmental laws, regulations, and
Executive Orders prior to issuing a
reentry site license. An applicant must
provide the FAA with information
needed to comply with such
requirements. The FAA will consider
and document the potential
environmental effects associated with
issuing a license for a reentry site.
(b) Environmental impact statement
or environmental assessment. When
directed by the FAA, an applicant
must—
(1) Prepare an Environmental
Assessment with FAA oversight;
(2) Assume financial responsibility for
preparation of an Environmental Impact
Statement by an FAA-selected and
-managed consultant contractor; or
(3) Submit information to support a
written re-evaluation of a previously
submitted Environmental Assessment or
Environmental Impact Statement.
(c) Categorical exclusion. The FAA
may determine that a categorical
exclusion is appropriate upon receipt of
supporting information from an
applicant.
(d) Environmental information. An
application must include an approved
FAA Environmental Assessment,
Environmental Impact Statement,
categorical exclusion determination, or
written re-evaluation covering all
planned licensed activities in
compliance with NEPA and the Council
on Environmental Quality Regulations
for Implementing the Procedural
Provisions of NEPA.
44. Effective March 10, 2026, remove
and reserve part 431.
■ 45. Revise § 431.1 to read as follows:
§ 431.73 Continuing accuracy of license
application; application for modification of
license.
§ 433.9
§ 431.1
*
PART 435—REENTRY OF A REENTRY
VEHICLE OTHER THAN A REUSABLE
LAUNCH VEHICLE (RLV)
■
jbell on DSKJLSW7X2PROD with RULES2
(c) Equivalent level of safety. Each
requirement of this part applies unless
the applicant or licensee clearly and
convincingly demonstrates that an
alternative approach provides an
equivalent level of safety to the
requirement of this part.
■ 46. Add § 431.2 to read as follows:
79717
General.
(a) Applicability. This part applies to
the following—
(1) Licenses issued under this part
before June 8, 2021; and
(2) Licenses issued on or after June 8,
2021, if the FAA accepted the
application under § 413.11 of this
chapter before that date.
(b) Scope. This part prescribes
requirements for obtaining a reusable
launch vehicle (RLV) mission license
and post-licensing requirements with
which a licensee must comply to remain
licensed. Requirements for preparing a
license application are contained in part
413 of this subchapter.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
*
*
*
*
(f) The Administrator may determine
that a modification to a license issued
under this part must comply with the
requirements in part 450 of this chapter.
The Administrator will base the
determination on the extent and
complexity of the modification, whether
the applicant proposes to modify
multiple parts of the application, or if
the application requires significant
evaluation.
PART 433—LICENSE TO OPERATE A
REENTRY SITE
50. The authority citation for part 433
will continue to read as follows:
■
PO 00000
Frm 00153
Fmt 4701
Sfmt 4700
■
[Removed]
52. Remove § 433.9.
53. The authority citation for part 435
continues to read as follows:
■
Authority: 51 U.S.C. 50901–50923.
PART 435—[REMOVED AND
RESERVED]
54. Effective March 10, 2026, remove
and reserve part 435.
■ 55. Revise § 435.1 to read as follows:
■
§ 435.1
General.
(a) Applicability. This part applies to
the following—
E:\FR\FM\10DER2.SGM
10DER2
79718
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(1) Licenses issued under this part
before June 8, 2021; and
(2) Licenses issued on or after June 8,
2021, if the FAA accepted the
application under § 413.11 of this
chapter before that date.
(b) Scope. This part prescribes
requirements for obtaining a license to
reenter a reentry vehicle other than a
reusable launch vehicle (RLV), and postlicensing requirements with which a
licensee must comply to remain
licensed. Requirements for preparing a
license application are contained in part
413 of this subchapter.
(c) Equivalent level of safety. Each
requirement of this part applies unless
the applicant or licensee clearly and
convincingly demonstrates that an
alternative approach provides an
equivalent level of safety to the
requirement of this part.
■ 56. Add § 435.2 to read as follows:
§ 435.2
Licenses.
(a) Definitions. For the purposes of
this subpart, the definitions of § 401.5 of
this chapter apply.
(b) Compliance with part 450 of this
chapter. Operations under this part
must comply with launch and reentry
collision avoidance requirements in
§ 450.169 and critical asset protection
requirements in § 450.101(a)(4) and
(b)(4).
■ 57. Amend § 435.3 by adding
paragraph (c) to read as follows:
§ 435.3
Types of reentry licenses.
*
*
*
*
*
(c) Duration of license.
Notwithstanding the duration for a
license established in paragraphs (a) and
(b) of this section, no license issued
under this part will be valid after March
10, 2026.
PART 437—EXPERIMENTAL PERMITS
58. The authority citation for part 437
continues to read as follows:
■
Authority: 51 U.S.C. 50901–50923.
§ 437.3
[Amended]
59. Amend § 437.3 by removing the
definitions for ‘‘anomaly’’ and ‘‘key
flight-safety event’’.
■ 60. Amend § 437.21 by revising
paragraphs (b) and (c) to read as follows:
■
§ 437.21
General.
jbell on DSKJLSW7X2PROD with RULES2
*
*
*
*
*
(b) Other regulations—(1)
Environmental—(i) General. The FAA is
responsible for complying with the
procedures and policies of the National
Environmental Policy Act (NEPA) and
other applicable environmental laws,
regulations, and Executive Orders to
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
consider and document the potential
environmental effects associated with
proposed reusable suborbital rocket
launches or reentries. An applicant
must provide the FAA with information
needed to comply with such
requirements. The FAA will consider
and document the potential
environmental effects associated with
proposed reusable suborbital rocket
launches or reentries.
(ii) Environmental Impact Statement
or Environmental Assessment. When
directed by the FAA, an applicant
must—
(A) Prepare an Environmental
Assessment with FAA oversight;
(B) Assume financial responsibility
for preparation of an Environmental
Impact Statement by an FAA-selected
and -managed consultant contractor; or
(C) Submit information to support a
written re-evaluation of a previously
submitted Environmental Assessment or
Environmental Impact Statement.
(iii) Categorical exclusion. The FAA
may determine that a categorical
exclusion determination is appropriate
upon receipt of supporting information
from an applicant.
(iv) Information requirements. An
application must include an approved
FAA Environmental Assessment,
Environmental Impact Statement,
categorical exclusion determination, or
written re-evaluation covering all
planned licensed activities in
compliance with NEPA and the Council
on Environmental Quality Regulations
for Implementing the Procedural
Provisions of NEPA.
(2) Financial responsibility. An
applicant must provide the information
required by part 3 of appendix A of part
440 for the FAA to conduct a maximum
probable loss analysis.
(3) Human space flight. An applicant
proposing launch or reentry with flight
crew or a space flight participant on
board a reusable suborbital rocket must
demonstrate compliance with §§ 460.5,
460.7, 460.11, 460.13, 460.15, 460.17,
460.51, and 460.53 of this subchapter.
(c) Use of a safety element approval.
If an applicant proposes to use any
reusable suborbital rocket, safety
system, process, service, or personnel
for which the FAA has issued a safety
element approval under part 414 of this
chapter, the FAA will not reevaluate
that safety element to the extent its use
is within its approved scope. As part of
the application process, the FAA will
evaluate the integration of that safety
element into vehicle systems or
operations.
*
*
*
*
*
■ 61. Revise § 437.41 to read as follows:
PO 00000
Frm 00154
Fmt 4701
Sfmt 4700
§ 437.41
Mishap plan.
An applicant must submit a mishap
plan that meets the requirements of
§ 450.173 of this chapter.
■ 62. Revise § 437.65 to read as follows:
§ 437.65
Collision avoidance analysis.
For a permitted flight with a planned
maximum altitude greater than 150
kilometers, a permittee must obtain a
collision avoidance analysis in
accordance with § 450.169 of this
chapter.
§ 437.75
[Removed and Reserved]
63. Remove and reserve § 437.75.
64. Amend § 437.87 by revising
paragraph (b) to read as follows:
■
■
§ 437.87
Records.
*
*
*
*
*
(b) For any event that meets any of
paragraphs (1) through (3), (5), or (8) of
the definition of ‘‘mishap’’ in § 401.7 of
this chapter, a permittee must preserve
all records related to the event. Records
shall be retained until any Federal
investigation is complete and the FAA
advises the permittee that the records
need not be retained.
*
*
*
*
*
■ 65. Amend § 437.89 by revising
paragraphs (a) introductory text and (b)
to read as follows:
§ 437.89
Pre-flight reporting.
(a) Not later than 30 days before each
flight or series of flights conducted
under an experimental permit, unless
the Administrator agrees to a different
time frame in accordance with § 404.15,
a permittee must provide the FAA with
the following information:
*
*
*
*
*
(b) Not later than 15 days before each
permitted flight planned to reach greater
than 150 km altitude, unless the
Administrator agrees to a different time
frame in accordance with § 404.15, a
permittee must provide the FAA its
planned trajectory for a collision
avoidance analysis.
PART 440—FINANCIAL
RESPONSIBILITY
66. The authority citation for part 440
continues to read as follows:
■
Authority: 51 U.S.C. 50901–50923.
67. Amend § 440.3 by revising the
introductory text and the definition for
‘‘maximum probable loss (MPL)’’ to read
as follows:
■
§ 440.3
Definitions.
Except as otherwise provided in this
section, any term used in this part and
defined in 51 U.S.C. 50901–50923, or in
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
§ 401.5 or § 401.7 of this chapter shall
have the meaning contained therein.
*
*
*
*
*
Maximum probable loss (MPL) means
the greatest dollar amount of loss for
bodily injury or property damage that is
reasonably expected to result from a
licensed or permitted activity;
(1) Losses to third parties, excluding
Government personnel and other launch
or reentry participants’ employees
involved in licensed or permitted
activities and neighboring operations
personnel, that are reasonably expected
to result from a licensed or permitted
activity are those that have a probability
of occurrence of no less than one in ten
million.
(2) Losses to Government property
and Government personnel involved in
licensed or permitted activities and
neighboring operations personnel that
are reasonably expected to result from
licensed or permitted activities are those
that have a probability of occurrence of
no less than one in one hundred
thousand.
*
*
*
*
*
§ 440.3
[Amended]
68. Effective March 10, 2026, further
amend § 440.3 in the introductory text
by removing ‘‘ in §§ 401.5 or 401.7’’ and
add, in its place, ‘‘in § 401.7’’.
■ 69. Amend § 440.15 by revising
paragraphs (a)(1) through (4) to read as
follows:
■
jbell on DSKJLSW7X2PROD with RULES2
§ 440.15
(a) * * *
(1) All reciprocal waiver of claims
agreements required under § 440.17(c)
must be submitted at least 30 days
before the start of any licensed or
permitted activity involving a customer,
crew member, or space flight
participant; unless the Administrator
agrees to a different time frame in
accordance with § 404.15;
(2) Evidence of insurance must be
submitted at least 30 days before
commencement of any licensed launch
or permitted activity, and for licensed
reentry no less than 30 days before
commencement of launch activities
involving the reentry licensee, unless
the Administrator agrees to a different
time frame in accordance with § 404.15;
(3) Evidence of financial
responsibility in a form other than
insurance, as provided under § 440.9(f)
must be submitted at least 60 days
before commencement of a licensed or
permitted activity, unless the
Administrator agrees to a different time
frame in accordance with § 404.15; and
(4) Evidence of renewal of insurance
or other form of financial responsibility
18:40 Dec 09, 2020
Jkt 253001
■
70. Add part 450 to read as follows:
PART 450—LAUNCH AND REENTRY
LICENSE REQUIREMENTS
Sec.
Subpart A—General Information
450.1 Applicability.
450.3 Scope of a vehicle operator license.
450.5 Issuance of a vehicle operator license.
450.7 Duration of a vehicle operator license.
450.9 Additional license terms and
conditions.
450.11 Transfer of a vehicle operator
license.
450.13 Rights not conferred by a vehicle
operator license.
Subpart B—Requirements to Obtain a
Vehicle Operator License
450.31 General.
450.33 Incremental review and
determinations.
450.35 Means of compliance.
450.37 Equivalent level of safety.
450.39 Use of safety element approval.
450.41 Policy review and approval.
450.43 Payload review and determination.
450.45 Safety review and approval.
450.47 Environmental review.
Subpart C—Safety Requirements
Safety Criteria
450.101
Safety criteria.
System Safety Program
Demonstration of compliance.
VerDate Sep<11>2014
must be submitted at least 30 days in
advance of its expiration date, unless
the Administrator agrees to a different
time frame in accordance with § 404.15.
*
*
*
*
*
450.103
System safety program.
Hazard Control Strategies
450.107
450.108
450.109
450.110
450.111
Hazard control strategies.
Flight abort.
Flight hazard analysis.
Physical containment.
Wind weighting.
Flight Safety Analyses
Prescribed Hazard Controls for SafetyCritical Hardware and Computing Systems
450.141 Computing systems.
450.143 Safety-critical system design, test,
and documentation.
450.145 Highly reliable flight safety system.
Frm 00155
Fmt 4701
Other Prescribed Hazard Controls
450.147 Agreements.
450.149 Safety-critical personnel
qualifications.
450.151 Work shift and rest requirements.
450.153 Radio frequency management.
450.155 Readiness.
450.157 Communications.
450.159 Pre-flight procedures.
450.161 Control of hazard areas.
450.163 Lightning hazard mitigation.
450.165 Flight commit criteria.
450.167 Tracking.
450.169 Launch and reentry collision
avoidance analysis requirements.
450.171 Safety at end of launch.
450.173 Mishap plan—reporting, response,
and investigation requirements.
450.175 Test-induced damage.
450.177 Unique safety policies,
requirements, and practices.
Ground Safety
450.179 Ground safety—general.
450.181 Coordination with a site operator.
450.183 Explosive site plan.
450.185 Ground hazard analysis.
450.187 Toxic hazards mitigation for
ground operations.
450.189 Ground safety prescribed hazard
controls.
Subpart D—Terms and Conditions of a
Vehicle Operator License
450.201 Responsibility for public safety and
safety of property.
450.203 Compliance.
450.205 Financial responsibility
requirements.
450.207 Human spaceflight requirements.
450.209 Compliance monitoring.
450.211 Continuing accuracy of license
application; application for modification
of license.
450.213 Pre-flight reporting.
450.215 Post-flight reporting.
450.217 Registration of space objects.
450.219 Records.
Appendix A to Part 450—Collision Analysis
Worksheet
Authority: 51 U.S.C. 50901–50923.
Subpart A—General Information
450.113 Flight safety analysis
requirements—scope.
450.115 Flight safety analysis methods.
450.117 Trajectory analysis for normal
flight.
450.119 Trajectory analysis for malfunction
flight.
450.121 Debris analysis.
450.123 Population exposure analysis.
450.131 Probability of failure analysis.
450.133 Flight hazard area analysis.
450.135 Debris risk analysis.
450.137 Far-field overpressure blast effects
analysis.
450.139 Toxic hazards for flight.
PO 00000
79719
Sfmt 4700
§ 450.1
Applicability.
This part prescribes requirements for
obtaining and maintaining a license to
launch, reenter, or both launch and
reenter, a launch or reentry vehicle.
§ 450.3 Scope of a vehicle operator
license.
(a) General. A vehicle operator license
authorizes a licensee to conduct one or
more launches or reentries using the
same vehicle or family of vehicles. A
vehicle operator license identifies the
scope of authorization as defined in
paragraphs (b) and (c) of this section or
as agreed to by the Administrator.
(b) Scope of launch. A vehicle
operator license authorizes launch,
which includes the flight of a launch
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79720
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
vehicle and pre- and post-flight ground
operations as follows:
(1) Launch begins when hazardous
pre-flight operations commence at a
U.S. launch site that may pose a threat
to the public. Hazardous pre-flight
operations that may pose a threat to the
public include pressurizing or loading
of propellants into the vehicle,
operations involving a fueled launch
vehicle, the transfer of energy necessary
to initiate flight, or any hazardous
activity preparing the vehicle for flight.
Hazardous pre-flight operations do not
include the period between the end of
the previous launch and launch vehicle
reuse, when the vehicle is in a safe and
dormant state.
(2) At a non-U.S. launch site, launch
begins at ignition or at the first
movement that initiates flight,
whichever occurs earlier.
(3) Launch ends when any of the
following events occur:
(i) For an orbital launch of a vehicle
without a reentry of the vehicle, launch
ends after the licensee’s last exercise of
control over its vehicle on orbit, after
vehicle component impact or landing on
Earth, after activities necessary to return
the vehicle or component to a safe
condition on the ground after impact or
landing, or after activities necessary to
return the site to a safe condition,
whichever occurs latest;
(ii) For an orbital launch of a vehicle
with a reentry of the vehicle, launch
ends after deployment of all payloads,
upon completion of the vehicle’s first
steady-state orbit if there is no payload
deployment, after vehicle component
impact or landing on Earth, after
activities necessary to return the vehicle
or component to a safe condition on the
ground after impact or landing, or after
activities necessary to return the site to
a safe condition, whichever occurs
latest;
(iii) For a suborbital launch that
includes a reentry, launch ends after
reaching apogee;
(iv) For a suborbital launch that does
not include a reentry, launch ends after
vehicle or vehicle component impact or
landing on Earth, after activities
necessary to return the vehicle or
vehicle component to a safe condition
on the ground after impact or landing,
or after activities necessary to return the
site to a safe condition, whichever
occurs latest.
(c) Scope of reentry. A vehicle
operator license authorizes reentry.
Reentry includes activities conducted in
Earth orbit or outer space to determine
reentry readiness and that are critical to
ensuring public health and safety and
the safety of property during reentry
flight. Reentry also includes activities
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
necessary to return the reentry vehicle,
or vehicle component, to a safe
condition on the ground after impact or
landing.
(d) Application requirements. An
applicant must identify pre- and postflight ground operations at a U.S. launch
site sufficient for the Administrator to
determine the scope of activities
authorized under the license.
§ 450.5 Issuance of a vehicle operator
license.
(a) The FAA issues a vehicle operator
license to an applicant who has
obtained all approvals and
determinations required under this part
for a license.
(b) A vehicle operator license
authorizes a licensee to conduct
launches or reentries, in accordance
with the representations contained in
the licensee’s application, with subparts
C and D of this part, and subject to the
licensee’s compliance with terms and
conditions contained in license orders
accompanying the license, including
financial responsibility requirements.
§ 450.7 Duration of a vehicle operator
license.
A vehicle operator license is valid for
the period of time determined by the
Administrator as necessary to conduct
the licensed activity but may not exceed
5 years from the issuance date.
§ 450.9 Additional license terms and
conditions.
The FAA may modify a vehicle
operator license at any time by
modifying or adding license terms and
conditions to ensure compliance with
the Act and regulations.
§ 450.11
license.
Transfer of a vehicle operator
(a) Only the FAA may transfer a
vehicle operator license.
(b) Either the holder of a vehicle
operator license or the prospective
transferee may request a vehicle
operator license transfer.
(c) Both the holder and prospective
transferee must agree to the transfer.
(d) An applicant for transfer of a
vehicle operator license must submit a
license application in accordance with
part 413 of this chapter and must meet
the requirements of part 450 of this
chapter.
(e) The FAA will transfer a license to
an applicant that has obtained all of the
approvals and determinations required
under this part for a license. In
conducting its reviews and issuing
approvals and determinations, the FAA
may incorporate by reference any
findings made part of the record to
support the initial licensing
PO 00000
Frm 00156
Fmt 4701
Sfmt 4700
determination. The FAA may modify a
license to reflect any changes necessary
as a result of a license transfer.
(f) The FAA will provide written
notice of its determination to the person
requesting the vehicle operator license
transfer.
§ 450.13 Rights not conferred by a vehicle
operator license.
Issuance of a vehicle operator license
does not relieve a licensee of its
obligation to comply with all applicable
requirements of law or regulation that
may apply to its activities, nor does
issuance confer any proprietary,
property, or exclusive right in the use of
any Federal launch or reentry site or
related facilities, airspace, or outer
space.
Subpart B—Requirements to Obtain a
Vehicle Operator License
§ 450.31
General.
(a) To obtain a vehicle operator
license, an applicant must—
(1) Submit a license application in
accordance with the procedures in part
413 of this chapter;
(2) Obtain a policy approval from the
Administrator in accordance with
§ 450.41;
(3) Obtain a favorable payload
determination from the Administrator in
accordance with § 450.43, if applicable;
(4) Obtain a safety approval from the
Administrator in accordance with
§ 450.45;
(5) Satisfy the environmental review
requirements of § 450.47; and
(6) Provide the information required
by appendix A of part 440 for the
Administrator to conduct a maximum
probable loss analysis for the applicable
licensed operation.
(b) An applicant may apply for the
approvals and determinations in
paragraphs (a)(2) through (6) of this
section separately or all together in one
complete application, using the
application procedures contained in
part 413 of this chapter.
(c) An applicant may also apply for a
safety approval in an incremental
manner, in accordance with § 450.33.
(d) An applicant may reference
materials previously provided as part of
a license application in order to meet
the application requirements of this
part.
§ 450.33 Incremental review and
determinations.
An applicant may submit its
application for a safety review in
modules using an incremental approach
approved by the Administrator.
(a) An applicant must identify to the
Administrator, prior to submitting an
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
application, whether it will submit a
modular application for any approval or
determination.
(b) An applicant using an incremental
approach must have the approach
approved by the Administrator prior to
submitting an application. In reviewing
a proposed approach, the Administrator
will consider the following:
(1) Whether the modules can be
reviewed independently; and
(2) Whether the modules will be
submitted in a workable chronological
order.
(c) The Administrator may make
incremental determinations as part of
this review process.
§ 450.35
Means of compliance.
(a) Prior to application acceptance, a
means of compliance must be accepted
by the Administrator for the following:
(1) Section 450.115(b)(1) regarding
flight safety analyses;
(2) Section 450.139(e)(1) regarding
toxic hazards for flight;
(3) Section 450.145(b) regarding
highly-reliable flight safety system;
(4) Section 450.163(a)(1) regarding
lightning hazard mitigation; and
(5) Section 450.187(e)(1) regarding
toxic hazards mitigation for ground
operations.
(b) A person requesting acceptance of
a proposed means of compliance
outside a license application must
submit the proposed means of
compliance to the FAA in a form and
manner acceptable to the Administrator.
§ 450.37
Equivalent level of safety.
(a) An applicant must demonstrate
compliance with each requirement of
this part, unless the applicant clearly
and convincingly demonstrates that an
alternative approach provides an
equivalent level of safety to the
requirement of this part.
(b) Paragraph (a) of this section does
not apply to § 450.101(a), (b), (c)(1) and
(3), (d), (e)(1), and (g).
§ 450.39
Use of safety element approval.
jbell on DSKJLSW7X2PROD with RULES2
If an applicant proposes to use any
vehicle, safety system, process, service,
or personnel for which the FAA has
issued a safety element approval under
part 414 of this chapter, the FAA will
not reevaluate that safety element
during a license application evaluation
to the extent its use is within its
approved scope.
§ 450.41
Policy review and approval.
(a) General. The FAA issues a policy
approval to an applicant unless the FAA
determines that a proposed launch or
reentry would jeopardize U.S. national
security or foreign policy interests, or
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
international obligations of the United
States.
(b) Interagency consultation. (1) The
FAA consults with the Department of
Defense to determine whether a license
application presents any issues affecting
U.S. national security.
(2) The FAA consults with the
Department of State to determine
whether a license application presents
any issues affecting U.S. foreign policy
interests or international obligations.
(3) The FAA consults with other
Federal agencies, including the National
Aeronautics and Space Administration,
authorized to address issues identified
under paragraph (a) of this section,
associated with an applicant’s proposal.
(c) Issues during policy review. The
FAA will advise an applicant, in
writing, of any issue raised during a
policy review that would impede
issuance of a policy approval. The
applicant may respond, in writing, or
amend its license application as
required by § 413.17 of this chapter.
(d) Denial of policy approval. The
FAA notifies an applicant, in writing, if
it has denied policy approval for a
license application. The notice states
the reasons for the FAA’s determination.
The applicant may seek further review
of the determination in accordance with
§ 413.21 of this chapter.
(e) Application requirements for
policy review. In its license application,
an applicant must—
(1) Identify the model, type, and
configuration of any vehicle proposed
for launch or reentry by the applicant;
(2) Describe the vehicle by
characteristics that include individual
stages, their dimensions, type and
amounts of all propellants, and
maximum thrust;
(3) Identify foreign ownership of the
applicant as follows:
(i) For a sole proprietorship or
partnership, identify all foreign
ownership;
(ii) For a corporation, identify any
foreign ownership interests of 10
percent or more; and
(iii) For a joint venture, association, or
other entity, identify any participating
foreign entities; and
(4) Identify the proposed vehicle
flight profile, including:
(i) Launch or reentry site, including
any contingency abort locations;
(ii) Flight azimuths, trajectories, and
associated ground tracks and
instantaneous impact points for the
duration of the licensed activity,
including any contingency abort
profiles;
(iii) Sequence of planned events or
maneuvers during flight;
(iv) Normal impact or landing areas
for all mission hardware; and
PO 00000
Frm 00157
Fmt 4701
Sfmt 4700
79721
(v) For each orbital mission, the range
of intermediate and final orbits of each
vehicle upper stage and their estimated
orbital lifetimes.
§ 450.43 Payload review and
determination.
(a) General. If applicable, the FAA
issues a favorable payload
determination for a launch or reentry to
a license applicant or payload owner or
operator if—
(1) The applicant, payload owner, or
payload operator has obtained all
required licenses, authorizations, and
permits; and
(2) Its launch or reentry would not
jeopardize public health and safety,
safety of property, U.S. national security
or foreign policy interests, or
international obligations of the United
States.
(b) Relationship to other executive
agencies. The FAA does not make a
determination under paragraph (a)(2) of
this section for—
(1) Those aspects of payloads that are
subject to regulation by the Federal
Communications Commission or the
Department of Commerce; or
(2) Payloads owned or operated by the
U.S. Government.
(c) Classes of payloads. The FAA may
review and issue findings regarding a
proposed class of payload, including
communications, remote sensing, or
navigation. However, prior to a launch
or reentry, each payload is subject to
verification by the FAA that its launch
or reentry would not jeopardize public
health and safety, safety of property,
U.S. national security or foreign policy
interests, or international obligations of
the United States.
(d) Payload owner or payload
operator may apply. In addition to a
launch or reentry operator, a payload
owner or payload operator may request
a payload review and determination.
(e) Interagency consultation. The FAA
consults with other agencies as follows:
(1) The Department of Defense to
determine whether launch or reentry of
a proposed payload or payload class
would present any issues affecting U.S.
national security;
(2) The Department of State to
determine whether launch or reentry of
a proposed payload or payload class
would present any issues affecting U.S.
foreign policy interests or international
obligations; or
(3) Other Federal agencies, including
the National Aeronautics and Space
Administration, authorized to address
issues of public health and safety, safety
of property, U.S. national security or
foreign policy interests, or international
obligations of the United States,
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79722
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
associated with the launch or reentry of
a proposed payload or payload class.
(f) Issues during payload review. The
FAA will advise a person requesting a
payload determination, in writing, of
any issue raised during a payload
review that would impede issuance of a
license to launch or reenter that payload
or payload class. The person requesting
payload review may respond, in writing,
or amend its application as required by
§ 413.17 of this chapter.
(g) Denial of a payload determination.
The FAA notifies an applicant, in
writing, if it has denied a favorable
payload determination. The notice
states the reasons for the FAA’s
determination. The applicant may seek
further review of the determination in
accordance with § 413.21 of this
chapter.
(h) Incorporation of payload
determination in license application. A
favorable payload determination issued
for a payload or class of payload may be
included by a license applicant as part
of its application. However, any change
in information provided under
paragraph (i) of this section must be
reported in accordance with § 413.17 of
this chapter. The FAA determines
whether a favorable payload
determination remains valid in light of
reported changes and may conduct an
additional payload review.
(i) Application requirements. A
person requesting review of a particular
payload or payload class must identify
the following:
(1) For launch of a payload:
(i) Payload name or class of payload,
and function;
(ii) Description, including physical
dimensions, weight, composition, and
any hosted payloads;
(iii) Payload owner and payload
operator, if different from the person
requesting payload review and
determination;
(iv) Any foreign ownership of the
payload or payload operator, as
specified in § 450.41(e)(3);
(v) Hazardous materials as defined in
§ 401.7 of this chapter, radioactive
materials, and the amounts of each;
(vi) Explosive potential of payload
materials, alone and in combination
with other materials found on the
payload;
(vii) For orbital launches, parameters
for parking, transfer and final orbits, and
approximate transit times to final orbit;
(viii) Delivery point in flight at which
the payload will no longer be under the
licensee’s control;
(ix) Intended operations during the
lifetime of the payload, including
anticipated life span and any planned
disposal;
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
(x) Any encryption associated with
data storage on the payload and
transmissions to or from the payload;
and
(xi) Any other information necessary
to make a determination based on
public health and safety, safety of
property, U.S. national security or
foreign policy interests, or international
obligations of the United States.
(2) For reentry of a payload:
(i) Payload name or class of payload,
and function;
(ii) Physical characteristics,
dimensions, and weight of the payload;
(iii) Payload owner and payload
operator, if different from the person
requesting the payload review and
determination;
(iv) Type, amount, and container of
hazardous materials and radioactive
materials in the payload;
(v) Explosive potential of payload
materials, alone and in combination
with other materials found on the
payload or reentry vehicle during
reentry; and
(vi) Designated reentry site.
§ 450.45
Safety review and approval.
(a) General. The FAA issues a safety
approval to an applicant if it determines
that an applicant can conduct launch or
reentry without jeopardizing public
health and safety and safety of property.
A license applicant must satisfy the
application requirements in this section
and subpart C of this part.
(b) Services or property provided by a
Federal launch or reentry site. The FAA
will accept any safety-related launch or
reentry service or property provided by
a Federal launch or reentry site or other
Federal entity by contract, as long as the
FAA determines that the launch or
reentry services or property provided
satisfy this part.
(c) Issues during safety review. The
FAA will advise an applicant, in
writing, of any issues raised during a
safety review that would impede
issuance of a safety approval. The
applicant may respond, in writing, or
amend its license application as
required by § 413.17 of this chapter.
(d) Denial of a safety approval. The
FAA notifies an applicant, in writing, if
it has denied a safety approval for a
license application. The notice states
the reasons for the FAA’s determination.
The applicant may seek further review
of the determination in accordance with
§ 413.21 of this chapter.
(e) Application requirements. An
applicant must submit the information
required in the ‘‘Application
requirements’’ paragraphs in individual
sections in subpart C of this part, as well
as the following:
PO 00000
Frm 00158
Fmt 4701
Sfmt 4700
(1) General. An application must—
(i) Contain a glossary of unique terms
and acronyms used in alphabetical
order;
(ii) Contain a listing of all referenced
material;
(iii) Use equations and mathematical
relationships derived from or referenced
to a recognized standard or text, and
define all algebraic parameters;
(iv) Include the units of all numerical
values provided; and
(v) Include a legend or key that
identifies all symbols used for any
schematic diagrams.
(2) Site description. An applicant
must identify the proposed launch or
reentry site, including contingency abort
locations, and submit the following:
(i) Boundaries of the site;
(ii) Launch or landing point locations,
including latitude and longitude;
(iii) Identity of any site operator; and
(iv) Identity of any facilities at the site
that will be used for pre- or post-flight
ground operations.
(3) Vehicle description. An applicant
must submit the following:
(i) A written description of the vehicle
or family of vehicles, including
structural, thermal, pneumatic,
propulsion, electrical, and avionics and
guidance systems used in each vehicle,
and all propellants. The description
must include a table specifying the type
and quantities of all hazardous materials
on each vehicle and must include
propellants, explosives, and toxic
materials; and
(ii) A drawing of each vehicle that
identifies:
(A) Each stage, including strap-on
motors;
(B) Physical dimensions and weight;
(C) Location of all safety-critical
systems;
(D) Location of all major vehicle
control systems, propulsion systems,
pressure vessels, and any other
hardware that contains potential
hazardous energy or hazardous material;
and
(E) For an unguided suborbital launch
vehicle, the location of the rocket’s
center of pressure in relation to its
center of gravity for the entire flight
profile.
(4) Mission schedule. An applicant
must submit a generic launch or reentry
processing schedule that identifies any
readiness activities, such as reviews and
rehearsals, and each safety-critical preflight operation to be conducted. The
mission schedule must also identify day
of flight activities.
(5) Human space flight. For a
proposed launch or reentry with a
human being on board a vehicle, an
applicant must demonstrate compliance
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
with §§ 460.5, 460.7, 460.11, 460.13,
460.15, 460.17, 460.51, and 460.53 of
this chapter.
(6) Radionuclides. The FAA will
evaluate the launch or reentry of any
radionuclide on a case-by-case basis,
and issue an approval if the FAA finds
that the launch or reentry is consistent
with public health and safety, safety of
property, and national security and
foreign policy interests of the United
States. For any radionuclide on a launch
or reentry vehicle, an applicant must—
(i) Identify the type and quantity;
(ii) Include a reference list of all
documentation addressing the safety of
its intended use; and
(iii) Describe all approvals by the
Nuclear Regulatory Commission for preflight ground operations.
(7) Additional material. The FAA may
also request—
(i) Any information incorporated by
reference in the license application; and
(ii) Additional products that allow the
FAA to conduct an independent safety
analysis.
jbell on DSKJLSW7X2PROD with RULES2
§ 450.47
Environmental review.
(a) General. The FAA is responsible
for complying with the procedures and
policies of the National Environmental
Policy Act (NEPA) and other applicable
environmental laws, regulations, and
Executive Orders prior to issuing a
launch or reentry license. An applicant
must provide the FAA with information
needed to comply with such
requirements. The FAA will consider
and document the potential
environmental effects associated with
issuing a launch or reentry license
consistent with paragraph (b) of this
section.
(b) Environmental Impact Statement
or Environmental Assessment. When
directed by the FAA, an applicant
must—
(1) Prepare an Environmental
Assessment with FAA oversight;
(2) Assume financial responsibility for
preparation of an Environmental Impact
Statement by an FAA-selected and
-managed consultant contractor; or
(3) Submit information to support a
written re-evaluation of a previously
submitted Environmental Assessment or
Environmental Impact Statement.
(c) Categorical exclusion. The FAA
may determine that a categorical
exclusion is appropriate upon receipt of
supporting information from an
applicant.
(d) Application requirements. An
application must include an approved
FAA Environmental Assessment,
Environmental Impact Statement,
categorical exclusion determination, or
written re-evaluation, which should
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
address compliance with any other
applicable environmental laws,
regulations, and Executive Orders
covering all planned licensed activities
in compliance with NEPA and the
Council on Environmental Quality
Regulations for Implementing the
Procedural Provisions of NEPA.
Subpart C—Safety Requirements
Safety Criteria
§ 450.101
Safety criteria.
(a) Launch risk criteria. For any
launch, an operator may initiate the
flight of a launch vehicle only if all risks
to the public satisfy the criteria in this
paragraph (a). For an orbital launch, the
criteria in this paragraph apply from
liftoff through orbital insertion. For a
suborbital launch, or a suborbital launch
and reentry, the criteria in this
paragraph apply from liftoff through
final impact or landing.
(1) Collective risk. The collective risk,
measured as expected number of
casualties (EC), consists of risk posed by
impacting inert and explosive debris,
toxic release, and far field blast
overpressure. Public risk due to any
other hazard associated with the
proposed flight of a launch vehicle will
be determined by the Administrator on
a case-by-case basis.
(i) The risk to all members of the
public, excluding persons in aircraft and
neighboring operations personnel, must
not exceed an expected number of 1 ×
10¥4 casualties.
(ii) The risk to all neighboring
operations personnel must not exceed
an expected number of 2 × 10¥4
casualties.
(2) Individual risk. The individual
risk, measured as probability of casualty
(PC), consists of risk posed by impacting
inert and explosive debris, toxic release,
and far field blast overpressure. The
FAA will determine whether to approve
public risk due to any other hazard
associated with the proposed flight of a
launch vehicle on a case-by-case basis.
(i) The risk to any individual member
of the public, excluding neighboring
operations personnel, must not exceed a
probability of casualty of 1 × 10¥6 per
launch.
(ii) The risk to any individual
neighboring operations personnel must
not exceed a probability of casualty of
1 × 10¥5 per launch.
(3) Aircraft risk. A launch operator
must establish any aircraft hazard areas
necessary to ensure the probability of
impact with debris capable of causing a
casualty for aircraft does not exceed 1 ×
10¥6.
(4) Risk to critical assets. (i) The risk
to critical assets, measured as the
PO 00000
Frm 00159
Fmt 4701
Sfmt 4700
79723
probability of loss of functionality, must
not exceed the following probabilities:
(A) For each critical asset, except for
a critical payload, 1 × 10¥3 ; and
(B) For each critical payload, 1 ×
10¥4.
(ii) The Administrator will consult
with relevant Federal agencies, and each
agency will identify, for purposes of this
part, any critical assets that the agency
owns or otherwise depends on. For
purposes of this part, the Administrator
will accept any identification by the
Secretary of Defense that an asset is
critical to national security.
(iii) The Administrator or Federal site
operator will notify the licensee of any
risk to critical assets above the risk
criteria in paragraph (a)(4)(i) of this
section.
(iv) The Administrator may
determine, in consultation with relevant
Federal agencies, that a more stringent
probability is necessary to protect the
national interests of the United States.
(v) The risk criteria in paragraph
(a)(4)(i) of this section do not apply to
property, facilities, or infrastructure
supporting the launch that are within
the public area distance, as defined in
part 420, appendix E, tables E1 and E2
or associated formulae, of the vehicle’s
launch point.
(b) Reentry risk criteria. For any
reentry, an operator may initiate the
deorbit of a vehicle only if all risks to
the public satisfy the criteria in this
paragraph (b). The following criteria
apply to each reentry, other than a
suborbital reentry, from the final health
check prior to initiating deorbit through
final impact or landing:
(1) Collective risk. The collective risk,
measured as expected number of
casualties (EC), consists of risk posed by
impacting inert and explosive debris,
toxic release, and far field blast
overpressure. Public risk due to any
other hazard associated with the
proposed deorbit of a reentry vehicle
will be determined by the Administrator
on a case-by-case basis.
(i) The risk to all members of the
public, excluding persons in aircraft and
neighboring operations personnel, must
not exceed an expected number of 1 ×
10¥4 casualties.
(ii) The risk to all neighboring
operations personnel must not exceed
an expected number of 2 × 10¥4
casualties.
(2) Individual risk. The individual
risk, measured as probability of casualty
(PC), consists of risk posed by impacting
inert and explosive debris, toxic release,
and far field blast overpressure. Public
risk due to any other hazard associated
with the proposed flight of a launch
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79724
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
vehicle will be determined on a case-bycase basis.
(i) The risk to any individual member
of the public, excluding neighboring
operations personnel, must not exceed a
probability of casualty of 1 × 10¥6 per
reentry.
(ii) The risk to any individual
neighboring operations personnel must
not exceed a probability of casualty of
1 × 10¥5 per reentry.
(3) Aircraft risk. A reentry operator
must establish any aircraft hazard areas
necessary to ensure the probability of
impact with debris capable of causing a
casualty for aircraft does not exceed 1 ×
10¥6.
(4) Risk to critical assets. (i) The risk
to critical assets, measured as the
probability of loss of functionality, must
not exceed the following probabilities:
(A) For each critical asset, except for
a critical payload, 1 × 10¥3 ; and
(B) For each critical payload, 1 ×
10¥4.
(ii) The Administrator will consult
with relevant Federal agencies, and each
agency will identify, for purposes of this
part, any critical assets that the agency
owns or otherwise depends on. For
purposes of this part, the Administrator
will accept any identification by the
Secretary of Defense that an asset is
critical to national security.
(iii) The Administrator or Federal site
operator will notify the licensee of any
risk to critical assets above the risk
criteria in paragraph (b)(4)(i) of this
section.
(iv) The Administrator may
determine, in consultation with relevant
Federal agencies, that a more stringent
probability is necessary to protect the
national interests of the United States.
(c) High consequence event
protection. An operator must protect
against a high consequence event in
uncontrolled areas for each phase of
flight by:
(1) Using flight abort as a hazard
control strategy in accordance with the
requirements of § 450.108;
(2) Ensuring the consequence of any
reasonably foreseeable failure mode, in
any significant period of flight, is no
greater than 1 × 10¥3 conditional
expected casualties; or
(3) Establishing the launch or reentry
vehicle has sufficient demonstrated
reliability as agreed to by the
Administrator based on conditional
expected casualties criteria during that
phase of flight.
(d) Disposal safety criteria. A launch
operator must ensure that any disposal
meets the criteria of paragraphs (b)(1)
through (3) of this section, or targets a
broad ocean area.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
(e) Protection of people and property
on orbit. (1) A launch or reentry
operator must prevent the collision
between a launch or reentry vehicle
stage or component and people or
property on orbit, in accordance with
the requirements in § 450.169(a).
(2) For any launch vehicle stage or
component that reaches Earth orbit, a
launch operator must prevent the
creation of debris through the
conversion of energy sources into
energy that fragments the stage or
component, in accordance with the
requirements in § 450.171.
(f) Notification of planned impacts.
For any launch, reentry, or disposal, an
operator must notify the public of any
region of land, sea, or air that contains,
with 97 percent probability of
containment, all debris resulting from
normal flight events capable of causing
a casualty.
(g) Validity of the analysis. For any
analysis used to demonstrate
compliance with this section, an
operator must use accurate data and
scientific principles and the analysis
must be statistically valid. The method
must produce results consistent with or
more conservative than the results
available from previous mishaps, tests,
or other valid benchmarks, such as
higher-fidelity methods.
System Safety Program
§ 450.103
System safety program.
An operator must implement and
document a system safety program
throughout the lifecycle of a launch or
reentry system that includes the
following:
(a) Safety organization. An operator
must maintain a safety organization that
has clearly defined lines of
communication and approval authority
for all public safety decisions. At a
minimum, the safety organization must
have the following positions:
(1) Mission director. For each launch
or reentry, an operator must designate a
position responsible for the safe conduct
of all licensed activities and authorized
to provide final approval to proceed
with licensed activities. This position is
referred to as the mission director in
this part.
(2) Safety official. For each launch or
reentry, an operator must designate a
position with direct access to the
mission director who is—
(i) Responsible for communicating
potential safety and noncompliance
issues to the mission director; and
(ii) Authorized to examine all aspects
of the operator’s ground and flight safety
operations, and to independently
monitor compliance with the operator’s
PO 00000
Frm 00160
Fmt 4701
Sfmt 4700
safety policies, safety procedures, and
licensing requirements.
(3) Addressing safety official
concerns. The mission director must
ensure that all of the safety official’s
concerns are addressed.
(b) Hazard management. For hazard
management:
(1) An operator must implement
methods to assess the system to ensure
the validity of the hazard control
strategy determination and any flight
hazard or flight safety analysis
throughout the lifecycle of the launch or
reentry system;
(2) An operator must implement
methods for communicating and
implementing any updates throughout
the organization; and
(3) Additionally, an operator required
to conduct a flight hazard analysis must
implement a process for tracking
hazards, risks, mitigation measures, and
verification activities.
(c) Configuration management and
control. An operator must—
(1) Employ a process that tracks
configurations of all safety-critical
systems and documentation related to
the operation;
(2) Ensure the use of correct and
appropriate versions of systems and
documentation tracked in paragraph
(c)(1) of this section; and
(3) Document the configurations and
versions identified in paragraph (c)(2) of
this section for each licensed activity.
(d) Post-flight data review. An
operator must employ a process for
evaluating post-flight data to—
(1) Ensure consistency between the
assumptions used for the hazard control
strategy determination, any flight hazard
or flight safety analyses, and associated
mitigation and hazard control measures;
(2) Resolve any inconsistencies
identified in paragraph (d)(1) of this
section prior to the next flight of the
vehicle;
(3) Identify any anomaly that may
impact any flight hazard analysis, flight
safety analysis, or safety-critical system,
or is otherwise material to public safety;
and
(4) Address any anomaly identified in
paragraph (d)(3) of this section prior to
the next flight as necessary to ensure
public safety, including updates to any
flight hazard analysis, flight safety
analysis, or safety-critical system.
(e) Application requirements. An
applicant must submit in its application
the following:
(1) A description of the applicant’s
safety organization as required by
paragraph (a) of this section, identifying
the applicant’s lines of communication
and approval authority, both internally
and externally, for all public safety
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
decisions and the provision of public
safety services; and
(2) A summary of the processes and
products identified in the system safety
program requirements in paragraphs (b),
(c), and (d) of this section.
Hazard Control Strategies
§ 450.107
Hazard control strategies.
(a) General. To meet the safety criteria
of § 450.101(a), (b), or (c) for the flight,
or any phase of flight, of a launch or
reentry vehicle, an operator must use
one or more of the hazard control
strategies identified in § 450.108
through § 450.111.
(b) Hazard control strategy
determination. For each phase of flight
during a launch or reentry, an operator
must use a functional hazard analysis to
determine a hazard control strategy or
strategies that account for—
(1) All functional failures associated
with reasonably foreseeable hazardous
events that have the capability to create
a hazard to the public;
(2) Safety-critical systems; and
(3) A timeline of all safety-critical
events.
(c) Flight hazard analysis. An
operator must conduct a flight hazard
analysis in accordance with § 450.109 of
this part for the flight, or phase of flight,
of a launch or reentry vehicle if the
public safety hazards cannot be
mitigated adequately to meet the public
risk criteria of § 450.101(a), (b), and (c)
using physical containment, wind
weighting, or flight abort.
(d) Application requirements. An
applicant must submit in its
application—
(1) The results of the hazard control
strategy determination, including—
(i) All functional failures identified
under paragraph (b)(1) of this section;
(ii) The identification of all safetycritical systems; and
(iii) A timeline of all safety-critical
events.
(2) A description of its hazard control
strategy or strategies for each phase of
flight.
jbell on DSKJLSW7X2PROD with RULES2
§ 450.108
Flight abort.
(a) Applicability. This section applies
to the use of flight abort as a hazard
control strategy for the flight, or phase
of flight, of a launch or reentry vehicle
to meet the safety criteria of § 450.101.
(b) Flight safety system. An operator
must use a flight safety system that:
(1) Meets the requirements of
§ 450.145 if the consequence of any
reasonably foreseeable failure mode in
any significant period of flight is greater
than 1 × 10¥2 conditional expected
casualties in uncontrolled areas; or
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
(2) Meets the requirements of
§ 450.143 if the consequence of any
reasonably foreseeable failure mode in
any significant period of flight is
between 1 × 10¥2 and 1 × 10¥3
conditional expected casualties for
uncontrolled areas.
(c) Flight safety limits objectives. An
operator must determine and use flight
safety limits that define when an
operator must initiate flight abort for
each of the following—
(1) To ensure compliance with the
safety criteria of § 450.101(a) and (b);
(2) To prevent continued flight from
increasing risk in uncontrolled areas if
the vehicle is unable to achieve a useful
mission;
(3) To prevent the vehicle from
entering a period of materially increased
public exposure in uncontrolled areas,
including before orbital insertion, if a
critical vehicle parameter is outside its
pre-established expected range or
indicates an inability to complete flight
within the limits of a useful mission;
(4) To prevent conditional expected
casualties greater than 1 × 10¥2 in
uncontrolled areas due to flight abort or
due to flight outside the limits of a
useful mission from any reasonably
foreseeable off-trajectory failure mode in
any significant period of flight; and
(5) To prevent the vehicle state from
reaching identified conditions that are
anticipated to compromise the
capability of the flight safety system if
further flight has the potential to violate
a flight safety limit.
(6) In lieu of paragraphs (c)(2) and (4)
of this section, to prevent debris capable
of causing a casualty due to any hazard
from affecting uncontrolled areas using
a flight safety system that complies with
§ 450.145.
(d) Flight safety limits constraints. An
operator must determine flight safety
limits that—
(1) Account for temporal and
geometric extents on the Earth’s surface
of any reasonably foreseeable vehicle
hazards under all reasonably foreseeable
conditions during normal and
malfunctioning flight;
(2) Account for physics of hazard
generation and transport including
uncertainty;
(3) Account for the potential to lose
valid data necessary to evaluate the
flight abort rules;
(4) Account for the time delay,
including uncertainties, between the
violation of a flight abort rule and the
time when the flight safety system is
expected to activate;
(5) Account in individual, collective,
and conditional risk evaluations both
for proper functioning of the flight
PO 00000
Frm 00161
Fmt 4701
Sfmt 4700
79725
safety system and failure of the flight
safety system;
(6) Are designed to avoid flight abort
that results in increased collective risk
to the public in uncontrolled areas,
compared to continued flight; and
(7) Ensure that any trajectory within
the limits of a useful mission that is
permitted to fly without abort would
meet the collective risk criteria of
§ 450.101(a)(1) or (b)(1) when analyzed
as if it were the planned mission in
accordance with § 450.213(b)(2).
(e) End of flight abort. A flight does
not need to be aborted to protect against
high consequence events in
uncontrolled areas beginning
immediately after critical vehicle
parameters are validated, if the vehicle
is able to achieve a useful mission and
the following conditions are met for the
remainder of flight:
(1) Flight abort would not materially
decrease the risk from a high
consequence event; and
(2) There are no key flight safety
events.
(f) Flight abort rules. For each launch
or reentry, an operator must establish
and observe flight abort rules that
govern the conduct of the launch or
reentry as follows.
(1) Vehicle data required to evaluate
flight abort rules must be available to
the flight safety system under all
reasonably foreseeable conditions
during normal and malfunctioning
flight.
(2) The flight safety system must abort
flight:
(i) When valid, real-time data indicate
the vehicle has violated any flight safety
limit developed in accordance with this
section;
(ii) When the vehicle state approaches
identified conditions that are
anticipated to compromise the
capability of the flight safety system and
further flight has the potential to violate
a flight safety limit; and
(iii) In accordance with methods used
to satisfy (d)(3) of this section, if
tracking data is invalid and further
flight has the potential to violate a flight
safety limit.
(g) Application requirements. An
applicant must submit in its application
the following:
(1) A description of the methods used
to demonstrate compliance with
paragraph (c) of this section, including
descriptions of how each analysis
constraint in paragraph (d) of this
section is satisfied in accordance with
§ 450.115.
(2) A description of how each flight
safety limit and flight abort rule is
evaluated and implemented during
vehicle flight, including the quantitative
E:\FR\FM\10DER2.SGM
10DER2
79726
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
criteria that will be used, a description
of any critical parameters, and how the
values required in paragraphs (c)(3) and
(e) of this section are identified;
(3) A graphic depiction or series of
depictions of flight safety limits for a
representative mission together with the
launch or landing point, all
uncontrolled area boundaries, the
nominal trajectory, extents of normal
flight, and limits of a useful mission
trajectories, with all trajectories in the
same projection as each of the flight
safety limits; and
(4) A description of the vehicle data
that will be available to evaluate flight
abort rules under all reasonably
foreseeable conditions during normal
and malfunctioning flight.
jbell on DSKJLSW7X2PROD with RULES2
§ 450.109
Flight hazard analysis.
(a) Applicability. This section applies
to the use of a flight hazard analysis as
a hazard control strategy to derive
hazard controls for the flight, or phase
of flight, of a launch or reentry vehicle.
Hazards associated with computing
systems and software are further
addressed in § 450.141.
(b) Analysis. A flight hazard analysis
must identify, describe, and analyze all
reasonably foreseeable hazards to public
safety resulting from the flight of a
launch or reentry vehicle. Each flight
hazard analysis must—
(1) Identify all reasonably foreseeable
hazards, and the corresponding failure
mode for each hazard, associated with
the launch or reentry system relevant to
public safety, including those resulting
from:
(i) Vehicle operation, including
staging and release;
(ii) System, subsystem, and
component failures or faults;
(iii) Software operations;
(iv) Environmental conditions;
(v) Human factors;
(vi) Design inadequacies;
(vii) Procedure deficiencies;
(viii) Functional and physical
interfaces between subsystems,
including any vehicle payload;
(ix) Reuse of components or systems;
and
(x) Interactions of any of the above.
(2) Assess each hazard’s likelihood
and severity.
(3) Ensure that the likelihood of any
hazardous condition that may cause
death or serious injury to the public is
extremely remote.
(4) Identify and describe the risk
elimination and mitigation measures
required to satisfy paragraph (b)(3) of
this section.
(5) Document that the risk elimination
and mitigation measures achieve the
risk level of paragraph (b)(3) of this
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
section through validation and
verification. Verification includes:
(i) Analysis;
(ii) Test;
(iii) Demonstration; or
(iv) Inspection.
(c) New Hazards. An operator must
establish and document the criteria and
techniques for identifying new hazards
throughout the lifecycle of the launch or
reentry system.
(d) Completeness Prior to Flight. For
every launch or reentry, the flight
hazard analysis must be complete and
all hazards must be mitigated to an
acceptable level in accordance with
paragraph (b)(3) of this section.
(e) Updates. An operator must
continually update the flight hazard
analysis throughout the lifecycle of the
launch or reentry system.
(f) Application requirements. An
applicant must submit in its application
the following:
(1) Flight hazard analysis products of
paragraphs (b)(1) through (5) of this
section, including data that verifies the
risk elimination and mitigation
measures resulting from the applicant’s
flight hazard analyses required by
paragraph (b)(5) of this section; and
(2) The criteria and techniques for
identifying new hazards throughout the
lifecycle of the launch or reentry system
as required by paragraph (c) of this
section.
§ 450.110
Physical containment.
(a) Applicability. This section applies
to the use of physical containment as a
hazard control strategy for the flight, or
phase of flight, of a launch or reentry
vehicle to meet the safety criteria of
§ 450.101(a), (b), and (c).
(b) Containment. To use physical
containment as a hazard control
strategy, an operator must—
(1) Develop the flight hazard area in
accordance with § 450.133;
(2) Ensure that the launch vehicle
does not have sufficient energy for any
hazards associated with its flight to
reach outside the flight hazard area;
(3) Ensure the hazard area is clear of
the public and critical assets; and
(4) Apply other mitigation measures
necessary to ensure no public or critical
asset exposure to hazards, such as
control of public access or wind
placards.
(c) Application requirements. An
applicant must submit in its application
the following:
(1) A demonstration that the launch
vehicle does not have sufficient energy
for any hazards associated with its flight
to reach outside the flight hazard area
developed in accordance with
§ 450.133; and
PO 00000
Frm 00162
Fmt 4701
Sfmt 4700
(2) A description of the methods used
to ensure that flight hazard areas are
cleared of the public and critical assets.
§ 450.111
Wind weighting.
(a) Applicability. This section applies
to the use of wind weighting as a hazard
control strategy for the flight of an
unguided suborbital launch vehicle to
meet the safety criteria of § 450.101(a),
(b), and (c).
(b) Wind weighting safety system. The
flight of an unguided suborbital launch
vehicle that uses a wind weighting
safety system must meet the following:
(1) The launcher azimuth and
elevation settings must be wind
weighted to correct for the effects of
wind conditions at the time of flight to
provide impact locations that will
ensure compliance with the safety
criteria in § 450.101; and
(2) An operator must use launcher
azimuth and elevation angle settings
that ensures the rocket will not fly in an
unintended direction accounting for
uncertainties in vehicle and launcher
design and manufacturing, and
atmospheric uncertainties.
(c) Analysis. An operator must—
(1) Establish flight commit criteria
and other flight safety rules that control
the risk to the public from potential
adverse effects resulting from normal
and malfunctioning flight;
(2) Establish any wind constraints
under which flight may occur; and
(3) Conduct a wind weighting analysis
that establishes the launcher azimuth
and elevation settings that correct for
the windcocking and wind-drift effects
on the unguided suborbital launch
vehicle.
(d) Stability. An unguided suborbital
launch vehicle, in all configurations,
must be stable throughout each stage of
powered flight.
(e) Application requirements. An
applicant must submit in its application
the following:
(1) A description of its wind
weighting analysis methods, including
its method and schedule of determining
wind speed and wind direction for each
altitude layer;
(2) A description of its wind
weighting safety system including all
equipment used to perform the wind
weighting analysis; and
(3) A representative wind weighting
analysis using actual or statistical winds
for the launch area and samples of the
output.
Flight Safety Analyses
§ 450.113 Flight safety analysis
requirements—scope.
(a) An operator must perform and
document a flight safety analysis for all
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
phases of flight, except as specified in
paragraph (b) of this section, as
follows—
(1) For orbital launch, from liftoff
through orbital insertion, and through
all component impacts or landings;
(2) For suborbital launch, from liftoff
through all component impacts or
landings;
(3) For disposal, from the initiation of
the deorbit through final impact; and
(4) For reentry, from the initiation of
the deorbit through all component
impacts or landing.
(b) An operator is not required to
perform and document a flight safety
analysis for a phase of flight if agreed to
by the Administrator based on
demonstrated reliability. An operator
demonstrates reliability by using
operational and flight history to show
compliance with the risk criteria in
§ 450.101(a) and (b).
jbell on DSKJLSW7X2PROD with RULES2
§ 450.115
Flight safety analysis methods.
(a) Scope of the analysis. An
operator’s flight safety analysis method
must account for all reasonably
foreseeable events and failures of safetycritical systems during nominal and
non-nominal launch or reentry that
could jeopardize public safety.
(b) Level of fidelity of the analysis. An
operator’s flight safety analysis method
must have a level of fidelity sufficient
to—
(1) Demonstrate that any risk to the
public satisfies the safety criteria of
§ 450.101, including the use of
mitigations, accounting for all known
sources of uncertainty, using a means of
compliance accepted by the
Administrator; and
(2) Identify the dominant source of
each type of public risk with a criterion
in § 450.101(a) or (b) in terms of phase
of flight, source of hazard (such as toxic
exposure, inert, or explosive debris),
and failure mode.
(c) Application requirements. An
applicant must submit a description of
the flight safety analysis methodology,
including identification of:
(1) The scientific principles and
statistical methods used;
(2) All assumptions and their
justifications;
(3) The rationale for the level of
fidelity;
(4) The evidence for validation and
verification required by § 450.101(g);
(5) The extent to which the
benchmark conditions are comparable
to the foreseeable conditions of the
intended operations; and
(6) The extent to which risk
mitigations were accounted for in the
analyses.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
§ 450.117
flight.
Trajectory analysis for normal
(a) General. A flight safety analysis
must include a trajectory analysis that
establishes, for any phase of flight
within the scope as provided by
§ 450.113(a), the limits of a launch or
reentry vehicle’s normal flight as
defined by the nominal trajectory, and
the following sets of trajectories
sufficient to characterize variability and
uncertainty during normal flight:
(1) A set of trajectories to characterize
variability. This set must describe how
the intended trajectory could vary due
to conditions known prior to initiation
of flight; and
(2) A set of trajectories to characterize
uncertainty. This set must describe how
the actual trajectory could differ from
the intended trajectory due to random
uncertainties in all parameters with a
significant influence on the vehicle’s
behavior throughout normal flight.
(b) Trajectory model. A final trajectory
analysis must use a six-degree of
freedom trajectory model to satisfy the
requirements of paragraph (a) of this
section.
(c) Atmospheric effects. A trajectory
analysis must account for atmospheric
conditions that have an effect on the
trajectory, including atmospheric
profiles that are no less severe than the
worst conditions under which flight
might be attempted, and for uncertainty
in the atmospheric conditions.
(d) Application requirements. An
applicant must submit the following:
(1) A description of the methods used
to characterize the vehicle’s flight
behavior throughout normal flight, in
accordance with § 450.115(c).
(2) The quantitative input data,
including uncertainties, used to model
the vehicle’s normal flight in six degrees
of freedom.
(3) The worst atmospheric conditions
under which flight might be attempted,
and a description of how the operator
will evaluate the atmospheric
conditions and uncertainty in the
atmospheric conditions prior to
initiating the operation;
(4) Representative normal flight
trajectory analysis outputs, including
the position velocity, and orientation for
each second of flight for—
(i) The nominal trajectory;
(ii) A set of trajectories that
characterize variability in the intended
trajectory based on conditions known
prior to initiation of flight; and
(iii) A set of trajectories that
characterize how the actual trajectory
could differ from the intended trajectory
due to random uncertainties.
PO 00000
Frm 00163
Fmt 4701
Sfmt 4700
79727
§ 450.119 Trajectory analysis for
malfunction flight.
(a) General. A flight safety analysis
must include a trajectory analysis that
establishes—
(1) The vehicle’s deviation capability
in the event of a malfunction during
flight,
(2) The trajectory dispersion resulting
from reasonably foreseeable
malfunctions, and
(3) For vehicles using flight abort as
a hazard control strategy under
§ 450.108, trajectory data or parameters
that describe the limits of a useful
mission. The FAA does not consider the
collection of data related to a failure to
be a useful mission.
(b) Analysis constraints. A
malfunction trajectory analysis must
account for each cause of a malfunction
flight, including software and hardware
failures, for every period of normal
flight. The analysis for each type of
malfunction must have sufficient
temporal and spatial resolution to
establish flight safety limits, if any, and
individual risk contours that are smooth
and continuous. The analysis must
account for—
(1) The relative probability of
occurrence of each malfunction;
(2) The probability distribution of
position and velocity of the vehicle
when each malfunction trajectory will
terminate due to vehicle breakup,
ground impact, or orbital insertion along
with the cause of termination and the
state of the vehicle;
(3) The parameters with a significant
influence on a vehicle’s flight behavior
from the time a malfunction begins to
cause a flight deviation until the time
each malfunction trajectory will
terminate due to vehicle breakup,
ground impact, or orbital insertion; and
(4) The potential for failure of the
flight safety system, if any.
(c) Application requirements. An
applicant must submit—
(1) A description of the methodology
used to characterize the vehicle’s flight
behavior throughout malfunction flight,
in accordance with § 450.115(c).
(2) A description of the methodology
used to determine the limits of a useful
mission, in accordance with
§ 450.115(c).
(3) A description of the input data
used to characterize the vehicle’s
malfunction flight behavior, including:
(i) A list of each cause of malfunction
flight considered;
(ii) A list of each type of malfunction
flight for which malfunction flight
behavior was characterized; and
(iii) A quantitative description of the
parameters, including uncertainties,
with a significant influence on the
E:\FR\FM\10DER2.SGM
10DER2
79728
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
vehicle’s malfunction behavior for each
type of malfunction flight characterized.
(4) Representative malfunction flight
trajectory analysis outputs, including
the position and velocity as a function
of flight time for—
(i) Each set of trajectories that
characterizes a type of malfunction
flight;
(ii) The probability of each set of
trajectories that characterizes a type of
malfunction flight; and
(iii) A set of trajectories that
characterizes the limits of a useful
mission as described in paragraph (a)(3)
of this section.
jbell on DSKJLSW7X2PROD with RULES2
§ 450.121
Debris analysis.
(a) General. A flight safety analysis
must include an analysis characterizing
the hazardous debris generated from
normal and malfunctioning vehicle
flight as a function of vehicle flight
sequence.
(b) Vehicle impact and breakup
analysis. A debris analysis must account
for:
(1) Each reasonably foreseeable cause
of vehicle breakup and intact impact,
(2) Vehicle structural characteristics
and materials, and
(3) Energetic effects during break-up
or at impact.
(c) Propagation of debris. A debris
analysis must compute statistically
valid debris impact probability
distributions. The propagation of debris
from each predicted breakup location to
impact must account for—
(1) All foreseeable forces that can
influence any debris impact location;
and
(2) All foreseeable sources of impact
dispersion, including, at a minimum:
(i) The uncertainties in atmospheric
conditions;
(ii) Debris aerodynamic parameters,
including uncertainties;
(iii) Pre-breakup position and
velocity, including uncertainties; and
(iv) Breakup-imparted velocities,
including uncertainties.
(d) Application requirements. An
applicant must submit:
(1) A description of all scenarios that
can lead to hazardous debris;
(2) A description of the methods used
to perform the vehicle impact and
breakup analysis, in accordance with
§ 450.115(c);
(3) A description of the methods used
to compute debris impact distributions,
in accordance with § 450.115(c);
(4) A description of the atmospheric
data used as input to the debris analysis;
and
(5) A quantitative description of the
physical, aerodynamic, and harmful
characteristics of hazardous debris.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
§ 450.123
Population exposure analysis.
(a) General. A flight safety analysis
must account for the distribution of
people for the entire region where there
is a significant probability of impact of
hazardous debris.
(b) Constraints. The exposure analysis
must—
(1) Characterize the distribution of
people both geographically and
temporally;
(2) Account for the distribution of
people among structures and vehicle
types;
(3) Use reliable, accurate, and timely
source data; and
(4) Account for vulnerability of
people to hazardous debris effects.
(c) Application requirements. An
applicant must submit:
(1) A description of the methods used
to develop the exposure input data in
accordance with § 450.115(c), and
(2) Complete population exposure
data, in tabular form.
§ 450.131
Probability of failure analysis.
(a) General. For each hazard and
phase of flight, a flight safety analysis
for a launch or reentry must account for
vehicle failure probability. The
probability of failure must be consistent
for all hazards and phases of flight.
(1) For a vehicle or vehicle stage with
fewer than two flights, the failure
probability estimate must account for
the outcome of all previous flights of
vehicles developed and launched or
reentered in similar circumstances.
(2) For a vehicle or vehicle stage with
two or more flights, vehicle failure
probability estimates must account for
the outcomes of all previous flights of
the vehicle or vehicle stage in a
statistically valid manner. The outcomes
of all previous flights of the vehicle or
vehicle stage must account for data on
any mishap and anomaly.
(b) Failure. For flight safety analysis
purposes, a failure occurs when a
vehicle does not complete any phase of
normal flight or when any anomalous
condition exhibits the potential for a
stage or its debris to impact the Earth or
reenter the atmosphere outside the
normal trajectory envelope during the
mission or any future mission of similar
vehicle capability.
(c) Previous flight. For flight safety
analysis purposes—
(1) The flight of a launch vehicle
begins at a time in which a launch
vehicle lifts off from the surface of the
Earth; and
(2) The flight of a reentry vehicle or
deorbiting upper stage begins at a time
in which a vehicle attempts to initiate
a reentry.
(d) Allocation. The vehicle failure
probability estimate must be distributed
PO 00000
Frm 00164
Fmt 4701
Sfmt 4700
across flight phases and failure modes.
The distribution must be consistent
with—
(1) The data available from all
previous flights of vehicles developed
and launched or reentered in similar
circumstances; and
(2) Data from previous flights of
vehicles, stages, or components
developed and launched, reentered,
flown, or tested by the subject vehicle
developer or operator. Such data may
include previous experience involving
similar—
(i) Vehicle, stage, or component
design characteristics;
(ii) Development and integration
processes, including the extent of
integrated system testing; and
(iii) Level of experience of the vehicle
operation and development team
members.
(e) Observed vs. conditional failure
rate. Probability of failure allocation
must account for significant differences
in the observed failure rate and the
conditional failure rate. A probability of
failure analysis must use a constant
conditional failure rate for each phase of
flight, unless there is clear and
convincing evidence of a different
conditional failure rate for a particular
vehicle, stage, or phase of flight.
(f) Application requirements. An
applicant must submit:
(1) A description of the methods used
in probability of failure analysis, in
accordance with § 450.115(c); and
(2) A representative set of tabular data
and graphs of the predicted failure rate
and cumulative failure probability for
each foreseeable failure mode.
§ 450.133
Flight hazard area analysis.
(a) General. A flight safety analysis
must include a flight hazard area
analysis that identifies any region of
land, sea, or air that must be surveyed,
publicized, controlled, or evacuated in
order to control the risk to the public.
The analysis must account for, at a
minimum—
(1) The regions of land, sea, and air
potentially exposed to hazardous debris
generated during normal flight events
and all reasonably foreseeable failure
modes;
(2) Any hazard controls implemented
to control risk from any hazard;
(3) The limits of a launch or reentry
vehicle’s normal flight, including—
(i) Atmospheric conditions that are no
less severe than the worst atmospheric
conditions under which flight might be
attempted; and
(ii) Uncertainty in the atmospheric
conditions;
(4) All hazardous debris;
(5) Sources of debris dispersion in
accordance with § 450.121(c); and
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(6) A probability of one for any
planned debris hazards or planned
impacts.
(b) Waterborne vessel hazard areas.
The flight hazard area analysis for
waterborne vessels must determine the
areas and durations for regions of
water—
(1) That are necessary to contain, with
97 percent probability of containment,
all debris resulting from normal flight
events capable of causing a casualty to
persons on waterborne vessels;
(2) That are necessary to contain
either where the probability of debris
capable of causing a casualty impacting
on or near a vessel would exceed 1 ×
10¥5, accounting for all relevant
hazards, or where the individual
probability of casualty for any person on
board a vessel would exceed the
individual risk criteria in § 450.101(a)(2)
or (b)(2); and
(3) Where reduced vessel traffic is
necessary to meet the collective risk
criteria in § 450.101(a)(1) or (b)(1).
(c) Land hazard areas. The flight
hazard area analysis for land must
determine the durations and areas
regions of land—
(1) That are necessary to contain, with
97 percent probability of containment,
all debris resulting from normal flight
events capable of causing a casualty to
any person on land;
(2) Where the individual probability
of casualty for any person on land
would exceed the individual risk
criteria in § 450.101(a)(2) or (b)(2); and
(3) Where reduced population is
necessary to meet the collective risk
criteria in § 450.101(a)(1) or (b)(1).
(d) Airspace hazard volumes. The
flight hazard area analysis for airspace
must determine the durations and
volumes for regions of air to be
submitted to the FAA for approval—
(1) That are necessary to contain, with
97 percent probability of containment,
all debris resulting from normal flight
events capable of causing a casualty to
persons on an aircraft; and
(2) Where the probability of impact on
an aircraft would exceed the aircraft risk
criterion in § 450.101(a)(3) or (b)(3).
(e) Application requirements. An
applicant must submit:
(1) A description of the methodology
to be used in the flight hazard area
analysis in accordance with
§ 450.115(c), including:
(i) Classes of waterborne vessel and
vulnerability criteria employed; and
(ii) Classes of aircraft and
vulnerability criteria employed.
(2) Tabular data and graphs of the
results of the flight hazard area analysis,
including:
(i) Geographical coordinates of all
hazard areas that are representative of
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
those to be published, in accordance
with § 450.161, prior to any proposed
operation;
(ii) Representative 97 percent
probability of containment contours for
all debris resulting from normal flight
events capable of causing a casualty for
all locations specified in paragraph (a)
of this section;
(iii) Representative individual
probability of casualty contours for all
locations specified in paragraph (a) of
this section, including tabular data and
graphs showing the hypothetical
location of any member of the public
that could be exposed to a probability of
casualty of 1 × 10¥5 or greater for
neighboring operations personnel, and 1
× 10¥6 or greater for other members of
the public, given all foreseeable
conditions within the flight commit
criteria;
(iv) If applicable, representative 1 ×
10¥5 and 1 × 10¥6 probability of impact
contours for all debris capable of
causing a casualty to persons on a
waterborne vessel regardless of location;
and
(v) Representative 1 × 10¥6 and 1 ×
10¥7 probability of impact contours for
all debris capable of causing a casualty
to persons on an aircraft regardless of
location.
§ 450.135
Debris risk analysis.
(a) General. A flight safety analysis
must include a debris risk analysis that
demonstrates compliance with safety
criteria in § 450.101, either—
(1) Prior to the day of the operation,
accounting for all foreseeable conditions
within the flight commit criteria; or
(2) During the countdown using the
best available input data, including
flight commit criteria and flight abort
rules.
(b) Casualty area and consequence
analysis. A debris risk analysis must
model the casualty area, and compute
the predicted consequences of each
reasonably foreseeable failure mode in
any significant period of flight in terms
of conditional expected casualties. The
casualty area and consequence analysis
must account for—
(1) All relevant debris fragment
characteristics and the characteristics of
a representative person exposed to any
potential debris hazard;
(2) Statistically-valid debris impact
probability distributions;
(3) Any impact or effects of hazardous
debris; and
(4) The vulnerability of people to
debris impact or effects, including:
(i) Effects of buildings, ground
vehicles, waterborne vessel, and aircraft
upon the vulnerability of any occupants;
(ii) Effect of atmospheric conditions
on debris impact and effects;
PO 00000
Frm 00165
Fmt 4701
Sfmt 4700
79729
(iii) Impact speed and angle,
accounting for motion of impacted
vehicles;
(iv) Uncertainty in input data, such as
fragment impact parameters; and
(v) Uncertainty in modeling
methodology.
(c) Application requirements. An
applicant must submit:
(1) A description of the methods used
to demonstrate compliance with the
safety criteria in § 450.101, in
accordance with § 450.115(c), including
a description of how the operator will
account for the conditions immediately
prior to enabling the flight of a launch
vehicle or the reentry of a reentry
vehicle, such as the final trajectory,
atmospheric conditions, and the
exposure of people;
(2) A description of the atmospheric
data used as input to the debris risk
analysis;
(3) The effective unsheltered casualty
area for all fragment classes, assuming a
representative impact vector;
(4) The effective casualty area for all
fragment classes for a representative
type of building, ground vehicle,
waterborne vessel, and aircraft,
assuming a representative impact
vector;
(5) Collective and individual debris
risk analysis outputs under
representative conditions and the worst
foreseeable conditions, including:
(i) Total collective casualty
expectation for the proposed operation;
(ii) A list of the collective risk
contribution for at least the top ten
population centers and all centers with
collective risk exceeding 1 percent of
the collective risk criteria in
§ 450.101(a)(1) or (b)(1);
(iii) A list of the maximum individual
probability of casualty for the top ten
population centers and all centers that
exceed 10 percent of the individual risk
criteria in § 450.101(a)(2) or (b)(2); and
(iv) A list of the conditional collective
casualty expectation for each failure
mode for each significant period of
flight under representative conditions
and the worst foreseeable conditions.
§ 450.137 Far-field overpressure blast
effects analysis.
(a) General. A flight safety analysis
must include a far-field overpressure
blast effect analysis that demonstrates
compliance with safety criteria in
§ 450.101, either—
(1) Prior to the day of the operation,
accounting for all foreseeable conditions
within the flight commit criteria; or
(2) During the countdown using the
best available input data, including
flight commit criteria and flight abort
rules.
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
79730
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(b) Analysis constraints. The analysis
must account for—
(1) The explosive capability of the
vehicle and hazardous debris at impact
and at altitude;
(2) The potential influence of
meteorological conditions and terrain
characteristics; and
(3) The potential for broken windows
due to peak incident overpressures
below 1.0 psi and related casualties
based on the characteristics of exposed
windows and the population’s
susceptibility to injury, with
considerations including, at a
minimum, shelter types, window types,
and the time of day of the proposed
operation.
(c) Application requirements. An
applicant must submit a description of
the far-field overpressure analysis,
including all assumptions and
justifications for the assumptions,
analysis methods, input data, and
results. At a minimum, the application
must include:
(1) A description of the population
centers, terrain, building types, and
window characteristics used as input to
the far-field overpressure analysis;
(2) A description of the methods used
to compute the foreseeable explosive
yield probability pairs, and the
complete set of yield-probability pairs,
used as input to the far-field
overpressure analysis;
(3) A description of the methods used
to compute peak incident overpressures
as a function of distance from the
explosion and prevailing meteorological
conditions, including sample
calculations for a representative range of
the foreseeable meteorological
conditions, yields, and population
center locations;
(4) A description of the methods used
to compute the probability of window
breakage, including tabular data and
graphs for the probability of breakage as
a function of the peak incident
overpressure for a representative range
of window types, building types, and
yields accounted for;
(5) A description of the methods used
to compute the probability of casualty
for a representative individual,
including tabular data and graphs for
the probability of casualty, as a function
of location relative to the window and
the peak incident overpressure for a
representative range of window types,
building types, and yields accounted
for;
(6) Tabular data and graphs showing
the hypothetical location of any member
of the public that could be exposed to
a probability of casualty of 1 × 10¥5 or
greater for neighboring operations
personnel, and 1 × 10¥6 or greater for
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
other members of the public, given
foreseeable conditions;
(7) The maximum expected casualties
that could result from far-field
overpressure hazards given foreseeable
conditions; and
(8) A description of the
meteorological measurements used as
input to any real-time far-field
overpressure analysis.
§ 450.139
Toxic hazards for flight.
(a) Applicability. (1) Except as
specified in paragraph (a)(2), this
section applies to any launch or reentry
vehicle, including all vehicle
components and payloads, that use
toxic propellants or other toxic
chemicals.
(2) No toxic release hazard analysis is
required for kerosene-based fuels,
unless the Administrator determines
that an analysis is required to protect
public safety.
(b) General. An operator must—
(1) Conduct a toxic release hazard
analysis in accordance with paragraph
(c) of this section;
(2) Manage the risk of casualties that
could arise from the exposure to toxic
release through one of the following
means:
(i) Contain hazards caused by toxic
release in accordance with paragraph (d)
of this section; or
(ii) Perform a toxic risk assessment, in
accordance with paragraph (e) of this
section, that protects the public in
compliance with the safety criteria of
§ 450.101, including toxic release
hazards.
(3) Establish flight commit criteria
based on the results of its toxic release
hazard analysis and toxic containment
or toxic risk assessment for any
necessary evacuation of the public from
any toxic hazard area.
(c) Toxic release hazard analysis. A
toxic release hazard analysis must—
(1) Account for any toxic release that
could occur during nominal or nonnominal flight;
(2) Include a worst-case release
scenario analysis or a maximumcredible release scenario analysis for
each process that involves a toxic
propellant or other chemical;
(3) Determine if toxic release can
occur based on an evaluation of the
chemical compositions and quantities of
propellants, other chemicals, vehicle
materials, and projected combustion
products, and the possible toxic release
scenarios;
(4) Account for both normal
combustion products and any unreacted
propellants and phase change or
chemical derivatives of released
substances; and
PO 00000
Frm 00166
Fmt 4701
Sfmt 4700
(5) Account for any operational
constraints and emergency procedures
that provide protection from toxic
release.
(d) Toxic containment. An operator
using toxic containment must manage
the risk of any casualty from the
exposure to toxic release either by—
(1) Evacuating, or being prepared to
evacuate, the public from any toxic
hazard area in the event of a worst-case
release or maximum-credible release
scenario; or
(2) Employing meteorological
constraints to limit an operation to
times during which prevailing winds
and other conditions ensure that any
member of the public would not be
exposed to toxic concentrations and
durations greater than accepted toxic
thresholds for acute casualty in the
event of a worst-case release or
maximum-credible release scenario.
(e) Toxic risk assessment. An operator
using toxic risk assessment must
establish flight commit criteria that
demonstrate compliance with the safety
criteria of § 450.101. A toxic risk
assessment must—
(1) Account for airborne concentration
and duration thresholds of toxic
propellants or other chemicals. For any
toxic propellant, other chemicals, or
combustion product, an operator must
use airborne toxic concentration and
duration thresholds identified in a
means of compliance accepted by the
Administrator;
(2) Account for physical phenomena
expected to influence any toxic
concentration and duration in the area
surrounding the potential release site;
(3) Determine a toxic hazard area for
the launch or reentry, surrounding the
potential release site for each toxic
propellant or other chemical based on
the amount and toxicity of the
propellant or other chemical, the
exposure duration, and the
meteorological conditions involved;
(4) Account for all members of the
public who may be exposed to the toxic
release, including all members of the
public on land and on any waterborne
vessels, populated offshore structures,
and aircraft that are not operated in
direct support of the launch or reentry;
and
(5) Account for any risk mitigation
measures applied in the risk assessment.
(f) Application requirements. An
applicant must submit:
(1) The identity of toxic propellant,
chemical, or combustion products or
derivatives in the possible toxic release;
(2) The applicant’s selected airborne
toxic concentration and duration
thresholds;
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(3) The meteorological conditions for
the atmospheric transport and buoyant
cloud rise of any toxic release from its
source to downwind receptor locations;
(4) Characterization of the terrain, as
input for modeling the atmospheric
transport of a toxic release from its
source to downwind receptor locations;
(5) The identity of the toxic
dispersion model used, and any other
input data;
(6) Representative results of an
applicant’s toxic dispersion modeling to
predict concentrations and durations at
selected downwind receptor locations,
to determine the toxic hazard area for a
released quantity of the toxic substance;
(7) A toxic release hazard analysis in
accordance with paragraph (c) of this
section:
(i) A description of the failure modes
and associated relative probabilities for
potential toxic release scenarios used in
the risk evaluation; and
(ii) The methodology and
representative results of an applicant’s
determination of the worst-case or
maximum-credible quantity of any toxic
release that might occur during the
flight of a vehicle;
(8) In accordance with § 450.139(b)(2),
(i) A toxic containment in accordance
with paragraph (d) of this section,
identify the evacuation plans or
meteorological constraints and
associated launch commit criteria
needed to ensure that the public will
not be within a toxic hazard area in the
event of a worst-case release or
maximum-credible release scenario; or
(ii) A toxic risk assessment in
accordance with paragraph (e) of this
section:
(A) A demonstration that the safety
criteria in § 450.101 will be met;
(B) The population characteristics in
receptor locations that are identified by
toxic dispersion modeling as toxic
hazard areas;
(C) A description of any risk
mitigations applied in the toxic risk
assessment; and
(D) A description of the population
exposure input data used in accordance
with § 450.123.
Prescribed Hazard Controls for SafetyCritical Hardware and Computing
Systems
jbell on DSKJLSW7X2PROD with RULES2
§ 450.141
Computing systems.
(a) Identification of computing system
safety items. An operator must identify:
(1) Any software or data that
implements a capability that, by
intended operation, unintended
operation, or non-operation, can present
a hazard to the public; and
(2) The level of criticality of each
computing system safety item identified
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
in paragraph (a)(1) of this section,
commensurate with its degree of control
over hazards to the public and the
severity of those hazards.
(b) Safety requirements. An operator
must develop safety requirements for
each computing system safety item. In
doing so, the operator must:
(1) Identify and evaluate safety
requirements for each computing system
safety item;
(2) Ensure the safety requirements are
complete and correct;
(3) Implement each safety
requirement; and
(4) Verify and validate the
implementation of each safety
requirement by using a method
appropriate for the level of criticality of
the computing system safety item. For
each computing system safety item that
is safety critical under § 401.7,
verification and validation must include
testing by a test team independent of the
development division or organization.
(c) Development process. An operator
must implement and document a
development process for computing
system safety items appropriate for the
level of criticality of the computing
system safety item. A development
process must define:
(1) Responsibilities for each task
associated with a computing system
safety item;
(2) Processes for internal review and
approval—including review that
evaluates the implementation of all
safety requirements—such that no
person approves that person’s own
work;
(3) Processes to ensure development
personnel are trained, qualified, and
capable of performing their role;
(4) Processes that trace requirements
to verification and validation evidence;
(5) Processes for configuration
management that specify the content of
each released version of a computing
system safety item;
(6) Processes for testing that verify
and validate all safety requirements to
the extent required by paragraph (b)(4)
of this section;
(7) Reuse policies that verify and
validate the safety requirements for
reused computing system safety items;
and
(8) Third-party product use policies
that verify and validate the safety
requirements for any third-party
product.
(d) Application requirements. An
applicant must:
(1) Identify and describe all
computing system safety items involved
in the proposed operations;
(2) Provide the safety requirements for
each computing system safety item;
PO 00000
Frm 00167
Fmt 4701
Sfmt 4700
79731
(3) Provide documentation of the
development processes that meets
paragraph (c) of this section;
(4) Provide evidence of the execution
of the appropriate development process
for each computing system safety item;
and
(5) Provide evidence of the
implementation of each safety
requirement.
§ 450.143 Safety-critical system design,
test, and documentation.
(a) Applicability. This section applies
to all safety-critical systems, except
for—
(1) Highly reliable flight safety
systems covered under § 450.145; or
(2) Safety-critical systems for which
an operator demonstrates through its
flight hazard analysis that the likelihood
of any hazardous condition specifically
associated with the system that may
cause death or serious injury to the
public is extremely remote, pursuant to
§ 450.109(b)(3).
(b) Design. An operator must design
safety-critical systems such that no
credible fault can lead to increased risk
to the public beyond nominal safetycritical system operation.
(c) Qualification testing of design. An
operator must functionally demonstrate
the design of the vehicle’s safety-critical
systems at conditions beyond its
predicted operating environments. The
operator must select environmental test
levels that ensure the design is
sufficiently stressed to demonstrate that
system performance is not degraded due
to design tolerances, manufacturing
variances, or uncertainties in the
environment.
(d) Acceptance of hardware. An
operator must—
(1) Functionally demonstrate any
safety-critical system, while exposed to
its predicted operating environments
with margin, is free of defects, free of
integration and workmanship errors,
and ready for operational use; or
(2) Combine in-process controls and a
quality assurance process to ensure
functional capability of any safetycritical system during its service life.
(e) Lifecycle of safety-critical systems.
(1) The predicted operating
environments must be based on
conditions predicted to be encountered
in all phases of flight, recovery, and
transportation.
(2) An operator must monitor the
flight environments experienced by
safety-critical system components to the
extent necessary to—
(i) Validate the predicted operating
environments; and
(ii) Assess the actual component life
remaining or adjust any inspection
period.
E:\FR\FM\10DER2.SGM
10DER2
79732
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(f) Application requirements. An
applicant must submit to the FAA the
following as part of its application:
(1) A list and description of each
safety-critical system;
(2) Drawings and schematics for each
safety-critical system;
(3) A summary of the analysis to
determine the predicted operating
environments and duration to be
applied to qualification and acceptance
testing covering the service life of any
safety-critical system;
(4) A description of any method used
to validate the predicted operating
environments;
(5) A description of any
instrumentation or inspection processes
to monitor aging of any safety-critical
system;
(6) The criteria and procedures for
disposal or refurbishment for service life
extension of safety-critical system
components; and
(7) A description of the standards
used in all phases of the lifecycle of
each safety-critical system.
jbell on DSKJLSW7X2PROD with RULES2
§ 450.145
system.
Highly reliable flight safety
(a) General. For each phase of flight
for which an operator must implement
flight abort to meet the requirement of
§ 450.108(b)(1), the operator must use a
highly reliable flight safety system on
the launch or reentry vehicle, vehicle
component, or payload with a design
reliability in accordance with this
section.
(b) Reliability. A highly reliable flight
safety system must, using a means of
compliance accepted by the
Administrator—
(1) Have a design reliability of 0.999
at 95 percent confidence and
commensurate design, analysis, and
testing for the portion of the flight safety
system onboard the vehicle; and
(2) Have a design reliability of 0.999
at 95 percent confidence and
commensurate design, analysis, and
testing for the portion of the flight safety
system not onboard the vehicle, if used.
(c) Monitoring. An operator must
monitor the flight environments
experienced by any flight safety system
component to the extent necessary to—
(1) Validate the predicted operating
environment; and
(2) Assess the actual component life
remaining or adjust any inspection
period.
(d) Application requirements. An
applicant must submit the information
identified below, for any highly reliable
flight safety system:
(1) Flight safety system description.
An applicant must describe the flight
safety system and its operation in detail,
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
including all components, component
functions, and possible operational
scenarios.
(2) Flight safety system diagram. An
applicant must submit a diagram that
identifies all flight safety system
subsystems and shows the
interconnection of all the elements of
the flight safety system. The diagram
must include any subsystems used to
implement flight abort both on and off
the vehicle, including any subsystems
used to make the decision to abort
flight.
(3) Flight safety system analyses. An
applicant must submit any analyses and
detailed analysis reports of all flight
safety system subsystems necessary to
calculate the reliability and confidence
levels required by paragraph (a) of this
section.
(4) Tracking validation procedures.
An applicant must document and
submit the procedures for validating the
accuracy of any vehicle tracking data
utilized by the flight safety system to
make the decision to abort flight.
(5) Flight safety system test plans. An
applicant must submit acceptance,
qualification, and preflight test plans of
any flight safety system, subsystems,
and components. The test plans must
include test procedures and test
environments.
(6) Monitoring plan. An applicant
must submit a description of any
method used to validate the predicted
operating environments.
Other Prescribed Hazard Controls
§ 450.147
Agreements.
(a) General. An operator must
establish a written agreement with any
entity that provides a service or
property that meets a requirement in
this part, including:
(1) Launch and reentry site use
agreements. A Federal launch or reentry
site operator, a licensed launch or
reentry site operator, or any other
person that provides services or access
to or use of property required to support
the safe launch or reentry under this
part;
(2) Agreements for notices to
mariners. Unless otherwise addressed in
agreements with the site operator, for
overflight of navigable water, the U.S.
Coast Guard or other applicable
maritime authority to establish
procedures for the issuance of a Notice
to Mariners prior to a launch or reentry
and other measures necessary to protect
public health and safety;
(3) Agreements for notices to airmen.
Unless otherwise addressed in
agreements with the site operator, the
FAA Air Traffic Organization or other
PO 00000
Frm 00168
Fmt 4701
Sfmt 4700
applicable air navigation authority to
establish procedures for the issuance of
a Notice to Airmen prior to a launch or
reentry, for closing of air routes during
the respective launch and reentry
windows, and for other measures
necessary to protect public health and
safety; and
(4) Mishap response. Emergency
response providers, including local
government authorities, to satisfy the
requirements of § 450.173.
(b) Roles and responsibilities. The
agreements required in this section must
clearly delineate the roles and
responsibilities of each party to support
the safe launch or reentry under this
part.
(c) Effective date. The agreements
required in this section must be in effect
before a license can be issued, unless
otherwise agreed to by the
Administrator.
(d) Application requirements. An
applicant must—
(1) Describe each agreement in this
section; and
(2) Provide a copy of any agreement,
or portion thereof, to the FAA upon
request.
§ 450.149 Safety-critical personnel
qualifications.
(a) General. An operator must ensure
safety-critical personnel are trained,
qualified, and capable of performing
their safety-critical tasks, and that their
training is current.
(b) Application requirements. An
applicant must—
(1) Identify safety-critical tasks that
require qualified personnel;
(2) Provide internal training and
currency requirements, completion
standards, or any other means of
demonstrating compliance with the
requirements of this section; and
(3) Describe the process for tracking
training currency.
§ 450.151 Work shift and rest
requirements.
(a) General. For any launch or reentry,
an operator must document and
implement rest requirements that ensure
safety-critical personnel are physically
and mentally capable of performing all
assigned tasks.
(b) Work shifts and deviation
approval process. An operator’s rest
requirements must address the
following:
(1) Duration of each work shift and
the process for extending this shift,
including the maximum allowable
length of any extension;
(2) Number of consecutive work shift
days allowed before rest is required;
(3) Minimum rest period required—
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(i) Between each work shift, including
the period of rest required immediately
before the flight countdown work shift;
and
(ii) After the maximum number of
work shift days allowed; and
(4) Approval process for any deviation
from the rest requirements.
(c) Application requirement. An
applicant must submit rest rules that
demonstrate compliance with the
requirements of this section.
§ 450.153
Radio frequency management.
(a) General. For any radio frequency
used, an operator must—
(1) Ensure radio frequency
interference does not adversely affect
performance of any flight safety system
or safety-critical system; and
(2) Coordinate use of radio
frequencies with any site operator and
any local and Federal authorities.
(b) Application requirements. An
applicant must submit procedures or
other means to demonstrate compliance
with the radio frequency requirements
of this section.
§ 450.155
Readiness.
(a) General. An operator must
document and implement procedures to
assess readiness to proceed with the
flight of a launch or reentry vehicle.
These procedures must address, at a
minimum, the following:
(1) Readiness of vehicle and launch,
reentry, or landing site, including any
contingency abort location;
(2) Readiness of safety-critical
personnel, systems, software,
procedures, equipment, property, and
services; and
(3) Readiness to implement the
mishap plan required by § 450.173.
(b) Application requirements. An
applicant must—
(1) Demonstrate compliance with the
requirements of paragraph (a) of this
section through procedures that may
include a readiness meeting close in
time to flight; and
(2) Describe the criteria for
establishing readiness to proceed with
the flight of a launch or reentry vehicle
so that public safety is maintained.
jbell on DSKJLSW7X2PROD with RULES2
§ 450.157
Communications.
(a) An operator must implement
communication procedures during the
countdown and flight of a launch or
reentry vehicle that—
(1) Define the authority of personnel,
by individual or position title, to issue
‘‘hold/resume,’’ ‘‘go/no go,’’ and abort
commands;
(2) Assign communication networks
so that personnel identified in
paragraph (a)(1) of this section have
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
direct access to real-time, safety-critical
information required to issue ‘‘hold/
resume,’’ ‘‘go/no go,’’ and any abort
commands; and
(3) Implement a protocol for using
defined radio telephone
communications terminology.
(b) An operator must ensure the
currency of the communication
procedures, and that all personnel are
working with the approved version of
the communication procedures.
(c) An operator must record all safetycritical communications network
channels that are used for voice, video,
or data transmissions that support
safety-critical systems during each
countdown.
§ 450.159
Pre-flight procedures.
(a) An operator must implement preflight procedures that—
(1) Verify that each flight commit
criterion is satisfied before flight is
initiated; and
(2) Ensure the operator can return the
vehicle to a safe state after a countdown
abort or delay.
(b) An operator must ensure the
currency of the pre-flight procedures,
and that all personnel are working with
the approved version of the pre-flight
procedures.
§ 450.161
Control of hazard areas.
(a) General. The operator must
publicize, survey, control, or evacuate
each flight hazard area identified in
accordance with § 450.133 prior to
initiating flight of a launch vehicle or
the reentry of a reentry vehicle to the
extent necessary to ensure compliance
with § 450.101.
(b) Verification. The launch or reentry
operator must perform surveillance
sufficient to verify or update the
assumptions, input data, and results of
the flight safety analyses.
(c) Publication. An operator must
publicize warnings for each flight
hazard area, except for regions of land,
sea, or air under the control of the
vehicle operator, site operator, or other
controlling authority with which the
operator has an agreement. If the
operator relies on another entity to
publicize these warnings, it must:
(1) Determine whether the warnings
have been issued; and
(2) Notify the FAA if the warnings
have not been issued so that the FAA
can determine if the launch or reentry
can be conducted in a manner that
sufficiently protects the public. This
notification must provide sufficient
information to enable FAA to issue
warnings to U.S. aircraft.
(d) Application requirements. An
applicant must submit—
PO 00000
Frm 00169
Fmt 4701
Sfmt 4700
79733
(1) A description of how the applicant
will provide for day-of-flight
surveillance and control of flight hazard
areas, if necessary, to ensure that the
presence of any member of the public in
or near a flight hazard area is consistent
with flight commit criteria developed
for each launch or reentry as required by
§ 450.165(b);
(2) A description of how the applicant
will provide for any publication of flight
hazard areas necessary to meet the
requirements of this section; and
(3) A description of how the applicant
will establish flight commit criteria
based on the results of its toxic release
hazard analysis, toxic containment, or
toxic risk assessment for any necessary
evacuation of the public from any toxic
hazard area.
§ 450.163
Lightning hazard mitigation.
(a) Lightning hazard mitigation. An
operator must—
(1) Establish flight commit criteria
that mitigate the potential for a launch
or reentry vehicle intercepting or
initiating a direct lightning strike, or
encountering a nearby discharge, using
a means of compliance accepted by the
Administrator; or
(2) Use a vehicle designed to protect
safety-critical systems in the event of a
direct lightning strike or nearby
discharge.
(b) Application requirements. (1) An
applicant electing to comply with
paragraph (a)(1) of this section must
submit flight commit criteria that
mitigate the potential for a launch or
reentry vehicle intercepting or initiating
a direct lightning strike, or encountering
a nearby lightning discharge.
(2) An applicant electing to comply
with paragraph (a)(2) of this section
must submit documentation providing
evidence that the vehicle is designed to
protect safety-critical systems against
the effects of a direct lightning strike or
nearby discharge.
§ 450.165
Flight commit criteria.
(a) General. For each launch or
reentry, an operator must establish and
observe flight commit criteria that
identify each condition necessary prior
to flight to satisfy the requirements of
§ 450.101, and must include:
(1) Surveillance of any region of land,
sea, or air in accordance with § 450.161;
(2) Monitoring of any meteorological
condition necessary to—
(i) Be consistent with any safety
analysis required by this part; and
(ii) If necessary in accordance with
§ 450.163, mitigate the potential for a
launch or reentry vehicle intercepting a
lightning strike, or encountering a
nearby discharge;
E:\FR\FM\10DER2.SGM
10DER2
79734
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(3) Implementation of any launch or
reentry window closure in the launch or
reentry window for the purpose of
collision avoidance in accordance with
§ 450.169;
(4) Confirmation that any safetycritical system is ready for flight;
(5) Confirmation from the FAA that
the risk to critical assets satisfies the
requirements of § 450.101(a)(4) or (b)(4);
(6) For any reentry vehicle, except a
suborbital vehicle, monitoring by the
operator or an onboard system that the
status of safety-critical systems is
healthy before enabling reentry flight, to
assure the vehicle can reenter safely to
Earth; and
(7) Any other hazard controls derived
from any safety analysis required by this
part.
(b) Application requirements. An
applicant must submit a list of all flight
commit criteria.
§ 450.167
Tracking.
(a) General. During the flight of a
launch or reentry vehicle, an operator
must measure and record in real time
the position and velocity of the vehicle.
The system used to track the vehicle
must provide data to predict the
expected impact locations of all stages
and components, and to obtain vehicle
performance data for comparison with
the pre-flight performance predictions.
(b) Application requirements. An
applicant must identify and describe
each method or system used to meet the
tracking requirements of paragraph (a)
of this section.
jbell on DSKJLSW7X2PROD with RULES2
§ 450.169 Launch and reentry collision
avoidance analysis requirements.
(a) Criteria. Except as provided in
paragraph (d) of this section, for an
orbital or suborbital launch or reentry,
an operator must establish window
closures needed to ensure that the
launch or reentry vehicle, any jettisoned
components, or payloads meet the
following requirements with respect to
orbiting objects, not including any
object being launched or reentered.
(1) For inhabitable objects, one of
three criteria below must be met:
(i) The probability of collision
between the launching or reentering
objects and any inhabitable object must
not exceed 1 × 10¥6;
(ii) The launching or reentering
objects must maintain an ellipsoidal
separation distance of 200 km in-track
and 50 km cross-track and radially from
the inhabitable object; or
(iii) The launching or reentering
objects must maintain a spherical
separation distance of 200 km from the
inhabitable object.
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
(2) For objects that are neither orbital
debris nor inhabitable, one of the two
criteria below must be met:
(i) The probability of collision
between the launching or reentering
objects and any object must not exceed
1 × 10¥5; or
(ii) The launching or reentering
objects must maintain a spherical
separation distance of 25 km from the
object.
(3) For all other known orbital debris
identified by the FAA or other Federal
Government entity as large objects with
radar cross section greater than 1 m2 and
medium objects with radar cross section
0.1 m2 to 1 m2:
(i) The probability of collision
between the launching or reentering
objects and any known orbital debris
must not exceed 1 × 10¥5; or
(ii) The launching or reentering
objects must maintain a spherical
separation distance of 2.5 km.
(b) Screening time. A launch or
reentry operator must ensure the
requirements of paragraph (a) of this
section are met as follows:
(1) Through the entire segment of
flight of a suborbital launch vehicle
above 150 km;
(2) For an orbital launch, during
ascent from a minimum of 150 km to
initial orbital insertion and for a
minimum of 3 hours from liftoff;
(3) For reentry, during descent from
initial reentry burn to 150 km altitude;
and
(4) For disposal, during descent from
initial disposal burn to 150 km altitude.
(c) Rendezvous. Planned rendezvous
operations that occur within the
screening time frame are not considered
a violation of collision avoidance if the
involved operators have pre-coordinated
the rendezvous or close approach.
(d) Exception. A launch collision
avoidance analysis is not required for
any launched object if the maximum
planned altitude by that object is less
than 150 km.
(e) Analysis. Collision avoidance
analysis must be obtained for each
launch or reentry from a Federal entity
identified by the FAA, or another entity
agreed to by the Administrator.
(1) An operator must use the results
of the collision avoidance analysis to
establish flight commit criteria for
collision avoidance; and
(2) The collision avoidance analysis
must account for uncertainties
associated with launch or reentry
vehicle performance and timing, and
ensure that each window closure
incorporates all additional time periods
associated with such uncertainties.
(f) Timing and information required.
An operator must prepare a collision
PO 00000
Frm 00170
Fmt 4701
Sfmt 4700
avoidance analysis worksheet for each
launch or reentry using a standardized
format that contains the input data
required by appendix A to this part, as
follows:
(1) Except as specified in paragraphs
(f)(1)(i) and (ii) of this section, an
operator must file the input data with an
entity identified in paragraph (e) of this
section and the FAA at least 7 days
before the first attempt at the flight of a
launch vehicle or the reentry of a
reentry vehicle.
(i) Operators that have never received
a launch or reentry conjunction
assessment from the entity identified in
paragraph (e) of this section, must file
the input data at least 15 days in
advance.
(ii) The Administrator may agree to an
alternative time frame in accordance
with § 404.15;
(2) An operator must obtain a
collision avoidance analysis performed
by an entity identified in paragraph (e)
of this section, no later than 3 hours
before the beginning of a launch or
reentry window; and
(3) If an operator needs an updated
collision avoidance analysis due to a
launch or reentry delay, the operator
must file the request with the entity
identified in paragraph (e) of this
section and the FAA at least 12 hours
prior to the beginning of the new launch
or reentry window.
§ 450.171
Safety at end of launch.
(a) Orbital debris mitigation. An
operator must ensure for any proposed
launch that for all vehicle stages or
components that reach Earth orbit—
(1) There is no unplanned physical
contact between the vehicle or any of its
components and the payload after
payload separation;
(2) Debris generation does not result
from the conversion of energy sources
into energy that fragments the vehicle or
its components. Energy sources include
chemical, pressure, and kinetic energy;
and
(3) For all vehicle stages or
components that are left in orbit, stored
energy is removed by depleting residual
fuel and leaving all fuel line valves
open, venting any pressurized system,
leaving all batteries in a permanent
discharge state, and removing any
remaining source of stored energy.
(b) Application requirement. An
applicant must demonstrate compliance
with the requirements in paragraph (a)
of this section.
§ 450.173 Mishap plan—reporting,
response, and investigation requirements.
(a) General. An operator must report,
respond to, and investigate mishaps, as
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
defined in § 401.7 of this chapter, in
accordance with paragraphs (b) through
(g) of this section using a plan or other
written means.
(b) Responsibilities. An operator must
document—
(1) Responsibilities for personnel
assigned to implement the requirements
of this section;
(2) Reporting responsibilities for
personnel assigned to conduct
investigations and for anyone retained
by the operator to conduct or participate
in investigations; and
(3) Allocation of roles and
responsibilities between the launch
operator and any site operator for
reporting, responding to, and
investigating any mishap during ground
activities at the site.
(c) Mishap reporting requirements. An
operator must—
(1) Immediately notify the FAA
Washington Operations Center in case
of a mishap that involves a fatality or
serious injury (as defined in 49 CFR
830.2);
(2) Notify within 24 hours the FAA
Washington Operations Center in the
case of a mishap that does not involve
a fatality or serious injury (as defined in
49 CFR 830.2); and
(3) Submit a written preliminary
report to the FAA Office of Commercial
Space Transportation within five days
of any mishap. The preliminary report
must include the following information,
as applicable:
(i) Date and time of the mishap;
(ii) Description of the mishap and
sequence of events leading to the
mishap, to the extent known;
(iii) Intended and actual location of
the launch or reentry or other landing
on Earth;
(iv) Hazardous debris impact points,
including those outside a planned
landing site or designated hazard area;
(v) Identification of the vehicle;
(vi) Identification of any payload;
(vii) Number and general description
of any fatalities or injuries;
(viii) Description and estimated costs
of any property damage;
(ix) Identification of hazardous
materials, as defined in § 401.7 of this
chapter, involved in the event, whether
on the vehicle, any payload, or on the
ground;
(x) Action taken by any person to
contain the consequences of the event;
(xi) Weather conditions at the time of
the event; and
(xii) Potential consequences for other
similar vehicles, systems, or operations.
(d) Emergency response requirements.
An operator must—
(1) Activate emergency response
services to protect the public and
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
property following a mishap as
necessary including, but not limited to:
(i) Evacuating and rescuing members
of the public, taking into account debris
dispersion and toxic plumes; and
(ii) Extinguishing fires;
(2) Maintain existing hazard area
surveillance and clearance as necessary
to protect public safety;
(3) Contain and minimize the
consequences of a mishap, including:
(i) Securing impact areas to ensure
that no members of the public enter;
(ii) Safely disposing of hazardous
materials; and
(iii) Controlling hazards at the site or
impact areas.
(4) Preserve data and physical
evidence; and
(5) Implement agreements with
government authorities and emergency
response services, as necessary, to
satisfy the requirements of this section.
(e) Mishap investigation requirements.
In the event of a mishap, an operator
must—
(1) Investigate the root causes of the
mishap; and
(2) Report investigation results to the
FAA.
(f) Preventative measures. An operator
must identify and implement preventive
measures for avoiding recurrence of the
mishap prior to the next flight, unless
otherwise approved by the
Administrator.
(g) Mishap records. An operator must
maintain records associated with the
mishap in accordance with § 450.219(b).
(h) Application requirements. An
applicant must submit the plan or other
written means required by this section.
§ 450.175
Test-induced damage.
(a) Applicability. This section applies
to license applicants or operators
seeking an optional test-induced
damage exception.
(b) Coordination of potential testinduced damage. Test-induced damage
is not a mishap if all of the following are
true:
(1) A license applicant or operator
coordinates potential test-induced
damage with the FAA before the
planned activity, and with sufficient
time for the FAA to evaluate the
operator’s proposal during the
application process or as a license
modification;
(2) The test-induced damage did not
result in any of the following:
(i) Serious injury or fatality (as
defined in 49 CFR 830.2);
(ii) Damage to property not associated
with the licensed activity; or
(iii) Hazardous debris leaving the predefined hazard area; and
(3) The test-induced damage falls
within the scope of activities
PO 00000
Frm 00171
Fmt 4701
Sfmt 4700
79735
coordinated with the FAA in paragraph
(b)(1) of this section.
(c) Application requirements. An
applicant must submit the following
information—
(1) Test objectives;
(2) Test limits;
(3) Expected outcomes;
(4) Potential risks, including the
applicant’s best understanding of the
uncertainties in environments, test
limits, or system performance;
(5) Applicable procedures;
(6) Expected time and duration of the
test; and
(7) Additional information as required
by the FAA to ensure protection of
public health and safety, safety of
property, and the national security and
foreign policy interests of the United
States.
§ 450.177 Unique safety policies,
requirements, and practices.
(a) Unique hazards. An operator must
review operations, system designs,
analysis, and testing, and identify any
unique hazards not otherwise addressed
by this part. An operator must
implement any unique safety policy,
requirement, or practice needed to
protect the public from the unique
hazard.
(b) Unique requirements. The FAA
may identify and impose a unique
policy, requirement, or practice as
needed to protect the public health and
safety.
(c) Application requirements. An
applicant must—
(1) Identify any unique safety policy,
requirement, or practice necessary in
accordance with paragraph (a) of this
section, and demonstrate that each
unique safety policy, requirement, or
practice protects public health and
safety.
(2) Demonstrate compliance with each
unique safety policy, requirement, or
practice imposed by the FAA in
accordance with paragraph (b) of this
section.
Ground Safety
§ 450.179
Ground safety—general.
(a) At a U.S. launch or reentry site, an
operator must protect the public and
property from adverse effects of
hazardous operations and systems
associated with—
(1) Preparing a launch vehicle for
flight;
(2) Returning a launch or reentry
vehicle to a safe condition after landing,
or after an aborted launch attempt; and
(3) Returning a site to a safe
condition.
(b) An operator is not required to
comply with §§ 450.181 through
450.189 of this part if:
E:\FR\FM\10DER2.SGM
10DER2
79736
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(1) The launch or reentry is being
conducted from a Federal launch or
reentry site;
(2) The operator has a written
agreement with the Federal launch or
reentry site for the provision of ground
safety services and oversight; and
(3) The Administrator has determined
that the Federal launch or reentry site’s
ground safety processes, requirements,
and oversight are not inconsistent with
the Secretary’s statutory authority over
commercial space activities.
(c) In making the determination
required by paragraph (b)(3) of this
section, the Administrator will consider
the nature and frequency of launch and
reentry activities conducted from the
Federal launch or reentry site,
coordination between the FAA and the
Federal launch or reentry site safety
personnel, and the Administrator’s
knowledge of the Federal launch or
reentry site’s requirements.
§ 450.181
operator.
Coordination with a site
jbell on DSKJLSW7X2PROD with RULES2
(a) General. For a launch or reentry
conducted from or to a Federal launch
or reentry site or a site licensed under
part 420 or 433 of this chapter, an
operator must coordinate with the site
operator to—
(1) Ensure public access is controlled
where and when necessary to protect
public safety;
(2) Ensure launch or reentry
operations are coordinated with other
launch and reentry operators and other
affected parties to prevent unsafe
interference;
(3) Designate any ground hazard area
that affects the operations of a launch or
reentry site; and
(4) Ensure a prompt and effective
response is undertaken in the event of
a mishap that could impact the safety of
the public and property.
(b) Licensed site operator. For a
launch or reentry conducted from or to
a site licensed under part 420 or 433 of
this chapter, an operator must also
coordinate with the site operator to
establish roles and responsibilities for
reporting, responding to, and
investigating any mishap during ground
activities at the site.
(c) Application requirement. An
applicant must describe how it is
coordinating with a Federal or licensed
launch or reentry site operator in
compliance with this section.
§ 450.183
Explosive site plan.
(a) Explosive siting requirements. For
a launch or reentry conducted from or
to a site exclusive to its own use, an
operator must comply with the
explosive siting requirements of
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
§§ 420.63, 420.65, 420.66, 420.67,
420.69, and 420.70 of this chapter.
(b) Application requirement. An
applicant must submit an explosive site
plan in accordance with paragraph (a) of
this section.
§ 450.185
Ground hazard analysis.
An operator must perform and
document a ground hazard analysis, and
continue to maintain it throughout the
lifecycle of the launch or reentry
system. The analysis must—
(a) Hazard identification. Identify
system and operation hazards posed by
the vehicle and ground hardware,
including site and ground support
equipment. Hazards identified must
include the following:
(1) System hazards, including:
(i) Vehicle over-pressurization;
(ii) Sudden energy release, including
ordnance actuation;
(iii) Ionizing and non-ionizing
radiation;
(iv) Fire or deflagration;
(v) Radioactive materials;
(vi) Toxic release;
(vii) Cryogens;
(viii) Electrical discharge; and
(ix) Structural failure.
(2) Operation hazards, including:
(i) Propellant handling and loading;
(ii) Transporting of vehicle or vehicle
components;
(iii) Vehicle testing; and
(iv) Vehicle or system activation.
(b) Hazard assessment. Assess each
hazard’s likelihood and severity.
(c) Risk acceptability criteria. Ensure
that the risk associated with each hazard
meets the following criteria:
(1) The likelihood of any hazardous
condition that may cause death or
serious injury to the public must be
extremely remote; and
(2) The likelihood of any hazardous
condition that may cause major damage
to property not associated with the
launch or reentry must be remote.
(d) Risk mitigation. Identify and
describe the risk elimination and
mitigation measures required to satisfy
paragraph (c) of this section.
(e) Validation and verification.
Document that the risk elimination and
mitigation measures achieve the risk
levels of paragraph (c) of this section
through validation and verification.
Verification includes:
(1) Analysis;
(2) Test;
(3) Demonstration; or
(4) Inspection.
(f) Application requirements. An
applicant must submit—
(1) A description of the methodology
used to perform the ground hazard
analysis;
PO 00000
Frm 00172
Fmt 4701
Sfmt 4700
(2) A list of all systems and operations
that may cause a hazard involving the
vehicle or any payload; and
(3) The ground hazard analysis
products of paragraphs (a) through (e) of
this section, including data that verifies
the risk elimination and mitigation
measures.
§ 450.187 Toxic hazards mitigation for
ground operations.
(a) Applicability. (1) Except as
specified in paragraph (a)(2), this
section applies to any launch or reentry
vehicle, including all vehicle
components and payloads, that use
toxic propellants or other toxic
chemicals.
(2) No toxic release hazard analysis is
required for kerosene-based fuels,
unless the Administrator determines
that an analysis is required to protect
public safety.
(b) General. An operator must—
(1) Conduct a toxic release hazard
analysis in accordance with paragraph
(c) of this section;
(2) Manage the risk of casualties that
could arise from the exposure to toxic
release through one of the following
means:
(i) Contain hazards caused by toxic
release in accordance with paragraph (d)
of this section; or
(ii) Perform a toxic risk assessment, in
accordance with paragraph (e) of this
section, that demonstrates compliance
with the risk criteria of § 450.185(c).
(3) Establish ground hazard controls
based on the results of its toxic release
hazard analysis and toxic containment
or toxic risk assessment for any
necessary evacuation of the public from
any toxic hazard area.
(c) Toxic release hazard analysis. A
toxic release hazard analysis must—
(1) Account for any toxic release that
could occur during nominal or nonnominal launch or reentry ground
operations;
(2) Include a worst-case release
scenario analysis or a maximumcredible release scenario analysis for
each process that involves a toxic
propellant or other chemical;
(3) Determine if toxic release can
occur based on an evaluation of the
chemical compositions and quantities of
propellants, other chemicals, vehicle
materials, and projected combustion
products, and the possible toxic release
scenarios;
(4) Account for both normal
combustion products and any unreacted
propellants and phase change or
chemical derivatives of released
substances; and
(5) Account for any operational
constraints and emergency procedures
E:\FR\FM\10DER2.SGM
10DER2
jbell on DSKJLSW7X2PROD with RULES2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
that provide protection from toxic
release.
(d) Toxic containment. An operator
using toxic containment must manage
the risk of casualty from the exposure to
toxic release either by—
(1) Evacuating, or being prepared to
evacuate, the public from any toxic
hazard area in the event of a worst-case
release or maximum credible release
scenario; or
(2) Employing meteorological
constraints to limit a ground operation
to times during which prevailing winds
and other conditions ensure that the
public would not be exposed to toxic
concentrations and durations greater
than accepted toxic thresholds for acute
casualty in the event of a worst-case
release or maximum credible release
scenario.
(e) Toxic risk assessment. An operator
using toxic risk assessment must
manage the risk from any toxic release
hazard and demonstrate compliance
with the criteria in § 450.185(c). A toxic
risk assessment must—
(1) Account for airborne concentration
and duration thresholds of toxic
propellants or other chemicals. For any
toxic propellant, other chemicals, or
combustion product, an operator must
use airborne toxic concentration and
duration thresholds identified in a
means of compliance accepted by the
Administrator;
(2) Account for physical phenomena
expected to influence any toxic
concentration and duration in the area
surrounding the potential release site;
(3) Determine a toxic hazard area for
each process surrounding the potential
release site for each toxic propellant or
other chemical based on the amount and
toxicity of the propellant or other
chemical, the exposure duration, and
the meteorological conditions involved;
(4) Account for all members of the
public that may be exposed to the toxic
release; and
(5) Account for any risk mitigation
measures applied in the risk assessment.
(f) Application requirements. An
applicant must submit:
(1) The identity of the toxic
propellant, chemical, or combustion
products or derivatives in the possible
toxic release;
(2) The applicant’s selected airborne
toxic concentration and duration
thresholds;
(3) The meteorological conditions for
the atmospheric transport and buoyant
cloud rise of any toxic release from its
source to downwind receptor locations;
(4) Characterization of the terrain, as
input for modeling the atmospheric
transport of a toxic release from its
source to downwind receptor locations;
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
(5) The identity of the toxic
dispersion model used, and any other
input data;
(6) Representative results of an
applicant’s toxic dispersion modeling to
predict concentrations and durations at
selected downwind receptor locations,
to determine the toxic hazard area for a
released quantity of the toxic substance;
(7) For toxic release hazard analysis in
accordance with paragraph (c) of this
section:
(i) A description of the failure modes
and associated relative probabilities for
potential toxic release scenarios used in
the risk evaluation; and
(ii) The methodology and
representative results of an applicant’s
determination of the worst-case or
maximum-credible quantity of any toxic
release that might occur during ground
operations;
(8) For toxic containment in
accordance with paragraph (d) of this
section, identify the evacuation plans or
meteorological constraints and
associated ground hazard controls
needed to ensure that the public will
not be within any toxic hazard area in
the event of a worst-case release or
maximum credible release scenario.
(9) For toxic risk assessment in
accordance with paragraph (e) of this
section:
(i) A demonstration that the risk
criteria in § 450.185(c) will be met;
(ii) The population characteristics in
receptor locations that are identified by
toxic dispersion modeling as toxic
hazard areas;
(iii) A description of any risk
mitigation measures applied in the toxic
risk assessment; and
(iv) A description of the population
exposure input data used in accordance
with § 450.123.
§ 450.189
controls.
Ground safety prescribed hazard
(a) General. In addition to the hazard
controls derived from an operator’s
ground hazard analysis and toxic hazard
analysis, an operator must comply with
paragraphs (b) through (e) of this
section.
(b) Protection of public on the site. An
operator must document a process for
protecting members of the public who
enter any area under the control of a
launch or reentry operator, including:
(1) Procedures for identifying and
tracking the public while on the site;
and
(2) Methods the operator uses to
protect the public from hazards in
accordance with the ground hazard
analysis and toxic hazard analysis.
(c) Countdown abort. Following a
countdown abort or recycle operation,
PO 00000
Frm 00173
Fmt 4701
Sfmt 4700
79737
an operator must establish, maintain,
and perform procedures for controlling
hazards related to the vehicle and
returning the vehicle, stages, or other
flight hardware and site facilities to a
safe condition. When a launch vehicle
does not liftoff after a command to
initiate flight was sent, an operator
must—
(1) Ensure that the vehicle and any
payload are in a safe configuration;
(2) Prohibit entry of the public into
any identified hazard areas until the site
is returned to a safe condition; and
(3) Maintain and verify that any flight
safety system remains operational until
verification that the launch vehicle does
not represent a risk of inadvertent flight.
(d) Fire suppression. An operator
must have reasonable precautions in
place to report and control any fire
caused by licensed activities.
(e) Emergency procedures. An
operator must have general emergency
procedures that apply to any
emergencies not covered by the mishap
plan of § 450.173 that may create a
hazard to the public.
(f) Application requirement. An
applicant must submit the process for
protecting members of the public who
enter any area under the control of a
launch or reentry operator in
accordance with paragraph (b) of this
section.
Subpart D—Terms and Conditions of a
Vehicle Operator License
§ 450.201 Responsibility for public safety
and safety of property.
A licensee is responsible for ensuring
public safety and safety of property
during the conduct of a licensed launch
or reentry.
§ 450.203
Compliance.
A licensee must conduct a licensed
launch or reentry in accordance with
representations made in its license
application, the requirements of
subparts C and D of this part, and the
terms and conditions contained in the
license. A licensee’s failure to act in
accordance with the representations
made in the license application, the
requirements of subparts C and D of this
part, and the terms and conditions
contained in the license, is sufficient
basis for the revocation of a license or
other appropriate enforcement action.
§ 450.205 Financial responsibility
requirements.
A licensee must comply with
financial responsibility requirements of
part 440 of this chapter and as specified
in a license or license order.
E:\FR\FM\10DER2.SGM
10DER2
79738
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
§ 450.207 Human spaceflight
requirements.
A licensee conducting a launch or
reentry with a human being on board
the vehicle must comply with human
spaceflight requirements of part 460 of
this chapter as specified in a license or
license order.
§ 450.209
Compliance monitoring.
(a) A licensee must allow access by,
and cooperate with, Federal officers or
employees or other individuals
authorized by the FAA to observe any
of its activities, or any of its contractors’
or subcontractors’ activities, associated
with the conduct of a licensed launch or
reentry.
(b) For each licensed launch or
reentry, a licensee must provide the
FAA with a console for monitoring the
progress of the countdown and
communication on all channels of the
countdown communications network,
unless the licensee has another
acceptable means. A licensee must also
provide the FAA with the capability to
communicate with the mission director
designated by § 450.103(a)(1).
jbell on DSKJLSW7X2PROD with RULES2
§ 450.211 Continuing accuracy of license
application; application for modification of
license.
(a) A licensee is responsible for the
continuing accuracy of representations
contained in its application for the
entire term of the license.
(b) After a license has been issued, a
licensee must apply to the FAA for
modification of the license if—
(1) The licensee proposes to conduct
a launch or reentry in a manner not
authorized by the license; or
(2) Any representation contained in
the license application that is material
to public health and safety or the safety
of property is no longer accurate and
complete or does not reflect the
licensee’s procedures governing the
actual conduct of a launch or reentry. A
change is material to public health and
safety or the safety of property if it alters
or affects—
(i) The class of payload;
(ii) The type of launch or reentry
vehicle;
(iii) The type or quantity of hazardous
material;
(iv) The flight trajectory;
(v) The launch site or reentry site or
other landing site; or
(vi) Any system, policy, procedure,
requirement, criteria, or standard that is
safety critical.
(c) An application to modify a license
must be prepared and submitted in
accordance with part 413 of this
chapter. If requested during the
application process, the FAA may
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
approve an alternate method for
requesting license modifications. The
licensee must indicate any part of its
license or license application that
would be changed or affected by a
proposed modification.
(d) Upon approval of a modification,
the FAA issues either a written approval
to the licensee or a license order
amending the license if a stated term or
condition of the license is changed,
added, or deleted. An approval has the
full force and effect of a license order
and is part of the licensing record.
§ 450.213
Pre-flight reporting.
(a) Reporting method. A licensee must
send the information in this section as
an email attachment to ASTOperations@
faa.gov, or other method as agreed to by
the Administrator in the license.
(b) Mission information. A licensee
must submit to the FAA the following
mission-specific information no less
than 60 days before each mission
conducted under the license, unless the
Administrator agrees to a different time
frame in accordance with § 404.15 in the
license, except when the information
was provided in the license application:
(1) Payload information in accordance
with § 450.43(i); and
(2) Planned mission information,
including the vehicle, launch site,
planned flight path, staging and impact
locations, each payload delivery point,
intended reentry or landing sites
including any contingency abort
location, and the location of any
disposed launch or reentry vehicle stage
or component that is deorbited.
(c) Flight abort and flight safety
analysis products. A licensee must
submit to the FAA updated flight abort
and flight safety analysis products,
using methodologies previously
approved by the FAA, for each mission
no less than 30 days before flight, unless
the Administrator agrees to a different
time frame in accordance with § 404.15
in the license.
(1) A licensee is not required to
submit the flight abort and flight safety
analysis products if—
(i) The analysis submitted in the
license application satisfies all the
requirements of this section; or
(ii) The licensee demonstrated during
the application process that the analysis
does not need to be updated to account
for mission-specific factors.
(2) If a licensee is required to submit
the flight abort and flight safety analysis
products, the licensee—
(i) Must account for vehicle- and
mission-specific input data;
(ii) Must account for potential
variations in input data that may affect
PO 00000
Frm 00174
Fmt 4701
Sfmt 4700
any analysis product within the final 30
days before flight;
(iii) Must submit the analysis
products using the same format and
organization used in its license
application; and
(iv) May not change an analysis
product within the final 30 days before
flight unless the licensee has a process,
approved in the license, for making a
change in that period as part of the
licensee’s flight safety analysis process.
(d) Flight safety system test data. Any
licensee that is required by § 450.101(c)
to use a flight safety system to protect
public safety must submit to the FAA,
or provide the FAA access to, any test
reports, in accordance with approved
flight safety system test plans, no less
than 30 days before flight, unless the
Administrator agrees to a different time
frame in accordance with § 404.15 in the
license. These reports must include:
(1) A summary of the system,
subsystem, and component-level test
results, including all test failures and
corrective actions implemented;
(2) A summary of test results
demonstrating sufficient margin to
predicted operating environments;
(3) A comparison matrix of the actual
qualification and acceptance test levels
used for each component in each test
compared against the predicted flight
levels for each environment, including
any test tolerances allowed for each test;
and
(4) A clear identification of any
components qualified by similarity
analysis or a combination of analysis
and test.
(e) Collision avoidance analysis. A
licensee must submit to a Federal entity
identified by the FAA and to the FAA
the collision avoidance information in
appendix A to part 450 in accordance
with § 450.169(f).
(f) Launch or reentry schedule. A
licensee must file a launch or reentry
schedule that identifies each review,
rehearsal, and safety-critical operation.
The schedule must be filed and updated
in time to allow FAA personnel to
participate in the reviews, rehearsals,
and safety-critical operations.
§ 450.215
Post-flight reporting.
(a) A licensee must submit to the FAA
the information in paragraph (b) of this
section no later than 90 days after a
launch or reentry, unless the
Administrator agrees to a different time
frame in accordance with § 404.15 of
this chapter.
(b) A licensee must send the following
information as an email attachment to
ASTOperations@faa.gov, or other
method as agreed to by the
Administrator in the license:
E:\FR\FM\10DER2.SGM
10DER2
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(1) Any anomaly that occurred during
countdown or flight that is material to
public health and safety and the safety
of property;
(2) Any corrective action
implemented or to be implemented after
the flight due to an anomaly or mishap;
(3) The number of humans on board
the vehicle;
(4) The actual trajectory flown by the
vehicle, if requested by the FAA; and
(5) For an unguided suborbital launch
vehicle, the actual impact location of all
impacting stages and impacting
components, if requested by the FAA.
§ 450.217
Registration of space objects.
(a) To assist the U.S. Government in
implementing Article IV of the 1975
Convention on Registration of Objects
Launched into Outer Space, each
licensee must submit to the FAA the
information required by paragraph (b) of
this section for all objects placed in
space by a licensed launch, including a
launch vehicle and any components,
except any object owned and registered
by the U.S. Government.
(b) For each object that must be
registered in accordance with this
section, no later than 30 days following
the conduct of a licensed launch, a
licensee must file the following
information:
(1) The international designator of the
space object;
(2) Date and location of launch;
(3) General function of the space
object;
(4) Final orbital parameters,
including:
(i) Nodal period;
(ii) Inclination;
(iii) Apogee;
(iv) Perigee; and
(5) Ownership, and country of
ownership, of the space object.
(c) A licensee must notify the FAA
when it removes an object that it has
previously placed in space.
jbell on DSKJLSW7X2PROD with RULES2
§ 450.219
Records.
(a) Except as specified in paragraph
(b) of this section, a licensee must
maintain for 3 years all records, data,
and other material necessary to verify
that a launch or reentry is conducted in
accordance with representations
contained in the licensee’s application,
the requirements of subparts C and D of
this part, and the terms and conditions
contained in the license.
(b) For an event that meets any of
paragraph (1) through (5) or paragraph
(8) of the definition of ‘‘mishap’’ in
§ 401.7 of this chapter, a licensee must
preserve all records related to the event.
Records must be retained until
completion of any Federal investigation
VerDate Sep<11>2014
18:40 Dec 09, 2020
Jkt 253001
and the FAA advises the licensee that
the records need not be retained. The
licensee must make all records required
to be maintained under the regulations
available to Federal officials for
inspection and copying.
Appendix A to Part 450—Collision
Analysis Worksheet
(a) Launch or reentry information. An
operator must file the following information:
(1) Mission name. A mnemonic given to
the launch vehicle/payload combination
identifying the launch mission distinctly
from all others;
(2) Launch location. Launch site location
in latitude and longitude;
(3) Launch or reentry window. The launch
or reentry window opening and closing times
in Greenwich Mean Time (referred to as
ZULU time) and the Julian dates for each
scheduled launch or reentry attempts
including primary and secondary launch or
reentry dates;
(4) Epoch. The epoch time, in Greenwich
Mean Time (GMT), of the expected launch
vehicle liftoff time;
(5) Segment number. A segment is defined
as a launch vehicle stage or payload after the
thrusting portion of its flight has ended. This
includes the jettison or deployment of any
stage or payload. For each segment, an
operator must determine the orbital
parameters;
(6) Orbital parameters. An operator must
identify the orbital parameters for all objects
achieving orbit including the parameters for
each segment after thrust ends;
(7) Orbiting objects to evaluate. An
operator must identify all orbiting object
descriptions including object name, length,
width, depth, diameter, and mass;
(8) Time of powered flight and sequence of
events. The elapsed time in hours, minutes,
and seconds, from liftoff to passivation or
disposal. The input data must include the
time of powered flight for each stage or
jettisoned component measured from liftoff;
and
(9) Point of contact. The person or office
within an operator’s organization that
collects, analyzes, and distributes collision
avoidance analysis results.
(b) Collision avoidance analysis results
transmission medium. An operator must
identify the transmission medium, such as
voice or email, for receiving results.
(c) Deliverable schedule/need dates. An
operator must identify the times before flight,
referred to as ‘‘L-times,’’ for which the
operator requests a collision avoidance
analysis. The final collision avoidance
analysis must be used to establish flight
commit criteria for a launch.
(d) Trajectory files. Individual position and
velocity trajectory files, including:
(1) The position coordinates in the EarthFixed Greenwich (EFG) coordinates system
measured in kilometers and the EFG velocity
components measured in kilometers per
second, of each launch vehicle stage or
payload starting below 150 km through
screening time frame;
(2) Radar cross section values for each
individual file;
PO 00000
Frm 00175
Fmt 4701
Sfmt 4700
79739
(3) Position Covariance, if probability of
impact analysis option is desired; and
(4) Separate trajectory files identified by
valid window time frames, if launch or
reentry trajectory changes during launch or
reentry window.
(e) Screening. An operator must select
spherical, ellipsoidal, or collision probability
screening as defined in this paragraph for
determining any conjunction:
(1) Spherical screening. Spherical
screening centers a sphere on each orbiting
object’s center-of-mass to determine any
conjunction;
(2) Ellipsoidal screening. Ellipsoidal
screening utilizes an impact exclusion
ellipsoid of revolution centered on the
orbiting object’s center-of-mass to determine
any conjunction. An operator must provide
input in the UVW coordinate system in
kilometers. The operator must provide deltaU measured in the radial-track direction,
delta-V measured in the in-track direction,
and delta-W measured in the cross-track
direction; or
(3) Probability of Collision. Collision
probability is calculated using position and
velocity information with covariance in
position.
PART 460—HUMAN SPACE FLIGHT
REQUIREMENTS
71. The authority citation for part 460
continues to read as follows:
■
Authority: 51 U.S.C. 50901–50923.
72. Amend § 460.45 by revising
paragraph (d) to read as follows:
■
§ 460.45 Operator informing space flight
participant of risk.
*
*
*
*
*
(d) An operator must describe the
safety record of its vehicle to each space
flight participant as follows:
(1) For licenses issued under part 450
of this chapter, the operator’s safety
record must cover any event that meets
any of paragraph (1), (4), (5), or (8) of the
definition of ‘‘mishap’’ in § 401.7 that
occurred during and after vehicle
verification performed in accordance
with § 460.17, and include:
(i) The number of vehicle flights;
(ii) The number of events that meet
any of paragraph (1), (4), (5), or (8) of the
definition of ‘‘mishap’’ in § 401.7 of this
chapter; and
(iii) Whether any corrective actions
were taken to resolve these mishaps.
(2) For licenses issued under part 415,
431, or 435 of this chapter, the
operator’s safety record must cover
launch and reentry accidents and
human space flight incidents as defined
by § 401.5, that occurred during and
after vehicle verification performed in
accordance with § 460.17, and include:
(i) The number of vehicle flights;
(ii) The number of accidents and
human space flight incidents as defined
by § 401.5; and
E:\FR\FM\10DER2.SGM
10DER2
79740
Federal Register / Vol. 85, No. 238 / Thursday, December 10, 2020 / Rules and Regulations
(iii) Whether any corrective actions
were taken to resolve these accidents
and human spaceflight incidents.
*
*
*
*
*
73. Effective March 10, 2026, further
amend § 460.45 by revising paragraph
(d) to read as follows:
■
§ 460.45 Operator informing space flight
participant of risk.
jbell on DSKJLSW7X2PROD with RULES2
*
*
*
VerDate Sep<11>2014
*
*
18:40 Dec 09, 2020
Jkt 253001
(d) An operator must describe the
safety record of its vehicle to each space
flight participant. The operator’s safety
record must cover any event that meets
any of paragraph (1), (4), (5), or (8) of the
definition of ‘‘mishap’’ in § 401.7 that
occurred during and after vehicle
verification performed in accordance
with § 460.17, and include:
(1) The number of vehicle flights;
(2) The number of events that meet
any of paragraph (1), (4), (5), or (8) of the
PO 00000
Frm 00176
Fmt 4701
Sfmt 9990
definition of ‘‘mishap’’ in section
§ 401.7; and
(3) Whether any corrective actions
were taken to resolve these mishaps.
*
*
*
*
*
Issued under authority provided by 49
U.S.C. 106(f) and 51 U.S.C. Chapter 509 in
Washington, DC, on September 30, 2020.
Steve Dickson,
Administrator.
[FR Doc. 2020–22042 Filed 12–2–20; 4:15 pm]
BILLING CODE 4910–13–P
E:\FR\FM\10DER2.SGM
10DER2
]]>Agencies
[Federal Register Volume 85, Number 238 (Thursday, December 10, 2020)]
[Rules and Regulations]
[Pages 79566-79740]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-22042]
[[Page 79565]]
Vol. 85
Thursday,
No. 238
December 10, 2020
Part II
Department of Transportation
-----------------------------------------------------------------------
Federal Aviation Administration
-----------------------------------------------------------------------
14 CFR Parts 401, 404, 413, et al.
Streamlined Launch and Reentry License Requirements; Final Rule
Federal Register / Vol. 85 , No. 238 / Thursday, December 10, 2020 /
Rules and Regulations
[[Page 79566]]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Parts 401, 404, 413, 414, 415, 417, 420, 431, 433, 435, 437,
440, 450, and 460
[Docket No.: FAA-2019-0229; Amdt. No(s). 401-9; 404-7, 413-12, 414-4,
415-7, 417-6, 420-9, 431-7, 433-3, 435-5, 437-3, 440-5, 450-2, and 460-
3]
RIN 2120-AL17
Streamlined Launch and Reentry License Requirements
AGENCY: FAA Aviation Administration (FAA), Department of Transportation
(DOT).
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: This rule streamlines and increases flexibility in the FAA's
commercial space launch and reentry regulations, and removes obsolete
requirements. It consolidates and revises multiple regulatory parts and
applies a single set of licensing and safety regulations across several
types of operations and vehicles. The rule describes the requirements
to obtain a vehicle operator license, the safety requirements, and the
terms and conditions of a vehicle operator license.
DATES:
Effective date: This rule is effective March 10, 2021, except for
amendatory instructions 3, 11, 17, 20, 27, 44 and 54, concerning
Sec. Sec. 401.5, 413.1, and 413.23, the removal of parts 415, 417,
431, and 435, and instructions 68 and 73 amending Sec. Sec. 440.3 and
460.45, respectively, which are effective March 10, 2026.
Compliance: Affected parties, however, are not required to comply
with the information collection requirements in part 450 until the
Office of Management and Budget (OMB) approves the collection and
assigns a control number under the Paperwork Reduction Act of 1995. The
FAA will publish in the Federal Register a notice of the control number
assigned by the Office of Management and Budget (OMB) for these
information collection requirements.
ADDRESSES: For information on where to obtain copies of rulemaking
documents and other information related to this final rule, see ``How
To Obtain Additional Information'' in the SUPPLEMENTARY INFORMATION
section of this document.
FOR FURTHER INFORMATION CONTACT: For technical questions concerning
this action, contact Randy Repcheck, Office of Commercial Space
Transportation, Federal Aviation Administration, 800 Independence
Avenue SW, Washington, DC 20591; telephone (202) 267-8760; email
[email protected].
SUPPLEMENTARY INFORMATION:
Authority for This Rulemaking
The Commercial Space Launch Act of 1984, as amended and codified at
51 U.S.C. 50901-50923 (the Act), authorizes the Secretary of
Transportation to oversee, license, and regulate commercial launch and
reentry activities, and the operation of launch and reentry sites
within the United States or as carried out by U.S. citizens. Section
50905 directs the Secretary to exercise this responsibility consistent
with public health and safety, safety of property, and the national
security and foreign policy interests of the United States. In
addition, Sec. 50903 requires the Secretary to encourage, facilitate,
and promote commercial space launches and reentries by the private
sector. As codified at 49 CFR 1.83(b), the Secretary has delegated
authority to carry out these functions to the FAA Administrator.
This rulemaking amends the FAA's launch and reentry requirements,
consolidating and revising multiple regulatory parts to set forth a
single set of licensing and safety regulations across several types of
operations and vehicles. It also streamlines the commercial space
regulations by, among other things, replacing many prescriptive
regulations with performance-based rules, and giving industry greater
flexibility to develop means of compliance that maximize their
objectives while maintaining public safety.
List of Abbreviations and Acronyms Frequently Used in This Document
AC--Advisory Circular
CEC--Conditional expected casualty
EC--Expected casualty
ELOS determination--Equivalent-level-of-safety determination
ELV--Expendable launch vehicle
FSA--Flight safety analysis
FSS--Flight safety system
RLV--Reusable launch vehicle
Table of Contents
I. Overview
II. Background
III. Discussion of the Rule
A. Safety Framework
B. Detailed Discussion of the Final Rule
1. Prescriptive vs Performance-Based Regulations, ELOS, Safety
Case
2. Part 450 Subpart A--General Discussion
a. Pre-Application Consultation
b. Application Process
c. Compliance Period for Legacy Licenses (Sec. 450.1(b))
d. Definition and Scope of Launch (Sec. 450.3)
e. Safety Element Approval (Part 414)
f. Vehicle Operator License--Issuance, Duration, Additional
License Terms and Conditions, Transfer, and Rights Not Conferred
(Sec. Sec. 450.5 Through 450.13)
3. Part 450 Subpart B--Requirements To Obtain a Vehicle Operator
License
a. Incremental Review and Determinations (Sec. 450.33)
b. Means of Compliance (Sec. 450.35)
c. Use of Safety Element Approval (Sec. 450.39)
d. Policy Review (Sec. 450.41)
e. Payload Reviews (Sec. 450.43)
f. Safety Review and Approval (Sec. 450.45)
g. Environmental Review (Sec. 450.47)
4. Part 450 Subpart C--Safety Requirements
a. Neighboring Operations Personnel (Sec. 450.101(a) and (b))
b. High Consequence Event Protection (Sec. 450.101(c))
c. Critical Asset and Critical Payload Protection
d. Other Safety Criteria (Sec. 450.101(d), (e), (f), and (g))
e. System Safety Program (Sec. 450.103)
f. Hazard Control Strategies (Sec. 450.107)
g. Hazard Control Strategy Determination (Sec. 450.107(b))
h. Flight Abort (Sec. 450.108)
i. Flight Hazard Analysis (Sec. 450.109)
j. Physical Containment (Sec. 450.110)
k. Wind Weighting (Sec. 450.111)
l. Flight Safety Analysis (Sec. Sec. 450.113 to 450.139)
m. Flight Safety Analysis Requirements--Scope (Sec. 450.113)
n. Flight Safety Analysis Methods (Sec. 450.115)
o. Trajectory Analysis for Normal Flight (Sec. 450.117)
p. Trajectory Analysis for Malfunction Flight (Sec. 450.119)
q. Debris Analysis (Sec. 450.121)
r. Population Exposure Analysis (Sec. 450.123)
s. Probability of Failure Analysis (Sec. 450.131)
t. Flight Hazard Area Analysis (Sec. 450.133)
u. Debris Risk Analysis (Sec. 450.135)
v. Far-Field Overpressure Blast Effect Analysis, or Distant
Focus Overpressure (DFO) (Sec. 450.137)
w. Toxic Hazards (Sec. Sec. 450.139 and 450.187)
x. Computing Systems (Sec. 450.141)
y. Safety-Critical Systems Design, Test, and Documentation
(Sec. 450.143)
z. Flight Safety Systems (Sec. Sec. 450.143 and 450.145)
aa. Hybrid Vehicles
bb. Agreements and Airspace (Sec. 450.147)
cc. Safety-Critical Personnel Qualifications (Sec. 450.149)
dd. Work Shift and Rest Requirements (Sec. 450.151)
ee. Radio Frequency (Sec. 450.153)
ff. Readiness and Rehearsals (Sec. 450.155)
gg. Communications (Sec. 450.157)
hh. Pre-Flight Procedures (Sec. 450.159)
ii. Control of Hazard Areas (Sec. 450.161)
jj. Lightning Hazard Mitigation (Sec. 450.163)
kk. Flight Commit Criteria (Sec. 450.165)
ll. Tracking (Sec. 450.167)
mm. Launch and Reentry Collision Avoidance Analysis Requirements
(Sec. 450.169)
[[Page 79567]]
nn. Safety at End of Launch (Sec. 450.171)
oo. Mishap (Definition, Sec. Sec. 450.173 and 450.175)
pp. Unique Safety Policies, Requirements and Practices (Sec.
450.177)
qq. Ground Safety (Sec. 450.179 to Sec. 450.189)
5. Part 450 Subpart D--Terms and Conditions of a Vehicle
Operator License
a. Public Safety Responsibility, Compliance With License,
Financial Responsibility, Human Spaceflight Requirements (Sec. Sec.
450.201 to 450.207)
b. Compliance Monitoring (Sec. 450.209)
c. Continuing Accuracy of License Application; Application for
Modification of License (Sec. 450.211)
d. Pre-Flight Reporting (Sec. 450.213)
e. Post-Flight Reporting (Sec. 450.215)
f. Registration of Space Objects (Sec. 450.217)
6. Changes to Parts 401, 413, 414, 420, 433, 437, and 440
7. Miscellaneous Comments
8. Responses to Regulatory Impact Analysis Comments
IV. Regulatory Notices and Analyses
A. Regulatory Evaluation
B. Regulatory Flexibility Act
C. International Trade Impact Assessment
D. Unfunded Mandates Assessment
E. Paperwork Reduction Act
F. International Compatibility
G. Environmental Analysis
V. Executive Order Determinations
A. Executive Order 13771, Reducing Regulation and Controlling
Regulatory Costs
B. Executive Order 13132, Federalism
C. Executive Order 13211, Regulations That Significantly Affect
Energy Supply, Distribution, or Use
VI. How To Obtain Additional Information
Rulemaking Documents
Comments Submitted to the Docket
Small Business Regulatory Enforcement Fairness Act
I. Overview
Overview of Final Rule
This rule amends 14 CFR parts 415, 417, 431, and 435 by
consolidating, updating, and streamlining all launch and reentry
regulations into a single part 450. After March 10, 2026, parts 415,
417, 431, and 435 will be removed. This rule also revises multiple
regulatory parts to apply a single set of licensing and safety
regulations across several types of operations and vehicles. In
addition, this rule replaces many prescriptive regulations with
performance-based rules, giving industry greater flexibility to develop
means of compliance that meet their objectives while maintaining public
safety. Where possible, the FAA has adopted performance standards, and
considered the prescriptive requirements for placement in advisory
circulars (AC) that will identify possible means of compliance, but not
the only means of compliance, with this rule. The goal of this approach
is to afford the industry and the FAA the added flexibility of using
new methods to better enable future innovative concepts and operations.
While some of the provisions in this rule may increase the risk to
public safety compared to the current regulations, such as the
provisions that apply to neighboring operations personnel, the FAA has
ensured that the increased risk is minimal and there is a corresponding
public interest benefit.
Part 450 accommodates all vehicle operators, including hybrid
vehicle operators. The revisions include more performance-based
requirements, alternatives to flight abort and flight safety analysis
(FSA) requirements based on demonstrated reliability, use of equivalent
level of safety (ELOS) for the measurement of a high consequence event,
and allowing application process alternatives as agreed to by the FAA.
Part 450 is divided into subparts A through D. Part 450 is
organized by sections that have both safety requirements for what an
operator must do to be safe and application requirements for what must
be submitted in an application. By ``applicant,'' the FAA intends to
reference an applicant for either a vehicle operator license, an
incremental approval, a payload determination, a policy approval, or an
environmental determination. By ``operator,'' the FAA intends to
reference the holder of a license, which is consistent with the
definition of ``operator'' in Sec. 401.7.
This preamble will discuss in detail the safety framework
encapsulated in part 450, part 450 requirements in sequential order,
followed by corresponding and related changes to other parts, and cost
implications for this rule.
i. Subpart A
Subpart A includes a general discussion on the application process,
licensing scope and duration, and compliance dates. Pre-application
consultation, which may include discussion of any applicable
flexibilities in the application process, scope of license, and means
of compliance, is required by part 413.
Figure 1 illustrates the licensing process. The licensing process
begins with pre-application consultation, which sets the stage for an
applicant to submit a license application. The application evaluation
consists of five major components: (1) A policy review, (2) a payload
review, (3) a safety review, (4) a determination of maximum probable
loss (MPL) for establishing financial responsibility requirements, and
(5) an environmental review. The license specifies the range of
activities the licensee may undertake along with any limitations.
Requirements after a license is issued encompass the licensee's
responsibility for public safety and compliance with its license,
representations in the license application, and FAA regulations. An
important component of this compliance is the FAA's authority to
perform safety inspections.
[[Page 79568]]
[GRAPHIC] [TIFF OMITTED] TR10DE20.000
In the final rule, the FAA does not make any changes to the
existing pre-application consultation provision, except to update the
term ``safety approval'' to the newly adopted ``safety element
approval.'' The FAA makes this change to delineate between the safety
approval portion of a license application and a safety element approval
that the FAA grants under Part 414. This distinction between terms will
not affect industry.
During the pre-application consultation stage, an applicant will
work with the FAA to develop an application and licensing process that
best fits its proposed operation. This stage will focus on compliance
planning and positioning the applicant to prepare an acceptable
application, which will increase the efficiency of the licensing
process. The length of pre-application consultation will vary based on
the proposed operation. For example, pre-application consultations may
be lengthy when involving new launch vehicles that are under
development or with operators inexperienced with the FAA's regulations.
Alternatively, pre-application consultation with experienced operators
using proven vehicles from established sites may be considerably
shorter.
During this stage, the FAA expects to discuss the following topics
with an applicant: Entrance and exit criteria for pre-application
consultation, the intended means of compliance to meet the regulatory
requirements in part 450, the scope of the license, safety element
approvals, incremental review, review period for license evaluation,
compliance expectations, and time frames an operator is required to
meet to satisfy part 450. Some of the topics allow for flexibility that
can result in a more efficient licensing process for both the applicant
and the FAA.
