15296 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

DEPARTMENT OF TRANSPORTATION Docket: Background documents or FSS—Flight safety system comments received may be read at PC—Probability of casualty Federal Aviation Administration http://www.regulations.gov at any time. PI—Probability of impact Follow the online instructions for RLV—Reusable launch vehicle 14 CFR Parts 401, 404, 413, 414, 415, accessing the docket or go to the Docket Table of Contents 417, 420, 431, 433, 435, 437, 440, and Operations in Room W12–140 of the 450 I. Overview of Proposed Rule West Building Ground Floor at 1200 II. Background [Docket No.: FAA–2019–0229; Notice No. New Jersey Avenue SE, Washington, A. History 19–01] DC, between 9 a.m. and 5 p.m., Monday B. Licensing Process through Friday, except Federal holidays. C. National Space Council RIN 2120–AL17 FOR FURTHER INFORMATION CONTACT: For D. Streamlined Launch and Reentry Licensing Requirements Aviation Streamlined Launch and Reentry questions concerning this action, contact Randy Repcheck, Office of Rulemaking Committee Licensing Requirements III. Discussion of the Proposal Commercial Space Transportation, A. The FAA’s Approach To Updating and AGENCY: Federal Aviation Federal Aviation Administration, 800 Streamlining Launch and Reentry Administration (FAA), Department of Independence Avenue SW, Washington, Regulations Transportation (DOT). DC 205914; telephone (202) 267–8760; B. Single Vehicle Operator License ACTION: Notice of proposed rulemaking email [email protected]. C. Performance-Based Requirements and (NPRM). SUPPLEMENTARY INFORMATION: Means of Compliance D. Launch From a Federal Launch Range SUMMARY: This rulemaking would Authority for This Rulemaking E. Safety Framework streamline and increase flexibility in the Flight Safety The Commercial Space Launch Act of A. Public Safety Criteria FAA’s commercial space launch and 1984, as amended and codified at 51 1. Neighboring Operations Personnel reentry regulations, and remove obsolete U.S.C. 50901–50923 (the Act), 2. Property Protection (Critical Assets) requirements. This action would authorizes the Department of 3. Consequence Protection Criteria for consolidate and revise multiple Transportation, and the FAA through Flight Abort and Flight Safety System regulatory parts and apply a single set delegation, to oversee, license, and B. System Safety Program of licensing and safety regulations regulate commercial launch and reentry 1. Safety Organization across several types of operations and activities, and the operation of launch 2. Procedures vehicles. The proposed rule would 3. Configuration Management and Control and reentry sites as carried out by U.S. 4. Post-Flight Data Review describe the requirements to obtain a citizens or within the United States. C. Preliminary Safety Assessment for Flight vehicle operator license, the safety Section 50905 directs the FAA to D. Hazard Control Strategy requirements, and the terms and exercise this responsibility consistent E. Flight Abort conditions of a vehicle operator license. with public health and safety, safety of 1. Flight Safety Limits and Uncontrolled DATES: Send comments on or before property, and the national security and Areas June 14, 2019. foreign policy interests of the United 2. Flight Abort Rules 3. Flight Safety System ADDRESSES: Send comments identified States. In addition, section 50903 requires the FAA encourage, facilitate, F. Flight Hazard Analysis by docket number FAA–2019–0229 G. Computing Systems and Software using any of the following methods: and promote commercial space Overview Federal eRulemaking Portal: Go to launches and reentries by the private H. Hybrid Launch Vehicles http://www.regulations.gov and follow sector. I. Flight Safety Analysis Overview the online instructions for sending your If adopted as proposed, this J. Safety-Critical Systems comments electronically. rulemaking would consolidate and 1. Safety-Critical Systems Design, Test, and Mail: Send comments to Docket revise multiple regulatory parts to apply Documentation Operations, M–30; U.S. Department of a single set of licensing and safety 2. Flight Safety System K. Other Prescribed Hazard Controls Transportation (DOT), 1200 New Jersey regulations across several types of operations and vehicles. It would also 1. Agreements Avenue SE, Room W12–140, West 2. Safety-Critical Personnel Qualifications Building Ground Floor, Washington, DC streamline the commercial space 3. Work Shift and Rest Requirements 20590–0001. regulations by, among other things, 4. Radio Frequency Management Hand Delivery or Courier: Take replacing many prescriptive regulations 5. Readiness: Reviews and Rehearsals comments to Docket Operations in with performance-based rules, giving 6. Communications Room W12–140 of the West Building industry greater flexibility to develop 7. Preflight Procedures Ground Floor at 1200 New Jersey means of compliance that maximize 8. Surveillance and Publication of Hazard Avenue SE, Washington, DC, between 9 their business objectives while Areas 9. Lightning Hazard Mitigation a.m. and 5 p.m., Monday through maintaining public safety. Because this rulemaking would amend the FAA’s 10. Flight Safety Rules Friday, except Federal holidays. 11. Tracking Fax: Fax comments to Docket launch and reentry requirements, it falls 12. Launch and Reentry Collision Operations at 202–493–2251. under the authority delegated by the Avoidance Analysis Requirements Privacy: In accordance with 5 U.S.C. Act. 13. Safety at End of Launch 553(c), DOT solicits comments from the List of Abbreviations and Acronyms 14. Mishaps: Definition, Plan, Reporting, public to better inform its rulemaking Frequently Used in This Document Response, Investigation, Test-Induced process. DOT posts these comments, Damage without edit, including any personal AC—Advisory Circular L. Pre- and Post-Flight Reporting 1. Preflight Reporting information the commenter provides, to CEC—Conditional expected casualty EC—Expected casualty 2. Post-Flight Reporting www.regulations.gov, as described in ELOS determination—Equivalent-level-of- Ground Safety the system of records notice (DOT/ALL– safety determination A. Definition and Scope of Launch 14 FDMS), which can be reviewed at ELV—Expendable launch vehicle B. Ground Safety Requirements www.dot.gov/privacy. FSA—Flight safety analysis Process Improvements

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15297

A. Safety Element Approval A. Comments Invited process. That being said, the FAA has B. Incremental Review of a License B. Availability of Rulemaking Documents used the more detailed part 417 Application The Proposed Amendment requirements to inform parts 431 and C. Time Frames 435. While these separate regulatory D. Continuing Accuracy of License I. Overview of Proposed Rule parts and requirements satisfied the Application and Modification of License The FAA commercial space need of the commercial space Other Changes transportation regulations protect public A. Pre-Application Consultation transportation industry at the time they health and safety and the safety of 2 B. Policy Review and Approval property from the hazards of launch and were issued, the industry has changed C. Payload Review and Determination reentry. In addition, the regulations and continues to evolve. D. Safety Review and Approval The FAA proposes to consolidate, E. Environmental Review address national security and foreign policy interests of the United States, update, and streamline all launch and F. Additional License Terms and reentry regulations into a single Conditions, Transfer of a Vehicle financial responsibility, environmental Operator License, Rights Not Conferred impacts, informed consent for crew and performance-based part to better fit by a Vehicle Operator License space flight participants, and, to a today’s fast-evolving commercial space G. Unique Safety Policies, Requirements, limited extent, authorization of transportation industry. Proposed part and Practices payloads not otherwise regulated or 450 would include regulations H. Compliance Monitoring owned by the U.S. Government. The applicable to all launch and reentry I. Registration of Space Objects vehicles, whether they have reusable J. Public Safety Responsibility, Compliance FAA is proposing this deregulatory action consistent with President Donald components or not. The FAA looked to With License, Records, Financial balance the regulatory certainty but Responsibility, and Human Spaceflight J. Trump’s Space Policy Directive—2 Requirements (SPD–2) ‘‘Streamlining Regulations on rigidity of current ELV regulations with K. Applicability Commercial Use of Space.’’ 1 The the flexibility but vagueness of current L. Equivalent Level of Safety directive charged the Department of RLV regulations. As a result, these Additional Technical Justification and Transportation with revising regulations proposed regulations are flexible and Rationale to require a single license for all types scalable to accommodate innovative A. Flight Safety Analyses of commercial space flight operations safety approaches while also protecting 1. Scope and Applicability and replace prescriptive requirements public health and safety, safety of 2. Flight Safety Analysis Methods with performance-based criteria. property, and the national security and 3. Trajectory Analysis for Normal Flight foreign policy interests of the United 4. Trajectory Analysis for Malfunction Streamlining these regulations would Flight lower administrative burden and States. 5. Debris Analysis regulatory compliance costs and bolster The FAA proposes to continue 6. Flight Safety Limits Analysis the U.S. space commercial sector and reviewing licenses in five component 7. Gate Analysis industrial base. parts: Policy review, payload review, 8. Data Loss Flight Time and Planned Safe Additionally, this proposed rule safety review, maximum probable loss Flight State Analyses incorporates industry input and determination, and environmental 9. Time Delay Analysis recommendations provided primarily by review. However, after consulting with 10. Probability of Failure the Streamlined Launch and Reentry the FAA, applicants would have the 11. Flight Hazard Areas option of submitting portions of 12. Debris Risk Analysis Licensing Requirements Aviation 13. Far-Field Overpressure Blast Effects Rulemaking Committee (ARC). The applications for incremental review and 14. Toxic Hazards for Flight subject proposed rule would implement approval by the FAA. In terms of the 15. Wind Weighting for the Flight of an the applicable section of SPD–2 and applications themselves, the FAA has Unguided Suborbital Launch Vehicle address industry. The recommendation streamlined and better defined B. Software report is provided in the docket for this application requirements. C. Changes to Parts 401, 413, 414, 420, 437, rulemaking. In terms of safety requirements, the 440 Current regulations setting forth FAA would maintain a high level of 1. Part 401—Definitions application procedures and safety. Neighboring operations 2. Part 413—Application Procedures requirements for commercial space requirements would result in a minimal 3. Part 414—Safety Element Approvals 4. Part 420—License To Operate a Launch transportation licensing were based risk increase compared to current Site largely on the distinction between regulations, offset by operational 6. Part 437—Experimental Permits expendable and reusable launch benefits. The FAA would anchor the 7. Part 440—Financial Responsibility vehicles. Specifically, title 14 of the proposed requirements on public safety IV. Regulatory Notices and Analyses Code of Federal Regulations (14 CFR) criteria. The FAA would continue to use A. Regulatory Evaluation parts 415 and 417 address the launch of the current collective and individual B. Regulatory Flexibility Determination expendable launch vehicles (ELVs) and risk criteria. However, this proposal C. International Trade Impact Assessment are based on the Federal launch range would implement risk criteria for D. Unfunded Mandates Assessment standards developed in the 1990s. Part neighboring operations personnel, E. Paperwork Reduction Act F. International Compatibility 431 addresses the launch and reentry of critical asset protection, and conditional G. Environmental Analysis reusable launch vehicles (RLVs), and risk to protect from an unlikely but V. Executive Order Determinations part 435 addresses the reentry of reentry catastrophic event.3 In particular, the A. Executive Order 13132, Federalism vehicles other than RLVs. Parts 431 and B. Executive Order 13211, Regulations 435 are primarily process-based, relying 2 The current 14 CFR parts 415, 417, 431, and 435 That Significantly Affect Energy Supply, on a license applicant to derive safety regulatory text can be found at https:// www.ecfr.gov/ under their respective links. The Distribution, or Use requirements through a ‘‘system safety’’ C. Executive Order 13609, International eCFR contains Federal Register citations for each time a regulation is modified by rulemaking. Cooperation 1 Space Policy Directive—2, Streamlining 3 As will be discussed later, ‘‘neighboring D. Executive Order 13771, Reducing Regulations on Commercial Use of Space; May 24, operations personnel’’ would be defined as those Regulation and Controlling Regulatory 2018 (https://www.whitehouse.gov/presidential- members of the public located within a launch or Costs actions/space-policy-directive-2-streamlining- reentry site, or an adjacent launch or reentry site, VI. Additional Information regulations-commercial-use-space/). Continued

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00003 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15298 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

conditional risk would be used to At the time of writing, the FAA addressing launch and reentry have determine the need for a flight safety estimates this proposed rule would gone through a number of iterations system 4 and the reliability of that affect 12 operators that have an active intended to be responsive to an system. To meet these public safety license or permit to conduct launch or emerging industry while at the same criteria, most operators would have the reentry operations. In addition, the FAA time ensuring public safety. A review of option of using traditional hazard estimates this proposed rule would this history is provided to put this controls or to derive alternate controls affect approximately 276 launches over rulemaking in perspective. through a system safety approach. These the next 5 years (2019 through 2023). 1. First Licensing Regulations in 1988 rules would also revise quantitative The FAA anticipates this proposed rule flight safety analyses to better define would reduce the costs of current and DOT’s first licensing regulations for their applicability and to reduce the future launch operations by removing commercial launch activities became level of prescriptiveness. In terms of prescriptive requirements that are effective over 30 years ago, on April 4, ground safety, the FAA has scoped its burdensome to meet or require a waiver. 1988. The regulations replaced previous oversight to better fit the safety risks and The FAA expects these changes would guidance and constituted the procedural to increase operator flexibility. lead to more efficient launch operations framework for reviewing and To satisfy the proposed performance- and have a positive effect on expanding authorizing all proposals to conduct based regulations, operators would be the number of future launch and reentry non-Federal launch activities, including able to use a means of compliance that operations. the launching of launch vehicles, has already been accepted by the FAA Based on the preliminary analysis, the operation of launch sites, and payload or propose an alternate approach. To FAA estimates industry stands to gain activities that were not licensed by other retain the maximum flexibility to adjust about $19 million in discounted present federal agencies. They included general to dynamic industry changes, the FAA value net savings over 5 years or about administrative procedures and a revised would continue to offer operators the $5 million in annualized net savings compilation of DOT’s information choice to request waivers of regulations (using a discount rate of 7 percent). In requirements. No licensed launches had yet taken and equivalent level of safety addition, the FAA will save about $1 place when DOT initially issued these determinations. million in the same time period. The FAA expects industry will gain regulations. Accordingly, DOT The proposed rule is a deregulatory established a flexible regime intended to 5 additional unquantified savings and action under Executive Order 13771. benefits as the proposed rule is be responsive to an emerging industry This deregulatory action would implemented, since it would provide while at the same time ensuring public consolidate and revise multiple flexibility and scalability through safety. This approach worked well commercial space regulatory parts to performance-based requirements that because all commercial launches at the apply a single set of licensing and safety would reduce the future cost of time took place from Federal launch regulations across several types of innovation and improve the efficiency ranges where safety practices were well operations and vehicles. It would also and productivity of U.S. commercial established and had proven effective in replace many prescriptive regulations space transportation.6 protecting public safety. In 1991, when with performance-based regulations, Throughout this document, the FAA the industry reached about ten launches giving industry greater flexibility to uses scientific notation to indicate a year, DOT took further steps designed develop a means of compliance that probabilities. For example, 1 × 10¥2 to simplify the licensing process for maximizes their business objectives. means one in a hundred and 1 × 10¥6 launch operators with established safety This proposed rule would result in net means one in a million. records by instituting a launch operator cost savings for industry and enable license, which allowed one license to II. Background future innovation in U.S. commercial cover a series of launches where the space transportation. A. History same safety resources support identical As noted earlier, the Act authorizes or similar missions. who are not associated with a specific hazardous licensed or permitted operation currently being the Secretary of Transportation to 2. Licensing Changes in 1999 oversee, license, and regulate conducted but are required to perform safety, On June 21, 1999,7 the FAA amended security, or critical tasks at the site and are notified commercial launch and reentry its commercial space transportation of the operation. ‘‘Critical asset’’ means an asset that activities and the operation of launch is essential to the national interests of the United licensing regulations to clarify its and reentry sites as carried out by U.S. States. Critical assets include property, facilities, or license application process generally, citizens or within the United States. The infrastructure necessary to maintain national and for launches from Federal launch defense, or assured access to space for national Act directs the Secretary to exercise this ranges specifically. The FAA intended priority missions. For ‘‘conditional risk,’’ the FAA responsibility consistent with public would require that operators quantify the the regulations to provide an applicant health and safety, safety of property, consequence of a catastrophic event, by calculating or an operator with greater specificity and the national security and foreign the conditional risk as conditional expected and clarity regarding the scope of a casualties for any one-second period of flight. policy interests of the United States, and license and to codify and amend Unlike collective risk that determines the expected to encourage, facilitate, and promote casualties factoring in the probability that a licensing requirements and criteria. commercial space launches by the dangerous event will occur, conditional risk Notable changes were dividing launch private sector. The FAA carries out the determines the expected casualties assuming the into preflight and flight activities; dangerous event will occur. Secretary’s responsibilities under the 4 defining launch to begin with the arrival The FAA proposes to revise the definition in Act. § 401.5 of ‘‘flight safety system’’ to mean a system In the past 30 years, the Department of the launch vehicle or its major used to implement flight abort. A human can be a of Transportation (DOT) regulations components at a U.S. launch site; part of a flight safety system. The proposed separating what had been a safety and definition is discussed later in this preamble. 5 Executive Order 13771, Reducing Regulation 6 51 U.S.C. 50904 grants the FAA authority to mission review into a safety, policy, and and Controlling Regulatory Costs, January 30, 2017, oversee, license, and regulate commercial launch (https://www.whitehouse.gov/presidential-actions/ and reentry activities, and the operation of launch 7 Commercial Space Transportation Licensing presidential-executive-order-reducing-regulation- and reentry sites as carried out by U.S. citizens or Regulations, Final Rule. 64 FR 19586 (April 21, controlling-regulatory-costs/). within the United States. 1999).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00004 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15299

payload review; and the addition of a believed that it would be advantageous documents that are not necessary to specific requirement to ‘‘passivate’’ any for its ELV regulations to be consistent conduct safe launch operations. In vehicle stage left on orbit to avoid the with Federal launch range requirements contrast, the regulations for RLV potential of creating orbital debris and worked with the United States Air launches have proven to be too general, through a subsequent explosion. Force (Air Force) and the National lacking regulatory clarity. For example, Aeronautics and Space Administration part 431 does not contain specificity 3. Reusable Launch Vehicle Regulations (NASA) to codify safety practices for regarding the qualification of flight in 2000 ELVs. Those regulations reside in 14 safety systems, acceptable methods for In the mid-1990s, prospective RLV CFR parts 415 and 417. The 2006 rule flight safety analyses, and ground safety operators identified the absence of also codified safety responsibilities and requirements. This lack of clarity can adequate regulatory oversight over RLV requirements that applied to any cause delays in the application process operations, particularly their reentry, as licensed launch, regardless of whether to allow for discussions between the an impediment to technology the launch occurs from a Federal launch FAA and the applicant. Operators development. The need for a stable and range or a non-Federal launch site. frequently rely upon the requirements predictable regulatory environment in In developing the technical in part 417 to demonstrate compliance. which RLVs could operate was requirements, the FAA built on the Since 2015, the launch rate has only considered critical to the capability of safety success of Federal launch ranges increased, from 9 licensed launches a the emerging RLV industry to obtain the and sought to achieve their same high year to 33 licensed launches in 2018. capital investment necessary for level of safety by using Federal launch Beginning in 2016, the FAA developed research and development and range practices as a basis for FAA a comprehensive strategy to consolidate ultimately vehicle operations. The regulations consistent with its authority. and streamline the regulatory parts Commercial Space Act of 1998, Public The regulations specified detailed associated with commercial space Law 105–303, extended DOT’s licensing processes, procedures, analyses, and launch and reentry operations and authority to the reentry of reentry general safety system design licensing of space vehicles. Actions by vehicles and the operation of reentry requirements. For safety-critical the National Space Council confirmed sites by non-Federal entities. In hardware and software, where and accelerated FAA rulemaking plans September 2000, the FAA amended the necessary, the rule provided design and regarding launch and reentry licenses. commercial space transportation detailed test requirements. The FAA B. Licensing Process licensing regulations by establishing attempted to provide flexibility by requirements for the launch of an RLV, allowing a launch operator the When it issues a license, the Act the reentry of a reentry vehicle, and the opportunity to demonstrate an requires the FAA to do so consistent operation of launch and reentry sites.8 alternative means of achieving an with public health and safety, safety of At the time, the FAA believed that the equivalent level of safety. property, and national security and differences between ELVs and RLVs foreign policy interests of the United justified a different regulatory approach. 5. Evolution of Launch Vehicles and the States.10 The FAA currently conducts its There was a long history of successful Need for Updated and Streamlined licensing application review in five ELV launches from Federal launch Regulations component parts: Policy Review, ranges using detailed prescriptive Since 2006, the differences between Payload Review, Safety Review, regulations, encouraging the FAA to ELVs and RLVs have blurred. Vehicles Maximum Probable Loss Determination, follow suit. Also, ELVs and RLVs used that utilize traditional flight safety and Environmental Review. The license different means of terminating flight. systems now are partially reusable. For application review is depicted in figure ELV launches typically relied on flight example, the Falcon 9 first stage, 1. A policy review, in consultation with safety systems (FSS) that terminated launched by Space Exploration other government agencies, determines flight to ensure flight safety by Technologies Corporation (SpaceX), whether the launch or reentry would preventing a vehicle from traveling routinely returns to the launch site or jeopardize U.S. national security or beyond approved limits. Unlike an ELV, lands on a barge, and other operators are foreign policy interests, or international the FAA contemplated that an RLV developing launch vehicles with similar obligations of the United States. A might rely upon other means of ending return and reuse capabilities. Although payload review, also in consultation vehicle flight, such as returning to the the reuse of safety critical systems or with other government agencies, launch site or using an alternative components can have public safety determines whether the launch or landing site, in case the vehicle might implications, labeling a launch vehicle reentry of a payload would jeopardize not be able to safely conclude a mission as expendable or reusable has not public health and safety, safety of as planned. Importantly, other than impacted the primary approach property, U.S. national security or the NASA’s Space Shuttle, there was little necessary to protect public safety, foreign policy interests, or international experience with RLVs. For these certainly not to the extent suggested in obligations of the United States. A safety reasons, the FAA decided to enact the differences between part 431 and review examines whether the launch or flexible process-based regulations for parts 415 and 417. reentry would jeopardize public health RLVs and other reentry vehicles. These Moreover, the regulations for ELV and safety and safety of property, and regulations reside in 14 CFR parts 431 launches in parts 415 and 417 have typically is the most extensive part of and 435. proven to be too prescriptive and one- FAA’s review. The Act also requires the size-fits-all, and the significant detail 4. Further Regulatory Changes in 2006 FAA to determine financial has caused the regulations to become responsibility of the licensee for third The last major change to FAA launch obsolete in many instances. For party liability and losses to U.S. regulations occurred in 2006.9 The FAA example, part 417 requires all launch Government property based on the operators to have at least 11 plans that maximum probable loss. Lastly, the 8 Commercial Space Transportation Reusable define how launch processing and flight National Environmental Policy Act Launch Vehicle and Reentry Licensing Regulations, Final Rule. 65 FR 56617 (September 19, 2000). of a launch vehicle will be conducted, requires the FAA to consider and 9 Licensing and Safety Requirements for Launch, each with detailed requirements. This Final Rule. 71 FR 50508 (August 25, 2006). can lead an operator to produce 10 51 U.S.C. 50905(a).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00005 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15300 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

document the potential environmental effects associated with issuing a launch effects associated with issuing a launch or reentry license. or reentry license.

This proposal would not alter this 5- Intelligence, and the NASA and comment proposed rules rescinding pronged approach to licensing. Administrator. or revising the launch and reentry Although the FAA usually evaluates On June 30, 2017, President Donald J. licensing regulations, no later than components concurrently, as noted later Trump signed Executive Order 13803, February 1, 2019. SPD–2 charged the in this preamble, the FAA may make which reestablished the National Space Department with revising the separate determinations after Council to provide a coordinated regulations such that they would require considering the interrelationship process for developing and monitoring a single license for all types of between the components. For instance, the implementation of national space commercial space flight operations and this proposal would allow an applicant policy and strategy. The newly- replace prescriptive requirements with to apply for a Safety Review component reinstituted body met for the first time performance-based criteria. SPD–2 in an incremental manner. This on October 5, 2017. As Chair of the further commended the Secretary to preamble will discuss the proposed Council, the Vice President directed the coordinate with the members of the incremental review process in further Secretaries of Transportation and National Space Council, especially the detail later. Commerce, and the Director of the Secretary of Defense and the NASA Office of Management and Budget, to Administrator, to minimize C. National Space Council conduct a review of the U.S. regulatory requirements associated with framework for commercial space commercial space flight launch and The National Space Council was activities and report back within 45 reentry operations from Federal launch established by President George H.W. days with a plan to remove barriers to ranges as appropriate. Bush on April 20, 1989 by Executive commercial space enterprises. The D. Streamlined Launch and Reentry Order 12675 to have oversight of U.S. assigned reports and recommendations national space policy and its Licensing Requirements Aviation for regulatory streamlining were Rulemaking Committee implementation. Chaired by Vice presented at the second convening of President Dan Quayle until its the National Space Council on February On March 8, 2018, the FAA chartered disbanding in 1993, the first National 21, 2018. The Council approved four the Streamlined Launch and Reentry Space Council consisted of the recommendations, including DOT’s Licensing Requirements Aviation Secretaries of State, Treasury, Defense, recommendation that the launch and Rulemaking Committee (ARC) to Commerce, Transportation, Energy, the reentry regulations should be reformed provide a forum to discuss regulations Director of the Office of Management into a consolidated, performance-based to set forth procedures and requirements and Budget, the Chief of Staff to the licensing regime. for commercial space transportation President, the Assistant to the President On May 24, 2018, the Council launch and reentry licensing. The FAA for National Security Affairs, the memorialized its recommendations in tasked the ARC to develop Assistant to the President for Science SPD–2. SPD–2 instructed the Secretary recommendations for a performance- and Technology, the Director of Central of Transportation to publish for notice based regulatory approach in which the

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00006 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 EP15AP19.000 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15301

regulations set forth the safety objectives application consultation process as the areas such as software safety and flight to be achieved while providing the basis for a ‘‘complete enough’’ safety analyses (FSA), to reflect recent applicant with the flexibility to produce determination, considering both an advancements. Finally, the FAA tailored and innovative means of applicant’s prior experience and proposes to streamline its regulations by compliance. whether the subject vehicle is known or designing them to be flexible and The ARC’s membership represented a unknown. scalable, to reduce timelines, to remove broad range of stakeholder perspectives, 4. Contain defined review timelines. or minimize duplicative jurisdiction, including members from aviation and i. Support significantly-reduced and to limit FAA jurisdiction over space communities. The ARC was timelines and more efficient review. ground safety to operations that are ii. Increase predictability for industry. supported by the FAA and other federal hazardous to the public. This agency subject matter experts. The iii. Create reduced review timelines streamlining was the focus of the ARC. following table identifies ARC for both new and continuing accuracy participants from the private sector: submissions. The FAA proposal would follow the 5. Contain continuing accuracy ARC recommendations to enable greater Aerospace industries association. requirements. Continuing accuracy regulatory flexibility. First, the proposed Airlines for America. submissions should be based upon rule would be primarily performance- Alaska Aerospace Corporation. impact to public safety as measured by based, codifying performance standards Astra Space. the Expected Casualty (EC). and relying on FAA guidance or other Blue Origin. 6. Limit FAA jurisdiction. Boeing. standards to provide acceptable means i. Limit FAA jurisdiction to activities of compliance. This would allow the Coalition for Deep Space Exploration. so publicly hazardous as to warrant Commercial Spaceflight Federation. regulations to better adapt to Exos Aerospace Systems & Technologies, FAA-oversight. advancements in the industry. Second, ii. Identify well-defined inspection Inc. the FAA proposes to change the Generation Orbit. criteria. 7. Eliminate duplicative jurisdiction structure of its launch and reentry Lockheed Martin Corporation. license to be more flexible in the MLA Space, LLC. on Federal launch ranges. Mojave air and spaceport. The FAA will address these number and types of launches and Orbital ATK. recommendations in more detail reentries one license can accommodate. RocketLab. throughout the remainder of this Third, as the ARC suggested, system Sierra Nevada Corp. document. safety principles would be prominent. Spaceport America. During the course of the ARC, All applicants would need to comply SpaceX. with core system safety management Space Florida. volunteer industry members formed a Stratolaunch. Task Group to provide draft regulatory principles and conduct a preliminary United Launch Alliance. text reflecting proposed revisions to the safety assessment. Some applicants may Vector Launch, Inc. commercial space transportation also be required to use a flight hazard Virgin Galactic/Virgin Orbit. regulations. The volunteer industry analysis to derive hazard controls World View Enterprises. members of the Task Group were Blue particular to their operation. Lastly, for Origin, Sierra Nevada Corporation, any particular requirement, the FAA On April 30, 2018, the ARC produced Space Florida, and SpaceX. The would maintain the ability for an its final recommendation report, which majority of the ARC opposed the applicant or operator to propose an has been placed in the docket to this formation of this Task Group and alternative approach for compliance, 11 rulemaking. The ARC recommended disagreed with including the proposed and then clearly demonstrate that the that the proposed regulations should— regulatory text into the ARC’s alternative approach would provide an 1. Be performance-based, primarily recommendation report. The FAA will equivalent level of safety to the based upon the ability of the applicant not specifically address the proposed to comply with expected casualty limits. requirement. regulatory text in this document because 2. Be flexible. The ARC recommended that the level it did not receive broad consensus i. Adopt a single license structure to of rigor of an applicant’s safety within the ARC. accommodate a variety of vehicle types demonstration vary based on vehicle and operations and launch or reentry III. Discussion of the Proposal history, company history, and the sites. relative risk of the launch or reentry. It A. The FAA’s Approach To Updating ii. Allow for coordinated also recommended that the FAA not and Streamlining Launch and Reentry determination of applicable regulations always require a flight safety system. Regulations prior to the application submission. The FAA recognizes that different iii. Develop regulations that can be The FAA’s approach to meeting SPD– operations require different levels of met without waivers. 2’s mandate is to consolidate, update, rigor, and is proposing a more scalable iv. Use guidance documents to and streamline all launch and reentry regulatory regime. Given performance- facilitate frequent updates. regulations into a single performance- 3. Reform the pre-application based regulations are inherently based part. Pursuant to SPD–2, and in scalable, the FAA proposal is consistent consultation process and requirements. the interest of updating the FAA’s i. Use ‘‘complete enough’’ as the real with the ARC recommendation, even regulations to reflect the current though it does not explicitly account for criterion for entering application commercial space industry, the FAA evaluation and remove the requirement vehicle or operator history as a means proposes to consolidate requirements for pre-application consultation. of scaling requirements. In addition to for the launch and reentry of ELVs, ii. Use a level-of-rigor approach to performance-based requirements, this RLVs, and reentry vehicles other than scope an applicant-requested pre- proposal would implement a specific an RLV.12 The FAA would also update level-of-rigor approach to ensure safety a number of safety provisions, including 11 Streamlined Launch and Reentry Licensing requirements are proportionate to the Requirements ARC, Recommendations Final Report public safety risk in the need for a flight (April 30, 2008). The ARC Report is available for 12 These requirements currently appear in parts reference in the docket for this proposed rule. 415, 417, 431, and 435. safety system and its required

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00007 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15302 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

reliability, in flight safety analysis,13 the result of a software issue concerning license covers only one launch site, and and in software safety. These are all a flight safety system that the applicant would eliminate the designations of discussed in greater detail later in this needed to resolve. To our knowledge, a launch-specific license and launch preamble. launch has never been delayed as a operator license, mission-specific Because the rulemaking process is result of the time it took the FAA to license and operator license, and time-consuming and labor intensive, the make a license determinations. reentry-specific license and reentry- FAA seeks to minimize the need for The ARC recommended that the FAA operator license. The proposal would regulatory updates to proposed part 450 propose rules that eliminate duplicative also allow the FAA to scope the through the proposed performance- U.S. Government requirements when an duration of the license to the operation. based regulations which would allow operator conducts operations at a Although the FAA has not defined a for a variety of FAA-approved means of Federal launch range. The FAA’s ‘‘family of vehicles,’’ launch operators compliance. Approving new means of proposal would allow for varying levels often do so themselves. Usually, the compliance creates flexibility for of Federal launch range involvement, vehicles share a common core, i.e., the operators without reducing safety. including a single FAA authorization. It booster and upper stage. Sometimes Additionally, approving new means of would also minimize duplicative work multiple boosters are attached together compliance is easier to accomplish than by a launch or reentry operator. This to form a larger booster. Historically, updating regulatory standards through issue is discussed in more detail later in solid rocket motors have been attached the rulemaking process. Thus, the this preamble. to core boosters to enhance capability. proposed regulatory scheme would be Also, the ARC recommended that the There has never been an issue more adaptable to the fast-evolving FAA limit its jurisdiction over ground concerning what operators and the FAA commercial space industry. operations to activities so publicly consider to be members of the same The ARC recommended that the FAA hazardous as to warrant the FAA’s family. It is merely a convenient way to should design a modular approach to oversight. This proposal would scope structure licenses. application submittal and evaluation ground activities overseen by FAA to SPD–2 directed the DOT to revise the and significantly reduce FAA review each operation. It would also permit current launch and reentry licensing timelines. This proposal would allow an neighboring operations personnel to be regulations with special consideration applicant to apply for a license in an present during launch activities in to requiring a single license for all types incremental manner,14 to be developed certain circumstances. of commercial launch and reentry The ARC also recommended that the on a case-by-case basis during pre- operations. Similarly, the ARC FAA require the pre-application process application consultation. Most timelines recommended that the FAA adopt a only for new operators or new vehicle in the proposal would have a default single license structure to accommodate programs, and that pre-application value, followed by an option for the a variety of vehicle types, operations, occur at the operator’s discretion for all FAA to agree to a different time frame, and launch and reentry sites. In other operations.15 The FAA proposes taking into account the complexity of accordance with these to retain the requirement for pre- the request and whether it would allow recommendations, the FAA proposes a application consultation because of the sufficient time for the FAA to conduct single vehicle operator license that various flexibilities proposed in this its review and make its requisite could be scoped to the operation. In rule. These include incremental review, findings. Lastly, the FAA proposes to order to accommodate the increasingly timelines, and the performance-based make it easier for a launch or reentry similar characteristics of some ELVs and nature of many of the regulatory operator to obtain a safety element RLVs, as well as future concepts, these requirements. Pre-application approval, which would reduce the time proposed regulations would no longer consultation would assist operators with and effort of an experienced operator in distinguish between ELVs and RLVs. the licensing process and accommodate a future license application. Although Rather, this proposal would consolidate all operators, including those that these provisions should reduce the time the licensing requirements for all choose to avail themselves of the for experienced operators, the FAA does commercial launch and reentry flexibilities provided in this proposal. not propose to reduce by regulation the activities under one part, and applicants The FAA acknowledges, however, that statutory review period of 180 days to would apply for the same type of pre-application consultation can be make a decision on a license license. minimal for operators experienced with application. In addition to accommodating FAA requirements. In such cases, It might be useful to provide some different vehicles and types of consultation may consist of a telephone perspective concerning the time the operations, this proposal would allow conversation. FAA actually takes to make license launches or reentries under a single determinations. The average of the last B. Single Vehicle Operator License vehicle operator license from or to ten new license determinations through As part of its streamlining effort, the multiple sites. Under the current calendar year 2018 was 141 days; the FAA proposes in § 450.3 (Scope of regulations, in order for an operator to median was 167 days. The FAA strives Vehicle Operator License) to establish benefit from using multiple sites for to expedite determinations when one license, a vehicle operator license, launches authorized by a part 415 possible to accommodate launch license, the operator must apply for a for commercial launch and reentry 16 schedules. In three of these ten, the FAA activity. A vehicle operator license new license. This process is made determinations in 54, 73, and 77 would authorize a licensee to conduct unnecessarily burdensome. This days, all without tolling. Three one or more launches or reentries using determinations were tolled for 73, 77, 16 For example, in 2018, a launch operator held the same vehicle or family of vehicles a launch license under part 415 that authorized it and 171 days. The lengthy tolling was and would specify whether it covers to launch from Kennedy Space Center (KSC) in launch, reentry, or launch and reentry. Florida; however, the operator contemplated 13 For flight safety analyses, various levels of rigor The FAA would eliminate the current launching from a nearby launch site, Cape would be outlined in ACs. Canaveral Air Force Station (CCAFS). Under 14 In this rulemaking, the term ‘‘incremental’’ limitation in § 415.3 specifying a launch current part 415, in order to launch from CCAFS would be synonymous with the ARC’s proposed instead of KSC, the operator has to file a separate term of ‘‘modular.’’ 15 ARC Report at p. 23. application for a license to launch from CCAFS.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00008 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15303

proposed change would facilitate the site but not all launch sites included in allowed varying means of compliance application process because an operator the application, the FAA would have proposed by the operator.17 In response would no longer be required to apply for the option to toll the review period, as to SPD–2 and the ARC a separate license to launch or reenter provided in § 413.15(b). Alternatively, recommendations, the FAA is proposing from a launch site other than that the FAA could continue its review of to replace many of the prescriptive specified by the license. the part of the application with licensing requirements with In order to apply for a license that complete enough information and toll performance-based requirements. These includes multiple sites, an applicant the portion involving any launch site performance-based requirements would would need to provide the FAA with with insufficient information to make a provide flexibility, scalability, and application materials that would allow licensing determination. In either case, adaptability as discussed in the the FAA to conduct separate reviews for the FAA would notify the applicant as introduction. An operator would be able each site to determine, for example: required by § 413.15(c). to use an acceptable means of Maximum probable loss required by Finally, the FAA proposes a more compliance to demonstrate compliance part 440; public risk to populated areas, flexible approach to the duration of a with the requirements. aircraft, and waterborne vessels; and the vehicle operator license under § 450.7 Currently, the FAA uses both environmental impacts associated with (Duration of a Vehicle Operator prescriptive and performance-based proposed launches or reentries. The License). Specifically, the FAA would requirements for launches and reentries FAA foresees that a license that determine, based on information respectively.18 Parts 415 and 417 authorizes launches or reentries at more received from an applicant, the provide detailed prescriptive than one site would make it appropriate duration of the license, not requirements for ELVs. Although these administratively easier for an operator to exceed five years. In making this requirements provide regulatory to change sites for a particular determination, the FAA would continue certainty, they have proven inflexible. operation. For example, an operator its current practice of setting the As the industry grows and innovates, could move a launch from one site to duration of a license for specified ELV operators have identified alternate another due to launch facility launches to be approximately one year ways of operating safely that do not availability. A launch might move from after the expected date of the activity. comply with the regulations as written. CCAFS to KSC. Additionally, FAA Currently, a launch-specific license This has forced operators to request foresees multiple sites will be utilized expires upon completion of all launches waivers or equivalent-level-of safety- by operators of hybrid vehicles at authorized by the license or the determinations (ELOS determinations), launch sites with runways as well as expiration date stated in the license, often close to scheduled launch dates. vehicles supporting operationally whichever occurs first. An operator On the other hand, the performance- responsive space missions such as license remains in effect for two years based regulations in parts 431 and 435 DARPA Launch Challenge. Under this for an RLV and five years for an ELV lack the detail to efficiently guide proposed licensing regime, an applicant from the date of issuance. The FAA operators through the FAA’s regulatory should be prepared to discuss its intent considered setting all license durations regime. Indeed, the FAA often fills these to conduct activity from multiple sites to five years, but rejected this option to regulatory gaps by adopting part 417 during pre-application consultation. allow an applicant to obtain a license requirements in practice. The process of This discussion would give both the for a limited specific activity rather than adding regulatory certainty to these applicant and the agency an opportunity for a more general range of activities. An performance-based regulations by to scope the application and identify applicant may prefer a shorter license adopting part 417 requirements has any potential issues early on when duration for a specific activity because been frustrating and contentious for changes to the application or proposed a licensee has obligations under an FAA both operators and the FAA. licensed activities would be less likely license, such as the requirements to Adopting performance-based to cause additional issues or significant demonstrate financial responsibility and requirements that allow operators to use delays. The launch operator would not allow access to FAA safety inspectors, an acceptable means of compliance need to specify the specific launches and a shorter license duration would would decrease the need for waivers or that would be planned for each site. The relieve an applicant of compliance with ELOS determinations to address new FAA would continue its current practice these requirements after the activity has technology advancements. An for operator licenses of requiring a ended. Unless an operator requests an acceptable means of compliance is one demonstration that a proposed range of operator license, currently good for means, but not the only means, by activities, not every trajectory variation either two or five years, the operator which a requirement could be met. The within that range, can be safely does not typically request a license FAA would set the safety standard in conducted in order to scope the license. duration. The FAA initially sets the regulations and identify any acceptable The license would not need to be duration to encompass the authorized means of compliance currently modified unless the proposed operation activity. The FAA plans to continue its available. The FAA would provide fell outside the authorized range. current practice of extending licenses public notice of each means of The FAA further notes that under through renewals or modifications to compliance that the Administrator has § 413.11, after an initial screening the accommodate delays in authorized accepted by publishing the acceptance FAA determines whether an application launches or reentries. is complete enough to begin its review. 17 ARC Report, at p. 7. If an application that includes multiple C. Performance-Based Requirements 18 Parts 415 and 417, and their associated launch sites is complete enough for the and Means of Compliance appendices, provide primarily prescriptive requirements for licensing and launch of an ELV. FAA to accept it and begin its review, SPD–2 directs the FAA to consider Part 431 provides primarily performance- and the 180-day review period under replacing prescriptive requirements in process-based requirements for a launch and § 413.15(a) would begin. However, if the commercial space flight launch and reentry of a reusable launch vehicle. Part 435 during the FAA’s initial review it reentry licensing process with provides similar requirements to part 431 for the reentry of a reentry vehicle other than a reusable determines that an application is performance-based criteria. The ARC launch vehicle. Parts 431 and 435 rely on a system sufficiently complete to make a license echoed the SPD–2 recommendation for safety process performed by an operator in order to determination for at least one launch performance-based requirements that demonstrate adequate safety of the operation.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00009 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15304 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

on its website, for example. This and determination. These factors may Transportation in implementing the notification would communicate to the affect how quickly the FAA is able to Secretary’s responsibilities to review public and the industry that the FAA review and make a determination. The and revise its launch and reentry has accepted a means of compliance or time could range from a few days to regulations.20 Most recently, the John S. any revision to an existing means of many weeks. McCain National Defense Authorization compliance. A consensus standards Although applying for the acceptance Act for Fiscal Year 2019 includes a body, any individual, or any of a new means of compliance may take provision stating that the Secretary of organization would be able to submit time, once an operator’s unique means Defense may not impose any means of compliance documentation to of compliance is accepted by the FAA, requirement on a licensee or transferee the FAA for consideration and potential the operator can use it in future license that is duplicative of, or overlaps in acceptance. applications. The FAA also anticipates intent with, any requirement imposed An operator could also develop its that this process will result in flexibility by the Secretary of Transportation under own means of compliance to for industry and will encourage 51 U.S.C. chapter 509, unless imposing demonstrate it met the safety standard. innovation as industry and consensus such a requirement is necessary to avoid Once the Administrator has accepted a standards bodies 19 develop multiple negative consequences for the national means of compliance for that operator, ways for an operator to meet the security space program.21 the operator could use it in future requisite safety standards. The FAA Currently, the FAA issues a safety license applications. The FAA would believes this is the best approach to approval to a license applicant not provide public notice of individual enabling new ways of achieving proposing to launch from a Federal operator-developed means of acceptable levels of safety through launch range if the applicant satisfies compliance. If any information industry innovation, and seeks public the requirements of part 415, subpart C, submitted to the FAA as part of a means comment on whether this approach may and has contracted with the range for of compliance for acceptance is induce additional innovation through the provision of safety-related launch proprietary, it would be afforded the industry-developed consensus services and property, as long as an same protections as are applied today to standards. FAA Launch Site Safety Assessment license applications submitted under (LSSA) 22 shows that the range’s launch § 413.9. D. Launch From a Federal Launch services and launch property satisfy part For five of the proposed requirements, Range 417. The FAA assesses each range and an operator would have to demonstrate Both industry and the National Space determines if the range meets FAA compliance using a means of Council have urged government safety requirements. If the FAA assessed compliance that has been approved by agencies involved in the launch and a range, through its LSSA, and found the FAA before an operator could use it reentry of vehicles by commercial that an applicable range safety-related in a license application. These five operators to work towards common launch service or property satisfies FAA requirements are flight safety systems standards and to remove duplicative requirements, then the FAA treats the (proposed § 450.145), FSA methods oversight. The ARC recommended an range’s launch service or property as (proposed § 450.115), lightning flight end goal of either exclusive FAA that of a launch operator’s, and there is commit criteria (proposed § 450.163(a)), jurisdiction over commercial launches no need for further demonstration of and airborne toxic concentration and at a range, or a range adopting the same compliance to the FAA. The FAA duration thresholds (proposed flight safety regulations used by the reassesses a range’s practices only when §§ 450.139 and 450.187). The FAA has FAA. SPD–2 directed the Secretary of the range chooses to change its practice. developed Advisory Circulars (ACs) or Defense, the Secretary of The ARC recommended that ranges identified government standards that Transportation, and the NASA and the FAA have common flight safety discuss an acceptable means of Administrator to coordinate to examine regulations and guidance documents. To compliance for each of these all existing U.S. Government address this recommendation, the FAA requirements, and has placed these requirements, standards, and policies proposes performance-based documents in the docket for the public’s associated with commercial space flight requirements for both ground and flight review and comment. If an operator launch and reentry operations from safety that an operator could meet using wishes to use a means of compliance Federal launch ranges and minimize Air Force and NASA practices as a not previously accepted by the FAA to those requirements, except those means of compliance. The FAA expects demonstrate compliance with one of the necessary to protect public safety and that there will be few, if any, instances five requirements, the FAA would have national security, that would conflict where Air Force or NASA practices do to review and accept it prior to an not satisfy the proposed performance- operator using that means of compliance with the efforts of the Secretary of based requirements. Additionally, the to satisfy a licensing requirement. 19 If an operator is interested in applying The FAA intends to rely increasingly on proposed requirements should provide voluntary consensus standards as means of enough flexibility to accommodate for the acceptance of a unique means of compliance. Section 12(d) of the National compliance, it should submit any data Technology Advancement Act (Pub. L. 104–113; 15 changes in Air Force and NASA or documentation to the FAA necessary U.S.C. 3701, et seq.) directs federal agencies to use practices in the future. The FAA expects to demonstrate that the means of voluntary consensus standards in lieu of that range services that a range applies government-unique standards except where to U.S. Government launches and compliance satisfies the safety inconsistent with law or otherwise impractical. requirements established in the Because voluntary consensus bodies are made up of 20 regulation. An operator should note that a wide selection of industry participants, and often SPD–2; May 24, 2018 (https:// also include FAA participation, the FAA expects its www.whitehouse.gov/presidential-actions/space- the FAA will take into account such review of a means of compliance developed by a policy-directive-2-streamlining-regulations- factors as complexity of the means of voluntary consensus standards body would be more commercial-use-space). compliance; whether the means of expeditious than a custom means of compliance. 21 Section 1606(2)(A), John S. McCain National compliance is an industry, government, Unlike means of compliance developed by a Defense Authorization Act for Fiscal Year 2019, voluntary consensus standards body, a custom Public Law 115–232 (amending 51 U.S.C. 50918 or voluntary consensus standard; and means of compliance would not be subject to peer note). whether the means of compliance has review or independent review of the viability of the 22 LSSA is an FAA evaluation of Federal range been peer-reviewed during its review technical approach. services and launch property.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00010 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15305

reentries will almost invariably satisfy to eliminate duplicative approvals. exclusively on a robust systems safety the FAA’s proposed requirements. The Instead, the FAA will continue to work approach. As noted earlier, experience FAA currently accepts flight safety with the appropriate agencies to has shown that part 431 does not offer analyses performed by Air Force on streamline commercial launch and enough specificity and, as a result, it has behalf of an operator without additional reentry requirements at ranges and been unclear to operators what safety analysis and anticipates that it would Federal facilities by leveraging the measures the FAA requires to achieve give similar deference to other analyses Common Standards Working Group an acceptable level of safety. In by federal agencies once it established (CSWG).23 particular, there are no explicit that they meet FAA requirements. E. Safety Framework requirements for ground safety, flight safety analysis, or flight safety systems. The FAA developed this approach to In addition to proposing a single On the other hand, part 417 is too reduce operator burden to the largest vehicle operator license and replacing prescriptive, particularly regarding extent possible. The FAA is bound to prescriptive requirements with design and detailed procedural execute its statutory mandates and may performance-based requirements, this do so only to the extent authorized by rule would rely on a safety framework requirements for ground safety, detailed those statutes. Although federal entities that provides the flexibility needed to design and test requirements for flight often have complimentary mandates accommodate current and future safety systems, and numerous plans that and statutory authorities, they are rarely operations and the regulatory certainty placed needless burden on operators identical. That is, each federal lacking in some of the current and impeded innovation. Thus, the department or agency has been given regulations. framework described below is designed separate mission. Federal entities This proposal would consolidate the to strike a balance between these two establish interagency processes to launch and reentry safety requirements parts. The proposed regulations clearly manage closely related functions in as in subpart C. Figure 2 depicts the safety lay out FAA expectations, but should smoothly and least burdensome manner framework on which the FAA relied in provide a launch or reentry operator possible. Coordinating FAA developing its proposed safety with flexibility on how it achieves requirements, range practices, and those requirements. In developing this acceptable public safety. The framework practices implemented at other Federal framework, the FAA considered also seeks to allow operators that wish facilities is largely an interagency issue, following the approach taken in parts to conduct operations using proven this proposal does not include language 431 and 435 and relying almost hazard control strategies to do so.