The rule allows an applicant and the FAA flexibility to establish
the scope of the license. Determining the point at which launch begins
will be discussed during pre-application consultation. The applicant
will describe to the FAA its launch site and its intended concept of
operations leading up to a launch, including any operations that are
hazardous to the public. Once the FAA and the applicant have a mutual
understanding of the applicant's intended concept of operations, the
FAA will determine what constitutes hazardous pre-flight operations and
thus the beginning of launch. The applicant will then scope its
application materials based on this starting point.
In the Notice of Proposed Rulemaking (NPRM), the FAA proposed to
set the scope of activity authorized by a vehicle operator license by
identifying the beginning and end of launch and reentry. The final rule
provides flexibility to scale the beginning of launch to the operation.
Specifically, the FAA will identify the beginning and end of launch on
a case-by-case basis and in consultation with an applicant. The final
rule does not adopt the proposed default that hazardous ground pre-
flight operations commence when a launch vehicle or its major
components arrive at a U.S. launch site. Instead, the final rule
identifies certain activities that qualify as hazardous pre-flight
operations, including, but not limited to, pressurizing or loading of
propellants into the vehicle or launch system, operations involving a
fueled launch vehicle, the transfer of energy necessary to initiate
flight, or any hazardous activity preparing the vehicle for flight.
This rule also clarifies that hazardous pre-flight operations do not
include the period between the end of the previous launch and launch
vehicle reuse when the vehicle is in a safe and dormant state.
For the end of launch and reentry, the FAA replaces each use of
``vehicle stage'' in the proposed rule with ``vehicle component'' in
the final rule. The FAA adopts this change in recognition that
components other than vehicle stages may return to Earth. Also, the FAA
now includes ``impact or landing'' in the end of launch and reentry
sections in the scope of license requirements to accommodate increasing
efforts to reuse components.
ii. Subpart B
Subpart B contains the requirements to obtain a vehicle operator
license. The topics include incremental review and determinations,
means of compliance,
[[Page 79569]]
policy review, payload review, safety review and approval, and
environmental review. This rule retains the key components of a license
application review: The policy review, payload review, safety review,
MPL determination, and environmental review. This rule continues to
allow operators to submit the payload, policy, environmental, and
financial responsibility portions of its application independently of
each other.
The final rule will also allow an applicant to submit an
application for a safety review in modules using an incremental
approach approved by the FAA. The safety review is typically the most
complex part of the license application and usually involves submission
of numerous documents. In this rule, the FAA has concluded that a
structured approach agreed to during pre-application consultation will
reduce regulatory uncertainty by allowing the FAA to affirm at an early
stage of development that the proposed safety measure or methodology
meets the FAA's requirements. An applicant must have its incremental
review approach approved by the FAA prior to submitting its application
so that the FAA can ensure that the modules can be reviewed
independently and in a workable order under an agreed time frame.
The rule makes it easier for an applicant to seek a safety element
approval in conjunction with its license application. A safety element
approval is an FAA document containing the FAA determination a safety
element, when used or employed within a defined envelope, parameter, or
situation, will not jeopardize public health and safety or safety of
property. A safety element includes a launch vehicle, reentry vehicle,
safety system, process, service, or any identified component thereof;
and qualified and trained personnel, performing a process or function
related to licensed activities or vehicles. An applicant may also
leverage existing safety element approvals by citing a safety element
approval in another license application, thus streamlining the
subsequent licensing process.
After the final rule becomes effective on March 10, 2021, operators
holding an active launch or reentry license, or who have an accepted
launch or reentry license application within 90 days after the
effective date, may choose to operate under parts 415 and 417 for
expendable launch vehicles (ELVs), part 431 for reusable launch
vehicles (RLVs), or part 435 for reentry vehicles, until five years
after the effective date of this rule.\1\ All operators, including
those exercising this provision, must come into compliance with this
regulation's requirements for critical asset protection and collision
avoidance (COLA) analysis beginning from the effective date of this
rule. Any operator may also choose to operate under part 450 on the
effective date of this rule. Operators conducting operations under
parts 415, 417, 431 or 435 may submit requests for license renewals
such that their license remains valid for up to five years after the
effective date of this rule. A license renewal issued after the
effective date of this rule will be valid for no longer than five years
after the effective date of this rule.\2\ All operators will need to
comply with all parts of this rule five years after its effective date.
Any operator may also choose to operate under part 450 on the effective
date of this rule.
---------------------------------------------------------------------------
\1\ The FAA refers to these licenses as ``legacy licenses''
throughout this preamble. After that time, all operators must come
into compliance with the new regulations.
\2\ Operators holding a part 431 mission operator license have a
2-year renewable period, operators holding a part 435 reentry
operator license have a 2-year renewable period, and operators
holding a part 415 launch operator license have a 5-year renewable
period.
---------------------------------------------------------------------------
For an application for a license modification submitted after this
rule becomes effective and within five years of the effective date, the
FAA will determine the applicability of part 450 on a case-by-case
basis. In determining whether to apply part 450 in evaluating a license
modification under this scenario in consultation with the applicant,
the FAA will consider the extent and complexity of the modification,
whether the applicant proposes to modify multiple parts of the
application, and if the application requires significant reevaluation.
The final rule allows most time frames to be determined during pre-
application consultation, or during the application review process. An
operator may propose alternative time frames for any of the
requirements listed in the newly created Appendix A to part 404.
Compliance with the performance requirements in this rule may be
demonstrated by using a means of compliance that is accepted by the
FAA. Means of compliance may be government standards, industry
consensus standards, or unique means of compliance developed by an
individual applicant. During pre-application consultation, the FAA will
work with applicants on compliance planning. The FAA will review the
submitted means of compliance to determine whether they satisfy the
regulatory safety standard.
For five requirements, an applicant must use a means of compliance
the FAA has accepted in advance of submitting an application. Those
requirements for which an applicant must use an accepted means of
compliance in advance are identified in Sec. 450.35 and include FSA
methods, airborne toxic concentration and duration thresholds for any
toxic hazards for flight, highly reliable flight safety systems (FSS),
lightning commit criteria, and airborne toxic concentration and
duration thresholds toxic hazard mitigation for ground operations. For
all other requirements, an applicant may include an accepted means of
compliance or a means of compliance the FAA has not yet accepted as
part of its application for the FAA to review during application
evaluation. The FAA will publish any publicly available means of
compliance that it accepts. In addition, an operator may request that
the FAA publish the operator's unique means of compliance, once
reviewed and accepted.
The FAA evaluates five major components in an application for a
vehicle operator license. The FAA adopts the proposed requirements for
the policy review without modification. For the FAA to conduct a policy
review, an applicant must identify the launch or reentry vehicle and
its proposed flight profile, and describe the vehicle by
characteristics that include individual stages and their dimensions,
the type and amounts of all propellants, and maximum thrust. The final
rule clarifies that a payload review is not required when the proposed
launch or reentry vehicle will not carry a payload or when the payload
is owned or operated by the U.S. Government. The FAA will continue to
conduct safety reviews to determine whether an applicant is capable of
conducting a launch or reentry without jeopardizing public health and
safety and safety of property as specified in Sec. Sec. 415.103,
431.31(a), and 435.31. Finally, the FAA adopts with revisions the
proposed requirements for environmental review. The revisions include
clarification on the FAA requirements for an Environmental Assessment
(EA) and the FAA's responsibility to determine whether a Categorical
Exemption (CATEX) applies, in accordance with current regulations. The
MPL calculation and financial responsibility requirements are discussed
under Subpart D.
iii. Subpart C
Subpart C addresses safety requirements. In the final rule, the FAA
revises numerous sections under
[[Page 79570]]
subpart C in response to public comments on the proposed rule, so that
the rule is more performance-based. Subpart C includes regulations for
key areas of concern to Federal launch or reentry sites that had not
been covered in previous FAA regulations (e.g., the treatment of
neighboring operations personnel and critical assets, including
critical payloads). Throughout this document, the terms ``Federal
launch or reentry sites'' and ``Federal sites'' replace the NPRM's use
of ``Federal launch range.''
The FAA structured the rule to facilitate elimination of
duplication of the requirements of Federal launch or reentry sites by
incorporating critical asset protections, to avoid the need for Federal
sites to impose this requirement. The rule also creates a path for the
FAA to determine that a Federal launch or reentry site's ground safety
processes, requirements, and oversight are not inconsistent with the
Secretary's statutory authority over commercial space activities.
The safety criteria in Sec. 450.101 (Safety Criteria) set the
public and property safety criteria that must be met before an operator
may initiate the flight of a launch or reentry vehicle.\3\ The
quantitative safety criteria continue to be the linchpin requirement
for flight safety, which is fundamental for all operators. There are
quantitative risk criteria for collective risk, individual risk, and
aircraft risk. The final rule applies collective and individual risk
criteria to people on waterborne vessels, enabling risk management
techniques that previously required a waiver. The rule carves out
neighboring operations personnel on a launch or reentry site as a
separate category of the public subject to different risk criteria.
This rule also adds risk criteria for the protection of critical assets
essential to the national interests of the United States, including a
more stringent requirement for the protection of critical payloads. The
final rule uses conditional risk management to ensure (1) mitigations,
such as flight abort, will be implemented to protect against high
consequence events, and (2) implementation of mitigations will produce
reasonable conditional risks.
---------------------------------------------------------------------------
\3\ The FAA changes the title of Sec. 450.101 from ``public
safety criteria'' in the NPRM to ``safety criteria'' in the final
rule. This is because the FAA changed the definition of ``public''
in new Sec. 401.7 of the final rule. In the NPRM, ``public'' was
defined to include ``people and property that are not involved in
supporting the launch or reentry and includes those people and
property that may be located within the launch or reentry site, such
as visitors, individuals providing goods or services not related to
launch or reentry processing or flight, and any other operator and
its personnel.'' In the final rule, the FAA removed references to
property, limiting the scope of the term ``public'' to people. This
was done to provide better clarity throughout part 450 regarding the
protection of people, property, or both. Because Sec. 450.101
includes criteria for both people and property, the FAA removes
``public'' from the title.
---------------------------------------------------------------------------
The rule allows for neighboring operations personnel to be
protected as members of the public, but to a less stringent risk
threshold as compared to other members of the public. In the final
rule, the FAA adopts the proposed requirements on neighboring
operations personnel in Sec. Sec. 401.7, 440.3, 450.101(a) and (b),
and 450.137 (Far-field Overpressure Blast Effect Analysis) paragraph
(c)(6), but removes the phase ``as determined by the Federal or
licensed launch or reentry site operator'' from the definition of
``neighboring operations personnel'' in Sec. 401.7. Instead, the
Federal or licensed site operator will determine those persons who are
eligible for neighboring operations personnel status in coordination
with the operators at the site and in accordance with definition in
Sec. 401.7. A site operator at a non-Federal site will have the option
to designate certain personnel as neighboring operations personnel.
In the final rule, critical assets include property, facilities, or
infrastructure necessary to maintain national security, or assured
access to space for national priority missions. In the final rule, the
FAA does not adopt the proposed requirement for operators to calculate
the risks to critical assets in preparing a flight hazard analysis,
debris analysis, and debris risk analysis. The FAA anticipates that it
will perform all critical asset and critical payload risk assessments
for commercial space transportation operations involving non-Federal
sites.
Under Sec. 450.101(c) of the NPRM, the FAA proposed to require an
operator to use flight abort as a hazard control strategy if the
consequence of any reasonably foreseeable vehicle response mode, in any
one-second period of flight, is greater than 1 x 10-\3\
CEC for uncontrolled areas. The FAA amends the title of
Sec. 450.101(c) from ``Flight Abort'' in the NPRM to ``High
Consequence Event Protection'' in the final rule, because the final
rule allows an operator to use a method other than flight abort in
certain situations in which the operator can show sufficient protection
against high consequence events. The FAA retains the CEC
requirement as a quantitative criterion that an applicant must use to
measure high consequence events, but revises the final rule to allow
ELOS for the CEC requirement. The final rule also allows
options for how an applicant may protect against a low likelihood, high
consequence event in uncontrolled areas for each phase of flight, such
as using flight abort in accordance with Sec. 450.108 (Flight Abort)
or demonstrating that CEC is below a certain threshold
without using flight abort.
The FAA adopts with revisions the proposal that an operator must
implement and document a system safety program throughout the
operational lifecycle of a launch or reentry system in Sec. 450.103
(System Safety Program). The system safety program includes a safety
organization, hazard management, configuration management and control,
and post-flight data review. In the final rule, the FAA removes the
proposed term ``operational'' to clarify that the regulation applies to
hazards throughout the lifecycle of a launch or reentry system--not
just to operational hazards. The FAA also does not adopt the proposed
requirement in Sec. 450.105 to conduct a preliminary safety
assessment, because that requirement has been replaced with a
requirement to conduct a functional hazard analysis under the Hazard
Control Strategies section in the final rule.
In the NPRM, the FAA proposed under the Hazard Control Strategies
section (Sec. Sec. 450.107 to 450.111) that, for each phase of a
vehicle's flight, an operator would not need to conduct a flight hazard
analysis for that phase of flight if the public safety and safety of
property hazards identified in the preliminary safety assessment could
be mitigated adequately to meet the requirements of proposed Sec.
450.101 using physical containment, wind weighting, or flight abort. In
the final rule, the FAA concludes that an operator must use one or more
of the hazard control strategies defined in Sec. Sec. 450.108 through
450.111 to meet the safety criteria. The FAA also adds a new paragraph
to this section to address how an operator determines its hazard
control strategy or strategies for any phase of flight during a launch
or reentry.
The FAA adopts proposed Sec. 450.108, which is a consolidation and
revision of several proposed sections associated with flight abort
requirements in the NPRM. As a result of this consolidation, the FAA
removes the flight abort related requirements in Sec. Sec. 450.123,
450.125, 450.127, and 450.129. The requirements in these sections have
been revised to be performance-based standards included in Sec.
450.108(c), which addresses flight safety limits objectives, and Sec.
450.108(d), which addresses flight safety limits constraints.
[[Page 79571]]
Section 450.109 (Flight Hazard Analysis) details requirements for
an operator using a flight hazard analysis as its hazard control
strategy for one or more phases of flight. A flight hazard analysis
must identify, describe, and analyze all reasonably foreseeable hazards
to public safety and safety of property resulting from the flight of a
launch or reentry vehicle, mitigate hazards as appropriate, and
validate and verify the hazard mitigations. The FAA revises the final
rule to reflect that performing a flight hazard analysis is included as
a hazard control strategy to derive hazard controls for the flight, or
phase of flight, of a launch or reentry vehicle.
Regardless of the hazard control strategy chosen or mandated an
operator must conduct an FSA to demonstrate quantitatively that a
launch or reentry meets the safety criteria for debris, far-field
overpressure, and toxic hazards. An operator may be required to conduct
additional analyses to use flight abort or wind weighting hazard
control strategies. The FAA anticipates that an operator will be
required to conduct some FSA for at least some phases of flight,
regardless of the hazard control strategy chosen or mandated. For
example, an FSA must determine flight hazard areas for any vehicle with
planned debris impacts capable of causing a casualty.
The FAA revises the FSA requirements in Sec. 450.113 (Flight
Safety Analysis Requirements--Scope), which establish the portions of
flight for which an operator would be required to perform and document
an FSA. An operator must perform and document an FSA for all phases of
flight, unless otherwise agreed to by the FAA. The FAA may agree there
is no need for an FSA for certain phases of flight based on
demonstrated reliability for any launch or reentry vehicle, instead of
just for hybrid vehicles as proposed in the NPRM. The FAA expands this
exception because, conceivably, an operation involving a vehicle other
than a hybrid could have an extensive and safe enough flight history to
demonstrate compliance with the risk criteria in Sec. 450.101 based on
empirical data in lieu of the traditional risk analysis.
An FSA generally consists of a set of quantitative analyses used to
determine flight commit criteria, flight abort rules, flight hazard
areas, and other mitigation measures, and to demonstrate compliance
with the safety criteria in Sec. 450.101. In the NPRM, the FAA
proposed 15 sections associated with FSA requirements in Sec. Sec.
450.113 to 450.141. The final rule moves requirements associated with
flight safety limits to Sec. 450.108 and condenses the remaining FSA
requirements into 11 performance-based sections that cover the scope of
the analyses, general methodology requirements, and specific sections
on normal trajectories, malfunction trajectories, hazardous debris
characterization, population exposure, probability of failure, flight
hazard areas, debris risks, and far-field overpressure blast effects.
The FAA moved some of the proposed FSA requirements such that an
operator could generally perform the analyses in the order that they
appear in the final rule, if they choose.
The FAA revises the FSA sections to be more performance-based than
what was proposed in the NPRM. Specifically, the FAA revises the FSA
requirements to identify their fundamental purpose, the essential
constraints, and the objectives in each section. The FSA requirements
in the final rule are consistent with current practice, but the rule
articulates important, often misunderstood, aspects of flight analysis
such as the creation of hazard areas and other operating constraints
necessary to protect public health and safety and safety of property.
Sections 450.139 (Toxic Hazards for Flight) and 450.187 (Toxic
Hazards Mitigation for Ground Operations) contain the requirements for
toxic release analysis. In the final rule, the FAA adopts Sec. Sec.
450.139 and 450.187 with some revisions. The FAA clarifies that
operators are not required to perform a toxic release hazard analysis
for kerosene-based fuels unless directed by the FAA. Also, the FAA
revises the requirements for performing toxic containment.
In the NPRM, Sec. 450.111 contained computing systems and software
requirements. In the final rule, the FAA revises and relocates the
requirements for computing systems and software to Sec. 450.141
(Computing Systems and Software). In response to comments, the FAA
revises the requirements of Sec. 450.141 to be more performance-based,
and levies requirements for computing system safety items in proportion
to their criticality instead of the item's level of autonomy. The final
rule also requires independent verification and validation for
computing system safety items that meet the definition of ``safety-
critical'' in Sec. 401.7.
The requirements of Sec. 450.143 (Safety-Critical System Design,
Test, and Documentation) apply to all safety-critical systems except
highly reliable FSS and safety-critical software items, which are
regulated by the requirements in Sec. Sec. 450.145 and 450.141
respectively. In the final rule, the FAA revises the reference to FSS
requirements in Sec. 450.143(a); amends Sec. 450.143(b) to include
other means of compliance and broader safe design concepts; and removes
the term ``vehicle'' in Sec. 450.143(c) because safety-critical
systems can be located off-vehicle. In addition, the FAA amends the
application requirements in Sec. 450.143(f) to require that applicants
describe the method used to validate predicted operating environments
and any standards used for each safety-critical system.
Section 450.145 (Highly Reliable Flight Safety System) contains the
requirements for certain FSS. The FAA revises Sec. 450.145 to apply to
a highly reliable FSS, which consists of any onboard portion and if
used, any ground-based, space-based, or otherwise not onboard portion
of the system. Conventional FSS with airborne flight termination
receivers and ground-based command transmitter systems will have both
airborne and ground-based subsystems. The final rule provides
additional flexibility for operations where the CEC is
between 1 x 10-\2\ and 1 x 10-\3\ and exempts the
FSS for such operations from the requirements of Sec. 450.145;
however, the FSS for such operations must still meet the requirements
of Sec. 450.143. The FAA makes these changes to scope the FSS design,
testing, and analysis more closely to potential consequence and risk.
These changes will reduce burden on operators that have a lower
potential for causing high consequence events. The FAA also removes the
reliability threshold required of an FSS for operations where
CEC is between 1 x 10-\2\ and 1 x
10-\3\. The final rule provides that an FSS required for
operations for which the CEC is between 1 x
10-\2\ and 1 x 10-\3\ must meet the requirements
of Sec. 450.143.
Section 450.147 (Agreements) requires a vehicle operator to have a
written agreement with any entity that provides a service or use of
property to meet a requirement in part 450. In the final rule, the FAA
requires an operator to enter into multiple agreements if the operator
works with multiple entities. Also, operators will continue to be
required to enter into agreements with the appropriate entities for
launches and reentries that cross airspace or impact water not under
U.S. jurisdiction.
Section 450.153 contains the requirements for radio frequency. In
the NPRM, the FAA proposed that an operator would be required to
identify each frequency, all allowable frequency tolerances, and each
frequency's intended use, operating power, and
[[Page 79572]]
source; and provide for the monitoring of frequency usage and
enforcement of frequency allocations. In the final rule, the FAA adopts
the proposed requirements with modifications to the performance-based
objectives central to radio frequency management. Operators will be
required to ensure that radio frequency does not adversely affect the
performance of FSS or safety-critical systems, and to coordinate radio
frequency with local and Federal authorities.
Section 450.157 contains the requirements for communications. In
the NRPM, the FAA proposed that personnel that have authority to issue
``hold/resume,'' ``go/no go,'' and abort commands must monitor each
common intercom channel during countdown and flight. The FAA does not
adopt the proposal because it was overly prescriptive.
Section 450.161 (Control of Hazard Areas) contains the control of
hazard areas. In the final rule, the FAA does not remove the
requirement for an operator to verify that warnings have been issued
when the operator relies on another party to publicize those warnings.
Instead, the FAA clarifies that the requirement may be met by
demonstrating due diligence pursuant to agreements that the operator
has with that party and notifying the FAA of any deviations from the
agreements by any party. The FAA also adds an application requirement
for the applicant to give a description of how the applicant will
provide for any publication of flight hazard areas.
In the final rule, the FAA does not adopt the four mishap
categories proposed in the NPRM. The FAA agrees with commenters that
the regulatory requirements for the proposed mishap classes, from most
severe (Class 1) to least severe (Class 4), were largely the same, and
concludes that the mishap classes are not needed to achieve the
objective of consolidating mishap-related terms and streamlining the
requirements to report, respond to, and investigate mishaps. Instead,
the FAA combines the substantive criteria of Mishap Classes 1-4 under
the definition of ``mishap.'' The revised definition in the final rule
describes events that constitute a mishap. The requirements to report,
respond to, and investigate mishaps are incumbent upon an operator
regardless of a mishap's severity.
Section 450.173 (Mishap Plan--Reporting, Response, and
Investigation Requirements) contains the requirements for the mishap
plan. In the final rule, the FAA does not adopt the proposed
requirement for a licensee to cooperate with FAA and NTSB
investigations contained in the NPRM. The FAA finds this requirement
duplicative of Sec. 450.13, which states that a vehicle operator
license does not relieve a licensee of its obligations to comply with
all applicable requirements of law or regulation that may apply to its
activities. Also, the final rule standardizes criteria for mishap plans
across all of 14 CFR Chapter III by making Sec. 450.173 applicable to
launch and reentry licensees, experimental permittees, and site
operators.
The FAA proposed to give license applicants and licensees the
option to pre-coordinate testing activities with the FAA. In the final
rule, the FAA clarifies that Sec. 450.175 (Test-induced Damage) will
only apply to licensees or license applicants who choose to apply for
the exception. The final rule also allows an operator to coordinate the
possibility of test-induced damage prior to an operation and exclude
damage meeting certain requirements from constituting a mishap, thereby
reducing unnecessary reporting.
v. Subpart D
Subpart D addresses the terms and conditions of a vehicle operator
license. This includes compliance monitoring (Sec. 450.209), material
changes and continuing accuracy (Sec. 450.211), pre-flight reporting
(Sec. 450.213), post-flight reporting (Sec. 450.215), and
registration of space objects (Sec. 450.217). In the final rule, the
FAA adopts these sections as proposed with the exception of revisions
to Sec. 450.213 (Pre-flight Reporting) as described below.
The final rule makes few changes to the post-licensing
requirements, for which the final rule standardizes requirements for
all launches and reentries from Federal sites and commercial spaceports
or exclusive use launch sites. In line with the previous requirements,
operators will provide information and comply with reported collision
avoidance closures. A Federal agency will continue to provide operators
the appropriate launch or reentry closures, but the rule allows the
possibility of some other entity's providing this service in the
future. The final rule offers operators flexibility, in coordination
with the FAA, to use different timelines for the submission of pre-
flight and post-flight reports. The FAA revises Sec. 450.213(d) to
allow an operator the flexibility to identify an appropriate time frame
in coordination with the FAA. The FAA also revises Sec. 450.217(c) so
that licensees will only need to notify the FAA that they removed an
object from orbit if removal occurs during or immediately after
licensed activities.
II. Background
This rulemaking arose from work by the National Space Council that
led to President Donald J. Trump's Space Policy Directive-2 (SPD-2) in
May 2018, directing the U.S. Department of Transportation to streamline
the regulations governing commercial space launch and reentry
licensing. The goals of this streamlining include creating a single
licensing regime for all types of commercial space flight launch and
reentry operations, and replacing prescriptive requirements with
performance-based criteria. The final rule is consistent with DOT's
regulations under 49 CFR 5.5(e), which instruct that regulations should
be technologically neutral, and, to the extent feasible, should specify
performance objectives, rather than prescribing specific conduct that
regulated entities must adopt.
On March 8, 2018, the FAA chartered the Streamlined Launch and
Reentry Licensing Requirements Aviation Rulemaking Committee (ARC) to
provide a forum for a broad range of stakeholders from the aviation and
space communities to discuss regulations to set forth procedures and
requirements for commercial space transportation launch and reentry
licensing. The FAA tasked the ARC with developing recommendations for a
performance-based regulatory approach in which the regulations set
forth the safety objectives to be achieved while providing the
applicant flexibility to produce tailored and innovative means of
compliance.
On April 30, 2018, the ARC submitted its final recommendation
report to the FAA.\4\ The FAA addressed the recommendations in more
detail throughout the NPRM. This final rule incorporates
recommendations provided by the ARC.
---------------------------------------------------------------------------
\4\ Streamlined Launch and Reentry Licensing Requirements ARC,
Recommendations Final Report (April 30, 2008). The ARC Report is
available for reference in the docket (Docket FAA-2019-0229).
---------------------------------------------------------------------------
On March 26, 2019, the FAA posted on its website an NPRM titled
``Launch and Reentry Licensing Requirements'' that would revise parts
401, 404, 413, 414, 415, 417, 420, 431, 433, 435, 437, and 440, and
create a new part 450. In the NPRM, the FAA proposed to streamline and
increase flexibility in the FAA's commercial space launch and reentry
regulations, remove obsolete requirements, consolidate and revise
multiple regulatory parts, and apply a single set of licensing and
safety
[[Page 79573]]
regulations across several types of operations and vehicles.
On April 15, 2019, the FAA published this NPRM in the Federal
Register (85 FR 15296). The initial comment period was 60-days from the
date of publication, ending on June 14, 2019.
In the ensuing month, commenters submitted fifty-six requests for
an extension of the comment period to a total of 120 days, or until
August 13, 2019.
In response, on May 31, 2019, the FAA published an extension of the
comment period on the NPRM (84 FR 25207), for an additional 45-days to
July 30, 2019, to allow commenters more time to analyze the proposed
rule.
On June 14, 2019, the FAA posted to the docket a response \5\ to
MLA Space, LLC, which had requested that the FAA reconvene the ARC to
engage in dialogue regarding the NPRM. In the response, the FAA stated
its belief that engagement with industry in the form of an ARC, a
public meeting, or through a special session of Commercial Space
Transportation Advisory Committee (COMSTAC) would not be beneficial at
that point in the rulemaking process. The FAA encouraged members of
industry to submit any questions requesting clarification regarding the
NPRM to the docket.
---------------------------------------------------------------------------
\5\ See FAA-2019-0229-0088.
---------------------------------------------------------------------------
On July 16, 2019, the FAA posted to the docket the first of its
responses \6\ to commenters' questions requesting clarification. Also
on July 16, 2019, the FAA posted a statement \7\ to the docket
encouraging commenters to post any further requests for clarification
in the docket as soon as possible. That statement reasserted the FAA's
judgment that further engagement with industry through a public meeting
to have clarifying dialogue regarding the NPRM would not be beneficial,
but also offered to entertain meetings in the month of July 2019 with
members of the public who wished to provide to the FAA their
information bearing on the proposed rule.
---------------------------------------------------------------------------
\6\ See FAA-2019-0229-0106.
\7\ See FAA-2019-0229-0107.
---------------------------------------------------------------------------
Subsequently, the FAA met with Blue Origin,\8\ the Coalition for
Deep Space Exploration,\9\ Space Exploration Technologies Corp.
(SpaceX),\10\ Virgin Galactic,\11\ and Virgin Orbit \12\ to receive
their clarifying questions and a preview of their comments on the
NPRM.\13\
---------------------------------------------------------------------------
\8\ See FAA-2019-0229-0127.
\9\ See FAA-2019-0229-0178.
\10\ See FAA-2019-0229-0129.
\11\ See FAA-2019-0229-0128.
\12\ See FAA-2019-0229-0126.
\13\ Since the information provided at these meetings is already
captured in these commenters' clarifying questions or comments
submitted to the docket, the FAA gave these commenters the option of
not posting to the docket a summary of the meeting, as required by
the FAA's Statement Regarding Requests for Public Meetings (see FAA-
2019-0229-0107), as this would be a duplicative effort.
---------------------------------------------------------------------------
On July 22, 2019, the FAA published a second extension of the
comment period to the NPRM (84 FR 35051). To provide commenters with
sufficient time to review the FAA's clarifications in response to the
commenter's questions, the FAA extended the comment period to August
19, 2019.\14\
---------------------------------------------------------------------------
\14\ See 84 FR 35051.
---------------------------------------------------------------------------
On August 16, 2019, the FAA posted its response to the docket \15\
to commenters' questions for clarification received by July 12, 2020,
and July 29, 2019.
---------------------------------------------------------------------------
\15\ See FAA-2019-0229-0134 and FAA-2019-0229-0135.
---------------------------------------------------------------------------
On August 19, 2019, the comment period closed, with a total of 155
submissions from 85 commenters, and two submissions containing
proprietary information. Of these comments, 62 requested an extension
of the comment period, 10 requested to reconvene the ARC, 29 requested
a public meeting, 18 requested a Supplemental Notice of Proposed
Rulemaking (SNPRM), 18 contained clarifying questions for parts of the
NPRM, and 53 comments contained substantive feedback regarding the
proposed rule. The FAA discusses the adjudication of these comments in
more detail later in the preamble.
III. Discussion of the Rule
A. Safety Framework
[[Page 79574]]
[GRAPHIC] [TIFF OMITTED] TR10DE20.001
General. The final rule relies on a safety framework that provides
the flexibility needed to accommodate current and future launch and
reentry operations. The safety framework encompasses both ground safety
and flight safety. Acceptable safety for ground operations is achieved
primarily through a process-based hazard analysis and certain
prescribed hazard controls. Acceptable safety for flight operations is
achieved through several elements discussed further in this preamble
section. The FAA identifies specific safety criteria and requirements
in Sec. 450.101 that must be met before a launch or reentry can take
place, including collective risk, individual risk, aircraft risk, risk
to critical assets, protection against high consequence events,
disposal of orbiting stages, risk to people and property on orbit, and
notification of planned impacts.
System Safety Program. All operators are required to have a system
safety program that establishes system safety management principles for
both ground safety and flight safety throughout the operational
lifecycle of a launch or reentry system. The system safety program
includes a safety organization, hazard management, configuration
management and control, and post-flight data review.
Hazard Control Strategies. To address the wide variety of
commercial launch and reentry systems and operations concepts, the
final rule includes four hazard control strategies. An operator can use
multiple hazard control strategies during flight because different
strategies may be appropriate for different phases of flight. Different
hazard control strategies may also be appropriate during any one phase
of flight to protect different sets of people and property. The hazard
control strategies are physical containment, wind weighting, flight
abort, and flight hazard analysis.
Physical containment would most likely be used for low
energy test flights, when a launch vehicle does not have sufficient
energy for any hazards associated with its flight to reach the public
or critical assets.
Wind weighting is traditionally used in the launch of
unguided suborbital launch vehicles, otherwise known as sounding
rockets, where the operator adjusts launcher azimuth and elevation
settings to correct for the effects of wind conditions at the time of
flight to provide impact locations for the launch vehicle or its
components that will ensure compliance with the safety criteria in
Sec. 450.101.
Flight abort is the traditional safety approach for
expendable launch vehicles, and is a process to limit or restrict the
hazards to public safety and the safety of property presented by a
launch vehicle or reentry vehicle, including any payload, while in
flight by initiating and accomplishing a controlled ending to vehicle
flight. With the exception of phases of flight with demonstrated
reliability, flight abort is mandated as a hazard control strategy if
the potential for a high consequence event is above a certain
threshold.
Flight hazard analysis is the traditional safety approach
for reusable launch vehicles, and is the most flexible hazard control
strategy because an operator derives specific hazard controls unique to
its launch or reentry vehicle system and operations concept. Flight
hazard analysis is mandated as a hazard control strategy if the other
three hazard control strategies cannot mitigate the safety hazards
sufficient to meet the safety criteria of Sec. 450.101.
An operator determines the appropriate hazard control strategy by
conducting a functional hazard analysis.
[[Page 79575]]
Flight Safety Analyses. Regardless of the hazard control strategy
chosen or mandated, an operator is required to conduct several FSA.
These include trajectory analyses for normal and malfunction flight, a
debris analysis, a population exposure analysis, and a probability of
failure analysis. These analyses provide input to a debris risk
analysis, a far-field overpressure blast effects analysis, and a toxic
hazard analysis that together demonstrate compliance with the safety
criteria of Sec. 450.101, and provide input to a flight hazard area
analysis.
Derived Hazard Controls. With respect to flight operations, an
operator would derive several hazard controls by conducting the FSA
and, if necessary, a flight hazard analysis. Because hazard controls
are derived from these analyses, they are not specifically addressed in
part 450.
Prescribed Hazard Controls for Computing Systems and Software and
Safety-Critical Hardware. Regardless of the hazard controls derived
from a flight hazard analysis and FSA, the FAA requires many other
hazard controls. The first set of hazard controls includes requirements
for computing systems and software, safety-critical systems, and highly
reliable FSS.
Other Prescribed Hazard Controls. The second set of hazard controls
have historically been necessary to achieve acceptable flight safety.
These include requirements for (1) written agreements, (2) safety-
critical personnel qualifications, (3) work shift and rest
requirements, (4) radio frequency management, (5) readiness, (6)
communications, (7) pre-flight procedures, (8) control of hazard areas,
(9) lightning hazard mitigation, (10) flight commit criteria, (11)
tracking, (12) collision avoidance, (13) safety at the end of launch,
and (14) mishap plans.
Ground Safety. With respect to the safety of ground operations, the
safety framework includes (1) coordination with a site operator, (2)
explosive siting, (3) a ground hazard analysis, (4) toxic hazard
mitigations, and (5) prescribed hazard controls addressing visitors,
countdown aborts, fire suppression, and emergency procedures. These
together provide an acceptable set of public safety considerations for
ground operations.
B. Detailed Discussion of the Final Rule
1. Prescriptive vs Performance-Based Regulations, ELOS, Safety Case
i. Prescriptive
The FAA sought in the NPRM to propose changes that would convert
many of its prescriptive requirements to more performance-based
requirements that would allow for different means of compliance. The
FAA received several comments stating generally that the proposed rule
was still too prescriptive. The Commercial Spaceflight Federation (CSF)
and SpaceX commented that some of the proposed requirements would
unnecessarily drive applicants to a burdensome equivalent level of
safety (ELOS) process as a default. Blue Origin recommended broadly
that the FAA remove all prescriptive portions of the proposed rule.\16\
---------------------------------------------------------------------------
\16\ Blue Origin submitted to the rulemaking docket a letter to
Admiral James Ellis, Jr, USN (ret.), Chairman, Users' Advisory
Group, National Space Council, in which Blue Origin expressed
concerns with the NPRM. The letter encouraged Adm. Ellis to
communicate the concerns to the Administration and the members of
the National Space Council and advise the Office of the Secretary of
Transportation and FAA to engage further with industry through a
public meeting to address concerns with the NPRM and then to issue a
supplemental NPRM that achieves the goals of SPD-2. The FAA is
construing the contents of the letter as comments on the proposals
in the NPRM.
---------------------------------------------------------------------------
The FAA agrees that some of the requirements in proposed part 450
were unnecessarily prescriptive, particularly those for software and
FSA. The FAA has modified those requirements to remove unnecessary
prescriptiveness and provide additional flexibility while still
preserving safety and providing regulatory clarity. For many of the
requirements amended for this purpose in the final rule, the
prescriptive parts of the proposal will be moved to a corresponding AC
as guidance on means of compliance. Specific changes to the
requirements are discussed later in this preamble.
Several commenters, including Blue Origin, CSF, and SpaceX, also
stated that the FAA should base its new requirements on parts 431 and
435 and add details on how to comply through guidance. CSF also stated
that the FAA ignored the draft regulatory text provided by the ARC,
which used parts 431 and 435 as a basis for updated rules.
The FAA disagrees that parts 431 and 435 should be used as the sole
basis for part 450. Part 431 depends on an operator to use the system
safety process to derive hazard controls, which as reflected in part
450, is appropriate for some launch and reentry vehicle systems and
operations. However, as also reflected in part 450, not all launch and
reentry vehicle systems and operations require an operator to derive
hazard controls through the system safety process. Specifically,
physical containment, wind weighting, and, most importantly, flight
abort are often sufficient. Part 450 incorporates the flexibility of
part 431, but acknowledges the acceptability of other hazard control
strategies. Part 450 also builds on the precedent set by part 431's
limits on the foreseeable consequences of a failure in terms of
conditional expected casualties and establishes a less stringent
threshold.\17\ Furthermore, the FAA stated in the NPRM that it would
not specifically address the ARC's proposed regulatory text because
that regulatory text did not receive broad consensus within the ARC.
---------------------------------------------------------------------------
\17\ Section 431.43(d) sets a limit for foreseeable public
consequences in terms of CEC, but only for an unproven
RLV. Section 431.43(d) provides an unproven RLV may only be operated
so that during any portion of flight, the expected number of
casualties does not exceed 1 x 10-\4\ given a vehicle
failure will occur at any time the instantaneous impact point is
over a populated area. This is in greater detail in the high
consequence event protection section of the preamble.
---------------------------------------------------------------------------
One individual commenter noted that streamlining was long overdue.
Another individual commenter noted that the proposed rule is longer and
more complicated than the rule it proposes to replace, and that past
FAA approaches led to codifying Federal launch and reentry site
requirements, which the Federal sites subsequently changed such that
they no longer matched the FAA requirements.
In response, the FAA notes that the proposed regulation combined
elements from parts 415, 417, 431, and 435. Part 450 is shorter than
parts 415 and 417 and more performance-based. Although it is longer
than parts 431 and 435, part 450 is more flexible and encompasses more
types of launch and reentry operations. This final rule allows
operators to use a means of compliance that will accommodate customized
operations, changing technologies, and innovation.
ii. Equivalent Level of Safety (Sec. 450.37)
In the NPRM, the FAA proposed in Sec. 450.37 (Equivalent Level of
Safety) that for all requirements in part 450, except Sec. 450.101, an
applicant may clearly and convincingly demonstrate that an alternative
approach provides an equivalent level of safety (ELOS) to the
requirement.
In the final rule, the FAA revises Sec. 450.37 so that only some
portions of Sec. 450.101--specifically Sec. 450.101(a), (b), (c)(1),
(c)(3), (d), (e)(1), and (g)--are excluded from eligibility for an ELOS
approach. This change allows an applicant to propose an equivalent
level of safety to the orbital debris requirement in Sec.
450.101(e)(2) and the notification of planned impacts requirement in
Sec. 450.101(f). Most significantly, this change also allows an
applicant to propose an equivalent level of safety to the use of a
CEC of 1 x 10-\3\
[[Page 79576]]
as the measure of a high consequence event in Sec. 450.101(c)(2).
Section 450.101(c) is discussed more fully later in this preamble.
Virgin Galactic commented that ELOS determinations should be part
of the license application process. The FAA agrees with the comment and
incorporates ELOS determinations into the license application process.
To exercise this option, an applicant must demonstrate, through
technical rationale, that the proposed alternative provides a level of
safety equivalent to the requirement it would replace. The FAA will
evaluate the proposal during the application evaluation.
CSF stated that, if the FAA adopted the parts 431 and 435
framework, ELOS would be unnecessary because the ELOS process does not
exist under those regulations.\18\ Blue Origin urged the FAA to
consider the need for an ELOS option in this rule.
---------------------------------------------------------------------------
\18\ The FAA added equivalent level of safety provisions to
parts 431 and 435 in a 2018 final rule. 83 FR 28528 (June 20, 2018).
---------------------------------------------------------------------------
In response to CSF's comments, the FAA acknowledges that, in
theory, a performance-based regulation like part 450 could function
without an ELOS provision, because, in concept, a performance-based
rule allows many different means of compliance with the required safety
standard. The FAA considered eliminating the ELOS provision from the
final rule, but decided that eliminating the ELOS provision would
remove a useful regulatory tool that provides flexibility. Unlike means
of compliance, which demonstrate compliance with the regulation, ELOS
allows an applicant to propose and demonstrate a method that ensures an
ELOS to the requirement, but not necessarily compliance with the
requirement itself. The FAA has chosen to retain the option of ELOS to
allow operators to propose unique processes and procedures that this
rule may not have contemplated.
Blue Origin stated that it supports the use of safety cases as a
means to establish an ELOS under proposed Sec. 450.37. A safety case
is a structured argument, supported by a body of evidence that provides
a compelling, comprehensive, and valid case that a system is safe, for
a given application in a particular setting. Regarding process, Blue
Origin recommended requiring only one layer of external-to-applicant
audit, and that the audit criteria be transparently developed with
industry input to ensure understanding of the scope of compliance with
the ELOS proposal process. Another individual commenter stated that the
FAA should add a provision that would allow use of an alternate process
for obtaining a license based on the use of a ``safety case''
methodology. This methodology would consist of voluntary audits of an
applicant's safety and risk management program, followed by development
of a safety case showing how the public would be protected during
licensed activities.
The FAA finds that the proposed regulation is flexible in allowing
an applicant to propose a means of compliance. It also affords the
possibility of meeting most requirements by demonstrating an ELOS.\19\
An applicant may wish to use a safety case to demonstrate that it is
has satisfied the ELOS standard; however, the FAA declines to add
prescriptive audit requirements for its use. An applicant could, but is
not required to, use a safety case to show that a certain method
satisfies an ELOS to a regulatory requirement, excluding the
requirements of Sec. 450.101(a), (b), (c)(1), (c)(3), (d), (e)(1), and
(g). A safety case is not required to demonstrate ELOS. It is one way
to provide rationale for ELOS. An applicant could use a safety case or
other justification for ELOS.
---------------------------------------------------------------------------
\19\ ELOS is not applicable to Sec. 450.101(a), (b), (c)(1),
(c)(3), (d), (e)(1), and (g).
---------------------------------------------------------------------------
Virgin Galactic recommended that safety cases be counted as an
alternative to CEC in Sec. 450.101(c). The Boeing Company
(Boeing), Lockheed Martin Corporation (Lockheed Martin), Northrop
Grumman Corporation (Northrop Grumman), and United Launch Alliance
(ULA) sought clarification as to why Sec. 450.37 would not apply to
Sec. 450.101. Similarly, Blue Origin, CSF, SpaceX, and Virgin Galactic
commented that ELOS should be allowed for Sec. 450.101(c).
The FAA agrees with allowing ELOS for Sec. 450.101(c)(2). This
allows an operator to make a safety case or provide some other
justification for an ELOS determination for an alternative method to
protect against a high consequence event, such as safeguards other than
flight abort, or an alternative to CEC as a measurement of
the potential for a high consequence event, such as a risk profile,
both of which are described more in the preamble section discussing
Sec. 450.101(c). Section 450.101(a), (b), (c)(1), (c)(3), (d), (e)(1),
and (g) contain the core safety requirements to protect people and
property on land, at sea, in the air, and in space. Any proposed non-
compliance with these risk requirements will require a waiver and are
not eligible for a demonstration of ELOS. By contrast, all other flight
safety requirements in part 450 subpart C, which can be demonstrated
through ELOS, support the achievement of these underlying risk
criteria. To use an ELOS, an operator may demonstrate that an
alternative approach provides an equivalent level of safety to a
requirement in accordance with Sec. 450.37. A petition for waiver must
be submitted at least 60 days in advance and address why granting the
request for relief is in the public interest and will not jeopardize
the public health and safety, safety of property, and national security
and foreign policy interests of the United States in accordance with
Sec. 404.5.
Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that
the FAA should accept a Federal launch or reentry site's safety
processes as providing an ELOS to the FAA's own safety standards
without any additional safety requirements.
The FAA disagrees. FAA regulations apply to licensed launches and,
in accordance with Sec. 450.45(b) (Safety Review and Approval), the
FAA will accept any safety-related launch or reentry service provided
by a Federal launch or reentry site or other Federal entity by
contract, if the FAA determines that the launch or reentry service
satisfies part 450. Although it is possible for the FAA to find that a
service provided by a Federal launch or reentry site does not satisfy a
requirement in part 450 but does provide an ELOS, the FAA needs to make
that determination on a case-by-case basis.
iii. ``As agreed to by the Administrator''
Throughout the NPRM, the FAA used the clause ``as agreed to by the
Administrator.'' The term was used in all time frame requirements, as
well as in proposed Sec. Sec. 450.3(a) and (b)(1), 450.33, 450.101(c),
450.113(a)(5), 450.107(b)(2), 450.107(d), 450.147(c), 450.173(g),
450.213(a), and 450.215(b). As stated in the proposal, this clause is
used to mean that an operator may submit an alternative to the proposed
requirement to the FAA for review. The FAA must agree to the operator's
proposal for the operator to use the alternative.
CSF and SpaceX commented that it was unclear how the clause ``as
agreed to by the Administrator'' differed from an ELOS determination.
CSF and SpaceX requested that the FAA describe its expectations and
capture any process associated with this option in guidance. CSF and
SpaceX also recommended adding ``unless otherwise agreed to by the
Administrator'' to the beginning of proposed Sec. 450.101(c).
[[Page 79577]]
The clause ``as agreed to by the Administrator'' means that an
operator may submit an alternative to a regulatory requirement. The FAA
must agree to the operator's proposal for the operator to use this
alternative. Unlike an ELOS determination, an applicant need not
demonstrate that this alternative satisfies an ELOS to the requirement.
Each use of the term ``as agreed to by the Administrator'' includes
criteria or considerations by which the FAA will agree to a different
approach than the regulatory requirement. An applicant should look to
these criteria or considerations to determine what the FAA would expect
from an applicant when providing an alternative proposal.
For most of the requirements in part 450, an applicant may
demonstrate an equivalent level of safety if the applicant is unable to
meet a requirement. In addition, an operator may request a waiver to
any requirement. An ELOS may be submitted in a license application and
must clearly and convincingly demonstrate that an alternative approach
provides an equivalent level of safety to the requirement. A petition
for waiver must be submitted 60 days in advance and address why
granting the request for relief is in the public interest and will not
jeopardize the public health and safety, safety of property, and
national security and foreign policy interests of the United States.
For some requirements, the FAA anticipated the need for additional
regulatory flexibility without the burden of providing an equivalent
level of safety or applying for a separate waiver. For those
requirements, the FAA has incorporated the clause ``as agreed to by the
Administrator'' to mean that an operator may submit an alternative to
the proposed requirement to the FAA for review. For each requirement
where the FAA has provided additional flexibility by including the ``as
agreed to by the Administrator'' clause, the FAA has also provided
criteria that the Administrator will consider in determining whether to
approve the alternative approach, including safety considerations when
appropriate. For example, an alternative time frame will generally be
accepted if it provides sufficient time for the FAA to review the
submittal. These alternatives will typically be agreed to in pre-
application consultation.
The FAA addresses the recommendation from CSF and SpaceX by
including ELOS in Sec. 450.101(c)(2). The use of ELOS and ``agreed to
by the Administrator'' for Sec. 450.101(c) is discussed in more detail
in the preamble section addressing CEC.
iv. Time frames
In the NPRM, the FAA proposed to allow an operator to propose
different time frames for certain regulatory sections if ``agreed to by
the Administrator''. Blue Origin, CSF, and SpaceX disagreed with this
approach and requested that the FAA remove any requirement to submit
such a request in a specific time frame other than as soon as the
operator understands that a different time frame is necessary. Virgin
Galactic recommended that alternate time frames should be spelled out
within an operator's license application documents and suggested
alternative regulatory text.
The FAA disagrees with the approach to remove specific time frames
because the time frames are designed to ensure the FAA has sufficient
time to conduct its review and make the requisite public health and
safety, safety of property, and national security and foreign policy
findings. The FAA notes that the time frames proposed in the NPRM and
adopted in the final rule are default time frames. An applicant can
propose and the FAA can accept an alternative time frame. The FAA
expects alternative time frames to be proposed and accepted during pre-
application consultation or during the application process so that the
agreed to time frames are then reflected in the license once issued.
Time frames can be adjusted after a license is issued through the
license modification process, as opposed to the waiver process under
the current regulations. However, in most cases, the FAA expects
flexible time frames to be negotiated for all the launches or reentries
under the license prior to the first licensed activity.
v. Level of Rigor Based on Experience
An individual commenter stated startup launch operators should not
operate under the same regimen as experienced operators. This
individual stated that startup operators should be subject to strict
and precise regulations. Similarly, another individual expressed
concern that the proposed rule would apply performance-based
requirements to launch vehicles with no prior launch history.
SpinLaunch, Inc. (SpinLaunch) commented that the correct regulatory
framework should consist of an applicant's demonstrating the necessary
skills and knowledge to perform safe and accepted operations.
The FAA disagrees that startup launch operators should operate
under a different regulatory regime than experienced operators, and
that performance-based requirements should not apply to launch vehicles
with no prior launch history. Performance-based requirements provide
flexibility to all operators. Means of compliance located in ACs and
other standards that have been identified as accepted means of
compliance to part 450 provide detailed guidance to those new operators
that have not yet established safety processes and procedures. In
response to SpinLaunch's comment, the final rule is structured such
that an applicant must demonstrate to the FAA the necessary skills and
knowledge to perform safe operations in its launch or reentry license
application.
2. Part 450 Subpart A--General Discussion
a. Pre-Application Consultation
In the NPRM, the FAA proposed to retain the requirement for pre-
application consultation from Sec. 413.5 (Pre-Application
Consultation) because the various flexibilities proposed in this rule
would benefit from pre-application discussions. These include
incremental review, timelines, and the performance-based nature of the
regulatory requirements. In the final rule, the FAA adopts the proposal
with no changes to the existing pre-application consultation provision.
As proposed, this rule retains pre-application consultation for
vehicle operators seeking a license. The FAA will also publish a pre-
application consultation Advisory Circular, which will provide
additional guidance but will not establish new regulatory requirements.
Pre-application consultation will continue to focus on compliance
planning and ensuring the applicant can prepare an acceptable
application, which will increase the efficiency of the licensing
process. The length of pre-application consultation will vary based on
the proposed operation. For example, pre-application consultations may
be longer when involving new launch vehicles that are under development
or with operators inexperienced with FAA's regulations. Alternatively,
pre-application consultations with operators who demonstrate knowledge
of FAA regulations and/or use proven vehicles from established sites
should be considerably shorter. The FAA expects to discuss the
following topics with an applicant during pre-application consultation,
to the extent they are relevant to the applicant's proposed operation:
Entrance and exit criteria for pre-application consultation, the
intended means of compliance to meet the regulatory requirements in
part 450,
[[Page 79578]]
the scope of the license, safety element approvals, incremental review,
review period for license evaluation, compliance expectations, and time
frames an operator is required to meet to satisfy part 450. Some of the
topics allow for flexibility that can result in a more efficient
licensing process for both the applicant and the FAA.
The FAA will continue to consider the following factors to
determine if a prospective applicant is ready to begin pre-application
consultation: Whether the concept of operations is realistic and
whether the prospective applicant is able to provide a program schedule
that includes definition of significant milestones and a funding source
or sources. The regulatory requirements for a launch and reentry
license are the same for all applicants; however, FAA expects it will
take longer for less experienced operators to meet all of the
requirements. As currently required, to exit pre-application
consultation and begin the license evaluation period, an application
must be complete enough in accordance with Sec. 413.11 (Acceptance of
an application). A complete enough application must include enough
information for the FAA to start its review. The FAA will screen an
application in its entirety or in modules to determine whether it is
complete enough for the FAA to start its review. The components of a
vehicle operator license application are listed in Sec. 450.31
(General) and include a policy review, a payload review, a safety
review that complies with Subpart C, an environmental review, and
information necessary to satisfy the maximum probable loss analysis
required by part 440.
For the five sections listed in Sec. 450.35(a), an applicant must
use a means of compliance that has been accepted by the Administrator
prior to application acceptance. An applicant may propose another
standard or a unique means of compliance for these five sections before
submitting its application.\20\ Furthermore, many requirements
throughout the final rule allow an operator to use an alternative
method if that method has been agreed to by the Administrator. This
allowance maximizes flexibility and will reduce the need for the
applicant and the FAA to use process waivers. During pre-application
consultation, the FAA anticipates that applicants will discuss the
means of compliance they plan to use for the remaining sections of the
rule, and any alternative means they plan to use for those sections
that allow alternative means of compliance. While the FAA anticipates
that this pre-application consultation will expedite license review
times and aid both FAA and applicant, it is only required for the
sections listed in Sec. 450.35(a).
---------------------------------------------------------------------------
\20\ Further discussion on this topic is in the preamble section
for performance-based regulations and means of compliance.
---------------------------------------------------------------------------
The final rule has built-in flexibilities for determining the
beginning and end of launch such that the launch is scoped to an
individual operator's unique circumstances. It is important that the
applicant and the FAA come to a mutual understanding during pre-
application consultation about the beginning and end of launch for the
license. The beginning and end points of a launch operation define the
extent of a number of requirements, including, but not limited to,
indemnification and FAA oversight. Therefore, an applicant should
define the beginning and end of its operation during pre-application
consultation, and should coordinate with the FAA before finalizing and
submitting its application.\21\ In this way, the applicant can ensure
that the FAA will evaluate the complete scope of its proposed
operation.
---------------------------------------------------------------------------
\21\ A discussion on what constitutes beginning and end of
launch is in the preamble section discussing scope of launch.
---------------------------------------------------------------------------
If an applicant is planning to seek a safety element approval, the
applicant must continue to consult with the FAA before submitting its
application in accordance with Sec. 414.9 (Pre-Application
Consultation). Doing so will help ensure that the FAA and the applicant
have a thorough understanding of how the applicant will comply with the
regulatory requirements surrounding a safety element approval before
submitting an application. During pre-application consultation, the FAA
would expect an applicant to be able to discuss, at a minimum, the
following information as outlined in Sec. 414.15: (1) How the
applicant will meet the applicable requirements of part 450; (2) the
information required in Sec. 414.13(b)(3), (c)(2), and (c)(3); and (3)
the sections of the license application that support the application
for a safety element approval.
If an applicant is proposing an incremental review of its
application, the applicant must have its approach approved by the FAA
prior to submitting its application, in accordance with Sec. 450.33
(Incremental Review and Determinations). Incremental review is intended
primarily to give additional flexibility to the applicant, by allowing
the applicant to separate the safety review into sections so that those
sections can be approved independently. In many ways, the incremental
review process is similar to the independent payload review or a safety
element approval process because it allows the applicant to comply with
the safety approval portion of the regulation in modules or sections
rather than all at once. An applicant considering the use of the
incremental review process should indicate to the FAA during pre-
application consultation which portions of its application will be
evaluated under the incremental review process. See the Incremental
Review section of this preamble for further discussion.
Finally, part 450 allows an operator to propose alternative time
frames for certain requirements, which are listed in Appendix A to part
404. If an operator knows in advance of application submittal that it
will propose an alternative time frame, the applicant should raise this
proposal during pre-application consultation. The FAA would also be
able to discuss during pre-application consultation the FAA's expected
review period to make its determination on the proposed alternative
time frame. Flexible time frames are discussed at length later in this
preamble.
The FAA received several comments on the pre-application
consultation process. An individual commenter stated that pre-
application consultation may not provide substantial benefits for an
existing program and suggested allowing the FAA to request a pre-
application consultation process with a 30-day completion timeline for
any ``material changes'' to existing programs deemed as posing a
significant risk to the safety of the vehicle. The commenter also
suggested the FAA could request this process at least 60 days before
the integration of the launch vehicle. The commenter stated that past
performance of space flights and aircraft should be taken into
consideration for the level of rigor for the pre-application process.
The FAA will not attach a schedule to pre-application consultation
but agrees with the commenter that a material change can be discussed
as part of pre-application consultation. The FAA acknowledges that pre-
application consultation should be minimal for experienced operators
using proven vehicles from established sites. This type of abbreviated
consultation period for experienced operators would be consistent with
the pre-application process prior to issuance of this final rule. The
FAA disagrees with a 30-day completion timeline for pre-application
consultation for any material change to existing programs. The FAA also
disagrees with the suggestion that the
[[Page 79579]]
FAA request pre-application consultation at least 60 days before
integration of the launch vehicle or that pre-application consultation
be tied to the flight safety risk of the vehicle. These timelines and
criteria may be inadequate in some cases to prepare a complete
application properly; in others, they might result in unnecessary
delays in addressing and implementing critical safety changes. In
addition, the FAA will not tie pre-application consultation to risk to
the vehicle because the FAA does not oversee risk to the vehicle but
rather risk to the public.
Sierra Nevada noted that operators could work with the FAA to
develop a program schedule and define anticipated data submissions
during pre-application consultation. Sierra Nevada noted that this use
of the consultation process was not specifically codified in the
proposed regulations and recommended including it expressly in an AC.
The FAA agrees and will include guidance on application scheduling
and data submissions in the pre-application consultation AC. The FAA
considered including more robust requirements for pre-application
consultation in the final rule, however, the FAA concluded that the
current regulation both prepares the applicant to submit a complete
application and the FAA to accept it, while also providing flexibility
to the applicant to approach pre-application consultation in a manner
that best fits the proposed operation.
b. Application Process
In the NPRM, the FAA proposed to clarify in Sec. 413.1 (Scope of
this Part) that the term ``application'' means either an application in
its entirety or a portion of an application for incremental review. In
Sec. 413.21 (Denial of a License or Permit Application), the FAA
proposed to remove ``license'' from paragraph (c) so the regulation
applied to both license and permit applications. In part 414 (Safety
Element Approvals), the FAA proposed to change the term ``sufficiently
complete'' to ``complete enough,'' as used in Sec. 413.11 (Acceptance
of an Application), because the two terms both described the point at
which the FAA determined it had sufficient information to accept an
application and begin its evaluation. Finally, the FAA proposed to
amend Sec. 413.7 (Application Submission) paragraph (a)(3) to allow an
applicant the option to submit its application by email as a link to a
secure server and remove the requirement that an application be in a
format that cannot be altered. In the final rule, the FAA adopts these
changes as proposed.
A joint set of comments submitted by Boeing, Lockheed Martin,
Northrop Grumman, and ULA expressed support for the proposal to allow
the submission of an application using physical electronic storage.
In addition, the FAA received suggested changes to the generic
application process. The American Association of Airport Executives
(AAAE) and the Denver International Airport commented on the need for
further engagement with stakeholders during an operator's application
process. These commenters said the FAA should provide an opportunity
for affected stakeholders to provide input on an operator's application
regarding issues such as impacts to the National Airspace System (NAS).
Denver International Airport stated that stakeholders should be able to
submit comments on license applications.
The FAA does not agree that an application should be open to a
public input process. The FAA issues a license based on whether the
applicant's proposal will not jeopardize public health and safety, the
safety of property, and the national security and foreign policy
interests of the United States. The FAA coordinates with government or
private entities as necessary to make this determination. A broad
public input process outside the environmental review process is
unnecessary for the FAA to make its licensing determination. While
commenters may seek the opportunity to raise issues such as non-safety
impacts to the NAS or the economic impact to land adjacent to a launch,
the FAA cannot consider such issues in the licensing determination.
The NPRM specifically sought comments on how the FAA could
standardize and better implement the ``complete enough'' application
standard. Sierra Nevada inquired whether the FAA will still conduct a
complete enough review. Sierra Nevada concurred with the FAA's approach
in conducting complete enough reviews but commented that the FAA should
specify a timeline for these reviews. SpaceX commented that the FAA
should aim to conduct its complete enough review within ten days of
receipt of submission and apply that standard to submissions for
continuing accuracy, renewals, and modifications. Furthermore, Sierra
Nevada asserted that the review should be included in the FAA's
statutory 180-day review period or a new, defined timeline. CSF and
SpaceX recommended that the complete enough standard in current Sec.
413.11 be expanded to apply to any application submission, including
the initial license application, continuing accuracy submissions, and
modification submissions. CSF and SpaceX suggested regulatory text
changes to Sec. 413.11 to this end. Both commenters also requested the
FAA issue an AC that that explains how the agency makes the complete
enough determination, including a checklist comprising regulatory
sections that require submissions. Virgin Galactic recommended that
what constitutes ``complete enough'' be agreed upon by both the
applicant and the FAA during the pre-application consultation phase and
provided several changes to the regulatory text.
The FAA will continue to use the complete enough standard to
determine whether a license is sufficiently complete to begin review.
The FAA endeavors to make these determinations within 14 calendar days
of receiving an application. Limiting the FAA to ten days, as suggested
by SpaceX, may not provide adequate time for review. The FAA begins the
calculation of the 180-day statutory review period on the date that it
receives the information needed to make the application complete
enough, regardless of how long it takes to make that determination. The
FAA does not base this calculation on the date it determines that the
application is complete enough. The complete enough standard applies to
any submission, including those for license modifications for
consistency. The FAA has applied this standard to submissions for
license modifications and, when necessary, requested additional
information and clarifications to allow it to proceed with its
evaluation. Section 450.211(c) states that an application to modify a
license must be prepared and submitted in accordance with part 413.
Therefore, Sec. 413.11 is applicable to an initial license application
submission and license modification submissions and does not need to be
modified to apply to any application submission. The FAA will work
closely with applicants on a case-by-case basis to determine what
changes may be made without invalidating the license. In accordance
with Sec. 450.211(c), the licensee must apply to the FAA for
modification of the license once a license has been issued, except for
the allowable changes identified by the FAA. An operator may propose an
alternate method from part 413 to request a license modification. This
alternate method could include an agreed-upon submittal schedule and
FAA review period.
It should be noted that Sec. 450.211 (Continuing Accuracy of
License
[[Page 79580]]
Application; Application for Modification of License) also covers
license modification submissions related to continuing accuracy. The
FAA will provide an AC that includes application checklists that an
applicant can choose to use to help guide application submittal.
However, additional information may be needed depending on the type of
operation.
In response to Virgin Galactic's comments, the FAA agrees that
dialogue as to what constitutes ``complete enough'' can be part of the
pre-application consultation, but disagrees that any change in the
regulatory text is required. One of the primary purposes of pre-
application consultation is to provide the applicant guidance in
preparing its license application. Although the FAA determines when an
application is complete enough to begin its review, the FAA expects to
develop collaboratively agreed upon criteria with an applicant for
determining ``complete enough'' during pre-application consultation. By
allowing applicants and the FAA to negotiate criteria for ``complete-
enough'' during pre-application, the FAA anticipates applicants will be
able to more predictably track their progress toward completing the
application.
CSF and SpaceX also suggested that the FAA provide a substantive
response to submittals within 30 days of receiving the application. CSF
also suggested the FAA provide status updates to an applicant every two
weeks.
The FAA already typically provides written response to submittals
within 30 days, often much sooner. In some instances, however, the FAA
requires more than 30 days to draft a response, especially for highly
technical analyses. The FAA also provides a substantive response to an
applicant in writing whenever additional information is required and,
therefore, does not see a compelling rationale for a requirement to
provide status updates on a predetermined schedule. However, FAA
recognizes the concerns expressed by operators regarding extended
delays between communications in certain circumstances. While the FAA
does not believe establishing a specific time period for communication
to applicants is a necessary component of its regulatory framework, it
also recognizes the need for applicants to stay informed and
anticipates communicating with applicants throughout the application
process, including procedural changes to ensure applicants will be
provided a status update within 14 days of receipt of an application.
c. Compliance Period for Legacy Licenses (Sec. 450.1(b))
In the NPRM, under proposed Sec. 450.1(b) and subject to two
exceptions, the FAA would permit an operator to conduct a launch or
reentry pursuant to a license issued by the FAA under parts 415,\22\
431, and 435 before the effective date of the new part 450 or an
application accepted by the FAA before the effective date of part 450.
Even though the operator could continue to conduct operations under the
regulations in effect at the time of license or application as
referenced above, the proposed requirements under Sec. Sec. 450.169
for collision avoidance analysis (COLA) and 450.101(a)(4) and (b)(4)
for critical asset protection would apply to all operators subject to
the FAA's authority under 51 U.S.C. chapter 509 conducting launches
after the effective date of the new regulations. The FAA would
determine the applicability of part 450 to an application for a license
modification submitted after the effective date of the part on a case-
by-case basis based on the extent and complexity of the modification,
whether the applicant proposes to modify multiple parts of the
application, or if the application requires significant reevaluation.
---------------------------------------------------------------------------
\22\ The FAA notes that an operator operating under a license
issued under part 415 would also be subject to the requirements of
part 417.
---------------------------------------------------------------------------
The FAA adopts Sec. 450.1 (Applicability) with revisions. The FAA
does not adopt Sec. 450.1(b) as proposed in the NPRM. While the FAA
adopts the concept as proposed in Sec. 450.1(b) in parts 415, 417,
431, and 435, it also makes corresponding changes to Sec. Sec. 413.23
and 415.3 to limit the duration of all licenses issued or renewed to no
more than five years after the effective date of part 450. The FAA
refers to these licenses as ``legacy licenses'' throughout this
preamble. After that time, all operators must come into compliance with
the new regulations. In the final rule, the FAA makes numerous
revisions to certain regulations that apply to operators conducting
operations under parts 415, 417, 431, and 435. These revisions include
amending Sec. 401.5 title to read ``Definitions as Applied to Parts
415, 417, 431, 435,'' adding new Sec. 401.7 for definitions, updating
Sec. 413.1, and amending parts 415, 417, 431, 435, 440, and 460 to
reference compliance with part 450.
The FAA notes that certain definitions in Sec. 401.5 apply to
parts 415, 417, 431, and 435. Therefore, because the FAA will allow
operators that hold an approved license at the time this rule goes into
effect, or an accepted license application within 90 days after the
effective date of the final rule, to operate under parts 415, 417, 431,
and 435 for up to five years, this rule preserves Sec. 401.5 without
change. Section 401.5 will be removed five years after the effective
date of the final rule.
The FAA adds Sec. 401.7, which contains the definitions that apply
to Chapter III other than parts 415, 417, 431, and 435, and which
broadly captures those changes proposed in Sec. 401.5 in the NPRM. The
FAA notes that parts 415, 417, 431, and 435 and Sec. 401.5 will be
removed five years after the effective date of the final rule.
Part 413 explains how to apply for a license or experimental
permit. In the final rule, the FAA amends the table in Sec. 413.1(b)
to identify that the requirements in parts 415, 417, 431, and 435 apply
only to applicants whose launch or reentry license has been approved or
license application has been accepted by the FAA no later than 90 days
after the effective date of the final rule. As previously mentioned,
operators holding an approved launch or reentry license, or who have an
accepted launch or reentry license application may choose to continue
to operate under parts 415 and 417, part 431, and part 435, until five
years after the effective date of this rule. The FAA also adds ``Launch
and Reentry License Requirements'' as a subject in the table in Sec.
413.1(b). Finally, the FAA adopts the provision that the FAA may grant
a request to renew a license issued under parts 415, 417, 431 or with a
non-standard duration in proposed Sec. 450.1(b) and re-designates it
as Sec. 413.23(a)(2) in the final rule. Specifically, the FAA may
grant a request to renew a under parts 415, 431, and 435 with a non-
standard duration so as not to exceed five years after the effective
date of this rulemaking. The FAA adds an applicability section to parts
415, 431, and 435. These parts apply to such licenses issued before the
effective date of the final rule and licenses issued on or after the
effective date of the final rule if the FAA accepted the application
under Sec. 413.11 no later than 90 days after the effective date. All
operators must comply with the COLA and critical asset protection
requirements in part 450.
In the final rule, the FAA adds the phrase ``pursuant to a license
issued under part 415 of this chapter'' to the scope in Sec. 417.1(a).
The FAA also removes Sec. 417.1(e), which addresses grandfathering
that is no longer used from when part 417 was first established. For
the same reason, the FAA also removes the grandfathering
[[Page 79581]]
reference to paragraph (e) in Sec. 417.1(f). As a result of this
amendment, the FAA re-designates Sec. 417.1(f) and (g) as Sec.
417.1(e) and (f) in the final rule.
The FAA further revises Sec. Sec. 417.11 and 431.73 in the final
rule. The FAA adds a paragraph stating that the Administrator may
determine that a modification to a license issued under these parts
must comply with the requirements in part 450. The Administrator will
base the determination on the extent and complexity of the
modification, whether the applicant proposes to modify multiple parts
of the application, or if the application requires significant
evaluation.
The FAA revises Sec. 440.3, which addresses definitions. In the
final rule, Sec. 440.3 references the definitions contained in
Sec. Sec. 401.5 and 401.7. The reference to Sec. 401.5 will be
removed from Sec. 440.3 five years after the effective date of the
final rule.
Finally, the FAA revises Sec. 460.45 to identify which mishap
definitions an operator should apply in the description of the safety
record of the vehicle to each space flight participant. Specifically,
Sec. 460.45(d)(1) addresses licenses issued under part 450. For these
licenses, the operator's safety record must cover events that meet
paragraphs (1), (4), (5), and (8) of the definition of a ``mishap'' in
Sec. 401.7 that occurred during and after vehicle verification
performed in accordance with Sec. 460.17. Section 460.45(d)(2)
addresses licenses issued under parts 415, 431, or 435. For these
licenses, the operator's safety record must cover launch and reentry
accidents and human space flight incidents as defined by Sec. 401.5.
Section 460.45(d)(1) will be re-designated to Sec. Sec. 460.45(d) and
460.45(d)(2) will be removed from Sec. 460.45 five years after the
effective date of the final rule.
Several commenters asked for clarity on the FAA's approach in Sec.
450.1(b) to legacy licenses issued under the current regulations. CSF
objected to requiring renewals of licenses issued under the current
regulations to meet the requirements of proposed part 450, as this
would result in significant cost and regulatory burdens for the
operator and the FAA.
As previously noted, the FAA does not adopt Sec. 450.1(b) in the
final rule. However, the FAA implements the concept as proposed in
Sec. 450.1(b) in parts 415, 417, 431, and 435. In the final rule, the
FAA establishes a five-year period after the effective date of this
rule. Operators holding either an active license or an accepted license
application no later than 90 days after the effective date of this rule
may operate under the applicable regulatory provisions upon which the
licensing determination was made. In addition, these operators may
submit requests for license renewals within that five-year period and
will be required to comply with the regulations under which the license
determination was made.\23\ The FAA has revised Sec. Sec. 413.23 and
415.3 to reflect that no license issued under parts 415, 431 or 435
will be renewed with an expiration date that extends beyond the five-
year period. As such, applications for renewal submitted near the end
of the five-year period will be valid only for a short time. All
operators will need to comply with this rule in its entirety five years
after its effective date.
---------------------------------------------------------------------------
\23\ As noted, all operators are also required to comply with
the critical assets and COLA provisions of part 450 beginning from
the effective date of this rule.
---------------------------------------------------------------------------
CSF noted that operators under current parts 431 and 435 would need
to come into compliance with the proposed part 450. Similarly, Virgin
Galactic requested that FAA allow currently licensed operators to be
grandfathered into part 450 for vehicles that cannot meet certain part
450 requirements as long as the current public safety requirements are
met. Virgin Galactic stated that, unlike ELV operators, RLV operators
use their vehicles repeatedly, and the FAA has not shown why it is
necessary for current operators to undergo new analyses and possible
design changes. Virgin Galactic noted that the FAA's aviation
regulations allow for ``true'' grandfathering. Virgin Galactic
commented that if the FAA chooses not to allow for ``true''
grandfathering, it should work with each licensee during pre-
application consultation to determine applicability of the new rule to
modifications to current licenses.
The FAA notes that as the final rule is more performance-based than
the rule as proposed in the NPRM, many of the current requirements
would serve as a means of compliance to meet the new regulations. The
FAA anticipates that there would be few, if any, additional
requirements that will not be fulfilled by previously submitted
information. The FAA will not allow operating under parts 415, 417,
431, and 435 indefinitely because the current rule is more streamlined,
performance-based, and up-to-date than the previous regulations.
Therefore, the FAA will require all operators to come into compliance
with the new rule five years after the effective date. The FAA will
consult with existing licensees shortly after the final rule is
published to assist operators with the transition to part 450 so they
may take advantage of the significant number of new flexibilities.
CSF objected to the lack of clarity on grandfathering and
recommended that the FAA make clear that a licensee approved under the
current licensing regime may continue to renew its approvals, with no
significant changes, without having to apply under part 450. License
renewals without significant changes may continue to be renewed, but
not to exceed the five-year compliance period.
Operators currently holding an active, valid license will have five
years after the effective date of this rule to come into compliance
with the entirety of part 450. If a license expires before the end of
this period, an applicant may seek a renewal under the previous
provisions in parts 415, 417, 431, and 435, but the renewal will only
be valid for however much time remains between the time of issuance of
the renewal and the end of the five-year period.
Virgin Galactic recommended the FAA hold a pre-application phase
for all current license holders to ensure that licensees and the FAA
are in agreement as to whether the FAA would require part 450
requirements or parts 415, 417, 431, and 435 requirements when an
operator requests to modify a legacy license once part 450 becomes
effective.
During the five-year compliance period, an operator may need to
modify its legacy license. The provisions that relate to modification
are contained in Sec. Sec. 417.11 and 431.73. Whether or not new
license modifications need to comply with part 450 is subject to
Administrator approval on a case-by-case basis, which can be determined
during consultation with the FAA before the applicant requests the
modification. In making the determination as to whether a license
modification is necessary to comply with the new requirements, the
Administrator will consider the extent and complexity of the
modification, whether the licensee would need to modify multiple parts
of the application, or if the license requires significant
reevaluation. The FAA encourages licensees to consult with the FAA on
transitioning to part 450 in advance of the compliance period deadline.
d. Definition and Scope of Launch (Sec. 450.3)
In the NPRM, the FAA proposed to set the scope of activity
authorized by a vehicle operator license by identifying the beginning
and end of launch in
[[Page 79582]]
Sec. 450.3 (Scope of Vehicle Operator License).\24\
---------------------------------------------------------------------------
\24\ The FAA proposed to move the beginning and end of launch
and reentry language from the definition of ``launch'' in Sec.
401.5 to proposed Sec. 450.3.
---------------------------------------------------------------------------
i. Beginning of Launch
In Sec. 450.3(b)(1) and (b)(2), the FAA proposed that launch
begins under a license with the start of hazardous activities that pose
a threat to the public at a U.S. launch site. The proposed rule further
stated that, unless agreed to by the Administrator, those hazardous
pre-flight ground operations would commence when a launch vehicle or
its major components arrive at a U.S. launch site. For a non-U.S.
launch site, the FAA proposed that launch begins at ignition or first
movement that initiates flight.
In the final rule, the FAA adopts proposed Sec. 450.3(b)(1) and
(b)(2) with revisions. First, the FAA does not adopt the proposed
default that hazardous ground pre-flight operations commence when a
launch vehicle or its major components arrive at a U.S. launch site.
The final rule identifies certain activities that qualify as hazardous
pre-flight operations, including but not limited to, pressurizing or
loading of propellants into the vehicle or launch system, operations
involving a fueled launch vehicle, the transfer of energy necessary to
initiate flight, or any hazardous activity preparing the vehicle for
flight. Second, this rule also clarifies that hazardous pre-flight
operations do not include the period between the end of the previous
launch and launch vehicle reuse when the vehicle is in a safe and
dormant state. Finally, this rule adds language in Sec. 450.3(a) that
allows the Administrator to agree to a scope of license different from
that laid out in Sec. 450.3(b), as discussed later in this document.
An applicant wishing to deviate from the scope of license parameters
laid out in Sec. 450.3(b) would discuss the deviation during pre-
application consultation. The FAA would only allow a deviation for
unique operations where the scope of license continued to cover those
hazardous launch activities identified by statute.
CSF, SpaceX, and Virgin Galactic suggested proposed Sec.
450.3(b)(1) be revised to remove reference to the arrival of major
components at a U.S. launch site as beginning of launch. Virgin
Galactic noted that the beginning of hazardous pre-flight ground
operations should be determined only on a case-by-case basis and
commented that the arrival of components at a launch site was an
inappropriate prescriptive default limit chosen for administrative
convenience. CSF, SpaceX, and Virgin Galactic also requested that the
FAA limit the beginning of hazardous pre-flight operations only to
include potential threats to the public over which no other Federal
regulatory agency has jurisdiction.
The FAA agrees that the beginning of pre-flight ground operations
should be determined on a case-by-case basis because each operation is
unique. The FAA recognizes that with this flexibility comes some
ambiguity as to when launch will begin for each unique operation. The
designation of when launch begins is important for both operators and
the FAA. Among other things, the financial responsibility protections
apply from beginning to end of launch. Therefore, a clear understanding
of when launch begins is essential for an operator to understand fully
its responsibilities under chapter III and for the FAA to satisfy its
obligations, including the calculation of maximum probable loss (MPL).
Because the proposed default beginning of launch, phrased as
``arrival of major components at a U.S. launch site,'' is removed from
Sec. 450.3(b)(1) in the final rule, an application requirement is
added to Sec. 450.3(d) to require an operator to identify the scope of
the license being sought in the application, specifically pre- and
post-flight ground operations. The final rule requires an applicant
intending to launch from a U.S. launch site to identify pre- and post-
flight ground operations such that the FAA is able to determine when
the launch operation would begin and end. This requirement applies only
to launches from a U.S. launch site, as launches from a non-U.S launch
site begin at ignition or first movement that initiates flight. The FAA
anticipates that an applicant would identify hazardous pre- and post-
flight operations that are reasonably expected to pose a risk to the
public. During pre-application consultation, the applicant is expected
to describe to the FAA its launch site and its intended concept of
operations leading up to a launch, including any operations that are
potentially hazardous to the public. Once the FAA and the applicant
have a clear, mutual understanding of the applicant's concept of
operations, the FAA and the applicant will agree on a starting point
for hazardous pre-flight operations, and thus, the beginning of launch.
The applicant will provide that information in its application and
scope its application materials based on this starting point. The scope
of the license lends itself to the first module of an incremental
review.
The FAA also agrees that the arrival of components at the launch
site is an unnecessarily prescriptive baseline that may not constitute
the threshold for hazardous pre-flight operations for all launches.
Therefore, the FAA revises Sec. 450.3(b)(1) to remove the reference to
arrival of components at a launch site. Because the beginning of launch
is an important designation upon which many licensee responsibilities
rely, the FAA has added to the regulatory text certain activities that
constitute hazardous pre-flight operations. The list of hazardous pre-
flight operations added to the final regulatory text is derived from
the preamble text in the NPRM explaining the proposal.\25\ Hazardous
pre-flight operations include, but are not limited to, pressurizing or
loading of propellants into the vehicle or launch system, operations
involving a fueled launch vehicle, the transfer of energy necessary to
initiate flight, or any hazardous activity preparing the vehicle for
flight. This list is not exhaustive, and during pre-application
consultation the FAA or an applicant may identify an activity not
included in this list that poses a hazard to the public and may
constitute the beginning of launch. The FAA retains the ability to
determine that licensed oversight is unnecessary for certain activities
if the Administrator determines that they do not jeopardize public
health and safety, safety of property, and the national security and
foreign policy interests of the United States.
---------------------------------------------------------------------------
\25\ See 84 FR at 15361.
---------------------------------------------------------------------------
The FAA further amends Sec. 450.3(b)(1) to indicate clearly that
activities occurring between launches of reusable vehicles will not be
considered hazardous pre-flight activities if the vehicle is in a safe
and dormant state. Generally, a launch system is in a safe and dormant
state when it is not undergoing the pressurizing or loading of
propellants, a transfer of energy necessary to initiate flight,
operations involving a fueled launch vehicle, or any other hazardous
activity preparing the vehicle for flight. The NPRM preamble discussed
the exemption of RLVs if a vehicle is in a safe and dormant state.\26\
---------------------------------------------------------------------------
\26\ See 84 FR at 15359.
---------------------------------------------------------------------------
One commenter suggested the definition of beginning of flight for
hybrid vehicles be changed to include the first forward motion of the
vehicle with the intent for takeoff.
The FAA agrees that the beginning of flight for a hybrid vehicle is
the first forward motion of the vehicle with the
[[Page 79583]]
intent to takeoff. However, the FAA will continue to use ``first
movement that initiates flight'' to define beginning of the flight
phase of launch because it better accommodates all vehicle types.
Regarding the FAA's jurisdiction over launch activities at a non-
U.S. launch site, CSF stated that proposed Sec. 450.3(b)(2) could be
problematic for captive carry technologies for which an operator must
comply with the oversight of foreign aviation authorities. CSF
suggested removing reference to ``the first movement that initiates
flight.''
The FAA does not adopt CSF's recommendation because the current
regulation is flexible enough to accommodate all launch vehicle
technologies at non-U.S. sites, as well as comprehensive enough to
protect public safety. Starting launch at ignition will not capture the
full flight of the captive carry hybrid vehicle system. The FAA
regulates all of the components of a hybrid vehicle system, including
any captive carry operations under a license; however, as discussed
earlier, the flexibility in Sec. 450.3(a) for the Administrator to
adjust the scope of license applies to Sec. 450.3(b)(2) as well. In
the case of a unique operation for which hazardous activities begin
later than first movement or ignition, the Administrator may agree to a
different beginning of launch for that operation.
Virgin Galactic recommended that the FAA continue to avoid
duplicating oversight and memorialize that commitment in its
description of the beginning of launch as starting when hazardous pre-
flight ground operations commence at a U.S. launch site that pose a
threat to the public and over which no other Federal regulatory agency
has jurisdiction.
The FAA has amended the regulation to address duplicative oversight
at Federal launch or reentry sites in the final rule. These changes are
discussed in the preamble section addressing launch and rentries from a
Federal launch or reentry site. The FAA does not agree with the comment
that launch under this chapter may only begin at a site over which no
other Federal agency has jurisdiction. In fact, many sites, such as
Federal sites or launch sites co-located at airports, may be subject to
the jurisdiction of multiple Federal agencies depending on the types of
activities that are conducted.
ii. End of Launch
In the NPRM, the FAA proposed to amend the definition of end of
launch to remove reference to RLVs and ELVs. Although it did not
receive comment on this proposal specifically, the FAA makes the
following additional changes to the end of launch language: The
addition of ``vehicle component'' and ``impact or landing'' throughout
to ensure the definition captures a broader variety of operations; and
the addition of ``deployment'' in Sec. 450.3(b)(3) to include
operations for which a payload remains on the vehicle. Under Sec.
450.3(b)(3) and (c), the FAA replaces each use of ``vehicle stage'' in
the proposed rule in recognition of the fact that components other than
vehicle stages may return to Earth. Examples include a discarded engine
or payload fairing. In addition, throughout Sec. 450.3(b)(3) and (c),
the FAA includes ``impact or landing'' in the end of launch and reentry
sections in the scope of license requirements where the proposal only
referred to one or the other or failed to reference either. With the
increasing efforts to reuse components, including both impact and
landing throughout Sec. 450.3(b)(3) and (c) encompasses a broader
range of activities because landing includes a soft vertical landing or
runway landing of a vehicle or component, whereas impact is more
accurate to describe a hard landing of a stage or component. Under
Sec. 450.3(b)(3)(ii), the FAA adds that, for an orbital launch of a
vehicle with a reentry of the vehicle, launch may also end ``after
vehicle component impact or landing on Earth, after activities
necessary to return the vehicle or component to a safe condition on the
ground after impact or landing.'' This additional language accommodates
a carrier vehicle landing after the completion of the orbital part of
the launch.
CSF, SpaceX, and Virgin Galactic expressed confusion regarding
proposed Sec. 450.3(b)(3), and requested clarity regarding proposed
Sec. 450.3(b)(3)(iv), including when reentry applies to suborbital
vehicles and end of launch. The FAA introduced suborbital reentry in
its experimental permit final rulemaking in 2007. In that rulemaking,
the FAA stated that:
A suborbital rocket may engage in reentry. For most suborbital
launches, whether the flight entails a reentry will not matter from
a regulatory perspective. The FAA will authorize the flight under a
single license or permit, implementing safety requirements suitable
to the safety issues involved. Recognizing suborbital reentry
matters for two reasons. First, if a suborbital rocket is flown from
a foreign country by a foreign entity into the United States, that
entity may require a reentry license or permit from the FAA,
depending on whether the planned trajectory of the rocket includes
flight in outer space. Second, a permanent site that supports the
landing of suborbital rockets may now be considered a reentry site
depending, once again, on whether the planned trajectory reaches
outer space.\27\
---------------------------------------------------------------------------
\27\ See 72 FR 17001, 17002.
The NPRM did not propose any change to this framework, and no
change is made in the final rule.
Virgin Galactic commented that the FAA should include specific
parameters for suborbital reentry. Virgin Galactic also recommended
additional regulatory language specifying that, for a suborbital
reentry, reentry ends when each vehicle has returned to Earth and has
been returned to a safe condition as defined in the operator's
application documents. As noted earlier, a suborbital reentry requires
flight into outer space.
This distinction does not change when launch ends for a suborbital
vehicle because, whether a vehicle or vehicle component impacts or
lands on Earth due to a launch or reentry, the launch or reentry would
end at the same point in time; namely, after activities necessary to
return the vehicle or vehicle component to a safe condition on the
ground after landing. (See Sec. 450.3(b)(3)(iv) and (c)).
CSF and SpaceX suggested that orbital launch without a reentry in
proposed Sec. 450.3(b)(3)(i) did not need to be separately defined by
the regulation, stating that, regardless of the type of launch,
something always returns: Boosters land or are disposed, upper stages
are disposed. CSF and SpaceX further requested that the FAA not
distinguish between orbital and suborbital vehicles for end of launch.
The FAA does not agree because the distinctions in Sec.
450.3(b)(3)(i) and (ii) are necessary due to the FAA's limited
authority on orbit. For a launch vehicle that will eventually return to
Earth as a reentry vehicle, its on-orbit activities after deployment of
its payload or payloads, or completion of the vehicle's first steady-
state orbit if there is no payload, are not licensed by the FAA. In
addition, the disposal of an upper stage is not a reentry under 51
U.S.C. Chapter 509, because the upper stage does not return to Earth
substantially intact.
The FAA proposed in Sec. 450.3(b)(3)(ii) that for an orbital
launch of a vehicle with a reentry of the vehicle, launch ends after
deployment of all payloads, upon completion of the vehicle's first
steady-state orbit if there is no payload, after vehicle component
impact or landing on Earth, after activities necessary to return the
vehicle or component to a safe condition on the ground after impact or
landing, or after activities necessary to return the site to a safe
condition, whichever occurs later. The final rule changes ``if there is
no payload'' to ``if there is no payload
[[Page 79584]]
deployment'' to clarify the FAA's intent on how to determine the end of
launch for a vehicle carrying no payload or payloads that stay onboard
a vehicle.
Both CSF and SpaceX proposed ``end of launch'' should be defined on
a case-by-case basis in pre-application consultation and specified in
the license. The FAA disagrees, in part. The FAA only regulates on a
case-by-case basis if the nature of an activity makes it impossible for
the FAA to promulgate rules of general applicability. This need has not
arisen, as evidenced by decades of FAA oversight of end-of-launch
activities. That said, because the commercial space transportation
industry continues to innovate, Sec. 450.3(a) gives the FAA the
flexibility to adjust the scope of license, including end of launch,
based on unique circumstances as agreed to by the Administrator. Unique
circumstances may include, but are not limited to, unconventional
technologies like railguns that may use innovative launch and reentry
procedures requiring adjustments to a scope of license.
Finally, CSF pointed out that in the proposed rule, for hybrid
vehicles, end of launch did not mention the recovery of carrier
aircraft.
Section 450.3(b)(3) distinguishes orbital vehicles with and without
a reentry, and suborbital vehicles with and without a reentry. A
separate section for end of launch for hybrid vehicles is unnecessary
because the same parameters apply to hybrids as apply to non-hybrid
vehicles regarding end of launch. The FAA also acknowledges that the
end-of-launch parameters do not mention the recovery of a carrier
aircraft. Again, it is unnecessary to include this distinction because,
during launch, a carrier aircraft is considered part of the launch
vehicle.\28\ Therefore, to the extent that Sec. 450.3(b)(3) refers to
activities necessary to return the vehicle or component to a safe
condition on the ground after impact or landing, this reference will
include returning the carrier aircraft to a safe condition after impact
or landing.\29\
---------------------------------------------------------------------------
\28\ See Legal Interpretation to Pamela Meredith from Mark W.
Bury, Assistant Chief Counsel for International Law, Legislation and
Regulations (Sept. 26, 2013); available at https://www.faa.gov/about/office_org/headquarters_offices/agc/practice_areas/regulations/interpretations/Data/interps/2013/Meredith-ZuckertScoutt&Rasenberger%20-%20(2013)%20Legal%20Interpretation.pdf.
\29\ See Legal Interpretation to Laura Montgomery from Lorelei
Peter, Assistant Chief Counsel for Regulations (Dec. 10, 2019);
available at https://www.faa.gov/about/office_org/headquarters_offices/agc/practice_areas/regulations/interpretations/Data/interps/2019/Montgomery-Ground%20Based%20Space%20Matters%20-%202019%20Legal%20Interpretation.pdf.
---------------------------------------------------------------------------
Blue Origin asked how the FAA plans to prevent disparate impacts of
the proposed rule on those operators at multiuse facilities and at U.S.
facilities. While the meaning of disparate impacts is unclear, the FAA
construes the commenter as asking how the FAA will distinguish between
launch and non-launch (e.g., manufacturing or refurbishment of pre-
flown stages) activities at a launch site. Because launch begins with
the start of hazardous pre-flight ground operations that prepare a
vehicle for flight, an operator may manufacture or refurbish launch
vehicle components or perform certain other activities on a launch site
without requiring an FAA authorization during the time after the end of
the launch and before hazardous operations begin for the next launch.
This treatment is consistent with existing practice prior to this rule:
a vehicle operator could theoretically perform non-launch related
activities on a launch site without needing a license as long as those
activities are not in the scope of the license and do not pose a risk
to public safety.
The Airline Pilots Association (ALPA) suggested the FAA define
``family of vehicles.''
The FAA does not define ``family of vehicles'' in this final rule
because the industry continues to innovate and it would be premature to
attempt to classify all types of vehicle families for the emerging and
still-evolving commercial space industry. As discussed in the NPRM,
launch operators often define ``family of vehicles'' themselves.
Usually, the vehicles have similar base operational characteristics,
but each member of the family may be capable of different performance
characteristics.
AAAE and Denver International Airport believed that operating at a
specific site should necessitate a separate and thorough review from
the FAA, and that operators should not be able to receive one license
covering multiple sites.
The FAA will perform a thorough and complete review of all sites
where a vehicle is authorized to operate. An applicant will not be able
to add another location to its license ``with a lesser review
standard'' as described by the commenter. A licensee will have to meet
all applicable regulations for all sites authorized in a license.
Denver International Airport cited 49 U.S.C 50904(d) to argue the FAA
lacked statutory authority to grant a vehicle operator permission to
operate from multiple launch and/or reentry sites on a single license.
The FAA believes Denver International Airport meant to cite 51 U.S.C.
50904(d), which states that the Secretary of Transportation (the
``Secretary'') shall ensure that only 1 license or permit is required
from the DOT to conduct activities, including launch and reentry. The
law does not prohibit the FAA from issuing a license that allows an
operator to conduct an approved operation from various sites. Rather,
section 50904(d) merely prevents the FAA from requiring multiple
licenses for the same type of activity for which a license or permit is
required under title 51 chapter 509.
e. Safety Element Approval (Part 414)
In the NPRM, the FAA proposed to change the part 414 term from
``safety approval'' to ``safety element approval'' to distinguish it
from ``safety approval'' as used in parts 415, 431, 435, and 450. Also,
the NPRM proposed to modify part 414 to streamline the process by
enabling applicants to request a safety element approval in conjunction
with a license application. The final rule adopts the changes as
proposed.
Several commenters expressed general support for the FAA's proposed
regulations regarding safety element approvals in part 414. Blue Origin
concurred with the FAA's proposal and anticipated many benefits to an
applicant's ability to submit a separate safety element approval. One
individual commented that more extensive use of these approvals could
increase operator flexibility and significantly simplify the licensing
process for future launches.
Virgin Galactic recommended an operator that already holds a
license be able to use previously submitted data to apply for a safety
element approval. Virgin Galactic also noted that the language in the
first sentence of proposed Sec. 414.23 should be changed from ``safety
approval'' to ``safety element approval'' to reflect the updated
terminology.
The FAA agrees that an operator that already holds a license may
use previously submitted data to apply for a safety element approval.
Just as is the case with a license application or modification, an
applicant can reference previously submitted data in its safety element
approval application. The applicant will need to specify clearly what
it is referencing and indicate the referenced material is still valid.
In addition, the FAA has corrected ``safety approval'' to ``safety
element approval'' in Sec. Sec. 414.23 and 414.3.
An individual commenter suggested a new definition for safety
element approvals for hybrid vehicles. The commenter suggested the
definition include a reference to hybrid vehicle components that are
critical to avoiding
[[Page 79585]]
or mitigating hazards to the public, including vehicle characteristics.
The FAA does not agree that it should add a separate definition of
``safety element approvals'' specifically for hybrid vehicles. The
definition of ``safety element approval'' is broad enough to encompass
approvals for hybrid and non-hybrid vehicle systems. The definition
already includes the phrase ``any identified component thereof,'' which
includes a carrier vehicle. The FAA agrees that it is possible to craft
a safety element approval for the types of hazard control strategies
employed by hybrid vehicles. The FAA notes that the definition of a
``safety element'' includes launch vehicle, reentry vehicle, safety
system, process, service, or any identified component thereof; or
qualified and trained personnel performing a process or function
related to licensed activities or vehicles. This definition would allow
a hybrid operator to apply for a wide range of safety element
approvals.
Regarding process, a joint set of comments submitted by Boeing,
Lockheed Martin, Northrop Grumman, and ULA stated an operator should
not be required to apply to the FAA to transfer a safety element
approval under proposed Sec. 414.33 when the transfer is due to a
corporate transaction, reorganization, or restructure that does not
affect the material content of the original application.
The FAA will apply the same standard for application, transfer, and
issuance of a safety element approval as it does for a license. Name
changes and internal corporate restructuring do not typically require a
license transfer and therefore will not require a safety element
approval transfer.
Microcosm, Inc. (Microcosm), inquired as to how the FAA will issue
a safety element approval. The FAA will issue a safety element approval
applied for concurrently with a part 450 license in accordance with
part 414.
f. Vehicle Operator License--Issuance, Duration, Additional License
Terms and Conditions, Transfer, and Rights Not Conferred (Sec. Sec.
450.5 Through 450.13)
In the NPRM, the FAA proposed requirements addressing the issuance,
duration, and transfer of a vehicle operator license in proposed
Sec. Sec. 450.5 (Issuance of a Vehicle Operator License), 450.7
(Duration of a Vehicle Operator License), and 450.11 (Transfer of a
Vehicle Operator License), respectively. The FAA also proposed
requirements addressing the addition and modification of licensing
terms in proposed Sec. 450.9 (Additional License Terms of Conditions).
Finally, the FAA proposed requirements describing those rights that
would not be conferred by a vehicle operator license in proposed Sec.
450.13 (Rights Not Conferred by a Vehicle Operator License). The FAA
proposed these rules to consolidate the requirements for different
types of launch and reentry licenses in parts 415, 431, and 435 into a
single vehicle operator license.
AIA and Sierra Nevada commented that the FAA should not be allowed
to make modifications to the terms and conditions of a license except
within a limited time frame and subject to specified procedures to
ensure reasonable notice and due process to the vehicle operator. The
FAA will not adopt this recommendation and retains the provision in
Sec. 450.9 that allows the FAA to modify a vehicle operator license at
any time by modifying or adding license terms and conditions to ensure
compliance with the Act and its implementing regulations. This
provision was introduced in 1999 in 14 CFR 415.11 because the FAA
recognized that a particular licensee's launch (or reentry) may present
unique circumstances that were not covered by the license terms and
conditions in place. Because such a modification would be based on
unique circumstances, the FAA is unable to specify a timeline as
requested by the commenter.
In the final rule, the FAA adopts these requirements as proposed
and adds specificity to Sec. 450.11 to indicate that either the holder
of a vehicle operator license or the prospective transferee may request
a vehicle operator license transfer, both the holder and prospective
transferee must agree to the transfer, and the FAA will provide written
notice of its determination to the person requesting the vehicle
operator license transfer. These additions mirror the language used for
the transfer of a safety element approval and reflect current practice.
The FAA did not receive any comments on these proposed
requirements.
3. Part 450 Subpart B--Requirements To Obtain a Vehicle Operator
License
a. Incremental Review and Determinations (Sec. 450.33)
In the NPRM, the FAA proposed to amend part 413 and to include
provisions in part 450 to allow an applicant the option for an
incremental review of all portions of its application. This proposal
was in response to the ARC recommendations. Specifically, the FAA
proposed to amend Sec. 413.15 (Review Period) to provide that the time
frame for any incremental review and determinations would be
established with an applicant on a case-by-case basis during pre-
application consultation. As stated in the NPRM, the FAA did not
propose to reduce by regulation the statutory review period of 180
days.
In the final rule, the FAA provides clarification on the basis the
Administrator would consider when approving an incremental approach.
In the NPRM, the FAA sought comment on how a formal incremental
review process would account for the statutory 180-day review period
when application increments or modules are likely to be submitted and
reviewed at different times, other useful guidelines for applicants
crafting incremental approaches, and any safety approval sections that
would be appropriate for incremental review. The FAA did not receive
any comments with feasible solutions on any of these topics.
Several commenters expressed support for the FAA's proposed
incremental review process, stating that it would increase flexibility.
Virgin Galactic supported the FAA's proposed approach to incremental
review and commented that it aligned with many other approval processes
in other divisions of the FAA.
Many commenters, including Leo Aerospace, Microcosm, Sierra Nevada,
SpaceX, and Virgin Orbit asked about the duration of incremental review
periods. Noting the FAA's statutory mandate to issue a license
determination not later than 180 days after accepting an application,
commenters inquired whether each module would be subject to this 180-
day review period. Several commenters, including CSF and Sierra Nevada,
stated they interpret the 180-day statutory requirement to mean that
the sum total of all module reviews must not exceed 180 days.
Commenters noted that if every module was subject to a 180-day review,
the process would be very time-intensive.
Until the FAA has more experience with the incremental review
process, the FAA will review each module in accordance with a schedule
discussed with the prospective applicant during pre-application
consultation. In developing the incremental review schedule, the FAA
will consider the interdependence of parts of the evaluation and the
sequence of their submissions. The FAA makes these criteria explicit in
this rule in Sec. 450.33 (Incremental Review and
[[Page 79586]]
Determinations) paragraphs (b)(1) and (b)(2).\30\
---------------------------------------------------------------------------
\30\ These criteria derived from the discussion in the preamble
to the NPRM on what an applicant should consider when proposing an
incremental approach. In relevant part, the NPRM stated: ``1.
Application increments submitted at different times should be not be
dependent on other increments to the extent practicable. 2.
Application increments should be submitted in a workable
chronological order. In other words, an applicant should not submit
an application increment before a separate application increment on
which it is dependent. For example, the FAA would not expect to
agree to review a risk analysis before reviewing a debris analysis
or probability of failure analysis because the risk analysis is
directly dependent on the other two analyses.'' 84 FR at 15366.
---------------------------------------------------------------------------
Review of any modules prior to submittal of an application in its
entirety will not initiate or be bound by the statutory 180-day review
period. Rather, an agreed upon review period will begin once the FAA
has a complete enough application in its entirety. During pre-
application consultation, an applicant seeking an incremental review
may negotiate a time frame shorter than the statutory 180-day review
period. As the FAA gains more experience with the incremental review
process, it may develop guidance concerning expected timelines for
various sequences of modular submissions.
Sierra Nevada commented that, if a module is denied, proposed Sec.
413.21 (Denial of a License or Permit Application) should allow the FAA
to extend the review period by up to 60 days to consider a revised
application. The commenter noted it supports the FAA's practice of
tolling the review period in the case of a deficient application as
long as the applicant understands the deficiency and what must be
submitted for the FAA to continue its review. Leo Aerospace inquired
whether an application would be considered accepted after the
incremental process is defined, or after the last step of the
incremental process is completed, and asked how an operator would be
notified if its safety review was accepted.
Sierra Nevada's interpretation of incremental review is incorrect
because a module cannot be denied under Sec. 413.21. If the FAA
determines a module does not contain sufficient information, the FAA
and the applicant will discuss amending the agreed upon incremental
review schedule to allow time for the applicant to submit a revised
module. An applicant will be notified in writing when its complete
application has been accepted.
Sierra Nevada noted the primary concern with module time frames was
the transparency of the FAA's license application process and the
ability for operators to reduce operational risk associated with the
various time frames. To that end, a number of commenters, including
Sierra Nevada, Leo Aerospace, and SpaceX, requested the FAA provide an
outline of acceptance and review timelines and example timelines for
incremental applications. CSF and Sierra Nevada agreed with the FAA's
proposal to establish the timeline for incremental submissions in the
pre-application phase but suggested the FAA include in an AC its goal
for maximum review time frames for particular modules. CSF and Sierra
Nevada recommended the AC include the following time frames: 60 days
for policy approval; 30 days for payload review; 60 days for safety
approval; 5 days for environmental assessment; and 15 days for
financial responsibility assessment. CSF and Sierra Nevada noted that
the FAA's review of the environmental assessment should only take 5
days because the FAA has had insight into the contractor used to
conduct the environmental assessment, and the FAA's review should
therefore simply be a verification that the applicant has submitted the
final product. CSF and Sierra Nevada acknowledged that the financial
responsibility assessment could take longer than 15 days for methods
other than obtaining insurance, but stated that this possibility could
be mitigated by the FAA's providing guidance that addresses the type of
information that a licensee would need to submit to satisfy FAA review
under Sec. 440.9(f).
Commenters suggested that time frames for incremental review should
be based on the complexity of the review and that they should be
shorter than the statutory limit for the review of a complete
application. Specifically, Virgin Galactic commented time frames should
be based on the complexity of the item being reviewed. Sierra Nevada
recommended modules be subject to a shorter review time frame than full
application reviews and to define that time frame in Sec. 413.15.
Sierra Nevada stated the FAA should consider a shorter timeline of 90
days for review of a license application in order to meet the direction
in Space Policy Directive-2 to streamline the review process.
The FAA declines to incorporate the suggested time frame changes
because they will not provide adequate time for the FAA to assess
application materials for completeness in all situations and for all
potential applications. The FAA agrees that modules will likely be
reviewed faster than an entire application, and that review times will
depend largely on complexity; however, at this point it is premature to
define those time frames until FAA has more experience with incremental
reviews. The FAA will not at this time adopt maximum time frames,
because each evaluation is a unique review that must be adjusted to
each operation. The FAA's evaluation of the safety implications of an
application typically requires the most effort and time, usually far
more than the 60 days suggested by the commenters. The MPL is derived
from the safety analysis and cannot be completed independently of it.
An environmental review must be completed before a license can be
issued. Particularly for new operations, the environmental process can
be lengthy, and the FAA advises applicants to begin it early, even
before a license application is submitted. For example, an applicant
must submit a completed environmental impact statement (EIS) prepared
by the FAA (or an FAA-selected and managed consultant contractor), FAA-
approved environmental assessment (EA), categorical exclusion
determination, or written re-evaluation as part of its application
materials. The 180-day statutory application review period is not
intended to encompass the time needed for the applicant to develop the
necessary application materials, including environmental documentation.
Five days may not be enough time to evaluate an environmental document,
such as a complex EA.
For conventional operations that do not pose substantial policy-
related challenges, policy and payload reviews can be conducted in less
time than the safety review. However, these reviews are often performed
concurrently with the safety review so their completion typically does
not reduce the overall time required to reach a license determination.
As the FAA gains more experience with the incremental review process,
it may elect to update guidance to reflect timelines that have
consistently proven effective.
Submitting an application incrementally affords an applicant the
approval of various systems and processes earlier than the current non-
incremental review process. The FAA expects that the central value of
an incremental approach is regulatory certainty for components of the
application and flexibility for applicants rather than a reduction in
overall review time. However, the FAA anticipates that a determination
of an accepted application that utilizes safety element approvals or
approved modules will be completed faster than a similar application
that does not use safety element approvals or incremental review.
[[Page 79587]]
Sierra Nevada recommended that an AC should also address the type
of information a licensee would need to submit for the FAA's financial
responsibility review. The financial responsibility requirements
contained in part 440 are beyond the scope of this rulemaking. However,
the financial responsibility requirements are adequately addressed in
Appendix A to Part 440--Information Requirements for Obtaining a
Maximum Probable Loss Determination for Licensed or Permitted
Activities. Virgin Galactic recommended the FAA take into account FAA
AVS \31\ Project Specific Certification Plans to inform the incremental
review process in proposed part 414. The FAA will discuss project-
specific information, including AVS documents, during pre-application
consultation.
---------------------------------------------------------------------------
\31\ AVS is the FAA's Office of Aviation Safety.
---------------------------------------------------------------------------
Virgin Galactic also inquired how the operator would be notified
when the operator's safety review has been accepted or rejected. The
FAA will inform an applicant in writing as to whether each module is
accepted or rejected.
b. Means of Compliance (Sec. 450.35)
In the NPRM, the FAA proposed that an applicant would be required
to use an accepted means of compliance for the following requirements:
Highly reliable FSS, FSA methods, lightning flight commit criteria, and
airborne toxic concentration and duration thresholds for both flight
and ground hazards. For these requirements, the means of compliance
would need to be accepted by the FAA prior to the submission of an
application. For all other performance-based requirements, an applicant
would be able to use a means of compliance proposed in an application.
While the final rule maintains that an applicant must use an
accepted means of compliance in an application for specified
requirements, the FAA has made amendments to the structure of the
regulatory text to identify more clearly that the use of accepted means
of compliance is an application requirement. This requirement is now
specified in Sec. 450.35(a) of the final rule.
As stated above, for those five sections now identified in Sec.
450.35, an applicant must use a means of compliance in its application
that has been reviewed and accepted by the Administrator. The FAA will
not accept an application that uses a means of compliance that has not
already been accepted by the Administrator for any of the five
requirements listed in Sec. 450.35. The five requirements listed in
Sec. 450.35 are essential to public safety and involve well-
established and complex methodologies, thresholds, or practices.
Because of the complex nature and public safety impact of these
requirements, the FAA would be unable to review unique means of
compliance for these five requirements during its application
evaluation within its review time frame. Rather, an applicant could
choose to use an accepted means of compliance in its evaluation, or
could submit a unique means of compliance for review and acceptance
prior to submitting its application. Unique means of compliance for the
requirements identified in Sec. 450.35 may require evaluation before
they are accepted as demonstrating fidelity and safety, however this
rule allows unique means of compliance for these sections to be
submitted in advance of a license application in order to provide
flexibility and enable innovative concepts. For all other sections of
part 450, an applicant may propose in its application a means of
compliance that has not been previously accepted by the Administrator,
and the FAA will review the means of compliance as part of its
application review process. It is worth noting that an applicant who
uses means of compliance that have already been accepted by the FAA in
its license application will likely experience a more expeditious
license review and determination.
A means of compliance is one means, but not the only means, by
which a requirement can be met and may be used to demonstrate
compliance with any of the performance-based requirements. For all
performance-based requirements other than those listed in Sec. 450.35,
an applicant may include a unique means of compliance in an application
for the FAA to review during the application evaluation. In the NPRM
docket,\32\ the FAA included a table listing all publicly available
means of compliance for each proposed performance-based requirement
(the ``Means of Compliance Table'') in subpart C that the FAA has
accepted to date. An applicant need not include the entirety of an
accepted means of compliance standard in an application, but may
instead reference the accepted means of compliance using identifying
features such as title and date or version.
---------------------------------------------------------------------------
\32\ See FAA-2019-0229-0018.
---------------------------------------------------------------------------
Several commenters interpreted the NPRM as only allowing the means
of compliance listed in the Means of Compliance Table. Conversely, the
CSF commented that applying means of compliance flexibility only to the
regulations cited in the Means of Compliance Table would be too
limited, and should be expanded. The CSF also requested that the FAA
remove or correct the preamble text to reflect that any applicant can
seek to add an accepted means of compliance to the Means of Compliance
table. The CSF specifically mentioned that the FAA should allow
flexible means of compliance to meet the conditional expected casualty
calculation in proposed Sec. 450.101(c). SpaceX also commented that
the FAA should expand the scope of flexible means of compliance and
specifically identified proposed Sec. 450.101(c).
The FAA emphasizes that any requirement in part 450 can have one or
more means of compliance. The Means of Compliance Table provides one
way, but not the only way, to meet the requirements in part 450. The
conditional expected casualty thresholds in proposed Sec. 450.101(c)
were intended as safety criteria to measure and protect against
potential high consequence events. In the final rule, the FAA has
clarified Sec. 450.101(c) to allow alternative demonstrations of high
consequence event mitigation. This change is discussed in detail later
in the preamble. The FAA will review the submitted means of compliance
to determine whether they satisfy the regulatory safety standard. These
means of compliance may be government standards, industry consensus
standards, or unique means of compliance developed by an individual
applicant. For government standards or means of compliance developed by
a consensus standards body, the FAA will provide public notice of those
accepted means of compliance that it determines satisfy the
corresponding regulatory requirement. The FAA will also review unique
means of compliance developed by an individual applicant to determine
whether they satisfy the regulatory requirement.
Once a means of compliance is accepted by the FAA, it may be used
to demonstrate compliance with the corresponding regulatory
requirement. An updated Means of Compliance Table will be placed on the
docket once the final rule publishes. This updated table identifies the
means of compliance accepted by the FAA at this time for the
corresponding regulation. This table will be made available on the FAA
website and updated as additional means of compliance are accepted by
the FAA. Unique individual operator-developed means of compliance will
not be included in the Means of Compliance Table to protect proprietary
information,
[[Page 79588]]
unless the operator that developed the means of compliance requests
that its means of compliance be included.
CSF requested that the FAA clarify that it would not require
compliance with an untailored RCC 319 \33\ in order to demonstrate
reliability. Blue Origin commented that the preamble does not address
accepted means of compliance as a standalone flexibility measure. CSF
and SpaceX commented that the proposed rule risks being quickly
outdated and could discourage innovation because it does not allow
tailoring of the requirements.
---------------------------------------------------------------------------
\33\ The Range Commanders Council (RCC) addresses the common
concerns and needs of operational ranges within the United States.
It works with other government departments and agencies to establish
various technical standards to assist range users. RCC 319 provides
for the safety of people and missions during launch and flight
operations.
---------------------------------------------------------------------------
This rule does not require compliance with an untailored RCC 319 in
order to demonstrate reliability; however, at this time, RCC 319 is the
only accepted means of compliance for flight abort with a highly
reliable FSS under Sec. 450.145. An applicant may propose a tailored
version of any accepted means of compliance, including RCC 319. If an
applicant wishes to tailor RCC 319, the applicant must propose its
tailored means of compliance as a unique means of compliance in advance
of its license application. An applicant may include any unique means
of compliance as part of its license application, other than those
sections identified in Sec. 450.35(a) that require a means of
compliance to be accepted prior to application submittal. An applicant
may also propose a unique means of compliance to meet these
requirements in advance of its license application.
An individual commenter recommended that the FAA allow tailoring
and include a clause to attend United States Air Force (USAF) tailoring
meetings as part of meeting parts 415 and 417 requirements. As noted
earlier, the FAA does allow tailoring. Part 450 will not change the
FAA's current practice of attending tailoring meetings.
Virgin Galactic also recommended that the current part 417
appendices and range analyses continue to satisfy the requirements in
part 450, and that the FAA complete its Launch Site Safety Assessments
(LSSAs) in order for operators to know which Federal launch or reentry
site's analyses and processes the FAA would find acceptable as means of
compliance. ULA commented that the rule should more clearly allow work
performed by another Federal agency to meet FAA requirements.
The part 417 appendices that can be used as an accepted means of
compliance to part 450 requirements are listed in the Means of
Compliance Table in the docket. The FAA agrees that it needs to
determine and communicate to the industry which Federal launch or
reentry site analyses and processes satisfy part 450. As noted earlier,
the FAA will accept any safety-related launch or reentry service
provided by a Federal launch or reentry site or other Federal entity by
contract, as long as the FAA determines that the launch or reentry
service satisfies part 450.
The New Zealand Space Agency (NZSA) and Virgin Galactic asked what
process and standards the Administrator would employ for accepting
means of compliance. Virgin Galactic asked what accepted means of
compliance would be and whether the Administrator would use means of
compliance that have not been published. Virgin Galactic also stated
that means of compliance would need to be published prior to any work
being performed that would require the means of compliance. Northrup
Grumman supported the publication of newly accepted means of
compliance.
The FAA will provide public notice of each publicly available means
of compliance that the Administrator has accepted by posting the
acceptance on its website. This notification will communicate to the
public and the industry that the FAA has accepted a means of compliance
or any revision to an existing means of compliance. The FAA will not
post unique means of compliance documents with proprietary information
submitted by applicants, unless specifically authorized by the
applicant. The applicant may wish to consider offering its unique means
of compliance to a consensus standards body for inclusion as part of an
industry-developed consensus standard. The final rule does not adopt
proposed Sec. 450.35(b), which stated that the FAA would provide
public notice of each means of compliance that the Administrator has
accepted. The FAA removes this requirement because it is not a
licensing requirement.
Proposed Sec. 450.35(c) is amended and renumbered as Sec.
450.35(b). The provision is renumbered because the final rule removes
the proposed Sec. 450.35(b), as discussed previously. In the final
rule, Sec. 450.35(b) allows a person to submit a means of compliance
to the FAA for review outside the licensing process. The means of
compliance must be submitted in a form and manner acceptable to the
Administrator. The proposed rule limited this provision to applicants,
whereas the final rule would allow any person to request acceptance of
a proposed means of compliance. This is because the FAA anticipates
other people or entities other than applicants may wish to submit a
proposed means of compliance, such as operators that plan to be
applicants in the future, and voluntary consensus standards bodies. The
FAA wants to enable this. Section 450.35(b) is limited to requests for
acceptance of a proposed means of compliance outside a license
application, because the license application process is already defined
in parts 413 and 450. Lastly, the FAA changes the modifier in front of
``means of compliance'' from ``alternative'' to ``proposed.'' The term
``proposed'' is better suited to the types of means of compliance the
FAA would expect from this provision.
The process the FAA employs to accept a means of compliance will be
set forth in guidance. \34\ When submitting a unique means of
compliance, an applicant's proposal should identify the regulation that
the proposed means of compliance will address and provide the rationale
as to why it demonstrates compliance with the applicable regulation.
When reviewing a unique means of compliance, the FAA will consider past
engineering practices, the technical quality of the proposal to
demonstrate compliance with the part 450 regulations, the safety risk
of the proposal, best practice history, and consultations with
technical specialists for additional guidance.
---------------------------------------------------------------------------
\34\ See AC 450.35-1, Means of Compliance.
---------------------------------------------------------------------------
NZSA and Virgin Galactic asked how the FAA would protect an
operator's proprietary information when publishing means of compliance.
NZSA recommended that the FAA retain the ability to share, with consent
of the applicant, information about the means of compliance used to
issue a license that may include proprietary information.
As a general matter, the FAA does not share proprietary data with
the public. The FAA will treat any proprietary data linked to a unique
means of compliance in the same manner as it protects proprietary data
that an applicant uses to support a license application.
An individual commenter suggested the development of a Space Safety
Institute to develop industry consensus standards. A consensus
standards body, any individual, or any organization would be able to
submit means of compliance documentation to the FAA for consideration
and potential acceptance. The FAA recommends that in developing
standards, a voluntary
[[Page 79589]]
consensus standards body consider the processes outlined in OMB
Circular A-119.
c. Use of Safety Element Approval (Sec. 450.39)
In the NPRM, the FAA proposed Sec. 450.39 (Use of Safety Element
Approval) to allow an applicant to use any vehicle, safety system,
process, service, or personnel for which the FAA has issued a safety
element approval under part 414 without the FAA's reevaluation of that
safety element during a license application evaluation to the extent
its use is within its approved envelope. The proposed rule would also
change the part 414 term from ``safety approval'' to ``safety element
approval'' to distinguish it from ``safety approval'' as used in parts
415, 431, and 435, and proposed part 450, because these terms have
different meanings.
In the final rule, the FAA replaces the word ``envelope'' with the
word ``scope.'' ``Scope'' more accurately captures ``envelope,
parameter, or situation'' as used in the definition of ``safety element
approval.'' For consistency, the same change is made in Sec. 437.21.
d. Policy Review (Sec. 450.41)
In the NPRM, the FAA proposed to remove the requirement that
applications include, for the purpose of conducting a policy review,
information related to the structural, pneumatic, propulsion,
electrical, thermal, guidance, and avionics systems used in the launch
vehicle and all propellants. Instead, in order for the FAA to conduct
its policy review, the FAA proposed that an applicant identify the
launch or reentry vehicle and its proposed flight profile and describe
the vehicle by characteristics that include individual stages, its
dimensions, type and amounts of all propellants, and maximum thrust. In
the final rule, the FAA adopts Sec. 450.41 (Policy Review and
Approval) as proposed.
Boeing, Lockheed Martin, Northrop Grumman, Sierra Nevada, and ULA
suggested the FAA change the word ``normal'' in proposed Sec.
450.41(e)(4)(iv) to ``nominal'' to be consistent with industry
vernacular.
The FAA disagrees with this suggestion because the FAA seeks a
range of possible impact areas in this section, not a particular impact
point inferred by the use of ``nominal.''
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the
FAA add to Sec. 450.41(b)(3) the phrase ``but not limited to'' in
order to allow the FAA to consult Federal agencies other than the
National Aeronautics and Space Administration (NASA).
The FAA disagrees that the additional language is needed to clarify
that the FAA may consult Federal agencies other than NASA pursuant to
Sec. 450.41(b)(3). The term ``include'' implies the phrase ``but not
limited to.''
The FAA notes, consistent with current practice, that if a launch
or reentry proposal would potentially jeopardize U.S. national security
or foreign policy interests, or international obligations of the United
States, the FAA may seek additional information from an applicant in
support of interagency consultation to protect U.S. Government
interests.
An individual commenter recommended the FAA require licensees to
comply with the Committee on Space Research's planetary protection
policy (COSPAR PPP) as a means of ensuring that commercial launches
comply with the Outer Space Treaty and of resolving existing gaps in
the statutory prohibition on obtrusive advertising in outer space.
The FAA acknowledges the commenter's concerns, but the scope of
this rulemaking does not encompass COSPAR's PPP or the statutory
prohibition on obtrusive advertising.
e. Payload Reviews (Sec. 450.43)
In the NPRM, the FAA proposed to consolidate payload review
requirements, remove the requirement to identify the method of securing
the payload on an RLV, add application requirements to assist the
interagency review, such as the identification of approximate transit
time to final orbit and any encryption, clarify the FAA's relationship
with other Federal agencies for payload reviews, and modify the 60-day
notification requirements currently found in Sec. Sec. 415.55 and
431.53.
The FAA stated in the NPRM preamble that, while it would review all
payloads to determine their effect on the safety of launch, the FAA
will not make a determination on those aspects of payloads that are
subject to regulation by the Federal Communications Commission (FCC) or
the Department of Commerce or on payloads owned or operated by the U.S.
Government. In addition, the proposed rule added informational
requirements that would include the composition of the payload and any
hosted payloads, anticipated life span of the payload in space, any
planned disposal, and any encryption associated with data storage on
the payload and transmissions to or from the payload. Finally, the NPRM
proposed to preserve the ability of payload operators to request a
payload review independent of a launch license application. The FAA
sought comments on the approach of including more requirements for a
payload review in the regulation in order to expedite payload review
application processing, but received none.
In the final rule, the FAA adopts Sec. 450.43 (Payload Review and
Determination) with revisions. The FAA adds the term, ``if
applicable,'' to Sec. Sec. 450.31(a)(3) and 450.43(a) to clarify that
a payload review is not always required. The FAA notes that all
payloads include any hosted or secondary payloads.
The Commercial Smallsat Spectrum Management Association (CSSMA)
suggested that the FAA adopt a sixty (60) day timeline for independent
payload review. CSSMA found little incentive for a payload owner or
operator to use the independent payload review process, absent a fixed
timeline for such payload reviews. CSSMA also recommended language that
would render Sec. 413.21(a) (Denial of a License or Permit) applicable
to independent payload reviews.
The FAA declines to revise Sec. 413.21(a) as suggested because the
payload review is a requirement to obtain a launch or reentry license
under part 450. The FAA notes that a favorable payload determination
does not itself constitute a license. As such, the procedures set forth
in Sec. 413.21(a) do not apply to payload reviews, whether conducted
independently of or in conjunction with a license application.
The FAA also declines to incorporate CSSMA's suggested timeline for
review. The FAA has not specified a timeline to complete payload
reviews independent of a license application because, historically,
payload owners or operators have requested such reviews for unique
missions that have raised novel concerns regarding public health and
safety, safety of property, or national security or foreign policy
interests of the United States. Because independent payload reviews
often raise complex issues and often require extensive interagency
consultation, the FAA cannot anticipate a standard timeline for payload
reviews conducted independently from a license application.
Accordingly, FAA will not establish a standard timeline for such
reviews in its regulations. Applicants are encouraged to discuss
timelines to review their particular proposals during pre-application
consultation.
NZSA requested the FAA include in the final rule all legislative or
regulatory standards by which the FAA will assess payloads at the
application stage. NZSA stated that doing so would give owners
[[Page 79590]]
of novel payloads and non-U.S. operators regulatory certainty on the
standards they must meet to be launched on a vehicle licensed by the
FAA. As one example of a rule that would affect payload review but did
not appear in proposed Sec. 450.41, NZSA cited the prohibition on
launching payloads for ``Obtrusive Space Advertising.''
The FAA declines to expand the bases for issuing an unfavorable
payload determination beyond those set forth in Sec. 450.43(a). It
would not be practical to list every law, regulation, and policy that
may possibly affect a proposed payload under Sec. 450.43. Rather,
applicants are required to complete a pre-application consultation
during which the FAA can learn about the proposed action and advise the
applicant on a path forward, including any U.S. regulations, laws, or
policies that may impact its proposal. Payload owners and operators may
also use the independent payload review process set forth in Sec.
450.43(d), which provides greater regulatory certainty for novel
payloads.
Virgin Galactic suggested the FAA treat payloads that stay within a
vehicle as additional equipment on the launch vehicle, subject only to
the safety analysis required of any other piece of equipment on board a
launch vehicle. Virgin Galactic commented that requiring a payload
review for items not ejected from a launch vehicle places an
unnecessary burden on operators and the FAA. Virgin Galactic also
requested clarification on seemingly contradictory language in the NPRM
preamble regarding a payload placed in outer space versus a payload
that remained on or within the vehicle.
The FAA disagrees with Virgin Galactic's suggestion. Payloads that
(1) stay within a vehicle, (2) do not contain hazardous materials, or
(3) have previously been approved may require less scrutiny but are
still being placed in outer space and therefore meet the 14 CFR 401.5
definition of ``payload'' and require a payload review. Under 51 U.S.C.
50904(c), the FAA must verify that all licenses, authorizations, and
permits required for a payload have been obtained; and that the
proposed launch or reentry will not jeopardize public health and
safety, safety of property, U.S. national security or foreign policy
interests, or international obligations of the United States. The FAA
therefore declines to exclude from the requirement to obtain a payload
review any payload that remains on the vehicle.
Virgin Galactic recommended the FAA amend proposed Sec.
450.31(a)(3), which seemed to require favorable payload determinations
for any launch or reentry, noting that not all vehicles carry payloads.
Absent this amendment, Virgin Galactic commented it would need to seek
a waiver for each non-payload flight, creating an unnecessary burden.
The FAA agrees that an applicant does not need to seek a payload
determination if the proposed launch or reentry will not involve a
payload. Therefore, the FAA revises Sec. 450.31(a)(3) by adding the
phrase, ``if applicable.''
Space Logistics, LLC (Space Logistics) urged the FAA to coordinate
with other Federal agencies before expanding its payload review process
in order to avoid duplicating activities. Space Logistics noted that
the requirements to describe encryption associated with a payload's
data storage and transmissions and to provide any information deemed
necessary by the FAA under proposed Sec. 450.43(i) were open-ended and
may duplicate requirements of the FCC, NASA, the National Oceanic and
Atmospheric Administration (NOAA), or Office of Space Commerce (OSC).
The FAA agrees with Space Logistics's comment that Federal agencies
must continue to streamline requirements applicable to commercial space
activities and work closely to eliminate duplicative requirements and
minimize review times for policy and payload issues. The FAA has
engaged its Federal partners in this rulemaking process in order to
minimize duplication. For instance, the FAA proposed to require that
applicants provide encryption data (in Sec. 450.43(i)(1)(x)) in part
to support the Department of Defense (DOD) review of payloads for
impacts to national security. Encryption information allows the DOD to
assess impacts on national security due to potential cyber intrusion or
loss of vehicle control. Through its interagency coordination, the FAA
endeavors not to request information already provided to other Federal
agencies.
Boeing, Lockheed Martin, Northrop Grumman, and ULA suggested adding
to proposed Sec. 450.43(a) a requirement for FAA coordination with the
applicable Federal agency to ensure that the payload will not interfere
with or impede launch, on[hyphen]orbit operations, or reentry of other
approved missions. The commenters stated this addition would avoid
adverse impacts to other federally-approved missions or operating
systems.
Although the FAA agrees that coordination with applicable Federal
agencies is important to ensure a payload or payload class will not
interfere with agency operations, the FAA disagrees that the
recommended addition to Sec. 450.43(a) is necessary. The interagency
coordination required for both payload and license application review,
coupled with the criteria set forth in Sec. 450.43(a)(1) and (a)(2),
adequately addresses the commenters' concerns. Those provisions direct
that the FAA will issue a favorable payload determination if (1) the
applicant, payload owner, or payload operator has obtained all required
licenses, authorizations, and permits; and (2) the launch or reentry of
the payload would not jeopardize public health and safety, safety of
property, U.S. national security or foreign policy interests, or
international obligations of the United States. The FAA notes,
consistent with current practice, that if a payload or payload class
presents a potential risk to an agency's asset or other mission, the
FAA may seek additional information from an applicant on behalf of the
agency to protect U.S. Government interests and assets consistent with
these two objectives. However, in light of commenters' concerns, the
FAA is working with the appropriate agencies to increase transparency
and support the development of agency guidance on the interagency
consultation process during a payload review. The FAA also plans to
publish its own guidance on payload review, in the form of an Advisory
Circular, which will reference NASA, DOD, or other agency guidance.
Insight into the interagency process will help operators anticipate
what questions and concerns may arise during interagency consultation,
which may vary depending on the operation, and will allow operators to
be better prepared to address any potential issues during payload
review. To the extent the commenters intended to address space traffic
management or access-to-space issues, such matters exceed the scope of
this rulemaking.
Boeing suggested the FAA refrain, in proposed Sec. 450.43(b)(2),
from issuing a determination on payload components owned, sponsored, or
operated by the U.S. Government. Similarly, Boeing, Lockheed Martin,
Northrop Grumman, and ULA recommended the FAA exclude from the review
requirement in proposed Sec. 450.31(a)(3) any payloads that have
undergone safety review or received approval by another Federal agency.
The FAA declines to exclude from review under Sec. 450.43(b)
payloads that are sponsored by the U.S. Government. Section
450.43(b)(2) excludes payloads owned or operated by the U.S.
[[Page 79591]]
Government. Payloads that are not owned or operated by the U.S.
Government may not have undergone the same scrutiny, and hence the FAA
review is warranted. The FAA also disagrees with the recommended change
to Sec. 450.31(a)(3). Although the FAA does not make a determination
on those aspects of payloads that are subject to regulation by other
Federal agencies, the FAA does review all payloads to determine their
effect on the safety of launch, which may differ from the purpose of
another agency's payload review. As such, no change from the proposal
is made.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended
adding to the agencies listed in proposed Sec. 450.43(e)(3) the FCC,
NOAA, and the National Telecommunications and Information
Administration. The commenters also proposed adding to the interagency
consultation process set forth in proposed Sec. 450.43(e) a
requirement that the FAA consult with Federal launch or reentry sites
to coordinate facility information for MPL determination, and to
coordinate collision avoidance analysis with the cognizant Federal
agency, when the launch or reentry activity is not on a Federal launch
or reentry site. The commenters stated that operators should not have
to obtain and provide Federal site facility information, which is often
sensitive and not available to commercial operators.
The FAA disagrees that the recommended addition to Sec.
450.43(e)(3) is necessary. The list of agencies that the FAA consults
with under Sec. 450.43(e) is not exhaustive and does not preclude
consultation with any other Federal entity in order to ensure that a
payload meets the criteria set forth in Sec. 450.43. With respect to
the recommendation for the FAA to add the interagency consultation
process to its MPL determination, current regulations address
coordination. In addition, changes to part 440 are outside the scope of
the rulemaking. In accordance with 14 CFR 440.7(b), the FAA consults
with Federal agencies that are involved in, or whose personnel or
property are exposed to risk of damage or loss as a result of, a
licensed activity and obtains any information needed to determine
financial responsibility requirements. Similarly, collision avoidance
analysis is conducted wholly outside of the payload review. Part 450
provides for coordination of collision avoidance analyses with the
cognizant Federal agency, though this coordination is primarily
conducted on a launch-by-launch basis, and well after the payload
review process, which often occurs during the application review
process.
f. Safety Review and Approval (Sec. 450.45)
i. Launch and Reentries From a Federal Launch or Reentry Site (Sec.
450.45(b))
In the NPRM, to address concerns regarding duplicative government
requirements at Federal launch or reentry sites, the FAA proposed
largely performance-based requirements for both ground and flight
safety that an operator could meet using Air Force and NASA practices
as means of compliance. The FAA pointed out that it issues a safety
approval to a license applicant proposing to launch from a Federal
launch or reentry site if the applicant satisfies the requirements of
part 415, Subpart C (Safety Review and Approval for Launch from a
Federal Launch Range), and has contracted with the Federal site for the
provision of safety-related launch services and property, as long as an
FAA LSSA shows that the site's launch services and launch property
satisfy part 417. The FAA did not refer to the LSSA process in the
regulatory text in proposed part 450. The FAA did propose, in Sec.
450.45 (Safety Review and Approval) paragraph (b), that the FAA would
accept any safety-related launch or reentry service or property
provided by a Federal launch or reentry site or other Federal entity by
contract, as long as the FAA determined that the launch or reentry
services or property provided satisfy part 450.
The FAA adopts Sec. 450.45(b) as proposed, with one revision. The
FAA changes the reference to ``Federal range'' to ``Federal launch or
reentry site'' throughout part 450, to include NASA and DOD launch and
reentry sites.
As discussed in the NPRM preamble, the FAA assesses each Federal
launch or reentry site and determines if the Federal site meets FAA
safety requirements. If the FAA assessed a Federal launch or reentry
site and found that an applicable safety-related launch service or
property satisfies FAA requirements, then the FAA treats the Federal
site's launch service or property as that of a launch operator's, and
there is no need for further demonstration of compliance to the FAA.
The FAA reassesses a site's practices only when the site changes its
practice. The final rule maintains the position discussed in the NPRM,
namely that these performance-based regulations allow an operator to
use DOD and NASA practices as a means of compliance. In addition, this
rule introduces a provision that allows operators operating from
certain Federal sites to opt out of demonstrating compliance with the
FAA's ground safety requirements.
CSF and Space Florida submitted comments indicating their
dissatisfaction with the NPRM's approach to reducing duplication
regarding launch from a Federal launch or reentry site. ULA encouraged
the FAA to reduce duplication between the FAA and Federal sites.
Northrop Grumman commented that the FAA should accept the Federal
launch or reentry site safety processes as satisfying FAA requirements
because it was reasonable to presume changes to launch range
regulations would continue to provide for safe pre-flight and flight
operations on Federal launch or reentry sites. Similarly, SpaceX stated
that part 450 or its supporting documents should reference agreements
between the FAA and other Federal entities, including the USAF, which
allow each agency to accept the analyses and technical determinations
of the other. Blue Origin commented that it looks forward to
understanding the contents of any agreements between the ranges and the
FAA.
Another individual commenter raised similar concerns that the FAA's
proposed licensing regulations do not resolve long-standing issues with
duplicative and overlapping rules burdening commercial launch operators
at the KSC and CCAFS. CSF stated that duplicative or conflicting rules
among overlapping Federal jurisdictions create a barrier to entry for
small startups and unnecessarily increase the cost of space access to
all users by forcing all providers either to pass those costs on to
their customers (including the U.S. Government) or to be denied the
availability of new capabilities due to lack of bandwidth and
resources. CSF argued that this burden will drive internationally-
competed business to other countries to avoid the cost or schedule
impacts arising from duplicative, conflicting, and overlapping sets of
rule. CSF also argued the FAA did not address the overlapping
jurisdiction of the FAA and other Federal and State agencies (the
Occupational Safety and Health Administration (OSHA), the Environmental
Protection Agency (EPA), the Bureau of Alcohol, Tobacco, Firearms and
Explosives (ATF), and their State and local equivalents) for hazardous
ground operations.
The FAA does not agree with the comment that the FAA is duplicating
oversight with other agencies such as OSHA, EPA, and ATF. Commercial
space activities may be subject to the
[[Page 79592]]
jurisdiction of multiple Federal agencies depending on the types of
activities that are being conducted. OSHA, EPA, and ATF may regulate or
provide oversight for different aspects of an operation without
duplicating FAA oversight. The authority for protecting public health
and safety, safety of property, and national security and foreign
policy interests of the United States during commercial space launches
and reentries remains solely with the FAA.
In the interest of removing duplicative authorities, CSF suggested
the FAA should acknowledge when other agencies have jurisdiction over
activities and not duplicate that oversight. SpaceX recommended that
instead of the FAA's determining that the launch or reentry services or
property provided by a Federal launch or reentry site or other Federal
entity satisfy part 450, the FAA should just determine that the site
operations are in good standing.
In the final rule, an operator may meet part 450's performance-
based requirements using DOD and NASA practices that have been accepted
by the FAA as a means of compliance. An applicant would reference in
its application those DOD or NASA requirements or procedures accepted
as means of compliance. The 2015 Commercial Space Launch
Competitiveness Act directed the Secretary of Transportation to consult
with the Secretary of Defense, Administrator of NASA, and other
agencies, as appropriate, to identify and evaluate requirements imposed
on commercial space launch and reentry operators to protect the public
health and safety, safety of property, national security interests, and
foreign policy interests of the United States. It also directed the
Secretary of Transportation to resolve any inconsistencies and remove
any outmoded or duplicative Federal requirements or approvals
applicable to any commercial launch of a launch vehicle or commercial
reentry of a reentry vehicle.\35\ The FAA has worked closely with DOD
and NASA in developing part 450 to minimize any need for a DOD or a
NASA facility to impose additional requirements.\36\ The FAA will
continue to work with DOD and NASA in reviewing means of compliance
that involve these Federal entities' practices to ensure those
practices continue to satisfy the FAA's part 450 requirements. The FAA
expects that there will be few, if any, instances in which DOD or NASA
practices do not satisfy part 450's performance-based requirements. In
addition, part 450 should provide enough flexibility to accommodate
changes in DOD and NASA practices in the future.
---------------------------------------------------------------------------
\35\ Public Law 114-90--Nov. 25, 2015 U.S. Commercial Space
Launch Competitiveness Act.
\36\ Note that the John S. McCain National Defense Authorization
Act for Fiscal Year 2019 (NDAA) includes a provision stating that
the Secretary of Defense may not impose any requirement on a
licensee or transferee that is duplicative of, or overlaps in intent
with, any requirement imposed by the Secretary under 51 U.S.C.
chapter 509, unless imposing such a requirement is necessary to
avoid negative consequences for the national security space program.
---------------------------------------------------------------------------
In addition to issuing performance-based requirements that an
operator could meet using DOD and NASA practices as means of
compliance, the FAA has addressed concerns regarding duplicative
government requirements by modifying its approach to ground safety at
certain Federal sites. For ground safety, the Administrator may
determine that the Federal launch or reentry site's ground safety
processes, requirements, and oversight are not inconsistent with the
Secretary's statutory authority over commercial space activities.
Therefore, under Sec. 450.179 (Ground Safety--General) paragraph (b),
an operator is not required to comply with the ground safety
requirements of part 450 if:
(1) The launch or reentry is being conducted from a Federal launch
or reentry site;
(2) The operator has contracted with the Federal launch or reentry
site for ground safety services or oversight; and
(3) The Administrator has determined that the Federal launch or
reentry site's ground safety processes, requirements and oversight are
not inconsistent with the Secretary's statutory authority over
commercial space activities.
In making the determination to accept the Federal site's processes
without specific compliance with ground safety regulations, under Sec.
450.179(c), the Administrator will consider the nature and frequency of
launch and reentry activities conducted from the Federal launch or
reentry site, coordination between the FAA and the Federal launch or
reentry site safety personnel, and the Administrator's knowledge of the
Federal site's requirements. The FAA will consider the nature and
frequency of the activity in order to evaluate a site's level of
experience with different types of launch and reentry operations. An
example of the ``nature'' of the launch and reentry activities would be
that a site's experience with non-toxic or non-explosive propellant
might not qualify the site for an exemption from FAA ground safety
requirements involving toxic or explosive materials. The FAA makes this
change to respond to the direction of SPD-2, the National Space
Council, and the recommendation of the ARC to address duplicative
requirements across Federal agencies for commercial space licensing.
In the final rule, an operator need not comply with the ground
safety requirements contained in Sec. Sec. 450.181 (Coordination with
a Site Operator) through 450.189 (Ground Safety Prescribed Hazard
Controls) if the conditions in Sec. 450.179(b) are met. In making this
change, the FAA preserves its statutory jurisdiction over those ground
safety activities that are part of launch and reentry, but recognizes
certain Federal processes and procedures as sufficient to meet the
FAA's mandate.
For Sec. 450.179(b) to apply, an operator must conduct launch or
reentry activities from a Federal launch or reentry site. The FAA
limits the applicability of this provision to certain Federal sites,
such as Kennedy Space Center and Cape Canaveral Air Force Station,
because they have a long history of conducting launches and reentries
in a manner consistent with FAA regulations. In addition, an operator
must contract with the Federal launch or reentry site for ground safety
services or oversight. The FAA would require that the operator have a
written agreement with the Federal site to use its ground safety
services or oversight and comply with its ground safety processes and
requirements. Finally, the Administrator must have determined,
consistent with the considerations in Sec. 450.179(c), that the
Federal launch or reentry site's ground safety processes, requirements,
and oversight are not inconsistent with the Secretary's statutory
authority over commercial space activities. In considering the site's
ground safety record, the Administrator will consider the extent and
sophistication of both its ground safety procedures and the frequency
with which the site uses them during FAA-licensed activities.
In making the determination to accept a Federal site's ground
safety procedures, the Administrator generally will accept only those
sites that have a regular cadence of both commercial and government
launches and highly developed, well-understood processes and
procedures. In considering the coordination between the FAA and the
Federal site safety personnel, the Administrator generally will approve
only those sites with which the FAA has a long-term working
relationship through the Common Standards Working Group (CSWG).
Familiarity with a Federal site's ground safety practices and
procedures is the only means by which the FAA can ensure it has met its
statutory obligation to ensure public health and safety, safety of
[[Page 79593]]
property, and national security and foreign policy interests of the
United States. When the Administrator finds that a site meets the
conditions in Sec. 450.179(b), the FAA will develop a Memorandum of
Agreement (MOA) with the approved site and publish the MOA on the FAA's
website. If these conditions are met, then the operator can seek FAA
permission during pre-application consultation to comply only with the
ground safety regulations imposed by the Federal site. The FAA will
publish, maintain, and update the Federal launch and reentry site
ground safety MOAs on its website.
For Federal launch or reentry sites or other Federal entities that
do not satisfy the conditions in Sec. 450.179(b), the final rule
retains the LSSA-like process in accordance with Sec. 450.45(b). As
noted earlier, the FAA believes that because of the performance-based
nature of part 450, Federal launch or reentry sites will typically
satisfy most or all FAA requirements.
ii. Radionuclides (Sec. 450.45(e)(6))
In the NPRM, the FAA proposed in Sec. 450.45(e)(6) that the FAA
would evaluate the launch or reentry of any radionuclide on a case-by-
case basis, and issue an approval if the FAA finds that the launch or
reentry is consistent with public health and safety, safety of
property, and national security and foreign policy interests of the
United States. For any radionuclide on a launch or reentry vehicle, an
applicant would need to identify the type and quantity, include a
reference list of all documentation addressing the safety of its
intended use, and describe all approvals by the Nuclear Regulatory
Commission for pre-flight ground operations.
SpaceX requested that the FAA clarify the intent of this
regulation, as this topic is heavily regulated by other Federal
entities. In addition, SpaceX recommended that the FAA defer to and
accept results from other Federal entities when applicable, and stated
that processes for acceptance and deferral should be provided in an AC.
As discussed in the NPRM preamble, Sec. 450.45(e)(6) will address
the potential launch or reentry of radionuclides, similar to current
Sec. 415.115(b), but with the addition of reentries. It is the current
practice of the FAA to address novel public safety issues on a case-by-
case basis because such proposals are so rarely encountered in
commercial space transportation. When applicable, FAA will work closely
with other Federal entities to avoid duplicative requirements. Moving
forward however, the Presidential Memorandum on Launch of Spacecraft
Containing Space Nuclear Systems \37\ directs the Secretary to issue
public guidance for applicants seeking a license for launch or reentry
of a space nuclear system. The FAA is currently developing this
guidance.
---------------------------------------------------------------------------
\37\ https://www.whitehouse.gov/presidential-actions/presidential-memorandum-launch-spacecraft-containing-space-nuclear-systems/ (August, 2019).
---------------------------------------------------------------------------
g. Environmental Review (Sec. 450.47)
In the NPRM, the FAA proposed to consolidate and clarify
environmental review requirements for launch and reentry operators in a
single section, Sec. 450.47 (Environmental Review). In addition, the
FAA proposed to revise Sec. Sec. 420.15, 433.7, 433.9, and 437.21 to
conform to the changes in proposed Sec. 450.47. These revisions codify
the environmental review process as currently conducted, in accordance
with FAA Order 1051.F, in which applicants for a launch or reentry
license provide the FAA with the information needed to comply with the
National Environmental Policy Act (NEPA) and other applicable
environmental laws, regulations, and Executive Orders.
In the final rule, the FAA adopts Sec. 450.47 as proposed with
revisions. The FAA revises Sec. 450.47(b) to affirmatively state that
an applicant must prepare an Environmental Assessment (EA), assume
financial responsibility for preparation of an Environmental Impact
Statement (EIS), or provide information to support a written re-
evaluation of a previously submitted EA or EIS, when directed by the
FAA. The FAA revised this section to clarify that the FAA, not the
applicant, determines which environmental documentation is required by
NEPA. If the FAA determines that under NEPA an EIS is required, the FAA
will select a contractor to prepare the EIS for the license applicant
who will pay the contractor. The FAA also revised Sec. Sec. 420.15(b),
433.7(c), 437.21(b)(1)(iii), and 450.47(c) to clarify that it is the
FAA's responsibility to determine whether a Categorical Exemption
(CATEX) applies under NEPA.
An applicant may provide data and analysis to assist the FAA in
determining whether a CATEX could apply (including whether an
extraordinary circumstance exists) to a license action. Examples
include modifications that are administrative in nature or involve
minor facility siting, construction, or maintenance actions. In the
final rule, the FAA revises Sec. Sec. 420.15(b), 433.7(c),
437.21(b)(1)(iii), and 450.47(c) to state affirmatively that it is the
FAA's responsibility to determine whether a CATEX applies rather than
an applicant's responsibility to request a CATEX.
If a CATEX does not apply to the proposed action, but it is not
anticipated to have significant environmental effects, then NEPA
requires the preparation of an EA. When directed by the FAA, an
applicant must prepare an EA with FAA oversight. When NEPA requires an
EIS for commercial space actions, the FAA uses third-party contracting
to prepare the document. That is, the FAA selects a contractor to
prepare the EIS, and the license applicant pays the contractor.
Finally, if an EA or EIS was previously developed, the FAA may require
an applicant to submit information to support a written re-evaluation
of the environmental document by an FAA-selected contractor to ensure
the document's continued adequacy, accuracy, and validity.\38\
---------------------------------------------------------------------------
\38\ FAA Order 1050.1, Environmental Impacts: Policies and
Procedures, provides a more detailed description of the FAA's
policies and procedures for NEPA and CEQ compliance.
---------------------------------------------------------------------------
This rule will not alter the current environmental review
requirements. However, as explained in the NPRM preamble, the
consolidation of the launch and reentry regulations necessitates a
consolidation of the environmental review requirements.
CSF asked the FAA to explain why it added the requirement that
applicants prepare EAs with FAA oversight, assume financial
responsibility for preparation of an EIS, or submit a written re-
evaluation of a previously submitted EA or EIS. CSF requested
clarification on the phrase ``under FAA oversight'' in proposed Sec.
450.47, versus the current language in FAA Order 1050.1 that requires
FAA approval of an applicant-prepared EA. CSF requested further that
the FAA clarify when and for what purpose the FAA might require an
applicant to prepare a written re-evaluation of a previously-submitted
EA or EIS, noting that the costs and schedule impacts of this
requirement are unclear.
As noted in the NPRM, the changes to the regulatory text on
environmental review do not represent a substantive change to past
regulations or to current practice. Section 450.47 reflects the
existing environmental review process that Sec. Sec. 415.201 and
415.203 broadly described, in which applicants must provide sufficient
information to enable the FAA to comply with NEPA. Section 450.47
replaces this general requirement by identifying the specific documents
that the FAA may require applicants to
[[Page 79594]]
provide and the process to prepare those documents. The language added
to Sec. 450.47 reflects current practice and is consistent with NEPA
and FAA policy. According to FAA Order 1050.1, unless the FAA
determines that a categorical exclusion applies, the FAA may prepare an
EA, EIS, or written re-evaluation, or direct an applicant to provide
the information as described in Sec. Sec. 450.47(b)(1), (2), and
(3).\39\ In response to CSF's comment, the FAA revises Sec. 450.47(b),
as well as Sec. Sec. 420.15(b), 433.7(b), and 437.21(b)(1)(ii), from
the language proposed in the NPRM to state expressly that an applicant
must provide the documents set forth in paragraph (b) ``when directed
by the FAA.'' The modified text clarifies the applicant's
responsibilities in accordance with FAA Order 1050.1 (Paragraph 2-2-2).
These responsibilities are consistent with current practice and will
not increase the cost, impact schedules, or alter the burden under the
previous regulations.
---------------------------------------------------------------------------
\39\ Currently, the FAA has not established categorical
exclusions for this program. However, the FAA may propose new
categorical exclusions applicable to the program after the FAA's
performance of NEPA reviews of proposed actions finds that the
actions, when implemented, do not result in significant individual
or cumulative environmental effects.
---------------------------------------------------------------------------
With respect to Sec. 450.47(b)(1), ``with FAA oversight'' means
the FAA will guide the work of an applicant or an applicant's
contractor. In order to use an applicant or contractor-prepared
document for compliance with NEPA or other environmental requirements,
the FAA must evaluate and take responsibility for the document. The
FAA's oversight ensures that: (1) The applicant's potential conflict of
interest does not impair the objectivity of the document; and (2) the
EA meets the requirements of FAA Order 1050.1. The FAA may require an
applicant to submit information to support a written re-evaluation of a
previously prepared environmental document (i.e., a draft or final EA
or EIS) to determine whether the document remains valid or a new or
supplemental environmental document is required. Applicants should work
closely with the FAA to determine the documentation requirements of
NEPA and other applicable environmental requirements.\40\ In response
to CSF's comment, the FAA revises Sec. 450.47(b)(3), as well as
Sec. Sec. 420.15(b), 433.7(b), and 437.21(b)(1)(ii), to clarify that
an applicant would submit ``information to support'' a written re-
evaluation of a previously submitted EA or EIS, rather than the re-
evaluation document itself, as proposed. The contractor selected by the
FAA will use the information provided by the applicant to prepare the
re-evaluation document.
---------------------------------------------------------------------------
\40\ See FAA Order 1050.1, Section 9-2.
---------------------------------------------------------------------------
CSF commented that the FAA should adopt, to the greatest extent
possible, NEPA documentation from other Federal agencies or licensed
site operators.
The FAA notes that it may adopt, in whole or in part, another
Federal agency's draft or final EA, the EA portion of another agency's
EA/FONSI, \41\ or EIS in accordance with applicable regulations and
authorities implementing NEPA.\42\ Whenever possible, the FAA will
adopt the other Federal agency's NEPA documents to support the issuance
of launch and reentry licenses. Further, the FAA encourages early
coordination with the FAA to benefit applicants that are seeking
approvals from other Federal agencies related to the FAA-issued license
(e.g., an applicant seeking approval from a Federal agency to make
modifications on a Federal launch or reentry site in anticipation of
receiving a launch license from the FAA). This coordination will
increase the likelihood of a more efficient environmental review
process as the applicant seeks different but related approvals from
multiple Federal agencies. The applicant should consult with the FAA
early in the project's development phase, prior to the development of
the NEPA document, to determine environmental review responsibilities,
and the appropriate level of review, and to foster efficient procedures
to develop documentation to meet the agencies' legal requirements.
---------------------------------------------------------------------------
\41\ Finding of No Significant Impact.
\42\ 40 CFR 1506.3 of the Council on Environmental Quality (CEQ)
Regulations and FAA Order 1050.1, as of the publication date of this
rule.
---------------------------------------------------------------------------
CSF also encouraged the FAA to request appropriations to fund
regional or area EAs. This recommendation is beyond the scope of this
rulemaking.
The Aircraft Owners and Pilots Association (AOPA) stated its
concern that, under the proposed regulations, existing Special Use
Airspace approvals (SUAs) would be activated for purposes that may not
align with the original environmental determinations that led to
approval of the SUAs. AOPA noted that the environmental process for
establishing SUAs includes detailed studies of the intended activity,
its frequency, and its effect on the public. Many of the SUAs activated
in support of commercial space activity originally underwent
environmental review and approval on the assumption that they were
supporting military or governmental activity, not commercial civil
space operators.
This rule will not affect the environmental determination process
for establishing or altering SUAs. Environmental review concerns
associated with the designation or activation of SUAs are not the
subject of this rulemaking. The FAA notes that all environmental
impacts associated with a proposed launch or reentry will be addressed
in the NEPA document prepared for that activity.
AOPA urged the FAA to ensure that the documentation for commercial
space operations is complete and transparent so that the public can
understand and identify potential impacts.
This rule will not alter the current environmental review process,
which requires documentation of environmental impacts. The FAA remains
responsible for complying with NEPA and other applicable environmental
laws, regulations, and Executive Orders prior to issuing a launch or
reentry license. The FAA ensures transparency of the potential
environmental impacts by publishing all draft and final EAs and EISs,
and associated Findings of No Significant Impact and Records of
Decisions.
CSF and Denver International Airport requested clarification on how
the environmental reviews required under NEPA would apply to multiple
sites. In accordance with applicable regulations and authorities
implementing NEPA, the FAA's decision-making process must consider and
disclose the potential impacts of a proposed action and its
alternatives on the quality of the human environment. This process
includes considering the impacts of launches from multiple sites, which
may be covered in a single NEPA document when appropriate. In some
instances, one single NEPA document may not be possible and individual
site-specific NEPA documents could be developed. The FAA is examining
the use of programmatic NEPA documents to analyze the impacts of
launches from multiple sites. Under such an approach, applicants could
tier their individual, site-specific NEPA analyses from the
programmatic document.\43\ The FAA will conduct programmatic EA
analyses consistent with FAA Order 1050.1 and CEQ regulations.
---------------------------------------------------------------------------
\43\ See Order 1050.1, Section 3-2.
---------------------------------------------------------------------------
SpinLaunch stated the environmental review process is lengthy,
sometimes taking as long as 2 years or more. To facilitate the process,
it recommended (1) including the environmental review within the
statutory period, thereby
[[Page 79595]]
forcing an expedited process; and (2) establishing limited
environmental approval for proposed activities (e.g., non-rocket launch
systems) that do not have the adverse environmental impacts of a
traditional rocket.
The FAA does not consider the 180-day statutory review period to
include NEPA document preparation. Specifically, the applicant must
submit a completed EIS prepared by the FAA (or an FAA-selected and
managed consultant contractor) or an FAA-approved EA, categorical
exclusion determination from the FAA, or written re-evaluation as part
of its application materials. The statutory application review period
is not intended to encompass the time needed for the applicant to
develop the necessary application materials, including environmental
documentation. Regarding the commenter's second recommendation, the FAA
is bound by CEQ's NEPA regulations. There are three levels of NEPA
review: CATEX, EA, and EIS. Each of the three levels of review is
described in FAA Order 1050.1. The required level of review depends on
the nature of the commercial space action. Applicants should coordinate
with the FAA early in the application process to determine the
appropriate level of NEPA review based on the potential for significant
impact.
Boeing, Lockheed Martin, Northrop Grumman, and ULA jointly
recommended adding to proposed Sec. 450.47(a) a statement requiring
the FAA to coordinate with other government entities to assist the
applicant in completing EAs, in order to alleviate the cost impact on
operators who currently have to negotiate multiple sets of requirements
by Federal, State, and local governments. The joint commenters also
recommended amending Sec. Sec. 420.15(b)(ii), 433.7(b)(2), and
450.47(b)(2) to allow EISs to be prepared by an FAA-approved consultant
contractor, in addition to one selected and managed by the FAA. The
commenters suggested these changes would provide flexibility and allow
an operator to use qualified EIS contractors at the State- or local-
level as long as the contractor meets the qualifications for completing
an EIS in accordance with the law.
The FAA declines the suggested regulatory text changes.
Section 1506.5(c) of the CEQ Regulations for Implementing the
Provisions of NEPA and Appendix C of FAA Order 1050.1 state that EISs
must be prepared by a contractor selected by the lead agency to avoid a
conflict of interest.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the
FAA craft an additional section to proposed Sec. 450.47 to address
space environmental impacts such as debris, collision risk, and
interference.
The FAA does not agree with this recommendation. The applicability
of NEPA to space debris is outside the scope of this rulemaking.
One individual commenter expressed concern that the proposed part
450 may cause companies to forgo environmental considerations or
somehow bypass compliance requirements. The proposal does not alter
NEPA and will continue to require potential licensees to comply with
all policies and procedures implementing NEPA, as well as other
applicable environmental laws, regulations, and Executive Orders
intended to protect the environment.
4. Part 450 Subpart C--Safety Requirements
a. Neighboring Operations Personnel (Sec. 450.101(a) and (b))
In the NPRM, the FAA proposed to carve out separate individual and
collective risk criteria for neighboring operations personnel. The
proposal was intended to reduce the need to clear or evacuate other
launch operator personnel during a commercial launch or reentry
operation. Under the current regulations, an operator may be required
to clear anywhere from a handful of employees to over a thousand
employees from a neighboring site for a significant portion of a day.
To address this issue, the NPRM proposed to define ``public'' and
``neighboring operations personnel'' in Sec. 401.5. Under the
proposal, neighboring operations personnel would still be members of
the public, but would be subject to different individual and collective
risk criteria. These proposed regulations were intended to enable
neighboring operations personnel to remain within safety clear zones
and hazardous launch areas during flight as long as their risk did not
exceed the newly designated thresholds.
In the final rule, the FAA adopts the proposal for neighboring
operations personnel in Sec. Sec. 401.7, 440.3, 450.101(a) and (b),
and 450.137(c)(6). The FAA revises the Sec. 401.7 definition of
``neighboring operations'' by removing the phrase ``as determined by
the Federal or licensed launch or reentry site operator'' because the
phrase is not relevant to the definition of neighboring operations
personnel. The FAA also revises Sec. 450.133 (Flight Hazard Area
Analysis) paragraph (e)(2) to require that an applicant provide the
hypothetical location of any member of the public that could be exposed
to a probability of casualty of 1 x 10-\5\ or greater for
neighboring operations personnel, in response to a comment to clarify
representative probability contours.
The FAA sought comment on the proposed approach, as well as on
proposals (1) not to require that neighboring operations personnel be
specially trained, (2) not to designate ground operations hazard
criteria for neighboring operations personnel, and (3) for the purpose
of determining MPL, to align the individual risk threshold for
neighboring operations personnel with the threshold for losses to
government property and involved government personnel. Many commenters
agreed with the FAA's proposal to change the risk threshold for
neighboring operations personnel, stating that a higher risk threshold
is necessary to allow for co-processing of multiple operations at a
single facility. Despite this general agreement, some commenters
disagreed with the specifics of the proposal. Several commenters
pointed out that the FAA's approach to neighboring operations personnel
differs from the ARC recommendation to exclude permanently badged
personnel and neighboring launch operations from the definition of
``public'' but still to employ mitigation measures for uninvolved
neighboring operations personnel when a hazardous operation or launch
is scheduled.
Several commenters, including Blue Origin, Boeing, CSF, Lockheed
Martin, Northrop Grumman, Space Florida, SpaceX, ULA, and Virgin Orbit,
commented that neighboring operations personnel should not be included
as members of the public. CSF stated that neighboring operations
personnel should not be considered members of the public because they
have essential, on-going requirements to conduct neighboring space
transportation activities. CSF further stated that the FAA has the
flexibility to exclude neighboring operations personnel from its
definition of ``public.'' Blue Origin similarly stated that neighboring
operations personnel are more familiar with the hazardous operations
present at a launch site and may have a relationship or engagement with
their neighboring operators and, therefore, should be treated
differently from the public who are completely uninvolved and are not
knowledgeable about launch and reentry operations. Space Florida also
commented that employees of the licensee who may be working on a test
program or a different launch or reentry program are not members of the
public and raised the question whether the
[[Page 79596]]
FAA should have statutory authority over launch essential personnel of
a neighboring operator for other launch, reentry, or associated
operations. Virgin Orbit commented that it would be better to include
neighboring operations personnel under launch personnel, rather than
requiring a new and possibly burdensome expected casualty analysis.
The FAA agrees that neighboring operations personnel are a unique
category of people because of their essential, ongoing tasks. The FAA
disagrees, however, with commenters' assertions that neighboring
operations personnel should be excluded from the definition of
``public'' because of their involvement in launch operations or the
tasks they are expected to perform. The FAA has a statutory obligation
to protect the health and safety of members of the public. Prior to
this rulemaking, the FAA defined public safety, for a particular
licensed launch, as the safety of people and property that are not
involved in supporting the launch, including those people and property
that may be located within the boundary of a launch site, such as
visitors, individuals providing goods or services not related to launch
processing or flight, and any other launch operator and its personnel.
The FAA's definition of ``public'' is derived from the definition of
``public safety'' in Sec. 401.5 and the definition of ``public'' in
Sec. 420.5.\44\
---------------------------------------------------------------------------
\44\ Both of these definitions are being replaced by the new,
consolidated definition of ``public'' in Sec. 401.7.
---------------------------------------------------------------------------
The FAA's definition of ``public'' encompasses neighboring
operations personnel because they are not involved in supporting the
specific launch or reentry they are neighboring. The FAA agrees that
neighboring operations personnel are more familiar with the hazardous
operations present at a launch site and may have a relationship or
engagement with their neighboring operators, but the FAA does not find
that to be sufficient to exclude them from the definition of
``public.'' It was a factor, however, in the FAA's decision to apply a
risk requirement to neighboring operations personnel different from the
requirement applied to other members of the public. Although this rule
includes neighboring operations personnel in the definition of
``public,'' the FAA recognizes that neighboring operations personnel
are aware of the inherent risks associated with launch and reentry
activities and are likely trained and prepared to respond to hazards
present at these sites. Because of these differences, as well as their
unique role in performing safety, security, and critical tasks, the FAA
considers neighboring operations personnel a separate category of
public, whose collective exposure to risk may not exceed 2 x
10-\4\ and for whom the risk to any individual may not
exceed 1 x 10-\5\.
The FAA disagrees with Virgin Orbit's comment that neighboring
operations personnel should be included as launch personnel so as to be
exempted from risk calculations and eliminate the burden of the
additional risk calculation. Neighboring operations personnel are not
supporting the licensed activity and are members of the public;
therefore, they must be protected under the FAA's statutory mandate.
The FAA acknowledges that this conclusion requires risk analysis for
the neighboring operations personnel; however, the FAA expects that
this analysis will involve little additional effort because the
operator already has to perform a similar analysis for the other
members of the public and will only need to account for the population
of neighboring operations personnel, if any. For these reasons, the FAA
adopts the proposal without amendment.
In addition to comments recommending that neighboring operations
personnel be excluded from the definition of ``public,'' several
commenters had other recommendations for the proposed definition of
``public.'' CSF commented that the proposal does not specify how
involved in a licensed operation a person needs to be to fall outside
public risk protections. CSF also proposed that the definition of
``public'' should allow for a risk threshold for those who have been
briefed on the risks and hazards and chosen to participate to the same
level as neighboring operations personnel, and that historic NASA
operations have followed this model. CSF further stated that the
definition of ``public'' should not include persons who have a passive
involvement in the licensed activity, such as invited guests of the
operator, customers, families of astronauts, and other stakeholders
with a legitimate enough interest in the launch or reentry activity to
be on-site. SpaceX echoed CSF's comments on this issue, and further
suggested that the definition of ``public'' should generally include
only those people who reside and work outside the controlled areas of a
launch or reentry site. Blue Origin, CSF, and SpaceX recommended
excluding invited guests of the launch or reentry operator from the
definition of ``public.''
As discussed earlier, the FAA's definition of ``public'' was
derived from the definition of ``public safety'' in Sec. 401.5 and the
definition of ``public'' in Sec. 420.5. Historically, the FAA has
considered ``public'' to include all people and property that are not
involved in supporting a licensed or permitted launch and in the final
rule extends the same definition to reentry. While neighboring
operations personnel or invited guests \45\ may accept a higher level
of background risk, they are not involved in supporting the particular
licensed operation and this rule continues the FAA's longstanding
practice of protecting them as members of the ``public.'' While the FAA
expects that certain members of the public may be briefed and aware of
hazards, the FAA does not agree with CSF's rationale that being
informed is a sufficient condition for such persons to be treated under
the higher risk threshold for neighboring operations personnel. In
addition to being informed of potential hazards, neighboring operations
personnel are required to perform safety, security, or critical tasks
at the neighboring site. The FAA finds that the necessity of these
tasks justifies the minimal increase in risk to which neighboring
operations personnel are exposed. Informed members of the public do not
meet this criterion and, therefore, will continue to be protected at
the public threshold rather than the higher threshold for neighboring
operations personnel.
---------------------------------------------------------------------------
\45\ The FAA is not proposing a higher risk threshold for
invited guests or other consenting members of the public at this
time.
---------------------------------------------------------------------------
The FAA considered potential regulatory mechanisms for allowing
public stakeholders with a legitimate enough interest in the launch or
reentry activity to be on-site as requested by commenters. However, the
FAA identified certain statutory and regulatory challenges with making
these changes as a part of this final rule. Given the inherent risks
associated with commercial space activity, Congress established a
framework for liability insurance and financial responsibility that
distinguishes individuals involved in launch or reentry activities from
third parties. Section 50902 defines third party as persons other than
launch or reentry participants.\46\ Section 50914
[[Page 79597]]
states that a licensee must obtain liability insurance to protect
launch or reentry participants from third party claims, based on
maximum probable loss calculations.\47\ Additionally, section 50914(b)
establishes a reciprocal waiver of claims regime for applicable parties
whereby each party to the waiver agrees to be responsible for personal
injury to, death of, or property damage or loss sustained by it or its
own employees resulting from an activity carried out under the
applicable license. This regime includes certain parties waiving claims
against the U.S. Government.\48\ The FAA has codified these
requirements in the part 440 regulations.
---------------------------------------------------------------------------
\46\ Specifically, in accordance with Sec. 50902(26), ``third
party'' means a person except--
(A) the United States Government or the Government's contractors
or subcontractors involved in launch services or reentry services;
(B) a licensee or transferee under this chapter;
(C) a licensee's or transferee's contractors, subcontractors, or
customers involved in launch services or reentry services;
(D) the customer's contractors or subcontractors involved in
launch services or reentry services; or
(E) crew, government astronauts, or space flight participants.
\47\ Specifically, in accordance with Sec. 50914(a)(4), the
insurance must protect the following, to the extent of their
potential liability for involvement in launch services or reentry
services, at no cost to the Government:
(A) the Government.
(B) executive agencies and personnel, contractors, and
subcontractors of the Government.
(C) contractors, subcontractors, and customers of the licensee
or transferee.
(D) contractors and subcontractors of the customer.
(E) space flight participants.
\48\ 51 U.S.C. 50914(b)(2).
---------------------------------------------------------------------------
While the FAA may waive certain risk requirements in order to allow
members of the public to be present in hazard areas during launch or
reentry activities, these individuals are third parties under title 51
and will therefore be included in maximum probable loss calculations.
This would likely increase insurance costs, which would be borne by the
licensee. Additionally, these individuals are not currently included in
title 51's cross-waiver framework nor has the FAA gone beyond the scope
of title 51 in part 440 to expand the cross-waiver framework to include
them. As such, their presence in hazard areas during launch or reentry
activities may increase the liability of the United States (and others
involved in the launch who have executed cross-waivers with the
operator) because of the increased potential for third party claims.
Finally, any regulatory changes would need to be effectuated in part
440 where the FAA's financial responsibility requirements for
commercial space transportation are located; however, the FAA did not
contemplate substantial changes to part 440 in this rulemaking. Because
of these challenges, the FAA elects to proceed with a waiver regime
rather than a regulatory change at this time.The FAA notes that
operators may request waivers to allow members of the public to be
present in areas where risk requirements under part 450 would not
otherwise allow them to be during launch and reentry activities.\49\
Such requests can serve a purpose of encouraging, facilitating, or
promoting commercial space launches and reentries by the private
sector, facilitating private sector involvement in commercial space
transportation activity, and promoting public-private partnerships.
However, the FAA expects operators to articulate more specifically the
reasons why allowing particular individuals to be in areas they
otherwise would be prohibited from entering is in the public interest.
In considering such waiver requests, the FAA would be mindful of its
role in protecting the public and accounting for any additional
liability such a waiver would impose on the U.S. Government. Some
factors that would affect the FAA's decision may include the number of
people an operator seeks to have present and the strength of
association between those people and the launch or reentry activity.
Individuals that have an employment or contractual arrangement with the
licensee, or are otherwise part of the cross-waiver framework of the
license, may pose minimal, if any, liability for the U.S. Government.
This could include high-level company officials and U.S. Government
officials. Members of the public for whom a waiver is requested should
have a strong connection to the launch, reentry, or licensee; for
example, future customers, major investors, or invited press might
qualify.
---------------------------------------------------------------------------
\49\ Should the FAA grant such a waiver, any individuals to whom
the waiver applied would still constitute third parties under title
51 U.S.C. 50902, and operators would continue to be required to
obtain liability insurance or demonstrate financial responsibility
to cover third party claims as required by 51 U.S.C. 50914 and 14
CFR part 440.
---------------------------------------------------------------------------
The operator bears the burden of providing adequate justification
for this relief through the waiver process. The operator should include
in its waiver application an assessment of the risks to the individuals
covered by the requested waiver,\50\ information on how the operator
will assume liability and hold the U.S. Government harmless, and the
individuals' association to the launch, reentry, or licensee. The FAA
anticipates using its experience in considering waivers to accommodate
the presence of additional members of the public during commercial
space launch and reentry activities to inform potential future
rulemaking in this area.
---------------------------------------------------------------------------
\50\ An operator may perform a risk analysis using its own
methods or the risk analyses identified in part 450 in order to
demonstrate the individual and collective risks imposed on the
individuals identified in the waiver request.
---------------------------------------------------------------------------
The FAA also received several comments on the proposed definition
of ``neighboring operations personnel.'' Blue Origin requested that the
FAA further define the term ``critical tasks'' referenced in the new
definition to include ``tasks that are critical to normal business
operations.''
The FAA does not agree that adding Blue Origin's definition of
``critical tasks'' is necessary. In the absence of a regulatory
definition, the plain language definition applies and is sufficient
here. In addition, the FAA gave context in the preamble to the NPRM for
the types of activity that may qualify as ``safety, security, or
critical tasks.'' The plain language definition maintains flexibility
to include various tasks as industry practices evolve over time. These
tasks include maintaining the security of a site or facility or
performing critical launch processing tasks such as monitoring pressure
vessels or testing safety-critical systems of a launch vehicle for an
upcoming mission. These tasks also include business operations that
cannot be reasonably conducted off site, such as onsite hardware work
as well as data processing that must be conducted in a secure facility.
Neighboring operations personnel do not include individuals conducting
normal business operations that need not be conducted in hazardous
areas, individuals in training for any job, or individuals performing
routine activities such as administrative, office building maintenance,
human resource functions, or janitorial work. This flexibility
accommodates practices like those USAF and NASA follow at their launch
sites and is intended to allow critical operations to proceed at
neighboring locations without jeopardizing those operations. As
explained in the NPRM, neighboring operations personnel are members of
the public. The FAA allows a slightly increased risk to these personnel
over that permissible to other members of the public. The FAA does not
believe that an increase in risk is justified for reasons other than to
facilitate performing safety, security, or critical tasks at the site.
The FAA estimates that the collective risk criteria in the final rule
for neighboring operations personnel will enable, on average,
approximately forty additional personnel to operatate in this capacity,
which the FAA believes will ensure that neighboring operators can
maintain operations with minimum disruption.
Virgin Galactic commented that the definition of ``neighboring
operations personnel'' should include all personnel who have been
properly trained to respond to hazards present at a launch or reentry
site and who are notified of hazardous operations occurring by other
licensed operators at that site. Virgin
[[Page 79598]]
Galactic objected to including in the definition a requirement that
neighboring operations personnel be notified of the operation, stating
that a lack of notification should not exclude individuals from
qualifying as neighboring operations personnel. Similarly, ULA
commented that the requirement appeared to be mostly in the definition,
which ``removes the definition's objectivity.''
FAA disagrees with Virgin Galactic that training and notification
are sufficient to justify the inclusion of personnel in the neighboring
operations personnel category. Training alone does not justify placing
personnel at a raised level of risk. Only those personnel performing
safety, security, or critical tasks qualify as neighboring operations
personnel who may be subjected to a higher risk threshold because of
the nature of those tasks, as discussed previously and in the NPRM.
Furthermore, as explained in the NPRM, requiring a licensee to ensure
neighboring operations personnel are trained would be burdensome and is
not necessary to justify the increase in risk allowed for workers
performing safety, security, or critical tasks.
The FAA does not agree with Virgin Galactic and ULA that the
definition of ``neighboring operations personnel'' imposes a regulatory
requirement. Rather, it enables neighboring operations to continue by
describing which individuals qualify as neighboring operations
personnel. Notification of an operation is a precondition to qualify as
neighboring operations personnel. Personnel cannot be designated as
neighboring operations personnel and be subject to the higher risk
thresholds, if they have not been notified of the operation. For these
reasons, the FAA declines to accept these particular changes to the
proposed definition.
A number of commenters focused on which authority designates
personnel as neighboring operations personnel. Many commenters,
including CSF, Space Florida, and SpaceX, noted their agreement that
the designation of neighboring operations personnel should be
coordinated and determined by the site operator, but urged the FAA to
remove its proposed neighboring operations personnel risk thresholds
and instead allow site operators to designate what mitigations would be
necessary to protect neighboring operations personnel. CSF urged the
FAA generally to defer to Federal, State, local, or private site owners
and operators as the sole decision-makers responsible for determining
which personnel would be considered essential to ongoing operations and
what hazard mitigation measures should be observed.
Other commenters, including ULA and Virgin Galactic, commented that
the FAA should designate neighboring operations personnel. These
commenters argued that a site operator should not determine who
qualifies as neighboring operations personnel, because it would be
tantamount to the FAA's reassigning its decision-making authority on
the matter. Sierra Nevada recommended that the FAA collect the
neighboring operations personnel information and calculate the risk on
behalf of the applicant so that the proprietary nature of workforce
numbers can be maintained between competitive companies. The Aerospace
Industry Association (AIA), Blue Origin, Virgin Galactic, and other
commenters also raised concerns about how proprietary data would be
shared after neighboring operations are designated. Virgin Galactic
commented that those best suited to know which employees are required
for safety, security, or critical tasks are the other launch operators,
not the site operator.
As previously described, the FAA maintains that the separate risk
thresholds are the appropriate protections for neighboring operations
personnel, and the FAA does not agree with removing its proposed
neighboring operations personnel risk thresholds and instead allowing
site operators to designate what mitigations would be necessary to
protect neighboring operations personnel. The FAA does not agree with
ULA and Virgin Galactic that the FAA or the launch operator should
determine what individuals are appropriately classified as neighboring
operations personnel. Site operators are in the best position to know
what operations occur on their sites and which individuals are
appropriately designated as neighboring operations personnel. The FAA
expects that the site operator (i.e., an operator of a Federal site or
FAA-licensed launch or reentry site) would work with operators of
neighboring sites to identify these personnel because the site operator
is in the best position to identify which personnel are required to
perform safety, security, or critical tasks at the launch site. The
site operator has a formal relationship with all operators on its site
and has an interest in enabling continued and unimpeded operations
amongst its tenants. At Federal sites, the site operator already
fulfills this function, and thus enabling neighboring operations
personnel does not impose any additional costs on the site operator.
The designation of neighboring operations personnel is optional for
FAA-licensed or exclusive use site operators. The FAA will monitor a
launch site operator's designation and vehicle operator's
implementation of neighboring operations personnel to ensure the
appropriateness of these designations, thereby retaining its authority
to determine which individuals are properly characterized as
neighboring operations personnel.
Further, site operators are best positioned to adjudicate between
tenants, to coordinate acceptable numbers of neighboring operations
personnel during licensed operations, and to protect their tenants'
proprietary information and furnish the necessary information to the
licensed operator. The FAA expects that the coordination of the
necessary data transfer will be collaborative between the licensed
operator, the site operator, and the neighboring operators. Neighboring
operators have the option of removing their personnel during the flight
of a neighboring flight or reentry. As discussed above, neighboring
operators have the option of discussing with the site operator which
personnel they believe need to remain present in order to maintain
safety, security, or other critical tasks. The accommodation of
neighboring operations personnel through the risk thresholds benefits
the launch or reentry operator by reducing the possibility that their
presence without evacuation could result in a violation of the public
risk criteria. It also benefits the neighboring operators to allow
safety, security, or critical tasks to continue in cases where the site
operator might otherwise require evacuation of personnel. Hence, the
FAA believes that generally, as is current practice at Federal sites,
neighboring operations personnel can be accommodated with little direct
intervention by the FAA.
Blue Origin, CSF, and SpaceX all commented that the neighboring
operations personnel provisions should apply to exclusive-use or
private sites. Blue Origin asked whether the FAA intended to exclude
such sites from its proposal because, although these are sites that the
FAA does not license, launch and reentry activities at these sites can
cause disruptions to non-licensed neighboring activities, such as
developmental or test programs.
The FAA does not license exclusive-use sites, but it does license
launch and reentry activities that occur at exclusive-use sites. The
FAA does not anticipate that many exclusive-use sites would have
personnel within a launch or reentry site, or an adjacent launch or
reentry site, that qualify as neighboring
[[Page 79599]]
operations personnel. Nevertheless, the FAA may accept the designation
of neighboring operations personnel at an exclusive-use site if they
are designated by the licensed vehicle operator that operates the site.
Such designations will only apply to members of the public located
within the site or an adjacent launch or reentry site who are not
associated with the specific hazardous licensed or permitted operation
being conducted, but who are required to perform safety, security, or
critical tasks at the site and are notified of the operation. This
approach is accommodated by the proposed regulations without change.
The FAA recognizes that there are activities that currently take
place at launch sites that are not explicitly associated with launch or
reentry operations. For example, payload processing typically occurs at
launch sites. The Reagan Test Site at Kwajalein also has facilities
that are essential for tracking objects in space. The U.S. Navy has a
presence at Cape Canaveral Air Force Station (CCAFS). These activities
may sometimes require critical personnel to remain on site during
neighboring launch activities to ensure the continuation of operations.
While the FAA envisioned primarily facilitating launch operations by
proposing a carve out for neighboring operations personnel, it will
allow other personnel conducting non-licensed activities on a launch or
reentry site or an adjacent launch or reentry site to qualify as
neighboring operations personnel as long as they meet the criteria
enumerated in the definition.
ALPA and Space Florida questioned whether the neighboring
operations personnel provisions would apply at joint spaceport/airport
facilities to allow airport staff to stay in the hazard area or clear
zone based on risk assessments during licensed space operations. In the
NPRM, the FAA took into account that neighboring operations personnel
are more likely than the rest of the public to be specially trained and
prepared to respond to hazards present at a launch or reentry site. The
USAF and NASA definitions specify that these personnel are either
trained in mitigation techniques or accompanied by a properly trained
escort. However, the FAA did not require that neighboring operations
personnel be trained or accompanied by a trained escort because such a
requirement would be burdensome, and training is not necessary to
justify the slight increase in risk allowed for workers performing
safety, security, or critical tasks. Although in developing the NPRM,
the FAA did not contemplate airport personnel at co-located sites as
neighboring operations personnel, the proposed definition did not
preclude the possibility. In response to commenters, the FAA finalizes
the definition of ``neighboring operations personnel'' as proposed, and
agrees that the definition may include airport personnel working at a
launch site.
Many commenters expressed concerns about the impact of designating
neighboring operations personnel on the MPL calculation and the
associated financial responsibility requirements. Northrup Grumman,
Sierra Nevada, SpaceX, and ULA all commented that the inclusion of
neighboring operations personnel would likely raise MPL, even at the
proposed lower threshold in the NPRM. CSF, Space Florida, and SpaceX
requested that neighboring operations personnel should be excluded from
MPL calculations via waivers of liability.
Section 50914(c) of title 51 of the U.S. Code states that the
Secretary of Transportation shall determine the maximum probable losses
for which a licensee must obtain liability insurance or demonstrate
financial responsibility. This amount must include the maximum probable
loss from claims by, in relevant part, third parties. 51 U.S.C.
50914(a)(1)(A). Neighboring operations personnel are third parties
under chapter 509 of title 51.\51\ Therefore, the FAA must include
neighboring operations personnel in its MPL calculations.
---------------------------------------------------------------------------
\51\ ``Third party'' means a person except--(A) the United
States Government or the Government's contractors or subcontractors
involved in launch services or reentry services; (B) a licensee or
transferee under this chapter; (C) a licensee's or transferee's
contractors, subcontractors, or customers involved in launch
services or reentry services; (D) the customer's contractors or
subcontractors involved in launch services or reentry services; or
(E) crew, government astronauts, or space flight participants. 51
U.S.C. 50902(26).
---------------------------------------------------------------------------
The FAA agrees with the comments that MPL calculations could be
affected by the designation of neighboring operations personnel because
the proposed rule allowed more people to stay inside the 1 x
10-\5\ probability of casualty hazard area. While the FAA
must include neighboring operations personnel in the MPL calculation,
it does not expect the inclusion to affect materially the MPL amount.
This expectation is based on the adoption in the proposed rule, for the
purpose of determining MPL, of setting the threshold for neighboring
operations personnel at the same threshold for losses to government
property and involved government personnel. The MPL will determine
losses to property and personnel of neighboring operators that have a
probability of occurrence of no less than one in one hundred thousand
(1 x 10-\5\), instead of the more stringent requirement of
one in ten million (1 x 10-\7\) used for other third party
losses. This threshold is appropriate for neighboring operations
personnel because, unlike other third parties, except for involved
government personnel, the presence of neighboring operations personnel
at a launch or reentry site is necessary either for security reasons or
to avoid the disruption of co-located activities at neighboring sites.
The MPL methodology captures catastrophic events that, while extremely
unlikely, still fall within the probability threshold.
The FAA's examination of past MPL determinations gives it
confidence that these other events will generally drive MPL amounts
more than the limited presence of neighboring operations personnel.\52\
While additional insurance costs are expected to be minimal, these
minimal cost burdens are more appropriately placed on the launch or
reentry operator creating the hazards, rather than the neighboring
operator who otherwise must halt its operation. The FAA notes, however,
that these regulations do not prevent a launch operator from entering
into an agreement with a neighboring operator to recover costs as a
result of any increase in the required amount of third party liability
insurance due to the presence of neighboring operations personnel.
Should a launch operator choose to enter into such an agreement, the
launch operator would still be required to purchase insurance to cover
all third parties, to include any neighboring operations personnel, and
could seek reimbursement as a secondary measure. Therefore, the FAA
adopts the proposal without amendment.
---------------------------------------------------------------------------
\52\ For example, the third party MPL for an Atlas 541 launch
from CCAFS is currently $164M, which accounts for an event involving
30 third party casualties based on the risk profile method. An
unlicensed government launch of the same vehicle occurred with 12
people deemed neighboring operations personnel that were located
within the 1 x 10-\6\ PC contour. If the
conditions present during that unlicensed launch were to occur under
part 450, then those 12 neighboring operations personnel would be
accounted for in the third party MPL calculation at the 1 x
10-\5\ probability threshold (instead of the current
standard 1 x 10-\7\ threshold for third parties as
explained in the previous paragraph). The presence of the 12
neighboring operations personnel does not exceed the event involving
30 third party casualties. Therefore, it is unlikely that those 12
neighboring operations personnel would lead to an increase in the
MPL for the Atlas 541 under part 450.
---------------------------------------------------------------------------
[[Page 79600]]
b. High Consequence Event Protection (Sec. 450.101(c))
In the NPRM, the FAA proposed to expand the FAA's use of
consequence criteria to protect the public from an unlikely but
catastrophic event. Specifically, the FAA proposed to use conditional
expected casualties (CEC) as the quantitative metric for:
(1) Determining the need for flight abort \53\ as a hazard control
strategy in proposed Sec. 450.101(c); (2) setting reliability
standards for an FSS required by Sec. 450.101(c) in proposed Sec.
450.145(a); and (3) determining when to initiate a flight abort in
proposed Sec. 450.125(c)(1) and (c)(2). The proposed use of
CEC represented the most significant change in the NPRM
because it introduced a new safety criteria pertaining to low
probability, high consequence events and provided a means by which an
operator could demonstrate that expensive, highly reliable FSS design
and testing may be unnecessary to protect public safety. As explained
in the NPRM, consequence can be measured in terms of CEC
without regard to the probability of failure.
---------------------------------------------------------------------------
\53\ In the final rule, flight abort is defined as the process
to limit or restrict the hazards to public health and safety, and
the safety of property, presented by a launch vehicle or reentry
vehicle, including any payload, while in flight by initiating and
accomplishing a controlled ending to vehicle flight. Flight abort is
discussed more fully in the discussion of Sec. 450.108.
---------------------------------------------------------------------------
The FAA received extensive comments on this proposal and, as a
result, has made significant changes in the final rule to allow for
additional flexibility in measuring and mitigating high consequence
events. The following subsections provide an overview of the finalized
CEC requirements in Sec. 450.101(c), the FAA's rationale
for making the change, and specific responses to comments. The FAA
notes that this section of the preamble focuses on CEC as a
means to measure the potential for high consequence events under Sec.
450.101(c). CEC will be discussed further in the preamble
sections addressing Sec. Sec. 450.108 (Flight Abort) and 450.145
(Highly Reliable Flight Safety System).
i. Sec. 450.101(c)
In the NPRM, proposed Sec. 450.101(c) would require an operator to
use flight abort as a hazard control strategy if the consequence of any
reasonably foreseeable vehicle response mode, in any one-second period
of flight, is greater than 1 x 10-\3\ CEC for
uncontrolled areas. The FAA further proposed that the requirement would
apply to all phases of flight, unless otherwise agreed to by the
Administrator based on the demonstrated reliability of the launch or
reentry vehicle during that phase of flight. Although not specifically
spelled out in the regulatory text, the FAA explained in the preamble
that Sec. 450.101(c) was designed to ensure the public was
sufficiently protected against low probability, high consequence events
using CEC as a measure of the potential for high consequence
events.
In the final rule, the FAA retains the use of CEC as a
quantitative criteria that an applicant may use to measure the
potential for high consequence events. However, as explained in the
preamble section addressing Sec. 450.101(c)(2), the FAA revises Sec.
450.37(b) (Equivalent Level of Safety) to allow an applicant to propose
an alternative way to measure high consequence events other than by
CEC. The final rule also allows multiple ways an applicant
may protect against a low probability, high consequence event in
uncontrolled areas for each phase of flight in Sec. 450.101(c)(1)
through (3). As discussed in more detail later in this section, an
operator sufficiently protects against a high consequence event by (1)
using flight abort in accordance with Sec. 450.108; (2) demonstrating
that CEC is below a certain threshold without any FSS; or
(3) demonstrating sufficient vehicle reliability and in consideration
of CEC.\54\ The FAA changes the heading of Sec. 450.101(c)
from ``Flight Abort'' in the NPRM to ``High Consequence Event
Protection'' in the final rule because this section allows an operator
in certain circumstances to use a method other than flight abort to
protect against high consequence events.
---------------------------------------------------------------------------
\54\ A CEC value is calculated as the mean number of
casualties predicted to occur given a specified failure mode in a
given time interval with a probability of 1.
---------------------------------------------------------------------------
Multiple commenters, including CSF, Sierra Nevada, and SpaceX,
stated that the NPRM requirements in Sec. 450.101(c) were too
prescriptive and objected to the lack of an explicit provision allowing
an applicant to propose another approach to address a high consequence
event, absent a waiver. The FAA agrees that the final rule should
provide additional flexibility and discusses those changes in more
detail later in this section.
Multiple commenters, including CSF and Virgin Galactic, indicated
that the EC collective risk criteria alone should be enough
to establish the need for an FSS, the reliability of the FSS, and when
an FSS would be required to be activated to ensure public safety.\55\
The FAA finds that the use of collective risk through analyses of
EC and individual risk through analysis of Probability of
Casualty (PC) is inherently inadequate to establish
sufficient protection against low probability, high consequence events
during launch and reentry operations. Whereas PC limits the
maximum risk to an individual and EC limits the average
outcome in terms of casualties in a group of people, both PC
and EC are indifferent to the risk of events that involve
multiple casualties. This indifference means that, if the risk of a
potential event that could result in a high number of casualties is low
enough, the PC and EC criteria would not act to
prevent that event. As explained in the NPRM, the purpose of
CEC is to protect the public from certain high consequence
events, regardless of the probability of those events. Thus, the final
rule includes specific provisions, such as in Sec. Sec. 450.101,
450.108, and 450.145, to ensure adequate protection against low
probability but high consequence events during launch and reentry.
---------------------------------------------------------------------------
\55\ As proposed, Sec. 450.101(c) simply used CEC to
determine whether flight abort would be required as a hazard control
strategy. Other proposed regulations relied on CEC to
establish FSS reliability and activation of FSS. These regulations
and the response to commenters' concern with using CEC for those
purposes are discussed later in the preamble.
---------------------------------------------------------------------------
In addition, a conditional risk assessment ensures adequate
mitigation measures are in place to protect against a low probability,
high consequence event in circumstances in which EC and Pc
may not dictate the need for mitigation. As explained in the NPRM,
unlike collective risk that determines the expected casualties
factoring in the probability that a dangerous event will occur,
conditional risk determines the expected casualties assuming the
dangerous event will occur.\56\ This assumption means that using
EC alone may result in a lack of mitigations, such as flight
abort capability and preparedness, for certain high consequence events
because the low probability of occurrence would translate into an
EC below the 1 x 10-\4\ limit. Conversely, using
a conditional risk assessment ensures that, if a high consequence event
is reasonably foreseeable, such as an incorrect azimuth at lift-off,
then an operator will have a mitigation in place to prevent that event
from producing catastrophic results. This result is assured because the
decision to activate an FSS is always made in response to a system
failure in the operational environment, as no operator plans to
implement a flight abort unless the mission objectives include an
intentional test of the FSS.
---------------------------------------------------------------------------
\56\ See 84 FR at 15298.
---------------------------------------------------------------------------
[[Page 79601]]
Calculating CEC ensures an operator correctly recognizes
certain system failures that may have catastrophic consequences and
builds mitigations into the system to account for those failures. As
such, an FSS is generally activated in the following context: (1) The
vehicle is no longer performing nominally; (2) the vehicle is outside
the limits of a useful mission; \57\ and (3) continued flight would
increase public risks in uncontrolled areas. Hence, the risk to the
public associated with the decision to activate an FSS is inherently
conditioned on the fact that a system failure has occurred. An operator
would only identify a system failure for low probability, high
consequence events if the operator used a CEC-based
analysis, rather than an EC calculation, because a
CEC analysis assumes that the event will occur. Therefore,
relying on the collective risk criteria alone would not adequately
protect against low probability, high consequence events that could
result in multiple public casualties.
---------------------------------------------------------------------------
\57\ Limits of a useful mission are defined in the final rule as
the trajectory data or other parameters that bound the performance
of a useful mission, including flight azimuth limits. This concept
is discussed in greater detail in Sec. 450.119.
---------------------------------------------------------------------------
The FAA received several comments regarding the potential for
various launch operations to comply with the proposed CEC
thresholds in the NPRM. Rocket Lab USA, Inc. (``Rocket Lab'') commented
that it would be ``nearly impossible'' for any orbital launch vehicle
to meet the CEC thresholds defined in the proposal and
recommended the use of cumulative risk and individual risk metrics as
additional or alternative means of determining the reliability required
for the flight abort system. Blue Origin also stated that most, if not
all operators, including those operating smaller suborbital launch
vehicles in remote locations, would be forced to implement an FSS that
complies with an unmodified set of USAF requirements. SpaceX
recommended that the FAA gather more detail on CEC for
different launch vehicles and trajectory profiles to evaluate
appropriate lower tiers of reliability.
The FAA sponsored a series of tasks, performed by ACTA, LLC (ACTA),
to investigate the potential conditional risks associated with a wide
array of past and foreseeable future launch operations using the best
available information and tools. The study \58\ provided an independent
evaluation of the potential for the CEC-related requirements
in the NPRM to necessitate changes to current practice for more than a
dozen missions involving large, medium, and small launch vehicles from
a wide variety of sites. The results of this study demonstrate that the
required reliability of an FSS for relatively small rockets depends
greatly on the launch site. Specifically, the ACTA study found that a
small ELV launched from Cape Canaveral or Wallops Island would need a
highly reliable FSS compliant with proposed Sec. 450.145 to meet the
NPRM requirements, but that a less reliable FSS, such as an FSS
compliant with proposed Sec. 450.143, would suffice for the same
vehicle launched from more remote locations, such as the Mahia
Peninsula and Kodiak Island. To the extent that commenters suggested
proposed Sec. 450.101(c) would require currently licensed operators to
use an FSS, the ACTA study results indicate that no changes would be
required under the final rule regarding the need for an FSS for any
currently licensed launch vehicle launched from a Federal launch or
reentry site.\59\ The ACTA study also indicates that, for operators who
currently employ an FSS to meet the FAA's public risk criteria, their
current practices regarding FSS reliability and activation criteria
would be sufficient to demonstrate compliance with the requirements in
Sec. 450.108.
---------------------------------------------------------------------------
\58\ The report can be found in docket number FAA-2019-0229.
\59\ The ACTA study made four notable conclusions:
1. For two current launch vehicles launched from outside the
continential US, the 1 x 10-\3\ CEC threshold
is not exceeded. Thus, part 450 will not require an FSS for either
of these two launches, yet both are designed to employ an FSS (as
required by part 417).
2. For ten launch vehicles launched from within the continential
US9, the part 450 CEC requirements are consistent with
current practice, where part 417 requires the highly reliable FSS.
3. For two piloted launch vehicles, one would require no
changes, and the other would require no FSS although a flight abort
capability is currently employed under part 431.
4. One current reentry poses CEC well above the 1 x
10-\2\ threshold. Thus, under part 450 this reentry
operation would either need to be modified to reduce the consequence
of failure modes that would result in an intact impact, or be
granted a waiver.
---------------------------------------------------------------------------
A number of commenters asserted that the proposed CEC
requirements would increase cost for operators, particularly for
current RLV operators.
CEC analysis is not mandatory. If an operator chooses to
use a Sec. 450.145 compliant FSS, it does not need to do the
CEC analysis to establish if a Sec. 450.145 compliant FSS
is necessary or if a Sec. 450.143 compliant FSS would suffice. A
CEC analysis to establish compliant Flight Safety Limits is
unnecessary if the operator chooses to demonstrate compliance with
Sec. 450.108(c)(6).
The FAA does not agree that the cost of a CEC analysis
is prohibitively expensive. The FAA provides estimates in the final
Regulatory Impact Assessment of the costs of the CEC
analyses as well as estimates of cost savings on those launches that
will not need an FSS.
The ACTA study calculated CEC for a sample of licensed
RLVs and the results indicate that the final rule will not require any
changes regarding the FSS robustness and FSS activation criteria
currently used for the operations at the Mojave Air and Space Port. The
ACTA study results suggest that launches from Spaceport America would
not need to use flight abort as a hazard control strategy to meet the
CEC requirements in the final rule. Thus, the ACTA study
suggests the final rule could facilitate a reduction in costs for RLV
launches from non-Federal launch sites for current part 431 licenses
that include flight abort as a hazard control strategy. Ultimately, the
ACTA study indicates that CEC will not drive a requirement
for flight abort for currently licensed RLVs operating from non-Federal
sites and is therefore not expected to drive costs for RLV operators.
In the final Regulatory Impact Analysis, the FAA discusses in detail
estimated voluntary costs to perform CEC analyses as well as
cost savings that result when an FSS is not required.
Several commenters, including CSF, Rocket Lab, Sierra Nevada,
SpaceX, and an individual commenter, expressed a need for clarification
of acceptable methodologies to compute CEC. CSF and Sierra
Nevada commented that there are no publicly available methodologies or
background for conducting CEC analysis. CSF noted that the
CEC analysis is computationally intensive and approved risk
analysis tools and input data were not readily available. SpaceX stated
it needed guidance on several specific technical issues on the
computation of CEC. Rocket Lab stated that, without
standardized methods and input data, results would vary widely.
The FAA notes that CEC is inherent in the calculation of
EC for launch or reentry operations. There are extensive
guidance documents available currently that explain methodologies that
can be used to compute EC and, as a byproduct,
CEC as well.\60\ The FAA is aware of at least one operator
that has used these guidelines to develop and implement its own safety
analysis tools to demonstrate
[[Page 79602]]
compliance with the current public risk criteria under part 417. Some
tools have already been modified to compute CEC with only a
few hours of effort. Even so, the FAA remains dedicated to improving
the guidance materials available to applicants and plans to provide
additional advisory materials to explain acceptable safety analysis
methods, including those that address any unique aspects of
CEC computations.
---------------------------------------------------------------------------
\60\ See e.g., the FAA Flight Safety Analysis Handbook v 1.0,
2009 and the Range Commanders Council Risk Committee of the Range
Safety Group, Common Risk Criteria for National Test Ranges--
Supplement, RCC 321-20, White Sands Missile Range, New Mexico, 2020.
---------------------------------------------------------------------------
Sierra Nevada commented that CEC analysis was not a
widely accepted practice, nor had it been subject to rigorous testing,
and it was not ready to be implemented. In response, the FAA notes that
RCC 321 Standard and Supplement has included conditional risk standards
and guidelines since 2010. Moreover, CEC analysis has been
used to help inform important decisions regarding the safety of
commercial space transportation operations since 2016, when the FAA
first cited CEC as part of a formal waiver evaluation.\61\
As noted in the NPRM preamble, in granting these waivers, the FAA has
adopted the conditional risk management approach, noting that the
predicted consequence was below a threshold of 1 x 10-\2\
CEC.\62\ The FAA further stated in the preamble that
measuring the consequence from reasonably foreseeable, albeit unlikely,
failures is an appropriate metric to assess prudent mitigations of
risks to public health and safety and the safety of property. In recent
years, the USAF has also used CEC analyses to establish
appropriate FSS activation criteria for launch operations from both
CCAFS and VAFB. Most recently, the FAA considered the results of
CEC analyses in granting waivers to the debris containment
requirements in Sec. 417.213(a) and (d) that enabled the SAOCOM-1B
mission to be conducted safely.
---------------------------------------------------------------------------
\61\ See Waiver of Debris Containment Requirements for Launch.
81 FR 1470, 1470-1472 (January 12, 2016).
\62\ 84 FR 15312.
---------------------------------------------------------------------------
Several commenters, including CSF, Sierra Nevada, and SpaceX,
recommended that the proposed CEC-related requirements be
moved to a guidance document as an accepted means of compliance to a
more performance-based regulation to preserve flexibility. CSF stated
that, at a minimum, the quantitative criteria should be moved to a
guidance document.
The FAA considered replacing the proposed quantitative
CEC criteria with a qualitative standard and moving the
quantitative criteria to a guidance document as one acceptable means of
compliance. However, the FAA finds that a qualitative approach to
determine the three key CEC-related issues (i.e., the need
for flight abort with a reliable FSS as a hazard control strategy, the
reliability standards for any required FSS, and the criteria for
activation of an FSS) would lack regulatory clarity necessary to ensure
a consistent level of public protection, given the wide variety of
launch and reentry operations. As noted by Rocket Lab and other
commenters, even the results of quantitative high consequence event
assessments can vary significantly from operator to operator without
standardized methods and input data.
Although quantitative CEC is retained in the final rule,
the FAA adds flexibility in both the manner in which a high consequence
may be measured and the manner in which an operator can sufficiently
protect against a high consequence event. First, in the NPRM, ELOS
would not have been allowed for the requirements in Sec. 450.101. As
noted in the discussion of ELOS earlier in the preamble, the FAA has
revised Sec. 450.37 in the final rule to allow operators to use ELOS
to measure a high consequence event under Sec. 450.101(c)(2). Second,
Sec. 450.101(c)(2) permits an operator whose CEC is greater
than 1 x 10-\3\ to propose safeguards other than flight
abort to reduce the CEC below 1 x 10-\3\. These
revisions are discussed in greater detail later in this section.
Virgin Galactic recommended the FAA provide a definition of
CEC. In addition, Virgin Galactic commented that, in the
NPRM preamble, CEC was described using the phrase, ``without
regard to the probability of failure,'' which appeared to Virgin
Galactic to translate to ``assume 100% failure probability.'' Virgin
Galactic recommended the FAA use the terminology ``assuming the failure
will occur'' and clearly state the probability of failure would be 1,
if that was what was intended.
The FAA does not agree that CEC should be defined in the
final rule. Rather, the preamble and associated AC (on High Consequence
Event Protection) discuss in detail what the requirement entails and
how to calculate CEC. A CEC value is calculated
as the mean number of casualties predicted to occur given a specified
failure mode in a given time interval with a probability of 1. As
previously mentioned, there are extensive guidance documents currently
available that explain methodologies that can be used to compute
EC and, as a byproduct, CEC as well.\63\ The term
``high consequence'' appears in Sec. 417.107(a)(1)(ii), but the FAA
chose not to define this term formally at this time to allow for
operational flexibility. High consequence events include incidents that
could involve multiple casualties, massive toxic exposures, extensive
property or environmental damage, or events that jeopardize the
national security or foreign policy interests of the United States.
---------------------------------------------------------------------------
\63\ The FAA notes that CEC is inherent in the
calculation of EC because the total EC for the
operation is the sum of all EC contributions from each
failure mode and failure time, and each EC contribution
for a failure mode and failure time is the probability of failure
multiplied by CEC. Therefore, CEC for a given
failure mode and failure time can be found by dividing the
EC contribution by the probability of failure for that
failure mode and failure time.
---------------------------------------------------------------------------
Boeing, Lockheed Martin, Northrop Grumman, and ULA provided
regulatory text recommendations for Sec. 450.101(c) including removal
of ``flight abort,'' stating that a distinction needed to be made from
flight abort that was not initiated based on threat to public health
and safety because not all abort systems are considered FSS.
The FAA understands that the term ``flight abort'' has been used in
other U.S. Government contexts to mean something different, but the FAA
finds that ``flight abort'' accurately describes the required hazard
mitigations while remaining flexible as to implementation. For these
reasons, the FAA will not amend the rule to remove the term ``flight
abort.'' The final rule adopts the proposed definition of flight abort
in Sec. 401.7, which means the process to limit or restrict the
hazards to public health and safety, and the safety of property,
presented by a launch vehicle or reentry vehicle, including any
payload, while in flight by initiating and accomplishing a controlled
ending to vehicle flight. The final rule also adopts in Sec. 401.7 the
proposed definition of ``flight safety system,'' which means a system
used to implement flight abort, for which a human can be a part of an
FSS.
The FAA finds that the definition of ``flight abort'' is consistent
with current practice for licensed launches and reentries. Most RLVs
use some method to achieve flight abort reliably, either in the form of
a pilot that can safely abort flight using system controls or an
automated system to terminate thrust. Traditional FSS for ELVs are
comprised of an onboard flight termination system, a ground-based
command and control system, and tracking and telemetry systems.
Historically, the flight safety crew monitoring the course of a vehicle
would send a command to self-destruct,
[[Page 79603]]
thus aborting the flight, if the vehicle crossed flight safety limits
and in doing so threatened a protected area. Redundant transceivers in
the launch vehicle would receive the destruct command from the ground,
set off charges in the vehicle to destroy the vehicle and disperse the
propellants so that an errant vehicle's hazards would not impact
populated areas. While this method of flight abort through ordnance is
conventional, the existing definition in Sec. 417.3 and the definition
in the final rule do not require an FSS to be destructive.
In response to commenters' concerns, the FAA finds that the
definitions of ``flight abort'' and ``flight safety system'' adopted in
the final rule remove any perceived confusion over the use of these
terms for the purpose of FAA licensing under part 450.
ii. Sec. 450.101(c)(1)
Section 450.101(c)(1) states that an operator must protect against
a high consequence event in uncontrolled areas for each phase of flight
by using flight abort as a hazard control strategy in accordance with
the requirements of Sec. 450.108. The FAA has not included the
reference to the CEC threshold of 1 x 10-\3\ in
Sec. 450.101(c)(1) because an operator who uses flight abort in
accordance with Sec. 450.108 has demonstrated compliance with Sec.
450.101(c)'s requirement to protect against a high consequence event
without further inquiry into CEC beyond the requirements in
Sec. 450.108(c). This change is consistent with the concept proposed
in Sec. 450.101(c) of the NPRM that required an operator to use flight
abort with a reliable FSS \64\ if CEC was greater than 1 x
10-\3\ for any phase of flight. Under the proposal, if an
operator elected to use flight abort with an FSS that met the
reliability requirements in Sec. 450.145, the FAA would not have
required the operator to calculate CEC for the purposes of
determining compliance with proposed Sec. 450.101(c) because the
operator opted into flight abort as a hazard control strategy
irrespective of CEC.
---------------------------------------------------------------------------
\64\ Proposed Sec. 450.101(c) required an operator to use fight
abort with an FSS that met the reliability requirements set forth in
Sec. 450.145. The reference to reliability requirements for FSS has
been moved to Sec. 450.108(b) and will be discussed in that section
of the preamble.
---------------------------------------------------------------------------
As such, in the final rule, there is no need to reference a
CEC threshold in Sec. 450.101(c)(1) because an operator who
elects to use flight abort as its hazard control strategy and complies
with Sec. 450.108 does not need to calculate CEC (beyond
the requirements in Sec. 450.108(c) discussed later in the preamble)
to determine that it has sufficiently protected against a high
consequence event. Rather, use of flight abort consistent with the
requirements in Sec. 450.108 by itself demonstrates compliance with
Sec. 450.101(c).
As explained in the next two sections, operators who do not elect
to use flight abort consistent with the requirements of Sec. 450.108
must demonstrate they can protect against a high consequence event by
means other than flight abort. If an operator cannot demonstrate
compliance with Sec. 450.101(c)(2)--including through ELOS--or (c)(3),
the operator would be required to rely on Sec. 450.101(c)(1) as the
only remaining means to protect against a high consequence event.
iii. Sec. 450.101(c)(2)
In the final rule, Sec. 450.101(c)(2) states that an operator must
protect against a high consequence event in uncontrolled areas for each
phase of flight by ensuring the consequence of any reasonably
foreseeable failure mode, in any significant period of flight, is not
greater than 1 x 10-\3\ CEC. As noted, proposed
Sec. 450.101(c) would have required an operator with a CEC
greater than 1 x 10-\3\ to use flight abort with an FSS that
meets the reliability requirements of proposed Sec. 450.145 except for
a single exception explained in greater detail in the discussion of
Sec. 450.101(c)(3).
The FAA recognizes that flight abort is not the only method to
protect against low probability, high consequence events. Therefore, in
the final rule, Sec. 450.101(c)(2) allows an operator with
CEC greater than 1 x 10-\3\ in any significant
period of flight to demonstrate protection against a low probability,
high consequence event through means other than flight abort. This
added flexibility in the final rule allows operators to implement other
safeguards that sufficiently protect against a high consequence event.
For example, one company included a design feature in a system so that
a launch failure during downrange overflight would result in break-up
and demise and thus mitigate the risk from the potential for the
capsule to survive intact to impact.
In addition, although this provision retains the quantitative
CEC threshold proposed in Sec. 450.101(c), the FAA provides
additional flexibility by modifying Sec. 450.37 to allow applicants to
propose alternative approaches that provide an equivalent level of
safety, which can be approved by the FAA without a waiver. The FAA
added this flexibility because it is aware of methods other than using
CEC to measure high consequence events, such as conditional
risk profile. If an operator chooses to propose an alternative means of
measuring a high consequence event, the FAA would expect the
alternative means to account for the potential for any event that would
be expected to produce multiple casualties,\65\ using a method that
demonstrates equivalent level of safety to a CEC analysis.
The operator must ensure that the alternative means accurately assesses
that the operation would not exceed an acceptable threshold for high
consequence events. In order to determine whether an alternative
threshold for high consequence events is acceptable, the FAA will
compare the alternative measurement to the CEC threshold.
Alternatively, the applicant would be expected to demonstrate that
either the consequence of any failure during any significant period of
flight is at least an order of magnitude less than the average results
from a fixed-wing general aviation aircraft fatal accident.\66\
---------------------------------------------------------------------------
\65\ High consequence events include incidents that could
involve multiple casualties, massive toxic exposures, extensive
property or environmental damage, or events that jeopardize the
national security or foreign policy interests of the United States.
\66\ The FAA computed this risk profile using NTSB accident data
between 1982 and 2019 for fixed-wing aircraft operated under FAR
parts 91, 135, and 137, excluding aircraft type certificated under
part 25.
---------------------------------------------------------------------------
For example, the Range Commanders Council Document 321-17, ``Common
Risk Criteria Standards for National Test Ranges'' (RCC 321) includes
catastrophic risk protection provisions that use a ``risk profile.''
\67\ In fact, the FAA currently uses a modified risk profile method to
establish the insurance requirements for certain launch or reentry
operations.\68\ The
[[Page 79604]]
FAA understands that risk profiles are currently in use in other
industries \69\ and could be a useful means to quantify the probability
of high consequence events associated with a wide variety of hazardous
operations. However, the computation of a risk profile generally
entails significantly more effort than the CEC evaluation
because a risk profile involves more sophisticated computations and
additional input data. Specifically, the development of a risk profile
for a launch or reentry operation would consist of an evaluation of the
absolute probability of each foreseeable failure mode and the relative
probability of each outcome of each failure mode in terms of the number
of public casualties that could result in uncontrolled areas. The RCC
321 Supplement describes a more simplified and conservative method to
screen for excessive catastrophic risk, which the FAA finds as another
acceptable method to measure high consequence events.\70\ In contrast,
a CEC analysis is independent of the probability of each
failure mode and requires an assessment of only the average outcome of
each failure mode. In addition, the FAA is publishing an AC that
describes how an applicant can demonstrate compliance with Sec.
450.101(c)(2) by showing that the conditional risk profile for its
proposed launch or reentry mission is comparable with the conditional
risk profile empirically derived from evidence from a set of past
fixed-wing general aviation fatal accidents. Finally, the FAA
recognizes that industry may develop new innovative and less burdensome
methods, and therefore the final rule allows applicants to propose
methods other than CEC to measure high consequence events.
---------------------------------------------------------------------------
\67\ RCC 321-17 defines a risk profile as ``a plot that shows
the probability of N or more casualties (vertical axis) as a
function of the number of casualties, N (horizontal axis),'' such
that the area under a risk profile is equal to the EC. Unlike the
single valued EC, risk profiles illustrate whether the collective
risk is from a relatively low probability, high consequence event or
from more frequent, smaller consequence outcomes.
\68\ See, e.g., the 2016 Report to Congress ``FAA's Development
of an Updated Maximum Probable Loss Method'' in response to Public
Law 114-90, Section 102. An MPL analysis must model each accident
scenario as a discrete event with discrete results, e.g., no
casualties, exactly one casualty, two casualties, etc. Each accident
scenario also has a quantitative probability of occurrence. The MPL
analysis process involves simulation of many thousands of discrete
accident scenarios that cover the parameter space of the problem
(i.e., all foreseeable accident scenarios for each and every failure
time and vehicle failure mode). The predicted results of all
foreseeable accident scenarios are accumulated into a histogram and
the risk profile is computed as the complementary cumulative
distribution. For details, see Collins, Brinkman, and Carbon paper
``Determination of Maximum Probable Loss'' presented at 2nd IAASS
conference in Chicago, May 2007.
\69\ For example, Santa Barbara County, California (where
Vandenberg AFB is located) uses risk profiles as part of their
management of public casualty risks from activities that involve
significant quantities of hazardous materials as explained in the
County of Santa Barbara, Planning and Development, Environmental
Thresholds and Guidelines Manual, October 2008. Several European
countries, including the UK and Netherlands, use risk profiles as
part of their governance of a wide array of industries that pose
public risks.
\70\ For example, the catastrophic risk averse pseudo-
EC contribution from people in ships may be computed
using a standard EC computation but replacing the number
of casualties contributed by type of ship, N, with N raised to an
exponent of 1.5.
---------------------------------------------------------------------------
In Sec. 450.101(c)(2), the FAA replaces the term ``one-second
period of flight'' in proposed Sec. 450.101(c) with ``significant
period of flight.'' A period of flight would be significant if it is
long enough for a mitigation, such as flight abort, to decrease the
public risks or consequences materially from any reasonably foreseeable
failure mode. The FAA makes this change because it recognizes that for
some launch and reentry concepts, such as relatively slow-moving
vehicles like balloons, a ``significant'' period of flight could exceed
one second. In addition, the FAA foresees circumstances in which an
elevated CEC in a single second of flight would not warrant
additional mitigation, such as when no additional mitigation would
improve public safety meaningfully in terms of the public risks and
consequences. The preamble discussion of Sec. 450.108 contains further
explanation of what constitutes a material decrease.
Finally, the final rule replaces the phrase ``any reasonably
foreseeable vehicle response mode'' proposed in Sec. 450.101(c) with
``any reasonably foreseeable failure mode'' in Sec. 450.101(c)(2) of
the final rule. The NPRM defined ``vehicle response mode'' as a
mutually exclusive scenario that characterizes foreseeable combinations
of vehicle trajectory and debris generation. Thus, the NPRM would have
required an evaluation of CEC for each foreseeable
combination of vehicle trajectory and debris generation. By replacing
the term ``vehicle response mode'' (VRM) with ``failure mode,'' the
final rule is both less prescriptive and consistent with the current
requirements.\71\
---------------------------------------------------------------------------
\71\ As part of the demonstration required under Sec.
431.35(c), a part 431 applicant is required in Sec. 431.35(d)(4) to
identify and describe all safety-critical failure modes and their
consequences.
---------------------------------------------------------------------------
In the NPRM, the FAA defined a VRM as a mutually exclusive scenario
that characterizes foreseeable combinations of vehicle trajectory and
debris generation. As stated in the NPRM, proposed Sec. 450.101(c)
would have required, at a minimum, that an operator compute the
effective casualty area and identify the population density that would
be impacted for each reasonably foreseeable vehicle response mode in
any one-second period of flight in terms of CEC. The NPRM
further explained that the casualty area, population density, and
predicted consequence for each vehicle response mode are intermediate
quantities that are necessary to demonstrate compliance with the
individual and collective risk criteria currently; thus, these new
requirements would not necessarily impart significant additional burden
on operators.
The draft AC 450.115-1 on High Fidelity Flight Safety Analysis
published for comment in conjunction with the NPRM further explained
that ``VRMs are a combination of debris list and failure modes'' and
provided a description of typical failure modes for launch and reentry
systems, including loss of thrust, engine explosion, attitude control
failure, structural failure, separation failure, guidance or navigation
failure, etc. Because the final rule replaces the term ``vehicle
response mode'' with ``failure mode,'' an operator is no longer
required to evaluate CEC for each foreseeable combination of
failure mode and debris generation. Instead, an operator is required to
evaluate CEC for each reasonably foreseeable failure mode in
any significant period of flight.\72\
---------------------------------------------------------------------------
\72\ As an example of the distinction between ``vehicle response
mode'' in the NPRM and ``reasonably foreseeable failure mode,'' in
the final rule consider, a loss of thrust (LoT) failure mode. Under
the NPRM, LoT failure mode would need to be accounted for by three
VRMs: A LoT resulting in an intact impact, a LoT resulting in
aerodynamic break-up, and a LoT resulting in explosion due to FSS
activation. Under the NPRM's proposal, the operator would have been
required to compute CEC for three VRMs associated with
LoT, but under the same circumstances the final rule will require
only one CEC for the LoT. The final rule CEC
for LoT will equal the average CEC for the three VRMs
that the NPRM would have required.
---------------------------------------------------------------------------
Boeing suggested changing the term ``reasonably foreseeable'' to
``credible'' vehicle response modes. The FAA does not agree that the
term ``reasonably foreseeable'' should be replaced by the term
``credible'' in this section. As previously noted, the term
``reasonably foreseeable'' is used in Sec. 431.35 and commonly used in
system safety. In the absence of a compelling reason to change, the FAA
prefers to continue to use language consistent with previous
regulations instead of introducing a new term at this time.
Furthermore, the FAA finds that the term ``credible'' is prone to
errors in judgment whereas the term ``reasonably foreseeable'' is more
readily discerned by analysis (e.g., fault trees).
iv. Sec. 450.101(c)(3)
In the NPRM, in instances in which CEC was greater than
1 x 10-\3\, proposed Sec. 450.101(c) provided relief from
the use of flight abort if the Administrator agreed that flight abort
was not necessary based on the demonstrated reliability of the launch
or reentry vehicle during a phase of flight. The NPRM preamble cited
the flight of a certificated aircraft carrying a rocket to a drop point
as an example of a phase of flight when the use of an FSS would likely
not be necessary, even though the CEC could be above the threshold
because the aircraft would have demonstrated reliability.
While the final rule retains the ``demonstrated reliability
concept'' proposed in the Sec. 450.101(c) of the
[[Page 79605]]
NPRM, it has been revised and relocated to Sec. 450.101(c)(3). Section
450.101(c)(3) of the final rule states that an operator must protect
against a high consequence event in uncontrolled areas for each phase
of flight by establishing the launch or reentry vehicle has sufficient
demonstrated reliability based on the CEC during that phase
of flight.
Because demonstrated reliability provides an alternative to flight
abort when CEC is greater than 1 x 10-\3\, it is
appropriate to assess it consistent with the approach to flight abort
and FSS reliability, which depends on CEC with a 1 x
10-\2\ threshold.\73\ Notably, the ARC recommended that the
need for an FSS should be determined by taking into account population
density, the realm of reasonably foreseeable failures, trajectory,
size, and explosive capabilities of the vehicle. CEC
accounts for all those factors. As such, the CEC computed
for a proposed operation is inherent in determining whether the vehicle
has sufficient demonstrated reliability to protect against a high
consequence event. This revision informs operators on the approach the
FAA will take in determining whether the launch or reentry vehicle has
sufficient demonstrated reliability to protect against a high
consequence event.
---------------------------------------------------------------------------
\73\ In the proposal and the final rule, the FAA uses
CEC not only as a basis to determine whether flight abort
is required but also as a basis to determine the appropriate FSS
requirements. As noted, FSS requirements are discussed later in the
preamble.
---------------------------------------------------------------------------
More specifically, the FAA will use the demonstrated reliability
and average ground consequence results from fatal accidents involving
U.S. civil aviation aircraft with standard airworthiness certificates
to establish what constitutes sufficient demonstrated reliability to
protect against a high consequence event based on CEC. For
example, a carrier vehicle with a CEC near 1 x
10-\2\ in a given phase of flight would need to have
demonstrated reliability during that phase of flight on par with the
subset of fixed-wing general aviation aircraft that empirically produce
CEF \74\ near 1 x 10-\2\. However, the same
carrier vehicle operated in a more densely populated area could have a
CEC near 1 in a given phase of flight and thus would need to
have demonstrated reliability during that phase of flight on par with
commercial transport aircraft that empirically produce CEF
near 1.\75\ This approach is consistent with the longstanding and often
cited principle that launch and reentry should be no more hazardous to
the public than over-flight of conventional aircraft, as explained in
the NPRM preamble.
---------------------------------------------------------------------------
\74\ CEF represents conditional expected fatalities
and is used to measure the mean number of fatalities predicted to
occur given an event with a probability of 1. As noted in the NPRM,
the FAA found that about one ground fatality resulted on average
from one-hundred fatal accidents involving US aircraft operated
under part 91 between 1984 and 2013 based on NTSB data. A comparison
of CEC to CEF is appropriate here because the
CEF values cited here are empirical results from aviation
accidents, whereas the CEC values used here are the
results of physics-based computer simulations for launch and reentry
operations. In addition, the differences between aviation and space
operations justify some margin in the tolerability of the
conditional risks predicted for space transportation operations.
\75\ As noted in the NPRM, the FAA found that about one ground
fatality resulted on average from a fatal accident involving US
aircraft operated under part 121 between 1984 and 2013 based on NTSB
data.
---------------------------------------------------------------------------
The FAA received multiple comments seeking clarification of the
provision to use demonstrated reliability as a means to ensure a low
probability, high consequence event is sufficiently mitigated. In the
NPRM, the FAA noted that ``demonstrated reliability'' in this context
refers to statistically valid probability of failure estimates based on
the outcomes of all previous flights of the vehicle or stage. For
example, a probability of failure analysis that complies with Sec.
450.131 will provide a valid basis to establish the demonstrated
reliability of a launch or reentry vehicle in a given phase of flight.
That concept is also applicable to Sec. 450.101(c)(3) of the final
rule. Furthermore, the FAA will consider the magnitude of the high
consequence event in determining what level of reliability will be
sufficient to ensure that the high consequence event is mitigated. One
way to show that a vehicle has demonstrated reliability during a phase
of flight is to show that it has demonstrated reliability during that
phase of flight equivalent to a specific aircraft type or an average
aircraft of similar size and performance characteristics with a
standard airworthiness certificate.\76\ The FAA notes an average
aircraft of similar size would have less uncertainty than a specific
type aircraft because there would be more data collected for an average
aircraft, and thus the demonstrated reliability of an average aircraft
could be more readily characterized with a reasonable level of
confidence. Furthermore, both a specific aircraft type and an average
aircraft with a standard airworthiness certificate generally will not
need additional flight abort capability unless the addition of the
rocket substantially increased the risk from a high consequence event.
However, aside from some carrier aircraft used as a component of a
launch vehicle, no launch vehicle, including U.S. government owned and
operated vehicles, to date has a significant amount of historical
flights to ensure sufficient protection against a high consequence
event based on demonstrated reliability in accordance with Sec.
450.101(c)(3).
---------------------------------------------------------------------------
\76\ As discussed in the preamble section on Hybrid Vehicles,
the FAA agreed with a comment that the FAA should not similarly find
that an aircraft with only an experimental airworthiness certificate
(EAC) would satisfy the demonstrated reliability standard. An
aircraft with an EAC may demonstrate sufficient reliability through
the use of a rigorous flight test program or numerous flights
without a failure as defined in Sec. 450.131.
---------------------------------------------------------------------------
c. Critical Asset and Critical Payload Protection
Commercial space transportation operations occur increasingly in
close proximity to critical assets. In order to maintain the continuing
functionality of critical assets, the FAA proposed to define ``critical
assets'' in Sec. 401.5 (Sec. 401.7 in the final rule) and add a
quantitative risk criterion (1 x 10-\3\) for the protection
of critical assets during launch or reentry activity under Sec.
450.101 in the NPRM.
In the final rule, the FAA adopts the ``critical asset'' definition
in Sec. 401.7 with modification, as discussed below. The FAA adopts
the risk criterion as proposed but removes the requirement for
operators to assess the risks to critical assets in preparing a flight
hazard analysis (proposed Sec. 450.109(a)(3)(ii)), debris analysis
(proposed Sec. 450.121(c)(1) and (c)(2)), debris risk analysis (Sec.
450.135), and ground hazard analysis (Sec. 450.185(c)). Instead, in
accordance with Sec. 450.101(a)(4)(iii) and (b)(4)(iii), either the
FAA or a Federal launch or reentry site operator will determine whether
the proposed activity would expose critical assets to a risk of loss of
functionality that exceeds the risk criterion in Sec. 450.101(a)(4) or
(b)(4) and convey any necessary constraints to the operator. The
operator must receive confirmation from the FAA or Federal launch or
reentry site operator that the risk to critical assets satisfies the
risk criterion in Sec. 450.101(a)(4) or (b)(4) prior to launch or
reentry. The FAA anticipates that most critical assets for a given
launch site will be known when an applicant begins pre-application
consultation. Current practice demonstrates that the critical asset
evaluation can often be completed using preliminary flight safety data
(during pre-application or during the license evaluation), sufficient
to show critical assets risks are acceptable. Where the prevailing
weather conditions are important to the critical asset risks, an
assessment is performed either close to or on the day-of-launch.
[[Page 79606]]
In the final rule, the FAA also clarified in Sec.
450.101(a)(4)(ii) and (b)(4)(ii) the Federal procedure by which
critical assets will be identified. To identify critical assets, the
FAA will consult with relevant Federal agencies, and each agency will
identify, for purposes of part 450, any critical assets that the agency
owns or otherwise depends on. The FAA will accept any identification by
the Secretary of Defense that an asset is critical to national
security. For critical assets identified by other relevant Federal
agencies, such as NASA, the FAA will work with the agency to ensure its
identification of critical assets aligns with the requirements of part
450.
The FAA also adds in Sec. 450.165(a)(5) (Flight Commit Criteria) a
requirement that operators' flight commit criteria include confirmation
from the FAA that the risk to critical assets satisfies the
requirements of Sec. 450.101(a)(4) or (b)(4). Lastly, the FAA sought
comments in the NPRM on its proposal to add to the final rule a
definition for ``critical payload'' and a requirement that the
probability of loss of functionality not exceed 1 x 10-\4\
for each critical payload. The FAA adopts the proposed definition and
requirement in the final rule.
In the final rule, the FAA adopts the risk criterion proposed for
critical assets in the NPRM. The property protection criteria in Sec.
450.101(a)(4) and (b)(4) are consistent with current practice at
Federal sites. Launch operations from NASA-operated ranges are
currently subject to requirements that limit the probability of debris
impact to less than or equal to 1 x 10-\3\ for designated
assets. The USAF requirement in AFI 91-202 and the Guidance Memorandum
to AFSPCI 13-610 match those proposed by the FAA. The FAA also adopts
its proposal to extend the protection of critical assets to non-Federal
launch or reentry sites because the protection of critical assets is
necessary irrespective of the location of the launch.
As proposed in the NPRM, a critical asset is an asset that is
essential to the national interests of the United States. The proposed
definition noted that critical assets include property, facilities, or
infrastructure necessary to maintain national defense, or assured
access to space for national priority missions.\77\ In the final rule,
the FAA replaces ``necessary to maintain national defense'' with
``necessary for national security'' to be more consistent with the rest
of 14 CFR Chapter III. The FAA also adds that critical assets may
include those necessary for high priority civil space purposes, for
clarity. An example of this would be infrastructure necessary to
support launch and reentry services to deliver cargo to and from the
International Space Station.
---------------------------------------------------------------------------
\77\ ``Property'' includes launch vehicles, reentry vehicles,
and payloads.
---------------------------------------------------------------------------
CSF and SpaceX noted that critical assets are frequently located on
or near Federal launch or reentry sites, and that the current practice
at Federal launch or reentry sites is to allow a site operator or
neighboring operator to waive the critical asset requirement for its
own facilities. The commenters requested the regulation provide a
similar allowance to reduce the frequency with which operators would
need to apply for waivers. SpaceX recommended revising the regulation
to allow for the waiver of an operator's own designated critical
assets, as well as assets that may be shared or used as common
infrastructure at a range.
The FAA acknowledges that critical assets located on a launch site,
including the launch facility itself, may be exposed to a risk of loss
of functionality that exceeds 1 x 10 -\3\ during launch
activity. The FAA finds that it would be burdensome to require a waiver
of the critical asset protection requirement when a launch site
operated by the U.S. Government or licensed by the FAA allows an
operator to use its facility for launch. Therefore, the FAA revises
Sec. 450.101(b)(4) to not apply the critical asset risk criteria to
property, facilities, or infrastructure supporting the launch that are
within the public area distance, as defined in part 420 Appendix E,
Tables E1 and E2 or associated formulae, of the vehicle's launch
point.\78\ Assets that fall within this exception, located at Sec.
450.101(b)(4)(v), are exempt from the critical asset protection
requirements in Sec. 450.101(a)(4)(i) and (b)(4)(ii) for a licensed
launch.
---------------------------------------------------------------------------
\78\ Part 420 defines public area distance as ``the minimum
distance permitted between a public area and an explosive hazard
facility.''
---------------------------------------------------------------------------
Assets excepted from risk criteria are determined by the required
distance to a public area specified in Table E-1 or E-2 or associated
formulae in Appendix E to part 420, using the quantities of propellants
or other explosives on the vehicle, including any payloads. These
distances are equivalent to Inhabited Building Distances commonly
observed on Federal launch or reentry sites to protect critical assets.
The exception limits consideration to quantities of propellants on the
vehicle, including any payloads. Any critical assets within this area
that are not supporting the activity would be subject to the risk
criteria. This exclusion would be applicable from ignition or at the
first movement that initiates flight, whichever occurs earlier, and end
when the launch ends.
The FAA received many comments on the definition of ``critical
asset.'' ULA expressed support for the proposed definition. A number of
commenters, including CSF and Sierra Nevada, asked who will determine
whether an asset is ``critical'' and how the determination would be
communicated to an applicant. Virgin Galactic commented that the
proposed definition is vague and did not provide enough information to
the operator to ensure protection of critical assets because the
definition could potentially apply to all property at a Federal site.
Virgin Orbit commented that the lack of clarity could result in Federal
agencies incorrectly concluding their assets were protected. CSF and
SpaceX commented that there was no limit on the number or location of
assets for which an operator would need to perform a risk analysis. CSF
and SpaceX recommended the definition of ``critical asset'' be limited
to U.S. Government assets located on Federal property that the
Secretary of Defense or Administrator of NASA determines to be
essential to the national interests of the United States. Boeing,
Lockheed Martin, Northrop Grumman, and ULA recommended critical assets
be defined as assets for which incapacitation or destruction would have
a very serious, debilitating effect on national defense, or assured
access to space for national priority missions. The commenters noted
this change would be consistent with the definition in DCMA-MAN 3401-
02, Defense Industrial Base Critical Asset Identification and
Prioritization. Furthermore, the commenters stated that classification
as a critical asset should be determined by minimum criteria (not
specified in the comment) and an assessment by the asset owner.
The FAA disagrees that the definition of ``critical asset'' is
vague or overbroad. The proposed definition, along with the examples
provided in the NPRM preamble, bound the scope of critical assets
appropriately and provide sufficient clarity for operators. Only those
facilities, property, or infrastructure that are necessary for national
security purposes, high priority civil space purposes, or assured
access to space for national priority missions will be deemed critical
assets under Sec. 401.7. Critical assets will also include certain
military, intelligence, and civil payloads, including essential
infrastructure when directly supporting the payload at the launch site.
The FAA provided several examples of critical
[[Page 79607]]
assets in the NPRM. Critical assets include assets that, if
incapacitated or destroyed, would have a serious, debilitating effect
on national security or assured access to space for national security
missions, but the FAA disagrees that the additional words proposed by
the commenters add clarity beyond the proposed definition.
Virgin Orbit's concern that Federal agency may assume incorrectly
that a critical asset was protected is alleviated by the fact that
critical assets will be identified by Federal agencies that own or
otherwise depend on assets that are essential to the national interests
of the United States. The FAA will work with operators to identify any
measures that operators may need to undertake in order to protect
critical assets to the level required by Sec. 450.101(a)(4) or (b)(4).
With respect to the concern that Federal agencies might be inclined
to overestimate their assets as critical, the FAA does not find that
experience at Federal launch or reentry sites warrants such a concern.
In fact, discussions with safety officials at CCAFS indicate that the
risk to critical assets or critical payloads has rarely exceeded the
risk thresholds adopted by the FAA. Federal launch or reentry sites
have not excessively designated assets as critical, nor have they
imposed significant restrictions on launch activity. When approving the
use of their sites for launch activity, Federal sites consider the
potential of launch activities endangering other facilities. Similarly,
other users of the site do not knowingly put their assets at risk. The
FAA maintains that similar considerations would hold at non-Federal
sites. Non-Federal launch or reentry site operators will consider the
siting and scheduling of activities to avoid one user's activity
threatening the assets of another user. Occasionally, delays in one
site user's activity may necessitate rescheduling another user's
activity. Otherwise, a new activity that was not anticipated when
siting decisions were made, such as fly-back of a stage, is most likely
to expose a critical asset to risk exceeding the criterion.
Only property, facilities, or infrastructure located close to the
launch point might typically be expected to exceed the criteria, and
those assets are generally associated with the subject launch
operation. As discussed in this section, the FAA revised Sec.
450.101(a)(4) to eliminate the need to seek waivers for assets located
within the immediate vicinity of a launch point during the launch.
Although many of these assets may be critical, meeting the critical
asset criteria would be impractical during a launch from the particular
launch point. Hence, assets located within the public area distance
required by part 420 during a licensed launch are exempt from the
critical asset protection requirements in Sec. 450.101(a)(4)(i) and
(b)(4)(i). As such, the FAA anticipates that operations exceeding the
risk criteria for critical assets will continue to be few, resulting in
minimal restrictions on launch activity.
The FAA maintains that establishing explicit risk criteria for
protecting critical assets in this final rule provides a level of
certainty. Launch and reentry site operators will have a metric to
determine what activities are appropriate for various locations on
their sites. Either the FAA or Federal site will perform any necessary
analysis, and will provide written confirmation to the operator that
the criteria in Sec. 450.101(a)(4) or (b)(4) have been met. If the
risk to critical assets posed by the proposed activity exceeds the
criteria in Sec. 450.101(a)(4) or (b)(4), then the FAA will work with
asset owners and operators to reach solutions that allow operations
without sacrificing safety to the critical assets or mission
objectives.
The FAA does not adopt the suggestion by CSF and SpaceX to limit
critical assets to U.S. Government assets located on Federal property
that the Secretary of Defense or the Administrator of NASA determines
to be essential to the national interests of the United States. Federal
entities other than the DOD and NASA might own or otherwise depend on
critical assets, such as NOAA. Thus, it would be inappropriate to
assign the determination of critical assets to only these agencies.
However, as noted earlier, critical assets will be identified by
Federal agencies, such as DOD and NASA, which own or otherwise depend
on assets that are essential to the national interests of the United
States, and the FAA will accept any identification by the Secretary of
Defense that an asset is critical to national security. Note also that
the FAA does not limit the definition of ``critical assets'' to assets
that are owned or located on property owned by the U.S. Government. As
stated in the NPRM, the FAA extended the protection of critical assets
to non-Federal launch or reentry sites, which previously had no
regulatory assurance of protection from loss of functionality of
critical assets. The FAA maintains the same safety standards for
critical assets for launches that take place on a Federal launch or
reentry site as those that take place on a non-Federal launch or
reentry site, some of which are dual use, supporting both commercial
and military operations. Similarly, as explained in the NPRM the FAA
will deem any commercial property that meets the definition set forth
in Sec. 401.7 a critical asset.
Blue Origin asked the FAA to provide examples of critical
infrastructure. The FAA notes that in the past, the launch complexes at
CCAFS that support Atlas V and Delta IV launches have been designated
as critical assets because they support missions essential to the
interests of the United States.
An individual commenter recommended the FAA define categories of
national security interests, including cybersecurity, security
controls, and classification level. Although these are important
national interests, they are not by themselves critical assets, and the
FAA does not find it necessary to add categories of national security
interests.
Airlines for America (A4A) recommended the FAA extend the safety
protections of critical assets to include critical aviation
infrastructure, including airports. The FAA notes that the definition
of ``critical asset'' does not preclude aviation infrastructure from
being a critical asset. More generally, the definition of ``critical
asset'' can include non-space associated assets, including those not
located at or adjacent to a launch or reentry site. However, the
criterion for loss of functionality likely limits aviation
infrastructure assets from being subject to protection.
Commenters were divided on the need for critical asset protection.
ULA acknowledged the need for protection of critical assets. Virgin
Galactic questioned whether the FAA's proposed critical asset
requirements were within the FAA's statutory authority, as title 51 did
not reference ``national interests'' or ``national priority missions.''
Blue Origin acknowledged the FAA's statutory authority to protect
property and asked the FAA to explain how it will interpret and
implement this authority. An individual commenter stated only assets
directly related to national security should be given heightened
protection. CSF, Spaceport Strategies, LLC (Spaceport Strategies), and
SpaceX commented that critical assets were already protected by current
requirements at Federal launch and reentry sites, rendering the FAA's
regulations duplicative. SpaceX added that NASA or DOD may not agree
with the FAA's proposed critical asset requirements, which may lead to
further duplication of requirements at Federal sites.
[[Page 79608]]
The FAA has the authority to protect critical assets. The
Commercial Space Launch Act authorizes the DOT, and the FAA by
delegation, to protect public health and safety, safety of property,
and national security and foreign policy interests of the United
States. In carrying out its responsibility to protect property, the FAA
has established a quantitative requirement to protect assets that are
essential to the national interests of the United States. As noted in
the NPRM, national interests go beyond national security and include
infrastructure such as that used to support high priority NASA
missions. As noted earlier, an example of this would be infrastructure
necessary to support launch and reentry services to deliver cargo to
and from the International Space Station.
As CSF, Spaceport Strategies, and SpaceX noted, the FAA's critical
asset requirements codify current practice at Federal launch or reentry
sites, but also extend the same regulatory protection for launch or
reentry activity at non-Federal launch or reentry sites. Although
critical assets are primarily located on Federal launch or reentry
sites at this time, the FAA foresees increased commercial space
activity at non-Federal sites that may result in the presence of
critical assets at those sites. In licensing commercial launch or
reentry activities, the FAA safeguards critical assets--which by
definition are essential to the national interests of the United
States--irrespective of their location.
The FAA does not find the critical asset requirements to be
unnecessarily duplicative of requirements at Federal launch or reentry
sites. As discussed in the NPRM, the FAA proposed these requirements to
further the goal of common standards for launches from any U.S. launch
or reentry site, Federal or non-Federal. Inclusion of critical asset
protection in FAA regulations aligns FAA licensing with Federal launch
or reentry site requirements and removes duplication of effort. The FAA
closely coordinated the critical asset requirements with the CSWG and
its interagency partners, including NASA and DOD. As a result of this
coordination, the FAA anticipates that the methodologies used by the
Federal launch or reentry sites will satisfy the FAA's requirements for
critical asset protection.
Many commenters, including AIA, Blue Origin, Boeing, CSF, Lockheed
Martin, Northrop Grumman, Sierra Nevada, SpaceX, Virgin Galactic, and
ULA raised concerns about how an applicant would obtain the information
necessary to perform the proposed critical asset analysis, including
proprietary or confidential information. CSF and SpaceX noted the same
data should be provided to all operators to ensure the fair and
unbiased application of this regulation. Sierra Nevada recommended the
FAA provide a method of acceptable means of compliance that does not
require a commercial company to contract with DOD to complete this
analysis. Alternatively, Sierra Nevada recommended the FAA provide the
analysis instead of the applicant. CSF and SpaceX also recommended the
FAA publish an AC that would provide an acceptable means for analyzing
critical assets, describe how the FAA would obtain a definitive list of
critical assets, and how the FAA would provide operators the data
necessary to conduct the analysis. Blue Origin stated that, by
requiring information that includes data from other entities, the FAA
would become responsible for facilitating acquisition of this data or
would risk implementing a requirement that would not be possible to
comply with or a requirement that would establish a sole source
provider of a service.
The FAA acknowledges the practical problems an applicant would
likely encounter in collecting the input data necessary to identify and
perform a risk assessment for critical assets, especially critical
payloads. The FAA agrees with Sierra Nevada that it would be better for
the U.S. Government to perform all critical asset and critical payload
risk assessments necessary to ensure operators comply with the risk
criteria in part 450. The FAA therefore removes the requirement for
operators to assess the risks to critical assets in preparing a flight
hazard analysis, debris analysis, and debris risk analysis. The FAA
also removes from Sec. 450.185 (Ground Hazard Analysis) the
requirement that the ground hazard analysis ensure that the likelihood
of any hazardous condition that may cause damage to critical assets is
remote. The FAA notes that the input data and analysis tools necessary
to perform a risk assessment for critical assets are often a subset of
those the FAA uses to establish the MPL values. The FAA will perform
all critical asset and critical payload risk assessments for commercial
space transportation operations involving non-Federal sites. Hence,
operators should not bear additional cost for the analyses associated
with critical assets.
Blue Origin asked how the FAA will address overflight of critical
assets. The FAA notes that overflight of a critical asset is possible
if the safety criteria set forth in Sec. 450.101 are satisfied. Past
experience demonstrates that the critical asset criteria in Sec.
450.101 are satisfied except in occasional cases involving critical
assets located within the same launch site. Historically, the risk to
critical assets from overflight outside the launch site is negligible.
Virgin Galactic asked how an operator would have input on or
dispute the determination of a critical asset. The FAA will discuss
with operators any concerns they may have about ensuring protection of
critical assets during their licensed activities, but the FAA is not
proposing a formal dispute mechanism to adjudicate its determination
that an asset is critical or threatened within the risk criterion.
Often, it might not be possible to share such information due to
national security issues and proprietary interests. The FAA notes,
however, that if the FAA denies an application for a license based on
its determination that the proposed activity exceeds the risk threshold
for critical assets, an applicant may request reconsideration under
Sec. 413.21 or a hearing in accordance with part 406 of this chapter.
CSF asked how the FAA will manage proprietary and national security
concerns among operators and asset-owners. The FAA does not foresee a
need to share proprietary data with non-Federal entities because the
Federal Government will conduct the assessment of critical asset risk
on behalf of the licensee. Based on discussions with relevant Federal
agencies, it is also possible to perform an assessment of critical
assets without disclosing the precise location or nature of each asset,
thereby eliminating the need to share proprietary and national security
information. For example, the USAF 45th Space Wing/Wing Safety
identifies what facilities are threatened within the thresholds and
shares that information with the appropriate tenants. The tenant can
then inform the USAF, or another entity performing the analysis, that
an asset is threatened without divulging sensitive information to any
entity outside the U.S. Government. The FAA will work with the entities
responsible for critical assets to ensure any necessary coordination,
taking into account the need to protect proprietary and confidential
data.
Several commenters, including CSF, SpaceX, and Virgin Galactic
requested clarification as to the meaning of ``loss of functionality''
and how the FAA or other entity would determine what could result in
the ``loss of functionality'' of a critical asset. CSF sought
clarification on whether infrastructure was ``critical'' if it was
needed to support full functionality of a critical asset and on the
standard for
[[Page 79609]]
determining whether an asset's function had been lost. It inquired
whether it would matter if the function could be restored in a timely
manner or met with an alternative asset.
CSF and SpaceX also recommended that ``loss of functionality'' be
defined in Sec. 401.7 as an asset designated critical by the Secretary
of Defense or Administrator of NASA that (a) has been rendered unable
to support a specific mission or program deemed critical to the
national interest; (b) for which the loss of function will preclude the
assurance of a time-critical mission or program unless promptly
restored; or (c) for which the asset's function cannot be restored by
an accelerated recovery strategy or replaced by an alternate means of
mission/program execution. SpaceX and Virgin Galactic requested the FAA
include this new definition in an SNPRM, along with a clear rationale
for the FAA's proposed requirements for protecting critical assets.
Under the final rule, the party responsible for the critical asset
would determine what constitutes loss of functionality. The FAA
recognizes that the threshold conditions that cause loss of
functionality will be different depending on the type of asset and its
robustness. For example, infrastructure is typically more robust than a
payload that may be more fragile. For this reason, the FAA does not
elect to incorporate a specific standard for what may constitute loss
of functionality into the final rule. Likewise, the FAA does not find
that it is useful to create a more detailed definition of ``loss of
functionality'' but agrees that considerations such as those suggested
by CSF and SpaceX (e.g., ability to support missions critical to
national interests, or ability to repair or restore function through
alternative means in a timely manner) would be relevant and appropriate
to determining loss of functionality.
An individual commenter stated that critical asset protection
should not compromise protection of the public and neighboring
operation personnel. The commenter stated that an operator's required
insurance should already cover losses to critical assets.
The FAA notes that the critical asset protection requirements will
not compromise the protection of the public or neighboring operation
personnel. The FAA retains stringent requirements for protecting the
public, including neighboring operations personnel, which are
independent of the requirements protecting critical assets. The FAA
also disagrees with the commenter that an operator's financial
responsibility requirements are adequate to protect critical assets.
The FAA is limited by statute to imposing no more than $100 million in
financial responsibility to compensate for losses to U.S. Government
property. The value of many critical assets easily exceeds that limit,
with some critical payloads reportedly costing over a billion dollars.
More importantly, financial compensation for a loss may not address the
delay before repairs or replacement, during which time national
security might be jeopardized or the opportunity to accomplish
important national interests missed.
The FAA sought comments on its proposal to require a more stringent
criterion for critical assets of utmost importance to the U.S., to be
defined as ``critical payloads'' in Sec. 401.7. The FAA proposed to
require that the probability of loss of functionality for critical
payloads, including essential infrastructure when directly supporting
the payload, not exceed 1 x 10-\4\. In the past, Federal
launch or reentry sites have, on occasion, applied a more stringent
requirement, limiting the probability of debris impact caused by launch
or reentry hazards to less than or equal to 1 x 10-\4\ for
national security payloads, including essential infrastructure when
directly supporting the payload at the launch site. The FAA asked
commenters to identify (1) the impacts a 1 x 10-\4\ risk
criterion would have on their operations if applied to critical
payloads; (2) whether a more stringent risk criterion should be imposed
on any commercial payload; and (3) potential additional costs and
benefits associated with applying a 1 x 10-\4\ risk
criterion to critical payloads.
In the final rule, the FAA adopts the risk criterion and definition
as discussed in the NPRM preamble, with minor clarifications.
ULA supported the 1 x 10-\4\ risk criterion for critical
payloads, stating that given the time and expense associated with
replacing these assets, it was essential they receive the greatest
protection possible. It further commented that this risk criterion
should also apply to infrastructure and booster hardware in direct
support of critical payloads, beginning when booster hardware for that
particular critical payload was received and began processing at the
launch site. Under ULA's suggestion, at the completion of the launch
campaign, the risk criterion should revert to 1 x 10-\4\.
Virgin Galactic, however, commented that it was not necessary to adopt
a heightened risk criteria for critical payloads. It saw no benefit to
the discussed 1 x 10-\4\ requirement over the 1 x
10-\4\ requirement. It also inquired whether the criterion
would apply to payloads on the vehicle of the operator that might be
subject to this new risk threshold. If so, Virgin Galactic stated this
would constitute managing mission success. Virgin Galactic also
inquired whether this risk criterion would apply to payloads at
neighboring launch sites. If so, Virgin Galactic believes the FAA must
demonstrate need and a nexus to statutorily obligated concerns. It
further stated that a more stringent criterion for commercial payloads
would place undue burden on operators, potentially requiring additional
analyses or redesign. Virgin Galactic noted that it did not intend to
carry critical payloads, so impacts to its operations from this
requirement would be negligible.
In the final rule, the FAA defines a critical payload as a payload
and essential infrastructure directly supporting such a payload that is
a critical asset (1) that is so costly or unique that it cannot be
readily replaced, or (2) for which the time frame for its replacement
would adversely affect the national interests of the United States. As
noted in the NPRM, a commercial payload that meets this definition will
be treated as a critical payload. The critical payload protection
requirement does not apply to payloads on the vehicle of the operator
regulated under part 450 but will apply to payloads on neighboring
launch sites. The FAA agrees with ULA that the 1 x 10-\3\
risk criterion should apply to essential infrastructure directly
supporting the critical payload, and notes that it will likely apply to
booster hardware in direct support of the launch of a critical payload.
After a launch of a critical payload, the infrastructure supporting the
launch will be critical only if it is essential to the national
interests of the United States. The risk criterion determines the
protection required for critical assets and payloads. It is not
necessary to specify in the regulation that this requirement does not
apply during activities that do not exceed the risk threshold.
The FAA disagrees with Virgin Galactic that there is no benefit in
applying a 1 x 10-\4\ risk criterion to critical payloads.
As explained in the NPRM, during the interagency review process, DOD
requested that the FAA consider specifying a more stringent criterion
for certain critical assets of utmost importance. The FAA considers a
critical payload a type of critical asset. The FAA finds it necessary
to protect payloads such as vital national security payloads and high-
priority NASA and NOAA payloads. The NPRM noted that a payload such as
NASA's Curiosity rover would likely be afforded this
[[Page 79610]]
protection. In the final rule, the FAA adopts this higher protection
criterion to safeguard those payloads of utmost importance to the U.S.
meriting a greater degree of protection than other critical assets.
While the FAA is providing for heightened protection for critical
payloads, it expects the protection to have minimal effects on
commercial launch and reentry operations. Currently there are few
commercial payloads that would rise to the level of being considered
critical payloads, although the FAA recognizes that might change in the
future, if for instance, DOD were to rely on a commercial service for
critical communication support.
Virgin Galactic requested the FAA adopt neither 1 x
10-\3\ nor a more stringent criterion. It argued the
proposed requirement contradicted the requirement in 51 U.S.C. Sec.
50901(a)(7) that the FAA regulate only to the extent necessary. Virgin
Galactic stated the FAA did not show why these requirements were
necessary, given that Federal launch or reentry sites already protect
their own property. Furthermore, Virgin Galactic commented that the FAA
would be enforcing a more stringent, but undisclosed criterion and
argued the proposed regulation was non-transparent and would deprive
the public of the opportunity to comment on this criterion as required
by the Administrative Procedure Act. The commenter asserted this
undisclosed criterion could prevent operators from planning ahead and
would create two standards that might conflict.
As articulated in the NPRM, the FAA finds it necessary to codify
current practice at Federal launch or reentry sites to protect critical
assets that are of utmost importance to the U.S. and to extend the same
protections for launch or reentry activity conducted at non-Federal
sites. For launches from Federal sites, this rule does not change
current practice; rather it incorporates that practice in a regulation.
This regulation consolidates the FAA's requirements for protection of
critical assets and critical payloads in all commercial launch or
reentry operations, in accordance with the FAA's statutory authority.
This rule reduces the need for a Federal or non-Federal site operator
to impose critical asset protection requirements on operators as a
contractual condition for the use of its facility. The FAA expects that
the instances in which a more stringent criterion will be necessary
will be rare. Preserving the flexibility to protect particularly vital
assets at a more stringent criterion in a license, as proposed in the
NPRM, is consistent with current practice at Federal launch and reentry
sites and will reduce the need for a Federal or non-Federal launch site
operator to impose a more stringent criterion on operators through
contract.
CSF and SpaceX commented that the FAA did not assess the cost
burden on industry for compliance with the critical asset requirements.
Virgin Orbit commented that critical asset calculations would require
additional analysis and resources.
In the final rule, the FAA's removal of the requirements for
operators to assess impacts to critical assets in flight hazard, ground
hazard, debris or debris risk analyses assuages the commenters'
concerns for costs associated with performing those analyses. As
compared to the proposal, there will be much reduced administrative
burden on the operator. The FAA will coordinate as necessary with
critical assets owners, and either the FAA or the Federal site operator
will provide written confirmation to the operator that the criteria in
Sec. 450.101(a)(4) or (b)(4) have been met. If the FAA or Federal site
operator determines that the criteria have not been met, either the FAA
or Federal site operator will work with the operator to identify any
measures that operators may need to undertake in order to protect
critical assets to the level required by Sec. 450.101(a)(4) or (b)(4).
An individual commenter stated that the proposed regulation would
require companies to perform trade studies to determine if additional
controls would be needed to reduce the likelihood of critical asset
loss of functionality. The commenter requested the FAA require a cost-
benefit analysis to ensure that upfront investment of controls to
protect critical assets would be less than the cost of replacing that
asset.
When determining whether an asset is a critical asset, the cost of
an asset is a factor. However, ultimately an asset is critical if it is
essential to the national interests of the United States. If it cannot
be replaced in a time frame that satisfies those interests, the cost of
the asset is irrelevant. Furthermore, the FAA does not find that most
mitigations will impose significant cost.
Virgin Galactic indicated the need for FAA assistance in planning
hazard control strategies pursuant to proposed Sec. 450.107(e)(2)(ii)
\79\ due to the secrecy of some critical assets. If an operator is
using physical containment as a hazard control strategy, the FAA or
Federal launch or reentry site operator will work with the operator to
ensure no critical assets are within the flight hazard area. The most
likely mitigation is shifting the launch point or, if the critical
asset is mobile, changing in the launch schedule.
---------------------------------------------------------------------------
\79\ As proposed, an applicant using physical containment as a
hazard control strategy would have been required to describe the
methods used to ensure that flight hazard areas are cleared of the
public and critical assets. This requirement has been relocated to
Sec. 459.110(c)(2) in the final rule.
---------------------------------------------------------------------------
Sierra Nevada requested the FAA conduct a publicly-available
assessment to determine if the proposed critical asset protection
requirements would impact an operator's MPL calculation. CSF requested
the FAA engage industry on the topic of critical assets.
The FAA does not find that the protection of critical assets will
increase MPL. The designation of an asset as critical is unrelated to
financial responsibility. In performing its MPL calculation for U.S.
Government property, the FAA ascertains the financial responsibility
required so that the likelihood of exceeding losses to government
property involved in a licensed activity (taken to mean such property
on a Federal launch or reentry site) that are reasonably expected to
result from that activity does not exceed 1 x 10-\5\; or, in
the rarer situation in which a critical asset might not be U.S.
Government property on a Federal launch or reentry site, 1 x
10-\7\. Critical assets are protected to a less stringent 1
x 10-\3\, or in the case of certain critical payloads, 1 x
10-\4\, and financial responsibility and protection are not
directly related. If anything, the requirement to protect critical
assets has the potential to lower MPL for U.S. Government property
because the mitigation employed may well remove the possibility that
the asset can be damaged even within the more stringent MPL threshold.
This would be the case if, to avoid placing the critical asset at risk
a launch was rescheduled, its trajectory adjusted, or the critical
asset was moved or physically protected. The FAA finds that it is
unlikely that a mitigation employed to protect critical assets will
change the MPL for third-party liability.
d. Other Safety Criteria (Sec. 450.101(d), (e), (f), and (g))
The FAA adopts the criteria in Sec. 450.101(d), (e), (f), and (g)
with no changes. Section 450.101(d) addresses disposal safety criteria,
Sec. 450.101(e) is the requirement for the protection of people and
property on orbit, Sec. 450.101(f) requires the notification of
planned impacts, and Sec. 450.101(g) addresses the validity of
analyses.
The FAA received public comments from Virgin Galactic on the
notification of planned impacts. Specifically, Virgin
[[Page 79611]]
Galactic advised that a carrier aircraft operating under an
airworthiness certificate should be exempt from proposed Sec.
450.101(f). This comment is discussed in further detail in the preamble
section on hybrid vehicles. The FAA will not exempt all hybrid vehicle
operators from the requirement in Sec. 450.101(f). If an operation has
no planned impacts from debris capable of causing a casualty, then no
notification will be necessary to comply with Sec. 450.101(f). The
regulation is adopted as proposed.
e. System Safety Program (Sec. 450.103)
In the NPRM, the FAA proposed in Sec. 450.103 that an operator
must implement and document a system safety program throughout the
operational lifecycle of a launch or reentry system. The system safety
program was proposed to include a safety organization (Sec.
450.103(a)), procedures to evaluate the operational lifecycle of the
launch or reentry system (Sec. 450.103(b)), configuration management
and control (Sec. 450.103(c)), and post-flight data review (Sec.
450.103(d)).
In the final rule, the FAA adopts proposed Sec. 450.103 with
revisions. The FAA replaced the term ``operational lifecycle'' in the
introductory paragraph of Sec. 450.103 with simply ``lifecycle'' to
clarify that the regulation applies to hazards throughout the lifecycle
of a launch or reentry system, not just operational changes to the
system. This change is consistent with the statements in the NPRM
indicating that, due to the complexity and variety of vehicle concepts
and operations, a system safety program would be necessary to ensure
that an operator considers and addresses all risks to public safety,
which include both design and operational changes to a system.
i. Safety Organization
In the NPRM, the FAA proposed that the system safety program would
require an operator to maintain and document a safety organization that
has clearly defined lines of communication and approval authority for
all public safety decisions, and that includes a mission director and
safety official. In the final rule, the FAA adopts the proposed rule
with a revision. The FAA removes ``and document'' from the proposed
requirement because the first sentence in Sec. 450.103 already
requires a system safety program to be documented.
Proposed Sec. 450.103(a)(1) stated that for each launch or
reentry, an operator would be required to designate a position
responsible for the safe conduct of all licensed activities and
authorized to provide final approval to proceed with licensed
activities. This position is referred to as the mission director. In
the final rule, the FAA adopts Sec. 450.103(a)(1) as proposed. The FAA
did not receive comments on this section.
Proposed Sec. 450.103(a)(2) stated that, for each launch or
reentry, an operator would be required to designate a position with
direct access to the mission director who would be responsible for
communicating potential safety and noncompliance issues to the mission
director and would be authorized to examine all aspects of the
operator's ground and flight safety operations, and to independently
monitor compliance with the operator's safety policies, safety
procedures, and licensing requirements. This position would be referred
to as a safety official. The FAA noted in the NPRM preamble that the
absence of a safety official could result in a lack of independent
safety oversight and a potential for a breakdown in communications of
important safety-related information. The FAA also noted that a safety
organization that included a safety official was essential to public
safety; however, identifying that individual by name was not necessary.
In the final rule, the FAA adopts Sec. 450.103(a)(2) as proposed.
Thus, a safety official will need to be in place prior to and
throughout any licensed activity.
Rocket Lab supported the proposed safety organization documentation
requirements in proposed Sec. 450.103(a), noting the requirements
would provide improved flexibility for the industry and support growth
in operations, while maintaining clear lines of communication and
independence in safety decision making. Virgin Galactic noted that it
agreed with the FAA's approach not to require a specific person be
listed as the safety official. Microcosm inquired if a specific named
safety official would be required for each launch site for operators
with licensed activity at multiple sites, and how far in advance that
information would need to be provided to the FAA.
The FAA notes that a safety official must be named and in place
prior to the initiation of any licensed activity, and an operator may
use the same safety official for multiple launch or reentry sites. It
may be difficult for a single individual to serve as a safety official
for multiple sites if launch or reentry activities were to occur close
in time to each other. In those instances, an operator may choose to
have multiple safety officials. An operator needs to provide the name
of the safety official to the FAA only when requested. The FAA may
request the name of the individual who will act as a safety official as
part of a compliance monitoring action. As is current practice, the FAA
will coordinate in advance with the operator prior to a compliance
monitoring action.
ALPA concurred with the requirement for operators to develop a
general system safety program. It also recommended that that embedding
FAA representatives within commercial space companies would assist the
commercial space community in growing robust system safety procedures.
The FAA notes that embedding FAA representatives within commercial
space companies is outside the scope of this rulemaking.
Proposed Sec. 450.103(a)(3) requires the mission director to
ensure that all of the safety official's concerns are addressed. In the
final rule, the FAA adopts Sec. 450.103(a)(3) as proposed. The FAA did
not receive any comments on this section.
ii. Hazard Management
Proposed Sec. 450.103(b) would have required an operator to
establish procedures to evaluate the operational lifecycle of the
launch or reentry system, including methods to review and assess the
validity of the proposed preliminary safety assessment and any flight
hazard analysis throughout the operational lifecycle of the launch or
reentry system, methods for updating the preliminary safety assessment
and flight hazard analysis, and methods for communicating and
implementing the updates throughout the organization. For operators
that would need to conduct a flight hazard analysis, the proposed rule
would also require an operator's system safety program to include a
process for tracking hazards, risks, mitigation and hazard control
measures, and verification activities.
In the final rule, the FAA adopts proposed Sec. 450.103(b) with
revisions. The FAA renames this section ``Hazard management'' to be
more descriptive than the proposed name of ``Procedures.'' The FAA also
does not adopt the proposed requirement in Sec. 450.103(b)(1) to
conduct a preliminary safety assessment because that requirement has
been replaced with the requirement to conduct a hazard control strategy
determination in Sec. 450.107(b) in the final rule, as will be
discussed later.
As noted, proposed Sec. 450.103(b)(1) would have required the
system safety program to include: (i) Methods to review and assess the
validity of the preliminary safety assessment throughout the
operational lifecycle of
[[Page 79612]]
the launch or reentry system; (ii) methods for updating the preliminary
safety assessment; and (iii) methods for communicating and implementing
the updates throughout the organization. For those operators required
to conduct a flight hazard analysis, proposed Sec. 450.103(b)(2) would
have required the system safety program to include the same methods for
the flight hazard analysis and a process for tracking hazards, risks,
mitigation and hazard control measures, and verification activities.
In the final rule, the FAA consolidates the requirements in
proposed Sec. 450.103(b)(1) and (b)(2) into Sec. 450.103(b)(1) of the
final rule. Section 450.103(b)(1) requires a system safety program to
include methods to assess the system to ensure the validity of the
hazard control strategy determination and any flight hazard or FSA
throughout the lifecycle of the launch or reentry system.\80\ The FAA
added FSA to this requirement because, as proposed in Sec. 450.101(g)
and adopted in the final rule, any analysis used to demonstrate
compliance with Sec. 450.101 must use accurate data. This is
consistent with the proposal because proposed Sec. 450.103(b)(1)(i)
would have required methods to review and assess the validity of the
preliminary safety assessment, which would have included components of
FSA such as vehicle response modes, public safety hazards associated
with vehicle response modes, population exposed to hazards, and
CEC. As previously noted, the final rule in Sec.
450.103(b)(1) uses the term ``lifecycle'' by itself to clarify that the
regulation applies to hazards throughout the lifecycle of a launch or
reentry system, not just operations hazards.
---------------------------------------------------------------------------
\80\ Proposed Sec. 450.103(b)(1)(ii) and (b)(2)(ii) would have
required the system safety program to include methods for updating
the preliminary safety assessment and flight hazard analysis. In the
final rule, the FAA simplifies the regulatory text of Sec.
450.103(b) in the final rule, which requires an operator to
implement methods to assess the system to ensure the validity of the
hazard control strategy determination and any flight hazard or
flight safety analysis throughout the lifecycle of the launch or
reentry system. Updating the safety analyses is a component of
ensuring their validity.
---------------------------------------------------------------------------
Proposed Sec. 450.103(b)(1)(iii) and (b)(2)(iii) would have
required the system safety program to include methods for communicating
and implementing the updates throughout the organization. In the final
rule, the FAA consolidates the requirements in proposed Sec.
450.103(b)(1)(iii) and (b)(2)(iii) into Sec. 450.103(b)(2) of the
final rule with a revision. The FAA changes the term ``the updates'' to
``any updates'' to clarify the intent for comprehensiveness.
Proposed Sec. 450.103(b)(2)(iv) would have required the system
safety program, for operators that must conduct a flight hazard
analysis, to include a process for tracking hazards, risks, mitigation
and hazard control measures, and verification activities. The FAA
adopts the language proposed in Sec. 450.103(b)(2)(iv) of the NPRM in
Sec. 450.103(b)(3) of the final rule with a revision. The FAA deletes
the terms ``hazard control,'' because it is duplicative with the
existing term ``mitigation measures.''
iii. Configuration Management and Control
Proposed Sec. 450.103(c) would have required an operator to (1)
employ a process that tracks configurations of all safety-critical
systems and documentation related to the operation; (2) ensure the use
of correct and appropriate versions of systems and documentation
tracked under the subsection; and (3) maintain records of launch or
reentry system configurations and document versions used for each
licensed activity, as required by the requirement for records in
proposed Sec. 450.219.
In the final rule, the FAA adopts Sec. 450.103(c)(1) and (c)(2) as
proposed and revises Sec. 450.103(c)(3) as discussed later.
Blue Origin commented that tracking and maintaining records of
individual configurations and associated operations documentation for
completed operations does not, by itself, enhance public safety. Blue
Origin believes that changes should be evaluated for safety impact
according to a configuration management plan, which is a deliverable
under the current regulations. Blue Origin stated that an approved
configuration management plan, coupled with continued accuracy of the
application, should suffice without additional requirements for
increased documentation and storage of records.
The FAA agrees that tracking and maintaining records for completed
operations in isolation does not directly enhance public safety, but
tracking and maintaining records for completed operations is an
important component of configuration management, which, as a whole,
does enhance public safety. The FAA agrees with Blue Origin that an
approved configuration management plan coupled with continued accuracy
of the application should suffice, but does not agree that current
requirements are sufficient. Part 431 does not have any requirements
for configuration management, and Sec. 417.111(e) is more general in
its requirement to define the launch operator's process for managing
and controlling any change to a safety-critical system to ensure its
reliability. Section 450.103(c) adds necessary detail.
Blue Origin also stated that proposed Sec. 450.103(c) is
repetitive of the recordkeeping requirements in proposed Sec. 450.219,
making it unnecessary. Blue Origin added that if the FAA were to
maintain the requirement, it should be written in the context of
safety-critical systems, which would tie directly to FAA's
responsibility to protect public safety.
While the FAA considers Sec. 450.103(c) necessary, proposed Sec.
450.103(c)(3) could be perceived as repetitive. Proposed Sec.
450.103(c)(3) would have required an operator to maintain records of
launch or reentry system configurations and document versions used for
each licensed activity, as required by Sec. 450.219 (Records). Section
450.219 requires a licensee to maintain for 3 years all records, data,
and other material necessary to verify that a launch or reentry is
conducted in accordance with representations contained in the
licensee's application, the requirements of part 450 subparts C and D,
and the terms and conditions contained in the license. The FAA removes
the reference to maintaining records in Sec. 450.103(c)(3) and revises
the provision to require an operator to document the configurations and
versions identified in paragraph (c)(2) for each licensed activity.
This is a more focused requirement than Sec. 450.219 and limits the
documentation requirement specifically to safety-critical systems,
consistent with Blue Origin's recommendation.
iv. Post-Flight Data Review
Proposed Sec. 450.103(d) would have required an operator to employ
a process for evaluating post-flight data to (1) ensure consistency
between the assumptions used for the preliminary safety assessment, any
hazard or flight safety analysis, and associated mitigation and hazard
control measures; (2) resolve any identified inconsistencies prior to
the next flight of the vehicle; (3) identify any anomaly that may
impact any flight hazard analysis, FSA, or safety-critical system, or
would otherwise be material to public health and safety and the safety
of property; and (4) address any anomaly identified in (3) prior to the
next flight, including updates to any flight hazard analysis, FSA, or
safety-critical system. The FAA explained in the NPRM that this
requirement was consistent with industry practice to review post-flight
data to address
[[Page 79613]]
vehicle reliability and mission success and that this requirement
imposes no additional burden. The FAA sought comment on whether
proposed Sec. 450.103(d) would change an operator's approach to
reviewing post-flight data.
In the final rule, the FAA adopts proposed Sec. 450.103(d)(1),
(d)(2), and (d)(4) with revisions, and adopts Sec. 450.103(d)(3) as
proposed. Section 450.103(d)(1) was modified to replace ``preliminary
safety assessment'' with ``hazard control strategy determination'' as
discussed earlier. The FAA also added the word ``flight'' in front
``hazard or flight safety analysis'' to make clear that the requirement
addresses any flight hazard analysis or FSA.
CSF, Rocket Lab, and Sierra Nevada commented that proposed Sec.
450.103(d) should be deleted because it was overly burdensome and
inconsistent with the directive to streamline the regulations. The
commenters stated that the requirement would extend the industry
practice beyond the typical analysis for reliability and mission
success. Sierra Nevada suggested that the section could be re-written
to address only post-flight data of safety-critical systems.
As discussed in the NPRM, operator review of post-flight data
provides valuable safety information on future operations. The
inconsistencies that need to be resolved in this subsection are only
those that affect safety analyses and associated mitigation and hazard
control measures, such as greater population in the launch area than
modeled. The anomalies that need to be addressed are only those that
may impact any flight hazard analysis, FSA, or safety-critical system,
or are otherwise material to public health and safety and the safety of
property, such as the momentary drop-out of an FSS. Therefore, while
the FAA revises Sec. 450.103(d)(2) to narrow its applicability, as
discussed below, it declines to remove proposed Sec. 450.103(d)(2).
Blue Origin proposed a revision of Sec. 450.103(d)(2) to specify
``public safety.'' Virgin Galactic recommended removing the word
``any'' in front of ``identified inconsistencies,'' and recommended
limiting applicable inconsistencies to those that have an effect on the
safety criteria of Sec. 450.101.
The FAA agrees that proposed Sec. 450.103(d)(2) could be read to
reach more broadly than public safety, so the FAA has revised the
section to require that an operator resolve any inconsistencies
``identified in paragraph (d)(1) of this section'' prior to the next
flight of the vehicle. This language would explicitly limit the
applicability of the provision to the hazard control strategy
determination, and any hazard or flight safety analyses and associated
mitigation and hazard control measures, as opposed to mission success.
The FAA does not agree with Virgin Galactic's suggestion to limit
applicable inconsistencies to those that have an effect on the safety
criteria of Sec. 450.101. That change would imply that a quantitative
analysis is all that is required. As discussed earlier in the hazard
management section, the hazard control strategy determination and the
hazard and flight safety analyses must be kept up to date throughout
the lifecycle of the launch and reentry system, so inconsistencies need
to be addressed. The FAA also does not agree with Virgin Galactic to
remove the word ``any'' in front of ``inconsistencies'' because it
would not change the scope of the requirement, because Sec.
450.103(d)(2) explicitly refers to the analyses in Sec. 450.103(d)(1).
Virgin Galactic recommended that proposed Sec. 450.103(d)(4)--
which would have required an operator to address any anomaly identified
in paragraph (d)(3) prior to the next flight, including updates to any
flight hazard analysis, FSA, or safety-critical system--be revised to
state the FAA should review and provide a determination on an
operator's post-flight data to approve the operator's ability to launch
according to schedule, rather than delaying until all anomalies are
resolved.
The FAA notes that proposed Sec. 450.103(d)(4) would not have
required FAA approval of the methodology an operator uses to address
anomalies in general or a specific anomaly in particular. In order to
avoid Virgin Galactic's interpretation that all anomalies must be
resolved prior to the next flight, the FAA revised the final rule to
require an operator to address any anomaly identified in paragraph
(d)(3) prior to the next flight as necessary to ensure public safety.
As proposed, this would include updates to any flight hazard analysis,
FSA, or safety-critical system. To ensure public safety, the FAA would
expect an operator to reassess its safety analyses to determine any
potentially new public safety hazards or increased risks to known
public safety hazards due to the anomaly and, if necessary, determine
the need for any additional mitigation strategies or updates to its
safety analyses.
v. Application Requirements
An applicant under proposed Sec. 450.103(e) would have to submit
(1) a description of the applicant's safety organization, identifying
the applicant's lines of communication and approval authority, both
internally and externally, for all public safety decisions and the
provision of public safety services; and (2) a summary of the processes
and products identified in the system safety program requirements.
In the final rule, the FAA adopts Sec. 450.103(e) as proposed. The
FAA did not receive any comments on this section.
f. Hazard Control Strategies (Sec. 450.107)
In the NPRM, the FAA proposed in Sec. 450.107 that, for each phase
of a vehicle's flight, an operator does not need to conduct a flight
hazard analysis for that phase of flight if the public safety hazards
identified in the preliminary safety assessment (PSA) can be mitigated
adequately to meet the requirements of proposed Sec. 450.101 using
physical containment, wind weighting, or flight abort, in accordance
with Sec. 450.107(b), (c), and (d). If the public safety hazards
identified in the PSA could not be adequately mitigated using these
methods, an operator would be required to conduct a flight hazard
analysis in accordance with proposed Sec. 450.109 to derive hazard
controls for that phase of flight.
The FAA has restructured Sec. 450.107 in the final rule to require
an operator to use a functional hazard analysis to make a hazard
control strategy determination. This requirement is based on the
requirements for the PSA that was proposed, but not adopted, in Sec.
450.105. In addition, the FAA has removed from Sec. 450.107 specific
details for each hazard control strategy available to operators and
instead directs operators to Sec. Sec. 450.108, 450.109, 450.110, and
450.111, which provide requirements for flight abort,\81\ flight hazard
analysis, physical containment,\82\ and wind weighting, respectively.
---------------------------------------------------------------------------
\81\ In the NPRM, the requirements for flight abort had been
scattered throughout proposed Sec. Sec. 450.107, 450.123, 450.125,
450.127, 450.129, and 450.165. Section 450.108 is discussed more
fully later in the preamble section titled Flight Abort.
\82\ The NPRM did not include a separate section for physical
containment. In the final rule, as will be discussed later, the
requirements from proposed Sec. 450.107(b) are relocated to a new
Sec. 450.110 (Physical Containment).
---------------------------------------------------------------------------
Section 450.107 also characterizes flight hazard analysis as a
hazard control strategy. Although a flight hazard analysis is different
from the other hazard control strategies in that it does not lay out
specific hazard controls, it does lay out a process by which hazard
controls can be derived. The hazard controls that are derived from the
flight hazard analysis, like those defined in the other three hazard
[[Page 79614]]
control strategies, are then used as part of the input to the FSA that
is used to show compliance with Sec. 450.101(a), (b), and (c).
Therefore, because a flight hazard analysis is a means by which an
operator derives the appropriate hazard controls, the FAA has
characterized it as a hazard control strategy in this final rule. As
such, throughout the final rule, a flight hazard analysis is listed
with physical containment, wind-weighting, and flight abort as a hazard
control strategy.\83\ Further, Sec. 450.107(c) retains the proposed
requirement that an operator must conduct a flight hazard analysis if
the public safety hazards for that phase of flight cannot be mitigated
adequately to meet the requirements of Sec. 450.101 through physical
containment, wind weighting, or flight abort.\84\
---------------------------------------------------------------------------
\83\ The FAA notes that, throughout the preamble, it uses the
phrase ``as a hazard control strategy'' to modify physical
containment, wind-weighting, flight abort, and flight hazard
analysis. For example, in the preamble, the FAA refers to operators
who use ``flight abort as a hazard control strategy.'' In such
instances, the FAA means that flight abort is being used as a hazard
control strategy consistent with the requirements in Sec. 450.108.
Likewise, when an operator uses flight hazard analysis as a hazard
control strategy, the operator is conducting a flight hazard
analysis consistent with the requirements set forth in Sec.
450.109.
\84\ Although proposed Sec. 450.107 was written in the
negative, stating that an operator was not required to conduct a
flight hazard analysis if the public safety hazards identified in
the preliminary safety assessment for that phase of flight could be
mitigated adequately to meet the requirements of Sec. 450.101
through physical containment, wind weighting, or flight abort, the
final rule has revised this language to be more easily understood.
---------------------------------------------------------------------------
Lastly, the final rule fixes an error in proposed Sec. 450.107,
which referenced Sec. 450.101 in its entirety as being relevant to the
hazard control strategies, even though certain requirements in Sec.
450.101 regarding the disposal of upper stages, protection of people
and property on orbit, and notification of planned impacts, are not
relevant to the hazard control strategies defined in Sec. 450.107.
Section 450.107 refers instead to Sec. 450.101(a), (b), or (c).
The FAA adds paragraph (b) to Sec. 450.107 to address how an
operator determines its hazard control strategy or strategies for any
phase of flight during a launch or reentry. This paragraph is based on
and replaces a portion of the preliminary safety assessment in proposed
Sec. 450.105 of the NPRM. Because an operator determines a hazard
control strategy or strategies based on an assessment of potential
hazards, the requirements for such an assessment are better suited for
this section. The next preamble section discusses the revision to Sec.
450.107(b) more fully.
Proposed Sec. 450.107(e) would have required an applicant in its
application to describe its hazard control strategy for each phase of
flight. The application requirements in the final rule, in Sec.
450.107(d), similarly require an applicant to provide a description of
its hazard control strategy or strategies for each phase of flight. The
FAA added the phrase ``or strategies'' to reflect the fact that an
operator may use one or more hazard control strategies for any given
phase of flight. In addition, because the requirements for physical
containment have been relocated to Sec. 450.110, the FAA has likewise
relocated the application requirements for physical containment
proposed in Sec. 450.107(e) to Sec. 450.110(c).\85\ These
requirements have been adopted as proposed.
---------------------------------------------------------------------------
\85\ The proposed rule also required an applicant using physical
containment as a hazard control strategy to demonstrate that the
launch vehicle does not have sufficient energy for any hazards
associated with its flight to reach outside the flight hazard area
developed in accordance with Sec. 450.133, and to describe the
methods used to ensure that flight hazard areas are cleared of the
public and critical assets.
---------------------------------------------------------------------------
Lastly, Sec. 450.107(d) in the final rule requires an applicant to
submit in its application the results of its hazard control strategy
determination, including all functional failures identified under Sec.
450.107(b)(1), the identification systems, and a timeline of all
safety-critical events. These relate to the hazard control strategy
determination, which is discussed in the next section of this preamble.
The FAA received a few comments for proposed Sec. 450.107. One
individual commenter supported the additional flexibility inherent in
allowing an operator to select its hazard control strategy and noted
that this flexibility would help to reduce overall design costs for the
private enterprise. Virgin Galactic requested that the FAA define
``traditional hazard controls'' and provide opportunity for public
comment through the issuance of an SNPRM. Blue Origin proposed that the
FAA amend proposed Sec. 450.107(e)(2)(ii) to require that an applicant
describe the methods used to ensure that risk to the public and
critical assets in flight hazard areas meet allowable criteria. This
latter comment is discussed later in the preamble section titled
Physical Containment.
To the extent that Virgin Galactic commented that the term
``traditional hazard controls'' should be defined and comment allowed
through publication of an SNPRM, the FAA notes that the NPRM stated
that traditional hazard controls included physical containment, wind
weighting, and flight abort.\86\
---------------------------------------------------------------------------
\86\ See 84 FR 15316 (footnote 62).
---------------------------------------------------------------------------
g. Hazard Control Strategy Determination (Sec. 450.107(b))
In the NPRM, the FAA proposed in Sec. 450.105 to require that
every operator conduct and document a PSA for the flight of a launch or
reentry vehicle to identify potential public safety impacts early in
the design process. The FAA intended the PSA to be a top-level
assessment of the potential public safety impacts identifiable early in
the design process and broad enough that minor changes in vehicle
design or operations would not have a significant impact on, or
invalidate the products produced by, the PSA. As proposed, the PSA
would have required the operator to identify a number of items,
including: A preliminary hazard list that documents all hardware,
operational, and design causes of vehicle response modes that,
excluding mitigation, have the capability to create a hazard to the
public; safety-critical systems; and a timeline of all safety-critical
events.\87\ An applicant would have been required to submit the PSA
result, including the items identified above, in its application for a
license.
---------------------------------------------------------------------------
\87\ The operator would also have needed to identify (1) vehicle
response modes; (2) public safety hazards associated with vehicle
response modes, including impacting inert and explosive debris,
toxic release, and far field blast overpressure; (3) geographical
areas where vehicle response modes could jeopardize public safety;
(4) any population exposed to public safety hazards in or near the
identified geographical areas; and (5) the CEC, unless otherwise
agreed to by the Administrator based on the demonstrated reliability
of the launch or reentry vehicle during any phase of flight.
---------------------------------------------------------------------------
The final rule removes proposed Sec. 450.105 in its entirety but
relocates certain items from the PSA section into Sec. 450.107(b) as
part of the hazard control strategy determination. The final rule
replaces the requirement for a PSA with a functional hazard analysis
and replaces the term ``vehicle response mode'' with ``reasonably
foreseeable hazardous events.'' The FAA finds these changes are less
prescriptive and burdensome on an operator, while preserving the
intended benefits and level of safety of the proposed requirements.
Blue Origin and Microcosm commented that requiring operators to
develop a preliminary hazard list that identifies all causes of hazards
and vehicle response modes for a PSA, prior to analysis or testing of
their vehicle systems, was unreasonable. Blue Origin stated it would be
infeasible to document in a preliminary hazard list all hardware,
operational, and design causes of vehicle response modes capable of
causing a hazard to the public at the preliminary design phase.
[[Page 79615]]
The commenters noted that operators identify potential hazards, but not
all causes of vehicle response modes, prior to the detailed design
phase. Blue Origin added that identification of causes was a continuous
process that evolves as hardware and operations design matures, and
recommended the PSA be limited to analyzing and identifying all
functional failures that could have the capability to create a hazard
to the public, rather than analyzing the detailed design, which may
still be maturing. Blue Origin also noted that early engagement with
the FAA through the pre-application process, before a design is mature,
was beneficial to both parties.
The FAA concurs that the detailed design may not be mature enough
at a preliminary stage such that an operator could define all hardware,
operational, and design causes of vehicle response modes with minimal
changes downstream in the development process in a preliminary hazard
list. Although the preliminary hazard list would not have been provided
to the FAA until an applicant submitted an application, the FAA agrees
with the commenters that the proposed rule would have required a launch
or reentry operator to complete the preliminary hazard list early in
the design process, to enable the operator to then carry out its hazard
control strategy or strategies. This, as noted by Blue Origin, would
not have been practicable as proposed. Accordingly, the FAA does not
adopt the proposed requirement for an operator to identify a
preliminary hazard list. Instead, the FAA requires an operator, in
Sec. 450.107(b), to determine its hazard control strategy or
strategies for any phase of flight during a launch or reentry, based on
a functional hazard analysis accounting for all functional failures
associated with reasonably foreseeable hazardous events, safety-
critical systems, and safety-critical events. Even with this change,
the FAA also agrees with Blue Origin that this approach will encourage
operators to engage early with the FAA, prior to the design becoming
mature.
In the final rule, the FAA eliminates proposed Sec. 450.105, but
moves, with some revision, the requirements in proposed Sec. Sec.
450.105(a)(6) through (a)(8) into Sec. 450.107(b). Section 450.107(b),
titled ``Hazard Control Strategy Determination,'' requires that for any
phase of flight during a launch or reentry, an operator must use a
functional hazard analysis to determine a hazard control strategy or
strategies accounting for (1) all functional failures associated with
reasonably foreseeable hazardous events that, excluding mitigation,
have the capability to create a hazard to the public, (2) safety-
critical systems, and (3) a timeline of all safety-critical events.
In the NPRM, proposed Sec. 450.105(a)(6) would have required a
preliminary hazard list documenting all hardware, operational, and
design causes of vehicle response modes that, excluding mitigation,
have the capability to create a hazard to the public. The final rule
requires an operator to use a functional hazard analysis that accounts
for, among other things, all functional failures associated with
reasonably foreseeable hazardous events that, excluding mitigation,
have the capability to create a hazard to the public. A functional
failure is a condition of a system, subsystem, or component function
derived by assessing each function against multiple potential failure
modes during each phase of the system's mission. This addresses Blue
Origin's concerns about the preliminary hazard list because identifying
functional failures does not require detailed design information that
may not be finalized at the stage of design when a hazard control
strategy is being considered.
A functional hazard analysis is a common system safety tool that,
as articulated in DOD's MIL-STD-882E, is used to identify and classify
the system functions and the safety consequences of functional failure
or malfunction.\88\ A functional hazard analysis is a foundational tool
useful throughout the lifecycle of the launch or reentry system that
helps drive the design and development process at a preliminary stage
by identifying safety-critical functions of which launch and reentry
vehicle developers should be cognizant throughout the process to ensure
public safety. The requirement to perform a functional hazard analysis
instead of a preliminary hazard list, as proposed in Sec. 450.105,
should reduce the burden on operators, for the reasons cited by Blue
Origin.
---------------------------------------------------------------------------
\88\ Department of Defense, Standard Practice for System Safety,
MIL-STD-882E, May 11, 2012.
---------------------------------------------------------------------------
The FAA finds that a functional hazard analysis will preserve the
benefits of the preliminary safety assessment proposed in the NPRM, but
reduce the burden on applicants by not requiring detailed design
information that may not be finalized at the stage of design when a
hazard control strategy is being considered. Like the PSA, a functional
hazard analysis should help an operator identify specific information
relevant to public safety, scope the analyses that must be conducted to
ensure that the launch or reentry operation satisfies safety criteria,
identify the effect of design and operational decisions on public
safety, and provide the operator with an appropriate hazard control
strategy for its proposed operation.
Section 450.107(b)(1) in the final rule requires an operator to use
a functional hazard analysis to determine a hazard control strategy
accounting for all functional failures associated with reasonably
foreseeable hazardous events that, excluding mitigation, have the
capability to create a hazard to the public. As noted earlier, a
functional failure is a condition of a system, subsystem, or component
function derived by assessing each function against multiple potential
failure modes during each phase of the system's mission. The failure
end-effect is the resulting system behavior from each functional
failure. Failure end-effects that result in impacts to public safety
should in turn identify the safety-critical systems and can be grouped
to identify the system hazards to the public. Thus, the inability of a
safety-critical system, subsystem, or component to function as
designed, or to function erroneously, may potentially result in a
hazard to the public. It is important to note that public exposure to a
hazard should only be accounted for after determining the potential
hazards to the public. That is, limits to public exposure can be a
mitigation when considering hazards at the overall system or mission
level, and thus not considered when determining what constitutes a
hazard to the public (i.e., functional sources of the hazard) for the
purposes of Sec. 450.107(b)(1).
The FAA does not retain in Sec. 450.107(b) the items in proposed
Sec. 450.105(a)(1) through (a)(5) for an operator to identify (1)
vehicle response modes, (2) public safety hazards associated with
vehicle response modes, (3) geographical areas where vehicle response
modes could jeopardize public safety, (4) any population exposed to
public safety hazards in or near the identified geographical areas, and
(5) the CEC. These are addressed in the four hazard control
strategies and in FSA.
Finally, the FAA replaces the term ``vehicle response mode'' in the
NPRM with ``reasonably foreseeable hazardous events'' in Sec.
450.107(b)(1) in the final rule. As explained in the preamble section
discussing Sec. 450.101(c), the NPRM defined ``vehicle response mode''
as a mutually-exclusive scenario that characterizes foreseeable
combinations of vehicle trajectory and debris generation. The final
rule is less prescriptive by requiring that an operator account for
reasonably foreseeable hazardous events, instead of
[[Page 79616]]
each foreseeable combination of vehicle trajectory and debris
generation. Accounting for reasonably foreseeable hazardous events in a
functional hazard analysis is consistent with common industry
standards. This change also means the FAA does not adopt the proposed
definition of ``vehicle response mode'' in Sec. 401.7.
Blue Origin also requested clarification from the FAA on its
interpretation of the requirement proposed in Sec. 450.105(a)(8) to
provide ``a timeline of all safety-critical events.'' Blue Origin noted
that it interprets ``safety'' to mean meeting the collective and
individual risk requirements for launch and reentry and, in essence,
suggested that the PSA should be limited in scope based on the
collective risk criteria resulting from the FSA.
The FAA does not agree with Blue Origin's interpretation nor with
its suggestion that this requirement, now in Sec. 450.107(b)(3) in the
final rule, be limited by the results of FSA. The FAA will consider any
event that occurs during a phase of flight of a launch or reentry
vehicle that meets the definition of ``safety critical'' in Sec. 401.7
to be a ``safety-critical event.''
As noted earlier, proposed Sec. 450.105 would have required that
every operator conduct and document a PSA for the flight of a launch or
reentry vehicle and submit its results. Virgin Galactic inquired as to
when the PSA would be due to the FAA, as well as the timeline for the
review. The final rule replaces the requirement to conduct a PSA with
the requirement to conduct a functional hazard analysis in Sec.
450.107(b). The application requirements for Sec. 450.107(b) are in
Sec. 450.107(d) and are due with the application, even though a launch
or reentry operator will conduct the functional hazard analysis early
in the design phase, well before it applies for a license. This
approach is consistent with Blue Origin's recommendation that the
analysis be limited to analyzing and identifying all functional
failures that could have the capability to create a hazard to the
public, rather than analyzing the detailed design, which may still be
maturing. As such, in the final rule an applicant is required to
provide the results of the functional hazard analysis, including all
functional failures, the identification of all safety-critical systems,
and a timeline of all safety-critical events.
h. Flight Abort (Sec. 450.108)
As discussed, if an operator cannot ensure by means other than
flight abort \89\ that it has sufficiently protected against a high
consequence event (as measured by CEC), the only remaining
way to satisfy Sec. 450.101(c) is to use flight abort consistent with
the requirements in Sec. 450.108.
---------------------------------------------------------------------------
\89\ As discussed, Sec. 450.101(c)(2) and (c)(3) allow an
operator to demonstrate it can sufficiently protect against a high
consequence event through other means that reduce CEC
below 1 x 10-\3\ or through demonstrated reliability.
---------------------------------------------------------------------------
In the NPRM, the FAA proposed to address flight abort in several
sections. As proposed, to implement flight abort as a hazard control
strategy, an operator would have been required to:
(1) Establish flight safety limits and gates in accordance with
proposed Sec. Sec. 450.123 (Flight Safety Limits Analysis) and
450.125 (Gate Analysis);
(2) establish when an operator must abort a flight following the
loss of vehicle tracking information with proposed Sec. 450.127
(Data Loss Flight Time and Planned Safe Flight State Analyses);
(3) establish the mean elapsed time between the violation of a
flight abort rule and the time when the FSS is capable of aborting
flight for use in establishing flight safety limits in accordance
with proposed Sec. 450.129 (Time Delay Analysis);
(4) establish flight abort rules in accordance with Sec.
450.165(c) (Flight Abort Rules); and
(5) employ an FSS in accordance with Sec. 450.145 and software
in accordance with Sec. 450.111.
Many of these requirements were derived from existing requirements in
part 417 and retained a more prescriptive approach to flight abort than
the final rule adopts.
Blue Origin, CSF, and SpaceX commented that the FSA requirements in
proposed Sec. Sec. 450.117 through 450.141 were too prescriptive and
should be replaced with a performance standard. The commenters cited a
lack of flexibility and the use of an approach directed at large
orbital launches from Federal launch or reentry sites.
In the final rule, the FAA consolidates the requirements for flight
abort in Sec. 450.108 and revises the more prescriptive requirements
from the proposal into a single performance-based regulation. As a
result of this consolidation, proposed Sec. Sec. 450.123, 450.125,
450.127, and 450.129 are not included in the final rule. The
requirements in these sections have been revised to reflect the
performance-based standards in Sec. 450.108(c), which establishes
flight safety limits objectives, and Sec. 450.108(d), which
establishes flight safety limits constraints. The FAA adds Sec.
450.108(e) in the final rule to relieve the operator from the
requirement to use flight abort in certain situations in which high
consequence events are possible but would not be effectively mitigated
by an FSS. In addition, the flight abort rule requirements proposed in
Sec. 450.165(c) have been revised and relocated to Sec. 450.108(f) to
reflect the revisions to the flight safety limits requirements. The FAA
also moves the reference to FSS reliability from proposed Sec.
450.101(c) to Sec. 450.108(b).
The FAA will provide guidance to illustrate how operators may
demonstrate compliance with these requirements. The guidance will
encompass many of the traditional means of developing flight safety
limits, but operators can develop other means of demonstrating
compliance with the performance-based objectives and constraints. As
discussed in more detail throughout this section of the preamble, the
revisions in the final rule allow for greater flexibility for operators
while maintaining the same level of safety as proposed in the NPRM.
i. FSS Thresholds Using CEC
In the NPRM, an operator required to use flight abort under
proposed Sec. 450.101(c) was referred to proposed Sec. 450.145 to
determine the required reliability of its FSS based on CEC.
Section 450.145(a)(1) proposed to require an operator to employ an FSS
with design reliability of 0.999 at 95 percent confidence and
commensurate design, analysis, and testing if the consequence of any
vehicle response mode is 1 x 10-\2\ CEC or
greater. This is the reliability standard for a highly reliable FSS
under part 417. Section 450.145(a)(2) proposed to require that, if the
consequence of any vehicle response mode is between 1 x
10-\2\ and 1 x 10-\3\ CEC for
uncontrolled areas, an operator must employ an FSS with a design
reliability of 0.975 at 95 percent confidence and commensurate design,
analysis, and testing. The FAA explained that, for operations for which
the consequence of a flight failure is less, an FSS--while still being
reliable--may not need to be as highly reliable as an FSS for a vehicle
operating in an area where the consequence of a flight failure is
higher.\90\
---------------------------------------------------------------------------
\90\ The FAA anticipated that this proposed relaxation of the
FSS reliability requirements would be applicable to operations
launching or reentering in remote locations or for stages that do
not overfly population centers. 84 FR 15328.
---------------------------------------------------------------------------
In the final rule, the CEC thresholds for establishing
the reliability or other requirements for an FSS proposed in Sec.
450.145(a) have been moved to Sec. 450.108(b). The requirements for a
highly reliable FSS proposed in
[[Page 79617]]
Sec. 450.145(a)(1) remain in Sec. 450.145.\91\ However, the
requirements for an FSS proposed in Sec. 450.145(a)(2) have been
revised and relocated to Sec. 450.143.\92\
---------------------------------------------------------------------------
\91\ The reliability requirements for a highly reliable FSS will
be discussed later in the preamble in the section pertaining to
Sec. 450.145.
\92\ The reliability requirements for an FSS that is not
required to meet the standard for highly reliable FSS will be
discussed later in the preamble in the section pertaining to Sec.
450.143.
---------------------------------------------------------------------------
Rocket Lab agreed with the concept of quantifying consequence as a
key metric in determining the reliability of a flight abort system.
Other commenters were critical of the proposed use of CEC
thresholds to set reliability standards for any required FSS,
particularly in situations in which a lower reliability FSS may be
sufficient to protect the public. For example, SpaceX commented that
the requirement in RCC 319 for an FSS with 0.999 at 95 percent
confidence reliability was overly prescriptive for low-risk mission
profiles. CSF noted that, by ``binning'' the CEC of a
vehicle and then prescribing a fixed reliability requirement for the
FSS, risk of an unmitigated (by FSS) CEC event was not
consistent. CSF commented that such an approach requires the same FSS
even though the risk varies by an order of magnitude between the
extreme values. Several other commenters, including CSF and Sierra
Nevada commented that the FAA should not preclude applicants from
making a ``safety case'' to justify a certain level of rigor for their
FSS.
As noted in the discussion of Sec. 450.101(c), the FAA has
retained CEC as the appropriate regulatory standard for
measuring high consequence events. Likewise, for the reasons set forth
in that section of the preamble, the FAA has retained the use of
CEC in Sec. 450.108(b) to determine the level of
reliability required for an FSS. However, in response to comments, the
FAA has added flexibility for FSS that do not need to meet the standard
for highly reliable FSS in proposed Sec. 450.145(a)(1) based on the
CEC. The FAA notes that an operator does not need to
calculate CEC for the purposes of determining reliability
under Sec. 450.108(b) if it elects to use a highly reliable FSS that
meets the requirements of Sec. 450.145.