System Safety Program. All operators organization, procedures, configuration an entire flight. An operator could use would be required to have a system control, and post-flight data review. traditional hazard controls such as safety program that would establish Preliminary Flight Safety Assessment. physical containment, wind weighting, system safety management principles For flight safety, an operator would or flight abort to mitigate hazards. for both ground and flight safety conduct a preliminary flight safety Physical containment is when a launch throughout the operational lifecycle of a assessment to identify public hazards vehicle does not have sufficient energy launch or reentry system. The system and determine the appropriate hazard for any hazards associated with its flight safety program would include a safety control strategy for a phase of flight or to reach the public or critical assets.

23 The CSWG consists of range safety personnel in the early 2000’s to develop and maintain from the Air Force and NASA, and was chartered common launch safety standards among agencies.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00011 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 EP15AP19.001 15306 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

Wind weighting is when the operator of derived from a flight hazard analysis and individual risk for aircraft in flight. an unguided suborbital launch vehicle and flight safety analyses, the FAA Lastly, critical asset risk addresses the adjusts launcher azimuth and elevation would require a number of other hazard loss of functionality of an asset that is settings to correct for the effects of wind controls that have historically been essential to the national interests of the conditions at the time of flight to necessary to achieve acceptable public United States. Critical assets include provide a safe impact location for the safety. These include requirements for property, facilities, or infrastructure launch vehicle or its components. Flight flight safety and other safety critical necessary to maintain national defense, Abort is the process to limit or restrict systems, agreements, safety-critical or assured access to space for national the hazards to public health and safety personnel qualifications, crew rest, priority missions. and the safety of property presented by radio frequency management, readiness, Proposed § 450.101(a)(1) would a launch vehicle or reentry vehicle, communications, preflight procedures, establish the collective risk criteria for including any payload, while in flight surveillance and publication of hazard flight, measured by expected casualties by initiating and accomplishing a areas, lightning hazard mitigation, flight (EC). The proposal would define EC as controlled ending to vehicle flight. safety rules, tracking, collision the mean number of casualties predicted Flight abort as a hazard control strategy avoidance, safety at the end of launch, to occur per flight operation if the would be required for a phase of flight and mishap planning. operation were repeated many times. that is shown by a consequence analysis Acceptable Flight Safety. All elements The term casualties refers to serious to potentially have significant public of the safety framework combine to injuries or worse, including fatalities. It safety impacts. Otherwise, an operator provide acceptable public safety during would require the risk to all members of would be able to bypass these flight. In proposed § 450.101 (Public the public, excluding persons in aircraft traditional hazard control strategies and Safety Criteria), the FAA would outline and neighboring operations personnel, conduct a flight hazard analysis. specific public safety criteria to clearly to not exceed an expected number of 1 × ¥4 Flight Hazard Analysis. As an define how safe is safe enough. Section 10 casualties, posed by impacting alternative to traditional hazard control 450.101 is discussed in detail later in inert and explosive debris, toxic release, measures, an operator would be able to this preamble. and far field blast overpressure.25 With conduct a flight hazard analysis to Ground Safety. With respect to two exceptions, this is the same criteria derive hazard controls. Hazard analysis ground safety, an operator would currently used in §§ 417.107(b)(1) and is a proven engineering discipline that, conduct a ground hazard analysis to 431.35(b)(1)(i). The first exception when applied during system derive ground hazard controls. Those, applies to people on waterborne vessels, development and throughout the along with prescribed hazard controls, who would now be included in the system’s lifecycle, identifies and would provide acceptable public safety collective risk criteria to all members of mitigates hazards and, in so doing, during ground operations. the public. The second exception eliminates or reduces the risk of applies to neighboring operations potential mishaps and accidents. In Flight Safety personnel. This proposal would require addition, a separate hazard analysis A. Public Safety Criteria the risk to all neighboring operations methodology is outlined for computing personnel not exceed an expected systems and software. Proposed § 450.101 would consolidate number of 2 × 10¥4 casualties. Both of Flight Safety Analysis. Regardless of all public safety criteria for flight into these topics are discussed separately the hazard control strategy chosen or one section. It would contain the core later in this preamble. mandated, an operator would be performance-based safety requirements Proposed § 450.101(a)(2) would required to conduct a number of flight to protect people and property on land, establish the individual risk criteria for safety analyses. At a minimum, these at sea, in the air, and in space. All other flight, measured by probability of analyses would quantitatively flight safety requirements in proposed casualty (PC). The proposal would demonstrate that a launch or reentry part 450 subpart C would support the define PC as the likelihood that a person meets the public safety criteria for achievement of these criteria. The will suffer a serious injury or worse, debris, far-field overpressure, and toxic § 450.101 requirements would define including a fatal injury, due to all hazards. Other analyses support flight how safe is safe enough for the flight of hazards from an operation at a specific abort and wind weighting hazard a commercial launch or reentry vehicle. location. It would require the risk to any control strategies and determine flight Proposed § 450.101(a) contains launch individual member of the public, hazard areas.24 For a detailed risk criteria, or the risk thresholds an excluding neighboring operations discussion, please see the ‘‘Additional operator may not exceed during flight. personnel, to not exceed a PC of 1 × Technical Justification and Rationale’’ An operator would be permitted to 10¥6 per launch, posed by impacting discussion later in the preamble. initiate the flight of a launch vehicle inert and explosive debris, toxic release, Derived Hazard Controls. An operator only if the collective, individual, and far field blast overpressure. With would derive a number of hazard aircraft, and critical asset risk satisfy the one exception, this is the same criteria controls through its conduct of a flight proposed criteria. The criteria would currently in §§ 417.107(b)(2) and hazard analysis and flight safety apply to every launch from liftoff 431.35(b)(1)(iii). The exception is analyses. through orbital insertion for an orbital neighboring operations personnel would Prescribed Hazard Controls. launch, and through final impact or have separate individual risk criteria, Regardless of the hazard controls landing for a suborbital launch, which which is discussed later in this is the same scope used for current preamble. 24 Note that flight hazard analysis and flight safety launch risk criteria in parts 417 and 431. Proposed § 450.101(a)(3) would set analysis are interdependent in that each can help Each measure of risk serves a different aircraft risk criteria for flight. It would inform the other. Flight safety analysis quantifies the risks posed by hazards, which are typically purpose. Collective risk addresses the identified and mitigated during the flight hazard risk to a population as a whole, whereas 25 Far field blast overpressure is a phenomenon analysis, by using physics to model how the vehicle individual risk addresses the risk to resulting from the air blast effects of large will respond to specific failure modes. The FSA is each person within a population. The explosions that may be focused by certain also useful to define when operational restrictions conditions in the atmosphere through which the are necessary to meet quantitative risk measure of aircraft risk is unique, due blast waves propagate. Population may be at risk requirements. to the difficulty of modeling collective from broken window glass shards.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00012 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15307

require a launch operator to establish section. Flight abort with the use of an area has such a low density of people any aircraft hazard areas necessary to FSS and applying the CEC criteria in that are exposed almost exclusively in ensure the probability of impact with proposed part 450 is discussed later in large waterborne vessels, objects that debris capable of causing a casualty for this preamble. Proposed § 450.101(c) survive reentry to impact in these areas ¥6 aircraft does not exceed 1 × 10 . This would apply to all phases of flight, produce an insignificant PC. Therefore, is the same requirement as current unless otherwise agreed to by the FAA operators disposing a vehicle stage or § 417.107(b)(4). Part 431 does not have based on the demonstrated reliability of component into a broad ocean area aircraft risk criteria, although the FAA’s the launch or reentry vehicle during that would not need to demonstrate current practice is to use the part 417 phase of flight. The flight of a compliance with the collective, criteria for launches licensed under part certificated aircraft that is carrying a individual, or aircraft risk criteria. For 431. With this proposal, the FAA would rocket to a drop point is an example of purposes of this proposal, the FAA expressly apply this criterion to all when the use of an FSS would likely not considers ‘‘broad ocean’’ as an area 200 launches. The FAA does not propose be necessary even though the CEC could nautical miles (nm) from land. Two any other changes for the protection of be above the threshold, because the hundred nm is also the recognized limit aircraft at this time. The FAA has an aircraft would have a demonstrated high of exclusive economic zones (EEZ), ongoing Airspace Access ARC, reliability. which are zones prescribed by the composed of commercial space Proposed § 450.101(d) would United Nations Convention on the Law transportation and aviation industry establish disposal 28 safety criteria. It of the Sea 32 over which the owning representatives, whose would require that an operator state has exclusive exploitation rights recommendations may inform a future conducting a disposal of a vehicle stage over all natural resources. Disposal rulemaking on protection of aircraft. or component from Earth orbit either beyond an EEZ further reduces the Proposed § 450.101(a)(4) would set meet the criteria of § 450.101(b)(1), (2), chance of disrupting economic the launch risk criteria for critical and (3), or target a broad ocean area. operations such as commercial fishing. assets. It would require the probability Because a launch vehicle stage or Proposed § 450.101(e) would address of loss of functionality for each critical component will not survive a disposal the protection of people and property asset to not exceed 1 × 10¥3, or some substantially intact, disposal is not on-orbit, through collision avoidance other more stringent probability if considered a reentry.29 Disposal is an requirements during launch or reentry deemed necessary to protect the effective method of orbital debris and through requirements aimed at national security interests of the United prevention because it eliminates the preventing explosions of launch vehicle States. This would be a new vehicle stage or component as a piece of stages or components on-orbit. requirement and is discussed separately orbital debris and as a risk for future Specifically, proposed § 450.101(e)(1) later in this preamble. debris creation through collision. The would require a launch or reentry Proposed § 450.101(b) would define FAA is not proposing to require that a operator to prevent the collision risk criteria for reentry. These would be launch operator dispose of any upper between a launch or reentry vehicle the same as the risk criteria for launch, stage or component in this rulemaking. stage or component, and people or except that the proposed criteria would The current proposal would only apply property on-orbit, in accordance with apply to each reentry, from the final if a launch operator chooses to dispose the requirements in proposed health check prior to the deorbit burn of its upper stage or other launch § 450.169(a) (Launch and Reentry through final impact or landing. The vehicle component. Although an Collision Avoidance Analysis same discussion earlier regarding operator could choose to demonstrate Requirements). Proposed § 450.101(e)(2) collective risk, individual risk, aircraft that the proposed collective and would require that a launch operator risk, and risk to critical assets would individual risk criteria are met for a prevent the creation of debris through apply to the reentry risk criteria. disposal, the FAA expects most, if not the conversion of energy sources into Proposed § 450.101(c) would set the all, disposals to target a broad ocean energy that fragments the stage or flight abort criteria for both launch and area.30 This is consistent with current component, in accordance with the reentry. It represents the most practice and NASA Technical requirements in proposed § 450.171 significant change to public safety Standards.31 Because the broad ocean (Safety at End of Launch). Proposed criteria in this proposed rule. It would § 450.171 would contain the same require that an operator use flight abort 28 The FAA proposes to define ‘‘disposal’’ in requirements as in §§ 417.129 and as a hazard control strategy if the § 401.5 to mean the return or attempt to return, 431.43(c)(3). Both §§ 450.169(a) and purposefully, a launch vehicle stage or component, consequence of any reasonably not including a reentry vehicle, from Earth orbit to 450.171 are addressed in greater detail foreseeable vehicle response mode,26 in Earth, in a controlled manner. The proposed later in the preamble. any one-second period of flight, is definition is discussed later in this preamble. Proposed § 450.101(f) would require 29 greater than 1 × 10¥3 conditional A ‘‘reentry’’ is defined in 51 U.S.C. 50902, as that an operator for any launch, reentry, ‘‘to return or attempt to return, purposefully, a or disposal notify the public of any expected casualties (CEC) for reentry vehicle and its payload or human beings, if 27 uncontrolled areas. CEC is the any, from Earth orbit or from outer space to Earth.’’ region of land, sea, or air that contains, A ‘‘reentry vehicle’’ is defined as ‘‘a vehicle consequence, measured in terms of EC, with 97 percent probability of designed to return from Earth orbit or outer space containment, all debris resulting from without regard to the probability of to Earth, or a reusable launch vehicle designed to failure, and will be discussed in the return from Earth orbit or outer space to Earth, normal flight events capable of causing Consequence Protection Criteria for substantially intact.’’ a casualty. The requirement to notify the Flight Abort and Flight Safety System 30 A disposal that ‘‘targets a broad ocean area’’ public of planned impacts is currently would wholly contain the disposal hazard area in §§ 417.111(i)(5) and 431.75(b). The within a broad ocean area. 26 calculation of such hazard areas is Vehicle response mode means a mutually 31 NASA–STD–8715.14A, paragraph 4.7.2.1.b, exclusive scenario that characterizes foreseeable states, ‘‘For controlled reentry, the selected discussed later in this preamble in the combinations of vehicle trajectory and debris trajectory shall ensure that no surviving debris generation. impact with a kinetic energy greater than 15 joules 32 United Nations Convention on the Law of the 27 Uncontrolled Area is an area of land not is closer than 370 km from foreign landmasses, or Sea, Dec. 10, 1982, 1833 U.N.T.S. 397. Although the controlled by a launch or reentry operator, a launch is within 50 km from the continental U.S., United States has not ratified UNCLOS, its or reentry site operator, an adjacent site operator, territories of the U.S., and the permanent ice pack comprehensive legal framework codifies customary or other entity by agreement. of Antarctica.’’ international law governing uses of the ocean.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00013 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15308 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

discussion of proposed § 450.133 (Flight launch tempo increases and similar i. FAA Proposed Definitions of Public Hazard Areas). Notification of planned operations are conducted at other sites. and Neighboring Operations Personnel impacts would be included in proposed The Air Force, NASA, and industry in § 401.5 § 450.101 because it is not tied to risk have recommended that the FAA treat To address these concerns, the FAA and is therefore not covered by the other certain personnel of other launch proposes to add two definitions to public safety criteria of proposed operators, referred to in this proposed § 401.5. The first is ‘‘public,’’ which the § 450.101. rulemaking as ‘‘neighboring operations FAA would define in § 401.5, for a In proposed § 450.101(g), the FAA personnel,’’ differently than the rest of particular licensed or permitted launch would establish performance level the public who are typically visitors, or reentry, as people and property that requirements for the validity of analysis tourists, or people who are located are not involved in supporting the methods. Specifically, consistent with outside a launch site and are not aware launch or reentry. This would include the existing language in § 417.203(c) and of the hazards nor trained and prepared those people and property that may be current practice for launch and reentry to respond to them. Specifically, they located within the launch or reentry assessments, an operator’s analysis recommend that the FAA characterize site, such as visitors, individuals method would have to use accurate data neighboring operations personnel who providing goods or services not related and scientific principles and be work at a launch site as either non- to launch or reentry processing or flight, statistically valid. ‘‘Accurate data’’ public or subject to a higher level of risk and any other operator and its would continue to refer to than the rest of the public, to minimize personnel. This language is similar to completeness, exactness, and fidelity to the need to evacuate them during the current definition of ‘‘public safety’’ the maximum extent practicable. In this certain licensed operations.34 in § 401.5, which the FAA proposes to context, ‘‘scientific principles’’ would The ARC recommended: (1) delete, except that the FAA has continue to refer to knowledge based on Excluding permanently badged included reentry and permitted the scientific method, such as that personnel and neighboring launch activities in the definition.37 established in the fields of physics, operations from the definition of The second is the definition of chemistry, and engineering. An analysis ‘‘public’’; (2) revising the definition of ‘‘neighboring operations personnel,’’ based on non-scientific principles, such ‘‘public safety’’ because the current which the FAA would define in § 401.5 as astrology, would not be consistent definition is overly broad, ambiguous, as those members of the public located with this standard. A ‘‘statistically and inconsistent with other federal within a launch or reentry site, as valid’’ analysis would be the result of a agencies, including the Air Force; (3) determined by the Federal or licensed sound application of mathematics and distinguishing between ‘‘public’’ (i.e., launch or reentry site operator,38 or an would account for the uncertainty in those uninvolved individuals located adjacent launch or reentry site, who are any statistical inference due to sample outside the controlled-access not associated with a specific hazardous size limits, the degree of applicability of boundaries of a launch or reentry site or licensed or permitted operation data to a particular system, and the clustered sites within a defined Federal currently being conducted but are degree of homogeneity of the data. or private spaceport) and people who required to perform safety, security, or work regularly within the controlled- critical tasks at the site and are notified 1. Neighboring Operations Personnel access boundaries of a Federal or private of the hazardous operation. While Two of the proposed requirements in spaceport or an operator’s dedicated neighboring operations personnel would § 450.101 that do not exist in the current launch or reentry site; 35 and (4) still fall under the proposed definition regulations carve out separate employing mitigation measures for of public, this proposal would apply individual and collective risk criteria for uninvolved neighboring operations different individual and collective risk neighboring operations personnel. With personnel when a hazardous operation criteria to them. The FAA seeks the increase in operations and launch or launch is scheduled.36 comment on this approach. rate, the Air Force, NASA, and the In developing its proposal, the FAA industry have expressed concerns about 34 The Air Force requested that the FAA propose looked to NASA and Air Force the FAA’s public risk criteria because in an approach that allows certain neighboring requirements, which treat a portion of operations personnel during an FAA-licensed certain circumstances they force an launch to be assessed at the Air Force’s higher the public differently than the FAA operator to clear or evacuate any other launch essential risk criteria of 10 × 10¥6 regulations by allowing some other launch operator and its personnel not individual probability of casualty. Also, Air Force launch operators and their personnel, involved with a specific FAA-licensed and NASA members of the CSWG have asked for referred to as ‘‘neighboring operations increased flexibility with the collective risk EC for 39 operation from a hazard area or safety flight to accommodate neighboring operations personnel’’ by the Air Force and clear zone during certain licensed personnel. As one of its recommendations to the activities.33 The clearing or evacuation National Space Council in November 2017, NASA 37 The FAA would also delete the definition of of other launch operator personnel, suggested a change to operational requirements to ‘‘public’’ in § 420.5 for launch sites, which means clear employees from hazard areas during people and property that are not involved in which can range from a handful of commercial operations under an FAA license. supporting a licensed or permitted launch. The new workers to over a thousand for a 35 According to the ARC, these individuals who definition of public in § 401.5 will apply to all significant portion of a day, results in work regularly within the boundaries of a federal parts, including part 420. potential schedule impacts and lost range or private spaceport are industry workers who 38 Since neighboring operations personnel, as know and accept the risks associated with the defined in this proposal, work at a launch or reentry productivity costs to other range users. hazardous environment in which they work. site, the FAA expects that the site operator (i.e., an These impacts will increase as the 36 These mitigations might include: facility operator of a Federal site or FAA-licensed launch separation distances (e.g., separation between or reentry site), not the launch operator, would 33 To illustrate the problematic nature of the launch points on a multi-user spaceport) that identify these personnel. current risk requirements as they are applied to the anticipate and allow for safe concurrent operations; 39 The Air Force has two sub-categories of public: public, flybacks and landings of reusable boosters terms in site and use agreements with the Federal Neighboring operations personnel and the general at Cape Canaveral Air Force Station conducted or non-Federal property owner that indemnify and public. For a specific launch, the general public under an FAA license are causing operational hold harmless the government or other landlord; includes all visitors, media, and other non-essential impacts to other range users due to FAA and potential reciprocal waivers (not required by personnel at the launch site, as well as persons requirements to clear the public, including range regulation) that may be entered into among located outside the boundaries of the launch site. users not involved with the launch, to meet public neighboring operations to share risks of hazards to For the Air Force, neighboring operations personnel safety criteria. each other’s property and personnel. are individuals, not associated with the specific

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00014 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15309

‘‘critical operations personnel’’ by more likely than the rest of the public members of the public such as visitors NASA,40 to be subjected to a higher to be specially trained and prepared to or tourists—the presence of these level of risk than the rest of the public. respond to hazards present at a launch personnel at a launch or reentry site is This approach lessens the impact to or reentry site. Those hazards include necessary for security or to avoid the multiple users and enables concurrent exposure to debris, overpressure, toxics, disruption of launch or reentry activities operations at a site. The FAA’s proposed and fire. The Air Force and NASA at neighboring sites. In addition, the definition more closely aligns with the definitions specify that these personnel proposed increased risk to which these definitions of neighboring operations are either trained in mitigation personnel would be exposed is minimal. personnel and critical operations techniques or accompanied by a iii. Collective Risk Level for personnel adopted by the Air Force and properly trained escort. Note, however, Neighboring Operations Personnel NASA, respectively, because it that the FAA would not require that distinguishes neighboring operations neighboring operations personnel be Sections 417.107(b)(1) and personnel as personnel required to trained or accompanied by a trained 431.35(b)(1)(i) and (ii) currently require perform safety, security, or critical tasks escort. It would be burdensome to that for each proposed launch or and who are notified of neighboring require a licensee to ensure neighboring reentry, the risk level to the collective hazardous operations. Critical tasks may operations personnel are trained, and members of the public, which would include maintaining the security of a training is not necessary to justify the include neighboring operations site or facility or performing critical slight increase in risk allowed for personnel but exclude persons in water- launch processing tasks such as workers performing safety, security, or borne vessels and aircraft, must not ¥ monitoring pressure vessels or testing critical tasks. exceed an expected number of 1 × 10 4 safety critical systems of a launch The FAA proposal would not include casualties from impacting inert and vehicle for an upcoming mission. all permanently badged personnel on a explosive debris and toxic release Because of these specific duties, launch or reentry site as neighboring associated with the launch or reentry. neighboring operations personnel are operations personnel. While Similar to individual risk, the FAA neighboring operations personnel are proposes a separate collective risk operation or launch currently being conducted, permanently-badged personnel, criterion for neighboring operations required to perform safety, security, or critical tasks including all permanently-badged personnel in § 450.101(a)(1). This at the launch base, and who are notified of a personnel as neighboring operations proposal would permit a launch neighboring hazardous operation and are either operator to initiate the flight of a launch trained in mitigation techniques or accompanied by personnel could then include a properly trained escort. In accordance with individuals performing routine vehicle only if the total risk associated guidance information in AFSPCMAN 91–710V1, activities such as administrative, with the launch to all members of the neighboring operations personnel may include maintenance, or janitorial duties. These public, excluding neighboring individuals performing launch processing tasks for operations personnel and persons in another launch, but do not include individuals in individuals are not necessary for critical training for any job or individuals performing tasks. Unlike for neighboring operations aircraft, does not exceed an expected ¥ routine activities such as administrative, personnel, the disruption to routine number of 1 × 10 4 casualties. maintenance, support, or janitorial. AFSPCMAN activities does not sufficiently justify Additionally, a launch operator would 91–710V1 can be found at https://static.e- be permitted to initiate the flight of a publishing.af.mil/production/1/afspc/publication/ allowing these individuals to remain on afspcman91-710v1/afspcman91-710v1.pdf. The Air site during hazardous operations. launch vehicle only if the total risk Force may allow neighboring operations personnel associated with the launch to to be within safety clearance zones and hazardous ii. Individual Risk Level for Neighboring neighboring operations personnel did Operations Personnel launch areas, and neighboring operations personnel not exceed an expected number of 2 × would not be evacuated with the general public. ¥4 The Air Force includes neighboring operations Currently, for ELVs, the individual 10 casualties. These risk criteria personnel in the same risk category as launch- risk criterion for the public in would also apply to reentry. essential personnel. The allowable collective § 417.107(b)(2) allows a launch operator These proposed requirements would aggregated risk for launch essential personnel is 300 to initiate flight only if the risk to any enable neighboring operations × 10¥6 and the allowable individual risk for launch essential personnel is 10 × 10¥6. individual member of the public does personnel to remain within safety clear × ¥6 40 NASA, for the purposes of range safety risk not exceed 1 10 per launch for each zones and hazardous launch areas management, defines public as visitors and hazard. Part 431 is similar for an RLV during flight. Additionally, neighboring personnel inside and outside NASA-controlled mission. Thus, any person not involved operations personnel would not be locations who are not critical operations personnel in supporting a launch or reentry, or mission essential personnel and who may be on required to evacuate with the rest of the land, on waterborne vessels, or in aircraft. Similar whether within or outside the bounds of public as long as their collective risk ¥ to the Air Force’s definition of neighboring the launch or reentry site, are required does not exceed 2 × 10 4. The rationale operations personnel, NASA considers critical to have a risk of casualty no higher than is the same as that for individual risk. operations personnel to include persons not 1 × 10¥6 per launch or reentry for each essential to the specific operation (launch, reentry, While the FAA proposal would add a flight) being conducted, but who are required to hazard. separate collective risk limit for perform safety, security, or other critical tasks at the The FAA proposes in § 450.101(a)(2) neighboring operations personnel, the launch, landing, or flight facility; are notified of the a higher individual risk criterion of 1 × collective risk limit for the public other ¥ hazardous operation and either trained in 10 5 for neighboring operations than neighboring operations personnel mitigation techniques or accompanied by a properly ¥ × 6 × ¥4 trained escort; are not in training for any job or personnel compared to 1 10 for the would not be able to exceed 1 10 individuals performing routine activities such as rest of the public for launch and reentry. for flight. administrative, maintenance, or janitorial activities; Although neighboring operations and may occupy safety clearance zones and personnel would still fall under the iv. Maximum Probably Loss (MPL) hazardous areas, and are not evacuated with the FAA’s definition of public, this proposal Thresholds for Neighboring Operations public. NASA includes critical operations Personnel personnel in the same risk category as mission would establish a higher risk threshold essential personnel. For flight, the allowable for neighboring operations personnel as Under a license, an operator must collective aggregated risk for the combination of compared to other members of the obtain liability insurance or mission essential personnel and critical operations personnel is 300 × 10¥6 and the allowable public. This proposal would permit demonstrate financial responsibility to individual risk for mission essential or critical neighboring operations personnel to compensate for the maximum probable operations personnel is 10 × 10¥6. remain on site because—unlike other loss from claims by a third party for

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00015 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15310 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

death, bodily injury, or property damage thresholds reflects the government’s begin at the start of preflight ground or loss.41 For financial responsibility acceptance of greater risk in supporting operations that pose a threat to the purposes under 14 CFR part 440, launch and reentry activities than that public, which could be when a launch neighboring operations personnel accepted by the uninvolved public.43 vehicle or its major components arrive qualify as third parties.42 Thus, allowing The FAA proposes, for the purpose of at a U.S. launch site, or at a later point neighboring operations personnel to determining MPL, that the threshold for as agreed to by the Administrator.44 remain within hazard areas has the neighboring operations personnel be the Scoping preflight ground operations to potential to increase the maximum same as the threshold for losses to only those that require FAA oversight probable loss, and therefore the amount government property and involved would alleviate many of the previously- of third party liability insurance that a government personnel, such that losses discussed issues associated with licensee would be required to obtain. to neighboring operations personnel neighboring operations personnel. However, this would be fully or would have a probability of occurrence partially mitigated by changing the of no less than 1 × 10¥5. This approach 2. Property Protection (Critical Assets) threshold value used to determine MPL would be appropriate because unlike Another proposed requirement in for neighboring operations personnel. other third parties, except for involved § 450.101 that does not exist in the The MPL is the greatest dollar amount government personnel, the presence of current regulations is the proposal to of loss that is reasonably expected to neighboring operations personnel at a adopt a critical asset protection criterion result from a launch or reentry. Current launch or reentry site is necessary for in proposed § 450.101. To better inform regulations define what is reasonable by security or to avoid the disruption of this proposed requirement, the FAA establishing probability thresholds: launch or reentry activities at • would also amend § 401.5 to add a Losses to third parties that are neighboring sites. The presence of definition of critical asset. Specifically, reasonably expected to result from a neighboring operations personnel licensed or permitted activity are those during licensed activities would not the probability of loss of functionality that have a probability of occurrence of for each critical asset would not be able influence the MPL value for third-party ¥ no less than one in ten million. to exceed 1 × 10 3, or a more stringent • liability in most cases because, as Losses to government property and discussed above, the 1 × 10¥5 threshold probability if the FAA determines, in government personnel involved in would capture fewer events and consultation with relevant federal licensed or permitted activities that are therefore have less of an influence on agencies, it is necessary to protect the reasonably expected to result from MPL. The FAA seeks comment on this national security interests of the United licensed or permitted activities are those approach. States. This requirement is necessary to that have a probability of occurrence of ensure a high probability of the no less than one in one hundred v. Ground Operations Pertinent to continuing functionality of critical thousand. Neighboring Operations Personnel assets. A critical asset would be defined Therefore, for any launch or reentry, For ground operations, the FAA as an asset that is essential to the there should only be a 1 in 10,000,000 currently does not have, nor is it national interests of the United States, × ¥7 (1 10 ) chance that claims from third proposing at this time, quantitative as determined in consultation with parties would exceed the MPL value, public risk criteria for neighboring relevant federal agencies. Critical assets × ¥5 and a 1 in 100,000 (1 10 ) chance operations personnel or the rest of the would include property, facilities, or that claims from the government for public. As will be discussed in greater infrastructure necessary to maintain government property loss would exceed detail later, an operator would conduct national defense, or assured access to the MPL value. Because it is much less a ground hazard analysis to derive space for national priority missions. likely that claims from third parties ground hazard controls. This analysis Critical assets would also include would exceed the MPL value, the FAA’s would be a qualitative, not quantitative. certain military, intelligence, and civil calculation of MPL takes into account a Thus, there would be no quantitative payloads, including essential larger number of rare events that could criteria to treat neighboring operations infrastructure when directly supporting result in a third party claim than could personnel differently than other the payload at the launch site. Under result in a government property claim. members of the public during ground this proposal, the FAA anticipates that And, because the MPL calculation for operations. An operator would be it would work with relevant authorities, third party liability involves expected to use hazard controls to including a launch or reentry site consideration of more events related to contain hazards within defined areas operator or Federal property owner, to non-government personnel third party and to control public access to those identify each ‘‘critical asset’’ and its losses than events related to government areas. An operator may use industry or potential vulnerability to launch and personnel losses, non-government third government standards to determine reentry hazards. party losses are more likely to influence proper mitigations to protect the public, the MPL calculation. The difference in including neighboring operations 44 The clause ‘‘as agreed to by the Administrator’’ personnel, from hazards. The impact on is used throughout the proposed regulations, 41 An operator must also obtain liability insurance particularly in relation to timeframes discussed in or demonstrate financial responsibility to neighboring operations personnel detail later in this preamble. Where the clause is compensate the U.S. Government for damage or loss during ground activities should be used, it means that an operator may submit an to government property, but this is not affected by minimal. alternative to the proposed requirement to the FAA the neighboring operations personnel proposal. Additionally and as discussed later, for review. The FAA must agree to the operator’s 42 Title 51 U.S.C. 50902 defines third party as a proposal in order for the operator to use the person except the U.S. Government or its the FAA is proposing that launch would alternative. By whatever means the FAA’s contractors or subcontractors involved in the agreement to an alternative is communicated to the launch or reentry services; a licensee or transferee 43 Subject to congressional appropriation, the operator, the agreement means that the alternative under Chapter 509 and its contractors, Federal Government indemnifies a launch or does not jeopardize public health and safety and the subcontractors or customers involved in launch or reentry operator for claims above the insured FAA has no objection to the submitted alternative. reentry services; the customer’s contractors or amount up to $1.5 billion, adjusted for inflation Unless the context of the situation clearly provides subcontractors involved in launch or reentry from January 1989 (approximately $3 billion as of otherwise, ‘‘as agreed to by the Administrator’’ does services; or crew, government astronauts, or space 2016). The lower the threshold used for calculating not simply mean receipt by the FAA (i.e., that the fight participants. Section 440.3 incorporates this MPL, the greater chance that the Federal item was given to a representative of the FAA and definition into the regulations. Government may need to indemnify a licensee. that person received it on behalf of the FAA).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00016 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15311

The FAA’s existing risk criteria, infrastructure used to serve high priority time frame for its replacement would currently found in §§ 417.107(b) and NASA missions as well. For example, adversely affect the national interests of 431.35(b), do not explicitly set any limit the FAA considers launch and reentry the United States. Critical payloads may on the probability of loss of services to deliver cargo to and from the include vital national security payloads, functionality for any assets on the International Space Station as national and high-priority NASA and NOAA surface of the Earth due to launch or priority missions. As another example, payloads. For example, a payload such reentry operations. An example of loss the launch infrastructure used by as NASA’s Curiosity rover would likely of functionality would be if a launch SpaceX to launch the Falcon 9 from be afforded this protection. The higher vehicle crashed on a nearby launch Kennedy Space Center is within 2 nm protection criterion would have complex and resulted in damage that of the launch infrastructure used by safeguarded those payloads of utmost prevented the use of the launch ULA to launch the Atlas V, which are importance to the United States complex until repaired. Currently, FAA both used to support commercial meriting a greater degree of protection requirements provide some protection operations and operations that serve the than other critical assets. The specific 1 for the safety of property during launch national interests of the United States. × 10¥4 criterion would apply to those or reentry by limiting individual and The FAA coordinated the development national priority payloads at a launch or collective risks because people are of this proposed critical asset protection reentry site, including essential generally co-located with property. requirement with NASA, the infrastructure when directly supporting However, no protection is afforded for Department of Defense, and the the payload. A federal agency would assets within areas that are evacuated. Intelligence Community. identify payloads meeting the definition The proposed property protection Furthermore, the proposed property of ‘‘critical payload’’ as warranting criteria would be consistent with protection requirement would also help protection at the 1 × 10¥4 level. These current practice at Federal launch achieve the goal of common standards may include commercial payloads that ranges. Launch operations from NASA- for launches from any U.S. launch site, meet the national interest described operated ranges are subject to Federal or non-Federal. Common above. requirements that limit the probability standards are public safety related The FAA opted to not include this of debris impact to less than or equal to requirements and practices that are higher protection criterion due to 1 × 10¥3 for designated assets. While consistently employed by the Air Force, uncertainty about its impact on future the Air Force does not have a formal the FAA, and NASA during launch and launch or reentry operations. Therefore, requirement, in practice, launch reentry activities. Common standards in order to properly analyze this operations from Air Force-operated would provide launch and reentry request, the FAA requests comment on ranges have adopted the NASA operators certainty in planning and the following: standard. In the past, Federal launch enable a body of expertise to support (1) If the FAA adopted the more- ranges have, on occasion, applied a those standards. stringent 1 × 10¥4 criterion for critical more stringent requirement limiting the Finally, the proposed property payloads, what impacts would it have probability of debris impact caused by protection standards would apply to all on your operation? launch or reentry hazards to less than or FAA-licensed launches, whether to or (2) Should FAA consider applying equal to 1 × 10¥4 for national security from a Federal launch range or a non- this more-stringent criterion to any payloads, including essential Federal launch or reentry site. Applying commercial payload? Please provide infrastructure when directly supporting the provision to non-Federal sites would specific examples and rationale. the payload at the launch site. The FAA ensure continuity in the protection of (3) If this criterion is applied to is looking to extend the protection of critical assets and that the probability of commercial space launch and reentry critical assets to non-Federal launch or loss of functionality of critical assets is operations, what would be the reentry sites. The Pacific Spaceport the same for all commercial launch and additional, incremental costs and (located on Kodiak Island, Alaska) is an reentry operations. The FAA sees no benefits on your current and future example of a non-Federal launch or reason for imposing different standards operations compared to the proposed 1 reentry site that is a dual-use of safety for critical assets based on × 10¥3 criterion? Specifically, the FAA commercial and military spaceport whether a launch takes place from a requests information and data to (meaning that commercial missions non-Federal launch site or from a quantify additional costs and benefits of have been conducted there, as well as Federal launch range, especially in light this criterion compared to the proposed missions for the Department of Defense), of the fact that some non-Federal sites 1 × 10¥3 criterion. Please provide which has no regulatory assurance of are dual use, supporting both sources for information and data protection from loss of functionality of commercial and military operations. provided. critical assets. During the interagency review 3. Consequence Protection Criteria for For these reasons, the FAA has process, the Department of Defense determined that a requirement to requested and the FAA considered Flight Abort and Flight Safety System maintain a high probability of specifying a more stringent criterion for This proposal would expand the continuing functionality of critical certain critical assets of utmost FAA’s use of consequence criteria to assets at a launch site is necessary to importance. This subcategory of critical protect the public from an unlikely but ensure the safety of property and assets would be known as critical catastrophic event. Proposed national security interests of the United payloads. Specifically, the FAA § 450.101(c) would require that States. Launch and reentry considered requiring the probability of operators quantify the consequence of a infrastructure used for commercial loss of functionality for critical catastrophic event by calculating CEC operations are increasingly in close payloads, including essential for any one-second period of flight. proximity to critical assets, such as infrastructure when directly supporting Unlike EC that determines the expected infrastructure used to support the the payload at the launch site, not casualties factoring in the probability ¥4 national interests of the United States. exceed 1 × 10 . The FAA considered that a dangerous event will occur, CEC The national interests of the U.S. defining a critical payload as a critical determines the expected casualties relevant to this proposal go beyond asset that (1) is so costly or unique that assuming the dangerous event will national security interests, and include it cannot be readily replaced, or (2) the occur. In essence, it represents the

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00017 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15312 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

consequence of the worst foreseeable issue numerous waivers to these approach proven to address concerns of events during a launch or reentry. The requirements to accommodate the fast- low probability/high consequence FAA proposes to use CEC to determine evolving commercial space industry. event. The ARC only identified risk as the need for flight abort with a reliable The need for waivers has been partially a means of scaling FSS requirements FSS as a hazard control strategy, to set driven by changes to Air Force and did not recommend specific risk reliability standards for any required requirements, which diverged from FAA thresholds.52 FSS, and to determine when to initiate regulations beginning in 2013.47 For In light of the shortcomings identified a flight abort. In other words, the more example, the FAA has repeatedly by the FAA and ARC recommendations, severe the potential consequences from waived its requirement to activate an the FAA agrees that the FAA’s FSS an unplanned event, the more stringent FSS to ensure no debris greater than 3 requirements should be scaled. For that the flight abort requirements. pounds per square foot (psf) ballistic reason, the FAA proposes to use The current ELV flight abort coefficient 48 reaches protected areas.49 consequence to determine the need for regulations are essentially a one-size- In granting these waivers, the FAA has an FSS, the required FSS reliability, and fits-all approach. In practice, the current adopted the conditional risk when to activate an FSS. requirement in § 417.107(a) requires an management approach, noting that the To determine whether or not an FSS FSS for any orbital launch vehicle to predicted consequence was below a is needed, an operator would be ¥2 prevent hazards from reaching protected threshold of 1 × 10 CEC. The FAA has required to calculate CEC in any one areas at all times during flight. concluded that measuring the second period of flight. The calculation Regardless of the individual and consequence from reasonably of CEC can range from a straightforward collective risks, or the consequences in foreseeable, albeit unlikely, failures is product of the effective casualty area the case of a catastrophic event, all FSSs an appropriate metric to assess prudent and the population density to a high must satisfy part 417, subparts D and E, mitigations of risks to public health and fidelity analysis.53 Proposed requirements.45 These include safety and the safety of property.50 § 450.101(c) would require, at a reliability requirements (0.999 reliable The ARC also made recommendations minimum, that an operator compute the at 95 percent confidence) 46 and with respect to flight abort and FSS effective casualty area and identify the extensive testing requirements. Besides requirements. It recommended the FAA population density that would be requiring a potentially expensive FSS, tier the level of rigor for FSSs into three impacted for each reasonably the part 417 hazard control approach risk categories. In relevant part, ARC foreseeable vehicle response mode in also has the potential to limit vehicle members proposed that the lowest risk any one-second period of flight in terms flight paths unnecessarily, even when category not require an FSS, that the of CEC. The casualty area, population those flight paths would produce low medium risk category require density, and predicted consequence for public risks and consequences. This streamlined FSS test requirements (e.g., each vehicle response mode are preamble will discuss these areas in reduce from three to one qualification intermediate quantities that are further detail later. units) and not require configuration and necessary to demonstrate compliance The FAA also recognizes risk management, and the highest risk with the individual and collective risk shortcomings in its current part 431 category require a Range Commanders criteria currently, thus these new hazard control approach. Part 431 does Council (RCC) 51 319-compliant FSS. It requirements would not necessarily not expressly require the use of an FSS also suggested the highest risk category impart significant additional burden on to manage hazards. Rather, § 431.35(c) could use another operational or design operators. requires a system safety process to The FAA is proposing to rely on CEC identify hazards and assess the risk to 47 The FAA regulations and Air Force rather than EC to determine whether or public health and safety and the safety requirements regarding flight abort were virtually of property. The system safety approach identical from the time part 417 was promulgated 52 ARC Report at p. 12. has consistently resulted in the use of in 2006 until 2013 when the Air Force provided 53 The FAA referenced the need to prevent a high permanent relief from the requirement for impact consequence event in its evaluation of a 2016 an FSS as a hazard control strategy. In limit lines to bound where debris with a ballistic waiver request, which enabled the first Return to practice, the FAA has applied part 417 coefficient greater than 3 pounds per square foot Launch Site (RTLS) mission (Orbcomm-2). FSS requirements to part 431 to ensure can impact if the FSS works properly. The Air Specifically, the FAA noted that the 3 psf ballistic proper reliability and flight abort rules. Force cited an ELOS determination when it issued coefficient requirement of § 417.213(d) was the permanent relief, stating that the public risk intended to (1) capture the current practice of the Part 417 FSS requirements have criteria would still apply. U.S. Air Force, (2) provide a clear and consistent proven difficult to scale to different 48 Ballistic coefficient is a measure of an object’s basis to establish impact limit lines to determine operations. Indeed, the FAA has had to ability to overcome air resistance, and it is defined the occurrence of an accident as defined by § 401.5, as the gross weight in pounds divided by the frontal and (3) help prevent a high consequence to the 45 area of the vehicle (in square feet) times the public given FSS activation. As part of the waiver Part 417 sets specific FSS requirements rationale, the FAA cited the longstanding governing covering general command control system coefficient of drag. 49 Waiver of Debris Containment Requirements principle applied to launch safety: ‘‘to provide for requirements, command control system testing, FSS the public safety, the Ranges, using a Range Safety support systems, FSS analysis, and flight safety for Launch. 81 FR 1470, 1470–1472 (January 12, 2016). Program, shall ensure that the launch and flight of crew roles and qualifications. launch vehicles and payloads present no greater 46 50 Using consequence as safety criteria in FAA Section 417.309 requires that each onboard risk to the general public than that imposed by the commercial space regulations is not without flight termination system and each command over-flight of conventional aircraft.’’ (Eastern and control system must have a predicted reliability of precedent. Section 431.43(d) sets a limit for Western Range 127–1, Range Safety Requirements, 0.999 at the 95 percent confidence level when foreseeable public consequences in terms of CEC, Oct. 31, 1997) The waiver rationale also cited an operating, as well as predicted reliability of 0.999 but only for an unproven RLV. Section 431.43(d) analysis of 30 years of empirical evidence provided at the 95 percent confidence for multiple provides that an unproven RLV may only be by the NTSB that showed that the public safety component systems such as the ordnance train to operated so that during any portion of flight, the consequence associated with general aviation × propagate a charge, any safe-and-arm device, and expected number of casualties does not exceed 1 × ¥2 ¥ accidents is 1 10 expected fatalities. The FAA’s ordinance interrupters and initiators. As these 10 4 given assuming a vehicle failure will occur at analysis demonstrated that the consequence of component systems define the reliability of the FSS any time the instantaneous impact point is over a events that could produce debris outside of the and approximate the design reliability of the entire populated area. impact limit lines was consistent with the threshold 51 ¥2 flight safety system, for the purpose of the preamble The Range Commanders Council addresses the of 1 × 10 CEC, even with input data the current requirements are discussed as requiring common concerns and needs of operational ranges corresponding to the worst-case weather conditions. an FSS to have predicted reliability of 0.999 at a within the United States. It works with other Thus, the FAA concluded that the waiver would 95 percent confidence level. This will be discussed government departments and agencies to establish not jeopardize public health and safety or the safety later in the preamble in further detail. various technical standards to assist range users. of property.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00018 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15313

not an FSS is needed because FAA also rooted in the longstanding and invites comments on this approach in believes it is the best approach to often cited principle that launch and general, as well as the specific implement the ARC’s recommendation reentry should present no greater risk to thresholds proposed. that the FAA treat high consequence the public than that imposed by the Lastly, proposed § 450.125 (Gate events differently than lower over-flight of conventional aircraft. The Analysis), in paragraph (c), would limit consequence events. As noted earlier, Air Force, the RCC, and an American the predicted average consequence from the ARC recommended a three tiered National Standard (ANSI/AIAA S–061– flight abort resulting from a failure in approach—high risk would require a 1998) 57 58 have identified the public any one-second period of flight to 1 × ¥2 highly reliable FSS, medium risk would risks posed by conventional aircraft as 10 CEC. Flight abort will be discussed require an FSS with more streamlined an important benchmark for the in more detail later in the preamble. requirements, and low risk would acceptable risks posed by launch require no FSS. The FAA’s approach of vehicles. Like commercial space B. System Safety Program using a consequence analysis instead of operations, civil aviation poses an Proposed § 450.103 (System Safety a risk analysis would use the same involuntary hazard to the public on the Program) would require an operator to factors as used in a risk analysis, such ground. Therefore, the FAA looked to implement and document a system as casualty area, population density, this risk to the public on the ground to safety program throughout the lifecycle and predicted consequence for each derive consequence limits for of a launch or reentry system that vehicle response. commercial space activities. The FAA includes at least the following: (1) Proposed § 450.145 (Flight Safety analyzed National Transportation Safety Safety organization, including a mission System), in paragraph (a), would require Board (NTSB) aviation accident data director and safety official; (2) an operator to employ an FSS with and determined that the average procedures to evaluate the operational design reliability of 0.999 at 95 percent consequences on the ground from all lifecycle of the launch or reentry system confidence and commensurate design, fatal civil aviation accidents are 0.06 to maintain current preliminary safety analysis, and testing if the consequence casualties and 0.02 fatalities. The assessments and any flight hazard of any vehicle response mode is 1 × average ground fatality of an airline analyses; (3) configuration management ¥2 10 CEC or greater, consistent with the crash is 1, and of a general aviation and control; and (4) post-flight data 59 current FSS requirements in part 417.54 crash is 0.01. The proposed threshold review. Due to the complexity and If the consequence of any vehicle appears reasonable given this range of variety of vehicle concepts and ¥ response mode is between 1 × 10 2 and aviation related accident consequences. operations, a system safety program ¥3 The FAA proposes a threshold of 1 × 1 × 10 CEC, the required design ¥3 would be necessary to ensure that an reliability would be relaxed to no lower 10 CEC as a metric for determining operator considers and addresses all than 0.975 at 95 percent confidence 55 the need for any FSS. This is an order risks to public safety. of magnitude less than the threshold with commensurate design, analysis, Currently, parts 415 and 417 have a that determines the need for a highly- and testing requirements necessary to more prescriptive philosophy of flight reliable FSS, and which is scaled to the support this reliability. If the CEC is less safety hazard mitigation. While the than 1 × 10¥3, and the individual and reliability of the required FSS. Combined with the individual risk and requirements ensure safety, they neither collective risk criteria are met, an provide the flexibility needed to address operator would not be required to have cumulative risk thresholds, the FAA believes that this proposed threshold the diverse and dynamic nature of an FSS. The FAA coordinated with today’s commercial space transportation NASA and the Department of Defense in would ensure public safety. The use of a consequence metric is industry nor address the unique aspects the Common Standards Working Group consistent with the ARC comments. The of non-traditional launch and reentry to arrive at this proposal. ARC suggested that an FSS with a vehicles. For example, except for An RCC 319-compliant FSS would reliability of 0.999 at 95 percent unguided suborbital launch vehicles, it only be required for any phase of flight ¥ confidence is appropriate for high is virtually impossible for operations in which the CE exceeds 1 × 10 2. This C consequence, low probability events that can reach populated areas but that threshold is consistent with past and a lower reliability could be do not use an FSS to comply with parts precedent, FAA waivers, and U.S. acceptable under the right 415 and 417. Government consensus standards. Other circumstances. The FAA notes that the Regulations applicable to reentry and government entities use a consequence RLVs in part 431 expressly established × ¥2 ARC did not identify any threshold threshold of 1 10 to protect against system safety requirements as a flexible 56 values to define ‘‘high consequence’’; explosive hazards. This threshold is however, the proposal does identify approach to approving a safety process that encompasses design and operation. 54 specific quantitative consequence Sections 417.303 and 417.309. Section 431.33 sets the requirements for 55 In statistics, a confidence interval is the range thresholds in terms of CEC. The FAA of values that includes the true value at a specified the maintenance and documentation of confidence level. A confidence level of 95% is and thus enforces a consequence limit of no more a safety organization. Specifically, it commonly used which means that there is a 95% than 1 × 10¥2 conditional expected fatalities requires: (1) The identification of lines chance that the true value is encompassed in the (NASA–STD–8719.12A—2018–05–23, p. 63). of communication and approval interval. 57 Waiver of Debris Containment Requirements 56 The Department of Defense, NASA, and the for Launch. 81 FR 1470 (January 12, 2016), at 1470– authority for all mission decisions FAA use quantity-distance limits originally 1472. possibly affecting public safety designed to limit conditional individual risk of 58 According to ANSI/AIAA S–061–1998, ‘‘during including internal and external lines of fatality to 1 × 10¥2 from inert debris fragment the launch and flight phase of commercial space communication with the launch or impacts. They define minimum separation vehicle operations, the safety risk for the general distances between potential sources of high speed public should be no more hazardous than that reentry site to ensure compliance with fragments (propelled by accidental explosions) and caused by other hazardous human activities (e.g., required plans and procedures; (2) the areas with exposed personnel to ensure no more general aviation over flight).’’ designation of a person responsible for than one hazardous fragment impact per 600 sqft, 59 The FAA looked at NTSB data on injuries and conducting all licensed RLV mission with the assumption that any exposed person has fatalities of people on the ground from fatal civil activities; and (3) designation of a a vulnerable area of 6 sqft. NASA only permits aviation accidents (where an occupant of the inhabited buildings at closer distances if proved aircraft died) for the 30-year period between 1984 qualified safety official by name, title, sufficient to limit hazardous debris to 1/600 sqft, and 2013. and qualifications.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00019 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15314 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