In the final rule, the FAA removes the prescribed reliability
threshold proposed in Sec. 450.145(a)(2) of the NPRM for operations
with a maximum CEC value between 1 x 10-\2\ and 1
x 10-\3\. Accordingly, an operator does not need to employ
an FSS with a design reliability of 0.975 at 95 percent confidence and
commensurate design, analysis, and testing. Rather, under Sec.
450.108(b)(2), an operator must use an FSS that meets the requirements
of Sec. 450.143 if the consequence of any reasonably foreseeable
failure mode in any significant period of flight is between 1 x
10-\2\ and 1 x 10-\3\ CEC for
uncontrolled areas.
The requirements for the two types of FSS, as well as the removal
of the proposed requirements, are discussed in more detail later in
this preamble in the discussion of Sec. Sec. 450.143 and 450.145.
ii. Flight Safety Limits Objectives
Proposed Sec. 450.123(a) stated an FSA must identify the location
of uncontrolled areas and establish flight safety limits that define
when an operator must initiate flight abort to: (1) Ensure compliance
with the safety criteria of Sec. 450.101; and (2) prevent debris
capable of causing a casualty from impacting in uncontrolled areas if
the vehicle is outside the limits of a useful mission.
The introductory language of Sec. 450.108(c) is a revision of
proposed Sec. 450.123(a).\93\ In the final rule, Sec. 450.108(c),
titled ``Flight Safety Limits Objectives,'' requires an operator to
determine and use flight safety limits that define when an operator
must initiate flight abort if the conditions enumerated in Sec.
450.108(c)(1) through (c)(5) are met. Alternatively, an operator could
meet Sec. 450.108(c)(6) to satisfy the requirements of Sec.
450.108(c)(2) and (c)(4).
---------------------------------------------------------------------------
\93\ The FAA has not included in the final rule the language in
Sec. 450.123(a) that would have required the operator to identify
the location of uncontrolled areas. The FAA finds it is unnecessary
to specify this language in the introductory paragraph of Sec.
450.108(c) because an operator must identify the location of
uncontrolled areas to meet the objectives of Sec. 450.108(c)(2)
through (6).
---------------------------------------------------------------------------
The following sections provide additional detail on the
performance-based flight safety limits objectives derived from the more
prescriptive requirements proposed in the NPRM and respond to public
comments on the proposals in the NPRM to the extent they are relevant
to compliance with the final rule.
Section 450.108(c)(1)
Section 450.108(c)(1) requires that an operator initiate flight
abort to ensure compliance with the safety criteria of Sec. 450.101(a)
and (b). The FAA proposed a related requirement in Sec. 450.123(a)(1),
which stated that an FSA must identify the location of uncontrolled
areas and establish flight safety limits that define when an operator
must initiate flight abort to ensure compliance with the safety
criteria of Sec. 450.101. In the final rule, Sec. 450.108(c)(1)
specifies the relevant subparagraphs in Sec. 450.101 to which this
requirement applies. The FAA makes this change in the final rule
because the requirement in Sec. 450.101(c)(1) is met through use of
flight abort as a hazard control strategy, and Sec. 450.101(d), (e),
and (f) are not relevant to flight abort.
Section 450.108(c)(2)
In the NPRM, proposed Sec. 450.123(a)(2) required the operator to
prevent debris capable of causing a casualty from impacting in
uncontrolled areas if the vehicle is outside the limits of a useful
mission. In the final rule, Sec. 450.108(c)(2) requires that an
operator initiate flight abort to prevent continued flight from
increasing risk in uncontrolled areas if the vehicle is unable to
achieve a useful mission.
Although proposed Sec. 450.123(a)(2) focused on debris impacts in
uncontrolled areas to define when an operator must initiate flight
abort, Sec. 450.108(c)(2), as finalized, acknowledges that debris
impact is not the only risk contributor that must be accounted for in
determining flight safety limits. For example, a release of toxic
propellant following a debris impact may also contribute to risk.
Therefore, in Sec. 450.108(c)(2), an operator must determine and use
flight safety limits to prevent continued flight from increasing risk
once a vehicle can no longer achieve a useful mission. The FAA
recognizes that a vehicle may deviate from the limits of a useful
mission during a period when hazard containment through flight abort is
not possible. In this case, the requirement is not to allow continued
flight to increase risk, though some risk from either flight abort or
continued flight may be unavoidable.
For example, a vehicle may begin an unplanned turn away from a
nominal trajectory while overflying an island. Once the vehicle leaves
the limits of a useful mission, the operator should initiate flight
abort if continued flight would result in an increase in risk. Pursuant
to Sec. 450.108(c)(2), depending on the risk to the public, it may be
better to withhold flight abort until the hazards resulting from the
abort would not affect the island. However, if the turn is towards a
major population center on the island, it may pose less of a risk to
the public to abort the flight as soon as it leaves the limits of a
useful mission, even if it might result in a hazard posed to less-dense
populated areas.
[[Page 79618]]
The concepts of ``useful mission'' and ``limits of a useful
mission'' \94\ are discussed in greater detail in the preamble section
on FSA methods (specifically, in Sec. 450.119 (Trajectory Analysis for
Malfunction Flight)).
---------------------------------------------------------------------------
\94\ A useful mission means a mission that can attain one or
more objectives. Limits of a useful mission means the trajectory
data or other parameters that bound the performance of a useful
mission, including flight azimuth limits.
---------------------------------------------------------------------------
The FAA also notes that the maximum extents of a gate,\95\
determined by the limits of a useful mission in proposed Sec.
450.125(c)(2), are addressed by Sec. 450.108(c)(2) in the final rule,
which requires flight abort to prevent continued flight from increasing
risk in uncontrolled areas if the vehicle is unable to achieve a useful
mission. Therefore, trajectories outside the limits of a useful mission
that intersect flight safety limits that prevent increased risk in
uncontrolled areas must trigger flight abort.
---------------------------------------------------------------------------
\95\ A gate is an opening in a flight safety limit through which
a vehicle may fly, provided the vehicle meets certain pre-defined
conditions such that the vehicle performance indicates an ability to
continue safe flight. Gate analysis has been removed from the final
rule.
---------------------------------------------------------------------------
Virgin Galactic recommended that the term ``prevent'' in proposed
Sec. 450.123(a)(2) be qualified, as it could be taken to mean many
probabilistic values. Although proposed Sec. 450.123(a)(2) has been
removed from the final rule, Sec. 450.108(c) uses the term ``prevent''
in five places including Sec. 450.108(c)(2). In Sec. 450.108 (c)(2),
(3), (5), and (6), prevention is dependent on the proper functioning of
the FSS. There is no expectation that these objectives will be met if
the FSS fails to function properly. In Sec. 450.108(c)(4), when the
reliability of the FSS is accounted for pursuant to Sec.
450.108(d)(5), prevention is considered to be achieved.
Section 450.108(c)(3)
As noted earlier, the FAA proposed in Sec. 450.125 to establish
the requirements for a gate analysis. The FAA explained that the
primary purpose of gates is to establish safe locations and conditions
to abort the flight prior to the vehicle entering a region or condition
where it may endanger populated or other protected areas if flight were
to continue. A gate should be placed where a trajectory within the
limits of a useful mission intersects a flight safety limit as long as
that trajectory meets the risk criteria in Sec. 450.101. In response
to comments that the proposed gate analysis requirements created
confusion and should be more performance-based, Sec. 450.125 is not
included in the final rule.
In the final rule, the concept of gate analysis in proposed Sec.
450.125 is captured in a more performance-based manner in Sec.
450.108(c)(3).\96\ Section 450.108(c)(3) requires that an operator
initiate flight abort to prevent the vehicle from entering a period of
materially increased public exposure in uncontrolled areas, including
before orbital insertion, if a critical vehicle parameter is outside
its pre-established expected range or indicates an inability to
complete flight within the limits of a useful mission. The FAA removes
the term ``gate'' in the final rule to allow operators to use another
method to comply with the requirements. Furthermore, the term ``gate''
can have different meanings within the industry, which can cause
confusion. However, although the term ``gate'' is not used in the final
rule, the FAA expects a similar approach to a gate analysis will be
used by many operators and by Federal launch or reentry sites. With the
removal of explicit gate requirements, the term ``tracking icon'' is no
longer required, and the FAA therefore removes the term from the final
rule.
---------------------------------------------------------------------------
\96\ The performance-based requirement in Sec. 450.108(c)(3)
incorporates elements of proposed Sec. 450.125(a), (b)(1), (b)(2),
and (b)(4).
---------------------------------------------------------------------------
The FAA notes that a period of materially increased public exposure
would include the beginning of a period when the vehicle will overfly a
major landmass prior to orbital insertion (e.g., Europe, Africa, or
South America). Overflight of large islands with substantial population
may also constitute a period of materially increased public exposure,
while overflight of islands with small populations or other areas of
sparse population will not constitute a period of materially increased
public exposure. Consequence may be used to determine if an exposed
area should be considered an area of materially increased public
exposure. Orbital insertion also results in a material increase in
public exposure due to the possibility of a random reentry from a
vehicle that cannot achieve a minimum safe orbit. A vehicle intended
for orbit that cannot achieve a minimum safe orbit would require flight
abort under Sec. 450.108(c)(3). The FAA will provide guidance on what
constitutes materially increased public exposure.\97\
---------------------------------------------------------------------------
\97\ For example, a period of materially increased public
exposure would include any area where the CEC from any
on-trajectory failure mode is greater than 1 x 10-\2\.
---------------------------------------------------------------------------
The FAA notes that, for purposes of Sec. 450.108(c)(3), a
``critical vehicle parameter'' is a parameter that demonstrates the
vehicle is capable of completing safe flight through the upcoming phase
of flight for which population is exposed to hazardous debris effects
from reasonably foreseeable failure modes. An example of a critical
vehicle parameter outside its pre-established expected range is a tank
pressure that is higher than the normal operating range and could lead
to a rupture. An example of a critical vehicle parameter that indicates
an inability to complete flight within the limits of a useful mission
is an acceleration that is too low and would result in a vehicle
failing to reach orbit. The operator must select parameters and their
acceptable ranges that are appropriate for the vehicle and mission,
with consideration of the ability to measure and act on the parameters,
and describe in the application the parameters that will be used and
how their ranges were determined, pursuant to the application
requirement in Sec. 450.108(g)(3).
The intent of the gate analysis in proposed Sec. 450.125 was to
prevent unnecessarily exposing the public to hazards from a mission
that can no longer be useful. Proposed Sec. 450.125(a) required that
an FSA include a gate analysis for an orbital launch or any launch or
reentry where one or more trajectories that represent a useful mission
intersect a flight safety limit that provides containment of debris
capable of causing a casualty. Gate analysis was necessary if a vehicle
on a useful mission needed to fly in an area where population could be
exposed to hazards in the event of a vehicle failure. As long as a
trajectory met the individual and collective risk criteria of Sec.
450.101(a)(1) and (a)(2) for a launch, or (b)(1) and (b)(2) for a
reentry, when treated like a nominal trajectory with normal trajectory
dispersions, the flight safety limit with which it intersected would be
removed (or ``relaxed,'' as described in the NPRM),\98\ so flight of
the vehicle would not be aborted. Alternatively, under proposed Sec.
450.125(b)(1), the flight safety limit could be replaced with a gate
that allowed continued flight as long as a real-time measure of
performance indicated that the vehicle was able to complete a useful
mission.
---------------------------------------------------------------------------
\98\ See 84 FR 15386.
---------------------------------------------------------------------------
Section 450.108(c)(3) achieves the intent in proposed Sec.
450.125(a) because it codifies the goals achieved by gate analysis but
allows for alternative approaches to achieve the same objective.
Similar to the gate analysis in proposed Sec. 450.125(a), the analysis
in Sec. 450.108(c)(3) is required when a trajectory that represents a
useful
[[Page 79619]]
mission approaches an uncontrolled area.
Proposed Sec. 450.125(b)(1) required that a gate analysis
establish a relaxation of the flight safety limits that allows
continued flight or a gate where a decision will be made to abort the
launch or reentry or allow continued flight. This proposed requirement
is addressed in Sec. 450.108(c)(3) because it also either allows
continued flight without a check of critical vehicle parameters if the
upcoming population exposure is not materially increased, or requires a
check of critical vehicle parameters before continued flight if the
upcoming population exposure is materially increased. In this respect,
the final rule provides clarity on the point at which the check of
critical vehicle parameters is required, whereas the proposal was
ambiguous on when a gate would be required.
Proposed Sec. 450.125(b)(2) stated that, if a gate is established,
a gate analysis must include a measure of performance at the gate that
enables the flight abort crew or autonomous FSS to determine whether
the vehicle is able to complete a useful mission or abort the flight if
it is not. In the final rule, this requirement is addressed in Sec.
450.108(c)(3), which states, ``if a critical vehicle parameter is
outside its pre-established expected range or indicates an inability to
complete flight within the limits of a useful mission.'' The pre-
established expected range of the critical vehicle parameters are those
values that do not predict the vehicle will fail or exit the limits of
a useful mission, or simply those that indicate the vehicle is
performing as intended. Accordingly, as with gate analysis under the
proposal, the operator will establish the measure of performance--
referred to as the critical vehicle parameter(s) and pre-established
expected range(s) in the final rule--that will determine whether flight
abort must be initiated.
Proposed Sec. 450.125(b)(4) stated that a gate analysis must
establish, for an orbital launch, a gate at the last opportunity to
determine whether the vehicle's flight is in compliance with the flight
abort rules and can make a useful mission, and to abort the flight if
it is not. This requirement is addressed by the Sec. 450.108(c)(3)
requirement that critical vehicle parameters must be checked before
orbital insertion. Therefore, Sec. 450.108(c)(3) is a more
performance-based requirement that is consistent with the proposed
Sec. 450.125(b)(4).
The FAA notes that certain concepts in proposed Sec. 450.125 are
also captured in Sec. 450.108(c)(2), (c)(4), and (d)(7), as discussed
in the preamble associated with those sections. The FAA finds that the
intent of the proposed gate analysis requirements would be clearer if
these requirements are included as separate flight safety limits
objectives and constraints because they can also be applied outside of
a traditional gate analysis.
The FAA received several comments on proposed Sec. 450.125 focused
on the proposed definition of the term ``gate,'' the prescriptive
nature of the requirements for a gate analysis, and the manner in which
gates would be applied. Boeing, Lockheed Martin, Northrop Grumman, and
ULA commented that the gate analysis must establish a relaxation of the
flight safety limits that allows continued flight or a gate where a
decision will be made to abort the launch or reentry or allow continued
flight. The commenters asserted that flight rules and placards can
constrain allowable trajectories, and that it is appropriate to
disapprove a trajectory if the nominal trajectory is beyond the flight
safety limits. The FAA declined to make the recommended change because
Sec. 450.108(c)(3) allows a nominal vehicle to overfly a populated
area, which is current practice. A flight safety limit that intersects
the nominal trajectory trace can only be enforced if the vehicle has
experienced a malfunction before reaching the limit. These limits are
common, such as gates protecting downrange landmasses before
overflight.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended
replacing ``flight abort'' with ``flight termination'' to distinguish
between a flight abort for a reason unrelated to public safety. The FAA
did not adopt this change because the term ``flight abort'' is meant to
encompass hazard control strategies that may not include destruction of
a vehicle or termination of thrust. For example, flight abort for a
captive carry mission may entail aborting the mission and returning to
base or landing at a contingency site. The FAA finds that the term
``flight termination'' has connotations that are inconsistent with the
FAA's intent.
Boeing, Lockheed Martin, Northrop Grumman, and ULA requested
clarification on the term ``relaxation of a flight safety limit'' in
the NPRM and questioned whether it is appropriate for an operator to
relax a flight safety limit.
The FAA agrees that the proposed language ``relaxation of a flight
safety limit'' lacked clarity and that the regulation should be clear
about when a vehicle may overfly population without a performance
check. The final rule removes terms related to relaxed flight safety
limits and states in Sec. 450.108(c)(3) that the critical vehicle
parameter check is required prior to entering a period of materially
increased public exposure in uncontrolled areas, including before
orbital insertion. The meaning of ``materially increased public
exposure'' is discussed earlier in this section.
Rocket Lab inquired whether a gate analysis is required for when a
trajectory intersects a flight safety limit, if an operator was using
flight abort only as a hazard control strategy.
In the final rule, pursuant to Sec. 450.108(c)(3), this
performance check is not necessary if the vehicle is not approaching an
area of materially increased public exposure regardless of how the
operator develops flight safety limits, as long as it meets
requirements in Sec. 450.108(c) and (d). The FAA also notes that if
flight abort is not required as a hazard control strategy to meet the
safety criteria of Sec. 450.101, an operator may still choose to use
flight abort at its discretion. Compliance with Sec. 450.108(c)(3) is
only required for an operator required to use flight abort as a hazard
control strategy to meet the safety criteria of Sec. 450.101.
Section 450.108(c)(4)
As noted earlier, proposed Sec. 450.125(c) would have required the
extent of any gate or relaxation of the flight safety limits to be
based on normal trajectories, trajectories that may achieve a useful
mission, collective risk, and consequence criteria. Section
450.108(c)(4) in the final rule is related to proposed Sec.
450.125(c)(1) and (c)(2) in that it describes the consequence
requirements for flight safety limits; however, it contains differences
as explained in this section of the preamble.
In the final rule, Sec. 450.108(c)(4) requires that an operator
initiate flight abort to prevent conditional expected casualties
greater than 1 x 10-\2\ in uncontrolled areas due to flight
abort or due to flight outside the limits of a useful mission from any
reasonably foreseeable off-trajectory failure mode initiating in any
significant period of flight. The purpose of Sec. 450.108(c)(4) is to
ensure that, when an operator cannot develop flight safety limits that
prevent hazards from affecting uncontrolled areas, the failure modes
that result in deviations from the planned trajectory will not result
in a high consequence event if the vehicle is unable to achieve a
useful mission. This scenario can arise when some public exposure must
be accepted to allow useful vehicles to continue during a phase of
flight when flight abort is still used as a hazard control strategy.
[[Page 79620]]
This situation frequently occurs, for example, on northeasterly
missions launched from the Eastern Range that are permitted to overfly
some portions of Nova Scotia and Newfoundland on trajectories within
the limits of a useful mission. If the vehicle fails after the
overflight has begun and reaches flight safety limits protecting more
westerly portions of the uncontrolled areas from flight outside the
limits of a useful mission, the consequence from flight abort must meet
the criteria in Sec. 450.108(c)(4).
Proposed Sec. 450.125(c)(1) and (c)(2) included the consequence
requirements as a part of gate analysis. In the final rule, the
consequence requirements are a standalone flight safety limits
objective in Sec. 450.108(c)(4). The final rule also makes several
revisions. First, the final rule expressly states flight safety limits
are required only to prevent high consequence events in uncontrolled
areas. This concept was implied in the NPRM because, per proposed Sec.
450.123(a)(2), flight safety limits must prevent debris capable of
causing a casualty from impacting in uncontrolled areas if the vehicle
is outside the limits of a useful mission. The consequence criteria in
proposed Sec. 450.125(c)(1) and (c)(2) were applicable to flight
safety limits that did not prevent debris from impacting in
uncontrolled areas following a gate or relaxation in a flight safety
limit developed per Sec. 450.123(a)(2). Therefore, the proposed
consequence criteria only applied to uncontrolled areas.
Second, the requirement in the final rule applies in cases of
flight abort and in cases where the vehicle is outside the limits of a
useful mission. The consequence criteria in proposed Sec.
450.125(c)(1) and (c)(2) were only applicable in cases of flight abort.
If only flight abort action were considered, a high consequence event
resulting from other outcomes (intact impacts, structural breakup,
etc.) outside the limits of a useful mission might not be identified.
Vehicle failures within the limits of a useful mission are excluded
from the consequence criteria in Sec. 450.108(c)(4) in the final rule
because flight abort cannot prevent a failure from affecting
uncontrolled areas that must be exposed to allow a vehicle on a useful
mission to continue flight. For example, if a vehicle begins an
unplanned turn from the nominal trajectory while overflying
uncontrolled areas and breaks up aerodynamically before exiting the
limits of a useful mission, this failure would not count against the
consequence criteria because the vehicle was within the limits of a
useful mission when the outcome of the failure occurred. Collective
risk requirements still apply in these scenarios and ensure that the
risk is met for any trajectory that the operator declares as
representing a useful mission, pursuant to Sec. 450.108(d)(7).
Third, whereas proposed Sec. 450.125(c)(1) and (c)(2) concerned
the consequence from flight abort ``resulting from any reasonable
vehicle response mode,'' Sec. 450.108(c)(4) concerns the consequence
from any ``reasonably foreseeable off-trajectory failure mode.'' The
replacement of ``vehicle response mode'' with ``failure mode'' is
discussed in the preamble section on Sec. 450.101(c)(2).\99\ The term
``off-trajectory'' was added to explain further which types of failures
must result in the consequence criteria being met. Off-trajectory
failures are those for which the vehicle deviates from its intended
flight path--for example due to failures of the guidance, navigation,
or control systems. Outcomes from on-trajectory failures, such as an
explosion or loss of thrust along the intended flight path, are not
able to be fully mitigated by an FSS because once the failure occurs
the hazard cannot be prevented from affecting uncontrolled areas if the
failure occurred during a period in which the uncontrolled areas were
exposed. At best, the hazard can be reduced for some failure modes such
as a loss of thrust that may result in an intact impact unless a
destructive abort that disperses propellants is implemented. In this
case, flight abort may still be required to reduce risk per Sec.
450.108(c)(2) since the vehicle is unable to achieve a useful mission,
but the consequence criteria would not apply.
---------------------------------------------------------------------------
\99\ The FAA also notes that the term ``in any one-second period
of flight'' has been changed throughout the final rule to the term
``in any significant period of flight,'' as described in the
preamble section discussing Sec. 450.101(c).
---------------------------------------------------------------------------
Boeing, Lockheed Martin, Northrop Grumman, and ULA requested
clarification on the intent of the CEC limits in proposed
Sec. 450.125(c)(1) and (c)(2). In the final rule, the FAA retained the
CEC limits related to flight abort. The intent of these
limits is to ensure that, when flight abort or a flight outside the
limits of a useful mission resulting from an off-trajectory failure
mode produces debris capable of causing a casualty, it nonetheless
protects against a high consequence event. In other words, flight abort
provides sufficient protection against a high consequence event when
flight abort is implemented to prevent the CEC from any
reasonably foreseeable off-trajectory failure mode initiating in any
significant period of flight from exceeding 1 x 10-\2\
casualties, even though the public in uncontrolled areas might be
exposed to debris from a flight abort.
SpaceX asked if there were restrictions to using flight safety
limits that met the risk requirements of proposed Sec. 450.101 but did
not meet the 1 x 10-\2\ CEC requirement.
Under Sec. 450.108(c)(4), flight safety limits must not allow
CEC greater than
1 x 10-\2\ unless the consequence resulted from a
vehicle within the limits of a useful mission and therefore could not
be mitigated by flight abort without aborting a vehicle on a useful
mission, or the consequence resulted from an on-trajectory failure
mode.
An example of when the consequence requirement would not apply is
when a vehicle on a normal trajectory suffers a spontaneous breakup.
This on-trajectory event cannot be mitigated by flight abort without
terminating a useful vehicle before it overflies uncontrolled areas. An
operator would not be required to initiate flight abort under the final
rule for this scenario. An example of when the consequence requirement
would apply is if a malfunction causes the vehicle to depart from the
limits of a useful mission. If CEC is used to measure high
consequence events, the flight safety limits must prevent the
consequence from such a failure mode (i.e., a malfunction that causes
the vehicle to depart from the limits of a useful mission) from
exceeding 1 x 10-\2\ CEC, whether produced by
flight abort or other reasonably foreseeable outcomes (such as
aerodynamic/structural breakup, intact impact, etc.).
SpaceX requested guidance on how an operator should balance
EC and CEC when designing flight safety limits
and expressed concern that EC may increase as an operator
attempts to reduce CEC. SpaceX also recommended removing all
numerical values associated with CEC and requiring the
consequence of flight abort at the flight safety limits to be
minimized.
Regarding the balance of EC and CEC, the FAA
notes that flight safety limits must be designed to meet the
EC and CEC requirements as described in Sec.
450.108(c)(1) and (c)(4), respectively. If the flight safety limits
must be modified to reduce the CEC to acceptable levels,
EC must still be kept within acceptable levels. The FAA does
not agree with the recommendation to remove the numerical value
associated with the CEC requirement because this could allow
flight safety limits that result in a high consequence through flight
abort or through flight abort inaction. However, the final rule does
[[Page 79621]]
allow for methods of measuring consequence other than CEC
that provide an equivalent level of safety under Sec. 450.37.
Section 450.108(c)(5)
Section 450.108(c)(5) requires that an operator initiate flight
abort to prevent the vehicle state from reaching identified conditions
that are anticipated to compromise the capability of the FSS if further
flight has the potential to violate a flight safety limit. For example,
if a roll rate of a particular magnitude would preclude ground-based
flight abort commands from being received by the vehicle, a flight
safety limit should be developed that triggers flight abort before the
roll rate reaches this value.
Section 450.108(c)(5) is related to the flight abort rule in
proposed Sec. 450.165(c)(3)(ii), which required that flight abort
rules include that the FSS must abort flight when the vehicle state
approaches conditions that are anticipated to compromise the capability
of the FSS and further flight has the potential to violate the FSS. In
the NPRM, the FAA did not include a flight safety limit objective that
corresponded with the flight abort rule in proposed Sec.
450.165(c)(3)(ii). The FAA adds this flight safety limit objective in
Sec. 450.108(c)(5). The flight abort rule in proposed Sec.
450.165(c)(3)(ii) is in Sec. 450.108(f)(2)(ii) and is discussed
further under Flight Abort Rules in the following paragraphs.
Section 450.108(c)(6)
Section Sec. 450.108(c)(6) states that, in lieu of meeting Sec.
450.108(c)(2) and Sec. 450.108(c)(4), an operator may initiate flight
abort to prevent debris capable of causing a casualty due to any hazard
from affecting uncontrolled areas using an FSS that complies with Sec.
450.145. The FAA adds this regulation to clarify that a CEC
analysis is not required if an FSS that complies with Sec. 450.145
provides hazard containment. Hazard containment is a means of achieving
the goals of Sec. 450.108(c)(2) and (c)(4) because, if an operator
provides for hazard containment, continued flight will not increase
risk in uncontrolled areas and hazard containment would prevent
conditional expected casualties greater than 1 x 10-\2\ in
uncontrolled areas. This requirement is consistent with the NPRM
because if an operator is able to contain hazards throughout the period
when flight abort is used, the proposed consequence requirements in
Sec. 450.125(c)(1) and (c)(2) would not apply since a gate analysis
would not be necessary.
In developing the NPRM, the FAA considered alternatives to a
conditional risk limit, including the current approach employed in
Sec. 417.213.\100\ The FAA rejected using the approach in Sec.
417.213 as a requirement in part 450 because it is unnecessarily
restrictive to require designated impact limit lines to bound the area
where debris with a ballistic coefficient of three pounds per square
foot or more is allowed to impact if the FSS functions properly, as
evidenced by the need for the FAA to grant waivers to allow innovative
missions to proceed safely, such as return of boosters to the launch
site.\101\ However, if an operator satisfies the current requirements
in Sec. 417.213, it would meet the requirement in Sec. 450.108(c)(6).
This strategy is not an option when hazard containment is not possible
during a phase of flight when flight abort must be used as a hazard
control strategy. For example, if an area of overflight occurs on the
nominal trajectory during a phase of flight when flight abort is still
used as a hazard control strategy, an operator cannot claim containment
during this phase and must meet Sec. 450.108(c)(2) and (c)(4). The FAA
notes that its approach in Sec. 450.108(c) to employing conditional
risk limits is consistent with a recommendation made by the National
Academy of Sciences.\102\
---------------------------------------------------------------------------
\100\ The FAA currently requires in Sec. 417.213 that ``a
flight safety analysis must identify the location of populated or
other protected areas, and establish flight safety limits that
define when an FSS must terminate a launch vehicle's flight to
prevent the hazardous effects of the resulting debris impacts from
reaching any populated or other protected area and ensure that the
launch satisfies the public risk criteria.''
\101\ See Waiver of Debris Containment Requirements for Launch.
81 FR 1470, 1470-1472 (January 12, 2016).
\102\ In 2001, the National Research Council published a report
on ``Streamlining Space Launch Range Safety,'' which included a
recommendation that ``destruct lines and flight termination system
requirements should be defined and implemented in a way that is
directly traceable to accepted risk standards.'' See p. 44 of IBSN
0-309-51648-X available at https://www.nap.edu/catalog/9790.html. The
flight safety limit requirements currently in Sec. 417.213(d) are
not directly traceable to accepted risk standards in that they
require the analysis to ``establish designated impact limit lines to
bound the area where debris with a ballistic coefficient of three or
more is allowed to impact if the flight safety system functions
properly.'' As noted earlier, the approach in Sec. 417.213 has been
rejected because it is unnecessarily restrictive, as evidenced by
the need for the FAA to grant waivers to allow innovative missions
to proceed safely, such as return of boosters to the launch site.
The FAA found that those waivers did not jeopardize public safety
based on conditional risk analyses that are inherent in methods the
NAS referred to as accepted risk standards.
---------------------------------------------------------------------------
Virgin Galactic recommended adding an exclusion to the requirement
for flight safety limits in proposed Sec. 450.123 for vehicles that
already meet the public risk criteria, as flight safety limits analysis
amounts to an additional layer of regulation that Virgin Galactic
believed was redundant and unneeded.
The FAA determined that a clarification is required in response to
this recommendation. Pursuant to Sec. 450.108(a), flight safety limits
are only required in phases of flight in which flight abort is used as
a hazard control strategy to meet the safety criteria of Sec. 450.101.
The FAA does not agree that meeting public risk criteria, or just
collective and individual risk, are the only objectives of flight
abort, as explained in the preamble section on CEC. The FAA
finds it necessary to include additional objectives for flight abort in
Sec. 450.108(c) to protect public safety adequately. Lastly, the
preamble section on CEC describes why a conditional risk
assessment is appropriate to provide the public protection from
unlikely but catastrophic events in the context of launch and reentry
operations.
iii. Flight Safety Limits Constraints
Section 450.108(d) in the final rule describes flight safety limits
constraints. This subsection consolidates the flight safety limits
constraints in proposed Sec. Sec. 450.123 through 450.129.
Section 450.108(d)(1)
Proposed Sec. 450.123(b)(1) required flight safety limits to
account for temporal and geometric extents on the Earth's surface of
any vehicle hazards resulting from any planned or unplanned event for
all times during flight.
In the final rule, Sec. 450.108(d)(1) requires that flight safety
limits account for temporal and geometric extents on the Earth's
surface of any reasonably foreseeable vehicle hazards under all
reasonably foreseeable conditions during normal and malfunctioning
flight. The FAA adds ``reasonably foreseeable'' before ``vehicle
hazards'' to be consistent with language elsewhere in the regulation.
As noted earlier, ``reasonably foreseeable'' is a term commonly used in
system safety. The FAA also replaces ``from any planned or unplanned
event for all times during flight'' in proposed Sec. 450.123(b)(1)
with ``under all reasonably foreseeable conditions during normal and
malfunctioning flight'' in Sec. 450.108(d)(1). This revision does not
result in a substantive change from the proposal, but the FAA finds the
revised language to be clearer and consistent with language elsewhere
in the regulation through use of the term ``reasonably foreseeable
conditions'' in place of the proposed ``planned or
[[Page 79622]]
unplanned event.'' This standard does not hold the operator responsible
for unforeseeable events.
Section 450.108(d)(2)
Section 450.108(d)(2) requires that flight safety limits account
for the physics of hazard generation and transport including
uncertainty. This articulation represents a revision of proposed Sec.
450.123(b)(2), which stated flight safety limits must account for
potential contributions to debris impact dispersions. The FAA finds the
NPRM language was unclear as to the scope of the requirement. The NPRM
would have required an operator to consider how factors like winds,
imparted velocities, and uncertainty in mass properties affect where
debris from a failed vehicle may impact. However, direct debris impacts
are not the only hazards posed by vehicle failures. For example, an
intact impact of a vehicle may lead to a blast wave or release of toxic
propellant, both of which must be considered when developing flight
safety limits. Hazard generation and transport are factors that apply
to all hazards, unlike factors that only apply to determining debris
impact dispersions. Hazard generation refers to the process by which a
vehicle becomes a hazard, and transport is how the hazard moves from
the source to an exposed person or asset. Simply accounting for
potential contributions to debris impact dispersions would not
encompass all hazards, though debris impact dispersions also need to be
accounted for under Sec. 450.108(d)(2).
Blue Origin requested clarification of the term ``potential
contributions'' in proposed Sec. 450.123(b)(2). The FAA notes the term
``potential contributions'' to debris impact dispersions are those that
influence the propagation of debris following a vehicle breakup, such
as explosion-induced velocities, winds, uncertainty in aerodynamic
properties, etc. The FAA further notes the term ``potential
contributions'' does not appear in the final rule. The FAA will address
development of debris impact dispersions in guidance, similar to the
existing Flight Safety Analysis Handbook.
Section 450.108(d)(3)
In the NPRM, the FAA proposed to consolidate and update data loss
flight times and planned safe flight states requirements in proposed
Sec. 450.127 (Data Loss Flight Time and Planned Safe Flight State
Analyses). As explained in the proposal, data loss flight time analysis
is necessary to establish when an operator must abort a flight
following the loss of vehicle tracking information. In the NPRM, the
FAA explained that data loss flight time would be the shortest elapsed
thrusting or gliding time during which a vehicle flown with an FSS can
move from its trajectory to a condition in which it is possible for the
vehicle to violate a flight safety limit. Data loss flight times would
have been required from the initiation of flight until the minimum
elapsed thrusting or gliding time was no greater than the time it would
take for a normal vehicle to reach the final gate crossing or the
planned safe flight state.
Section 450.108(d)(3) revises the prescriptive requirements in
Sec. 450.127 to require that flight safety limits account for the
potential to lose valid data necessary to evaluate the flight abort
rules. Data is valid when it is of sufficient quality to be used to
make flight abort decisions. Data used to make flight abort decisions
can be missing or invalid for a number of reasons, but resulting from
an unplanned event, such as disruption or loss of communication
pathways with ground-based or onboard tracking sensors. Despite an
operator's or launch site's best efforts, the potential to lose track
data is a contingency for which operators must plan.
Section 450.108(d)(3) requires an operator to account for the
potential to lose valid data necessary to evaluate the flight abort
rules because the loss of valid data does not absolve the operator from
attempting to meet the flight safety limits requirements in Sec.
450.108(c) and (d). Section 450.108(d)(3) captures the performance-
based intent of proposed Sec. 450.127 (Data Loss Flight Time and
Planned Safe Flight State Analyses). The FAA finds that this revision
allows for the use of data loss flight times as a means of satisfying
Sec. 450.108(d)(3), but also allows operators to propose other methods
of meeting the requirement.
Microcosm and SpaceX requested clarification of the intent for
proposed Sec. 450.127. The FAA notes that the purpose of proposed
Sec. 450.127 was to determine when flight abort is required if track
data used to evaluate the flight abort rules is lost. If a vehicle is
able to reach a flight safety limit when track data is lost, then a
countdown begins that would indicate, upon reaching zero, that a flight
safety limit may have been reached. Under proposed Sec.
450.165(c)(3)(iii), flight abort would have to occur no later than when
the countdown reaches zero. Throughout flight, the time for the
countdown to reach zero is the data loss flight time. If reliable
tracking sources are regained before the countdown reaches zero, then
flight abort rule evaluation resumes and the countdown resets. In
Federal launch site parlance, data loss flight times are known as
``green numbers.''
In the NPRM, data loss flight times would not be used if a
vehicle's tracking icon has potentially passed a final gate when the
countdown reaches zero because this could result in introducing hazards
in uncontrolled areas that the gate protects. As described in proposed
Sec. 450.127(b)(1), there are no data loss flight times when the
minimum elapsed thrusting or gliding time is greater than the time it
would take for a normal vehicle to reach the final gate crossing, to
preclude abort from occurring after a gate crossing.
Proposed Sec. 450.127(c)(1) through (c)(3) described other phases
of flight when data loss flight times would be unnecessary. If a
vehicle cannot reach a flight safety limit, then a data loss flight
time cannot be computed and would be unnecessary. It may seem futile to
have a flight safety limit that cannot be reached, but for purposes of
data loss flight times a flight safety limit is considered unreachable
if the vehicle cannot reach it starting from within normal trajectory
limits when track data is lost. The flight safety limit may still be
reachable if the vehicle was outside of normal trajectory limits at the
time data was lost. Therefore, these flight safety limits may still
have value.
Finally, in the NPRM, data loss flight times would not be necessary
in phases of flight when an FSS is not required. There may still be
flight safety limits during such phases if an operator retains an FSS
and active flight abort rules even though they are not required. Loss
of track data would not require flight abort since the flight safety
limits themselves are unnecessary. This approach would allow operators
to be conservative in the use of flight safety limits in phases of
flight when they are unnecessary, with no threat of flight abort from
loss of track data.
Proposed Sec. 450.127(b)(3) would have permitted the real-time
computation and application of data loss flight times during vehicle
flight, in which case the state vector just prior to loss of data
should be used as the nominal state vector. The FAA finds that Sec.
450.108(d)(3) provides the same level of safety as the proposed
requirement in Sec. 450.127 and provides additional flexibility. The
FAA will provide guidance on compliance with Sec. 450.108(d)(3). The
proposed requirement in Sec. 450.127 can be part of a viable means of
compliance with Sec. 450.108(d)(3). An operator may propose other
means of compliance with Sec. 450.108(d)(3). Microcosm and SpaceX
requested clarification of the intent for proposed Sec. 450.127. The
FAA
[[Page 79623]]
notes that the purpose of proposed Sec. 450.127 was to determine when
flight abort is required if track data used to evaluate the flight
abort rules is lost.
Section 450.108(d)(4)
Proposed Sec. 450.129 (Time Delay Analysis) would have required an
operator to perform a time delay analysis to establish the mean elapsed
time between the violation of a flight abort rule and the time when the
FSS is capable of aborting flight for the purpose of establishing
flight safety limits. The time delay analysis would have been required
to determine a time delay distribution that accounts for all
foreseeable sources of delay.
While proposed Sec. 450.129 does not appear in the final rule, the
objective of proposed Sec. 450.129 is captured by Sec. 450.108(d)(4).
Section 450.108(d)(4) requires that flight safety limits account for
the time delay, including uncertainties, between the violation of a
flight abort rule and the time when the FSS is expected to activate.
The term in the final rule ``time delay including uncertainties'' is
consistent in intent with the NPRM language ``mean elapsed time'' and
``determine a time delay distribution.''
The time delay distribution in proposed Sec. 450.129 is
distribution in a statistical sense. The uncertainties referred to in
Sec. 450.108(d)(4) are the same as the time delay distribution
referred to in proposed Sec. 450.129. To meet Sec. 450.108(d)(4), the
operator must consider the range of values that the actual time delay
could fall between. While proposed Sec. 450.129 stated that the time
delay analysis would be used in establishing flight safety limits, the
final rule specifies that the time delay is a constraint in developing
flight safety limits. Time delays are important in a flight safety
limits analysis because the decision to abort flight must be made in
time to achieve the flight safety limits objectives. This is not
possible unless the time delay between the violation of a flight abort
rule and the time when the FSS is expected to activate is known. The
FAA finds that including this requirement in the flight safety limits
constraints provides more clarity regarding the relation between this
requirement and the flight safety limits.
Section 450.108(d)(5)
Section 450.108(d)(5) requires an operator to determine flight
safety limits that account for individual, collective, and conditional
risk evaluations both for proper functioning of the FSS and failure of
the FSS. To satisfy this requirement, an operator must account for the
reliability of the FSS under two scenarios when determining whether
individual, collective, or conditional risk requirements are met with
the flight safety limits objectives. The applicable flight safety
limits objectives are located in Sec. 450.108(c)(1), which addresses
individual and collective risk, and Sec. 450.108(c)(4), which
addresses conditional risk. Although Sec. 450.108(c)(2) is also
associated with risk, it is independent of the FSS reliability because
it is a comparison between the risk if the FSS is activated and the
risk if it is not activated.
To comply with Sec. 450.108(d)(5), first, the FSS must be assumed
to have a reliability of one, meaning it is presumed to function
without error. The risk evaluations using an FSS reliability of one
ensure that the criteria are met if the FSS functions as intended. This
requirement is important because an FSS failure should not be relied
upon to make flight safety limits compliant with risk requirements. The
decision to implement a flight abort is a deliberate safety
intervention. The FAA wants to be sure that the public is safe given
any deliberate safety intervention. This objective is consistent with
proposed Sec. 450.125(c)(1) and (c)(2), which contain requirements for
consequence from flight abort, implying that the flight abort action
occurs, and is also consistent with current practice for all risk
evaluations.
Second, the risk evaluations must consider the predicted
reliability of the FSS. Predicted reliability of the FSS is important
because even low probabilities of FSS failures can have significant
impacts on risk. This consideration is consistent with the NPRM because
FSS reliabilities are a fundamental component of the viability of
flight abort as a hazard control strategy, and it is expressly stated
in the final rule for clarity. Consideration of the FSS reliability in
risk evaluations is also consistent with current practice.
The final rule allows an operator flexibility to establish the
design, analysis, and testing of its FSS and the conditions that
require initiation of flight abort as long as the CEC is no
greater than 1 x 10-\2\ for any reasonably foreseeable
failure mode in any significant period of flight that could require the
operator to initiate flight abort, accounting for the reliability of
the FSS pursuant to Sec. 450.108(d)(5).
Section 450.108(d)(6)
Proposed Sec. 450.123(b)(3) would have added a requirement to
design flight safety limits to avoid flight abort under conditions that
result in increased collective risk to people in uncontrolled areas,
compared to continued flight. In the NPRM, the FAA explained that the
proposed requirement is equivalent to the U.S. Government consensus
standard that a conditional risk management process should be
implemented to ensure that mission rules do not induce unacceptable
consequences when they are implemented.
Section 450.108(d)(6) requires that flight safety limits be
designed to avoid flight abort that results in increased collective
risk to the public in uncontrolled areas, compared to continued flight.
This language is very similar to proposed Sec. 450.123(b)(3), with one
change. The FAA changes the term ``people'' in the proposed rule to
``the public'' in the final rule because the FAA regulates the safety
of the public. The term ``people'' could be construed as meaning
something broader than ``public,'' such as mission essential personnel
who may be in uncontrolled areas.
Blue Origin stated that proposed Sec. Sec. 450.123(d),
450.125(b)(2), 450.125(c), and 450.125(c)(3) were in conflict and
commented on the definition of a ``useful mission.'' Blue Origin
explained that, even though the intent was to meet the public safety
requirements in proposed Sec. 450.101, terminating a vehicle that may
not meet the definition of a ``useful mission'' may result in an
increase in risk to the public, including those on ships and aircraft,
compared to continued flight that may result in reaching orbit. Blue
Origin commented that, if the limits were defined only with respect to
the risk criteria in proposed Sec. 450.101, allowing the vehicle to
continue flight may result in a safer risk profile.
The FAA agrees that the risk to the public must not be increased by
flight abort. However, if a vehicle intended for orbit is outside the
limits of a useful mission and approaching populated uncontrolled
areas, there is likely an optimum location to abort the flight without
increasing risk. For launches where the instantaneous impact point
(IIP) \103\ approaches a landmass from the ocean, aborting flight
before the resulting debris would encroach on the landmass and dense
coastal shipping traffic would be compliant with Sec. 450.108(d)(6).
Current practice for orbital launches from Federal launch sites is to
allow the vehicle to continue to orbit if it can achieve a minimum safe
orbit and is within the limits of a useful
[[Page 79624]]
mission in the IIP projection. This practice is consistent with the
requirements in Sec. 450.108. If an operator proposes to allow a
vehicle outside the IIP limits of a useful mission to overfly
population to proceed to orbit, it must demonstrate that this option
presents lower risk than aborting the flight before the overflight
begins.
---------------------------------------------------------------------------
\103\ Section 401.5 has a long-standing definition of IIP:
``instantaneous impact point means an impact point, following thrust
termination of a launch vehicle, calculated in the absence of
atmospheric drag effects.''
---------------------------------------------------------------------------
The FAA agrees that a discrepancy existed in the NPRM in proposed
Sec. 450.123(d) but is uncertain if this is the conflict to which Blue
Origin referred. The proposed Sec. 450.123(d) referred to risk
criteria in Sec. 450.101, but mistakenly omitted the requirement to
prevent debris capable of causing a casualty from impacting in
uncontrolled areas if the vehicle is outside the limits of a useful
mission. The option to determine the need for flight abort in real time
as described in proposed Sec. 450.123(d) does not appear in the final
rule because it is just one means of meeting the requirements for
flight safety limits. However, this does not preclude an operator from
determining the need for flight abort entirely in real-time, as long as
requirements in Sec. 450.108 are met.
Section 450.108(d)(7)
As noted in the section on flight safety limits objectives,
proposed Sec. 450.125(c)(1) stated that flight safety limits would be
required to be gated or relaxed where they intersect with a normal
trajectory if that trajectory would meet the individual and collective
risk criteria of proposed Sec. 450.101(a)(1) and (a)(2) or (b)(1) and
(b)(2) when treated like a nominal trajectory with normal trajectory
dispersions. Proposed Sec. 450.125(c)(2) stated that flight safety
limits may be gated or relaxed where they intersect with a trajectory
within the limits of a useful mission if that trajectory would meet the
individual and collective risk criteria of proposed Sec. 450.101(a)(1)
and (a)(2) or (b)(1) and (b)(2) when treated like a nominal trajectory
with normal trajectory dispersions.
In the final rule, Sec. 450.108(d)(7) requires an operator to
determine flight safety limits that ensure that any trajectory within
the limits of a useful mission that is permitted to be flown without
abort would meet the collective risk criteria of Sec. 450.101(a)(1) or
(b)(1) when analyzed as if it were the planned mission pursuant to
Sec. 450.213(b)(2).\104\ The relocation of requirements in proposed
Sec. 450.125 to Sec. 450.108(c)(2) through (c)(4) and Sec.
450.108(d)(7) necessitated a revision to the language in Sec.
450.108(d)(7). Section 450.108(d)(7) requires only that any trajectory
within the limits of a useful mission that is permitted to be flown
without abort would meet the collective risk criteria of Sec.
450.101(a)(1) or (b)(1) when analyzed as if it were the planned mission
pursuant to Sec. 450.213(b)(2). As stated in the NPRM, the philosophy
behind proposed Sec. 450.125(c)(2) was to allow a non-normal flight to
continue as long as the mission does not pose an unacceptable
conditional risk given the present trajectory. The intent of Sec.
450.108(d)(7) is similar but is stated in a different context than in
the NPRM and also revised for clarity. In the final rule, the FAA
removes the individual risk criterion from the requirement because the
intent of the requirement was not to potentially create flight hazard
areas along every azimuth within the limits of a useful mission
wherever an individual risk contour exceeds 1 x 10-\6\.
---------------------------------------------------------------------------
\104\ As part of pre-flight planning, an operator must submit to
the FAA planned mission information, including the vehicle, launch
site, planned flight path, staging and impact locations, each
payload delivery point, intended reentry or landing sites including
any contingency abort location, and the location of any disposed
launch or reentry vehicle stage or component that is deorbited.
---------------------------------------------------------------------------
The FAA found that the phrase ``when analyzed as if it were the
planned mission pursuant to Sec. 450.213(b)(2)'' was more precise than
``when treated like a nominal trajectory with normal trajectory
dispersions.'' A planned mission must be characterized with
uncertainties and assessed for risk from planned events and reasonably
foreseeable failure modes; therefore, trajectories must be within the
limits of a useful mission that are permitted to be flown without
abort, pursuant to Sec. 450.108(d)(6).
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended
replacing the terms ``normal trajectories'' and ``limits of a useful
mission trajectories'' in proposed Sec. 450.123(c) and Sec.
450.125(c) with ``nominal trajectories.'' The FAA finds that such a
change would restrict severely the allowable flight corridor of
vehicles that could achieve a potentially useful mission by requiring
that a vehicle be on a nominal trajectory to enter a period of
materially increased public exposure in uncontrolled areas. As such,
Sec. Sec. 450.108(c)(3) and 450.108(d)(7) in the final rule allow
vehicles within the limits of a useful mission to enter a period of
materially increased public exposure in uncontrolled areas, provided
the trajectory meets the collective risk requirement.
iv. End of Flight Abort
The FAA adds Sec. 450.108(e) in the final rule, which states that
a flight does not need to be aborted to protect against high
consequence events in uncontrolled areas beginning immediately after
critical vehicle parameters are validated, if the vehicle is able to
achieve a useful mission and certain conditions are met for the
remainder of flight. Specifically, the conditions which must be present
are: (1) Flight abort would not materially decrease the risk from a
high consequence event, and (2) there are no key flight safety events.
Section 450.108(e) relieves the operator from the requirement to use
flight abort in certain situations in which high consequence events are
possible but would not be effectively mitigated by an FSS. This change
responds to comments and addresses a common occurrence during a period
of planned overflight of an uncontrolled area before orbital insertion.
Section 450.108(e) applies to a flight beginning immediately after
critical vehicle parameters are validated, if the vehicle is able to
achieve a useful mission. As discussed in the section on flight safety
limits objectives, ``critical vehicle parameters'' are those parameters
that demonstrate the vehicle is capable of completing safe flight
through the upcoming phase of flight where population is exposed to
hazardous debris effects from reasonably foreseeable failure modes. Due
to the wide variety of launch and reentry vehicles that could be
licensed, there is a wide variety of vehicle parameters that could be
considered critical in this context. For example, recent state vector
history data, as well as vehicle health indicators such as motor
chamber pressure, generally will qualify as critical vehicle
parameters.
Section 450.108(e) only applies when the following conditions are
met. The first condition is that flight abort would not decrease the
risk from a high consequence event materially as measured by CEC or
other means identified through ELOS. The FAA expects that the
requirement in Sec. 450.108(e)(1) can be met by implementation of the
current practices at the 45th SW, specifically, performing a comparison
of the CEC and EC in uncontrolled areas with and
without flight abort from each reasonably foreseeable failure mode in
any significant period of flight during the subject phase of flight. If
flight abort would not reduce the CEC and EC
associated with each failure mode materially, then this condition is
met.
[[Page 79625]]
A material decrease would exclude any best estimate of the mean
value that is already two orders of magnitude or more below the
criteria in Sec. 450.101(a) and (b). As the best estimate approaches
the established limits in Sec. 450.101(a) and (b) on the mean
predicted values, a material decrease would be smaller, including: (1)
Any reduction that brings the operation into compliance with Sec.
450.101(a) and (b) limits, (2) any half-order of magnitude reduction in
the best estimate of the mean value of EC, or (3) a
reduction by an amount at least as large as the coefficient of
variation due to uncertainty in the population distribution. Section
450.108(e)(1) uses the phrase ``risk from a high consequence event''
deliberately so that other measures of collective risk and
consequences, not just CEC and EC, can be
considered in evaluating compliance with this requirement, absent a
waiver. The FAA will provide guidance on what constitutes material
decrease.
The second condition in Sec. 450.108(e) requires that there are no
key flight safety events for the remainder of flight. The FAA currently
has a formal definition of the term ``key flight-safety event'' in part
437 (Experimental Permits). Section 437.3 states that key flight-safety
event means a permitted flight activity that has an increased
probability of causing a launch accident compared with other portions
of flight. In addition, Sec. 437.59(a) states that, at a minimum, a
key flight-safety event includes: (1) Ignition of any primary rocket
engine, (2) any staging event, or (3) any envelope expansion. The
current description of key flight safety events in the permit
regulation conveys what the FAA may consider a key flight safety event
in the context of part 450.
Section 401.7 of the final rule has added a definition of ``key
flight safety events'' and states that a key flight safety event means
a flight activity that has an increased probability of causing a
failure compared with other portions of flight. The term key flight
safety event in the context of part 450 includes events that could
compromise any safety-critical system, or otherwise increase the risk
from high consequence events, such as events that subject a safety-
critical system to environments at or near the maximum predicted
environment.
SpaceX commented that launches that overfly major landmasses (e.g.,
Europe, Africa, or South America) prior to orbital insertion would
violate the CEC requirement in proposed Sec. 450.101(c)
during overflight. SpaceX urged the FAA to update the regulation to
clarify that an operator would not have to perform a CEC
analysis for the ''overflight'' phase of flight. SpaceX also
recommended that the CEC requirement apply only to vehicle
response modes that are mitigated by the FSS.
The FAA acknowledges that some launches that overfly major
landmasses prior to orbital insertion produce CEC levels in
excess of the 1 x 10-\2\ threshold and that flight abort
will not mitigate the consequences associated with those failure modes.
The FAA modifies the final rule to address such circumstances by
adopting requirements proposed in the NPRM, such as Sec. 450.125(c).
Specifically, Sec. 450.108(e) identifies conditions that, if met,
demonstrate a high consequence event is sufficiently mitigated. These
conditions are met generally by U.S. launches that overfly downrange
landmasses prior to orbital insertion. Thus, the final rule includes
specific provisions designed to allow the current practice where some
launches proceed through a phase of flight, such as the downrange
overflight of a major landmass just prior to orbital insertion, without
additional protections against low probability, high consequence
events.
The FAA finds that meeting the requirements in Sec. 450.108(e)
demonstrates sufficient protection against the probability of high
consequence events, even though the CEC may exceed the 1 x
10-\3\ or 1 x 10-\2\ thresholds during the
subject phase of flight. The use of collective risk to determine
acceptability of downrange overflight is consistent with current
practice.
Blue Origin, CSF, and SpaceX commented that flight abort may
actually increase risk during overflight where vehicle hazards cannot
be contained. Even for vehicles that implement an FSS with a
reliability of 0.999 at 95 percent, it would still be possible to fall
into the highest risk bin and not improve a risk posture measured by
CEC.
The FAA agrees with the commenters. In the final rule in Sec.
450.108(e), the FAA sets conditions that demonstrate that a high
consequence event is sufficiently mitigated, including if flight abort
in that phase of flight would not materially decrease the risk from a
high consequence event.
vi. Flight Abort Rules
Proposed Sec. 450.165(c) (Flight Commit Criteria) contained the
requirements for flight abort rules. As explained in the NPRM, an
operator would identify the conditions under which an FSS, including
the functions of any flight abort crew, must abort the flight to ensure
compliance with Sec. 450.101. An operator would be required to abort a
flight if a flight safety limit is violated or if some condition exists
that could lead to a violation, such as a compromised FSS or loss of
data.
In the final rule, the FAA revised and relocated the flight abort
rules to Sec. 450.108 consistent with the objective of consolidating
relevant flight abort requirements into a single section in the final
rule. In Sec. 450.108(f), an operator must establish and observe
flight abort rules that govern the conduct of launch and reentry.
Section 450.108(f)(1) requires that vehicle data required to
evaluate flight abort rules must be available to the FSS under all
reasonably foreseeable conditions during normal and malfunctioning
flight. A similar requirement appeared in proposed Sec. 450.165(c)(2),
which required vehicle data necessary to evaluate flight abort rules to
be available to the FSS across the range of normal and malfunctioning
flight. The FAA adds ``under all reasonably foreseeable conditions'' to
Sec. 450.108(f)(1) to acknowledge that some conditions that prevent
vehicle data from being available to evaluate flight abort rules might
be unforeseeable and therefore unpreventable through planning and
design.
Section 450.108(f)(2) describes when the FSS must abort flight,
similar to proposed Sec. 450.165(c)(3). Section 450.108(f)(2)(i)
requires that the FSS must abort flight when valid, real-time data
indicate the vehicle has violated any flight safety limit developed
pursuant to this section. In the final rule, the FAA revised the
language from proposed Sec. 450.165(c)(3)(i) to add ``developed
pursuant to this section'' because the flight safety limits
requirements now appear in the same section as this flight abort rule.
As proposed in Sec. 450.165(c)(3)(ii), the flight abort rules
would have required the FSS to abort flight when the vehicle state
approaches conditions that are anticipated to compromise the capability
of the FSS and further flight has the potential to violate a flight
safety limit.
Blue Origin commented that, while it is possible to write flight
abort rules to account for specific cases, there was not currently a
practical means of writing general rules that would abort flight when
the vehicle state approaches conditions that could result in a
compromise of the FSS for every circumstance proposed in Sec.
450.165(c)(3)(ii). It also commented that the potential to violate a
flight safety limit is vague and outside the capability of current
generation autonomous FSS. Blue Origin
[[Page 79626]]
recommended the rule be reworded as ``the flight safety system must
abort flight when the vehicle state approaches identified conditions
from the system safety analysis that are anticipated to compromise the
capability of the flight safety system and the flight safety system is
required to contain the risk to an acceptable level (as analyzed in the
flight safety analysis).''
In the final rule, the revised requirement in Sec.
450.108(f)(2)(ii) adopts Blue Origin's recommendation to add
``identified'' before ``conditions that are anticipated to compromise
the capability of the flight safety system.'' The FAA finds this
addition reasonable because it avoids requiring protections against
unknown conditions. As revised, Sec. 450.108(f)(2)(ii) requires that
the FSS must abort flight when the vehicle state approaches identified
conditions that are anticipated to compromise the capability of the FSS
and further flight has the potential to violate a flight safety limit.
This requirement is used in conjunction with the flight safety limits
objective in Sec. 450.108(c)(5).
The FAA declines to adopt Blue Origin's recommendation to limit
this requirement to the system safety analysis because a system safety
analysis is not the only means to identify these conditions. For
example, an FSS survivability analysis or a link analysis for a command
destruct architecture may identify conditions anticipated to compromise
the capability of the FSS. The FAA also does not adopt Blue Origin's
recommendation to change Sec. 450.165(c)(3)(ii) by replacing ``and
further flight has the potential to violate a flight safety limit''
with ``and the flight safety system is required to contain the risk to
an acceptable level (as analyzed in the flight safety analysis).''
The FAA finds an acceptable level of risk might be interpreted as
only meeting collective and individual risk requirements, while flight
safety limits must meet other requirements as described in Sec.
450.108 in the final rule. The FAA recognizes that a real-time
determination of whether a particular failure may evolve to reach a
flight safety limit is not possible. The operator must determine in
pre-flight analyses (system safety analysis, link analysis, etc.) which
failure modes can compromise the capability of the FSS. The operator
must then use FSA to determine if those failure modes can potentially
violate a flight safety limit. If it finds a failure mode that can
potentially violate a flight safety limit, the operator must develop
flight abort rules that protect against those modes. If the ability to
reach a flight safety limit via a particular failure mode is uncertain,
the assumption should be made that it is possible during any phase of
flight where flight abort is used as a hazard control strategy. This
approach is consistent with acceptable methods of compliance with
proposed Sec. 450.165(c)(3)(ii).
Section 450.108(f)(2)(iii) requires that the FSS must abort flight
in accordance with methods used to satisfy Sec. 450.108(d)(3) if
tracking data is invalid and further flight has the potential to
violate a flight safety limit. This requirement is similar to proposed
Sec. 450.165(c)(3)(iii), which stated that the FSS must incorporate
data loss flight times to abort flight at the first possible violation
of a flight safety limit, or earlier, if valid tracking data is
insufficient for evaluating a minimum set of flight abort rules
required to maintain compliance with proposed Sec. 450.101.
As noted in the discussion of flight abort constraints, the FAA has
replaced proposed Sec. 450.127, which contained requirements for a
data loss flight time analysis, with the more performance-based
approach in Sec. 450.108(d)(3). Consistent with that change, the FAA
revises the language in proposed Sec. 450.165(c)(3)(iii) in final
Sec. 450.108(f)(2)(iii). Data loss flight times are not the only means
of compliance with the performance-based requirement in Sec.
450.108(d)(3) to account for the potential to lose valid data necessary
to evaluate the flight abort rules. The FAA also removes the
requirement to abort flight at the first possible violation of a flight
safety limit, or earlier, if valid tracking data is insufficient for
evaluating a minimum set of flight abort rules required to maintain
compliance with proposed Sec. 450.101. This statement was associated
with implementation of data loss flight times, but the performance-
based requirement in Sec. 450.108(d)(3) will allow other methods of
compliance that may not be consistent in all cases with the NPRM
language in Sec. 450.165(c)(3)(iii). The FAA will provide guidance on
compliance with Sec. Sec. 450.108(d)(3) and 450.108(f)(2)(iii). The
FAA also does not adopt the proposed definition for ``data loss flight
time'' in Sec. 401.7 in the final rule. The relation between
Sec. Sec. 450.108(d)(3) and 450.108(f)(2)(iii) in the final rule is
substantively the same as that between proposed Sec. Sec. 450.127 and
450.165(c)(3)(iii).
The FAA removes proposed Sec. 450.165(c)(1), which required that
for a vehicle that uses an FSS, the flight abort rules must identify
the conditions under which the FSS, including the functions of any
flight abort crew, must abort the flight. These included proposed Sec.
450.165(c)(1)(i), to ensure compliance with proposed Sec. 450.101, and
proposed Sec. 450.165(c)(1)(ii), to prevent debris capable of causing
a casualty from impacting in uncontrolled areas if the vehicle is
outside the limits of a useful mission. The FAA finds this requirement
to be unnecessary, as flight safety limits requirements and flight
abort rules requirements are clearly stated in Sec. 450.108(c) through
(f). In addition, in the final rule the FAA does not adopt the proposed
definition for ``flight abort crew'' in Sec. 401.7 because the term is
no longer used in the final rule.
Virgin Galactic commented that proposed Sec. 450.165(c)(ii) seems
unachievable for an operator with a nominal trajectory that meets
EC requirements but can result in debris outside of the
controlled area. Virgin Galactic recommended deleting the requirement
or excluding the requirement if EC was met.
The FAA finds, based on the context of the comment, that Virgin
Galactic meant to refer to proposed Sec. 450.165(c)(1)(ii). The FAA
acknowledges that a mission that flies over uncontrolled areas on the
nominal trajectory cannot always prevent debris impacts on the
uncontrolled area, but the requirement only applies to vehicles outside
the limits of a useful mission. A nominal vehicle is on a useful
mission; therefore, this requirement would not apply to the scenario in
Virgin Galactic's comment. In the final rule, the intent of proposed
Sec. 450.165(c)(1)(ii) is covered in Sec. 450.108(f)(2)(i).
The FAA removes the requirement proposed in Sec. 450.165(c)(3)(iv)
that a flight may continue past any gate established under proposed
Sec. 450.125 only if the parameters used to establish the ability of
the vehicle to complete a useful mission are within limits. The
replacement of proposed Sec. 450.125 with performance-based
requirements in Sec. 450.108(c) and (d) makes this requirement
unnecessary.
SpinLaunch commented that the FAA should simplify the proposed
flight safety limits analysis (Sec. 450.123), gate analysis (Sec.
450.125), and time delay analysis (Sec. 450.129) regulations by
stating that the safety analyses must address certain goals and relying
on a training and evaluation structure to assure applicants are
knowledgeable and capable of performing the analyses in a manner that
sufficiently addresses those goals. The FAA revises the requirements in
proposed Sec. Sec. 450.123, 450.125, and 450.129 to be more
[[Page 79627]]
performance-based. However, the FAA does not agree that training
applicants to be capable of performing the subject analyses is
sufficient to ensure compliance with the regulations.
v. Application Requirements
Section 450.108(g) contains application requirements for flight
abort. Section 450.108(g)(1) requires an applicant to submit a
description of the methods used to demonstrate compliance with Sec.
450.108(c), including descriptions of how each analysis constraint in
Sec. 450.108(d) is satisfied in accordance with Sec. 450.115 (Flight
Safety Analysis Methods). This rule is similar to proposed Sec.
450.123(e)(1), which required that an applicant submit in its
application a description of how each flight safety limit would be
computed, including references to the safety criteria of proposed Sec.
450.101.\105\ The intent of the requirement in the final rule is
similar to the proposal. However, the reference to Sec. 450.101 is
excluded in the final rule because not all flight safety limits
objectives in Sec. 450.108(c) refer directly to Sec. 450.101.
---------------------------------------------------------------------------
\105\ Section 450.115 addresses the scope and level of fidelity
required for FSA methods. The level of fidelity must demonstrate
that any risk to the public satisfies the safety criteria of Sec.
450.101.
---------------------------------------------------------------------------
Section 450.108(g)(2) requires that an applicant must submit in its
application a description of how each flight safety limit and flight
abort rule is evaluated and implemented during vehicle flight,
including the quantitative criteria that will be used, a description of
any critical parameters, and how the values required in Sec.
450.108(c)(3) and 450.108(e) are identified. This provision is derived
from three requirements in the NPRM. First, proposed Sec.
450.123(e)(2) would have required an applicant to submit representative
flight safety limits and associated parameters. Second, proposed Sec.
450.125(d)(2) would have required an applicant to submit a description
of the measure of performance used to determine whether a vehicle would
be allowed to cross a gate without flight abort, the acceptable ranges
of the measure of performance, and how these ranges were determined.
Third, proposed Sec. 450.165(d)(2)(i) would have required an applicant
to submit, for flight abort rules, a description of each rule and the
parameters that would be used to evaluate each rule.
As discussed earlier, the FAA has removed Sec. Sec. 450.123 and
450.125 from the final rule and relocated the flight abort rules from
Sec. 450.165 to reflect a more performance-based approach to flight
abort and allow greater flexibility than would have been possible under
the flight safety limits analysis and traditional gate analysis
proposed in the NPRM. Accordingly, the application requirements
associated with those sections have been combined in Sec.
450.108(g)(2) in the final rule. This approach improves organization
and increases flexibility with regard to how an operator demonstrates
compliance with Sec. 450.108.
Section 450.108(g)(3) requires an applicant to submit a graphic
depiction or series of depictions of flight safety limits for a
representative mission, together with the launch or landing point, all
uncontrolled area boundaries, the nominal trajectory, extents of normal
flight, and limits of a useful mission trajectories, with all
trajectories in the same projection as each of the flight safety
limits. This rule is similar to proposed Sec. 450.123(e)(4), which
required that an applicant submit a graphic depiction or series of
depictions of representative flight safety limits, the launch or
landing point, all uncontrolled area boundaries, and vacuum IIP traces
for the nominal trajectory, extents of normal flight, and limits of a
useful mission trajectories.
The final rule clarifies that an applicant will need only to submit
flight safety limits for a representative mission. Also, the FAA finds
that the requirement for depictions of vacuum IIP trajectories would
not be appropriate for flight safety limits in different projections
(such as present position) and revises the final rule to require all
trajectories in the same projection as each of the flight safety
limits. This change will not result in an increased burden compared to
the NPRM because the applicant would have to depict the trajectories in
either case; the final rule simply states explicitly that the
trajectories must be depicted in the appropriate projection.
Section 450.108(g)(4) requires an applicant to submit a description
of the vehicle data that will be available to evaluate flight abort
rules under all reasonably foreseeable conditions during normal and
malfunctioning flight. This section is similar to proposed Sec.
450.165(d)(2)(iii), which required an applicant to submit a description
of the vehicle data that would be available to evaluate flight abort
rules across the range of normal and malfunctioning flight. In the
final rule, the FAA replaces ``across the range of normal and
malfunctioning flight'' with ``under all reasonably foreseeable
conditions during normal and malfunctioning flight'' to be consistent
with language elsewhere in the regulation. It results in no increased
burden on the operator from the application requirement proposed in the
NPRM.
Microcosm requested clarification of proposed Sec.
450.165(d)(2)(i) and (iii), which would require that the applicant
submit, for flight abort rules, a description of each rule, and the
parameters that would be used to evaluate each rule; and a description
of the vehicle data that would be available to evaluate flight abort
rules across the range of normal and malfunctioning flight.
The FAA provides the following examples in response to Microcosm's
comment. An example of a flight abort rule would be a line on the
Earth's surface that, when crossed by an IIP (the parameter), would
trigger flight abort. In this example, the vehicle data would be
position and velocity data necessary to compute the IIP, as provided by
external (such as ground-based) or onboard sensors. The operator should
consider the availability of this data during normal and malfunctioning
flight and the effect on the operator's ability to evaluate the
applicable flight abort rule--which in this example is that flight
abort be initiated if the IIP crosses the line on the Earth's surface.
Another example would be an altitude versus downrange distance
constraint. If the vehicle is outside of a range of altitudes as a
function of the downrange distance, flight abort would be triggered.
The ranges of altitudes and downrange distances are the parameters in
this example. In this example, the vehicle data would be position data,
similarly reported by external or onboard sensors.
Other examples of parameters used in flight abort rules could be
chamber pressure, body rates, health and status of critical systems,
etc. In the final rule, the requirements in proposed Sec.
450.165(d)(2)(i) and (d)(2)(iii) are addressed by Sec. 450.108(g)(2)
and Sec. 450.108(g)(4), respectively.
i. Flight Hazard Analysis (Sec. 450.109)
In the NPRM, the FAA proposed in Sec. 450.109 that, unless an
operator uses physical containment, wind weighting, or flight abort as
a hazard control strategy, an operator would be required to perform and
document a flight hazard analysis and continue to maintain it
throughout the lifecycle of the launch or reentry system. As explained
in the NPRM, the use of a flight hazard analysis to derive hazard
controls would provide flexibility that does not currently exist under
the prescriptive requirements in part 417 and is broadly consistent
with the practice in parts 431 and 435.
[[Page 79628]]
As proposed in Sec. 450.109(a), the flight hazard analysis would
need to identify, describe, and analyze all reasonably foreseeable
hazards to public safety and safety of property resulting from the
flight of a launch or reentry vehicle. Each flight hazard analysis
would need to: (1) Identify all reasonably foreseeable hazards, and the
corresponding vehicle response mode for each hazard, associated with
the launch or reentry system relevant to public safety and safety of
property; (2) assess each hazard's likelihood and severity; (3) ensure
that the risk associated with each hazard would meet certain defined
criteria; (4) identify and describe the risk elimination and mitigation
measures required to satisfy the criteria; and (5) demonstrate that the
risk elimination and mitigation measures would achieve the necessary
risk levels through validation and verification.
In the final rule, the FAA revises Sec. 450.109 by adding a new
applicability paragraph (a) and by re-designating proposed Sec.
450.109(a) through (e) as Sec. 450.109(b) through (f).\106\ The FAA
adds an applicability paragraph in Sec. 450.109(a) that applies to the
use of a flight hazard analysis as a hazard control strategy to derive
hazard controls for the flight, or phase of flight, of a launch or
reentry vehicle. Hazards associated with computing systems and software
are further addressed in Sec. 450.141. This revised language reflects
that performing a flight hazard analysis is included as one of the
hazard control strategies in Sec. 450.107(c) of the final rule.
---------------------------------------------------------------------------
\106\ The FAA changes the term ``vehicle response mode'' in
proposed Sec. 450.109(a)(1) to ``failure mode,'' consistent with
similar changes throughout the final rule as discussed in the
conditional expected casualty section of the preamble.
---------------------------------------------------------------------------
Proposed Sec. 450.109 included several provisions that required
the flight hazard analysis to address hazards to property. For
instance, the FAA proposed in the introductory language to Sec.
450.109(a) that operators identify, describe, and analyze all
reasonably foreseeable hazards to public safety and safety of property.
The FAA proposed in Sec. 450.109(a)(1) that an operator identify all
reasonably foreseeable hazards, and the corresponding vehicle response
mode for each hazard, associated with the launch or reentry system
relevant to public safety and safety of property. The FAA also proposed
in Sec. 450.109(a)(3)(ii) that the likelihood of any hazardous
condition that may cause major damage to public property or critical
assets must be remote.
Blue Origin and Virgin Galactic commented on the property
protection requirements in proposed Sec. 450.109. Blue Origin
acknowledged the FAA's statutory authority to protect property but
noted that FAA regulations do not define property nor the criteria for
the safety of property. Blue Origin also expressed concern that the
requirements in Sec. 450.109 extended to critical assets and property
located in controlled areas. Blue Origin requested clarity on these
issues. Virgin Galactic commented that the protection of property was a
new requirement and also expressed concerns about the criteria
requiring an operator to mitigate the likelihood of any hazardous
condition that can cause a major property damage to ``remote.''
In response, the FAA has not adopted the requirement to identify,
describe, and analyze all reasonably foreseeable hazards to property
resulting from the flight of a launch or reentry vehicle. Although
property protection is codified in current licensing requirements for
reusable launch vehicles in Sec. 431.35(c), launch and reentry
operators have not in the past been required to account for hazards to
property due to flight. However, the FAA retains in the final rule
specific requirements for critical assets and property on orbit, which
have specific safety criteria in Sec. 450.101 and Sec. 450.169,
respectively. The FAA notes that the emergency response requirements in
Sec. 450.173(d), which address fire hazards, may also mitigate hazards
to property. The FAA may address other property and property hazards in
a future rulemaking if launch and reentry flight operations dictate
such a need.
Blue Origin also recommended proposed Sec. 450.109(a) be revised
to require that a flight hazard analysis identify, describe, and
analyze all reasonably foreseeable hazards to public safety and safety
of critical assets and safety of property resulting from the flight of
a launch or reentry vehicle.
The FAA declines to adopt this recommended language because, as
discussed in the preamble section dedicated to critical assets, the FAA
will determine whether an asset is critical in consultation with the
entity responsible for the asset, and either the FAA or a Federal
launch or reentry site will determine whether the proposed activity
would expose critical assets to a risk of loss of functionality that
exceeds the risk criterion in Sec. 450.101(a)(4) or (b)(4), and convey
any necessary constraints to the operator.
Virgin Galactic commented on proposed Sec. 450.109(a)(1)(i)
through (a)(1)(x) and noted the list of error sources, or very similar,
shows up in four other locations: (1) Sec. 437.55, (2) AC 431.35-2A,
(3) FAA Flight Safety Handbook, and (4) the AIAA Safety Critical RLV
guide. Virgin Galactic noted that the wording differed slightly from
one source to another and recommended that the FAA harmonize the
various lists. The FAA notes this comment is outside the scope of this
rulemaking.
Proposed Sec. 450.109(a)(3) stated that a flight hazard analysis
must ensure that the risk associated with each hazard would meet the
following criteria: (1) The likelihood of any hazardous condition that
may cause death or serious injury to the public must be extremely
remote; and (2) the likelihood of any hazardous condition that may
cause major damage to public property or critical assets must be
remote.
In the final rule, the FAA revises this requirement to remove the
property protection requirement in proposed Sec. 450.109(a)(3)(ii), as
discussed earlier. Section 450.109(b)(3) states that a flight hazard
analysis must ensure that the likelihood of any hazardous condition
that may cause death or serious injury to the public is extremely
remote.
Proposed Sec. 450.109(a)(5) stated a flight hazard analysis must
demonstrate that the risk elimination and mitigation measures would
achieve the risk levels of proposed Sec. 450.109(a)(3) through
validation and verification. Verification includes analysis, test,
demonstration, or inspection. The FAA adopts and re-designates proposed
Sec. 450.109(a)(5) as Sec. 450.109(b)(5) in the final rule, with one
revision. In Sec. 450.109(b)(5), the FAA changes the term
``demonstrate'' in the introductory paragraph to ``document.''
Virgin Galactic noted that the NPRM used the term ``demonstrate''
as both part of the introductory paragraph in proposed Sec.
450.109(a)(5) and as a verification method in proposed Sec.
450.109(a)(5)(iii). Virgin Galactic commented that demonstration is a
standard verification method, and use of the word in both places could
drive confusion. Virgin Galactic recommended changing the term
``demonstrate'' in Sec. 450.109(a)(5) to ``verify and validate'' to
clarify that demonstration is not the only method of completing
validation and verification.
The FAA agrees that the proposed language could cause confusion,
and that demonstration is not the only method of completing validation
and verification. The FAA changes ``demonstrate'' to ``document'' to
avoid that confusion. The FAA does not adopt Virgin Galactic's specific
suggestion because ``verification'' and ``validation'' are terms used
later in the sentence, and are defined in Sec. 401.7.
Virgin Galactic commented on proposed Sec. 450.109(c) and
recommended that there be an exclusion
[[Page 79629]]
for vehicles that follow the same standard trajectory each flight.
The FAA disagrees with Virgin Galactic's recommendation. Even if an
operator follows a stable trajectory, vehicle design changes or other
operational changes may introduce new hazards. An operator must confirm
that the flight hazard analysis is valid for each mission in order to
ensure that all hazards are identified and mitigated to an acceptable
level. That said, the FAA expects that operators with stable vehicle
designs and operations will typically not have major updates to their
flight hazard analyses.
The FAA re-designates proposed Sec. 450.109(d) as Sec. 450.109(e)
in the final rule, and removes the term ``operational'' to reflect that
an operator must continually update the flight hazard analysis
throughout the lifecycle of the launch or reentry system, rather than
just address operational changes. As discussed in the preamble
discussion on the system safety program (Sec. 450.103), design and
operational changes to a system can have an impact on public safety.
Virgin Galactic commented that the term ``continually'' in Sec.
450.109(d) is not defined and is vague. In addition, Virgin Galactic
noted that the requirement appears to duplicate the current continuing
accuracy requirements in part 413 and the proposed continuing accuracy
requirements in proposed Sec. 450.211. Virgin Galactic recommends this
requirement be removed.
The FAA notes that, for the purposes of the flight hazard analysis,
``continually'' means that the operator must update the flight hazard
analysis as aspects of the mission change or as new information is
learned about an operation, if potential impacts to the analysis are
identified. Although somewhat redundant with the requirement in Sec.
450.211 for a licensee to maintain the continuing accuracy of
representations in its application, proposed Sec. 450.109(d) (re-
designated Sec. 450.109(e) in the final rule) provides the specific
expectation that the flight hazard analysis must be complete and all
hazards must be mitigated to an acceptable level for every launch or
reentry.
SpinLaunch commented that the requirements in proposed Sec.
450.109(c) and (d) were an onerous burden, and that to achieve a
regulatory framework that can effectively and efficiently oversee
multi-site, multi-vehicle operations, a shift away from the traditional
regulatory verification of each component to a more practical method
would be necessary. SpinLaunch recommended that an applicant just
demonstrate knowledge and skills to perform safe and accepted
operations.
Operators have a responsibility to ensure that public safety
analyses are consistent with their proposed operations and that all
hazards are mitigated to an acceptable level. This practice is
consistent with system safety practices and current commercial space
regulations. The framework recommended by SpinLaunch would not achieve
these public safety outcomes because it is too broad and lacks
performance metrics.
In the final rule, the FAA re-designates proposed Sec. 450.109(e)
as Sec. 450.109(f), (Application requirements). Except for number re-
designations, the FAA adopts the requirements as proposed.
j. Physical Containment (Sec. 450.110)
As discussed earlier, unlike other hazard control strategies, the
FAA did not propose a separate section for the physical containment
hazard control strategy in the NPRM. Rather, proposed Sec. 450.107(b)
simply contained the requirements for physical containment as a hazard
control strategy. The FAA proposed that, to use physical containment as
a hazard control strategy, an operator would be required to ensure that
the launch vehicle does not have sufficient energy for any hazards
associated with its flight to reach outside the flight hazard area
developed in accordance with proposed Sec. 450.133 (Flight Hazard Area
Analysis), and would be required to apply other mitigation measures to
ensure no public exposure to hazards as agreed to by the Administrator
on a case-by-case basis. In addition, proposed Sec. 450.107(e)
included specific application requirements for an operator using
physical containment as a hazard control strategy; namely, that it must
(1) demonstrate that the launch vehicle does not have sufficient energy
for any hazards associated with its flight to reach outside the flight
hazard area developed in accordance with Sec. 450.133, and (2)
describe the methods used to ensure that flight hazard areas are
cleared of the public and critical assets.
In the final rule, the FAA places the requirements for the physical
containment hazard control strategy in a separate section, Sec.
450.110. With one exception, the proposed requirements are unchanged in
the final rule. The one exception, as discussed next in response to a
comment, is that the FAA clarifies that the hazard area must be clear
of the public and critical assets.
As noted earlier in the discussion of Sec. 450.107, Blue Origin
commented that the FAA amend proposed Sec. 450.107(e)(2)(ii), which
proposed to require an applicant to describe the methods used to ensure
that flight hazard areas are cleared of the public and critical assets,
and to require that an applicant describe the methods used to ensure
that risk to the public and critical assets in flight hazard areas meet
allowable criteria. Blue Origin pointed out that critical assets cannot
be cleared from a flight hazard area. In addition, Blue Origin stated
that the proposed definition of ``flight hazard area'' in Sec. 401.5
already captured that the area would be controlled to risk limits and
that can be achieved through methods other than clearing the area.
The FAA disagrees with Blue Origin that proposed Sec.
450.107(e)(2)(ii), now Sec. 450.110(c)(2), should be amended to
require an applicant to describe the methods used to ensure that risk
to the public and critical assets in flight hazard areas meet allowable
criteria, as opposed to ensuring that the area is cleared of the public
and critical assets. Although Blue Origin is correct in noting that the
definition of ``flight hazard area'' is not limited to clearing the
area,\107\ the physical containment hazard control strategy is designed
to be a simple method of protecting public safety by launching within
an area that is cleared of the public and critical assets, and within
an area that contains hazards based on the potential energy of the
vehicle. The FAA modifies what was proposed in Sec. 450.107(b)(1) and
(b)(2), now Sec. 450.110(b)(1) and (b)(2), from what was proposed in
the NPRM, to clarify that the hazard area must be clear of the public
and critical assets.
---------------------------------------------------------------------------
\107\ The proposed definition of ``flight hazard area'' in the
NPRM was ``any region of land, sea, or air that must be surveyed,
publicized, controlled, or evacuated in order to protect public
health and safety and the safety of property.''
---------------------------------------------------------------------------
The FAA also modifies the definition of ``flight hazard area'' in
Sec. 401.7 to change the language from ``in order to protect public
health and safety and the safety of property'' to ``in order to ensure
compliance with the safety criteria in Sec. 450.101.'' The FAA makes
this change to tie flight hazard areas to the safety criteria in Sec.
450.101.
k. Wind Weighting (Sec. 450.111)
In the NPRM, the FAA proposed wind weighting requirements in Sec.
450.141. As discussed earlier, the wind weighting requirements have
been moved to Sec. 450.111 in order to group all hazard control
strategies together. Although the FAA did not receive any comments on
this hazard control strategy, the FAA
[[Page 79630]]
has made a few changes in the final rule.
In the applicability section, the FAA specifies that an operator
may use wind weighting as a hazard control strategy to meet the safety
criteria of Sec. 450.101 to Sec. 450.101(a), (b), and (c), which
address launch risk criteria, reentry risk criteria, and high
consequence event protection. The FAA makes this change because the
criteria in Sec. 450.101(d), (e), (f), and (g)--addressing disposal
safety criteria, the protection of people and property on orbit, the
notification of planned impacts, and the validity of analyses,
respectively--are not relevant to wind weighting. Therefore, an
operator does not need to demonstrate that wind weighting satisfies
these requirements.
In the NPRM, proposed Sec. 450.141(b) would require that for the
flight of an unguided suborbital launch vehicle that uses a wind
weighting safety system, the launcher azimuth and elevation settings
must be wind weighted to correct for the effects of wind conditions at
the time of flight to provide a safe impact location. The FAA has
replaced ``to provide a safe impact location'' with ``to provide impact
locations that will ensure compliance with the safety criteria in Sec.
450.101.'' This change removes any ambiguity as to the meaning of
``safe impact location.''
Also in the NPRM, proposed Sec. 450.141(b) would require that for
the flight of an unguided suborbital launch vehicle that uses a wind
weighting safety system, an operator must use launcher azimuth and
elevation angle settings that ensures the rocket will not fly in an
unintended direction given wind uncertainties. The FAA has replaced
``given wind uncertainties'' with ``accounting for uncertainties in
vehicle and launcher design and manufacturing, and atmospheric
uncertainties.'' This change acknowledges that the uncertainties that
affect an unguided suborbital launch vehicle's ability to fly in an
unintended direction are broader than just wind uncertainties--they
include uncertainties in vehicle and launcher design and manufacturing,
and other atmospheric uncertainties. The FAA makes two grammatical
changes to the application requirements, which in the final rule are in
Sec. 450.111(e). First, in Sec. 450.111(e)(2), the FAA replaces ``and
identify'' with ``including.'' In Sec. 450.111(e)(3), the FAA removes
the word ``provide.''
Lastly, similar to other sections in this rule, the FAA removes the
proposed requirement for an applicant to provide additional products
that allow an independent analysis as requested by the Administrator
because the requirement was redundant with Sec. 450.45(e)(7)(ii).
l. Flight Safety Analysis (Sec. Sec. 450.113 to 450.139)
Regardless of the hazard control strategy chosen or mandated, the
FAA anticipates that an operator will be required to conduct an FSA for
at least some phases of flight. For example, an FSA must determine
flight hazard areas for any vehicle with planned debris impacts capable
of causing a casualty. Also, an FSA must quantitatively demonstrate
that a launch or reentry meets the safety criteria for debris, far-
field overpressure, and toxic hazards. An operator may be required to
conduct additional analyses to use flight abort or wind weighting
hazard control strategies.
Generally, an FSA consists of a set of quantitative analyses used
to determine flight commit criteria, flight abort rules, flight hazard
areas, and other mitigation measures and to demonstrate compliance with
the safety criteria in Sec. 450.101. In the NPRM, the FAA proposed 15
sections associated with FSA requirements in Sec. Sec. 450.113 through
450.141. The final rule moves requirements associated with flight
safety limits to Sec. 450.108, such that 11 interrelated sections
remain component parts of an FSA.
There are 11 performance-based sections with FSA requirements that
fall into three groups. The first group, Sec. Sec. 450.113 and
450.115, provides requirements on the scope and fidelity of the
analyses required by the remaining nine sections. The second group,
which consists of five sections from Sec. 450.117 through Sec.
450.131, specifies the requirements for analyses necessary to develop
quantitative input data used by the last four sections. The last group
consists of four sections that specify quantitative risk analyses with
products necessary to evaluate compliance with the safety criteria in
Sec. 450.101. All of the FSA sections must use methods that comply
with Sec. 450.101(g) because they are essential to demonstrating
compliance with the safety criteria in Sec. 450.101.
To aid in holistically understanding the substance of, and
relationships between, the FSA sections, the following provides a brief
overview, before a more detailed discussion of each FSA section.
Section 450.113 specifies the overall scope of the subsequent analyses
in terms of the period of flight for which the public risks must be
quantified. For example, for an orbital launch, an FSA must account for
all phases of flight from liftoff through orbital insertion and through
all component impacts or landings. Section 450.115 specifies that the
operator's analysis methods must account for all reasonably foreseeable
events and failures of safety-critical systems during nominal and non-
nominal launch or reentry that could jeopardize public health and
safety, and the safety of property. Section 450.115 also specifies that
the operator's methods must have a level of fidelity sufficient (1) to
demonstrate compliance with the safety criteria of Sec. 450.101,
accounting for all known sources of uncertainty, using means of
compliance accepted by the Administrator; and (2) to identify the
dominant source of each type of public risk with a criterion in Sec.
450.101(a) or (b) in terms of phase of flight, source of hazard (such
as toxic exposure, inert, or explosive debris), and failure mode. An
operator must comply with these foundational sections when performing
any of the separate analyses that together comprise the FSA.
Sections 450.117 and 450.119 specify the constraints and objectives
of analyses sufficient to characterize the trajectory of the vehicle
during normal and malfunction flight. Section 450.121 specifies the
constraints and objectives of an analysis sufficient to quantify the
physical, aerodynamic, and harmful characteristics of hazardous debris,
including impact probability distributions generated from normal and
malfunction flight. Section 450.123 specifies requirements to
characterize the population exposed to a significant probability of
impact by hazardous debris, including the vulnerability of people in
various structure types. Section 450.131 specifies requirements for
statistically valid estimates of the probability of reasonably
foreseeable failures based on the outcomes of previous flights.
Depending on the type of operation or the hazard control strategy used,
an operator may be required to perform some or all of these analyses in
developing its FSA.
Finally, Sec. Sec. 450.133, 450.135, 450.137, and 450.139 specify
the requirements for quantitative risk analyses to demonstrate that the
risks to the public from debris, far-field overpressure, and toxic
hazards are consistent with the safety criteria in Sec. 450.101.
Generally, the analyses conducted under Sec. Sec. 450.117 through
450.131 are used to inform the analyses for these final portions of the
FSA. Flight commit criteria, flight hazard areas, flight abort rules,
and other mitigation measures are typically derived as necessary to
demonstrate compliance with the safety criteria in Sec. 450.101, and
thus are typical byproducts of the risk analyses
[[Page 79631]]
performed to satisfy the requirements in Sec. Sec. 450.133, 450.135,
450.137, and 450.139. The requirements for each of the FSA sections are
described in more detail in the following sections.
m. Flight Safety Analysis Requirements--Scope (Sec. 450.113)
In the NPRM, proposed Sec. 450.113 stated the scope and
applicability of FSA requirements. Proposed Sec. 450.113(a), which
covered scope, stated an operator would be required to perform and
document an FSA: (1) For orbital launch, from liftoff through orbital
insertion, and any component or stage landings; (2) for suborbital
launch, from liftoff through final impact; (3) for disposal, from the
beginning of the deorbit burn through final impact; (4) for reentry,
from the beginning of the deorbit burn through landing; and (5) for
hybrid vehicles, for all phases of flight, unless the Administrator
determines otherwise based on demonstrated reliability. Proposed Sec.
450.113(b), which covered applicability, identified what sections
needed to be included in an FSA depending on the type of operation or
hazard control strategy being used.
In the final rule, the FAA has removed the proposed applicability
provision and adopted the scope provisions with some changes and
reorganization. The FAA revised Sec. 450.113(a) to state that an
operator must perform and document an FSA for all phases of flight,
except as specified in Sec. 450.113(b). The FAA also revised Sec.
450.113 to add in paragraph (b) an operator is not required to perform
and document an FSA for a phase of flight if agreed to by the
Administrator based on demonstrated reliability. An operator
demonstrates reliability by using operational and flight history to
show compliance with the risk criteria in Sec. 450.101(a) and (b).
Operational history includes the flight time and/or cycles of an
aircraft, which may have an airworthiness certificate, operating under
part 91, part 135 or part 121 as an example. Flight history could be
represented by flight time accumulated through a period of
developmental and flight tests of a vehicle that does not have an
airworthiness certificate. Although the demonstrated reliability
language was limited to hybrid vehicles in the proposed rule, the FAA
is providing additional flexibility by expanding it to all vehicles.
Some vehicles other than hybrids could conceivably have an extensive
and safe enough flight history to demonstrate compliance with the risk
criteria in Sec. 450.101(a) and (b) based on empirical data in lieu of
the traditional risk analysis.
In the final rule, the FAA modifies Sec. 450.113(a)(1), which
addresses orbital launches, to clarify that an FSA covers from liftoff
through orbital insertion and through ``all component impacts or
landings'' instead of proposed ``any component or stage landings or
final impacts.'' Likewise, for the scope of an FSA for suborbital
launches, the FAA changes Sec. 450.113(a)(2) to ``through all
component impacts or landings'' instead of proposed ``through final
impact.'' These changes reflect the reality that orbital and suborbital
launch vehicles often have multiple components that can either impact
the Earth or land intact. An FSA should address all such impacts or
landings.
The FAA modifies Sec. 450.113(a)(4) for a similar reason. For the
scope of a reentry analysis, the FAA changes Sec. 450.113(a)(4) to
include ``through all component impacts or landings'' instead of
proposed ``through landing.'' This change reflects the reality that
reentry vehicles often have multiple components that can either impact
the Earth or land intact.
The FAA modifies Sec. 450.113(a)(3) and (4) by replacing the term
``the beginning of the deorbit burn'' with ``the initiation of the
deorbit.'' The FAA notes not all deorbit operations will include a
``burn.'' The FAA notes that, for a disposal, an operator could
discontinue the analysis prior to final impact and demonstrate an
equivalent level of safety by presenting evidence of complete demise
due to aerothermal heating. The scope of the FSA is consistent with the
risk criteria in Sec. 450.101 and the long-standing definition of
``reentry'' in Sec. 401.7. The FAA clarifies here that, for the
purposes of the FSA and risk criteria, the initiation of the deorbit
for a reentry or disposal from orbit generally coincides with the final
health check prior to the final command to commit the vehicle to a
perigee below 70 nautical miles.
The final rule removes the language proposed in Sec. 450.113(b)
covering applicability, because the reorganization of the flight abort
related sections means that all FSA sections are applicable, unless
otherwise agreed to by the Administrator based on demonstrated
reliability. Instead, Sec. 450.113(b) in the final rule addresses how
an operator demonstrates reliability, as discussed.
n. Flight Safety Analysis Methods (Sec. 450.115)
In the NPRM, proposed Sec. 450.115 outlined the methods for
conducting FSA. The FAA did not receive comments on this proposal
unique to this section.
In the final rule, the FAA adopts Sec. 450.115 as proposed with
one change. The term ``vehicle response mode'' is changed to ``failure
mode'' to be consistent with the changes to this term made elsewhere in
the final rule. Consistent with the NPRM, Sec. 450.115(c)(4) requires
that an FSA methodology must identify the evidence for validation and
verification required by Sec. 450.101(g), which addresses the required
accuracy and validity of data and scientific principles. For example,
the ``accounting for all known sources of uncertainty'' requirement
specified in Sec. 450.115(b)(1) must produce results consistent with
or more conservative than the results available from previous mishaps,
tests, or other valid benchmarks, such as higher-fidelity methods.
o. Trajectory Analysis for Normal Flight (Sec. 450.117)
In the NPRM, proposed Sec. 450.117 (Trajectory Analysis for Normal
Flight) set requirements for an FSA for normal trajectories. The
proposed provision was meant to distinguish between variability in the
intended trajectory and uncertainties due to random sources of
dispersion such as winds and vehicle performance. The FAA explained
that all FSAs depend on some form of analysis of the trajectory under
normal conditions, otherwise known as a normal trajectory. That is, a
vehicle's trajectory when it performs as intended and under normal
conditions must be understood to determine the effects of malfunctions
along its flight path.
Proposed Sec. 450.117(a)(1) required an FSA to include a
trajectory analysis that established, for any phase of flight within
the scope of proposed Sec. 450.113(a), the limits of a launch or
reentry vehicle's normal flight as defined by the nominal trajectory,
and sets of trajectories sufficient to characterize variability and
uncertainty during normal flight. First, proposed Sec.
450.117(a)(1)(i) required a set of trajectories to characterize
vulnerability. This set would be required to describe how the intended
trajectory could vary due to the conditions known prior to initiation
of flight. Second, proposed Sec. 450.117(a)(1)(ii) required a set of
trajectories to characterize uncertainty. This set would be required to
describe how the actual trajectory could differ from the intended
trajectory due to random uncertainties. The FAA also proposed to
require an FSA to include a trajectory analysis establishing a fuel
exhaustion trajectory in proposed Sec. 450.117(a)(2) and, for vehicles
with an
[[Page 79632]]
FSS, trajectory data or parameters that describe the limits of a useful
mission in proposed Sec. 450.117(a)(3).
In the final rule, the FAA adopts proposed Sec. 450.117 with
revisions. The FAA makes clarifying changes for a number of
requirements regarding trajectory analysis; removes and relocates the
fuel exhaustion trajectory requirement to Sec. 450.119; and removes
and relocates references to ``limits of a useful mission'' to Sec.
450.119. The FAA also makes changes to remove prescriptiveness in favor
of more performance-based language.
Boeing, Lockheed Martin, Northrop Grumman, Sierra Nevada, and ULA
recommended changing the term ``normal'' flight to ``nominal'' flight
in numerous parts of proposed Sec. 450.117. The FAA does not agree
with this recommendation because both of these terms are defined by the
FAA and are distinct. Section 401.7 defines ``nominal'' to mean, in
reference to launch vehicle performance, trajectory, or stage impact
point, a launch vehicle flight for which all vehicle aerodynamic
parameters are as expected, all vehicle internal and external systems
perform as planned, and there are no external perturbing influences
other than atmospheric drag and gravity. Section 401.7 defines ``normal
flight'' to mean the flight of a properly performing vehicle whose
real-time vacuum IIP does not deviate from the nominal vacuum
instantaneous impact point by more than the sum of the wind effects and
the three-sigma guidance and performance deviations in the uprange,
downrange, left-crossrange, or right-crossrange directions. Thus, in
simple terms, a nominal trajectory is a single trajectory that the
vehicle would fly in the absence of wind effects and guidance and
performance variability. Section 401.7 defines ``normal trajectory'' to
mean ``a trajectory that describes normal flight.'' The FAA retains the
definitions of these terms. It is virtually impossible for flights to
be nominal such that all aerodynamic parameters and systems are as
expected without the influence of any uncertainties. To replace
``normal'' with ``nominal'' would substantively change the meaning of
the rule, as uncertainty does not apply to a nominal trajectory.
Requiring normal flight trajectories is a more permissive range of
trajectories than nominal flight and allows the rule to be performance
based within safe parameters. The FAA retains the use of the terms as
proposed.
In the final rule, the FAA narrows the scope of the set of
trajectories to characterize uncertainty due to random uncertainties
``in all parameters with a significant influence on the vehicle's
behavior through normal flight'' in Sec. 450.117(a)(2). Generally, the
FAA considers ``a significant influence'' to include any parametric
uncertainties within three-sigma that affect the crossrange IIP
location or downrange IIP rate by at least one percent because the IIP
location and rate is often a convenient surrogate for the potential
impact locations of hazardous debris. One percent is a typical
threshold value used in RCC 321-20 Standard and Supplement. Thus, the
final rule does not intend for applicants to characterize the influence
of all random uncertainties or variability, but only those with a
significant influence on the potential impact locations for hazardous
debris.
The FAA removes the NPRM requirements for a fuel exhaustion
trajectory in proposed Sec. 450.117(a)(2) and its associated
application requirement in proposed Sec. 450.117(d)(3)(ii). The
requirements for this analysis are more appropriately located in the
malfunction flight section because a fuel exhaustion trajectory is a
malfunction trajectory that results when thrust termination does not
occur as planned. A fuel exhaustion trajectory is not always required;
however, such an analysis could be necessary for certain operations.
For example, a fuel exhaustion trajectory will be necessary under the
final rule Sec. 450.119(a)(2) for a return to launch site scenario. As
a result of this removal, the FAA combines proposed Sec. 450.117
paragraph (a) with paragraph (a)(1) as a new paragraph (a), and re-
designates proposed Sec. 450.117(a)(1)(i) and (a)(1)(ii) as Sec.
450.117(a)(1) and (a)(2), respectively.
The NPRM referenced the limits of a useful mission in proposed
Sec. 450.117(a)(3). In the final rule, the FAA moves all references to
the limits of a useful mission from Sec. 450.117, including proposed
Sec. 450.117(a)(3), to Sec. 450.119 (Trajectory Analysis for
Malfunction Flight). The FAA finds that the requirements associated
with the limits of a useful mission belong in the malfunction flight
section because limits of a useful mission can exceed the bounds of
normal flight.
The FAA received several comments on the proposed use of the term
``limits of a useful mission.'' A summary of the comments and FAA's
responses can be found in the preamble section on Trajectory Analysis
for Malfunction Flight.
The FAA adopts Sec. 450.117(b) as proposed. A final trajectory
analysis must use a six-degree of freedom trajectory model to satisfy
the requirements of Sec. 450.117(a). The FAA did not receive comments
on this proposal.
Proposed Sec. 450.117(c) would have required a trajectory analysis
to account for all wind effects including profiles of winds that are
not less severe than the worst wind conditions under which flight might
be attempted and for uncertainty of the wind conditions. In the final
rule, the FAA revises the requirement to state that a trajectory
analysis must account for ``atmospheric conditions that have an effect
on the trajectory'' rather than ``all wind effects.'' The FAA notes
that the revision captures the intent of (1) the proposed requirement
to account specifically for wind effects under all foreseeable
conditions within the flight commit criteria and consistent with the
flight abort rules, and (2) the proposed requirement in Sec.
450.117(a) to establish sets of trajectories sufficient to characterize
variability and uncertainty during normal flight.
The FAA recognizes that wind is the primary atmospheric
consideration for most vehicles, but, for some (non-traditional)
vehicles, other atmospheric parameters such as density, humidity, or
temperature may affect trajectory and be part of the flight commit
criteria. Although these other conditions would have necessarily been
accounted for in the trajectory analysis for normal flight as
``uncertainties'' in the introductory language to Sec. 450.117(a), the
final rule expressly refers to all atmospheric conditions in Sec.
450.117(c). The FAA also notes that flight in the context of this
section refers to the period of launch or reentry within the scope of
Sec. 450.113.
Boeing commented that it is impossible to account for all wind
effects, as wind models were local and limited in altitude. Boeing
recommended incorporating an altitude limit of 60,000 feet, and
modifying the requirement to state, ``a trajectory analysis must
account for launch and, if different, reentry site wind effects, as
applicable, including profiles of winds that are no less severe than
the worst wind conditions under which flight might be attempted, and
for uncertainty in the wind conditions.''
The FAA notes that the proposed requirement concerning wind
effects, revised to ``atmospheric effects'' in the final rule,
specifies profiles under which flight may be attempted based on the
launch commit criteria and flight abort rules. The NPRM and the final
rule set performance level requirements that avoid placing an arbitrary
altitude limit that may not encompass all the conditions that may have
an effect on a
[[Page 79633]]
normal trajectory. Accordingly, the final rule requires a trajectory
analysis to account not for all wind effects, but instead for
atmospheric conditions that have an effect on the trajectory, including
any uncertainty. Accounting for atmospheric effects on the trajectory
will be addressed in guidance.
Blue Origin stated the requirements in proposed Sec. 450.117(b)
through (d)(2) amount to translating complex vehicle trajectory models
into verbiage for delivery to FAA for licensing. Blue Origin proposed
revising the language to specify vehicle state vector parameters in
terms of position, attitude, velocity, thrust, and mass. In terms of a
statistical distribution of each parameter, Blue Origin recommends
providing a covariance matrix describing vehicle guidance and
performance uncertainty as meeting the intent of the requirement.
The FAA notes Blue Origin's recommendation to specify the vehicle's
position and velocity during normal flight using covariance matrices
would satisfy the requirement in Sec. 450.117(a)(2) because that
approach was identified in Appendix A to part 417 under
A417.7(g)(7)(xiii). The approach in Appendix A to part 417 under
A417.7(g)(7)(xiii) meets the requirement in Sec. 450.117(a)(2) because
a set of covariance matrices for the vehicle position coordinates and
velocity component magnitudes are an acceptable means to describe how
the actual trajectory could differ from the intended trajectory due to
random uncertainties in all parameters with a significant influence on
the vehicle's behavior throughout normal flight. However, the FAA
recognizes that other approaches, including a sufficiently large \108\
set of Monte Carlo sample trajectories,\109\ may also satisfy the
requirement. The FAA does not intend to prescribe a specific method to
characterize normal flight. Therefore, the FAA declines Blue Origin's
recommendation to revise the requirement to specify vehicle state
vector and covariance parameters. Instead, the final rule implements
performance-based trajectory analysis requirements as proposed, such
that an applicant must submit a description of the methods and input
data used to characterize the vehicle's flight behavior throughout
normal flight.
---------------------------------------------------------------------------
\108\ The FAA will determine what constitutes a sufficiently
large set of Monte Carlo trajectories pursuant to the level fidelity
of analysis requirements in Sec. 450.115(b).
\109\ Monte Carlo methods include computational algorithms that,
for example, repeatedly sample from probability distributions that
characterize input parameters (such as the weight, thrust, and drag
of a vehicle) and perform physics-based (such as Newton's laws)
simulations to obtain numerical results (such as a set of
trajectories that characterize flight under normal or malfunction
conditions).
---------------------------------------------------------------------------
The FAA proposed application requirements for trajectory analysis
for normal flight in Sec. 450.117(d). In the final rule, the FAA
adopts proposed Sec. 450.117(d) with revisions. Specifically, the FAA
removes the proposed requirement to describe the methodology used to
determine the limits of a useful mission in Sec. 450.117(d)(1).
Instead, an equivalent requirement appears in Sec. 450.119(c)(2) of
the final rule. The FAA also removes the items proposed in Sec.
450.117(d)(1)(i) through (d)(1)(iv) because they were redundant with
the performance-based requirements that apply to all FSA in accordance
with Sec. 450.115(c).\110\ The FAA removes the prescriptive
requirements in Sec. 450.117(d)(2)(ii) through (d)(2)(iv) proposed in
the NPRM because these requirements are captured with the final rule
requirement in Sec. 450.117(d)(2), as explained later in this preamble
section. In addition, the FAA re-designates proposed Sec.
450.117(d)(2)(i) as (d)(3), and 450.117(d)(3) as (d)(4) with a minor
revision. The FAA removed proposed Sec. 450.117(d)(4), which required
an applicant to submit additional products that allow an independent
analysis, as requested by the Administrator, because the requirement
was redundant with Sec. 450.45(e)(7)(ii).
---------------------------------------------------------------------------
\110\ Section 450.115(c) requires an applicant to submit a
description of the FSA methodology, including identification of: (1)
The scientific principles and statistical methods used; (2) all
assumptions and their justifications; (3) the rationale for the
level of fidelity; (4) the evidence for validation and verification
required by Sec. 450.101(g); (5) the extent that the benchmark
conditions are comparable to the foreseeable conditions of the
intended operations; and (6) the extent that risk mitigations were
accounted for in the analyses.
---------------------------------------------------------------------------
In the NPRM, proposed Sec. 450.117(d)(2) required an applicant to
submit a description of the input data used to characterize the
vehicle's flight behavior throughout normal flight and limits of a
useful mission. The proposal would have required a description of the
wind input data, including uncertainties (Sec. 450.117(d)(2)(ii)); a
description of the parameters with a significant influence on the
vehicle's behavior throughout normal flight, including a quantitative
description of the nominal value for each significant parameter
throughout normal flight (Sec. 450.117(d)(2)(iii)); and a description
of the random uncertainties with a significant influence on the
vehicle's behavior throughout normal flight, including a quantitative
description of the statistical distribution for each significant
parameter (Sec. 450.117(d)(2)(iv)).
Commenters asserted these proposed requirements were too
prescriptive, and the FAA agrees. The FAA revises Sec. 450.117(d)(2)
to require an applicant to submit the quantitative input data,
including uncertainties, used to model the vehicle's normal flight in
six degrees of freedom. This revision in the final rule captures the
parameters of the proposed requirements in Sec. 450.117(d)(2)(ii)
through (d)(2)(iv), while allowing for more flexibility in the
application of the regulatory requirements. Quantitative input data
used to model the vehicle's normal flight in six degrees of freedom
includes comprehensive sets of aerodynamic and mass properties.
Explanation and details on how to comply with these requirements will
be included in Advisory Circular 450.117-1, ``Trajectory Analysis.''
The FAA retains the requirement proposed in Sec. 450.117(d)(2)(i)
and re-designates it as Sec. 450.117(d)(3) in the final rule. In
addition, the FAA changes the term ``wind effects'' to ``atmospheric
effects'' to be consistent with Sec. 450.117(c) of the final rule.
The FAA revises proposed Sec. 450.117(d)(3) as discussed in this
paragraph and re-designates it as Sec. 450.117(d)(4) in the final
rule. The proposal required an applicant to submit representative
normal flight trajectory analysis outputs, including the position,
velocity, and vacuum IIP, for each second of flight. Blue Origin
commented that this requirement created an unnecessary burden to
calculate vacuum IIP for potentially hundreds or thousands of normal
and malfunction vehicle trajectories. Blue Origin stated that vacuum
IIP was not representative of where vehicle hazards may impact the
Earth and believed this requirement should only apply to the nominal
trajectory.
The FAA disagrees that the IIP application requirement would have
created an unnecessary burden; however, the final rule removes the
application requirement because vacuum IIP can be readily computed if
necessary from the position and velocity vectors, which are a part of
the application materials. In the final rule, Sec. 450.117(d)(4)
specifies that the representative normal flight trajectory analysis
outputs include orientation of the vehicle in addition to the position
and velocity data specified in the proposal. The FAA notes that
orientation is inherent in any six-degree of freedom trajectory model,
as required by both the proposed and final Sec. 450.117(b).
Orientation is important to
[[Page 79634]]
public safety when the induced velocities have a preferred direction.
The FAA also removes the requirement proposed in Sec.
450.117(d)(3)(ii) that applies to fuel exhaustion trajectory under
otherwise nominal conditions, because a fuel exhaustion trajectory is
merely one specific type of malfunction trajectory and is not
necessarily required for all applicants. For example, a fuel exhaustion
trajectory would be necessary under the final rule for a return to
launch site scenario but not for a typical unguided suborbital rocket.
The requirement in Sec. 450.119(a)(2) of the final rule is used to
determine whether an applicant must include a fuel exhaustion
trajectory.
p. Trajectory Analysis for Malfunction Flight (Sec. 450.119)
In the NPRM, the FAA proposed requirements associated with
trajectory analysis for malfunction flight in Sec. 450.119. As stated
in the NPRM, a malfunction trajectory analysis is necessary to
determine how far a vehicle can deviate from normal flight. This
analysis helps determine potential impact points in the case of a
malfunction and is therefore a vital input for the analyses needed to
demonstrate compliance with risk criteria.
In the final rule, the FAA adopts proposed Sec. 450.119 with
revisions. The FAA removes, as unnecessary, proposed Sec.
450.119(a)(1), which required that an FSA include a trajectory analysis
that establishes the vehicle's capability to depart from normal flight,
formally defined in terms of IIP in Sec. 401.7. Proposed Sec.
450.119(a)(2) is re-designated (a)(1) and requires that a trajectory
analysis establish the vehicle's deviation capability in the event of a
malfunction during flight. The FAA adds a new requirement, designated
as Sec. 450.119(a)(2), which requires that an FSA must include a
trajectory analysis that establishes the trajectory dispersion
resulting from reasonably foreseeable malfunctions. This language
retains the concept of proposed Sec. 450.119(a)(1), but revises the
regulatory language to allow for a medium-fidelity FSA approach (e.g.,
corridor method) for which the vehicle vacuum IIP during a malfunction
is not specified, as explained in the FAA's Flight Safety Analysis
Handbook.\111\ More specifically, the proposed requirement in Sec.
450.119(a)(1) to establish the vehicle's capability to depart from
normal flight would have required the analysis to account for the IIP
in modeling of a malfunction trajectory because normal flight is
defined in terms of IIP. Thus, the proposed requirement in Sec.
450.119(a)(1) would have foreclosed a valid medium-fidelity FSA
approach. In the final rule, Sec. 450.119(a)(1) and Sec.
450.119(a)(2) provide flexibility and permit at least one approach that
allows a simpler computation of risk but still preserves safety. Not
all operations are eligible for this corridor method, but it is valid
when the vehicle debris risks are due to flight phases where the IIP is
moving steadily downrange, and when the failure modes do not involve
distorted impact distributions.\112\ In the final rule, the FAA amended
the requirement to allow this and other simplified methods for those
operations for which they may be valid.
---------------------------------------------------------------------------
\111\ See Flight Safety Analysis Handbook, V1.0, August 2009
(available at https://www.faa.gov/about/office_org/headquarters_offices/ast/media/Flight_Safety_Analysis_Handbook_final_9_2011v1.pdf).
\112\ Distorted impact distributions are often caused by actions
taken in response to abort criteria.
---------------------------------------------------------------------------
The FAA adds Sec. 450.119(a)(3) in the final rule. Section
450.119(a)(3) states that an FSA must include a trajectory analysis
that establishes, for vehicles using flight abort as a hazard control
strategy under Sec. 450.108, trajectory data or parameters that
describe the limits of a useful mission. This requirement was found in
Sec. 450.117(a)(3) of the NPRM. The FAA finds that trajectory analysis
requirements associated with the limits of a useful mission belong in
the malfunction flight section because presumably normal flight can
attain the one or more objectives within the flight azimuth limits.
The requirement in Sec. 450.119(a)(3) is related to the
requirement proposed in Sec. 450.119(a)(1) because trajectories that
are outside of the normal envelope can still be ``useful,'' even though
they involve a malfunction.\113\ The FAA notes that an operator can
elect to designate the normal mission trajectories as the limits of a
useful mission and meet the application requirement to submit data that
describes the limits of a useful mission, but this may result in the
termination of a flight that could still achieve a mission objective.
---------------------------------------------------------------------------
\113\ Publicly available information indicates that the flight
of the Ariane 5 VA241 that occurred from the Guiana Space Centre on
January 25, 2018 may be a potential empirical example. There the
flight path anomaly was evident from the beginning of flight and the
payloads were deployed into an orbital inclination that was
approximately 18 degrees from the intended orbit, yet the payloads
were still able to deliver useful data.
---------------------------------------------------------------------------
The FAA received several comments on the NPRM's proposal to use the
``limits of a useful mission'' to inform the development of flight
safety limits and when flight abort was necessary, and to establish the
width of a gate. Microcosm requested that the FAA define ``a useful
mission.'' Boeing, Lockheed Martin, Northrop Grumman, and ULA
recommended changing the definition of ``limits of a useful mission''
to mean the trajectory or other parameters that bound performance of a
mission that can attain its primary objective. Blue Origin disagreed
with the addition of ``limits of a useful mission'' to the regulation
and stated that regulating what is considered a useful mission was
outside of the FAA's jurisdiction.
In the final rule, the FAA adopts a new definition of a ``useful
mission'' in Sec. 401.7 and amends the proposed definition of ``limits
of a useful mission'' to mean the trajectory data or other parameters
that bound the performance of a useful mission, including flight
azimuth limits. A ``useful mission'' means a mission that can attain
one or more objectives and is based on the definition of ``limits of a
useful mission'' proposed in the NPRM. The definition of ``limits of a
useful mission'' adopted in the final rule removes the language
``describe the limits of a mission that can attain the primary
objective'' and replaces it with ``bound the performance of a useful
mission,'' consistent with the commenters' recommendation. In this
context, bounding the performance will include flight azimuth limits
and could include limits on the altitude versus distance downrange or
other physics-based limits depending on the nature of the operation.
The FAA makes these changes because it recognizes that pursuit of
objectives other than the primary objective may be considered a useful
mission. However, when all other objectives can no longer be achieved
the FAA does not consider the collection of data related to a failure
in and of itself to be a useful mission. This is because mere failure
data collection alone does not justify continued risk to the public.
Therefore, the final rule states in Sec. 450.119(a)(3) that the FAA
does not consider the collection of data related to a failure to be a
useful mission.
The FAA finds the requirements associated with ``useful mission''
and ``limits of a useful mission'' are central to the hazard control
strategies. The FAA is not attempting to regulate what the operator or
its customer considers a useful mission. The FAA instead is simply
requiring that the applicant identify which missions are useful so that
vehicles that fly outside of these parameters erroneously are not
permitted to threaten the public. The FAA finds it necessary to include
a
[[Page 79635]]
requirement that would prevent a launch or reentry vehicle from
continued flight that would increase risk to the public if that vehicle
can no longer achieve an objective of the operator, outside of the
collection of data related to a failure.
Blue Origin recommended replacing ``limits of a useful mission''
with ``limits to meet public risk criteria.'' The FAA does not agree
with this recommendation. As described in the section on
CEC, public risk criteria alone are inadequate to establish
the need for an FSS, the reliability of the FSS, or the timing of an
FSS activation to ensure public safety. Similarly, while some might
consider risk-based flight safety limits as a reasonable approach to
risk management when a vehicle is on a potentially useful mission, once
a malfunction results in a mission that can no longer achieve an
objective, then hazard containment should be the goal and flight abort
must be used to protect the public against high consequence events.
Application of the limits of a useful mission benefits the operator
because flights with trajectories that are outside of the normal
envelope, but still useful according to the operator, will be permitted
to continue without flight abort as long as they comply with Sec.
450.108(d)(7), including trajectories that overfly the public. This was
the intent of proposed Sec. 450.123(b)(6) in the NPRM, and remains the
intent of Sec. 450.108(d)(7) in the final rule.
Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that
limits of a useful mission were already addressed in flight termination
triggers, and that proposed Sec. 450.117(a)(3) requiring trajectory
data or parameters that describe the limits of a useful mission should
be replaced with limits that trigger flight termination.
The FAA declines to adopt this recommendation because of the
relationship between the limits of a useful mission and flight safety
limits. Pursuant to Sec. 450.108(c)(2) in the final rule (similar to
proposed Sec. 450.123(a)(2) of the NPRM), flight safety limits define
when an operator must initiate flight abort to prevent continued flight
from increasing public risk in uncontrolled areas if the vehicle is
unable to achieve a useful mission. Under the final rule, flight safety
limits will be developed after the limits of a useful mission are
identified. An operator can elect to designate the normal mission
trajectories as the limits of a useful mission and meet the application
requirement to submit data describing the limits of a useful mission,
but this may result in the termination of a flight that could still
achieve a mission objective. As an example, during an operation for
which a gate width was determined using only a vehicle's normal
trajectory envelope, a failure before the gate resulted in the flight
nearly being terminated at the gate, even though it went on to achieve
the mission's primary objective. In that instance, if the limits of a
useful mission data included flight azimuth limits, this vehicle would
have had more margin in the form of a wider gate. Under the final rule,
if an operator decides that placing a payload in any orbit or
withholding abort for crewed flights is more useful than terminating a
flight, it may declare that flight is useful at any azimuth or altitude
and may fly the vehicle on any trajectory that meets Sec.
450.108(d)(7). However, flight safety limits that terminate flights
that are no longer useful should be placed so that they do not increase
risk compared to continued flight, pursuant to Sec. 450.108(d)(6).
The FAA found it necessary to move all references to the limits of
a useful mission from Sec. 450.117 to Sec. 450.119 (Trajectory
Analysis for Malfunction Flight), including proposed Sec.
450.117(a)(3). The FAA finds that the requirements associated with the
limits of a useful mission belong in the malfunction flight section
because limits of a useful mission can exceed the bounds of normal
flight.
In the NPRM, the FAA proposed in Sec. 450.119(b) that a
malfunction trajectory analysis must account for each cause of a
malfunction flight, including software and hardware failures. For each
cause of a malfunction trajectory, the analysis would have been
required to characterize the foreseeable trajectories resulting from a
malfunction. The proposal included six items in Sec. 450.119(b)(1)
through (b)(6) that would be required to be included in the analysis.
In the final rule, the FAA adopts proposed Sec. 450.119(b) with
revisions. The FAA removes proposed Sec. 450.119(b)(1) through (b)(3)
because they are no longer needed due to the adoption of performance-
based standards and re-designates proposed Sec. 450.119(b)(4) through
(b)(6) as (b)(1) through (b)(3). Also, the FAA revises the introductory
language in Sec. 450.119(b) to improve clarity and remove prescriptive
language.
Blue Origin commented that it was not feasible to model a
malfunction turn trajectory for each software or hardware cause, only
for vehicle responses to the cause as proposed in Sec. 450.119(b).
Blue Origin recommended striking the phrase, ``for each cause of a
malfunction trajectory,'' and instead indicate that a malfunction
trajectory analysis must characterize the foreseeable trajectories
resulting from a malfunction.
The FAA partially agrees with Blue Origin's recommendations. The
FAA deletes the proposed language in Sec. 450.119(b), ``for each cause
of a malfunction trajectory, the analysis must characterize the
foreseeable trajectories resulting from a malfunction,'' but retains
the phrase ``for each cause of a malfunction flight'' in the first
sentence of Sec. 450.119(b). The FAA notes the analysis must account
for the probability of each set of trajectories that characterize a
type of malfunction flight, and that probability must account for each
cause of a malfunction flight, including software and hardware
failures, for every period of normal flight.
The FAA notes that use of the phrase ``for each type of
malfunction'' in Sec. 450.119(b) of the final rule addresses Blue
Origin's comment that it is not feasible to model a malfunction turn
trajectory for each cause, but only for vehicle responses to the cause.
The term ``each type of malfunction'' refers to the vehicle response to
the cause and multiple causes could result in a similar vehicle
response. For example, under part 417 a malfunction turn analysis would
account for a series of ``tumble turns,'' as enumerated in Appendix A
to part 417 under A417.9(d)(5), which result in the launch vehicle
rotating due to a constant thrust vector offset angle. The FAA
recognizes that there could be multiple causes for a constant thrust
vector offset, such as a jammed mechanism, loss of electrical power, or
loss of hydraulic fluid pressure. Thus, the probability of a tumble
turn must account for ``each cause of a malfunction flight, including
software and hardware failures,'' in accordance with Sec. 450.119(b).
Furthermore, the FAA recognizes that multiple sets of trajectories are
necessary to characterize the vehicle behavior in response to a
malfunction. An example is a malfunction that results in a constant
thrust vector offset, because a range of thrust vector offsets is
reasonably foreseeable (from very small angles that would cause a slow
departure from normal flight up to the maximum feasible thrust offset
that would typically result in a rapid tumble of the vehicle). Thus,
there is a natural question regarding the appropriate resolution of the
malfunction trajectory analysis. The intent of the requirements in
Sec. 450.119 is to produce sets of trajectories that are sufficient to
characterize the public risks posed by each type of malfunction. Thus,
the final rule sets a performance standard in Sec. 450.119(b) that the
analysis for each
[[Page 79636]]
type of malfunction must have sufficient temporal and spatial
resolution to establish flight safety limits, if any, and individual
risk contours that are smooth and continuous.
In order to be less prescriptive, the FAA further amends Sec.
450.119(b) in response to Blue Origin's comment. The NPRM proposed in
Sec. 450.119(b)(1) through (b)(3) that the malfunction trajectory
analysis must account for (1) all trajectory times during the thrusting
phases, or when the lift vector is controlled, during flight; (2) the
duration, starting when a malfunction begins to cause each flight
deviation throughout the thrusting phases of flight; and (3) trajectory
time intervals between malfunction turn start times that are sufficient
to establish flight safety limits, if any, and individual risk contours
that are smooth and continuous. The FAA removes proposed Sec.
450.119(b)(1) through (b)(3) and consolidates these requirements into
Sec. 450.119(b). This revision sets more performance-based
requirements for the scope and resolution of the malfunction trajectory
analysis to create flexibility in demonstrating the trajectory
dispersion resulting from reasonably foreseeable malfunctions. In the
final rule, Sec. 450.119(b) will require the analysis for each type of
malfunction to have sufficient temporal and spatial resolution to
establish flight safety limits, if any, and individual risk contours
that are smooth and continuous.
In the NPRM, proposed Sec. 450.119(b)(2) required that a
malfunction trajectory analysis account for the duration, starting when
a malfunction begins to cause each flight deviation throughout the
thrusting phases of flight. Virgin Galactic commented that a
malfunction turn analysis would not apply to operations for which a
pilot is in control of a winged vehicle because the pilots act as an
FSS.
The FAA is aware that having pilots onboard and in control of a
vehicle during flight may mitigate the need for certain malfunction
analyses; however, there may still be instances when pilots may become
incapacitated during flight. In any such instances, a trajectory
analysis for malfunction flight would still potentially be necessary to
identify impact points as an essential input for risk analyses to
demonstrate compliance with risk criteria in Sec. 450.101. The FAA
notes that flight simulators can facilitate the development of
representative malfunction trajectory analysis outputs in cases in
which pilot responses have a significant influence on the trajectory
dispersion resulting from reasonably foreseeable malfunctions.
Virgin Galactic also recommended a wording change to Sec.
450.119(b)(2) to define the duration as, ``starting when a malfunction
begins . . . until such time the effects of the malfunction are
mitigated.'' As previously discussed, the FAA does not adopt proposed
Sec. 450.119(b)(2) in the final rule. However, the FAA notes in the
final rule, the combination of the requirement for sufficient temporal
resolution to establish smooth and continuous individual risk contours,
along with the requirement to account for the timing of each
malfunction trajectory's termination due to means other than flight
abort, including vehicle breakup, ground impact, or orbital insertion,
provide a sufficient performance-based specification to establish the
duration of the malfunction trajectory analysis. In addition, the FAA
finds that the commenter's suggestion that the duration of the analysis
continue only ``until such time the effects of the malfunction are
mitigated'' would not analyze both the success and the failure of the
mitigation necessary to quantify the risk and consequence in the event
that the FSS fails.
As a result of removing proposed Sec. 450.119(b)(1) through
(b)(3), the FAA re-designates proposed Sec. 450.119(b)(4) as Sec.
450.119(b)(1) in the final rule. Proposed Sec. 450.119(b)(4) required
that a trajectory analysis for malfunction flight account for the
relative probability of occurrence of each malfunction turn for which
the vehicle is capable. In the final rule, the FAA revises Sec.
450.119(b)(1) to reflect that the analysis must account for the
relative probability of occurrence of each malfunction, and not
specifically a malfunction turn. The FAA views the term ``malfunction
turn'' as outdated. The requirement in the final rule is consistent
with the proposal.
The FAA re-designates proposed Sec. 450.119(b)(5) as Sec.
450.119(b)(2) in the final rule. The FAA also revises Sec.
450.119(b)(2) to correct an omission of the word ``trajectory.''
Furthermore, the FAA adds ground impact and orbital insertion as
potential termination states. The FAA found the exclusion of these
states in the NPRM to be a deficiency that would have resulted in an
operator's inability to meet regulatory requirements for quantifying
the risk because malfunctions can result in trajectories that result in
ground impact or orbital insertion, as well as vehicle break-up, and
those additional outcomes can pose significant public risks as well.
The FAA re-designates proposed Sec. 450.119(b)(6) as Sec.
450.119(b)(3) in the final rule and revises the requirements. Section
450.119(b)(3) requires that a malfunction trajectory analysis account
for the parameters with a significant influence on a vehicle's flight
behavior from the time when a malfunction begins to cause a flight
deviation until each malfunction trajectory will terminate due to
vehicle breakup, ground impact, or orbital insertion. The FAA adds the
phrase ``parameters with a significant influence on vehicle's flight
behavior'' because the analysis must account for these parameters to
characterize sufficiently the vehicle's flight behavior. This language
was proposed in the application requirements in Sec.
450.119(c)(2)(iii) and has been added to paragraph (b)(3) in the final
rule. The FAA received no comments on this language. The FAA also
clarifies that a malfunction trajectory can terminate due to orbital
insertion, not just ground impact or predicted structural failure
(vehicle breakup), as specified in the NPRM, for the same reason that
those outcomes were added to Sec. 450.119(b)(2). Finally, the FAA
replaces the proposed term ``predicted structural failure'' with the
term ``vehicle break-up'' in the final rule. This change is consistent
with the terminology used in Sec. 450.121 (Debris Analysis).
Blue Origin commented that smooth and continuous contours were not
typically feasible unless flight limits were also included in the
malfunction turn analysis. Blue Origin also recommended adding flight
abort to the list of vehicle end state conditions.
The FAA did not add flight abort to the list of vehicle end state
conditions based on Blue Origin's comment because of the relationship
between trajectory analysis for malfunction flight and risk analyses
that produce risk contours. Risk analyses must consider outcomes of
flight abort and FSS inaction, whether through failure of the FSS or
because no flight abort rules were violated, which could result in
vehicle breakup, ground impact, or orbital insertion. If the
trajectories for malfunction flight were terminated when flight abort
was predicted, no trajectory data would exist for cases when the FSS
failed. The rule ensures that complete trajectory data exists to
account for flight abort action and inaction in risk analyses. More
specifically, ending the malfunction trajectories at the flight safety
limits conflicts with the requirement in Sec. 450.108(d)(5) to account
for proper functioning of the FSS and failure of the FSS in individual,
collective, and conditional risk evaluations. It was not necessary to
amend the rule according
[[Page 79637]]
to Blue Origin's comment because flight abort is already a necessary
end case to be analyzed when producing risk contours in accordance with
Sec. 450.133(e)(2)(iii), which is a separate analysis from producing
trajectories for malfunction flight.
Section 450.119(b)(4) explicitly requires a malfunction trajectory
analysis to account for potential FSS failure, if an FSS is used,
because that can also influence the termination condition of a
malfunction trajectory. For example, if a malfunction trajectory
triggers a flight abort rule, potential outcomes of the trajectory are
abort (through destruct, thrust termination, or other method) or
continued flight resulting in aerodynamic breakup, intact impact, or
orbital insertion if the FSS fails. The requirement in Sec.
450.119(b)(4) is consistent with the proposal because both the proposed
and final Sec. 450.115(a) explicitly require that an operator's FSA
method must account for all failures of safety-critical systems during
nominal and non-nominal launch or reentry that could jeopardize public
health and safety and the safety of property. Furthermore, any FSS
required to comply with Sec. 450.143 or Sec. 450.145 necessarily will
meet the definition of a safety-critical system. Therefore, the
proposed requirement Sec. 450.123(a) would have necessitated that the
malfunction trajectory analysis account for the potential failure of
the FSS.
In the NPRM, Sec. 450.119(c) addressed the application
requirements associated with trajectory analysis for malfunction
flight. In the final rule, the FAA adopts the application requirements
in proposed Sec. 450.119(c) with revisions. The revisions include
adding a new Sec. 450.119(c)(2), re-designating proposed Sec.
450.119(c)(2) through (c)(4), and removing proposed Sec.
450.119(c)(1)(i) through (c)(1)(iv).
Proposed Sec. 450.119(c)(1) required an applicant to submit a
description of the methodology used to characterize the vehicle's
flight behavior throughout malfunction flight. In the final rule, the
FAA adopts the proposal and adds a reference to the requirements in
Sec. 450.115(c), which sets the standards for the methodologies used
in the FSA. Also, the FAA removes the items proposed in Sec.
450.119(c)(1)(i) through (c)(1)(iv) because they were redundant with
the performance-based requirements that apply to all FSA in accordance
with Sec. 450.115(c).
In the final rule, a new Sec. 450.119(c)(2) requires an applicant
to submit a description of the methodology used to determine the limits
of a useful mission, in accordance with Sec. 450.115(c). This
requirement was proposed as Sec. 450.117(d)(1) in the NPRM. Moving
this application requirement to Sec. 450.119 is consistent with the
relocation of its associated analysis requirement to Sec.
450.119(a)(3). The FAA re-designates proposed Sec. 450.119(c)(2) as
Sec. 450.119(c)(3) in the final rule. The FAA captures the
requirements of proposed Sec. 450.119(c)(2)(i) and (c)(2)(ii) and
relocates them in Sec. 450.119(c)(3)(i) and (c)(3)(ii).
The FAA re-designates proposed Sec. 450.119(c)(2)(iii) as Sec.
450.119(c)(3)(iii) in the final rule and revises the final Sec.
450.119(c)(3)(iii) to specify the need for an applicant to submit a
quantitative description of the parameters, including uncertainties,
with significant influence on the vehicle's malfunction behavior for
each type of malfunction flight characterized. Proposed Sec.
450.119(c)(2)(iii) required an applicant to submit a description of the
input data used to characterize the vehicle's malfunction flight
behavior, including a description of the parameters with a significant
influence on the vehicle's behavior throughout malfunction flight for
each type of malfunction flight characterized. Proposed Sec.
450.119(c)(2)(iii) also required a quantitative description of the
nominal value for each significant parameter throughout normal flight.
The FAA specifically replaces the proposed requirements in Sec.
450.119(c)(2)(iii) and (c)(2)(iv) \114\ with the requirement in Sec.
450.119(c)(3)(iii) in the final rule. This revision retains the intent
of the requirements proposed in the NPRM but is more flexible in its
application because, although it still requires a quantitative
description, the regulation permits something other than the
statistical distribution that would have been required by the proposal.
---------------------------------------------------------------------------
\114\ Proposed Sec. 450.119(c)(2)(iv) required an applicant to
submit a description of the random uncertainties with a significant
influence on the vehicle's behavior throughout malfunction flight
for each type of malfunction flight characterized, including a
quantitative description of the statistical distribution for each
significant parameter.
---------------------------------------------------------------------------
The FAA re-designates proposed Sec. 450.119(c)(3) as Sec.
450.119(c)(4) in the final rule. The FAA also removes the need for the
vacuum IIP for each second of flight. The FAA makes this change in
response to Blue Origin's comment on computing vacuum IIP for a large
number of trajectories, as addressed in the preamble section on Sec.
450.117.
The FAA adopts the requirements in Sec. 450.119(c)(4)(i) as
proposed in Sec. 450.119(c)(3)(i) in the NPRM. The FAA received no
comments on proposed Sec. 450.119(c)(3)(i). The FAA adopts, with
revisions, the requirements in Sec. 450.119(c)(4)(ii) as proposed in
Sec. 450.119(c)(3)(ii) in the NPRM. Proposed Sec. 450.119(c)(3)(ii)
required submission of the probability of each trajectory that
characterizes a type of malfunction flight. Blue Origin commented that
delivering probabilities for each trajectory modelled was not practical
or useful for independent assessment. Instead, Blue Origin proposed
revising the regulatory language to require the applicant to submit the
probability of each set of malfunction trajectories. The FAA agrees
with this comment and revises Sec. 450.119(c)(4)(ii) in the final rule
to reflect Blue Origin's recommendation.
In the final rule, Sec. 450.119(c)(4)(iii) requires an applicant
to submit a representative malfunction flight trajectory analysis
output, including the position and velocity as a function of flight
time for a set of trajectories that characterize the limits of a useful
mission as described in Sec. 450.119(a)(3) of this section. This
requirement was proposed as Sec. 450.117(d)(3)(v) in the NPRM. As
discussed earlier, the FAA moves the limits of a useful mission
requirement from proposed Sec. 450.117 to Sec. 450.119 in the final
rule.
Lastly, similar to other sections in this rule, the FAA removes the
requirement for an applicant to provide additional products that allow
an independent analysis, as requested by the Administrator. The FAA
finds the requirement redundant with Sec. 450.45(e)(7)(ii). Blue
Origin and the CSF objected to proposed Sec. 450.119(c)(4). Blue
Origin strongly disagreed that the FAA should be in the business of
recreating analysis completed by operators. It submitted that the FAA
should vet the process used by the operator to conduct the analysis,
along with the products of the analysis, to determine whether approval
was warranted. Blue Origin further stated that such independent
recreation of the analysis could lead to protracted back and forth
between an operator and the FAA that was unnecessary if the FAA had
vetted the process used by the operator to conduct the analysis. Blue
Origin proposed to delete this requirement in order to limit the scope
to what was required to establish confidence in the validity of an
operator's analysis. CSF stated that the FAA's practice of recreating
an applicant's analysis should be ended, as it was expensive and
burdensome. CSF recommended that an AC should guide and inform this
analysis.
Virgin Galactic noted that numerous regulations under part 450,
including proposed Sec. 450.119(c)(4), call for additional products
that allow an
[[Page 79638]]
independent analysis, as requested by the Administrator. Virgin
Galactic stated that ``additional products'' was neither defined nor
constrained, permitting the FAA to request any information from
operators at any time. This would create uncertainty regarding the kind
of products an applicant or operator would need to prepare for the FAA.
Virgin Galactic recommended striking the above references in their
entirety. Virgin Galactic commented that, based on prior experience
under part 431 with the FAA requesting additional information, these
regulations may have a significant time and monetary impact on an
operator, if implemented.
The FAA does not agree with the commenters' recommendation to
delete this requirement in its entirety from the final rule. The goal
is for the FAA to evaluate, in an efficient and thorough manner, the
validity of an analysis, along with the products of the analysis
submitted by an operator. The FAA finds that at times it may be
necessary to conduct an independent analysis of the process used by the
operator in order to ensure safety. Additional product requests under
part 431 may have been more frequent due to a lack of well-defined
application requirements. However, under part 450, the FAA expects the
application requirements are sufficient and will generally not request
additional products beyond those that are necessary to protect public
safety. Furthermore, as noted in the NPRM, the FAA has evaluated the
validity of an applicant's proposed methods by comparing the results to
valid benchmarks such as data from mishaps, tests, or validated high-
fidelity methods. Once that has occurred, the FAA can issue an
operator's license for a repeatable operation at a specific site for a
specified range of trajectory azimuths.
Using published benchmarks, the FAA intends to facilitate the
validation and verification of FSA methods to alleviate some of the
needs for the FAA to perform independent analyses. However, the FAA
finds that relying on an approved process alone is insufficient when
certain critical variables may change that affect flight safety or the
MPL determination, or in cases in which the operator proposes launch or
reentry operations that are so unique that relevant benchmarks are
unavailable. Also, the FAA will continue to verify flight operations
for new vehicles, for existing vehicles conducting operations at new
sites, for vehicles flying a trajectory outside the accepted range of
trajectory azimuths, and vehicles that have undergone significant
modifications to vehicle design or flight safety critical systems.
Thus, the FAA foresees continuing to perform independent analyses in
certain circumstances to assure that it has met its statutory
obligation to ensure public health and safety and safety of property.
Although the FAA declines to remove the ``additional products''
reference in Sec. 450.45(e)(7)(ii) of the final rule, the FAA does not
include the redundant references proposed in other sections.
``Additional products'' refers to data that will allow the FAA to
conduct an independent safety analysis in support of its application
assessment and licensing determination. It would be impractical to list
everything needed for every independent analysis. As explained in the
NPRM, the FAA's decision to conduct an independent analysis is usually
reserved for new vehicle concepts, new analysis methods, or proposals
involving unique public safety cases. In all instances, the request for
information is bounded by the regulatory requirements for obtaining a
license and the FAA's need to ensure compliance with the safety
criteria. The FAA adopts the requirement that an applicant submit
additional products to facilitate an independent analysis, as requested
by the Administrator in Sec. 450.45(e)(7)(ii).
q. Debris Analysis (Sec. 450.121)
The NPRM proposed in Sec. 450.121 to require a debris analysis
that characterized the debris generated for each foreseeable vehicle
response mode as a function of vehicle flight time, accounting for the
effects of fuel burn and any configuration changes. The proposal
required that the debris analysis account for each foreseeable cause of
vehicle breakup, including any breakup caused by an FSS activation or
by impact of an intact vehicle. As noted in the NPRM, this would
include debris from a vehicle's jettisoned components and payloads
because such debris could cause a casualty due to impact with an
aircraft or waterborne vessel or could pose a toxic or fire
hazard.\115\ Under proposed Sec. 450.121(c), the debris analysis would
include inert, explosive, and other hazardous vehicle debris from both
normal and malfunctioning flight during launch or reentry.
---------------------------------------------------------------------------
\115\ 84 FR 15383.
---------------------------------------------------------------------------
In the final rule, the FAA adopts proposed Sec. 450.121 with
revisions. Specifically, the FAA preserves the scope of the debris
analysis from the NPRM but consolidates, clarifies, and increases the
flexibility of the regulations in this section. The final rule's
revisions include (1) replacing the requirement to characterize the
debris from ``each foreseeable vehicle response mode'' with ``debris
generated from normal and malfunctioning vehicle flight,'' (2) relying
upon a new definition for ``hazardous debris,'' (3) replacing ``flight
time'' with ``flight sequence,'' and (4) removing prescriptive
thresholds for various debris hazards in favor of a performance-based
standard of ``capable of causing a casualty or loss of functionality to
a critical asset.'' Each of these changes is discussed in the following
paragraphs.
Proposed Sec. 450.121(a) required that an FSA include a debris
analysis that characterizes the debris generated for each foreseeable
vehicle response mode as a function of vehicle flight time, accounting
for the effects of fuel burn and any configuration changes. The NPRM
noted that an operator's debris list generally changes over time with
variations in the amount of available propellant and the jettisoning of
hardware.
In the final rule, the FAA adopts proposed Sec. 450.121(a) with
revisions. The FAA replaces the proposed requirement to characterize
``the debris generated for each foreseeable vehicle response mode as a
function of vehicle flight time, accounting for the effects of fuel
burn and any configuration changes'' with a more flexible and
performance-based requirement to characterize ``the hazardous debris
generated from normal and malfunctioning vehicle flight as a function
of vehicle flight sequence.''
Several commenters suggested changing the term ``foreseeable''
vehicle response modes in Sec. 450.121(a) of the NPRM to ``credible''
vehicle response modes. The commenters stated that credibility was
determined during the system safety analysis, and that the debris
analysis should not have to include extremely improbable, non-credible
failure modes.
The FAA does not agree that the term ``foreseeable'' should be
replaced by the term ``credible'' in this section or throughout the
final rule. The term ``foreseeable'' is used in Sec. 431.35 and also
commonly used in system safety; therefore, the FAA is not changing
these references. The FAA finds that the term ``credible'' is
unacceptably prone to errors in judgment whereas the term
``foreseeable'' is more readily discerned by analysis (e.g., fault
trees). With regard to Sec. 450.121(a) of the final rule, the FAA
adopts the more flexible and performance-based requirement recommended
by the commenters to characterize the hazardous debris generated from
normal and malfunctioning vehicle flight as a
[[Page 79639]]
function of vehicle flight sequence. With the removal of the reference
to ``each foreseeable vehicle response mode'' in Sec. 450.121(a), the
final rule standard for the scope is set by the language in Sec.
450.115(a), specifically by the reference to reasonably foreseeable
events. In addition, the resolution of the failure modes accounted for
in the debris analysis is set by the level of fidelity necessary to
comply with Sec. 450.115(b). The FAA also notes that, in the context
of Sec. 450.121, reasonably foreseeable events that can generate
hazardous debris during malfunctioning vehicle flight generally include
engine/motor explosion, exceeding structural limits due to aerodynamic
loads, inertial loads, aerothermal heating, and activation of a flight
termination system.
In reference to the use of the term ``hazardous debris'' in Sec.
450.121(a), the final rule in Sec. 401.7 includes a definition of this
term. Hazardous debris means any object or substance capable of causing
a casualty or loss of functionality to a critical asset. Hazardous
debris includes inert debris and explosive debris such as an intact
vehicle, vehicle fragments, any detached vehicle component, whether
intact or in fragments, payload, and any planned jettisoned bodies.
This definition is based on proposed Sec. 450.121(c)(1), which
required a debris analysis to identify all inert debris that could
cause a casualty or loss of functionality of a critical asset. The FAA
clarifies that the clause ``whether intact or in fragments'' applies to
the payload and jettisoned bodies as well.
The final rule's definition of ``hazardous debris'' facilitated
streamlining in proposed Sec. Sec. 450.113 through 450.139. For
example, the term hazardous debris in Sec. 450.121(a) establishes a
performance-based threshold, which resulted in the elimination of the
prescriptive debris thresholds proposed in Sec. 450.121(c)(1)(i)
through (v).\116\ Section 450.121(a) retains the essential performance
standards in proposed Sec. 450.121(c)(1) and (c)(2) (i.e., that the
analysis must identify all inert and explosive debris capable of
causing a casualty or loss of functionality to a critical asset), and
allows operators to propose impact vulnerability models appropriate for
the materials used in their licensed operations.
---------------------------------------------------------------------------
\116\ As proposed, an operator would have been required to
include all debris that could impact a human being with a mean
expected kinetic energy at impact greater than or equal to 11 ft-
lbs; impact a human being with a mean impact kinetic energy per unit
area at impact greater than or equal to 34 ft-lb/in2; cause a
casualty due to impact with an aircraft; cause a casualty due to
impact with a waterborne vessel; or pose a toxic or fire hazard.
---------------------------------------------------------------------------
For example, recent research and development sponsored by the FAA
demonstrates that the threshold kinetic energy capable of causing a
casualty from a collision with a rigid object is substantially lower
than for a collision with an object made of certain composite
materials.\117\ The FAA will provide an AC with valid debris impact
thresholds, such as those proposed in Sec. 450.121(c)(1)(i) and (ii).
Thus, in the final rule, Sec. 450.121(a) uses the definition of
``hazardous debris'' in a way that will enable those debris impact
thresholds to be updated as appropriate based on future research and
development. In addition, the definition of ``hazardous debris'' is
used in Sec. 450.121(a) in a way that replaces the relatively verbose
requirement in proposed Sec. 450.121(c) that ``a debris analysis must
account for all inert, explosive, and other hazardous vehicle, vehicle
component, and payload debris foreseeable from normal and
malfunctioning vehicle flight.''
---------------------------------------------------------------------------
\117\ ``The crash test results and subsequent analysis strongly
suggest that RCC-based thresholds are overly conservative because
they do not accurately represent the collision dynamics of
elastically-deformable sUAS with larger contact areas in comparison
to the metallic debris analysis methods for high speed missiles on
the national test ranges.'' Final Report for the FAA UAS Center of
Excellence Task A4; UAS Ground Collision Severity Evaluation
Revision 2, Arterburn et al, 2017. https://www.assureuas.org/projects/deliverables/a4/ASSURE_A4_Final_Report_UAS_Ground_Collision_Severity_Evaluation.pdf.
---------------------------------------------------------------------------
In summary, the final rule uses the performance-based definition of
``hazardous debris'' that currently equates to the same debris
thresholds as proposed in the NPRM because ``hazardous debris'' means
any object or substance capable of causing a casualty, including people
in aircraft or waterborne vessels or loss of functionality to a
critical asset. Thus, by relying on the definition of ``hazardous
debris,'' the final rule retains the standard in proposed Sec.
450.121(c) of debris capable of causing a casualty or loss of
functionality to a critical asset and allows operators to propose
impact vulnerability models appropriate for the materials used in their
vehicle.
In the final rule, the FAA replaces the term ``flight time'' in
Sec. 450.121(a) with the more flexible term ``flight sequence''
because it is a better independent variable. For example, during a
reentry operation, the transitions between phases of flight, which
generally produce substantially different hazardous debris, such as
prior to and after peak aero-thermal heating, can occur at widely
variable flight times. Also, imparted velocities due to break-up
typically correlate with propellant load better than flight time does.
Therefore, the final rule uses ``flight sequence'' as a less
prescriptive and more accurate independent variable. The FAA notes that
the term ``sequence'' is used in the common meaning of the word, which
is a series of related things or events, or the order in which things
or events follow each other. The phrase ``as a function of vehicle
flight sequence'' would naturally include ``accounting for the effects
of fuel burn and any configuration changes,'' so the final rule deletes
those elements of the proposed requirement as redundant.