Section 431.35(c) specifically requires means of scoping requirements to communicating safety concerns the use of a system safety process to vehicle hazards and potential effectively throughout the organization. identify hazards and assess the risks to population exposure. The FAA agrees This proposal would allow for one public health and safety and the safety that the system safety process should person, or several, to perform the safety of property and to demonstrate form the core of its safety requirements official’s functions. Unlike current compliance with the acceptable risk as a means of making the safety regulations, an operator would not have criteria.60 It also incorporates core requirements more flexible for novel to name a specific safety official in its components of a hazard analysis. operations and processes. license application. Instead, an operator Section 431.35(d) requires several Proposed § 450.103 lists the minimum would be required to designate a deliverables to demonstrate compliance components all operators would be position to accomplish the necessary with acceptable risk criteria and a required to have in their system safety tasks of a safety official. The FAA seeks compliant system safety process. programs to protect public health and comment on this approach, and whether Despite the explicit deliverables, the safety and the safety of property. Part it provides an appropriate level of structure of the regulation has proved to 431 established a process-based flexibility to industry. be confusing for applicants. For requirement for a system safety program Many operators have complained instance, some system safety analysis but did not define its components or a about the burden of naming a specific element requirements are intermixed safety standard. This lack of definition safety official in a license application. with vehicle design element has led to many operators establishing One challenge is that, in many cases, an requirements. Similarly, general system safety programs that are missing operator applies for a license before information requirements such as the components necessary for public safety. selecting a safety official. As such, many identification of hazardous material can This lengthened some applicants’ pre- operators must submit a modification of be found listed with unrelated application consultation and the license their application once they have chosen requirements such as the description of application evaluation process. The a safety official. Another issue is that the RLV. The inclusion of these FAA intends to further define the operators that conduct activities at a elements in the section governing system safety program to lessen the frequent rate must employ several system safety has led applicants to potential for misunderstandings persons that serve as safety officials to produce application deliverables that between applicants and the FAA. This keep pace with their operations. These were scattered and not easily proposal should allow potential persons may serve as safety officials on understood by the FAA. Also, some less operators to design system safety several different types of operations on experienced applicants did not programs that better address public multiple licenses. Therefore, the understand that the regulation required safety concerns prior to license operator must frequently submit license a system safety analysis and provided application submittal. application modifications every time it selects a new person to serve in that general information and an informal 1. Safety Organization assessment of how that general capacity. An operator is further information may have affected public Proposed § 450.103(a) would require burdened when safety officials leave the safety. an operator to maintain and document launch operator’s organization or The ARC made specific suggestions a safety organization with clearly assume a new role within the on the role of system safety in the FAA’s defined lines of communication and organization that would prohibit them safety regulatory scheme. It approval authority for all public safety from serving as a safety official. The recommended the FAA use a system decisions. This safety organization FAA believes a safety organization that safety process at the core of its safety would include at least two positions, includes a safety official is essential to requirements to identify hazards and referred to as a mission director and a public safety; however, identifying that develop hazard control strategies that safety official. The mission director individual by name is not necessary. are verified by means of an FSA, would be responsible for the safe Under the proposal, the operator relevant operational constraints, and conduct of all licensed activities and would still be required to designate a means of meeting those constraints. It authorized to provide final approval to safety official for any licensed activity noted the FAA could provide better proceed with licensed activities. The prior to the start of that activity. The 61 detail on its safety requirements. For safety official would be required to FAA has previously noted that licensed instance, § 431.35(c) could be expanded communicate potential safety and non- ground operations have commenced to include risk-informed decision compliance matters to the mission without designating a safety official. making and continuous risk director during flight and ground Many applicants mistakenly assumed management requirements. It further operations. The safety official would the safety official was only necessary for suggested the FAA incorporate varying also be authorized to examine all flight operations. These operators levels of rigor that would scale required aspects of an operator’s ground safety conducted preflight ground operations verification requirements, like test plans and flight safety operations. It is in advance of flight without a safety and performance results, by vehicle, common practice in any safety official monitoring the operation. This operator category, and relative risk as a organization, including those within the proposal would require a safety official commercial space industry, to establish for all licensed operations to who will be responsible for ensuring 60 Section 431.35(c) also fails to provide a independently monitor licensed activity detailed description of the composition of a safety and to have clear processes for to ensure compliance with the compliant system safety process. This lack of detail operator’s safety policies. Additionally, has often led to the submission of deficient 61 In 1999, the FAA added the requirement for a the safety official would report directly applications because the applicant failed to safety official possessing authority to examine to the mission director. The absence of demonstrate that the system safety process was launch safety operations and to monitor adequate to meet public safety requirements and independently personnel compliance with safety a safety official could result in a lack of therefore the FAA did not find the application to policies and procedures. The FAA stated in the independent safety oversight and a be complete enough for acceptance. The ARC noted preamble to the final rule that the person potential for a break down in the confusion around the FAA’s evaluation of an responsible for safety should have the ability to communications of important safety- application’s system safety submission and perform independently of those parts of the recommended changing the regulation to increase applicant’s organization responsible for mission related information. The FAA would regulatory certainty. assurance. 64 FR 19604 (April 21, 1999). continue to inspect licensed operations

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00020 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15315

to ensure that a safety official is in place The FAA expects that an operator predicted limits. Flight safety systems throughout the course of the licensed would design configuration are examples of safety-critical systems activity. management and control into its that could jeopardize public safety if operations. The FAA also expects that they do not perform nominally. 2. Procedures an operator would provide the Proposed § 450.103(d)(4) would Proposed § 450.103(b) would require capability to both alert responsible require an operator to address any that an operator establish procedures to individuals when key documentation anomaly identified in proposed evaluate hazards throughout the must be updated and ensure that all § 450.103(d)(3). Prior to the next flight, complete operational lifecycle of a stakeholders—internal and external to an operator would be required to program. This is important because the launch operator’s organization—are address each anomaly by, at a design and operational changes to a using current and accurate information. minimum, updating any flight hazard system can have an impact on public analysis, flight safety analysis, or safety safety. This proposed requirement was 4. Post-Flight Data Review critical system. implied in § 431.35(c) but was not Proposed § 450.103(d) would require The FAA seeks comment on whether explicitly stated. Specifically, that an applicant conduct a post-flight proposed § 450.103(d) would change an § 450.103(b) would require the operator data review. The proposed requirements operator’s approach to reviewing post- to implement a process to update the in § 450.103(d) are not explicitly flight data. preliminary safety assessment and any contained in part 415, 417 or 431. 5. Application Requirements flight hazard analysis to reflect the However, it is industry practice to knowledge gained during the lifecycle review post-flight data to address Proposed § 450.103(e) would set the of the system. To accomplish this, an vehicle reliability and mission success, system safety program application operator would be required to establish so any added burden from proposed requirements. An applicant would be methods to review and assess the § 450.103(d) would be minimal. required to provide a summary of how validity of the preliminary safety Operator review of post-flight data it plans to satisfy the system safety assessment and any flight hazard provides valuable safety information on program requirements. It is currently analysis throughout the operational future operations, particularly the common practice for applicants to lifecycle of the launch or reentry identification of anomalies. At a provide the FAA with a system safety system. An operator would also need to minimum, proposed § 450.103(d)(1) program plan or documents containing have methods for updating the would require that an operator employ the necessary information to determine assessment or analysis, and to a process for evaluating post-flight data compliance with the system safety communicate the updates throughout its to ensure consistency between the program requirements in § 431.35(c). A organization. For any flight hazard assumptions used for the preliminary system safety program plan that covers analysis, an operator would also have to safety assessment, any flight hazard or the elements in § 450.103(e) would have a process for tracking hazards, flight safety analysis, and associated satisfy the proposed application risks, mitigation and hazard control mitigation and hazard control measures. requirements. The FAA also measures, and verification activities. Proposed § 450.103(d)(2) would recommends an applicant consult with require that an operator resolve any the FAA during the development of its 3. Configuration Management and inconsistencies identified in proposed system safety program prior to Control § 450.103(d)(1) prior to the next flight of implementation. Proposed § 450.103(c) would lay out the vehicle. The FAA expects that the With respect to the safety configuration management and control operator would address any organization, an applicant would be requirements. The FAA has chosen to inconsistencies by updating analyses required to describe the applicant’s consolidate configuration management using the best available data for the safety organization, identifying the and control requirements within the upcoming mission, or documenting the applicant’s lines of communication and system safety program requirements. rationale explaining how changes to the approval authority, both internally and Requirements addressing configuration data inputs would not have an impact externally, for all public safety decisions control were previously scattered on the results of the analysis for a and the provision of public safety throughout the regulations, including in proposed mission. The FAA would add services. In the past, many applicants §§ 417.111(e), 417.123(e)(2), 417.303(e), this requirement to ensure that the have chosen to provide an organization and 417.407(c). Operators frequently operator makes all appropriate updates chart depicting the safety organization. make changes to their vehicles, such as to the analysis identifying all public The FAA encourages the continuation of new manufacturing techniques for a safety impacts in order to avoid this practice. However, the applicant component or changes to the materials inconsistencies in future missions that would be required to provide a on key structures. Operators may also could jeopardize public safety. sufficient narrative describing the make operational changes such as new Proposed § 450.103(d)(3) would organization, particularly the lines of analysis techniques, automating require that an operator identify any communication. For example, if an processes that were previously anomaly that may impact the flight engineer in the safety organization conducted by personnel, or changing hazard analysis, flight safety analysis, becomes aware of a hazard, the the surveillance techniques in hazard safety critical system, or is otherwise applicant should describe how that areas. These types of changes can have material to public safety and safety of engineer would communicate that significant impacts on public safety. property. An examination and hazard to the safety official. This proposal would require an understanding of launch or reentry An applicant would also be required operator to track configurations of all vehicle system and subsystem to provide a summary of the processes safety-critical systems and anomalies throughout the lifecycle of and products identified in the system documentation, ensure the correct and the vehicle system can alert an operator safety program requirements. The FAA appropriate versions of the systems and of an impending mishap. An operator expects that processes would be scalable documentation are used, and maintain should review post-flight data to based on the size of the operation or the records of system configurations and identify unexpected issues or critical potential public safety impacts of the versions used for each licensed activity. systems that are operating outside of proposed operation. For example, an

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00021 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15316 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

applicant with a dozen employees and Under proposed § 450.105(a), an engineering judgement to develop the a relatively small launch or reentry acceptable PSA would identify at least preliminary hazard list. vehicle may use meetings or less formal the following key elements: (1) The An operator should describe hazards ways to develop its preliminary hazard vehicle response modes; (2) the types of in terms that identify each potential list. However, an applicant with a larger hazards associated with the vehicle source of harm, the mechanism by vehicle operating from multiple sites response modes; (3) the geographical which the harm may be caused, and the and hundreds of employees would need area where the public may be exposed potential outcome if the harm were to a more formal means of tracking to a hazard; (4) the population of the remain unaddressed.63 The operator information and developing the public exposed to the hazard; (5) the should ensure that the hazard is required analyses. CEC; (6) a preliminary hazard list which described in enough detail so that the documents all causes of vehicle safety critical personnel within the C. Preliminary Safety Assessment for response modes that, excluding operator’s organization would be able to Flight mitigation, have the capability to create review the hazard and easily ascertain Under proposed § 450.105 a hazard to the public; (7) safety-critical the source, mechanism, and the public (Preliminary Safety Assessment for systems; and (8) the timeline identifying safety-related outcome of the hazard. In Flight), every operator would be all safety critical events. The FAA developing the preliminary hazard list, required to conduct and document a expects that an operator would use an operator would not be required to preliminary safety assessment (PSA) for many of these PSA elements in assess the risk associated with each the flight of a launch or reentry vehicle. subsequent analyses. For instance, hazard or potential mitigation measures. The PSA would identify operation- population data, vehicle response These items would be determined in the specific information relevant to public modes, and the associated effects are flight hazard analysis, if required, as safety and would help the operator part of a valid quantitative risk analysis. discussed in the ‘‘Flight Hazard scope the analyses that must be These items could also be useful for a Analysis’’ section of this preamble. conducted to ensure that the operation flight hazard analysis. When developing the preliminary hazard list, the operator would also be satisfies the public safety criteria in A vehicle response mode is a required to address items that are not proposed § 450.101. An operator could mutually exclusive scenario that specific to the vehicle hardware but use the knowledge obtained from the characterizes foreseeable combinations necessary for the launch or reentry PSA to identify the effect of design and of vehicle trajectory and debris system. These items would include operational decisions on public safety generation. Examples include on- things like human factors, training, and and thus determine potential hazard trajectory explosion, on-trajectory loss control strategies. The products of the other operational concerns. of thrust, and tumble turns. The types The FAA believes the preliminary PSA are consistent with products that of hazards associated with any vehicle are currently produced for preliminary hazard list is critical as the regulatory response mode can include inert and approach changes from narrowly flight safety analyses and preliminary explosive debris, overpressure, and system safety analyses. The PSA will prescribed methods to performance- toxics. By understanding the potential based standards that focus on the allow operators to quickly identify and vehicle response modes and the hazards demonstrate the hazard control strategy applicant demonstrating safety through associated with those vehicle response system safety management and appropriate for their proposed modes, an operator can then determine operation. engineering. As the industry moves the geographical areas where the public toward to a more performance-based The FAA intends the PSA to be a top- may be exposed to a hazard. This level assessment of the potential public regime, there is a growing need for information, along with the population operators to produce the analyses safety impacts identifiable early in the of the public exposed to the hazard, design process. This assessment should specific to their unique operations in would allow an operator to begin to order to ensure public safety and detail be broad enough that minor changes in characterize the potential risk during vehicle design or operations would not the appropriate hazard mitigation any particular phase of flight. strategies for their proposed operation. have a significant impact on, or Calculating CEC as discussed earlier, is invalidate the products produced by, Additionally, an operator that makes important to understand the need for an changes to its operation could the PSA. At the same time, the PSA FSS and its required reliability. All of should be detailed enough to identify potentially move from a regulatory these elements, which comprise pathway that does not require a hazard the public safety and hazard control § 450.105(a)(1) through (5), are implications associated with key design analysis to one that does. The existence important to develop hazard control of a preliminary hazard list should trade studies. The FAA recommends strategies. that an operator perform an initial PSA alleviate some of the existing burdens Proposed § 450.105(a)(6) would on operators by requiring only those at the outset of the design phase of a require an operator to produce a proposed operation. Thereafter, the analyses necessary to ensure the safety preliminary hazard list. The operator of a particular operation. operator should update the assessment would be required to review the as needed in accordance with the It would also more quickly facilitate operation to determine what hazards analyses demonstrating public safety, launch operator’s established exist in order to generate the procedures to evaluate the complete thus creating the potential for preliminary hazard list. This assessment operational changes closer to flight of operational lifecycle of a launch or is different from the quantitative risk reentry system. The results of the PSA the vehicle. For example, consider an analysis and is meant to give an operation where a flight hazard analysis would provide the operator with an operator an understanding of how appropriate hazard control strategy for public safety is affected at the 63 62 For example, a potential source of harm could its proposed operation. subsystem or component level of the be a leak in a rocket engine fuel system line caused operation. An operator should use by a manufacturing defect, overpressure, or 62 As mentioned previously and discussed in improper installation. The mechanism for harm greater detail in the next section, traditional hazard common system safety tools such as could be a fire resulting from that leak. The controls include physical containment, wind Fault Trees, Failure Modes and Effects outcome could be loss of the vehicle with impact weighting, or flight abort. Analyses (FMEA), safety panels, and on population.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00022 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15317

was unnecessary because of the use of how public safety hazards are mitigated. public or critical assets to a hazard. an FSS under proposed § 450.145(a)(1). If there is a phase of flight where all These launches can take place from any In that case, a change in FSS design, identified public safety hazards are not launch site, depending on the size of the testing or qualification, or disabling the mitigated using physical containment, launch vehicle, the expected trajectory, abort system during some phases of wind weighting, or flight abort, the and other factors. The more remote a flight, could result in the need for a operator would be required to perform launch site is, the greater its capacity to flight hazard analysis. Because the a flight hazard analysis, discussed later accommodate a launch using physical operator would be required to generate in this preamble, for that particular containment. a preliminary hazard list, it would phase of flight. This approach is consistent with already have the initial step of the flight D. Hazard Control Strategy current practice because the FAA has hazard analysis completed, excluding always accepted a demonstration of any impacts of the change. The operator Proposed § 450.107 (Hazard Control physical containment as a means of would then be required to complete the Strategies) would provide options for satisfying risk requirements. The use of final steps of the hazard analysis to hazard control strategies that an physical containment as a hazard complete its safety documentation. operator could use to meet the public control strategy is the easiest way to Proposed § 450.105(a)(7) would safety criteria in proposed § 450.101 for meet the public safety requirements of require an operator to identify safety- each phase of a launch or reentry proposed § 450.101 and may, in a critical systems. A safety critical system vehicle’s flight. An operator could use remote location, involve a simple would be a system that is essential to physical containment, wind weighting, showing that the maximum distance or flight abort and would not be safe performance or operation. A safety- vehicle hazards can reach defines an required to conduct a flight hazard critical system, subsystem, component, area that is unpopulated and does not analysis. Alternatively, an operator condition, event, operation, process, or contain any critical assets. Because could conduct a flight hazard analysis to item, is one whose proper recognition, physical containment precludes the derive hazard controls. As part of its control, performance, or tolerance, is need for an FSS, an operator would not application, an operator would be essential to ensuring public safety. It is be required to meet any requirements required to identify the selected hazard important for an operator to clearly relevant to an FSS. If an operator shows control strategy for each phase of flight. identify safety critical systems because its vehicle does not have sufficient many requirements in proposed part The use of a flight hazard analysis to derive hazard controls provides the energy for any of its associated hazards 450 relate to these systems. to reach outside the flight hazard area, Proposed § 450.105(a)(8) would most flexibility of any of the hazard the operator would not have to perform require an operator to identify a control strategies. The ARC a flight hazard analysis. Further, many timeline identifying all safety critical recommended this approach and stated events. This timeline is important to that the system safety process should be other requirements would be either not identify the potential public safety used to identify hazards and develop applicable or easily met. Because consequences during any particular control strategies, which would then be physical containment may also involve phase of flight. verified by means of flight safety visitor control, wind constraints, real- Proposed § 450.105(b) would set the analysis and relevant operational time toxic analysis, and other mitigation PSA application requirements. The constraints and means of meeting those measures, the FAA would require an applicant would be required to provide constraints.64 In certain circumstances, operator to apply other mitigation the results of the preliminary safety however, historical methods may also measures to ensure no public exposure assessment in its application. The provide an acceptable level of safety. If to hazards, as agreed to by the applicant would be required to provide the public safety hazards identified in Administrator on a case-by-case basis. information for every requirement listed the preliminary safety assessment can Under proposed § 450.107(c), an under § 450.105(a). These application be mitigated adequately to meet the operator could use wind weighting to requirements are consistent with those public safety requirements of proposed satisfy the public safety requirements of currently in part 431. Although these § 450.101 using physical containment, proposed § 450.101 when an operator specific system safety requirements wind weighting, or flight abort with a uses launcher elevation and azimuth would be new for ELV operators, the highly reliable FSS, an operator would settings to correct for wind effects that FAA does not expect they would add a not need to conduct a flight hazard an unguided suborbital launch vehicle, substantial burden given that part 417 analysis for that phase of flight. This typically called a sounding rocket, operators were performing similar work, proposal is different than current would experience during flight. Due to albeit not under the system management regulations, where the option of its relative simplicity and effectiveness, umbrella. ELV operators must already conducting a hazard analysis to derive wind weighting has historically been identify vehicle failure modes; debris, hazard controls is only available to used by NASA, the Department of toxics, distant-focusing overpressure, reusable launch vehicles. Under Defense, and commercial operators as and other hazards; geographical proposed part 450, the option to use a the primary method to ensure public containment and overflight trajectories; flight hazard analysis would not rest on safety for the launch of a sounding consequences that determine flight whether a vehicle is expendable or rocket. This approach is currently limits; and all safety critical systems reusable. codified in part 417. Under part 431, an and events. The PSA codifies these Under proposed § 450.107(b), an operator can use wind weighting as an concerns as primary to safety and the operator could use physical acceptable hazard mitigation measure development of hazard control strategies containment to satisfy the public safety determined through the system safety and requires all vehicle operators to requirements of proposed § 450.101 process. Under proposed part 450, an document such considerations. when an operator’s launch vehicle does operator launching a sounding rocket Development of the PSA would allow not have sufficient energy for any could use wind weighting or it could the operator to determine whether they hazards associated with its flight to propose other hazard controls in its must perform a flight hazard analysis. reach an area where it exposes the application through a flight hazard The operator would be required to analysis. The specific wind weighting assess each phase of flight to determine 64 ARC Report at p. 10. requirements are discussed in the

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00023 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15318 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

‘‘Additional Technical Justification and flight poses less risk to public safety and establish flight safety limits that define Rationale’’ section. the safety of property than continued when an operator must initiate flight Under proposed § 450.107(d), an flight without a safety intervention. abort to: operator could use flight abort to satisfy Flight abort is the primary hazard • Prevent debris capable of causing a the public safety requirements of control strategy used today for orbital casualty from impacting in uncontrolled proposed § 450.101 when an operator expendable launch vehicles under part areas if the vehicle is outside the limits limits or restricts the hazards to the 417, and under Air Force and NASA of a useful mission, and public or critical assets presented by a launch range requirements. • Ensure compliance with the public launch vehicle or reentry vehicle, The FAA proposes to require this safety criteria of § 450.101. including any payload, while in flight approach, with a reliable FSS, only The FAA would define debris capable by initiating and accomplishing a when certain conditional risks are of causing a casualty with kinetic energy controlled ending to vehicle flight, present. Specifically, proposed or other thresholds as will be discussed when necessary. This is discussed in § 450.101(c) would require an operator later. The public safety criteria that more detail in the ‘‘Flight Abort’’ to use flight abort with an FSS that would go into determining flight safety section. meets the requirements of § 450.145 as limits would be collective risk, If the public safety hazards identified a hazard control strategy if the individual risk, risk to critical assets, in the preliminary safety assessment consequence of any reasonably and conditional risk. An uncontrolled cannot be mitigated adequately to meet foreseeable vehicle response mode, in area would be an area of land not the public risk criteria of proposed any one-second period of flight, is controlled by a launch or reentry § 450.101 using physical containment, greater than 1 × 10¥3 conditional operator, a launch or reentry site wind weighting, or flight abort, an expected casualties for uncontrolled operator, an adjacent site operator, or operator would be required to conduct areas.65 The basis for this number is other entity by agreement. Under a flight hazard analysis in accordance discussed in the ‘‘Consequence current regulations, these areas are with proposed § 450.109 (Flight Hazard Protection Criteria for Flight Abort and referred to as ‘‘protected areas.’’ Analysis) to derive hazard controls for Flight Safety System’’ section. Under Importantly, as discussed earlier, the that phase of flight. The use of a flight this test, a typical orbital launch from conditional risk criteria would not hazard analysis to derive hazard the Air Force Eastern and Western apply to controlled areas, which are controls is the primary approach used in ranges would require an FSS capable of areas that are controlled by any of the current parts 431, 435, and 437. The initiating flight abort. Small orbital entities listed earlier, because by FAA has previously required the use of launch vehicles launched from more exercising control over these areas the a flight hazard analysis for reentry, for remote locations, however, would not entity would have a greater ability to the captive carry portion of an air- normally be required to use flight abort ensure that catastrophic risk is mitigated launched vehicle, and for piloted as a hazard control strategy. The FAA by other means. suborbital vehicles. A detailed seeks comment on this approach. In addition to establishing flight discussion of flight hazard analysis is To implement flight abort as a hazard safety limits, an operator would included later in this preamble. control strategy, an operator would establish gates, if the vehicle would In its application, an applicant would establish flight safety limits and gates in need to overfly a landmass during its be required to describe its hazard accordance with proposed §§ 450.123 flight. A gate is an opening in a flight control strategy for each phase of flight. (Flight Safety Limits Analysis) and safety limit through which a vehicle An applicant may elect to use different 450.125, establish flight abort rules in may fly, provided the vehicle meets hazard control strategies for different accordance with § 450.165 (Flight Safety certain pre-defined conditions such that phases of flight, depending on risks Rules), and employ an FSS in the vehicle performance indicates an associated with those phases. For accordance with § 450.145 and software ability to continue safe flight. If the example, an applicant using an air- in accordance with § 450.111. vehicle fails to meet the required launched system might use a flight Flight abort as a hazard control conditions to pass a gate, then flight hazard analysis during the captive carry strategy can be used by an operator, abort would occur at the flight safety phase of flight, and flight abort during even if it is not required under limit. In other words, the gate would be the rocket-powered phase of flight. § 450.101(c), as a hazard mitigation closed. Additionally, if using physical measure derived from the flight hazard Flight safety limits and gates are containment as a hazard control analysis. For example, a piloted vehicle discussed in greater detail later in this strategy, an applicant would be required with low conditional expected casualty preamble. to demonstrate that the launch vehicle during powered flight may use an FSS 2. Flight Abort Rules does not have sufficient energy for any in combination with other measures, hazards associated with its flight to such as propellant dumping, to keep An operator would identify the reach outside the flight hazard area. The vehicle hazards from reaching a conditions under which the FSS, applicant would also be required to populated area. including the functions of any flight describe the methods used to ensure abort crew, must abort the flight to that flight hazard areas are cleared of the 1. Flight Safety Limits and Uncontrolled ensure compliance with § 450.101. An public and critical assets. Areas operator would be required to abort a E. Flight Abort An operator would have to identify flight if a flight safety limit is violated, the location of uncontrolled areas and or if some condition exists that could As discussed earlier, flight abort is a lead to a violation, such as a hazard control strategy to limit or 65 The proposed requirement to use flight abort as compromised FSS or loss of data. restrict the hazards to the public or a hazard control strategy is less restrictive than Flight abort rules are discussed in critical assets presented by a launch § 417.107(a), which requires a launch operator to greater detail later in this preamble. vehicle or reentry vehicle, including any use an FSS in the vicinity of the launch site if any hazard from a launch vehicle, vehicle component, 3. Flight Safety System payload, while in flight. Flight abort is or payload can reach any protected area at any time a controlled ending to vehicle flight and during flight, or if a failure of the launch vehicle To enable flight abort, an operator is initiated by an operator when ending would have a high consequence to the public. must use an FSS. An FSS is an integral

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00024 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15319

part of positive control of a launch or environments exceeding the expected hazard list developed during the earlier reentry vehicle because it allows an operating environment for the system PSA, including verifying the list of operator to destroy the vehicle, components, acceptance tests to items identified in § 450.109 and any terminate thrust, or otherwise achieve demonstrate that the selected batch of new hazards identified since completing flight abort to limit or restrict the components meets the requirements of the PSA. A hazard is a real or potential hazards to public health and safety and the design specifications, and other condition that could lead to an the safety of property presented by a preflight testing at the system or unplanned event or series of events vehicle while in flight. Traditional FSSs subsystem level to demonstrate resulting in death, serious injury, or are comprised of an onboard flight functionality after installation. damage to or loss of equipment or termination system, a ground-based In the short term, the FAA expects property. The list of items in proposed command and control system, and individual applicants to create their § 450.109(a)(1) is a list of hazard tracking and telemetry systems. own FSS requirements based on RCC categories that exist in all commercial Historically, the flight safety crew 319 and have them approved as an space operations and must therefore be monitoring the course of a vehicle accepted means of compliance by the eliminated or mitigated to acceptable would send a command to the vehicle FAA prior to application submittal. This levels. to terminate flight if the vehicle violated would be akin to ‘‘tailoring’’ RCC 319, After identifying and describing a flight abort rule. Recently, operators which is current practice at the Federal hazards, proposed § 450.109(a)(2) would are favoring autonomous FSSs, negating launch ranges. In the long run, the FAA require that an operator assess each the need for a ground-based command expects the industry to develop hazard’s likelihood and severity. This and control system or flight abort crew. voluntary consensus standards for FSSs, assessment would be used to establish As discussed earlier, the CEC would particularly for those FSSs that are only mitigation priorities. The operator establish whether an FSS is required, required to have a design reliability of would then determine the severity of and if so, its reliability. 0.975 at 95 percent confidence. By the specific potential hazardous • If the consequence of any vehicle removing detailed design and testing condition with respect to public safety. response mode is 1 × 10¥2 conditional requirements from FAA regulations and An operator should determine the expected casualties or greater for relying on standards to meet reliability severity for a specific hazard by uncontrolled areas, an operator would thresholds, the FAA would encourage identifying the worst credible event that be required to employ an FSS with innovation in flight abort. The FAA may result from the hazard. For design reliability of 0.999 at 95 percent seeks comment on whether this example, if an operator identifies a confidence and commensurate design, approach would encourage innovation hazard such as incorrect vehicle analysis, and testing; or and more rapid evolution of FSS position data due to inertial • If the consequence of any vehicle designs. measurement unit (IMU) drift leading to ¥2 an off nominal trajectory, the operator response mode is between 1 × 10 and F. Flight Hazard Analysis 1 × 10¥3, an operator would be required would determine the public impact Proposed § 450.109 would require to employ an FSS with a design using the greatest off nominal vehicle that an operator conduct and document reliability of 0.975 at 95 percent trajectory and the worst credible public a flight hazard analysis and continue to confidence and commensurate design, safety outcome. Meaning, if the vehicle maintain the flight hazard analysis analysis, and testing. would break up aerodynamically due to throughout the lifecycle of the launch or Note that if the consequence of any an off nominal trajectory caused by IMU reentry system unless an operator uses vehicle response mode is less than 1 × drift, the operator should base its proven hazard control strategies such as 10¥3, the FAA would not require an severity assessment on the debris event physical containment, wind weighting, FSS or mandate its reliability if an generated by the break up taking into or flight abort. At its most basic, a flight account the population in the area. If operator chooses to use one. hazard analysis identifies all reasonably Unlike part 417, the FAA would not the vehicle operates in a remote area the foreseeable hazards and the necessary severity may be low; however, if the propose specific design or testing measures to eliminate or mitigate that requirements for an FSS. Instead, the operation occurs within the reach of the risk. A flight hazard analysis would be population, the severity would be FAA would accept specified required only for those phases of flight government or industry standards as catastrophic. for which the operator does not employ After severity and likelihood are meeting the FSS reliability a traditional hazard control (e.g., assessed, proposed § 450.109(a)(3) requirements. At this time, only one physical containment). As noted earlier, would require that an operator ensure government standard would meet the the use of a flight hazard analysis to that any hazard that may cause a requirement for a design reliability of derive hazard controls would provide casualty is extremely remote, and any 0.999 at 95 percent confidence and flexibility that does not currently exist hazard that can cause major damage to commensurate design, analysis, and under the prescriptive requirements in 66 public property or critical assets is testing, and that is RCC 319. part 417 67 and is broadly consistent remote. If a particular hazard source has The FSS requirements codified in part with the practice in parts 431 and 435.68 been observed in a similar operation 417, including component performance Proposed § 450.109(a) would require under similar conditions, it will be requirements and acceptance and that an operator further refine the flight difficult to justify that the likelihood of qualification testing, were originally the reoccurrence of the event will written to align FAA launch licensing 67 The current ELV regulatory scheme in parts 415 qualify as remote or extremely remote. requirements with the Federal launch and 417 mitigates flight hazards for all launches by This requirement is substantively the requiring a reliable FSS and prescriptive flight abort range standards in RCC 319. Like part same as current practice under 417, RCC 319 requires qualification tests requirements. 68 Current RLV and reentry vehicle regulations in § 431.35(c) and is specifically called out to demonstrate reliable operation in parts 431 and 435 do not specifically require a flight in § 437.55(a)(3) for experimental hazard analysis. However, § 431.35(c) and (d) permits. Examples of suggested 66 RCC 319 can be found at http:// require a system safety process to identify hazards, www.wsmr.army.mil/RCCsite/Documents/319-14_ assess the risks, and the elimination or mitigation likelihood categories for remote and Flight_Termination_Systems_Commonality_ of the risk. In practice, the FAA has interpreted this extremely remote are provided in FAA’s Standard/RCC_319-14_FTS_Commonality.pdf. broad section to require a flight hazard analysis. Advisory Circular (AC) 437.55–1

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00025 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15320 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

‘‘Hazard Analyses for the Launch or themselves are properly developed and key to ensuring that the operator is Reentry of a Reusable Suborbital Rocket implemented while validation ensures aware of the hazards in the proposed Under an Experimental Permit’’ as 1 × the measures will actually achieve the operation. ¥ ¥ 10 5 and 1 × 10 6, respectively. desired outcome. Verification takes Proposed § 450.109(d) requires that an The operator would then need to place while developing the measures operator continually update the flight identify and describe risk elimination and validation after development and hazard analysis throughout the and mitigation measures as required by implementation. This requirement is operational lifecycle of the launch or proposed § 450.109(a)(4). The operator substantively the same as current reentry system. This requirement is should always consider whether the risk practice under § 431.35(c). The substantively the same as current FAA mitigation measures introduce new acceptable methods of verifying safety practice under § 431.35(c). hazards. This proposed section codifies measures are: Proposed § 450.109(e) establishes the 1. Analysis: Technical or current practice under the § 431.35(c) flight hazard analysis application mathematical evaluation, mathematical broad system safety analysis requirements. An applicant would be models, simulations, algorithms, and requirement. Although not required, required to submit a flight hazard system safety standards and advisory circuit diagrams. 2. Test: Actual operation to evaluate analysis in its application to provide the material such as MIL–STD–882E, AC FAA with sufficient detail to evaluate 437.55–1, and AC 431.35–2A ‘‘Reusable performance of system elements during ambient conditions or in operational the applicant’s flight hazard analyses Launch and Reentry Vehicle System and its criteria and techniques for Safety Process’’ recommend that environments at or above expected levels. These tests include functional identifying new hazards throughout the operators develop risk elimination or lifecycle of the launch or reentry mitigation approaches in the following tests and environmental tests. 3. Demonstration: Actual operation of system. The FAA recommends that the order: applicant provide at a minimum a 1. Design for minimum risk. The first the system or subsystem under specified hazard table that provides a description priority should be to eliminate hazards scenarios, often used to verify of each hazard identified, associated through appropriate design or reliability, transportability, severity and likelihood of each hazard, operational choices.69 If an operator maintainability, serviceability, and the mitigation measures identified for cannot eliminate a risk, it should human engineering factors. each hazard, and a summary of the minimize it through design or 4. Inspection: Examination of validation and verification of each operational choices. hardware, software, or documentation to 2. Incorporate safety devices. If an verify compliance of the feature with hazard. For hazards that require operator cannot eliminate hazards predetermined criteria. mitigation, the applicant would also be through design or operation selection, An operator could use methods required to provide the data showing then an operator should reduce risks separately or combine them depending the verification of those mitigations through the use of active or passive on the feasibility of the methods and the measures. The FAA expects the results safety devices.70 maturity of the vehicle and operation. of any testing or analysis associated 3. Provide warning devices. When Proposed § 450.109(b) would require with the verification to be in a format neither design nor safety devices can that an applicant establish and that is easily understood by an eliminate or adequately reduce document the criteria and techniques experienced technical evaluator. For identified risks, the operator should use for identifying new hazards throughout items verified by analysis, the applicant a device to detect and warn of the the launch or reentry system lifecycle. should provide the assumptions and hazardous condition to minimize the Development, implementation, and methodology used to conduct the likelihood of inappropriate human continued operation of any system analyses if it is not easily understood by reaction and response.71 requires that changes be made evaluating the results. These application 4. Implement procedures and throughout the lifecycle. Changes to the requirements would not require more training. When it is impractical to vehicle, especially to safety-critical than the current practices under eliminate risks through design or safety systems and operations, can have § 431.35(c) and (d). and warning devices, the operator significant impacts on public safety and will result in changes to the hazard G. Computing Systems and Software should develop and implement Overview procedures and training that mitigate analysis. Anomalies and failures can the risks.72 also identify unknown hazards. This The FAA is proposing to address Proposed § 450.109(a)(5) would requirement is substantively the same as hazards associated with computing require that the risk elimination and the FAA’s current practice under systems and software separate from mitigation measures achieve the § 431.35(c). Parts 415 and 417 do not flight hazard analysis. The FAA would proposed risk levels in § 450.109(a)(3) have a flight hazard analysis consolidate all software safety through verification and validation. requirement. requirements applicable to launch or Verification ensures the measures Proposed § 450.109(c) would require reentry operations in a single section, in that the flight hazard analysis be proposed § 450.111 (Computing Systems 69 An example of designing out risk to the public updated and complete for every launch and Software).73 These proposed would be to operate in an unpopulated area. or reentry. In other words, the analysis regulations address both software and 70 An example of an active safety device would must be applicable to the specific how the software operates on the be a computing system that automatically shuts mission. A hazard analysis for a down the rocket engine when a sensor detects high intended hardware and computing 74 thrust chamber temperatures. A passive safety previous mission may be used only if systems. While the FAA discusses device might be a firewall to prevent a fire from the vehicle and operational details of reaching a pilot. the mission do not impact the validity 73 For the purpose of this discussion, the phrase 71 An example of a warning device would be an of any aspect of the hazard analysis. The ‘‘software safety requirements’’ refers to software abort indicator such as a flashing light or a message FAA has not prescribed the safety regulations and ‘‘software requirements’’ on a cockpit instrument panel. refers to the specifications that define a software 72 An example of risk mitigation procedures and methodology that an operator must component’s intended functionality. training are abort procedures and rehearsals of follow to ensure the accuracy of a flight 74 The FAA understands software to mean a those procedures. hazard analyses. However, this item is combination of computer instructions and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00026 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15321

hardware requirements elsewhere under high demonstrated reliability during regulated under title 49 or Title 51.80 As the safety-critical systems requirements, those phases of flight. The FAA would new hybrid concepts are unveiled, the it is important to recognize that software make these determinations on a case-by- FAA anticipates issuing additional safety cannot be evaluated outside of the case basis based on a vehicle’s guidance to assist operators. computing system in which it demonstrated reliability. The FAA has worked with and 75 received input from industry on how to operates. A computing system is a The FAA may regulate hybrid regulate hybrid vehicles. For instance, complete system made up of the central vehicles under either the commercial in 2017 and 2018, the FAA convened a processing unit, memory, related space transportation or the civil aircraft electronics, and peripheral devices. Safety Risk Management (SRM) panel regulations, depending on the operation. These proposed software safety consisting of FAA and industry requirements would streamline the For a flight of a hybrid vehicle where a representatives to review and assess software safety evaluation process by carrier aircraft has been modified to hazards associated with captive carry adding detail to the performance-based carry a rocket and the operator intends operations.81 The panel recommended requirements in the existing rules. The to ignite the rocket, the FAA considers dispensing with any aircraft hazard area software safety requirements in the the aircraft a component of the launch requirement during the captive carry 78 proposed rule are levied in proportion vehicle. The combination launch phase of flight for previously licensed to the potential software hazards and vehicle system is authorized solely by a hybrid vehicles with fixed-wing carrier the degree of control over those vehicle operator license or experimental aircraft. The ARC also recommended hazards.76 In other words, software permit under Title 51. The FAA that the FAA set a different standard for safety requirements would increase in currently authorizes the operation of hybrid vehicles, specifically that the rigor with the rise in potential safety hybrid vehicles using a license or FAA not require an FSA for operations risks and degree of autonomy. permit for the entire mission from where the agency has already Conversely, software safety preflight ground activities through taxi, considered impacts to public safety requirements would decrease in rigor take off, flight, landing, wheel stop, and during the airworthiness certification with reductions in the potential safety post-flight safing for all components of process. Additionally, the ARC risk or degree of autonomy.77 This the combined launch vehicle system. recommended that an operator only be approach would codify existing FAA The FAA has granted a license to hybrid required to conduct an FSA for those practice of modulating the stringency of vehicles such as the Stargazer/Pegasus, portions of flight when the hazardous review commensurate with the level of WhiteKnightOne/SpaceShipOne, configuration of the hybrid system public risk. The FAA would also add WhiteKnightTwo/SpaceShipTwo, and differs from that approved under an more clarity to the software scaled Cosmic Girl/LauncherOne experimental airworthiness certificate or requirements to guide applicants to combinations. In addition to carrier equivalent authorization. appropriate and predictable engineering aircraft models, hybrid vehicles may As discussed earlier, the FAA judgments when determining the proper also include future concepts such as a proposes to provide flexibility for depth and breadth of software single vehicle with both air-breathing certain phases of flight with respect to development, analysis, and verification and rocket engines, winged launch or FSA (proposed § 450.113(a)(5)) and FSS activities. The FAA expects these reentry vehicles, balloon-launched (proposed § 450.101(c)) requirements. changes would enable innovation by rockets, and other concepts that may This is consistent with the ARC’s setting predictable safety requirements have characteristics of both aviation and recommendation. The FAA recognizes based on knowable characteristics of traditional launch or reentry vehicles.79 that airworthiness certificates and new software systems and in proportion The FAA will work with applicants licenses, when developed to the risks involved with the using hybrid vehicles during pre- collaboratively between the Aviation innovation. For a detailed discussion, application to identify the appropriate Safety and Commercial Space please see the Additional Technical regulatory path. To date, the FAA has Transportation lines of business, Justification and Rationale discussion issued guidance in two legal sufficiently protect the public. In these later in the preamble. interpretations on the process for cases, the FAA would include a license determining whether flights or portions term and condition for a current H. Hybrid Launch Vehicles of flights of hybrid vehicles are airworthiness certificate. Specifically, Hybrid vehicles are vehicles that have the license would impose terms and some characteristics of aircraft and other 78 ‘‘Chapter 509 applies when [a hybrid] system conditions such as compliance with characteristics of traditional launch or operates as a launch vehicle from the flight of the certain part 91 (General Operating and reentry vehicles. This proposal would carrier aircraft, through ignition of the rocket, to the allow an operator to forego the use of return and landing of the carrier aircraft and the 80 Legal Interpretation to Kelvin B. Coleman from suborbital rocket. For a mission that does not entail Lorelei Peter, July 23, 2018; (https://www.faa.gov/ flight abort as a hazard control strategy ignition of the rocket, the FAA’s aviation statute about/office_org/headquarters_offices/agc/practice_ during certain phases of flight if the and regulations apply.’’ See Legal Interpretation to areas/regulations/interpretations/data/interps/ hybrid launch or reentry vehicle has a Pamela L. Meredith from Mark W. Bury (September 2018/coleman-ast-1%20-%20(2018)%20legal% 26, 2013). 20interpretation.pdf); Legal Interpretation to Pamela 79 An example of a hybrid vehicle that does not L. Meredith from Mark W. Bury, Sept. 26, 2013; computer data that enables a computer to perform use a carrier aircraft is the World View capsule. (https://www.faa.gov/about/office_org/ computational and control functions. This capsule is not a rocket, but it meets the headquarters_offices/agc/practice_areas/ 75 Hardware is the collection of physical parts of definition of a launch vehicle because it operates regulations/interpretations/data/interps/2013/ a computer system, including memory storage at an altitude where it needs to be designed, built, meredith-zuckertscoutt&rasenberger%20-% devices, power sources, and processors that execute and tested to operate in outer space. See Legal 20(2013)%20legal%20interpretation.pdf). software. Interpretation to Pamela L. Meredith from Mark W. 81 The SRM panel members included FAA 76 For the purpose of this rulemaking, software Bury, September 26, 2013; (https://www.faa.gov/ representatives from the Air Traffic Organization, hazards are those hazardous conditions created by about/office_org/headquarters_offices/agc/practice_ Aviation Safety, and the Office of Commercial the execution of software, or for which software is areas/regulations/interpretations/data/interps/ Space Transportation. The panel also included civil used as a mitigation or control. 2013/meredith-zuckertscoutt&rasenberger%20- aviation and commercial space participants such as 77 The FAA uses the phrase ‘‘level of rigor’’ to %20(2013)%20legal%20interpretation.pdf). Similar the Air Line Pilots Association, the National Air describe the amount of precision and effort applied to other hybrid vehicles, when not operating as a Traffic Controllers Association, Orbital ATK, Virgin by an applicant to address the severity of a hazard launch vehicle, World View will operate under the Galactic, Virgin Orbit, and Mojave Air and Space and associated software autonomy. appropriate aviation provisions of title 49. Port.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00027 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15322 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

Flight Rules) requirements and unknown operating characteristics of areas and establish flight safety limits airworthiness operating limitations, not future hybrid vehicles, the FAA is not that define when an operator must including any restrictions on proposing to provide a blanket FSA initiate flight abort to (1) ensure compensation or hire. This blended exemption for all hybrid systems. compliance with the public safety approach of combining airworthiness criteria of proposed § 450.101, and (2) I. Flight Safety Analysis Overview with part 450’s system safety prevent debris capable of causing a requirements would ensure public For purposes of this proposed rule, a casualty from impacting in uncontrolled safety without the need for an FSA. flight safety analysis consists of a set of areas if the vehicle is outside the limits This proposal would reduce FSA, quantitative analyses used to determine of a useful mission. CEC, and FSS requirements for phases of flight commit criteria, flight abort rules, 2. Gate Analysis (§ 450.125). A gate flight such as the captive carry phase, flight hazard areas, and other mitigation analysis is necessary to determine the carrier-vehicle-alone phase, and any measures, and to verify compliance with necessary openings in a flight safety rocket component glide back. The the public safety criteria in proposed limit through which a vehicle may fly, captive carry phase of flight starts when § 450.101. The FAA proposes 15 provided the vehicle meets certain pre- the carrier vehicle takes off carrying the sections for flight safety analysis. The defined conditions indicating an ability rocket aloft and transports it to the analyses are described here briefly to continue safe flight. rocket release location. The carrier- because of their overall importance to 3. Data Loss Flight Time and Planned vehicle-alone phase starts when the the regulation and are discussed in Safe Flight State Analyses (§ 450.127). A carrier vehicle releases the rocket, and greater detail in the ‘‘Additional data loss flight time analysis is includes all flight activities in support Technical Justification and Rationale’’ necessary to establish when an operator of the mission until the carrier vehicle section. Furthermore, the FAA plans to must abort a flight following the loss of lands and is safed. During the carrier- publish updated ACs and guidelines to vehicle tracking information. A planned vehicle-alone phase, the rocket describe acceptable means to conduct safe flight state analysis is necessary to component is conducting its rocket- these analyses. determine when an FSS is no longer powered and coast phases. The rocket The first two sections for FSA would necessary. coast phase occurs immediately after the outline the scope, applicability, and 4. Time Delay Analysis (§ 450.129). A rocket engine shuts down, and is not methods for conducting FSAs: time delay analysis is necessary to considered an aviation-like glide phase 1. Flight Safety Analysis establish the mean elapsed time because the pilot does not have Requirements—Scope and Applicability between the violation of a flight abort significant control authority over the (§ 450.113). This section would rule and the time when the flight safety instantaneous impact point (the establish the portions of flight for which system is capable of aborting flight for predicted impact point following thrust an operator would be required to use in establishing flight safety limits. termination of a vehicle). For returning perform and document an FSA and One section addresses probability of rockets, there may be a glide phase would identify the analyses required for failure analysis: which begins at a point to be each type of operation. 1. Probability of Failure Analysis determined on a case-by-case basis after 2. Flight Safety Analysis Methods (§ 450.131). During any particular flight the vehicle completes any (§ 450.115). This section would set or phase of flight, an estimated reconfiguration necessary and methodology requirements for FSAs, probability of failure, and how that demonstrates non-rocket powered including level of fidelity. probability is allocated across flight control authority and ends when the Three sections would require time and vehicle response mode, is vehicle lands. fundamental flight safety analyses: The FAA would work with hybrid 1. Trajectory Analysis for Normal necessary to support the determination vehicle applicants during pre- Flight (§ 450.117). All the FSAs depend of hazard areas and risk. application consultation to determine on some form of analysis of the One section addresses the determination of flight hazard areas: the applicability of FSA, CEC, and FSS trajectory under normal conditions, requirements. For example, the FAA referred to as a normal trajectory. 1. Flight Hazard Area Analysis might determine the quantitative FSA 2. Trajectory Analysis for Malfunction (§ 450.133). This analysis is necessary to requirement for those portions of a Flight (§ 450.119). A malfunction determine any region of land, sea, or air mission where the vehicle operates as a trajectory analysis is necessary to that must be surveyed, publicized, civil aviation aircraft governed by civil determine how far a vehicle can deviate controlled, or evacuated in order to aviation regulations (as incorporated from its normal flight path in case of a protect the public health and safety, and into the license) is unnecessary because malfunction. This analysis helps safety of property. the vehicle has demonstrated reliability determine impact points in case of a Three sections would be necessary to during that phase as indicated by the malfunction and is therefore a vital determine whether risk criteria are met issuance of an airworthiness certificate. input for the analyses needed to for different types of hazards: Thus, an applicant would not have to demonstrate compliance with risk 1. Debris Risk Analysis (§ 450.135). A conduct the quantitative FSA for the criteria. debris risk analysis is necessary to aircraft-like controllable phases of flight, 3. Debris Analysis (§ 450.121). A determine whether the individual and such as the captive carry phase or for debris analysis is necessary to collective risks of public casualties, due phases with non-rocket powered or characterize the debris generated in to inert and explosive debris hazards glide phases previously authorized various failure scenarios, including meets public safety criteria. under an airworthiness certificate. This those that could produce an intact 2. Far-field Overpressure Blast Effects would not normally be the case during vehicle impact. Analysis (§ 450.137). This analysis is the rocket-powered, coast, reentry, or Four analyses would produce necessary to determine whether the glide back phases of flight that are information necessary to implement potential public hazard from broken unique to space flight. All other flight abort as a hazard control strategy: windows as a result of impacting regulatory requirements, including 1. Flight Safety Limits Analysis explosive debris, including impact of an system safety requirements, would (§ 450.123). A flight safety limit analysis intact launch vehicle, meets public apply to the entire mission. Due to the is necessary to identify uncontrolled safety criteria.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00028 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15323

3. Toxic Hazards for Flight 417 require ELVs to have very reliable ELV. For ELVs, current qualification (§ 450.139). This analysis is necessary to hazard-constraining FSSs that ensure and acceptance testing requirements determine whether hazards associated public safety. These FSSs are subject to and procedures for FSS subsystems and with toxic release meet public safety design requirements, extensive design components are listed in §§ 417.305, criteria. qualification testing, and acceptance 417.307, and appendix E of part 417 Lastly, one section is necessary for the testing of all components. RLVs and (E417). As FSSs are the only safety- launch of an unguided suborbital reentry vehicles are required to undergo critical systems on traditional ELVs, the launch vehicle using wind weighting as a comprehensive system safety component-level testing requirements in a hazard control strategy. A launch engineering process that, in part, part 417 describe the testing of specific vehicle using other mitigations would identifies and eliminates hazards to possible components in great detail, not be required to conduct this analysis: reduce the associated risk to acceptable going so far as to differentiate testing 1. Wind Weighting for the Flight of an levels by defining safety-critical systems requirements for silver-zinc batteries in Unguided Suborbital Launch Vehicle and identifying associated hazards and E417.21 from nickel-cadmium batteries (§ 450.141). This section would outline risks. Under system safety, an operator in E417.22. While the FAA has a wind weighting analysis that is develops design-level safety approved alternative FSSs, the required to ensure that the launch of an requirements and provides evidence for prescription level of the current unguided suborbital launch vehicle verification and validation of safety- requirements discourages significant using wind weighting as a hazard critical systems and requirements. For innovation. control strategy meets public safety safety-critical systems this serves the The same emphasis on validation of criteria. purpose of design qualification and design and verification of hardware acceptance. Given that RLVs are built to tolerances applies to components that J. Safety-Critical Systems experience multiple flights, the have been identified as safety-critical 1. Safety-Critical Systems Design, Test, lifecycle 83 of safety-critical systems during a system safety process. For and Documentation must also be considered as part of the RLVs and reentry vehicles, a system safety process is required by The FAA proposes to consolidate the design, testing, and documentation. § 431.35(c).84 Under the system safety design, test, and documentation i. Current Qualification and Acceptance process, a vehicle designer must assess requirements for safety-critical Testing Requirements nominal and non-nominal flight components in proposed § 450.143 Qualification testing is an assessment scenarios of the vehicle and must (Safety-Critical System Design, Test, and of a prototype or other structural article account for any possible safety-critical Documentation). A common set of to verify the structural integrity of a system failures during flight that could requirements is needed for clarity and design. Generally, qualification testing result in a casualty to the public. Those consistency. involves testing the design under a vehicle operators are required, by Safety-critical systems or components number of different environmental § 431.35(d)(3), to identify all safety- include those systems or components factors to stress the design, with a critical systems and are required by whose performance is essential to multiplying factor applied to the § 431.35(d)(7) to demonstrate the risk ensuring public safety. Historically, the expected environmental testing limit. elimination in relation to those safety- FAA has considered the FSS to be the This qualification testing is conducted critical systems. While not explicitly only safety-critical system on an ELV. for temperatures, tensile loads, handling called out in the current part 431 or 435, For RLVs and reentry vehicles, the use shocks, and other expected qualification and acceptance testing are of a systematic, logical, and disciplined environmental stressors. the widely accepted standards for system safety process is meant to Unlike qualification testing that is demonstrating that safety-critical identify safety-critical systems and the 82 performed on qualification units, systems, subsystems, and components extent of prudent operational controls. acceptance testing is performance are not at risk of failing during flight. If a system failure would cause any testing conducted on the actual Current regulations are undefined hazards and those hazards could reach hardware to be used on a vehicle after with respect to the applicability of a populated area, then the system is the completion of the manufacturing qualification and testing of safety- likely a safety-critical system. Generally, process. Generally, acceptance tests are critical components that are not listed in RLV operators incorporate FSSs, performed on each article of the safety- §§ 417.301(b), 417.305 and 417.307, or although they may also incorporate critical flight hardware to verify that it appendix E of part 417. The regulations other safety-critical elements of risk is free of defects, free of integration and are similarly ambiguous if the vehicle mitigation and hazard control. Non-RLV workmanship errors, and ready for does not have a traditional FSS but still reentry vehicles also require a thorough operational use. Acceptance testing has components that are considered system safety process to identify safety- includes testing for defects, along with safety-critical, like many vehicles critical hardware. environmental testing similar to the licensed under part 431. This ambiguity The current rules for ELV, RLV, and qualification testing described earlier. has led to regulatory uncertainty, which reentry vehicle safety-critical systems For ELVs, qualification and in turn has resulted in lengthy are quite different. However, in practice, acceptance testing are important exchanges between the FAA and license the evaluation of the safety of such verification of the reliability of all FSSs applicants about what components and systems is very similar. Parts 415 and at the subsystem and component level, systems needed to be tested, what and ensures the safe operability of the testing would be acceptable to the FAA, 82 Some of the more commonly used methodologies include Preliminary Hazard Lists only safety-critical system on any given and why that testing was necessary to be (PHL), Preliminary Hazard Analyses (PHA), Event compliant. Testing is currently generally Tree Analyses (ETA), Fault Tree Analyses (FTA), 83 Many operators seek to refurbish or otherwise required for safety-critical systems FMEAs, and FMECAs. Generally, these reuse safety-critical systems for multiple flights. across all vehicle types, either explicitly methodologies help operators determine whether a Operators must design, test, and document safety- system failure could cause a loss of vehicle control, critical systems to demonstrate their safety-critical or as verification and validation in the a vehicle breakup or other creation of uncontrolled systems can continue to operate reliably throughout debris, a discharge of hazardous material, or would the component life in all predicted operating 84 Section 431.35(c) is required for reentry prevent safe landing. environments. vehicles by § 435.33.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00029 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15324 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

system safety process, but this is often cable such that if the cable snaps the Those test plans must show that any not well-reflected in the current brakes engage and stop the elevator from FSS component is still capable of regulations. As a result, applicants often falling. The FAA has granted waivers to performing as required when subjected are confused by qualification testing the redundancy requirement of section to the qualification test environmental requirements asserted by the FAA for D417.5(c) for fail-safe safety-critical levels plus the total number of RLVs when there are no explicit systems that have been integrated in exposures to the maximum expected qualification testing requirements in such a way that a loss of power to that environmental levels for each of the part 431. system would result in direct thrust flights to be flown. Previously flown termination of the launch vehicle FSSs must also abide by § E417.13(a)(3), ii. Current Fault Tolerance though deactivation of normally-closed and the components must undergo one Requirements valves. Also, ELOS determinations have or more reuse acceptance tests before Fault-tolerance is the idea that a been issued for flight termination each flight to demonstrate that the system must be designed so that it is receivers that have fail-safe commands component still satisfies all its able to perform its function in the event that are issued on signal loss because performance specifications when of a failure of one or more of its the failure of the system automatically subjected to each maximum predicted components. In a fault-tolerant design of results in termination of the flight and environment. Additionally, tests for a safety-critical system, no single the constraint of flight hazards. Less reuse must compare performance credible fault should be capable of prescriptive fault-tolerant design measurements to all previous tests to increasing the risk to public safety regulations could enable such designs ensure no trends emerge that indicate beyond that of a nominal operation. instead of requiring waivers or ELOS performance degradation in the Typically, a fault-tolerant design applies determinations. component that could prevent the redundancy or a system of safety Operations licensed under parts 431 component from satisfying all its barriers to ensure the system can and 435 may not have traditional FSSs, performance specifications during function, though perhaps with reduced but the need for fault-tolerance is flight. As the lines have blurred between performance. An example of a fault- implicitly derived from the system ELVs with significantly reusable safety- tolerant design is an aircraft with safety process of § 431.35(c) and (d), as critical systems and RLVs, these multiple engines that can continue it is often a necessary control for an requirements still contain good safety flying even if one of the engines fails. identified hazard. The FAA views fault- policy, but they are constrained by their The current part 417 regulations cover tolerance as a necessary characteristic of limited coverage of only traditional fault-tolerant design of FSS components any reliable system. FSSs. as a set of explicit prescriptive The current fault tolerance provisions While operations licensed under part requirements. For instance, § 417.303(d) lack clarity in the scope of their 431 are focused on RLVs, neither part specifically lists fault-tolerance as a applicability to RLVs and reentry 431 nor part 435 contain any explicit requirement of an FSS command control vehicles because they are implicit in the requirements placed on reuse. Like all system design, requiring that no single system safety processes of hazard other aspects of safety-critical system failure point be able to inhibit the identification and mitigation. As with requirements, reuse under these parts is system’s function or inadvertently the testing requirements, a lack of governed by the system safety process of transmit a flight termination command. regulatory clarity is detrimental to both § 431.35. Safety-critical systems that do An operator must demonstrate that the applicants and the FAA, leading to not account for expected lifecycle, command system, in accordance with confusion, a drawn-out application refurbishment, and reuse do not § 417.309(c), is fault tolerant through acceptance process, and lengthy adequately meet the hazard analysis, identification of possible discussions to arrive at a clear identification and risk mitigation of the failure modes, implementation of understanding of how fault tolerance is system safety requirements. Implicit in redundant systems or other mitigation applicable to a proposed operation. the system safety requirements, measures, and verification that the commensurate testing is required to iii. Current Reuse Requirements mitigation measures will not fail demonstrate that the planned lifecycle simultaneously. Appendix D of part 417 Safety-critical FSSs of ELVs generally performance remains accurate. Reuse of (section D417.5) further details single undergo a single flight. Therefore, very safety-critical components is a potential fault tolerance and prescribes little life-cycle planning is required for hazard that needs to be mitigated. redundancy of command strings that are them unless an operator seeks to reuse Reuse induces stress on components structurally, electrically, and certain safety-critical components. and systems that can degrade mechanically separated to ensure that However, ELV operators must still operational performance if not any failure that would damage, destroy, account for environments that the FSS accounted for in design and testing. or otherwise inhibit the operation of one is expected to encounter throughout the Additionally, ‘‘reuse’’ implies multiple redundant component would not inhibit lifecycle of the system, including uses of a component after its initial the operation of the other redundant storage, transportation, installation, and intended lifetime or outside of its initial component. flight, which generally are built into intended operating environments. Based The current ELV regulations are qualification and acceptance testing on industry best practices, intended use prescriptive and often dictate specific levels. Lifecycle planning is a more and lifetime should be designed into implementations of fault-tolerance significant concern for reusable safety- components initially; qualification and where other forms may be adequate. For critical systems because near-total reuse acceptance testing should be based on instance, a fail-safe approach has been is an expected part of their operation. predicted operating environments that used in the rationale of past applicants Current parts 415 and 417 contain encompass the entire lifetime of a that use thrust termination systems to requirements for the reuse of ELV FSS system; and lifecycle management protect public safety. A fail-safe design components. To be a licensed ELV practices should be used to refine initial is a system that can fail in a controlled operator, an applicant must submit to predictions. The current lack of a clear, way, such that the failure will still the FAA any reuse qualification testing, unified, and simple requirement that ensure public safety, like elevator brakes refurbishment, and acceptance testing explicitly covers reuse for all safety- held open by the tension of the elevator plans, in accordance with § 415.129(f). critical systems leads to prescriptive

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00030 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15325

constraints on ELV operators and remove and recomplete acceptance Proposed § 450.143 would clearly regulatory confusion for RLV and testing prior to reuse of flight safety state the requirements for all safety- reentry operators who are unfamiliar system components between each flight critical system components and with the implicit requirements of a as an untenable burden both in terms of eliminate the ambiguity that exists in system safety process. cost and time. Furthermore, the ARC the current regulations regarding also noted that continued acceptance required testing of safety-critical system iv. Consolidation of Design, Test and testing of flight hardware to predict components that are not a part of an Documentation Requirements environmental levels plus margins puts FSS. While FSSs are safety-critical The FAA proposes to consolidate the undue strain on flight systems and can systems, their criticality requires design, test and documentation significantly reduce their lifespan. additional requirements beyond requirements for safety-critical systems To remedy the confusion resulting proposed § 450.143. The consolidated and components, both identified by a from a current lack of regulatory clarity performance requirements for FSS system safety process and as part of an for RLVs and reentry vehicles, proposed components are detailed in proposed FSS, currently found in parts 415 and § 450.143(c) and (d) would explicitly § 450.145, and are discussed in the 417, 431, and 435. Specifically, the FAA require qualification testing of the ‘‘Flight Safety System’’ section of this proposes to provide performance-based design and acceptance testing of the preamble. requirements for safety-critical systems, safety-critical flight hardware. To As the proposed rule seeks to make including fault tolerant design, design remedy the implied design constraints the safety requirements of § 450.143 qualification testing, hardware of current detailed requirements for applicable to all commercial space acceptance testing, and the verification ELVs, proposed § 450.143(c) and (d) launch and reentry vehicles, there of flight environments to assess the life- would be general, high-level should be better clarity across the cycle of safety-critical systems for reuse requirements for demonstrating the industry and the government regarding purposes. performance of safety-critical system what is required of safety-critical Under proposed § 450.143, all safety- design, and that the system is systems for both design qualification critical systems would be required to operational and free from defects and testing and flight hardware acceptance meet these requirements, including a errors. testing. Also, as recommended by the FSS that also would be required to meet Specifically, proposed § 450.143(c) ARC, the FAA’s proposal would allow the additional requirements of proposed would require an operator to for the possibility of other forms of § 450.145. By having a consistent set of functionally demonstrate 85 the design acceptance testing methodologies and overarching requirements regulating the of a vehicle’s safety-critical systems at quality controls, subject to approval of design, testing, and documentation of conditions beyond its predicted the FAA, for safety-critical components safety-critical systems and hardware, operating environment. The design that are not directly covered by the the FAA anticipates that applicants qualification tests should include flight safety system requirements. This would be enabled to implement new enough margin beyond predicted option should enable new business risk-mitigating design strategies under a operating environments to demonstrate practices but maintain the safety clear and consolidated regulatory that the system design can tolerate verification necessary to ensure public regime. New technologies that emerge manufacturing variance or safety. would be covered by the general environmental uncertainties without The ARC did not speak specifically to requirements without causing regulatory performance degradation. fault tolerant design but did indicate delays due to confusion, increasing Proposed § 450.143(d)(1) would that vehicle reliability and architecture paperwork burdens required for require operators to perform a should be considerations in the FAA’s requesting waivers, or waiting for future functional demonstration of any safety- evaluation of novel systems. Proposed rulemaking changes necessary to allow critical systems by exposing them to § 450.143(b) would require an emerging technologies. These criteria their predicted operating environment applicant’s safety-critical system to be would be the standards for with margin. The performance of the designed so that no single credible fault demonstrating that such systems can flight hardware during the test would be would impact public safety. This survive and perform to an adequate required to demonstrate that the flight proposal would provide clarity to the level of safety in all operating units are free of defects, integration or scope of the requirement of fault- environments. workmanship errors, and are ready for tolerance by defining it as an explicit The ARC recommended that better operational use. Alternatively, an design performance requirement. It standards need to be developed applicant would be able to comply with would replace many specific regarding safety-critical systems. The proposed § 450.143(d)(2) instead of prescriptive requirements in part 417’s ARC pointed out that there is no single proposed § 450.143(d)(1). If an applicant subpart D and appendices D and E with process or procedure that documents an chooses to comply with proposed a single general performance acceptable way to go through a system § 450.143(d)(2), it would be required to requirement and clarify the scope of design and determine safety-criticality, ensure functional capability and that the applicability for RLV and reentry and it asked for better guidance on flight hardware remains free from error vehicle applicants. Additionally, by safety-criticality, given that usually and defect during its service life through requiring only that the safety-critical industry views criticality more from a a combination of in-process controls systems be designed to be fault tolerant mission assurance point of view. More and a quality assurance process. This so that no single credible fault can lead generally, the ARC requested a more flexible approach to acceptance testing to increased risk to public safety, the performance-based regulatory regime, would relieve some of the burdens of a proposed regulations would allow with a clearer focus on safety and traditional acceptance testing regime flexibility as to the method an operator greater flexibility for novel operations. and would add clarity that these uses to comply with the requirements. In regards to reuse and maintenance, the demonstrations are required for all For example, the FAA anticipates that ARC suggested that requirements should safety-critical flight hardware. an operator might choose to comply be focused on maintaining reliability of with proposed § 450.143(b) with a inputs. The ARC specifically called out 85 Functional demonstration is generally achieved design that provides for redundancy for the section E417.13 requirement to through testing. systems that can be duplicated or

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00031 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15326 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

through damage-tolerant design for demonstrate to the FAA how they § 450.143(f)(4) and (5), applicants would those safety-critical systems (like would ensure reused safety-critical be required to detail their plans for primary structures) that cannot be components will not degrade in lifecycle monitoring by describing any redundant. It is expected that this performance. The FAA anticipates that instrumentation or inspection processes flexibility would accommodate such a demonstration would include used to assess reused safety-critical technical innovation. Additionally, an elements such as qualification of the systems, and the criteria and procedures operator would be able to satisfy the design for its intended lifetime; for any service life extension proposed fault-tolerance requirement by fail-safe acceptance testing to screen for those system components. Much like designs that have traditionally been components; monitoring of the rest of the FAA’s proposal, approved through ELOS determinations, environmental levels during use; and applicants of any vehicle type are eliminating the need for applicants to monitoring component health through already expected to provide this apply for additional FAA review and inspections for either disposal or information, but the requirements have evaluation. refurbishment. been distilled into high-level, The ARC advised the FAA to focus on While the lifecycle management generalized requirements to allow for verifying the veracity of maintenance requirement would give the applicant maximum operational flexibility while processes for reuse, combined with flexibility on implementation, the still identifying the inputs the FAA alternatives to acceptance testing on per proposed rule would require applicants needs to verify compliance with the safe flight basis. The FAA believes it has to consider the implementation details performance and operation addressed the testing alternatives in this such as maintenance, inspection, and requirements. While FSSs are NPRM and agrees that the processes and consumable replacement. With the additionally subject to the requirements procedures to ensure safety-critical flexibility of the top-level requirement, of proposed § 450.145, the proposed systems are safe for reuse are an applicants could continue to employ requirements for safety-critical systems important part of lifecycle validation. rigorous, per flight acceptance testing of would clarify existing practice and Given safety-critical systems are safety-critical components, or with enable novel concepts of safety and essential to public safety, the FAA enough flight data they may be able to safety-critical design. proposes that an operator would be employ a system more similar to required to validate predicted operating commercial aviation where flown 2. Flight Safety System environments against actual operating components can be assessed in light of An FSS is an integral tool to protect environments and assess component life the actual operating environment and public health and safety and the safety throughout the lifecycle of the safety- planned component reuse does not of property from hazards presented by a critical unit. This validation can be require component testing on a per vehicle in flight. An FSS allows an done through an initial fatigue life flight basis. Monitoring of environments operator to exercise positive control of assessment and continual accounting of and assessment of safety-critical a launch or reentry vehicle, allowing an remaining components life or through a hardware for reuse is expected to affect operator to destroy the vehicle, comprehensive inspection and the probability of failure that would terminate thrust, or otherwise achieve maintenance program that accounts for feed back into FSAs as a check that risk flight abort. An extremely reliable FSS damage accumulation and fault to public safety is not increased. These that controls the ending of vehicle flight detection. flexible, top-level requirements for according to properly established rules Proposed § 450.143(e) would require safety-critical systems would make nearly ensures containment of hazards that predicted operating environments explicit the currently implicit reuse within acceptable limits. For that be based on conditions expected to be requirements of parts 431 and 435’s reason, the FAA considers an FSS a encountered in all phases of flight, system safety process, improving safety-critical system. The FAA recovery, preparation, and regulatory clarity and operational currently requires an FSS for ELVs. transportation. It would also require an flexibility, while still requiring the Most RLVs—aside from unguided operator to monitor the environments important planning, monitoring, and suborbital vehicles utilizing a wind experienced by safety-critical systems in assessments necessary to ensure public weighting system or certain vehicles order to validate the predicated safety. where the vehicle’s operation is operating environment and assess the To demonstrate compliance with the contained by physics—derive from the actual component life left or to adjust proposed performance requirements, the system safety process the need for some inspection periods. While the system FAA proposes clear application FSS to mitigate flight hazards. safety and FSS approaches to reuse can requirements in § 450.143(f). As in the Traditional FSSs for ELVs are further define specific requirements, the current § 431.35(d)(3) and (5), an comprised of an onboard flight FAA proposes more general applicant would have to describe and termination system (FTS), a ground- requirements on the operator to account diagram all safety-critical systems in its based command and control system, for the complete lifecycle of each safety- application. Similar requirements exist and tracking and telemetry systems. critical system, considering the design, for ELV flight safety systems of part Historically, the flight safety crew testing, and use of safety-critical § 415.127(b) and (c). Section monitoring the course of a vehicle components. Allowing operators to 450.143(f)(3) also would require a would send a command to self-destruct determine a proposed lifecycle for a summary of the analysis detailing how if the vehicle crossed flight safety limit safety-critical system, to demonstrate applicants arrived at the predicted lines and in doing so threatened a operational capabilities and operating environment and duration for protected area. Redundant transceivers environmental endurance through all qualification and acceptance testing. in the launch vehicle would receive the testing, to devise processes for This is current practice, and proposed destruct command from the ground, set monitoring the lifecycle of the safety- § 450.143(e) makes this requirement off charges in the vehicle to destroy the critical system, and setting criteria and explicit for RLVs and reentry vehicles. vehicle and disperse the propellants so procedures for refurbishment or The proposed requirements are also that an errant vehicle’s hazards would replacement allows operators flexibility more generalized and adaptable than the not impact populated areas. While this in their business plans. Having this current component-level requirements method of flight abort through ordnance flexibility would allow applicants to for ELVs. Under proposed is conventional, the FAA currently does

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00032 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15327

not require an FSS to be destructive, as prescriptive FSS design, performance, acceptable system safety analysis made explicit in the definitions of FSS testing, and analysis requirements. identifies and assesses the probability in both §§ 401.5 and 417.3. Under part 417, an FSS must consist of and consequences of any reasonably There has been some innovation in an FTS, a command and control foreseeable hazardous event and safety- FSSs—thrust termination systems are system,89 support systems (like tracking critical system failures during launch used frequently and most RLVs can and telemetry),90 and identification of flight that could result in a casualty to demonstrate regulatory compliance with the functions of any personnel who the public. Based on current practice, part 431 with a safety system that operate FSS hardware or software.91 most RLVs must have some method to achieves a controlled landing in the Together, these requirements allow for a reliably achieve flight abort to fully event of an aborted flight. As the very limited range of FSS concepts mitigate flight risks and consequences, commercial space transportation because they are primarily focused on either in the form of a pilot that can industry has matured, operators have containment of hazards by destruction safely abort flight using system controls, proposed FSS alternatives. These of the vehicle or stage. a more traditional FSS that is designed alternative approaches include fail-safe Section 417.301(b) permits applicants and tested in the same manner as is single string systems that trade off to propose alternative FSSs, which do required for ELVs, or a system that can mission assurance and redundancy, not need to satisfy one or more of the meet the requirements for an alternative other fail-safe consequence mitigation prescriptive requirements of subpart D FSS under § 417.301(b). The lack of an systems, and dual purpose systems such of part 417. This provision is intended explicit requirement for an FSS in part as FSSs that reuse the output of safety- to enable greater flexibility for 431 often leads to confusion regarding critical GPS components for primary innovation without negatively what is expected for applicants navigation avionics. These alternative impacting safety. The FAA approves an mitigating hazards through flight abort. approaches are not well governed by the alternative FSS if an operator Reentry vehicles under part 435 are existing regulations. establishes through a clear and also subject to a system safety process convincing demonstration that a launch to identify hazards and mitigate risks to i. Current Regulatory Framework for would achieve an equivalent level of public health and safety under non- FSS safety to an operation that satisfies all of nominal flight of the reentry vehicle and The present ELV licensing the existing FSS requirements. any payload. Because § 435.33 points to requirements in parts 415 86 and 417 Alternative FSS, like traditional FSS, part 431, an acceptable system safety include lengthy and detailed must still undergo rigorous analysis and analysis for reentry also assesses the requirements for the performance of an testing to demonstrate the system’s probability and consequences of any FSS and its components, as well as reliability to perform each intended reasonably foreseeable hazardous events detailed testing and reporting function. during the reentry flight that could requirements. These requirements were Unlike ELVs, RLVs are not explicitly result in a casualty to the public. Unlike originally adopted to match current required to have an FSS, but the part 431, most part 435 reentries do not practices at Federal ranges. Section requirement for an FSS and its require an FSS because it is generally 417.107(a) identifies the need for an FSS reliability requirement is derived as an accepted that, if controlled reentries while subpart D (§§ 417.301–417.311) essential hazard mitigation from a become uncontrolled, the vehicle is identifies the performance requirements robust system safety process under part unlikely to substantially survive reentry. of an FSS and its component systems. 431. This requirement falls under the Due to the nature of the hazards Appendices D 87 and E 88 include § 431.35(c) requirement for applicants to associated with reentry, and since use a system safety process to identify breakup is expected for non-nominal 86 Part 415 contains the application requirements the hazards and mitigate risks to public reentries, an FSS often cannot to demonstrate compliance with part 417 and the health and safety under non-nominal significantly ameliorate a reentry flight’s test report requirements to demonstrate compliance flight of the vehicle and payload. An risk or consequence. A reentry applicant with the relevant appendices of part 417. Specifically, § 415.127 requires detailed must still account for the possibility of descriptions and diagrams of the FSS and the lot) that must undergo each test type. The a random reentry in its risk analysis subsystems, a list of all system components that testing plans must detail the environment, after attempting a reentry burn. have a critical storage or service life, detailed equipment, pass/fail criteria, measurements, other descriptions of controls and displays, the system testing parameters, and any analyses planned in ii. Autonomous Systems analyses of § 417.309, demonstration of compliance lieu of testing. with the performance requirements, installation 89 A command control system transmits a Current regulations do not allow an procedures, and tracking and monitoring validation command signal that has the radio frequency operator to rely solely on an procedures. Applicants must file all preliminary characteristics and power needed for receipt of the autonomous system to terminate a design data no later than 18 months before bringing signal by the flight termination system onboard the flight. At the time of their publication, any launch vehicle to a proposed launch site. launch vehicle. The command control system must human control capability was 87 Appendix D lists very detailed performance include equipment to ensure that an onboard flight requirements and design reliability requirements termination system will receive a transmitted considered critical to safety because including fault tolerance and redundancy, command signal and must meet specific neither software nor hardware had been environment survivability requirements, radio performance requirements in § 417.303. proven reliable to make flight command destruct parameters, remote and 90 Currently, under § 417.307 an FSS must termination decisions. Since that time, redundant safing mechanisms, positively controlled include two independent tracking sources and arming mechanisms, installation procedures, and provide the launch vehicle position and status to the FAA has approved the use of system health monitoring. It also requires vehicles the flight safety crew from liftoff until the vehicle autonomous FSSs for ELVs by finding to have an automatic or inadvertent separation reaches its planned safe flight state. Additionally, that they can meet the requirements of destruct system for any stage that does not possess data processing, display, and recording systems an alternative FSS under § 417.301(b). a complete command destruct system but is capable must display, and record, raw input and processed of reaching a protected area before the planned safe data at no less than 0.1 second intervals. Applicants were able to demonstrate flight state. 91 As part of the current requirements for an FSS, that the autonomous FSS achieved an 88 Appendix E to part 417 contains the tests and § 417.311(a) requires human intervention capability equivalent level of safety to a launch analysis requirements to verify the performance for flight termination to be initiated by flight safety with a human-in-the-loop as the risk to requirements of FTSs and their components. It crew. Therefore, § 417.307 requires design, test, and contains detailed component level charts for functional requirements for systems that support public safety was extremely low and the acceptance and qualification performance testing, the functions of a flight safety crew, including any autonomous system had been flight including the number of samples (or percentage of vehicle tracking system. tested in shadow mode. In past

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00033 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15328 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

rulemakings, the FAA has made clear components meets the requirements of an FSS for a vehicle operating in an area that, in requiring human intervention the design specifications, and other where the consequence of a flight failure capability for activation of an FSS, the preflight testing at the system or is higher. Generally, this proposed FAA did not intend to foreclose subsystem level to demonstrate relaxation of the FSS reliability development or use of autonomous functionality after installation. requirement—based on reduced systems. However, despite those The benefit of the part 417 and RCC potential consequence—is expected to assurances and the FAA findings of 319 method is that for qualification be applicable to operations launching or equivalent safety, current FAA tests, generally only three test units are reentering in remote locations or for regulations still expressly require that a required. Three units are required stages that do not overfly population capability exist for a person to intervene instead of many more because the units centers. In order to achieve these and make decisions for FSS activation. are tested with margin above their scalable, performance-based The FAA is proposing to update the predicted operating environment. requirements, proposed § 450.145(a) regulations to match the current practice Testing three units with the margin would contain two reliability standards of allowing autonomous FSSs. By specified achieves the required for an FSS. removing the outdated requirements for reliability and confidence levels of Proposed § 450.145(a)(1) would a human in-the-loop, the FAA believes 0.999 design reliability at 95 percent require any operator with a consequence ¥2 that it would encourage further confidence level, rather than having to of 1 × 10 CEC or greater in any innovation without negatively test 2,995 units at the predicted uncontrolled area for any vehicle impacting safety. The consequence operating environment with no margin. response mode to employ an FSS with analysis and reliability thresholds the standard design reliability of 0.999 iv. Proposed Reliability Standards for would continue to hold any potential at 95 percent confidence and FSS autonomous FSS to the rigorous commensurate design, analysis, and standards previously required of a Given the FAA anticipates that most testing. This reliability standard would human-initiated FSS, and the software commercial space vehicles will be consistent with various sections of as part of the autonomous FSS must be continue to control flight hazards part 417, in particular § 417.309(b)(2), demonstrated to meet reliability through the use of FSSs, the FAA that require major FSS component requirements. With the recent proposes in § 450.145 to continue to systems, such as onboard flight advancements of the requisite require a very reliable FSS in most termination systems and ground-based technology and the performance instances. Under the current command control systems, to be tested constraints of the FSS, the FAA is regulations, FSS not only enable an to demonstrate 0.999 design reliability confident that it is beneficial both to the operation to meet the collective and at 95 percent confidence. This reliability commercial space transportation individual risk criteria during flight but threshold would have to be industry and public safety to explicitly also protect against low-probability but demonstrated for the operation of the allow flight abort to be governed by high-consequence events near the entire system, including any systems capable autonomous systems. launch site or when flying over located on-board the launch or reentry populated areas. As previously vehicle, any ground-based systems, and iii. Current Requirement for Reliability discussed, the FAA’s proposal to any other component or support of a FSS quantify these low-probability but high- systems. Each FTS and command and control consequence events as CEC in proposed Alternatively, in order to make system must satisfy the predicted § 450.101(c) would clearly delineate regulations adaptable to innovative reliability requirement of 0.999 at the 95 which operations are required to use an operations while maintaining percent confidence level. For FSSs on FSS to control for risks and appropriate levels of safety, operations 92 both ELVs and RLVs, there are consequences. The CEC calculation is with lower potential consequences effectively only two methods of the consequence, measured in terms of would require an FSS with less currently demonstrating that a system EC, without regard to the probability of demonstrated design reliability at the meets reliability standards. The first failure. same confidence. Proposed method is to test 2,995 units at expected The underlying intent of the current § 450.145(a)(2) would require any operating environment levels with 0 prescriptive requirements was to have operator with a consequence of between ¥2 ¥3 failures to demonstrate a 0.999 design an FSS that could reliably perform flight 1 x 10 and 1 × 10 CEC in any reliability at a 95 percent confidence abort to restrict hazards from reaching uncontrolled area for any vehicle level. Given the cost of FSS populated or otherwise protected areas. response mode to only employ an FSS components, the cost of testing, and the The FAA also recognizes that vehicles with design reliability of at least 0.975 time required to conduct such tests, this operating in remote areas are less likely at 95 percent confidence and is not practicable. to have significant consequences in the commensurate testing. The FAA The second method arises out of RCC case of a flight failure. For operations considered simply setting the proposed 319. The FSS requirements codified in where the consequence of a flight failure § 450.145(a)(2) threshold an order of part 417, including component is less, the FAA has determined that, magnitude lower, at 0.99 design performance requirements, and while still being highly reliable, the FSS reliability with a 95 percent confidence, acceptance and qualification testing, may not need to be as highly reliable as to reflect the order of magnitude less were originally written to align FAA CEC from the consequence analysis. launch licensing requirements with the 92 As noted earlier, only operations that have a Absent other standards to demonstrate × ¥3 Federal launch range standards in RCC predicted consequence of 1 10 CEC or above for compliance with the reliability uncontrolled areas for each reasonably foreseeable 319. Like part 417, RCC 319 requires vehicle response mode in any one-second period of threshold, that would mean testing 299 qualification tests to demonstrate flight would be required to implement an FSS to units with 0 failures, instead of testing reliable operation in environments abort flight as a hazard control strategy. An FSS 2,995 units with 0 failures. However, in exceeding the expected operating would not be required for operations that can be consultation with NASA and Air Force shown to have a predicted consequence of less than environment for the system ¥3 representatives in the CSWG, the FAA 1 × 10 CEC; however, a hazard analysis would be components, acceptance tests to required for any operations without a FSS or has elected to propose that the reduced demonstrate that the selected batch of demonstrable physical containment. reliability threshold should be set at

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00034 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15329

0.975 design reliability with a 95 flight failure. Furthermore, while operators would be required to submit, percent confidence for lower rigorous tests and analysis should still or to provide the FAA access to, any test consequence vehicles. be expected for most FSSs, FAA reports associated with the flight safety While there are no established regulations would no longer prescribe a system test plans approved during the standards to demonstrate the 0.975 particular form of FSS. The proposed application process. These reports must reliability number, that threshold is performance measure of reliability to be submitted or made available no less consistent with reliability parameters in achieve safe flight abort to meet than 30 days before flight unless the RCC 324 and represents existing single collective and individual risk limits and Administrator agrees to a different time string flight reliability requirements. to mitigate the possibility of low frame under § 404.15. In the reports, The FAA is confident that industry probability but high consequence events licensees would have to clearly show associations will develop consensus is the best method for maintaining that the testing results demonstrate standards regarding design and testing safety while scoping FAA regulations to compliance with the reliability that sufficiently demonstrate that a govern only the function, not the form, requirements in proposed § 450.145(a). novel FSS design meets this reliability of FSSs. threshold. Until such time as an This is current practice under industry standard is established, v. FSS Design, Testing, and § 417.17(c)(1) and (4) through (6). proposed § 450.145(a)(2) in practice may Documentation Requirements To show the FSS is in compliance and result in single string or equivalent FSSs Applicants using a FSS of any can support the mission as intended, being approved for operations in remote reliability threshold would be required FSS reports would continue to be areas or for phases of flight that do not to meet the proposed § 450.143 safety- required to include testing reports that overfly populated areas. Similar to FSS critical system design, test, and detail the results of the approved that must meet the more reliable documentation requirements discussed subsystem and component-level testing, threshold, all means of compliance previously. As an FSS will always be including any failures, any actions would be required to be accepted by the considered a safety critical system, any necessary to correct for any failures, FAA in accordance with proposed operator utilizing an FSS must comply actual testing environment showing §§ 450.145(b) and 450.35. with the requirements to design their sufficient margin to predicted operating system as fault tolerant, conduct These proposed reliability environments, and a comparison matrix requirements would replace the existing qualification and acceptance testing, of the actual qualification and launch and reentry FSS licensing and provide evidence to validate acceptance test levels used for each requirements on all commercial space predicted operating environments and transportation missions. However, the component life. component compared against the FAA anticipates that, with the Proposed § 450.145(d) would include predicted flight levels for each consequence analysis driving the the application requirements for an FSS. environment. Proposed § 450.213(d)(4) requirement to have an FSS, most Similar to the current part 415 would require licensees to report any reentry operations would continue to requirements, proposed § 450.145 components qualified by similarity not require an FSS as is the current case would require applicants to describe the analysis or some combination of under part 435. For launch operators, FSS, including its proposed operation, analysis and testing. Preflight reporting applicants would still be required to and diagram the FSS in detail. The is necessary to demonstrate compliance demonstrate the reliability by FAA’s intent is to make these with the test plans approved in the submitting to review of their design, requirements less prescriptive than application and to demonstrate that the testing, and analysis. Operators would current regulations and also to allow FSS meets the reliability threshold prior still be required to monitor the flight more flexible time frames. Proposed to flight. environments actually experienced by § 450.145(d) would require applicants to Proposed § 450.215 (Post-Flight their FSSs in accordance with proposed submit any analyses reports and Reporting) would continue to require § 450.145(c) to corroborate the acceptance, qualification, and preflight licensees to submit a post-flight report qualification test data submitted to the test plans used to demonstrate that the no later than 90 days after an operation FAA. reliability and confidence levels are if there were any anomalies in the flight Proposed part 450 would consolidate met. Any test plans or documentation environment material to public health and clarify the performance would be required to detail the planned and safety and the safety of property, requirements for future FSSs. In doing test procedures and the test including those experienced by any FSS so, the FAA anticipates that some environments. Further, an applicant components; a practice currently operations will be relieved of the would have to submit procedures for required by § 417.25(c). RLV operators burden of unnecessarily stringent FSS validating the accuracy of any vehicle licensed under part 431 are not reliability requirements and that some tracking data utilized by the flight safety currently required to submit a post- operations will be able to utilize crew or the FSS to make the decision to flight report identifying anomalies that innovative concepts to achieve flight abort flight. While proposed are material to public safety and abort. By appropriately scaling FSS § 450.145(d) consolidates these reliability to consequence analysis, the application requirements and removes corrective actions, but the added burden FAA expects to see the emergence of prescriptive component-level design is expected to be minimal. To accurately new industry standards, increased use requirements, the proposed regulations report any such anomalies so that they of autonomous FSSs, and no measurable would not require substantially different may be corrected in future flights, adverse impact to public health and information than the FAA requires operators would also be required to safety or the safety of property. There is today to demonstrate that FSSs meet monitor the FSS during each flight, in expected to be no measurable adverse performance standards and will undergo accordance with proposed § 450.145(c). impact to public health and safety or the the required testing prior to flight. Any anomalies experienced by the FSS safety of property because the lowered would be considered material to public reliability threshold will only apply to vi. Reporting Requirements health and safety and the safety of launches and reentries which would not Under the preflight reporting property and, therefore, would need to create significant consequences, given a requirements in proposed § 450.213(d), be included in post-flight reporting.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00035 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15330 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

vii. ARC Recommendations design is flexible and open to systems that are already considered The ARC suggested that, in a innovation as long as the reliability reliable. The FAA maintains that for performance-based licensing scheme, thresholds for flight abort are met. 0.999 design reliability at 95 percent, the regulations should be flexible with The ARC also discussed a number of the qualification testing of three or more regard to FSSs and allow an operator to concepts that industry believes should units may be required to reduce the propose a means of achieving the be considered in scaling an FSS’s likelihood of either anomalous test performance metric without dictating a necessary reliability as determined passes or failures. The FAA seeks specific hardware approach. For through the FSA. The ARC pointed comment on this approach. The FAA example, the ARC recommended that an specifically to population density, the also seeks comment on how SMC–S– operator should be able to propose an realm of reasonably foreseeable failures, 016 could be incorporated as an trajectory, size, and explosive alternative to having a destruct flight accepted means of compliance for capabilities of the vehicle. The FAA termination system. While, the FAA reliability demonstration of the lower proposes that these factors would be believes that the current regulations reliability criteria. contemplated as a part of the In discussions with Federal launch allow for non-destructive FSSs, it consequence analysis required in the range personnel, it has been suggested acknowledges that the preponderance of public safety criteria of proposed that testing and analysis requirements in the existing prescriptive requirements § 450.101(c), alongside traditional RCC 324 may be a more appropriate address FSSs that terminate flight measures of risk. In identifying FSS basis for evaluating a FSS meeting the through destructive means. The ARC reliability thresholds pegged to potential lower reliability threshold. The FAA recommended the current prescriptive consequence, or CE , the reliability of remains interested in identifying requirements be moved to a guidance C FSSs is determined through analysis standards that are applicable or could be document. As discussed previously, the that accounts for factors such as what drawn upon to develop means of FAA intends to recognize RCC 319 as population centers a vehicle or debris compliance to the proposed regulations. the accepted means of compliance in can reach and potential failure modes. The FAA is also not foreclosing the demonstrating that a FSS has a design The FAA anticipates that this would idea that vehicles can demonstrate the reliability of 0.999 at 95 percent address the ARC’s recommendation that reliability of the FSS or vehicle through confidence. The RCC 319 document vehicles with low risk to the public, flight history. The ARC pointed out in would maintain the common standards especially vehicles operating in remote their report that certain aspects of FSSs between all Federal launch and reentry and sparsely populated areas, may can be tested in flight—for example safety authorities but also would be require a lower demonstrated reliability. using an autonomous FSS in ‘‘shadow updated periodically to address the To the question of how an applicant mode’’ on-board a vehicle and testing evolving space transportation industry. might demonstrate the reliability of an the system’s function with no ordnance Industry could also develop new means FSS with a less than extremely reliable or other active destruct capabilities. The of compliance in the future, as design that does not otherwise meet FAA ultimately decided to not propose discussed below. current common standards like RCC any explicit requirements pertaining to The ARC also recommended that an 319, such as the FAA proposed acceptable flight testing as a means of FSS should not be required, proposing threshold of 0.975 at 95 percent allowing industry applicants and the instead that an operator should only be confidence, the ARC advised that FAA to develop new accepted means of required to meet risk calculations in the several approaches may already exist. compliance in the demonstration of FSA and may do so by utilizing a FSS. As previously discussed, the less reliability. While the FAA wishes to The FAA disagrees that an FSS should reliable FSS can be demonstrated by encourage the innovation and not be required, as there are other safety testing several hundred units under development of novel reliability factors to be considered beyond simple expected environments, instead of the demonstration standards, the FAA also individual or collective risk, namely, 2,995 tests required to demonstrate recognizes that such standards are not the consequence of a failure as design reliability of 0.999 at 95 currently developed and would require discussed earlier. However, the FAA has percent—but it is still likely that neither extensive evaluation before they could attempted to propose more flexible is practical or viable for most operators. be accepted as demonstrating fidelity regulations that would allow some In their place, alternative standards are and safety. Because the FSS is so critical operations to be licensed without an necessary to approximate the to flight safety in the instances where it FSS, or with novel concepts of FSS, or demonstration of the reliability is required, new reliability and an FSS that may require less extensive threshold through less burdensome compliance demonstration strategies demonstration of reliability. In means. The ARC report pointed to the must be accepted by the FAA prior to quantifying the low probability but high Air Force Space Command’s Space and application acceptance. consequence events that necessitate an Missile Systems Center Standard SMC– In discussing the scalability of FSS FSS beyond collective and individual S–016, ‘‘Test Requirements For Launch, requirements, the ARC proposed that risk limits, the FAA intends to more Upper-Stage and Space Vehicles,’’ as an the FAA delineate categories of clearly delineate when it would be example of a standard that allows for operators and vehicles. The suggested appropriate for an operation to forego an one unit of qualification testing, instead categories included a new vehicle by a extremely reliable FSS or an FSS of the standard three units required by new operator, a proven vehicle by an completely. If an FSS is not required, experienced operator, a derived vehicle RCC–319.93 The ARC noted that the applicant would be required to by an experienced operator, and standard may be useful for heritage demonstrate that hazards are contained considerations for vehicle hazard class or mitigated through a hazard analysis 93 As one company pointed out in the ARC report, and population density in operating and system safety principles. In SMC–S–016 and similar standards are for general areas. The FAA considered operator and addition to proposing the acceptability vehicle testing and do not consider the higher vehicle categories as a means of scaling of FSSs with a design reliability of 0.975 reliability required for FSS, whereas RCC 319 and FSS reliability requirements as an AFSPCMAN91–710 require additional margins and at 95 percent confidence, under certain certainty. The company believes that testing a alternative to consequence analysis, but situations, the FAA proposes to indicate single unit is not sufficient, unless there was a determined that the relevant measure of more clearly that FSS concept and tradeoff that increased the required test margin. public protection indicating the need for