In Sec. 450.121(b) of the NPRM, the FAA proposed to require that
the debris analysis account for each foreseeable cause of vehicle
breakup, including any breakup caused by FSS activation, and for impact
of an intact vehicle. Consistent with Sec. 450.133(a)(4), this
proposal included debris from a vehicle's jettisoned components and
payloads because such debris could cause a casualty due to impact with
an aircraft or waterborne vessel or could pose a toxic or fire
hazard.\118\
---------------------------------------------------------------------------
\118\ The preamble to the NPRM stated that ``this proposal would
include debris from a vehicle's jettisoned components and payloads
because such debris could cause a casualty due to impact with an
aircraft or waterborne vessel or could pose a toxic or fire
hazard,'' but the proposed regulatory text did not include that
specific language.
---------------------------------------------------------------------------
Section 450.121(b) retains the requirement that a debris analysis
account for each reasonably foreseeable cause of vehicle breakup and
intact impact. As explained in the NPRM, this would include ``engine or
motor explosion, or exceeding structural limits due to aerodynamic
loads, inertial loads, or aerothermal heating.'' \119\
---------------------------------------------------------------------------
\119\ 84 FR 15383.
---------------------------------------------------------------------------
In addition, the final rule requires an operator to account for
vehicle structural characteristics and materials and energetic effects
during break-up or at impact. Although these items would be necessary
considerations in any debris analysis, the FAA has added them expressly
in Sec. 450.121(b). The requirement to account for energetic effects
in Sec. 450.121(b)(3) is consistent with the requirement in proposed
Sec. 450.135(d)(3)(iii) which addresses ``indirect or secondary
effects such as bounce, splatter, skip, slide, or ricochet.'' \120\
Moreover, accounting for the fundamental physical phenomena identified
in Sec. 450.121(b)(2) of the final rule would logically be necessary
to comply with the requirement in
[[Page 79640]]
proposed Sec. 450.135(d) to ``model the casualty area, and compute the
predicted consequences of each reasonably foreseeable vehicle response
mode.'' As explained in the NPRM, ``the casualty area and consequence
analysis would be required to account for all relevant debris fragment
characteristics.'' The characteristics of all relevant debris
fragments, such as the size and kinetic energy at impact, depend on the
three fundamental physical phenomena identified in the final rule.
---------------------------------------------------------------------------
\120\ This language in proposed Sec. 450.135(d)(3)(iii) is
removed in the final rule, as discussed in the preamble associated
with that section.
---------------------------------------------------------------------------
As noted earlier, the NPRM proposed to require in Sec. 450.121(c)
that a debris analysis account for all inert, explosive, and other
hazardous vehicle, vehicle component, and payload debris foreseeable
from normal and malfunctioning vehicle flight. The NPRM also specified
a set of items for which a debris analysis would be required to
account, at a minimum. These items included highly specific and
prescriptive debris thresholds requirements. With the addition of the
hazardous debris definition, Sec. 450.121 no longer requires a
specific subsection establishing debris thresholds.
In the final rule, new Sec. 450.121(c) contains requirements
associated with the propagation of debris that are relocated from the
proposed debris risk analysis requirements in Sec. 450.135(b).
Specifically, a debris analysis must compute statistically valid debris
impact probability distributions. The propagation of debris from each
predicted breakup location to impact must account for all foreseeable
forces that can influence any debris impact location, and all
foreseeable sources of impact dispersion, including, at a minimum: The
uncertainties in atmospheric conditions; debris aerodynamic parameters,
including uncertainties; pre-breakup position and velocity, including
uncertainties; and breakup-imparted velocities, including
uncertainties. The FAA notes that a quantitative description of the
physical, aerodynamic, and harmful characteristics of hazardous debris
is a prerequisite to compute statistically valid debris impact
probability distributions and to quantify the risks to the public.
The propagation of debris is a physics-based analysis that predicts
where debris impacts will occur given a debris event while the vehicle
is in flight, such as jettison of a vehicle stage or an explosion. The
FAA moves the requirements in proposed Sec. 450.135(b) to Sec.
450.121(c) because the computation of statistically-valid debris impact
distributions naturally depends on the nature of the debris and the
trajectory analysis products from Sec. Sec. 450.117 and 450.119.
Similarly, the final rule requirements in Sec. 450.121(c) are nearly
identical to those in proposed Sec. 450.135(b), except that the final
rule removes the term ``including uncertainties'' from the regulation.
The FAA finds inclusion of this term to be superfluous, as accounting
for foreseeable sources of impact dispersion naturally includes the
uncertainties in the debris aerodynamic parameters, pre-breakup state
vectors, and breakup-imparted velocities. The FAA notes that the debris
analysis must compute statistically valid debris impact probability
distributions of all hazardous debris to be consistent with the scope
identified in Sec. 450.121(a).
Virgin Galactic recommended that the FAA allow operators to provide
their own assessments of casualty causing debris. The FAA agrees that
the specific impact vulnerability thresholds specified in the NPRM were
overly prescriptive and potentially overly conservative for some non-
rigid debris impacts. Thus, the final rule removes these proposed
requirements in Sec. 450.121(c) entirely.
In the NPRM, Sec. 450.121(d) provided the debris analysis
application requirements. In the final rule, the FAA relocates and
revises proposed Sec. 450.121(d)(1), which was a requirement to submit
a description of the debris analysis methodology, to Sec.
450.121(d)(2). The FAA re-designates and revises proposed Sec.
450.121(d)(2) as Sec. 450.121(d)(1) in the final rule. In the NPRM,
proposed Sec. 450.121(d)(2) required an operator submit a description
of all vehicle breakup modes and the development of debris lists. In
the final rule, the re-designated Sec. 450.121(d)(1) makes use of the
formal definition of ``hazardous debris,'' requiring a description of
all scenarios that can lead to hazardous debris.
In the final rule, Sec. 450.121(d)(2) and (d)(3) require an
operator to submit a description of the methods used to perform the
vehicle impact and breakup analysis in accordance with Sec.
450.115(c), which is consistent with similar changes in other FSA
sections. The final rule also moves the requirements relevant to the
debris propagation analysis from proposed Sec. 450.135(e)(2) and
(e)(5) to Sec. 450.121(d)(3) and (d)(4).
The FAA re-designates and revises proposed Sec. 450.121(d)(3) as
Sec. 450.121(d)(5). In the NPRM, proposed Sec. 450.121(d)(3) required
an applicant to submit all debris fragment lists necessary to describe
the physical, aerodynamic, and harmful characteristics of each debris
fragment or fragment class quantitatively. Section 450.121(d)(5) of the
final rule requires a quantitative description of the physical,
aerodynamic, and harmful characteristics of hazardous debris. The FAA
finds that ``quantitative description'' will allow alternative
approaches for the applicant to demonstrate compliance with this
section.
Virgin Galactic stated the proposal would introduce additional
workload to the company. Virgin Galactic raised concern that proposed
Sec. 450.121 introduced requirements for waterborne vessels that were
not referenced in other parts of the rule. The NPRM proposed, and the
final rule requires in Sec. 450.133(b), that a flight hazard area
analysis must determine waterborne vessel hazard areas. Also, the NPRM
preamble explained that the requirement includes people on ships in the
collective risk computation (see proposed Sec. 450.101(a)(1) and
(b)(1)), and thus explicitly allows the application of risk management
principles to protect people on waterborne vessels. The FAA finds that
the scope of the FSA requirements in the final rule are consistent with
current practice and will not introduce additional workload.
Virgin Galactic stated that the FAA should quantify the debris that
could cause a casualty on a waterborne vessel. The FAA notes that it
provided guidance on debris thresholds for waterborne vessels in Table
10 of the draft AC on High-Fidelity FSA published with the NPRM.
r. Population Exposure Analysis (Sec. 450.123)
In the NPRM, the exposure model requirements were addressed in the
debris risk analysis section in proposed Sec. 450.135(c) and (d)
because a complete risk analysis must account for the distribution of
people and how those people may be sheltered. The FAA received numerous
comments stating the proposed requirements were too prescriptive. The
FAA agrees and has revised the requirements to be more performance-
based.
In the final rule, the FAA revises the exposure model requirements
and moves them from proposed Sec. 450.135(c) and (d) to Sec. 450.123
(Population Exposure Analysis). The FAA moves the population exposure
analysis requirements out of the proposed debris risk analysis section
because this analysis informs other sections of the FSA. A population
exposure analysis must also be used to provide input to other public
risk analyses to address toxic hazards and far-field overpressure blast
effects, if any. This change does
[[Page 79641]]
not an expand the scope of the final rule beyond what was proposed in
the NPRM because the NPRM identified the need for population exposure
input to address toxic hazards for flight and far-field overpressure
blast effects.\121\ The rationale for the final rule requirements
remains the same as proposed in the NPRM: An exposure model provides
critical input data on the geographical location of people and critical
assets at various times when the launch or reentry operation could
occur. While the rationale remains the same, the FAA makes two changes
in Sec. 450.123. Consistent with the change discussed in the critical
assets section of the preamble, the FAA removes the requirement for an
operator to characterize the distribution and vulnerability of critical
assets. The FAA also revises the population exposure analysis to
require that input data must account for the vulnerability of people to
hazardous debris effects. The FAA will issue a Population Exposure
Assessment AC to describe a possible means of compliance.
---------------------------------------------------------------------------
\121\ Specifically, in Sec. 450.139(f) the FAA proposed to
require an applicant submit (ii) the population density in receptor
locations that are identified by toxic dispersion modeling as toxic
hazard areas; and (iv) the identity of the population database used.
Also, in Sec. 450.137(c)(1) the FAA proposed to require an
applicant submit a description of the population centers, terrain,
building types, and window characteristics used as input to the far-
field overpressure analysis.
---------------------------------------------------------------------------
Section 450.123(a) requires that an FSA must account for the
distribution of people for the entire region where there is a
significant probability of impact of hazardous debris. This final rule
is consistent with the requirement in proposed Sec. 450.135(c)(1) that
the population exposure data would be required to include the entire
region where there is a significant probability of impact of hazardous
debris. The definition of ``hazardous debris'' in Sec. 401.7 informs
the scope of this requirement. In Sec. 450.123(a), the standard of
``significant'' means that the scope of the population exposure
analysis is bounded by what is necessary to demonstrate compliance with
the risk criteria in Sec. 450.101(a) and (b), consistent with the
scope requirements set in Sec. Sec. 450.113 and 450.115.
Section 450.123(b) sets constraints on the population exposure
analysis consistent with proposed Sec. 450.135(c)(2) through (c)(7).
Specifically, Sec. 450.123(b) requires that the exposure analysis must
characterize the distribution of people both geographically and
temporally; account for the distribution of people among structures and
vehicle types; and use reliable, accurate, and timely source data.
Section 450.123(b)(1) relocates the requirements in proposed Sec.
450.135(c)(2), but removes the term ``vulnerability'' and the reference
to critical assets, as discussed earlier.\122\ The final rule removes
proposed Sec. 450.135(c)(4), which would have required the exposure
model to have sufficient temporal and spatial resolution that a uniform
distribution of people within each defined region can be treated as a
single average set of characteristics without degrading the accuracy of
any debris analysis output. By removing this requirement, an operator
may demonstrate compliance with Sec. 450.123(b) in the manner set
forth in proposed Sec. 450.135(c)(4), but also has flexibility to
demonstrate compliance through other means.
---------------------------------------------------------------------------
\122\ However, the proposed requirement in Sec. 450.135(c)(4)
to characterize the vulnerability of people both geographically and
temporally is effectively preserved in the final rule requirement in
Sec. 450.123(b)(4) to account for vulnerability of people to
hazardous debris effects in the population exposure analysis.
---------------------------------------------------------------------------
Section 450.123(b)(2) replaces the more prescriptive requirements
in proposed Sec. 450.135(c)(3) by removing the requirement that, in
accounting for the distribution of people among structures and vehicle
types, an exposure analysis includes ``a resolution consistent with the
characteristic size of the impact probability distributions for
relevant fragment groups.'' The language removed from the final rule
remains a valid means for an operator to demonstrate compliance with
Sec. 450.123(b)(2) in the final rule.
Section 450.123(b)(3) replaces the more prescriptive requirements
in proposed Sec. 450.135(c)(5) and (c)(6) so that an exposure analysis
must use reliable, accurate, and timely source data.
Section 450.123(b)(4) consolidates and replaces the requirements to
account for the vulnerability of people to hazardous debris effects
that were proposed in Sec. 450.135(d)(3)(i) and (ii), as well as
proposed in Sec. 450.137(b)(4). In the final rule, the FAA removes the
requirement in proposed Sec. 450.135(c)(7) altogether. Proposed Sec.
450.135(c)(7) is redundant in conjunction with the requirements in
Sec. 450.115(b), which specify the necessary fidelity of any FSA, and
the requirement in Sec. 450.101(g) that an operator must use accurate
data and scientific principles and the analysis must be statistically
valid.
The FAA moves and revises the application requirements in proposed
Sec. 450.135(e)(3) as Sec. 450.123(c)(1) in the final rule. The FAA
revises the final Sec. 450.123(c)(1), which requires an applicant to
submit a description of the FSA methodology, to reference Sec.
450.115(c). As previously noted, the population exposure analysis must
also be used to provide input to other public risk analyses to address
toxic hazards and far-field overpressure blast effects, if any. Section
450.123(c)(2) requires an applicant to submit complete population
exposure data, in tabular form, which is a more concise statement
equivalent to proposed Sec. 450.135(e)(4). In the final rule, the FAA
specifies that the complete population exposure data must be in tabular
form and deletes the requirement that the description of the exposure
input data include, for each population center, a geographic definition
and the distribution of population among shelter types as a function of
time of day, week, month, or year. The population exposure data
provided under Sec. 450.123(c)(2) may reflect some or all of the
information described in proposed Sec. 450.135(e)(4).
s. Probability of Failure Analysis (Sec. 450.131)
In the NPRM, proposed Sec. 450.131 covered probability of failure
analysis requirements for all launch and reentry vehicles. In the final
rule, the FAA adopts proposed Sec. 450.131 with minor revisions
codifying current practices and eliminating the proposed classes of
mishaps referenced in Sec. 450.131.
Section 450.131(a) proposed that for each hazard and phase of
flight, an FSA for a launch or reentry would be required to account for
vehicle failure probability. The probability of failure would be
required to be consistent for all hazards and phases of flight. For a
vehicle stage with fewer than two flights, the failure probability
estimate would be required to account for the outcome of all previous
flights of vehicles developed and launched or reentered in similar
circumstances. For a vehicle or vehicle stage with two or more flights,
vehicle failure probability estimates would be required to account for
the outcomes of all previous flights of the vehicle or vehicle stage in
a statistically valid manner. The outcomes of all previous flights of
the vehicle or vehicle stage would be required to account for data on
any partial failure and anomalies, including Class 3 and Class 4
mishaps, as defined in proposed Sec. 401.5. The FAA adopts Sec.
450.131(a) as proposed with a minor change to the language pertaining
to mishaps to reflect revisions to the definition of ``mishap'' in
Sec. 401.7. The FAA notes that the final rule replaced the term
``partial failures'' with ``mishap'' in Sec. 450.131(a)(2)
[[Page 79642]]
because the proposed language referenced both anomalies and mishaps,
and ``partial failure'' is redundant since any partial failure could
qualify as an anomaly or a mishap under Sec. 401.7, depending on the
nature of the failure.
Virgin Galactic commented that the proposed requirements to gather
and account for anomaly data in the probability of failure analysis
introduced additional workload compared to the current regulation. It
recommended the FAA adopt a performance-based standard in an SNPRM.
The FAA does not agree that this requirement results in additional
workload from current regulations. The FAA notes that the final rule
requirement in Sec. 450.101(g) is relevant here because it requires
that a method must produce results consistent with, or more
conservative than, the results available from previous mishaps, tests,
or other valid benchmarks, such as higher-fidelity methods.\123\ Hence,
an operator has the option to use a more conservative approach to avoid
any unnecessary additional workload. For example, an operator can
assume one more failure than the actual outcomes of all previous
flights of the vehicle or vehicle stage. Therefore, the FAA does not
find that the requirements in the final rule constitute additional
workload compared to current regulations.
---------------------------------------------------------------------------
\123\ Because the FSA is necessary to demonstrate compliance
with the risk criteria in Sec. 450.101, the requirements set forth
in that section regarding the validity of analysis apply to all
parts of the FSA.
---------------------------------------------------------------------------
Boeing requested clarification on what is meant by a ``consistent''
probability of failure in this section. The FAA clarifies that the
vehicle or vehicle stage probability of failure must be consistent
internally with outcomes of previous flights, as described in Sec.
450.131(a)(1) and (a)(2). Furthermore, the probability of failure input
data must be consistent for all phases of flight and hazards. In this
context, ``consistent'' does not mean identical and does not preclude
an operator from varying the probability of failure within statistical
confidence limits for the same event in different contexts, in order to
bias an analysis towards a conservative outcome.\124\ The probability
of failure input data should be reasonably conservative and consistent
across phases of flight and for various hazards given the uncertainty
in each probability of failure.
---------------------------------------------------------------------------
\124\ Section 450.115(b)(1) requires an operator to demonstrate
that any risk to the public satisfies the safety criteria of Sec.
450.101 accounting for all known sources of uncertainty.
---------------------------------------------------------------------------
A hypothetical example is a proposed launch of a two-stage launch
vehicle from both CCAFS and Vandenberg Air Force Base (VAFB). In this
case, the best-available data indicates the mean conditional
probability of a failure during first stage and second stages of flight
are both 50 percent, with plus or minus 10 percent uncertainty at a
minimal level of confidence (e.g., 60 percent lower and upper bound
confidence limits at 40 percent and 60 percent based on the binomial
distribution).
Given the fact that the public exposure to hazardous debris effects
for launches from VAFB is relatively high during stage one, and the
opposite is true for launches from CCAFS, a consistent and reasonably
conservative probability of failure analysis would use a 60-40 split in
the conditional probability of failure during stage one and stage two
flight for launches from VAFB, but a 40-60 split in the conditional
probability of failure during stage one and stage two flight for
launches from CCAFS. Furthermore, the conditional probability of a
failure applied to different hazards, such as debris and toxics, must
be consistent with each other. More details on means of compliance are
provided in the High Fidelity FSA Methods AC published with this rule,
and a future AC on probability of failure.
Leo Aerospace asked if the FAA would consider a balloon platform to
be a stage.
The FAA will discuss project-specific information, including
whether a balloon platform is part of a launch vehicle stage, during
pre-application consultation.
Boeing, Blue Origin, and Sierra Nevada commented on the lack of
availability of previous flight information for vehicles not operated
or owned by the applicant.
The FAA responded to this comment in the FAA's ``Responses to the
Public's Clarifying Questions Received by July 12, 2019,'' \125\ which
is posted in the docket. An operator should use the best-available
data, which in many cases would be limited to publicly available data.
The FAA will also provide data and guidance on failure mode and phase
of flight allocations in the High Fidelity FSA Methods AC, which will
be finalized with this rule.
---------------------------------------------------------------------------
\125\ See FAA-2019-02290-0134.
---------------------------------------------------------------------------
In the final rule, the FAA replaces all references to Class 3 and
Class 4 mishaps in Sec. 450.131 with the term ``mishap.'' As
previously noted, the FAA eliminates the proposed classes of mishaps in
the revised definition of mishap in Sec. 401.7 of the final rule.
In the NPRM, the FAA proposed that, for FSA purposes, a failure
occurs when a vehicle does not complete any phase of normal flight or
when any anomalous condition exhibits the potential for a stage or its
debris to impact the Earth or reenter the atmosphere outside the normal
trajectory envelope during the mission or any future mission of similar
vehicle capability. It further stated that Class 1 or Class 2 mishaps
would constitute failures.
Blue Origin commented that defining failure as not completing any
phase of normal flight is ``overly punitive'' as proposed in Sec.
450.131(b). Operators may define secondary mission objectives for
research and development purposes that, if not achieved, do impact
mission success but do not impact safety. Blue Origin proposed deleting
the language ``when a vehicle does not complete any phase of normal
flight or'' and anchor the definition in impacts outside the normal
envelope. Virgin Galactic recommended that the FAA should only account
for failures, partial failures, and anomalies that affect public
safety. Blue Origin also commented that including anomalies that might
impact a future mission conflicts with the causal logic that an anomaly
experienced on a given mission will be subject to corrective actions
prior to the next mission.
The FAA understands the concerns raised by the commenters but finds
it unnecessary to change the regulatory text to address these concerns.
An operator may adjust its final failure probability estimates to
account for various extenuating circumstances, as will be described in
a future Probability of Failure Analysis AC. For example, the
probability of failure may be adjusted based on extenuating
circumstances with justification (e.g., if the failure is not public
safety related or if corrective actions implemented after a failure
were demonstrated to be successful). If an operator makes any
adjustments to the final failure probability estimates to account for
various extenuating circumstances, it can update its FSA in accordance
with Sec. 450.103(d).
The FAA notes that, for FSA purposes, the vehicle failure
probability accounts for any failure of the launch or reentry system
because of the way failure is defined in Sec. 450.131(b).
Specifically, for FSA purposes, a failure occurs when a vehicle does
not complete any phase of normal flight or when any anomalous condition
exhibits the potential for a stage or its debris to impact the Earth or
reenter the atmosphere outside the normal trajectory envelope during
the mission or any future mission of similar vehicle
[[Page 79643]]
capability. Therefore, in the context of FSA, any failure of the launch
or reentry system, including pilot error, that produced vehicle failure
as defined in Sec. 450.131(b) must be taken into account.\126\
---------------------------------------------------------------------------
\126\ The SpaceShipTwo accident on October 31, 2014, is an
example of this situation.
---------------------------------------------------------------------------
Proposed Sec. 450.131(c) defined ``previous flight'' by stating
that the flight of a launch vehicle begins at a time when a launch
vehicle normally or inadvertently lifts off from a launch platform and
the flight of a reentry vehicle or deorbiting upper stage begins at a
time when a vehicle attempts to initiate a deorbit. The FAA adopts
Sec. 450.131(c)(1) as proposed with a minor change. The FAA strikes
the words ``normally or inadvertently'' as redundant, since any lift
off, whether normal or inadvertent, would count as a flight under the
proposed and final rule requirements in Sec. 450.131(c)(1).
Boeing, Lockheed Martin, Northrop Grumman, ULA, and Virgin Galactic
requested explanation on whether the proposed requirement in Sec.
450.131(c) would apply to hybrid vehicles.
In the final rule, the FAA revises the regulatory text in response
to these comments. The FAA changes ``launch platform'' to ``surface of
the Earth'' as the point at which flight begins for a probability of
failure analysis. This change reflects the fact that various types of
vehicles, such as hybrids, do not lift off from launch platforms. The
probability of failure analysis must account for the probability of
failure during all phases of flight to ensure public safety, including
captive carry, unless the exception in Sec. 450.113(b) applies to that
phase of flight. For example, an aircraft crash with a rocket attached
can present much higher risks to the public from an explosion, toxic
release, or inert impact, than the risks posed by an aircraft crash
without a rocket attached.
For the purposes of Sec. 450.131(c)(1) and (c)(2), a previous
flight may include flights conducted outside FAA licensed activity,
such as amateur, permitted, U.S. government, or foreign launches,
reentries, or flights. For the purposes of Sec. 450.131(c)(1) and
(c)(2), a previous flight may include FAA-licensed activity, such as
the Falcon 9 launch vehicle anomaly which destroyed the vehicle and its
AMOS-6 payload,\127\ if the outcome exhibited the potential for a stage
or its debris to impact the Earth or reenter the atmosphere outside the
normal trajectory envelope during the mission or any future mission of
similar vehicle capability. The FAA also changes the word ``deorbit''
to ``reentry'' to accommodate a reentry that starts on a suborbital
trajectory.
---------------------------------------------------------------------------
\127\ On September 1, 2016.
---------------------------------------------------------------------------
In the NPRM, Sec. 450.131(d) proposed to require that a vehicle
probability of failure be distributed across flight times and vehicle
response modes. The distribution would be consistent with the data
available from all previous flights of vehicles developed and launched
or reentered in similar circumstances and data from previous flights of
vehicles, stages, or components developed and launched or reentered by
the subject vehicle developer or operator. As proposed, the data could
include previous experience involving, among other things, a similar
level of experience of the vehicle operation and development team
members.
The FAA adopts Sec. 450.131(d) with revisions. Specifically, the
FAA changes ``flight time'' to ``flight phase.'' ``Flight phase'' gives
applicants more flexibility in their analysis because it is less
specific than ``flight time.'' The FAA also changes ``vehicle response
mode'' to ``failure mode,'' consistent with similar changes throughout
the final rule. Finally, the FAA replaces the phrase ``launched or
reentered'' in Sec. 450.131(d)(2) to ``launched, reentered, flown, or
tested.'' This change will enable the probability of failure allocation
across flight phases and failure modes to account for data from
previous flights of vehicles, stages, or components by the subject
vehicle developer or operator that did not qualify as launch or reentry
operations, such as drop tests or glide flights. The FAA also revises
``flight phases'' and ``failure modes'' to be plural in the final rule.
This amended language is a minor grammatical change and is consistent
with the intent of the proposed requirement.
Virgin Galactic commented that the FAA should not employ a
subjective measure of ``level of experience'' and requested this
language be stricken.
The FAA asserts that this measure is not subjective. The High
Fidelity FSA Methods draft AC contained specific quantitative
thresholds that have been used for many years as guidelines to
distinguish new versus experienced developers for the purposes of
probability of failure analyses. Because the quantitative thresholds
are in guidance, the FAA may consider other quantitative thresholds as
appropriate. Furthermore, the data available from previous flights of
ELVs developed by experienced and inexperienced operators demonstrates
a statistically significant difference between the relative frequency
of failures during the first and second phases of flight. Therefore,
because the required input data may involve a similar level of
experience of the vehicle operation and development team members, the
final rule in Sec. 450.131(d)(2)(iii) retains that consideration.
The FAA adopts the observed and conditional failure rate
requirements in Sec. 450.131(e) as proposed and the application
requirements in Sec. 450.131(f) with revisions. Section 450.131(f)(1)
to require methods used in probability of failure analysis be in
accordance with Sec. 450.115(c) because that section sets out the
requirements for FSA methodologies. In Sec. 450.131(f)(2), the FAA
changes the term ``vehicle response mode'' to ``failure mode,'' which
is consistent with similar changes throughout this final rule.
t. Flight Hazard Area Analysis (Sec. 450.133)
In Sec. 450.133, the NPRM proposed general requirements for the
flight hazard area analysis as well as requirements specific to
waterborne vessel hazard areas, land hazard areas, airspace hazard
volumes, and the license application. In the final rule, the FAA adopts
Sec. 450.133 with revisions. The revisions include changing terms
proposed in the NPRM and removing redundant requirements.
Proposed Sec. 450.133(a) stated that an FSA would be required to
include a flight hazard area analysis that identifies any region of
land, sea, or air that would be required to be surveyed, publicized,
controlled, or evacuated in order to control the risk to the public. A
flight hazard area analysis would be required to account for all
reasonably foreseeable vehicle response modes during nominal and non-
nominal flight that could result in a casualty. The NPRM specified six
items that would be required to be included in a flight hazard area
analysis, at a minimum.
The FAA adopts Sec. 450.133(a) with revisions. The FAA moves the
requirement in Sec. 450.133(a) that a flight hazard area analysis must
account for all reasonably foreseeable vehicle response modes during
nominal and non-nominal flight that could result in a casualty to Sec.
450.133(a)(1). This text is also revised, as discussed below. The
replacement of ``vehicle response modes'' with ``failure modes'' was
discussed in the preamble section on Sec. 450.101(c)(2).
In Sec. 450.133(a)(1), the FAA proposed that the flight hazard
analysis must account for the regions of land, sea, and air potentially
exposed to debris impact resulting from normal flight events and from
debris hazards resulting from any
[[Page 79644]]
potential malfunction. The FAA revises proposed Sec. 450.133(a)(1) by
adding the term ``hazardous debris'' as discussed in the preamble
section for Sec. 450.121 (Debris Analysis). As defined, hazardous
debris includes any object or substance capable of causing a casualty
or loss of functionality to a critical asset, such as an intact
vehicle, vehicle fragments, any detached vehicle component, whether
intact or in fragments, payload, and any planned jettison bodies. The
FAA also replaces ``vehicle response mode'' with ``failure modes'' for
consistency throughout the final rule.
In Sec. 401.7, the FAA modifies the definition of ``flight hazard
area'' as applied to part 450. The NPRM proposed that flight hazard
area means any region of land, sea, or air that must be surveyed,
publicized, controlled, or evacuated in order to ``protect public
health and safety and the safety of property.'' This language was
inconsistent with the language in Sec. 450.133. As such, in the final
rule, the definition has been revised in Sec. 401.7 for consistency to
state that a flight hazard area is any region of land, sea, or air that
must be surveyed, publicized, controlled, or evacuated in order to
``ensure compliance with the safety criteria in Sec. 450.101.''
Boeing, Lockheed Martin, Northrop Grumman, and ULA suggested
replacing ``all reasonably foreseeable'' with ``credible'' because
credibility is established in the system safety analysis. As discussed
previously, the FAA does not agree with the recommendation because the
term credible is prone to errors in judgment whereas the term
foreseeable is more readily discerned by analysis (e.g., fault trees).
The final rule moves the term ``reasonably foreseeable'' from proposed
Sec. 450.133(a) to Sec. 450.133(a)(1), where it more appropriately
modifies the language in Sec. 450.133(a)(1) that specifies the
analysis must account for the regions of land, sea, and air potentially
exposed to hazardous debris generated during normal flight events and
all reasonably foreseeable failure modes.
The FAA adopts Sec. 450.133(a)(2) with a minor correction. The FAA
replaces ``control risk to any hazard'' in the NPRM with ``control risk
from any hazard'' in the final rule.
In Sec. 450.133(a)(3), the FAA proposed that the analysis account
for the limits of a launch or reentry vehicle's normal flight,
including winds that were no less severe than the worst wind conditions
under which flight might be attempted and uncertainty in the wind
conditions. The FAA adopts Sec. 450.133(a)(3) with revisions. The FAA
changes ``wind conditions'' to ``atmospheric conditions'' because in
some cases, such as far-field overpressure blast and toxics analyses,
the temperature profile is an atmospheric condition that may also be
stipulated as part of the flight commit criteria (in addition to the
wind profile). This change does not create any additional burden to the
operator because the proposed and final requirements in Sec.
450.135(e)(1) and Sec. 450.165(b)(2) already require an operator to
account for and identify the conditions immediately prior to enabling
the flight of a launch vehicle or the reentry of a reentry vehicle that
are necessary to demonstrate compliance with the safety criteria in
Sec. 450.101, such as the atmospheric conditions and any
meteorological conditions. The final rule in Sec. 450.133(a)(3)
clarifies that all atmospheric conditions are considerations when the
operator establishes the worst conditions under which flight might be
attempted.
In Sec. 450.133(a)(4), the FAA proposed that the analysis account
for the debris identified for each foreseeable cause of breakup, and
any planned jettison of debris, launch or reentry vehicle components,
or payload. The FAA adopts Sec. 450.133(a)(4) with a revision. For
reasons previously discussed, the FAA replaces this section with ``all
hazardous debris,'' which uses the term defined in Sec. 401.7 of the
final rule. This revision does not change the intent of the
requirement.
In Sec. 450.133(a)(5), the FAA proposed that the analysis account
for all foreseeable sources of debris dispersion during freefall,
including wind effects, guidance and control, velocity imparted by
breakup or jettison, lift, and drag forces. The FAA adopts Sec.
450.133(a)(5) with revisions. In the final rule, the analysis must
account for sources of debris dispersion in accordance with Sec.
450.121(c). The FAA makes this revision to avoid replication of
requirements between Sec. Sec. 450.133(a)(5) and 450.121(c) and to
ensure consistency in the FSA.
AOPA commented that the FAA should provide the public an
authoritative source of flight hazard area information as well as
guidance on various flight hazard area analysis methodology. The FAA is
working on the NOTAM/Aeronautical Information Service (AIS)
Modernization effort, which will redesign the current NOTAM management
information system with a single technology gateway for entering,
processing, and retrieving all NOTAM data, making it easier for all
users of the airspace to access safety-critical information. The FAA
finds that the issue raised by AOPA is best addressed by the NOTAM/AIS
Modernization effort rather than this rulemaking. Industry can provide
input on this effort through the Aeronautical Information Systems
Coalition. Information regarding temporary flight restrictions (TFR)
can be found at: https://tfr.faa.gov/tfr2/list.html and is searchable
by the type of TFR being implemented. The FAA plans to complete the
NOTAM/AIS Modernization effort by late 2022. In addition, an acceptable
flight hazard area analysis methodology is addressed in the High
Fidelity FSA AC.
Boeing, Lockheed Martin, Northrop Grumman, and ULA also provided
suggested regulatory text that stated the airspace hazard volume was
only necessary for airspace up to 60,000 feet mean sea level. The FAA
agrees that the analysis only needs to account for reasonably expected
air traffic in a given region, but, in order to account for operations
in different regions, does not change the text to a specific altitude.
The FAA adopts Sec. 450.133(b), (c), and (d) as proposed. Section
Sec. 450.133(b)(1), (c)(1), and (d)(1) state that flight hazard areas
must be determined as necessary to contain, with 97 percent probability
of containment, all debris resulting from normal flight events capable
of causing a casualty to any person located on land, sea, or air. In
the NPRM, the FAA explained that proposed Sec. 450.133(b)(1), (c)(1),
and (d)(1) would align FAA regulations with practices at the Federal
launch or reentry sites by allowing operators to reduce or otherwise
optimize the size of the regions for warnings of potential hazardous
debris resulting from normal flight events.
Virgin Galactic stated that, given the currently available
information and tools regarding debris, the 97 percent probability of
containment requirement in proposed Sec. 450.133(b)(1), (c)(1), and
(d)(1) would result in inflated hazard area determinations. Boeing,
Lockheed Martin, Northrop Grumman, and ULA commented on proposed Sec.
450.133(b)(1) and suggested it reference current 3-sigma standards.
Boeing stated that, given the new limitation on debris, changing from
99.7 percent to 97 percent containment appeared less safe.
The final rule retains the 97 percent containment requirement
proposed in the NPRM. The FAA notes that the comments demonstrate a
difference of opinion in the industry regarding the appropriate
probability of containment requirement for flight hazard areas, with
Virgin Galactic claiming the proposal would result in inflated hazard
area determinations, as opposed to the other commenters calling for
more stringent
[[Page 79645]]
hazard area requirements to maintain public safety. The FAA finds the
97 percent containment requirement strikes an appropriate balance,
particularly when coupled with the requirement to include the
collective risk contribution from people in waterborne vessels in the
public risk criteria in Sec. 450.101. As noted in the NPRM, the FAA
adopts flight hazard area regulations for waterborne vessels consistent
with past waivers that the FAA granted to ensure they align with
current practices at the Federal launch ranges, where most commercial
launches take place currently. Recent experience from commercial and
U.S. Government launch and reentry operations demonstrates that the
requirements adopted eliminate unnecessary launch delays while ensuring
that the overall level of safety provided to the public remains
consistent with the public risk criteria in Sec. 450.101. The FAA
notes that the application of a risk management approach to ensure the
safety of people in waterborne vessels is consistent with
recommendations made by the National Academy of Sciences.\128\ The FAA
finds that public safety is not compromised by changing 99.7 percent
containment to 97 percent containment because the overall public risk
criteria must also be met, irrespective of the size of the hazard
areas. From a policy perspective, the final rule approach to protect
people in waterborne vessels achieves the goal of common standards for
launches from any U.S. launch site, Federal or non-Federal. Both
industry and the National Space Council have urged government agencies
involved in the launch and reentry of vehicles by commercial operators
to work towards common standards.
---------------------------------------------------------------------------
\128\ In 2001, the NRC published a report on ``Streamlining
Space Launch Range Safety,'' which included a recommendation that
``safety procedures based on risk avoidance should be replaced with
procedures consistent with the risk management philosophy specified
by EWR 127-1.'' See p. 44 of IBSN 0-309-51648-X available at https://www.nap.edu/catalog/9790.html.
---------------------------------------------------------------------------
Boeing also requested clarification on how containment boxes for
nominal impacts can use the same standard as hazard areas intended to
contain debris in the much less likely event of a failure. The FAA
notes that planned hazardous debris impacts must use a probability of 1
in the analysis in accordance with Sec. 450.133(a)(6), while hazardous
debris impacts due to a failure will have a probability applied as
determined from the Sec. 450.131 probability of failure analysis.
The FAA adopts Sec. 450.133(b)(2), (c)(2), and (d)(2) as proposed.
These sections use probability of impact contours or probability of
casualty contours to meet the risk requirements in Sec. 450.101 for
sea, land, and air.
Blue Origin commented that the intent of these requirements seems
to be to establish hazard areas for normal operations and mishaps, but
the requirements do not explicitly state that the risk criteria applies
to malfunction trajectories. Blue Origin proposed that the FAA should
specify that risk contours should be conducted for malfunction
trajectories.
The FAA notes the proposed requirement in Sec. 450.133(a) that a
flight hazard area analysis must account for all reasonably foreseeable
vehicle response modes during nominal and non-nominal flight that could
result in a casualty also specified that the risk contours required in
proposed Sec. 450.133(e)(2)(iii) through (v) must account for
malfunction trajectories. However, the FAA revises the requirement to
state in Sec. 450.133(a)(1) that the flight hazard area analysis must
account for the regions of land, sea, and air potentially exposed to
hazardous debris generated during normal flight events and ``all
reasonably foreseeable failure modes,'' which includes malfunction
trajectories. In addition, the FAA revises the risk contour requirement
in Sec. 450.133(e)(2)(iii), which is explained below in the discussion
on that requirement. The FAA notes that the High-Fidelity FSA Methods
AC describes one acceptable methodology for flight hazard areas, which
accounts for malfunction trajectories.
Virgin Galactic commented that requirements for waterborne vessels
should also be in Sec. 450.101. The FAA notes that the operator must
meet individual and collective risk requirements, as stated in Sec.
450.101. People on waterborne vessels are included in the collective
and individual risk calculations. However, as explained in the NPRM,
operators have the option to use the current approach in part 417 as a
means of compliance, which requires surveillance to ensure no ship is
exposed to more than 1 x 10-\5\ probability of impact,
because that will be generally sufficient to ensure compliance with
Sec. 450.101.
In Sec. 450.133(e)(1), the FAA proposed that the applicant submit
a description of the methodology to be used in the flight hazard area
analysis including all assumptions and justifications for the
assumptions, vulnerability models, analysis methods, and input data. In
the final rule, the FAA revises this requirement by adding that the
analysis must be done in accordance with Sec. 450.115(c) to avoid
replication of requirements and ensure consistency throughout subpart C
of part 450.
In Sec. 450.133(e)(1)(i), the FAA proposed that an applicant
provide input wind data and justification in the application. The FAA
did not adopt this proposal in the final rule. Rather, the FAA deletes
proposed Sec. 450.133(e)(1)(i) because this application requirement is
covered in Sec. 450.117(c). Section 450.117(c) accounts for all
atmospheric conditions that have an effect on the trajectory, including
worst case atmospheric profile conditions under which flight might be
attempted.
In Sec. 450.133(e)(2), the FAA proposed that an applicant submit
tabular data and graphs of the results of the flight hazard area
analysis, including in Sec. 450.133(e)(2)(iv) and (v) the following:
if applicable, representative 1 x 10-\5\ and 1 x
10-\6\ probability of impact contours for all debris capable
of causing a casualty to persons on a waterborne vessel regardless of
location; and representative 1 x 10-\6\ and 1 x
10-\7\ probability of impact contours for all debris capable
of causing a casualty to persons on an aircraft regardless of
location.\129\
---------------------------------------------------------------------------
\129\ The FAA received no comments on Sec. 450.133(e)(2)(i) and
(ii) and adopts Sec. 450.133(e)(2)(i) as proposed and Sec.
450.133(e)(2)(ii) a revision include a cross-reference to the hazard
area publication requirement in Sec. 450.161.
---------------------------------------------------------------------------
Blue Origin commented that, by requiring 1 x 10-\6\ and
1 x 10-\7\ risk contours for waterborne vessels and
aircraft, respectively, the FAA was extending application requirements
beyond those either currently codified in part 400 or proposed in part
450.
The FAA notes that, as stated in the NPRM preamble, these contours
are necessary for the applicant to demonstrate to the FAA sufficient
computational resolution and analysis fidelity for the results that are
critical to public safety. Thus, the FAA declines to adopt the
recommended change. For these reasons, the FAA adopts Sec.
450.133(e)(2)(iv) and (e)(2)(v) as proposed.
In Sec. 450.133(e)(2)(iii), the FAA proposed that an applicant
would be required to submit representative individual probability of
casualty contours regardless of location.
Virgin Galactic requested clarification on the meaning of the term
``regardless of location.'' Based on the context in proposed Sec.
450.133(a), which required the flight hazard area analysis to identify
any region of land, sea, or air that must be surveyed, publicized,
controlled, or evacuated in order to control the risk to the public,
the term ``regardless of location'' referred to whether the contours
are on land, sea,
[[Page 79646]]
or air. In the final rule, the FAA changes the term ``regardless of
location'' to ``for all locations specified in paragraph (a)'' for more
specificity. The FAA further specifies that ``representative
probability of casualty contours'' must account for both neighboring
operations personnel (at the 1 x 10-\5\ probability of
casualty level) and other members of the public (at the 1 x
10-\6\ probability of casualty level). Hence, the
requirement in Sec. 450.133(e)(2)(iii) of the final rule specifies
that representative individual probability of casualty contours include
tabular data and graphs showing the hypothetical location of any member
of the public that could be exposed to a probability of casualty of 1 x
10-\5\ or greater for neighboring operations personnel, and
1 x 10-\6\ or greater for other members of the public, given
all foreseeable conditions within the flight commit criteria.
The FAA adds this explicit language to the application requirement
to reflect what is necessary to demonstrate compliance with the
substantive requirements for flight hazard area analysis as proposed in
the NPRM and as set forth in the final rule. Specifically, the
substantive requirements proposed in Sec. 450.133(b)(2) and (c)(2),
which required an operator to determine the areas of water and land
where the individual probability of casualty for any person on a vessel
or on land would exceed the criterion in Sec. 450.101(a)(2) or (b)(2),
would necessarily have required a demonstration consistent with the
revised application requirements.
u. Debris Risk Analysis (Sec. 450.135)
In the NPRM, the FAA proposed to require that a debris risk
analysis be performed to determine whether the individual and
collective risk of public casualties meet the safety criteria in Sec.
450.101. The debris risk analysis would be required to compute
statistically-valid debris impact probability distributions using the
input data produced by FSAs required in proposed Sec. Sec. 450.117
through 450.133. In the final rule, the FAA adopts Sec. 450.135 with
revisions.
Proposed Sec. 450.135(a) stated that a debris risk analysis would
be required to demonstrate compliance with safety criteria in proposed
Sec. 450.101, either prior to the day of the operation, by accounting
for all foreseeable conditions within the flight commit criteria or
during the countdown using the best available input data. The FAA
adopts Sec. 450.135(a) with revisions. Specifically, the FAA adds in
Sec. 450.135(a)(2) that the ``best available input data'' used during
the countdown must include any applicable ``flight commit criteria and
flight abort rules'' if such controls are necessary to ensure
compliance with the public risks as required in proposed and final
Sec. 450.165(b).
There is no additional burden on the operator due to the updated
language in Sec. 450.135(a)(2), because this requirement is consistent
with the proposed requirements in Sec. Sec. 450.135(e)(1) and
450.165(b)(2). An operator is required to account for and identify the
conditions immediately prior to enabling the flight of a launch vehicle
or the reentry of a reentry vehicle that are necessary to demonstrate
compliance with the safety criteria in Sec. 450.101, such as the
atmospheric conditions and any other commit criteria. The final rule in
Sec. 450.135(a)(2) now explicitly acknowledges that a valid debris
risk analysis must account for any applicable flight commit criteria
and flight abort rules when the operator establishes if the present
conditions produce public risks consistent with the safety criteria in
Sec. 450.101.
In Sec. 450.135(b), the FAA proposed performance-based
requirements to address the physical phenomena that influence the
propagation of debris, which the analysis would be required to account
for to compute the probability of impact of debris on people and
critical assets. In the final rule, the FAA adopts and moves these
requirements with revisions to Sec. 450.121(c), as discussed in the
section of this preamble on Debris Analysis. There were two reasons for
moving the proposed propagation of debris requirements in Sec.
450.135(b) to Sec. 450.121(c). First, the computation of valid impact
probability distributions is relevant to more than the debris risk
analyses; for example, valid impact probability distributions are
necessary for the development of flight hazard areas and the yield-
probability pairs used as input to the far-field overpressure analysis.
Second, although the relationships between the FSA sections are complex
and interdependencies exist, the FAA sought to lay out the FSA
requirements in a sequential order.
In Sec. 450.135(c), the FAA proposed the features of a valid
population exposure analysis. In the final rule, the FAA adopts and
moves these requirements with revisions to Sec. 450.123, as discussed
in the preamble associated with that section. As noted, the FAA moved
the population exposure analysis requirements out of the proposed
debris risk analysis section because a population exposure analysis
must also be used to provide input to other public risk analyses to
address toxic hazards and far-field overpressure blast effects, if any.
As discussed earlier, this is not an expansion of the scope because the
NPRM identified the need for population exposure input to address toxic
hazards for flight and far-field overpressure blast effects.
In proposed Sec. 450.135(d), the FAA set forth the features of a
valid casualty area and consequence analysis. Proposed Sec. 450.135(d)
stated that a debris risk analysis would be required to model the
casualty area and compute the predicted consequences of each reasonably
foreseeable vehicle response mode in any one-second period of flight in
terms of CEC. The NPRM also specified that the contents of a
casualty area and consequence analysis must account for, at a minimum,
the items proposed in Sec. 450.135(d)(1) through (d)(3).\130\
---------------------------------------------------------------------------
\130\ The FAA received no comments on Sec. 450.135(d)(1), which
requires the casualty and consequence analysis to account for all
relevant debris fragment characteristics and the characteristics of
a representative person exposed to any potential hazard. The FAA
adopts this requirement without change.
---------------------------------------------------------------------------
In the final rule, the FAA revises and re-designates the
requirements proposed in Sec. 450.135(d) to Sec. 450.135(b). In
addition, the FAA replaces the term ``vehicle response mode'' with
``failure mode,'' consistent with similar changes made throughout the
final rule and discussed further in Sec. 450.101(c)(2) of this
preamble. The FAA also replaces the term ``one-second period of
flight'' with ``significant period of flight,'' as discussed in the
preamble section associated with high consequence event protection.
In the NPRM, the FAA included a definition of ``casualty area'' in
Sec. 401.5, defined as the area surrounding each potential debris or
vehicle impact point where serious injuries, or worse, can occur. The
FAA adopts this definition as proposed.
SpaceX commented the FAA should modify proposed Sec. 450.135(d) to
require that the casualty area and consequence analysis not only
account for the items in proposed Sec. 450.135(d)(1) through (d)(3)
but also model them conservatively. The FAA notes that the term
``account for'' already includes using conservative data or assumptions
for all inputs and results of an analysis, pursuant to Sec.
450.101(g). Thus, this change would be redundant.
As previously discussed, the requirements for debris propagation in
Sec. 450.135(b) have been relocated in the final rule to Sec.
450.121(c). As a result, the FAA adds a requirement in Sec.
450.135(b)(2) that a casualty area and consequence analysis must
account for
[[Page 79647]]
statistically-valid debris impact probability distributions. This
requirement is derived from the requirements in proposed Sec.
450.135(b). The FAA notes that without statistically-valid impact
probability distributions it would be impossible to compute the
predicted consequences of each reasonably foreseeable failure mode in
any significant period of flight in terms of conditional expected
casualties, as required in proposed Sec. 450.135(d) and Sec.
450.135(b) of the final rule, because the consequence of any failure
depends on the characteristics of the debris (such as the casualty
area) predicted to impact exposed populations. Thus, the FAA finds the
final rule is consistent with the NPRM in requiring this information as
part of a debris risk analysis.
In the NPRM, the FAA proposed to require that the casualty area and
consequence analysis account for any direct impacts of debris
fragments, intact impact, or indirect impact effects, in proposed Sec.
450.135(d)(2). It also proposed that the analysis account for the
vulnerability of people and critical assets to debris impacts including
all hazard sources, such as the potential for any toxic or explosive
energy releases, in proposed Sec. 450.135(d)(3)(ii) and indirect or
secondary effects such as bounce, splatter, skip, slide or ricochet,
including accounting for terrain, in proposed Sec. 450.135(d)(3)(iii).
In the final rule, the FAA consolidates the three proposed
requirements into Sec. 450.135(b)(3). Section 450.135(b)(3) more
simply states that the analysis must account for ``any impact or
effects of hazardous debris,'' because the new definition of
``hazardous debris'' in Sec. 401.7 reflects the scope of the NPRM
requirements. In the final rule, the use of the defined term
``hazardous debris'' in Sec. 450.135(b)(3) replaces the requirement in
proposed Sec. 450.135(d)(3)(ii) to account for all hazard sources,
such as the potential for any toxic or explosive energy releases. It
also replaces the requirement in proposed Sec. 450.135(d)(2) to
account for any direct impacts of debris fragments, intact impact, or
indirect impact effects. Also, the final rule uses the phrase ``any
impact or effects'' of hazardous debris to replace the proposed
requirements to account for any direct or indirect effects, including
indirect or secondary effects such as bounce, splatter, skip, slide, or
ricochet, including accounting for terrain. The FAA's use of the
defined term hazardous debris, discussed previously, allows for
consistency throughout the final rule with regard to the scope of the
FSA requirements. This revision does not change the scope of the
proposed requirements because the definition includes the concept of
all hazard sources and the direct impacts of debris fragments, intact
impact, or indirect impact effects.
In the NPRM, the FAA required in proposed Sec. 450.135(d)(3) that
the analysis account for the vulnerability of people and critical
assets to debris impacts. In the final rule, the FAA moves proposed
Sec. 450.135(d)(3) as Sec. 450.135(b)(4) and strikes the reference to
critical assets, as explained in the preamble section on critical
assets. The FAA also re-designates and adopts proposed Sec.
450.135(d)(3)(i) as Sec. 450.135(b)(4)(i) in the final rule. As
discussed, the proposed requirements in Sec. 450.135(d)(3)(ii) and
(d)(3)(iii) are captured in Sec. 450.135(b)(3) in the final rule.
In the NPRM, the FAA proposed in Sec. 450.135(d)(3)(iv) that the
analysis must account for the effect of wind on debris impact vector
and toxic releases. In the final rule, the FAA re-designates proposed
Sec. 450.135(d)(3)(iv) as Sec. 450.135(b)(4)(ii). The FAA also
revises the requirement so that the analysis must account for the
effect of atmospheric conditions on debris impact and effects known to
influence the vulnerability of people to hazardous debris impacts. For
example, wind can typically have a pronounced effect on the debris
impact vector as illustrated in the FAA FSA Handbook. In addition,
other atmospheric conditions, such as the presence of a temperature
inversion can have a significant effect on the vulnerability of people
to toxic releases.\131\
---------------------------------------------------------------------------
\131\ The FAA re-designates and adopts proposed Sec.
450.135(d)(3)(v) as Sec. 450.135(b)(4)(iii) without substantive
changes in the final rule. The FAA received no specific comments on
the proposed requirement.
---------------------------------------------------------------------------
The change from the proposed Sec. 450.135(d)(3)(iv) implemented in
the final rule in Sec. 450.135(b)(4)(ii) does not create any
additional burden to the operator because this requirement is
consistent with the proposed requirements in Sec. Sec. 450.135(e)(1)
and 450.165(b)(2). An operator is required to account for and identify
the conditions immediately prior to enabling the flight of a launch
vehicle or the reentry of a reentry vehicle that are necessary to
demonstrate compliance with the safety criteria in Sec. 450.101, such
as the atmospheric conditions and any meteorological conditions.
Furthermore, given the proposed requirement in Sec. 450.135(d)(vi) to
account for the uncertainty in fragment impact parameters in assessing
the vulnerability of people to debris impacts, an operator already
would have contemplated the need to account for the effect of
atmospheric conditions on debris impact effects now explicitly required
under Sec. 450.135(b)(4)(ii).
In the NPRM, proposed Sec. 450.135(d)(3)(vi) specified that the
analysis account for uncertainty in fragment impact parameters. In the
final rule, the FAA re-designates proposed Sec. 450.135(d)(3)(vi) as
Sec. 450.135(b)(4)(iv). The FAA also requires in the final rule that
the analysis account for uncertainty in the input data, such as
fragment impact parameters. Although the uncertainty in fragment impact
parameters typically has a pronounced effect, it is conceivable that
uncertainties in the input data more generally could affect the
vulnerability of people to hazardous debris effects. The FAA finds
these changes consistent with the proposed and final requirements in
Sec. 450.115(b)(1) that an operator's FSA method must have a level of
fidelity sufficient to account for all known sources of
uncertainty.\132\
---------------------------------------------------------------------------
\132\ The FAA re-designates and adopts proposed Sec.
450.135(d)(3)(vii) as Sec. 450.135(b)(4)(v) without substantive
change in the final rule. The FAA received no specific comments on
the proposed requirement.
---------------------------------------------------------------------------
In the NPRM, proposed Sec. 450.135(e) listed the application
requirements associated with the debris risk analysis, including the
casualty area and consequence analysis. Proposed Sec. 450.135(e)(1)
required an applicant to submit a description of the methods used to
compute the parameters required to demonstrate compliance with the
safety criteria in proposed Sec. 450.101, including a description of
how the operator would account for the conditions immediately prior to
enabling the flight of a launch vehicle or the reentry of a reentry
vehicle, such as the final trajectory, atmospheric conditions, and the
exposure of people and critical assets.
In the final rule, the FAA re-designates and adopts proposed Sec.
450.135(e)(1) as Sec. 450.135(c)(1) with revisions. The FAA removes
the proposed requirement to submit a description of the methods ``used
to compute the parameters'' required to demonstrate compliance with the
safety criteria in Sec. 450.101. Instead, the FAA replaces this
requirement with a requirement to submit a description of the methods
used to demonstrate compliance with the safety criteria in Sec.
450.101, in accordance with Sec. 450.115(c). This change is consistent
with other FSA sections. Also, the FAA strikes the reference to
critical assets as explained in the preamble section associated with
critical assets.
[[Page 79648]]
In the NPRM, the application requirements in Sec. 450.135(e)(2)
addressed the methods used to compute debris impact distributions. In
the final rule, the FAA moves proposed Sec. 450.135(e)(2) to Sec.
450.121(d)(3). Proposed Sec. 450.135(e)(3) and (e)(4) addressed
population exposure data. In the final rule, those requirements are
moved to Sec. 450.123(c). These changes are described in the preamble
sections associated with those sections.\133\
---------------------------------------------------------------------------
\133\ The FAA adopts without change and re-designates proposed
Sec. 450.135(e)(5) through (e)(7) as Sec. 450.135(c)(2) through
(c)(4) in the final rule. The FAA received no specific comments on
these proposals.
---------------------------------------------------------------------------
The FAA moves the application requirements in proposed Sec.
450.135(e)(8)(i) through (iii) regarding the collective and individual
debris risk outputs to Sec. 450.135(c)(5)(i) through (iii) and removes
the proposed requirement to report critical asset results in Sec.
450.135(e)(8)(iv), as discussed further in the critical asset section
of this preamble.
The FAA revises and re-designates the application requirements in
proposed Sec. 450.135(e)(9) on the collective and individual debris
risk outputs as Sec. 450.135(c)(6). The FAA replaces the term
``vehicle response mode'' with ``failure mode.'' This revision is
consistent with changes throughout the final rule. The FAA also changes
the term ``one-second interval'' to ``significant period,'' as
explained in the preamble section on CEC.
SpaceX commented that it was not clear why proposed Sec.
450.135(e)(8) and (9) would require debris risk analysis to include
both representative conditions and the worst foreseeable conditions,
arguing that if the worst foreseeable conditions meet requirements,
then representative conditions are of no consequence. The FAA responds
that, for the purposes of Sec. 450.135(c)(5) and (c)(6), worst
foreseeable conditions means those conditions that produce the highest
individual, collective, and conditional risks under which the operator
would initiate the launch or reentry. An operator can submit the same
debris risk analysis results for representative conditions and the
worst foreseeable conditions in cases where there is no difference
between representative conditions and the worst foreseeable conditions
that are significant to public safety.
However, the FAA foresees the potential for situations where the
differences between the representative conditions and the worst
foreseeable conditions would require additional operational
mitigations. An example would be running the debris risk analysis using
input data for atmospheric conditions that lead to risks just below the
limits set in Sec. 450.101 (i.e., worst foreseeable conditions) and
running the debris risk analysis using more typical atmospheric
conditions that produce risks clearly below the limits. Under the worst
foreseeable conditions, the collective risk results for people on land
could be such that the operator would need to perform additional
surveillance of areas to ensure the absence of waterborne vessels,
whereas under representative conditions such surveillance would not be
necessary to ensure compliance with collective risk limits in Sec.
450.101(a)(1) and (b)(1). The FAA does not anticipate that there will
be significant additional burden in providing the analysis for
representative conditions.
v. Far-Field Overpressure Blast Effect Analysis, or Distant Focus
Overpressure (DFO) (Sec. 450.137)
In the NPRM, Sec. 450.137 proposed requirements for far-field
overpressure blast effects analysis. Proposed Sec. 450.137(a) required
that a far-field overpressure blast effect analysis demonstrate
compliance with safety criteria in proposed Sec. 450.101 either prior
to the day of the operation, accounting for all foreseeable conditions
within the flight commit criteria, or during the countdown using the
best available input data. In the final rule, the FAA adopts Sec.
450.137(a) with one revision.
The final rule in Sec. 450.137(a)(2) specifies that far-field
overpressure analysis performed during the countdown using the best
available input data must also include flight commit criteria and
flight abort rules. The FAA notes that the best available input data
specified in proposed Sec. 450.137(a)(2) would naturally include
flight commit criteria and flight abort rules because those would
generally have a significant influence on the public risks posed by
hazardous debris effects. Hence, the phrase ``including flight commit
criteria and flight abort rules'' is consistent with the requirement
for a debris risk analysis in Sec. 450.135(a)(2).
Virgin Galactic commented that Sec. 450.137(a)(1) appeared to
require an FSA the day before launch for the portion of its launches
involving its carrier aircraft's captive carriage of the spaceship.
Virgin Galactic expressed a concern about the operational impact and
additional workload of a day of launch analysis. Microcosm requested
clarification on whether the regulations required a day of launch
analysis if meteorological conditions did not present an environment
conducive to far-field overpressure.
Section 450.137(a)(1) does not require a full FSA the day before
launch. Instead, Sec. 450.137(a) requires the far-field overpressure
blast effect analysis be performed either as a ``screening'' analysis
prior to the day of the operation, accounting for all foreseeable
conditions within the flight commit criteria, or during the countdown
using the best available input data. The requirement in Sec.
450.137(a)(1) does not have a time constraint for when the ``screening
analysis'' must be completed. In response to Microcosm's comment, the
FAA notes that, in order to determine that local meteorological
conditions do not present an environment conducive to far-field
overpressure, an operator would necessarily be required to perform an
analysis under Sec. 450.137(a)(1). As such, Sec. 450.137(a)(1), as
proposed and adopted without change, allows an operator to demonstrate
that a far-field overpressure analysis need not be performed during the
countdown if the flight commit criteria are sufficient to ensure
compliance with Sec. 450.101.
In the NPRM, the FAA proposed requirements associated with analysis
constraints in Sec. 450.137(b) that set required performance outcomes
and the specific factors that a far-field overpressure blast effect
analysis must consider. Blue Origin commented that the proposed
requirements in Sec. 450.137(b) were prescriptive. The FAA agrees that
the proposal was unnecessarily specific in Sec. 450.137(b)(3) through
(5) and revises these requirements.
In the NPRM, Sec. 450.137(b)(3) proposed that the analysis account
for the explosive capability of the vehicle at impact and at altitude,
and potential explosions resulting from debris impacts, including the
potential for mixing of liquid propellants. In the final rule, the FAA
revises the language in proposed Sec. 450.137(b)(3) and relocates it
to Sec. 450.137(b)(1) to reflect the order in which the FAA expects
the analysis will be conducted. As rewritten, Sec. 450.137(b)(1) in
the final rule requires the analysis to account for the explosive
capability of the vehicle and hazardous debris at impact and at
altitude. As discussed previously, the FAA uses the definition for
``hazardous debris'' to reflect the scope of the NPRM requirements. The
final rule also removes the phrase ``potential for mixing of liquid
propellant'' because it is redundant with ``explosive capability,''
which is already included in the requirement. The FAA has also removed
reference to solid propellant
[[Page 79649]]
impacts because they are part of the explosive capability.
In the NPRM, proposed Sec. 450.137(b)(1) required that the
analysis account for the potential for distant focus overpressure or
overpressure enhancement given current meteorological conditions and
terrain characteristics. In the final rule, the FAA re-designates
proposed Sec. 450.137(b)(1) as Sec. 450.137(b)(2). The FAA also
requires in Sec. 450.137(b)(2) that the analysis must account for the
influence of meteorological conditions and terrain characteristics. The
FAA notes meteorological conditions are known to have a potentially
substantial influence on the propagation and attenuation of blast waves
with peak incident overpressures at or below 1.0 psi. In the final
rule, the FAA removes the reference to current meteorological
conditions in proposed Sec. 450.137(b)(1) to reflect that an applicant
may use a screening analysis pursuant to Sec. 450.137(a)(1) to
demonstrate additional analysis is not required by accounting for all
foreseeable conditions within the flight commit criteria.
In the NPRM, proposed Sec. 450.137(b)(2) required that the
analysis account for the potential for broken windows due to peak
incident overpressures below 1.0 psi and related casualties. In the
final rule, the FAA re-designates proposed Sec. 450.137(b)(2) as Sec.
450.137(b)(3) and adds the essential elements from proposed Sec.
450.137(b)(4) through (b)(6). Those sections contained unnecessary
details regarding shelter types, time of day, characteristics of
potentially affected windows including size, location, glazing
material, and characteristics of potential glass shards.
Section 450.137(b)(3) removes these details and captures the
concept of the requirements proposed in Sec. 450.137(b)(4) through
(b)(6) by adding language to reflect that the potential for broken
windows due to peak incident overpressures below 1.0 psi and related
casualties must ``be based on the characteristics of exposed windows
and the population's susceptibility to injury, with considerations
including, at a minimum, shelter types, window types, and the time of
day of the proposed operation.''
Blue Origin commented that the constraints could be accomplished by
an analysis tool available only to the government. The FAA disagrees
that the far-field overpressure analyses can only be accomplished using
a tool available to the U.S. government. Currently available materials
contain a detailed technical description of a valid approach.\134\
Furthermore, the FAA confirms that the analysis tool in use by the U.S.
government has been used by the U.S. commercial space transportation
industry at non-Federal sites as well.
---------------------------------------------------------------------------
\134\ A valid approach is described in ``Safety Design for Space
Operations,'' Allahdadi, Firooz A., Isabelle Rongier, Tommaso
Sgobba, Paul D. Wilde (Eds.), ``Safety Design for Space
Operations,'' Sponsored by The International Association for the
Advancement of Space Safety, published by Elsevier, Watham, MA,
2013. The only three topics not addressed in that reference (updated
explosive impact yield models, launch availability analyses based on
past measurements of meteorological conditions, and satisfaction of
license application requirements) are addressed in AC 450.137
``Distant Focusing Overpressure Risk Analysis Supplemental Topics,''
which is planned to be published after this final rule.
---------------------------------------------------------------------------
The FAA adopts Sec. 450.137(c) with only two minor modifications.
In the NPRM, Sec. 450.137(c)(6) explicitly identified that an
applicant would be required to submit the analysis results given
foreseeable meteorological conditions, yields, and population
exposures.
In the final rule, Sec. 450.137(c)(6) requires that the
application include the individual risk data given foreseeable
conditions. The FAA also revises Sec. 450.137(c)(7) in this manner.
The FAA notes generally that the same elements of the foreseeable
conditions listed in the NPRM influence the results of the far-field
overpressure blast effects analysis. Thus, the reworded final rule
maintains the same scope and intent of the NPRM application
requirements. The FAA adds this language because the proposal was
unnecessarily limited.
w. Toxic Hazards (Sec. Sec. 450.139 and 450.187)
In the NPRM, the FAA proposed to consolidate requirements for toxic
release analysis into two performance-based regulations: Sec. Sec.
450.139 (Toxic Hazards for Flight) and 450.187 (Toxic Hazards
Mitigation for Ground Operations). Although the two proposed sections
contained a number of similarities, the FAA divided them into two
sections because ground operations and flight operations had different
proposed criteria to establish an acceptable level of public safety.
Proposed Sec. Sec. 450.139(a) and 450.187(a) made the sections
applicable to any launch or reentry vehicle, including all vehicle
components and payloads, that use toxic propellants or other toxic
chemicals.
Virgin Galactic requested that the FAA create an exception to
Sec. Sec. 450.139 and 450.187 for carrier aircraft on hybrid systems
that already possess a standard airworthiness certificate or
experimental airworthiness certificate from FAA, as these aircraft most
commonly carry jet fuel. Virgin Galactic commented that, although jet
fuel may be considered a toxic substance, it is carried by thousands of
aircraft every day and thus performing a toxic release hazard analysis
for jet fuel would not have a material effect on public safety.
The FAA acknowledges that, historically, no toxic release hazard
analysis has been required for kerosene-based fuels, such as jet fuel,
and agrees that such an analysis would be unnecessary in most
instances. Therefore, in the final rule, the FAA revises the
applicability language in Sec. Sec. 450.139(a) and 450.187(a) to
create an exception from the toxic release hazard analysis for
kerosene-based fuels unless the Administrator determines that an
analysis is necessary to protect the public safety. The FAA anticipates
that such an analysis will be required for uses of kerosene-based fuels
that are novel or inconsistent with standard industry practices. The
FAA will work with operators during pre-application consultation to
identify any kerosene-based propellants requiring a toxic release
hazard analysis under Sec. Sec. 450.139 or 450.187.
Proposed Sec. 450.139(b) required an operator to conduct a toxic
release hazard analysis and manage the risk of casualties from exposure
to toxic release either through containing hazards in accordance with
proposed Sec. 450.139(d) or by performing a toxic risk assessment,
under proposed Sec. 450.139(e), that protects the public consistent
with the safety criteria proposed in Sec. 450.101. Furthermore,
proposed Sec. 450.139(b)(3) required an operator to establish flight
commit criteria based on the results of its toxic release hazard
analysis, containment analysis, or toxic risk assessment for any
necessary evacuation of the public from any toxic hazard area. The FAA
adopts Sec. 450.139(b) as proposed.
In the NPRM, paragraph (b) was inadvertently omitted from the
regulatory text to Sec. 450.187; however, the preamble discussed that
proposed Sec. 450.187(b) would, like proposed Sec. 450.139(b),
require an operator to manage the risk of casualties from exposure to
toxic release by either containing the hazards or performing a toxic
risk assessment. The preamble stated that for ground operations, an
operator using a toxic risk assessment must demonstrate compliance with
proposed Sec. 450.109(a)(3), rather than Sec. 450.185(c).\135\ The
FAA adds paragraph (b) to Sec. 450.187 in the final rule. As discussed
later in this section,
[[Page 79650]]
the FAA revises the toxic risk assessment criteria for ground
operations by replacing the reference to proposed Sec. 450.109(b)(3)
with a reference to Sec. 450.185(c). The FAA also revises Sec.
450.139(b)(3) to refer to ``toxic containment,'' rather than a ``toxic
containment analysis,'' as this term does not appear in the regulation.
---------------------------------------------------------------------------
\135\ 84 FR 15395.
---------------------------------------------------------------------------
Proposed Sec. Sec. 450.139(c) and 450.187(b) set forth the
requirements for toxic release hazard analysis. The FAA adopts the
substance of those provisions in the final rule, but re-designates
proposed Sec. 450.187(b) as Sec. 450.187(c), to account for the
addition of new Sec. 450.187(b).
As noted, Sec. Sec. 450.139(b) and 450.187(b) in the final rule
require an operator to manage the risk of casualties that could arise
from the exposure to toxic release through toxic containment or by
using a toxic risk assessment. Toxic containment, as proposed in
Sec. Sec. 450.139(d) and 450.187(c), required an operator to manage
the risk of casualty from the exposure to toxic release either by
evacuating, or being prepared to evacuate, the public from a toxic
hazard area, or by employing meteorological constraints. In either
scenario--evacuation or employment of meteorological constraints--the
operator would be required to demonstrate that an average member of the
public would not be exposed to greater than one percent conditional
individual probability of casualty in the event of a worst-case release
or maximum credible release scenario. The FAA received a formal comment
from NASA during the interagency review on proposed Sec. 450.139(d)
and Sec. 450.187(c). The FAA revised these provisions in the final
rule consistent with the updated definition of toxic hazard area
described below. Specifically, Sec. 450.139(d)(1) and Sec.
450.187(c)(1) require an operator using toxic containment to manage the
risk of casualty from the exposure to toxic release either by
evacuating, or being prepared to evacuate, the public from any toxic
hazard area. These revisions are consistent with current practice. The
FAA also re-designates proposed Sec. 450.187(c) as Sec. 450.187(d) to
account for the addition of new Sec. 450.187(b).
The FAA proposed to define ``toxic hazard area'' in Sec. 401.5
(Sec. 401.7 in the final rule) as ``a region on the Earth's surface
where toxic concentrations and durations may be greater than approved
toxic thresholds for acute casualty, in the event of a release during
launch or reentry.''
In the final rule, the FAA revises the proposed definition of
``toxic hazard area'' to include the language from proposed Sec. Sec.
450.139(d) and 450.187(c) regarding the ``a worst-case toxic or maximum
credible release scenario.'' Thus, in the final rule, a ``toxic hazard
area'' means ``a region on the Earth's surface where toxic
concentrations and durations may be greater than accepted toxic
thresholds for acute casualty in the event of a worst-case toxic or
maximum credible release scenario during launch or reentry.'' The FAA
revises this definition to ensure that the toxic hazard area is
consistent whether the operator performs a toxic risk assessment or
toxic containment. The revised definition of ``toxic hazard area'' is
consistent with the approach taken in current regulation in Appendix I
to part 417 under I417.5(c), which directly links the toxic
concentration thresholds to the size of the toxic hazard area. The FAA
anticipates that the toxic concentration thresholds used in an accepted
means of compliance for Sec. Sec. 450.139 and 450.187 will generally
be consistent with those in Appendix I to part 417 under I417.5(c).
The final rule's requirements for a toxic risk assessment under
Sec. 450.139(e) are unchanged from the proposal. A toxic risk
assessment must meet the safety criteria of Sec. 450.101 and account
for: Airborne concentration and duration thresholds of toxic
propellants or other chemicals; physical phenomena expected to
influence any toxic concentration and duration; the toxic hazard area
and the meteorological conditions involved; and all members of the
public that may be exposed to the toxic release.
In the final rule, Sec. 450.187(e), which contains the
requirements for a toxic risk assessment for ground operations,
includes one revision from the proposal. As mentioned, proposed Sec.
450.187(d) required an operator using toxic risk assessment to manage
the risk from any toxic release hazard and demonstrate compliance with
the criteria in Sec. 450.109(a)(3). The FAA replaces the reference to
proposed Sec. 450.109(a)(3) with a reference to Sec. 450.185(c)
because the flight hazard analysis risk criteria were removed from
Sec. 450.109. The standard in Sec. 450.185(c) is the same as in
proposed Sec. 450.109(a)(3); therefore, there is no substantive change
in the criteria. As a result, an operator complies with the
requirements for a toxic risk assessment by demonstrating no more than
an extremely remote likelihood of toxic exposure causing death or
serious injury to the public, using toxic concentration and duration
thresholds accepted by the Administrator as a means of compliance.
In the final rule, the FAA amends the application requirements
proposed in Sec. Sec. 450.139(f) and 450.187(e). Although proposed
Sec. Sec. 450.139(d) and 450.187(c) detailed the two ways in which an
operator could perform toxic containment, the NPRM did not specify how
an operator would demonstrate compliance with the toxic containment
requirements in their application. In the final rule, the FAA adds an
application requirement for toxic containment, in Sec. Sec.
450.139(f)(8)(i) and 450.187(f)(8), which reflects the substantive
requirements for performing toxic containment. That is, if toxic
containment is selected, the applicant must identify the evacuation
plans or meteorological constraints and associated launch commit
criteria or ground hazard controls that it will employ to ensure that
the public will not be within a toxic area in the event of a worst-case
or maximum credible release scenario. The FAA notes that an applicant
will need to submit the information required by this subsection in
order to demonstrate compliance with the substantive requirements for
toxic containment in Sec. Sec. 450.139(d) and 450.187(c).
The FAA revises the application requirements, in Sec. Sec.
450.139(f)(8)(ii) and 450.187(f)(9), to reflect the substantive
requirements of toxic risk assessment. If a toxic risk assessment is
performed, then the applicant must account for the public that may be
exposed to airborne concentrations above the toxic concentration and
duration thresholds, describe any risk mitigations applied in the toxic
risk assessment, describe the population exposure input data used in
accordance with Sec. 450.123 (Population Exposure Analysis), and
demonstrate compliance with the applicable public risk criteria (for
flight, the risk criteria in Sec. 450.101; for ground operations, the
risk criteria in Sec. 450.185(c)). Lastly, the FAA replaced the term
``population density'' with ``population characteristics'' in Sec.
450.139(f)(8)(ii)(2) and Sec. 450.187(f)(9)(ii) because
characteristics other than density (e.g., vulnerability of population)
would be relevant to assessing potential effects of toxic release, as
indicated by the Population Exposure Analysis criteria in Sec.
450.123.
Blue Origin commented that toxic risk analysis tools were not
currently available to operators, and that, unless the FAA facilitated
access to these tools, a sole-source provider of this service may
arise. One individual commenter asked what dispersion models were
acceptable to the FAA and commented that the FAA should provide
specific examples of allowable and acceptable toxic release and
dispersion mitigations.
[[Page 79651]]
The FAA disagrees that the tools needed to analyze risks associated
with a potential release of toxic substances during launch or reentry
are not currently available to operators. However, the FAA will issue
an AC entitled, ``Toxic Hazards for Flight,'' that will provide
guidance and examples of publicly available tools for conducting the
required toxic release hazard analyses, as well as a toxic risk
assessment and toxic containment. This guidance will include
information on:
Determining the airborne toxic concentration threshold or
level of concern (LOC) for each toxic propellant or toxic combustion
by-product;
Determining the worst-case quantity of any toxic release
that might occur during the proposed flight of a launch vehicle, or
that might occur in the event of a flight mishap;
Determining the worst-case quantity of any toxic release
that might occur during normal launch processing, and that might occur
in the event of a mishap during launch processing;
Characterizing the terrain, as a precursor for modeling
the atmospheric transport of a toxic release from its source to
downwind receptor locations;
Determining the meteorological conditions for the
atmospheric transport of any toxic release from its source to downwind
receptor locations;
Performing air quality dispersion modeling to predict
concentrations at selected downwind receptor locations (by
characterizing the atmospheric processes that disperse a toxic
substance emitted by a source); and
Determining the population density in receptor locations
that could potentially be identified by air quality dispersion modeling
as toxic hazard areas.\136\
---------------------------------------------------------------------------
\136\ SpaceX made a comment referencing an agreements subsection
of Sec. 450.139(b), but no such subsection existed in the NPRM.
---------------------------------------------------------------------------
x. Computing Systems (Sec. 450.141)
In the NPRM, the FAA proposed in Sec. 450.111 (Computing Systems
and Software) to require operators to develop a process that identifies
and assesses hazards to public safety and the safety of property
arising from computing systems and software. Operators would have
needed to identify all safety-critical functions associated with its
computing systems and software and to classify software based on degree
of autonomy. In the NPRM, software safety requirements would have
increased in rigor with the rise in the degree of autonomy of the
software. Conversely, software safety requirements would have decreased
in rigor with reductions in the software's degree of autonomy.
In the final rule, the FAA revises proposed Sec. 450.111 and re-
designates it as Sec. 450.141 (Computing Systems). Although the scope
of the requirements for operators under Sec. 450.141 does not differ
substantially from the proposed version, the FAA replaces prescriptive
requirements with performance-based standards and provides increased
flexibility for operators to demonstrate compliance with Sec. 450.141.
The final rule levies requirements for computing system safety items in
proportion to their criticality rather than their autonomy; requires
independent verification and validation for safety-critical computing
system safety items; and retains the NPRM's focus on development and
testing processes instead of direct inspection of software by the FAA.
The FAA removed the term, ``software,'' from the section heading since
``computing systems'' would include software. The FAA also removes the
definition of ``control entity'' proposed in Sec. 401.5 because the
term is no longer used in the final rule.
A number of commenters stated the requirements proposed in Sec.
450.111 were overly prescriptive or difficult to meet. SpaceX stated
that the proposed software process would be more burdensome and costly
for applicants than it had been under current regulations and would
prevent applicants from utilizing safer methods to construct a safety
case. Blue Origin and SpaceX argued the proposed requirement would
hinder technological advances that could improve safety. Blue Origin
stated the proposal threatened innovation towards lower cost, higher
quality, and safer software approaches, but did not specify the
approaches that would be impeded by the NPRM. Rocket Lab similarly
asserted that the proposal would hinder the development of software for
FSS, the automation of which is currently a major area for innovation.
Rocket Lab commented that the proposal did not allow flexibility to use
other means of functional system safety from equivalent industries or
government standards, and that the requirements would become quickly
outdated as software technologies and best practices evolve. CSF also
viewed the proposal as highly prescriptive and uneconomical for the FAA
or for industry.
CSF and SpaceX specifically rejected the degree of autonomy
approach proposed in Sec. 450.111, noting that human involvement did
not always produce a safer system. CSF suggested the FAA scale the
levels of rigor based on hazard effects and architectural mitigations.
Virgin Galactic stated that software need not be categorized by levels
of consequence and degrees of control if the software development
process was linked to a system safety program.
The FAA agrees that some of the requirements proposed in Sec.
450.111 were too prescriptive, potentially overly burdensome, and could
have the effect of discouraging technological innovation to improve
safety.\137\ The FAA also agrees with the commenters' discussion of the
limitations of autonomy as a criterion for level of rigor. In the final
rule, the FAA revises the requirements for computing systems, which are
now located in Sec. 450.141 to address the commenters' concerns.
Section 450.141 scales level of rigor for computing system requirements
based on system-level criticality rather than on degree of autonomy,
and is designed to parallel the requirements of computing system safety
responses to the existing regulations. The existing regulations require
plans for software development and validation and verification plans
but remain silent on the acceptable content of those plans. The final
rule requirements are designed to align with current software safety
submissions. The FAA also removes prescriptive requirements from Sec.
450.141, as detailed in the following paragraphs, to increase
flexibility in application to current and future computing system
designs.
---------------------------------------------------------------------------
\137\ As an example, the FAA acknowledges the commenter's
concerns in particular with regard to the requirements to document a
process for identifying hazards arising from software; to meet
software testing standards and hazard analyses based on levels of
autonomy; and to detail the functionality of all software having no
safety impact.
---------------------------------------------------------------------------
Section 450.141 requires the identification and assessment of the
public safety-related computing system requirements, functions, and
data items, in order to streamline the evaluation of computing system
safety. The final rule retains the requirement proposed in Sec.
450.111 to identify and assess the public safety implications of
computing systems, which derives from the current requirements in
Sec. Sec. 417.123(a) and 431.35(c) to perform this assessment as part
of a system safety process. The explicit identification of the public
safety related aspects of computing systems enables a reduction in the
scope of FAA's evaluation compared to the current regulations.
In the final rule, Sec. 450.141(a) requires an operator to
identify computing system safety items, meaning any software or data
that implements a capability that could present a hazard to
[[Page 79652]]
the public, and the criticality of each computing system safety item,
commensurate with its degree of control over hazards to the public and
the severity of those hazards. For purposes of this section, a
computing system safety item is any item that is a computing system or
software that has some degree of control over hazards to the public; a
computing system that is either a cause of or a mitigation for a hazard
that can affect the public. Computing system safety items include not
only software, but also software elements, including data, and
interfaces that present or control risks to the public (e.g., software/
hardware interfaces, and software/human interfaces). The FAA uses the
term ``computing system safety item'' in order to provide a clean
interface between software safety, which controls risks due to flaws in
logic, and system safety, which controls risk. Software runs on
hardware in response to commands and inputs, so a computing system
safety item is often more than just software. ``Level of criticality''
here means the combination of a computing system safety item's
importance in the causal chain for a given hazard, which is
commensurate to its degree of control, and the severity of that hazard.
Computing system safety items that are more influential on a causal
chain for a hazard of a given severity would be subject to a
proportionally higher level of rigor in development and testing. The
degree of control may be evident in (1) a system's tolerance to a given
computing system fault, (2) the computing system's autonomy in causing
or preventing a hazard, (3) the number and characteristics of other
system faults or failures required for the hazard to manifest itself,
or (4) some other measure devised by the applicant.
The requirement proposed in Sec. 450.111(c) to allocate
development process rigor according to degree of autonomy has been
replaced with the requirement in Sec. 450.141(a)(2) to use system-
level criticality to set the minimum level of rigor in developing and
testing each computing system safety item. The FAA agrees with the
comments received on the shortcomings of allocation by degree of
autonomy and the recommendation to use a system safety approach to
computing system safety. System safety allocates level of rigor
according to the criticality of each item in the system, and the
revised regulation aligns software and computing system level of rigor
allocation with system safety's level of rigor allocation, erasing a
difference between the two safety analyses.\138\ For some systems,
system-level criticality and degree of autonomy will produce the same
or similar allocations of rigor in computing system development. An
applicant can propose to use degree of autonomy as a proxy for system-
level criticality based on that similarity, as it is an industry
standard method of determining level of rigor allocation. This revision
achieves the objective stated in the NPRM of tailoring safety
requirements based on criticality but eliminates the prescriptive
criticality levels proposed in the NPRM. The criticality of each
computing system or function must be assessed at the system level so
the applicant can clearly demonstrate to the FAA how the system uses
computing systems and the influence of each computing system safety
item on public safety.
---------------------------------------------------------------------------
\138\ Since the approach in proposed Sec. 450.111 of using
degrees of autonomy was largely informed by MIL-STD-882E, this
revised approach in Sec. 450.141 of the final rule will reduce
confusion and error caused by translating between different
allocation schemes already adopted by other industry standards. This
will also improve the rule's resilience to future changes to
standards.
---------------------------------------------------------------------------
Section 450.141(b) requires an operator to develop safety
requirements for each computing system safety item. A safety
requirement specifies the implementation of one or more public safety-
related functions, capabilities, or attributes in a computing system
safety item. The FAA notes that it uses the phrase ``safety
requirements'' in the final rule differently than it did in the NPRM.
In the NPRM, ``software safety requirements'' referred to regulatory
requirements for software. In Sec. 450.141 of the final rule, ``safety
requirements'' means computing system requirements that specify
computing system attributes or functionality that have public safety
significance. Identification of this subset of computing system
requirements related to public safety is essential to focus an
operator's safety efforts on those parts of the computing system safety
item that have public safety consequences. It will also streamline the
scope and depth of data required of applicants and the FAA's evaluation
process relative to current requirements, to the same extent as
proposed Sec. 450.111.
Section 450.141(b)(1) requires an operator to identify and evaluate
safety requirements for each computing system safety item. Safety
requirements are the subset of requirements that define features,
capabilities, or behaviors that have public safety implications. This
identification and evaluation process may identify new computing system
safety items if safety requirements are identified for items that did
not previously have known safety requirements.
Section 450.141(b)(2) requires an operator to ensure the safety
requirements are complete and correct. A computing system requirement
set is complete if it contains all of the requirements necessary to
specify all of the functions and attributes needed for the computing
system to perform its required tasks. A computing system requirement is
correct if it specifies the correct functionality or attributes for the
item to perform its intended system-level functions. This can be
accomplished as part of an applicant's normal software and computing
system requirement review process. The FAA does not require the
applicant to conduct a separate public safety-specific review, provided
the applicant's computing system requirement review process
accomplishes the intent of Sec. 450.141(b)(2).
Section 450.141(b)(3) requires an operator to implement each safety
requirement. That is, the safety requirements reviewed in accordance
with Sec. 450.141(b)(2) must be built into the system for verification
in Sec. 450.141(b)(4). Requirements are normally implemented by
operators, and no special implementation process is required for safety
requirements.
Section 450.141(b)(4) requires that the applicant verify and
validate the implementation of each safety requirement using a method
appropriate for the level of criticality of the computing system safety
item. Computing system requirements are normally verified and validated
by a combination of testing, analysis, and inspection. The NPRM
proposed to require specific testing and verification methods that have
not been retained in the final rule due to the removal of specific
criticality levels for software. The final rule allows sufficient
flexibility for operators to implement methods and levels of rigor
appropriate for their operations. For example, a development process
that traces from computing system requirements to verification and
validation evidence is necessary but may not be the only process for
adequate verification and validation; a process that traces from
verification and validation tests to the intended computing system
functionality may be more appropriate for third-party products.
Operators may use many different processes that accomplish traceability
as long as the process demonstrates that the verification and
validation evidence is sufficient to verify and validate all of
[[Page 79653]]
the computing system safety requirements.
Section 450.141(b)(4) further specifies that, for each computing
system safety item that meets the definition of ``safety critical'' in
Sec. 401.7, verification and validation must include testing by a test
team independent of the development division or organization. As
defined in Sec. 401.7, a safety-critical item means a system,
subsystem, component, condition, event, operation, process, or item,
whose proper recognition, control, performance, or tolerance, is
essential to ensuring public safety. A safety-critical computing system
safety item is a computing system safety item of which proper
recognition, control, performance, or tolerance is essential to
ensuring public safety. As described in the NPRM, the FAA uses the term
``independent'' to designate a verification and validation group that
has substantial and credible independence from the development team.
This independent group has a separate personnel structure through at
least senior leadership, operates under distinct performance,
technical, schedule, and incentive pressures, and has the latitude to
develop and test requirements independently. This independent
verification and validation group can be a third party or an in-house
group but in either case must have the technical, managerial, schedule,
and incentive independence \139\ to carry out its functions without
undue pressure from the development team. The requirement for
independent verification and validation of safety-critical computing
system safety items is broadly aligned with current practices for
verification and validation. Specifically, the minimum expectation is
that safety-critical computing systems, such as autonomous FSS, are
subjected to a level of verification and validation rigor that can only
be achieved by verification and validation staff that are independent
of the development organization.
---------------------------------------------------------------------------
\139\ Incentive independence means that the independent
verification and validation group is rewarded based on some metric
other than schedule or throughput, so that the schedule or
throughput demands that drive error rates upward do not also drive
testing thoroughness downward.
---------------------------------------------------------------------------
The requirement in proposed Sec. 450.111(b) to identify all
safety-critical functions involving software is revised and included in
Sec. 450.141(b) of the final rule. Section 450.141(b) requires the
applicant to identify all safety requirements performed by computing
system safety items, check that the safety requirements are complete
and correct, implement the safety requirements, and verify and validate
their implementation including independent verification and validation
for safety-critical computing system safety items. These regulatory
requirements have the net effect of identifying all safety-critical
functions involving computing systems, since safety requirements
necessarily include all safety-critical functions, capabilities, and
attributes of computing systems.
Section 450.141(c) requires operators to implement and document a
development process for computing system safety items identified in
Sec. 450.141(a) appropriate for the level of criticality of the
computing system safety item. The requirement to implement and document
such a development process for all computing system safety items is
substantially similar to both existing rules and the requirements
proposed in Sec. 450.111, except in the final rule the requirement is
no longer contained in separate subsections for each level of autonomy
(proposed Sec. 450.111(d) through (g)). As explained in the NPRM
preamble, the FAA needs to understand the computing system development
processes used for each computing system safety item, relative to its
effect on public safety, in order to assess computing system safety.
The final rule calls for a development ``process,'' rather than a
``plan,'' that achieves the same objectives key to a development plan
but affords applicants greater flexibility to structure their processes
as needed to satisfy Sec. 450.141(c). Operators need not employ a
separate development process for each computing system item. However,
the development process must be appropriate to the level of criticality
of each computing system safety item to which it is applied, and must
satisfy the criteria listed in Sec. 450.141(c), at a minimum.
In order to demonstrate that a development process is appropriate
to the level of criticality of each computing system safety item, an
operator would need to identify the tasks associated with each safety
item, along with its processes for reviewing, verifying, and validating
computing system safety requirements. Section 450.141(c)(1) requires a
development process to define responsibilities for each task associated
with a computing system safety item. This requirement derives from the
requirement proposed in Sec. 450.111(d)(5) for a software development
plan; in order to be acceptable, the development process must assign
responsibilities for its execution. This requirement intends to ensure
that development tasks for computing system safety items are carried
out by defined personnel in the organization, though not necessarily
individuals by name.
Under Sec. 450.141(c)(2), a development process must include
processes for internal review and approval, including review that
evaluates the implementation of all safety requirements, such that no
person approves their own work. This is consistent with proposed Sec.
450.111(d)(4), which required independent verification and validation,
and proposed Sec. 450.111(d)(5)(i), which required coding standards.
Neither of those requirements could be met in absence of a review and
approval process that meets Sec. 450.141(c)(2) of the final rule,
since acceptable performance of those tasks inherently includes review
and approval by a person independent of those who did the work.
Software and computing system development is a complex set of actions,
and some subsets of those actions are milestones that require review
and approval. This requirement means that those reviews and approvals
must have some degree of independence such that no person approves
their own work, and requires that the minimum set of reviews and
approvals contains reviews of the implementation of safety
requirements. This association is defined by generation, such as code
written to implement a safety requirement, or by interaction, such as
code that must function in order for a safety requirement to be met.
Code reviews conducted to meet this requirement need not be single
events but may be modularized in a manner similar to the code itself as
long as comprehensive understanding is communicated between modular
reviews. Computing system development efforts that use pre-commit and
post-commit reviews to conduct a modularized code review process could
meet Sec. 450.141(c)(2). The intent is that code developed to
implement safety requirements should be checked by at least one
independent technical reviewer prior to its release.
Section 450.141(c)(3) requires the operator to ensure that
development personnel are trained, qualified, and capable of performing
their roles. This is consistent with Sec. 450.111(d)(5)(i) of the
NPRM, which required coding standards, which are an implicit part of
the training of development personnel. The final rule makes this
implicit requirement in the NPRM explicit. Personnel responsible for
public safety tasks must have training and experience that enables them
to discharge their responsibilities effectively. In its
[[Page 79654]]
application review, the FAA does not intend to verify the
qualifications of individual development personnel, but rather to
verify that the operator has a process in place to put appropriately-
trained and experienced personnel in public safety roles.
Section 450.141(c)(4) requires a development process to define
processes that trace requirements to verification and validation
evidence. This requirement is a performance criterion that was implicit
in the proposed Sec. 450.111(d)(5) software development plan; FAA is
making this criterion explicit and performance-based in the final rule
to address commenters' concerns. Traceability from computing system
requirement to verification and validation evidence significantly
streamlines computing system safety evaluations by connecting the
requirements that define a computing system's capabilities to evidence
of their implementation. Importantly, this requirement applies to all
requirements for computing system safety items, as a lack of rigor
inmanaging requirements on any computing system safety item is an
opportunity for undocumented or unintended computing system safety
requirements to be introduced into the system.
Section 450.141(c)(5) requires a development process to define
processes for configuration management that specify the content of each
released version of a computing system safety item. This requirement is
a performance-based version of proposed Sec. 450.111(d)(5)(ii), which
required configuration control. Configuration management at this level
of performance is the baseline expectation for any computing system
safety item because a known configuration with a known history is
required to provide adequately for safety. The revised requirement
contains the performance criteria that were implicit in the NPRM.
Section 450.141(c)(6) requires a development process to define
processes for testing that verify and validate all safety requirements
to the extent required by Sec. 450.141(b)(4). This means that safety
requirements must be tested in a manner consistent with their level of
criticality. The FAA removed a prescriptive requirement proposed in the
NPRM for testing on flight-like hardware \140\ to increase flexibility.
The FAA requires verification and validation that is appropriate for
the level of criticality of the computing system safety item, and
allows the operator to define the levels of criticality that are
appropriate for its operations. The operator must determine, and the
FAA will verify, which of the operator's levels of criticality affect
public safety and which of the computing systems described in the
proposed operation are in each of those public safety levels. Operators
must then define verification and validation procedures to test
computing system safety items in appropriately representative
environments.
---------------------------------------------------------------------------
\140\ For each level of criticality in proposed 450.111(d)
through (g), the FAA proposed that the software component's safety-
critical functions must be tested on flight-like hardware, which
must include nominal operation and fault responses for all safety-
critical functions.
---------------------------------------------------------------------------
Section 450.141(c)(7) requires a development process to define
reuse policies that verify and validate the safety requirements for
reused computing system safety items. This requirement was retained
from proposed Sec. 450.111(d)(5)(v), which similarly required an
operator to develop and implement software development plans, to
include descriptions of a policy on software reuse. In essence, the
applicant is required to have processes in place to understand the
safety implications of any computing system safety item developed for a
different project or purpose.
Section 450.141(c)(8) requires a development process to define
third-party product use policies that verify and validate the safety
requirements for any third-party product. This requirement was retained
from proposed Sec. 450.111(d)(5)(iv), which required an operator to
develop and implement software development plans, to include a
description of a policy on use of any commercial-off-the-shelf
software. The FAA replaces the term ``commercial-off-the-shelf
software'' in the proposal with ``third-party product'' because
commercial software is not the only kind of third-party computing
system that an applicant could use; government-off-the-shelf and free,
open source products need strategies for safe use, and the policy does
not need to vary based on the nature of the third party. The important
characteristic is that the computing system was not developed by the
applicant, so FAA now uses ``third-party'' to describe it. The final
rule sets performance criteria for this requirement with the addition
of the phrase ``that verify and validate the safety requirements in any
third-party product.'' This means that the safety requirements
implemented by third-party products must be subjected to verification
and validation just like applicant-developed computing system safety
items.
Section 450.141(d) contains the application requirements for this
section. Each of the first five requirements in paragraph (d) mirrors a
key aspect of computing system safety, allowing the applicant and FAA
to understand the rigor of development in terms of public safety. This
structure is meant to reflect the typical formats of computing system
safety data submissions received by the FAA to date. The regulation
requires an applicant to describe the computing system safety items,
identify the safety requirements implemented by each computing system
safety item, provide the development processes that generated them,
provide evidence that the development process was followed, and provide
data verifying the correct implementation of the safety requirements.
These application requirements need not be met in separate documents.
The application requirements of Sec. 450.141(d) essentially
replicate those proposed in Sec. 450.111(h), except that the revised
regulation allows greater latitude to implement development processes
that achieve the same goals by different means. An example of such an
alternative process would be a formal mathematical proof that the code
will function only as designed and that the design meets all of its
requirements. A formal proof is preferable to an iterative development
and testing process, whenever practical, because a formal proof
demonstrates that every possible action that a computing system system
can take is safe whereas iterative development can only approximate
that demonstration. A formal proof would have required waivers under
proposed Sec. 450.111 but will not under Sec. 450.141.
Several commenters recommended that hazards associated with
computing systems and software be addressed through other sections in
part 450, rather than in a dedicated section on computing systems and
software. CSF, SpaceX, Virgin Galactic, and Virgin Orbit stated that
hazards associated with computing systems and software should be
addressed through the system safety requirements for flight hazard
analyses, proposed Sec. 450.109. CSF commented that a computing system
was just one of many critical subsystems integrated into a larger
complex system, that all systems and subsystems should be analyzed and
controlled for hazards, and that the fact that a particular system may
contain software should be irrelevant to top level performance-based
safety requirements. Blue Origin and CSF recommended that the
requirements for safety-critical systems in Sec. 450.143 be used for
software
[[Page 79655]]
systems. SpaceX recommended that hazard analyses be limited to
demonstrating one fault tolerance for safety-critical functions,
including tolerance to faults in any inputs to the functions (e.g.,
data loss, data corruption) and any downstream hardware or software
effects required for public safety (e.g., effecting thrust
termination).
The FAA will retain a separate section for computing system
requirements in the final rule. As stated in the NPRM preamble, the FAA
consolidated the computing system safety requirements applicable to
launch or reentry operations under a single section in Sec. 450.141 of
the final rule to address software, firmware, and data, and the way
they operate in computing systems. The FAA based this approach on a
determination that software safety cannot be evaluated outside of the
computing system in which it operates. Software and computing systems
are decision engines that, like humans, control other vehicle systems
that can present hazards to the public and therefore merit analysis of
their control logic. Although computing systems and software must be
factored into an operator's system safety process and hazard control
strategies, the FAA has determined that computing systems warrant
separate consideration due to distinct characteristics that make them
uniquely ill-suited to most traditional system safety methods.
Software assurance is often a more appropriate mitigation strategy
than fault tolerance for software faults. The FAA anticipates that any
emergent method for system safety analysis that handles software and
computing systems well will meet Sec. 450.141 because such a method
would necessarily produce the essential elements of computing system
safety embodied in the regulation. That is, Sec. 450.141 applies
equally well to dedicated computing system safety analyses and to
system safety analyses that handle computing systems in an integrated
manner.
Furthermore, although computing systems can be ``safety critical,''
as defined in Sec. 401.7, the FAA declines to apply the requirements
set forth in Sec. 450.143 regarding safety-critical system design,
test, and documentation to computing systems because those requirements
do not adequately address the idiosyncrasies of computing systems. For
example, Sec. 450.143(b) in the final rule requires an operator to
design safety-critical systems to be fault-tolerant, fail safe, damage-
tolerant, or otherwise designed such that no fault can lead to
increased risk to the public beyond nominal safety-critical system
operation. Fault tolerance is not achievable for many software faults.
Similarly, the predicted environments are defined and evaluated very
differently for software than for other safety-critical systems under
Sec. 450.143. The predicted operating environment for computing
systems is defined in computing system requirements, but those
requirements are derived from the mathematical relationships that the
software must embody, so the requirement to provide predicted
environments for computing systems is indistinguishable from providing
the computing system requirements and design documentation for
computing systems.
Blue Origin, CSF, Sierra Nevada, Virgin Galactic, and Virgin Orbit
commented that any prescription in the regulation should be moved to an
AC as a means of compliance. Virgin Galactic commented that guidance
material should be based on industry standard development assurance
processes. CSF suggested that ACs reference industry standards and to
refer to new or existing FAA ACs, such as AC 20-115C, AC 20-152, AC 20-
153, AC 20-170, and AC 20-174, to provide a detailed means of
compliance to performance-based regulations for computing systems.
As discussed, the FAA has revised the proposed requirements to be
less prescriptive in the final rule. The FAA regulates software
assurance only to the extent that it is used as a mitigation strategy
for computing system hazards. The FAA plans to issue guidance that will
provide further clarity on the requirements in Sec. 450.141, including
the integration of existing software assurance standards, such as the
referenced ACs, with computing system safety processes. The FAA
considers these changes in the final rule to be consistent with the
comments received.
Blue Origin, CSF, Rocket Lab, SpaceX, and Virgin Galactic commented
that the requirements in proposed Sec. 450.111 did not integrate well
with most industry applications and best practices. CSF and SpaceX
commented that the methods prescribed by the proposal were incompatible
with proven industry standards such as ISO 26262 \141\ and DO-
178C.\142\
---------------------------------------------------------------------------
\141\ ISO 26262 is an adaptation of the Functional Safety
standard IEC 61508 for Automotive Electric/Electronic Systems. ISO
26262 defines functional safety for automotive equipment applicable
throughout the lifecycle of all automotive electronic and electrical
safety-related systems.
\142\ DO-178C, Software Considerations in Airborne Systems and
Equipment Certification, is the primary document by which the
certification authorities such as FAA, EASA, and Transport Canada
approve all commercial software-based aerospace systems. The FAA
approved AC 20-115C July 2013, making DO-178C a recognized
``acceptable means, but not the only means, for showing compliance
with the applicable airworthiness regulations for the software
aspects of airborne systems and equipment certification.''
---------------------------------------------------------------------------
The FAA revises the regulation in a way that aligns better with the
system safety process and replaces the prescriptive requirements
identified by commenters with performance-based metrics. The final rule
also aligns better with industry standards, including ISO 26262 and DO-
178C. Virgin Galactic noted similarities between proposed Sec. 450.111
and existing standards, and this similarity is intentional as the FAA
was attempting to codify those parts of industry standards that were
well suited to standardization. The final rule bears less similarity to
existing standards, instead specifying the goals of those standards as
requirements in Sec. 450.141. The FAA has revised the computing
systems and software safety requirements to contain the minimum set of
performance requirements necessary to address the public safety
implications of a given operation. The FAA also removed many
prescriptive requirements from the regulation. This revision allows for
more flexibility and thus consistency with industry standards.
CSF, SpaceX, and Virgin Galactic commented that the proposed rule
was not comprehensive enough and was missing items such as aeronautical
databases, integrated modular avionics, regression testing, and other
details. Blue Origin, CSF, and SpaceX stated that the proposal failed
to address object-oriented technology, model-based development, machine
learning, tool qualification, load control, formal methods, robust
protection and partitioning, integrated modular avionics, and
integration with the system process.
As discussed, the final rule has been revised to remove
prescriptiveness and increase flexibility. Therefore, because such
prescription was removed from the final rule, the FAA does not find the
changes recommended by these comments to be necessary. The FAA will
address items like aeronautical databases, integrated modular avionics,
regression testing, and other details in guidance documents. These
items will be addressed by Sec. 450.141(c), which implements safety
requirements for these and all other computing system safety items.
An individual commenter suggested that all hardware dependent on
software be vertically integrated and signal proof to protect against
issues posed by cyber
[[Page 79656]]
security or signal interference. The FAA does not believe a change to
the regulations is necessary. Issues posed by cyber security or signal
interference that could pose a threat to public safety are adequately
addressed by the hazard identification and mitigation requirements in
Sec. 450.141.
SpinLaunch recommended that the proposed set of software
requirements, compliance plans, and test data be replaced with the
requirement either to submit a software plan and sample results or to
demonstrate the capability of the software to perform as required.
The requirement that an operator either submit a software plan and
sample results or demonstrate the capability of the software would not
protect public safety adequately for three reasons. First, a software
plan is insufficient without evidence of its execution. Section 450.141
requires an operator to document a development process for all
computing system safety items and provide evidence of its execution.
Second, the minimum set of sample results that would be sufficient to
verify protection of the public is the set that meets the requirements
in Sec. 450.141(b)(4) for verification of public safety-related
functionality. Third, an adequate demonstration of software capability
necessarily will include the level of testing specified by Sec.
450.141. For these reasons, the FAA does not see a distinction between
Sec. 450.141 and either the submission of a software plan and sample
results or a demonstration of software capability.
y. Safety-Critical Systems Design, Test, and Documentation (Sec.
450.143)
In the NPRM, the FAA proposed standalone performance-based
requirements for safety-critical systems in Sec. 450.143. The proposed
requirements covered fault tolerance, qualification testing, acceptance
of hardware, and lifecycle management for all safety-critical systems
including FSS.\143\ In the NPRM, the FAA noted that applicants using an
FSS of any reliability threshold would be required to meet the proposed
Sec. 450.143 safety-critical system design, test, and documentation
requirements.\144\ In addition, under proposed Sec. 450.143(a),
operators required to use an FSS under Sec. 450.101(c) would be
required to meet the standards in Sec. 450.145.
---------------------------------------------------------------------------
\143\ As noted in the NPRM, an FSS is an integral tool to
protect public health and safety and the safety of property from
hazards presented by a vehicle in flight. An FSS allows an operator
to exercise positive control of a launch or reentry vehicle,
enabling an operator to destroy the vehicle, terminate thrust, or
otherwise achieve flight abort. A highly reliable FSS that controls
the ending of vehicle flight according to properly established rules
nearly ensures containment of hazards within acceptable limits. For
that reason, the FAA considers an FSS a safety-critical system. See
84 FR 15326.
\144\ See 84 FR 15329.
---------------------------------------------------------------------------
The FAA also proposed to revise the definition of ``safety
critical'' in Sec. 401.5. As proposed, ``safety critical'' retained
the longstanding definition of being something ``essential to safe
performance or operation,'' and the proposed definition further
explained that a safety-critical system, subsystem, component,
condition, event, operation, process, or item, is one whose proper
recognition, control, performance, or tolerance, is essential to
ensuring public safety. The FAA proposed to remove language in the
existing definition stating that something is ``safety critical'' if it
creates a safety hazard or provides protection from a safety hazard,
because that language is redundant.
In the final rule, the FAA adopts Sec. 450.143 with some revisions
discussed later in this section. The FAA also adopts the proposed
definition of ``safety critical'' without substantive change and
relocates it to Sec. 401.7. Based on the change to the definition of
``public'' in the final rule, the FAA changes the reference to ``public
safety'' in the definition of ``safety critical'' to ``public safety
and the safety of property.''
Blue Origin, CSF, and one individual commented that the term
``safety critical'' was ambiguous in light of the proposed revision to
Sec. 401.5.
A system is safety critical if its performance is essential to safe
performance or operation. If the failure of a system can create a
hazard to the public, then the system is a safety-critical system.
Section 450.143 would apply to a safety-critical system unless an
operator demonstrates through its flight hazard analysis that the
likelihood of any hazardous condition associated with the system that
may cause death or serious injury to the public is extremely remote,
pursuant to Sec. 450.109(b)(3). Due to the inherent risk to the
public, an operator must demonstrate the reliability of a safety-
critical system by meeting the requirements of Sec. 450.143.\145\
---------------------------------------------------------------------------
\145\ In addition to Sec. 450.143, requirements in the final
rule that apply to safety-critical systems are also found in
Sec. Sec. 450.45(e)(3)(ii)(C), 450.103(c)(1), 450.103(d)(4),
450.107(b)(2), and 450.107(d)(1)(ii). These requirements are
discussed within those sections.
---------------------------------------------------------------------------
The applicant's identification and proper management of safety-
critical systems is fundamental to mitigating potential hazards and
ensuring public safety, and the FAA will work with an applicant if it
believes the applicant has failed to identify all safety-critical
systems. The potential failure of safety-critical systems is integral
to the FSA, and the vulnerabilities of safety-critical systems must be
accounted for in the flight commit criteria, hazard analyses, lightning
protection criteria, management of radio frequency to prevent
interference, and communications plans.
Virgin Galactic commented that the requirements of Sec. 450.143
are costly, time-consuming, burdensome, and contrary to the Commercial
Space Launch Act requirement to only regulate to the extent necessary.
Virgin Galactic requested that an applicant not be mandated to comply
with Sec. 450.143 if it can provide proof that a safety-critical
system meets the safety criteria.
The FAA acknowledges that, under certain circumstances, an operator
could demonstrate that a safety-critical system would not need to have
the robust design and testing required of Sec. 450.143. The FAA
considered relieving an operator from the requirements in Sec. 450.143
if the safety criteria in Sec. 450.101 were met. However, the FAA
found that use of the safety criteria for this purpose is not
appropriate because whereas the requirements in Sec. 450.143 apply to
safety critical systems--which, as defined, can be a system, subsystem,
component, condition, event, operation, process, or item--the safety
criteria in Sec. 450.101 measure the effects of the failure modes of
the vehicle as a whole, as analyzed in the FSA. Therefore,
demonstrating compliance with the safety criteria in Sec. 450.101 is
not sufficient to relieve an operator from the requirements in Sec.
450.143, because that alternative would relieve the operator from
analyzing the vehicle's discrete systems, subsystems, components,
conditions, events, operations, processes, and items. The FAA finds
that analysis at this more discrete level is necessary to ensure safety
of the public.
The FAA finds that a more appropriate method to provide flexibility
and be responsive to Virgin Galactic's concern is to rely on the flight
hazard analysis in Sec. 450.109. Specifically, the FAA revises Sec.
450.143(a) to exclude safety-critical systems for which an operator
demonstrates through its flight hazard analysis that the likelihood of
any hazardous condition specifically associated with the system that
may cause death or serious injury to the public is extremely remote,
pursuant to Sec. 450.109(b)(3). As explained in the preamble section
associated with
[[Page 79657]]
Sec. 450.109, the flight hazard analysis focuses on the reasonably
foreseeable hazards to public safety resulting from the flight of a
launch or reentry vehicle. In performing the flight hazard analysis,
the operator is required in Sec. 450.109(b)(1)(ii) to identify
reasonably foreseeable hazards and corresponding failure modes relevant
to public safety resulting from system, subsystem, and component
failures or faults. Therefore, unlike the safety criteria in Sec.
450.101, the flight hazard analysis explicitly requires the operator to
examine the hazards associated with the discrete systems, subsystems,
and components of the vehicle.
Thus, to provide increased flexibility without reducing safety, the
final rule excludes certain safety-critical systems from the
requirements of Sec. 450.143 if an operator demonstrates through its
flight hazard analysis that the likelihood of any hazardous condition
specifically associated with the system that may cause death or serious
injury to the public is extremely remote, pursuant to Sec.
450.109(b)(3). That is, the operator must show that specific
requirements in Sec. 450.143, which ensure that the system will
function reliably, are not entirely necessary to mitigate the hazards
specifically associated with the system to an extremely remote level.
For example, an operator's launch vehicle may have a number of
systems whose failure could potentially cause hazardous debris to
impact the public. If an operator chooses to launch in a sparsely
populated area and limit propellant loading to minimize risk to the
public to an extremely remote level despite the failure of one or more
safety-critical systems, then those systems would not need to be
designed or tested to the level set forth in Sec. 450.143. The
operator must show that the exception in Sec. 450.143(a)(2) applies
for a particular safety-critical system through its flight hazard
analysis. If the operator cannot show that all hazards involving the
system are sufficiently mitigated to an extremely remote level despite
a failure of that system, then that system must meet the design and
testing requirements in Sec. 450.143.
However, the FAA anticipates that certain systems will not qualify
for the exception in Sec. 450.143(a)(2). Specifically, safety critical
systems that prevent hazards from reaching the public given other
system failures would likely be required to meet Sec. 450.143. This is
also true of systems that create hazards to the public that are not
otherwise mitigated by other hazard controls. The FAA anticipates that
it is unlikely that an operator would be able to demonstrate that the
hazards associated with these systems meet the ``extremely remote''
standard in Sec. 450.109(b)(3) without subjecting them to the
reliability requirements in Sec. 450.143. Furthermore, FSS required by
Sec. 450.108(b)(2) must meet Sec. 450.143 without exception.
The FAA also revises Sec. 450.143(a) and removes the proposed
requirement that all FSS required by Sec. 450.101(c) must meet
Sec. Sec. 450.143 and 450.145. Instead, Sec. 450.143(a) requires all
safety-critical systems except for the highly reliable FSS required by
Sec. 450.108(b)(1) to meet the requirements in Sec. 450.143. As
discussed in the flight abort section of this preamble, an FSS required
by Sec. 450.108(b)(2) must comply only with Sec. 450.143 rather than
meeting the additional requirements proposed in Sec. 450.145.
Likewise, an operator who chooses to use flight abort as a hazard
control strategy for reasons other than protecting against a high
consequence event under Sec. 450.101(c)(1) must also satisfy the
requirements of Sec. 450.143 for its FSS. For reasons explained later
in this section, highly reliable FSS under Sec. 450.145 do not need to
comply with the general safety-critical systems requirements of Sec.
450.143 as was proposed in the NPRM.
The FAA proposed in Sec. 450.143(b) to require that all safety-
critical systems follow reliable design principles. Specifically, an
operator would be required to design those systems to be fault-tolerant
so that no single credible fault could lead to increased risk to the
public.
Both Sierra Nevada and Virgin Galactic commented that requiring
fault tolerance would be so burdensome to the applicant that several
current operators would not be able to meet the requirement for systems
on existing vehicles. Sierra Nevada commented that using fault
tolerance as a catch-all hazard control can add risk in certain cases,
and the determination regarding whether something is fault-tolerant is
not straightforward.
Fault tolerance \146\ is the idea that a system must be designed so
that it is able to perform its function in the event of a failure of
one or more of its components. In a fault-tolerant design of a safety-
critical system, no single credible fault should be capable of
increasing the risk to public safety beyond that of a nominal
operation. Although the FAA proposed fault tolerance for the design of
safety-critical systems in the regulatory text, the FAA intended to
accept other methods of safety design, including fail-safe \147\ and
damage-tolerant \148\ systems like primary structures that generally
cannot be redundant. This broader view of safe design allows an
operator to factor planned operational restrictions, testing, and
inspection into the design to demonstrate that a system is broadly
fault-tolerant.
---------------------------------------------------------------------------
\146\ Typically, a fault-tolerant design applies redundancy or a
system of safety barriers to ensure the system can function, though
perhaps with reduced performance. An example of a fault-tolerant
design is an aircraft with multiple engines that can continue flying
even if one of the engines fails.
\147\ A fail-safe design is a system that can fail in a
controlled way, such that the failure will still ensure public
safety, like elevator brakes held open by the tension of the
elevator cable such that, if the cable snaps, the brakes engage and
stop the elevator from falling.
\148\ Damage-tolerant design allows for robust design, or design
to fail gracefully, for systems like a vehicle hull that cannot be
redundant or fail-safe. Fault-tolerant, fail-safe, and damage-
tolerant designs are all design concepts meant to prevent credible
faults or prevent increased risk to the public if failures do occur.
---------------------------------------------------------------------------
The FAA acknowledges that its articulation of a fault-tolerant
design requirement in the proposed regulation did not accurately
reflect the FAA's statements in the NPRM preamble allowing other
methods of safe design, like fail-safe systems, damage-tolerant
systems, or other designs for graceful degradation.\149\ A system that
is designed to be fail-safe or degrade gracefully, whether it functions
at a reduced level or fails completely, does so in a way that protects
people and property from injury or damage, or generally prevents a more
serious failure event. Such design is desirable, and was intended to be
captured in the FAA's design requirements for safety-critical systems.
In the final rule, the FAA amends Sec. 450.143(b) to state only that
safety-critical systems must be designed such that no credible fault
can lead to increased risk to the public beyond nominal safety-critical
system operation. The final rule gives the operator flexibility to
achieve this requirement through a design that is fault-tolerant, fail-
safe, damage-tolerant, or any other solution.
---------------------------------------------------------------------------
\149\ 84 FR 15325-15326.
---------------------------------------------------------------------------
The FAA views design for reduced risk as a necessary characteristic
of any reliable system. The FAA recognizes there may be other
acceptable design principles that protect the public adequately from or
in spite of a credible fault. In the final rule, the FAA removed the
word ``single'' from Sec. 450.143(b) to clarify that some design
concepts may allow faults, but that the faults should not lead to
increased risk to the public. The FAA also removed ``safety'' from
Sec. 450.143(b) because ensuring no increased risk to the public
necessarily addresses public safety. An applicant
[[Page 79658]]
may demonstrate that no credible fault can lead to increased risk
through analysis, identification of possible failure modes,
implementation of redundant systems or other mitigation measures, and
verification that the mitigation measures will not fail simultaneously.
Safety-critical systems requirements necessitate testing that
accounts for the operating environment the system will encounter. For
that reason, the FAA proposed to define ``operating environment'' in
Sec. 401.5 (Sec. 401.7 in the final rule) as ``an environment that a
launch or reentry vehicle component will experience during its
lifecycle.'' The proposed definition further stated that operating
environments include shock, vibration, thermal cycle, acceleration,
humidity, and thermal vacuum.
In the final rule, the FAA adopts the proposed definition with
additional language indicating that operating environments also include
other environments relevant to system or material degradation. As
stated in the NPRM, the list of examples in the definition is not
exhaustive, and the additional language in the final rule establishes a
standard for operators to consider in assessing relevant environmental
factors when qualifying an FSS or other safety-critical system design
through testing and analysis.
In addition to meeting the design requirements of Sec. 450.143(b),
the FAA proposed qualification testing \150\ requirements in Sec.
450.143(c) that required, in part, that an operator demonstrate the
design of the vehicle's safety-critical systems functionally at
conditions beyond its predicted operating environment. An operator must
select environmental test levels that ensure the design is sufficiently
stressed to demonstrate that system performance is not degraded due to
design tolerances, manufacturing variances, or uncertainties in the
environment. Qualification testing will demonstrate margin over all
operating and non-operating environments to which the flight unit can
be exposed, including margin over all component acceptance tests. Valid
qualification testing environments should--
---------------------------------------------------------------------------
\150\ Qualification testing is an assessment of a prototype or
other structural article to verify the structural integrity of a
design. Generally, functional demonstration of the design's
qualification at operating environments involves testing the design
under a number of different environmental factors to stress the
design, with a multiplying factor applied to the expected
environmental testing limit. This qualification testing is conducted
for temperatures, tensile loads, handling shocks, and other expected
environmental stressors relevant to system or material degradation.
---------------------------------------------------------------------------
Account for material variation, because all materials have
properties that have a variance from nominal values.
Account for manufacturing variation, because the
functionality of a system is not only dictated by the quality of
materials used, but also the quality of the manufacturing processes
employed.
Account for environmental variation, because environmental
predictions can have a great deal of uncertainty, particularly early in
a program.
Demonstrate margin against failure, because safety-
critical systems often fail in complex and unpredictable ways.
The FAA also proposed requirements for acceptance \151\ of hardware
in Sec. 450.143(d) that required, in part, an operator to demonstrate
any safety-critical system functionally while exposed to its predicted
operating environment with margin to demonstrate that it is free of
defects, free of integration and workmanship errors, and ready for
operational use. Acceptance testing on flight units should uncover
critical workmanship errors, and damaged, weak, or out-of-specification
components before they fail in flight. Because this testing is done on
flight units, valid acceptance testing should avoid over-testing
safety-critical components. This avoidance is accomplished by testing
significantly under qualification levels and durations, but still over
nominal operation levels and durations. The FAA adopts these
requirements as proposed, with minor editorial corrections.
---------------------------------------------------------------------------
\151\ Unlike qualification testing that is performed on
qualification units, acceptance testing or other functional
demonstration of acceptance required by Sec. 450.143(d) is
performance testing conducted on the actual hardware to be used on a
vehicle after the completion of the manufacturing process.
Generally, acceptance tests are performed on each article of the
safety-critical flight hardware to verify that it is free of
defects, free of integration and workmanship errors, and ready for
operational use. Acceptance testing includes testing for defects,
along with environmental testing similar to the qualification
testing described earlier.
---------------------------------------------------------------------------
Lastly, the FAA proposed requirements pertaining to the lifecycle
of safety-critical systems in Sec. 450.143(e), which required an
operator to monitor the flight environments experienced by safety-
critical system components to the extent necessary to validate the
predicted operating environment.\152\
---------------------------------------------------------------------------
\152\ Applicants must account for environments that any safety-
critical system is expected to encounter throughout the lifecycle of
the system in accordance with Sec. 450.143(e), including storage,
transportation, installation, and flight, which generally are built
into qualification and acceptance testing levels.
---------------------------------------------------------------------------
In the final rule, the FAA makes one minor revision to Sec.
450.143(c), (d), and (e). In each of those subsections, the FAA has
changed the term ``operating environment'' to ``operating
environments'' because all systems will experience multiple operating
environments. As stated in the NPRM preamble,\153\ applicants must
account for all operating environments that any safety-critical system
is expected to encounter throughout the lifecycle of the system in
accordance with Sec. 450.143(e), including storage, transportation,
installation, and flight, which generally are built into qualification
and acceptance testing levels. Other than this minor revision, the FAA
adopts these subsections as proposed. Note also that in the means of
compliance table released with the NPRM, the FAA identified SMC-S-016,
``Test Requirements For Launch, Upper-Stage and Space Vehicles,'' as an
acceptable means of compliance with Sec. 450.143. SMC-S-016 is an Air
Force standard that defines environmental test requirements for launch
vehicles, upper-stage vehicles, space vehicles, and their subsystems
and units. The FAA maintains that the environmental test levels in that
standard are acceptable for safety-critical systems under Sec.
450.143, except, as noted in the means of compliance table,
protoqualification testing testing found in 4.2.3 and B.1.3-4, and
protoqualification by similarity in 4.10.1.\154\
---------------------------------------------------------------------------
\153\ 84 FR 15323.
\154\ Protoqualification is used when test hardware is planned
to be used for flight, generally for designs that will have limited
production. Tests conducted to demonstrate satisfaction of design
requirements use reduced margins, supplemented with other analyses
and tests.
---------------------------------------------------------------------------
As noted earlier, FSS required pursuant to Sec. 450.108(b)(2),
when the consequence of any reasonably foreseeable failure mode in any
significant period of flight is between 1 x 10-\2\ and 1 x
10-\3\ CEC for uncontrolled areas, must satisfy
the requirements in Sec. 450.143. This approach is consistent with the
NPRM, which required all safety-critical systems including all FSS to
satisfy the general requirements in Sec. 450.143. For the reasons
explained more fully in the next section, the final rule does not adopt
the additional requirements for such an FSS that were proposed in Sec.
450.145(a)(2), which would have required the FSS to have a design
reliability of 0.975 at 95 percent confidence and commensurate design,
analysis, and testing. The FAA no
[[Page 79659]]
longer finds this reliability value necessary because, as a commenter
noted, it was unnecessarily prescriptive.\155\ Moreover, as discussed
in the NPRM, there are no established standards to demonstrate the
0.975 reliability number, other than a single string FSS that otherwise
meets the requirements of RCC 319.
---------------------------------------------------------------------------
\155\ CSF commented that by binning the CEC of a
vehicle and then prescribing a fixed reliability requirement for the
FSS, the risk of an unmitigated CEC event is not
consistent because the binning requires the same FSS even though the
risk varies by an order of magnitude. Although the FAA does not
agree with CSF's solution to move the entire concept of
CEC into an Advisory Circular, as discussed earlier, the
FAA does agree that it is unnecessary to establish a fixed
reliability number for all Sec. 450.108(b)(2) flight FSS required
for operations with CECs that could be an order of
magnitude apart.
---------------------------------------------------------------------------
Instead, the FAA requires Sec. 450.108(b)(2) FSS to meet the
requirements in Sec. 450.143. This regulatory approach should support
ongoing innovation in the development of FSS. As noted in the NPRM, the
commercial space transportation industry has continued to mature and
operators have proposed FSS alternatives. These alternative approaches
include fail-safe single string systems that trade off mission
assurance and redundancy, other fail-safe consequence mitigation
systems, and dual-purpose systems such as FSS that reuse the output of
safety-critical GPS components for primary navigation avionics. The FAA
is publishing a ``Safety-Critical Systems'' AC to provide an acceptable
means of compliance with Sec. 450.143. However, the FAA does not claim
that an FSS approved under Sec. 450.143 necessarily has a reliability
of 0.975. Although some standard in the future may be able to establish
a reliability of 0.975 at 95 percent confidence, that standard does not
exist today. FSS are discussed more fully in the next section of this
preamble.
The FAA amends the proposed application requirements in Sec.
450.143(f) for safety-critical systems to require that applicants
describe the methods used to validate the predicted operating
environments. In order to comply with Sec. 450.143(e)(2)(i),
applicants must validate the predicted operating environments for their
safety-critical systems. However, the NPRM inadvertently omitted the
corresponding application requirement from proposed Sec. 450.143(f).
This change results in no additional burden as an operator would have
to demonstrate compliance with the substantive provision by providing
this information.
The FAA also adds new Sec. 450.143(f)(7) to the application
requirements, which requires an applicant to describe the standards
used in each phase of a safety-critical system's lifecycle. This
addition is consistent with current practice and will not increase the
burden on operators, because an operator would likely provide this
information to support its finding that a safety-critical system is
designed such that no credible fault can lead to increased risk to the
public beyond nominal safety-critical system operation. In addition,
this description of standards is necessary to help identify previous
flights of a vehicle developed and launched or reentered in similar
circumstances, as required under Sec. 450.131(d)(1).
Virgin Galactic asked how the requirements of Sec. 450.143 would
apply to safety-critical systems that have been licensed previously.
Virgin Galactic generally objected to proposed Sec. 450.143, arguing
its requirements were similar to aircraft certification rules and would
be appropriate for a more mature industry. Virgin Galactic requested an
exclusion from proposed Sec. 450.143 for hybrid vehicles that have
been issued an experimental airworthiness certificate by the FAA and
operate as aircraft.
As discussed in the preamble section on Hybrid Vehicles, the FAA
does not agree that an airworthiness certificate issued by the FAA
should automatically exempt a vehicle used in a launch or reentry from
the safety-critical system requirements in Sec. 450.143. An applicant
may make an ELOS case for a component of a launch vehicle, such as a
carrier aircraft, if it holds a airworthiness certificate with an
acceptable flight test history. Section 450.143 is flexible and broad
enough that the FAA is not aware of any currently licensed vehicles or
operators in formal pre-application consultation that would not meet
the new requirements. For example, operators licensed under parts 431
or 435 use a system safety process to verify and validate the
reliability and mitigation of hazards for any safety-critical system.
The treatment of safety-critical systems under part 431 and 435
provides an ELOS to the safety-critical systems requirements in Sec.
450.143. Flight Safety Systems (Sec. Sec. 450.143 and 450.145)
z. Flight Safety Systems (Sec. Sec. 450.143 and 450.145)
As previously discussed, proposed Sec. 450.101(c) would have
required an operator to use flight abort with an FSS that meets the
requirements of Sec. 450.145 if the consequence of any reasonably
foreseeable vehicle response mode, in any one-second period of flight,
was greater than 1 x 10-\3\ CEC for uncontrolled
areas.\156\
---------------------------------------------------------------------------
\156\ As explained in the section of the preamble on high
consequence events, this proposed requirement would have applied to
all phases of flight unless otherwise agreed to by the Administrator
based on the demonstrated reliability of the launch or reentry
vehicle during that phase of flight.
---------------------------------------------------------------------------
As proposed in Sec. 450.145(a)(1), if the consequence of any
vehicle response mode was 1 x 10-\2\ CEC or
greater for uncontrolled areas, an operator would have been required to
employ an FSS with design reliability of 0.999 at 95 percent confidence
and commensurate design, analysis, and testing. The FAA noted that RCC
319 is the only government standard that would meet the requirement for
a design reliability of 0.999 at 95 percent confidence and commensurate
design, analysis, and testing.
Proposed Sec. 450.145(a)(2) required that, if the consequence of
any vehicle response mode was between 1 x 10-\2\ and 1 x
10-\3\ CEC for uncontrolled areas, an operator
would have been required to employ an FSS with a design reliability of
0.975 at 95 percent confidence and commensurate design, analysis, and
testing. In the NPRM, the FAA acknowledged that, although no standard
exists for an FSS with this design reliability, it expected individual
applicants to create their own FSS requirements based on RCC 319 and
have them approved as an accepted means of compliance by the FAA prior
to application submittal.\157\ The FAA anticipated the industry would
develop voluntary consensus standards for FSS, particularly for those
FSS that are only required to have a design reliability of 0.975 at 95
percent confidence.
---------------------------------------------------------------------------
\157\ The FAA indicated that this approach would be akin to
``tailoring'' RCC 319, which is current practice at Federal launch
ranges.
---------------------------------------------------------------------------
The FAA explained the proposed lower reliability by noting that,
for operations in which the consequence of a flight failure is lower,
the FSS, while still being reliable, may not need to be as highly
reliable as an FSS for a vehicle operating in an area where the
consequence of a flight failure is higher. As such, in order to make
regulations adaptable to innovative operations while maintaining
appropriate levels of safety, the FAA proposed to allow an FSS with
less demonstrated design reliability for operations with lower
potential consequences. In the final rule, the FAA removes the proposed
requirement for an FSS with design reliability of 0.975 at 95 percent
confidence, as will be discussed later in this preamble section.
In the final rule, the FAA has maintained the proposed requirement
[[Page 79660]]
for an operator to employ an FSS with design reliability of 0.999 at 95
percent confidence and commensurate design, analysis, and testing if
the consequence of any reasonably foreseeable failure mode in any
significant period of flight is greater than 1 x 10-\2\
CEC in uncontrolled areas.\158\ Operators currently meet
this requirement for launches conducted under legacy regulations by
tailoring RCC 319, and an operator could submit a tailored version of
RCC 319 to the FAA as a means of compliance for Sec. 450.145(b).
---------------------------------------------------------------------------
\158\ As previously explained, the FAA has replaced the term
``vehicle response mode'' with ``failure mode'' and the term ``one-
second period of flight'' with ``significant period of flight,''
throughout the final rule. The basis for these changes is discussed
in the preamble section on flight abort.
---------------------------------------------------------------------------
In the final rule, the FAA has revised the section heading for
Sec. 450.145 from ``Flight safety system'' to ``Highly reliable flight
safety system'' because it now contains only those requirements for an
FSS required by Sec. 450.108(b)(1) when the consequence of any
reasonably foreseeable failure mode in any significant period of flight
is greater than 1 x 10-\2\ CEC in uncontrolled
areas. The FAA has also reorganized the section and moved the
reliability requirements in proposed Sec. 450.145(a) to Sec.
450.145(b) with revisions.
While the design reliability required for a highly reliable FSS
remains 0.999 at 95 percent confidence and commensurate design,
analysis, and testing, the FAA has specified in Sec. 450.145(b)(1) of
the final rule that this reliability applies to the portion of the FSS
onboard the vehicle. In addition, if a portion of an operator's FSS is
ground-based, space-based, or otherwise not onboard the vehicle, the
FAA has specified in Sec. 450.145(b)(2) of the final rule that it must
have the same reliability as the onboard portion; that is, 0.999 at 95
percent confidence and commensurate design, analysis, and testing.
Although not all FSS have a ground portion, this requirement reflects
past and current practice for launches from both Federal and non-
Federal sites, in which the ground portion of an FSS and the airborne
portion of an FSS are independently designed, tested, and operated to
rigorous standards. This independence ensures that the appropriate
command is sent by the ground-based system with a high reliability, and
received and acted upon with high reliability by the onboard portion of
the system, to result in the desired termination action.
The reference in Sec. 450.145(a) to an FSS ``on the launch or
reentry vehicle'' did not reflect the FAA's intention accurately, as
stated in the NPRM, to include FSS not onboard the vehicle in the
design reliability requirements in Sec. 450.145.\159\ Conventional FSS
with onboard flight termination receivers and not-onboard command
transmitter systems will have both onboard and not-onboard subsystems.
Many current autonomous FSS only have onboard systems. As discussed
previously, the final rule requires both onboard and not-onboard FSS
systems independently to demonstrate 0.999 at 95 percent reliability.
This requirement is because FSS with both onboard and not onboard
systems that individually meet 0.999 at 95 percent reliability could
have a combined reliability as low as 0.998 at 95 percent confidence,
whereas FSS with only onboard systems would be required to have a
reliability of at least 0.999 at 95 percent confidence. To ensure that
FSS all meet the same standard required to protect public safety, the
final rule requires that onboard systems and not onboard independently
meet the 0.999 at 95 percent confidence level of reliability. The
collective FSS design reliability requirement is not specifically
stated in the final rule since the onboard FSS and not-onboard FSS
design reliability requirements are independently defined in Sec.
450.145 and the overall FSS design reliability is dependent on the type
of FSS employed.\160\
---------------------------------------------------------------------------
\159\ In the NPRM, the FAA stated that the reliability standard
in proposed Sec. 450.145(a)(1) would be consistent with various
sections of part 417, in particular Sec. 417.309(b)(2), that
require major FSS component systems, such as onboard flight
termination systems and ground-based command control systems, to be
tested to demonstrate 0.999 design reliability at 95 percent
confidence. The FAA further noted that this reliability threshold
would have to be demonstrated for the operation of the entire
system, including any systems located on-board the launch or reentry
vehicle, any ground-based systems, and any other component or
support systems. 84 FR 15328.
\160\ As discussed earlier in the preamble, if the consequence
of any vehicle response mode is less than 1 x 10-\3\, the
FAA will not require an FSS or mandate its reliability if an
operator chooses to use one.
---------------------------------------------------------------------------
For Sec. 450.108(b)(1) FSS that must meet the requirements of
Sec. 450.145, unless alternative methods are accepted by the
Administrator, the FAA has identified RCC 319 as an existing means of
compliance to demonstrate FSS reliability. This standard is currently
used by applicants that employ traditional flight abort under part 417.
The FAA expects to continue the current practice of working with
applicants to tailor RCC 319 in order to comply with Sec. 450.145. A
tailored RCC 319 that is used as a means of compliance for Sec.
450.145(b) must be submitted to the FAA for acceptance prior to being
included in a license application.
As noted in the previous preamble section, the FAA has removed the
additional requirements proposed in Sec. 450.145(a)(2), and is relying
on requirements in Sec. 450.143 to ensure that an FSS required by
Sec. 450.108(b)(2) is sufficiently reliable. As with the NPRM, the
final rule reduces the burden on operators that have a lower potential
for causing high consequence events. This change maintains the intent
of the proposal to protect against high consequence events using a
means different from the traditional highly reliable FSS.
As noted in the previous section, the Safety-Critical Systems AC
will provide an approach to compliance with Sec. 450.143 that modifies
the provisions in RCC 319. The approach uses a menu of potential
options that, when met, would demonstrate that an operator has met
Sec. 450.143. The AC will provide combinations of various tailored RCC
319 requirements that the FAA has determined demonstrate compliance
with Sec. 450.143. Some of the tailored requirements include:
Reducing the random vibration and thermal cycle
qualification test margins to a level and duration that remains above
acceptance test levels;
Reducing the number of required qualification test units;
Reducing the minimum required sample size for ordnance lot
acceptance testing and ordnance qualification testing;
Allowing qualification by similarity with deviations to
RCC 319 qualification by similarity criteria;
Reducing the required number of thermal cycles for
component level qualification thermal cycle test requirements;
Reducing the radio frequency link margin requirements for
traditional commanded FSS;
Allowing single string fail-safe FSS;
Reducing electronic piece parts requirements; and
Allowing use of vehicle components or systems for FSS use
such as vehicle power source or flight computer.
An operator could work with the FAA to determine what combination
of options would satisfy Sec. 450.143 for specific FSS. In addition,
an operator could develop its own combination of tailored RCC
requirements to demonstrate compliance, or could elect to use a
different means of compliance outside of the RCC 319 requirements.
An operator may demonstrate compliance with Sec. 450.143 through
other means that adequately establish
[[Page 79661]]
design, qualification testing, and acceptance testing. As mentioned
earlier, the environmental test levels in SMC-S-016 are acceptable for
safety-critical systems under Sec. 450.143, including some FSS
components, except protoqualification testing found in 4.2.3 and B.1.3-
4, and protoqualification by similarity in 4.10.1.
Lastly, the FAA also makes minor changes to the application
requirements in Sec. 450.145. In the NPRM, Sec. 450.145(d) stated
that an FSS includes any FSS located onboard a launch or reentry
vehicle; any ground based command control system; any support system,
including telemetry subsystems and tracking subsystems, necessary to
support a flight abort decision; and the functions of any personnel who
operate the FSS hardware or software. This provision has been moved to
the definition of ``flight safety system'' and deleted from Sec.
450.145(d).\161\
---------------------------------------------------------------------------
\161\ In the final rule, the definition of FSS is ``a system
used to implement flight abort. A flight safety system includes any
flight safety system located onboard a launch or reentry vehicle;
any ground based command control system; any support system,
including telemetry subsystems and tracking subsystems, necessary to
support a flight abort decision; and the functions of any personnel
who operate the flight safety system hardware or software.'' In the
NRPM, the definition also included that a human can be a part of an
FSS. The FAA removed this sentence from the definition because ``the
functions of any personnel who operate the flight safety system''
covers this circumstance.
---------------------------------------------------------------------------
The FAA received several comments on the limited means of
compliance available to demonstrate compliance with the FSS reliability
requirements. Blue Origin commented that the industry had only been
given one means of compliance for both tiers of FSS reliability. Blue
Origin also commented that the proposal indicated the only accepted
means of complying with Sec. 450.145 would be an untailored RCC 319.
Blue Origin and CSF suggested that there exist other industry and
government standards that should be accepted means of compliance with
the reliability requirements of Sec. 450.145. Blue Origin and
Microcosm stated that a tailored RCC 319 or SMC-S-016 should also be an
accepted means of compliance. SpaceX commented that RCC 319 was an
acceptable standard, but only if the document may be tailored for each
operator.
The FAA clarifies that RCC 319 is a means of compliance the FAA has
identified to date that ensures compliance with Sec. 450.145, but RCC
319 is not the only possible means of compliance that the FAA will
consider. The performance-based nature of Sec. 450.145 allows an
operator to submit its own unique means of compliance to the FAA. An
applicant may propose a tailored version of RCC 319 prior to submitting
its application as a unique means of compliance to be accepted by the
Administrator. As discussed earlier, the Safety-Critical Systems AC
will provide guidance to operators on how to comply with the
requirements for Sec. 450.108(b)(2) FSS. This approach uses RCC 319 as
one starting point. The AC will also refer to SMC-S-016, as discussed
earlier. The FAA notes that, unlike for highly reliable FSS required to
meet Sec. 450.145, for an FSS required by Sec. 450.108(b)(2) an
operator is not required to have a means of compliance with Sec.
450.143 accepted in advance of application submittal. However, it would
be advisable for an operator to consult with the FAA early in its
program's development on the approach to compliance with Sec. 450.143,
whether for an FSS or other safety-critical systems.
The performance-based nature of Sec. Sec. 450.143 and 450.145 also
allows an industry consensus standards body to submit a proposed means
of compliance to the FAA for general use. This process is discussed in
more detail in the Means of Compliance section of the preamble.
Applicants are encouraged to work with the FAA in pre-application
consultation to discuss potential unique means of compliance. For
example, for Sec. 450.108(b)(1) FSS, an applicant could work with the
FAA during pre-application consultation to tailor RCC 319 to the
operation while still ensuring compliance with Sec. 450.145. The FAA
will review the documents tailored to vehicle programs and mission-
specific applications as unique means of compliance for a given
license.
Blue Origin, CSF, and Virgin Galactic expressed concern that a
vehicle that did not require an FSS under parts 431 or 435 might
require one under part 450. The FAA disagrees. This rule maintains the
level of safety required under parts 415, 417, 431, and 435 for FSS.
Furthermore, as discussed in the High Consequence Event Protection
section of this preamble, the ACTA study results indicate that no
changes would be required under the final rule regarding the need for
an FSS for any currently licensed launch vehicle launched from a
Federal or commercial launch or reentry site. Therefore, the FAA does
not expect to require an FSS under part 450 for any launch vehicle that
would not have been required to have an FSS under parts 431 and 435.
CSF commented that the NPRM's proposed structure for requiring
flight abort was overly prescriptive and would not give an operator
flexibility to define the type of FSS to implement. CSF recommended
requiring operators to make a safety case and moving CEC and
the reliability requirements for FSS of the NPRM to an AC.
The FAA disagrees that a safety case should take the place of
discrete CEC thresholds and the requirements for FSS in
Sec. Sec. 450.143 and 450.145. Although a safety case is a potential
approach to applying for an ELOS determination for many of the
regulatory requirements, the FAA does not believe that requiring a
safety case, by itself, provides sufficient regulatory clarity as to
what is expected of a launch or reentry operator to obtain and maintain
a license.
Blue Origin commented that the means of compliance for FSS
requirements in the NPRM was unclear, particularly for systems not on
the launch vehicle such as tracking systems, ground systems, and flight
abort crew. As examples, Blue Origin mentioned RCC 324 \162\ and EWR
127-1 \163\ for tracking systems, AFSPCI 91-701 \164\ for ground
systems, and AF 13-602 \165\ for flight abort crew.
---------------------------------------------------------------------------
\162\ RCC 324-01 Global Positioning and Inertial Measurements
Range Safety Tracking Systems' Commonality Standard.
\163\ Eastern and Western Range (EWR) 127-1 Range Safety
Requirements.
\164\ AFSPCI 91-701, Launch and Range Safety Program Policy and
Requirements.
\165\ AFI 13-602 Ready Spacecrew Program Training.
---------------------------------------------------------------------------
As discussed above, Sec. 450.145(b) has been amended to address
more clearly the part of the FSS onboard the vehicle and the part not
onboard the vehicle, such as ground-based and space-based systems. In
addition, this preamble addresses means of compliance for FSS
requirements specifically, as well as means of compliance used to meet
the requirements of part 450 more generally. As discussed previously,
an untailored RCC 319-19 is currently the only means of compliance the
FAA has reviewed and accepted to meet the Sec. 450.145 FSS
requirements; however, the FAA anticipates operators will provide
unique tailored versions of RCC 319-19 to the FAA for acceptance under
part 450. In addition, RCC 324 is an acceptable means of compliance for
the airborne tracking sources such as C-Band transponders used with
ground based command systems and for GPS receivers and inertial
measurement units used as airborne tracking data sources. EWR 127-1 is
not a current means of compliance for tracking systems because it is
out of date. AFSPCI 91-701 is an acceptable means of compliance for
FSS-related ground systems. Lastly, AFI 13-602 is an acceptable means
of compliance for flight abort crew.
[[Page 79662]]
Blue Origin noted that proposed Sec. 450.143 appeared to be
appropriately performance-based and applicable to all safety-critical
systems, including software. Except for Sec. 450.108(b)(1) FSS and
software, the FAA agrees with Blue Origin that Sec. 450.143 is
appropriately performance-based and applicable to all safety-critical
systems. The requirements in Sec. 450.143 are not sufficient for Sec.
450.108(b)(1) FSS because those systems require a higher reliability
due to the potential for high consequence events, as measured by
CEC. As discussed earlier, the unique hazards due to
software have a separate set of requirements in Sec. 450.141.
Otherwise, Sec. 450.143 is sufficient for safety-critical systems and
FSS that do not fall under Sec. 450.145 because it includes
performance standards for design, testing, and lifecycle management.
Note that Sec. 450.143 covers a Sec. 450.108(b)(2) FSS that an
operator uses to comply with the high consequence protection
requirements of Sec. 450.101(c), as well as an FSS that an operator
uses when it chooses flight abort as a hazard control strategy under
Sec. 450.107, notwithstanding Sec. 450.101(c). The requirements are
the same for either FSS because, although the potential for a high
consequence event is less of a concern in the latter case, each FSS is
critical to meeting the collective, individual, aircraft, and critical
asset risk criteria in Sec. 450.101(a) and (b).
Blue Origin sought clarification as to whether an operator would
need to comply with the software requirements of RCC 319 under the
requirements proposed for Sec. 450.145, in addition to the software
requirements under Sec. 450.141. An operator is not required to comply
with the software requirements of RCC 319 under the requirements for
Sec. 450.145. Section 450.141 applies to any software or data that
implements a capability that, by intended operation, unintended
operation, or non-operation, can present a hazard to the public.
Section 450.141 applies to FSS under either Sec. 450.108(b)(1) or
(b)(2). An operator is not required to meet RCC 319 in order to satisfy
Sec. 450.141, but RCC 319 is an acceptable means of demonstrating
compliance with Sec. 450.141.
Blue Origin and CSF commented that the NPRM's assertion that to get
a 0.999 design reliability at 95 percent confidence by testing at
predicted environment levels, an operator would have to test 2,995
units was incorrect because it did not take into account the dual
redundant string architecture traditionally implemented for an FSS. The
FAA concurs that its statement in the NPRM was an oversimplification
that did not describe typical FSS component testing adequately. FSS
testing generally consists of testing a certain number of units of an
individual component to determine its reliability and confidence level,
and that testing is part of determining the overall FSS system
reliability. The FAA maintains that, for most operators, testing a few
units at greater than expected operating environments is significantly
less burdensome than testing many units at expected operating
environments. Operating environments include shock, vibration, thermal
cycle, acceleration, humidity, and thermal vacuum, or other
environments relevant to system or material degradation. The
opportunity for operators to submit new means of compliance to be
accepted by the Administrator prior to application submission will
allow applicants to propose their own means of compliance if they
believe that another method of FSS design reliability, testing, and
analysis is less burdensome than a means of compliance currently
accepted by the FAA.
Microcosm asked if all orbital operators launching from the United
States would be required to have a 0.999 design reliability FSS in
accordance with proposed Sec. 450.145. The FAA does not expect that
all orbital operators launching from the U.S. will have operations with
a potential consequence of a reasonably foreseeable failure mode in any
significant period of flight that is greater than 1 x 10-\2\
CEC in uncontrolled areas. The FAA notes that, as described in
reference to the high consequence event protection requirements of
Sec. 450.101(c), operators will be required to have an FSS if the
consequence of any reasonably foreseeable failure mode in any
significant period of flight is greater than 1 x 10-\3\
CEC in uncontrolled areas, and, as proposed, that FSS will
need to have the high design reliability of 0.999 at 95 percent
confidence if the consequence of any reasonably foreseeable failure
mode in any significant period of flight is greater than 1 x
10-\2\ CEC in uncontrolled areas. However, the
FAA has removed the additional requirements proposed in Sec.
450.145(a)(2) in the final rule if the consequence of any reasonably
foreseeable failure mode is between 1 x 10-\2\ and 1 x
10-\3\ CEC, and in that scenario will only
require an operator to use an FSS that complies with Sec. 450.143.
SpaceX commented that RCC 319, section 1.10, allowed previously
approved components and systems to be grandfathered such that they not
be required to meet subsequent versions of RCC 319 unless certain
criteria apply. SpaceX suggested that this approach be taken by the FAA
in accepting previously tailored documents. SpaceX further recommended
allowing such grandfathered acceptance of different standards such as
AFSPCMAN 91-710.
The FAA's current practice is to accept FSS that have been approved
under a standard such as AFSPCMAN 91-710 and RCC 319 even after updated
versions of those standards are released. Licensing under part 450
should be consistent with that practice; a licensee should be able to
renew its license without changes to its FSS simply because a standard
that was used as a means of compliance has evolved with time. There
would be exceptions, however, if a significant flaw was discovered in
the earlier version of the standard.
SpaceX also commented on proposed Sec. 450.145(d)(3), which stated
that an applicant must submit any analyses and detailed analysis
reports of all FSS subsystems necessary to demonstrate the reliability
and confidence levels required by proposed Sec. 450.145. SpaceX
pointed out that while other government requirements, such as RCC 319,
provide guidance on what analyses and reports are necessary, the
proposed rule was unclear as to what specific analyses and reports are
necessary.