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00036 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15331

an FSS is not experience, but risk and operator must satisfy the requirements meets a requirement in part 450. Such possible consequence. While less of part 420. In addition, a launch entities would include a Federal launch experienced operators will likely pose a operator must: (1) Describe its range operator, a licensed launch or higher risk, as accounted for in the procedures for informing local reentry site operator, any party that probability of failure, experience does authorities of each designated hazard provides access to or use of property not account for the potential area near the launch site associated with and services required to support a safe consequences of a vehicle failure. a launch vehicle’s planned trajectory launch or reentry under part 450, the Experienced operators with experienced and any planned impacts of launch U.S. Coast Guard, and the FAA. Other vehicle designs can propose operations vehicle components and debris; (2) entities that provide a service or that still pose a high risk to the public, provide any hazard area information to property could also include local, state, or an operation with low risk but high the local U. S. Coast Guard, or or federal agencies, or private parties. potential consequences in the event of equivalent local authority, for the For instance, a local fire department a failure. The FAA seeks comment on issuance of NTMs and to the FAA ATC might provide a standby service to the proposal to use consequence, not office, or equivalent local authority, that control a possible fire, a state agency operator experience, as a factor in level- have jurisdiction over the airspace could provide any number of services of-rigor. through which the launch will take such as road closures, and NASA might place for the issuance of NOTAMs; and provide telemetry capability. Although K. Other Prescribed Hazard Controls (3) coordinate with any other local agreements with local agencies, for 1. Agreements agency that supports the launch, such as example, may be necessary to ensure local law enforcement agencies, The FAA proposes to streamline the public safety, the FAA believes that it is emergency response agencies, fire existing agreement requirements by overly prescriptive to list in regulation departments, the National Park Service, removing specific requirements for a the specific entities with which each and the Mineral Management Service. operator must enter into an agreement. variety of agreements and procedures For launches of RLVs under part 431 and allowing an operator to determine This proposal would require an and reentries under part 435, an operator to enter into only those what agreements would be needed for operator must enter into launch and its particular operation. In § 450.147 agreements necessary for its particular reentry site use agreements with a operation. If an operator works with (Agreements), a vehicle operator would Federal launch range or a licensed be required to have written agreements multiple entities to satisfy requirements launch or reentry site operator that in proposed part 450, it would need with any entity that provides a service provide for access to and the use of or use of property to meet a requirement multiple agreements. However, if property and services required to agreements required under this in part 450. support a licensed RLV mission or Current § 417.13 requires a launch proposed section are already addressed reentry and public safety-related in agreements executed by the site operator to enter into an agreement with operations and support. Additionally, a Federal launch range to have access to operator, an operator would only need an operator must enter into agreements to enter into agreements with either the and the use of U.S. Government with the U.S. Coast Guard and the FAA property and services required to Federal launch range or other site regional office that has jurisdiction over operator and any entity with which the support a licensed launch from the the airspace through which a launch facility and for public-safety related site operator does not perform the and reentry will take place to establish necessary coordination. In particular, operations and support before procedures for the issuance of NTMs conducting a licensed launch from a Federal launch ranges almost always and NOTAMs. arrange for the issuance of NTMs and Federal launch range. The Federal As discussed earlier, there are NOTAMs for launches.94 launch range arranges for the issuances currently similar requirements under The proposal also contemplates of notifications to mariners and airmen. parts 417 and 431 and, by reference, agreements between a maritime or Currently, for launches from a non- part 435, for agreements to ensure that aviation authority other than the U.S. Federal launch site in the United States, NTMs and NOTAMs are implemented. Coast Guard or the FAA. Unless a launch operator must ensure that Part 417 references part 420, which also otherwise addressed in agreements with launch processing at the launch site contains requirements for these notices the site operator, the proposed rule satisfies the requirements of part 417. and requires operators to describe would require an operator to enter into For a launch from a launch site licensed procedures to ensure that these and such agreements for a launch or reentry under part 420, a launch operator must other notifications are accomplished. conduct its operations in accordance Part 417 requires an operator to execute that crosses airspace or impacts water with any agreements that the launch site agreements with multiple entities. None not under the jurisdiction or authority operator has entered into with any of the current requirements adequately of the U.S. Coast Guard or the FAA. Section 450.147(b) would require all Federal and local authorities. These addresses NTMs and NOTAMs when agreements to clearly delineate the roles include agreements with the local U.S. the U.S. Coast Guard or the FAA does Coast Guard district to establish not have jurisdiction, such as with and responsibilities of each party in procedures for the issuance of a Notice launches or reentries from or to foreign order to avoid confusion concerning to Mariners (NTM) prior to a launch and or international territories. Currently, responsibility for executing safety- with the FAA air traffic control (ATC) these agreements must be in place related activities. Section 450.147(c) facility having jurisdiction over the before a license is issued. However, in would require all agreements to be in airspace through which the launch will practice, the FAA sometimes accepts effect before a license can be issued. take place to establish procedures for draft agreements or makes the However, as noted earlier, the FAA the issuance of a Notice to Airmen submission of the executed agreements recognizes that agreements might not be (NOTAM) prior to the launch and for a condition of the license. finalized by the time the FAA is the closing of air routes during the Under proposed § 450.147, a vehicle 94 Typically, Federal ranges do not arrange for the launch window. For a launch from an operator would be required to enter into issuance of NTMs and NOTAMs for the disposal of exclusive-use site, where there is no a written agreement with any entity that a launch vehicle from orbit or the reentry of a licensed launch site operator, a launch provides a service or property that reusable launch or reentry vehicle.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00037 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15332 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

prepared to make a licensing by position individuals who implement and procedures related to a launch prior determination. Therefore, the regulation the program. The document must also to being called on to support a launch. would allow an operator to request a demonstrate how the launch operator It also requires a preflight readiness later effective date, contingent upon the implements the program, contain a table training and certification program be Administrator’s approval. An operator listing each hazardous operation or completed and prescribes the content could do this by providing the FAA the safety critical task certified personnel that must be included in such training. status of the negotiations involving the must perform, and include the position The current regulations are a burden to agreement including any significant of the individual who reviews personnel operators because they focus on FSSs issues that require resolution and the qualifications and certifies the and do not account for evolving expected date for its execution. personnel performing the task. In technologies, including autonomous Under proposed § 450.147(d), an § 417.105(b), an operator is required to FSSs. Removing the prescriptive applicant would be required to describe review personnel qualifications and requirements in § 417.311 and replacing each agreement in its vehicle operator issue individual certifications. The them with performance-based license application. An applicant intent behind this requirement was to requirements would alleviate this should clearly delineate the roles and ensure that qualified people perform the burden. responsibilities of each party to the required safety tasks. The ARC recommends that the agreement to support a safe launch or Neither part 431 nor part 435 have a proposed regulation ensure that the reentry. The applicant would also need personnel certification program applicant has a structure in place to to provide a copy of any agreement, or requirement or any personnel training protect public safety, and that the FAA portion thereof, to the FAA upon requirement; however, the need for use current requirements as guidelines request. The FAA recognizes that some personnel qualifications is a natural for evaluation and approval when portions of agreements may contain outcome of the system safety process. necessary. The FAA agrees that the business-related provisions that do not The FAA recognizes that the current regulations should ensure that pertain to FAA requirements. Those regulations in part 417 are inflexible personnel performing tasks that impact portions would not be required. The and that using a certification program is public safety are qualified to perform FAA seeks comment on its proposed not the only method to ensure qualified those tasks. As the industry grows and approach to agreements. personnel perform safety-critical tasks. operations become more frequent and Operators may use other methods to varied, operators need greater flexibility 2. Safety-Critical Personnel verify all training and experience in operational practices. Employing a Qualifications required for personnel to perform a task qualification program to ensure The FAA proposes to remove the is current. For example, an operator may personnel performing safety-critical certification requirements found in maintain training records to document tasks are trained is one factor in §§ 417.105, 417.311, and 415.113 and internal training and currency protecting safety of public and public replace them with performance-based requirements or completion standards property. requirements in § 450.149 (Safety- for its safety critical personnel. An Therefore, the FAA proposes to Critical Personnel Qualifications). operator’s issuance of individual remove the requirements for a Section 450.149 would require qualified certifications does not itself enhance certification program described in personnel to perform safety-critical public safety. If the personnel are §§ 415.113 and 417.105 and replace the tasks for launch and reentry operations. qualified through training and prescriptive requirements of § 417.311 The FAA also proposes to expand experience for each safety task with performance-based requirements personnel qualification requirements to performed, additional certification is that capture the intent of the current ensure that safety-critical personnel are unnecessary because no additional regulations—to ensure that an operator’s qualified to perform their assigned training is required for an individual to safety-critical personnel are trained, safety tasks. be issued a certification. Removing the qualified, and capable of performing An operator must qualify and train its certification requirement would also their safety critical tasks, and that their safety-critical personnel in performing reduce cost to the industry by removing training is current. Under proposed their safety-critical tasks for all vehicle the two-step process to allow qualified § 450.149, an applicant would be and license types because training personnel to perform safety-related required to identify in its application mitigates the potential for human error tasks. the safety-critical tasks that require during safety-critical operations. Additionally, the flight safety crew qualified personnel and provide its Currently, the FAA requires a personnel roles and qualifications requirements in internal training and currency certification program in part 417 for § 417.311, are prescriptive. Section requirements, completion standards, or personnel that perform safety-related 417.311(a) requires a flight safety crew any other means of demonstrating tasks. Specifically, § 417.105 requires to document each position description compliance with proposed § 450.149(a). that a launch operator employ a and maintain documentation of The proposed performance-based personnel certification program that individual crew qualifications, requirements would allow each operator documents the qualifications, including including education, experience, and to identify the safety-critical operations education, experience and training, for training, as part of the personnel and personnel needed for the operation. each member of the launch crew. The certification program of § 417.105. It would also allow an operator to launch operator’s certification program Section 417.311(b) describes the roles of determine what training, experience, must include annual reviews and the flight safety crew and explicitly and qualification should be required for revocation of certifications for states subjects and tasks that the crew each safety-critical task. The FAA negligence or failure to satisfy must be trained in and references the would consider any task that may have certification requirements. Section certification program. Finally, an effect on public safety and meets the 415.113 requires an operator to submit § 417.311(c) requires the flight safety definition of safety-critical found in a safety review document that describes crew members to complete a training § 401.5 subject to the requirements of how the applicant will satisfy the and certification program to ensure § 450.149. These tasks would include, personnel certification program familiarization with launch site, launch but are not limited to, operating and requirements of § 417.105 and identify vehicle, and FSS functions, equipment, installing flight safety system hardware,

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00038 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15333

operating safety support systems, affect public safety. Fatigue can degrade The 2006 final rule adopted the monitoring vehicle performance, a person’s ability to function and make current § 417.113(f), which is more performing flight safety analysis, the necessary decisions to conduct a performance-based than § 431.43(c)(4). conducting launch operations, safe launch or reentry operation. Since Section 417.113(f) requires that for any controlling public access, surveillance, the FAA started requiring rest rules, operation that has the potential to have and emergency response. With the many there have been no incidents resulting an adverse effect on public safety, the different kinds of operations currently from fatigue during a licensed launch or launch rules must ensure that the underway, an operator is in the best reentry. To maintain this level of safety, launch crew is physically and mentally position to identify the operations, the FAA proposes to continue requiring capable of performing all assigned tasks. personnel, and training needed for its rest rules in order to prevent fatigue and It also requires those rules to govern the operation. ensure operator personnel can perform length, number, and frequency of work The FAA would also require that an their duties safely. shifts, and the rest afforded to launch operator ensure personnel are qualified, A 1993 NTSB investigation of an crew between shifts. and that those qualifications are current, anomaly that occurred during a The ARC recommended the FAA use without requiring certification. The commercial launch from a Federal the § 417.113(f) approach as a basis for regulation would require proper training launch range found a high probability the proposed rest rules. The ARC of personnel and verification that each that fatigue and lack of rest prior to recommended that the regulations person performing safety critical tasks is launch operations contributed to should require each license applicant qualified. Under § 450.149, an applicant mistakes that resulted in the vehicle and operator to establish crew rest would be required to document all initiating flight while the range was in requirements applicable to their safety-critical tasks and internal a no-go condition.95 Launching in a no- individual operation and suggested that requirements or standards for personnel go condition increases risk to the public the FAA consider each operator’s rules to meet prior to performing the because the vehicle operates outside of through the application review and identified tasks during the application established boundaries and analysis. approval process. The FAA agrees with phase. The applicant would be required The NTSB found that the person who this approach. Additionally, the ARC to provide internal training and decided to proceed with the launch was suggested that the rest rules apply to currency requirements, completion not given enough time to rest after specific personnel with direct control of standards, or any other means of working extra hours the previous day. In the vehicle or launch or reentry decision demonstrating compliance with the addition, the launch was scheduled for making. While the FAA agrees with the requirements of § 450.149 in its early in the morning so the on-console intent of requiring all safety critical application. The applicant would also time was around 2:00 a.m. The NTSB personnel to adhere to rest rules, it does be required to describe the process for report recommended instituting rest not want to limit safety critical tracking training currency. In the event rules that allow for sufficient rest before personnel to the roles the ARC that a person’s qualification was not the launch operation. identified because it is prescriptive and current, either because their As a result of the 1993 NTSB report, does not allow for operational qualification does not meet the training the FAA issued rest rules in its 1999 flexibility. The FAA also agrees with the ARC currency requirements detailed in the final rule. The 1999 final rule required that it is up to the company to monitor application or because a new process or an applicant to ensure that its flight compliance with its rest rules. The FAA procedure has been instituted that has safety personnel adhere to Federal does not have an explicit requirement made the training inaccurate or launch range rest rules. In its 2000 final for an operator to monitor its incomplete, the individual would not be rule for RLVs, the FAA required rest qualified to perform safety-related tasks employees, only that it documents and rules, in § 431.43(c)(4), similar to the Air implements rest requirements. The FAA specific to the expired qualification. Force work and rest standards for Lastly, part 460 contains training and seeks comment on whether a specific launches and the FAA’s ELV qualification requirements for flight requirement for operator monitoring requirements.96 The specific and crew. Compliance with these would be necessary. Regardless, the detailed requirements set forth in requirements would meet the training FAA would monitor compliance on § 431.43(c)(4) fail to account for the and qualification requirements in occasion with its inspection program, as various factors that can affect crew rest proposed § 450.149 for flight crew. it does today with current crew rest such as the time of day of an operation, rules. 3. Work Shift and Rest Requirements length of preflight operations, and travel The FAA recognizes that launch and The FAA proposes to combine the rest to and from the launch or reentry site. reentry operations are varied. The FAA requirements of §§ 417.113(f) and considered using prescriptive 95 431.43(c)(4)(i) through (iv) into Special Investigation Report: Commercial requirements like those in § 431.43(c)(4) Space Launch Incident, Launch Procedure Anomaly proposed § 450.151 (Work Shift and Orbital Sciences Corporation, Pegasus/SCD–1, 80 to address rest rules. However, there are Rest Requirements) which would Nautical Miles East of Cape Canaveral, Florida, many factors that can affect crew rest require an applicant to document and February 9, 1993. Report PB 93–917003/NTSB/ that make a prescriptive regulation implement rest requirements that ensure SIR93–02, July 23, 1993; (https://www.ntsb.gov/ impracticably complex and inflexible safety/safety-studies/Documents/SIR9302.pdf). personnel are physically and mentally 96 Section 431.43(c)(4) contains requirements that for allowing alternate methods of capable of performing tasks assigned. are detailed and prescriptive. It requires vehicle compliance that take into account An applicant would be required to safety operations personnel to adhere to specific mitigations and unique circumstances. submit its rest rules during the work and rest standards. These requirements Section 450.151 would retain the prescribe the maximum length of workshift and the application phase. minimum rest period after such work shift current performance-based requirements Personnel involved in the launch or preceding initiation of an RLV reentry mission or of § 417.113(f) with modifications to reentry of expendable and reusable during the conduct of the mission. It also prescribes include launch and reentry operations. vehicles need to be physically and the maximum hours permitted to be worked in the The proposed requirements would cover 7 days preceding initiation of an RLV mission, the mentally capable of performing their maximum number of consecutive work days, and operations of expendable, reusable, and duties, especially those people making the minimum rest period after 5 consecutive days reentry vehicles and allow an operator decisions or performing operations that of 12-hour shifts. flexibility to employ rest rules that fit

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00039 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15334 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

the particular operations. Current critical tasks. The rest period before a procedures for coordinating use of radio § 417.113(f) requires that crew rest rules countdown is particularly important frequencies with any launch site govern the length, number, and because it can be affected by time of operator and any local and Federal frequency of work shifts, including the launch, reviews, and work needed to get authorities, including the FCC. rest afforded the launch crew between a vehicle ready for operation. While parts 431 and 435 do not shifts. Similarly, proposed § 450.151(a) The FAA also proposes to remove the contain explicit frequency management would require an operator to document term ‘‘crew’’ from the rest requirements. requirements, an operator is required to and implement rest requirements that The use of ‘‘crew’’ can be misleading identify and mitigate hazards, including ensure safety-critical personnel are and limiting. Operators could interpret hazards associated with frequency physically and mentally capable of crew to be flight crew only, whereas the management as part of the system safety performing all assigned tasks. Proposed rest rules are intended to apply to any process in § 431.35(c) and (d). Section § 450.151(b) would provide additional position affecting public safety. Under 431.35(c) requires operators to perform requirements regarding the aspects of this proposal, an applicant would be a hazard analysis and identify, work shifts and rest periods critical to required to submit rest rules to the FAA implement, and verify mitigations are in public safety, and would add a process that demonstrate compliance with place.98 for extending work shifts. proposed § 450.151. The FAA would Section 450.153 would replace the Proposed § 450.151(b)(1) would evaluate an operator’s rest rules in the current requirement in § 417.111(f) to require an operator’s rest rules to same way as it currently does under implement a frequency management include the duration of each work shift § 417.113(f) to ensure that personnel plan. In proposed § 450.153(a), the FAA and the process for extending this shift; affecting public safety are mentally and proposes to make these radio frequency including the maximum allowable physically capable of performing their management requirements applicable to length of any extension. This duties during launch or reentry any radio frequency used. This requirement would provide each operations, and that the rest rules satisfy proposed requirement would include operator with the flexibility to identify the requirements of proposed § 450.151. radio frequencies used not only in the duration of each work shift most While an operator would be able to launch vehicles, but also in RLVs and suited to the operation such that safety- create its own rest rules under proposed reentry vehicles. Because radio critical personnel are physically and § 450.151, an applicant would also be frequency requirements are a mitigation mentally capable of performing all able to use current rest rules. That is, for hazards associated with frequency assigned tasks. It would also require a § 431.43(c)(4) would be an acceptable management, the proposed process for extending a work shift. Work means of compliance to proposed requirements would not necessarily be shift length is important because § 450.151. The FAA would evaluate new requirements for RLVs or reentry performance decreases and fatigue other rest rules against this benchmark vehicles but would codify the need for increases as the length of the work shift and relevant standards. radio frequency management for RLVs increases. An operator should determine and reentry vehicles. 4. Radio Frequency Management the optimum length for a work shift that The FAA also proposes to maintain ensures personnel are capable of The FAA proposes to maintain the the substantive radio frequency performing their assigned tasks. current substantive requirements of requirements of current § 417.111(f) in Unforeseen circumstances can require § 417.111(f) for radio frequency proposed § 450.153(a). Although the personnel to work beyond the management and to expand the increased use of autonomous established work shift length. In such applicability of these requirements to termination systems makes frequency cases, under this proposal, the operator RLVs and reentry vehicles in proposed management less critical for flight would be required to have a process for § 450.153 (Radio Frequency termination, there are still many extending the work shift length up to a Management). The FAA also would operators that use command termination limit where personnel are no longer remove the current requirements to systems. Moreover, these requirements considered capable of performing their implement a frequency management remain applicable to autonomous duties. plan and to identify agreements for termination systems because operators Proposed § 450.151(b)(2) would coordination of use of radio frequencies still need to allocate radio frequencies to require an operator’s rest rules to with any launch site operator and local telemetry and tracking. There are also include the number of consecutive work and federal authorities. other hazards, such as electromagnetic shift days allowed before rest is Under § 415.119 and appendix B of interference and induced currents, that required. This requirement would part 415, an applicant for a launch can result from radio frequency provide each operator with the license is required to include a interference and that require mitigation. flexibility to identify the number of 97 frequency management plan in its Therefore, an operator would continue consecutive work shift days safety- application, and that plan must satisfy to be required to: (1) Identify each critical personnel may work such that the requirements of § 417.111(f). frequency, all allowable frequency they remain physically and mentally Specifically, current § 417.111(f) tolerances and each frequency’s capable of performing all assigned tasks. requires an operator to implement a Proposed § 450.151(b)(3) would require intended use, operating power and frequency management plan that source; (2) provide for monitoring of an operator’s rest rules to include the identifies each frequency, all allowable minimum rest period required between frequency usage and enforcement of frequency tolerances, and each frequency allocations; and (3) each work shift, including the period of frequency’s intended use, operating rest required immediately before the power, and source. The plan must also 98 flight countdown work shift. An One such hazard is radio interference that provide for the monitoring of frequency could disable a commanded FSS. An operator might operator would also be required to usage and enforcement of frequency mitigate such a hazard by ensuring that the power identify the minimum rest period allocations and identify agreements and level of the command transmitter is sufficient to required after the maximum number of ensure termination with high reliability (i.e., 0.999 at 95 percent). For reentry vehicles, radio work shift days allowed. Having enough 97 A radio frequency management plan describes frequencies for tracking are coordinated to ensure rest between work shifts is important to how an operator manages radio frequencies to meet there is coverage where needed as well as ensure personnel are able to perform termination or tracking requirements. communication with the vehicle.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00040 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15335

coordinate the use of radio frequencies operations, systems, equipment and has processed over 20 waivers to the 48- with any site operator and any local and personnel required by part 417, (2) hour requirement. In situations where Federal authorities. maintain and implement documented ELV operators have not requested a While no substantive changes are criteria for successful completion of waiver to the timing requirement, they proposed to the radio frequency each review, (3) track and document have held additional reviews just to requirements, this proposal would corrective actions or issues identified meet the timing requirement of the remove the current requirement that an during the review, and (4) ensure that flight readiness review. Additionally, operator’s frequency management plan launch operator personnel overseeing the FAA has issued at least three identify agreements and procedures for the review attest to successful enforcement letters because operators coordinating the use of radio completion of the reviews criteria in did not meet the timing requirement. frequencies with any launch site writing. Section 417.117(b)(3) requires The ARC recommended that the FAA operator and any local or federal an operator to conduct a launch distill reviews down to intent, list the authorities. Many of the agreements readiness review for flight within 48 minimum items the FAA reviews, and necessary for radio frequency hours of flight. The decision to proceed let the operator inform the FAA in the management would be covered in with launch must be in writing and license application where those items proposed § 450.147. signed by the launch director and any are and how they would be reported. In proposed § 450.153(b), an applicant launch site operator or Federal launch The FAA agrees that specific reviews would be required to submit procedures range. The launch operator must also are not required and proposes a list of or other means to demonstrate poll the FAA to verify that the FAA has items required to address readiness. The compliance with the requirements of not identified any issues related to the FAA also agrees that specific rehearsals § 450.153(a) as part of its application. launch operator’s license. are not required because there are a This requirement would provide an For RLV operations, § 431.37 requires variety of methods by which an operator applicant flexibility in the manner of an applicant to submit procedures that could meet readiness requirements. As demonstrating compliance, such as ensure readiness of the vehicle, discussed later, the FAA proposes to using checklists or continuing to use a personnel, and equipment as part of the remove the specific requirement for frequency management plan. application process. These procedures rehearsals. The FAA proposes to revise and 5. Readiness: Reviews and Rehearsals must involve the vehicle safety operations personnel and the launch consolidate the readiness requirements The FAA proposes to revise and site and reentry site personnel involved of parts 417 and part 431 into proposed consolidate the readiness requirements in the mission. The procedures must § 450.155, which would require an of parts 417 and 431 into a performance- include a mission readiness review and operator to document and implement based regulation that would require an specify that the individual responsible procedures to assess readiness to operator to document and implement for the conduct of the licensed activities proceed with the flight of a launch or procedures to assess readiness to is provided specific information upon reentry vehicle. The FAA anticipates proceed with the flight of a launch or which he or she can make a judgement that under this proposal an operator reentry vehicle. The FAA currently as to mission readiness. would be able to achieve readiness by requires an operator to be ready to Additionally, as part of the readiness various methods including, but not perform launch or reentry operations. requirements, § 417.119 requires an limited to, readiness meetings, tests, Readiness, which is currently addressed operator to rehearse its launch crew and rehearsals, static fire tests, wet dress through readiness reviews and systems to identify corrective actions rehearsals,99 training, and experience. rehearsals, has three components— necessary to ensure public safety that While current regulations require readiness of the vehicle, of the cover the countdown, communications, specific readiness reviews, proposed personnel, and of the equipment. In and emergency procedures, and it § 450.155 (Readiness) would remove the consolidating these parts, the FAA specifically directs the launch operator requirement for flight readiness reviews, proposes to remove the current in how to conduct its rehearsals. Section including the requirements for a launch requirements to conduct rehearsals, to 431.33(c)(1) similarly requires an readiness review no earlier than 15 days poll the FAA at the launch readiness applicant to monitor and evaluate before flight and the flight readiness review, and to provide a signed written operational dress rehearsals to ensure review no earlier than 48 hours before decision to proceed. The FAA also they are conducted in accordance with flight. The FAA proposes to remove proposes to eliminate the specific procedures required by § 431.37 to these requirements because it has found review requirements of §§ 417.117 and ensure the readiness of vehicle safety that multiple readiness reviews may not 431.37. operations personnel. be necessary to demonstrate readiness. Launch rates have increased The requirements of both parts 417 For instance, readiness can be substantially since the adoption of parts and 431 are prescriptive and do not determined by a single meeting close 417 and 431. In 2007, an operator might provide an operator with much enough in time to the launch or reenty only launch one to three times a year. flexibility as to compliance. The lack of to ensure there have been no material Currently, there are operators that have flexibility is evidenced by the issuance changes to readiness, such as failure of launch rates exceeding 20 launches per of waivers and documentation of non- a radar or telemetry system. Under the year. Readiness requirements have compliances. This requirement has proposed rule, it would be up to the become overly burdensome as operators created a burden on operators because operator to propose how it would spend time on rehearsals and reviews they must spend extra resources ensure readiness, and whether such that were meant to ensure readiness. requesting waivers and responding to procedures would include one or more Timing requirements have resulted in enforcement actions. Processing waivers readiness reviews, testing, or some other additional reviews or non-compliances. and conducting additional reviews costs means. By eliminating the timing Operators in a high launch rate time and money for the FAA, as well. requirements, operators with high environment may not benefit much from For example, § 417.117(b)(3) requires a launch rates could propose how they rehearsals and added reviews. flight operator to hold a launch Currently, § 417.117 requires that a readiness review no earlier than 48 99 A wet dress rehearsal includes at least a partial launch operator (1) review the status of hours before flight. Since 2007, the FAA fueling of a vehicle with a liquid propellant.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00041 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15336 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

will ensure they are ready for launch decision to proceed contained in readiness to implement a mishap plan and whether that involves one or more § 417.117. This polling is unnecessary in the event of a mishap. The proposal readiness reviews held close enough in because the FAA will always inform the would allow flexibility to meet the time to the launch to ensure no operator of any licensing issues as soon readiness requirement for implementing significant changes occur between the as the FAA becomes aware of them. The a mishap plan by allowing an operator review and the launch. Removing the FAA also proposes to remove the to propose a procedure acceptable to the specific requirements for reviews and requirement that an operator provide a FAA. Thus, an operator would have the tests would not relieve the operator signed certificate of the decision to ability to develop procedures to ensure from having to perform a test or hold a proceed with launch or reentry readiness through training, rehearsals, review that is necessary for determining operations because the FAA has not or other means that might be more readiness, rather it would provide the used any signed certificate required applicable to its vehicle and mission. operator with flexibility to develop and under § 417.117 for any launch or The FAA would still expect an operator propose those tests and reviews most reentry. All the certificates have been to review any lesson learned, corrective suitable for the operation in order to filed and have not served any purpose action, or changes to procedures ensure readiness. The FAA would other than to comply with the resulting from any mishap plan evaluate and make a determination on requirement under § 417.117. The FAA rehearsals or mishap investigations. the adequacy of the proposed believes that removing the requirements Under § 450.155(b), an applicant procedures during the licensing process. to poll the FAA and to have a signed would need to demonstrate compliance The FAA plans to publish a draft certificate to proceed would not affect with the requirements through means-of-compliance guide with the public safety and would relieve burdens procedures that may include a readiness publication of the proposed rule, which to comply with those requirements from meeting close in time to flight and should include acceptable approaches. the operator and the FAA. describe the criteria for establishing In the long term, the FAA plans to refer The FAA proposes to remove the readiness to proceed with the flight of to an AC or standard for every requirements in § 417.119 because a launch or reentry vehicle. rehearsals are not always needed to performance-based requirement. 6. Communications Instead of requiring specific readiness achieve readiness. It is important that reviews, proposed § 450.155 would the launch team be familiar with Currently, the FAA requires operators require that an operator document and operations. Rehearsals are a good way to to implement communications plans to implement procedures to assess ensure proficiency with procedures, ensure that clear lines of authority and readiness to proceed with the flight of exercise communications and critical situational awareness are maintained a launch or reentry vehicle. As part of safety positions as a team, and identify during countdown operations. The the application requirements, the areas where the operator needs to communications plan was the result of operator would be required to improve. However, the FAA a 1993 NTSB investigation discussed demonstrate compliance with the acknowledges that rehearsals are not the earlier. One of the contributing factors requirements of proposed § 450.155 only way to ensure the readiness identified in the investigation was the through procedures that may include a performance requirement is met. This lack of clear communications between readiness meeting close in time to flight. proposal would allow an operator to different ranges and the operator. The Unlike §§ 417.117 and 431.37, proposed determine what methods would be best FAA requirements for communications § 450.155 would not specify particulars suited to ensure readiness for its plans are currently found in of what the procedures must contain. operation. Operators that have high §§ 417.111(k) and 431.41 and are nearly However, the operator would be launch rates may not need to rehearse identical. Currently, §§ 417.111(k) and required to document and implement personnel that were involved in a 431.41 require an operator to implement procedures that at a minimum address: similar launch days or weeks earlier. a communications plan. Part 435 (1) Readiness of vehicle and launch, However, licensees that have not requires a reentry vehicle operator to reentry, or landing site, including any launched for a long time or that are comply with the safety requirements of contingency abort location; (2) readiness launching for the first time may need part 431, including § 431.41. Both of safety-critical personnel, systems, rehearsals to meet some of the readiness §§ 417.111(k) and 431.41 require an software, procedures, equipment, requirements. Operators with high operator’s communications plan to property and services; and (3) readiness launch rates could demonstrate define the authority of personnel, by to implement a mishap plan. The FAA readiness with a readiness review and individual or position title, to issue proposes to require that the procedures would not have to hold rehearsals, and ‘‘hold/resume,’’ ‘‘go/no-go,’’ and abort address these particular areas because training could fill gaps where actual commands; assign communication the FAA has determined that a safe operations do not provide familiarity networks so that personnel have direct launch or reentry, at a minimum, with certain aspects of operations. For access to real-time safety-critical requires the vehicle, site, and safety example, if no anomalies are information required to issue ‘‘hold/ personnel to be ready and all safety experienced during actual operations, resume,’’ ‘‘go/no-go,’’ and any abort systems and safety support equipment the operator could hold a rehearsal or decisions and commands; ensure to be working properly. Additionally, provide additional training to exercise personnel monitor common intercom being prepared to implement a mishap the anomaly resolution process. channels during countdown and flight; plan would ensure that public safety is Current § 417.117(b)(3)(xi) requires an and implement a protocol for using maintained during a mishap because operator to review launch failure initial defined radio telephone personnel would be familiar with their response actions and investigation roles communications terminology. roles and ready to perform their duties and responsibilities and § 417.119(c) Additionally, § 431.41(b) requires that in order to return the vehicle and site to requires an operator to have a mishap the applicant submit procedures to a safe condition after the mishap. plan rehearsal; current § 431.45 contains ensure that the licensee and reentry site The FAA also proposes to remove the the requirements for a mishap plan for personnel receive copies of the requirement that an operator poll the RLVs. Section 450.155(a)(3) would communications plan, and that the FAA at the launch readiness review and require an operator to document and reentry site operator concurs with the provide a signed certificate of the implement procedures to ensure plan. For launches from a Federal

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00042 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15337

launch range, § 417.111(k) also requires current practice, where FAA inspectors that contain all the checklists and the Federal launch range to concur with often review the operator’s final countdown procedures. There are many the communications plan. communications procedures. Given that advantages to electronic records, such as Operators launching from Federal the FAA would no longer require ease of dissemination and configuration launch ranges comply with § 417.111(k). demonstrations of compliance at the control. As electronic file use becomes Operators submit a communications application stage for communications more common, the need for a physical plan during the application process and and preflight procedures, operators may notebook becomes unnecessary. What is coordinate with the Air Force. The be required to make revisions to those critical for safety is that all launch communications plan includes lines of procedures to resolve issues identified personnel have the same set of authority, identification of who has during compliance monitoring. procedures. Due to the dynamic nature access to which channels, protocols for 7. Preflight Procedures of countdown procedures, operators communication and procedures for provide checklists and procedures used decision processes. Often, the Under § 417.111(l), an operator is in prior launches to meet the communication plan is not fully required to develop and implement a application requirements. The FAA developed at the time the operator countdown plan that verifies each evaluates these checklists and applies for a license, so operators often launch safety rule and launch commit procedures during the license submit a representative plan during the criterion is satisfied, personnel can evaluation. However, because the application process and then provide a communicate during the countdown, checklists and procedures being final plan prior to the first launch under the communication is available after the evaluated are not final, operators must a license. flight, and a launch operator will be able submit all updates to these documents The FAA proposes to retain the to recover from a launch abort or delay. as part of the continuing accuracy of the substantive communications This countdown plan must cover the license requirements. FAA inspectors requirements in §§ 417.111(k) and period of time when any launch support ensure the checklists and procedures are 431.41 in § 450.157 (Communications), personnel are required to be at their the most current, and that configuration in paragraph (a), and remove the designated stations through initiation of control is maintained. specific requirement to implement a flight. It also must include procedures The FAA proposes to streamline the communications plan. Section for handling anomalies that occur current countdown procedures and 450.157(b) would also require an during countdown and any constraints requirements in §§ 415.37(a)(2), operator to ensure currency of the to initiation of flight, for delaying or 417.111(l), and 431.39(a)(2) and replace communication procedures, similar to holding a launch when necessary, and them in § 450.159 (Preflight the current requirement in § 417.111(e). for resolving issues. It must identify Procedures). In doing so, the FAA The FAA would preserve these each person by position who approves proposes to remove the requirements for requirements because all key the corrective actions, and each person safety directives or safety notebooks and participants must work from the same by position who performs each for a countdown plan, and the operation or specific action. It also must communications procedures in order to requirement to file such plans because include a written countdown checklist avoid miscommunication that could there are many methods of documenting 100 that must include, among other items, lead to a mishap. the preflight procedures that do not Section 450.157(c) would require an verification that all launch safety rules involve a plan or notebook. Although operator during each countdown to and launch commit criteria have been the proposed preflight procedures record all safety-critical satisfied. In case of a launch abort or would not be required to be submitted communications network channels that delay, the countdown plan must as part of the license application are used for voice, video, or data identify each condition that must exist process, FAA inspectors would still transmissions to support safety-critical in order attempt another launch, ensure that such preflight procedures systems. This is substantially the same including a schedule depicting the flow requirement as in §§ 417.111(l)(5)(vii) of tasks and events in relation to when are implemented. Unlike the current regulations, the and 431.41. The FAA would retain this the abort or delay occurred and the new FAA proposes a performance-based requirement because communications planned launch time, and identify each requirement where an operator would recording is often critical to mishap interface and entity needed to support need to implement preflight procedures investigations. recovery operations. Currently Lastly, the FAA would not require § 415.37(a)(2) requires that the applicant would verify that all flight commit operators to submit communication file procedures that ensure mission criteria are satisfied before flight and procedures during the application constraints, rules and abort procedures that ensure the operator is capable of process because generally such returning the vehicle to a safe state after are listed and consolidated in a safety 101 procedures are not mature at the time of directive or notebook. Similarly, the a countdown abort or delay. This application, and hence are unlikely to mission readiness requirements of aligns with the intent of current be the ones used during the actual § 431.37(a)(2) require that procedures regulations while permitting flexibility countdown. Under the proposal, the that ensure mission constraints, rules, on how the safety goal is achieved. As FAA would not approve the and abort plans are listed and a result, there would be no impact on communications procedures prior to consolidated in a safety directive safety resulting from the removal of the licensing and would rely instead on an notebook. current prescriptive requirements. inspection process that ensures the Currently some operators have paper Additionally, proposed § 450.159(b) operator is following the requirements notebooks containing all the checklists would require an operator to ensure the for communications procedures. These and countdown plans. These notebooks currency of the preflight procedures, inspections would be consistent with are updated frequently, even up to the and that all personnel are working with day before a launch with change pages the approved version of the preflight 100 NTSB Special Investigation Report: by every member of the launch team. 101 Commercial Space Launch Incident, Launch This process can sometimes lead to A countdown abort includes launch scrubs, Procedure Anomaly Orbital Science Corporation, recycle operations, hang-fires, or any instance in Pegasus/SCD–1, 80 Nautical Miles East of Cape confusion and configuration issues. which the launch vehicle does not lift-off after a Canaveral, Florida (February 9, 1993); at p. 53. Other operators have electronic systems command to initiate flight has been sent.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00043 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15338 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

procedures, similar to the current Although not explicit, the current ensure public safety, but at times overly requirement in §§ 415.37(a)(3) and regulations for ELV and RLV operations prescriptive and unduly conservative. 431.39(c). The FAA would preserve effectively require surveillance and The FAA has waived several these requirements because all key evacuation of all regions where the waterborne vessel protection participants must work from the same individual risk criterion would be requirements 106 in light of advanced preflight procedures in order to avoid a violated by the presence of any member ship monitoring technology and risk mishap. of the public. calculation models. The FAA’s first The FAA anticipates that the current waiver of the § 417.107(b)(3) requirements of § 417.111(l)(1) through The net effects of the current ELV requirement illustrates the need for this (6) would be a means of compliance regulations are: (1) An operator must proposed change.107 In approving the under the proposal, but not the only establish a ship hazard area sufficient to first waiver and numerous subsequent means of compliance. By allowing ensure the PI for any ship does not waivers to enable the proposed option, × ¥5 alternative means of compliance, the exceed 1 10 for any debris that the FAA assessed the technological proposed regulations would provide could cause a casualty, (2) an operator advances previously discussed. In this greater operational flexibility and must monitor the ship hazard area prior assessment, the FAA reviewed the procedure streamlining across all to initiating the flight operation, and (3) Federal launch range input data and operation types. if a large enough ship enters the probabilistic casualty models that the waterborne vessel hazard area to exceed Air Force at the 45th Space Wing uses 8. Surveillance and Publication of ¥5 the 1 × 10 PI criterion, then the to quantify individual and collective Hazard Areas launch must be scrubbed or delayed risks to people on waterborne vessels The FAA proposes to adopt until the ship exits the hazard area. during the launch countdown for space surveillance of a flight hazard area Appendix B to part 417 directs a launch launch missions. The FAA found that regulations based on recent granted operator to evacuate and monitor each the 45th Space Wing’s public risk waivers and to better align with current launch site hazard area to ensure analyses use accurate data and scientific practices at the Federal launch ranges, compliance with the risk criteria in methods that are mathematically valid, where most commercial launches take § 417.107(b)(2) and (3) and provide an with reasonably conservative place, and to codify current practice that adequate methodology to achieve this assumptions applied in areas where eliminates unnecessary launch delays end. The FAA designed this significant uncertainty exists. In that while maintaining public safety. This methodology to be consistent with Air instance, the FAA performed proposal would only alter the Force range safety requirements in 2006 independent analyses using alternative substantive requirements applicable to and to ensure that the cumulative PI to methods to estimate the casualty risks the surveillance of ship (waterborne ¥ any ships would not exceed 1 × 10 5 for for multiple foreseeable scenarios vessel) hazard areas not the surveillance any debris expected to exceed the involving debris impacts on various of land or aircraft hazard areas. kinetic energy or overpressure types of waterborne vessels and found Therefore, this discussion will focus thresholds established by § 417.107(c). that large passenger vessels anywhere primarily on the proposal’s effect on the between the launch point and the first surveillance of waterborne vessel hazard Current § 417.223(b) requires public stage disposal zone can contribute areas. The specific requirements for notices for flight hazard areas. A flight significantly to the estimated EC from a conducting a flight hazard area analysis hazard area analysis must establish the launch. The FAA also found that small are discussed later in the preamble. ship hazard areas for notices to mariners boats (too small to have Automatic Current regulations on establishing that encompass the three-sigma impact Identification System (AIS) required 108) and surveilling hazard areas, including dispersion area for each planned debris located close to the launch point should ship hazard areas, for ELVs are found in 105 impact. Section 417.121(e) contains not produce significant individual risks. §§ 417.205 102 and 417.223 103 and part procedural requirements for issuing However, no past waivers involved 417, appendix B.104 Part 431 does not notices to mariners (and airmen). changes in the areas where surveillance set explicit requirements for the Furthermore, § 417.111(j) requires a was mandatory in current practice, only surveillance of waterborne vessel hazard launch operator to implement a plan where ships were allowed to be present areas, and the FAA has not yet issued that defines the process for ensuring in order for the launch to proceed. a license under part 431 over water. that any unauthorized persons, ships, Section 450.161 (Surveillance and However, both §§ 417.107(b)(2) and trains, aircraft or other vehicles are not Publication of Hazard Areas) would 431.35(b)(1)(ii) require that an operator within any hazard areas identified by require an operator to publicize, survey, ensure all members of the public are the FSA or the ground safety analysis. and evacuate each flight hazard area cleared of all regions, whether land, sea, In the plan, the launch operator must before initiating flight or reentry, to the or air, where any individual would be list each hazard area that requires extent necessary to ensure compliance exposed to more than 1 × 10¥6 P . C surveillance to meet §§ 417.107 and with proposed § 450.101. Proposed 417.223, as well as describe how the § 450.161(a) does not change the need 102 Section 417.205 requires the flight safety analysis to employ risk assessment, hazard launch operator will provide for day-of- for surveillance relative to the current isolation, or a combination of risk assessment and flight surveillance of the flight hazard requirements in parts 417 or 431 for partial isolation of the hazards to demonstrate area to ensure that the presence of any people on land or aircraft because the control of risk to the public. member of the public in or near a flight proposal would continue to require that 103 Section 417.223 requires, in part, that an FSA include a flight hazard area analysis that identifies hazard area is consistent with flight any regions of land, sea, or air that must be commit criteria developed for each 106 For example, see Waivers of Ship Protection surveyed, publicized, controlled, or evacuated in launch. In practice, these regulations Probability of Impact Requirement, 81 FR 28930 order to control the risk to the public from debris (May 10, 2016). impact hazards. have been comprehensive enough to 107 81 FR 28930 (May 10, 2016). 104 Section B417.5(a) of appendix B to part 417 108 AIS is required on commercial vessels 65 feet states that a launch operator must perform a launch 105 In addition, a flight hazard area analysis must in length or more, towing vessels 26 feet in length site hazard area analysis that protects the public, establish the aircraft hazard areas for notices to or more, and other self-propelled vessels certified aircraft, and ships from the hazardous activities in airmen that encompass the 3-sigma impact to carry more than 150 passengers or carrying the vicinity of the launch site. dispersion volume for each planned debris impact. dangerous cargo.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00044 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15339

an operator ensure all regions where any maritime activities. The IMO has capable of causing casualties to people individual member of the public would developed a risk-based approach to in a class of aircraft (e.g., business jets). ¥6 be exposed to more than 1 × 10 PC are safety and environmental protection An operator would be required to evacuated. However, the proposal regulations, which identifies a key employ some type of surveillance (e.g., would remove the requirement to threshold of one in a million (1 × 10¥6) telemetry data, or remote sensors such evacuate and monitor areas where a probability of fatality per year for as a camera or radar) to verify that the waterborne vessel would be exposed to individual crewmembers, passengers, jettisoned stage behaves as assumed by ¥5 greater than 1 × 10 PI currently and members of the public ashore the FSA if that behavior is germane to required by Appendix B to part 417, (considered third parties by the IMO). the size of the aircraft hazard area. paragraph 417.5(a). The IMO guidelines equate individual Additionally, § 450.161(c) would The FAA proposal to include people risks at the 1 × 10¥6 probability of require an applicant to publicize on ships in the collective risk fatality per year as broadly acceptable warnings for each flight hazard area, computation (see proposed for maritime activities, and specifically except for regions of land, sea, or air § 450.101(a)(1) and (b)(1)) would state that individual risks below this under the control of the vehicle or site explicitly allow the application of risk level are negligible and no risk operator or other entity by agreement. If management principles to protect reduction required. The proposed the operator relies on another entity to people on waterborne vessels. For § 450.101(a)(2) and (b)(2) requirements publicize these warnings, the proposal example, an applicant could apply would ensure that no person will be requires the operator to verify that the conservative estimates of the ship traffic present on ships where the individual warnings have been issued. The FAA ¥6 and vulnerability to demonstrate risk exceeds 1 × 10 PC . This notes that some operators already follow acceptable public risks. In proposed requirement is consistent, and this practice. The proposed § 450.161(a), surveillance would only be reasonably conservative, with respect to requirements would allow warnings that required to the extent necessary to the IMO guidelines as explained in the are consistent with current practice but ensure compliance with the public RCC 321–07 Supplement.110 Thus, the would also allow more flexibility for safety criteria, including individual and FAA proposes to codify requirements warnings to mariners in accordance collective risks as well as notification of for the development and surveillance of with proposed § 450.133(b). Notably, planned impacts from normal flight ship hazard area that are reasonably § 450.133(b)(1) would be consistent with events capable of causing a casualty. For consistent with IMO guidelines for current practice at the Federal launch instance, an operator would not need to formal safety assessments. ranges based on input from the CSWG, perform surveillance of areas where the As previously discussed, there were and § 450.133(b)(2) and (3) are based on risk to any individual would be no more important advances in ship surveillance current U.S. Government consensus ¥6 112 than 1 × 10 PC, unless surveillance techniques in recent years. In the past, standards). Proposed § 450.161(d) was necessary to ensure acceptable observation techniques posed would also require an applicant to collective risks. significant risks to launch operators. For describe how it will provide for day-of- The proposal would generally allow example, the only known deaths related flight surveillance of flight hazard areas, operators the option to use the current to launch operations at Cape Canaveral if necessary, to ensure that the presence approach in part 417, where were five occupants of a helicopter that of any member of the public in or near surveillance is required to ensure no crashed at sea shortly after 2 a.m. on a flight hazard area is consistent with ship is exposed to more than 1 × 10¥5 April 7, 1984, while flying surface flight commit criteria developed for PI, because that would generally be surveillance for the scheduled launch of each launch or reentry. sufficient to ensure compliance with a Trident 1 missile from the USS This proposal is consistent with the proposed § 450.101. In addition, the Georgia.111 In many cases, the proposal executive branch policy to replace proposal would also provide the option would relieve the requirement for the prescriptive requirements with for launch and reentry operators to use type of surveillance that posed performance-based criteria.113 the new technology, including modern significant risks to launch operators in Specifically, the FAA proposes to surveillance techniques, and include the past. replace the ‘‘one-size-fits-all’’ approach people in waterborne vessels as part of Section 450.161(b) would require to ship protection that effectively the collective risk calculation as surveillance sufficient to verify or prevents launch or reentry operations to approved by previous waivers.109 update the assumptions, input data, and proceed if ships are in identified hazard Current practice is to issue waivers to results of the flight safety analyses. areas irrespective of the estimated risks operators as an alternative to scrubbing Given there are numerous assumptions posed to people on those vessels. For or delaying a launch or reentry due to and input data that are critical to the example, during the launch of the waterborne vessels in an area where the validity of the flight safety analyses, this Falcon 9 from CCAFS to deliver the ¥5 PI exceeds 1 × 10 . Thus, the proposal requirement could have a variety of SES–9 payload to orbit, SpaceX was would curtail the need for waivers. surveillance implications beyond the delayed by the presence of a tug boat While the proposal would relax the surveillance necessary to ensure the towing a large barge inside the ship current part 417 requirement to ensure public exposure at the time of the hazard area in compliance with the that no ship is exposed to more the 1 × operation is consistent with the FAA’s requirement in § 417.107(b) to ¥5 10 PI, the FAA notes that the assumptions and input data for the limit the PI for waterborne vessels to 1 requirement to ensure no ships are flight safety analyses. For example, an × 10¥5.114 Under the proposal, delays present in areas where the individual FSA could assume that a jettisoned such as this would be avoided without × ¥6 risk exceeds 1 10 PC is consistent stage remains intact to impact or breaks the need for waivers. The FAA proposes with international guidelines. The up into numerous pieces that are all to replace the ‘‘one-size-fits-all’’ International Maritime Organization approach with the performance-based (IMO) is the United Nations 110 Range Commanders Council Risk Committee criteria of the collective and individual organization for safety and of the Range Safety Group, Common Risk Criteria for National Test Ranges: Supplement. RCC 321–07 environmental protection regulations for Supplement, White Sands Missile Range, New 112 RCC 321–17 Standard. Mexico, 2007, p. 5–50. 113 SPD–2 (May 24, 2018), at Section 2b. 109 81 FR 28930 (May 10, 2016). 111 Air Force News Print Today (Apr. 8, 2011). 114 81 FR 28930 (May 10, 2016).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00045 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15340 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

risk limits in proposed § 450.101, and in under the same environmental concerns that the direct and indirect doing so would require an operational conditions. This unpredictability is effects of a natural or triggered lightning delay only when necessary to ensure exacerbated further by the fact that a strike may disable a vehicle’s FSS such acceptable individual and collective triggered lightning strike can occur even that the launch operator could not stop risks. This approach was safely and when the vehicle is penetrating a benign the vehicle if it veered outside the successfully used, by waiver, for all cloud, or is outside a cloud that is not impact limit lines (i.e., due to degraded Falcon 9 launches from the CCAFS and producing lightning. signal). The FAA renamed these KSC starting in 2016. The FAA seeks Lightning can and has caused or requirements to ‘‘Lightning Flight comment on the proposed approach. necessitated the destruction of launch Commit Criteria’’ (LFCC). Application of public risk and reentry vehicles in flight. This The LFCC in appendix G to part 417 management for the protection of people destruction may occur both by physical consist of 10 natural and triggered in waterborne vessels has the potential damage (direct effect) to structural or lightning avoidance rules that provide for reducing launch costs by reducing electronic components from lightning criteria to minimize the risk of a launch the number of operational delays and attachment to the vehicle and by vehicle being struck by lightning or scrubs due to ships in areas where the damage or upset to electronic systems triggering lightning. One rule contains individual and collective risks are from a nearby discharge (indirect effect). criteria for avoiding natural lightning, nevertheless acceptable. Because it is a The direct and indirect effects of a the remaining nine contain avoidance major procurer of launch services, lightning discharge pose hazards to the criteria for triggering or initiating reduced launch costs would be of direct safety critical systems of launch and lightning when flying through, or near, benefit to the U.S. Government. It would reentry vehicles, such as the FSS. If specific cloud types or phenomena also help to make the U.S. launch damage to the vehicle’s safety critical known to produce natural or triggered industry more competitive components renders it inoperable or lightning. Taking into account the internationally by reducing launch causes safety-critical systems to electrification process and the delays and scrubs. malfunction, there may be no way to properties of electric fields within clouds, the triggered lightning rules 9. Lightning Hazard Mitigation stop the vehicle from reaching the public. For example, the damage may establish time and distance The FAA proposes to remove cause the command signal that instructs requirements for distinct cloud types appendix G to part 417 and replace it the vehicle to stop thrusting, or to abort (e.g., cumulus cloud, attached or with the performance-based the mission, to not be received. detached anvil cloud, thick clouds) requirements of § 450.163 (Lightning Two such triggered lightning events believed to contain the necessary Hazard Mitigation). The current occurred in 1969 and 1987, during environmental conditions to produce requirements in appendix G to part 417 ascent. In 1969, when a manned Apollo elevated electric fields. These time and are outdated, inflexible, overly XII 117 vehicle lost power to its distance criteria help mitigate the threat conservative, and not explicitly Command Module, the launch was of triggering lightning by increasing the applicable to many RLVs and reentry seconds away from beginning initiation probability that the electric field, at a vehicles. of its abort command. In 1987, an given distance or after a length of time, Lightning is an atmospheric discharge unmanned ELV lost its guidance, will be below the threshold needed to of electricity, and can either occur navigation and control 118 and began produce lightning. Other rules contain naturally or be ‘‘triggered.’’ Triggered careening towards the range safety prescriptive requirements and lightning can be initiated as a result of impact limit lines. The range safety thresholds for not launching if there are a launch vehicle and its electrically- officer had to terminate its flight. high-surface electric fields as measured conductive exhaust plume passing These two incidents led to the by a ground-based field mill, or if there through a strong pre-existing electric establishment of the present-day is a threat of a vehicle becoming charged 115 field. However, the triggering lightning launch commit criteria if it penetrates a cloud that contains 120 phenomenon is unpredictable because (LLCC), which the Air Force and NASA frozen precipitation. there are many conditions that must adhere to for all launches from a Federal Unfortunately, codifying the LLCC occur in order for the breakdown of the launch range. The Lightning Advisory into appendix G of part 417 has led to electric field resulting in a lightning Panel (LAP),119 an advisory body to the two major challenges. First, because the strike to occur. One condition is the Air Force and NASA, is responsible for science behind triggering lightning is enhancement factor of the launch or reviewing and proposing modifications not fully known, the criteria were reentry vehicle that acts as a conductor. to the LLCC. Adherence to the LLCC has developed with a margin of safety for The extremities of the vehicle, such as resulted in zero lightning-caused launch large ELVs, such as the Titan IV. As a the nose radius of curvature coupled incidents for over thirty years. consequence, the criteria may be overly with the effective length of the vehicle The FAA codified the LLCC into conservative for certain types of (taking into account the plume length) Appendix G to part 417 to address vehicles. While the LAP has updated will establish the viability of a lightning the LLCC to keep pace with the strike. Furthermore, a launch vehicle’s 117 Merceret et al., ed., A History of the Lightning advances in science and technology, the propellants will have different Launch Commit Criteria and the Lightning Advisory FAA rulemaking process is lengthy, and conductivity characteristics, leading to Panel for America’s Space Program. NASA/TP– does not permit appendix G to be varying lengths; 116 as a result, not every 2010–216283, 10, Section 2.3 (August 2010). updated with the frequency necessary to 118 Merceret et al., ed., A History of the Lightning keep up with the changes to the LLCCs. vehicle will trigger a lightning strike Launch Commit Criteria and the Lightning Advisory Panel for America’s Space Program. NASA/TP– Revisions to appendix G are likely to be 115 Roeder, William P. and Todd M. McNamara, 2010–216283, 31, Section 4.3.2 (August 2010). A Survey Of The Lightning Launch Commit Criteria, 119 The LAP’s expertise range from in-depth 120 Triboelectrification is a phenomenon that can American Meteorological Society, Aviation Range knowledge of the physics of lightning, electric occur when a launch vehicle flies through a region and Meteorology Conference. fields, and clouds, to lightning impacts on launch in a cloud that contains frozen precipitation. Under 116 E. P. Krider, M. C. Noogle, M. A. Uman, and vehicles and statistics of electric field strength in the right conditions, frozen precipitation can R. E. Orville. ‘‘Lightning and the Apollo 17/Saturn specific environmental conditions. Its membership deposit a charge on the vehicle. If the launch V Exhaust Plume,’’ Journal of Spacecraft and is primarily academia, although the Air Force and vehicle is not treated, an electrostatic discharge Rockets, Vol. 11, No. 2 (1974), p. 72–75. NASA fund this organization. could result.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00046 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15341

out-of-date by the time they are relieved the burden from the operator to much higher triggering threshold (i.e., it finalized and published. As a result, seek approval from the FAA, and was harder to initiate lightning) than appendix G preserves much of the allowed the operator to immediately use that of a Titan IV ELV and that they each original LLCCs outdated standards, different radar wavelengths or wait until had different triggering thresholds which leaves a discrepancy between the the FAA updated appendix G. within each concept vehicle and phase LLCC and appendix G. The fourth ELOS determination of mission. For instance, the glide phase In an effort to address this issue, the informed the launch operator that was shown to have a higher triggering FAA made four ELOS determinations. satisfying NASA–STD–4010 would meet threshold than a powered phase. On the The first ELOS determination permitted the requirements of appendix G to part other hand, the study noted that many the use of a new maximum radar 417.123 This ELOS determination uncertainties remain with reflectivity method 121 to determine enabled an operator to use the more up- understanding the triggering conditions. whether the radar reflectivity values to-date LLCC in place of the outdated Therefore, the results of the study were below the risk threshold for LFCC in appendix G. It also recognized recommended that until more accurate triggering lightning in the cloud. that the NASA–STD–4010 contained the triggering thresholds for the differing Because this new measurement most current LLCCs and removed the vehicle concepts can be quantified, the technique was not in appendix G, the burden from the FAA to issue an ELOS avoidance criteria should be followed. launch operator could not benefit from determination for every new update to The FAA requests comments on this this improvement unless it requested the LLCC. proposal. and received approval to use this The FAA only codified the LFCCs The ARC recommended the intent or technique rather than follow the criteria into part 417, and not parts 431 and 435. performance goal of the current LFCC be currently in appendix G. The ELOS While the LFCCs are not explicitly captured into performance-based determination relieved the burden on included in part 431 or 435, § 431.35(c) requirements that allow for the the operator to seek approval to use a requires an applicant to employ a consideration of each launcher’s different radar reflectivity measurement system safety process to identify and mission profile, general vehicle and process; therefore, allowing more mitigate hazards, including lightning. flight safety system components, and opportunity for the launch operator to Additionally, while not all launch and other factors that may reduce the take advantage of the improvement reentry vehicles have the same currently-required 30-minute wait.127 rather than wait until a final rulemaking threshold to trigger lightning, they do The ARC also recommended that the incorporated the change. have the potential to incur direct or prescriptive requirements in Appendix When the LAP updated the LLCCs indirect effects that may impact their G be placed in a guidance document again, the FAA issued a second ELOS safety critical systems. Therefore, in that provides acceptable means of determination reducing the distance order to protect public health and meeting the performance-based requirement for the flight path of the safety, the LFCCs are an appropriate requirements. Finally, the ARC launch vehicle in relation to a thick mitigation strategy for suborbital RLVs estimated that launch and site operators cloud, if the radar reflectivity thresholds and reentry vehicles that can induce could save hundreds of thousands of 122 were satisfied. The issuance of this lightning that could affect public safety. dollars, or more, for each avoidance of ELOS determination was necessary to In 2006, the FAA sponsored a study to launch scrubs and no-go calls due to enable operators to use the most recent conduct a triggered lightning risk unnecessarily conservative weather thick cloud rule without needing to seek assessment for five different concept restrictions. individual ELOS determinations from suborbital RLVs, from two different The FAA generally agrees with the the FAA or waiting for the FAA to launch sites, to gain an understanding of ARC’s recommendation and proposes to update appendix G through a the potential risk of triggering lightning replace the detailed prescriptive LFCC rulemaking. for these new categories of vehicles.124 in appendix G with performance-based The third ELOS determination also The study took into account the vehicle requirements in proposed § 450.163. It resulted from an update to the LLCCs design, mission profile, and propellants, would also provide an AC that contains and allowed for use of a shorter radar as well as the lightning climatology of an accepted means of compliance with wavelength to measure radar reflectivity a given launch site. In 2010,125 a follow- the proposed § 450.163(a)(1), including if the criteria for attenuation due to 128 on study was performed for four reference to NASA–STD–4010 and rainfall and beam spreading were met. concept vehicles at a total of four would also include other relevant This modification allowed a launch 126 standards for the design of a vehicle to operator to make use of weather radars different launch sites. The study showed that all concept vehicles had a withstand the direct and indirect effects that have wavelengths between 3 and 5 of a lightning discharge. The FAA seeks cm, in addition to radars with 123 The NASA–STD–4010 has been adopted by comment on this approach. wavelengths of 5 cm or greater. Similar both NASA and the Air Force. When NASA The FAA anticipates that a to the other ELOS determinations, this published the LLCCs in a NASA Standard performance-based regulation, document it provided uniform engineering and accompanied by an associated AC and 121 technical requirements in one location lessening This radar reflectivity method allowed government standards, would resolve measurement of a hydrometeor by a radar with a confusion to which version of the LLCCs were wavelength of less than 5 centimeters but greater currently being applied. than 3 centimeters if: (1) The surface of the radome 124 Krider, Phil, E. et al., Triggered Lightning Risk 127 The ARC stated, ‘‘intent or performance goal, of the radar was hydrophobic and the precipitation Assessment for Reusable Launch Vehicles at the of the stated requirements.’’ The FAA has rate at the radar site was less than 15 mm/hr (0.59 Southwest Regional and Oklahoma Spaceports, interpreted the phrase ‘‘of the stated requirements’’ in/hr) rainfall equivalent, and (2) For each point Report No: ATR–2006(5195)–1, Jan 30, 2006 to mean of the current LFCC found in appendix G that was measured, the horizontal extent of (https://www.faa.gov/about/office_org/ to part 417. composite radar reflectivity greater than lOdBZ headquarters_offices/ast/reports_studies/media/ 128 NASA–STD–4010 is the current lighting along the line of sight between the radar and the ATR-2006(5195)-1.pdf). launch commit criteria employed by NASA and the point did not exceed the reflectivity extent in 125 Krider, Phil, E., et al., Triggered Lightning Risk Air Force. The FAA uses this standard as its basis kilometers for a 3 cm radar due to radar beam Assessment for Reusable Launch Vehicles at Four for the requirements in Appendix G and has issued attenuation. Regional Spaceports, Report No: ATR–2010(4387)– a broad-based ELOS determination allowing an 122 The Launch operator can launch within 5nm 1, Apr 30, 2010. (https://www.faa.gov/about/office_ operator to comply with the current NASA–STD– of a thick cloud layer if the radar reflectivity is org/headquarters_offices/ast/reports_studies/ 4010 instead of the existing Appendix G which is below 0 dBZ. media/ATR-2010%20(5387)-1.pdf). outdated.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00047 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15342 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

many of the issues with the current is NASA–STD–4010, operators would that an operator would be able to apply Appendix G. While a thorough have the flexibility to propose lightning new research findings or methodologies understanding of whether a given flight commit criteria based on a certain in a more timely manner than under launch vehicle and its mission profile vehicle’s mission profile (e.g., whether appendix G. Further, the FAA would be will trigger lightning is far from being it is a piloted RLV launching a payload able to update guidance materials in a understood, a performance-based to low Earth orbit, or a piloted timely manner to include those means requirement for mitigating natural and suborbital reusable launch vehicle with of compliance that result from advances triggered lightning strikes or spaceflight participants on board).129 in science, information, or technology. encountering a nearby lightning However, as previously discussed, such Additionally, the FAA believes that, by discharge would allow an operator to a proposed means of compliance would providing an operator with the use up-to-date lightning avoidance need to be accepted prior to being used flexibility to mitigate natural and criteria without having to wait for the in a license application to satisfy triggered lightning strikes through regulation to be updated, or for the FAA proposed § 450.165(a)(1). standards and best practices, the to issue an ELOS determination or a An operator may choose instead to operators could avoid costly delays waiver. mitigate lightning strikes and the resulting from compliance with the The intent of the current requirements initiation of lighting by using a vehicle requirements in the current appendix G. found in Appendix G to part 417 is to designed to continue safe flight in the Section 450.163(b) would establish avoid and mitigate natural and triggered event of a lightning strike, in accordance application requirements. To comply lightning. Under the proposed with proposed § 450.163(a)(2). To with proposed § 450.163(a)(1), an regulations, the FAA would require accomplish this, an operator would applicant would be required to submit operators to avoid and mitigate the need to demonstrate that the vehicle lightning flight commit criteria that potential for intercepting or initiating design adheres to design standards for mitigate the potential for a launch or lightning strike or encountering lightning protection of the vehicle and reentry vehicle intercepting or initiating discharge through implementation of its safety critical systems. The FAA is a lightning strike, or encountering a flight commit criteria. Alternatively, an currently evaluating current aircraft nearby discharge using a means of operator would be able to use a vehicle lightning protection standards, such as compliance accepted by the designed to continue safe flight if struck AC 20–136B and AC20–107B, to Administrator. As previously discussed, by lightning or encountering a nearby determine whether a launch or reentry the only current method to comply with discharge. Finally, an operator would be vehicle designed to those standards § 450.165(a)(1) would be to use NASA– able to comply with the proposed would allow for the continued safe STD–4010. If an applicant chooses regulation by ensuring that compliance flight of the vehicle.130 The FAA instead to comply with § 450.163(a)(2), with public safety criteria would be met anticipates that it would accept other it would be required to provide in the event of a lightning strike on the industry standards for lightning documentation demonstrating that the vehicle. protection or certification standards vehicle is designed to protect safety Proposed § 450.163(a)(1), would during vehicle design, such as SAE critical systems, such as electrical and require an operator to mitigate the Aerospace Recommended Practices, or electronic systems, or FSSs. The FAA potential for a vehicle to intercept or European Organization for Civil anticipates that this documentation initiate a lightning strike or encounter a Aviation Equipment, as an acceptable would include proof and validation that nearby discharge through flight commit means of compliance to proposed the vehicle has followed lightning criteria using a means of compliance § 450.163(a)(2). protections standards that would protect accepted by the Administrator. Finally, an operator would be able to the vehicle’s safety critical systems from Currently, the FAA is only aware of one choose to comply with proposed a direct or indirect lightning discharge. standard, NASA–STD–4010, that is § 450.163(c) by ensuring that it would If an applicant chooses to comply with currently acceptable and would satisfy be in compliance with the public safety § 450.163(a)(3), it would be required to the requirements of proposed criteria of proposed § 450.101 should it provide documentation demonstrating § 450.163(a)(1). While FAA anticipates encounter discharge or take a direct compliance with § 450.101 in the event that industry might develop new lightning strike. The use of physical of a lightning discharge. As previously standards as technology advances, such containment as a hazard control strategy discussed, the FAA expects that this standards would be required to be would be a prime example, but other would be demonstrated through any submitted as alternative means of scenarios may also apply. number of analyses that validate that the compliance under § 450.35 (Accepted Section 450.163 would apply to all vehicle is able to control individual and Means of Compliance) paragraph (c) and launch and reentry vehicles, including collective risk to the public, accepted by the Administrator prior to ELVs, RLVs, hybrids, and reentry The FAA considered using direct use. If an operator were to submit an vehicles. Because the proposed measurement of the electric field within alternative means of compliance to requirement is performance based, each a cloud as an option for a launch NASA–STD–4010, the proposed operator would be able to provide operator to comply with proposed lightning standard would need to be lightning mitigation methods designed § 450.163. However, it is the FAA’s evaluated and accepted by the FAA, for a specific vehicle’s mission profile. understanding that there is currently no including any consultation with outside Under § 450.163, the FAA anticipates consensus among the scientific expert, prior to being used in any community on the electric field value license application using the new 129 The piloted vehicles can control and threshold to initiate lightning. Without standard. maneuver the vehicle leading up the release point a definite threshold value, the FAA or area thus limiting the exposure of the vehicle to The FAA anticipates that this revision elevated electric fields upon its launch. would not be able to make a safety would provide more flexibility to an 130 AC 20–136B, Aircraft Electrical and Electronic determination if an operator were to operator than the current appendix G, Lightning System Lightning Protection, provides take direct measurements of the electric which prescribes the specific lightning information and guidance on the protection of field. In addition, further research and aircraft electrical and electronic systems from the flight commit criteria that an operator effects of lightning. AC 20–107B, provides data is required to establish procedures must use. While the only method information and guidance on composite aircraft for measuring within the cloud, for how currently accepted by the Administrator structure. many measurements to make within a

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00048 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15343

period of time or distance from the proceed with the flight of a launch or flight-commit criteria for collision cloud, and such other considerations. reentry vehicle. Proposed § 450.159 avoidance. Nevertheless, given the performance- would require an operator to implement ii. Flight Abort Rules based nature of § 450.163, it is possible preflight procedures to verify that each that in the future, an accepted means for flight-commit criterion has been met The FAA proposes to include flight obtaining real time electric field before initiating flight. abort rules as part of proposed flight readings along the flight profile could Proposed § 450.165 would mandate safety rules in § 450.165. Flight abort lead to less restrictive criteria. that an operator’s flight safety rules rules apply to a vehicle that uses an FSS include flight-commit criteria and are the conditions under which an 10. Flight Safety Rules identifying each condition necessary FSS must abort the flight to ensure In proposed § 450.165, an operator prior to initiating flight to satisfy compliance with flight safety criteria. would be required to establish and proposed § 450.101. These commit Current regulations in parts 417 and 431 observe flight safety rules that govern criteria would include surveillance, address flight abort rules. the conduct of each launch or reentry. monitoring of meteorological Section 417.113(d) sets flight These would include flight commit conditions, implementing window termination rules for ELVs. It requires criteria and flight abort rules. closures for the purpose of collision operators to identify the conditions i. Flight Commit Criteria avoidance, monitoring the status of any under which the FSS, including the flight safety system, and any other functions of the flight safety system The FAA proposes to consolidate the hazard controls derived from system crew, must terminate flight to ensure flight-commit criteria requirements safety, software safety, or flight safety public safety. The flight termination currently contained in parts 417, 431, analyses. Also, for any reentry vehicle, rules must implement the FSA, and and 435. Flight-commit criteria are the commit criteria would include specifically requires operators to conditions necessary prior to the flight monitoring the status of safety-critical terminate flight in the following six of a launch vehicle or the reentry of a systems before enabling reentry flight. scenarios: reentry vehicle to ensure that the launch Part 450 also includes requirements to 1. When real-time data indicate a or reentry does not exceed the public develop flight-commit criteria based on flight safety limit has been reached. safety criteria in proposed § 450.101. the results of various analysis. For 2. At the straight-up time if the Although this proposal restates flight- instance, § 450.135 (Debris Risk vehicle flies straight up. commit requirements differently than Analysis) would require operators to 3. If the vehicle becomes erratic and the current regulations, the changes demonstrate compliance with public may endanger protected areas, while would not alter substantive safety criteria in proposed § 450.101. In potentially losing control of the flight requirements, and are intended solely § 450.137, the far-field overpressure safety system. for clarification purposes. blast effect analysis would have to 4. No later than at the expiration of The ELV launch requirements for demonstrate compliance with public the data loss flight time if tracking data flight readiness are contained in safety criteria in proposed § 450.101. is lost. §§ 415.37 and 417.113. Section 415.37 Sections 450.139 (Toxic Hazards for 5. If a vehicle is performing erratically requires an applicant to file procedures Flight) and 450.187 (Toxic Hazards prior to entering an overflight gate, or if for verifying readiness for safe flight, Mitigation for Ground Operations) the vehicle is not flying parallel to or which result in flight-commit criteria. would require an operator to derive converging to the nominal trajectory Section 417.113(c) requires that the flight-commit criteria based on the prior to entering a gate. launch safety rules include flight- results of its toxic release hazard 6. If a vehicle is performing erratically commit criteria that identify each analysis, containment analysis, or toxic prior to entering a hold gate, or if the condition that must be met in order to risk assessment to ensure any necessary vehicle is not flying parallel to or initiate flight. The flight-commit criteria evacuation of the public from any toxic converging to the nominal trajectory must implement the FSA; for a launch hazard area prior to flight. Proposed prior to entering a hold gate. that uses an FSS, must ensure that the § 450.141 (Wind Weighting for the Some of these current requirements FSS is ready for flight; and for each Flight of an Unguided Suborbital may be overly prescriptive. For launch, must document the actual Launch Vehicle) would require an example, flight abort at the straight-up conditions used for the flight-commit operator to establish flight-commit time is only one method of mitigating criteria at the time of lift-off and verify criteria that control the risk to the risk to the launch area in the event of whether the flight-commit criteria are public from potential adverse effects a vehicle that fails to program and flies satisfied. from normal and malfunctioning flight. straight up. Although other methods Flight-commit criteria for launch and Proposed § 450.161 would require an may mitigate risk to an acceptable level, reentry of a reusable launch vehicle are applicant to describe how it will under the current requirements, an contained in §§ 431.37 and 431.39, and provide for day-of-flight surveillance of operator would be forced to abort flight by extension in § 435.33 for the reentry flight hazard areas, if necessary, to at the straight up time. Also, the rules of a reentry vehicle other than a RLV. ensure that the presence of any member for allowing vehicles to enter gates are Unlike part 417, the parts 431 and 435 of the public in or near a flight hazard too subjective and not easily tied to requirements are performance-based area is consistent with flight-commit specific hazards. and required as part of the system safety criteria. Section 450.163 would require Part 431, applicable to RLVs, does not analysis requirements. an operator to derive flight-commit impose specific flight abort rules. Flight-commit criteria-related criteria that mitigate the potential for a However, § 431.39(a) requires an requirements appear throughout launch or reentry vehicle intercepting or applicant to submit mission rules and proposed part 450. The main initiating a lightning strike, or contingency abort plans that ensure safe requirements would be found in encountering a nearby discharge. conduct of mission operations during §§ 450.155, 450.159, and 450.165. Finally, § 450.169 (Launch and Reentry nominal and non-nominal vehicle flight. Section 450.155 would require an Collision Avoidance Analysis) would These would encompass flight abort operator to document and implement require an operator use the results of the rules because § 401.5 defines procedures to assess readiness to collision avoidance analysis to develop contingency abort as the cessation of

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00049 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15344 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

vehicle flight during ascent or descent abort rules. An operator should balance launch that uses an FSS, readiness for in a manner that does not jeopardize potentially competing objectives as flight includes that the launch vehicle public health and safety and the safety necessary to minimize risk when tracking system has no less than two of property, in accordance with mission writing specific flight abort rules. For tracking sources prior to lift-off. Also, rules and procedures. Part 431 requires example, if there is a rule to destruct a the launch vehicle tracking system must flight abort when needed to mitigate risk vehicle to prevent an intact impact in have no less than one verified tracking and a set of rules to that end, yet does order to reduce distant focused source at all times from lift-off to orbit so without following part 417’s more overpressure risk, the operator should insertion for an orbital launch, to the detailed and prescriptive approach. In also consider the resulting risk to end of powered flight for a suborbital practice, orbital rockets licensed under aircraft when establishing the timing of launch. Of course, the need for tracking part 431 have used an AFSS with flight the destruct action. is implicit in other requirements for abort rules that are conservatively Proposed § 450.165(d) lays out the launch of a vehicle with an FSS, consistent with the six scenarios application requirements for flight including the requirements regarding identified in 417.113(d), when safety rules. For flight commit criteria, data loss flight times in § 417.219. applicable (e.g., no straight-up time for the FAA would require an applicant to Section § 417.125 also requires an a horizontal launch). provide a list of all flight commit operator of an unguided suborbital Section 450.165(c) lays out the criteria. These would include any launch vehicle to track the flight of its proposed consolidation and clarification criteria related to surveillance, vehicle. Specifically, § 417.125(f) of flight abort rules. Although the FAA monitoring of meteorological requires an operator to provide data to would maintain much of § 417.113(d)’s conditions, implementation of launch or determine the actual impact locations of structure and requirements, the FAA reentry windows closures for the all stages and components, to verify the looked for opportunities to replace purpose of collision avoidance, effectiveness of a launch operator’s prescriptive requirements with outcome confirmation that any safety-critical wind weighting safety system, and to objectives. The FAA would require system is ready for flight, monitoring of obtain rocket performance data for operators to develop flight abort rules to safety-critical systems prior to enabling comparison with the preflight comply with the public safety criteria of re-entry flight, and any other hazard performance predictions. § 450.101, as well as to prevent debris controls. For flight abort rules, the FAA Part 431 has no explicit requirements capable of causing a casualty from would require an applicant to provide a related to tracking. However, currently impacting in uncontrolled areas if the description of each rule, and the every operation licensed under part 431 vehicle is outside the limits of a useful parameters that will be used to evaluate is required to employ a telemetry system mission. Operators would also need to each rule, as well as a list that identifies that provides, among other safety identify the functions of any flight abort the rules necessary for compliance with critical information, data on the position crew, as specifically required in part each requirement in § 450.101. All and velocity of the vehicle in real-time. 417. This is also consistent with the conditions in which flight abort action In addition, the one orbital RLV FAA’s practice in implementing part would be taken must be described, as operation licensed to date employed an 431. Although not specifically stated in well as rules and conditions allowing FSS and established data loss flight § 431.39(a), the FAA has required flight to continue past a gate. Lastly, the times. The use of data loss flight times operators to identify crew functions. FAA would require an applicant to is an explicit recognition that a vehicle The FAA proposes to eliminate the provide a description of the vehicle data without tracking poses a potential straight-up rule, as it is not reasonable that will be available to evaluate flight hazard to the public. to include the rule at the exclusion of abort rules across the range of normal Tracking is also required under other existing mitigation options. Also, and malfunctioning flight. This Experimental Permit regulations. Under the FAA proposes to simplify the information is necessary to ensure that § 437.67, an operator must, during current requirements for gate passage to compliance with the flight abort rules is permitted flight, measure in real-time allow a vehicle to pass through a gate if achievable. the position and velocity of its reusable it can achieve a useful mission. This suborbital rocket. The requirements for 11. Tracking would allow the operator to specify an operator to measure in real time the which vehicle parameters are the most The FAA proposes to adopt vehicle position and velocity of its rocket, useful for determining whether a tracking requirements. Specifically, coupled with the requirement to vehicle should be allowed to enter a proposed § 450.167 (Tracking) would communicate with ATC during all gate. For orbital launches, vehicles require an operator to measure and phases of flight, are intended (among unable to achieve orbit cannot achieve record in real time the position and other things) to provide ATC with a useful mission and should be velocity of the vehicle. The system used enough information to protect the terminated. The FAA would delete to track the vehicle would be required public if the vehicle flies outside its separate requirements for hold-and- to provide data to determine the actual planned trajectory envelope. resume gates, as analysis should show impact locations of all stages and Tracking data sufficient to identify the which types of gates are most effective components, and to obtain vehicle location of any vehicle impacts for the proposed flight, and those performance data for comparison with following an unplanned event are should be implemented. the preflight performance predictions. necessary to ensure a proper response to These proposed rules, which would The proposed requirements would be an emergency. Specifically, a launch be similar to those from part 417, were consistent with current practice for a operator must implement its mishap chosen over the generic requirement for wide variety of vehicles, including the response plan if an unplanned event mission rules from part 431 because widespread use of telemetry data, and occurring during the flight of a launch they correspond to other sections in the various requirements of parts 417, 431, vehicle results in the impact of a launch proposed rule describing flight safety and 437. vehicle, its payload or any component limits, gates, and other requirements. Current regulations for ELVs require a thereof outside designated impact limit This is consistent with the ARC’s vehicle tracking system as part of the lines for an expendable launch vehicle; recommendation to change part 431 to FSS. For example, in § 417.113(c), as and, for an RLV, outside a designated better capture the intent of the flight part of the flight commit criteria for a landing site. More generally, vehicle-

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00050 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15345

tracking data provide a level of vehicle performance data for requirements from these three different awareness that enables an appropriate comparison with the preflight parts into a single safety rule. response to an off-nominal situation, performance predictions. The proposed The FAA anticipates that proposed such as knowing where to apply fire requirements are consistent with current changes to the collision avoidance suppression resources or where to practice for a wide variety of vehicles, analysis criteria would not significantly evacuate the public to protect against including the widespread use of affect operators. The changes would predicted toxic plumes. More telemetry data, and various capture current practice, provide specifically, tracking data are an requirements levied under parts 417, alternative means of meeting existing important element of current U.S. 431, and 437. requirements, and clarify the time Government consensus standards, in Proposed § 450.167(a) would period that the analysis must address. accordance with RCC 321, to ensure the consolidate and standardize the current Launch and reentry collision safety of people in aircraft. Specifically, regulatory requirements for vehicle avoidance measures are necessary since 2007, RCC 321 has included a tracking-related information. Vehicle- actions for responsible and safe requirement (in paragraph 3.3.4) to tracking data facilitate appropriate launches and reentries. Under current coordinate with the FAA to ensure emergency responses, and an ability to regulations, a launch collision timely notification of any expected air determine the actual vehicle impact avoidance analysis is performed prior to traffic hazard associated with range locations due to an unplanned event is each launch to protect against collision activities. In the event of a mishap, RCC critical to evaluate the class of mishap. with only inhabitable objects, including 321 requires that the operator must Comparison of the actual vehicle safety the International Space Station, as immediately inform the FAA of the performance, such as the trajectory, required screening objects. It is volume and duration of airspace where with preflight predictions helps ensure important to avoid collisions during 131 an aircraft hazard is predicted. the continued accuracy of the FSA launches because the energy released Tracking data are also necessary to input, and thus the validity of the through an impact during launch would evaluate vehicle safety performance, public risk assessments and hazard most likely be catastrophic for the even for normal flight. For example, areas. A comparison of the actual launch vehicle and the object it § 417.125(g)(3) requires a launch vehicle safety performance data to impacted. operator of an unguided suborbital predict performance provides the FAA In addition to mission assurance, to launch vehicle to compare the actual with a means to evaluate an operator’s ensure the successful launch of an and predicted nominal performance understanding of its safety margins, object, there are significant reasons to (i.e., trajectory) of the vehicle. Accurate which is a measure of maturity of the mitigate debris creation through data to describe the vehicle normal operation and thus a potential factor in collision avoidance. Launch collision trajectory envelope are necessary for the probability of failure analysis. avoidance analysis occurs prior to valid quantitative public risk launch and entails the determination of assessments. Proposed § 450.167(b) would require times when a launch should not be Current practice demonstrates that an applicant to identify and describe initiated. There is a balance between tracking data will help facilitate safe each method or system used to meet the launch opportunities and orbital safety and efficient integration of launch and tracking requirements of proposed that must be established to protect both reentry operations into the NAS. The § 450.167(a) of this section. Because the the launch vehicle and on-orbit objects. increasingly congested and constrained proposed requirements are consistent Reentry collision avoidance analysis NAS creates a need to transition from with current practice, and in some cases occurs prior to the initiation of a reentry segregation, to full integration of space less restrictive, the application maneuver and provides for the review of vehicles. The FAA has several efforts requirements would not increase burden the maneuver trajectory to establish underway to ensure the safe and on license applicants. when reentry should not be initiated. efficient transition of launch and reentry 12. Launch and Reentry Collision Section 431.43(c)(1)(ii) documents the vehicles through the NAS, while Avoidance Analysis Requirements requirement for reentry collision minimizing the effects of these avoidance. operations on other users of the NAS. The FAA proposes to modernize the The creation of orbital debris is an The FAA has contemplated the need to launch and reentry collision avoidance expected result of a collision during obtain real time data tracking data, analysis criteria to match current launch or reentry.133 As stated earlier, including vehicle state vectors, reports common practice and provide better limiting orbital debris is a vital part of of mission events, and indications of protection for inhabitable and active protecting the space environment and is vehicle status, to help accomplish this. orbiting objects. It would also allow a national objective. Therefore, the FAA However, the FAA is deferring that launch and reentry operators to obtain believes it is paramount to avoid all discussion until after the Airspace a launch collision avoidance analysis collisions during launch and reentry. Access Priorities ARC.132 from Federal entities identified by the The Department of Defense created a Proposed § 450.167(a) would require FAA. Previously, the FAA established tiered level of separation distance to an operator to measure and record in identical rules for expendable launches avoid collisions and still allow ample real time the position and velocity of the from Federal and non-Federal launch opportunity for launch. The FAA agrees vehicle. The system used to track the ranges, RLV operations, and permitted with the tiers, identified in the chart vehicle would need to provide data to launch operations. The proposed rule below. This chart excludes the object determine the actual impact locations of would consolidate launch and reentry launching or reentering, which would all stages and components, and to obtain collision avoidance analysis be damaged or destroyed in all cases.

131 Range Commanders Council, Common Risk documents/index.cfm/document/information/ rocket bodies and other hardware (e.g., bolt Criteria for National Test Ranges, RCC 321–07, documentID/3443. fragments and covers) left in orbit as a result of White Sands Missile Range, New Mexico, 2007. 133 Orbital debris is all human-generated debris in normal launch and operational activities, and 132 Information regarding the Airspace Access Earth orbit that is greater than 5 mm in any fragmentation debris produced by failure or Priorities ARC is available at https://www.faa.gov/ dimension. This includes, but is not limited to, collision. Gases and liquids in free state are not regulations_policies/rulemaking/committees/ payloads that can no longer perform their mission, considered orbital debris.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00051 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15346 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

FIGURE 2—LAUNCH COLLISION AVOIDANCE JUSTIFICATIONS AND TIERS

U.S. national security Separation Protect public health Safety of property or foreign policy in- International obliga- Avoid debris genera- distance and safety terests tions tion

Inhabitable Objects ..... 200 km ...... Yes ...... Yes ...... Yes ...... Yes ...... Yes. Active Satellites ...... 25 km ...... Yes ...... Yes ...... Yes ...... Yes. Trackable Debris >10 2.5 km ...... Yes, if it creates sig- Yes, if it creates sig- Yes. cm2 (LEO). nificant debris. nificant debris. Un-trackable Debris Not applicable ...... Protect with shielding <10 cm 2 (LEO). & design.