As noted earlier, RCC 319 is an accepted means of compliance for
Sec. 450.145. An FSS design, testing, and analysis process that
complies with the analysis requirements for RCC 319, or other accepted
means of compliance, will satisfy the FSS analysis requirements of
Sec. 450.145.
Rocket Lab requested clarification as to whether the FSS design
reliability is for hardware components only, and how to apply
reliability requirements to safety systems that include software. The
FAA notes that design reliability is for hardware only. The computing
system safety requirements in Sec. 450.141 do not provide an estimated
reliability, but instead establish process controls that prevent or
mitigate computing system faults.
The International Space Safety Foundation commented that FSS is the
only system of a launcher for which the operational experience did not
provide reliability significant data, because the system was ready but
rarely operated. The FAA concurs with the comment that there is a lack
of operational experience with FSS as far as terminating vehicles.
However, operational parameters are captured throughout flights,
whether the result is termination or not, and this data verifies many
of the expected operating modes.
[[Page 79663]]
Also, reliability is gained from design and thorough test programs, as
well as review of post-flight data.
The International Space Safety Foundation also commented that to
base the approval of a safety-critical system on reliability
predictions was not advisable considering the key role played by
software, which cannot be taken into account in the reliability
prediction. The International Space Safety Foundation recommended that
the FAA should instead define fault tolerance requirements for the FSS,
and specific software and computing system requirements in addition to
generic software development processes.
The FAA disagrees, noting that FSS reliability is also based on
design architecture, component selection, and testing that accounts for
fault tolerance and the overall system. Recognizing that there are some
difficulties in establishing reliability standards below a design
reliability of 0.999 at 95 percent confidence and commensurate design,
analysis, and testing, the FAA removes the proposed additional
requirements for Sec. 450.108(b)(2) FSS and instead relies solely on
Sec. 450.143 for design, testing, and monitoring requirements. In
addition, recognizing the importance of computing systems to system
reliability and public safety, the FAA proposed, and is including in
the final rule robust computing system requirements in Sec. 450.141.
Computing system requirements are further discussed in the preamble
section on Computing Systems and Software.
The International Space Safety Foundation recommended that the FAA
set up a multidisciplinary team of design and operation experts to draw
a strategy for the definition of FSS design performance requirements,
and for addressing the above issues. The FAA believes that standards
for FSS should continue to evolve and that industry should be
significantly involved in their development. An industry-led
development of a voluntary consensus standard or standards addressing
design, analysis, or testing of FSS would be particularly beneficial.
These standards could become new acceptable means of compliance with
FAA regulations.
aa. Hybrid Vehicles
In the NPRM, the FAA proposed one set of requirements for all
vehicle types without distinction between traditional and hybrid
vehicles. Hybrid vehicles are launch or reentry vehicles that have some
characteristics of aircraft and other characteristics of traditional
launch or reentry vehicles.
The FAA acknowledges that hybrid operations differ from traditional
rocket launches. Part 450 has been revised to accommodate better all
vehicle operators, including hybrid vehicle operators. The
accommodations include more performance-based requirements,
alternatives to flight abort, FSA requirements based on demonstrated
reliability, use of equivalent level of safety, and allowing
application process alternatives as agreed to by the Administrator. The
regulations allow currently licensed hybrid vehicle operators to
continue to use a flight hazard analysis as a hazard control strategy.
However, one or more hazard control strategies may be required to meet
the safety criteria in Sec. 450.101.
The FAA received numerous comments from industry regarding safety
requirements for hybrid vehicles, hybrid configurations, component
systems, and related operations. The FAA addresses the hybrid vehicle
comments that would be applicable to other operators in the applicable
topic area sections of this preamble. This section of the preamble
addresses the comments that are specific to hybrid operations, such as
aircraft certification, piloted vehicles, part 91 applicability, and
space support vehicles.
Two commenters stated that the applicability of hybrid systems
should be clarified and consolidated in a separate section of the
regulation. An individual commenter recommended that the preamble
material include a discussion of how the regulations would be applied
to hybrid configurations since their characteristics and operations are
significantly different from the more traditional RLV or ELV vertical
launch systems.
The FAA notes that the final rule provides flexible performance-
based regulations that work for all vehicle types, including hybrid
vehicles and other innovative architectures. Like all operators, an
operator of a hybrid launch or reentry vehicle must choose one or more
hazard control strategies for each phase of flight in accordance with
Sec. 450.107. The FAA anticipates that hybrid vehicle operators will
elect to use a flight hazard analysis as their hazard control strategy
for at least some phases of flight because the flight hazard analysis
is most similar to the existing system safety process in part 431.
An individual commenter stated that for hybrid vehicles, flying
qualities should be identified as safety critical and as a safety
element eligible for a safety element approval.
The FAA will work with operators during pre-application
consultation and throughout the application review to understand a
specific operation to determine what systems are safety critical as
defined in Sec. 401.7. All launch vehicles, reentry vehicles, safety
systems, processes, services, or personnel are eligible for safety
element approvals. The FAA will consider safety element approvals on a
case-by-case basis for hybrid vehicles. This concept is discussed in
the Safety Element Approval section of the preamble.
An individual commenter recommended that the FAA consider other
demonstrated measures of reliability for carrier aircraft to estimate
the public risk, such as ``attributed reliability'' and ``validated
reliability.''
In the final rule, the FAA uses the term ``demonstrated
reliability'' in Sec. Sec. 450.101(c)(3) and 450.113(b). The use of
this phrase in Sec. 450.101(c)(3) allows an operator to protect
against a high consequence event in uncontrolled areas for each phase
of flight by establishing the launch or reentry vehicle has sufficient
demonstrated reliability as agreed to by the Administrator based on
CEC criteria during that phase of flight. The use of this
phrase in Sec. 450.113(b) provides an exception for an operator from
performing and documenting an FSA for a phase of flight, if agreed to
by the Administrator, based on demonstrated reliability. These
requirements are discussed in more detail in the High Consequence Event
Protection and FSA preamble sections, respectively.
As discussed in the Conditional Expected Casualties section of this
preamble and in the NPRM, demonstrated reliability refers to
statistically valid probability of failure estimates based on the
outcomes of all previous flights of the vehicle or stage in accordance
with Sec. 450.131, which is discussed later in the preamble. The draft
High Fidelity FSA Methods AC,\166\ published with the NPRM, described
acceptable methods, including Bayesian and binomial methods, to
calculate demonstrated reliability and demonstrate compliance with
Sec. 450.131. As discussed in the draft AC, the prior estimate for the
probability of failure during a captive carry phase of flight could be
based on a different flight history database \167\ compared to
traditional ELVs. For example, the prior estimate for the probability
of failure during a captive carry phase of flight could be based on the
flight history of aircraft that also used certain proven or
[[Page 79664]]
industry standard design, manufacturing, or quality methods. Similarly,
if a carrier vehicle were based on or modified from a type certificated
commercial aircraft or used certified aircraft components, then the
carrier vehicle could be considered a derived vehicle.\168\ In this
example, the certification results and operational history for the
unmodified components of the aircraft would be accounted for in the
calculation of the demonstrated reliability. Under a performance-based
regulation, an applicant is free to propose a unique means of
compliance with other methods to calculate demonstrated reliability.
The FAA will consider other methods to calculate demonstrated
reliability for hybrid vehicles such as binomial methods consistent
with Appendix A to part 417 under A417.25(b)(5), and other methods used
in the past for launch and reentry vehicles.
---------------------------------------------------------------------------
\166\ See FAA-2019-0229-0019.
\167\ More specifically, a different set of outcomes of all
previous flights of vehicles developed and launched or reentered in
similar circumstances.
\168\ A derived vehicle is a term used when analyzing a new
variant of a known rocket. A derived vehicle should be alike in
substance or essentials considering the following factors that can
influence the probability of failure: (1) The development and
integration processes of the vehicle, including the extent of
testing; (2) the design and manufacture of safety-critical systems,
including but not limited to the structure (including the payload
faring), propulsion, guidance, control, and navigation; (3) all
aspects of the environment experienced by the vehicles, stages, and
components that can affect performance and reliability, including
but not limited to aerodynamic, thermal, acoustic, vibration, and
inertial environments; (4) vehicle performance in terms of payload
capability, maximum dynamic pressure, and maximum velocity.
---------------------------------------------------------------------------
The FAA notes that other vehicle characteristics, such as flying
qualities, do not lend themselves to analysis with statistical
reliability measures. For example, acceptable flying qualities in one
portion of the envelope do not necessarily predict good flying
qualities throughout the full operational envelope, and small
aerodynamic modifications or changes to the flight control system can
lead to disproportionally large and potentially hazardous changes in
flying qualities. In these cases, the FAA would consider flight test
results using proven flight test techniques and data analysis methods
as validated reliability.
An individual commenter urged the FAA to consider more than just
the fact that a vehicle holds an airworthiness certificate as evidence
of demonstrated reliability.
The FAA agrees that possession of an airworthiness certificate
alone does not guarantee that a vehicle or operation will have a level
of reliability sufficient to meet the part 450 public safety
requirements. The FAA considers other factors to determine reliability.
The FAA will consider the aircraft's original certification, its
current certification, and any modifications introduced through
issuance of supplemental type certificates. For example, a transport
category aircraft that has held a standard airworthiness certificate
and then been recertified to a restricted or experimental category. Any
modifications to the aircraft design certification may affect the
aircraft's reliability for the purposes of part 450, and the FAA
therefore will take these modifications into consideration. An
understanding of an aircraft's past and current operating environments
and its maintenance history are also relevant to the current
reliability estimate.
In addition, the FAA may consider other factors outside of
certification, such as a rigorous flight test program. Some launch
operators have or are developing new, purpose-built launch vehicles
that may serve as a component of a hybrid launch or may be designed as
rocket-powered aircraft and transitioned to licensed launch operations
following flight testing. These operators may hold experimental
airworthiness certificates for testing design concepts and aircraft
operating techniques. Experimental airworthiness certificates may also
be offered as part of a hybrid operator's application to establish the
vehicle's demonstrated reliability. The FAA's Office of Commercial
Space Transportation will continue to coordinate with the FAA's
Aviation Safety organization on issuance of an experimental
airworthiness certificate and the vehicle's developmental program to
understand its demonstrated reliability.
The FAA will also consider each crewmember's level of pilot
certification and flight experience, as well as the recency of that
experience as evidence of demonstrated reliability of the launch or
reentry system.\169\ While part 460 requires flight crew to hold at
least a private pilot certificate with an instrument rating, operators
using flight crew with higher levels of certification, operationally
related flight experience, and recent flight experience and training
can demonstrate higher reliability. For example, a crewmember holding
commercial and airline transport pilot certificates have more flight
experience and have been tested to a higher level of proficiency than a
crewmember who holds a private pilot certificate. In addition,
crewmembers with operationally related flight experience will have an
understanding of the decision-making required for high-altitude flight
and airspeed regimes, and the recent flight experience and training of
all crewmembers is recognized as foundational to ensuring a safe
operating environment of an aircraft or launch vehicle.
---------------------------------------------------------------------------
\169\ For FSA purposes, the vehicle failure probability accounts
for any failure of the launch or reentry system because of the way
failure is defined in Sec. 450.131(b). In the context of FSA, any
failure of the launch or reentry system, including pilot error, that
produced vehicle failure as defined in Sec. 450.131(b) must be
accounted for to establish the demonstrated reliability. Therefore,
the FAA would consider the pilot experience and training in making a
demonstrated reliability determination.
---------------------------------------------------------------------------
An individual commenter stated that the phase of a hybrid vehicle
operation in which the carrier vehicle is alone would be required to
take into account any potential aggressive maneuvers the vehicle may
have to make to clear a just-released rocket. The commenter further
stated that a civil airworthiness certificate may not be adequate to
cover the risks posed to the public by these unusual maneuvers.
The FAA agrees that the entirety of a launch or reentry operation
must be analyzed for hybrid operations. The FAA notes that once a
rocket is released, the carrier vehicle remains in the launch phase
until all components of the launch system have impacted or landed on
the earth and been rendered safe. Therefore, any maneuvers the carrier
vehicle makes after a rocket is released but before both components
have impacted or landed and been returned to a safe condition will
occur under the license and be assessed consistent with the
requirements of part 450.
Virgin Galactic expressed concerns that rather than streamlining
the requirements to create performance-based standards, the FAA is
combining its requirements for ELVs and hybrid RLVs so that each type
of operator might be subject to inappropriate or ambiguous
requirements. Virgin Galactic commented that it appreciated the
flexibility that some of the new regulations would provide but noted
that others seem too vague.
The FAA finds the final rule provides sufficient flexibility for
hybrid vehicles. The performance-based regulations in the final rule
allow operators like Virgin Galactic to propose an alternate approach
by demonstrating an equivalent level of safety or use a unique means of
compliance. To retain the maximum flexibility to adjust to dynamic
industry changes, the FAA will continue to offer operators the choice
to request ELOS determinations. In addition, 51 U.S.C. 50905(b)(3)
allows the Secretary to waive a requirement in the public interest and
will not jeopardize public health and safety, safety of property, and
national security and foreign policy interests of the United States.
Rather than explicitly
[[Page 79665]]
reference hybrid vehicles, the final rule provides the flexibilities to
all operators, including operators of hybrid vehicles and other
innovative concepts.
Virgin Galactic also stated that the intent of the requirement
should be publicly articulated in the regulations and not reside in the
preamble. The FAA notes both the preamble and the regulations are
publicly available. The intent behind the regulations correctly resides
in the preamble because the regulations contain only the regulatory
requirements by which regulated entities are bound. The preamble
provides further explanation as to why the FAA has elected to adopt the
regulatory requirements in order to provide transparency and further
elaborate on the agency's intent.
An individual commenter stated that hybrid configurations, carrier
aircraft flying alone, and reentry vehicles using aerodynamic controls
should follow controller instructions and abide by the general
operating and flight rules of aviation found in 14 CFR part 91. The
individual commented that hybrid launch vehicles with pilot-in-the-loop
control systems spend much more time than RLV and ELV systems in
restricted airspace and overflying populated areas and that this
requires hybrid configurations to have the capability to operate safely
in a controlled airspace environment like other aircraft.
The FAA agrees and notes that applicants may elect to mitigate
hazards to the public by proposing applicable sections of part 91 to
demonstrate compliance with specific requirements in part 450. However,
all components of a hybrid vehicle operate solely under a license when
the intent of flight is to conduct a launch or reentry.
Virgin Galactic stated that the FAA should have a narrowly tailored
CEC exemption from the flight abort requirements of proposed
Sec. Sec. 450.101(c) and 450.145 for piloted aircraft because the
pilot would already provide an FSS with abort capability. Virgin
Galactic further stated that a carrier aircraft in a hybrid system that
operated safely under its experimental airworthiness certificate should
not be subjected to the CEC requirement in proposed Sec.
450.101(c).
The FAA does not agree with Virgin Galactic's comment to include an
exemption from demonstrating protection against a high consequence
event for a piloted carrier vehicle because the operation of such a
vehicle may result in a high consequence event. As discussed earlier in
this preamble, operators must protect against a high consequence event
because such an event could result in a large number of casualties. The
FAA notes that the final rule allows an operator to seek an ELOS
determination for Sec. 450.101(c)(2). However, an exemption for all
piloted carrier vehicles would not be appropriate for launch or reentry
vehicle systems that have not yet been evaluated. Hence, an applicant
can use another method of measuring the potential for a high
consequence event that demonstrates an equivalent level of safety in
accordance with Sec. 450.37. Reusable vehicles and other innovative
architectures may be required by Sec. 450.101(c) to have a method to
achieve flight abort reliably to mitigate flight risks and consequences
fully, either in the form of a pilot that can safely abort flight using
system controls or a more traditional FSS. A pilot may provide
protection against a high consequence event. The FAA may consider a
pilot to be an FSS performing a flight abort if the pilot can initiate
and accomplish a controlled ending to vehicle flight reliably to limit
or restrict the hazards to public health and safety, and the safety of
property. Under the provision in Sec. 450.101(c)(3), the flight of a
carrier vehicle carrying a rocket to a drop point could be an example
of sufficient protection against a high consequence event, even if the
CEC were above the 1 x 10-\3\ threshold, if the
carrier vehicle has sufficient demonstrated reliability. Demonstrated
reliability and other flexibilities are discussed more fully in the
High Consequence Protection section of this preamble.
Virgin Galactic noted that a carrier aircraft operating under an
airworthiness certificate should be exempt from proposed Sec.
450.101(f), which, for any launch, reentry, or disposal, requires an
operator to notify the public of any region of land, sea, or air that
contains, with 97 percent probability of containment, all debris
resulting from normal flight events capable of causing a casualty.
Virgin Galactic stated that the requirement was unclear because it
discussed debris resulting from normal flight events. Virgin Galactic
requested further clarification on the purpose of public notification
if the proposed requirement was intended to address returning vehicles
that remain intact and on a nominal trajectory to the intended reentry
site. Virgin Galactic recommended that, if this regulation was intended
to apply to jettisoning of orbital rocket stages and the return/
disposal of upper stages, it should state as much.
The FAA agrees that returning vehicles on a normal trajectory do
not constitute ``debris'' as the term is used in Sec. 450.101(f).
However, the FAA will not exempt all hybrid vehicle operators from the
requirement in Sec. 450.101(f) because future hybrid operators could
possibly generate debris capable of causing a casualty from normal
vehicle flight. If an operation has no planned impacts from debris
capable of causing a casualty, then no notification will be necessary
to comply with Sec. 450.101(f).
Several commenters, including ALPA, Starfighters, and Virgin
Galactic, submitted comments regarding the applicability of FSA
requirements for hybrid vehicles under proposed Sec. 450.113(a)(5).
Virgin Galactic noted that, for the captive carry phase of a hybrid
vehicle mission, the FAA should exempt operators from performing an FSA
for a piloted aircraft that operated in accordance with aviation
regulations. Virgin Galactic stated the FAA should include such an
exemption because the pilot would already provide abort capability as
an FSS. Starfighters commented that an FSA should be required only for
the air-release launch phase of a hybrid vehicle mission, not the
earlier captive-carry phase, which might be many miles away from the
actual release point. However, ALPA stated that the FAA should require
an FSA for all phases of flight until sufficient quantitative data for
hybrid commercial space vehicles becomes available for analysis and to
conduct a regulatory process to standardize airworthiness requirements
for hybrid commercial space vehicles. An individual commenter noted
airworthiness certificates issued by the FAA are part of a safety
analysis but are not conclusive evidence of demonstrated reliability
for the purpose of proposed Sec. 450.113(a)(5). ALPA noted that flight
test results using proven flight test techniques and data analysis
methods should serve to validate reliability of hybrid vehicles'
carrier aircraft under proposed Sec. 450.113(a)(5), without requiring
documentation and statistical analysis of all previous flights.
In the final rule, the FAA is not providing a blanket exemption to
the FSA requirements for hybrid operations. The final rule removes
Sec. 450.113(a)(5) but maintains the flexibility proposed in the NPRM
to enable an operator of a hybrid vehicle with a high level of
demonstrated reliability to be exempt from performing some FSAs for
some phases of flight without seeking a waiver. The FAA will work with
hybrid vehicle applicants during pre-application consultation on how to
comply with FSA, CEC, and FSS requirements utilizing the
flexibilities that may be applicable depending on the applicant's
vehicle and concept of
[[Page 79666]]
operations. For example, the FAA might determine the quantitative FSA
requirements for those portions of an operation for which the vehicle
operates similarly to a civil aviation aircraft governed by civil
aviation regulations are unnecessary because the vehicle has
demonstrated reliability for operations using a certificated aircraft
or a valid airworthiness certificate with an acceptable flight test
history.
The FAA expands the flexibility for hybrid vehicles in proposed
Sec. 450.113(a)(5) to all vehicle operators in the final rule in Sec.
450.113, as discussed in more detail in the preamble section for FSA
Requirements Scope and Applicability. The FAA finds this flexibility
should be available to all operators if agreed to by the Administrator
based on demonstrated reliability. This wider availability will provide
a common regulatory construct across different operators to identify
the phases of flight for which FSA must be performed. Based on current
licensed operations, the FAA anticipates that initially only carrier
vehicles that have an airworthiness certificate and extensive flight
history would be able to meet the demonstrated reliability standard.
Aside from some carrier aircraft used as a component of a launch
vehicle, no existing launch vehicle has enough history to ensure
sufficient protection against a high consequence event based on
demonstrated reliability in accordance with Sec. 450.101(c) or enough
empirical evidence to demonstrate compliance with the public risk
criteria in Sec. 450.101(a) or (b).\170\
---------------------------------------------------------------------------
\170\ The L-1011 carrier vehicle used for Pegasus launches is an
example of a carrier aircraft with enough empirical evidence to
demonstrate compliance with the public risk criteria in Sec.
450.101(a) or (b). Using flight history to demonstrate compliance
with the risk criteria in Sec. 450.101(a) and (b) is relatively
simple, given a statistically significant number of flights relative
to the expected casualty limit of 1 x 10-\4\. As
discussed elsewhere in the preamble, the FAA notes that the operator
must also perform a system safety analysis to demonstrate that any
modifications made to the carrier vehicle introduce only hazards to
the public that are extremely remote.
---------------------------------------------------------------------------
Virgin Galactic asked about the applicability of the rule for
hybrid vehicles, including certain operational exemptions. Virgin
Galactic commented that the safety-critical system requirements in
Sec. 450.143 should not apply to hybrid carrier aircraft that operate
under an FAA-issued license and hold an airworthiness certificate
issued by the FAA. Virgin Galactic noted the requirements of this
section were akin to aircraft certification, which are spelled out in
the applicable parts of 14 CFR Chapter 1 that have been developed over
decades as the aviation industry matured. Virgin Galactic stated that
the commercial space industry is not at the state of maturity as
commercial aviation, and applying these similar ``certification''
requirements is contrary to the requirement in the Commercial Space
Launch Act to promote the commercial space launch industry and only
regulate to the extent necessary.
The FAA does not agree that carrier vehicles operating under an
FAA-issued license with an airworthiness certificate issued by the FAA
should be exempt from the safety-critical system requirements in Sec.
450.143. While airworthiness certification likely indicates increased
reliability because a certificated aircraft has satisfied many separate
FAA regulations, the satisfaction of those regulations does not alone
demonstrate that the carrier vehicle will meet the applicable
requirements under chapter III. However, an applicant may make a safety
case supporting an equivalent level of safety for a component of a
launch system if it holds a valid airworthiness certificate with an
acceptable flight test history. In the final rule, Sec. 450.143
includes the requirements for all safety-critical system components and
eliminates the ambiguity that existed in the part 431 regulations
regarding required testing of safety-critical systems. Section
450.143(e)(3) also requires a summary of the analysis detailing how
applicants arrived at the predicted operating environment and duration
for all qualification and acceptance testing. Such a summary is current
practice, and Sec. 450.143(e) makes this requirement explicit for all
vehicles. In response to Virgin Galactic's comments regarding the
relative maturity of commercial aviation versus the commercial space
industry and the appropriate approach to regulating the commercial
space industry, the FAA believes that the performance-based
requirements of the final rule fulfill statutory mandates and are
appropriate for the commercial space industry's capabilities now and as
they will evolve in the future.
An individual commenter stated that the carrier aircraft portion of
their launch system would also be capable of conducting operations as a
space support vehicle (SSV). The commenter sought clarification as to
whether part 450 would require adjustment to be consistent with new SSV
operations. SSVs and SSV flight are defined in section 50902 of title
51. Requirements to conduct the flight of a space support vehicle would
be promulgated pursuant to Section 44737, and are beyond the scope of
this rulemaking.
bb. Agreements and Airspace (Sec. 450.147)
In the NPRM, the FAA proposed to streamline the existing
requirements for agreements by removing specific requirements for a
variety of agreements and procedures and allowing an operator to
determine what agreements would be needed for its particular operation.
As proposed in Sec. 450.147, a vehicle operator would be required to
have written agreements with any entity that provides a service or use
of property to meet a requirement in part 450. The regulation
identified various entities for which agreements may be required
including a Federal launch range operator, a licensed launch or reentry
site operator, any party that provides access to or use of property and
services required to support a safe launch or reentry under part 450,
the U.S. Coast Guard, and the FAA.
In the final rule, the FAA adopts the proposal with one minor
change. The FAA has replaced the words ``Federal launch range'' in
Sec. 450.147(a)(1) with ``Federal launch or reentry site'' to
encompass all Federal sites used for licensed activities.
AAAE asked whether proposed Sec. 450.147(a)(1) would require
agreements with alternative or contingent landing sites and requested
that the FAA expressly require such agreements to ensure that they are
included in the licensing and launch preparation process. In Sec.
450.147(a)(1), the FAA requires agreements with any entity that
provides access to property required to support a safe launch or
reentry. Contingency abort locations are taken into consideration by
the applicant as part of its public safety analyses and by the FAA in
its environmental review. Because contingency abort locations
necessarily involve planned access to property, the FAA will not revise
the regulation to expressly require agreements with alternative or
contingent landing sites. The language in Sec. 450.147(a)(1) is
sufficient to ensure agreements are in place for all planned locations.
The FAA will not require such agreements for emergency landing sites or
other locations that are being considered, but have not been finalized
by the operator.\171\
---------------------------------------------------------------------------
\171\ The FAA notes that it has distinguished emergency abort
landing sites from planned contingency abort sites in other
rulemakings. For example, in the Commercial Space Transportation
Reusable Launch Vehicle and Reentry Licensing Regulations final
rule, Sec. 431.23 required an operator to identify contingency
abort sites in its application. The FAA stated that contingency
abort sites are pre-planned, and their potential use may be
identified as part of an application in order to meet mission risk
criteria and, therefore, are separate and distinct from emergency
abort landing situations that may potentially be anywhere. 65 FR
56617, 56635 (November 20, 2000).
---------------------------------------------------------------------------
[[Page 79667]]
Section 450.147(a)(3) requires operators to have written agreements
with FAA's Air Traffic Organization (ATO) or foreign air navigation
service providers (ANSP) to establish procedures for the issuance of a
Notices to Airmen (NOTAM) prior to a launch or reentry.
AOPA recommended that the FAA establish procedures for the issuance
of a Notices to Airmen (NOTAM) at least 72 hours prior to a launch or
reentry to forewarn the public about activation of different airspace.
It would not be appropriate within this commercial space rulemaking
to impose a requirement on the FAA ATO or a foreign ANSP to issue
NOTAMs within a particular time frame. Each ANSP is responsible for the
safe and efficient use of its airspace and can be expected to provide
notification consistent with its obligations. As such, notification
requirements necessary to protect the public, including any minimum
times for notification, should be determined as part of the agreement
development process with the FAA ATO or foreign ANSP.
Section 450.147(a)(4) requires an operator to enter into such
agreements with emergency response providers, including local
government authorities, as necessary to satisfy the requirements of
Sec. 450.173 (Mishap plan--reporting, response, and investigation
requirements).
SpaceX recommended that proposed Sec. 450.147(a)(4) exclude
government installations where responsibilities and mutual aid protocol
rendered separate agreements with local authorities unnecessary. SpaceX
believes this addition would manage expectations where multiple Federal
entities may have overlapping jurisdiction for addressing mishap
response.
Because Sec. 450.173(d)(5) requires an operator to implement
agreements with government authorities and emergency responders ``as
necessary'' to satisfy the requirements of Sec. 450.173, no change to
the proposed language in Sec. 450.147(a)(4) is required. An operator
that is launching from a Federal launch site is not required to execute
agreements with local authorities if the Federal site already has the
necessary coordination in place to satisfy the requirements in Sec.
450.173.
Section 450.147(b) requires that agreements clearly delineate the
roles and responsibilities of each party to support the safe launch or
reentry under part 450. SpaceX suggested adding language to require
parties to delineate roles and responsibilities ``within their
jurisdiction.'' Indeed, an entity may only enter into an agreement to
the extent they are authorized, but the FAA disagrees that this
language is needed in the regulation.
Section 450.147(d) requires operators to describe each agreement
submitted in accordance with the section.
SpaceX asked the FAA to clarify in a guidance document the intent
of proposed Sec. 450.147(d) and allow operators to provide other
acceptable documentation (e.g., business processes like the Universal
Documentation System) to avoid literal interpretations of requirements.
To comply with this requirement, the operator will enumerate those
services that the site operator is providing through various
agreements. The FAA may request a specific agreement that the site
operator has established to provide such a service. As long as each
agreement required by this section meets the criteria set forth in
Sec. 450.147, the operator may choose the format of the agreement.
Therefore, the FAA adopts the proposed rule without change.
Virgin Galactic asked whether an agreement would be required with
local authorities to ensure that the area is cleared of the public and
critical assets if an operator cannot meet conditional risk factor
criteria for an uncontrollable area of land. The FAA notes that
conditional risk does not trigger the need for an agreement with a
local authority. Instead, it is related to the need for an FSS.
However, such an agreement might be a means of mitigating conditional
risk, potentially to a degree at which the operator does not need to
employ an FSS.
A number of commenters expressed concern that the NPRM did not
require that airspace efficiency be taken into consideration as part of
a launch or reentry operation. AAAE, A4A, ACI, ALPA, AOPA, CAA, NATCA,
RAA, and Southwest Airlines recommended the FAA incorporate airspace
efficiency consideration into the licensing process to minimize
negative operational and financial impacts for airlines, passengers,
cargo shippers, and the public that will result from this rulemaking.
A4A, AAAE, and Southwest Airlines advocated increased transparency and
collaboration with airspace stakeholders in developing agreements
pursuant to proposed Sec. 450.147. A4A, AAAE, ACI, ALPA, AOPA, CAA,
NATCA, and RAA recommended the FAA ensure the safety requirements for
commercial space operations, particularly those addressing risks to
other aviation users, are commensurate with the expectations of the
flying public. AOPA recommended the FAA prioritize funding and
implementation of the Aeronautical Information Management Modernization
program, which would provide real-time airspace information. A4A, AAAE,
ACI, and AOPA recommended the FAA incorporate and implement various
recommendations from the Airspace Access Priorities ARC and Spaceport
Categorization ARC.
The FAA acknowledges the commenters' concerns regarding airspace
efficiency, but these issues are not within the scope of this
rulemaking. Operational oversight and management of airspace impacts
are managed at the FAA Air Traffic Control System Command Center. As
noted in the Flight Hazard Area Analysis section of this preamble, FAA
is working to address this issue through the Airspace Access ARC and
other initiatives.
cc. Safety-Critical Personnel Qualifications (Sec. 450.149)
In the NPRM, the FAA proposed to remove the certification
requirements found in Sec. Sec. 417.105, 417.311, and 415.113 and
replace them with performance-based requirements in proposed Sec.
450.149 (Safety-Critical Personnel Qualifications). Section 450.149(a)
would require an operator to ensure safety-critical personnel are
trained, qualified, and capable of performing their safety-critical
tasks, and that their training is current. Under proposed Sec.
450.149, an applicant would be required to identify in the application
all safety-critical tasks and internal requirements or standards for
personnel to meet prior to performing the identified tasks. The
application would be required to identify internal training and
currency requirements, completion standards, or any other means of
demonstrating compliance with the requirements of proposed Sec.
450.149. The applicant would also be required to describe the process
for tracking training currency.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended that
the FAA require that safety-critical personnel comply with the Federal
Drug-Free Workplace requirements set forth in 14 CFR 120. These
commenters noted that the Federal Drug-Free Workplace requirements
apply to government contractors, but commercial operators are only
subject to company policy, which may not address the use of drugs and
alcohol. The FAA did not propose to require drug and alcohol testing
and finds that such a requirement would exceed the scope of
[[Page 79668]]
this rulemaking. The FAA may consider proposing such action in a future
rulemaking.
The FAA received a comment from Blue Origin supporting the changes
to the safety-critical personnel qualifications requirements. In the
final rule, the FAA adopts Sec. 450.149 as proposed.
dd. Work Shift and Rest Requirements (Sec. 450.151)
In the NPRM, the FAA proposed to combine the rest requirements of
Sec. Sec. 417.113(f) and 431.43(c)(4) into Sec. 450.151 (Work Shift
and Rest Requirements), which would require an applicant to document
and implement rest requirements that ensure safety-critical personnel
are physically and mentally capable of performing assigned tasks. These
requirements would apply to operations of all launch and reentry
vehicles and would allow operators flexibility to employ rest rules
that fit their particular operations. Section 450.151(b)(1) would
require an operator's rest rules to include the duration of each work
shift and the process for extending this shift, including the maximum
allowable length of any extension. An operator's rest rules would be
required to include the number of consecutive work shift days allowed
before rest is required. Section 450.151(b)(3) would also require an
operator's rest rules to include the minimum rest period required
between each work shift, including the period of rest required
immediately before the flight countdown work shift. Applicants would be
required to submit their rest rules during the license application. In
the final rule, the FAA adopts Sec. 450.151 as proposed.
The FAA received seven comments on its proposed work shift and rest
requirements. Blue Origin, Rocket Lab, Virgin Galactic, and an
individual commenter agreed with FAA's proposed requirements permitting
greater flexibility in ensuring sufficient rest for safety-critical
personnel. Rocket Lab commented that the proposed approach would enable
operators to develop work shift and rest requirements that are
appropriate for the individual operating conditions, environment, and
mitigations that exist.
Virgin Galactic requested the FAA provide further guidance of what
would satisfy proposed Sec. 450.151 beyond the example of Sec.
431.43(c)(4). Section 431.43(c)(4) or the crew rest requirements of
AFSPCMAN 91-710 are two possible, but not the only, means of compliance
with Sec. 450.151.
ALPA opposed the performance-based approach to work shift and rest
requirements, stating that prescriptive duty limits were necessary to
reduce the likelihood of human error related to fatigue. ALPA indicated
the proposed rule made it possible for a commercial space operator ``to
set unrealistic crew rest requirements for cost management (doing more
with less) instead of safety.'' ALPA recommended the FAA adopt the rest
rules contained in Sec. 437.51.
The FAA elected a performance-based requirement over a prescriptive
one akin to Sec. 437.51 in order to allow operators to develop
requirements that are suited to their particular operations. In
addition, prescriptive requirements fail to account for the various
factors that can affect crew rest, such as the time of day of an
operation, length of pre-flight operations, and travel to and from the
launch or reentry site. The performance-based requirement set forth in
Sec. 450.151 allows operators to take into account such factors
affecting crew rest and adopt mitigations and procedures unique to each
launch operation. The FAA also disagrees that Sec. 450.151 will enable
operators to set unrealistic crew rest requirements in the interest of
cutting costs. Although operators can develop rest rules that fit their
operations, operators must demonstrate in their application that their
rest rules ensure safety-critical personnel are physically and mentally
capable of performing assigned tasks. The FAA will evaluate the rest
rules during review of the license application, and, if accepted, they
will become part of the license. The FAA finds that no change to the
proposed regulation is warranted.
ALPA and Blue Origin stated the commercial space operator should be
responsible for monitoring compliance with work shift and rest
requirements. Blue Origin noted the companies should be responsible for
monitoring compliance after the FAA accepts an operator's rules through
the application and approval process. Rocket Lab commented that a
specific requirement for operators to monitor compliance with work
shift and rest requirements was unnecessary as the regulation
explicitly required that the rest rules implemented ensure safety-
critical personnel are physically and mentally capable of performing
all assigned tasks.
Operators are expected to monitor compliance with their approved
crew rest rules so that personnel are fit to perform safety-critical
tasks and to provide records of compliance with those rules, as
required by Sec. 450.219(a), where requested by the FAA. The FAA finds
that a specific requirement for operators to monitor compliance with
work shift and rest requirements is unnecessary. The rest requirements
in Sec. 450.151(b) ensure safety-critical personnel are physically and
mentally capable of performing all tasks. It is up to the company to
monitor compliance with its work shift and rest rules to ensure
personnel are mentally and physically capable of performing safety-
critical tasks. An operator must comply with the rest rules accepted by
the FAA as part of the license because it must comply with the
representations in its application. Therefore, even absent an express
requirement, an operator must monitor compliance with its rest rules in
order to ensure that the objectives of Sec. 450.151 are met and that
the operator does not act contrary to its application.
Blue Origin asked the FAA to clarify the time period to which the
rest rules apply in finalizing the rest requirements and the scope of
license rule (Sec. 450.3). Blue Origin suggested the rest requirements
should only apply during the period an action could present a distinct
impact to safety, akin to how NASA closely monitors astronauts' rest/
work periods but does not mandate crew rest requirements for aerospace
employees in manufacturing plants or NASA mission control staff.
Although the FAA declines to limit the scope of Sec. 450.151 as
Blue Origin recommends, the FAA clarifies that Sec. 450.151 is
intended to ensure safety-critical personnel are prepared to perform
tasks that have an inherent impact on public safety. Operators must
document and implement rest rules to ensure that safety-critical
personnel have received adequate rest before they perform any safety-
critical task. Operators would not be able to ensure that personnel are
physically and mentally prepared to perform safety-critical tasks if
the rest rules set forth in Sec. 450.151 applied only during
activities that could distinctly affect safety (i.e., during safety-
critical tasks). For example, the rest rules apply to safety-critical
tasks such as end to end testing and safety-critical hardware
installation that may occur before hazardous pre-flight operations
trigger the start of launch. Operators must therefore comply with Sec.
450.151 for the duration of their license. The regulation is flexible
enough that an operator can develop rules that treat different parts of
launch activity differently. The FAA finds that no change to the
regulation is warranted.
Blue Origin suggested removing the definition of ``vehicle safety
operations personnel,'' as it has caused confusion in the industry. The
FAA agrees and does not adopt the definition.
Boeing, Lockheed Martin, Northrop Grumman, and ULA asserted the
[[Page 79669]]
requirements proposed in Sec. 450.151(b) reflect a relaxation of work
rule standards compared to the current FAA and range policies. They
further noted other DOT-regulated industries have explicit rest
criteria and recommended that the FAA publish the acceptable criteria
rather than having operators negotiate the hours deemed safe.
The requirements proposed in Sec. 450.151(b) are not a relaxation
of work rule standards compared to current FAA and range policies
because, as previously stated, two of the ways an operator can show
compliance with Sec. 450.151 are to meet current FAA rules (Sec.
431.43(c)(4)) or AFSPCMAN 91-710, and the FAA retains oversight to
determine that an operator's rules achieve the standard.
As previously stated, the FAA will issue an AC on a means of
compliance for Sec. 450.151. The crew rest requirements previously set
forth in part 431 and the current crew rest requirements in AFSPCMAN
91-710 will satisfy Sec. 450.151.
ee. Radio Frequency (Sec. 450.153)
In the NPRM, the FAA proposed that, for any radio frequency used,
an operator would be required to: (1) Identify each frequency, all
allowable frequency tolerances, and each frequency's intended use,
operating power, and source; (2) provide for the monitoring of
frequency usage and enforcement of frequency allocations; and (3)
coordinate use of radio frequencies with any site operator and local
and Federal authorities. Proposed Sec. 450.153(b) contained
application requirements and required an applicant to submit procedures
or other means to demonstrate compliance with the radio frequency
requirements.
Blue Origin, SpaceX, and Sierra Nevada commented the proposed
requirements were duplicative of Federal Communications Commission
(FCC) licensing requirements and, according to Blue Origin, were an
unnecessary burden on operators. Blue Origin explained that operators
coordinate frequency management through the FCC licensing process,
which is robust in its technical review of transmitter capabilities.
Blue Origin also noted FCC licenses are public information that the FAA
can verify. Sierra Nevada suggested the regulation should either
require only that the applicant demonstrate it has coordinated with the
FCC or be omitted altogether.
The FAA agrees that the proposed requirements in Sec.
450.153(a)(1) and (a)(2) are duplicative of FCC requirements for
radiating systems and overly burdensome. The FCC requires in Section
308(b) of the Communications Act of 1934, as amended, all the items in
proposed Sec. 450.153(a)(1) and (a)(2) as part of an FCC license for
radiating systems that an operator must obtain to operate radiating
equipment as part of a launch. The purpose of radio frequency
management, as stated in the NPRM,\172\ is to mitigate hazards
associated with radio frequency usage including interference that could
adversely affect the FSS or any safety-critical system of a vehicle,
including RLVs and reentry vehicles. The intent of proposed Sec.
450.153 (a)(1) and (a)(2) was to ensure radio transmissions would not
interfere with commanded flight termination systems and would be
compatible with the receiving system on the vehicle. The FAA finds that
operators can identify and mitigate hazards affecting FSS or safety-
critical systems effectively without duplicating information required
by the FCC. In the final rule, the FAA amends Sec. 450.153(a) by
replacing (a)(1) and (a)(2) with the performance-based objective
central to Sec. 450.153 that requires operators to ensure radio
frequency interference does not adversely affect performance of any FSS
or safety-critical system. Proposed Sec. 450.153(a)(3) is re-
designated as (a)(2) and continues to require operators to coordinate
use of radio frequencies with any site operator and any local and
Federal authorities, including any State, tribal, or territorial
authorities.
---------------------------------------------------------------------------
\172\ 84 FR 15334, footnote 98.
---------------------------------------------------------------------------
Blue Origin commented that proposed Sec. 450.153 added to the
burden previously placed on operators under part 431, which ought to be
included in the FAA's cost analysis. Blue Origin explained an applicant
would be required to submit to FAA the substantive content of a
frequency management plan and submit procedures to demonstrate
compliance with that plan. Blue Origin pointed out that under part 431,
the FAA did not require operators to prove they acquired FCC licenses
for a mission or that they coordinated the use of radio frequencies.
As previously explained, the FAA has removed the duplicative
provisions from Sec. 450.153, which would have amounted to a greater
burden on operators than has previously been required under part 431.
As such, in the final rule, Sec. 450.153 requires no more of operators
than what part 431 required for analysis of hazards associated with
licensed activities, creating no additional cost to operators.
Blue Origin recommended proposed Sec. 450.153 be removed since
applicants were already required to address and mitigate hazards
associated with frequency coordination or radiation exposure or power
limits as part of their hazard analysis. Blue Origin added that, for
launches at Federal launch or reentry sites, proposed Sec. 450.153
would duplicate much of the information submitted to the Federal site,
whose frequency management office typically works with range scheduling
to regulate radiation and power limits to prevent exceeding radiation
exposure and power limits while on the pad and harming the vehicle or
payload. For operations that do not occur on Federal sites, Blue Origin
indicated an operator would proceed as under the current part 431 by
identifying hazards and mitigation measures required to meet the public
safety limits. According to Blue Origin, operators should incorporate
hazards associated with this issue in their hazard analysis, including
identifying mitigation issues.
The FAA disagrees that Sec. 450.153 is unnecessary or duplicative
of hazard analysis requirements. As stated in the NPRM, the FAA has
determined that the public safety risks posed by radio frequency
interference warrant specific attention apart from the general
requirement that operators identify and mitigate hazards associated
with licensed activity. To the extent Federal launch or reentry site
procedures provide for coordination of radio frequencies used, an
operator may rely on those procedures to demonstrate compliance with
Sec. 450.153. The FAA does not prescribe the manner in which an
operator ensures that radio frequency interference does not adversely
affect a vehicle's FSS or any safety-critical system. The FAA merely
requires that operators set forth in their applications a means of
complying with Sec. 450.153 so that the FAA can ensure that radio
interference issues are appropriately addressed.
In an effort to streamline radio frequency requirements, SpaceX
recommended the FAA revise proposed Sec. 450.153(a)(2) to require that
operators ensure frequency utilization according to frequency
authorization parameters. SpaceX also recommended the FAA revise
proposed Sec. 450.153(b) to require coordination with site operators
and local and Federal authorities only for launches that do not occur
on a Federal launch or reentry site with existing radio frequency
policies and procedures.
The FAA disagrees that any frequency authorization parameters
issued by the FCC, which are geared toward managing
[[Page 79670]]
frequency use and operation, would be sufficient to assess hazards to
public safety posed by radio frequency interference, which are properly
within the FAA's purview. As previously discussed, the FAA has removed
the prescriptive requirements that it deemed duplicative of FCC
requirements in proposed Sec. 450.153(a) and replaces them with a
central performance-based objective. The FAA declines to accept
SpaceX's suggestion to amend Sec. 450.153(b). The coordination
required by Sec. 450.153(b) allows an operator to operate a command
transmitter at a frequency and power that ensures a flight termination
system signal can be successfully transmitted, and thereby prevent
harmful radio interference, in the interest of public safety. The FAA
declines to remove the requirement that all operators coordinate use of
radio frequencies with any site operator and local and Federal
authorities in order to protect the public and public property, because
such coordination is necessary to prevent radio interference that could
affect public safety. Users of Federal launch or reentry sites may use
Federal site procedures for radio frequency to demonstrate compliance
with Sec. 450.153.
Virgin Galactic asked if an operator could contract a third party
to meet the frequency management requirements.
The FAA does not prescribe the means by which an operator complies
with Sec. 450.153. An operator could therefore enter into an agreement
in accordance with Sec. 450.147 to have a third party, such as a
spaceport or Federal launch or reentry site, satisfy the radio
frequency management requirements contained in Sec. 450.153.
As noted, the FAA adopts Sec. 450.153 (Radio Frequency Management)
with revisions. The FAA replaces paragraphs (a)(1) and (a)(2) with
performance-based objectives central to radio frequency management.
Operators will be required to ensure that radio frequency does not
adversely affect the performance of FSS or safety-critical systems and
to coordinate use of radio frequencies with any site operator and local
and Federal authorities.
ff. Readiness and Rehearsals (Sec. 450.155)
In the NPRM, the FAA proposed an operator would be required to
document and implement procedures to assess readiness to proceed with
the flight of a launch or reentry vehicle. As part of the application
requirements, proposed Sec. 450.155(b)(2) would require an applicant
to describe the criteria for establishing readiness to proceed with the
flight of a launch or reentry vehicle.
Rocket Lab expressed support for the proposed requirements as
reducing the risk of unintended consequences that resulted from
stringent time requirements. SpaceX recommended that the FAA clarify
its intent for flight commit criteria in proposed Sec. 450.155(b)(2)
to ensure that mission success is not a factor by having applicants
describe the criteria ``to ensure public safety'' for establishing
readiness to proceed with the flight of a launch or reentry vehicle.
The FAA agrees that a change to the proposed regulatory language
would clarify the scope of the requirement. Therefore, the FAA revises
Sec. 450.155(b)(2) by adding the phrase ``so that public safety is
maintained'' to the end of the paragraph. The FAA did not adopt the
language recommended by SpaceX because the requirement calls for
criteria that establish readiness to proceed with flight or reentry
while ensuring public safety. The FAA's revision maintains the emphasis
on developing criteria to determine readiness to proceed with launch or
reentry, and clarifies that the operator need only identify those
criteria that affect public safety.
gg. Communications (Sec. 450.157)
In the NPRM, the FAA proposed to preserve the substantive
communications requirements from parts 417 and 431 but eliminate the
requirement to implement a communications plan. Proposed Sec.
450.157(a) would require an operator to define the authority of
personnel to issue ``hold/resume,'' ``go/no go,'' and abort commands,
assign communication networks so those personnel have direct access to
real-time safety-critical information, ensure those personnel monitor
each common intercom channel during countdown and flight, and implement
a protocol for using defined radio telephone communications
terminology. Proposed Sec. 450.157(c) would also require an operator
during each countdown to record all safety-critical communications
network channels that are used for voice, video, or data transmissions
to support safety-critical systems. This requirement is substantially
the same requirement in Sec. Sec. 417.111(l)(5)(vii) and 431.41. In
the final rule, with the exception of proposed Sec. 450.157(a)(3) as
discussed later in this preamble section, the FAA adopts Sec. 450.157
as proposed.
As explained in the NPRM, operators would not need to submit their
communication procedures during the application process as those
procedures generally are not mature at that time. The FAA will verify
compliance with Sec. 450.157 during inspections.\173\ The inspections
will be consistent with current practice, in which FAA inspectors often
review the operator's final communications procedures. Given that
operators do not need to demonstrate compliance with Sec. 450.157 at
the application stage, operators may be required to revise their
communication procedures to resolve issues identified during compliance
monitoring.
---------------------------------------------------------------------------
\173\ 84 FR 15337.
---------------------------------------------------------------------------
The FAA received three comments addressing the communications
requirements proposed in Sec. 450.157. AAAE recommended the FAA
require procedures and protocols on how the operator would communicate
with contingency or alternative landing sites, and emergency
responders. AAAE also suggested the FAA consider providing these same
stakeholders with the ability to monitor countdown and communications
channels, just as operators would be required to provide the FAA with
such access under proposed Sec. 450.209.
The FAA finds no additional requirements are necessary, as the
accident investigation and agreement requirements address AAAE's
concerns. Operators must include emergency response procedures in their
mishap plans pursuant to Sec. 450.173, which could, in many instances
include communication procedures with emergency response service
providers. In addition, operators must enter into and implement any
necessary agreements with local authorities and emergency response
services, such as first responders. Any other stakeholder, such as a
contingency abort site, may request to monitor channels as part of its
agreement with the operator, but the FAA does not find it necessary for
safety to mandate this type of monitoring in all situations.
Sierra Nevada commented that the requirement to monitor each common
intercom channel is excessive and would decrease the safety of an
operation. It noted that, for operators with multiple channels (e.g.,
more than 10), monitoring each channel would serve to decrease the
overall situational awareness of the controller. Sierra Nevada
recommended the FAA revise proposed Sec. 450.157(a)(3) to require that
personnel monitor only the applicable intercom channels during
countdown and flight.
The FAA agrees with Sierra Nevada's recommendation and removes
Sec. 450.157(a)(3). The persons responsible for the launch need to
maintain situational awareness and have all
[[Page 79671]]
safety-critical information in order to make decisions that affect
public safety. In cases in which there are multiple channels, all
channels do not have to be monitored at the same time. It is common
practice to turn down or turn off channels in order to listen to a
channel that has critical information. Each person identified in
paragraph (a)(1) of this section is not required to listen actively at
all times. Operator personnel other than those listed in (a)(1) may
listen to channels as necessary to relay critical information to the
personnel listed in (a)(1).
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the
FAA qualify the requirement to record safety-critical communications
channels in Sec. 450.157(c) as ``subject to records retention
requirements of Sec. 450.219.'' The FAA agrees that an operator must
record all safety-critical channels and retain them for the time
periods specified in Sec. 450.219, but does not agree that a change to
the regulatory text is necessary.
hh. Pre-Flight Procedures (Sec. 450.159)
In the NPRM, the FAA proposed to streamline countdown procedures
and requirements. Specifically, the FAA proposed not to include in part
450 the requirements for safety directives or safety notebooks in Sec.
431.37(a)(2) and for a countdown plan in Sec. 417.111(l), as well as
the requirement to file such plans, because there are many methods of
documenting pre-flight procedures that do not involve a plan or
notebook. In addition, the FAA proposed a performance-based requirement
in which an operator who needs to implement pre-flight procedures would
verify that all flight commit criteria are satisfied before flight and
ensure the operator is capable of returning the vehicle to a safe state
after a countdown abort or delay. In the final rule, the FAA adopts
Sec. 450.159 (Pre-flight Procedures) as proposed.
Virgin Galactic commented that, if the FAA knows which events must
take place as a part of a countdown, it should require them in proposed
Sec. 450.159(a)(1). Virgin Galactic recommended the FAA require
operators to identify the sequence of events that must take place to
initiate flight in order to verify that flight commit criteria are
satisfied.
Flight commit criteria involve much more than the launch sequence
of events, including interdependent conditions such as meteorological
conditions, lightning protection equipment measurements, and status of
safety system components. Therefore, the requirements of Sec. 450.159
cannot be satisfied by merely having operators identify the launch
sequence of events. Furthermore, the FAA does not think a prescriptive
requirement listing which events must take place as part of a countdown
is necessary to ensure safety. Rather, this section takes a performance
based approach that focuses more comprehensively on verification of
flight commit criteria and the operator's ability to ensure that it can
return the vehicle to a safe state after a countdown abort or delay.
The FAA notes that the requirements for the flight commit criteria
itself are clearly provided in Sec. 450.165(b).
ii. Control of Hazard Areas (Sec. 450.161)
In the NPRM, the FAA proposed that an operator would be required to
publicize, survey, and evacuate each flight hazard area before
initiating flight or reentry to the extent necessary to ensure
compliance with proposed Sec. 450.101. Proposed Sec. 450.161(a) did
not change the need for surveillance relative to the current
requirements in parts 417 and 431 \174\ for people on land or aircraft
because an operator must continue to ensure all regions where any
individual member of the public would be exposed to more than 1 x
10-\6\ PC (probability of casualty) are
evacuated. However, the FAA proposed to revise the requirement to
evacuate and monitor areas where a waterborne vessel would be exposed
to greater than 1 x 10-\5\ PI (probability of
impact) currently required by Appendix B to part 417 under B417.5(a).
The NPRM allowed an operator to include people in waterborne vessels in
collective risk computations, rather than clearing a waterborne vessel
from a hazard area because the vessel is exposed to 1 x
10-\5\ PI. The NPRM proposal to include people on
ships in the collective risk computation in Sec. 450.101(a)(1) and
(b)(1) would allow the application of risk management principles to
protect people on waterborne vessels. In the final rule, the FAA adopts
Sec. 450.161 with revisions. It updates Sec. 450.161 to be consistent
with the language in flight hazard area analysis section, Sec.
450.133, and adds an application requirement for a description of how
the applicant will provide for any publication of flight hazard areas.
---------------------------------------------------------------------------
\174\ Part 417 requirements for establishing and surveying
hazard areas for ELVs are found in Sec. Sec. 417.205, 417.223, and
part 417 appendix B. Part 431 does not set explicit requirements for
surveillance but both Sec. Sec. 417.107(b)(2) and 431.35(b)(1)(ii)
require that an operator ensure all members of the public are
cleared of all regions, whether land, sea, or air, where an
individual would be exposed to more than 1 x 10-\6\ PC.
---------------------------------------------------------------------------
The FAA changes the title of this section from ``Surveillance and
Publication of Hazard Areas'' to ``Control of Hazard Areas'' to
describe the contents of this section fully, as the requirements cover
more than surveillance and publication. The FAA also changed the
proposed wording in Sec. 450.161(a) from ``publicize, survey, and
evacuate'' to ``survey, publicize, control or evacuate'' to match the
language in Sec. 450.133(a), which describes flight hazard area
analysis. The term ``control'' is used to describe the overall
management of hazard areas, including control of entry and exit points
such as roadblocks and security checkpoints. The FAA also adds language
in Sec. 450.161(a) that references the flight hazard area requirements
in Sec. 450.133, which requires an applicant to identify the flight
hazard areas it needs to control.
The FAA notes that the requirements in Sec. 450.161 are consistent
with the recommendations made by the National Academy of Sciences
National Research Council.\175\ An applicant could apply conservative
estimates of the ship traffic and vulnerability to demonstrate
acceptable public risks. However, as explained in the NPRM, the
operators still have the option to use the current approach in part
417, where surveillance is required to ensure no ship is exposed to
more than 1 x 10-\5\ PI, because that would be
sufficient to ensure compliance with Sec. 450.101.
---------------------------------------------------------------------------
\175\ In 2001, the National Research Council published a report
on ``Streamlining Space Launch Range Safety,'' which included a
recommendation that ``safety procedures based on risk avoidance
should be replaced with procedures consistent with the risk
management philosophy specified by EWR 127-1.'' See p. 44 of IBSN 0-
309-51648-X available at https://www.nap.edu/catalog/9790.html.
---------------------------------------------------------------------------
Boeing, Lockheed Martin, Northrop Grumman, and ULA proposed that
the phrase ``unless otherwise assigned through agreement with a launch
or reentry facility'' be added to proposed Sec. 450.161(a) for
clarification. Virgin Galactic also recommended that this requirement
be handled through Letters of Agreement. Although the operator may
contract with another party for the provision of services to meet this
requirement, the licensee remains responsible for complying with the
requirement. As such, the FAA does not agree that this recommended
addition is necessary.
SpinLaunch commented that the goals of the NOTAM required under
proposed Sec. 450.161 can be addressed through area designations on
Sectional Aeronautical Charts, controlled airspace designation, and
coordination with Air Traffic Control. The FAA is responsible for the
[[Page 79672]]
management of the NAS and establishes the regulations, processes, and
procedures for restricting airspace including airspace restrictions for
commercial space activity. Under Sec. 450.147, when an operator enters
into a letter of agreement with the FAA, the airspace needed to
accomplish the proposed operation safely is notionally identified and
air traffic control coordination procedures are established
accordingly. The FAA did not propose changes to airspace management
regulations or processes, so SpinLaunch's comment is beyond the scope
of this rulemaking.
AOPA commented that airspace hazard volumes are not communicated in
a standardized manner today, nor are pilots educated on what to do with
this information. AOPA further commented that a publicly accessible,
authoritative source for launch information would greatly increase
awareness and mitigate adverse impacts caused by short notice
announcements of launches. The commenter also suggested that
prospective users of the system should be part of this capability's
development process.
As discussed more fully in the preamble section associated with
Flight Hazard Area Analysis, the FAA finds that the issue raised by
AOPA is best addressed by the NOTAM/AIM Modernization effort rather
than this rulemaking.
Boeing commented that, currently, not all areas that are publicized
are also surveyed, controlled, and evacuated. Boeing stated that the
need to survey and evacuate should be scalable and dependent upon the
risk magnitude and area, remoteness of the hazard areas, capabilities
for monitoring, and overall risk/benefit tradeoff. The FAA does not
believe a change to the proposed rule is necessary to address these
concerns. The requirement to survey, publicize, control, and evacuate
each flight hazard area is scalable, as these measures are required
``to the extent necessary to ensure compliance with Sec. 450.101.''
This reference to Sec. 450.101 means that the need to control the
hazard areas is dependent on the public risk criteria, as well as the
inputs and assumptions used in the FSA.
Sierra Nevada commented that Sec. 450.161 would be an increase in
regulatory burden due to surveillance over a large area being cost-
prohibitive and nearly impossible to implement for smaller companies.
Sierra Nevada recommended that operators only be required to ensure
NOTAMs and Notices to Mariners are in place prior to operation, and
should not bear consequences if the public breaches those areas. Sierra
Nevada also asked how an operator could reasonably survey an aircraft
hazard area over a large area of ocean.
The FAA disagrees with this comment and notes that this requirement
codifies current practice. The FAA further notes that the only change
to current practice--the inclusion of people on ships in collective
risk--actually decreases regulatory burden for waterborne vessel hazard
areas. An operator is no longer required to evacuate and monitor areas
where a waterborne vessel would be exposed to greater than 1 x
10-\5\ PI. In issuing its first waiver of the
existing requirement in Sec. 417.107(b)(3),\176\ the FAA explained
that successful application of the public risk management for the
protection of people in waterborne vessels has the potential for
reducing launch costs by reducing delays due to ship traffic in warning
areas while maintaining a high level of public safety. For example,
prior to the waiver of Sec. 417.107(b)(3), a launch from Cape
Canaveral Air Force Station was delayed, in order to meet the
requirements of Sec. 417.107(b)(3), by the presence of a tug boat
towing a large barge inside the ship hazard area. The final rule
addresses Sierra Nevada's concerns regarding surveillance of a large
portion of ocean by including people on ships in the collective risk
criterion. Furthermore, the FAA notes that this requirement could be
met a number of ways, including through an operator agreement with a
Federal launch or reentry site or the FAA.
---------------------------------------------------------------------------
\176\ See Waivers of Ship Protection Probability of Impact
Requirement, 81 FR 28930 (May 10, 2016).
---------------------------------------------------------------------------
Virgin Galactic asked whether it is necessary to require an
operator to meet the EC criteria if the operator is using a
flight hazard area, thus ensuring no member of the public is in the
area. The FAA addressed this issue during the public comment period in
``Responses to the Public's Clarifying Questions Received by July 12,
2019.'' An EC analysis is still required even if launch
hazards are contained over regions of land, sea, or air that are
completely void of members of the public because the systems necessary
to achieve such containment, such as an FSS, may fail. If an FSS fails,
debris may fall outside of hazard areas where members of the public are
present. The EC analysis ensures that the potential failure
of those systems is accounted for when calculating risk to the public.
In the NPRM, proposed Sec. 450.161(b) would have required an
operator to perform surveillance sufficient to verify or update the
assumptions, input data, and results of the FSA. The NPRM preamble
stated that, given that there are numerous assumptions and input data
that are critical to the validity of the FSA, this requirement could
have a variety of surveillance implications beyond the surveillance
necessary to ensure the public exposure at the time of the operation is
consistent with the assumptions and input data for the FSA. As
described in the NPRM preamble, an example would be that an FSA could
assume that a jettisoned stage remains intact to impact or breaks up
into pieces that are not all capable of causing casualties to people on
the ground but could still be capable of causing casualties to people
in a particularly vulnerable class of aircraft, such as helicopters.
In the final rule, the FAA maintains the requirement that an
operator employ some type of surveillance (e.g., telemetry data, or
remote sensors such as a camera or radar) to verify that the jettisoned
stage behaves in a manner consistent with the FSA if that behavior is
germane to the size of the aircraft hazard area. The FAA clarifies that
if an FSA includes conservative assumptions and inputs, or a
sensitivity analysis to demonstrate that the assumptions regarding
break-up of a jettisoned stage are not germane to the size of the
aircraft hazard area, the operator will only be required under Sec.
450.161(b) to demonstrate surveillance sufficient to verify the
accuracy of the FSA. If the assumptions and inputs are sufficiently
conservative, this contingency could mean an operator does not need to
employ surveillance at all.
Blue Origin provided suggested text for Sec. 450.161(b) related to
vehicle tracking rather than surveillance. The FAA declines to adopt
this change because vehicle tracking requirements in Sec. 450.167
(Tracking) are distinct from the requirement to surveil the flight
hazard areas in Sec. 450.161. The requirements and comments regarding
vehicle tracking are discussed in the preamble section associated with
Sec. 450.167.
CSF, Sierra Nevada, and SpaceX also commented that if a member of
the public or another Federal agency chooses to breach a hazard area
and put itself at risk, the operator should not bear the consequences.
Many commenters identified this possibility as a problem in the case of
a hazard area violation that occurs after the decision to commit to a
reentry.
The FAA understands the unique challenges of reentry operations
with respect to the control of hazard areas because of the long time
lag between the commitment to reenter and the planned or potential
unplanned vehicle presence
[[Page 79673]]
in a hazard area. The FAA will work with operators during the license
application process in applying this requirement to ensure verification
procedures protect the public adequately for each unique operation.
In the NPRM, proposed Sec. 450.161(c) would require an applicant
to publicize warnings for each flight hazard area, except for regions
of land, sea, or air under the control of the vehicle or site operator
or other entity by agreement. If the operator relies on another entity
to publicize these warnings, the proposed rule required the operator to
verify that the warnings have been issued. CSF and SpaceX commented
that operators would have very little ability to ensure and enforce
closures when launching from a Federal launch or reentry site or if the
hazard area falls within a foreign country's airspace.
The FAA agrees with these comments. To address this issue, the FAA
changes the language in proposed Sec. 450.161(c) from ``verify that
the warnings have been issued'' to ``determine whether the warnings
have been issued'' in Sec. 450.161(c)(1) in the final rule. The FAA
recognizes that an operator would be unable to meet the proposed
regulation to verify the warnings have been issued if the foreign Air
Navigation Service Provider (ANSP) fails to publicize the warnings. The
FAA also adds in Sec. 450.161(c)(2) of the final rule that the
operator must notify the FAA if the warnings have not been issued so
that the FAA can determine if the launch or reentry can be conducted in
a manner that protects the public sufficiently, and that this
notification must provide sufficient information to enable the FAA to
issue warnings to U.S. aircraft. An involved party could determine
whether the warnings have been issued pursuant to the agreements the
operator has with, for example, a Federal launch or reentry site or a
foreign government. In cases in which a foreign ANSP does not issue the
warnings in a timely manner, the operator must notify the FAA in
accordance with a means of compliance accepted by the FAA. The means of
compliance will describe information that the operators should
communicate to the FAA to (1) show due diligence in the fulfillment of
their requirements in accordance with agreements in place, and (2)
enable FAA to issue warnings to U.S. aircraft. The FAA finds that the
final rule requirement in Sec. 450.161(c)(2) is responsive to the
comment that operators have very little ability to enforce closures
when launching from a Federal launch or reentry site or if the hazard
area falls within a foreign country's airspace.
The FAA proposed in Sec. 450.161(d)(1) that an applicant must
submit a description of how the applicant will provide for day-of-
flight surveillance of flight hazard areas, if necessary, to ensure
that the presence of any member of the public in or near a flight
hazard area is consistent with flight commit criteria developed for
each launch or reentry as required by Sec. 450.165(b). In the final
rule, the FAA adds in Sec. 450.161(d)(1) that the applicant must also
provide for day-of-flight control of flight hazard areas. The FAA notes
that the nature of any surveillance (in terms of extent and frequency)
necessary to ensure conditions consistent with flight commit criteria
is naturally linked to the level of control an operator can exercise to
limit access to a flight hazard area.
In Sec. 450.161(d)(2), the FAA adds as an application requirement
that the applicant must submit a description of how they will provide
for any publication of flight hazard areas necessary to meet the
requirements of Sec. 450.161(c). This application requirement is
necessary for the FAA to evaluate compliance with the requirements of
Sec. 450.161(c), including verifying whether the warnings have been
issued.
jj. Lightning Hazard Mitigation (Sec. 450.163)
In the NPRM, the FAA proposed to require operators to mitigate
natural and triggered lightning by (1) implementing flight commit
criteria that avoid and mitigate the potential for intercepting or
initiating lightning strike or encountering discharge; (2) using a
vehicle designed to continue safe flight if struck by lightning or
encountering a nearby discharge; or (3) ensuring satisfaction of the
safety criteria set forth in proposed Sec. 450.101 in the event of a
lightning strike on the vehicle.
In the final rule, the FAA adopts Sec. 450.163 (Lightning Hazard
Mitigation) with modification. It revises Sec. 450.163 to remove
paragraphs (a)(3) and (b)(3). It adds the modifier ``direct'' to
``lightning strike'' in paragraph (a)(1), to match the application
requirement in paragraph (b)(1). The FAA also modifies Sec.
450.163(a)(2) in response to a comment as described below.
Blue Origin commented that proposed Sec. 450.163(a)(3) diverged
from the preamble to Sec. 450.163 and the rest of the proposed rule,
which clearly convey that satisfaction of the safety criteria in
proposed Sec. 450.101 was not optional. An operator would be required
to satisfy proposed Sec. 450.101 regardless of whether it chooses to
implement flight commit criteria or utilize a lightning-resistant
vehicle.
The FAA agrees with Blue Origin's comment and revises Sec.
450.163(a) by removing proposed Sec. 450.163(a)(3). Proposed Sec.
450.163(a)(3) was intended to cover an operator's use of physical
containment as a hazard control strategy when damage to a vehicle
caused by a lightning strike would not impact the safety of the launch.
The FAA has found this section to be unnecessary because lightning
would not be a concern for an operator using physical containment as a
hazard control strategy since, by definition, the launch vehicle does
not have sufficient energy for any hazards associated with its flight
to reach outside the flight hazard area.
Blue Origin requested that the FAA define ``continue safe flight''
in proposed Sec. 450.163(a)(2). In response, the FAA modifies Sec.
450.163(a)(2) to require the operator to use a vehicle designed to
protect safety-critical systems in the event of a direct lightning
strike or nearby discharge. Thus, the final rule requirement in Sec.
450.163(a)(2) mirrors the proposed application requirement in Sec.
450.163(b)(2) to submit documentation providing evidence that the
vehicle is designed to protect safety-critical systems against the
effects of a direct lightning strike or nearby discharge.
Virgin Galactic expressed concern for the amount of time it would
take operators to redesign their vehicles to satisfy proposed Sec.
450.163(a)(2) and asked that the FAA ``grandfather'' currently licensed
operators out of this requirement. The FAA notes that Sec. 450.163(a)
provides two ways for an operator to mitigate natural and triggered
lightning and does not mandate a lightning-related design change. The
decision to pursue flight commit criteria versus a lightning-resistant
vehicle rests with the operator.
The performance-based standards set forth in Sec. 450.163 will be
accompanied by AC 450.163-1 ``Lighting Hazard Mitigation'' in the
future, which will contain one, but not the only, acceptable means of
compliance for Sec. 450.163(a)(1). The AC will include references to
NASA-STD-4010, as well as relevant standards for the design of a
vehicle to withstand the direct and indirect effects of a lightning
discharge. Commenters largely supported this approach. Blue Origin
noted that, while the Lightning Flight Commit Criteria adopted by the
FAA have successfully prevented lightning attachment to vehicles in the
past, operators may demonstrate that the avoidance criteria can be
satisfied with their specific mission profile and vehicle design.
Aerospace Corporation echoed support for enabling operators to
[[Page 79674]]
develop new methods and evaluations for lighting avoidance and
mitigation.
Regarding proposed Sec. 450.163(a)(1), two commenters expressed
concern that the FAA, in adopting only NASA-STD-4010 as an accepted
means of compliance for now, may not accept unique means of compliance
in the future. The Aerospace Corporation and Weather Modification
International argued the FAA should adopt prelaunch in situ measurement
of electric fields as a means of demonstrating compliance with Sec.
450.163, noting that NASA-STD-4010 is imperfect because it relies
exclusively on observable ground data.
The FAA considered using direct measurement of the electric field
within a cloud as an option for compliance with Sec. 450.163. However,
the ambient electrostatic field within and near electrified clouds can
vary rapidly in both space and time because of the charge separation
and redistribution processes inside and around the clouds, and because
lightning can rearrange this charge abruptly over distances of many
kilometers. Because no measuring technique today can be applied
everywhere simultaneously and it is difficult to prove that electric
field measurements taken near the flight path at an earlier time will
remain valid at the time of launch or landing, this option is not
viable on its own.
The FAA agrees that the optimal standards for avoiding and
mitigating natural and triggered lightning may be achieved through
technological advancement in the future. Currently, NASA-STD-4010 is
the only standard of which the FAA is aware that will satisfy the
requirements of Sec. 450.163(a)(1). However, ongoing research efforts
could soon allow for modifications of the NASA's Lightning Launch
Commit Criteria, providing additional means of compliance. As stated in
the NPRM, the FAA anticipates that industry will develop and submit new
standards to the FAA to serve as unique means of compliance under Sec.
450.35(b).
The FAA also acknowledges the suggestion of Weather Modification
International that the FAA take the lead in developing a definitive set
of lightning standards. The FAA has traditionally relied upon the
Lightning Advisory Panel, with its technical expertise in mitigating
lightning hazards, to develop lightning standards. The FAA relied upon
the lightning standards recommended by the Lightning Advisory Panel in
developing the lightning requirements in part 417. Given the
performance-based nature of this rule, the FAA is not prescribing a
particular standard for mitigating lightning hazards, but instead will
allow applicants to develop their own means of complying with Sec.
450.163. The FAA notes, however, that the means of compliance
identified, NASA-STD-4010, was developed by the Lightning Advisory
Panel, and thus, would achieve the same result that the commenter
requests.
Blue Origin commented that, to the extent the FAA looks to aircraft
lightning protection standards (e.g., AC 20-136B, AC 20-107B) to
determine the appropriate industry standards applicable to Sec.
450.163(a)(2), the agency should adopt only those standards clearly
applicable to space vehicles. The commenter added that the use of SAE
recommended practices would create an undue burden on applicants since
the SAE protection rules apply to transport aircraft, which require a
much higher level of safety than that prescribed by part 450.
The FAA agrees that only those aircraft standards which are
appropriate to apply to space vehicles should be used to assess
compliance with Sec. 450.163(a)(2).
kk. Flight Commit Criteria (Sec. 450.165)
In the NPRM, the FAA proposed in Sec. 450.165 that an operator
establish and observe flight safety rules in order to initiate flight.
The proposed rule also required an operator to establish and observe
flight abort rules in order to end flight. Proposed Sec. 450.165 would
require that an operator's flight safety rules include flight commit
criteria identifying each condition necessary to satisfy proposed Sec.
450.101 prior to initiating flight. These flight commit criteria would
include: (1) Surveillance; (2) monitoring of meteorological conditions;
(3) implementing window closures for the purpose of collision
avoidance; (4) monitoring the status of any FSS; and (5) any other
hazard controls derived from system safety, computing system safety, or
FSA.
In the final rule, the FAA adopts proposed Sec. 450.165 with
revisions. The FAA moves the flight abort rules proposed in Sec.
450.165(c) to Sec. 450.108. The discussion of the revisions related to
abort rules in proposed Sec. 450.165 is in the Flight Abort Rules
section of the preamble. The FAA combines proposed Sec. 450.165(a) and
(b) into a single paragraph (a) to reflect that this section now only
relates to flight commit criteria.
In addition, the FAA adds a requirement that the flight commit
criteria must include confirmation from the FAA that the risk to
critical assets satisfies the requirements of Sec. 450.101(a)(4) or
(b)(4). This requirement is consistent with the changes to the critical
asset requirements discussed earlier in the preamble and ensures that a
flight is not initiated if it does not meet the risk criteria. The FAA
will work with the applicant to create a streamlined process to achieve
this confirmation. The FAA anticipates that it will generally be able
to provide this confirmation well before the actual flight countdown.
Sierra Nevada commented that the use of the term ``surveillance''
may be broader than the FAA intended. The FAA discusses surveillance in
the preamble section for Control of Hazard Areas (Sec. 450.161).
ll. Tracking (Sec. 450.167)
In the NPRM, the FAA proposed vehicle tracking requirements,
including that an operator would be required to measure and record in
real time the position and velocity of the vehicle. The system used to
track the vehicle would be required to provide data to determine the
actual impact locations of all stages and components, and to obtain
vehicle performance data for comparison with the pre-flight performance
predictions. The FAA intended the proposed requirements to capture
current practice. As explained in the NPRM, tracking data sufficient to
identify the location of any vehicle impacts following an unplanned
event are necessary to ensure a proper response to an emergency.\177\
---------------------------------------------------------------------------
\177\ See 84 FR 15344.
---------------------------------------------------------------------------
CSF, SpaceX, SpinLaunch, and Virgin Orbit commented that the
proposed language in Sec. 450.167(a) could be interpreted as tracking
stages and components all the way down to the earth or body of water.
CSF also sought clarity regarding the intent of the requirement to
``provide data to determine the actual impact locations of all stages
and components,'' and whether this requirement would mean that
operators must predict the expected impact locations or actual impact
locations. To clarify this point, CSF, SpaceX, and Virgin Orbit
suggested using the phrase ``predict the expected impact locations''
rather than ``determine the actual impact locations.'' The FAA concurs
and adopts the recommended change in the final rule. The change more
accurately reflects the intent of the requirement.
Blue Origin commented that RCC 321 requirements to coordinate with
the FAA to ensure timely notification of any expected air traffic
hazard do not actually mention vehicle tracking, and that it may be
possible to provide
[[Page 79675]]
notification of traffic hazards without the need for tracking (such as
a straight up suborbital trajectory \178\).
---------------------------------------------------------------------------
\178\ A straight up suborbital trajectory is a nearly vertical
suborbital trajectory. ``Suborbital trajectory'' is defined in Sec.
401.5 as the intentional flight path of a launch vehicle, reentry
vehicle, or any portion thereof, whose vacuum instantaneous impact
point does not leave the surface of the Earth.
---------------------------------------------------------------------------
Tracking data is an important element of current practice used to
ensure the safety of people in aircraft. In the past, tracking vehicles
was inherently a part of flight abort and an important means to ensure
safety in the event of a mishap in which hazardous debris falls outside
of designated hazard areas. During launch or reentry operations that
lack the ability to inform the FAA rapidly of the volume and duration
of airspace for which an aircraft hazard is predicted following a
mishap, the FAA must close inordinately large regions of airspace to
provide a sufficient level of safety to aircraft flying in regions
where hazardous debris could fall in the event of a break-up. Although
RCC 321 does not call for tracking per se, the FAA finds tracking
essential to the safe and efficient integration of launch and reentry
operations into the NAS. For example, the Columbia accident in 2003
\179\ demonstrated that there is often a significant period of time
between a vehicle break-up and when hazardous debris reaches aircraft
altitudes. The time between vehicle break-up and when hazardous debris
reaches aircraft altitudes enables the FAA to close a minimum amount of
airspace while ensuring a high level of safety for aircraft flying in
regions where hazardous debris could fall in the event of a break-up.
As explained in the NPRM preamble, tracking data are generally
necessary to ensure a proper response to an emergency, facilitate
flight abort, obtain vehicle performance data for comparison with the
preflight performance predictions in accordance with Sec. 450.103(d),
and facilitate safe and efficient integration of launch and reentry
operations into the NAS. Therefore, the final rule is consistent with
the NPRM and current practice.
---------------------------------------------------------------------------
\179\ See Report of Columbia Accident Investigation Board at
https://www.nasa.gov/columbia/home/CAIB_Vol1.html.
---------------------------------------------------------------------------
CSF, Leo Aerospace, Microcosm, Sierra Nevada, and SpaceX commented
that the proposed language regarding tracking was too broad and would
seem to require an operator to track pieces of debris to impact during
an off-nominal event. As clarified by the FAA during the public comment
period in ``Answers to Clarifying Questions Received by June 28, 2019''
and ``Answers to Clarifying Questions Received by July 29, 2019,'' the
term ``all stages and components'' does not mean that all debris must
be tracked to the ground after a vehicle breakup.
CSF and SpaceX suggested adding the word ``nominal'' to this
requirement when referring to flight tracking. The FAA declines to
adopt this change because it is important to track during off-nominal
trajectories as well, including during normal flight and for off-
trajectory malfunctions at least until flight abort is initiated or
vehicle break-up occurs. Tracking data can enable an appropriate
response to an off-nominal situation, such as where to evacuate the
public to protect against predicted toxic fumes or where to apply fire
suppression resources.
Blue Origin, CSF, and SpaceX commented that real time telemetry is
often not possible for the entire mission, such as when a vehicle
passes over the horizon or during a reentry blackout period. The FAA
concurs with the commenters that real time telemetry is not always
possible. In the past, there were times during reentry that the
presence of plasma typically blocked vehicle-to-ground communications.
More recently, space-based tracking and communications have made it
feasible to overcome reentry plasma and over the horizon limitations.
However, the final rule does not require operators to use space-based
tracking and communications to meet Sec. 450.167 unless it is
necessary to protect public safety, safety of property, and national
security and foreign interests of the United States. The FAA does not
currently foresee any licensed launch or reentry activity that will
require the use of space-based tracking to protect public safety,
safety of property, and national security and foreign interests of the
United States. Furthermore, ``real time'' does not mean ``zero lag
time.'' The tracking must be sufficient to meet the requirements in
Sec. 450.167(a) to predict the expected impact locations and obtain
vehicle performance data for comparison with pre-flight predictions.
The FAA would not hold an operator accountable if there was some lag
for reasons outside of the operator's control. The FAA believes that
this leeway answers Blue Origin's recommendation that tracking
requirements be limited to phases of launch or reentry vehicle flight
identified in Sec. 450.113(a), since on-orbit tracking is not
practical.
mm. Launch and Reentry Collision Avoidance Analysis Requirements (Sec.
450.169)
In the NPRM, the FAA proposed to update the information required
for launch collision avoidance (LCOLA) and expand the analysis
requirements to determine launch and reentry window closures, including
updated protections for human spaceflight and additional closures to
protect active payloads and prevent orbital debris generation. The FAA
proposed that all operators would be required to come into compliance
with the LCOLA requirements by the effective date of the rulemaking.
In the final rule, the FAA adopts Sec. 450.169 with revisions. The
finalized LCOLA rules better align with the existing processes used at
Federal sites, provide adequate orbital safety measures for launch and
reentry operations, and incorporate updated options for collision
avoidance analysis. The FAA maintains that all operators must come into
compliance with the LCOLA requirements by the effective date of this
rule. The FAA adds the words ``are met'' to Sec. 450.169(b) to fix a
typographical error in the NPRM.
For an orbital or suborbital launch or reentry, Sec. 450.169(a)
requires an operator to establish window closures needed to ensure that
the launch or reentry vehicle, any jettisoned components, or payloads,
meet the identified requirements with respect to orbiting objects, not
including objects being launched or reentered as part of the same
launch or reentry activity (e.g., dual manifested payloads). In
performing a launch or reentry collision avoidance analysis against
inhabitable objects, an operator may choose to stipulate an ellipsoidal
separation distance, a spherical separation distance, or satisfy the
probability of collision threshold (1 x 10-\6\). Collision
avoidance analyses must also account for other orbital objects, such as
spacecraft, and tracked debris. For these uninhabitable active objects,
operators must satisfy either a less restrictive probability of
collision threshold (1 x 10-\5\) or a spherical separation
distance of 25 km. As discussed more fully later, in response to
comments, the FAA revises Sec. 450.169(a)(3), which covers all other
known orbital debris, so that operators must maintain either a
spherical separation distance of 2.5 km or a less restrictive
probability of collision threshold (1 x 10-\5\) from orbital
debris that is medium or large in size (radar cross section greater
than 0.1m\2\), as identified by the FAA or another Federal Government
entity.
The FAA also received a number of comments to proposed Sec.
450.169(d), which identified when LCOLA analysis would not be required.
This section was not a new requirement, but a consolidation of the
existing regulations, Sec. 417.231(d) and Appendix C to part 417 under
C417.11. As
[[Page 79676]]
proposed, an LCOLA analysis would not be required if the maximum
altitude attainable by a launch operator's suborbital launch vehicle
and any released debris is less than 150 km. The proposed requirement
stated that the maximum altitude attainable is an optimized trajectory,
assuming maximum performance within 99.7 percent confidence bounds,
extended through fuel exhaustion of each stage, to achieve a maximum
altitude.
SpaceX opposed the requirement that LCOLA exclusions (launch and
reentry window closures) be based on fuel depletion trajectories or the
maximum attainable altitude of a launch vehicle. SpaceX commented that
both bases exceeded the scope of past requirements and requested that
LCOLA exclusions be based exclusively on the maximum performance case.
SpaceX also recommended the FAA delete proposed Sec. 450.169(d) due to
unclear technical or public safety benefits. Blue Origin recommended
that fuel exhaustion from each stage be excluded from proposed Sec.
450.169(d) because remaining fuel will always be required to land RLVs.
The FAA disagrees with the recommendation to remove Sec.
450.169(d). The FAA notes that, without this subsection, operators
would need to conduct LCOLA analyses for all launches, regardless of
altitude. The FAA has determined that no LCOLA analysis is needed for
missions that do not exceed 150 km in altitude because orbital objects
below this level are exceedingly sparse and usually are not present for
long durations. Furthermore, launch operators currently do not provide
trajectories for stages or objects that do not exceed 150 km. As such,
it is appropriate to specify in the regulation when the LCOLA analysis
is not required.
The FAA agrees, however, that the language proposed in Sec.
450.169(d) did not reflect current practice and could prove
impracticable. The requirement for accomplishing LCOLA for all objects
launched over 150 km was complicated by existing regulatory language on
maximum altitude calculations. LCOLA is accomplished using only the
nominal trajectory provided by the launch or reentry operator. No
screening is accomplished using maximum possible altitudes because
there is no planned trajectory to screen, and the FAA did not intend
for operators to develop alternate trajectories. Therefore, the FAA
revises Sec. 450.169(d) so that no LCOLA is required if the object's
maximum planned altitude is less than 150 km.
Similarly, the FAA revises Sec. 450.169(b)(1) to require LCOLA
analysis only for the entire segment of flight of a suborbital launch
vehicle above 150 km. The FAA agrees with SpaceX's comment that
requiring operators to conduct LCOLA analyses below 150 km is
unnecessary and would prove burdensome. This revision is consistent
with the requirements for orbital vehicles and acknowledges that only
the portions of flight above 150 km are screened in either case.
Virgin Galactic recommended that proposed Sec. 450.169(d) be
retitled, ``Applicability.'' SpaceX recommended the regulation refer to
a ``body'' or ``object,'' rather than ``suborbital'' or ``debris.'' The
FAA agrees with Virgin Galactic and SpaceX that these terms and the
title could be clearer and more consistent with current usage. The FAA
retitles Sec. 450.169(d) ``Exception,'' which more accurately
describes this subsection, and substitutes ``object'' in place of
suborbital vehicle in Sec. 450.169(d).
Regarding requirements proposed in Sec. 450.169(a) and (b), the
FAA received numerous comments questioning the need for a 200 km keep-
away distance for human spaceflight and the absence of probability of
collision screening for debris. Numerous commenters also recommended a
narrower trajectory data requirement for suborbital launches.
An individual commenter stated that a spherical separation distance
of 200 km from inhabitable objects, as set forth in proposed Sec.
450.169(a)(1)(ii) and (a)(1)(iii), may not be appropriate due to
advances in spaceflight systems such as autonomous flight termination
systems (AFTS) and autonomous flight systems (AFS). The commenter
recommended the FAA allow the 200-km limit to be tailored depending on
the reaction time of the flight termination system. The commenter also
suggested the 200-km limit could be tailored if the launch vehicle
contains a traffic collision avoidance system (TCAS) (akin to what
aircraft use to avoid planes) that can reasonably avoid nearby crewed
vehicles.
The FAA disagrees that a spherical separation distance of less than
200 km is appropriate for inhabitable objects. No termination systems
are currently used in orbit, and termination systems are not likely to
be viable safety measures in orbit. The 200 km safety standoff distance
is only for orbital spaceflight protection; it is not a separation
standard for airspace integration. An orbital termination system would
increase the danger to human spaceflight and increase the orbital
debris population. Safety and efficiency must be accomplished with a
screening prior to launch. Launch vehicles do not have TCAS-like
operations and are not expected to acquire such capabilities.
SpaceX asked the FAA to explain why Sec. 450.169(a)(3) requires
operators to screen orbital debris greater than 10 cm\2\ against a
spherical miss distance of 2.5 km, rather than meet a probability of
collision threshold, as the FAA allows for inhabitable objects and
active payloads. SpaceX stated that the requirement to maintain a
spherical miss distance, without the option to evaluate probability of
collision, is more restrictive than current requirements and
inconsistent with USAF practices. SpaceX argued there should be an
option to waive miss distance less than 2.5 km if probability of
collision is sufficiently low, as is done for active payloads.
The FAA agrees with SpaceX that probability of collision could be
used for medium and large orbital debris because those objects are
routinely well-tracked and have valid orbital covariances available.
This option would provide for higher fidelity screening of collisions
that could produce significant amounts of orbital debris. As such, the
FAA revises Sec. 450.169(a)(3) to allow operators to screen for
orbital debris identified by the FAA or other Federal Government entity
using either a spherical separation distance of 2.5 km or a less
restrictive probability of collision threshold (1 x 10-\5\).
The use of probability of collision will require realistic covariance
data on both the launching object and the screened orbital object to
produce meaningful results. Operators who do not provide realistic
covariance will be required to have the launch or reentry screened with
stand-off distance. The probability of collision threshold required for
debris is the same as that required for active payloads in Sec.
450.169(a)(2), which mirrors current USAF requirements. The USAF
requirements for debris screening use the same probability of collision
as a high-fidelity analysis in place of both 25 km and 2.5 km standoff
screening. The FAA slightly relaxed the debris screening size
requirement to include only medium (0.1 m\2\ to 1 m\2\) and large
objects (greater than 1 m\2\) in order to provide for accurate use of
probability of collision analysis. Medium and large debris objects are
well-tracked, and the U.S. Government maintains accurate covariance on
these objects. This requirement achieves the objectives stated in the
NPRM of avoiding conjunction analysis with micro-debris, while
preventing the generation of space debris since these objects are well-
tracked and capable of
[[Page 79677]]
creating significant amounts of persistent space debris in the event of
a collision.
In proposed Sec. 450.169(f), the FAA would require an operator to
prepare a collision avoidance analysis worksheet for each launch or
reentry using a standardized format that contains the input data
required by Appendix A to part 450. Proposed Sec. 450.169(f)(1) would
require an operator to file the input data with a Federal entity
identified by the FAA and with the FAA at least 15 days before the
first attempt at the flight of a launch vehicle or the reentry of a
reentry vehicle or in a different time frame in accordance with
proposed Sec. 404.15. Proposed Sec. 450.169(f)(2) would require an
operator to obtain a collision avoidance analysis performed by a
Federal entity identified by the FAA 6 hours before the beginning of a
launch or reentry window.
CSF and SpaceX requested the FAA alter proposed Sec. 450.169(f)(1)
to require operators to file input data 7 days before launch or reentry
rather than 15 days. The commenters stated the 15-day requirement
conflicts with current processes at Federal launch or reentry sites,
which allow submissions 7 to 10 days before launch or reentry. CSF and
SpaceX stated that 7 days prior to launch has proven sufficient to
produce screening results by 6 hours before launch. CSF and SpaceX also
indicated that the requirement to obtain final results 6 hours before
launch was inconsistent with current practice. The Federal entity
performing LCOLA screenings delivers the final data hours before
launch. CSF and SpaceX recommended adding a clause to proposed Sec.
450.169(f)(2) allowing trajectory data to be delivered within timelines
agreed to by the launch operator and the entity performing the
screening. Alternatively, SpaceX recommended the FAA either require the
data be submitted 3 hours before launch in Sec. 450.169(f)(2), as
currently practiced by the USAF, or allow operators flexibility to
obtain LCOLA data ``within'' 6 hours of the launch or reentry window
beginning, but no later than 3 hours before launch.
The FAA partially agrees with CSF's and SpaceX's recommended
changes to the timelines established in Sec. 450.169(f)(1) and (f)(2).
For launch or reentry operations that have successfully developed an
internal process that results in repeatable LCOLA data submission, the
FAA recognizes that 7 days prior to launch is an adequate time for
Federal entities to process the LCOLA data based on recent LCOLA
submissions reviewed for the last year. The FAA revises Sec.
450.169(f)(1) to require that most operators submit LCOLA data at least
7 days in advance of launch or reentry. However, the FAA disagrees that
a shorter time frame would be appropriate for operators that have not
yet conducted launch or reentry activities. The FAA has repeatedly
noted that LCOLA data submitted from first-time launch or reentry
operators often require significant reiterative work to achieve an
acceptable submission. As such, the FAA will require operators that
have not yet received conjunctive assessments to submit LCOLA data at
least 15 days in advance of launch or reentry. This approach is similar
to that of the USAF, which requires entities that have not yet received
conjunctive assessments to submit LCOLA data 30 days in advance of
launch. The FAA revises Sec. 450.169(f)(1)(i) to require that entities
that have not yet received conjunctive assessments to submit LCOLA data
at least 15 days in advance of launch. All other operators must submit
LCOLA data at least 7 days in advance of launch.
The FAA agrees that the requirement to receive results within 6
hours before beginning of the launch or reentry window could be reduced
to 3 hours. Later delivery will produce LCOLA results that are timelier
and therefore more accurate for orbital safety purposes. Therefore, the
FAA revises Sec. 450.169(f)(2) to alter delivery to 3 hours before
beginning of the launch or reentry window.
Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that
much of proposed Sec. 450.169(a) focused on analysis that was not
applicable to operators since applicants do not have the data and tools
to perform LCOLA analysis, but merely provide inputs and implement
operational windows based on closures provided. The commenters
advocated for a streamlined commercial process for licensed launches or
reentries that do not occur at a Federal launch or reentry site, in
which the FAA would take the applicant's trajectory inputs to the
Federal agency responsible for LCOLA analysis and establish stay-out
windows. The commenters argued a standardized process would eliminate
the need for multiple applicants to establish interfaces and procedures
with an agency that rarely deals with commercial (space transportation)
entities.
The FAA declines to streamline the LCOLA process further by
removing the analysis requirements of Sec. 450.169(a), such that
applicants only need to provide data and abide by results. Transparency
in LCOLA analysis provides confidence and understanding of the LCOLA
process for launch, reentry, and payload, for operators as well as the
public.
The same commenters noted that the FAA could act as a go-between
entity for all operators in a similar manner to Federal sites'
processes. The FAA agrees that operators could use the FAA or the
Federal sites as conduits to the LCOLA processing entity and recognizes
that this flexibility remains in the final rule language. This type of
activity is appropriately coordinated during the launch operator or
reentry operator pre-application discussions. The FAA disagrees with
requiring the FAA to act as a pass-through because the FAA believes
that removing launch operators from direct contact with the USAF 18th
Space Control Squadron could have unintended negative consequences. For
instance, an early orbit breakup emergency may require prompt exchange
of data between launch operators and on-orbit support services
providers using processes already tested during LCOLA development and
adding a pass-through element could hamper or slow analysis,
notifications, and potential mitigation actions. Moreover, the FAA does
not place orbital safety analysts on duty during launch or reentry
operations. To adequately support the passthrough, the FAA would need
to establish launch support teams and exercise the team in advance of
emergency operations.
Blue Origin and SpaceX recommended the FAA allow LCOLA analyses to
be conducted by non-Federal entities. Blue Origin recommended that
proposed Sec. 450.169(e) require LCOLA analyses be obtained from
Federal entities, unless otherwise agreed to by the Administrator.
SpaceX recommended proposed Sec. 450.169(f) allow operators to file
input data and obtain LCOLA analyses from approved third parties, as
opposed to Federal entities. SpaceX argued the FAA should foster a
competitive market and allow flexibility in using commercial services
as commercial entities enter the space situational awareness (SSA)
market and aim to provide the same services as Federal entities. Virgin
Galactic asked if the FAA anticipated a cost associated with obtaining
the analysis from the Federal entity.
The FAA declines to remove the reference to Federal entities in
Sec. 450.169. Although commercial entities are developing space
traffic support services that could eventually provide adequate safety
for launch collision avoidance, to date, only Federal entities have
full access to the authoritative catalog maintained by the DOD. Rather
[[Page 79678]]
than remove this clause, the FAA adds the phrase, ``or another entity
agreed to by the Administrator,'' to Sec. 450.169(e) in order to
provide flexibility should the space traffic authority and framework
change over time. The Administrator may allow another entity to provide
this service based on a demonstration that the data includes a complete
and accurate catalogue of all identifiable objects in the relevant
space environment. Currently, the DOD is the only entity that meets
this criterion. In response to Virgin Galactic's question regarding
cost, the current LCOLA analysis from the U.S. Government is provided
free of charge.
SpaceX recommended the FAA defer to or allow operators to use the
LCOLA processes and standards of Federal launch or reentry sites for
launches from Federal sites as means of compliance. SpaceX argues that
doing so would minimize confusion regarding the applicable standards
and procedures at different operating sites. SpaceX also suggested that
Sec. 450.169(e) be revised to state that operators may use Federal
launch or reentry site services with existing policies and processes to
ensure acceptable compliance.
The FAA declines to defer to the Federal launch or reentry sites.
The FAA and Federal sites have different waiver requirements and
processes. The FAA finds the language as proposed in the NPRM is
adequate when coupled with the existing waiver process and equivalent
level of safety process. In addition, the FAA notes that launches from
non-Federal sites are not required to follow Federal site practices,
and using a single FAA standard minimizes confusion both on and off
Federal launch or reentry sites.
Citing the discrepancy between the proposed collision avoidance
analysis and current USAF practice, CSF stated the proposed rule
attempted to ``fix'' parts of the licensing process that were not
broken.
The FAA disagrees that the collision avoidance analysis process is
incompatible with the current USAF practice. The procedures for launch
collision avoidance under Sec. Sec. 417.107, 417.231, 417.31, and
417.43 did not reflect current practice as they excluded any
probability of collision, referenced outdated processes and agencies,
and required outdated adjustments to closures. The updated LCOLA
process is compatible with USAF practices where appropriate (e.g.,
LCOLA timelines, screening options for human spaceflight protection,
and active payload protection), noting that the FAA regulation must
also guide operations of launch and reentry operations at non-Federal
sites.
nn. Safety at End of Launch (Sec. 450.171)
In the NPRM, the FAA proposed in Sec. 450.171 (Safety at End of
Launch) requirements for the prevention of creating orbital debris,
with which an applicant would be required to demonstrate compliance in
its application.
In the final rule, the FAA adopts Sec. 450.171 as proposed. The
FAA did not receive comments on these proposed requirements.
oo. Mishap (Definition, Sec. Sec. 450.173 and 450.175)
i. Mishap Definition
In the NPRM, the FAA proposed to consolidate the definitions of
``Mishap,'' ``Launch Accident,'' ``Launch Incident,'' ``Reentry
Accident,'' ``Reentry Incident,'' ``Human Spaceflight Incident,'' and
``Launch Site Accident'' under the definition of ``Mishap'' in Sec.
401.5. The FAA proposed four mishap categories, from most severe (Class
1) to least severe (Class 4).
In the final rule, the FAA does not adopt the proposed
classification system. Instead, the FAA combines the substantive
criteria of Mishap Classes 1 through 4 under the definition of
``mishap'' in Sec. 401.7. The revised definition describes events that
constitute a mishap in a straightforward manner that better corresponds
to regulatory requirements. The FAA incorporates additional changes to
the final rule as discussed in the following paragraphs.
Numerous commenters from industry expressed confusion about the
types of activities that would fall under each class. The commenters
questioned the necessity of classifying mishaps based on severity since
the regulatory requirements were largely the same for all mishaps.
The FAA reviewed the regulatory requirements associated with each
of the proposed mishap classes and agrees there were no significant
differences among the regulatory requirements for each class. The
requirements to report, respond to, and investigate mishaps are
incumbent upon an operator regardless of a mishap's severity. Mishap
classes are not needed to achieve the objective of consolidating
mishap-related terms and streamlining the requirements to report,
respond to, and investigate mishaps. Accordingly, the FAA removes the
proposed classification system. Except as discussed later in this
preamble, the criteria proposed under each mishap class have been
consolidated under ``mishap'' in Sec. 401.7.
In the NPRM, the FAA proposed that a Class 1 mishap would include
any event resulting in (1) a fatality or serious injury (as defined in
49 CFR 830.2) resulting from licensed or permitted activity to any
person who is not associated with the licensed or permitted activity,
or (2) a fatality or serious injury to any space flight participant,
crew, or government astronaut. This proposal was consistent with
longstanding definitions of ``launch accident'' and ``reentry
accident'' in Sec. 401.5.
A fatality or serious injury to a person associated with licensed
or permitted activity constitutes a mishap under Sec. 401.5, rather
than a launch or reentry accident. The FAA proposed to incorporate each
of the mishap-related terms found in Sec. 401.5 under the definition
of ``mishap.'' \180\ As such, save for the removal of the $25,000
monetary threshold, all events that meet the current accident,
incident, and mishap definitions would continue to be mishaps under the
consolidated definition.\181\ In combining the mishap-related terms,
the FAA inadvertently excluded from the proposed definition a fatality
or serious injury to persons associated with licensed or permitted
activity, which has been covered by the term ``mishap'' in Sec. 401.5.
The FAA did not intend to depart from current practice by excluding
these serious events from the definition, as evidenced by the NPRM
preamble. In revising the definition of ``mishap,'' the FAA stated its
intent to streamline and clarify existing definitions, eliminate the
monetary threshold, and consolidate the accident and incident
investigation sections of parts 417, 420, 431, 435, 437 into one
section applicable to all licenses, permits, and vehicles.\182\ In
proposing to consolidate existing definitions, the FAA did not propose
to narrow the scope of activities deemed a mishap. In the final rule,
the FAA revises the definition of ``mishap'' to include any fatality or
serious injury resulting from licensed or permitted activity,
irrespective of the person's involvement in the launch activity.
---------------------------------------------------------------------------
\180\ 84 FR 15351 (``The proposed mishap classification system
would streamline and clarify the current accident, incident, and
mishap definitions to create four mishap categories organized by
severity, from most severe (Class 1) to least severe (Class 4).'').
\181\ 84 FR 15352.
\182\ 84 FR 15351.
---------------------------------------------------------------------------
The FAA consolidates under paragraph (1) of the definition those
criteria proposed for Mishap Class 1 and the previous definition of
``mishap'' in Sec. 401.5. This revision is consistent with the mishap
reporting requirements
[[Page 79679]]
under Sec. 450.173(c)(1) for the occurrence of a fatality or serious
injury during FAA-authorized activities. The FAA removes the phrase
``including ground activities at a launch or reentry site'' from the
criterion addressing fatality or serious injury because the phrase
``events associated with a licensed or permitted activity'' adequately
covers such activities.
In the final rule, the FAA re-designates criterion (1) of proposed
Mishap Class 2 as paragraph (2) of the definition, which applied to the
malfunction of an FSS or safety-critical system. The FAA notes that it
removed the term ``flight safety system'' from paragraph (2) because an
FSS is a safety-critical system.
Paragraph (7) of the definition consolidates two criteria proposed
under Class 3 and 4 for permanent loss of a vehicle during licensed and
permitted activity, respectively. Since the FAA is discarding the
mishap classification system, there is no longer a need to
differentiate loss of a launch or reentry vehicle during licensed
versus permitted activity. Nor does the FAA intend to differentiate
loss of a ``vehicle'' from loss of a ``launch or reentry vehicle.''
The FAA proposed to replace the clause, ``failure to complete a
launch or reentry as planned,'' in the previous definition of
``mishap'' in Sec. 401.5, with the clause, ``failure to achieve
mission objectives.'' AIA, Sierra Nevada, and SpaceX objected to this
criterion, arguing that failure to achieve mission objectives related
to mission assurance and exceeded the FAA's authority to ensure public
safety.
Based on industry comments, the FAA reverts to the original phrase,
``failure to complete a launch or reentry as planned,'' but adds a
citation to a regulatory requirement that narrows the scope of this
criterion. Failure to complete a launch or reentry according to the
parameters provided by the operator under the pre-flight reporting
requirements of Sec. 450.213(b) \183\ will constitute a mishap. This
criterion more accurately reflects the scope of activities that the FAA
deems to be a mishap and alleviates the commenters' concerns about
mission assurance.
---------------------------------------------------------------------------
\183\ As discussed later in the preamble, Sec. 450.213(b)(2)
requires a licensee to submit planned mission information, including
the vehicle, launch site, planned flight path, staging and impact
locations, each payload delivery point, intended reentry or landing
sites including any contingency abort location, and the location of
any disposed launch or reentry vehicle stage or component that is
deorbited.
---------------------------------------------------------------------------
The FAA removes from the final rule all references to the proposed
mishap classes. The FAA revises Sec. 450.131(a)(2) to clarify that a
probability of failure analysis must account for data on any mishap and
anomaly. While the NPRM stated that the probability analysis must
account for all partial failures and anomalies, ``including Class 3 and
Class 4 mishaps,'' the language implied that it would also apply to
Class 1 and Class 2 mishaps--the more severe events. The FAA replaces
the mishap classes referenced in Sec. 450.173(a) with the term,
``mishap.'' Finally, the FAA replaces the mishap classes referenced in
Sec. 450.219(b) with a reference to the portion of the mishap
definition that corresponds to the proposed requirement: Events listed
in paragraphs (1) through (5) and (8).
The removal of the mishap classes dispenses with commenters'
requests for clarification or guidance in ACs on applying and
differentiating the proposed mishap classes.
The final rule adds three changes to sections that cross-reference
the mishap-related terms that the FAA proposed to replace with the
revised mishap definition: Sec. Sec. 420.61(b), 437.87(b), and
460.45(d). The FAA replaces the term ``launch or launch site accident''
in Sec. 420.61(b) with a reference to the portions of the mishap
definition that replace these terms: Paragraphs (1), (5), and (8). The
FAA also replaces the word ``shall'' with the word ``must'' in Sec.
420.61 because ``shall'' is no longer used in FAA regulations.
Similarly, in Sec. 437.87(b), the FAA replaces the phrase, ``launch or
reentry accident or incident,'' with a reference to corresponding
portions of the mishap definition in paragraphs (1) through (3), (5),
and (8). As noted in the section of this preamble discussing the
compliance period for legacy licenses (Sec. 450.1(b)), the FAA revises
Sec. 460.45(d) to require part 415, 431, and 435 licensees to apply
the mishap-related definitions in Sec. 401.5, and part 450 licensees
to apply the definitions in Sec. 401.7 when describing the safety
record of the vehicle to space flight participants. Specifically, Sec.
460.45(d)(1) requires that part 450 licensees identify events that meet
paragraphs (1), (4), (5), and (8) of the definition of a mishap in
Sec. 401.7, which occur during and after vehicle verification
performed in accordance with Sec. 460.17.
The FAA also revises Sec. 420.59 to identify the portions of the
mishap definition applicable to launch site operators licensed under
part 420. Not all of the events described under the definition of
``mishap'' apply to part 420 licenses, which do not authorize launch or
reentry activities, though the NPRM did not state this fact expressly.
Nor did the FAA intend the revised definition of ``mishap'' to expand
the scope of the previous ``launch site accident'' definition under
part 420. The FAA therefore revises Sec. 420.59(a) to state that a
licensee must report, respond to, and investigate mishaps that meet
paragraph (1) or (5) of the definition of ``mishap'' in Sec. 401.7.
The FAA specified in the final rule that part 420 licensees must
prepare mishap plans that meet Sec. 450.173(b) through (f), including
allocation of roles and responsibilities between the launch operator
and site operator for reporting, responding to, and investigating any
mishap during ground activities at the site, to specify the scope of
the mishap plan more accurately. The FAA also deletes the word
``response'' in Sec. 420.59(a) since Sec. 450.173 and the rest of
Sec. 420.59 refer to a ``mishap plan,'' not a ``mishap response
plan.''
AIA and Virgin Galactic commented that the term ``failure of a
safety organization'' in the ``mishap'' definition was unclear. The FAA
notes this term previously appeared under ``launch incident'' and
``reentry incident'' in Sec. 401.5. ``Failure of a safety
organization'' occurs when an operator fails to complete an action
expected or required by the safety organization, or when the
organization stops functioning normally, such that it creates a public
safety risk. For example, the FAA would consider an operator's failure
to follow existing safety processes or procedures, thereby placing the
public at risk, a failure of a safety organization. Additional examples
include (1) the failure of operator personnel to communicate a hold
condition upon a violation of launch commit criteria, (2) a safety
official failing to report potential safety matters to the mission
director, or (3) the failure of an organization to recognize and
mitigate a hazard, resulting in a public safety risk. No change was
made to the regulation based on this comment.
SpaceX and Virgin Galactic sought clarification on the meaning of
``high risk'' of causing serious or fatal injury and ``substantial
damage'' to property. SpaceX requested examples of high risk versus
non-high risk events. AIA asked how the FAA would determine whether an
event rises to the level of ``high risk.'' Virgin Galactic recommended
``high risk'' be defined in Sec. 401.5 as an event that would have
caused a casualty had one or more humans been present.
The FAA has used ``high risk'' of causing serious or fatal injury
to define ``human space flight incident'' in Sec. 401.5. As stated in
the FAA's ``Answers to Clarifying Questions
[[Page 79680]]
Received by June 28, 2019,'' \184\ the FAA would consider any off-
nominal event during pre-flight or flight operations that posed a high
probability of fatality or serious injury to spaceflight participants,
crew, government astronauts, or the public, to be ``high risk.'' The
FAA stated in the NPRM that it would determine on a case-by-case basis
whether damage to property not associated with the licensed activity is
``substantial damage,'' based on such factors as direct replacement
cost, repair cost, and the property's intended use and functionality.
When making a substantial damage determination, the FAA will include
damage caused by debris impacts, toxic plumes, and fires ignited by the
vehicle or its debris. The FAA provided, as an example, structural
damage to public property exceeding 50 percent of its market value,
such as a failed launch attempt with debris impacts outside a defined
hazard area resulting in a post-impact fire and loss of a residential
structure. The FAA will evaluate unplanned damage to property
associated with a licensed or permitted activity on the same bases.
Examples might include a major repair or replacement of launch
facilities due to an unsuccessful launch attempt, including processing
facilities, launch pads, or propellant tanks, based on cost of repair
or replacement or loss of use. Similar to the NTSB's definition of
``substantial damage'' (49 CFR 830.2), under paragraph (6) of the
``mishap'' definition in Sec. 401.7, the FAA may deem any damage that
adversely affects the structural strength, performance, or flight
characteristics of a launch or reentry vehicle which normally require
major repair or replacement of the affected component, to be
substantial.
---------------------------------------------------------------------------
\184\ See FAA-2019-0229-0106.
---------------------------------------------------------------------------
The FAA declines Virgin Galactic's suggested definition of ``high
risk'' because the suggested standard is too narrow and would exclude
serious injury short of fatality. As noted above, the FAA would
consider any off-nominal event during pre-flight or flight operations
that pose a high probability of fatality or serious injury to
spaceflight participants, crew, government astronauts, or the public,
to be high risk. The FAA intends ``high risk'' to cover events akin to
a near miss or close-call. This approach is consistent with USAF and
NASA practices. Virgin Galactic's suggestion would prove impracticable,
requiring near certainty that a casualty would have occurred.
Virgin Galactic recommended the FAA prescribe a timeline and
specific process for determining whether ``high risk'' or ``substantial
damage'' occurred. Virgin Galactic suggested the FAA develop such a
process and incorporate it elsewhere in the regulations, not in the
definition of ``mishap.'' Virgin Galactic argued the FAA should have no
more than 14 days to make these determinations in order to minimize
operational impacts.
It would not be appropriate to limit the time frame or implement
procedures to determine whether an event posed a high risk of causing
serious or fatal injury or resulted in substantial damage to property.
Although the FAA will begin to evaluate a mishap upon receiving notice
and details of the event, the rate at which the FAA can make these
determinations will necessarily depend on the attendant circumstances
and information supplied by the licensee. Moreover, the FAA retains the
ability to modify its determination upon receipt of new information
about the mishap.
SpaceX recommended the FAA remove ``government astronauts'' from
the ``mishap'' definition because, unlike the uninvolved public, those
individuals accept risk by virtue of their informed involvement in a
vehicle's flight. Acceptance of risk does not preclude a fatality or
serious injury from being considered a mishap. The FAA removes the
references to space flight participants, government astronauts, and
crew from the ``mishap'' definition to make it clear that the FAA will
deem any fatality or serious injury associated with licensed or
permitted activity a mishap irrespective of whether persons are
involved in the licensed activity.
SpaceX recommended the Class 2 definition be limited to events
``during a licensed or permitted activity,'' rather than events
``associated with'' licensed or permitted activity. The commenter
offered no rationale for temporally limiting the criteria now described
in paragraphs (2) through (5) of the ``mishap'' definition, and the FAA
sees no reason to do so. The FAA would only deem a mishap those events
that are within the scope of the FAA's statutory authority. No change
to the regulation is made based on this comment.
Sierra Nevada commented that treating the impact of a vehicle,
payload, or components thereof ``outside the designated area'' as a
mishap was overly prescriptive and unrealistic. Sierra Nevada commented
that since hazard areas are generated as probability contours, not
contours of total containment, debris could realistically exist outside
the hazard area that would not warrant segregation in the event of a
breakup scenario. Sierra Nevada also recommended removing from proposed
Sec. 450.173(d) the requirement to report vehicle or debris impact
points outside the hazard area to the FAA, which it claimed was
burdensome, cost prohibitive, and unreasonable.
The criterion cited by Sierra Nevada, now captured in paragraph (8)
of the mishap definition, does not require licensees to track every
possible piece of debris in an off-nominal scenario, but rather only
debris that presents a hazard to the public. The proposed criterion
closely followed the definitions of ``launch accident'' and ``reentry
accident'' in Sec. 401.5, but used ``hazard area'' in lieu of ``impact
limit lines'' and ``designated'' landing or reentry site, to be
consistent with the hazard analysis framework set forth in part 450. To
clarify the scope of this mishap criterion, the FAA replaces the term
``vehicle or debris'' in paragraph (8) with the term ``hazardous
debris,'' which is defined in Sec. 401.7. Thus, this criterion applies
to the impact of hazardous debris (i.e., debris capable of causing a
casualty or loss of functionality to a critical asset) outside the
planned landing site or hazard area. The occurrence of debris outside
the hazard area that does not meet the definition of ``hazardous
debris'' in Sec. 401.7 is not a mishap.
The FAA similarly revises Sec. 450.173(c)(3)(iv) to require that
operators identify ``hazardous debris'' impact points as part of a
preliminary mishap report, so that the FAA can assess potential public
safety risks. The FAA makes this change to be consistent with the new
definition of ``hazardous debris,'' and it is consistent with the
intent of the proposed regulation. The FAA also replaces the term
``impact area'' with the term ``designated hazard area'' to be
consistent with the terminology used in the mishap definition. This
revision does not change the scope of the requirement from the NPRM;
the FAA only requires an operator to report the hazardous debris impact
locations, not all debris impact locations. Use of the term ``hazard
area'' is also consistent with requirements for an operator to
establish ``hazard areas'' under part 450 to protect the public from
hazards associated with their operations.
The requirement to track and report hazardous debris is reasonable,
given that operators must employ vehicle tracking for normal flight,
and hazardous debris falling outside the designated area poses a
serious risk to public safety. In the event of a vehicle breakup,
operators should be able to approximate any hazardous debris impacts in
relation to the designated landing site or hazard area based on the
[[Page 79681]]
vehicle's last-known state vector or other tracking resources required
for normal flight.
ii. Mishap Plan (Sec. 450.173)
In the NPRM, the FAA proposed to consolidate mishap planning,
reporting, response, and investigation requirements under proposed
Sec. 450.173. The FAA also proposed to revise Sec. Sec. 420.59 and
437.41 to require an applicant to submit a mishap plan that meets the
requirements of Sec. 450.173. Proposed Sec. 450.173(c) required an
operator to report to and cooperate with FAA and NTSB investigations
and designate one or more points of contact for the FAA and NTSB.
Proposed Sec. 450.173(d) required operators to notify the FAA of
mishaps and submit a preliminary report within certain time frames.
Proposed Sec. 450.173(f) required that, in the event of a mishap, an
operator must investigate the root causes of the mishap and report
investigation results to the FAA.
Virgin Galactic broadly expressed support for the proposed rule.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended adding
to proposed Sec. 450.173(f) a requirement for licensees to support any
NTSB or government agency-led mishap investigation and to cooperate
with any other government investigative agencies.
The FAA declines to incorporate the suggested addition. Upon review
of the NPRM and comments received, the FAA determines that the
requirement originally proposed in Sec. 450.173(c) regarding NTSB and
FAA cooperation is unnecessary. Section 450.13 (Rights Not Conferred by
a Vehicle Operator License) plainly states that issuance of a license
does not relieve a licensee of its obligation to comply with all
applicable requirements of law or regulation. The duty of operators to
comply with lawful investigations, whether conducted by the FAA or
another entity with investigative authority, exists irrespective of the
language proposed in Sec. 450.173(c). Accordingly, the FAA removes
proposed Sec. 450.173(c) from the final rule. For the same reason, the
FAA also removes paragraph (b)(2) from proposed Sec. 420.59 (Mishap
Plan). Operators remain responsible for reporting investigation results
to the FAA under Sec. 450.173(e).
Sierra Nevada asked whether licensees must coordinate with the FAA
and NTSB for all mishaps. For the reasons stated above, the FAA removed
the requirement proposed in Sec. 450.173(c).
The National Fire Protection Association (NFPA) recommended the FAA
revise proposed Sec. 450.173(e), which contained emergency response
requirements, to require a level of safety based on its spaceport fire
safety and emergency response standards. The FAA supports the
development of industry consensus standards for fire safety and
emergency response, but disagrees that it would be appropriate to
prescribe such a code or standard in this performance-based rule.
In addition to removing proposed Sec. 450.173(c), the FAA replaces
the term ``vehicle and debris impact points, including those outside a
planned landing or impact area'' in proposed Sec. 450.173(d)(3)(iv)
with the term ``hazardous debris impact points, including those outside
a planned landing site or designated hazard area'' in Sec.
450.173(c)(3)(iv).\185\ This change is consistent with changes
previously discussed in the preamble. Lastly, the FAA revises the
emergency response requirements in Sec. 450.173(d)(1) to include the
term ``property'' because, as discussed in this preamble, the FAA
removed the reference to ``property'' from the definition of ``public''
in Sec. 401.7. The FAA adopts the rest of this section of the proposed
rule without change.
---------------------------------------------------------------------------
\185\ The FAA removes proposed Sec. 450.173(c) from the final
rule and re-designates Sec. 450.173(d) through (h) as Sec.
450.173(c) through (g).
---------------------------------------------------------------------------
iii. Test-Induced Damage (Sec. 450.175)
In the NPRM, the FAA proposed to give license applicants and
licensees the option to pre-coordinate testing activities with the FAA.
This pre-coordination would take place during FAA-licensed activities
to prevent the FAA from labeling test failures or associated damage as
mishaps.
In the final rule, the FAA adopts Sec. 450.175 with a
modification. Section 450.175 will only apply to licensees or license
applicants seeking this exception. The FAA will consider test failures
and damage covered by this section, including damage to ground support
equipment, ground support systems, and flight hardware, as test-induced
damage and not a mishap, so long as the failure falls within the pre-
coordinated scope and FAA-approved testing profile. Any mishap
resulting in a serious injury or fatality, damage to property not
associated with the licensed activity, or hazardous debris leaving the
pre-defined hazard area, will be treated as a mishap and not test-
induced damage, and will be subject to the reporting, response, and
investigation requirements of Sec. 450.173.
Several commenters expressed confusion about the effect of proposed
Sec. 450.175 on the part 450 licensing process. Boeing, Leo Aerospace,
Lockheed Martin, Northrop Grumman, and ULA asked how test-induced
damage would impact the licensing process. Boeing also commented that
all planned test operations within the scope of a license should be
assessed for public risk during the application process. Blue Origin
asked what type of test is contemplated by ``test-induced damage,'' and
if it would include tests conducted at a launch site with co-located
test facilities, as opposed to integrated vehicle tests that
traditionally happen at a launch site. Sierra Nevada and Microcosm
commented that testing was outside the FAA's jurisdiction, and the
proposed regulation should only apply to damage induced by a test
performed under a license.
The test-induced damage exception set forth in Sec. 450.175 only
applies to license applicants or licensees seeking a mishap exception
for test activities conducted during licensed activities. The test-
induced damage exception is optional. To clarify that the test-induced
damage exception is optional, the FAA adds paragraph (a)
(Applicability), which states that Sec. 450.175 only applies to
license applicants or licensees who choose to pre-coordinate and apply
for an optional test-induced damage exception. The FAA also replaces
the word ``operator'' with the term ``license applicants or licensees''
to clarify that this provision is only available through the part 450
licensing process. Experimental permittees under part 437, by contrast,
cannot seek to pre-coordinate test-induced damage with the FAA.
The exception does not apply to test activities that are not
associated with FAA-licensed activities, nor to any activities outside
FAA jurisdiction. The information submitted by the applicant will
define the scope and type of test activities considered for test-
induced damage. The FAA confirms that all planned test operations
occurring during the scope of a license will be assessed for public
safety risks. As stated in the FAA's ``Answers to Clarifying Questions
Received by June 28, 2019,'' test-induced damage refers to damage
expected to occur as part of a licensed activity approved by the FAA
prior to the operation. An applicant must identify expected outcomes
and potential risks associated with the proposed test activity. The FAA
expects an applicant to identify potential failure outcomes and their
consequences or risks, and plan for them appropriately. In order to
except damage from becoming a mishap, the applicant needs to identify
that potential damage to the
[[Page 79682]]
FAA. Unanticipated test damage may be excepted if it results from
activities conducted within the scope of the FAA approval, and does not
result in any of the events listed in Sec. 450.175(b)(2).
To seek an exception, an applicant must submit the information
listed in Sec. 450.175(c) to the FAA in advance with sufficient time
to evaluate the proposal. Although the FAA anticipates the amount of
time required to evaluate an applicant's proposal will be minimal, the
scope of review required will vary based on the proposed test
activities and completeness of information provided.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended
without explanation that the subheading for proposed Sec. 450.175(a)
be changed to, ``Coordination of risk of test-induced damage.'' The FAA
declines to incorporate this recommendation, as it does not accurately
describe the coordination set forth in Sec. 450.175. The possibility
of test-induced damage is assumed under Sec. 450.175. Identification
of potential risks associated with a testing activity is but one of the
items applicants must submit to seek an exception under this section.
The FAA agrees, however, that the proposed text was unclear, as the
heading used the term, ``anticipated,'' which does not appear in Sec.
450.175. Accordingly, the FAA revises the subheading for Sec.
450.175(b) to clarify that operators would be coordinating
``potential,'' rather than ``anticipated,'' test-induced damage.
Boeing, Lockheed Martin, Northrop Grumman, and ULA also
recommended, without explanation, that applicants be required to
coordinate test-induced damage with any affected third parties or
public authorities, in addition to the FAA. The FAA declines to
incorporate this recommendation. Section 450.175 provides a process for
license applicants and licensees to pre-coordinate with the FAA test-
induced damage that would otherwise fall under the FAA's definition of
``mishap.'' The FAA is the only entity with whom coordination will be
needed to seek exception from the FAA's ``mishap'' definition. It
should be noted, however, that pre-coordination of test-induced damage
under this section will not affect the duty of licensees to comply with
all other requirements of their license, and with all other applicable
laws and regulations.
In reference to what is now Sec. 450.175(b)(2), Boeing recommended
the FAA take into consideration insight gleaned from near-misses,
noting that while a test may not have resulted in damage, the same
anomaly could induce significant damage in a similar operational
sequence. The FAA acknowledges the commenter's concern for the net
effect of unreported anomalies but finds it unnecessary to change the
regulatory text. Section 450.175 provides an exception to the
``mishap'' definition. Test-induced damage that exceeds the scope of
FAA-approved activities will be treated as a mishap. It is possible for
an anomaly to occur during pre-coordinated test activities. Any
condition during licensed or permitted activity (including pre-
coordinated test activity) that deviates from what is standard, normal,
or expected during verification or operation of a system, process,
facility, or equipment is an anomaly under Sec. 401.7. Given that
Sec. 450.215 (Post-flight Reporting) requires operators to identify
anomalies and corrective actions taken in response in their post-flight
report, the FAA finds it will have notice of the ``near-miss''
anomalies referenced by the commenter.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended that
proposed Sec. 450.175(c) be made consistent with ground hazard
analysis requirements in proposed Sec. 450.185 or be deleted
altogether. The FAA disagrees with this comment because the
requirements of Sec. 450.185 apply to the entire launch and reentry
vehicle lifecycle, and are therefore much more comprehensive than the
information requirements for test-induced damage. Imposing ground
hazard analysis requirements would place an undue burden on applicants
seeking a test-induced damage exception. Moreover, the test-induced
paradigm is intended for the testing of a specific system, function, or
component during licensed activities. As stated in the NPRM, the test-
induced damage exception is not available for the operation of an
entire vehicle, but rather the testing of specific components and
systems. Lastly, unlike the ground hazard analysis requirements, the
information requirements of Sec. 450.175(c) only apply to applicants
seeking a mishap exception for damage resulting from specific test
activities taking place within a defined time-period, as coordinated
with and approved by the FAA.
pp. Unique Safety Policies, Requirements and Practices (Sec. 450.177)
In the NPRM, the FAA proposed requirements under Sec. 450.177 for
operators to implement unique policies, requirements, and practices
needed to protect the public health and safety, safety of property, and
the national security and foreign policy interests of the United
States. Proposed Sec. 450.177(a) would require an operator to review
operations, system designs, analysis, and testing, and to identify any
unique launch or reentry hazards not otherwise addressed by proposed
part 450. Proposed Sec. 450.177(b) would provide that the FAA may
identify and impose a unique policy, requirement, or practice, as
needed, to protect the public health and safety, safety of property,
and the national security and foreign policy interests of the United
States.
In the final rule, the FAA adopts Sec. 450.177 (Unique Safety
Policies, Requirements and Practices) with two revisions. For the
reasons discussed below, the FAA removes the references to property
protection and national security and foreign policy interests of the
United States, and adds ``safety'' to the section title.
CSF, Sierra Nevada, and Spaceport Strategies commented that
proposed Sec. 450.177(b) expanded regulatory uncertainty by allowing
the FAA to impose new requirements when needed to protect public health
and safety, safety of property, and national security or U.S. foreign
policy interests. CSF noted that part 417 previously allowed the FAA to
impose new requirements when needed ``to protect the public.'' CSF and
Sierra Nevada commented that proposed Sec. 450.177(b) expanded the
FAA's ability to impose requirements on an operator outside of
regulatory process even if the operator met all other criteria. The
commenters suggested that the ability to impose unknown requirements as
a result of innovation will adversely impact costs and could have a
chilling effect on innovation and investments in U.S. space industries
if the FAA's discretion under proposed Sec. 450.177 was unbounded.
They further contended that the proposed requirement would give the FAA
discretion to impose new requirements ``as-needed'' and result in no
cost savings. CSF also expressed concern that such requirements could
be inequitably imposed on a singular licensee or disparately among
licensees developing similar technologies or operational approaches.
CSF recommended the FAA be required to collaborate with the operator or
with industry before requiring a unique policy, rule, or practice. CSF
and Sierra Nevada recommended the rule be bounded to limit the scope
and timeline for the FAA to impose restrictions, and give applicants
due process.
The FAA agrees that it is unnecessary to include hazards to the
national security and foreign policy interests of the United States
under this section because those considerations are adequately covered
under policy and
[[Page 79683]]
payload reviews in part 450. In the final rule, the FAA removes
``national security and foreign policy interests of the United States''
from Sec. 450.177(b) and (c)(2).
In the final rule, the FAA also removes ``safety of property'' from
Sec. 450.177(b) and (c). As explained in other parts of this preamble,
the FAA is retaining in the final rule only specific requirements for
property protection (e.g. critical assets, property on orbit), which
have specific safety criteria. Operators may be required to mitigate
hazards to property through emergency response requirements in Sec.
450.173(d), but otherwise, the FAA declines to impose a more specific
property protection requirement at this time. Removal of the references
to property protection and national security and foreign policy
interests largely dispenses with the commenters' concerns that Sec.
450.177 would expand the scope of Sec. 417.127. Although the final
rule retains the provision in Sec. 450.177(b) regarding FAA's ability
to impose a unique requirement, policy, or practice needed to protect
public health and safety, the FAA does not foresee a substantive change
for operators from Sec. 417.127, which provides that FAA may impose
such unique requirements as needed to protect the public.
The FAA's authority to impose a unique requirement, policy, or
practice is bounded, as it is in Sec. 417.127, by the FAA's statutory
authority to protect public health and safety. The FAA understands the
concern expressed by Spaceport Strategies and others that the
imposition of unique policies, requirements, or practices deemed
necessary by the FAA to protect public health and safety has the
potential to impose additional costs on the operator. However, given
the rarity of the FAA's invocation of Sec. 417.127, and the prosperity
of today's commercial space industry under part 417, the FAA does not
foresee any additional costs to operators or a chilling of innovation
resulting from Sec. 450.177.
Moreover, as discussed in the NPRM preamble, the necessity for
Sec. 450.177 is the same as that for Sec. 417.127: The FAA expects
that advances in technology and implementation of innovations by launch
and reentry operators will likely introduce new and unforeseen safety
challenges. These advances and innovations can present regulatory
challenges that are unforeseen in existing regulations. In this case,
the FAA must work with operators on a case-by-case basis to identify
and mitigate those unique hazards posed to public health and safety,
which are not addressed by part 450. The FAA expects the need for the
use of this provision to be rare, as has the need to use Sec. 417.127,
due to the comprehensiveness and performance-based nature of part 450.
In the rare instance that it is used, the FAA will work with the
operator to reach a mutually satisfactory solution that allows the
activity while protecting public health and safety, but the FAA
declines to require collaboration in the regulation, as CSF suggests.
qq. Ground Safety (Sec. 450.179 to Sec. 450.189)
i. Ground Safety General (Sec. 450.179)
In the NPRM, the FAA proposed that an operator would be required to
protect the public from the adverse effects of hazardous operations and
systems associated with preparing a launch vehicle for flight,
returning a launch or reentry vehicle to a safe condition after flight,
or after an aborted launch attempt, and returning a site to a safe
condition.
In the final rule, the FAA adopts Sec. 450.179 with
revisions.\186\ This final rule moves proposed subsections (b) and (c)
to Sec. 450.179(a)(1) through (3) and adds new subsections (b) and
(c). These additions are discussed in more detail in the preamble
section addressing Launch and Reentries from a Federal Launch or
Reentry Site.
---------------------------------------------------------------------------
\186\ Proposed Sec. 450.179 required an operator at a U.S.
launch or landing site to protect the public from adverse effects of
hazardous operations and systems. The FAA changed ``protect the
public'' to ``protect the public and property'' in the final rule.
This change is because, as discussed earlier in this preamble,
property was removed from the definition of ``public.'' Thus,
``property'' was added to this section to keep the requirement
equivalent to what was proposed.
---------------------------------------------------------------------------
ii. Coordination With a Licensed Launch or Reentry Site Operator (Sec.
450.181)
In the NPRM, the FAA proposed that an operator would be required to
coordinate with site operators as both entities have public safety
obligations during ground operations. Operators would be required to
coordinate with site operators to ensure that access to public sites is
controlled and prevent unsafe interference of ground hazards. For a
launch or reentry conducted from or to an FAA licensed site, an
operator would be required to coordinate mishap reporting, response,
and investigations with the site operator for any mishap during ground
activities at the site.
In the final rule, the FAA adopts Sec. 450.181 as proposed with
two exceptions. In Sec. 450.181(a)(3), the ground hazard areas must be
coordinated with a site operator during the designation of those ground
hazard areas. In the final rule, the FAA changes the language used to
describe this coordination to ``[t]he designation of any ground hazard
area that affects the operations of a launch or reentry site is
coordinated with the Federal or licensed launch or reentry site
operator.'' This amended language is a minor grammatical change and is
consistent with the intent of the proposed requirement. In addition,
proposed Sec. 450.181(a)(4) required an operator to coordinate with a
site operator to ensure, in part, prompt and effective response in the
event of a mishap that could impact ``public safety.'' In the final
rule, the FAA changes this phrasing to require that a prompt and
effective response ``is undertaken'' in the event of a mishap that
could impact ``the safety of the public and property.'' The FAA changes
``public safety'' to ``the safety of the public and property'' in the
final rule because, as discussed earlier in this preamble, property was
removed from the definition of ``public.'' Thus, the FAA makes this
wording change to keep the requirement equivalent to what was proposed.
The FAA adds ``is undertaken'' as a minor grammatical change that is
consistent with the intent of the proposed requirement.
Sierra Nevada commented that proposed Sec. 450.181 seems to be
duplicative of proposed Sec. 450.147 (Agreements) and thus should be
removed. While agreements made with a Federal or licensed site operator
may satisfy the requirements of Sec. 450.181, the FAA finds the
requirement to coordinate with a site operator specifies what
coordination must be in place to prevent unsafe interference among
users of a site and ensure clear lines of responsibility for related
aspects of public safety. The FAA concurs that an applicant may be able
to show compliance with both requirements by providing an agreement
that shows compliance with the specific criteria in Sec. 450.181.
However, the two requirements are different and intentionally separate.
Specifically, Sec. 450.181 provides additional detail about
coordination that is necessary for public safety because improperly
coordinated neighboring operations that occur on or near the launch
site have the ability to create hazards to the public. In addition, the
agreement required by Sec. 450.147 is not an application deliverable,
whereas Sec. 450.181 requires an application deliverable. Accordingly,
the FAA adopts both Sec. Sec. 450.181 and 450.147.
Denver International Airport commented that, although it supported
the proposed requirements for
[[Page 79684]]
coordination with site operators, these requirements were too narrow to
keep site operators and surrounding communities properly informed.
Denver International Airport also commented that operators should be
required to coordinate on launch and reentry activities and mishaps
with a wider group of interested and affected stakeholders, including
first responders and local governments. Similarly, AAAE proposed that
licensed operators be required to notify contingent landing sites and
nearby airports of safety hazards, including providing them with the
ground safety hazard analysis. AAAE suggested such notifications could
be accomplished as part of the notifications required in proposed Sec.
450.147 or as part of a broader public disclosure.
The FAA notes that the notification requirements in Sec. 420.57
require licensed site operators to notify local officials and adjacent
landowners of flight schedules. In addition, Sec. 450.147 requires
vehicle operators to have agreements with any sites or services that
are necessary to meet the safety requirements for a license. These
requirements serve to notify the necessary entities about licensed
operations. Including notification requirements beyond those in
Sec. Sec. 420.57 and 450.147 is outside the needs of this rulemaking
to protect public health and safety, safety of property, and national
security and foreign policy interests of the United States.
Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the
FAA revise proposed Sec. 450.181(a)(3) to require only that
coordination ensure that any ground hazard areas are identified. The
FAA does not find the commenters' recommendation sufficient to protect
public safety and avoid adverse impacts on neighboring space
operations. The vehicle operator must take an active role in ensuring
the site operator is aware of ground hazard areas and how they may
impact other site operations.
iii. Explosive Site Plan (Sec. 450.183)
In the NPRM, the FAA proposed to require an applicant to include an
explosive site plan as part of its vehicle operator license application
for a launch or reentry from or to a site exclusive to its own use.
This plan would be required to demonstrate compliance with the
explosive siting requirements in part 420.
In the final rule, the FAA adopts Sec. 450.183 (Explosive Site
Plan) as proposed. The FAA received no comments on this section.
iv. Ground Hazard Analysis (Sec. 450.185)
In the NPRM, the FAA proposed an operator would be required to
complete a ground hazard analysis that would include an assessment of
the launch or reentry vehicle, the launch or reentry integrated
systems, ground support equipment, and other site hardware. In its
analysis, an applicant must identify hazards; include a risk
assessment; and identify and describe mitigations, controls, and
provisions for hazard control verification and validation. Although the
analysis might incorporate aspects of employee safety and mission
assurance, an applicant would only be required to identify the hazards
that affect the public and describe how those hazards are mitigated.
In the final rule, the FAA adopts Sec. 450.185 as proposed, with
minor edits to remove the reference to ``public property'' because
``property'' has been removed from the final rule's definition of
``public,'' as discussed in the preamble section for Neighboring
Operations Personnel. Instead, the FAA refers to ``property not
associated with the launch or reentry.''
In response to the proposed requirements, NFPA suggested its own
standards as guidance for complying with proposed Sec. Sec. 450.179,
450.185, and 450.189. Space Florida also commented that the FAA did not
provide clear guidance on what standards would be acceptable and how
the agency would judge the sufficiency of the ground hazard analysis.
Space Florida did not recommend a specific change to proposed Sec.
450.185.
In response to NFPA's comment, the FAA notes that applicants are
free to explore the use of any industry standard to demonstrate
compliance with these sections. If the industry standard has not
already been accepted by the FAA, the FAA would review the proposed
standard as part of an applicant's application. NFPA is also welcome to
submit its standards to the FAA for acceptance at any time.
In response to Space Florida, the FAA recommends that the applicant
identify proposed standards and common practices during pre-application
consultation to reach an agreement with the FAA on their applicability
for proposed operations. For items that may deviate from current
standards and practices, the FAA may seek additional justification or
analysis to determine whether ground hazards pose a risk to public
safety.
Virgin Galactic asked the FAA to retain the ground safety analysis
practices used under part 431 and not to impose proposed Sec. 450.185.
Virgin Galactic also asked that existing launch vehicles be
``grandfathered.'' Finally, Virgin Galactic commented that conducting a
ground hazard analysis would place a cost burden on hybrid vehicle
operators and asked the FAA to outline its reasoning for imposing the
requirement on hybrid operators.
The FAA discusses Virgin Galactic's question regarding cost burden
in the preamble section addressing Responses to Regulatory Impact
Analysis Comments. Part 431 does not have an explicit ground safety
requirement, and as a result it is often difficult for applicants to
ascertain how to meet the safety standard for pre-flight operations.
Concurrently, the ground safety requirements in part 417 are overly
prescriptive and onerous. The ground hazard analysis requirements in
part 450 strike a balance between the two parts, providing additional
guidance to applicants, while at the same time preserving flexibility.
An operation that was licensed prior to the effective date of this
rulemaking will be permitted to continue under its license for five
years from the effective date or when the license expires if the
operator does not seek a renewal. For further discussion, please see
the preamble section on Legacy Licenses. All regulated operators,
including hybrid launch or reentry systems operators, will need to
prepare a ground hazard analysis to ensure public safety is protected.
Hybrid launch or reentry vehicles may still pose a risk to the public;
therefore, the FAA imposes its ground hazard analysis requirements on
hybrid launch vehicles in order to identify and mitigate those risks.
Some launch or reentry systems will have very limited ground hazards,
and thus the ground hazard analysis will be similarly limited. An
operator would not need its ground hazard analysis to include carrier
aircraft activities that do not constitute launch or reentry.\187\
---------------------------------------------------------------------------
\187\ Such activities may include, for example, activities
conducted by a carrier aircraft without a rocket attached when the
carrier aircraft plus rocket constitutes the launch vehicle.
---------------------------------------------------------------------------
Boeing, Lockheed Martin, Northrop, and the ULA recommended the FAA
modify proposed Sec. 450.185(a) by adding that a ground hazard
analysis must identify system and operation hazards posed by the
vehicle ``and any of its components.'' The FAA does not adopt this
change because any requirement levied on the vehicle also necessarily
includes the vehicle's components.
CSF, Sierra Nevada, and Space Florida recommended that the FAA
consider an alternative regulatory approach giving site operators more
[[Page 79685]]
authority over ground safety. Specifically, CSF and Sierra Nevada
recommended that the FAA consider an alternative regulatory approach
that would give the responsibility for assessing and controlling ground
safety and hazards mitigations to the site operator.
Historically, the launch or reentry operator has been responsible
for ground safety and, as reflected in the NPRM, the FAA determined
that this allocation of responsibility was appropriate given that the
operator has the most comprehensive understanding of the parameters of
the licensed activity. The FAA expects that the launch or reentry
operator will work closely with the site operator to ensure all
requirements are met. Accordingly, the FAA retains the proposed
language in the final rule.
v. Ground Safety Prescribed Hazard Controls (Sec. 450.189)
In the NPRM, the FAA proposed that an operator would be required to
implement certain prescribed hazard controls during the ground
operations period of launch or reentry. These prescribed hazard
controls would require that an operator document how it would protect
members of the public who enter areas under the operator's control, and
mitigate hazards created by a countdown abort. They would also require
the operator to establish plans for controlling fires and emergency
procedures. In the final rule, the FAA adopts Sec. 450.189 as
proposed.
AAAE suggested licensed operators be required to notify nearby
airports and contingent landing sites of potential safety hazards and
their controls, including those described under this section and
proposed Sec. 450.185. The notification requirements in Sec. 420.57
require licensed site operators to notify local officials and adjacent
landowners of flight schedules. In addition, Sec. 450.147 requires
vehicle operators to have agreements with any sites or services that
are necessary to meet the safety requirements for a license. These
requirements serve to notify the necessary entities about licensed
operations.
5. Part 450 Subpart D--Terms and Conditions of a Vehicle Operator
License
a. Public Safety Responsibility, Compliance With License, Financial
Responsibility, Human Spaceflight Requirements (Sec. Sec. 450.201 to
450.207)
In the NPRM, the FAA proposed requirements addressing how a
licensee is responsible for ensuring public safety and safety of
property during the conduct of a licensed launch or reentry in proposed
Sec. 450.201, how a licensee would be required to comply with a
license in proposed Sec. 450.203 (Compliance with License), with
financial responsibility requirements of part 440 in proposed Sec.
450.205 (Financial Responsibility Requirements), and with human
spaceflight requirements in part 460 in proposed Sec. 450.207 (Human
Spaceflight Requirements).
In the final rule, the FAA adopts the requirements as proposed. The
FAA received no comments on these proposals.
b. Compliance Monitoring (Sec. 450.209)
In the NPRM, the FAA proposed to combine the compliance monitoring
requirements of Sec. Sec. 417.23 and 431.83 in Sec. 450.209. The FAA
also proposed to allow an operator the option to provide the FAA with
means other than a console for monitoring the communication and
countdown channels. The compliance monitoring requirements of proposed
Sec. 450.209 would apply to all launch and reentry operations.
Finally, proposed Sec. 450.209 codified the FAA practice for
conducting compliance monitoring of part 435 operations. In final rule,
the FAA adopts Sec. 450.209 as proposed.
Virgin Galactic expressed concern regarding proposed Sec.
450.209(b), which stated a licensee must provide the FAA with the
capability to communicate with the mission director. Virgin Galactic
suggested replacement language that gave the operator the
responsibility for assigning a radio communications point-of-contact
for the FAA during operations. The FAA does not adopt this suggestion
because the FAA must have direct contact with the mission director
during licensed operations to ensure any risk to public safety during
ongoing operations is immediately addressed. It will continue to be FAA
practice not to contact the mission director unless there is an
immediate and urgent risk to public safety.
The FAA also deletes Sec. 450.209(c) because it imposed a
requirement only on the FAA and was unnecessary legacy language.
c. Continuing Accuracy of License Application; Application for
Modification of License (Sec. 450.211)
In the NPRM, the FAA proposed to preserve the continuing accuracy
requirements in Sec. Sec. 417.11 and 431.73, and consolidate them in
proposed Sec. 450.211. In addition, the FAA proposed to allow an
applicant to request approval of an alternate method for requesting
license modifications during the application process.
In the final rule, the FAA adopts Sec. 450.211 as proposed with
only a minor revision to split the second requirement in proposed Sec.
450.211(a) into a new Sec. 450.211(b). Accordingly, proposed Sec.
450.211(b) and (c) were renumbered to become Sec. 450.211(c) and (d)
in the final rule, respectively.
CSF and SpaceX suggested that the FAA could update Sec. 413.17(a)
to clarify that it would agree to a modification to an existing license
when the FAA accepts and approves a continuing accuracy submission. CSF
requested that the FAA clarify its use of these terms in an AC.
Virgin Galactic noted that operators may have separate definitions
for continuing accuracy and license modifications. Virgin Galactic
proposed what it believed to be simpler requirements for continuing
accuracy updates and license modifications, which in Virgin Galactic's
experience aligned with how the FAA has processed Virgin Galactic's
license and license application updates over the past three years.
Specifically, Virgin Galactic recommended that proposed Sec.
450.211(a)(1) be rewritten to change the requirement so that after a
license has been issued, a licensee would be required to apply to the
FAA for modification of the license if the licensee proposes to make
changes that affect the license, as issued by the FAA. It also proposed
to add the term ``continuing accuracy updates'' for changes that a
licensee proposes that do not affect the license but do affect the
license application. Virgin Galactic maintained that this approach
would provide schedule assurance for operators, as license modification
usually involves time-intensive coordination between the FAA and an
operator.
Sierra Nevada commented that general edits to the listed documents
should not trigger the requirement of continuing accuracy, as such a
requirement would create an extremely burdensome amount of document
overhead an applicant would be required to maintain that is not
necessary for maintaining public safety.
The FAA does not agree that the suggested changes are necessary;
however, the FAA has split the two requirements in Sec. 450.211(a) so
that the application for modification of license is in Sec. 450.211(b)
for added clarity. The regulation states that a licensee is responsible
for the continuing accuracy of representations contained in its
application. A license modification is
[[Page 79686]]
required only if the licensee proposes to conduct a launch or reentry
in a manner not authorized by the license; or, if any representation
contained in the license application that is material to public health
and safety or the safety of property is no longer accurate and
complete, or does not reflect the licensee's procedures governing the
actual conduct of a launch or reentry. For representations that do not
meet either of these criteria, such as administrative information,
Sec. 450.211(b) continues to require an applicant to inform the FAA of
the change in order to ensure the representations made in the
application are accurate.
The NPRM preamble identified the following as areas that constitute
a material change: Reuse, after an earlier launch or reentry, of
safety-critical systems or components, requiring refurbishment, re-
qualification testing, and re-acceptance testing. Virgin Galactic
believed performing refurbishment and pre-flight testing of reusable
safety-critical systems or components would not constitute a material
change that affects public safety. Both vehicles of a hybrid RLV launch
system are reused, and pre-flight testing and refurbishment are
performed prior to each mission. Virgin Galactic recommended this reuse
language be stricken from the preamble because it is not a material
change to public safety.
The FAA clarifies that normal pre-flight testing and refurbishment
that are evaluated and accepted during a license application are not
considered a material change. The FAA further clarifies that only pre-
flight testing and refurbishment that is not evaluated during a
licensing process will be considered a material change. As discussed
above, a material change is a change that affects public safety that
has not been evaluated and authorized by the FAA during the licensing
process.
Virgin Orbit commented that some of the changes noted in preamble,
such as retesting a valve or changing a safety officer, should not
require a modification to a license. Virgin Orbit recommended that what
constituted a material change should be based on how the change
affected public safety elements contained within the FSA and PSA.
Virgin Orbit further recommended that the FAA allow operators to
determine how the areas that constituted a material change as
identified in the preamble affected the public safety elements.
As noted earlier, a material change is a change that affects public
safety that has not been evaluated and authorized by the FAA during the
licensing process. These changes may go beyond just the FSA and any PSA
\188\ as suggested by Virgin Orbit. All public safety requirements in
part 450 are applicable. The FAA does agree with Virgin Orbit that the
burden lies on the operator to determine what constitutes a material
change. The FAA notes, however, that an operator should consult with
the FAA regarding those changes for which an operator is unsure whether
the change is material or not.
---------------------------------------------------------------------------
\188\ As discussed earlier, the FAA removed the requirement for
a PSA from the final rule.
---------------------------------------------------------------------------
Virgin Orbit requested a definition of a ``minor'' change. It
further requested that minor changes would not require a full 180-day
review period, and that the regulation define a maximum review time for
minor changes. The FAA does not distinguish between major and minor
changes, only those changes that will or will not have a material
impact on public safety. Categorizing all potential changes that have a
material impact on public safety into only two categories is
problematic due to the variety of potential changes. The FAA does
agree, however, that not all requests for modification would require
extensive review. Although the statutory 180-day review period does not
apply to modifications, the FAA makes every effort to act upon all
requests for modifications in a timely manner. The FAA is able to
respond quickly if a change is indeed minor.
d. Pre-Flight Reporting (Sec. 450.213)
In the NPRM, the FAA proposed to require a licensee to provide the
FAA with the following information prior to each launch or reentry:
Mission-specific information, FSA products, FSS test data, data
required by the FAA to conduct a collision avoidance analysis, and a
launch or reentry schedule.