With space becoming more congested inconsistent with the current practices least a 200 km separation from any every year, it is vitally important for executed at Federal launch ranges that inhabitable orbiting object during launch or reentry collision avoidance to provides an equivalent level of safety. launch and reentry. It requires the extend beyond inhabitable objects to The current practice is to use a common analysis to address closures in a include all active orbiting objects and analysis time frame instead of a single planned launch window for ascent to trackable orbital debris. Records from a orbit as identified in the current outer space for an orbital RLV to initial recent Intelsat launch showed that if the regulations. The safety standard for the orbit through at least one complete launch occurred 35 minutes into the 2- standoff distance of 200 km remains orbit; for reentry, the reentry trajectory; hour launch window, the launch consistent throughout launch (and and expansions for the closure period. vehicle could have passed by a defunct reentry) requirements for launches of For reentry of vehicles not part of a but still orbiting COSMOS navigation expendable and reusable launch reusable system, § 435.33 refers to part satellite by only 600 meters. The FAA vehicles and for launches from both 431, subpart C, including § 431.43(c)(1) believes not proposing launch collision Federal launch ranges as well as non- as a requirement. avoidance in this instance is Federal launch sites. Appendix A to part 415 contains a unnecessarily hazardous. Section 417.231 requires a launch worksheet for the data input for launch. Sections 417.107(e), 417.231, and operator to include in its flight safety However, Appendix A to part 415 is a 437.65 require launch operators to analysis a collision avoidance analysis U.S. Space Command form that is no 134 ensure that the launch vehicle does not that (1) establishes each launch wait in longer in use. The current practice is pass closer than 200 km (approximately a planned launch window during which to submit the launch collision 124 statute miles) to a manned or a launch operator must not initiate a avoidance analysis data prior to launch mannable orbital object to avoid flight in order to protect any manned or in a form and manner accepted by the collisions during launch. A collision mannable orbiting object, and (2) Administrator, which is currently the avoidance analysis must be obtained accounts for uncertainties associated R–15 launch plan worksheet. The data through a Federal entity. The analysis with launch vehicle performance and collected on the R–15 launch plan must be used to determine any launch timing and ensures that any calculated worksheet are detailed in sections holds to avoid potential collisions. A417.31 and C417.11 and are used by launch waits incorporate additional In § 417.107(e), a launch operator the agency performing the launch time periods associated with such must ensure that a launch vehicle, any collision avoidance analysis. uncertainties. It also requires the launch jettisoned component, and its payload A number of issues are unclear or operator to implement any launch waits do not pass closer than 200 km to a outdated under section A417.31. In into its flight commit criteria under manned or mannable orbital object section A417.31(c)(8), the option to use § 417.113(c) to ensure that the operator’s throughout a sub-orbital launch, and for an ellipsoidal screening method does launch vehicle, any jettisoned an orbital launch, during ascent to not identify the size of the ellipsoid components, and its payload do not initial orbital insertion and through at required. Section A417.31(b)(3) limits pass closer than 200 km to a manned or least one complete orbit, and during an operator to use collision avoidance mannable orbiting object during ascent each subsequent orbital maneuver or analysis (COLA) products to 12 hours to initial orbital insertion through one burn from initial park orbit, or direct from when ‘‘manned’’ objects were last complete orbit. Further, under § 417.231 ascent to a higher or interplanetary tracked. This information is not no collision avoidance analysis is orbit, or until clear of all manned or provided to launch or reentry operators required if the maximum altitude mannable objects, whichever occurs and therefore is not implemented in the attainable, using an optimized first. A launch operator is also required current practices. Section A417.31(b)(4) trajectory, assuming 3-sigma maximum under § 417.107(e) to obtain a collision and (c)(7) also includes two expansions performance, by a launch operator’s avoidance analysis for each launch from of window closures. The first expansion unguided suborbital launch vehicle is United States Strategic Command or is for every 90 minutes, a 15 second less than the altitude of the lowest from a Federal launch range having an buffer should be added before and after manned or mannable orbiting object. approved launch site safety assessment. the provided window closures, and the Appendices A, section A417.31, and C, The detailed requirements for obtaining second is a 10-minute addition to the section C417.11, of part 417 provide a collision avoidance analysis are found screening time. Neither of these constraints for performing the collision in § 417.231 and section A417.31 of practices are currently implemented at avoidance analysis as part of the flight appendix A to part 417. The results of Federal launch ranges or non-Federal safety analysis required by § 417.231. the collision avoidance analysis must be launch sites. used to develop flight commit criteria Section 437.65 establishes the minimum With proposed § 450.169 and for collision avoidance as required by required altitude as 150 km, which is appendix A to part 450, the FAA would § 417.113(c). the current standard practice. align the collision avoidance analysis These requirements and processes for Section 431.43(c)(1) and (3) also ascertaining launch collision avoidance requires a collision avoidance analysis 134 The U.S. Space Command was deactivated in are unnecessarily complicated and are for RLVs to be performed to maintain at 2002.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00052 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15347

criteria with current practice and stipulate an ellipsoidal rather than a the FAA proposes the requirement with provide better protection for inhabitable spherical separation distance between 99.7% confidence level instead of the 3- and active orbiting objects. The FAA its vehicle and an inhabitable object or sigma rule in the existing regulation. also proposes to allow a launch operator satisfy a probability of collision In proposed § 450.169(e) an operator to obtain a collision avoidance analysis threshold rather than calculating a would be required to obtain a collision from a Federal entity identified by the separation distance. The FAA also avoidance analysis for each launch or FAA. The proposed changes balance would maintain the current requirement reentry from a Federal entity identified increased options and additional to maintain a spherical separation by the FAA. An operator would be requirements and would allow more distance as a third option. These required to use the results of the flexibility and accuracy in avoiding proposed requirements are discussed collision avoidance analysis to establish collision with orbiting objects. more fully later in this section. flight commit criteria for collision The FAA also proposes to remove The FAA also proposes to require that avoidance, account for uncertainties appendix A to part 415 in its entirety a collision avoidance analysis address associated with launch or reentry because the Launch Notification Form is other orbiting objects, such as active vehicle performance and timing, and no longer used by the FAA or launch spacecraft and tracked debris. The ensure that each window closure operators. The data is currently uninhabitable active objects would be incorporates all additional time periods collected via the R–15 work sheet and protected with significantly less associated with such uncertainties. This associated trajectory files and is detailed restrictive clearance distances than latter proposed requirement would in sections A417.31 and C417.11. provided to inhabitable objects. This remove outdated practices from the Sections A417.31 and C417.11 would be would require no extra work from the launch collision avoidance replaced with appendix A to part 450, operators, including those from non- requirements that are currently found in which would contain the Collision Federal launch sites. Additionally, no sections A417.31(c)(7)(iv) and Analysis Worksheet information launches have been scrubbed for COLA C417.11(d)(7)(iv), which require adding requirements and captures current closures, and the FAA does not 10 minutes to the screen duration time, practice. anticipate any impact to future sections A417.31(b)(4) and C417.11(c)(4) The FAA proposes a few format and operations due to this requirement. and § 431.43(c)(1)(iii) which require editorial changes in the collision Proposed § 450.169(b) would require adding 15-second buffers to the launch avoidance requirements of proposed an operator to ensure that the window closures, and appendix A to § 450.169. First, the proposal would requirements of proposed § 450.169(a) part 415 which is a redundant form to refer to ‘‘inhabitable’’ rather than are met for the durations specified. the worksheet specified in sections ‘‘manned or mannable’’ objects for Specifically, proposed § 450.169(b)(1) A417.31 and C417.11. The current greater simplicity and ease of would require screening through the understanding. Similarly, the proposal entire flight of a suborbital vehicle. practices no longer require a 10-minute would refer to ‘‘separation distances’’ Proposed § 450.169(b)(2) would extra pad as the screening time is no rather than ‘‘miss distances,’’ as this standardize the time period of the longer a single orbit. Also, the 15- terminology is more accurate and better launch collision avoidance analysis for second buffers are no longer required connotes the FAA’s goal of maintaining an orbital launch to ascent from a because the service provider accounts a safe separation of objects on orbit. minimum of 150 km to initial orbital for the accuracy of the result products Finally, the proposal would refer to insertion and for a minimum of 3 hours and the 15-second buffers were based ‘‘window closures’’ for launch and from liftoff. Proposed § 450.169(b)(3) upon the last time the orbital objects reentry rather than ‘‘waits’’ in a launch would identify the screening time frame were tracked. The launch operator is not or reentry window to provide a more for reentry as the time frame from initial responsible for tracking orbital objects cogent and accurate description. These reentry burn to an altitude of 150 km. and is not provided data on when the updated terms would have the same Similarly, proposed § 450.169(b)(4) orbital objects were last tracked making meaning as the terms they replace.135 would cover a disposal reentry with the the existing requirement difficult to Substantively, the FAA proposes to same altitude. apply. The launch or reentry operator consolidate the launch and reentry Proposed § 450.169(c) would establish would only be required to account for collision avoidance analysis that planned rendezvous operations that uncertainties associated with launch or requirements into proposed § 450.169. occur within the screening time frame reentry vehicle performance and timing Proposed § 450.169(a) would require, for are not considered a violation of in accordance with proposed orbital or suborbital launch or reentry, collision avoidance if the involved § 450.169(e)(2). This is consistent with an operator to establish any window operators have pre-coordinated the the existing requirement in § 417.231(a). closures needed to ensure that the rendezvous or close approach. In proposed § 450.169(f), the FAA vehicle, any jettisoned components, or Proposed § 450.169(d) would would require an operator to prepare a payload meet the specified requirements establish the exclusion of collision collision avoidance analysis worksheet of that section. When performing a avoidance for launch vehicles that do for each launch or reentry using a launch or reentry collision avoidance not reach a maximum altitude of 150 standardized format that contains the analysis for inhabitable objects, under km. The FAA also proposes to change input data required by appendix A to proposed § 450.169(a)(1), an operator from a 3-sigma maximum performance part 450. Proposed § 450.169(f)(1) would would have two alternatives in addition established in current § C417.11 and require an operator to file the input data to maintaining a spherical separation replace it with maximum performance with a Federal entity identified by the distance. An operator would be able to within 99.7% confidence level, FAA and the FAA at least 15 days extended through fuel exhaustion of before the first attempt at the flight of a 135 The FAA recognizes reentry windows as a each stage. The intention of the 3-sigma launch vehicle or the reentry of a number of discrete or short duration windows rule was the use of a 99.7% confidence reentry vehicle or in a different time during which a reentry may be commanded. Past level. However, the 3-sigma rule does frame in accordance with proposed experience shows window closures are insignificant § 404.15. The FAA anticipates that it for reentry. The safety requirements for launch or not hold true (the same percentage reentry window management are intended to be confidence level) when the analysis initially would identify the Air Force equitable. adds multiple dimensions. Therefore, Space Command (AFSPC) as an entity

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00053 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15348 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

with whom to file the collision inhabited, and the FAA views the term about the location of the launch vehicle avoidance analysis inputs. as encompassing any object that may be and therefore results in the largest The FAA also proposes to maintain inhabited, regardless of whether it is at window closures. If launch operators the current 15-day requirement of the time of launch. One point that have covariance—that is, uncertainty— sections A417.31(b)(1) and C417.11(c)(1) merits clarification in light of inquiries information applicable to their nominal in proposed § 450.169(f)(1). The 15-day the FAA has received—a launch trajectories, the option of limiting the requirement is necessary for federal operator’s own vehicle, if it is probability of collision allows for agencies to evaluate the content of the inhabitable, does not impose a greater fidelity in avoiding a collision submission and ensure the trajectory corresponding obligation on a space with inhabitable objects. files and data provide acceptable data station to keep away from it. A launch For collision probability screening, and can be processed successfully. It operator whose vehicle carries people proposed § 450.169(a)(1)(i) would would also allow federal agencies to should not construe the requirement to require a covariance information, determine early potential conjunctions mean that the operator must always typically provided in a matrix, that with national systems or human space keep the vehicle 200 km away from any identifies the uncertainty of the launch flight activities, and would provide other object. Current FAA regulations vehicle trajectory. When an operator can adequate time for federal agencies to do not protect persons on board a provide sufficient covariance (as develop a strategy for early orbit launch or reentry vehicle. identified in proposed appendix A to detection and tracking including Vehicles deliberately approaching part 450, paragraph (d)(3)), the taskings to global sensors and expected each other for rendezvous or docking probability of its collision with an trajectories for sensors to aid in initial purposes will have to get within 200 km inhabitable object can be accurately acquisition. of each other. In these instances, calculated and launch window closures Proposed § 450.169(f)(2) would collision avoidance remains paramount can be limited to only those times where require an operator to obtain a collision for those orbital objects other than the actual high risk exists. In essence, this avoidance analysis performed by a intended rendezvous spacecraft. Under fine-tuned launch collision avoidance Federal entity identified by the FAA 6 proposed § 450.169(c), planned close would provide assurance against hours before the beginning of a launch approaches for rendezvous would not be collisions while minimizing potential or reentry window. This is consistent considered violations of collision launch window closures. with existing sections A417.31(b)(2) and avoidance if the involved operators have The FAA proposes to allow the use of C417.11(c)(2). previously coordinated the rendezvous. a probability of collision because the Consistent with current sections The proposed requirement to perform 18th Space Control Squadron’s (SPCS) A417.31(b)(3) and C417.11(c)(3), collision avoidance would apply during use of the proposed probability proposed § 450.169(f)(3) would require launches that have a rendezvous within threshold has prevented collisions an operator that needs an updated the screening period and for licensed while still allowing for maximum collision avoidance analysis due to a reentries that originate from orbiting availability of launch windows. The launch or reentry delay to file the spacecraft or objects. For planned FAA agrees that using probability request with the Federal entity and the reentry, coordinated close approaches assessment adequately protects FAA at least 12 hours prior to the and departures would not be considered inhabitable spacecraft while maximizing beginning of the new launch or reentry violations of collision avoidance the time available for launch. window. Additionally, the current requirements if the involved operators Probability of collision is also the regulations, sections A417.31(b)(3) and have previously coordinated the preferred analysis method for reentry C417.11(c)(3), limit the use of products operation. collision avoidance. to 12 hours from the time U.S. Strategic According to NASA,136 the Command determines the state vectors ii. Probability of Collision Department of Defense’s 18th SPCS of manned or mannable objects. The The FAA also proposes to amend the current practice for on-orbit debris FAA intends to remove this limitation, collision avoidance screening methods regarding the ISS is to assess potential as launch or reentry operators are not to include new options for analysis. The conjunctions inside specific-sized boxes provided with the last time of current regulation offers spherical or centered on the ISS. Any object observation of inhabitable objects and ellipsoidal screening, however, it fails to predicted to pass within this box is therefore cannot determine a 12-hour provide distances for ellipsoidal tracked with higher priority. The 18th expiration time. The removal of this screening and identifies a spherical SPCS then uses the best available data requirement would place the distance of 200 km as default. The FAA set to compute the probability of responsibility on the service provider to proposes an additional option of collision with the potentially- provide the time frame that the analysis collision probability screening using a threatening catalogued object. If that is valid. For most cases, the analysis covariance matrix. A covariance matrix ¥ probability is greater than 1 × 10 4, the would be valid for the entire launch or is a mathematical construct that ISS performs a collision avoidance reentry window. However, an extremely describes the upper stage’s position and maneuver. If that probability is greater long launch window or sporadic reentry the uncertainty of that position in all ¥ than 1 × 10 5, then the ISS would window may require additional dimensions. perform a collision avoidance maneuver analysis. The service provider would In proposed § 450.169(a)(1)(i), the when doing so would not compromise identify to an operator when its analysis FAA would permit a launch operator to its mission objectives. Additionally, the in no longer valid, which is similar in employ a probability of collision of 1 × ¥ proposed requirements in § 450.169 for intent to the original 12-hour expiration 10 6, consistent with current Air Force a launch and reentry collision time, but more flexible in its practice, rather than relying solely on the spherical or ellipsoidal separation avoidance probability of collision application. × ¥6 distance of 200 km currently required criteria of 1 10 against inhabitable i. Inhabitable Objects by section A417.31(c)(8)(i) and (ii) and 136 Operational Interface Procedures. Volume A, Inhabitable objects are those that are § 431.43(c)(1). The spherical separation- Report Number SSP–50643–A, Section 7.16.2. or may be occupied by persons. An distance option is the most conservative Published June 28, 2003, and last modified October inhabitable object need not be option and requires the least detail 17, 2008.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00054 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15349

objects is consistent with current NASA iv. Collision Avoidance for Objects That uninhabitable objects. This level of practices. Are Not Inhabitable impact was validated for launch closures for launches conducted in iii. Separation Distance Calculations by Sections A417.31(c)(8) and 2017. The worst-case scenarios for Sphere or Ellipsoid C417.11(d)(8) require that if a launch operator requests launch collision launch collision avoidance are launches Section 417.231 currently requires a avoidance analysis for unmanned or of low inclination that pass through the launch operator to ensure a separation unmannable objects, the analysis must densest part of the low earth orbit (LEO) distance of 200 km between its launch use the spherical screening method with population, around 800 km vehicle, any jettisoned components, or a separation distance of 25 km (approximately 497 statute miles) in its payload, and an inhabitable (approximately 15.5 statute miles). The altitude. The FAA believes 137 object. The regulation does not screening was optional but, if used, the implementing collision avoidance for inhabitable objects, active satellites, and specify whether the separation distance distance was mandated. The FAA trackable debris would adequately must be spherical or may be ellipsoidal. proposes to alter the collision avoidance prevent collisions without placing Section A417.31(c)(8) of Appendix A requirements for uninhabitable objects. excessive restrictions on launch does, however, permit a launch operator Launches from federal ranges require opportunities. The FAA seeks comment to use spherical or ellipsoidal screening. screening for uninhabitable objects to on the potential impact of implementing In practice, the 18th SPCS provided meet Air Force or NASA requirements, these requirements. ellipsoidal distances in the standardized therefore there most space launch collision avoidance request form, and operators are already familiar with the v. Accounting for A Conjunction Up to the FAA has allowed the 18th SPCS process and requirements. The FAA 3 Hours After Launch methods as acceptable for launch proposal creates a common standard for screening volumes. The FAA anticipates The current FAA requirement for all commercial space launches. screening time is one orbit (at least 100 that identifying these options in In proposed § 450.169(a)(2) and (3), 138 proposed § 450.169(a) will reduce minutes) plus 10 minutes padding. the screening for potential conjunctions The current Federal screening practice confusion and accurately capture the would include avoidance of requirements for ellipsoidal screening. at the 18th SPCS covers 3 hours. The uninhabitable objects, active objects, FAA proposes to adopt 18th SPCS’s Additionally, the FAA’s proposal would and trackable debris. The required clarify that either method of calculation current practice as the minimum minimum separation distance would standard to ensure the necessary level of would be acceptable. × ¥5 remain at 25 km, or a PC of 1 10 , safety to inhabitable and active space Using ellipsoidal separation for active satellites. For those objects objects and to avoid the generation of calculation would permit a launch that are tracked and not active, such as space debris. Under proposed vehicle to come within a predicted 50 debris, defunct rocket bodies, and dead § 450.169(b), the collision avoidance km from an inhabitable object in the or inactive satellites, for which the FAA analysis for orbital launches would have cross-track and radial directions. The in- currently has no requirement, the FAA to account for a conjunction that could track distance would be maintained at proposes a required minimum occur up to 3 hours after launch. This 200 km. The result is an ellipse around separation distance of 2.5 km change would be in line with practices the inhabitable object that looks (approximately 1.6 statute miles), for Federal launches. In actual practice, approximately like a pencil with the tip consistent with 18th SPCS screening the 18th SPCS performs an analysis in the direction of travel. In accordance practice. This proposed separation from launch to about 3 hours against all with longstanding Federal range distance would provide increased safety objects and debris in the catalog. standards, the 50-km separation for launches and reentries. However, commercial launchers distance in the cross-track and radial The proposed screening would currently can request screening through directions would provide an equivalent coincide with the screening for only one orbit after launch. level of safety compared to a separation inhabitable objects and would cover the Pre-launch collision avoidance distance based on a sphere because the same time frames. This is consistent analysis ensures there are no immediate uncertainty in orbital location is with current 18th SPCS operational conjunctions during orbital insertion significantly less side-to-side than it is procedures. and shortly thereafter but is dependent along the velocity vector. Because the Launch availability during the launch on pre-launch estimated trajectories. velocity vector is greatest in-track, a window is a concern of the FAA Extending this collision avoidance small change in velocity results in a because excessive launch window analysis to three hours post-launch significant variation in arrival time, and closures could limit launch provides sufficient time for creation of therefore requires the greatest opportunities, increase the effects of the first orbital element set (ELSET), at compensation (200 km). However prolonged airspace closures on aviation, which point collision avoidance variations in orbital altitude are and increase launch operations costs. analysis begins being calculated using possible, but occur at a significantly The FAA analyzed previous U.S. real positioning information. To create reduced rate, allowing the exclusion launches—commercial, civil, and an ELSET, the Department of Defense distance to be reduced to 50 km military—to determine the consequence uses multiple tracking information to radially. Variations laterally are also to the launch window availability of establish the first ELSET and reduce the minimal and require the smallest adding uninhabitable objects as a position error significantly. Once an compensation, allowing the reduction to mandatory launch collision avoidance ELSET has been created when the 50 km in the cross-track directions. The requirement. Of the worldwide launches vehicle is on-orbit, an on-orbit collision FAA agrees with the Federal range between September 2011 and June 2012, avoidance analysis is routinely run out conclusions that the ellipsoidal the maximum impact was the closing of to 72 hours. Pre-launch collision calculation maintains an equivalent approximately 12% of the launch avoidance analysis is the only possible level of safety as the 200-km spherical window. The average impact was only method to prevent a collision until that calculation. 2% of each launch window closed due first ELSET is created. to launch collision avoidance 137 14 CFR 417.231(b). accounting for both inhabitable and 138 14 CFR 417.107(e)(1)(ii)(B).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00055 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15350 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

There is a significant collision for launch collision avoidance. As this and C417.11(d)(3) also remains avoidance warning time gap between data is generally submitted unchanged in proposed paragraph (b); the end of 18th SPCS’s 3-hour launch electronically, sending the data to both however, minor editorial revisions were screening time and when 18th SPCS the FAA and AFSPC is not expected to made to the examples of the determines an ELSET. Pre-launch increase cost or paperwork burden of transmission mediums provided to collision avoidance analysis beyond 3 the submission. Direct submission to reflect modern technology. hours is currently of limited utility. As AFSPC and the FAA will facilitate a The proposed rule provides positional errors based on predicted quicker response to the operator than clarifications for some data elements. trajectories grow, data validity becomes having the FAA act as a middleman Specifically, the FAA proposes to increasingly suspect. Additionally, it is between the operator and AFSPC, and change the requirement to identify possible to create large launch window enables coordination throughout the orbital objects to evaluate contained in closures or even close the launch process. section A417.31(c)(9). As written, window entirely. Therefore, without a In the past, the FAA has found section A417.31(c)(9) requires the significant development in prediction discrepancies between operator operator to identify the orbiting objects calculation fidelity and accuracy, the trajectory data and operator requests to to be included in the analysis. In all FAA proposes to extend pre-launch AFSPC for specific launch collision cases the analysis must include all collision avoidance to 3 hours. The avoidance analysis methods. On objects. However, the current practice is accuracy of pre-launch collision multiple occasions, operators have to identify the characteristics of the avoidance analysis would be dependent misapplied existing launch collision orbiting object, i.e., name, length, width, on the accuracy of the trajectories avoidance regulations. To ensure proper depth, diameter, and mass. The FAA provided. application of launch collision proposes to capture current practice in This 3-hour extension is important to avoidance regulations the FAA must be proposed paragraph (a)(6). Also, the protect inhabitable objects on-orbit. The able to review the launch collision data. proposed appendix would replace ISS incurs collision risk from every A specific example of a discrepancy ‘‘vector at injection’’ in sections launch. There is a warning time gap occurred when a launch operator A417.31(c)(5) and C417.11(d)(5), with between the end of the pre-launch directed the exclusion of the ISS from orbital parameters at proposed collision avoidance analysis and the launch collision avoidance analysis in a paragraph (a)(5). The proposed change start of on-orbit collision analysis done request to AFSPC. The launch operator would require an operator to identify by the 18th SPCS. Until the 18th SPCS incorrectly assumed the protections for the orbital parameters for all objects can determine the ELSET, the location the ISS, the ultimate destination for one achieving orbit including the parameters of upper stages, payloads, and any of the launched payloads, did not apply. for each segment after thrust end instead released debris is unknown. During that In actuality, the planned rendezvous of the vector at injection for each time, whether the ISS is at risk from a with the station was days into the segment. This requirement would allow collision would also be unknown. mission, and not all objects launched accurate COLA calculations that Extending the pre-launch collision were planned to rendezvous with the consider changes in trajectory after avoidance requirement from one orbit to ISS. Collision avoidance analysis should orbital insertion. 3 hours would codify current practice. have been requested for all launched The FAA also proposes to clarify the Additionally, although not required objects against the catalog of space trajectory file requirements in proposed by FAA regulation, operators should objects, including the ISS. FAA review paragraph (d) of appendix A to part 450. promptly provide the 18th SPCS of launch collision avoidance trajectory Sections A417.31(c)(5)(ii) and positional updates after orbital insertion data would have identified that C417.11(d)(5)(ii) require that current until such time as the ELSET is oversight. operators provide position and velocity established and on-orbit collision for each launched object after burnout vii. Appendix A to Part 450—Collision avoidance analysis commences. or deployment. This requirement The FAA proposes to remove the Analysis Worksheet severely lacks in clarity and requirements to expand the collision The FAA proposes to consolidate the completeness. Proposed paragraph (d) avoidance analysis screening time by 10 data input requirements of sections would provide a clearer requirement in minutes to ensure that the entire first A417.31 and C417.11 and to clarify the line with current practices. Launch and orbit of the launch vehicle is screened data and process for collision avoidance reentry operators would be required to in sections A417.31(c)(7)(iv) and in appendix A to part 450. Existing provide trajectory files with position C417.11(d)(7)(iv). The expanded sections A417.31 and C417.11 provide and velocity for each object through the screening time required by those nearly identical requirements for entire screening process, not exclusively appendices would be unnecessary if the mission information. However, some after burnout. The current practice at FAA extends the screening to 3 hours as elements are no longer useful or require Federal ranges is to provide data described in proposed § 450.169(b). an update to meet current practices. through the entire screening process, Specifically, proposed appendix A to therefore the FAA proposal is in line vi. Submitting Collision Avoidance part 450, paragraph (a)(1) mission name with current practices. Additionally, Inputs to the FAA and launch location, paragraph (a)(2) radar cross section and covariance Proposed § 450.169(f) would require a launch or reentry window, paragraph (position and velocity) for probability of launch operator to submit launch (a)(3) epoch, time of powered flight, and collision analysis would be required by collision avoidance trajectory data to point of contact remain the same as proposed paragraph (d). These products both AFSPC and the FAA. The current existing requirements. Proposed are used in the analysis of potential regulations only requires an operator to paragraph (a)(4) segment number has collisions. Parts 431 and 437 require the submit the data to the AFSPC. However, been updated to change the requirement same trajectory files for analysis, the AFSPC does not review launch to provide vector at injection to instead however the current regulations do not operator data to ensure it complies with provide orbital parameters. The provide guidance on how to provide the FAA requirements. The proposal would substantive requirement to identify how products necessary to complete the ensure the FAA receives and reviews the operator would receive analysis analysis. Proposed § 450.169 and the same data that is provided to AFSPC results in current sections A417.31(c)(3) appendix A to part 450 would provide

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00056 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15351

the necessary guidance for all launch The FAA proposes using an kinds of unplanned events,140 including and reentry analysis. overarching mishap classification five types of accidents and incidents. Proposed (e) of appendix A to part system instead of separate terms for These are launch accident, reentry 450 would provide the three possible ‘‘mishap,’’ ‘‘launch accident,’’ ‘‘reentry accident, launch incident, reentry screening methodologies—spherical, accident,’’ ‘‘launch incident,’’ ‘‘reentry incident, and launch site accident. ellipsoidal, or probability of collision. incident,’’ ‘‘human space flight These terms are defined separately in These requirements were discussed incident,’’ and ‘‘launch site accident.’’ §§ 401.5 and 420.5. Mishap also previously in this section. The proposed mishap classification includes unplanned events resulting in system would streamline and clarify the failure to complete a mission as 13. Safety at End of Launch current accident, incident, and mishap planned, a fatality or serious injury, or Proposed § 450.171 would include definitions to create four mishap damages greater than $25,000 to certain requirements aimed at preventing the categories organized by severity, from property associated with the licensed or creation of orbital debris. Proposed most severe (Class 1) to least severe permitted activity. § 450.171(a) is the same as § 417.129 (Class 4). This proposal would also The terms ‘‘launch accident,’’ and substantively the same as eliminate the $25,000 monetary ‘‘reentry accident,’’ and ‘‘launch site § 431.43(c)(3), which require certain threshold from current ‘‘mishap’’ and accident,’’ which are encompassed by measures to be taken by a launch accident terms. This proposal would the mishap definition, all include the operator to prevent the creation of consolidate parts 417 (Accident occurrence of a fatality or serious injury orbital debris. The FAA is not proposing investigation plan), 420 (Launch site to persons not associated with the to update the substantive requirements accident investigation plan), 431 and activity and damage to property not for orbital debris mitigation in this 435 (Mishap investigation plan and associated with the activity exceeding rulemaking because it plans to do so in emergency response plan), and 437 $25,000. Unlike the term ‘‘launch site a future rulemaking. (Mishap response plan), into a single accident,’’ launch and reentry accidents Proposed § 450.171(b) would require section applicable to all types of account for the occurrence of a fatality an applicant to demonstrate compliance licenses, permits, and vehicles. or serious injury to a space flight with the requirements in § 450.171(a) in Additionally, the FAA proposes to participant or crew member during its application. This requirement is the update the definition of the term FAA-regulated activities. Other factors same as § 415.133, which applies to ‘‘anomaly’’ and relocate it from part 437 may also satisfy the various accident applications for the launch of an ELV to part 401, making it applicable to definitions. For instance, for launches from a non-Federal launch site. licensed and permitted activities. involving an ELV, impacts of a launch Proposed § 450.171(b) would broaden Finally, the FAA proposes to exclude vehicle, its payload, or any component the applicability of the application pre-coordinated test activities, resulting thereof outside designated impact limit requirement to all launches. This is in damage to property owned by the lines constitute an accident. If, however, necessary because the importance of operator and associated with test the launch involves an RLV, impacts orbital debris mitigation has no relation activities, from mishap consideration. outside the designated landing site to whether a launch takes place from a This test-induced damage proposal constitute an accident. In contrast, the Federal or non-Federal launch site, or provides permittees and licensees the definition for reentry accident makes no whether the launch vehicle is freedom to conduct test activities that distinction between expendable and expendable or reusable. The expansion may result in damage to associated reusable vehicles. For reentry accidents, of the applicability of the application property, and the freedom to test if the vehicle, its payload, or any requirement is the only change related without the need for a mishap component thereof lands outside a to orbital debris mitigation. As noted investigation for foreseeable test designated reentry site, the FAA deems earlier, the substantive safety failures. it an accident. requirements remain the same. Similarly, although launch incidents i. Mishap Definitions and reentry incidents are both incidents, 14. Mishaps: Definition, Plan, The FAA currently uses a variety of their definitions consist of different Reporting, Response, Investigation, terms to describe the occurrence of an requirements. Launch and reentry Test-Induced Damage unplanned event during commercial incidents occur due to the malfunction As a part of its streamlining efforts, launch, reentry, and site activities. The of a FSS or other safety-critical system, the FAA proposes four mishap-related term ‘‘mishap’’ is a broad term or a failure of the operator’s safety actions, including a revised definition of encompassing several of these organization, design or operations. The anomaly. First, the FAA proposes to unplanned events. Mishap, as currently FAA proposes to consolidate these consolidate the many chapter III defined in § 401.5, means a launch or reentry accident, launch or reentry 140 (1) Launch accident; (2) reentry accident; (3) mishap-related definitions into a launch incident; (4) reentry incident; (5) launch site mishap classification system. Second, incident, launch site accident, failure to accident; (6) failure to complete a launch as this proposal would consolidate existing complete a launch or reentry as planned; (7) failure to complete a reentry as chapter III requirements for mishap, planned, or an unplanned event or planned; (8) an unplanned event resulting in a series of events resulting in a fatality or fatality; (9) an unplanned event resulting in a accident investigation, and emergency serious injury; (10) an unplanned event resulting in response plans, and clarify and serious injury (as defined in 49 CFR greater than $25,000 worth of damage to a payload; streamline reporting requirements. 830.2), or resulting in greater than (11) an unplanned event resulting in greater than Third, the FAA proposes to redefine the $25,000 worth of damage to a payload, $25,000 worth of damage to a launch vehicle; (12) a launch or reentry vehicle, a launch or an unplanned event resulting in greater than term ‘‘anomaly’’ and expand its $25,000 worth of damage to a reentry vehicle; (13) application to include licensed, and not reentry support facility, or government an unplanned event resulting in greater than just permitted, activities. Fourth, the property located on the launch or $25,000 worth of damage to a launch support FAA proposes to exempt pre- reentry site.139 As the definition shows, facility; (14) an unplanned event resulting in greater the term ‘‘mishap’’ captures 15 specific than $25,000 worth of damage to government coordinated test-induced damage to property located on the launch site; or (15) an property involved with the test from unplanned event resulting in greater than $25,000 being a mishap. 139 Section 401.5. worth of damage to a reentry site.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00057 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15352 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

terms into a single mishap classification a launch or reentry site. A Class 1 substantial damage and the scope of the system eliminating the need for mishap would be a mishap that has the resulting investigation. This is multiple terms. highest consequences and greatest consistent with the ARC feedback. Other Current definitions of mishap and impact on public safety. The proposed criteria—such as events posing a high accident also include a $25,000 Class 1 mishap definition would risk of causing a serious or fatal injury monetary threshold that is arbitrary and incorporate existing fatality and serious to any space flight participant, crew, outdated. Experience has shown that injury criteria from current ‘‘launch government astronaut, or member of the even minor damage that does not pose accident,’’ ‘‘reentry accident’’ and public—are based on the existing a threat to public safety can easily ‘‘launch site accident’’ definitions. ‘‘human space flight incident’’ exceed the $25,000 monetary threshold, On November 25, 2015, the U.S definition and expanded to include triggering potentially costly and Commercial Space Launch government astronauts and members of burdensome notification, reporting, and Competitiveness Act was signed into the public. With this criterion, the FAA investigation requirements. For law (Pub. L. 114–90). This law amends intends to cover events akin to a near example, a relatively minor unplanned 51 U.S.C. 50901(15) by inserting miss in the aviation industry and is event following a successful launch ‘‘government astronauts’’ after ‘‘crew’’ consistent with the Air Force and NASA could result in damages to ground each place it appears. In accordance practices. The addition of ‘‘members of support equipment or launch facilities with this amendment, and to ensure the public’’ is consistent with the FAA’s exceeding $25,000. The ARC noted the Class 1 mishap criteria applies equally public safety mission. The FAA’s goal is amount is outdated and does not to all persons on board a launch or to evaluate the event type by impact to necessarily reflect safety implications. reentry vehicle, the FAA Class 1 mishap public safety. Additionally, the conditions listed definition includes government The FAA proposes to define ‘‘Class 3 under the current definitions do not astronauts. The definition would only mishap’’ as any unplanned event, other necessarily reflect the severity of cover fatalities or serious injuries to than a Class 1 or Class 2 mishap, consequences and associated public crew, Government astronauts, resulting in permanent loss of a vehicle safety risks. A better mishap spaceflight participants, or uninvolved during licensed activity or the impact of classification system would provide public. The definition of Class 1 mishap a vehicle, its payload, or any component consistency of mishap thresholds and would not cover other persons thereof outside the planned landing site applicability to all types of operations, associated with the launch or reentry, or impact area. This change would mitigating potential confusion. Rather similar to the current accident differentiate between licensed launches than adding more definitions, the FAA definitions for which it replaces. The and reentries and permitted launches would consolidate and replace the proposed Class 1 Mishap also and reentries. The FAA believes this existing accident, incident, and mishap consolidates existing accident proposal captures the intent of the definitions with a mishap classification definitions, which would include current mishap definition that includes system that would be defined in § 401.5 potential recovery site accidents that the failure to complete a launch or and would apply to all licensed and were previously not defined. The FAA reentry as planned criterion. At the permitted activities. proposes to define a ‘‘Class 2 mishap’’ same time, the separation of licensed Under the proposed changes, as any unplanned event, other than a and permitted operations between Class ‘‘mishap’’ would mean any event, or Class 1 mishap, resulting in a 3 and 4 mishaps is also consistent with series of events associated with a malfunction of a safety-critical system, a ARC feedback. failure of the safety organization or The FAA would consider debris licensed or permitted activity, that procedures, substantial damage to impacts outside of defined limits to meets the criteria of a Class 1, 2, 3 or property not associated with the meet the Class 3 mishap definition, 4 mishap. The FAA would use this operation, or a high risk of causing a provided the event did not satisfy the overarching definition to describe any serious or fatal injury to any space flight criteria of a Class 1 or 2 mishap. Impacts mishap type occurring during permitted participant, crew, government astronaut, of launch vehicle debris outside or licensed activities regardless of or member of the public. The Class 2 designated impact limit lines are classification or consequence threshold. mishap definition would encompass the currently considered a launch accident. The FAA’s proposal was informed by current definitions of a ‘‘launch The FAA proposes to define a ‘‘Class existing NASA and Air Force mishap 4 mishap’’ as an unplanned event, other 141 incident,’’ ‘‘reentry incident,’’ and classification system definitions, and than a Class 1, Class 2, or Class 3 142 ‘‘human space flight incident.’’ The NTSB definitions. definition would use a substantial mishap, resulting in permanent loss of A ‘‘Class 1 mishap’’ would mean any damage to uninvolved property a vehicle during permitted activity, a event resulting in a fatality or serious requirement instead of the $25,000 failure to achieve mission objectives, or injury to any person who is not damage threshold. substantial damage associated with associated with the licensed or Under this proposal, the FAA would licensed or permitted activity. The FAA permitted activity (e.g., members of the make a case-by-case determination intends proposed ‘‘Class 4 Mishap’’ to public) along with any space flight whether the damage to public property capture other events with the potential participant, crew, or government is substantial. This evaluation may be for future public safety implications astronaut. The FAA would be adopting based on, but not limited to, direct without directly affecting public safety the definition of fatality or serious replacement cost, repair cost, and the during occurrence. For example, an injury from 49 CFR 830.2. To constitute property’s intended use and operator may have complete loss of a a Class 1 mishap, the fatality or injury functionality. For example, structural permitted vehicle in a remote and must result from licensed or permitted damage to public property exceeding 50 unpopulated area. Although the loss activity, including ground operations at percent of its market value may be may not have resulted in fatalities, deemed as substantial damage. This serious injuries, or public property 141 NPR 8621.1C, NASA Procedural Requirements approach potentially reduces the burden damage on this occasion, it is important for Mishap and Close Call Reporting, Investigating, and Recordkeeping. Air Force Instruction 91–204, on the commercial space industry and to find the root cause of the mishap. Safety Investigation and Hazard Reporting. Federal government by providing Otherwise, if the operator does not 142 As defined in 49 CFR 830.2. flexibility on the determination of identify and address the underlying

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00058 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15353

cause, it may endanger public safety definition of an anomaly to ‘‘any applicant’s procedures for reporting and during a future launch in different condition during a licensed or permitted responding to launch and reentry conditions. activity that deviates from what is accidents, launch and reentry incidents, standard, normal, or expected, during or other mishaps that occur during the ii. Anomaly Definition the verification or operation of a system, conduct of an RLV mission. It also The FAA proposes to change the subsystem, process, facility, or support requires that an RLV operator submit an definition of ‘‘anomaly’’ and to move equipment.’’ The proposed definition emergency response plan (ERP) the definition to § 401.5, where it would seeks only to clarify what a ‘‘problem’’ containing procedures for informing the apply to all of chapter III. Anomaly is by adding ‘‘deviates from what is affected public of a planned RLV would mean any condition during a standard, normal, or expected.’’ mission. The FAA requires that an licensed or permitted activity that individual authorized to sign and certify iii. Mishaps—Reporting, Response, and deviates from what is standard, normal, the license application, the person Investigation Requirements or expected, during the verification or responsible for the conduct of all operation of a system, subsystem, The FAA proposes to consolidate licensed RLV mission activities, and the process, facility, or support equipment. current chapter III mishap plan, designated safety official, sign the MIP The inclusion of anomaly in § 401.5 reporting, response and investigation and ERP. In contrast, § 437.41 does not would clearly define the expectation of requirements into proposed § 450.173. require any signatures. To ensure post-operation reporting for all licensed The FAA seeks comment on its consistency between all title 14 CFR or permitted operations. It would also proposed approach, as discussed below, chapter III requirements, the FAA capture off-nominal events that do not to mishap requirements, including proposes to consolidate these fall under the thresholds of Class 1–4 reporting. requirements. mishaps as part of the required post- Current title 14 CFR chapter III The ARC noted that reporting launch report. requirements for mishap and accident requirements for mishaps not involving The FAA currently defines anomaly reporting, response, and investigation a fatality or serious injury are unclear only in part 437. Part 437 defines an requirements are inconsistent and create and left up to the operator to determine. anomaly as a problem that occurs confusion. For that reason, the FAA’s The ARC said the FAA should define a during verification or operation of a proposed changes would apply to minimum standard for a reportable system, subsystem, process, facility, or mishap requirements for launch and mishap, in addition to a minimum set support equipment. Section 437.73 reentry licenses, experimental permits, of investigation and reporting requires strict recording, reporting, and and launch and reentry site licenses. requirements, including information implementation of corrective actions in Proposed § 450.173 would replace that should be provided during initial the event of a public safety related §§ 417.111(h) (Accident Investigation notification. anomaly. Section 417.25(c)(1), Plan), 417.415(c) (Post launch and post Current notification requirements are applicable to ELVs, requires operators to flight hazard controls), and 431.45 generally consistent for a launch, report an anomaly that occurred during (Mishap investigation plan and reentry, launch site accident, launch or launch countdown and flight in the emergency response plan). The reentry incident, or mishap involving a post-launch report but does not define proposed mishap plan changes to fatality or serious injury. In those anomaly. Although part 431 does not §§ 420.59(a) (Mishap) and 437.41 instances, regulations throughout title have specific anomaly reporting (Mishap plan) would require an 14 CFR chapter III require that operators requirements, in practice, the FAA operator to meet the requirements of provide immediate notification to the requires operators to report anomalies. § 450.173. FAA’s Washington Operations Center The inconsistencies in the FAA’s To ensure anomaly reporting, the FAA (WOC).143 This is not the case when a current regulatory scheme, including has begun adding a term and condition mishap does not involve a fatality or signature requirements for mishap to launch licenses requiring operators to serious injury.144 For example, part 417 plans, has led to much confusion. For report anomalies prior to the next requires notification within 24 hours to example, § 417.111(h) requires an launch. The FAA uses anomaly the Associate Administrator for operator to implement a plan containing reporting to track vehicle-related issues Commercial Space Transportation or to and to ensure an operator mitigates the launch operator’s procedures for the FAA WOC in the event of a mishap those issues prior to future flights. reporting and responding to launch that does not involve a fatality or Given that not all anomalies are accidents, launch incidents, or other serious injury. In contrast, parts 431 and identified during flight, the post-launch mishaps. It also requires two signatures, 437 only require 24-hour notification to reporting requirement allows the one from an individual authorized to the Associate Administrator for operator to review countdown and flight sign and certify the application, and Commercial Space Transportation, but data for off-nominal conditions and another from the designated safety not to the FAA WOC for a mishap that report any anomalous condition to the official. Similarly, § 420.59 requires that does not involve a fatality or serious FAA as a part of the post-launch report. licensed launch site operators develop injury. Current part 420 does not require Although an anomaly is defined in and implement a launch site accident a launch site operator to provide a 24- § 437.3, as ‘‘a problem that occurs investigation plan that contains the hour mishap notification. If a mishap during verification or operation of a licensee’s procedures for reporting, occur during non-business hours, this system, subsystem, process, facility, or responding to, and investigating launch raises the possibility that a launch support equipment,’’ it is not defined in site accidents and for cooperating with operator may be unable to report it to part 415, 417, 431, or 435, and hence, Federal officials in case of a launch the Associate Administrator for it is applicable only to experimental accident. It also requires a signature Commercial Space Transportation, permits. However, § 417.25—Post from an individual authorized to sign which would create the potential for a launch report, requires an operator to and certify the application, but not from ‘‘identify any discrepancy or anomaly the designated safety official like 143 14 CFR 417.111(h)(1)(i), 420.59(b)(1), that occurred during the launch § 417.111(h). Current § 431.45 requires 431.45(b)(1), and 437.75(a)(1). countdown or flight.’’ The FAA is an RLV operator to submit a mishap 144 14 CFR 417.111(h)(1)(ii), 431.45(b)(2), and proposing to update the existing investigation plan (MIP) containing the 437.75(a)(2).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00059 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15354 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

non-compliance. To address these or mishap across license types.146 After previously developed because the issues, the FAA proposes to provide a the investigation, an operator must requirements would be the same single source for all initial mishap report investigation results to the FAA regardless of license type. This mishap notifications. The single source would and delineate responsibilities for plan document would include be the FAA’s WOC, a 24-hour, seven- personnel assigned to conduct the notification to local officials should a day, operational facility. investigation and for anyone retained by mishap cause the vehicle to land offsite, Parts 417, 420, 431, and 437 all the operator to participate in an such that a coordinated effort can be require an operator to submit a written investigation. Section 420.59(e)(1) also made to protect the public. Provided preliminary report within five days 145 requires that a launch site operator’s emergency response requirements such of either an accident or incident to the investigation plan include procedures as coordinated emergency response FAA, Associate Administrator for for participating in an investigation of a agreements remain current, a permittee Commercial Space Transportation. The launch accident for launches launched can submit a mishap response plan five-day report is a follow-up from the launch site. developed for permitted operations to requirement designed to supplement To ensure vehicle recovery can be satisfy the mishap plan document initial mishap notification once more conducted safely and effectively and application requirements under a detailed information is known. Under with minimal risk to the public, part license. Additionally, the FAA would the proposed mishap classification 431 operators must submit an ERP not have to evaluate the same company system and mishap plan requirements, containing the operator’s procedures for differently depending on the permit or all mishaps would have similar notifying local officials of unplanned license type. This would reduce time reporting requirements. The FAA and offsite landings. In addition, these and cost for the industry and the FAA believes the proposed mishap operators must provide a plan for while maintaining the same level of classification system would save the informing the public potentially affected public safety. operator time and resources during the of the estimated date, time, and landing initial mishap response by eliminating location for the reentry activity. This iv. Discussion of the Mishap Plan— the need to evaluate whether the event information must be provided in Reporting, Response, and Investigation is an accident, incident, or mishap. This layman’s terms. These requirements are Proposed Requirements streamlining of reporting requirements unique to operations conducted under Proposed § 450.173 would eliminate reduces the burden of unclear reporting part 431. all mishap plan signature requirements. requirements noted by the ARC. Section 417.415(c)’s post-launch and The requirement that the person Based on past examples, the five-day post-flight-attempt hazard controls certifying the accuracy of the report is usually only one to three pages require that an operator establish application also sign the mishap plan in length, requiring minimal time to procedural controls for hazards document is not necessary because by compose. The FAA will use the associated with an unsuccessful flight signing the application, the operator is information contained within the five- where the launch vehicle has a land or already certifying that the components day report to ensure the mishap has water impact. These procedures ensure thereof, including the mishap plan been properly classified and the proper the evacuation and rescue of members document, are accurate. Additional level of investigation and FAA oversight of the public, the dispersion and signatures (e.g., from the safety official is being conducted. The FAA believes movement of toxic plumes, identifying or mission director) are also the time required to complete the five- areas of risk, and communication with unnecessary as the roles and day report is minimal and that by local government authorities. responsibilities for personnel providing a clear expectation of Additionally, these procedures require implementing the mishap plan required report contents in the event of that an operator extinguish fires, secure document are contained in the plan all mishap types will eliminate impact areas, evacuate members of the itself. Eliminating the signature confusion and ultimately result in time- public, prevent unauthorized access, requirements would provide operators savings. and preserve evidence. Lastly, the with the flexibility to assign personnel Response plan requirements for operator must ensure public safety from to implement a mishap plan document containing and minimizing the hazardous debris and have plans for the without having to resubmit a signed consequences of a mishap and for recovery, salvage, and safe disposal of document to the FAA. ensuring the preservation of data and debris and hazardous materials. Proposed § 450.173(a) would require physical evidence are generally For all FAA-licensed operations, an operator to report, respond, and consistent throughout license types with proposed § 450.173 would require that investigate class 1, 2, 3, and 4 mishaps some exceptions. For instance, the an operator report, respond, and according to paragraphs (b) through (h) regulations require that a launch site investigate class 1, 2, 3, and 4 mishaps, of § 450.173, using a plan or other operator’s plan include procedures for using a plan or other written means.147 written means. Proposed § 450.173(b)(1) reporting and cooperating with FAA An approved mishap plan document would require that an operator and NTSB investigations, and for would be eligible for reuse with other document the responsibilities for designating one or more points of specific or similar vehicles, sites, and personnel assigned to implement the contact. Additionally, licensees must operations. This would ease the burden requirements of proposed § 450.173. identify and adopt preventive measures on industry. For example, a permittee Proposed § 450.173(b)(2) would require for avoiding recurrence of the event. applying for a license or a current an operator to document reporting Current investigation requirements licensee applying for a different type of responsibilities for personnel assigned are also generally consistent across license, would be able to use the same to conduct investigations and for license types. The FAA currently written mishap plan document anyone retained by the licensee to requires that operators investigate the conduct or participate in investigations. cause of a launch, reentry, or launch site 146 14 CFR 417.111(h)(3), 420.59(d)(3), 431.45(d), Proposed § 450.173(b)(3) would require and 437.75(c). an operator to document the allocation accident, launch or reentry site incident, 147 For purposes of the preamble discussion regarding proposed § 450.173, the term ‘‘mishap of roles and responsibilities between the 145 14 CFR 417.111(h)(1)(iii), 420.49(b)(2), plan document’’ is used to encompass a plan or launch operator and any site operator 431.45(b)(3), and 437.75(a)(3). other written means. for reporting, responding to, and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00060 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15355

investigating any mishap during ground include the information listed in an operator to implement agreements activities at the site. Further, proposed proposed § 450.173(d)(3). This list of with local government authorities and § 450.173(c) would require an operator information would include the emergency response services, as to report to, and cooperate with, FAA operator’s assessment on how the cause necessary. Emergency response and NTSB mishap investigations. Also, of its mishap could potentially affect procedures should identify who is it would require that the operator similar vehicles, systems, or operations. responsible for securing the mishap site, identify one or more points of contact Given some systems and components and procedures for access to the mishap for the FAA and NTSB. This proposal are common across operators, this site. For example, the procedures does not substantively change current information could prevent mishaps due should identify who is responsible for requirements to report, cooperate, and to similar failures of a common system educating persons on the treatment of designate points of contact. Any or component, including ground and debris, and the disposal of hazardous changes from current regulations would range systems. The reporting materials. The FAA recommends that be made merely for clarification requirements in this paragraph are prior to beginning operations, an purposes. In the event of an FAA- or similar to existing five-day reporting operator coordinate with Federal, state, NTSB-led investigation, the FAA would requirements. Under current and local authorities and emergency not require an operator to perform an regulations, a five-day preliminary first responders to familiarize them with independent internal investigation written report was only required in the permitted and licensed operations and because it would be a party to the event of an accident or incident. Based hazards associated with an operator’s investigation. However, the operator on lessons learned from past mishaps, activities, such as launch vehicle would remain responsible for reporting the FAA is streamlining these reporting hazards. This pre-coordination is investigation results to the FAA, which requirements to ensure consistency important to ensure the safety of would include any government- between mishap classes and that emergency personnel responding to the generated or independent investigation information required to properly mishap. Vehicle and operational reports as well as party submissions. In classify a mishap and the level of hazards may include vehicle the event of an operator-led investigation required are reported. For composites, propellants, oxidizers, investigation under FAA oversight, the example, mishaps involving a fatality or pressure vessels, unexploded ordnance, operator’s investigation would be the serious injury are typically investigated oxygen systems, and batteries. primary investigation, although the FAA at the Federal level, as such, the FAA is If implemented, proposed § 450.173(f) may grant official observer status to U.S. aware of the information that may affect would require an operator to investigate Government representatives (e.g., the safety of the public or public the root causes of a mishap and report NASA, the Air Force). As official property. The operator, in accordance the results to the FAA. Proposed observers, these representatives would with their mishap plan, may investigate § 450.173(g) would require that an be integrated into the operator’s mishaps not involving a fatality or operator identify and implement investigation to the extent the FAA serious injury. In such cases, it is preventive measures prior to the next finds appropriate. These U.S. possible that the FAA may not become flight, unless otherwise approved by the Government entities may decide to aware of information potentially Administrator. The FAA is proposing conduct their own investigation affecting the public safety or public that preventive measures be implemented prior to the next flight in independent of FAA oversight, although property in a timely manner, or other all cases in order to codify current the FAA and NTSB have primary facts that may require elevating the class practice. The FAA would work with jurisdiction. of mishap to a higher level. operators on a case-by-case basis to Proposed § 450.173(d) would Proposed § 450.173(e) sets emergency determine whether its next operation establish mishap reporting requirements response requirements. Proposed may proceed if it is unable to implement applicable to all operations, vehicles, or § 450.173(e)(1) would require that an preventive measures before the next mishap types. Proposed § 450.173(d)(1) operator activate emergency response flight. The requirement to implement would require that an operator services following a mishap. This corrective action prior to next flight is immediately notify the FAA WOC in requirement is consistent with the post- consistent with existing requirements in case of a mishap involving a fatality or launch and post-flight attempt hazard § 437.73(d) for anomaly recording, serious injury. Immediately would controls in current § 417.415. Proposed reporting, and implementation of continue to mean notification without § 450.173(e)(2) would require that an corrective actions. delay. The immediate notification operator maintain existing hazard area Proposed § 450.173(h) would require should not hamper emergency response surveillance and clearance as necessary that an operator maintain records activities. Proposed § 450.173(d)(2) to protect public safety. These notices associated with a mishap in accordance would require that operators report would include NOTAM and NOTMAR. with proposed § 450.219(d) (Records). other mishaps not involving a fatality or Proposed § 450.173(e)(3) would require The operator would make these records serious injury to the WOC within 24 that an operator contain and minimize available to Federal officials for hours. This would eliminate the current the consequences of a mishap. Proposed inspection and copying. This option to notify the Associate § 450.173(e)(4) would provide for the requirement is consistent with existing Administrator for Commercial Space preservation of data and physical record keeping requirements.148 Transportation instead of the WOC evidence, including debris, which the Records would include debris, which because the WOC, unlike the FAA considers to be a physical record. the FAA considers a physical record. In Administrator for Commercial Space In an effort to contain and minimize the all mishap cases, disposal of any related Transportation, is available 24-hours per consequences of the mishap and debris would be required to be day, 7 days per week. Proposed maintain site integrity for investigation, coordinated with the FAA. Note that § 450.173(d)(3) would require operators an operator would need to safe and this proposal would allow for the to submit a written preliminary report to secure the mishap site in a timely sharing of proposed § 450.173 the FAA Office of Commercial Space manner. Proposed § 450.173(e)(4) is Transportation within five days of any consistent with current requirements. 148 Sections 417.15(b), 420.61(b), 431.77(b), and mishap. The report would need to Proposed § 450.173(e)(5) would require 437.87(b).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00061 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15356 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