In the final rule, the FAA adopts Sec. 450.213 with four
revisions. First, in Sec. 450.213(d)(2), the FAA replaces the term
``flight information'' with ``planned mission information'' because the
information required includes launch site information, and the term
``planned mission information'' is used in the final Sec.
450.208(d)(6). Second, the FAA revises Sec. 450.213(d) to allow an
operator the flexibility to identify an appropriate time frame in
coordination with the FAA. Third, in Sec. 450.213(e) the FAA removes
the reference to the time frames to submit LCOLA data, which the FAA
has revised in the final rule, so that Sec. 450.213(e) simply requires
operators to submit LCOLA data in accordance with Sec. 450.169(f).
Lastly, the FAA replaces ``operator'' with ``licensee'' throughout the
section to be consistent with the rest of subpart D. The FAA makes
similar changes in Sec. 450.450.215.
Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that
they appreciated the streamlining of pre-flight reporting. CSF
recommended that the FAA allow the submittal of test reports in
accordance with proposed Sec. 450.213(d) less than 30 days before
flight. SpinLaunch also stated that the proposed Sec. 450.213(d)
requirement to submit test reports 30 days prior to launch was too
burdensome.
The FAA agrees that not all test reports for the FSS, such as end-
to-end tests and pre-flight tests, can be delivered 30 days before
flight. The FAA therefore revises Sec. 450.213(d) to allow an operator
the flexibility to identify an appropriate time frame in coordination
with the FAA. The FAA discusses this flexibility in more detail in the
preamble section on Time Frames.
AAAE noted that, under proposed Sec. 450.213(f), launch schedules
would be required to be provided to the FAA in advance. AAAE
recommended that these schedules, including any changes to the
schedule, should also be distributed to nearby airports (within at
least five nautical miles of the launch site or along the vehicle's
trajectory), contingent landing sites, and any emergency responders
supporting the launch operation.
The FAA declines to adopt this recommendation. Section 450.147
requires that an operator establish written agreements with any entity
that provides a service that meets a requirement. The FAA notes that
these written agreements will include any agreements necessary to
ensure the safety of airspace. The FAA has drafted Sec. 450.147 to be
as performance-based as possible; therefore, the specificity
recommended by AAAE is unnecessary. That said, the FAA agrees that such
notifications would usually be required.
CSF noted that proposed Sec. 450.213 would require that the
licensee provide payload details to the FAA 60 days in advance of a
launch or reentry. CSF commented that operators often cannot meet that
time frame due to changes in manifests for passive or minor payloads
that occur inside of 60 days before flight. Proposed Sec. 404.15 would
not allow an operator to request that the time frame for payload
notification be changed unless it knew more than 60 days in advance of
flight that the manifest was going to change. CSF considered the
proposal inflexible and requested that FAA allow proposed Sec. 404.15
be made more flexible. The FAA disagrees with the comment, as Sec.
404.15 currently allows for an
[[Page 79687]]
applicant to request the FAA to relax the 60-day pre-flight reporting
requirement for payload information.
e. Post-Flight Reporting (Sec. 450.215)
In the NPRM, the FAA proposed an operator be required to provide
the actual trajectory flown by the vehicle and, for an unguided
suborbital launch vehicle, the actual impact location of all impacting
stages and impacting components, if requested by the FAA. In the final
rule, the FAA adopts Sec. 450.215 as proposed.
SpaceX generally agreed with the provisions of proposed Sec.
450.215 but suggested that the FAA remove proposed Sec. 450.215(b)(4)
because it contended that post-flight auditing was already an option
for the FAA and that the specific reference to a potential request for
a flown trajectory was redundant and unnecessary. Although the FAA
agrees with SpaceX that the FAA can request these data as part of its
inspection, the FAA finds that the explicit reference in the regulatory
text is necessary to ensure compliance. The FAA included this
requirement in the proposed rule because some operators failed to
provide flown trajectory information when the FAA requested it as part
of an inspection or post-flight review. The FAA will only ask for flown
trajectory data when necessary to verify models and assess vehicle
performance.
f. Registration of Space Objects (Sec. 450.217)
In the NPRM, the FAA consolidated and updated the requirements for
registration of space objects in proposed Sec. 450.217. The FAA
proposed to remove the caveat excluding foreign payloads and to add the
requirement to notify the FAA when removing objects placed in orbit.
The FAA noted that it is the responsibility of the U.S. Government to
register objects and launch operator data is used to make relevant
decisions on what to register. Proposed Sec. 450.217(c) retained Sec.
431.85's requirement that an operator notify the FAA when it removes a
space object.
In the final rule, the FAA adopts Sec. 450.217 as proposed.
NZSA asked if operators would have to report the reentry of an
object due to atmospheric reentry, presumably much later than launch.
NZSA supported the requirement of information on foreign-owned space
objects to determine who would register the objects, which NZSA also
requires. NZSA recommended the FAA clarify whether removal would relate
only to active removal or if it would include passive deorbiting. NZSA
viewed the latter to be in alignment with the terms of the Registration
Convention.\189\
---------------------------------------------------------------------------
\189\ Convention on Registration of Objects Launched into Outer
Space provides that the United Nations maintains a registry of
objects left in space by on data provided by the launching state.
---------------------------------------------------------------------------
The FAA did not intend the requirement to notify the FAA of objects
removed from orbit to cover eventual decays through atmospheric
reentry. NZSA is correct that the Registration Convention requires the
notification of objects removed from space. Yet, the FAA does not
believe there is a need to require launch operators to track the
orbital status of all objects previously launched in perpetuity.
6. Changes to Parts 401, 413, 414, 420, 433, 437, and 440
Part 401--Organization and Definitions
i. Sec. 401.5
In the NPRM, the FAA proposed new and amended definitions to Sec.
401.5 (Definitions). The new proposed definitions in proposed Sec.
401.5 were: ``anomaly,'' ``casualty area,'' ``command control system,''
``control entity,'' ``countdown,'' ``critical asset,'' ``crossrange,''
``data loss flight time,'' ``deorbit,'' ``disposal,'' ``dose-response
relationship,'' ``downrange,'' ``effective casualty area,'' ``expected
casualty,'' ``explosive debris,'' ``flight abort,'' ``flight abort
crew,'' ``flight abort rules,'' ``flight hazard area,'' ``flight safety
limit,'' ``gate,'' ``hazard control,'' ``launch or reentry system,''
``launch window,'' ``liftoff,'' ``limits of a useful mission,''
``mishap, class 1,'' ``mishap, class 2,'' ``mishap, class 3'',
``mishap, class 4,'' ``neighboring operations personnel,'' ``normal
flight,'' ``normal trajectory,'' ``operating environment,'' ``operation
hazard,'' ``orbital insertion,'' ``physical containment,''
``probability of casualty,'' ``public,'' ``reentry window,'' ``service
life,'' ``software function,'' ``sub-vehicle point,'' ``system
hazard,'' ``toxic hazard area,'' ``tracking icon,'' ``uncontrolled
area,'' ``unguided suborbital launch vehicle,'' ``uprange,'' and
``vehicle response modes,'' ``wind weighting safety system,'' and
``window closure.''
The amended definitions in proposed Sec. 401.5 were ``contingency
abort,'' ``flight safety system,'' ``instantaneous impact point,''
``launch,'' ``mishap,'' ``reenter; reentry,'' ``safety critical,'' and
``State and United States''. These new and revised definitions were
necessary additions to accompany the proposed part 450 requirements.
The FAA also proposed to remove a number of definitions from Sec.
401.5 that were no longer used in the regulations: ``emergency abort,''
``human space flight incident,'' ``launch accident,'' ``launch
incident,'' ``public safety,'' ``reentry accident,'' ``reentry
incident,'' and ``vehicle safety operations personnel.''
In the final rule, the FAA does not make any immediate changes to
Sec. 401.5. Instead, Sec. 401.5 will remain in effect for five years
after the effective date of this final rule, and its definitions will
be applied to parts 415, 417, 431, and 435. After five years, Sec.
401.5 will be removed from part 401 and all operators will use the
definitions in the new Sec. 401.7.
ii. Sec. 401.7
In the final rule, existing and proposed definitions from Sec.
401.5 are adopted as new Sec. 401.7 (Definitions) specifically
applicable to part 450 requirements, with the exception of the
following proposed definitions: ``control entity,'' ``data loss flight
time,'' ``dose-response relationship,'' ``flight abort crew,''
``gate,'' ``mishap, class 1,'' ``mishap, class 2,'' ``mishap, class
3'', ``mishap, class 4,'' ``tracking icon,'' and ``vehicle response
modes.'' In addition, Sec. 401.7 does not contain the definitions for
``Federal launch range'' and ``launch site safety assessment'' that
exist in Sec. 401.5. These definitions are not adopted because they
are no longer used in the regulations. Section 401.7 will apply to all
of Chapter III except parts 415, 417, 431, 435, and 440, where Sec.
401.5 will continue to apply until five years after the effective date
of this rule.
The FAA notes that the proposed definition of ``probability of
casualty'' uses the phrase ``serious injury or worse.'' Consistent with
current practice for launch and reentry safety analyses, as well as
other DOT modal administrations, the FAA maintains that the use of the
Abbreviated Injury Scale (AIS) Level 3 or greater (of the Association
for the Advancement of Automotive Medicine) is appropriate for
describing a medical condition sufficiently to allow modeling of
casualties for purposes of determining whether a launch or reentry
satisfies the public risk criteria. For additional information
regarding casualty modeling, the FAA refers the reader to the preamble
of a previous rulemaking.\190\
---------------------------------------------------------------------------
\190\ See 67 FR 49464 (July 30, 2002).
---------------------------------------------------------------------------
The FAA adds new definitions for ``critical payload,'' ``hazardous
debris,'' ``key flight safety event,'' and ``useful mission,'' which
were not proposed in the NPRM. These definitions and the rationale to
remove, adopt, or amend them are discussed in the relevant topic
sections of this preamble.
Sierra Nevada suggested including a specific reference to ground
safety for
[[Page 79688]]
the public in the definition of ``reentry.'' The FAA declines to adopt
this suggestion because public safety is the core of the FAA's
statutory mission, and including additional reference to public safety
for the definition of ``reentry'' is unnecessary.
Part 413--Application Procedures
In the NPRM, to enable incremental application submission and
review, the FAA proposed to modify Sec. 413.1 to clarify the term
``application'' to mean either an application in its entirety, or a
portion of an application for incremental review and determination in
accordance with proposed Sec. 450.33.
In the final rule, the FAA adopts the provision as proposed. This
decision is further discussed in the Incremental Review section of the
preamble. The FAA did not receive any comments on this part.
In the NPRM, the FAA proposed to revise the table in Sec. 413.1 by
replacing parts 415, 417, 431, and 435, with part 450. The FAA adopts
the proposed table with revisions as discussed in the preamble section
for Compliance Period for Legacy Licenses.
In the NPRM, the FAA proposed to amend Sec. 413.7(a)(3) to allow
an applicant the option to submit its application by email as a link to
a secure server and removed the requirement that an application be in a
format that cannot be altered. The FAA adopts Sec. 413.7(a)(3) as
proposed and this decision is further discussed in the Application
Process section of the preamble.
In the NPRM, the FAA proposed to revise Sec. 413.11(a) by removing
the reference to initiate a review ``required to make a decision about
the license or permit.'' This revision would enable incremental
application submission and review. In the final rule, the FAA adopts
the change as proposed.
In the NPRM, the FAA proposed a change to Sec. 413.15 to allow the
FAA to establish a time frame for any incremental review with an
applicant on a case-by-case basis during pre-application consultation.
In the final rule, the FAA adopts this change with a revision. The FAA
revises the explicit time frames in Sec. 413.15 to reference the time
frames specified in 51 U.S.C. 50905(a)(1) and 50906(a) so that a future
rulemaking will not be required if the time frames are modified in the
statute. This decision is further discussed in the Incremental Review
section of the preamble.
In the NPRM, the FAA proposed to correct the section heading of
Sec. 413.21 to reflect the content of the section, and to correct
Sec. 413.21(c) to reference both license and permit applications. The
FAA adopts these changes as proposed.
In the NPRM, the FAA included license and permit renewals in the
flexible time frames table in Appendix A to Part 404. The FAA
inadvertently omitted making the same change in the corresponding
regulatory text in Sec. 413.21. The FAA adopts the change as proposed,
and revises Sec. 413.21 to allow flexible time frames for license and
permit renewals. This decision is further discussed in the Time Frames
section of the preamble.
In the NPRM, the FAA proposed conforming changes in part 413 where
a part 414 safety approval is referenced, to change those references to
``safety element approval.'' The FAA adopts the changes as proposed.
This decision is further discussed in the Safety Element Approval
section of the preamble.
Part 414--Safety Element Approvals
In the NPRM, the FAA proposed to change the part 414 term ``safety
approval'' to ``safety element approval,'' to distinguish it from the
term ``safety approval'' as used in parts 415, 431, and 435, and
proposed part 450. Also, the FAA proposed to modify part 414 to enable
applicants to request a safety element approval in conjunction with a
license application in accordance with proposed part 450.
In the final rule, the FAA adopts the changes as proposed with
minor editorial corrections. The FAA did not receive any comments on
this part.
Part 420--License To Operate a Launch Site
In the NPRM, the FAA proposed multiple changes in part 420.
Specifically, the FAA proposed changes in Sec. Sec. 420.5, 420.15,
420.51, 420.57, 420.59, and 420.61 to align with requirements in part
450.
In Sec. 420.5, the FAA proposed to remove the definitions of
``instantaneous impact point,'' ``launch site accident,'' and
``public'' from Sec. 420.5. The FAA did not receive comments on these
changes and adopts them as proposed.
In Sec. 420.15(b), the FAA proposed to revise the environmental
review requirements under part 420 to match the environmental review
requirements proposed in Sec. 450.47. As discussed in the
Environmental Review section of this preamble, the FAA adopts this
change as proposed, with revisions that affirmatively state the
responsibilities of the FAA and an applicant in accordance with FAA
Order 1050.1.
The FAA proposed a minor edit to Sec. 420.51, and proposed to
allow alternate time frames in Sec. 420.57. The FAA adopts these
changes as proposed.
In Sec. 420.59, the FAA proposed changing the heading from
``Launch Site Accident Investigation Plan'' to ``Mishap Plan,'' and
modifying the requirements for Mishap Plans to match the requirements
for ``mishap plans'' in Sec. 450.173. As discussed in the Mishap
section of this preamble, the FAA revises Sec. 420.59(a) to state that
the requirements of this section only apply in the event of a mishap
that meets paragraph (a)(1) or (a)(5) of the definition of ``mishap''
in Sec. 401.7 and removes the requirement for the licensee to
cooperate with an FAA or NTSB investigations of a mishap for launches
launched from the launch site.
Lastly, in Sec. 420.61(b), the FAA replaces the word ``shall''
with the word ``must,'' and replaces the term ``launch or launch site
accident'' with a reference to the portions of the ``mishap''
definition that replace this term: paragraphs (1), (5), and (8). As
explained in the Mishap section of this preamble, the NPRM
inadvertently omitted these changes necessitated by the revised
definition of ``mishap'' in Sec. 401.7.
Part 433--License To Operate a Reentry Site
In the NPRM, the FAA proposed changes to the environmental
requirements in Sec. 433.7 to align them with the environmental
requirements in proposed Sec. 450.47 and removed and reserved Sec.
433.9.
In the final rule, the FAA adopts the proposed requirements in
Sec. 433.7 with revisions to align with the revisions in Sec. 450.47.
The revisions are discussed in the Environmental Review section of the
preamble. The FAA also adopts the proposal to remove and reserve Sec.
433.9. The FAA did not receive any comments on these proposals.
Part 437--Experimental Permits
In the NPRM, the FAA proposed the following changes to part 437
(Experimental Permits).
First, the FAA proposed to remove the definition of
``anomaly'' from Sec. 437.3 and include a modified version in proposed
Sec. 401.5.
Second, the FAA proposed to modify the environmental
requirements in Sec. 437.21(b)(1) to match the environmental
requirements proposed in Sec. 450.47.
Third, the FAA proposed to change the name of ``safety
approval'' to ``safety element approval'' in Sec. 437.21.
Fourth, the FAA proposed to modify the mishap plan
requirements in Sec. 437.41 to require that they meet the
[[Page 79689]]
requirements of proposed Sec. 450.173 and remove and reserve the
requirements in Sec. 437.75.
Fifth, the FAA proposed to change the requirements in
Sec. 437.65 for collision avoidance to match proposed Sec. 450.169.
Finally, the FAA proposed allowing for alternate time
frames for pre-flight reporting in Sec. 437.89.
In the final rule, the FAA adopts the proposed requirements with
the following exceptions. The FAA revises the environmental
requirements in Sec. 437.21 to align with Sec. 450.47, and replaces
the word ``envelope'' with the word ``scope.'' ``Scope'' more
accurately captures ``envelope, parameter, or situation'' as used in
the definition of ``safety element approval.'' The rationale for this
revision is discussed in the Environmental Review section of the
preamble. The FAA also aligns the recordkeeping requirements in Sec.
437.87(b) for an event that meets paragraph (a)(1) through (a)(3),
(a)(5), or (b)(3) of the definition of ``mishap'' in Sec. 401.7, for
which a permittee must preserve all records related to the mishap
event. The FAA removes the definition of ``anomaly'' from Sec. 437.3
and includes a revised definition of ``anomaly'' in Sec. 401.7 instead
of in Sec. 401.5 as proposed. The FAA also amends the language in
Sec. 437.87(b) to state that records must be retained until completion
of any Federal investigation and the FAA advises the permittee that the
records need no longer be retained. These changes will clarify the
records retention requirements and ensure consistency with part 450.
The changes do not modify the scope of the requirements. The FAA did
not receive any comments on this portion of the proposed rule.
Part 440--Financial Responsibility
In the NPRM, the FAA proposed to modify Sec. 440.15 to allow for
alternate time frames. The FAA also proposed to modify the definition
of ``maximum probable loss'' in Sec. 440.3 to exclude neighboring
operations losses from losses to third parties that are reasonably
expected to result from a licensed or permitted activity and that have
a probability of occurrence of no less than one in ten million (1 x
10-\8\), and to include those losses to neighboring
operations personnel that have a probability of occurrence of no less
than one in one hundred thousand (1 x 10-\5\).
In the final rule, the FAA adopts these changes as proposed. The
FAA did not receive any comments on this proposal.
7. Miscellaneous Comments
i. General Support/Opposition
Several commenters generally supported the proposed rule as a much-
needed effort to consolidate and update the licensing process in a way
that would foster innovation and growth of the space industry.
Individual commenters supported streamlined licensing as a way for
space startups to enter the industry.
The FAA also received comments stating the NPRM fell short in
streamlining rules and procedures, as directed by SPD-2. The FAA
received comments that the proposed rules made obtaining launch
licenses too difficult or expensive for small companies because they
require legal or technical experts for small, low-risk launches. An
individual commenter asserted the FAA should ease restrictions for
space startups. Another individual commenter stated the NPRM added
administrative requirements that the FAA would not be able to manage.
Virgin Galactic requested that the safety, efficiency, and clarity of
the current regulatory regime for suborbital, reusable vehicles be
maintained in any new rulemaking.
Individual commenters asserted the NPRM did not contain adequate
standards to evaluate the adverse effects of licensed activities on
public safety and the environment. The Center for a Sustainable Coast
(Center) stated the FAA should require applicants to analyze risks to
private or public property, including infrastructure and natural
resources. Without such a requirement, the Center and other commenters
argued the proposed rule would make it easier to launch over
residential areas, environmental preserves, or other areas presenting a
high risk of harm to persons, property, and natural resources. The FAA
also received comments raising concerns about Camden Spaceport, citing
the proposed rule's lack of noise limitations, emissions requirements,
and attention to the effects on the environment and residential areas.
The FAA notes that the commenters did not recommend specific
changes to the proposed rule, nor did they provide cost data to
substantiate the economic concern for small companies. As such, the FAA
cannot provide a specific response to these comments but notes its
general disagreement with the claim that the new rule will make it too
difficult or expensive for small companies to secure commercial space
launch and reentry licenses from the FAA. In fact, publicly available
means of compliance will assist small companies in entering the market
by providing multiple options for complying with the regulations.
Similarly, the FAA disagrees that it would be necessary or feasible to
create an exception in the licensing process for ``space startups.''
The FAA disagrees further that the administrative requirements to
be placed on the FAA will prove impracticable to administer. The final
rule upholds the FAA's responsibility to protect public safety and
safety of property. In addition, the final rule makes no change to the
FAA's assessment of environmental impacts. As such, the FAA disagrees
that the final rule will enable operators to secure licenses for
launches or reentries that do not satisfy the FAA's public safety or
environmental review criteria.
Finally, commenters' concerns regarding Camden Spaceport are beyond
the scope of this rulemaking.
ii. Miscellaneous Comments
Starfighters Aerospace asked if all present restrictions on
compensation or hire would be removed for licenses and certificates
developed collaboratively between AVS and AST.
The FAA notes that this rule will not change any current practice
or regulation regarding compensation or hire restrictions under
aviation regulations. Changes to compensation or hire are outside the
scope of this rulemaking.
An individual commenter stated that the FAA should have
incorporated the proposed regulatory text the ARC included at the end
of its report, or, alternatively, the FAA should reconvene the SLR2
ARC. Two individuals commented that the FAA did not provide sufficient
public engagement for this rule. SpaceX and two individuals commented
that the proposed rule did not adequately address stakeholder concerns.
Several commenters, including SpaceX and Virgin Orbit, requested a
public meeting.
As noted in the NPRM, the FAA does not address the ARC's
recommended regulatory text because the recommended text did not
receive broad consensus within the ARC. The FAA also disagrees that
commenters did not have sufficient opportunity to comment on the NPRM.
Although the FAA did not hold a public meeting, as some commenters
requested, the FAA accepted written questions seeking clarification on
the NPRM and, upon publication of the FAA's responses to those
questions, extended the comment period to allow commenters sufficient
time to review the FAA's clarifications. Similarly, while the FAA did
not reconvene the SLR2 ARC, the FAA
[[Page 79690]]
relied heavily upon the recommendations of the ARC, in addition to
industry and other public comments, in promulgating this rule.
Relativity Space commented that the NPRM preamble and proposed rule
diverged from stakeholder expectations and appeared contradictory.
Sierra Nevada requested that the FAA identify in the docket any
contractor support used to develop and draft the NPRM.
The FAA generally disagrees that the preamble contradicted the
proposed regulation, but notes that, as explained herein, the FAA has
revised particular provisions that commenters specifically identified
as unclear or impracticable. The question of contractor support is
irrelevant to this rule or its promulgation by the FAA.
CSF and SpaceX commented that the FAA should revise Sec. 440.15(c)
so that operators would not need to submit proof of insurance, as
required by Sec. 440.9, more than once if the insurance policy covered
multiple licensed activities.
CSF, Rocket Lab, and SpaceX requested the FAA revise Sec.
440.15(c)(1)(iv) through (c)(1)(vi) to allow use of electronic
signatures, in lieu of original signatures, for each party to the
required waiver of claims.
Denver International Airport asked the FAA to broaden the scope of
financial responsibility required by part 440 to include employees,
site operators, neighboring communities, and other stakeholders.
Boeing and Northrop Grumman recommended the FAA add to Sec.
404.5(b) a requirement that petitions for waivers specify the duration
or specific mission for which petitioner seeks relief, noting the FAA
should not assume a waiver applies to the entire license.
The FAA notes that the previous four issues raised by the
commenters are all beyond the scope of this rule because they contained
comments on areas of the commercial space transportation regulations
that were not part of the proposal.
CSF commented that the NPRM was anti-competitive and discouraged
operations from U.S. Government ranges, thereby favoring operators
located elsewhere, including outside the United States.
The FAA notes that CSF does not explain why it thinks the rule will
discourage operations from U.S. Government ranges and favor operators
located elsewhere, including outside the United States. Based on
applications received by the FAA, the locations of operations are
ultimately determined by the scale and complexity of operations,
including the size and type of launch vehicle, resource inputs,
infrastructure requirements, and payload considerations. The net cost
savings provided by this rule do not significantly change the relative
costs of operating from U.S. Government ranges in favor of locations
elsewhere given these considerations of scale and complexity of
operations. In addition, U.S. companies need a license from the FAA for
a commercial space launch regardless of where the launch occurs--this
rule does not change that. Currently, and prior to this rule, U.S.
companies operate at locations outside of U.S. Government ranges in
remote locations and abroad, such as New Zealand.
iii. Advisory Circulars (ACs)
CSF, Sierra Nevada, Space Florida, SpaceX, and two individuals
(including Congressman Steven M. Palazzo) commented that the FAA had
failed to provide sufficient accompanying guidance documents and ACs to
allow industry to provide meaningful input on the proposed regulations.
CSF and SpaceX both commented that the FAA's approach to publish many
ACs with the final rule did not allow industry to consider the proposed
rules and the draft ACs as a complete package. Virgin Galactic
recommended that the FAA release updated ACs and guidelines to coincide
with the new rule's going into effect, or allow a grace period for
applicants and currently licensed operators to be compliant.
The FAA acknowledges the commenters' concerns, but disagrees that
the lack of draft ACs, which are necessarily rooted in the text of
regulations, prevented commenters from substantively commenting on the
proposed rule. The preamble and table of accepted means of compliance
provided sufficient detail to support the proposal. The ACs will be
non-binding guidance documents designed to provide specific examples of
means of compliance and recognized practices without prescribing
regulatory requirements. The public and interested parties will have an
opportunity to provide comment on the ACs.
As noted under the performance-based regulations discussion, CSF
and SpaceX stated that some of the proposed rules may be performance-
based, but it was difficult to make that determination without
reviewing the accompanying ACs. Space Florida commented that there was
an absence of performance criteria and guidance providing acceptable
approaches.
The FAA does not agree that the absence of additional draft ACs
prevented members of the public from understanding the performance-
based requirements as proposed. The proposed requirements, along with
discussions in the preamble, provided ample notice to the public. An AC
would provide one means, but not the only means, of meeting any
particular requirement.
iv. Designated Engineering Representative Model
Blue Origin recommended the Designated Engineering Representative
(DER) model to determine compliance with the FAA's launch and reentry
regulations.
Delegating the agency's authority to make engineering compliance
findings to qualified individuals (DERs) in the context of licensing
commercial space transportation is beyond the scope of this rulemaking.
The FAA may consider such a recommendation in the future.
v. Request for SNPRM
The FAA received a number of comments requesting that the FAA issue
an SNPRM. Denver International Airport commented that the FAA should
wait to issue this rule until Congress adopts the Space Frontier Act,
and then, if required, issue an SNPRM.
One individual commenter asked the FAA to restart the rulemaking
process and work closely with industry and the ARC to produce a final
rule that would meet industry needs and would comply with the
Commercial Space Launch Act and SPD-2.
The FAA disagrees that the final rule is inconsistent with either
the Commercial Space Launch Act or SPD-2. Through this rule, the FAA
streamlines the licensing process for commercial launch and reentry
operations, and replaces many prescriptive requirements with
performance-based criteria, as directed by SPD-2. To forego rulemaking
until Congress passes additional legislation on commercial space
operations, as Denver International Airport suggested, would contravene
the President's policy directive.
The FAA finds no circumstances that would justify a second round of
notice and comment or SNPRM. The FAA provided ample opportunity for
members of the public to submit comments and supporting evidence to the
administrative record, as shown by the large volume of substantive,
diverse comments received. The FAA also provided two sets of written
responses to clarifying questions, and extended the comment period
following publication of those responses. Although the FAA has adjusted
and revised parts of the NPRM in light of the
[[Page 79691]]
comments received and interagency review, the final rule does not
materially differ from the proposed rule such that an SNPRM would have
been warranted. Nor does the FAA view the presence of the circumstances
that might otherwise necessitate publishing an SNPRM (e.g.,
availability of new studies or experiments affecting the agency's
analysis; supervening legal developments that significantly affect the
rulemaking; or any other important change to the agency's analytical
framework in the rulemaking).
vi. Airspace
The FAA received a number of comments on the effect of space
operations on the NAS. A4A, AAAE, ACI, ALPA, AOPA, CAA, NATCA, and RAA
recommended the FAA implement tools to integrate commercial space
activities safely and expeditiously into the NAS and to harmonize the
regulatory regime governing aviation and commercial space. These
commenters argue that greater communication and coordination with NAS
users was needed to reduce delays and obstacles faced by both
industries (e.g., coordinated vehicle surveillance, traffic management,
and hazard mitigation plans).
The same commenters recommended the FAA incorporate into the rule
the recommendations of the ongoing Airspace Access ARC. AOPA stated the
COMSTAC and SLR2 ARC should have included general aviation
representation.
A4A and Southwest Airlines asked that aviation stakeholders be
given an opportunity to identify potential NAS impacts during the
licensing process. A4A, AAAE, ACI, ALPA, CAA, NATCA, and RAA
recommended the FAA require licensees to identify and mitigate negative
operational and financial impacts to NAS users resulting from licensed
activities. A4A added that hazard mitigation plans and the FAA's
accepted means of compliance should be subject to public comment, or
otherwise allow NAS users the opportunity to identify airspace and
ground safety risks.
The FAA did not propose any changes for the protection of aircraft
other than the aircraft risk criteria proposed in Sec. 450.101(a)(3).
As such, these comments are beyond the scope of this rule.
Recommendations from the Airspace Access ARC, which included commercial
space and aviation industry representatives, may inform future actions
addressing aircraft protection.
8. Responses to Regulatory Impact Analysis Comments
i. Compliance Period for Legacy Licenses
CSF commented that if the FAA required holders of licenses issued
under current regulations to seek renewals under part 450, operators
and the FAA would experience significant additional cost and regulatory
burdens because currently licensed operators under parts 431 and 435
would have to come into compliance with certain additional requirements
in part 450. Blue Origin also expressed concern that, without
grandfathering, there would be a cost to transition a license to part
450. Blue Origin pointed out that, according to the NPRM, upon license
renewal, an existing operation would have to comply with part 450. Blue
Origin disagreed with the FAA's conclusion that operators would not
have great difficulty transitioning existing programs to part 450. It
cited, in particular, proposed CEC and associated
requirements in proposed Sec. 450.145.
The FAA notes that any request to renew a current license submitted
after the effective date of the rule will result in a license valid for
no more than five years after the effective date of this rule. However,
upon the effective date, the operator will be required to come into
compliance with COLA and critical asset requirements. The FAA does not
estimate additional costs for those two requirements because the
operator will provide the same information the operator currently
provides, and the U.S. Government will perform the necessary analyses,
as discussed in the preamble sections for Critical Asset and COLA.
After five years from the effective date of the final rule, all
vehicle operators must be in compliance with part 450, but information
previously submitted to the FAA in obtaining a license under parts 417
and 431 may be referenced as means of compliance to meet the
requirements of part 450. Concerns over costs of proposed
CEC and FSS requirements in Sec. 450.145 are discussed in
the remainder of this section. There may be costs to transition
licenses following the 5-year period after the rule's effective date.
However, as mentioned previously, the FAA anticipates few, if any,
additional requirements that could not be fulfilled by referencing
previous submittals.
ii. Sec. 450.47 Environmental Review
Several commenters stated that the proposed requirements would
impose added costs for which the FAA did not account. Space Florida
expressed concern that the FAA may determine that new or supplemental
environmental analyses would be necessary for operators opting for a
single vehicle license with vehicle and site flexibility. The commenter
was concerned that such analyses would be required before the
determination to add multiple vehicle configurations, operational
parameters, or launch site locations to an operator's single license.
Spaceport Strategies also expressed concern that the FAA had not
analyzed the cost to launch operators or to launch site operators for
additional or redundant environmental reviews that the FAA would likely
require of an operator under the new rule in order for an operator to
obtain a single license covering multiple launch or reentry sites or
multiple vehicle configurations and flight operations. Spaceport
Strategies noted that the added costs of repetitive or redundant
environmental reviews would cause unquantified cost impacts on
licensees, including State and local launch site license applicants.
CSF stated that applicants using the licensing option to include
multiple sites under one license may be vulnerable to time and cost
uncertainty resulting from these environmental review requirements.
The FAA does not agree that the final rule will impose additional
costs beyond what is currently required of applicants for environmental
reviews, including applications for a single vehicle license or
licenses that include multiple sites, as the final rule codifies
current practice. NEPA requires that an environmental review be
completed for each site covered by the FAA license. As such, the final
rule makes no change to the existing requirement that applicants submit
information allowing the FAA to fulfill its responsibility under NEPA
to assess the environmental impacts associated with the proposed
activities, at each site where the licensed activities will occur. An
applicant must submit these materials to allow the FAA to conduct site-
specific reviews regardless of whether multiple sites or vehicles are
covered under one license or several licenses. This could be
accomplished by including multiple sites into one NEPA document, or
separating them into individual NEPA documents.
Spaceport Strategies commented that the FAA did not consider the
offsetting costs of environmental reviews for the new vehicles and
launch sites for which cost savings were assessed. The FAA notes it did
not include offsetting costs for new vehicles and launch sites because
the same costs for environmental reviews will be imposed
[[Page 79692]]
under the current regulations. There will be no change in costs.
Spaceport Strategies commented that the FAA's re-write of
environmental review requirements was more than a simple
``consolidation'' as reported in the Preliminary Regulatory Impact
Assessment. The commenter stated that the proposed requirements had
unquantified cost impacts upon licensees, including State and local
launch site license applicants, for the additive costs of repetitive or
redundant environmental reviews.
As discussed in the Environmental Review section of this preamble,
the final rule codifies existing environmental review requirements. The
commenter did not identify the environmental reviews it deems
repetitive or redundant. However, the FAA confirms that in codifying
existing practice, the final rule will not impose additional costs for
environmental review.
Spaceport Strategies commented that licensees would face
significant costs to redo environmental analyses for previously studied
and permitted sites. As an example, the commenter referred to Space
Florida's being required to spend almost $239,000 for another
environmental assessment for its Launch Site Operator License for
horizontal launch at the former Shuttle Landing Facility, when NASA had
completed two previous environmental assessments on the same facility.
The FAA notes this rule will impose no additional environmental
reviews nor require a redo of an environmental assessment if an
operator's operation remains within the scope of the original
assessment. However, consistent with NEPA, an operator will be required
to do additional environmental reviews if the scope of its operation
has changed.
Spaceport Strategies commented that the FAA did not address
environmental review regulations derived from practices and policies
being codified into rules as potential federalism issues with the State
and local jurisdictions that operate the part 420-licensed sites. The
commenter stated that the FAA also did not consider that some, if not
all, of the local and State authorities are small governmental entities
for purposes of the Regulatory Flexibility Act.
The FAA determines that this rule codifies existing requirements in
FAA Order 1050.1 and will not affect the applicability of NEPA or any
other Federal environmental law to non-Federal launch or reentry sites.
Therefore, the FAA finds that the final rule will not have an
additional cost impact on small governmental jurisdictions.
iii. Sec. 450.101(a)(b) Neighboring Operations
Virgin Orbit believed the costs of the additional EC
analysis to use in determination of neighboring operations personnel
would be $10,000. As discussed in the preamble section for Neighboring
Operations Personnel, the FAA acknowledges that this requirement will
require additional analysis; however, the FAA expects that this
analysis will involve minor additional effort because the operator
already has to perform a similar analysis for the public and will only
need to account for the population of neighboring operations personnel,
if any.
Blue Origin expressed concern that the FAA might implement a
requirement for which compliance would be impossible, or would lead to
the creation of a sole source provider for a service necessary to
demonstrate compliance, if the FAA does not explain how the transfer of
neighboring operations personnel population data would take place.
Sierra Nevada expressed concern regarding an applicant's ability to
perform calculations to determine which neighboring operations
personnel could remain on a launch site, because the applicant would
need to get accurate data regarding the populations and locations of
neighboring operations. Sierra Nevada pointed out that, because data
could be on personnel performing operations for competing companies,
the data could be proprietary or sensitive. Sierra Nevada suggested the
FAA could perform this function to guard the proprietary nature of the
data.
In the final rule, the FAA notes that the Federal or licensed site
operator will determine those personnel who are eligible for
neighboring operations personnel status in coordination with the launch
operators, because the site operator is in the best position to
identify which personnel are required to perform safety, security, or
critical tasks at the launch site. Further, as previously discussed,
both the launch or reentry operator and the neighboring site operator
benefit from this treatment of neighboring operations personnel.
Spaceport Strategies faults the FAA for not comparing the estimated
marginal productivity improvement created by allowing certain personnel
of neighboring operators to remain at work during nearby operations
with adverse schedule and competitiveness losses if the FAA did not
adopt the alternative approaches suggested by the ARC and CSF.
The alternative chosen by the FAA provides cost savings compared to
the current regulations, and the FAA believes that this approach is
consistent with the intent of SPD-2. The FAA acknowledges that other
approaches exist, and considered three alternatives that are discussed
in the Regulatory Flexibility Act section of this preamble.
Spaceport Strategies commented that the labor categories used to
calculate neighboring operations personnel savings (engineers and
technicians) did not align with the restricted categories of work
functions allowed to remain (such as personnel required for safety,
security, or critical tasks), indicating that the FAA's savings
estimates may not actually be realized.
The FAA received input from licensed operators on the labor
categories that might be allowed to remain on the launch site and,
based on that input, is confident that these are reasonable labor
categories.
iv. Sec. 450.101(a) Incorporate Waterborne Vessels Into Collective
Risk Criteria
To incorporate waterborne vessels into collective risk assessment,
Virgin Orbit requested the FAA and other regulators work with launch
service providers by providing databases on global marine traffic.
Virgin Orbit also requested guidance on debris size/fragment velocities
that would result in injury to marine traffic, in an appendix or AC.
Virgin Orbit asserted that this requirement is not found in the
existing regulations, and estimated that the additional cost to analyze
and document the effort would be approximately $20,000 per launch,
which would become significant costs for a large number of launches.
The FAA does not agree that there will be additional costs of any
significance from the requirement to incorporate waterborne vessels
into collective risk criteria. The operator can continue its current
practice and demonstrate compliance in accordance with the RCC 321-20
Supplement. The FAA does not find a need to provide databases on global
marine traffic because there are several public sources of data on ship
traffic available through the internet which aggregate near real-time
Automatic Identification System (AIS) \191\ data from satellites and
ground stations. The FAA notes that all vessels over 300 tons on an
international voyage, all domestic vessels over 500 tons, and all
passenger carriers, are
[[Page 79693]]
required to operate ``Class A'' AIS transponders, broadcasting
continually-updated data, such as identity, position, course, speed,
ship characteristics, cargo, and voyage information, to other vessels
and the shore. The United States Coast Guard requires AIS Class A
transponders on all U.S. vessels engaged in commercial service that are
(1) self-propelled and over 65 feet in length, or (2) towing vessels of
26 feet or more in length and more than 600 horsepower. The USCG also
requires AIS Class B transponders on smaller vessels, such as fishing
industry vessels.\192\ Detection of smaller vessels, which tend to
remain close to shore, can be accomplished without AIS by fixed ground-
based and ship-board radar, as well as surveillance aircraft. The FAA
will publish an AC on population exposure analyses that includes
details about available databases that provide valid data on ship
traffic, including near real-time ship traffic useful for EC
analyses. The forthcoming RCC 321 Supplement will also include this
information.
---------------------------------------------------------------------------
\191\ AIS is a standardized maritime navigation safety
communications system that provides vessel information automatically
to appropriately equipped shore stations, other ships, and aircraft.
\192\ USGC regulations regarding AIS are given in 33 CFR 164.46.
---------------------------------------------------------------------------
The ship probability of impact contours (PI) and
individual risk contours are already required and computed based on
current practice to establish ship hazard areas. The FAA Office of
Commercial Space Transportation will facilitate access to the ship
traffic densities so that the EC contribution from ships can
be computed with a spreadsheet.
v. Sec. 450.101(a)(3) Aircraft Risk
Virgin Orbit commented on the proposed requirement for an operator
to establish aircraft hazard areas necessary to ensure the probability
of impact with debris capable of causing a casualty for aircraft does
not exceed 1 x 10-\6\. To incorporate airborne vessels into
the collective risk assessment, Virgin Orbit requested FAA databases on
civil and general aircraft, predicted air traffic, and debris size and
velocities that would result in aircraft casualties in order to comply
with this requirement. Virgin Orbit stated guidance on debris size and
fragment velocities could be added in an appendix or AC. Virgin Orbit
indicated that this is a new requirement relative to the existing
regulations and estimated that the additional cost to analyze and
document the effort would be $20,000 per launch. While not significant
by itself, Virgin Orbit stated that the additional cost for a large
number of launches becomes significant.
The FAA does not agree that this is a new requirement. Current part
431 regulations require an operator to demonstrate that the risk level
to an individual does not exceed 1 x 10-\6\ probability of
casualty per mission. The part 431 requirement is equivalent to the
corresponding part 450 requirement, which requires that the probability
of impact with debris capable of causing a casualty for aircraft does
not exceed 1 x 10-\6\. Because people in aircraft are not
excluded from the part 431 requirement, part 450 is not adding a new
requirement to demonstrate risk level for aircraft. In addition, Sec.
417.107(b)(4) is identical to the requirement in Sec. 450.101(a)(3).
Part 450 does not require a collective risk assessment for aircraft, so
aircraft traffic densities, data on civil and general aircraft, and
predicted air traffic, are not necessary.
vi. Sec. 450.101(a)(4) Critical Assets
Blue Origin commented that because operators on non-Federal launch
or reentry sites would be required to comply with USAF Federal site
requirements, the FAA would need either to confirm it had considered
private and licensed spaceports in its cost assessment and that those
operators would not need to complete any critical asset analyses, or to
confirm they were not included. The commenter also stated that it was
possible the new requirement would impose costs for operators not at
Federal sites.
Spaceport Florida voiced concern about the creation of a new
category of property designated as a ``critical asset,'' which would be
required to be protected against ``loss of functionality'' by
prescribed risk criteria limiting each designated asset's exposure to
launch or reentry hazards. The commenter indicated concerns about
extraordinary analysis requirements, unknown costs, and program risks
asking what limits the types and numbers of assets that may be
designated by multiple parties within proximity to a licensed launch
activity.
Spaceport Strategies commented that the FAA had not conducted
certain analyses. These included analyzing the cost to a licensee to
perform a risk assessment on each FAA-identified critical asset to be
incorporated into a flight safety risk analysis, analyzing the cost to
identify critical assets to be evaluated as a property at risk, and
analyzing operator time to process waivers required for an operator's
own critical assets or for an asset that may be at risk for a
particular critical licensed activity. Spaceport Strategies expressed
concern that the proposed requirements duplicated existing standards
imposed by NASA and the USAF, and noted that there was only brief
mention of this newly proposed requirement in the FAA's Preliminary
Regulatory Impact Analysis, which identified no costs associated with
its implementation. As proposed, this requirement would apply to all
licensed launches and reentries wherever they may occur, at any site in
the United States. The commenter noted that in the Baseline Analysis of
the cost impacts and cost savings of proposed Sec. 450.101, the FAA
claimed no cost impact for a new requirement that clearly would add
cost burden to every licensee, as well as to the FAA itself.
The FAA notes that under the final rule the U.S. Government will
perform the identification and analysis of critical assets. The FAA
expects these costs to be relatively small. The Federal launch or
reentry site will perform the analysis for launch or reentry operations
from Federal sites, and the FAA will perform the analysis for
operations from non-Federal launch or reentry sites. Therefore,
operators should incur no costs for determination of critical assets.
vii. Sec. 450.101(c) High Consequence Event Protection
Spaceport Strategies stated that the proposed requirement to use
the CEC analysis tool would be prohibitively expensive--even
technologically infeasible--to use, and faulted the Preliminary
Regulatory Impact Analysis for not including these costs. The commenter
also criticized the FAA for not including the costs for operators to
learn the skills or contract for the analysis. In addition, they stated
that the FAA did not include its cost to hire in-house personnel or
contractor skills to validate that the operator's analysis justifies
not needing an FSS.
CSF found the CEC to be a new and costly calculation
that may require significant resources, including possible reliance on
contracts for expensive modeling capabilities. The commenter feared
that meeting the CEC may result in substantial increase in
cost to those operators currently able to show compliance. Based on its
understanding of the proposed rule, CSF concluded that the majority, if
not all, of the operators would be captured by proposed Sec.
450.145(a)(1) and would be required to implement an FSS of the highest
reliability. CSF disagreed with the FAA's estimated FSS cost savings
and indicated there would be cost increases.
Virgin Orbit stated that CEC, as a new requirement,
would be burdensome to implement and would require changes to its in-
house algorithm to compute flight corridors with associated
EC. According to Virgin Orbit, this new burden would impact
timelines for future launches and would have
[[Page 79694]]
significant costs to implement. The commenter recommended
CEC be included as one method to determine whether an FSS
was needed and not as a required calculation. The commenter further
noted that CEC, as proposed, would be better suited in an
AC. Blue Origin described the proposed CEC as a complicated
analysis with debatable accuracy. Several commenters disagreed with the
FAA's conclusion that this new ``consequence risk'' methodology aligned
with current practices.
Rocket Lab explained that, because proposed CEC
disregarded demonstrated reliability and experience, it appeared almost
impossible for any orbital launch vehicle to meet the prescribed
CEC thresholds. Preliminary calculations suggested that the
majority of orbital launch vehicle operators would be directed toward a
flight abort system of the highest prescribed reliability.
The FAA does not agree that the cost to use CEC is
prohibitive or that Virgin Orbit will be required to make significant
changes to its in-house algorithm. Additional costs associated with
modifications of analysis tools, adjustments to data development,
additional analysis runtime, and interpretation of the results as
detailed below, should not be significant.
The modification of existing analysis tools is expected to take
only a few hours. As explained earlier, CEC is inherent in
the calculation of total casualty expectation. If the capability to
output the CEC values is not already part of the calculation
tool, adding the output of this value for each scenario should require
no more than a few hours of effort. This estimate is included in the
Regulatory Impact Analysis for those operators who choose to do the
analysis.
Because the CEC metric is more sensitive to the input
data and to numerical sampling approaches than the collective
EC metric, more rigor needs to be applied to the analysis or
more uncertainty accepted in the result. Some data development may need
to be of higher fidelity and more computation samples run to achieve a
statistically meaningful answer. Therefore, the FAA finds there will be
additional cost to perform the analysis. To comply with Sec.
450.101(c), the operator first calculates the CEC, assuming
no FSS is present, to determine whether flight abort with an FSS
meeting the requirements of Sec. 450.108(b) is needed. These
calculations will incur 5 percent of the debris analysis costs.\193\
These estimates are included in the Regulatory Impact Analysis.
---------------------------------------------------------------------------
\193\ Debris cost analysis is estimated to cost $50,000.
---------------------------------------------------------------------------
Applicants using an FSS can use hazard containment or analysis of
CEC as key criteria in the determination of flight safety
limits. The cost to interpret CEC results for flight safety
limit development is expected (after the debris analysis is run) to
reduce the costs nominally compared to existing containment approaches.
Using its CEC tool, ACTA, under contract to the FAA, has
identified several launches in the launch forecast that will not need
an FSS. The Regulatory Impact Analysis includes more information on
these launches, as well as an updated estimate of cost savings
anticipated because these launches will not need an FSS.
The FAA notes that any operator that agrees to have a Sec.
450.145-compliant FSS does not have to do a CEC analysis to
determine the required reliability level of the FSS. However, a
CEC analysis may still be needed to determine the flight
safety limits. As discussed in the High Consequence Event Protection
preamble section, the final rule now has a number of flexibilities in
Sec. 450.101(c). Nevertheless, an operator could opt to use the flight
safety limits approach in current Sec. 417.213 as a means of
compliance with Sec. 450.108(5), and thus avoid any costs associated
with CEC analysis.
viii. System Safety Program, Post-Flight Data Review, Post-Flight
Reporting
CSF disagreed with the FAA's rationale that any added burden of
this section would be minimal because industry practice was to review
post-flight data for reliability and mission success. CSF maintained
that the proposed post-flight data requirement extended beyond industry
practice. The commenter also stated that it was not clear whether the
process for evaluating post-flight data would be subject to FAA review
and approval, which would create an even larger burden. Sierra Nevada
also commented that the proposed requirements extended beyond the
industry practice of reviewing post-flight data for reliability and
mission success, to requiring an operator to develop and employ a
process for evaluating post-flight data to ensure consistency between
the assumptions used for preliminary safety assessment, any flight
hazard or FSA, and associated mitigation and control measures. Rocket
Lab and Sierra Nevada stated the proposed Sec. 450.103(d) would
require the operator to address any anomaly identified and resolve
inconsistencies prior to the next flight of the vehicle. Rocket Lab
pointed out that this was overly burdensome.
The FAA disagrees with the commenters. The FAA is only concerned
with ensuring consistency between the assumptions used for any safety
analysis and associated mitigation and hazard control measures. It is
industry practice to review post-flight data to address vehicle
reliability and mission success.
The FAA further notes that current regulations already require that
any representation contained in the license application that is
material to public health and safety or the safety of property be kept
accurate and complete, therefore any additional burden from Sec.
450.103(d) will be minimal. Currently, operators review the post-flight
data because it provides valuable information on future operations. At
a minimum, in the final rule, Sec. 450.103(d)(1) will require that an
operator employ a process for evaluating post-flight data to ensure
consistency between the assumptions used for the hazard control
strategy determination, any hazard or FSA, and associated mitigation
and hazard control measures. With respect to Sec. 450.103(d), the FAA
will evaluate the post-flight data review process during the
application evaluation. Applicants will not be required to provide
information obtained from the post-flight data review to the FAA unless
specifically requested to do so during the compliance monitoring
process. The FAA finds that it has always been the operator's
responsibility to ensure the accuracy of the relevant safety analyses.
Operators must review flight data in order to ensure that the operation
is conducted as predicted, and to inform necessary safety analysis
changes for future flights.
Section 450.215 will continue to require licensees to submit a
post-flight report no later than 90 days after an operation if there
are any anomalies in the flight environment material to public health
and safety and the safety of property, and if there is a need for
associated corrective actions. This practice is currently required by
Sec. 417.25(c). While RLV operators licensed under part 431 are not
currently required to submit a post-flight report, they are required to
ensure that all assumptions and representations made in their
application that are material to public health and safety or the safety
of property are kept accurate and complete, in accordance with
Sec. Sec. 413.7 and 431.73(b)(2). As such, the FAA expects the added
burden to be minimal because launch and reentry operators regularly
track anomalies and
[[Page 79695]]
implement corrective actions for mission assurance, continuing license
accuracy, and safety purposes. The FAA is normally made aware of any
anomalies and corrective actions that are material to public health and
safety through its inspection program.
ix. Sec. 450.141 (Proposed Sec. 450.111) Computing Systems and
Software Systems
Several commenters expressed concern that the NPRM proposed a
prescriptive approach to the software hazard, which would impose a
significant burden on operators to meet all of the proposed
requirements and structure.
An individual commenter estimated that changing the review process
and structure of software would require a substantial new effort and
add costs of over $40,000 per launch. Blue Origin faulted the FAA for
proposing overly prescriptive regulations governing how the operator
would design and test software. Blue Origin also contended that the
prescriptive proposed requirements did not integrate well with most
industry applications and best practices and failed to address critical
aspects of safety sufficiently for aeronautical databases, complex
distributed software systems, new techniques, and machine learning.
Blue Origin indicated that these would threaten progress being made
towards safer, lower cost and higher quality software approaches. CSF
maintained that the requirements of proposed Sec. 450.111 prescribing
how the operator would design and test software, and providing only one
way to demonstrate that software was safe, failed to allow development
of new technologies that could lead to safer solutions, and would
greatly increase costs. Leo Aerospace stated that the testing
requirements of proposed Sec. 450.111(d)(2) and (f)(1) were so
prescriptive that they would be cost-prohibitive.
In the final rule, the FAA revises Sec. 450.111 to mirror the
typical structure of computing system safety application data
submissions and adds flexibility in the means of compliance for key
aspects of safe computing system development. The FAA notes that these
revisions address the key aspects of commenters' concerns. The final
rule on computing and software systems, now located in Sec. 450.141,
aggregates the requirements in proposed Sec. 450.111 into performance-
based objectives set in the context of the appropriateness of each
element for the system as a whole. This aggregation removes any
prescriptive requirements and replaces them with the performance-based
objectives. The performance-based objectives are the elements of
software development and testing processes that enable an understanding
of the public safety implications of each software component, and the
objectives are structured to mirror typical software safety application
data submissions to minimize or eliminate the need to adapt existing
software safety processes to fit the new regulations. The final
performance-based objectives expand the range of software safety
approaches that could meet the regulation to enable more innovation
while keeping the compliance burden at or below the level proposed in
the NPRM.
x. Proposed Sec. 450.113(a)(5) Flight Safety Analysis Requirements
Virgin Galactic commented that its launch system had an FSS in the
form of its pilot, rendering the need for ``demonstrated reliability''
unnecessary. In addition, unlike the ELVs addressed by part 417, Virgin
Galactic's launch system does not have a large effective casualty area,
which raised the question of whether the risks truly justified the
costs of the proposed requirement, particularly to small businesses.
Under this rule, currently licensed hybrid systems will not have to
do an FSA for phases of flight that have a flight history to
demonstrate reliability based on operational and flight history in lieu
of a traditional risk analysis. This allowance is discussed in greater
detail in the Hybrid Vehicles section of the preamble.
xi. Sec. 450.115 Flight Safety Analysis Methods
CSF commented that prescriptive FSA requirements are inappropriate
for some vehicles and operations. An applicant would have to propose an
alternative method of compliance or submit a waiver request, resulting
in an increase in the amount of work. The lack of tool-availability
might also cause some applicants to incur costs of performing these
analyses themselves. CSF noted these costs had not been included in the
cost analysis. The FAA agrees that prescriptive requirements are not
appropriate and revises the requirements to be more performance-based.
x. Independent Analyses
CSF stated that the NPRM's Flight Safety Analysis sections
(proposed Sec. Sec. 450.119 and 450.135) include multiple references
to an applicant submitting any additional products that allow an
independent analysis as requested by the Administrator. CSF stated that
this behavior of recreating an applicant's analysis was already an
expensive and burdensome aspect of the current rules that should be
ended. A couple of commenters provided estimates of additional hours of
work that might be required to conduct independent analyses.
As mentioned previously, the goal is for the FAA to evaluate, in an
efficient and thorough manner, the validity of the analysis. The FAA
finds that conducting an independent analysis is typically the most
efficient and thorough means to verify compliance with the FSA
requirements for novel launch or reentry operations or operators that
propose to use substantially new FSA methods. Furthermore, the FAA
plans to provide benchmarks for comparison purposes that operators can
reference to as part of the validation and verification of their
analysis methods.
Therefore, the FAA does not anticipate this rule will impose an
additional cost burden for independent analyses because conducting
independent analyses is current practice.
xi. Sec. 450.135 Debris Risk Analysis
An individual commenter indicated that the proposed rule would add
significant work in additional debris risk analysis beyond what the
operator was doing to comply with the current regulations. The
commenter specified that the proposed rule would add requirements on
explosive debris, toxic release effects from the debris, accounting for
sheltering of individual from buildings and vehicles, a casualty mode
that included ricochet fragments, and impacts to critical assets. It
would also add reporting requirements for the top ten impacted
population centers and the need to perform conditional probability
calculations in the FSA.
The FAA notes that an explosive debris or toxic release effects
analysis will not be required if the vehicle does not have explosive
debris and toxics. Explosive debris or toxic release effects analysis
are currently required for ELVs under Sec. 417.107(b)(1) and for RLVs
under Sec. 431.35(b)(1)(ii), so the requirement for those analyses
under part 450 would not impose additional costs. The final rule
requirements allow operators to determine how to conduct their debris
risk analysis. For example, an operator will not need to update the
debris risk analysis to account for sheltering or ricochet if it uses a
conservative estimate of the casualty area for people in the open
pursuant to Sec. 450.101(g). Under the final rule, the FAA or Federal
launch or reentry site will do any critical asset risk assessment. The
cost of the CEC
[[Page 79696]]
assessment is addressed in the High Consequence Event Protection
preamble section. Reporting the top ten population centers is a minimal
amount of additional paperwork.
xii. Sec. 450.143 Safety-Critical System Design, Test, and
Documentation
An individual commenter expressed concern that the proposed rule
would constrain the design by prescribing fault tolerance where an
operational mitigation solution might exist, and stated that this would
result in a large burden.
The FAA finds that industry interpreted this regulation to be
burdensome due to a misunderstanding of the breadth of possible means
of compliance to the ``fault-tolerant'' requirement in Sec.
450.143(b). In the NPRM, the FAA noted that while redundancy was a
currently prescribed requirement for some safety-critical components,
the intent of this requirement was to accept other methods, including
fail safety and damage tolerance for systems like primary structures
that could not be redundant. This flexibility permits operational
restrictions, testing, and inspection to factor into the design to
demonstrate that a system is fault-tolerant. The FAA resolves these
concerns by revising Sec. 450.143(b) to allow for other means of
compliance.
xiii. Sec. 450.145 Flight Safety System
Several commenters took issue with the FAA's assessment of cost
savings associated with the new approach to FSS implementation. CSF
disagreed there would be cost savings and expressed that the majority
of operators would be required to implement an FSS of the highest
reliability. CSF concluded that the result would be significant
increases in cost and oversight burdens to every operator not already
operating at a U.S. Federal site that has not yet implemented a RCC
319-4-compliant FSS. Rocket Lab stated that preliminary calculations
suggested that the majority of orbital launch vehicle operators would
be directed toward a flight abort system of the highest prescribed
reliability. Blue Origin stated that most, if not all, operators
(whether smaller suborbital launch vehicles operating in remote
locations, or larger orbital launch vehicles operating at Federal
sites) would be forced down a path of implementing an FSS that must
comply with an unmodified set of prescriptive USAF requirements.
Spaceport Strategies criticized the FAA's analysis of cost savings from
launches not requiring an FSS as being speculative and not providing
information on whether the vehicles would fly from existing or newly
licensed or private launch sites. It expressed that the uncertainties
made the projected savings an overstatement.
The FAA disagrees that most, if not all, operators will be required
to implement an FSS of the highest reliability. For some launches, no
FSS may be required; for others, an FSS will be required, but not of
the highest reliability. The FAA sponsored an analysis performed by
ACTA \194\ using a CEC model to evaluate selected \195\
prospective launches and determine those which would not need a FSS to
be in compliance with part 450. The FAA then determined which of these
launches identified as not needing an FSS under part 450 would be
required to employ an FSS under part 431 or current practice. Based on
cost input received from industry on FSS costs, the FAA then estimated
cost savings due to the fact that some launches would not need an FSS
under part 450, as determined by the ACTA analysis. The cost savings
calculations are in the Regulatory Impact Analysis.
---------------------------------------------------------------------------
\194\ ACTA, LLC is a risk management company that evaluates
safety hazards and risks from space launch vehicle debris, blast,
fire, and toxic gases. The FAA sponsored ACTA to perform a series of
tasks to investigate the potential conditional risks associated with
past and foreseeable launch operations. The study provided an
independent evaluation of the potential for the CEC
related requirements in the NPRM to necessitate changes to current
practice for more than a dozen missions involving large, medium, and
small launch vehicles from a wide variety sites.
\195\ In selecting which launches to analyze, the FAA analyzed
those launches planned from remote areas, suborbital and launches
with a certain kind of upper stage. This is because orbital launches
that are not from remote areas are going to exceed the risk
threshold of greater than 1 x 10-\3\ conditional expected
casualties for uncontrolled areas.
---------------------------------------------------------------------------
xiv. Sec. 450.161 Control of Hazard Areas
CSF stated that, in cases in which the hazard area locations were
in extremely remote locations or significant distances away from the
launch and reentry site, it was unreasonable for cost and logistics
reasons to expect that a commercial company could provide such
surveillance. The FAA notes that Sec. 450.161 only requires
surveillance to the extent necessary to ensure compliance with Sec.
450.101. Hence, surveillance will be unnecessary in extremely remote
locations.
xv. Sec. 450.167 Tracking
Sierra Nevada expressed that, as written, the proposed rule seemed
to imply that tracking would be required for every possible piece of
debris in off-nominal scenarios. Sierra Nevada noted this would be
burdensome, cost prohibitive, and increase the risk to the public. As
clarified by the FAA in ``Answers to Clarifying Questions Received by
June 28, 2019'' and ``Answers to Clarifying Questions Received by July
29, 2019,'' the term ``all stages and components'' does not imply that
all debris must be tracked to the ground after a vehicle breakup. In
the final rule, the FAA replaces the requirement to ``determine the
actual impact locations'' with the phrase, ``predict the expected
impact locations,'' in Sec. 450.167. Hence, the FAA finds the final
rule requirements are consistent with current practice and thus incur
no additional costs.
xvi. Sec. 450. 173 Mishap Plan--Reporting, Response and Investigating
Requirements
Sierra Nevada recommended removing the mishap plan requirement to
report debris impact points, including those outside a planned landing
or impact area as proposed in Sec. 450.173(d)(3)(iv), this requirement
would be burdensome, cost prohibitive, and not reasonable. Sierra
Nevada stated that this burden would follow because hazard areas are
generated as probability contours and not contours of total
containment. The commenter further stated it was realistic that, in the
event of a breakup scenario, debris would exist outside the hazard area
but not at a high enough probability to warrant segregation.
The FAA notes that the requirement to report hazardous debris
impact points is consistent with the current 5-day reporting
requirements for ELVs. It is not the FAA's intent to require tracking
and surveillance for every possible piece of debris in off-nominal
scenarios. However, based on the vehicle's last-known state vector, an
operator should be able to calculate approximate hazardous debris
impact points, including those points outside a planned landing site or
designated hazard area. The FAA will consider an event that results in
hazardous debris impact points outside a planned landing site or
designated hazard area as a mishap. Considering the potential increased
risk to public safety resulting from hazardous debris impacts outside
planned landing site or designated hazard area, the FAA finds that this
requirement is reasonable and necessary.
In addition to requiring submission of a 5 day report in all mishap
cases, there might be some additional cost associated with submitting
debris impact location data, which is not currently required under part
431. Part 417 requires submission of this data
[[Page 79697]]
only for debris that lands outside the impact limit lines.
The FAA does not agree that this requirement will be costly or
unreasonable for the following reasons. First, the requirement has been
changed to require that only hazardous debris be reported. Second,
operators currently must employ vehicle tracking for normal flight. In
the event of a vehicle breakup, operators should be able to approximate
any hazardous debris impacts in relation to the designated landing site
or hazard area, based on the vehicle's last known state vector or other
tracking resources required for normal flight. In other words, this
requirement will involve only minimal costs because an operator can
leverage vehicle tracking data it already collects in order to submit
the debris impact location data. In addition, the FAA believes the
operator will benefit from reporting this debris.\196\
---------------------------------------------------------------------------
\196\ The debris data reported can be valuable in assessing the
current license representations to allow for adjustments to expand
launch availability or enhance the safety of operations.
---------------------------------------------------------------------------
xvii. Sec. 450.185 Ground Hazard Analysis
Virgin Galactic commented that the ground hazard analysis
requirements proposed in the NPRM would represent new requirements and
a new cost burden, creating new work outside of its existing license.
Virgin Galactic requested that the FAA determine whether a ground
hazard analysis would be necessary for hybrid operators, in accordance
with the Congressional direction that the FAA regulate only to the
extent necessary.
The FAA included estimated costs for ground hazard analyses in the
NPRM. For the final rule, the FAA estimates that 75 percent of
operators will spend no more than 80 hours on the ground hazard and 25
percent of the operators will spend no more than 160 hours (non-
recurring one time per license).
IV. Regulatory Notices and Analyses
A. Regulatory Evaluation
Changes to Federal regulations must undergo several economic
analyses. First, Executive Order 12866 and Executive Order 13563 direct
that each Federal agency shall propose or adopt a regulation only upon
a reasoned determination that the benefits of the intended regulation
justify its costs. In addition, DOT rulemaking procedures in Subpart B
of 49 CFR part 5 instruct DOT agencies to issue a regulation upon a
reasoned determination that benefits exceed costs. Second, the
Regulatory Flexibility Act of 1980 (Pub. L. 96-354) requires agencies
to analyze the economic impact of regulatory changes on small entities.
Third, the Trade Agreements Act (Pub. L. 96-39 as amended) prohibits
agencies from setting standards that create unnecessary obstacles to
the foreign commerce of the United States. In developing U.S.
standards, the Trade Agreements Act requires agencies to consider
international standards and, where appropriate, that they be the basis
of U.S. standards. Fourth, the Unfunded Mandates Reform Act of 1995
(Pub. L. 104-4) requires agencies to prepare a written assessment of
the costs, benefits, and other effects of proposed or final rules that
include a Federal mandate likely to result in the expenditure by State,
local, or tribal governments, in the aggregate, or by the private
sector, of $100 million or more annually (adjusted for inflation with
base year of 1995). The FAA has provided a more detailed Regulatory
Impact Analysis of the benefits and costs of this final rule in the
docket of this rulemaking. This portion of the preamble summarizes the
findings of this analysis.
In conducting these analyses, FAA has determined that this rule
will unleash economic benefits that will outweigh its costs. This rule
is a significant regulatory action, as defined in section 3(f) of
Executive Order 12866, as it raises novel policy issues. This rule is
also significant under DOT's administrative procedure rule on
rulemaking at 49 CFR 5.13 for the same reason. The rule will have a
significant economic impact on a substantial number of small entities.
It will not create unnecessary obstacles to the foreign commerce of the
United States, and will not impose an unfunded mandate on State, local,
or tribal governments, or on the private sector.
Changes to Regulatory Impact Analysis Since the Proposed Rule
The FAA updates its analysis for changes incorporated in the final
rule and additional information and data identified during the comment
period. The following is a summary of these changes (see the Regulatory
Impact Analysis available in the docket for additional discussion and
detail).
Changes period of analysis from 5 to 10 years to capture
the effects of a five-year compliance period and recurring impacts of
the rule.
Provides a range of net impacts from low to high based on
launch forecast that includes base, low, and high scenarios. The FAA
uses the base scenario as the primary estimate of the net impacts of
this rule.
Incorporates additional data to update savings estimates
for changes to an FSS.
Updates data and analysis of neighboring operations
(number of personnel that evacuate) that decreased savings.
Updates wage data and adds/clarifies small costs.
Statement of Need
In 2018, DOT was directed by the National Space Council and SPD-2
to streamline the regulations governing commercial space launch and
reentry licensing. The purpose of the final rule is to streamline and
simplify the licensing of launch and reentry operations by relying on
performance-based regulations rather than prescriptive regulations.
This action consolidates and revises multiple commercial space launch
and reentry regulations addressing licensing into a single regulatory
part that states safety objectives to be achieved for the launch of
suborbital and orbital launch vehicles, and the reentry of reentry
vehicles. This action also enables flexible time frames, removes
unnecessarily burdensome ground safety regulations, redefines when
launch begins to allow specified pre-flight operations prior to license
approval, and allows applicants to seek a license to launch from
multiple sites. This rule is necessary to reduce the need to file and
process waivers, improve clarity of the regulations, and relieve
unnecessary administrative and cost burdens on industry and the FAA.
The intended effect of this action is to make commercial space
transportation regulations more efficient and effective, while
maintaining public safety.
Affected Operators and Launches
At the time of writing based on FAA license data, the FAA estimates
this rule will affect 12 operators that have an active license or
permit to conduct launch or reentry operations. In addition, the FAA
estimates this rule will affect approximately 672 to 800 launches over
the next 10 years, with a base or primary estimate of approximately 737
launches.\197\ The
[[Page 79698]]
FAA anticipates this rule will reduce the costs of current and future
launch operations by removing current prescriptive requirements that
are often burdensome to comply with or require a waiver. The FAA
expects these changes will lead to more efficient launch operations and
have a positive effect on expanding the number of future launch and
reentry operations.
---------------------------------------------------------------------------
\197\ Based on historical launch data from the FAA Office of
Commercial Space Transportation and the 2020 FAA Aerospace Forecast
(https://www.faa.gov/data_research/aviation/aerospace_forecasts/media/FY2020-40_FAA_Aerospace_Forecast.pdf). See the Regulatory
Impact Analysis of this rule in the docket for more information. The
FAA acknowledges that there is uncertainty estimating future
launches over a 10-year period since industry is expanding and
planning for more launches in the future given expected business and
economic conditions. In addition, historical data has shown that
there is uncertainty and variation with the number of planned
launches that result in actual launches on annual basis.
---------------------------------------------------------------------------
Summary of Impacts
The FAA bases the analysis of this rule on a launch forecast that
includes base, low, and high scenarios. Accordingly, this analysis
provides a range of net impacts from low to high based on these
forecast scenarios. The FAA uses the base scenario as the primary
estimate of the net impacts of this rule.
For the primary estimate, over a 10-year period of analysis, the
rule will result in present value net cost savings to industry of about
$53.9 million at a seven percent discount rate with annualized net cost
savings of about $7.7 million. At a three percent discount rate, the
10-year present value net cost savings to industry is about $68.3
million with annualized net cost savings of about $8.0 million. The
rule will also result in net present value savings for the FAA of about
$1.7 million at a seven percent discount rate over the same period of
analysis, with annualized net cost savings of about $0.24 million. At a
three percent discount rate, the net present value savings for the FAA
is about $2.3 million with annualized net cost savings of about $0.27
million.
The largest quantified cost saving for industry will result from
eliminating or modifying requirements for an FSS on some launches:
About $52.6 million in present value savings over 10 years at a seven
percent discount rate or about $66.6 million at a three percent
discount rate. As previously discussed, the FAA will move from
prescriptive FSS requirements to performance-based requirements. The
rule will not require all launch vehicles to have an FSS. Launch
vehicles that have a very low probability of multiple casualties even
if vehicle control fails will not be required to have as robust an FSS.
In addition, vehicles that have moderately low probability of casualty,
even if vehicle control fails, will not be required to have robust
FSS.\198\ These performance-based requirements will reduce costs for
some vehicle operators, especially for small vehicles or those
operating in remote locations.
---------------------------------------------------------------------------
\198\ See discussion in the FSS preamble section.
---------------------------------------------------------------------------
The final rule will also generate another important area of
quantified savings by providing a new definition of ``neighboring
operations personnel'' and establishing new criteria for neighboring
launch site personnel for the purposes of risk and financial
responsibility. The change will allow affected operators to reduce the
number of personnel that must evacuate and will enable operations that
are more concurrent by accepting a small safety risk tradeoff. The FAA
has monetized the value of this small increased safety risk as
summarized in the following tables. The FAA estimates the present value
of these small increased safety risks to be about $0.16 million
discounted at seven percent or about $0.2 million discounted at three
percent over ten years.
The FAA estimates some small costs to industry that will assist
both industry and the FAA in the implementation of this final rule,
such as providing information to the FAA that other agencies frequently
request or performing one-time updates of flight safety limit analyses
and ground hazard analyses that will be used to determine performance-
based means of compliance that provide future savings. In addition,
there may be additional costs for the modification of existing licenses
to benefit from the cost saving provisions of this final rule. The FAA
will also incur small costs for payload review, flight hazard analysis,
ground hazard analysis, and the review of modifications to existing
licenses.
The following tables present a summary of the primary, low, and
high estimates of the quantified savings, costs, and the net impacts of
the rule.
Summary of 10-Year Quantified Savings, Costs and Net Impacts--Base Scenario or Primary Estimate
[Presented in thousands of dollars]
----------------------------------------------------------------------------------------------------------------
Industry Industry
Impact present value present value FAA present FAA present
(7%) (3%) value (7%) value (3%)
----------------------------------------------------------------------------------------------------------------
Cost Savings................................ $54,634.8 $69,193.0 $1,864.2 $2,468.3
Costs....................................... -733.3 -872.2 -162.7 -199.6
-------------------------------------------------------------------
Net Cost Savings........................ 53,901.5 68,320.7 1,701.5 2,268.7
-------------------------------------------------------------------
Annualized Net Cost Savings......... 7,674.4 8,009.3 242.3 266.0
----------------------------------------------------------------------------------------------------------------
Increased Safety Risks...................... -158.5 -197.3 ............... ...............
-------------------------------------------------------------------
Net Cost Savings less Increased Safety 53,743.0 68,123.5 1,701.5 2,268.7
Risks..................................
-------------------------------------------------------------------
Annualized Net Cost Savings less 7,651.8 7,986.1 242.3 266.0
Increased Safety Risks.............
----------------------------------------------------------------------------------------------------------------
Notes: In this and the following tables, the sum of individual items may not equal totals due to rounding.
Negative signs used to indicate costs and increased safety risks. Present value estimates provided at seven
and three percent discount rates per OMB guidance.
Summary of 10-Year Quantified Savings, Costs and Net Impacts--Low Scenario
[Presented in thousands of dollars]
----------------------------------------------------------------------------------------------------------------
Industry Industry
Impact present value present value FAA present FAA present
(7%) (3%) value (7%) value (3%)
----------------------------------------------------------------------------------------------------------------
Cost Savings................................ $44,274.1 $56,404.8 $1,850.3 $2,449.5
[[Page 79699]]
Costs....................................... -695.3 -828.0 -146.8 -180.6
-------------------------------------------------------------------
Net Cost Savings........................ 43,578.8 55,576.7 1,703.5 2,268.9
-------------------------------------------------------------------
Annualized Net Cost Savings......... 6,204.6 6,515.3 242.5 266.0
----------------------------------------------------------------------------------------------------------------
Increased Safety Risks...................... -143.8 -179.6 ............... ...............
-------------------------------------------------------------------
Net Cost Savings less Increased Safety 43,435.0 55,397.2 1,703.5 2,268.9
Risks..................................
-------------------------------------------------------------------
Annualized Net Cost Savings less 6,184.2 6,494.2 242.5 266.0
Increased Safety Risks.............
----------------------------------------------------------------------------------------------------------------
Summary of 10-Year Quantified Savings, Costs and Net Impacts--High Scenario
[Presented in thousands of dollars]
----------------------------------------------------------------------------------------------------------------
Industry Industry
Impact present value present value FAA present FAA present
(7%) (3%) value (7%) value (3%)
----------------------------------------------------------------------------------------------------------------
Cost Savings................................ $64,993.7 $81,979.8 $1,878.4 $2,487.5
Costs....................................... -769.6 -914.8 -179.2 -219.4
-------------------------------------------------------------------
Net Cost Savings........................ 64,224.1 81,065.0 1,699.3 2,268.1
-------------------------------------------------------------------
Annualized Net Cost Savings......... 9,144.1 9,503.3 241.9 265.9
----------------------------------------------------------------------------------------------------------------
Increased Safety Risks...................... -172.5 -214.3 ............... ...............
-------------------------------------------------------------------
Net Cost Savings less Increased Safety 64,051.6 80,850.7 1,699.3 2,268.1
Risks..................................
-------------------------------------------------------------------
Annualized Net Cost Savings less 9,119.5 9,478.2 241.9 265.9
Increased Safety Risks.............
----------------------------------------------------------------------------------------------------------------
The following table summarizes quantified impacts by provision
category for the primary estimate (see the Regulatory Impact Analysis
in the docket for tables presenting low and high estimates of
quantified impacts by provision category).
Summary of 10-Year Quantified Savings, Costs and Net Impacts by Provision Base Scenario--Primary Estimate
[Presented in thousands of dollars]
----------------------------------------------------------------------------------------------------------------
Industry Industry
Provision category/impact present value present value FAA present FAA present
(7%) (3%) value (7%) value (3%)
----------------------------------------------------------------------------------------------------------------
Waiver Avoidance:
--Definition of ``Launch''.............. $23.7 $32.1 $7.5 $10.1
--Waterborne Vessel Hazard Areas........ 47.5 64.2 14.9 20.2
--Waiver for 48 Hour Readiness.......... 29.7 40.1 9.3 12.6
System Safety Program--Safety Official...... 28.4 38.4 33.3 45.0
Duration of a Vehicle License............... 36.6 49.4 76.1 102.8
Readiness--Elimination of pre-launch meeting 860.7 1,169.5 155.9 211.8
15 days prior..............................
Flight Safety System--Not required for all 52,618.2 66,554.4 1,453.9 1,912.7
launches...................................
Flight Safety Analysis no longer required 34.4 46.7 4.4 6.0
for hybrids................................
Neighboring Operations *.................... 873.6 1,087.4 ............... ...............
Ground Hazard Analysis...................... 81.9 110.7 108.8 147.0
-------------------------------------------------------------------
Total Cost Savings...................... 54,634.8 69,193.0 1,864.2 2,468.3
----------------------------------------------------------------------------------------------------------------
Payload Review and Determination............ -52.5 -71.2 -54.0 -73.4
Safety criteria............................. -55.3 -64.1 ............... ...............
Flight Hazard Analysis...................... -56.9 -68.0 -15.9 -19.0
Flight Abort--Flight Safety Limits 58.5 79.0 ............... ...............
Constraint.................................
Flight Safety Limit Analysis................ -114.0 -143.3 ............... ...............
Far-field Overpressure Blast Effects -2.9 -3.9 ............... ...............
Analysis...................................
Safety-Critical System Design............... -19.3 -26.1 ............... ...............
Ground Hazard Analysis...................... -42.4 -57.3 -19.8 -26.8
[[Page 79700]]
Waivers for Neighboring Operations Personnel -171.5 -192.9 -54.0 -60.7
Modification Costs for Existing Licenses.... -160.2 -166.4 -19.0 -19.8
-------------------------------------------------------------------
Total Costs............................. -733.3 -872.2 -162.7 -199.6
-------------------------------------------------------------------
Net Cost Savings........................ 53,901.5 68,320.7 1,701.5 2,268.7
-------------------------------------------------------------------
Annualized Net Cost Savings......... 7,674.4 8,009.3 242.3 266.0
----------------------------------------------------------------------------------------------------------------
Increased Safety Risks: Neighboring -158.5 -197.3 ............... ...............
Operations *...............................
-------------------------------------------------------------------
Net Cost Savings less Increased Safety 53,743.0 68,123.5 1,701.5 2,268.7
Risks..................................
-------------------------------------------------------------------
Annualized Net Cost Savings less 7,651.8 7,986.1 242.3 266.0
Increased Safety Risks.............
----------------------------------------------------------------------------------------------------------------
Table notes: The sum of individual items may not equal totals due to rounding. Negative signs used to indicate
costs and increased safety risks in this table. Present value estimates are provided at seven and three
percent discount rates per OMB guidance.
* Changes to Neighboring Operations requirements result in net savings are less increased safety risks.
The FAA also expects industry will gain additional unquantified
savings and benefits from the final rule, because the rule provides
flexibility and scalability through performance-based requirements that
will reduce the future cost of innovation and improve the efficiency
and productivity of U.S. commercial space transportation.
The following table summarizes some of the changes that will result
in unquantified savings.
Unquantified Savings
------------------------------------------------------------------------
Change Savings
------------------------------------------------------------------------
Time Frames................................... The rule revises time
frames in parts 404,
413, 414, 415, 417,
420, 431, 437, and 440
that may be burdensome
for some operators.
This will increase
flexibility by allowing
an operator the option
to propose alternative
time frames that better
suit its operations.
Eligible time frames
include preflight and
post-flight reporting
among others listed in
Appendix A to Part 404--
Alternative Time
Frames.
Safety Element Approval....................... The rule removes the
requirement in part 414
to publish in the
Federal Register the
criteria upon which
safety element
approvals were based.
The purpose of this
notification
requirement was to make
clear the criteria and
standards the FAA used
to assess a safety
element, particularly
when no clear
regulatory requirement
existed and there could
be other potential
users of the safety
approval. However, the
FAA finds that this
requirement is
unnecessary, and has
potentially discouraged
applications for safety
element approvals due
to concerns that
proprietary data may be
disclosed. The FAA
anticipates that
removing this
requirement will lead
to increased use of
safety element
approvals, reducing
industry burden, and
potentially improving
safety.
Mishaps....................................... The rule provides the
following mishap-
related enhancements,
which will better
tailor mishap
responses.
Replaces
current part 400
mishap related
definitions with a
consolidated mishap
definition
(streamlines and
reduces confusion).
Consolidates
existing part 400
mishap/accident
investigation and
emergency response
plan requirements
into a single part
(streamlines and
reduces confusion).
Exempts pre-
coordinated test-
induced property
damage from being a
mishap (removes need
to consider test-
induced property
damages from mishap
requirements and
likely results in
fewer investigations
of minor mishaps).
Eliminates
the small $25,000
monetary threshold
from the current
mishap and accident
investigation
requirements
potentially reducing
the number of
mishaps investigated
that do not pose a
threat to public
safety. Minor damage
that does not pose a
threat to public
safety can easily
exceed the $25,000
monetary threshold,
triggering
potentially costly
and burdensome
notification,
reporting, and
investigation
requirements.
Clarifies
that a mishap is
triggered by
hazardous debris
falling outside a
planned landing site
or designated hazard
area. As a result,
non-hazardous
debris, no matter
where it falls, will
not be considered a
mishap potentially
avoiding unnecessary
notification,
reporting, and
investigation
requirements.
Toxics........................................ The rule replaces part
417 toxic release
hazard analysis
requirements with
performance-based
regulations that will
provide flexibility for
operators to comply
with the required risk
criteria in varied and
innovative ways for
their ground
operations.
Lightning protection requirement.............. The rule removes
Appendix G to part 417,
Natural and Triggered
Lightning Flight Commit
Criteria, and replaces
it with the performance-
based requirements. The
current requirements
are outdated,
inflexible, overly
conservative, and not
explicitly applicable
to RLVs and reentry
vehicles.
------------------------------------------------------------------------
[[Page 79701]]
The FAA analyzed the impacts of this rule based on the best
available data at the time of writing. The FAA acknowledges that there
are uncertainties with the savings and costs of this rule given the
variety of operators, locations of operations, and the scale and
complexity of operations. In addition, there is uncertainty regarding
how operators holding an active license, or who have an accepted
license application, will choose to operate during the five-year
compliance period after the effective date of the rule (i.e., choose to
operate under part 450 or operate under the legacy parts 415 and 417
for expendable launch vehicles, part 431 for reusable launch vehicles,
and part 435 for reentry vehicles). Lastly, there is uncertainty in the
range and scope of future means of compliance, since this rule replaces
many prescriptive regulations with performance-based rules, giving
industry greater flexibility to develop means of compliance that meet
their unique business objectives while maintaining public safety. All
of these factors may result in variation of savings and costs for
individual operators during and after the five-year compliance period.
As previously discussed, the FAA will continue to work with industry to
identify alternative means of compliance to provide future savings and
efficiencies from this rule as industry continues to evolve.
B. Regulatory Flexibility Act
The Regulatory Flexibility Act of 1980 (Pub. L. 96-354) (RFA)
establishes ``as a principle of regulatory issuance that agencies shall
endeavor, consistent with the objectives of the rule and of applicable
statutes, to fit regulatory and informational requirements to the scale
of the businesses, organizations, and governmental jurisdictions
subject to regulation. To achieve this principle, agencies are required
to solicit and consider flexible regulatory proposals and to explain
the rationale for their actions to assure that such proposals are given
serious consideration.'' The RFA covers a wide-range of small entities,
including small businesses, not-for-profit organizations, and small
governmental jurisdictions.
Agencies must perform a review to determine whether a proposed or
final rule would have a significant economic impact on a substantial
number of small entities. If the determination is that it would, the
agency must prepare a regulatory flexibility analysis as described in
the RFA.
The FAA estimates this final rule will have a significant economic
impact on a substantial number of small entities and therefore has
performed the following Final Regulatory Flexibility Analysis in
accordance with section 604(a)(1)-(a)(6).
(1) A statement of the need for, and objectives of, the rule.
The Department of Transportation was directed by the National Space
Council in February 2018, and SPD-2 to streamline the regulations
governing commercial space launch and reentry licensing. The goal of
the streamlining rule is to create a single licensing regime for
expendable and reusable launch vehicles and reentry vehicles.
The purpose of the final rule is to streamline and simplify the
licensing of launch and reentry operations by relying on performance-
based regulations rather than prescriptive regulations. This action
consolidates and revises multiple commercial space launch and reentry
regulations addressing licensing into a single regulatory part that
states safety objectives to be achieved for the launch of suborbital
and orbital expendable and reusable launch vehicles, and the reentry of
reentry vehicles. This action also enables flexible time frames,
removes unnecessarily burdensome ground safety regulations, redefines
when launch begins to allow specified pre-flight operations prior to
license approval, and allows applicants to seek a license to launch
from multiple sites. This rule is necessary to reduce the need to file
and process waivers, improve clarity of the regulations, and relieve
administrative and cost burdens on industry and the FAA. The intended
effect of this action is to make commercial space transportation
regulations more efficient and effective, while maintaining public
safety.
(2) A statement of the significant issues raised by the public
comments in response to the initial regulatory flexibility analysis, a
statement of the assessment of the agency of such issues, and a
statement of any changes made in the proposed rule as a result of such
comments.
Commenters indicated that the FAA only identified two small
entities that will be affected by the rule and left out numerous small
entities that will be affected. The FAA has reevaluated and identified
at least five small entities that will be affected by the rule and
indicates this fact in the description of small entities section in
this Final Regulatory Flexibility Analysis.
An individual commenter also noted that beyond the small entities
not addressed in the analysis as noted above, the FAA's proposal would
also impact small companies that are subcontractors, suppliers, or
service providers to licensed launch or reentry operators, both in
regard to a particular event and in the activities of neighboring
operations not involved in a particular licensed or permitted event.
The FAA finds these subcontractors, suppliers, or service providers
to licensed launch and reentry operators are not directly impacted by
the rule. The RFA requires an agency to perform a regulatory
flexibility analysis of small entity impacts only when a rule directly
regulates small entities. A commenter indicated that small State or
local governmental jurisdictions might be affected by the rule and
these were not mentioned by the FAA in the RFA. The commenter appeared
to be referring to potential costs from environmental review practices
and policies now being codified into rules. The FAA addresses concerns
related to potential costs from this codification in the comment
section of this preamble and finds that the potential costs are
negligible.
An individual commenter claimed several proposed new flight safety
requirements would impose complex and costly risk analyses on small
entities, including the ``consequence protection'' requirement, the
``critical assets'' risk assessment requirement, and flight software
requirements. Also, the commenter pointed out the duplicative or
conflicting rules among overlapping Federal jurisdictions as creating a
barrier for small startups.
The FAA finds the costs of these critical asset and consequence
protection requirements will be small or nonexistent. Operators in
remote locations will likely be able to avoid the higher costs of a
highly reliable FSS by demonstrating through a CEC analysis
that the launch in question will not exceed a certain risk threshold.
The initial CEC analysis under Sec. 450.101 that is
estimated to cost $2,500 may relieve some operators from the expense of
any FSS. If a determination is made that an FSS is necessary, further
analysis under Sec. 450.108 will be performed to determine the flight
safety limits needed for the FSS. The FAA estimated the cost of the
additional analysis to account for CEC in the flight safety
limit is $10,000. Of course, an operator could avoid these analysis
costs simply by choosing to use a highly reliable FSS, but the FAA
assumes that an operator would not perform these analyses if it
expected that it would still need the most highly reliable FSS. The
worst case would be that the operator would incur $12,500 in costs but
still need an FSS, just not a highly reliable FSS. The final rule also
allows an applicant to propose an alternative to CEC that
would measure
[[Page 79702]]
or mitigate the potential for a high consequence event by use of other
safeguards.
The identification of critical assets and the analysis to determine
how to protect the critical assets will be performed by the ranges for
launches from Federal sites and by the FAA for launches from non-
Federal sites. Therefore, small entities will not bear these costs.
(3) The response of the agency to any comments filed by the Chief
Counsel for Advocacy of the Small Business Administration in response
to the proposed rule, and a detailed statement of any change made to
the proposed rule in the final rule as a result of the comments.
The Chief Counsel for Advocacy of the Small Business Administration
did not file comments in response to the proposed rule.
(4) A description of and an estimate of the number of small
entities to which the rule will apply or an explanation of why no such
estimate is available.
The FAA identifies at least five licensees that would qualify as
small businesses. The rule will have a large effect in terms of cost
savings on some of these small businesses. In addition to the five
operators, there are two licensees that will be affected by the rule
that may fall under the small business threshold in terms of number of
employees, but they are subsidiaries of large parent companies and
therefore are not considered small businesses.
(5) A description of the projected reporting, recordkeeping, and
other compliance requirements of the rule, including an estimate of the
classes of small entities that will be subject to the requirement and
the type of professional skills necessary for preparation of the report
or record.
The rule will result in a reduction in reporting requirements
because there will be fewer requests for waivers to certain provisions,
fewer requests to modify licenses when a safety officer changes, and
fewer licenses having to be issued because there will be extension of
RLV licenses up to five years. The documentation accompanying a ground
hazard analysis for ELV operators will be reduced due to change in
launch scope.
Some new requirements will result in additional reporting. This
reporting includes the following:
(1) Paperwork associated with payload review and determination,
and safety criteria analyses;
(2) Paperwork resulting from the flight safety limits analysis
and the far-field overpressure blast effects analysis;
(3) Paperwork submitted by legacy license who would like to
waive the higher conditional expected casualty level for neighboring
operations under the current regulations, or the new ground safety
requirements for RLV operators; and
(4) Paperwork costs for those operators who modify their
licenses in the first five years to comply with the new regulations.
The paperwork costs are discussed in more detail in the Paperwork
Reduction Analysis section of this preamble.
(6) A description of the steps the agency has taken to minimize the
significant economic impact on small entities consistent with the
stated objectives of applicable statutes, including a statement of the
factual, policy, and legal reasons for selecting the alternative
adopted in the final rule and why each one of the other significant
alternatives to the rule considered by the agency which affect the
impact on small entities was rejected.
a. Factual, Policy, and Legal Reasons for Selecting the Adopted
Alternative
The Commercial Space Launch Act of 1984, as amended and re-codified
at 51 U.S.C. 50901-50923 (the Act), authorizes the Department of
Transportation, and the FAA through delegation, to oversee, license,
and regulate commercial launch and reentry activities, and the
operation of launch and reentry sites as carried out by U.S. citizens
or within the United States. Section 50905 directs the FAA to exercise
this responsibility consistent with public health and safety, safety of
property, and the national security and foreign policy interests of the
United States. The FAA is authorized to regulate only to the extent
necessary to protect the public health and safety, safety of property,
and national security and foreign policy interests of the United
States. In addition, section 50903 requires that the FAA encourage,
facilitate, and promote commercial space launches and reentries by the
private sector.
This rulemaking streamlines and increases flexibility in the FAA's
commercial space regulations. This action consolidates and revises
multiple regulatory parts to apply a single set of licensing and safety
regulations across several types of operations and vehicles. It also
replaces many prescriptive regulations with performance-based rules,
giving industry greater flexibility to develop means of compliance that
maximize their business objectives while maintaining an equivalent
level of safety to the agency's current regulations. Because this
rulemaking amends the FAA's launch and reentry requirements, it falls
under the authority delegated by the Act.
b. Alternatives Considered
The FAA considered three alternatives to the proposed rule. The FAA
restates these alternatives below. The FAA did not receive comment
convincing it that any of these alternatives would be better than the
rule it proposed and is now finalizing.
i. No Change to Current Regulations
This alternative was not chosen because the current regulations are
outdated, prescriptive, and do not adequately reflect industry current
practices or technology development. The inefficiency of the licensing
process due to current regulations risks stifling innovation and growth
of the industry, especially for small operators.
ii. Propose a More Process-Based Regulatory Approach
With this alternative, the FAA would have proposed less detailed
regulations that would have relied primarily on the outcome of an
operator's system safety process to protect public safety. The FAA did
not chose this alternative because it would have lacked regulatory
clarity and hazard control flexibility. System safety process is one
method to derive hazard controls; however, there are other hazard
control strategies that are more appropriate for some operations.
Specifically, physical containment, wind weighting, and, most
importantly, flight abort are often sufficient. Part 450 incorporates
the flexibility of part 431, but acknowledges the acceptability of
other hazard control strategies. Part 450 also builds on the precedent
set by part 431's limits on the foreseeable consequences of a failure
in terms of conditional expected casualties and establishes a less
stringent threshold.With this final rule, the FAA declines to adopt
this alternative.
iii. Propose a Defined Modular Application Process
With this alternative, the FAA would have proposed similar safety
requirements but would have added a more defined incremental or modular
application process. The final rule enables an incremental application
process, but does not define one with explicit modules and time frames.
This alternative was not chosen because the FAA has no experience with
an incremental or modular application process with which to base a
rule. In addition, a more defined incremental or modular application
process may be less flexible and scalable and therefore more burdensome
to small operators.
[[Page 79703]]
The FAA expects this final rule will provide regulatory relief to
small entities from current prescriptive requirements and result in net
savings. Accordingly, the FAA declines to adopt this alternative.
c. Cost Savings to Small Entities
The following sections identifies key provisions of the rule that
minimize impacts to and expand flexibilities for small entities.
i. Readiness--Elimination of Pre-Launch Meeting 15 Days Prior (Sec.
450.155)
ELV operators might save $4,683 per avoided launch readiness
meeting; however, this assumes the average number of people at each
meeting would be 25 and this might not apply to a small business.
ii. Flight Safety System--Not Required for All Launches (Sec. 450.145)
For launches for which an FSS would not be required under the
proposal, ELV operators might save $100,000 to $680,000 per launch and
RLV operators might save $20,000 per launch vehicle.
ELV operators might save between $479,000 and $1.4 million in non-
recurring costs and RLV operators might save approximately $375,000 for
new FSS designs by not having to incur all the research, design,
testing, materials, and installation costs for an FSS. This is likely
to benefit small operators launching from remote sites.
iii. Ground Hazard Analysis (Sec. 450.185)
An ELV operator might save approximately $28,026 per application by
not having to do a ground hazard analysis under this final rule.
d. Costs to Small Entities
The following sections identify provisions of the rule that might
result in additional costs for small entities. However, the rule
provides a compliance period of five years for holders of current
licenses at the effective date of the final rule and those who have an
accepted application within 90 days of the effective date of the final
rule. This will provide small operators more time to comply with the
final rule and will reduce costs.
i. Payload Review and Determination (Sec. 450.43)
The final rule could cause small operators to incur about $206 more
per launch than due to additional payload review and determination
costs.
ii. Flight Hazard Analysis (Sec. 450.107)
Operators who do not need FSS, and choose to operate without one,
will have to perform a flight hazard analysis. RLV operators currently
do flight hazard analyses, while ELV operators do not. To save the
costs of an FSS, an ELV operator will have to use another hazard
control strategy which will likely be a flight hazard analysis. In the
regulatory impact analysis, two small businesses have to perform a
flight hazard analysis. However, the cost savings of not having to have
an FSS will far exceed the costs of the flight hazard analysis.
iii. Flight Abort (Sec. 450.108(d)) Flight Safety Limits Constraint
Some operators will choose to do a CEC analysis
voluntarily as part of the flight safety limits analysis so they can
expand the area their flights can pass through. These operators would
only do this additional analysis if they expected the benefit to exceed
the cost. The estimated voluntary cost of $10,000 per license could be
incurred by small businesses.
iv. Far-Field Overpressure Blast Effects Analysis (Sec. 450.137)
Additional costs are $330 per application.
v. Safety-Critical System Design (Sec. 450.143)
Additional documentation costs are $1,649 per application.
vi. Ground Hazard Analysis (Sec. 450.185)
RLV applicants might incur about $7,254 more per application due to
having to perform ground hazard analyses under the final rule.
As previously discussed, the FAA provides a compliance period of
five years in the final rule for holders of current licenses at the
effective date of the final rule and those who have an accepted
application within 90 days of the effective date of the final rule.
This will give all businesses, including the small operators, more time
to comply with the final rule. This will reduce the burden on small
entities.
C. International Trade Impact Assessment
The Trade Agreements Act of 1979 (Pub. L. 96-39), as amended by the
Uruguay Round Agreements Act (Pub. L. 103-465), prohibits Federal
agencies from establishing standards or engaging in related activities
that create unnecessary obstacles to the foreign commerce of the United
States. Pursuant to these Acts, the establishment of standards is not
considered an unnecessary obstacle to the foreign commerce of the
United States, if the standard has a legitimate domestic objective,
such as the protection of safety, and does not operate in a manner that
excludes imports that meet this objective. The statute also requires
consideration of international standards and, where appropriate, that
they serve as the basis for U.S. standards. The FAA has assessed the
potential effect of this final rule and determined that it will not
create unnecessary obstacles to the foreign commerce of the United
States.
D. Unfunded Mandates Assessment
Title II of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-
4) requires each Federal agency to prepare a written statement
assessing the effects of any Federal mandate in a proposed or final
agency rule that may result in an expenditure of $100 million or more
(in 1995 dollars) in any one year by State, local, and tribal
governments, in the aggregate, or by the private sector; such a mandate
is deemed to be a ``significant regulatory action.'' The threshold
after adjustment for inflation is $150 million using the most current
annual (2017) Implicit Price Deflator for Gross Domestic Product from
the U.S. Bureau of Economic Analysis. This final rule does not contain
such a mandate; therefore, the requirements of Title II of the Act do
not apply.
E. Paperwork Reduction Act
The Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)) requires
that the FAA consider the impact of paperwork and other information
collection burdens imposed on the public. According to the 1995
amendments to the Paperwork Reduction Act (5 CFR 1320.8(b)(2)(vi)), an
agency may not collect or sponsor the collection of information, nor
may it impose an information collection requirement, unless it displays
a currently valid Office of Management and Budget (OMB) control number.
This action contains the following proposed consolidation of two
existing information collection requirements, previously approved under
OMB Control Numbers 2120-0608 and 2120-0643, under a new OMB control
number. As required by the Paperwork Reduction Act of 1995 (44 U.S.C.
3507(d)), the FAA will submit the proposed information collection
requirements to OMB for its review. In addition, the FAA has published
a separate notice of the proposed requirements for public comment, and
has included the notice in the docket for this rulemaking. The notice
includes instructions on how to submit comments specifically to the
proposed information collection requirements. Additional details on
assumptions and
[[Page 79704]]
calculations used in this section are presented in the Preliminary
Regulatory Impact Analysis available in the docket of this rulemaking.
The following estimates are included in the total savings and costs
summarized in the Regulatory Evaluation section and considered in the
Regulatory Flexibility Determination section of this proposed rule.
Because the FAA is allowing a five year compliance period for
existing operators holding a license under parts 417, 431, or 435, OMB
Control Numbers 2120-0608 and 2120-0643 will continue to be renewed for
five years. After five years, all operators are expected to comply with
part 450 and the new OMB number for collections.
Summary: The FAA proposes to consolidate under a new part 450, the
requirements currently contained in parts 415 and 417 for the launch of
an ELV, in part 431 for the launch and reentry of an RLV, and in part
435 for the reentry of a reentry vehicle other than an RLV. The result
of this effort will be streamlined regulations designed to be more
flexible and scalable, with reduced timelines and minimal duplicative
jurisdiction. The net result will be reduced paperwork for operators,
although for some provisions paperwork would increase.
Use: The information would be used by FAA to evaluate the launch
and reentry operators' applications and to ensure safety.
Paperwork Impact to Industry
Respondents: The information collection will potentially affect 12
operators based on available data at the time of writing.
Annual Burden Estimate: Most changes in part 450 will result in a
reduction in paperwork burden. The paperwork associated with industry
requesting waivers to certain provisions will be alleviated. Paperwork
associated with industry requesting license modifications would also be
reduced because an operator will not have to modify a license if the
specific safety official were to change. In addition, with the
extension of RLV licenses to up to five years, it is likely that fewer
licenses will be issued, resulting in less paperwork. Due to the change
in launch scope, the documentation accompanying a ground hazard
analysis for ELV operators would be reduced.
Industry Cost Savings
The following table indicates the frequency of responses, the
estimated time per response, the burdened wage rate, annual hours, and
the cost for each cost saving provision. Response frequency is provided
for the estimated number of waivers avoided (Sec. 450.3), estimated
reduction in annual number of licenses modified (Sec. 450.103),
estimated reduction in annual license renewals, and estimated annual
number of launches for which there would be a reduction in ground
hazard analysis paperwork (Sec. 450.185). An estimated time for each
response is also indicated below, as are burdened hourly wage rates for
the specific personnel associated with each provision and annual hours
and total cost savings.
Industry Paperwork Cost Savings
----------------------------------------------------------------------------------------------------------------
Estimated time
Description Response per response Industry wage Annual hours Cost savings
frequency (hours) rate
----------------------------------------------------------------------------------------------------------------
Waiver Avoidance (Sec. 450.3). 17 20 $101.52 340 $34,518
System Safety Program--Safety 5.6 24 72.40 134.4 9,731
Official (Sec. 450.103)......
Duration of a Vehicle License 1.2 126.5 82.43 151.8 12,513
(Sec. 450.7).................
Ground Hazard Analysis (Sec. 1 340 82.43 340 28,026
450.185).......................
-------------------------------------------------------------------------------
Total Annual Savings........ 24.8 .............. .............. 966 84,788
----------------------------------------------------------------------------------------------------------------
Cost savings includes paperwork related to waivers avoided due to
the definition of ``launch,'' waterborne vessel protection, and removal
of the 48-hour readiness requirement.
Industry Paperwork Burden
Other changes will result in an increase in paperwork burden. The
Payload Review and Determination section (Sec. 450.43) adds
requirements for applicants to provide explosive potential of payload
materials, alone and in combination with other materials on the payload
for launches, as well as the appropriate transit time to final orbit
for payloads with significant transit time after release from the
vehicle. The FAA is adding requirements for ground hazard analysis
(Sec. 450.185) for RLV launches. The provisions that will lead to
additional paperwork burdens are listed in the table below. The final
rule requires RLVs to submit information to the FAA.
The table below indicates the frequency of responses, estimated
time per response, burdened hourly wage rate, annual hours, and the
cost for each provision that would add burden. An estimated time per
response is also indicated below, as are burdened hourly wage rates for
the specific personnel associated with each provision and annual hours
and total cost savings.
Industry Paperwork Burden
----------------------------------------------------------------------------------------------------------------
Estimated time
Description Response per response Industry wage Annual hours Cost
frequency (hours) rate
----------------------------------------------------------------------------------------------------------------
Explosive Potential (Sec. 82 2 $82.43 164 $13,519
450.43)........................
Transit time (Sec. 450.43).... 82 0.5 82.43 41.0 3,380
Ground Hazard Analysis (Sec. 2 88 82.43 176 14,508
450.185).......................
Safety criteria (Sec. 4 60.66 82.43 80.88 6,667
450.101(c))....................
Flight Hazard Analysis (Sec. 2 53 82.43 106.67 8,793
450.107).......................
Flight Abort (Sec. 450.108(d)) 2 121 82.43 242.63 20,000
Flight Safety Limits Constraint
Flight Safety Limit Analysis 12 58 82.43 692 57,042
(Sec. 450.123)...............
Far-field Overpressure Blast 3 4 82.43 12 989
Effects Analysis (Sec.
450.137).......................
[[Page 79705]]
Safety-Critical System Design... 4 20 82.43 80 6,594
Waivers for Neighboring 18.9 20 101.52 378 38,375
Operations Personnel...........
Modification Costs for Existing 3 693 82.43 693 57,124
Licenses.......................
Records set up, record, archive. 82 4 89.72 328 29,429
Records retrieve and present.... 1 8 74.15 8 593
-------------------------------------------------------------------------------
Total Cost Burden........... 298 .............. .............. 3,002 257,012
----------------------------------------------------------------------------------------------------------------
The following table summarizes the industry total annual paperwork
savings, total annual paperwork burden and the net annual paperwork
savings.
Industry Net Paperwork Savings
------------------------------------------------------------------------
Description Annual hours Cost savings
------------------------------------------------------------------------
Total Annual Savings.................... 966 $84,787
Total Annual Burden..................... 3,002 257,012
-------------------------------
Net Annual Burden................... 2,036 172,225
------------------------------------------------------------------------
Paperwork Burden to the Federal Government
The following tables summarizes FAA paperwork savings and burden.
Similar to industry burden savings, the FAA receives burden relief from
waivers avoided due to the definition of ``launch,'' waterborne vessel
protection, and removal of the 48-hour readiness requirement. Other
provisions the FAA receives relief from and provisions that will impose
additional paperwork burden to the FAA are detailed in the tables
below. See the Regulatory Impact Analysis available in the docket for
more details on these estimates and calculations.
----------------------------------------------------------------------------------------------------------------
Estimated time
Description per response FAA wage rate Annual hours Cost savings
(hours)
----------------------------------------------------------------------------------------------------------------
FAA Paperwork Cost Savings
----------------------------------------------------------------------------------------------------------------
Waiver Avoidance (Sec. 450.3)................. 7.5 $85.17 127.5 $10,859
System Safety Program--Safety Official (Sec. 24 84.79 134.4 11,396
450.103).......................................
Duration of a Vehicle License (Sec. 450.7).... 253.5 85.54 304.2 26,021
Ground Safety (Sec. 450.185).................. 439 84.79 439 37,223
---------------------------------------------------------------
Total Annual Savings........................ .............. .............. 1,005 85,499
----------------------------------------------------------------------------------------------------------------
FAA Paperwork Burden
----------------------------------------------------------------------------------------------------------------
Explosive Potential (Sec. 450.43)............. 2.0 84.79 164 13,906
Transit time (Sec. 450.43).................... 0.5 84.79 41 3,476
Ground Safety (Sec. 450.185).................. 40 84.79 80 6,783
Flight Hazard Analysis (Sec. 450.107)......... 47 78.27 31 2,452
Waivers for Neighboring Operations Personnel.... 8 85.17 142 12,094
Modification Costs for Existing Licenses........ 80 84.79 80 6,783
Records retrieve and present.................... 20 84.79 20 1,696
---------------------------------------------------------------
Total Annual Burden......................... .............. .............. 558 47,191
----------------------------------------------------------------------------------------------------------------
FAA Net Paperwork Savings
------------------------------------------------------------------------
Description Annual hours Cost savings
------------------------------------------------------------------------
Total Annual Savings.................... 1,005 $85,499
Total Annual Burden..................... 558 47,191
-------------------------------
Net Annual Savings.................. 447 38,308
------------------------------------------------------------------------
[[Page 79706]]
Individuals and organizations may send comments on the information
collection requirement to the address listed in the ADDRESSES section
at the beginning of this preamble by March 10, 2021. Comments also
should be submitted to the Office of Management and Budget, Office of
Information and Regulatory Affairs, Attention: Desk Officer for FAA,
New Executive Building, Room 10202, 725 17th Street NW, Washington, DC
20053.
F. International Compatibility
In keeping with U.S. obligations under the Convention on
International Civil Aviation, it is FAA policy to conform to
International Civil Aviation Organization (ICAO) Standards and
Recommended Practices to the maximum extent practicable. The FAA has
determined that there are no ICAO Standards and Recommended Practices
that correspond to these proposed regulations.
G. Environmental Analysis
FAA Order 1050.1 identifies FAA actions that are categorically
excluded from preparation of an environmental assessment or
environmental impact statement under the National Environmental Policy
Act in the absence of extraordinary circumstances. The FAA has
determined this rulemaking action qualifies for the categorical
exclusion identified in FAA Order 1050.1 paragraph 5-6.6 and involves
no extraordinary circumstances.
V. Executive Order Determinations
A. Executive Order 13771, Reducing Regulation and Controlling
Regulatory Costs
This final rule is considered an E.O. 13771 deregulatory action.
Details on the estimated cost savings of this final rule can be found
in the rule's economic analysis.
B. Executive Order 13132, Federalism
The FAA has analyzed this final rule under the principles and
criteria of Executive Order 13132, ``Federalism.'' The agency
determined that this action will not have a substantial direct effect
on the States, or the relationship between the Federal Government and
the States, or on the distribution of power and responsibilities among
the various levels of government, and, therefore, does not have
federalism implications.
C. Executive Order 13211, Regulations That Significantly Affect Energy
Supply, Distribution, or Use
The FAA analyzed this final rule under Executive Order 13211,
``Actions Concerning Regulations that Significantly Affect Energy
Supply, Distribution, or Use'' (May 18, 2001). The agency has
determined that it is not a ``significant energy action'' under the
executive order and it is not likely to have a significant adverse
effect on the supply, distribution, or use of energy.
D. Executive Order 13609, International Cooperation
Executive Order 13609, ``Promoting International Regulatory
Cooperation,'' promotes international regulatory cooperation to meet
shared challenges involving health, safety, labor, security,
environmental, and other issues and to reduce, eliminate, or prevent
unnecessary differences in regulatory requirements. The FAA has
analyzed this action under the policies and agency responsibilities of
Executive Order 13609, and has determined that this action will not
affect international regulatory cooperation.
VI. How To Obtain Additional Information
Rulemaking Documents
An electronic copy of a rulemaking document may be obtained by
using the internet--
1. Search the Federal eRulemaking Portal at https://www.regulations.gov;
2. Visit the FAA's Regulations and Policies web page at https://www.faa.gov/regulations_policies/; or
3. Access the Government Printing Office's web page at https://www.gpo.gov/fdsys/.
Copies may also be obtained by sending a request (identified by
notice, amendment, or docket number of this rulemaking) to the Federal
Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence
Avenue SW, Washington, DC 20591, or by calling (202) 267-9677.
Comments Submitted to the Docket
Comments received may be viewed by going to https://www.regulations.gov and following the online instructions to search the
docket number for this action. Anyone may search the electronic form of
all comments received into any of the FAA's dockets by the name of the
individual submitting the comment (or signing the comment, if submitted
on behalf of an association, business, labor union, etc.).
Small Business Regulatory Enforcement Fairness Act
The Small Business Regulatory Enforcement Fairness Act (SBREFA) of
1996 requires FAA to comply with small entity requests for information
or advice about compliance with statutes and regulations within its
jurisdiction. A small entity with questions regarding this document,
may contact its local FAA official, or the person listed under the FOR
FURTHER INFORMATION CONTACT heading at the beginning of the preamble.
To find out more about SBREFA on the internet, visit https://www.faa.gov/regulations_policies/rulemaking/sbre_act/.
List of Subjects
14 CFR Part 401
Organization and functions (Government agencies), Space
Transportation and exploration.
14 CFR Part 404
Administrative practice and procedure, Space transportation and
exploration.
14 CFR Part 413
Confidential business information, Space transportation and
exploration.
14 CFR Part 414
Airspace, Aviation safety, Space transportation and exploration.
14 CFR Part 415
Aviation safety, Environmental protection, Space transportation and
exploration.
14 CFR Part 417
Aircraft, Aviation safety, Reporting and recordkeeping
requirements, Space transportation and exploration.
14 CFR Part 420
Environmental protection, Reporting and recordkeeping requirements,
Space transportation and exploration.
14 CFR Part 431
Aviation safety, Environmental protection, Investigations,
Reporting and recordkeeping requirements, Space transportation and
exploration.
14 CFR Part 435
Aviation safety, Environmental protection, Investigations,
Reporting and recordkeeping requirements, Space transportation and
exploration.
14 CFR Part 437
Aircraft, Aviation safety, Reporting and recording keeping
requirements, Space transportation and exploration.
[[Page 79707]]
14 CFR Part 440
Indemnity payments, Insurance, Reporting and recordkeeping
requirements, Space transportation and exploration.
14 CFR Part 450
Aircraft, Aviation safety, Environmental protection,
Investigations, Reporting and recordkeeping requirements, Space
transportation and exploration.
In consideration of the foregoing, the Federal Aviation
Administration amends chapter III for commercial space transportation
rules of title 14, Code of Federal Regulations as follows:
PART 401--ORGANIZATION AND DEFINITIONS
0
1. The authority citation for part 401 continues to read as follows:
Authority: 51 U.S.C. 50101-50923.
0
2. Amend Sec. 401.5 by revising the introductory text to read as
follows:
Sec. 401.5 Definitions.
For the purposes of parts 415, 417, 431, 435, 440, and 460 of this
chapter, the following definitions apply:
* * * * *
Sec. 401.5 [Removed and Reserved]
0
3. Effective March 10, 2026, remove and reserve Sec. 401.5.
0
4. Add Sec. 401.7 to read as follows:
Sec. 401.7 Definitions.
For the purposes of this chapter unless otherwise excepted, the
following definitions apply:
Act means 51 U.S.C Subtitle V, Programs Targeting Commercial
Opportunities, chapter 509--Commercial Space Launch Activities, 51
U.S.C. 50901-50923.
Anomaly means any condition during licensed or permitted activity
that deviates from what is standard, normal, or expected, during the
verification or operation of a system, subsystem, process, facility, or
support equipment.
Associate Administrator means the Associate Administrator for
Commercial Space Transportation, Federal Aviation Administration, or
any person designated by the Associate Administrator to exercise the
authority or discharge the responsibilities of the Associate
Administrator.
Casualty means serious injury or death.
Casualty area means the area surrounding each potential debris or
vehicle impact point where serious injuries, or worse, can occur.
Command control system means the portion of a flight safety system
that includes all components needed to send a flight abort control
signal to the on-board portion of a flight safety system.
Contingency abort means a flight abort with a landing at a planned
location that has been designated in advance of vehicle flight.
Countdown means the timed sequence of events that must take place
to initiate flight of a launch vehicle or reentry of a reentry vehicle.
Crew means any employee or independent contractor of a licensee,
transferee, or permittee, or of a contractor or subcontractor of a
licensee, transferee, or permittee, who performs activities in the
course of that employment or contract directly relating to the launch,
reentry, or other operation of or in a launch vehicle or reentry
vehicle that carries human beings. A crew consists of flight crew and
any remote operator.
Critical asset means an asset that is essential to the national
interests of the United States. Critical assets include property,
facilities, or infrastructure necessary for national security purposes,
high priority civil space purposes, or assured access to space for
national priority missions.
Critical payload means a payload and essential infrastructure
directly supporting such a payload that is a critical asset that:
(1) Is so costly or unique that it cannot be readily replaced; or
(2) The time frame for its replacement would adversely affect the
national interests of the United States.
Crossrange means the distance measured along a line whose direction
is either 90 degrees clockwise (right crossrange) or counter-clockwise
(left crossrange) to the projection of a vehicle's planned nominal
velocity vector azimuth onto a horizontal plane tangent to the
ellipsoidal Earth model at the vehicle's sub-vehicle point. The terms
right crossrange and left crossrange may also be used to indicate
direction.
Deorbit means the flight of a vehicle that begins with the final
command to commit to a perigee below 70 nautical miles (approximately
130 kilometers), and ends when all vehicle components come to rest on
the Earth.
Disposal means the return or attempt to return, purposefully, a
launch vehicle stage or component, not including a reentry vehicle,
from Earth orbit to Earth, in a controlled manner.
Downrange means the distance measured along a line whose direction
is parallel to the projection of a vehicle's planned nominal velocity
vector azimuth into a horizontal plane tangent to the ellipsoidal Earth
model at the vehicle sub-vehicle point. The term downrange may also be
used to indicate direction.
Effective casualty area means the aggregate casualty area of each
piece of debris created by a vehicle failure at a particular point on
its trajectory. The effective casualty area for each piece of debris is
a modeling construct in which the area within which 100 percent of the
population are assumed to be a casualty, and outside of which 100
percent of the population are assumed not to be a casualty.
Equivalent level of safety means an approximately equal level of
safety as determined by qualitative or quantitative means.
Expected casualty means the mean number of casualties predicted to
occur per flight operation if the operation were repeated many times.
Expendable launch vehicle means a launch vehicle whose propulsive
stages are flown only once.
Experimental permit or permit means an authorization by the FAA to
a person to launch or reenter a reusable suborbital rocket.
Explosive debris means solid propellant fragments or other pieces
of a vehicle or payload that result from breakup of the vehicle during
flight and that explode upon impact with the Earth's surface and cause
overpressure.
Federal launch or reentry site means a launch or reentry site, from
which launches routinely take place, that is owned and operated by the
government of the United States.
Flight abort means the process to limit or restrict the hazards to
public safety, and the safety of property, presented by a launch
vehicle or reentry vehicle, including any payload, while in flight by
initiating and accomplishing a controlled ending to vehicle flight.
Flight abort rules means the conditions under which a flight safety
system must abort the flight to ensure compliance with the safety
criteria in Sec. 450.101.
Flight crew means crew that is on board a vehicle during a launch
or reentry.
Flight hazard area means any region of land, sea, or air that must
be surveyed, publicized, controlled, or evacuated to ensure compliance
with the safety criteria in Sec. 450.101.
Flight safety limit means criteria to ensure that public safety and
critical assets are protected from the flight of a vehicle when a
flight safety system functions properly.
Flight safety system means a system used to implement flight abort.
A flight safety system includes any flight safety system located on
board a launch or
[[Page 79708]]
reentry vehicle; any ground based command control system; any support
system, including telemetry subsystems and tracking subsystems,
necessary to support a flight abort decision; and the functions of any
personnel who operate the flight safety system hardware or software.
Hazard control means a preventative measure or mitigation put in
place for systems or operations to reduce the severity of a hazard or
the likelihood of the hazard occurring.
Hazardous debris means any object or substance capable of causing a
casualty or loss of functionality to a critical asset. Hazardous debris
includes inert debris and explosive debris such as an intact vehicle,
vehicle fragments, any detached vehicle component whether intact or in
fragments, payload, and any planned jettison bodies.
Hazardous materials means hazardous materials as defined in 49 CFR
172.101.
Instantaneous impact point means a predicted impact point,
following thrust termination of a vehicle.
Key flight safety event means a flight activity that has an
increased likelihood of causing a failure compared with other portions
of flight.
Launch means to place or try to place a launch vehicle or reentry
vehicle and any payload or human being from Earth in a suborbital
trajectory, in Earth orbit in outer space, or otherwise in outer space,
including activities involved in the preparation of a launch vehicle or
payload for launch, when those activities take place at a launch site
in the United States.
Launch operator means a person who conducts or who will conduct the
launch of a launch vehicle and any payload.
Launch or reentry system means the integrated set of subsystems,
personnel, products, and processes that, when combined, carries out a
launch or reentry.
Launch site means the location on Earth from which a launch takes
place (as defined in a license the Secretary issues or transfers under
this chapter) and necessary facilities at that location.
Launch vehicle means a vehicle built to operate in, or place a
payload in, outer space or a suborbital rocket.
Launch window means an approved period of time during which the
flight of a launch vehicle may be initiated.
Liftoff means any motion of the launch vehicle with intention to
initiate flight.
Limits of a useful mission means the trajectory data or other
parameters that bound the performance of a useful mission, including
flight azimuth limits.
Mishap means any event, or series of events associated with a
licensed or permitted activity resulting in any of the following:
(1) A fatality or serious injury (as defined in 49 CFR 830.2);
(2) A malfunction of a safety-critical system;
(3) A failure of the licensee's or permittee's safety organization,
safety operations, safety procedures;
(4) High risk, as determined by the FAA, of causing a serious or
fatal injury to any space flight participant, crew, government
astronaut, or member of the public;
(5) Substantial damage, as determined by the FAA, to property not
associated with licensed or permitted activity;
(6) Unplanned substantial damage, as determined by the FAA, to
property associated with licensed or permitted activity;
(7) Unplanned permanent loss of a launch or reentry vehicle during
licensed activity or permitted activity;
(8) The impact of hazardous debris outside the planned landing site
or designated hazard area; or
(9) Failure to complete a launch or reentry as planned as reported
in Sec. 450.213(b).
Neighboring operations personnel means those members of the public
located within a launch or reentry site, or an adjacent launch or
reentry site, who are not associated with a specific hazardous licensed
or permitted operation currently being conducted, but are required to
perform safety, security, or critical tasks at the site and are
notified of the operation.
Nominal means, in reference to launch vehicle performance,
trajectory, or stage impact point, a launch vehicle flight where all
vehicle aerodynamic parameters are as expected, all vehicle internal
and external systems perform exactly as planned, and there are no
external perturbing influences other than atmospheric drag and gravity.
Normal flight means the flight of a properly performing vehicle
whose real-time vacuum instantaneous impact point does not deviate from
the nominal vacuum instantaneous impact point by more than the sum of
the wind effects and the three-sigma guidance and performance
deviations in the uprange, downrange, left-crossrange, or right-
crossrange directions.
Normal trajectory means a trajectory that describes normal flight.
Operating environment means an environment that a launch or reentry
vehicle component will experience during its lifecycle. Operating
environments include shock, vibration, thermal cycle, acceleration,
humidity, thermal vacuum, or other environments relevant to system or
material degradation.
Operation hazard means a hazard created by an operating environment
or by an unsafe act.
Operation of a launch site means the conduct of approved safety
operations at a permanent site to support the launching of vehicles and
payloads.
Operation of a reentry site means the conduct of safety operations
at a permanent site on Earth at which a reentry vehicle and its
payload, if any, is intended to land.
Operator means a holder of a license or permit under 51 U.S.C.
Subtitle V, chapter 509.
Orbital insertion means the point at which a vehicle achieves a
minimum 70-nautical mile perigee based on a computation that accounts
for drag.
Payload means an object that a person undertakes to place in outer
space by means of a launch vehicle, including components of the vehicle
specifically designed or adapted for that object.
Person means an individual or an entity organized or existing under
the laws of a State or country.
Physical containment means a launch vehicle does not have
sufficient energy for any hazards associated with its flight to reach
the public or critical assets.
Physical electronic storage means a physical device that can store
electronic documents and files including but not limited to an optical
disc, a memory card, a USB flash drive, or an external hard drive.
Pilot means a flight crew member who has the ability to control, in
real time, a launch or reentry vehicle's flight path.
Populated area means--
(1) An outdoor location, structure, or cluster of structures that
may be occupied by people;
(2) Sections of roadways and waterways that are frequented by
automobile and boat traffic; or
(3) Agricultural lands, if routinely occupied by field workers.
Probability of casualty means the likelihood that a person will
suffer a serious injury or worse, including a fatal injury, due to all
hazards from an operation at a specific location.
Public means, for a particular licensed or permitted launch or
reentry, people that are not involved in supporting the launch or
reentry and includes those people who may be located within the launch
or reentry site, such as visitors, individuals providing goods or
services not related to launch or reentry processing or flight, and any
other operator and its personnel.
Reenter; reentry means to return or attempt to return,
purposefully, a
[[Page 79709]]
reentry vehicle and its payload or human being, if any, from Earth
orbit or from outer space to Earth.
Reentry operator means a person responsible for conducting the
reentry of a reentry vehicle as specified in a license issued by the
FAA.
Reentry site means the location on Earth where a reentry vehicle is
intended to return. It includes the area within three standard
deviations of the intended landing point (the predicted three-sigma
footprint).
Reentry vehicle means a vehicle designed to return from Earth orbit
or outer space to Earth substantially intact. A reusable launch vehicle
that is designed to return from Earth orbit or outer space to Earth
substantially intact is a reentry vehicle.
Reentry window means an approved period of time during which the
reentry of a reentry vehicle may be initiated.
Remote operator means a crew member who--
(1) Has the ability to control, in real time, a launch or reentry
vehicle's flight path; and
(2) Is not on board the controlled vehicle.
Reusable launch vehicle (RLV) means a launch vehicle that is
designed to return to Earth substantially intact and therefore may be
launched more than one time or that contains vehicle stages that may be
recovered by a launch operator for future use in the operation of a
substantially similar launch vehicle.
Risk means a measure that accounts for both the probability of
occurrence of a hazardous event and the consequence of that event to
persons or property.
Safety critical means essential to safe performance or operation. A
safety-critical system, subsystem, component, condition, event,
operation, process, or item, is one whose proper recognition, control,
performance, or tolerance, is essential to ensuring public safety and
the safety of property.
Service life means, for a safety-critical system component, the sum
total of the component's storage life and operating life.
Sigma means a single standard deviation from a fixed value, such as
a mean.
Software function means a collection of computer code that
implements a requirement or performs an action. This includes firmware
and operating systems.
Space flight participant means an individual, who is not crew,
carried aboard a launch vehicle or reentry vehicle.
State and United States means, when used in a geographical sense,
the several States, the District of Columbia, the Commonwealth of
Puerto Rico, American Samoa, the United States Virgin Islands, Guam,
and any other commonwealth, territory, or possession of the United
States.
Suborbital rocket means a vehicle, rocket-propelled in whole or in
part, intended for flight on a suborbital trajectory, and the thrust of
which is greater than its lift for the majority of the rocket-powered
portion of its ascent.
Suborbital trajectory means the intentional flight path of a launch
vehicle, reentry vehicle, or any portion thereof, whose vacuum
instantaneous impact point does not leave the surface of the Earth.
Sub-vehicle point means the location on an ellipsoidal Earth model
where the normal to the ellipsoid passes through the vehicle's center
of gravity.
System hazard means a hazard associated with a system and generally
exists even when no operation is occurring.
Tether system means a device that contains launch vehicle hazards
by physically constraining a launch vehicle in flight to a specified
range from its launch point. A tether system includes all components,
from the tether's point of attachment to the vehicle to a solid base,
that experience load during a tethered launch.
Toxic hazard area means a region on the Earth's surface where toxic
concentrations and durations may be greater than accepted toxic
thresholds for acute casualty, in the event of a worst case release or
maximum credible release scenario during launch or reentry.
Uncontrolled area is an area of land not controlled by a launch or
reentry operator, a launch or reentry site operator, an adjacent site
operator, or other entity by agreement.
Unguided suborbital launch vehicle means a suborbital rocket that
does not contain active guidance or a directional control system.
United States citizen means:
(1) Any individual who is a citizen of the United States;
(2) Any corporation, partnership, joint venture, association, or
other entity organized or existing under the laws of the United States
or any State; and
(3) Any corporation, partnership, joint venture, association, or
other entity which is organized or exists under the laws of a foreign
nation, if the controlling interest in such entity is held by an
individual or entity described in paragraph (1) or (2) of this
definition. Controlling interest means ownership of an amount of equity
in such entity sufficient to direct management of the entity or to void
transactions entered into by management. Ownership of at least fifty-
one percent of the equity in an entity by persons described in
paragraph (1) or (2) of this definition creates a rebuttable
presumption that such interest is controlling.
Uprange means the distance measured along a line that is 180
degrees to the downrange direction.
Useful mission means a mission that can attain one or more
objectives.
Validation means an evaluation to determine that each safety
measure derived from a system safety process is correct, complete,
consistent, unambiguous, verifiable, and technically feasible.
Validation ensures that the right safety measure is implemented, and
that the safety measure is well understood.
Verification means an evaluation to determine that safety measures
derived from a system safety process are effective and have been
properly implemented. Verification provides measurable evidence that a
safety measure reduces risk to acceptable levels.
Wind weighting safety system means equipment, procedures, analysis
and personnel functions used to determine the launcher elevation and
azimuth settings that correct for wind effects that an unguided
suborbital launch vehicle will experience during flight.
Window closure means a period of time when launch or reentry is not
permitted in order to avoid a collision with an object in orbit. A
window closure may occur within a launch or reentry window, may delay
the start of a window, or terminate a window early.
PART 404--REGULATIONS AND LICENSING REQUIREMENTS
0
5. The authority citation for part 404 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
0
6. Revise Sec. 404.5 to read as follows:
Sec. 404.5 Filing a petition for waiver.
(a) A petition for waiver must be submitted at least 60 days before
the proposed effective date of the waiver, unless the Administrator
agrees to a different time frame in accordance with Sec. 404.15.
(b) The petition for waiver must include:
(1) The specific section or sections of 14 CFR chapter III from
which the petitioner seeks relief;
(2) The extent of the relief sought and the reason the relief is
being sought;
(3) The reason why granting the request for relief is in the public
interest and will not jeopardize the public
[[Page 79710]]
health and safety, safety of property, and national security and
foreign policy interests of the United States; and
(4) Any additional facts, views, and data available to the
petitioner to support the waiver request.
0
7. Add Sec. 404.15 to read as follows:
Sec. 404.15 Alternative Time Frames.
(a) General. Unless otherwise approved by the Administrator, an
applicant, a licensee, a permittee, or a safety element approval holder
must meet the time frames set forth in this chapter.
(b) Request to change a time frame. An applicant, a licensee, a
permittee, or a safety element approval holder may file a written
request to the FAA to propose an alternative time frame to any of the
time frames included in the chapter III sections listed in Appendix A
to part 404. The request must be--
(1) Emailed to [email protected] in accordance with Sec.
413.7; or
(2) Mailed to the Federal Aviation Administration, Associate
Administrator for Commercial Space Transportation, Room 331, 800
Independence Avenue SW, Washington, DC 20591. Attention: Alternative
Time Frame Request.
(c) Administrator review. The Administrator will review and make a
decision or grant a request for an alternative time frame as follows:
(1) The FAA will conduct its review on a case-by-case basis, taking
into account the complexity of the request, the timeliness of the
request, and whether the requested alternative allows sufficient time
for the FAA to conduct its review and make the requisite public health
and safety, safety of property, and national security and foreign
policy findings;
(2) The FAA will provide its decision in writing; and
(3) The FAA may grant the request, deny the request, or grant an
alternative time frame that differs from what was requested.
0
8. Add appendix A to part 404 the read as follows:
Appendix A to Part 404--Alternative Time Frames
A404.1 General
Alternative time frames. This appendix lists the sections and
corresponding paragraphs in this chapter that provide the eligible
time frames for an applicant, licensee, permittee, or safety element
approval holder, as applicable, to request an alternative time
frame.
Table A404.1--Eligible Time Frames
------------------------------------------------------------------------
Sections Paragraphs
------------------------------------------------------------------------
Sec. 404.5--Filing a petition for waiver...... (a).
Sec. 413.23--License or permit renewal........ (a).
Sec. 414.31--Safety element approval renewal.. (a).
Sec. 420.57--Notifications.................... (d).
Sec. 437.89--Pre-flight reporting............. (a), (b).
Sec. 440.15--Demonstration of compliance...... (a)(1), (a)(2),
(a)(3), (a)(4).
Sec. 450.169--Launch and Reentry Collision (f)(1).
Avoidance Analysis Requirements.
Sec. 450.213--Pre-flight reporting............ (b), (c), (d), (e).
Sec. 450.215--Post-flight reporting........... (a)
------------------------------------------------------------------------
PART 413--APPLICATION PROCEDURES
0
9. The authority citation for part 413 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
0
10. Revise Sec. 413.1 to read as follows:
Sec. 413.1 Scope of this part.
(a) This part explains how to apply for a license or experimental
permit. These procedures apply to all applications for obtaining a
license or permit, transferring a license, and renewing a license or
permit. In this part, the term application means either an application
in its entirety, or a portion of an application for incremental review
and determination in accordance with Sec. 450.33 of this chapter.
(b) Use paragraphs (b)(1) through (7) in the following table to
locate specific requirements:
------------------------------------------------------------------------
Subject Part
------------------------------------------------------------------------
(1) Obtaining a Launch License (only applications 415
accepted before June 8, 2021)..........................
(2) License to Operate a Launch Site.................... 420
(3) Launch and Reentry of a Reusable Launch Vehicle 431
(RLV) (only applications accepted before June 8, 2021).
(4) License to Operate a Reentry Site................... 433
(5) Reentry of a Reentry Vehicle other than a Reusable 435
Launch Vehicle (RLV) (only applications accepted before
June 8, 2021)..........................................
(6) Experimental Permits................................ 437
(7) Launch and Reentry License Requirements............. 450
------------------------------------------------------------------------
0
11. Effective March 10, 2026, futher amend Sec. 413.1 by revising
paragraphs (b)(1) through (4) and removing paragraphs (b)(5) through
(7).
The revisions read read as follows:
Sec. 413.1 Scope of this part.
* * * * *
(b) * * *
------------------------------------------------------------------------
Subject Part
------------------------------------------------------------------------
(1) License to Operate a Launch Site.................... 420
(2) License to Operate a Reentry Site................... 433
(3) Experimental Permits................................ 437
(4) Launch and Reentry License Requirements............. 450
------------------------------------------------------------------------
[[Page 79711]]
0
12. Amend Sec. 413.7 by revising the section heading and paragraph
(a)(3) to read as follows:
Sec. 413.7 Application submission.
(a) * * *
(3) For an application submitted by email, an applicant must send
the application as an email attachment, or as a link to a secure
server, to [email protected]. The application and the email to
which the application is attached or linked must also satisfy the
following criteria:
(i) The email to which the application is attached or linked must
be sent from an email address controlled by the person who signed the
application or by an authorized representative of the applicant;
(ii) The email must identify each document that is included as an
attachment or that is stored on a secure server; and
(iii) The electronic files must be date-stamped and have version
control documentation.
* * * * *
0
13. Amend Sec. 413.11 by revising paragraph (a) to read as follows:
Sec. 413.11 Acceptance of an application.
* * * * *
(a) The FAA accepts the application and will initiate review; or
* * * * *
0
14. Revise Sec. 413.15 to read as follows:
Sec. 413.15 Review period.
(a) Review period duration. Unless otherwise specified in this
chapter, the FAA reviews and makes a license or permit determination on
an accepted application in accordance with the time frame specified in
51 U.S.C. 50905(a)(1). The FAA will establish the time frame for any
incremental review and determination with an applicant on a case-by-
case basis during pre-application consultation.
(b) Review period tolled. If an accepted application does not
provide sufficient information to continue or complete the reviews or
evaluations required by this chapter for a license, permit, or
incremental determination, or an issue exists that would affect a
determination, the FAA notifies the applicant, in writing, and informs
the applicant of any information required to complete the application.
If the FAA cannot review an accepted application because of lack of
information or for any other reason, the FAA will toll the review
period until the FAA receives the information it needs or the applicant
resolves the issue.
(c) Notice. Except for applications under incremental review and
determination in accordance with Sec. 450.33, if the FAA does not make
a decision in accordance with the time frame specified in 51 U.S.C.
50905(a)(1) for an accepted license application or 51 U.S.C. 50906(a)
for an accepted permit application, the FAA informs the applicant, in
writing, of any outstanding information needed to complete the review,
or of any issues that would affect the decision.
0
15. Amend Sec. 413.21 by revising pargraphs (b) and (c) to read as
follows:
Sec. 413.21 Denial of a license or permit application.
* * * * *
(b) If the FAA has denied an application in its entirety, the
applicant may either--
(1) Attempt to correct any deficiencies identified and ask the FAA
to reconsider the revised application, in which case the FAA has 60
days or the number of days remaining in the review period, whichever is
greater, within which to reconsider the decision; or
(2) Request a hearing in accordance with part 406 of this chapter,
for the purpose of showing why the application should not be denied.
(c) An applicant whose application is denied after reconsideration
under paragraph (b)(1) of this section may request a hearing in
accordance with paragraph (b)(2) of this section.
0
16. Amend Sec. 413.23 by revising paragraphs (a) and (d) to read as
follows:
Sec. 413.23 License or permit renewal.
* * * * *
(a) Eligibility. (1) A licensee or permittee may apply to renew its
license or permit by submitting to the FAA a written application for
renewal at least 90 days before the license expires or at least 60 days
before the permit expires, unless the Administrator agrees to a
different time frame in accordance with Sec. 404.15.
(2) A request to renew a licensed under parts 415, 431, and 435 may
be granted with a non-standard duration so as not to exceed March 10,
2026.
* * * * *
(d) Renewal of license or permit. After the FAA finishes its
reviews, the FAA issues an order modifying the expiration date of the
license or permit. The FAA may impose additional or revised terms and
conditions necessary to protect public health and safety and the safety
of property and to protect U.S. national security and foreign policy
interests. The renewal period for a license issued under parts 415,
431, or 435 of this chapter cannot extend beyond March 10, 2026.
* * * * *
0
17. Effective March 10, 2026, Sec. 413.23 is further amended by
revising paragraphs (a) and (d) to read as follows:
Sec. 413.23 License or permit renewal.
* * * * *
(a) Eligibility. A licensee or permittee may apply to renew its
license or permit by submitting to the FAA a written application for
renewal at least 90 days before the license expires or at least 60 days
before the permit expires, unless the Administrator agrees to a
different time frame in accordance with Sec. 404.15.
* * * * *
(d) Renewal of license or permit. After the FAA finishes its
reviews, the FAA issues an order modifying the expiration date of the
license or permit. The FAA may impose additional or revised terms and
conditions necessary to protect public health and safety and the safety
of property and to protect U.S. national security and foreign policy
interests.
* * * * *
0
18. Revise part 414 to read as follows:
PART 414--SAFETY ELEMENT APPROVALS
Sec.
Subpart A--General
414.1 Scope
414.3 Definitions.
414.5 Applicability.
414.7 Eligibility.
Subpart B--Application Procedures
414.9 Pre-application consultation.
414.11 Application.
414.13 Application separate from a vehicle operator license
application.
414.15 Application concurrent with vehicle operator license
application.
414.17 Confidentiality.
414.19 Processing the initial application.
414.21 Maintaining the continued accuracy of the initial
application.
Subpart C--Safety Element Approval Review and Issuance
414.23 Technical criteria for reviewing a safety element approval
application.
414.25 Terms and conditions for issuing a safety element approval;
duration of a safety element approval.
414.27 Maintaining the continued accuracy of the safety element
approval application.
414.29 Safety element approval records.
414.31 Safety element approval renewal.
414.33 Safety element approval transfer.
414.35 Monitoring compliance with the terms and conditions of a
safety element approval.
414.37 Modification, suspension, or revocation of a safety element
approval.
Subpart D--Appeal Procedures
414.41 Hearings in safety element approval actions.
414.43 Submissions; oral presentations in safety element approval
actions.
[[Page 79712]]
414.45 Administrative law judge's recommended decision in safety
element approval actions.
Authority: 51 U.S.C. 50901-50923.
Subpart A--General
Sec. 414.1 Scope.
This part establishes procedures for obtaining a safety element
approval and renewing and transferring an existing safety element
approval. Safety element approvals issued under this part may be used
to support the application review for one or more vehicle operator
license requests under other parts of this chapter.
Sec. 414.3 Definitions.
Safety element. For purposes of this part, a safety element is any
one of the items or persons (personnel) listed in paragraphs (1) and
(2) of the definition of ``safety element approval'' in this section.
Safety element approval. For purposes of this part, a safety
element approval is an FAA document containing the FAA determination
that one or more of the safety elements listed in paragraphs (1) and
(2) of this definition, when used or employed within a defined
envelope, parameter, or situation, will not jeopardize public health
and safety or safety of property. A safety element approval may be
issued independent of a license, and does not confer any authority to
conduct activities for which a license is required under 14 CFR chapter
III. A safety element approval does not relieve its holder of the duty
to comply with all applicable requirements of law or regulation that
may apply to the holder's activities.
(1) Launch vehicle, reentry vehicle, safety system, process,
service, or any identified component thereof; or
(2) Qualified and trained personnel, performing a process or
function related to licensed activities or vehicles.
Sec. 414.5 Applicability.
This part applies to an applicant that wants to obtain a safety
element approval for any of the safety elements defined under this part
and to persons granted a safety element approval under this part. Any
person eligible under this part may apply to become the holder of a
safety element approval.
Sec. 414.7 Eligibility.
(a) There is no citizenship requirement to obtain a safety element
approval.
(b) You may be eligible for a safety element approval if you are--
(1) A designer, manufacturer, or operator of a launch or reentry
vehicle or component thereof;
(2) The designer or developer of a safety system or process; or
(3) Personnel who perform safety-critical functions in conducting a
licensed launch or reentry.
(c) A safety element approval applicant must have sufficient
knowledge and expertise to show that the design and operation of the
safety element for which safety element approval is sought qualify for
a safety element approval.
(d) Only the safety elements defined under this part are eligible
for a safety element approval.
Subpart B--Application Procedures
Sec. 414.9 Pre-application consultation.
The applicant must consult with the FAA before submitting an
application. Unless the applicant or the FAA requests another form of
consultation, consultation is oral discussion with the FAA about the
application process and the potential issues relevant to the FAA's
safety element approval decision.
Sec. 414.11 Application.
An applicant may submit an application for a safety element
approval in one of two ways:
(a) Separate from a vehicle operator license application in
accordance with Sec. 414.13; or
(b) Concurrent with a vehicle operator license application in
accordance with Sec. 414.15.
Sec. 414.13 Application separate from a vehicle operator license
application.
(a) An applicant must make an application in writing and in
English. The applicant must file the application with the Federal
Aviation Administration either by paper, by use of physical electronic
storage, or by email in the following manner:
(1) For an application submitted on paper, an applicant must send
two copies of the application to the Federal Aviation Administration,
Associate Administrator for Commercial Space Transportation, Room 331,
800 Independence Avenue SW, Washington, DC 20591. Attention:
Application Review.
(2) For an application submitted by use of physical electronic
storage, the applicant must either mail the application to the address
specified in paragraph (a)(1) of this section or hand-deliver the
application to an authorized FAA representative. The application and
the physical electronic storage containing the application must also
satisfy all of the following criteria:
(i) The application must include a cover letter that is printed on
paper and signed by the person who signed the application or by an
authorized representative of the applicant;
(ii) The cover letter must identify each document that is included
on the physical electronic storage; and
(iii) The physical electronic storage must be in a format such that
its contents cannot be altered.
(3) For an application submitted by email, an applicant must send
the application as an email attachment, or as a link to a secure
server, to [email protected]. The application and the email to
which the application is attached must also satisfy the following
criteria:
(i) The email to which the application is attached must be sent
from an email address controlled by the person who signed the
application or by an authorized representative of the applicant; and
(ii) The email must identify each document that is included as an
attachment or that is stored on a secure server; and
(iii) The electronic files must be date-stamped and have version
control documentation.
(b) The application must identify the following basic information:
(1) Name and address of the applicant.
(2) Name, address, and telephone number of any person to whom
inquiries and correspondence should be directed.
(3) Safety element as defined under this part for which the
applicant seeks a safety element approval.
(c) The application must contain the following technical
information:
(1) A Statement of Conformance letter, describing the specific
criteria the applicant used to show the adequacy of the safety element
for which a safety element approval is sought, and showing how the
safety element complies with the specific criteria.
(2) The specific operating limits for which the safety element
approval is sought.
(3) The following as applicable:
(i) Information and analyses required under this chapter that may
be applicable to demonstrating safe performance of the safety element
for which the safety element approval is sought.
(ii) Engineering design and analyses that show the adequacy of the
proposed safety element for its intended use, such that the use in a
licensed launch or reentry will not jeopardize public health or safety
or the safety of property.
(iii) Relevant manufacturing processes.
[[Page 79713]]
(iv) Test and evaluation procedures.
(v) Test results.
(vi) Maintenance procedures.
(vii) Personnel qualifications and training procedures.
(d) The application must be legibly signed, dated, and certified as
true, complete, and accurate by one of the following:
(1) For a corporation, an officer or other individual authorized to
act for the corporation in licensing or safety element approval
matters.
(2) For a partnership or a sole proprietorship, a general partner
or proprietor, respectively.
(3) For a joint venture, association, or other entity, an officer
or other individual duly authorized to act for the joint venture,
association, or other entity in licensing matters.
(e) Failure to comply with any of the requirements set forth in
this section is sufficient basis for denial of a safety element
approval application.
Sec. 414.15 Application concurrent with vehicle operator license
application.
(a) An applicant for a vehicle operator license may also identify
one or more sections of its application for which it seeks to obtain a
safety element approval concurrently with a license. An applicant
applying for a safety element approval concurrently with a license
must--
(1) Meet the applicable requirements of part 450;
(2) Provide the information required in Sec. 414.13(b)(3) and
(c)(2) and (3); and
(3) Specify the sections of the license application that support
the application for a safety element approval.
(b) The scope of the safety element approval will be limited to
what the application supports. The technical criteria for reviewing a
safety element submitted as part of a vehicle operator license
application are limited to the applicable requirements of part 450.
Sec. 414.17 Confidentiality.
(a) To ensure confidentiality of data or information in the
application, the applicant must--
(1) Send a written request with the application that trade secrets
or proprietary commercial or financial data be treated as confidential,
and include in the request the specific time frame confidential
treatment is required.
(2) Mark data or information that require confidentiality with an
identifying legend, such as ``Proprietary Information,'' ``Proprietary
Commercial Information,'' ``Trade Secret,'' or ``Confidential Treatment
Requested.'' Where this marking proves impracticable, attach a cover
sheet that contains the identifying legend to the data or information
for which confidential treatment is sought.
(b) If the applicant requests confidential treatment for previously
submitted data or information, the FAA will honor that request to the
extent practicable in case of any prior distribution of the data or
information.
(c) Data or information for which confidential treatment is
requested or data or information that qualifies for exemption under
section 552(b)(4) of title 5, U.S.C., will not be disclosed to the
public unless the Associate Administrator determines that withholding
the data or information is contrary to the public or national interest.
Sec. 414.19 Processing the initial application.
(a) The FAA will initially screen an application to determine if
the application is complete enough for the FAA to start the review.
(b) After completing the initial screening, the FAA will inform the
applicant in writing of one of the following:
(1) The FAA accepts the application and will begin the reviews or
evaluations required for a safety element approval determination under
this part.
(2) The FAA rejects the application because it is incomplete or
indefinite, making initiation of the reviews or evaluations required
for a safety element approval determination under this part
inappropriate.
(c) The written notice will state the reason(s) for rejection and
corrective actions necessary for the application to be accepted. The
FAA may return a rejected application to the applicant or may hold it
until the applicant provides more information.
(d) The applicant may withdraw, amend, or supplement an application
any time before the FAA makes a final determination on the safety
element approval application by making a written request to the
Associate Administrator. If the applicant amends or supplements the
initial application, the revised application must meet all the
applicable requirements under this part.
Sec. 414.21 Maintaining the continued accuracy of the initial
application.
The applicant is responsible for the continuing accuracy and
completeness of information provided to the FAA as part of the safety
element approval application. If at any time after submitting the
application, circumstances occur that cause the information to no
longer be accurate and complete in any material respect, the applicant
must submit a written statement to the Associate Administrator
explaining the circumstances and providing the new or corrected
information. The revised application must meet all requirements under
Sec. 414.13 or Sec. 414.15.
Subpart C--Safety Element Approval Review and Issuance
Sec. 414.23 Technical criteria for reviewing a safety element
approval application.
The FAA will determine whether a safety element is eligible for and
may be issued a safety element approval. The FAA will base its
determination on performance-based criteria, against which it may
assess the effect on public health and safety and on safety of
property, in the following hierarchy:
(a) FAA or other appropriate Federal regulations.
(b) Government-developed or adopted standards.
(c) Industry consensus performance-based criteria or standard.
(d) Applicant-developed criteria. Applicant-developed criteria are
performance standards customized by the manufacturer that intends to
produce the system, system component, or part. The applicant-developed
criteria must define--
(1) Design and minimum performance;
(2) Quality assurance system requirements;
(3) Production acceptance test specifications; and
(4) Continued operational safety monitoring system characteristics.
Sec. 414.25 Terms and conditions for issuing a safety element
approval; duration of a safety element approval.
(a) The FAA will issue a safety element approval to an applicant
that meets all the requirements under this part.
(b) The scope of the safety element approval will be limited by the
scope of the safety demonstration contained in the application on which
the FAA based the decision to grant the safety element approval.
(c) The FAA will determine specific terms and conditions of a
safety element approval individually, limiting the safety element
approval to the scope for which it was approved. The terms and
conditions will include reporting requirements tailored to the
individual safety element approval.
(d) A safety element approval is valid for five years and may be
renewed.
[[Page 79714]]
Sec. 414.27 Maintaining the continued accuracy of the safety element
approval application.
(a) The holder of a safety element approval must ensure the
continued accuracy and completeness of representations contained in the
safety element approval application, on which the approval was issued,
for the entire term of the safety element approval.
(b) If any representation contained in the application that is
material to public health and safety or safety of property ceases to be
accurate and complete, the safety element approval holder must prepare
and submit a revised application according to Sec. 414.13 or Sec.
414.15 under this part. The safety element approval holder must point
out any part of the safety element approval or the associated
application that would be changed or affected by a proposed
modification. The FAA will review and make a determination on the
revised application under the terms of this part.
Sec. 414.29 Safety element approval records.
The holder of a safety element approval must maintain all records
necessary to verify that the holder's activities are consistent with
the representations contained in the application for which the approval
was issued for the duration of the safety element approval plus one
year.
Sec. 414.31 Safety element approval renewal.
(a) Eligibility. A holder of a safety element approval may apply to
renew it by sending the FAA a written application at least 90 days
before the expiration date of the approval, unless the Administrator
agrees to a different time frame in accordance with Sec. 404.15.
(b) Application. (1) A safety element approval renewal application
must meet all the requirements under Sec. 414.13 or Sec. 414.15.
(2) The application may incorporate by reference information
provided as part of the application for the expiring safety element
approval or any modification to that approval.
(3) Any proposed changes in the conduct of a safety element for
which the FAA has issued a safety element approval must be described
and must include any added information necessary to support the fitness
of the proposed changes to meet the criteria upon which the FAA
evaluated the safety element approval application.
(c) Review of application. The FAA conducts the reviews required
under this part to determine whether the safety element approval may be
renewed. We may incorporate by reference any findings that are part of
the record for the expiring safety element approval.
(d) Grant of safety element approval renewal. If the FAA makes a
favorable safety element approval determination, the FAA issues an
order that amends the expiration date of the safety element approval or
issues a new safety element approval. The FAA may impose added or
revised terms and conditions necessary to protect public health and
safety and the safety of property.
(e) Written notice. The FAA will provide written notice to the
applicant of its determination on the safety element approval renewal
request.
(f) Denial of a safety element approval renewal. If the FAA denies
the renewal application, the applicant may correct any deficiency the
FAA identified and request a reconsideration of the revised
application. The applicant also has the right to appeal a denial as set
forth in subpart D of this part.
Sec. 414.33 Safety element approval transfer.
(a) Only the FAA may approve a transfer of a safety element
approval.
(b) Either the holder of a safety element approval or the
prospective transferee may request a safety element approval transfer.
(c) Both the holder and prospective transferee must agree to the
transfer.
(d) The person requesting the transfer must submit a safety element
approval application according to Sec. 414.13 or Sec. 414.15, must
meet the applicable requirements of this part, and may incorporate by
reference relevant portions of the initial application.
(e) The FAA will approve a transfer of a safety element approval
only after all the approvals and determinations required under this
chapter for a safety element approval have been met. In conducting
reviews and issuing approvals and determinations, the FAA may
incorporate by reference any findings made part of the record to
support the initial safety element approval determination. The FAA may
modify the terms and conditions of a safety element approval to reflect
any changes necessary because of a safety element approval transfer.
(f) The FAA will provide written notice to the person requesting
the safety element approval transfer of our determination.
Sec. 414.35 Monitoring compliance with the terms and conditions of a
safety element approval.
Each holder of a safety element approval must allow access by, and
cooperate with, Federal officers or employees or other individuals
authorized by the Associate Administrator to inspect manufacturing,
production, testing, or assembly performed by a holder of a safety
element approval or its contractor. The FAA may also inspect a safety
element approval process or service, including training programs and
personnel qualifications.
Sec. 414.37 Modification, suspension, or revocation of a safety
element approval.
(a) The safety element approval holder. The safety element approval
holder may submit an application to the FAA to modify the terms and
conditions of the holder's safety element approval. The application
must meet all the applicable requirements under this part. The FAA will
review and make a determination on the application using the same
procedures under this part applicable to an initial safety element
approval application. If the FAA denies the request to modify a safety
element approval, the holder may correct any deficiency the FAA
identified and request reconsideration. The holder also has the right
to appeal a denial as set forth in subpart D of this part.
(b) The FAA. If the FAA finds it is in the interest of public
health and safety, safety of property, or if the safety element
approval holder fails to comply with any applicable requirements of
this part, any terms and conditions of the safety element approval, or
any other applicable requirement, the FAA may--
(1) Modify the terms and conditions of the safety element approval;
or
(2) Suspend or revoke the safety element approval.
(c) Effective date. Unless otherwise stated by the FAA, any
modification, suspension, or revocation of a safety element approval
under paragraph (b)--
(1) Takes effect immediately; and
(2) Continues in effect during any reconsideration or appeal of
such action under this part.
(d) Notification and right to appeal. If the FAA determines it is
necessary to modify, suspend, or revoke a safety element approval, we
will notify the safety element approval holder in writing. If the
holder disagrees with the FAA's determination, the holder may correct
any deficiency the FAA identified and request a reconsideration of the
determination. The applicant also has the right to appeal the
determination as set forth in subpart D of this part.
Subpart D--Appeal Procedures
Sec. 414.41 Hearings in safety element approval actions.
(a) The FAA will give the safety element approval applicant or
holder, as appropriate, written notice stating the reason for issuing a
denial or for
[[Page 79715]]
modifying, suspending, or revoking a safety element approval under this
part.
(b) A safety element approval applicant or holder is entitled to a
determination on the record after an opportunity for a hearing.
Sec. 414.43 Submissions; oral presentations in safety element
approval actions.
(a) Determinations in safety element approval actions under this
part will be made on the basis of written submissions unless the
administrative law judge, on petition or on their own initiative,
determines that an oral presentation is required.
(b) Submissions must include a detailed exposition of the evidence
or arguments supporting the petition.
(c) Petitions must be filed as soon as practicable, but in no event
more than 30 days after issuance of decision or finding under Sec.
414.37.
Sec. 414.45 Administrative law judge's recommended decision in safety
element approval actions.
(a) The Associate Administrator, who will make the final decision
on the matter at issue, will review the recommended decision of the
administrative law judge. The Associate Administrator will make such
final decision within 30 days of issuance of the recommended decision.
(b) The authority and responsibility to review and decide rests
solely with the Associate Administrator and may not be delegated.
PART 415--LAUNCH LICENSE
0
19. The authority citation for part 415 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
PART 415--[REMOVED AND RESERVED]
0
20. Effective March 10, 2026, remove and reserve part 415.
0
21. Revise Sec. 415.1 to read as follows:
Sec. 415.1 Applicability and scope.
(a) Applicability. This part applies to the following:
(1) Licenses issued under this part before June 8, 2021; and
(2) Licenses issued on or after June 8, 2021, if the FAA accepted
the application under Sec. 413.11 of this chapter before that date.
(b) Scope. This part prescribes requirements for obtaining a
license to launch an expendable launch vehicle and post-licensing
requirements with which a licensee must comply to remain licensed.
Requirements for preparing a license application are in part 413 of
this subchapter.
0
22. Add Sec. 415.2 to read as follows:
Sec. 415.2 Licenses issued under this part.
(a) Definitions. For the purposes of this part, the definitions of
Sec. 401.5 of this chapter apply.
(b) Compliance with part 450 of this chapter. Operations under this
part must comply with launch and reentry collision avoidance
requirements in Sec. 450.169 of this chapter and critical asset
protection requirements in Sec. Sec. 450.101(a)(4) and (b)(4) of this
chapter.
0
23. Amend Sec. 415.3 by adding paragraph (c) to read as follows:
Sec. 415.3 Types of launch licenses.
* * * * *
(c) Notwithstanding the duration for a license established in
paragraphs (a) and (b) of this section, no license issued under this
part will be valid after March 10, 2026.
0
24. Amend Sec. 415.35 by revising paragraph (d) to read as follows:
Sec. 415.35 Acceptable flight risk.
* * * * *
(d) Operation. A launch vehicle must be operated in a manner that
ensures that flight risks meet the criteria of paragraph (a) of this
section and in accordance with collision avoidance requirements in
Sec. 450.169 and critical asset protection requirements in Sec.
450.101(a)(4) and (b)(4). An applicant must identify all launch
operations and procedures that must be performed to ensure acceptable
flight risk.
Appendix A to Part 415--[Removed and Reserved]
0
25. Remove and reserve appendix A to part 415.
PART 417--LAUNCH SAFETY
0
26. The authority citation for part 417 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
PART 417--[REMOVED AND RESERVED]
0
27. Effective March 10, 2026, remove and reserve part 417.
0
28. Revise Sec. 417.1 to read as follows:
Sec. 417.1 General information.
(a) Scope. This part sets forth--
(1) The responsibilities of a launch operator conducting a licensed
launch of an expendable launch vehicle pursuant to a license issued
under part 415 of this chapter; and
(2) The requirements for maintaining a launch license obtained
under part 415 of this chapter. Parts 413 and 415 of this chapter
contain requirements for preparing a license application to conduct a
launch, including information reviewed by the FAA to conduct a policy,
safety, payload, and environmental review, and a payload determination
(b) Applicability. (1) The administrative requirements for filing
material with the FAA in subpart A of this part apply to all licensed
launches from a Federal launch range or a non-Federal launch site,
except where noted.
(2) The safety requirements of subparts B through E of this part
apply to all licensed launches of expendable launch vehicles. See
paragraph (d) of this section for exceptions to this provision.
(c) ``Meets intent'' certification. For a licensed launch from a
Federal launch range, a launch operator need not demonstrate to the FAA
that an alternative means of satisfying a requirement of this part
provides an equivalent level of safety for a launch if written evidence
demonstrates that a Federal launch range has, by the effective date of
this part, granted a ``meets intent certification,'' including through
``tailoring,'' that applies to the requirement and that launch. See
paragraph (e) of this section for exceptions to this provision. Written
evidence includes:
(1) Range flight plan approval,
(2) Missile system pre-launch safety package,
(3) Preliminary and final flight data packages,
(4) A tailored version of EWR 127-1,
(5) Range email to the FAA stating that the MIC was approved, or
(6) Operation approval.
(d) Waiver. For a licensed launch from a Federal launch range, a
requirement of this part does not apply to a launch if written evidence
demonstrates that a Federal launch range has, by the effective date of
this part, granted a waiver that allows noncompliance with the
requirement for that launch. See paragraph (e) of this section for
exceptions to this provision. Written evidence includes:
(1) Range flight plan approval,
(2) Missile system pre-launch safety package,
(3) Preliminary and final flight data packages,
(4) A tailored version of EWR 127-1,
(5) Range email to the FAA stating that the waiver was approved, or
(6) Operation approval.
(e) Exceptions to Federal launch range meets intent certifications
and waivers. Even if a licensed launch from a Federal launch range
satisfies paragraph (c) or (d) of this section for a
[[Page 79716]]
requirement of this part, the requirement applies and a launch operator
must satisfy the requirement, obtain FAA approval of any alternative,
or obtain FAA approval for any further noncompliance if--
(1) The launch operator modifies the launch vehicle's operation or
safety characteristics;
(2) The launch operator uses the launch vehicle, component, system,
or subsystem in a new application;
(3) The FAA or the launch operator determines that a previously
unforeseen or newly discovered safety hazard exists that is a source of
significant risk to public safety; or
(4) The Federal launch range previously accepted a component,
system, or subsystem, but did not then identify a noncompliance to a
Federal launch range requirement.
(f) Equivalent level of safety. The requirements of this part apply
to a launch operator and the launch operator's launch unless the launch
operator clearly and convincingly demonstrates that an alternative
approach provides an equivalent level of safety.
Sec. 417.3 [Amended]
0
29. Amend Sec. 417.3 by removing the definitions for ``conjunction on
launch'' and ``launch wait''.
0
30. Amend Sec. 417.11 by adding paragraph (f) to read as follows:
Sec. 417.11 Continuing accuracy of license application; application
for modification of license.
* * * * *
(f) The Administrator may determine that a modification to a
license issued under this part must comply with the requirements in
part 450 of this chapter. The Administrator will base the determination
on the extent and complexity of the modification, whether the applicant
proposes to modify multiple parts of the application, or if the
application requires significant evaluation.
0
31. Amend Sec. 417.107 by adding paragraph (b)(5), and removing and
reserving paragraph (e).
The addition reads as follows:
Sec. 417.107 Flight safety.
* * * * *
(b) * * *
(5) A launch operator may initiate flight of a launch vehicle only
if all of the risks to the public satisfy the criteria in the critical
asset protection requirements in Sec. 450.101(a)(4) and (b)(4).
* * * * *
0
32. Amend Sec. 417.113 by revising paragraphs (c)(1) introductory text
and (c)(1)(iii) to read as follows:
Sec. 417.113 Launch safety rules.
* * * * *
(c) * * *
(1) The flight-commit criteria must implement the flight safety
analysis of subpart C of this part and collision avoidance requirements
in Sec. 450.169 and critical asset protection requirements in Sec.
450.101(a)(4) and (b)(4). These must include criteria for:
* * * * *
(iii) Implementation of any launch wait in the launch window for
the purpose of collision avoidance in accordance with collision
avoidance requirements in Sec. 450.169.
* * * * *
Sec. 417.121 [Amended]
0
32. Amend Sec. 417.121 by removing and reserving paragraph (c).
Sec. 417.231 [Removed and Reserved.]
0
33. Remove and reserve Sec. 417.231.
Appendix A to Part 417--[Amended]
0
34. Amend appendix A to part 417 by removing and reserving section
A417.31.
0
35. Amend appendix C to part 417 by revising paragraph (a) in section
C417.1 and removing section C417.11.
The revision reads as follows:
Appendix C to Part 417--Flight Safety Analysis Methodologies and
Products for an Unguided Suborbital Launch Vehicle Flown With a Wind
Weighting Safety System
* * * * *
C417.1 General
(a) This appendix contains methodologies for performing the
flight safety analysis required for the launch of an unguided
suborbital launch vehicle flown with a wind weighting safety system,
except for the hazard area analysis required by Sec. 417.107, which
is covered in appendix B of this part. This appendix includes
methodologies for a trajectory analysis, wind weighting analysis,
debris analysis, and debris risk analysis.
* * * * *
PART 420--LICENSE TO OPERATE A LAUNCH SITE
0
36. The authority citation for part 420 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
Sec. 420.5 [Amended]
0
37. Amend Sec. 420.5 by removing the definitions of ``Instantaneous
impact point'', ``Launch site accident'', and ``Public''.
0
38. Amend Sec. 420.15 by revising paragraph (b) to read as follows:
Sec. 420.15 Information requirements.
* * * * *
(b) Environmental. The FAA is responsible for complying with the
procedures and policies of the National Environmental Policy Act (NEPA)
and other applicable environmental laws, regulations, and Executive
Orders prior to issuing a launch site license. An applicant must
provide the FAA with information needed to comply with such
requirements. The FAA will consider and document the potential
environmental effects associated with issuing a launch site license.
(1) Environmental impact statement or environmental assessment.
When directed by the FAA, an applicant must--
(i) Prepare an Environmental Assessment with FAA oversight;
(ii) Assume financial responsibility for preparation of an
Environmental Impact Statement by an FAA-selected and -managed
consultant contractor; or
(iii) Submit information to support a written re-evaluation of a
previously submitted Environmental Assessment or Environmental Impact
Statement when requested by the FAA.
(2) Categorical exclusion. The FAA may determine that a categorical
exclusion is appropriate upon receipt of supporting information from an
applicant.
(3) Environmental information. An application must include an
approved FAA Environmental Assessment, Environmental Impact Statement,
categorical exclusion determination, or written re-evaluation covering
all planned licensed activities in compliance with NEPA and the Council
on Environmental Quality Regulations for Implementing the Procedural
Provisions of NEPA.
* * * * *
0
39. Revise Sec. 420.51 to read as follows:
Sec. 420.51 Responsibilities--general.
A licensee must operate its launch site in accordance with the
representations in its application.
0
40. Amend Sec. 420.57 by revising paragraph (d) to read as follows:
Sec. 420.57 Notifications.
* * * * *
(d) At least 2 days prior to flight of a launch vehicle, unless the
Administrator agrees to a different time frame in accordance with Sec.
404.15, the licensee must notify local officials and all owners of land
adjacent to the launch site of the flight schedule.
0
41. Revise Sec. 420.59 to read as follows:
[[Page 79717]]
Sec. 420.59 Mishap plan.
(a) General. A licensee must report, respond to, and investigate
any event that meets either paragraph (1) or (5) of the definition of
``mishap'' in Sec. 401.7 of this chapter. A licensee must submit a
mishap plan that meets the requirements of Sec. 450.173(b) through
(f).
(b) Launch mishaps. A launch site operator's mishap plan must also
contain procedures for participating in an investigation of a launch
mishap for launches launched from the launch site.
(c) Other agency procedures. Emergency response and investigation
procedures developed in accordance with 29 CFR 1910.119 and 40 CFR part
68 will satisfy the requirements of Sec. 450.173(d) and (e) to the
extent that they include the elements required by Sec. 450.173(d) and
(e).
0
42. Amend Sec. 420.61 by revising paragraph (b) to read as follows:
Sec. 420.61 Records.
* * * * *
(b) For any event that meets any of paragraph (1), (5), or (8) of
the definition of ``mishap'' in Sec. 401.7 of this chapter, a licensee
must preserve all records related to the event. Records must be
retained until completion of any Federal investigation and the FAA
advises the licensee that the records need not be retained.
* * * * *
PART 431--LAUNCH AND REENTRY OF A REUSABLE LAUNCH VEHICLE (RLV)
0
43. The authority citation for part 431 continue to read as follows:
Authority: 51 U.S.C. 50901-50923.
PART 431--[REMOVED AND RESERVED]
0
44. Effective March 10, 2026, remove and reserve part 431.
0
45. Revise Sec. 431.1 to read as follows:
Sec. 431.1 General.
(a) Applicability. This part applies to the following--
(1) Licenses issued under this part before June 8, 2021; and
(2) Licenses issued on or after June 8, 2021, if the FAA accepted
the application under Sec. 413.11 of this chapter before that date.
(b) Scope. This part prescribes requirements for obtaining a
reusable launch vehicle (RLV) mission license and post-licensing
requirements with which a licensee must comply to remain licensed.
Requirements for preparing a license application are contained in part
413 of this subchapter.
(c) Equivalent level of safety. Each requirement of this part
applies unless the applicant or licensee clearly and convincingly
demonstrates that an alternative approach provides an equivalent level
of safety to the requirement of this part.
0
46. Add Sec. 431.2 to read as follows:
Sec. 431.2 Licenses issued under this part.
(a) Definitions. For the purposes of this subpart, the definitions
of Sec. 401.5 of this chapter apply.
(b) Compliance with part 450 of this chapter. Operations under this
part must comply with launch and reentry collision avoidance
requirements in Sec. 450.169 of this chapter and critical asset
protection requirements in Sec. 450.101(a)(4) and (b)(4) of this
chapter.
0
47. Amend Sec. 431.3 by adding paragraph (c) to read as follows:
Sec. 431.3 Types of reusable launch vehicle mission licenses.
* * * * *
(c) Duration of license. Notwithstanding the duration for a license
established in paragraphs (a) and (b) of this section, no license
issued under this part will be valid after March 10, 2026.
0
48. Amend Sec. 431.43 by revising paragraph (a)(1) and removing and
reserving paragraph (c)(1).
The revision reads as follows:
Sec. 431.43 Reusable launch vehicle mission operational requirements
and restrictions.
(a) * * *
(1) That ensure RLV mission risks do not exceed the criteria set
forth in Sec. Sec. 431.35, 450.169, and in Sec. 450.101(a)(4) and
(b)(4) for nominal and non-nominal operations;
* * * * *
0
49. Amend Sec. 431.73 by adding paragraph (f) to read as follows:
Sec. 431.73 Continuing accuracy of license application; application
for modification of license.
* * * * *
(f) The Administrator may determine that a modification to a
license issued under this part must comply with the requirements in
part 450 of this chapter. The Administrator will base the determination
on the extent and complexity of the modification, whether the applicant
proposes to modify multiple parts of the application, or if the
application requires significant evaluation.
PART 433--LICENSE TO OPERATE A REENTRY SITE
0
50. The authority citation for part 433 will continue to read as
follows:
Authority: 51 U.S.C. 50901-50923.
0
51. Revise Sec. 433.7 to read as follows:
Sec. 433.7 Environmental.
(a) General. The FAA is responsible for complying with the
procedures and policies of the National Environmental Policy Act (NEPA)
and other applicable environmental laws, regulations, and Executive
Orders prior to issuing a reentry site license. An applicant must
provide the FAA with information needed to comply with such
requirements. The FAA will consider and document the potential
environmental effects associated with issuing a license for a reentry
site.
(b) Environmental impact statement or environmental assessment.
When directed by the FAA, an applicant must--
(1) Prepare an Environmental Assessment with FAA oversight;
(2) Assume financial responsibility for preparation of an
Environmental Impact Statement by an FAA-selected and -managed
consultant contractor; or
(3) Submit information to support a written re-evaluation of a
previously submitted Environmental Assessment or Environmental Impact
Statement.
(c) Categorical exclusion. The FAA may determine that a categorical
exclusion is appropriate upon receipt of supporting information from an
applicant.
(d) Environmental information. An application must include an
approved FAA Environmental Assessment, Environmental Impact Statement,
categorical exclusion determination, or written re-evaluation covering
all planned licensed activities in compliance with NEPA and the Council
on Environmental Quality Regulations for Implementing the Procedural
Provisions of NEPA.
Sec. 433.9 [Removed]
0
52. Remove Sec. 433.9.
PART 435--REENTRY OF A REENTRY VEHICLE OTHER THAN A REUSABLE LAUNCH
VEHICLE (RLV)
0
53. The authority citation for part 435 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
PART 435--[REMOVED AND RESERVED]
0
54. Effective March 10, 2026, remove and reserve part 435.
0
55. Revise Sec. 435.1 to read as follows:
Sec. 435.1 General.
(a) Applicability. This part applies to the following--
[[Page 79718]]
(1) Licenses issued under this part before June 8, 2021; and
(2) Licenses issued on or after June 8, 2021, if the FAA accepted
the application under Sec. 413.11 of this chapter before that date.
(b) Scope. This part prescribes requirements for obtaining a
license to reenter a reentry vehicle other than a reusable launch
vehicle (RLV), and post-licensing requirements with which a licensee
must comply to remain licensed. Requirements for preparing a license
application are contained in part 413 of this subchapter.
(c) Equivalent level of safety. Each requirement of this part
applies unless the applicant or licensee clearly and convincingly
demonstrates that an alternative approach provides an equivalent level
of safety to the requirement of this part.
0
56. Add Sec. 435.2 to read as follows:
Sec. 435.2 Licenses.
(a) Definitions. For the purposes of this subpart, the definitions
of Sec. 401.5 of this chapter apply.
(b) Compliance with part 450 of this chapter. Operations under this
part must comply with launch and reentry collision avoidance
requirements in Sec. 450.169 and critical asset protection
requirements in Sec. 450.101(a)(4) and (b)(4).
0
57. Amend Sec. 435.3 by adding paragraph (c) to read as follows:
Sec. 435.3 Types of reentry licenses.
* * * * *
(c) Duration of license. Notwithstanding the duration for a license
established in paragraphs (a) and (b) of this section, no license
issued under this part will be valid after March 10, 2026.
PART 437--EXPERIMENTAL PERMITS
0
58. The authority citation for part 437 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
Sec. 437.3 [Amended]
0
59. Amend Sec. 437.3 by removing the definitions for ``anomaly'' and
``key flight-safety event''.
0
60. Amend Sec. 437.21 by revising paragraphs (b) and (c) to read as
follows:
Sec. 437.21 General.
* * * * *
(b) Other regulations--(1) Environmental--(i) General. The FAA is
responsible for complying with the procedures and policies of the
National Environmental Policy Act (NEPA) and other applicable
environmental laws, regulations, and Executive Orders to consider and
document the potential environmental effects associated with proposed
reusable suborbital rocket launches or reentries. An applicant must
provide the FAA with information needed to comply with such
requirements. The FAA will consider and document the potential
environmental effects associated with proposed reusable suborbital
rocket launches or reentries.
(ii) Environmental Impact Statement or Environmental Assessment.
When directed by the FAA, an applicant must--
(A) Prepare an Environmental Assessment with FAA oversight;
(B) Assume financial responsibility for preparation of an
Environmental Impact Statement by an FAA-selected and -managed
consultant contractor; or
(C) Submit information to support a written re-evaluation of a
previously submitted Environmental Assessment or Environmental Impact
Statement.
(iii) Categorical exclusion. The FAA may determine that a
categorical exclusion determination is appropriate upon receipt of
supporting information from an applicant.
(iv) Information requirements. An application must include an
approved FAA Environmental Assessment, Environmental Impact Statement,
categorical exclusion determination, or written re-evaluation covering
all planned licensed activities in compliance with NEPA and the Council
on Environmental Quality Regulations for Implementing the Procedural
Provisions of NEPA.
(2) Financial responsibility. An applicant must provide the
information required by part 3 of appendix A of part 440 for the FAA to
conduct a maximum probable loss analysis.
(3) Human space flight. An applicant proposing launch or reentry
with flight crew or a space flight participant on board a reusable
suborbital rocket must demonstrate compliance with Sec. Sec. 460.5,
460.7, 460.11, 460.13, 460.15, 460.17, 460.51, and 460.53 of this
subchapter.
(c) Use of a safety element approval. If an applicant proposes to
use any reusable suborbital rocket, safety system, process, service, or
personnel for which the FAA has issued a safety element approval under
part 414 of this chapter, the FAA will not reevaluate that safety
element to the extent its use is within its approved scope. As part of
the application process, the FAA will evaluate the integration of that
safety element into vehicle systems or operations.
* * * * *
0
61. Revise Sec. 437.41 to read as follows:
Sec. 437.41 Mishap plan.
An applicant must submit a mishap plan that meets the requirements
of Sec. 450.173 of this chapter.
0
62. Revise Sec. 437.65 to read as follows:
Sec. 437.65 Collision avoidance analysis.
For a permitted flight with a planned maximum altitude greater than
150 kilometers, a permittee must obtain a collision avoidance analysis
in accordance with Sec. 450.169 of this chapter.
Sec. 437.75 [Removed and Reserved]
0
63. Remove and reserve Sec. 437.75.
0
64. Amend Sec. 437.87 by revising paragraph (b) to read as follows:
Sec. 437.87 Records.
* * * * *
(b) For any event that meets any of paragraphs (1) through (3),
(5), or (8) of the definition of ``mishap'' in Sec. 401.7 of this
chapter, a permittee must preserve all records related to the event.
Records shall be retained until any Federal investigation is complete
and the FAA advises the permittee that the records need not be
retained.
* * * * *
0
65. Amend Sec. 437.89 by revising paragraphs (a) introductory text and
(b) to read as follows:
Sec. 437.89 Pre-flight reporting.
(a) Not later than 30 days before each flight or series of flights
conducted under an experimental permit, unless the Administrator agrees
to a different time frame in accordance with Sec. 404.15, a permittee
must provide the FAA with the following information:
* * * * *
(b) Not later than 15 days before each permitted flight planned to
reach greater than 150 km altitude, unless the Administrator agrees to
a different time frame in accordance with Sec. 404.15, a permittee
must provide the FAA its planned trajectory for a collision avoidance
analysis.
PART 440--FINANCIAL RESPONSIBILITY
0
66. The authority citation for part 440 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
0
67. Amend Sec. 440.3 by revising the introductory text and the
definition for ``maximum probable loss (MPL)'' to read as follows:
Sec. 440.3 Definitions.
Except as otherwise provided in this section, any term used in this
part and defined in 51 U.S.C. 50901-50923, or in
[[Page 79719]]
Sec. 401.5 or Sec. 401.7 of this chapter shall have the meaning
contained therein.
* * * * *
Maximum probable loss (MPL) means the greatest dollar amount of
loss for bodily injury or property damage that is reasonably expected
to result from a licensed or permitted activity;
(1) Losses to third parties, excluding Government personnel and
other launch or reentry participants' employees involved in licensed or
permitted activities and neighboring operations personnel, that are
reasonably expected to result from a licensed or permitted activity are
those that have a probability of occurrence of no less than one in ten
million.
(2) Losses to Government property and Government personnel involved
in licensed or permitted activities and neighboring operations
personnel that are reasonably expected to result from licensed or
permitted activities are those that have a probability of occurrence of
no less than one in one hundred thousand.
* * * * *
Sec. 440.3 [Amended]
0
68. Effective March 10, 2026, further amend Sec. 440.3 in the
introductory text by removing `` in Sec. Sec. 401.5 or 401.7'' and
add, in its place, ``in Sec. 401.7''.
0
69. Amend Sec. 440.15 by revising paragraphs (a)(1) through (4) to
read as follows:
Sec. 440.15 Demonstration of compliance.
(a) * * *
(1) All reciprocal waiver of claims agreements required under Sec.
440.17(c) must be submitted at least 30 days before the start of any
licensed or permitted activity involving a customer, crew member, or
space flight participant; unless the Administrator agrees to a
different time frame in accordance with Sec. 404.15;
(2) Evidence of insurance must be submitted at least 30 days before
commencement of any licensed launch or permitted activity, and for
licensed reentry no less than 30 days before commencement of launch
activities involving the reentry licensee, unless the Administrator
agrees to a different time frame in accordance with Sec. 404.15;
(3) Evidence of financial responsibility in a form other than
insurance, as provided under Sec. 440.9(f) must be submitted at least
60 days before commencement of a licensed or permitted activity, unless
the Administrator agrees to a different time frame in accordance with
Sec. 404.15; and
(4) Evidence of renewal of insurance or other form of financial
responsibility must be submitted at least 30 days in advance of its
expiration date, unless the Administrator agrees to a different time
frame in accordance with Sec. 404.15.
* * * * *
0
70. Add part 450 to read as follows:
PART 450--LAUNCH AND REENTRY LICENSE REQUIREMENTS
Sec.
Subpart A--General Information
450.1 Applicability.
450.3 Scope of a vehicle operator license.
450.5 Issuance of a vehicle operator license.
450.7 Duration of a vehicle operator license.
450.9 Additional license terms and conditions.
450.11 Transfer of a vehicle operator license.
450.13 Rights not conferred by a vehicle operator license.
Subpart B--Requirements to Obtain a Vehicle Operator License
450.31 General.
450.33 Incremental review and determinations.
450.35 Means of compliance.
450.37 Equivalent level of safety.
450.39 Use of safety element approval.
450.41 Policy review and approval.
450.43 Payload review and determination.
450.45 Safety review and approval.
450.47 Environmental review.
Subpart C--Safety Requirements
Safety Criteria
450.101 Safety criteria.
System Safety Program
450.103 System safety program.
Hazard Control Strategies
450.107 Hazard control strategies.
450.108 Flight abort.
450.109 Flight hazard analysis.
450.110 Physical containment.
450.111 Wind weighting.
Flight Safety Analyses
450.113 Flight safety analysis requirements--scope.
450.115 Flight safety analysis methods.
450.117 Trajectory analysis for normal flight.
450.119 Trajectory analysis for malfunction flight.
450.121 Debris analysis.
450.123 Population exposure analysis.
450.131 Probability of failure analysis.
450.133 Flight hazard area analysis.
450.135 Debris risk analysis.
450.137 Far-field overpressure blast effects analysis.
450.139 Toxic hazards for flight.
Prescribed Hazard Controls for Safety-Critical Hardware and Computing
Systems
450.141 Computing systems.
450.143 Safety-critical system design, test, and documentation.
450.145 Highly reliable flight safety system.
Other Prescribed Hazard Controls
450.147 Agreements.
450.149 Safety-critical personnel qualifications.
450.151 Work shift and rest requirements.
450.153 Radio frequency management.
450.155 Readiness.
450.157 Communications.
450.159 Pre-flight procedures.
450.161 Control of hazard areas.
450.163 Lightning hazard mitigation.
450.165 Flight commit criteria.
450.167 Tracking.
450.169 Launch and reentry collision avoidance analysis
requirements.
450.171 Safety at end of launch.
450.173 Mishap plan--reporting, response, and investigation
requirements.
450.175 Test-induced damage.
450.177 Unique safety policies, requirements, and practices.
Ground Safety
450.179 Ground safety--general.
450.181 Coordination with a site operator.
450.183 Explosive site plan.
450.185 Ground hazard analysis.
450.187 Toxic hazards mitigation for ground operations.
450.189 Ground safety prescribed hazard controls.
Subpart D--Terms and Conditions of a Vehicle Operator License
450.201 Responsibility for public safety and safety of property.
450.203 Compliance.
450.205 Financial responsibility requirements.
450.207 Human spaceflight requirements.
450.209 Compliance monitoring.
450.211 Continuing accuracy of license application; application for
modification of license.
450.213 Pre-flight reporting.
450.215 Post-flight reporting.
450.217 Registration of space objects.
450.219 Records.
Appendix A to Part 450--Collision Analysis Worksheet
Authority: 51 U.S.C. 50901-50923.
Subpart A--General Information
Sec. 450.1 Applicability.
This part prescribes requirements for obtaining and maintaining a
license to launch, reenter, or both launch and reenter, a launch or
reentry vehicle.
Sec. 450.3 Scope of a vehicle operator license.
(a) General. A vehicle operator license authorizes a licensee to
conduct one or more launches or reentries using the same vehicle or
family of vehicles. A vehicle operator license identifies the scope of
authorization as defined in paragraphs (b) and (c) of this section or
as agreed to by the Administrator.
(b) Scope of launch. A vehicle operator license authorizes launch,
which includes the flight of a launch
[[Page 79720]]
vehicle and pre- and post-flight ground operations as follows:
(1) Launch begins when hazardous pre-flight operations commence at
a U.S. launch site that may pose a threat to the public. Hazardous pre-
flight operations that may pose a threat to the public include
pressurizing or loading of propellants into the vehicle, operations
involving a fueled launch vehicle, the transfer of energy necessary to
initiate flight, or any hazardous activity preparing the vehicle for
flight. Hazardous pre-flight operations do not include the period
between the end of the previous launch and launch vehicle reuse, when
the vehicle is in a safe and dormant state.
(2) At a non-U.S. launch site, launch begins at ignition or at the
first movement that initiates flight, whichever occurs earlier.
(3) Launch ends when any of the following events occur:
(i) For an orbital launch of a vehicle without a reentry of the
vehicle, launch ends after the licensee's last exercise of control over
its vehicle on orbit, after vehicle component impact or landing on
Earth, after activities necessary to return the vehicle or component to
a safe condition on the ground after impact or landing, or after
activities necessary to return the site to a safe condition, whichever
occurs latest;
(ii) For an orbital launch of a vehicle with a reentry of the
vehicle, launch ends after deployment of all payloads, upon completion
of the vehicle's first steady-state orbit if there is no payload
deployment, after vehicle component impact or landing on Earth, after
activities necessary to return the vehicle or component to a safe
condition on the ground after impact or landing, or after activities
necessary to return the site to a safe condition, whichever occurs
latest;
(iii) For a suborbital launch that includes a reentry, launch ends
after reaching apogee;
(iv) For a suborbital launch that does not include a reentry,
launch ends after vehicle or vehicle component impact or landing on
Earth, after activities necessary to return the vehicle or vehicle
component to a safe condition on the ground after impact or landing, or
after activities necessary to return the site to a safe condition,
whichever occurs latest.
(c) Scope of reentry. A vehicle operator license authorizes
reentry. Reentry includes activities conducted in Earth orbit or outer
space to determine reentry readiness and that are critical to ensuring
public health and safety and the safety of property during reentry
flight. Reentry also includes activities necessary to return the
reentry vehicle, or vehicle component, to a safe condition on the
ground after impact or landing.
(d) Application requirements. An applicant must identify pre- and
post-flight ground operations at a U.S. launch site sufficient for the
Administrator to determine the scope of activities authorized under the
license.
Sec. 450.5 Issuance of a vehicle operator license.
(a) The FAA issues a vehicle operator license to an applicant who
has obtained all approvals and determinations required under this part
for a license.
(b) A vehicle operator license authorizes a licensee to conduct
launches or reentries, in accordance with the representations contained
in the licensee's application, with subparts C and D of this part, and
subject to the licensee's compliance with terms and conditions
contained in license orders accompanying the license, including
financial responsibility requirements.
Sec. 450.7 Duration of a vehicle operator license.
A vehicle operator license is valid for the period of time
determined by the Administrator as necessary to conduct the licensed
activity but may not exceed 5 years from the issuance date.
Sec. 450.9 Additional license terms and conditions.
The FAA may modify a vehicle operator license at any time by
modifying or adding license terms and conditions to ensure compliance
with the Act and regulations.
Sec. 450.11 Transfer of a vehicle operator license.
(a) Only the FAA may transfer a vehicle operator license.
(b) Either the holder of a vehicle operator license or the
prospective transferee may request a vehicle operator license transfer.
(c) Both the holder and prospective transferee must agree to the
transfer.
(d) An applicant for transfer of a vehicle operator license must
submit a license application in accordance with part 413 of this
chapter and must meet the requirements of part 450 of this chapter.
(e) The FAA will transfer a license to an applicant that has
obtained all of the approvals and determinations required under this
part for a license. In conducting its reviews and issuing approvals and
determinations, the FAA may incorporate by reference any findings made
part of the record to support the initial licensing determination. The
FAA may modify a license to reflect any changes necessary as a result
of a license transfer.
(f) The FAA will provide written notice of its determination to the
person requesting the vehicle operator license transfer.
Sec. 450.13 Rights not conferred by a vehicle operator license.
Issuance of a vehicle operator license does not relieve a licensee
of its obligation to comply with all applicable requirements of law or
regulation that may apply to its activities, nor does issuance confer
any proprietary, property, or exclusive right in the use of any Federal
launch or reentry site or related facilities, airspace, or outer space.
Subpart B--Requirements to Obtain a Vehicle Operator License
Sec. 450.31 General.
(a) To obtain a vehicle operator license, an applicant must--
(1) Submit a license application in accordance with the procedures
in part 413 of this chapter;
(2) Obtain a policy approval from the Administrator in accordance
with Sec. 450.41;
(3) Obtain a favorable payload determination from the Administrator
in accordance with Sec. 450.43, if applicable;
(4) Obtain a safety approval from the Administrator in accordance
with Sec. 450.45;
(5) Satisfy the environmental review requirements of Sec. 450.47;
and
(6) Provide the information required by appendix A of part 440 for
the Administrator to conduct a maximum probable loss analysis for the
applicable licensed operation.
(b) An applicant may apply for the approvals and determinations in
paragraphs (a)(2) through (6) of this section separately or all
together in one complete application, using the application procedures
contained in part 413 of this chapter.
(c) An applicant may also apply for a safety approval in an
incremental manner, in accordance with Sec. 450.33.
(d) An applicant may reference materials previously provided as
part of a license application in order to meet the application
requirements of this part.
Sec. 450.33 Incremental review and determinations.
An applicant may submit its application for a safety review in
modules using an incremental approach approved by the Administrator.
(a) An applicant must identify to the Administrator, prior to
submitting an
[[Page 79721]]
application, whether it will submit a modular application for any
approval or determination.
(b) An applicant using an incremental approach must have the
approach approved by the Administrator prior to submitting an
application. In reviewing a proposed approach, the Administrator will
consider the following:
(1) Whether the modules can be reviewed independently; and
(2) Whether the modules will be submitted in a workable
chronological order.
(c) The Administrator may make incremental determinations as part
of this review process.
Sec. 450.35 Means of compliance.
(a) Prior to application acceptance, a means of compliance must be
accepted by the Administrator for the following:
(1) Section 450.115(b)(1) regarding flight safety analyses;
(2) Section 450.139(e)(1) regarding toxic hazards for flight;
(3) Section 450.145(b) regarding highly-reliable flight safety
system;
(4) Section 450.163(a)(1) regarding lightning hazard mitigation;
and
(5) Section 450.187(e)(1) regarding toxic hazards mitigation for
ground operations.
(b) A person requesting acceptance of a proposed means of
compliance outside a license application must submit the proposed means
of compliance to the FAA in a form and manner acceptable to the
Administrator.
Sec. 450.37 Equivalent level of safety.
(a) An applicant must demonstrate compliance with each requirement
of this part, unless the applicant clearly and convincingly
demonstrates that an alternative approach provides an equivalent level
of safety to the requirement of this part.
(b) Paragraph (a) of this section does not apply to Sec.
450.101(a), (b), (c)(1) and (3), (d), (e)(1), and (g).
Sec. 450.39 Use of safety element approval.
If an applicant proposes to use any vehicle, safety system,
process, service, or personnel for which the FAA has issued a safety
element approval under part 414 of this chapter, the FAA will not
reevaluate that safety element during a license application evaluation
to the extent its use is within its approved scope.
Sec. 450.41 Policy review and approval.
(a) General. The FAA issues a policy approval to an applicant
unless the FAA determines that a proposed launch or reentry would
jeopardize U.S. national security or foreign policy interests, or
international obligations of the United States.
(b) Interagency consultation. (1) The FAA consults with the
Department of Defense to determine whether a license application
presents any issues affecting U.S. national security.
(2) The FAA consults with the Department of State to determine
whether a license application presents any issues affecting U.S.
foreign policy interests or international obligations.
(3) The FAA consults with other Federal agencies, including the
National Aeronautics and Space Administration, authorized to address
issues identified under paragraph (a) of this section, associated with
an applicant's proposal.
(c) Issues during policy review. The FAA will advise an applicant,
in writing, of any issue raised during a policy review that would
impede issuance of a policy approval. The applicant may respond, in
writing, or amend its license application as required by Sec. 413.17
of this chapter.
(d) Denial of policy approval. The FAA notifies an applicant, in
writing, if it has denied policy approval for a license application.
The notice states the reasons for the FAA's determination. The
applicant may seek further review of the determination in accordance
with Sec. 413.21 of this chapter.
(e) Application requirements for policy review. In its license
application, an applicant must--
(1) Identify the model, type, and configuration of any vehicle
proposed for launch or reentry by the applicant;
(2) Describe the vehicle by characteristics that include individual
stages, their dimensions, type and amounts of all propellants, and
maximum thrust;
(3) Identify foreign ownership of the applicant as follows:
(i) For a sole proprietorship or partnership, identify all foreign
ownership;
(ii) For a corporation, identify any foreign ownership interests of
10 percent or more; and
(iii) For a joint venture, association, or other entity, identify
any participating foreign entities; and
(4) Identify the proposed vehicle flight profile, including:
(i) Launch or reentry site, including any contingency abort
locations;
(ii) Flight azimuths, trajectories, and associated ground tracks
and instantaneous impact points for the duration of the licensed
activity, including any contingency abort profiles;
(iii) Sequence of planned events or maneuvers during flight;
(iv) Normal impact or landing areas for all mission hardware; and
(v) For each orbital mission, the range of intermediate and final
orbits of each vehicle upper stage and their estimated orbital
lifetimes.
Sec. 450.43 Payload review and determination.
(a) General. If applicable, the FAA issues a favorable payload
determination for a launch or reentry to a license applicant or payload
owner or operator if--
(1) The applicant, payload owner, or payload operator has obtained
all required licenses, authorizations, and permits; and
(2) Its launch or reentry would not jeopardize public health and
safety, safety of property, U.S. national security or foreign policy
interests, or international obligations of the United States.
(b) Relationship to other executive agencies. The FAA does not make
a determination under paragraph (a)(2) of this section for--
(1) Those aspects of payloads that are subject to regulation by the
Federal Communications Commission or the Department of Commerce; or
(2) Payloads owned or operated by the U.S. Government.
(c) Classes of payloads. The FAA may review and issue findings
regarding a proposed class of payload, including communications, remote
sensing, or navigation. However, prior to a launch or reentry, each
payload is subject to verification by the FAA that its launch or
reentry would not jeopardize public health and safety, safety of
property, U.S. national security or foreign policy interests, or
international obligations of the United States.
(d) Payload owner or payload operator may apply. In addition to a
launch or reentry operator, a payload owner or payload operator may
request a payload review and determination.
(e) Interagency consultation. The FAA consults with other agencies
as follows:
(1) The Department of Defense to determine whether launch or
reentry of a proposed payload or payload class would present any issues
affecting U.S. national security;
(2) The Department of State to determine whether launch or reentry
of a proposed payload or payload class would present any issues
affecting U.S. foreign policy interests or international obligations;
or
(3) Other Federal agencies, including the National Aeronautics and
Space Administration, authorized to address issues of public health and
safety, safety of property, U.S. national security or foreign policy
interests, or international obligations of the United States,
[[Page 79722]]
associated with the launch or reentry of a proposed payload or payload
class.
(f) Issues during payload review. The FAA will advise a person
requesting a payload determination, in writing, of any issue raised
during a payload review that would impede issuance of a license to
launch or reenter that payload or payload class. The person requesting
payload review may respond, in writing, or amend its application as
required by Sec. 413.17 of this chapter.
(g) Denial of a payload determination. The FAA notifies an
applicant, in writing, if it has denied a favorable payload
determination. The notice states the reasons for the FAA's
determination. The applicant may seek further review of the
determination in accordance with Sec. 413.21 of this chapter.
(h) Incorporation of payload determination in license application.
A favorable payload determination issued for a payload or class of
payload may be included by a license applicant as part of its
application. However, any change in information provided under
paragraph (i) of this section must be reported in accordance with Sec.
413.17 of this chapter. The FAA determines whether a favorable payload
determination remains valid in light of reported changes and may
conduct an additional payload review.
(i) Application requirements. A person requesting review of a
particular payload or payload class must identify the following:
(1) For launch of a payload:
(i) Payload name or class of payload, and function;
(ii) Description, including physical dimensions, weight,
composition, and any hosted payloads;
(iii) Payload owner and payload operator, if different from the
person requesting payload review and determination;
(iv) Any foreign ownership of the payload or payload operator, as
specified in Sec. 450.41(e)(3);
(v) Hazardous materials as defined in Sec. 401.7 of this chapter,
radioactive materials, and the amounts of each;
(vi) Explosive potential of payload materials, alone and in
combination with other materials found on the payload;
(vii) For orbital launches, parameters for parking, transfer and
final orbits, and approximate transit times to final orbit;
(viii) Delivery point in flight at which the payload will no longer
be under the licensee's control;
(ix) Intended operations during the lifetime of the payload,
including anticipated life span and any planned disposal;
(x) Any encryption associated with data storage on the payload and
transmissions to or from the payload; and
(xi) Any other information necessary to make a determination based
on public health and safety, safety of property, U.S. national security
or foreign policy interests, or international obligations of the United
States.
(2) For reentry of a payload:
(i) Payload name or class of payload, and function;
(ii) Physical characteristics, dimensions, and weight of the
payload;
(iii) Payload owner and payload operator, if different from the
person requesting the payload review and determination;
(iv) Type, amount, and container of hazardous materials and
radioactive materials in the payload;
(v) Explosive potential of payload materials, alone and in
combination with other materials found on the payload or reentry
vehicle during reentry; and
(vi) Designated reentry site.
Sec. 450.45 Safety review and approval.
(a) General. The FAA issues a safety approval to an applicant if it
determines that an applicant can conduct launch or reentry without
jeopardizing public health and safety and safety of property. A license
applicant must satisfy the application requirements in this section and
subpart C of this part.
(b) Services or property provided by a Federal launch or reentry
site. The FAA will accept any safety-related launch or reentry service
or property provided by a Federal launch or reentry site or other
Federal entity by contract, as long as the FAA determines that the
launch or reentry services or property provided satisfy this part.
(c) Issues during safety review. The FAA will advise an applicant,
in writing, of any issues raised during a safety review that would
impede issuance of a safety approval. The applicant may respond, in
writing, or amend its license application as required by Sec. 413.17
of this chapter.
(d) Denial of a safety approval. The FAA notifies an applicant, in
writing, if it has denied a safety approval for a license application.
The notice states the reasons for the FAA's determination. The
applicant may seek further review of the determination in accordance
with Sec. 413.21 of this chapter.
(e) Application requirements. An applicant must submit the
information required in the ``Application requirements'' paragraphs in
individual sections in subpart C of this part, as well as the
following:
(1) General. An application must--
(i) Contain a glossary of unique terms and acronyms used in
alphabetical order;
(ii) Contain a listing of all referenced material;
(iii) Use equations and mathematical relationships derived from or
referenced to a recognized standard or text, and define all algebraic
parameters;
(iv) Include the units of all numerical values provided; and
(v) Include a legend or key that identifies all symbols used for
any schematic diagrams.
(2) Site description. An applicant must identify the proposed
launch or reentry site, including contingency abort locations, and
submit the following:
(i) Boundaries of the site;
(ii) Launch or landing point locations, including latitude and
longitude;
(iii) Identity of any site operator; and
(iv) Identity of any facilities at the site that will be used for
pre- or post-flight ground operations.
(3) Vehicle description. An applicant must submit the following:
(i) A written description of the vehicle or family of vehicles,
including structural, thermal, pneumatic, propulsion, electrical, and
avionics and guidance systems used in each vehicle, and all
propellants. The description must include a table specifying the type
and quantities of all hazardous materials on each vehicle and must
include propellants, explosives, and toxic materials; and
(ii) A drawing of each vehicle that identifies:
(A) Each stage, including strap-on motors;
(B) Physical dimensions and weight;
(C) Location of all safety-critical systems;
(D) Location of all major vehicle control systems, propulsion
systems, pressure vessels, and any other hardware that contains
potential hazardous energy or hazardous material; and
(E) For an unguided suborbital launch vehicle, the location of the
rocket's center of pressure in relation to its center of gravity for
the entire flight profile.
(4) Mission schedule. An applicant must submit a generic launch or
reentry processing schedule that identifies any readiness activities,
such as reviews and rehearsals, and each safety-critical pre-flight
operation to be conducted. The mission schedule must also identify day
of flight activities.
(5) Human space flight. For a proposed launch or reentry with a
human being on board a vehicle, an applicant must demonstrate
compliance
[[Page 79723]]
with Sec. Sec. 460.5, 460.7, 460.11, 460.13, 460.15, 460.17, 460.51,
and 460.53 of this chapter.
(6) Radionuclides. The FAA will evaluate the launch or reentry of
any radionuclide on a case-by-case basis, and issue an approval if the
FAA finds that the launch or reentry is consistent with public health
and safety, safety of property, and national security and foreign
policy interests of the United States. For any radionuclide on a launch
or reentry vehicle, an applicant must--
(i) Identify the type and quantity;
(ii) Include a reference list of all documentation addressing the
safety of its intended use; and
(iii) Describe all approvals by the Nuclear Regulatory Commission
for pre-flight ground operations.
(7) Additional material. The FAA may also request--
(i) Any information incorporated by reference in the license
application; and
(ii) Additional products that allow the FAA to conduct an
independent safety analysis.
Sec. 450.47 Environmental review.
(a) General. The FAA is responsible for complying with the
procedures and policies of the National Environmental Policy Act (NEPA)
and other applicable environmental laws, regulations, and Executive
Orders prior to issuing a launch or reentry license. An applicant must
provide the FAA with information needed to comply with such
requirements. The FAA will consider and document the potential
environmental effects associated with issuing a launch or reentry
license consistent with paragraph (b) of this section.
(b) Environmental Impact Statement or Environmental Assessment.
When directed by the FAA, an applicant must--
(1) Prepare an Environmental Assessment with FAA oversight;
(2) Assume financial responsibility for preparation of an
Environmental Impact Statement by an FAA-selected and -managed
consultant contractor; or
(3) Submit information to support a written re-evaluation of a
previously submitted Environmental Assessment or Environmental Impact
Statement.
(c) Categorical exclusion. The FAA may determine that a categorical
exclusion is appropriate upon receipt of supporting information from an
applicant.
(d) Application requirements. An application must include an
approved FAA Environmental Assessment, Environmental Impact Statement,
categorical exclusion determination, or written re-evaluation, which
should address compliance with any other applicable environmental laws,
regulations, and Executive Orders covering all planned licensed
activities in compliance with NEPA and the Council on Environmental
Quality Regulations for Implementing the Procedural Provisions of NEPA.
Subpart C--Safety Requirements
Safety Criteria
Sec. 450.101 Safety criteria.
(a) Launch risk criteria. For any launch, an operator may initiate
the flight of a launch vehicle only if all risks to the public satisfy
the criteria in this paragraph (a). For an orbital launch, the criteria
in this paragraph apply from liftoff through orbital insertion. For a
suborbital launch, or a suborbital launch and reentry, the criteria in
this paragraph apply from liftoff through final impact or landing.
(1) Collective risk. The collective risk, measured as expected
number of casualties (EC), consists of risk posed by
impacting inert and explosive debris, toxic release, and far field
blast overpressure. Public risk due to any other hazard associated with
the proposed flight of a launch vehicle will be determined by the
Administrator on a case-by-case basis.
(i) The risk to all members of the public, excluding persons in
aircraft and neighboring operations personnel, must not exceed an
expected number of 1 x 10-\4\ casualties.
(ii) The risk to all neighboring operations personnel must not
exceed an expected number of 2 x 10-\4\ casualties.
(2) Individual risk. The individual risk, measured as probability
of casualty (PC), consists of risk posed by impacting inert
and explosive debris, toxic release, and far field blast overpressure.
The FAA will determine whether to approve public risk due to any other
hazard associated with the proposed flight of a launch vehicle on a
case-by-case basis.
(i) The risk to any individual member of the public, excluding
neighboring operations personnel, must not exceed a probability of
casualty of 1 x 10-\6\ per launch.
(ii) The risk to any individual neighboring operations personnel
must not exceed a probability of casualty of 1 x 10-\5\ per
launch.
(3) Aircraft risk. A launch operator must establish any aircraft
hazard areas necessary to ensure the probability of impact with debris
capable of causing a casualty for aircraft does not exceed 1 x
10-\6\.
(4) Risk to critical assets. (i) The risk to critical assets,
measured as the probability of loss of functionality, must not exceed
the following probabilities:
(A) For each critical asset, except for a critical payload, 1 x
10-\3\ ; and
(B) For each critical payload, 1 x 10-\4\.
(ii) The Administrator will consult with relevant Federal agencies,
and each agency will identify, for purposes of this part, any critical
assets that the agency owns or otherwise depends on. For purposes of
this part, the Administrator will accept any identification by the
Secretary of Defense that an asset is critical to national security.
(iii) The Administrator or Federal site operator will notify the
licensee of any risk to critical assets above the risk criteria in
paragraph (a)(4)(i) of this section.
(iv) The Administrator may determine, in consultation with relevant
Federal agencies, that a more stringent probability is necessary to
protect the national interests of the United States.
(v) The risk criteria in paragraph (a)(4)(i) of this section do not
apply to property, facilities, or infrastructure supporting the launch
that are within the public area distance, as defined in part 420,
appendix E, tables E1 and E2 or associated formulae, of the vehicle's
launch point.
(b) Reentry risk criteria. For any reentry, an operator may
initiate the deorbit of a vehicle only if all risks to the public
satisfy the criteria in this paragraph (b). The following criteria
apply to each reentry, other than a suborbital reentry, from the final
health check prior to initiating deorbit through final impact or
landing:
(1) Collective risk. The collective risk, measured as expected
number of casualties (EC), consists of risk posed by
impacting inert and explosive debris, toxic release, and far field
blast overpressure. Public risk due to any other hazard associated with
the proposed deorbit of a reentry vehicle will be determined by the
Administrator on a case-by-case basis.
(i) The risk to all members of the public, excluding persons in
aircraft and neighboring operations personnel, must not exceed an
expected number of 1 x 10-\4\ casualties.
(ii) The risk to all neighboring operations personnel must not
exceed an expected number of 2 x 10-\4\ casualties.
(2) Individual risk. The individual risk, measured as probability
of casualty (PC), consists of risk posed by impacting inert
and explosive debris, toxic release, and far field blast overpressure.
Public risk due to any other hazard associated with the proposed flight
of a launch
[[Page 79724]]
vehicle will be determined on a case-by-case basis.
(i) The risk to any individual member of the public, excluding
neighboring operations personnel, must not exceed a probability of
casualty of 1 x 10-\6\ per reentry.
(ii) The risk to any individual neighboring operations personnel
must not exceed a probability of casualty of 1 x 10-\5\ per
reentry.
(3) Aircraft risk. A reentry operator must establish any aircraft
hazard areas necessary to ensure the probability of impact with debris
capable of causing a casualty for aircraft does not exceed 1 x
10-\6\.
(4) Risk to critical assets. (i) The risk to critical assets,
measured as the probability of loss of functionality, must not exceed
the following probabilities:
(A) For each critical asset, except for a critical payload, 1 x
10-\3\ ; and
(B) For each critical payload, 1 x 10-\4\.
(ii) The Administrator will consult with relevant Federal agencies,
and each agency will identify, for purposes of this part, any critical
assets that the agency owns or otherwise depends on. For purposes of
this part, the Administrator will accept any identification by the
Secretary of Defense that an asset is critical to national security.
(iii) The Administrator or Federal site operator will notify the
licensee of any risk to critical assets above the risk criteria in
paragraph (b)(4)(i) of this section.
(iv) The Administrator may determine, in consultation with relevant
Federal agencies, that a more stringent probability is necessary to
protect the national interests of the United States.
(c) High consequence event protection. An operator must protect
against a high consequence event in uncontrolled areas for each phase
of flight by:
(1) Using flight abort as a hazard control strategy in accordance
with the requirements of Sec. 450.108;
(2) Ensuring the consequence of any reasonably foreseeable failure
mode, in any significant period of flight, is no greater than 1 x
10-\3\ conditional expected casualties; or
(3) Establishing the launch or reentry vehicle has sufficient
demonstrated reliability as agreed to by the Administrator based on
conditional expected casualties criteria during that phase of flight.
(d) Disposal safety criteria. A launch operator must ensure that
any disposal meets the criteria of paragraphs (b)(1) through (3) of
this section, or targets a broad ocean area.
(e) Protection of people and property on orbit. (1) A launch or
reentry operator must prevent the collision between a launch or reentry
vehicle stage or component and people or property on orbit, in
accordance with the requirements in Sec. 450.169(a).
(2) For any launch vehicle stage or component that reaches Earth
orbit, a launch operator must prevent the creation of debris through
the conversion of energy sources into energy that fragments the stage
or component, in accordance with the requirements in Sec. 450.171.
(f) Notification of planned impacts. For any launch, reentry, or
disposal, an operator must notify the public of any region of land,
sea, or air that contains, with 97 percent probability of containment,
all debris resulting from normal flight events capable of causing a
casualty.
(g) Validity of the analysis. For any analysis used to demonstrate
compliance with this section, an operator must use accurate data and
scientific principles and the analysis must be statistically valid. The
method must produce results consistent with or more conservative than
the results available from previous mishaps, tests, or other valid
benchmarks, such as higher-fidelity methods.
System Safety Program
Sec. 450.103 System safety program.
An operator must implement and document a system safety program
throughout the lifecycle of a launch or reentry system that includes
the following:
(a) Safety organization. An operator must maintain a safety
organization that has clearly defined lines of communication and
approval authority for all public safety decisions. At a minimum, the
safety organization must have the following positions:
(1) Mission director. For each launch or reentry, an operator must
designate a position responsible for the safe conduct of all licensed
activities and authorized to provide final approval to proceed with
licensed activities. This position is referred to as the mission
director in this part.
(2) Safety official. For each launch or reentry, an operator must
designate a position with direct access to the mission director who
is--
(i) Responsible for communicating potential safety and
noncompliance issues to the mission director; and
(ii) Authorized to examine all aspects of the operator's ground and
flight safety operations, and to independently monitor compliance with
the operator's safety policies, safety procedures, and licensing
requirements.
(3) Addressing safety official concerns. The mission director must
ensure that all of the safety official's concerns are addressed.
(b) Hazard management. For hazard management:
(1) An operator must implement methods to assess the system to
ensure the validity of the hazard control strategy determination and
any flight hazard or flight safety analysis throughout the lifecycle of
the launch or reentry system;
(2) An operator must implement methods for communicating and
implementing any updates throughout the organization; and
(3) Additionally, an operator required to conduct a flight hazard
analysis must implement a process for tracking hazards, risks,
mitigation measures, and verification activities.
(c) Configuration management and control. An operator must--
(1) Employ a process that tracks configurations of all safety-
critical systems and documentation related to the operation;
(2) Ensure the use of correct and appropriate versions of systems
and documentation tracked in paragraph (c)(1) of this section; and
(3) Document the configurations and versions identified in
paragraph (c)(2) of this section for each licensed activity.
(d) Post-flight data review. An operator must employ a process for
evaluating post-flight data to--
(1) Ensure consistency between the assumptions used for the hazard
control strategy determination, any flight hazard or flight safety
analyses, and associated mitigation and hazard control measures;
(2) Resolve any inconsistencies identified in paragraph (d)(1) of
this section prior to the next flight of the vehicle;
(3) Identify any anomaly that may impact any flight hazard
analysis, flight safety analysis, or safety-critical system, or is
otherwise material to public safety; and
(4) Address any anomaly identified in paragraph (d)(3) of this
section prior to the next flight as necessary to ensure public safety,
including updates to any flight hazard analysis, flight safety
analysis, or safety-critical system.
(e) Application requirements. An applicant must submit in its
application the following:
(1) A description of the applicant's safety organization as
required by paragraph (a) of this section, identifying the applicant's
lines of communication and approval authority, both internally and
externally, for all public safety
[[Page 79725]]
decisions and the provision of public safety services; and
(2) A summary of the processes and products identified in the
system safety program requirements in paragraphs (b), (c), and (d) of
this section.
Hazard Control Strategies
Sec. 450.107 Hazard control strategies.
(a) General. To meet the safety criteria of Sec. 450.101(a), (b),
or (c) for the flight, or any phase of flight, of a launch or reentry
vehicle, an operator must use one or more of the hazard control
strategies identified in Sec. 450.108 through Sec. 450.111.
(b) Hazard control strategy determination. For each phase of flight
during a launch or reentry, an operator must use a functional hazard
analysis to determine a hazard control strategy or strategies that
account for--
(1) All functional failures associated with reasonably foreseeable
hazardous events that have the capability to create a hazard to the
public;
(2) Safety-critical systems; and
(3) A timeline of all safety-critical events.
(c) Flight hazard analysis. An operator must conduct a flight
hazard analysis in accordance with Sec. 450.109 of this part for the
flight, or phase of flight, of a launch or reentry vehicle if the
public safety hazards cannot be mitigated adequately to meet the public
risk criteria of Sec. 450.101(a), (b), and (c) using physical
containment, wind weighting, or flight abort.
(d) Application requirements. An applicant must submit in its
application--
(1) The results of the hazard control strategy determination,
including--
(i) All functional failures identified under paragraph (b)(1) of
this section;
(ii) The identification of all safety-critical systems; and
(iii) A timeline of all safety-critical events.
(2) A description of its hazard control strategy or strategies for
each phase of flight.
Sec. 450.108 Flight abort.
(a) Applicability. This section applies to the use of flight abort
as a hazard control strategy for the flight, or phase of flight, of a
launch or reentry vehicle to meet the safety criteria of Sec. 450.101.
(b) Flight safety system. An operator must use a flight safety
system that:
(1) Meets the requirements of Sec. 450.145 if the consequence of
any reasonably foreseeable failure mode in any significant period of
flight is greater than 1 x 10-\2\ conditional expected
casualties in uncontrolled areas; or
(2) Meets the requirements of Sec. 450.143 if the consequence of
any reasonably foreseeable failure mode in any significant period of
flight is between 1 x 10-\2\ and 1 x 10-\3\
conditional expected casualties for uncontrolled areas.
(c) Flight safety limits objectives. An operator must determine and
use flight safety limits that define when an operator must initiate
flight abort for each of the following--
(1) To ensure compliance with the safety criteria of Sec.
450.101(a) and (b);
(2) To prevent continued flight from increasing risk in
uncontrolled areas if the vehicle is unable to achieve a useful
mission;
(3) To prevent the vehicle from entering a period of materially
increased public exposure in uncontrolled areas, including before
orbital insertion, if a critical vehicle parameter is outside its pre-
established expected range or indicates an inability to complete flight
within the limits of a useful mission;
(4) To prevent conditional expected casualties greater than 1 x
10-\2\ in uncontrolled areas due to flight abort or due to
flight outside the limits of a useful mission from any reasonably
foreseeable off-trajectory failure mode in any significant period of
flight; and
(5) To prevent the vehicle state from reaching identified
conditions that are anticipated to compromise the capability of the
flight safety system if further flight has the potential to violate a
flight safety limit.
(6) In lieu of paragraphs (c)(2) and (4) of this section, to
prevent debris capable of causing a casualty due to any hazard from
affecting uncontrolled areas using a flight safety system that complies
with Sec. 450.145.
(d) Flight safety limits constraints. An operator must determine
flight safety limits that--
(1) Account for temporal and geometric extents on the Earth's
surface of any reasonably foreseeable vehicle hazards under all
reasonably foreseeable conditions during normal and malfunctioning
flight;
(2) Account for physics of hazard generation and transport
including uncertainty;
(3) Account for the potential to lose valid data necessary to
evaluate the flight abort rules;
(4) Account for the time delay, including uncertainties, between
the violation of a flight abort rule and the time when the flight
safety system is expected to activate;
(5) Account in individual, collective, and conditional risk
evaluations both for proper functioning of the flight safety system and
failure of the flight safety system;
(6) Are designed to avoid flight abort that results in increased
collective risk to the public in uncontrolled areas, compared to
continued flight; and
(7) Ensure that any trajectory within the limits of a useful
mission that is permitted to fly without abort would meet the
collective risk criteria of Sec. 450.101(a)(1) or (b)(1) when analyzed
as if it were the planned mission in accordance with Sec.
450.213(b)(2).
(e) End of flight abort. A flight does not need to be aborted to
protect against high consequence events in uncontrolled areas beginning
immediately after critical vehicle parameters are validated, if the
vehicle is able to achieve a useful mission and the following
conditions are met for the remainder of flight:
(1) Flight abort would not materially decrease the risk from a high
consequence event; and
(2) There are no key flight safety events.
(f) Flight abort rules. For each launch or reentry, an operator
must establish and observe flight abort rules that govern the conduct
of the launch or reentry as follows.
(1) Vehicle data required to evaluate flight abort rules must be
available to the flight safety system under all reasonably foreseeable
conditions during normal and malfunctioning flight.
(2) The flight safety system must abort flight:
(i) When valid, real-time data indicate the vehicle has violated
any flight safety limit developed in accordance with this section;
(ii) When the vehicle state approaches identified conditions that
are anticipated to compromise the capability of the flight safety
system and further flight has the potential to violate a flight safety
limit; and
(iii) In accordance with methods used to satisfy (d)(3) of this
section, if tracking data is invalid and further flight has the
potential to violate a flight safety limit.
(g) Application requirements. An applicant must submit in its
application the following:
(1) A description of the methods used to demonstrate compliance
with paragraph (c) of this section, including descriptions of how each
analysis constraint in paragraph (d) of this section is satisfied in
accordance with Sec. 450.115.
(2) A description of how each flight safety limit and flight abort
rule is evaluated and implemented during vehicle flight, including the
quantitative
[[Page 79726]]
criteria that will be used, a description of any critical parameters,
and how the values required in paragraphs (c)(3) and (e) of this
section are identified;
(3) A graphic depiction or series of depictions of flight safety
limits for a representative mission together with the launch or landing
point, all uncontrolled area boundaries, the nominal trajectory,
extents of normal flight, and limits of a useful mission trajectories,
with all trajectories in the same projection as each of the flight
safety limits; and
(4) A description of the vehicle data that will be available to
evaluate flight abort rules under all reasonably foreseeable conditions
during normal and malfunctioning flight.
Sec. 450.109 Flight hazard analysis.
(a) Applicability. This section applies to the use of a flight
hazard analysis as a hazard control strategy to derive hazard controls
for the flight, or phase of flight, of a launch or reentry vehicle.
Hazards associated with computing systems and software are further
addressed in Sec. 450.141.
(b) Analysis. A flight hazard analysis must identify, describe, and
analyze all reasonably foreseeable hazards to public safety resulting
from the flight of a launch or reentry vehicle. Each flight hazard
analysis must--
(1) Identify all reasonably foreseeable hazards, and the
corresponding failure mode for each hazard, associated with the launch
or reentry system relevant to public safety, including those resulting
from:
(i) Vehicle operation, including staging and release;
(ii) System, subsystem, and component failures or faults;
(iii) Software operations;
(iv) Environmental conditions;
(v) Human factors;
(vi) Design inadequacies;
(vii) Procedure deficiencies;
(viii) Functional and physical interfaces between subsystems,
including any vehicle payload;
(ix) Reuse of components or systems; and
(x) Interactions of any of the above.
(2) Assess each hazard's likelihood and severity.
(3) Ensure that the likelihood of any hazardous condition that may
cause death or serious injury to the public is extremely remote.
(4) Identify and describe the risk elimination and mitigation
measures required to satisfy paragraph (b)(3) of this section.
(5) Document that the risk elimination and mitigation measures
achieve the risk level of paragraph (b)(3) of this section through
validation and verification. Verification includes:
(i) Analysis;
(ii) Test;
(iii) Demonstration; or
(iv) Inspection.
(c) New Hazards. An operator must establish and document the
criteria and techniques for identifying new hazards throughout the
lifecycle of the launch or reentry system.
(d) Completeness Prior to Flight. For every launch or reentry, the
flight hazard analysis must be complete and all hazards must be
mitigated to an acceptable level in accordance with paragraph (b)(3) of
this section.
(e) Updates. An operator must continually update the flight hazard
analysis throughout the lifecycle of the launch or reentry system.
(f) Application requirements. An applicant must submit in its
application the following:
(1) Flight hazard analysis products of paragraphs (b)(1) through
(5) of this section, including data that verifies the risk elimination
and mitigation measures resulting from the applicant's flight hazard
analyses required by paragraph (b)(5) of this section; and
(2) The criteria and techniques for identifying new hazards
throughout the lifecycle of the launch or reentry system as required by
paragraph (c) of this section.
Sec. 450.110 Physical containment.
(a) Applicability. This section applies to the use of physical
containment as a hazard control strategy for the flight, or phase of
flight, of a launch or reentry vehicle to meet the safety criteria of
Sec. 450.101(a), (b), and (c).
(b) Containment. To use physical containment as a hazard control
strategy, an operator must--
(1) Develop the flight hazard area in accordance with Sec.
450.133;
(2) Ensure that the launch vehicle does not have sufficient energy
for any hazards associated with its flight to reach outside the flight
hazard area;
(3) Ensure the hazard area is clear of the public and critical
assets; and
(4) Apply other mitigation measures necessary to ensure no public
or critical asset exposure to hazards, such as control of public access
or wind placards.
(c) Application requirements. An applicant must submit in its
application the following:
(1) A demonstration that the launch vehicle does not have
sufficient energy for any hazards associated with its flight to reach
outside the flight hazard area developed in accordance with Sec.
450.133; and
(2) A description of the methods used to ensure that flight hazard
areas are cleared of the public and critical assets.
Sec. 450.111 Wind weighting.
(a) Applicability. This section applies to the use of wind
weighting as a hazard control strategy for the flight of an unguided
suborbital launch vehicle to meet the safety criteria of Sec.
450.101(a), (b), and (c).
(b) Wind weighting safety system. The flight of an unguided
suborbital launch vehicle that uses a wind weighting safety system must
meet the following:
(1) The launcher azimuth and elevation settings must be wind
weighted to correct for the effects of wind conditions at the time of
flight to provide impact locations that will ensure compliance with the
safety criteria in Sec. 450.101; and
(2) An operator must use launcher azimuth and elevation angle
settings that ensures the rocket will not fly in an unintended
direction accounting for uncertainties in vehicle and launcher design
and manufacturing, and atmospheric uncertainties.
(c) Analysis. An operator must--
(1) Establish flight commit criteria and other flight safety rules
that control the risk to the public from potential adverse effects
resulting from normal and malfunctioning flight;
(2) Establish any wind constraints under which flight may occur;
and
(3) Conduct a wind weighting analysis that establishes the launcher
azimuth and elevation settings that correct for the windcocking and
wind-drift effects on the unguided suborbital launch vehicle.
(d) Stability. An unguided suborbital launch vehicle, in all
configurations, must be stable throughout each stage of powered flight.
(e) Application requirements. An applicant must submit in its
application the following:
(1) A description of its wind weighting analysis methods, including
its method and schedule of determining wind speed and wind direction
for each altitude layer;
(2) A description of its wind weighting safety system including all
equipment used to perform the wind weighting analysis; and
(3) A representative wind weighting analysis using actual or
statistical winds for the launch area and samples of the output.
Flight Safety Analyses
Sec. 450.113 Flight safety analysis requirements--scope.
(a) An operator must perform and document a flight safety analysis
for all
[[Page 79727]]
phases of flight, except as specified in paragraph (b) of this section,
as follows--
(1) For orbital launch, from liftoff through orbital insertion, and
through all component impacts or landings;
(2) For suborbital launch, from liftoff through all component
impacts or landings;
(3) For disposal, from the initiation of the deorbit through final
impact; and
(4) For reentry, from the initiation of the deorbit through all
component impacts or landing.
(b) An operator is not required to perform and document a flight
safety analysis for a phase of flight if agreed to by the Administrator
based on demonstrated reliability. An operator demonstrates reliability
by using operational and flight history to show compliance with the
risk criteria in Sec. 450.101(a) and (b).
Sec. 450.115 Flight safety analysis methods.
(a) Scope of the analysis. An operator's flight safety analysis
method must account for all reasonably foreseeable events and failures
of safety-critical systems during nominal and non-nominal launch or
reentry that could jeopardize public safety.
(b) Level of fidelity of the analysis. An operator's flight safety
analysis method must have a level of fidelity sufficient to--
(1) Demonstrate that any risk to the public satisfies the safety
criteria of Sec. 450.101, including the use of mitigations, accounting
for all known sources of uncertainty, using a means of compliance
accepted by the Administrator; and
(2) Identify the dominant source of each type of public risk with a
criterion in Sec. 450.101(a) or (b) in terms of phase of flight,
source of hazard (such as toxic exposure, inert, or explosive debris),
and failure mode.
(c) Application requirements. An applicant must submit a
description of the flight safety analysis methodology, including
identification of:
(1) The scientific principles and statistical methods used;
(2) All assumptions and their justifications;
(3) The rationale for the level of fidelity;
(4) The evidence for validation and verification required by Sec.
450.101(g);
(5) The extent to which the benchmark conditions are comparable to
the foreseeable conditions of the intended operations; and
(6) The extent to which risk mitigations were accounted for in the
analyses.
Sec. 450.117 Trajectory analysis for normal flight.
(a) General. A flight safety analysis must include a trajectory
analysis that establishes, for any phase of flight within the scope as
provided by Sec. 450.113(a), the limits of a launch or reentry
vehicle's normal flight as defined by the nominal trajectory, and the
following sets of trajectories sufficient to characterize variability
and uncertainty during normal flight:
(1) A set of trajectories to characterize variability. This set
must describe how the intended trajectory could vary due to conditions
known prior to initiation of flight; and
(2) A set of trajectories to characterize uncertainty. This set
must describe how the actual trajectory could differ from the intended
trajectory due to random uncertainties in all parameters with a
significant influence on the vehicle's behavior throughout normal
flight.
(b) Trajectory model. A final trajectory analysis must use a six-
degree of freedom trajectory model to satisfy the requirements of
paragraph (a) of this section.
(c) Atmospheric effects. A trajectory analysis must account for
atmospheric conditions that have an effect on the trajectory, including
atmospheric profiles that are no less severe than the worst conditions
under which flight might be attempted, and for uncertainty in the
atmospheric conditions.
(d) Application requirements. An applicant must submit the
following:
(1) A description of the methods used to characterize the vehicle's
flight behavior throughout normal flight, in accordance with Sec.
450.115(c).
(2) The quantitative input data, including uncertainties, used to
model the vehicle's normal flight in six degrees of freedom.
(3) The worst atmospheric conditions under which flight might be
attempted, and a description of how the operator will evaluate the
atmospheric conditions and uncertainty in the atmospheric conditions
prior to initiating the operation;
(4) Representative normal flight trajectory analysis outputs,
including the position velocity, and orientation for each second of
flight for--
(i) The nominal trajectory;
(ii) A set of trajectories that characterize variability in the
intended trajectory based on conditions known prior to initiation of
flight; and
(iii) A set of trajectories that characterize how the actual
trajectory could differ from the intended trajectory due to random
uncertainties.
Sec. 450.119 Trajectory analysis for malfunction flight.
(a) General. A flight safety analysis must include a trajectory
analysis that establishes--
(1) The vehicle's deviation capability in the event of a
malfunction during flight,
(2) The trajectory dispersion resulting from reasonably foreseeable
malfunctions, and
(3) For vehicles using flight abort as a hazard control strategy
under Sec. 450.108, trajectory data or parameters that describe the
limits of a useful mission. The FAA does not consider the collection of
data related to a failure to be a useful mission.
(b) Analysis constraints. A malfunction trajectory analysis must
account for each cause of a malfunction flight, including software and
hardware failures, for every period of normal flight. The analysis for
each type of malfunction must have sufficient temporal and spatial
resolution to establish flight safety limits, if any, and individual
risk contours that are smooth and continuous. The analysis must account
for--
(1) The relative probability of occurrence of each malfunction;
(2) The probability distribution of position and velocity of the
vehicle when each malfunction trajectory will terminate due to vehicle
breakup, ground impact, or orbital insertion along with the cause of
termination and the state of the vehicle;
(3) The parameters with a significant influence on a vehicle's
flight behavior from the time a malfunction begins to cause a flight
deviation until the time each malfunction trajectory will terminate due
to vehicle breakup, ground impact, or orbital insertion; and
(4) The potential for failure of the flight safety system, if any.
(c) Application requirements. An applicant must submit--
(1) A description of the methodology used to characterize the
vehicle's flight behavior throughout malfunction flight, in accordance
with Sec. 450.115(c).
(2) A description of the methodology used to determine the limits
of a useful mission, in accordance with Sec. 450.115(c).
(3) A description of the input data used to characterize the
vehicle's malfunction flight behavior, including:
(i) A list of each cause of malfunction flight considered;
(ii) A list of each type of malfunction flight for which
malfunction flight behavior was characterized; and
(iii) A quantitative description of the parameters, including
uncertainties, with a significant influence on the
[[Page 79728]]
vehicle's malfunction behavior for each type of malfunction flight
characterized.
(4) Representative malfunction flight trajectory analysis outputs,
including the position and velocity as a function of flight time for--
(i) Each set of trajectories that characterizes a type of
malfunction flight;
(ii) The probability of each set of trajectories that characterizes
a type of malfunction flight; and
(iii) A set of trajectories that characterizes the limits of a
useful mission as described in paragraph (a)(3) of this section.
Sec. 450.121 Debris analysis.
(a) General. A flight safety analysis must include an analysis
characterizing the hazardous debris generated from normal and
malfunctioning vehicle flight as a function of vehicle flight sequence.
(b) Vehicle impact and breakup analysis. A debris analysis must
account for:
(1) Each reasonably foreseeable cause of vehicle breakup and intact
impact,
(2) Vehicle structural characteristics and materials, and
(3) Energetic effects during break-up or at impact.
(c) Propagation of debris. A debris analysis must compute
statistically valid debris impact probability distributions. The
propagation of debris from each predicted breakup location to impact
must account for--
(1) All foreseeable forces that can influence any debris impact
location; and
(2) All foreseeable sources of impact dispersion, including, at a
minimum:
(i) The uncertainties in atmospheric conditions;
(ii) Debris aerodynamic parameters, including uncertainties;
(iii) Pre-breakup position and velocity, including uncertainties;
and
(iv) Breakup-imparted velocities, including uncertainties.
(d) Application requirements. An applicant must submit:
(1) A description of all scenarios that can lead to hazardous
debris;
(2) A description of the methods used to perform the vehicle impact
and breakup analysis, in accordance with Sec. 450.115(c);
(3) A description of the methods used to compute debris impact
distributions, in accordance with Sec. 450.115(c);
(4) A description of the atmospheric data used as input to the
debris analysis; and
(5) A quantitative description of the physical, aerodynamic, and
harmful characteristics of hazardous debris.
Sec. 450.123 Population exposure analysis.
(a) General. A flight safety analysis must account for the
distribution of people for the entire region where there is a
significant probability of impact of hazardous debris.
(b) Constraints. The exposure analysis must--
(1) Characterize the distribution of people both geographically and
temporally;
(2) Account for the distribution of people among structures and
vehicle types;
(3) Use reliable, accurate, and timely source data; and
(4) Account for vulnerability of people to hazardous debris
effects.
(c) Application requirements. An applicant must submit:
(1) A description of the methods used to develop the exposure input
data in accordance with Sec. 450.115(c), and
(2) Complete population exposure data, in tabular form.
Sec. 450.131 Probability of failure analysis.
(a) General. For each hazard and phase of flight, a flight safety
analysis for a launch or reentry must account for vehicle failure
probability. The probability of failure must be consistent for all
hazards and phases of flight.
(1) For a vehicle or vehicle stage with fewer than two flights, the
failure probability estimate must account for the outcome of all
previous flights of vehicles developed and launched or reentered in
similar circumstances.
(2) For a vehicle or vehicle stage with two or more flights,
vehicle failure probability estimates must account for the outcomes of
all previous flights of the vehicle or vehicle stage in a statistically
valid manner. The outcomes of all previous flights of the vehicle or
vehicle stage must account for data on any mishap and anomaly.
(b) Failure. For flight safety analysis purposes, a failure occurs
when a vehicle does not complete any phase of normal flight or when any
anomalous condition exhibits the potential for a stage or its debris to
impact the Earth or reenter the atmosphere outside the normal
trajectory envelope during the mission or any future mission of similar
vehicle capability.
(c) Previous flight. For flight safety analysis purposes--
(1) The flight of a launch vehicle begins at a time in which a
launch vehicle lifts off from the surface of the Earth; and
(2) The flight of a reentry vehicle or deorbiting upper stage
begins at a time in which a vehicle attempts to initiate a reentry.
(d) Allocation. The vehicle failure probability estimate must be
distributed across flight phases and failure modes. The distribution
must be consistent with--
(1) The data available from all previous flights of vehicles
developed and launched or reentered in similar circumstances; and
(2) Data from previous flights of vehicles, stages, or components
developed and launched, reentered, flown, or tested by the subject
vehicle developer or operator. Such data may include previous
experience involving similar--
(i) Vehicle, stage, or component design characteristics;
(ii) Development and integration processes, including the extent of
integrated system testing; and
(iii) Level of experience of the vehicle operation and development
team members.
(e) Observed vs. conditional failure rate. Probability of failure
allocation must account for significant differences in the observed
failure rate and the conditional failure rate. A probability of failure
analysis must use a constant conditional failure rate for each phase of
flight, unless there is clear and convincing evidence of a different
conditional failure rate for a particular vehicle, stage, or phase of
flight.
(f) Application requirements. An applicant must submit:
(1) A description of the methods used in probability of failure
analysis, in accordance with Sec. 450.115(c); and
(2) A representative set of tabular data and graphs of the
predicted failure rate and cumulative failure probability for each
foreseeable failure mode.
Sec. 450.133 Flight hazard area analysis.
(a) General. A flight safety analysis must include a flight hazard
area analysis that identifies any region of land, sea, or air that must
be surveyed, publicized, controlled, or evacuated in order to control
the risk to the public. The analysis must account for, at a minimum--
(1) The regions of land, sea, and air potentially exposed to
hazardous debris generated during normal flight events and all
reasonably foreseeable failure modes;
(2) Any hazard controls implemented to control risk from any
hazard;
(3) The limits of a launch or reentry vehicle's normal flight,
including--
(i) Atmospheric conditions that are no less severe than the worst
atmospheric conditions under which flight might be attempted; and
(ii) Uncertainty in the atmospheric conditions;
(4) All hazardous debris;
(5) Sources of debris dispersion in accordance with Sec.
450.121(c); and
[[Page 79729]]
(6) A probability of one for any planned debris hazards or planned
impacts.
(b) Waterborne vessel hazard areas. The flight hazard area analysis
for waterborne vessels must determine the areas and durations for
regions of water--
(1) That are necessary to contain, with 97 percent probability of
containment, all debris resulting from normal flight events capable of
causing a casualty to persons on waterborne vessels;
(2) That are necessary to contain either where the probability of
debris capable of causing a casualty impacting on or near a vessel
would exceed 1 x 10-\5\, accounting for all relevant
hazards, or where the individual probability of casualty for any person
on board a vessel would exceed the individual risk criteria in Sec.
450.101(a)(2) or (b)(2); and
(3) Where reduced vessel traffic is necessary to meet the
collective risk criteria in Sec. 450.101(a)(1) or (b)(1).
(c) Land hazard areas. The flight hazard area analysis for land
must determine the durations and areas regions of land--
(1) That are necessary to contain, with 97 percent probability of
containment, all debris resulting from normal flight events capable of
causing a casualty to any person on land;
(2) Where the individual probability of casualty for any person on
land would exceed the individual risk criteria in Sec. 450.101(a)(2)
or (b)(2); and
(3) Where reduced population is necessary to meet the collective
risk criteria in Sec. 450.101(a)(1) or (b)(1).
(d) Airspace hazard volumes. The flight hazard area analysis for
airspace must determine the durations and volumes for regions of air to
be submitted to the FAA for approval--
(1) That are necessary to contain, with 97 percent probability of
containment, all debris resulting from normal flight events capable of
causing a casualty to persons on an aircraft; and
(2) Where the probability of impact on an aircraft would exceed the
aircraft risk criterion in Sec. 450.101(a)(3) or (b)(3).
(e) Application requirements. An applicant must submit:
(1) A description of the methodology to be used in the flight
hazard area analysis in accordance with Sec. 450.115(c), including:
(i) Classes of waterborne vessel and vulnerability criteria
employed; and
(ii) Classes of aircraft and vulnerability criteria employed.
(2) Tabular data and graphs of the results of the flight hazard
area analysis, including:
(i) Geographical coordinates of all hazard areas that are
representative of those to be published, in accordance with Sec.
450.161, prior to any proposed operation;
(ii) Representative 97 percent probability of containment contours
for all debris resulting from normal flight events capable of causing a
casualty for all locations specified in paragraph (a) of this section;
(iii) Representative individual probability of casualty contours
for all locations specified in paragraph (a) of this section, including
tabular data and graphs showing the hypothetical location of any member
of the public that could be exposed to a probability of casualty of 1 x
10-\5\ or greater for neighboring operations personnel, and
1 x 10-\6\ or greater for other members of the public, given
all foreseeable conditions within the flight commit criteria;
(iv) If applicable, representative 1 x 10-\5\ and 1 x
10-\6\ probability of impact contours for all debris capable
of causing a casualty to persons on a waterborne vessel regardless of
location; and
(v) Representative 1 x 10-\6\ and 1 x 10-\7\
probability of impact contours for all debris capable of causing a
casualty to persons on an aircraft regardless of location.
Sec. 450.135 Debris risk analysis.
(a) General. A flight safety analysis must include a debris risk
analysis that demonstrates compliance with safety criteria in Sec.
450.101, either--
(1) Prior to the day of the operation, accounting for all
foreseeable conditions within the flight commit criteria; or
(2) During the countdown using the best available input data,
including flight commit criteria and flight abort rules.
(b) Casualty area and consequence analysis. A debris risk analysis
must model the casualty area, and compute the predicted consequences of
each reasonably foreseeable failure mode in any significant period of
flight in terms of conditional expected casualties. The casualty area
and consequence analysis must account for--
(1) All relevant debris fragment characteristics and the
characteristics of a representative person exposed to any potential
debris hazard;
(2) Statistically-valid debris impact probability distributions;
(3) Any impact or effects of hazardous debris; and
(4) The vulnerability of people to debris impact or effects,
including:
(i) Effects of buildings, ground vehicles, waterborne vessel, and
aircraft upon the vulnerability of any occupants;
(ii) Effect of atmospheric conditions on debris impact and effects;
(iii) Impact speed and angle, accounting for motion of impacted
vehicles;
(iv) Uncertainty in input data, such as fragment impact parameters;
and
(v) Uncertainty in modeling methodology.
(c) Application requirements. An applicant must submit:
(1) A description of the methods used to demonstrate compliance
with the safety criteria in Sec. 450.101, in accordance with Sec.
450.115(c), including a description of how the operator will account
for the conditions immediately prior to enabling the flight of a launch
vehicle or the reentry of a reentry vehicle, such as the final
trajectory, atmospheric conditions, and the exposure of people;
(2) A description of the atmospheric data used as input to the
debris risk analysis;
(3) The effective unsheltered casualty area for all fragment
classes, assuming a representative impact vector;
(4) The effective casualty area for all fragment classes for a
representative type of building, ground vehicle, waterborne vessel, and
aircraft, assuming a representative impact vector;
(5) Collective and individual debris risk analysis outputs under
representative conditions and the worst foreseeable conditions,
including:
(i) Total collective casualty expectation for the proposed
operation;
(ii) A list of the collective risk contribution for at least the
top ten population centers and all centers with collective risk
exceeding 1 percent of the collective risk criteria in Sec.
450.101(a)(1) or (b)(1);
(iii) A list of the maximum individual probability of casualty for
the top ten population centers and all centers that exceed 10 percent
of the individual risk criteria in Sec. 450.101(a)(2) or (b)(2); and
(iv) A list of the conditional collective casualty expectation for
each failure mode for each significant period of flight under
representative conditions and the worst foreseeable conditions.
Sec. 450.137 Far-field overpressure blast effects analysis.
(a) General. A flight safety analysis must include a far-field
overpressure blast effect analysis that demonstrates compliance with
safety criteria in Sec. 450.101, either--
(1) Prior to the day of the operation, accounting for all
foreseeable conditions within the flight commit criteria; or
(2) During the countdown using the best available input data,
including flight commit criteria and flight abort rules.
[[Page 79730]]
(b) Analysis constraints. The analysis must account for--
(1) The explosive capability of the vehicle and hazardous debris at
impact and at altitude;
(2) The potential influence of meteorological conditions and
terrain characteristics; and
(3) The potential for broken windows due to peak incident
overpressures below 1.0 psi and related casualties based on the
characteristics of exposed windows and the population's susceptibility
to injury, with considerations including, at a minimum, shelter types,
window types, and the time of day of the proposed operation.
(c) Application requirements. An applicant must submit a
description of the far-field overpressure analysis, including all
assumptions and justifications for the assumptions, analysis methods,
input data, and results. At a minimum, the application must include:
(1) A description of the population centers, terrain, building
types, and window characteristics used as input to the far-field
overpressure analysis;
(2) A description of the methods used to compute the foreseeable
explosive yield probability pairs, and the complete set of yield-
probability pairs, used as input to the far-field overpressure
analysis;
(3) A description of the methods used to compute peak incident
overpressures as a function of distance from the explosion and
prevailing meteorological conditions, including sample calculations for
a representative range of the foreseeable meteorological conditions,
yields, and population center locations;
(4) A description of the methods used to compute the probability of
window breakage, including tabular data and graphs for the probability
of breakage as a function of the peak incident overpressure for a
representative range of window types, building types, and yields
accounted for;
(5) A description of the methods used to compute the probability of
casualty for a representative individual, including tabular data and
graphs for the probability of casualty, as a function of location
relative to the window and the peak incident overpressure for a
representative range of window types, building types, and yields
accounted for;
(6) Tabular data and graphs showing the hypothetical location of
any member of the public that could be exposed to a probability of
casualty of 1 x 10-\5\ or greater for neighboring operations
personnel, and 1 x 10-\6\ or greater for other members of
the public, given foreseeable conditions;
(7) The maximum expected casualties that could result from far-
field overpressure hazards given foreseeable conditions; and
(8) A description of the meteorological measurements used as input
to any real-time far-field overpressure analysis.
Sec. 450.139 Toxic hazards for flight.
(a) Applicability. (1) Except as specified in paragraph (a)(2),
this section applies to any launch or reentry vehicle, including all
vehicle components and payloads, that use toxic propellants or other
toxic chemicals.
(2) No toxic release hazard analysis is required for kerosene-based
fuels, unless the Administrator determines that an analysis is required
to protect public safety.
(b) General. An operator must--
(1) Conduct a toxic release hazard analysis in accordance with
paragraph (c) of this section;
(2) Manage the risk of casualties that could arise from the
exposure to toxic release through one of the following means:
(i) Contain hazards caused by toxic release in accordance with
paragraph (d) of this section; or
(ii) Perform a toxic risk assessment, in accordance with paragraph
(e) of this section, that protects the public in compliance with the
safety criteria of Sec. 450.101, including toxic release hazards.
(3) Establish flight commit criteria based on the results of its
toxic release hazard analysis and toxic containment or toxic risk
assessment for any necessary evacuation of the public from any toxic
hazard area.
(c) Toxic release hazard analysis. A toxic release hazard analysis
must--
(1) Account for any toxic release that could occur during nominal
or non-nominal flight;
(2) Include a worst-case release scenario analysis or a maximum-
credible release scenario analysis for each process that involves a
toxic propellant or other chemical;
(3) Determine if toxic release can occur based on an evaluation of
the chemical compositions and quantities of propellants, other
chemicals, vehicle materials, and projected combustion products, and
the possible toxic release scenarios;
(4) Account for both normal combustion products and any unreacted
propellants and phase change or chemical derivatives of released
substances; and
(5) Account for any operational constraints and emergency
procedures that provide protection from toxic release.
(d) Toxic containment. An operator using toxic containment must
manage the risk of any casualty from the exposure to toxic release
either by--
(1) Evacuating, or being prepared to evacuate, the public from any
toxic hazard area in the event of a worst-case release or maximum-
credible release scenario; or
(2) Employing meteorological constraints to limit an operation to
times during which prevailing winds and other conditions ensure that
any member of the public would not be exposed to toxic concentrations
and durations greater than accepted toxic thresholds for acute casualty
in the event of a worst-case release or maximum-credible release
scenario.
(e) Toxic risk assessment. An operator using toxic risk assessment
must establish flight commit criteria that demonstrate compliance with
the safety criteria of Sec. 450.101. A toxic risk assessment must--
(1) Account for airborne concentration and duration thresholds of
toxic propellants or other chemicals. For any toxic propellant, other
chemicals, or combustion product, an operator must use airborne toxic
concentration and duration thresholds identified in a means of
compliance accepted by the Administrator;
(2) Account for physical phenomena expected to influence any toxic
concentration and duration in the area surrounding the potential
release site;
(3) Determine a toxic hazard area for the launch or reentry,
surrounding the potential release site for each toxic propellant or
other chemical based on the amount and toxicity of the propellant or
other chemical, the exposure duration, and the meteorological
conditions involved;
(4) Account for all members of the public who may be exposed to the
toxic release, including all members of the public on land and on any
waterborne vessels, populated offshore structures, and aircraft that
are not operated in direct support of the launch or reentry; and
(5) Account for any risk mitigation measures applied in the risk
assessment.
(f) Application requirements. An applicant must submit:
(1) The identity of toxic propellant, chemical, or combustion
products or derivatives in the possible toxic release;
(2) The applicant's selected airborne toxic concentration and
duration thresholds;
[[Page 79731]]
(3) The meteorological conditions for the atmospheric transport and
buoyant cloud rise of any toxic release from its source to downwind
receptor locations;
(4) Characterization of the terrain, as input for modeling the
atmospheric transport of a toxic release from its source to downwind
receptor locations;
(5) The identity of the toxic dispersion model used, and any other
input data;
(6) Representative results of an applicant's toxic dispersion
modeling to predict concentrations and durations at selected downwind
receptor locations, to determine the toxic hazard area for a released
quantity of the toxic substance;
(7) A toxic release hazard analysis in accordance with paragraph
(c) of this section:
(i) A description of the failure modes and associated relative
probabilities for potential toxic release scenarios used in the risk
evaluation; and
(ii) The methodology and representative results of an applicant's
determination of the worst-case or maximum-credible quantity of any
toxic release that might occur during the flight of a vehicle;
(8) In accordance with Sec. 450.139(b)(2),
(i) A toxic containment in accordance with paragraph (d) of this
section, identify the evacuation plans or meteorological constraints
and associated launch commit criteria needed to ensure that the public
will not be within a toxic hazard area in the event of a worst-case
release or maximum-credible release scenario; or
(ii) A toxic risk assessment in accordance with paragraph (e) of
this section:
(A) A demonstration that the safety criteria in Sec. 450.101 will
be met;
(B) The population characteristics in receptor locations that are
identified by toxic dispersion modeling as toxic hazard areas;
(C) A description of any risk mitigations applied in the toxic risk
assessment; and
(D) A description of the population exposure input data used in
accordance with Sec. 450.123.
Prescribed Hazard Controls for Safety-Critical Hardware and Computing
Systems
Sec. 450.141 Computing systems.
(a) Identification of computing system safety items. An operator
must identify:
(1) Any software or data that implements a capability that, by
intended operation, unintended operation, or non-operation, can present
a hazard to the public; and
(2) The level of criticality of each computing system safety item
identified in paragraph (a)(1) of this section, commensurate with its
degree of control over hazards to the public and the severity of those
hazards.
(b) Safety requirements. An operator must develop safety
requirements for each computing system safety item. In doing so, the
operator must:
(1) Identify and evaluate safety requirements for each computing
system safety item;
(2) Ensure the safety requirements are complete and correct;
(3) Implement each safety requirement; and
(4) Verify and validate the implementation of each safety
requirement by using a method appropriate for the level of criticality
of the computing system safety item. For each computing system safety
item that is safety critical under Sec. 401.7, verification and
validation must include testing by a test team independent of the
development division or organization.
(c) Development process. An operator must implement and document a
development process for computing system safety items appropriate for
the level of criticality of the computing system safety item. A
development process must define:
(1) Responsibilities for each task associated with a computing
system safety item;
(2) Processes for internal review and approval--including review
that evaluates the implementation of all safety requirements--such that
no person approves that person's own work;
(3) Processes to ensure development personnel are trained,
qualified, and capable of performing their role;
(4) Processes that trace requirements to verification and
validation evidence;
(5) Processes for configuration management that specify the content
of each released version of a computing system safety item;
(6) Processes for testing that verify and validate all safety
requirements to the extent required by paragraph (b)(4) of this
section;
(7) Reuse policies that verify and validate the safety requirements
for reused computing system safety items; and
(8) Third-party product use policies that verify and validate the
safety requirements for any third-party product.
(d) Application requirements. An applicant must:
(1) Identify and describe all computing system safety items
involved in the proposed operations;
(2) Provide the safety requirements for each computing system
safety item;
(3) Provide documentation of the development processes that meets
paragraph (c) of this section;
(4) Provide evidence of the execution of the appropriate
development process for each computing system safety item; and
(5) Provide evidence of the implementation of each safety
requirement.
Sec. 450.143 Safety-critical system design, test, and documentation.
(a) Applicability. This section applies to all safety-critical
systems, except for--
(1) Highly reliable flight safety systems covered under Sec.
450.145; or
(2) Safety-critical systems for which an operator demonstrates
through its flight hazard analysis that the likelihood of any hazardous
condition specifically associated with the system that may cause death
or serious injury to the public is extremely remote, pursuant to Sec.
450.109(b)(3).
(b) Design. An operator must design safety-critical systems such
that no credible fault can lead to increased risk to the public beyond
nominal safety-critical system operation.
(c) Qualification testing of design. An operator must functionally
demonstrate the design of the vehicle's safety-critical systems at
conditions beyond its predicted operating environments. The operator
must select environmental test levels that ensure the design is
sufficiently stressed to demonstrate that system performance is not
degraded due to design tolerances, manufacturing variances, or
uncertainties in the environment.
(d) Acceptance of hardware. An operator must--
(1) Functionally demonstrate any safety-critical system, while
exposed to its predicted operating environments with margin, is free of
defects, free of integration and workmanship errors, and ready for
operational use; or
(2) Combine in-process controls and a quality assurance process to
ensure functional capability of any safety-critical system during its
service life.
(e) Lifecycle of safety-critical systems. (1) The predicted
operating environments must be based on conditions predicted to be
encountered in all phases of flight, recovery, and transportation.
(2) An operator must monitor the flight environments experienced by
safety-critical system components to the extent necessary to--
(i) Validate the predicted operating environments; and
(ii) Assess the actual component life remaining or adjust any
inspection period.
[[Page 79732]]
(f) Application requirements. An applicant must submit to the FAA
the following as part of its application:
(1) A list and description of each safety-critical system;
(2) Drawings and schematics for each safety-critical system;
(3) A summary of the analysis to determine the predicted operating
environments and duration to be applied to qualification and acceptance
testing covering the service life of any safety-critical system;
(4) A description of any method used to validate the predicted
operating environments;
(5) A description of any instrumentation or inspection processes to
monitor aging of any safety-critical system;
(6) The criteria and procedures for disposal or refurbishment for
service life extension of safety-critical system components; and
(7) A description of the standards used in all phases of the
lifecycle of each safety-critical system.
Sec. 450.145 Highly reliable flight safety system.
(a) General. For each phase of flight for which an operator must
implement flight abort to meet the requirement of Sec. 450.108(b)(1),
the operator must use a highly reliable flight safety system on the
launch or reentry vehicle, vehicle component, or payload with a design
reliability in accordance with this section.
(b) Reliability. A highly reliable flight safety system must, using
a means of compliance accepted by the Administrator--
(1) Have a design reliability of 0.999 at 95 percent confidence and
commensurate design, analysis, and testing for the portion of the
flight safety system onboard the vehicle; and
(2) Have a design reliability of 0.999 at 95 percent confidence and
commensurate design, analysis, and testing for the portion of the
flight safety system not onboard the vehicle, if used.
(c) Monitoring. An operator must monitor the flight environments
experienced by any flight safety system component to the extent
necessary to--
(1) Validate the predicted operating environment; and
(2) Assess the actual component life remaining or adjust any
inspection period.
(d) Application requirements. An applicant must submit the
information identified below, for any highly reliable flight safety
system:
(1) Flight safety system description. An applicant must describe
the flight safety system and its operation in detail, including all
components, component functions, and possible operational scenarios.
(2) Flight safety system diagram. An applicant must submit a
diagram that identifies all flight safety system subsystems and shows
the interconnection of all the elements of the flight safety system.
The diagram must include any subsystems used to implement flight abort
both on and off the vehicle, including any subsystems used to make the
decision to abort flight.
(3) Flight safety system analyses. An applicant must submit any
analyses and detailed analysis reports of all flight safety system
subsystems necessary to calculate the reliability and confidence levels
required by paragraph (a) of this section.
(4) Tracking validation procedures. An applicant must document and
submit the procedures for validating the accuracy of any vehicle
tracking data utilized by the flight safety system to make the decision
to abort flight.
(5) Flight safety system test plans. An applicant must submit
acceptance, qualification, and preflight test plans of any flight
safety system, subsystems, and components. The test plans must include
test procedures and test environments.
(6) Monitoring plan. An applicant must submit a description of any
method used to validate the predicted operating environments.
Other Prescribed Hazard Controls
Sec. 450.147 Agreements.
(a) General. An operator must establish a written agreement with
any entity that provides a service or property that meets a requirement
in this part, including:
(1) Launch and reentry site use agreements. A Federal launch or
reentry site operator, a licensed launch or reentry site operator, or
any other person that provides services or access to or use of property
required to support the safe launch or reentry under this part;
(2) Agreements for notices to mariners. Unless otherwise addressed
in agreements with the site operator, for overflight of navigable
water, the U.S. Coast Guard or other applicable maritime authority to
establish procedures for the issuance of a Notice to Mariners prior to
a launch or reentry and other measures necessary to protect public
health and safety;
(3) Agreements for notices to airmen. Unless otherwise addressed in
agreements with the site operator, the FAA Air Traffic Organization or
other applicable air navigation authority to establish procedures for
the issuance of a Notice to Airmen prior to a launch or reentry, for
closing of air routes during the respective launch and reentry windows,
and for other measures necessary to protect public health and safety;
and
(4) Mishap response. Emergency response providers, including local
government authorities, to satisfy the requirements of Sec. 450.173.
(b) Roles and responsibilities. The agreements required in this
section must clearly delineate the roles and responsibilities of each
party to support the safe launch or reentry under this part.
(c) Effective date. The agreements required in this section must be
in effect before a license can be issued, unless otherwise agreed to by
the Administrator.
(d) Application requirements. An applicant must--
(1) Describe each agreement in this section; and
(2) Provide a copy of any agreement, or portion thereof, to the FAA
upon request.
Sec. 450.149 Safety-critical personnel qualifications.
(a) General. An operator must ensure safety-critical personnel are
trained, qualified, and capable of performing their safety-critical
tasks, and that their training is current.
(b) Application requirements. An applicant must--
(1) Identify safety-critical tasks that require qualified
personnel;
(2) Provide internal training and currency requirements, completion
standards, or any other means of demonstrating compliance with the
requirements of this section; and
(3) Describe the process for tracking training currency.
Sec. 450.151 Work shift and rest requirements.
(a) General. For any launch or reentry, an operator must document
and implement rest requirements that ensure safety-critical personnel
are physically and mentally capable of performing all assigned tasks.
(b) Work shifts and deviation approval process. An operator's rest
requirements must address the following:
(1) Duration of each work shift and the process for extending this
shift, including the maximum allowable length of any extension;
(2) Number of consecutive work shift days allowed before rest is
required;
(3) Minimum rest period required--
[[Page 79733]]
(i) Between each work shift, including the period of rest required
immediately before the flight countdown work shift; and
(ii) After the maximum number of work shift days allowed; and
(4) Approval process for any deviation from the rest requirements.
(c) Application requirement. An applicant must submit rest rules
that demonstrate compliance with the requirements of this section.
Sec. 450.153 Radio frequency management.
(a) General. For any radio frequency used, an operator must--
(1) Ensure radio frequency interference does not adversely affect
performance of any flight safety system or safety-critical system; and
(2) Coordinate use of radio frequencies with any site operator and
any local and Federal authorities.
(b) Application requirements. An applicant must submit procedures
or other means to demonstrate compliance with the radio frequency
requirements of this section.
Sec. 450.155 Readiness.
(a) General. An operator must document and implement procedures to
assess readiness to proceed with the flight of a launch or reentry
vehicle. These procedures must address, at a minimum, the following:
(1) Readiness of vehicle and launch, reentry, or landing site,
including any contingency abort location;
(2) Readiness of safety-critical personnel, systems, software,
procedures, equipment, property, and services; and
(3) Readiness to implement the mishap plan required by Sec.
450.173.
(b) Application requirements. An applicant must--
(1) Demonstrate compliance with the requirements of paragraph (a)
of this section through procedures that may include a readiness meeting
close in time to flight; and
(2) Describe the criteria for establishing readiness to proceed
with the flight of a launch or reentry vehicle so that public safety is
maintained.
Sec. 450.157 Communications.
(a) An operator must implement communication procedures during the
countdown and flight of a launch or reentry vehicle that--
(1) Define the authority of personnel, by individual or position
title, to issue ``hold/resume,'' ``go/no go,'' and abort commands;
(2) Assign communication networks so that personnel identified in
paragraph (a)(1) of this section have direct access to real-time,
safety-critical information required to issue ``hold/resume,'' ``go/no
go,'' and any abort commands; and
(3) Implement a protocol for using defined radio telephone
communications terminology.
(b) An operator must ensure the currency of the communication
procedures, and that all personnel are working with the approved
version of the communication procedures.
(c) An operator must record all safety-critical communications
network channels that are used for voice, video, or data transmissions
that support safety-critical systems during each countdown.
Sec. 450.159 Pre-flight procedures.
(a) An operator must implement pre-flight procedures that--
(1) Verify that each flight commit criterion is satisfied before
flight is initiated; and
(2) Ensure the operator can return the vehicle to a safe state
after a countdown abort or delay.
(b) An operator must ensure the currency of the pre-flight
procedures, and that all personnel are working with the approved
version of the pre-flight procedures.
Sec. 450.161 Control of hazard areas.
(a) General. The operator must publicize, survey, control, or
evacuate each flight hazard area identified in accordance with Sec.
450.133 prior to initiating flight of a launch vehicle or the reentry
of a reentry vehicle to the extent necessary to ensure compliance with
Sec. 450.101.
(b) Verification. The launch or reentry operator must perform
surveillance sufficient to verify or update the assumptions, input
data, and results of the flight safety analyses.
(c) Publication. An operator must publicize warnings for each
flight hazard area, except for regions of land, sea, or air under the
control of the vehicle operator, site operator, or other controlling
authority with which the operator has an agreement. If the operator
relies on another entity to publicize these warnings, it must:
(1) Determine whether the warnings have been issued; and
(2) Notify the FAA if the warnings have not been issued so that the
FAA can determine if the launch or reentry can be conducted in a manner
that sufficiently protects the public. This notification must provide
sufficient information to enable FAA to issue warnings to U.S.
aircraft.
(d) Application requirements. An applicant must submit--
(1) A description of how the applicant will provide for day-of-
flight surveillance and control of flight hazard areas, if necessary,
to ensure that the presence of any member of the public in or near a
flight hazard area is consistent with flight commit criteria developed
for each launch or reentry as required by Sec. 450.165(b);
(2) A description of how the applicant will provide for any
publication of flight hazard areas necessary to meet the requirements
of this section; and
(3) A description of how the applicant will establish flight commit
criteria based on the results of its toxic release hazard analysis,
toxic containment, or toxic risk assessment for any necessary
evacuation of the public from any toxic hazard area.
Sec. 450.163 Lightning hazard mitigation.
(a) Lightning hazard mitigation. An operator must--
(1) Establish flight commit criteria that mitigate the potential
for a launch or reentry vehicle intercepting or initiating a direct
lightning strike, or encountering a nearby discharge, using a means of
compliance accepted by the Administrator; or
(2) Use a vehicle designed to protect safety-critical systems in
the event of a direct lightning strike or nearby discharge.
(b) Application requirements. (1) An applicant electing to comply
with paragraph (a)(1) of this section must submit flight commit
criteria that mitigate the potential for a launch or reentry vehicle
intercepting or initiating a direct lightning strike, or encountering a
nearby lightning discharge.
(2) An applicant electing to comply with paragraph (a)(2) of this
section must submit documentation providing evidence that the vehicle
is designed to protect safety-critical systems against the effects of a
direct lightning strike or nearby discharge.
Sec. 450.165 Flight commit criteria.
(a) General. For each launch or reentry, an operator must establish
and observe flight commit criteria that identify each condition
necessary prior to flight to satisfy the requirements of Sec. 450.101,
and must include:
(1) Surveillance of any region of land, sea, or air in accordance
with Sec. 450.161;
(2) Monitoring of any meteorological condition necessary to--
(i) Be consistent with any safety analysis required by this part;
and
(ii) If necessary in accordance with Sec. 450.163, mitigate the
potential for a launch or reentry vehicle intercepting a lightning
strike, or encountering a nearby discharge;
[[Page 79734]]
(3) Implementation of any launch or reentry window closure in the
launch or reentry window for the purpose of collision avoidance in
accordance with Sec. 450.169;
(4) Confirmation that any safety-critical system is ready for
flight;
(5) Confirmation from the FAA that the risk to critical assets
satisfies the requirements of Sec. 450.101(a)(4) or (b)(4);
(6) For any reentry vehicle, except a suborbital vehicle,
monitoring by the operator or an onboard system that the status of
safety-critical systems is healthy before enabling reentry flight, to
assure the vehicle can reenter safely to Earth; and
(7) Any other hazard controls derived from any safety analysis
required by this part.
(b) Application requirements. An applicant must submit a list of
all flight commit criteria.
Sec. 450.167 Tracking.
(a) General. During the flight of a launch or reentry vehicle, an
operator must measure and record in real time the position and velocity
of the vehicle. The system used to track the vehicle must provide data
to predict the expected impact locations of all stages and components,
and to obtain vehicle performance data for comparison with the pre-
flight performance predictions.
(b) Application requirements. An applicant must identify and
describe each method or system used to meet the tracking requirements
of paragraph (a) of this section.
Sec. 450.169 Launch and reentry collision avoidance analysis
requirements.
(a) Criteria. Except as provided in paragraph (d) of this section,
for an orbital or suborbital launch or reentry, an operator must
establish window closures needed to ensure that the launch or reentry
vehicle, any jettisoned components, or payloads meet the following
requirements with respect to orbiting objects, not including any object
being launched or reentered.
(1) For inhabitable objects, one of three criteria below must be
met:
(i) The probability of collision between the launching or
reentering objects and any inhabitable object must not exceed 1 x
10-\6\;
(ii) The launching or reentering objects must maintain an
ellipsoidal separation distance of 200 km in-track and 50 km cross-
track and radially from the inhabitable object; or
(iii) The launching or reentering objects must maintain a spherical
separation distance of 200 km from the inhabitable object.
(2) For objects that are neither orbital debris nor inhabitable,
one of the two criteria below must be met:
(i) The probability of collision between the launching or
reentering objects and any object must not exceed 1 x
10-\5\; or
(ii) The launching or reentering objects must maintain a spherical
separation distance of 25 km from the object.
(3) For all other known orbital debris identified by the FAA or
other Federal Government entity as large objects with radar cross
section greater than 1 m\2\ and medium objects with radar cross section
0.1 m\2\ to 1 m\2\:
(i) The probability of collision between the launching or
reentering objects and any known orbital debris must not exceed 1 x
10-\5\; or
(ii) The launching or reentering objects must maintain a spherical
separation distance of 2.5 km.
(b) Screening time. A launch or reentry operator must ensure the
requirements of paragraph (a) of this section are met as follows:
(1) Through the entire segment of flight of a suborbital launch
vehicle above 150 km;
(2) For an orbital launch, during ascent from a minimum of 150 km
to initial orbital insertion and for a minimum of 3 hours from liftoff;
(3) For reentry, during descent from initial reentry burn to 150 km
altitude; and
(4) For disposal, during descent from initial disposal burn to 150
km altitude.
(c) Rendezvous. Planned rendezvous operations that occur within the
screening time frame are not considered a violation of collision
avoidance if the involved operators have pre-coordinated the rendezvous
or close approach.
(d) Exception. A launch collision avoidance analysis is not
required for any launched object if the maximum planned altitude by
that object is less than 150 km.
(e) Analysis. Collision avoidance analysis must be obtained for
each launch or reentry from a Federal entity identified by the FAA, or
another entity agreed to by the Administrator.
(1) An operator must use the results of the collision avoidance
analysis to establish flight commit criteria for collision avoidance;
and
(2) The collision avoidance analysis must account for uncertainties
associated with launch or reentry vehicle performance and timing, and
ensure that each window closure incorporates all additional time
periods associated with such uncertainties.
(f) Timing and information required. An operator must prepare a
collision avoidance analysis worksheet for each launch or reentry using
a standardized format that contains the input data required by appendix
A to this part, as follows:
(1) Except as specified in paragraphs (f)(1)(i) and (ii) of this
section, an operator must file the input data with an entity identified
in paragraph (e) of this section and the FAA at least 7 days before the
first attempt at the flight of a launch vehicle or the reentry of a
reentry vehicle.
(i) Operators that have never received a launch or reentry
conjunction assessment from the entity identified in paragraph (e) of
this section, must file the input data at least 15 days in advance.
(ii) The Administrator may agree to an alternative time frame in
accordance with Sec. 404.15;
(2) An operator must obtain a collision avoidance analysis
performed by an entity identified in paragraph (e) of this section, no
later than 3 hours before the beginning of a launch or reentry window;
and
(3) If an operator needs an updated collision avoidance analysis
due to a launch or reentry delay, the operator must file the request
with the entity identified in paragraph (e) of this section and the FAA
at least 12 hours prior to the beginning of the new launch or reentry
window.
Sec. 450.171 Safety at end of launch.
(a) Orbital debris mitigation. An operator must ensure for any
proposed launch that for all vehicle stages or components that reach
Earth orbit--
(1) There is no unplanned physical contact between the vehicle or
any of its components and the payload after payload separation;
(2) Debris generation does not result from the conversion of energy
sources into energy that fragments the vehicle or its components.
Energy sources include chemical, pressure, and kinetic energy; and
(3) For all vehicle stages or components that are left in orbit,
stored energy is removed by depleting residual fuel and leaving all
fuel line valves open, venting any pressurized system, leaving all
batteries in a permanent discharge state, and removing any remaining
source of stored energy.
(b) Application requirement. An applicant must demonstrate
compliance with the requirements in paragraph (a) of this section.
Sec. 450.173 Mishap plan--reporting, response, and investigation
requirements.
(a) General. An operator must report, respond to, and investigate
mishaps, as
[[Page 79735]]
defined in Sec. 401.7 of this chapter, in accordance with paragraphs
(b) through (g) of this section using a plan or other written means.
(b) Responsibilities. An operator must document--
(1) Responsibilities for personnel assigned to implement the
requirements of this section;
(2) Reporting responsibilities for personnel assigned to conduct
investigations and for anyone retained by the operator to conduct or
participate in investigations; and
(3) Allocation of roles and responsibilities between the launch
operator and any site operator for reporting, responding to, and
investigating any mishap during ground activities at the site.
(c) Mishap reporting requirements. An operator must--
(1) Immediately notify the FAA Washington Operations Center in case
of a mishap that involves a fatality or serious injury (as defined in
49 CFR 830.2);
(2) Notify within 24 hours the FAA Washington Operations Center in
the case of a mishap that does not involve a fatality or serious injury
(as defined in 49 CFR 830.2); and
(3) Submit a written preliminary report to the FAA Office of
Commercial Space Transportation within five days of any mishap. The
preliminary report must include the following information, as
applicable:
(i) Date and time of the mishap;
(ii) Description of the mishap and sequence of events leading to
the mishap, to the extent known;
(iii) Intended and actual location of the launch or reentry or
other landing on Earth;
(iv) Hazardous debris impact points, including those outside a
planned landing site or designated hazard area;
(v) Identification of the vehicle;
(vi) Identification of any payload;
(vii) Number and general description of any fatalities or injuries;
(viii) Description and estimated costs of any property damage;
(ix) Identification of hazardous materials, as defined in Sec.
401.7 of this chapter, involved in the event, whether on the vehicle,
any payload, or on the ground;
(x) Action taken by any person to contain the consequences of the
event;
(xi) Weather conditions at the time of the event; and
(xii) Potential consequences for other similar vehicles, systems,
or operations.
(d) Emergency response requirements. An operator must--
(1) Activate emergency response services to protect the public and
property following a mishap as necessary including, but not limited to:
(i) Evacuating and rescuing members of the public, taking into
account debris dispersion and toxic plumes; and
(ii) Extinguishing fires;
(2) Maintain existing hazard area surveillance and clearance as
necessary to protect public safety;
(3) Contain and minimize the consequences of a mishap, including:
(i) Securing impact areas to ensure that no members of the public
enter;
(ii) Safely disposing of hazardous materials; and
(iii) Controlling hazards at the site or impact areas.
(4) Preserve data and physical evidence; and
(5) Implement agreements with government authorities and emergency
response services, as necessary, to satisfy the requirements of this
section.
(e) Mishap investigation requirements. In the event of a mishap, an
operator must--
(1) Investigate the root causes of the mishap; and
(2) Report investigation results to the FAA.
(f) Preventative measures. An operator must identify and implement
preventive measures for avoiding recurrence of the mishap prior to the
next flight, unless otherwise approved by the Administrator.
(g) Mishap records. An operator must maintain records associated
with the mishap in accordance with Sec. 450.219(b).
(h) Application requirements. An applicant must submit the plan or
other written means required by this section.
Sec. 450.175 Test-induced damage.
(a) Applicability. This section applies to license applicants or
operators seeking an optional test-induced damage exception.
(b) Coordination of potential test-induced damage. Test-induced
damage is not a mishap if all of the following are true:
(1) A license applicant or operator coordinates potential test-
induced damage with the FAA before the planned activity, and with
sufficient time for the FAA to evaluate the operator's proposal during
the application process or as a license modification;
(2) The test-induced damage did not result in any of the following:
(i) Serious injury or fatality (as defined in 49 CFR 830.2);
(ii) Damage to property not associated with the licensed activity;
or
(iii) Hazardous debris leaving the pre-defined hazard area; and
(3) The test-induced damage falls within the scope of activities
coordinated with the FAA in paragraph (b)(1) of this section.
(c) Application requirements. An applicant must submit the
following information--
(1) Test objectives;
(2) Test limits;
(3) Expected outcomes;
(4) Potential risks, including the applicant's best understanding
of the uncertainties in environments, test limits, or system
performance;
(5) Applicable procedures;
(6) Expected time and duration of the test; and
(7) Additional information as required by the FAA to ensure
protection of public health and safety, safety of property, and the
national security and foreign policy interests of the United States.
Sec. 450.177 Unique safety policies, requirements, and practices.
(a) Unique hazards. An operator must review operations, system
designs, analysis, and testing, and identify any unique hazards not
otherwise addressed by this part. An operator must implement any unique
safety policy, requirement, or practice needed to protect the public
from the unique hazard.
(b) Unique requirements. The FAA may identify and impose a unique
policy, requirement, or practice as needed to protect the public health
and safety.
(c) Application requirements. An applicant must--
(1) Identify any unique safety policy, requirement, or practice
necessary in accordance with paragraph (a) of this section, and
demonstrate that each unique safety policy, requirement, or practice
protects public health and safety.
(2) Demonstrate compliance with each unique safety policy,
requirement, or practice imposed by the FAA in accordance with
paragraph (b) of this section.
Ground Safety
Sec. 450.179 Ground safety--general.
(a) At a U.S. launch or reentry site, an operator must protect the
public and property from adverse effects of hazardous operations and
systems associated with--
(1) Preparing a launch vehicle for flight;
(2) Returning a launch or reentry vehicle to a safe condition after
landing, or after an aborted launch attempt; and
(3) Returning a site to a safe condition.
(b) An operator is not required to comply with Sec. Sec. 450.181
through 450.189 of this part if:
[[Page 79736]]
(1) The launch or reentry is being conducted from a Federal launch
or reentry site;
(2) The operator has a written agreement with the Federal launch or
reentry site for the provision of ground safety services and oversight;
and
(3) The Administrator has determined that the Federal launch or
reentry site's ground safety processes, requirements, and oversight are
not inconsistent with the Secretary's statutory authority over
commercial space activities.
(c) In making the determination required by paragraph (b)(3) of
this section, the Administrator will consider the nature and frequency
of launch and reentry activities conducted from the Federal launch or
reentry site, coordination between the FAA and the Federal launch or
reentry site safety personnel, and the Administrator's knowledge of the
Federal launch or reentry site's requirements.
Sec. 450.181 Coordination with a site operator.
(a) General. For a launch or reentry conducted from or to a Federal
launch or reentry site or a site licensed under part 420 or 433 of this
chapter, an operator must coordinate with the site operator to--
(1) Ensure public access is controlled where and when necessary to
protect public safety;
(2) Ensure launch or reentry operations are coordinated with other
launch and reentry operators and other affected parties to prevent
unsafe interference;
(3) Designate any ground hazard area that affects the operations of
a launch or reentry site; and
(4) Ensure a prompt and effective response is undertaken in the
event of a mishap that could impact the safety of the public and
property.
(b) Licensed site operator. For a launch or reentry conducted from
or to a site licensed under part 420 or 433 of this chapter, an
operator must also coordinate with the site operator to establish roles
and responsibilities for reporting, responding to, and investigating
any mishap during ground activities at the site.
(c) Application requirement. An applicant must describe how it is
coordinating with a Federal or licensed launch or reentry site operator
in compliance with this section.
Sec. 450.183 Explosive site plan.
(a) Explosive siting requirements. For a launch or reentry
conducted from or to a site exclusive to its own use, an operator must
comply with the explosive siting requirements of Sec. Sec. 420.63,
420.65, 420.66, 420.67, 420.69, and 420.70 of this chapter.
(b) Application requirement. An applicant must submit an explosive
site plan in accordance with paragraph (a) of this section.
Sec. 450.185 Ground hazard analysis.
An operator must perform and document a ground hazard analysis, and
continue to maintain it throughout the lifecycle of the launch or
reentry system. The analysis must--
(a) Hazard identification. Identify system and operation hazards
posed by the vehicle and ground hardware, including site and ground
support equipment. Hazards identified must include the following:
(1) System hazards, including:
(i) Vehicle over-pressurization;
(ii) Sudden energy release, including ordnance actuation;
(iii) Ionizing and non-ionizing radiation;
(iv) Fire or deflagration;
(v) Radioactive materials;
(vi) Toxic release;
(vii) Cryogens;
(viii) Electrical discharge; and
(ix) Structural failure.
(2) Operation hazards, including:
(i) Propellant handling and loading;
(ii) Transporting of vehicle or vehicle components;
(iii) Vehicle testing; and
(iv) Vehicle or system activation.
(b) Hazard assessment. Assess each hazard's likelihood and
severity.
(c) Risk acceptability criteria. Ensure that the risk associated
with each hazard meets the following criteria:
(1) The likelihood of any hazardous condition that may cause death
or serious injury to the public must be extremely remote; and
(2) The likelihood of any hazardous condition that may cause major
damage to property not associated with the launch or reentry must be
remote.
(d) Risk mitigation. Identify and describe the risk elimination and
mitigation measures required to satisfy paragraph (c) of this section.
(e) Validation and verification. Document that the risk elimination
and mitigation measures achieve the risk levels of paragraph (c) of
this section through validation and verification. Verification
includes:
(1) Analysis;
(2) Test;
(3) Demonstration; or
(4) Inspection.
(f) Application requirements. An applicant must submit--
(1) A description of the methodology used to perform the ground
hazard analysis;
(2) A list of all systems and operations that may cause a hazard
involving the vehicle or any payload; and
(3) The ground hazard analysis products of paragraphs (a) through
(e) of this section, including data that verifies the risk elimination
and mitigation measures.
Sec. 450.187 Toxic hazards mitigation for ground operations.
(a) Applicability. (1) Except as specified in paragraph (a)(2),
this section applies to any launch or reentry vehicle, including all
vehicle components and payloads, that use toxic propellants or other
toxic chemicals.
(2) No toxic release hazard analysis is required for kerosene-based
fuels, unless the Administrator determines that an analysis is required
to protect public safety.
(b) General. An operator must--
(1) Conduct a toxic release hazard analysis in accordance with
paragraph (c) of this section;
(2) Manage the risk of casualties that could arise from the
exposure to toxic release through one of the following means:
(i) Contain hazards caused by toxic release in accordance with
paragraph (d) of this section; or
(ii) Perform a toxic risk assessment, in accordance with paragraph
(e) of this section, that demonstrates compliance with the risk
criteria of Sec. 450.185(c).
(3) Establish ground hazard controls based on the results of its
toxic release hazard analysis and toxic containment or toxic risk
assessment for any necessary evacuation of the public from any toxic
hazard area.
(c) Toxic release hazard analysis. A toxic release hazard analysis
must--
(1) Account for any toxic release that could occur during nominal
or non-nominal launch or reentry ground operations;
(2) Include a worst-case release scenario analysis or a maximum-
credible release scenario analysis for each process that involves a
toxic propellant or other chemical;
(3) Determine if toxic release can occur based on an evaluation of
the chemical compositions and quantities of propellants, other
chemicals, vehicle materials, and projected combustion products, and
the possible toxic release scenarios;
(4) Account for both normal combustion products and any unreacted
propellants and phase change or chemical derivatives of released
substances; and
(5) Account for any operational constraints and emergency
procedures
[[Page 79737]]
that provide protection from toxic release.
(d) Toxic containment. An operator using toxic containment must
manage the risk of casualty from the exposure to toxic release either
by--
(1) Evacuating, or being prepared to evacuate, the public from any
toxic hazard area in the event of a worst-case release or maximum
credible release scenario; or
(2) Employing meteorological constraints to limit a ground
operation to times during which prevailing winds and other conditions
ensure that the public would not be exposed to toxic concentrations and
durations greater than accepted toxic thresholds for acute casualty in
the event of a worst-case release or maximum credible release scenario.
(e) Toxic risk assessment. An operator using toxic risk assessment
must manage the risk from any toxic release hazard and demonstrate
compliance with the criteria in Sec. 450.185(c). A toxic risk
assessment must--
(1) Account for airborne concentration and duration thresholds of
toxic propellants or other chemicals. For any toxic propellant, other
chemicals, or combustion product, an operator must use airborne toxic
concentration and duration thresholds identified in a means of
compliance accepted by the Administrator;
(2) Account for physical phenomena expected to influence any toxic
concentration and duration in the area surrounding the potential
release site;
(3) Determine a toxic hazard area for each process surrounding the
potential release site for each toxic propellant or other chemical
based on the amount and toxicity of the propellant or other chemical,
the exposure duration, and the meteorological conditions involved;
(4) Account for all members of the public that may be exposed to
the toxic release; and
(5) Account for any risk mitigation measures applied in the risk
assessment.
(f) Application requirements. An applicant must submit:
(1) The identity of the toxic propellant, chemical, or combustion
products or derivatives in the possible toxic release;
(2) The applicant's selected airborne toxic concentration and
duration thresholds;
(3) The meteorological conditions for the atmospheric transport and
buoyant cloud rise of any toxic release from its source to downwind
receptor locations;
(4) Characterization of the terrain, as input for modeling the
atmospheric transport of a toxic release from its source to downwind
receptor locations;
(5) The identity of the toxic dispersion model used, and any other
input data;
(6) Representative results of an applicant's toxic dispersion
modeling to predict concentrations and durations at selected downwind
receptor locations, to determine the toxic hazard area for a released
quantity of the toxic substance;
(7) For toxic release hazard analysis in accordance with paragraph
(c) of this section:
(i) A description of the failure modes and associated relative
probabilities for potential toxic release scenarios used in the risk
evaluation; and
(ii) The methodology and representative results of an applicant's
determination of the worst-case or maximum-credible quantity of any
toxic release that might occur during ground operations;
(8) For toxic containment in accordance with paragraph (d) of this
section, identify the evacuation plans or meteorological constraints
and associated ground hazard controls needed to ensure that the public
will not be within any toxic hazard area in the event of a worst-case
release or maximum credible release scenario.
(9) For toxic risk assessment in accordance with paragraph (e) of
this section:
(i) A demonstration that the risk criteria in Sec. 450.185(c) will
be met;
(ii) The population characteristics in receptor locations that are
identified by toxic dispersion modeling as toxic hazard areas;
(iii) A description of any risk mitigation measures applied in the
toxic risk assessment; and
(iv) A description of the population exposure input data used in
accordance with Sec. 450.123.
Sec. 450.189 Ground safety prescribed hazard controls.
(a) General. In addition to the hazard controls derived from an
operator's ground hazard analysis and toxic hazard analysis, an
operator must comply with paragraphs (b) through (e) of this section.
(b) Protection of public on the site. An operator must document a
process for protecting members of the public who enter any area under
the control of a launch or reentry operator, including:
(1) Procedures for identifying and tracking the public while on the
site; and
(2) Methods the operator uses to protect the public from hazards in
accordance with the ground hazard analysis and toxic hazard analysis.
(c) Countdown abort. Following a countdown abort or recycle
operation, an operator must establish, maintain, and perform procedures
for controlling hazards related to the vehicle and returning the
vehicle, stages, or other flight hardware and site facilities to a safe
condition. When a launch vehicle does not liftoff after a command to
initiate flight was sent, an operator must--
(1) Ensure that the vehicle and any payload are in a safe
configuration;
(2) Prohibit entry of the public into any identified hazard areas
until the site is returned to a safe condition; and
(3) Maintain and verify that any flight safety system remains
operational until verification that the launch vehicle does not
represent a risk of inadvertent flight.
(d) Fire suppression. An operator must have reasonable precautions
in place to report and control any fire caused by licensed activities.
(e) Emergency procedures. An operator must have general emergency
procedures that apply to any emergencies not covered by the mishap plan
of Sec. 450.173 that may create a hazard to the public.
(f) Application requirement. An applicant must submit the process
for protecting members of the public who enter any area under the
control of a launch or reentry operator in accordance with paragraph
(b) of this section.
Subpart D--Terms and Conditions of a Vehicle Operator License
Sec. 450.201 Responsibility for public safety and safety of property.
A licensee is responsible for ensuring public safety and safety of
property during the conduct of a licensed launch or reentry.
Sec. 450.203 Compliance.
A licensee must conduct a licensed launch or reentry in accordance
with representations made in its license application, the requirements
of subparts C and D of this part, and the terms and conditions
contained in the license. A licensee's failure to act in accordance
with the representations made in the license application, the
requirements of subparts C and D of this part, and the terms and
conditions contained in the license, is sufficient basis for the
revocation of a license or other appropriate enforcement action.
Sec. 450.205 Financial responsibility requirements.
A licensee must comply with financial responsibility requirements
of part 440 of this chapter and as specified in a license or license
order.
[[Page 79738]]
Sec. 450.207 Human spaceflight requirements.
A licensee conducting a launch or reentry with a human being on
board the vehicle must comply with human spaceflight requirements of
part 460 of this chapter as specified in a license or license order.
Sec. 450.209 Compliance monitoring.
(a) A licensee must allow access by, and cooperate with, Federal
officers or employees or other individuals authorized by the FAA to
observe any of its activities, or any of its contractors' or
subcontractors' activities, associated with the conduct of a licensed
launch or reentry.
(b) For each licensed launch or reentry, a licensee must provide
the FAA with a console for monitoring the progress of the countdown and
communication on all channels of the countdown communications network,
unless the licensee has another acceptable means. A licensee must also
provide the FAA with the capability to communicate with the mission
director designated by Sec. 450.103(a)(1).
Sec. 450.211 Continuing accuracy of license application; application
for modification of license.
(a) A licensee is responsible for the continuing accuracy of
representations contained in its application for the entire term of the
license.
(b) After a license has been issued, a licensee must apply to the
FAA for modification of the license if--
(1) The licensee proposes to conduct a launch or reentry in a
manner not authorized by the license; or
(2) Any representation contained in the license application that is
material to public health and safety or the safety of property is no
longer accurate and complete or does not reflect the licensee's
procedures governing the actual conduct of a launch or reentry. A
change is material to public health and safety or the safety of
property if it alters or affects--
(i) The class of payload;
(ii) The type of launch or reentry vehicle;
(iii) The type or quantity of hazardous material;
(iv) The flight trajectory;
(v) The launch site or reentry site or other landing site; or
(vi) Any system, policy, procedure, requirement, criteria, or
standard that is safety critical.
(c) An application to modify a license must be prepared and
submitted in accordance with part 413 of this chapter. If requested
during the application process, the FAA may approve an alternate method
for requesting license modifications. The licensee must indicate any
part of its license or license application that would be changed or
affected by a proposed modification.
(d) Upon approval of a modification, the FAA issues either a
written approval to the licensee or a license order amending the
license if a stated term or condition of the license is changed, added,
or deleted. An approval has the full force and effect of a license
order and is part of the licensing record.
Sec. 450.213 Pre-flight reporting.
(a) Reporting method. A licensee must send the information in this
section as an email attachment to [email protected], or other
method as agreed to by the Administrator in the license.
(b) Mission information. A licensee must submit to the FAA the
following mission-specific information no less than 60 days before each
mission conducted under the license, unless the Administrator agrees to
a different time frame in accordance with Sec. 404.15 in the license,
except when the information was provided in the license application:
(1) Payload information in accordance with Sec. 450.43(i); and
(2) Planned mission information, including the vehicle, launch
site, planned flight path, staging and impact locations, each payload
delivery point, intended reentry or landing sites including any
contingency abort location, and the location of any disposed launch or
reentry vehicle stage or component that is deorbited.
(c) Flight abort and flight safety analysis products. A licensee
must submit to the FAA updated flight abort and flight safety analysis
products, using methodologies previously approved by the FAA, for each
mission no less than 30 days before flight, unless the Administrator
agrees to a different time frame in accordance with Sec. 404.15 in the
license.
(1) A licensee is not required to submit the flight abort and
flight safety analysis products if--
(i) The analysis submitted in the license application satisfies all
the requirements of this section; or
(ii) The licensee demonstrated during the application process that
the analysis does not need to be updated to account for mission-
specific factors.
(2) If a licensee is required to submit the flight abort and flight
safety analysis products, the licensee--
(i) Must account for vehicle- and mission-specific input data;
(ii) Must account for potential variations in input data that may
affect any analysis product within the final 30 days before flight;
(iii) Must submit the analysis products using the same format and
organization used in its license application; and
(iv) May not change an analysis product within the final 30 days
before flight unless the licensee has a process, approved in the
license, for making a change in that period as part of the licensee's
flight safety analysis process.
(d) Flight safety system test data. Any licensee that is required
by Sec. 450.101(c) to use a flight safety system to protect public
safety must submit to the FAA, or provide the FAA access to, any test
reports, in accordance with approved flight safety system test plans,
no less than 30 days before flight, unless the Administrator agrees to
a different time frame in accordance with Sec. 404.15 in the license.
These reports must include:
(1) A summary of the system, subsystem, and component-level test
results, including all test failures and corrective actions
implemented;
(2) A summary of test results demonstrating sufficient margin to
predicted operating environments;
(3) A comparison matrix of the actual qualification and acceptance
test levels used for each component in each test compared against the
predicted flight levels for each environment, including any test
tolerances allowed for each test; and
(4) A clear identification of any components qualified by
similarity analysis or a combination of analysis and test.
(e) Collision avoidance analysis. A licensee must submit to a
Federal entity identified by the FAA and to the FAA the collision
avoidance information in appendix A to part 450 in accordance with
Sec. 450.169(f).
(f) Launch or reentry schedule. A licensee must file a launch or
reentry schedule that identifies each review, rehearsal, and safety-
critical operation. The schedule must be filed and updated in time to
allow FAA personnel to participate in the reviews, rehearsals, and
safety-critical operations.
Sec. 450.215 Post-flight reporting.
(a) A licensee must submit to the FAA the information in paragraph
(b) of this section no later than 90 days after a launch or reentry,
unless the Administrator agrees to a different time frame in accordance
with Sec. 404.15 of this chapter.
(b) A licensee must send the following information as an email
attachment to [email protected], or other method as agreed to by
the Administrator in the license:
[[Page 79739]]
(1) Any anomaly that occurred during countdown or flight that is
material to public health and safety and the safety of property;
(2) Any corrective action implemented or to be implemented after
the flight due to an anomaly or mishap;
(3) The number of humans on board the vehicle;
(4) The actual trajectory flown by the vehicle, if requested by the
FAA; and
(5) For an unguided suborbital launch vehicle, the actual impact
location of all impacting stages and impacting components, if requested
by the FAA.
Sec. 450.217 Registration of space objects.
(a) To assist the U.S. Government in implementing Article IV of the
1975 Convention on Registration of Objects Launched into Outer Space,
each licensee must submit to the FAA the information required by
paragraph (b) of this section for all objects placed in space by a
licensed launch, including a launch vehicle and any components, except
any object owned and registered by the U.S. Government.
(b) For each object that must be registered in accordance with this
section, no later than 30 days following the conduct of a licensed
launch, a licensee must file the following information:
(1) The international designator of the space object;
(2) Date and location of launch;
(3) General function of the space object;
(4) Final orbital parameters, including:
(i) Nodal period;
(ii) Inclination;
(iii) Apogee;
(iv) Perigee; and
(5) Ownership, and country of ownership, of the space object.
(c) A licensee must notify the FAA when it removes an object that
it has previously placed in space.
Sec. 450.219 Records.
(a) Except as specified in paragraph (b) of this section, a
licensee must maintain for 3 years all records, data, and other
material necessary to verify that a launch or reentry is conducted in
accordance with representations contained in the licensee's
application, the requirements of subparts C and D of this part, and the
terms and conditions contained in the license.
(b) For an event that meets any of paragraph (1) through (5) or
paragraph (8) of the definition of ``mishap'' in Sec. 401.7 of this
chapter, a licensee must preserve all records related to the event.
Records must be retained until completion of any Federal investigation
and the FAA advises the licensee that the records need not be retained.
The licensee must make all records required to be maintained under the
regulations available to Federal officials for inspection and copying.
Appendix A to Part 450--Collision Analysis Worksheet
(a) Launch or reentry information. An operator must file the
following information:
(1) Mission name. A mnemonic given to the launch vehicle/payload
combination identifying the launch mission distinctly from all
others;
(2) Launch location. Launch site location in latitude and
longitude;
(3) Launch or reentry window. The launch or reentry window
opening and closing times in Greenwich Mean Time (referred to as
ZULU time) and the Julian dates for each scheduled launch or reentry
attempts including primary and secondary launch or reentry dates;
(4) Epoch. The epoch time, in Greenwich Mean Time (GMT), of the
expected launch vehicle liftoff time;
(5) Segment number. A segment is defined as a launch vehicle
stage or payload after the thrusting portion of its flight has
ended. This includes the jettison or deployment of any stage or
payload. For each segment, an operator must determine the orbital
parameters;
(6) Orbital parameters. An operator must identify the orbital
parameters for all objects achieving orbit including the parameters
for each segment after thrust ends;
(7) Orbiting objects to evaluate. An operator must identify all
orbiting object descriptions including object name, length, width,
depth, diameter, and mass;
(8) Time of powered flight and sequence of events. The elapsed
time in hours, minutes, and seconds, from liftoff to passivation or
disposal. The input data must include the time of powered flight for
each stage or jettisoned component measured from liftoff; and
(9) Point of contact. The person or office within an operator's
organization that collects, analyzes, and distributes collision
avoidance analysis results.
(b) Collision avoidance analysis results transmission medium. An
operator must identify the transmission medium, such as voice or
email, for receiving results.
(c) Deliverable schedule/need dates. An operator must identify
the times before flight, referred to as ``L-times,'' for which the
operator requests a collision avoidance analysis. The final
collision avoidance analysis must be used to establish flight commit
criteria for a launch.
(d) Trajectory files. Individual position and velocity
trajectory files, including:
(1) The position coordinates in the Earth-Fixed Greenwich (EFG)
coordinates system measured in kilometers and the EFG velocity
components measured in kilometers per second, of each launch vehicle
stage or payload starting below 150 km through screening time frame;
(2) Radar cross section values for each individual file;
(3) Position Covariance, if probability of impact analysis
option is desired; and
(4) Separate trajectory files identified by valid window time
frames, if launch or reentry trajectory changes during launch or
reentry window.
(e) Screening. An operator must select spherical, ellipsoidal,
or collision probability screening as defined in this paragraph for
determining any conjunction:
(1) Spherical screening. Spherical screening centers a sphere on
each orbiting object's center-of-mass to determine any conjunction;
(2) Ellipsoidal screening. Ellipsoidal screening utilizes an
impact exclusion ellipsoid of revolution centered on the orbiting
object's center-of-mass to determine any conjunction. An operator
must provide input in the UVW coordinate system in kilometers. The
operator must provide delta-U measured in the radial-track
direction, delta-V measured in the in-track direction, and delta-W
measured in the cross-track direction; or
(3) Probability of Collision. Collision probability is
calculated using position and velocity information with covariance
in position.
PART 460--HUMAN SPACE FLIGHT REQUIREMENTS
0
71. The authority citation for part 460 continues to read as follows:
Authority: 51 U.S.C. 50901-50923.
0
72. Amend Sec. 460.45 by revising paragraph (d) to read as follows:
Sec. 460.45 Operator informing space flight participant of risk.
* * * * *
(d) An operator must describe the safety record of its vehicle to
each space flight participant as follows:
(1) For licenses issued under part 450 of this chapter, the
operator's safety record must cover any event that meets any of
paragraph (1), (4), (5), or (8) of the definition of ``mishap'' in
Sec. 401.7 that occurred during and after vehicle verification
performed in accordance with Sec. 460.17, and include:
(i) The number of vehicle flights;
(ii) The number of events that meet any of paragraph (1), (4), (5),
or (8) of the definition of ``mishap'' in Sec. 401.7 of this chapter;
and
(iii) Whether any corrective actions were taken to resolve these
mishaps.
(2) For licenses issued under part 415, 431, or 435 of this
chapter, the operator's safety record must cover launch and reentry
accidents and human space flight incidents as defined by Sec. 401.5,
that occurred during and after vehicle verification performed in
accordance with Sec. 460.17, and include:
(i) The number of vehicle flights;
(ii) The number of accidents and human space flight incidents as
defined by Sec. 401.5; and
[[Page 79740]]
(iii) Whether any corrective actions were taken to resolve these
accidents and human spaceflight incidents.
* * * * *
0
73. Effective March 10, 2026, further amend Sec. 460.45 by revising
paragraph (d) to read as follows:
Sec. 460.45 Operator informing space flight participant of risk.
* * * * *
(d) An operator must describe the safety record of its vehicle to
each space flight participant. The operator's safety record must cover
any event that meets any of paragraph (1), (4), (5), or (8) of the
definition of ``mishap'' in Sec. 401.7 that occurred during and after
vehicle verification performed in accordance with Sec. 460.17, and
include:
(1) The number of vehicle flights;
(2) The number of events that meet any of paragraph (1), (4), (5),
or (8) of the definition of ``mishap'' in section Sec. 401.7; and
(3) Whether any corrective actions were taken to resolve these
mishaps.
* * * * *
Issued under authority provided by 49 U.S.C. 106(f) and 51
U.S.C. Chapter 509 in Washington, DC, on September 30, 2020.
Steve Dickson,
Administrator.
[FR Doc. 2020-22042 Filed 12-2-20; 4:15 pm]
BILLING CODE 4910-13-P