responsibilities between launch and expected outcomes, and potential mishap involving a serious injury or reentry operators pursuant to an failure modes. It also allowed the fatality, damage to property not agreement. For example, the site operator and FAA to reach a common associated with the licensed activity, or operator may report the mishap understanding of what events would be hazardous debris leaving the pre- occurrence to the FAA as required by categorized as a test-induced damage or defined hazard area would be treated as proposed § 450.173(d), while the mishap. This approach would also be a mishap and not test-induced damage. emergency response requirements of consistent with ARC feedback that the Finally, proposed § 450.175(a)(3) would proposed § 450.173(e) may be shared by existing mishap definition leads to require test-induced damage to fall both the launch or reentry operator and protracted mishap investigations within the scope of activities site operator. An operator would be because it does not recognize the coordinated with the FAA to be eligible required to retain all records until difference between operational missions for this alternative. In other words, the completion of any Federal investigation and higher risk experimental or test FAA would consider the occurrence of and the FAA advises the operator that missions. The ARC and FAA believe damages resulting from test activities the records need no longer be retained. this discourages robust testing to push that fall outside the scope of approved Finally, proposed § 450.173(i) would the limits of a vehicle and undercutting activities (e.g., before scheduled test set application requirements. This test programs currently covered under activities begin or exceeding operation section would require the submission of experimental permits. limits) as a mishap in accordance with the mishap plan document at the time As noted earlier, the ARC shared its the proposed mishap classification of license or permit application. concern that current mishap reporting system. The approved scope of the test and investigation requirements v. Test-Induced Damage would be outlined in the information discourage robust testing. The FAA submitted by the permittee or licensee The FAA proposes to introduce a test- believes that the proposed test-induced to meet the application requirements of induced damage exception to the damages paradigm addresses this proposed § 450.175(b). mishap definition in proposed § 450.175 concern by providing an opportunity for Proposed § 450.175(b) would set the (Test-induced Damage). This proposal license applicants and existing license test-induced damage application would allow an operator to coordinate holders to pre-coordinate test activities requirements. The paragraph would list testing activities with the FAA before and pre-declare damages that the FAA the information an applicant would the activities take place to prevent the would not consider a mishap. Under need to submit under the test-induced FAA from labeling failures as mishaps. this paradigm, failure to achieve damage alternative to mishap Any test failure covered by this section identified test objectives and certain classification. The FAA does not intend would be considered test-induced pre-declared damages to property the test-induced damage exception to damage and not a mishap, so long as the associated with the licensed activity, apply to the operation of an entire failure falls within the pre-coordinated including ground support equipment, vehicle, but rather the testing of specific and FAA-approved testing profile. The ground support systems, and flight components and systems. The applicant test-induced damage concept is not hardware would not be reportable as an should submit test objectives in a currently within the FAA’s commercial FAA-mishap provided the requirements complete, clear, and concise manner to space regulations. This proposal is due of this section are met. The FAA also help the FAA distinguish between to the FAA’s recognition that current proposes to replace its existing mishap nominal operations and specific test mishap regulations may deter the kind related definitions in favor of a mishap objectives. It should also provide test of robust testing that may yield future classification system to further clarify limits such as the expected safety benefits. the types of events that would be environments, personnel, equipment, or The FAA currently deems a failure to considered a mishap. environmental limits. Also, the achieve test objectives as a mishap Proposed § 450.175(a) would lay out applicant would identify expected (failure to complete a launch or reentry the specific conditions for the test- outcomes that the FAA would later as planned). Similarly, a test failure that induced damage approach. It would compare to actual outcomes. The FAA results in over $25,000 in damage to require an operator to coordinate test would also request a list of potential associated property would also be activities with and obtain approval from risks, including the applicant’s best considered a mishap.149 In both cases, the FAA before the planned activity. understanding of the uncertainties in the resulting mishap designation would The coordination should take place with environments, test limits, or system require a mishap investigation to sufficient time for the FAA to evaluate performance. Applicable procedures or identify root causes and preventive the proposal during the application steps taken to execute the tests and the measures, which the operator would process or as a license modification. A expected time and duration of the test need to implement before the next test activity would need to be pre- would also be required. Finally, the operation. coordinated with the FAA to be eligible FAA may request additional In the recent past, the FAA accepted for the test-induced damage mishap information such as clarification the possibility of a test-induced damage exception. The FAA would conduct pre- information to ensure public safety, approach by pre-coordinating with a coordination activities during pre- safety of property, and to safeguard the launch operator prior to conducting an application consultation. The test- national security and foreign policy in-flight abort test of a crew escape induced damage exception would be interests of the United States. system.150 The FAA found that this optional and an operator would not be This proposal is similar to NASA’s process worked well in pre-defining the required to take this path. However, test-induced damages process, as objectives of the test, test limits, absent the test-induced damage defined in NPR 8621.1C (NASA exception, the FAA would categorize an Procedural Requirements for Mishap 149 ‘‘[R]esulting in greater than $25,000 worth of unplanned event as a mishap in and Close Call Reporting, Investigating, damage . . .’’ in accordance with the mishap accordance with the proposed mishap and Recordkeeping). NASA developed definition in § 401.5. classification system. Proposed the test-induced damages paradigm in 150 Given these events fell within the pre- coordinated possible scenarios, the FAA did not § 450.175(a)(2) would preclude certain support of the December 2014 launch of consider them unplanned events and therefore, did kinds of mishaps from the test-induced Exploration Flight Test-1 and it has not consider the events mishaps. damage alternative. Specifically, any been in use supporting NASA test

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00062 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15357

programs ever since. The test-induced information, including the vehicle, same format and organization used in its damages process is a formal process launch site, planned flight path, staging license application. Lastly, an operator documenting the risk of damage and and impact locations, each payload would not be able to change an analysis accepting that risk by signature before delivery point, intended reentry or product within the final 30 days before the test. Similar to the commercial space landing sites including any contingency flight, unless the operator has a process, industry, NASA conducts tests to better abort locations, and the location of any approved in the license, for making a understand and mitigate complex disposed launch or reentry vehicle stage change in that period as part of the design, manufacturing, or operational or component that is deorbited. This operator’s flight safety analysis process. issues with the objective of providing section would combine the reporting The third category is flight safety NASA with confidence that the system requirements of §§ 417.17(b)(2) and system test data in proposed meets its technical and programmatic 431.79(a), although reporting the § 450.213(d). If an operator would be requirements and can successfully and location of any disposed launch or required to use an FSS to protect public safely perform its mission in the reentry vehicle stage or component that safety as required by proposed operational environment. As noted in is deorbited would be a new § 450.101(c), it would need to submit to NPR 8261.1C, some tests are designed requirement. The FAA would add this the FAA, or provide access to, any test and intended to result in hardware information requirement because reports in accordance with approved damage (e.g., a structural test-to-failure). disposals are much more common now flight safety system test plans no less Other tests are aggressive in nature, and than when parts 417 and 435 were than 30 days before flight. The FAA may test-incurred damage often occurs; the issued, and notifications to airmen and also agree to a different time frame in knowledge gained is used to improve mariners would be necessary to protect accordance with proposed § 404.15. designs. These statements hold true for the public from vehicle stages or This reporting requirement is discussed the commercial space transportation components reentering as part of a earlier in the section for flight safety industry as well. The FAA’s proposed disposal. In practice, licensees have systems. test-induced damages takes a NASA- arranged for the issuance of NOTAMs The fourth category would be data proven process and tailors it to satisfy and NTMs for vehicle stages required by the FAA to conduct a the FAA’s public safety mission. purposefully deorbited. collision avoidance analysis in The second category is flight safety proposed § 450.213(e). Not less than 15 L. Pre- and Post-Flight Reporting analysis products in proposed days before the flight of a launch vehicle 1. Preflight Reporting § 450.213(c). An operator would need to or the reentry of a reentry vehicle, an submit to the FAA updated flight safety operator would need to submit the Under proposed § 450.213, the FAA analysis products, using previously- collision avoidance information in would continue to require a licensee to approved methodologies, for each proposed Appendix A to part 450 to a provide the FAA with specified mission no less than 30 days before Federal entity identified by the FAA, information prior to each launch or flight. The FAA may also agree to a and the FAA. This reporting reentry, consistent with current different time frame in accordance with requirement is discussed in the ‘‘Launch requirements. An operator would send proposed § 404.15. The flight safety and Reentry Collision Avoidance the information as an email attachment analysis products are similar to what is Requirements’’ section. to [email protected], or by some currently required under § 417.17(c)(3). The fifth category, as proposed in other method as agreed to by the Part 431 does not require similar flight § 450.213(f), a launch or reentry Administrator in the license. The FAA safety analysis products to be submitted, schedule that identifies each review, would require five categories of although current practice is to require rehearsal, and safety-critical operation. information: mission-specific, flight similar information in license orders. The schedule would be required to be safety analysis products, flight safety An operator would not be required to filed and updated in time to allow FAA system test data, data required by the submit flight safety analysis products if personnel to participate in the reviews, FAA to conduct a collision avoidance the analysis submitted in the license rehearsals, and safety-critical analysis, and a launch or reentry application already satisfies all the operations. This is similar to current schedule. requirements of the section. This would § 417.17(b). The first category would be mission- be the case if a licensee’s license 2. Post-Flight Reporting specific information in proposed authorizes specific missions, as opposed Under proposed § 450.215, the FAA § 450.213(b). As currently required in to unlimited launches within certain would require an operator to provide §§ 417.17(b)(2) and 431.79(a), an parameters. An operator would also not specified information no later than 90 operator would be required to provide be required to submit flight safety days after a launch or reentry. The FAA this information to the FAA not less analysis products if the operator may also agree to a different time frame than 60 days before each mission demonstrated during the application in accordance with proposed § 404.15. conducted under the license. The FAA process that the analysis does not need An operator would send the information may also agree to a different time frame to be updated to account for mission- as an email attachment to in accordance with § 404.15. An specific factors. This would be the case [email protected], or other operator would not have to provide any if an operator operates within certain method as agreed to by the information under this section if the operational constraints proven to satisfy Administrator in the license. mission-specific information was public safety criteria. Specifically, as discussed earlier, an already provided in the application. Otherwise, an operator would be operator would need to provide any This would be the case if an operator’s required to submit flight safety analysis anomaly that occurred during license authorizes specific missions, as products while accounting for vehicle countdown or flight that is material to opposed to unlimited launches or and mission specific input data and public health and safety and the safety potential variations in input data that reentries within certain parameters. of property,151 and any corrective action Specifically, an operator would may affect any analysis product within continue to have to provide payload the final 30 days before flight. An 151 What is material to public health and safety information in accordance with operator would also be required to and the safety of property is discussed later in this proposed § 450.43(i), and flight submit the analysis products using the preamble in reference to proposed § 450.211(a)(2).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00063 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15358 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

implemented or to be implemented after Proposed § 450.3(b) would establish that determined that launch begins when the flight due to an anomaly or mishap. launch begins under a license with the hazardous activities related to the Section 417.25(b) and (c) requires start of hazardous activities that pose a assembly and ultimate flight of the similar information. Part 431 does not threat to the public, and it would amend launch vehicle commence.154 The require post-flight information, although the end of launch language to remove preamble further elaborated that the current practice is to require similar any reference to ELVs and RLVs. moment at which hazardous activities information in license orders. Finally, the FAA proposes to clarify begin is when the major components of In addition, an operator would need that, absent the launch vehicle, the a licensee’s launch vehicle enter, for to provide the actual trajectory flown by arrival of a payload at the launch site purposes of preparing for flight, the gate the vehicle, and, for an unguided would not trigger the beginning of of a U.S. launch site, regardless of suborbital launch vehicle, the actual launch. Also, at a non-U.S. launch site, whether the site is situated on a Federal impact location of all impacting stages launch would begin at ignition or take- launch range and regardless of whether and impacting components. The actual off for a hybrid vehicle. flight occurs from that site.155 At the Title 51 U.S.C. 50902 defines launch trajectory flown by the vehicle would be time, the FAA determined that the as to place or try to place a launch a new requirement, while the actual arrival of the launch vehicle at a U.S. vehicle or reentry vehicle and any impact locations for an unguided launch site would trigger the beginning payload or human being from Earth in suborbital launch vehicle is similar to of launch for the following reasons: ease the requirements in current § 417.25(b) a suborbital trajectory; in Earth orbit in outer space; or otherwise in outer space, of administration, consistent and broad and (c). The FAA would use the actual interpretation, and change in the level trajectory flown by the vehicle to including activities involved in the of risk.156 Additionally, the rule stated compare it to predicted trajectories. preparation of a launch vehicle or that shortly after vehicle components Because the FAA may not need this payload for launch, when those arrive, hazardous activities related to information for all launches, this activities take place at a launch site in the assembly and ultimate flight of the information would only need to be the United States. The FAA added the launch vehicle begin and therefore the reported if requested by the FAA. current regulatory definition of launch Lastly, an operator would need to in the 1999 final rule.152 The language arrival of the vehicle or its parts is a report the number of humans on board in the regulatory definition differs logical point at which the FAA should the vehicle. This would be required slightly from the current statutory ensure that a launch operator is because the FAA keeps a human space language regarding activities in exercising safe practices and is flight database for use by launch and preparation of the vehicle, and the financially responsible for any damage reentry operators for the purposes of regulatory definition does not include it may cause.157 In accordance with the informed consent. Under § 460.45(c), the reference to human beings because definition of launch, the FAA has and pursuant to statute, an operator that reference was added to the statute required a launch license to be in place must inform each space flight after 1999.153 The regulatory definition before the arrival of major components participant of the safety record of all also includes language that is not set of a launch vehicle at a U.S. launch site launch or reentry vehicles that have forth in the statute pertaining to pre- that are intended for use on a specific carried one or more persons on board, and post-flight ground operations FAA-licensed launch. including language identifying the including both U.S. government and The lack of flexibility in the definition beginning of launch and end of launch. private sector vehicles, to include the of beginning of launch has led to total number of people who have died The FAA and industry have identified a number of issues associated with the multiple requests from the industry to or been seriously injured on these waive the requirement for a license to flights, the total number of launches and current definition of launch in § 401.5. The current definition of launch is bring vehicle hardware on site and reentries conducted with people on 158 inflexible and has resulted in confusion begin preflight activity. The FAA has board, and the number of catastrophic issued numerous waivers because it failures. To facilitate all operators regarding launch from non-U.S. sites and whether the arrival of a payload determined that the proposed preflight accurately informing space flight activities associated with the arrival of participants, the FAA maintains the constitutes the beginning of launch. The preamble discussion in the 1999 launch vehicles or their major human space flight database and final rule stated that the intent of the components were not so hazardous to populates it using voluntarily provided FAA’s definition of ‘‘launch’’ is to the public as to require FAA oversight. information from industry. As more require a license at the start of those In granting a waiver, the FAA launches and reentries are expected hazardous preflight activities that put determines that the waiver is in the with humans on board, the FAA will public safety at risk. The final rule public interest and will not jeopardize require this information to keep the stated that, in accordance with this public health and safety, the safety of human spaceflight database up to date, responsibility, the FAA will exercise property, or any national security or and expects that this would not regulatory oversight only if an activity is foreign policy interest of the United significantly increase the burden to so hazardous as to pose a threat to third States. In addition, by requesting a operators. parties. Specifically, the FAA waiver to conduct preflight activities, Ground Safety the operator agrees that it must forgo the 152 64 FR 19586 (April 21, 1999). opportunity to seek indemnification for A. Definition and Scope of Launch 153 As currently defined in 14 CFR 401.5, launch means to place or try to place a launch vehicle or As discussed in more detail in this 154 64 FR 19586 (April 21, 1999), at 19591. reentry vehicle and any payload from Earth in a 155 section, the FAA proposes to amend the suborbital trajectory, in Earth orbit in outer space, 64 FR 19586 (April 21, 1999). definitions of ‘‘launch’’ and ‘‘reentry’’ in or otherwise in outer space, and includes preparing 156 64 FR 19586 (April 21, 1999), at 19589. part 401 to mirror the statutory a launch vehicle for flight at a launch site in the 157 64 FR 19586 (April 21, 1999), at 19591. definitions. The FAA would move the United States. The current definition also defines 158 As stated previously, the FAA is only able to beginning and end of launch, which, as discussed waive regulatory requirements, not definitions, and beginning and end of launch to later in the preamble, the FAA proposes to amend therefore has issued waivers to the requirement to proposed § 450.3, which defines the and move to proposed part 450 (Scope of a vehicle obtain a license, rather than to the definition of scope of a vehicle operator’s license. operator license). launch.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00064 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15359

any loss incurred under the waiver FAA has consistently interpreted that with the 2015 update to the Act. during the waived preflight activities. launch from outside of U.S. territory to Similarly, the FAA would revise the Further, the current definition does begin at ignition or at the first definition of ‘‘reenter/reentry’’ in part not account for the significant movement that initiates flight, 401 to mirror the statutory definition, technological advances the industry has whichever occurs earlier. and would add the term ‘‘human being’’ experienced since adoption of the 1999 The ARC commented about the to align with the 2015 update to the Act. rule. For example, in the current definition of launch for licensed The FAA would move the beginning commercial space transportation launches from a U.S. launch site. The and end of launch and reentry language environment, launch operations often ARC report stated that launch should be to proposed § 450.3. The FAA proposes include vehicles or vehicle stages that defined on a case-by-case basis for all this change because such detail in a fly back to a U.S. launch site and remain operators. The ARC recommended definition makes the definition at the launch site. In cases where no licensed activities on U.S. launch sites unwieldy and, unlike regulatory license was in place to cover the for all vehicles include preflight ground requirements, definitions cannot be presence of flight hardware for possible operations, flight operations, and launch waived. reuse, consistent with 1999 rule operations phases as tailored by each The FAA would amend beginning of preamble language, the FAA has launch operator. The ARC further launch such that launch begins with the deemed this to be storage and does not recommends the initiation and scope of first hazardous activities related to the require a license or waiver.159 As launch activities, including preflight assembly and ultimate flight of the currently written, however, the ground operations and flight operation launch vehicle at a U.S. launch site. definition could imply that a license is phases, be defined by the impact of each Unless a later point is agreed to by the required for RLV launches during the activity on public safety and property. Administrator, hazardous preflight period between end-of-launch and These activities may include both ground operations would be presumed launch vehicle reuse, even when the hazardous and safety-critical operations, to begin when the launch vehicle or its vehicle is in a safe and dormant state, the latter encompassing non-hazardous major components arrive at the launch and would not be a threat to public activities that may impact public risk site. For operations where an applicant safety. during other pre-launch and flight identifies a later time when hazardous Because the current definition states activities. A list of performance-based operations begin, the applicant may that launch begins under a license with criteria for licensed activities would be propose the event that it believes should the arrival of a launch vehicle or tailored for each operator and the FAA constitute the beginning of launch payload at a U.S. launch site, the term based on their specific concept of during the pre-application process.162 ‘‘or payload’’ has been interpreted to operations. This scope should only As a result, there would be no need to mean arrival of a payload by itself could include hazardous operations unique to request a waiver. constitute beginning of launch. activities as defined in the operator’s This proposed change would also However, the 1999 preamble explicitly license application documents and not clarify that for launch vehicle stages or states that the FAA does not define activities already regulated by another when launch begins for an RLV that launch to commence with the arrival of government agency. returns to a launch site and remains a payload absent the launch vehicle at In light of the multiple waiver there in a dormant state, FAA oversight a launch site.160 Also, it states that the requests and ARC recommendations, the is not necessary since no hazardous FAA does not consider payload FAA proposes to amend the regulatory activity that falls under the FAA’s processing absent launch vehicle definitions of launch and reentry oversight responsibilities are being integration to constitute part of licensed (discussed later in this section) to match performed. activities.161 In addition, the 1999 rule the statutory definitions. The FAA This proposal would clarify that, preamble refers to launch beginning would also move the details in the absent vehicle hardware, the arrival of when the ‘‘major components’’ of a definitions for beginning and end of payload does not constitute beginning of launch vehicle arrive at the launch site. launch (discussed later in this section) launch. Instead, launch would begin However, the regulatory language and reentry to the scope of a vehicle with the arrival of a launch vehicle or remains unclear. operator license requirements in its major components at a U.S. launch Another point of current uncertainty proposed § 450.3. In addition, the FAA site, or at a later point as agreed to by is when launch begins from a non-U.S. would revise ‘‘beginning of launch’’ to the Administrator. site. Title 51 U.S.C. chapter 509 gives be more performance-based and ‘‘end of This proposal would also specify that the FAA authority to issue a launch launch’’ to remove references to ELVs launch from a non-U.S. site begins at license to a U.S. citizen conducting a and RLVs. Finally, the FAA proposes to ignition, or at the first movement that launch anywhere in the world. clarify that launch from a non-U.S. site initiates flight, of the launch vehicle, However, the current definition of would begin at ignition, and that the whichever comes first. For hybrid launch is silent as to when launch arrival of a payload to a launch site does vehicles, flight commences at take-off. begins from a non-U.S. site. This has not constitute beginning of launch. The The current ‘‘beginning of launch,’’ as resulted in operators lacking clarity as FAA believes the proposed revisions defined in the definition of ‘‘launch’’ to when launch begins. In recent years, capture the primary intent of the ARC’s refers only to launches from a U.S. the FAA has licensed launches from recommendation, which is to limit FAA launch site, and is silent with regard to international waters, Australia, the oversight to those launch operations launches from sites outside the United Marshall Islands, New Zealand, and that pose a hazard to public safety and States. Although the FAA issues launch Spain. In licensing these launches, the the safety of property. licenses for launches from non-U.S. The FAA would revise the definitions launch sites if the operator is a citizen 159 64 FR 19586 (April 21, 1999), at 19593. ‘‘On of launch and reentry in § 401.5 to the other hand, the FAA does not intend a launch mirror the statutory definitions. 162 The FAA’s proposal regarding how an license to encompass components stored at a Specifically, the FAA would remove the operator would determine what event constitutes launch site for a considerable period of time prior the beginning of launch, and how to obtain the to flight.’’ beginning and end of launch language Administrator’s approval, is located in the Ground 160 64 FR 19586 (April 21, 1999), at 19589. from the definition of ‘‘launch,’’ and Safety section under the Identifying First Hazardous 161 64 FR 19586 (April 21, 1999), at 19593. add the term ‘‘human being’’ to align Activity sub-heading of this preamble.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00065 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15360 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

of the U.S., the FAA considers it outside post-flight ground operations related to NPRM 163 and codified it in the 2006 its authority to license preflight returning the vehicle to a safe state on final rule. The 2006 final rule adopted activities that take place at a non-U.S. the ground. ground safety standards governing the launch site in light of the statutory Finally, the FAA proposes to modify preparation of a launch vehicle for definition of launch that explicitly the definition for reentry. Title 51 U.S.C. flight. The final rule specified that in refers to ‘‘activities involved in the 50902 defines reentry as: to return or order for a launch operator to meet part preparation of a launch vehicle . . . attempt to return, purposefully, a 417 ground safety requirements, an when those activities take place at a reentry vehicle and its payload or operator must conduct a ground hazard launch site in the United States.’’ The human beings, if any, from Earth orbit analysis to meet the requirements of FAA also believes that this or from outer space to Earth. In 2000, subpart E, part 417, as well as a toxic interpretation is necessary because of the FAA codified the current regulatory release hazard analysis to meet the issues of sovereignty and liability under definition of reentry in the final rule, requirements of § 417.227. For launches international law. For these non-U.S. Commercial Space Transportation conducted from a Federal launch range, launch sites, the FAA has historically Reusable Launch Vehicle and Reentry a launch operator could rely on an licensed launches beginning at ignition, Licensing Regulations. Section 401.5 LSSA as an alternative means of or if there is no ignition, then at the first defines ‘‘reenter; reentry’’ as: To return demonstrating compliance with the movement that initiates flight. In order or attempt to return, purposefully, a FAA’s part 417 ground safety rules. to provide clarity for launch operators reentry vehicle and its payload, if any, Because most licensed ground launching from non-U.S. sites, the FAA from Earth orbit or from outer space to operations were covered by the LSSA is proposing to codify this approach in Earth. The term ‘‘reenter; reentry’’ approach, the FAA did not begin to part 450. includes activities conducted in Earth exercise the ground safety requirements In addition to addressing issues in the orbit or outer space to determine reentry in part 417 until 2016. current definition of ‘‘launch’’ regarding readiness, and that are critical to Beginning in 2016, the FAA received when launch begins, the FAA proposes ensuring public health and safety and several applications for launch licenses to clarify when launch ends. First, the the safety of property during reentry from non-Federal launch sites.164 FAA would move the provisions in the flight. The term ‘‘reenter; reentry’’ also Applicants were required to current definition of launch regarding includes activities conducted on the demonstrate compliance with the end of launch to proposed § 450.3. ground after vehicle landing on Earth to ground safety regulations in part 417. Second, the FAA would remove the ensure the reentry vehicle does not pose During the FAA’s evaluation, the agency distinction between ELVs and RLVs, a threat to public health and safety or found that many of its ground safety which is consistent with one of the the safety of property. As noted earlier, requirements were overly burdensome, overall goals of this proposed rule. the FAA proposes to revise the highly prescriptive, and did not include Overall, the substance of the current definition to mirror the statute and criteria for determining public safety. provisions related to end of launch move the provisions related to reentry Furthermore, the FAA discovered the currently located in § 401.5 would not readiness and returning the vehicle to a requirements were out-of-date with change. Specifically, launch ends: safe state on the ground to proposed commercial space transportation 1. For an orbital launch of an ELV, § 450.3. practices and operations, and in some after the licensee’s last exercise of cases duplicated other state and Federal B. Ground Safety Requirements control over its vehicle whether on orbit regulations. or a vehicle stage impacting on Earth; This proposal would revise current Part 431 does not include explicit 2. For an orbital launch of an RLV, ground safety requirements to make ground safety requirements. However, after deployment of all payloads or if them more flexible, scalable, and the scope of a launch license under part there is no payload, after the launch adaptable to varying types of launch and 431 includes preparing a launch vehicle vehicle’s first steady state orbit; and reentry operations. The proposal seeks for flight at a launch site in the United 3. For a suborbital launch of either an to ensure that the FAA’s oversight of States. In conducting its safety review ELV or RLV that includes reentry, ground operations at U.S. launch sites under § 431.31, the FAA must launch ends after reaching apogee; or for would only cover activities that are determine whether an applicant is a suborbital launch that does not hazardous to the public and critical capable of launching an RLV and include a reentry, launch ends after the assets. Specifically, as proposed in payload, if any, from a designated vehicle or vehicle component lands or § 450.179, an operator would be launch site without jeopardizing public impacts on Earth. required to protect the public from health and safety and the safety of In all these cases, activities on the adverse effects of hazardous operations property. The FAA evaluates on an ground to return either the launch site and systems associated with preparing a individual basis all public safety aspects or the vehicle or vehicle component to launch vehicle for flight, returning a of a proposed RLV mission to ensure a safe condition are part of launch and launch or reentry vehicle to a safe they are sufficient to support safe could possibly extend the end of condition after landing, or after an conduct of the mission, including launch. In the rare, yet to be seen, aborted launch attempt, and returning a ground safety. In licenses issued under situation of a suborbital launch that site to a safe condition. An operator part 431, the FAA has required does not require an FAA launch license would be required to conduct a ground operators to address reasonably but does require a reentry license, hazard analysis (proposed § 450.185) launch ends after the vehicle reaches and comply with certain prescribed 163 Licensing and Safety requirements for Launch, apogee. In addition, the FAA would hazard controls during those preflight NPRM. 65 FR 63922 (October 25, 2000). move the provisions related to reentry 164 The FAA’s first license application involving activities that constitute launch. In a launch from a non-Federal launch range was from readiness and returning the vehicle to a addition, an operator would be required SpaceX for operations at pad 39A in Cape safe state on the ground to proposed to comply with other ground safety and Canaveral, Florida. The FAA completed its § 450.3. Including these reentry related application requirements in evaluation and issued SpaceX the license on provisions in the scope of a vehicle February 2017. Astra Space originally applied for a proposed part 450. launch license from a non-Federal launch range in operator license would clarify an The FAA proposed the part 417 June 2017, and the FAA issued its license March operator’s responsibilities regarding ground safety regulations in the 2000 2018.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00066 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15361

foreseeable hazards to ensure the safety coordinate with licensed launch and the applicant knows what to include in of pre- and post-flight ground reentry site operators (proposed its application. Early interactions with operations. The lack of clarity in part § 450.181). the FAA would allow a potential 431 is problematic, and would be fixed applicant to work with the FAA to 1. Ground Safety: Identifying First by the ground safety requirements in determine which preflight operations Hazardous Activity this proposal. constitute launch and therefore must The ARC recommended that the FAA In proposed § 450.3, an operator occur under a license. An applicant that create ground safety regulations that are would have the flexibility to determine elects to identify an activity after the flexible and streamlined, continue to for its particular operation when the arrival of a launch vehicle or associated protect the public, and are not first preflight activity that poses a major components at a launch site as the duplicative of other state or Federal hazard to the public begins in beginning of launch should be prepared authorities. The ARC provided four coordination with the FAA. An operator to discuss its operations with the FAA primary recommendations for ground could identify the arrival of the vehicle so that the FAA can determine that safety. First, the ARC recommended the or its major components at the launch operations occurring prior to that point FAA allow operators to determine what site as the beginning of hazardous would not pose a threat to public safety. activities and operations would be operations, which is consistent with Note that under this proposal, covered under FAA regulations by current practice. This option would indemnification and reciprocal waiver performing an analysis to define provide a clear demarcation of when of claims coverage would start when hazards. Second, the ARC launch begins that is easily understood launch begins as it does under current recommended the FAA scale the scope by both an operator and the FAA. The regulations. In other words, financial of what is considered licensed activities license would cover all ground responsibility requirements would based on each operator’s unique operations that may present a hazard to apply from the first hazardous operation operations. Third, the ARC the public from the time flight hardware until launch ends. recommended the FAA focus its first arrives at the launch or reentry site regulatory authority solely on those to the end of launch or reentry. 2. Ground Safety: Ground Hazard things that affect public safety. Finally, Alternatively, an operator could Analysis the ARC recommended the FAA only identify some other action, after the Proposed § 450.185 (Ground Hazard regulate those things that are not already arrival of the vehicle or its major Analysis) would require an operator to overseen by other governmental components at the launch site, as the complete a ground hazard analysis authorities. beginning of hazardous activities. As which would include a thorough The FAA agrees with the ARC’s discussed earlier in the scope of a assessment of the launch vehicle, the recommendations that ground safety vehicle operator license discussion, this launch vehicle integrated systems, regulations should be flexible, option would be available for those ground support equipment, and other performance-based, and utilize a ground operations where the arrival of the launch site hardware. The analysis hazard analysis that determines the best launch vehicle does not constitute the would include an identification of methods for protecting the public. The beginning of hazardous activities. It hazards, a risk assessment, an proposed ground safety regulations would also provide flexibility to identification and description of would rely on a system safety approach operators because the start of hazardous mitigations and controls, and provisions to allow flexibility by stripping away launch operations is unique to each for hazard control verification and specific design requirements, operator’s circumstances. These validation. Although the analysis might establishing more performance-based hazardous launch operations would incorporate employee safety and requirements, and giving the operator include the pressurizing or loading of mission assurance, this proposal would flexibility in satisfying these propellants into the vehicle or launch only require an applicant to identify the requirements. Specifically, an operator system,165 operations involving a fueled hazards that affect the public, and how would conduct a ground hazard analysis launch vehicle,166 or the transfer of an operator would mitigate those (proposed § 450.185), and comply with energy necessary to initiate flight.167 hazards. prescribed hazard controls. In addition While this option offers greater Proposed § 450.185(a) would require to any mitigations identified in the flexibility, it would require that an an operator to identify hazards. A ground hazard analysis, the proposed applicant talk with the FAA during pre- hazard is a real or potential condition regulations would require several application consultation to identify that could lead to an unplanned event prescribed hazard controls, including an which activity would be the beginning or series of events resulting in death, accounting of how the operator would of hazardous launch operations. This is serious injury, or damage to or loss of protect members of the public who enter necessary for the FAA to scope its equipment or property. The FAA areas under their control, provisions on requirements accordingly, and so that proposes separating ground hazards into how the operator would mitigate two primary categories: System and hazards created by a countdown abort, 165 This would include the loading of propellants operational hazards. System hazards an explanation of the operator’s plans or pressurants, where there are potential hazards would include, but would not be such as overpressure, explosion, debris, for controlling fires, and generic deflagration, fire, and toxic material release. The limited to, vehicle over-pressurization, emergency procedures an operator operations that are typically performed include wet sudden energy release including would implement. As will be discussed dress rehearsals, cold flow, returning the vehicle to ordnance actuation, ionizing and non- later, operators using toxic materials a safe state following a scrub, and tests that might ionizing radiation, fire or deflagration, would have to perform a toxic release be performed while the vehicle is being fueled. radioactive materials, toxic release, 166 This would include static fire or tests with a hazard analysis (proposed § 450.187), fully-fueled integrated vehicle. cryogens, electrical discharge, and show how it would contain the effects 167 This would include activities that involve structural failure. Operational hazards of a toxic release, or how the public placing the launch vehicle into a state that would would be hazards introduced to the would be protected from those risks enable it to achieve suborbital or orbital flight. Even launch site through procedures and if traditional propellants are not used, the energy from toxic releases. Operators would needed to escape Earth’s gravity is significant and processes that occur during vehicle also be required to develop an explosive the initiation of the action to launch a vehicle could processing. Operational hazards would siting plan (proposed § 450.183) and to potentially have significant impact to public safety. include propellant handling and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00067 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15362 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

loading, transporting vehicles or Verification provides measurable members of the public who enter areas components, vehicle system activation, evidence that a safety measure reduces under the operator’s control, mitigate and related tests. risk to acceptable levels. Validation is hazards created by a countdown abort. Once an operator has identified an evaluation to determine that each They would also require the operator’s hazards, proposed § 450.185(b) would safety measure derived from the ground plans for controlling fires and require an operator to conduct a risk hazard analysis is correct, complete, emergency procedures. assessment. In other words, an operator consistent, unambiguous, verifiable, and Specifically, proposed § 450.189(b) would have to evaluate each hazard to technically feasible. Validation ensures would require an operator to document determine the likelihood and the that the right safety measure is a process for protecting members of the severity of that hazard. This assessment implemented, and that the safety public who enter any area under the should identify the likelihood of each measure is well understood. operator’s control. Although the public hazard causing a casualty. This While this proposal would require an would be protected from many hazards assessment should also account for the operator to complete a full ground because they are excluded from safety likelihood of each hazard causing major hazard analysis as described previously, clear zones and prevented from entering damage to public property or critical an operator would not need to submit the site during certain hazardous assets. Public property, in this case, this analysis in its entirety as part of its operations, an operator should account means any property not associated with vehicle operator license application. for the protection of the public when the operation. Critical assets means an Rather in proposed § 450.185(f), the they are allowed to be on the site. The asset that is essential to the national FAA would require an applicant to proposed rule would require an operator interests of the United States, and provide a description of the ground to develop procedures to identify and includes property, facilities, or safety hazard analysis methodology, a track members of the public while on infrastructure necessary to maintain list of the systems and operations site, and methods to protect the public national defense, or assured access to involving the vehicle or payload that from hazards in accordance with the space for national priority missions. may cause a hazard to the public, and ground hazard analysis and the toxic Proposed § 450.185(c) would require the results of the ground hazard analysis hazard analysis. For example, the an operator to identify mitigations or that affect the public. Although the operator could have plans in place to controls used to eliminate or mitigate results of the ground hazard analysis control who enters its site, whether or the severity or likelihood of identified would be unique to each applicant’s not members of the public on site will hazards. An operator would be required operations, the ground hazard analysis be escorted, how the public will be to demonstrate, as part of its ground application deliverables should have made aware of and protected from hazard analysis, that the mitigations or common elements. Specifically, the hazards, and if members of the public controls reduce the likelihood of each ground hazard analysis should contain will be required to wear personal hazard that may cause (1) death or the hazards that have a high likelihood protective equipment. serious injury to the public to an or high severity of affecting the public. This rule would also require an extremely remote likelihood, and (2) The analysis should include controls for operator to establish, maintain, and major damage to public property or the hazards that mitigate the risk to the perform procedures for controlling critical assets to a remote likelihood. public and all of the other requirements certain hazards in the event of a These qualitative thresholds are the shown in § 450.185. Common hazards countdown abort or recycle operation. same as those in § 437.55(a)(3) and that affect public safety, which the FAA Current § 417.415(b) requires an proposed § 450.109(a)(3). A hazard would expect to be addressed in a operator to meet specific requirements control is a preventative or mitigation ground hazard analysis, include for safing their vehicle, maintaining measure that reduces the likelihood of propellant loading, ordinance control of their FSS, and controlling the hazard or ameliorates its severity. installation or actuation, proximity to access to the site until it is returned to Proposed § 450.185(d) would require pressurized systems during operations, a safe state. This rule would require a an operator to identify and describe the certain lifting operations (such as solid more performance-based approach to risk elimination and mitigation rocket motors and payload integration), ensuring the safety of the vehicle and measures required to satisfy the risk operations which could result in toxic the site following a countdown abort or criteria in proposed § 450.185(c). Under release, and RF testing. Fundamentally, recycle operation in order to current industry standards, these if the operator identifies a hazard that accommodate many different types of measures include one or more of the affects the public, it must be properly flight safety systems and operations. following: Design for minimum risk, documented and mitigated to reduce the Proposed § 450.189(c) would require incorporate safety devices, provide risk to the public. It should be noted that an operator, following a countdown warning devices, or implement that any part of the ground hazard abort or recycle operation, establish, procedures and training, as previously analysis could be reviewed during maintain, and perform procedures for discussed in reference to the analogous inspection. controlling hazards related to the flight hazard analysis requirement in vehicle and returning the vehicle, 3. Ground Safety: Ground Safety § 450.109(a)(4).168 stages, or other flight hardware and site Finally, proposed § 450.185(e) would Prescribed Hazard Controls facilities to a safe condition. In all of require an operator to demonstrate In addition to those mitigations an these instances, this proposal would through verification and validation that operator would implement as a result of require an operator to have provisions the risk elimination measures meet the its ground hazard analysis, proposed in place to keep the public safe while remote and extremely remote standards § 450.189 (Ground Safety Prescribed returning the launch vehicle or launch discussed earlier. Verification is an Hazard Controls) would require an site back to a safe condition. If a launch evaluation to determine that safety operator to implement certain vehicle does not lift-off after a command measures derived from the ground prescribed hazard controls during the to initiate flight, an operator would be hazard analysis are effective and have ground operations period of launch or required to ensure that the vehicle and been properly implemented. reentry. These prescribed hazard any payload are in a safe configuration, controls would require that an operator prohibit the public from entering into 168 MIL–STD–882E, section 4.3.4. document how it would protect any identified hazard areas until the site

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00068 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15363

is returned to a safe condition, and protecting members of the public who site. The same mishap plan maintain and verify that any FSS enter any area under the operator’s requirements in proposed § 450.173 remains operation until certain that the control. This process would be would apply to a site operator leaving launch vehicle does not represent a risk submitted as part of an applicant’s open the assignment of roles and of inadvertent flight. These more vehicle operator license application. responsibilities between a site and specific requirements would be levied launch or reentry operator for reporting, 4. Ground Safety: Coordination With a on an operator in the event of a failure responding to, and investigating Licensed Launch or Reentry Site to lift-off after a command to initiate mishaps during ground operations. Operator because a launch vehicle can be in a Proposed § 450.181(b) is designed to particularly hazardous state. Under proposed § 450.181(a), for a ensure those roles and responsibilities This proposed requirement is similar launch or reentry conducted from or to are established. to § 417.415(b), which requires a launch a Federal launch or reentry site or a site As part of its application, an applicant operator to establish procedures for licensed under part 420 or 433, an would be required to describe how it is controlling hazards associated with a operator must coordinate with the site coordinating with a Federal or licensed failed flight attempt where an engine operator because the two entities each launch or reentry site operator in start command was sent, but the launch have public safety responsibilities compliance with this section. As vehicle did not lift-off. These during ground operations. Specifically, discussed earlier, in reference to procedures must include maintaining an operator must coordinate with the proposed § 450.147, a vehicle operator and verifying that each flight site operator to ensure public access is would be required to submit as part of termination system remains operational, controlled where and when necessary to its vehicle operator license application assuring that the vehicle is in a safe protect public safety, to ensure launch references to any agreements with other configuration, and prohibiting launch or reentry operations are coordinated entities utilized to meet any complex entry until the launch pad area with other launch and reentry operators requirements of this section. In this safing procedures are complete. and other affected parties to prevent context, agreements may include Proposed § 450.189(d) would require unsafe interference, to ensure that any security, access control services, any an operator to have in place reasonable ground hazard area does not lease agreements for launch sites, precautions for reporting and unnecessarily interfere 169 with services used for hazard controls or controlling any fire that occurs during continued operation of the launch or analysis, or any agreement with local launch and reentry activities in order to reentry site, and to ensure prompt and emergency or government services. prevent the occurrence of secondary effective response in the event of a hazards such as a brush fire caused by mishap that could impact public safety. 5. Ground Safety: Explosive Site Plan a static fire test or some related ground This is similar to § 417.9(b)(2), which Proposed § 450.183 (Explosive Site launch activity. These secondary requires a launch operator to coordinate Plan) would require an applicant to hazards, if not controlled, could reach with a launch site operator and provide include an explosive site plan as part of pressure vessels or other related any information on its activities and its vehicle operator license application, equipment causing more damage. An potential hazards necessary for the if it proposes to conduct a launch or operator may choose to meet industry launch site operator to determine how reentry from or to a site exclusive to its standards or fire codes as a means of to protect any other launch operator, own use. The explosive site plan would satisfying this requirement. person, or property at the launch site. have to demonstrate compliance with Proposed § 450.189(e) would require Part 431 requires an agreement between the explosive siting requirements of an operator to establish general a launch or reentry operator and any site §§ 420.63, 420.65, 420.66, 420.67, emergency procedures that address how operator in § 431.75. In addition, in the 420.69, and 420.70. Currently for emergencies would be handled at the mission readiness review requirements exclusive use sites, § 417.9(c) requires a site. An emergency has the potential to in § 431.37(a), an operator must involve launch operator to satisfy the directly affect the public or create secondary hazards that may affect the launch site and reentry site personnel requirements of the public safety public; therefore, implementation of and verify their readiness to provide requirements of part 420. With proposed these procedures are critical for safety of safety-related launch property and § 450.183, the FAA is clarifying that the the public. An emergency would launch services. only requirements from part 420 that include any event that would require an For a launch or reentry conducted need be conducted by an exclusive use evacuation, or a response from from or to a site licensed under part 420 operator is the explosive safety emergency officials such as the fire or 433, § 450.181(b) would require an requirements. operator to also coordinate with the site department or emergency medical 6. Ground Safety: Toxic Hazards During operator to establish roles and technicians. Additionally, the Ground Operations establishment of general emergency responsibilities for reporting, Proposed § 450.187 contains procedures would allow the operator to responding to, and investigating any requirements for toxic hazard mitigation have roles, responsibilities, and plans in mishap during ground activities at the for ground operations. This is discussed place in advance of an emergency to 169 The FAA has proposed minimum later in the ‘‘Additional Technical reduce the effects of any emergency on requirements for ground hazard areas based on Justification and Rationale’’ section, in the public. Section 417.111(c)(15) safety thresholds, either toxic hazard areas or other the subsection on toxic hazards for currently requires an operator to have hazard areas derived from the ground hazard flight, due to the commonality of toxic generic emergency procedures in place analysis, but has always allowed operators to propose to clear areas larger than necessary to requirements for ground operations and for any emergency that may create a ensure greater safety. In consultation with NASA flight. hazard to the public, and this rule and the Department of Defense, the FAA discovered would replace those prescriptive that FAA approved ground hazard areas were Process Improvements requirements with performance-based having adverse impacts on neighboring space operations in easily avoidable ways. As such, the A. Safety Element Approval requirements. FAA has proposed ground hazard areas be Proposed § 450.189(f) would require coordinated with the affected launch or reentry site This proposal would modify part 414 an applicant to submit its process for operators prior to licensing. to enable applicants to request a safety

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00069 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15364 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

element approval in conjunction with a would maintain the same meaning as element approval concurrently with a license application as provided in that in current 415, 431 and 435 where license application. These safety proposed part 450. Proposed § 450.39 it appears in the proposed rule. element approval applications (Use of Safety Element Approval) would submitted in conjunction with a license ii. Part 414 Safety Element Approval 170 allow an applicant to use any vehicle, would largely use information Application Submitted in Conjunction safety system, process, service, or contained in a license application to With a License Application personnel for which the FAA has issued satisfy part 414 requirements. This a safety element approval under part Part 414 enables a launch and reentry would alleviate the need to provide 414 without the FAA’s reevaluation of operator to use an approved safety separate applications for a vehicle that safety element during a license element within a specified scope operator license and a safety element application evaluation to the extent its without a re-examination of the approval. The FAA envisions safety use is within its approved envelope. element’s fitness and suitability for a element approvals in conjunction with Finally, this proposal would change the particular launch or reentry proposal. A a license application to cover the same part 414 term from ‘‘safety approval’’ to safety element approval may be issued safety elements as delineated in § 414.3. ‘‘safety element approval’’ to distinguish independent of a license, and it does not Using similar processes as for part it from ‘‘safety approval’’ as used in confer any authority to conduct 414, the FAA would determine whether parts 415, 431, and 435, and proposed activities for which a license is required a safety element is eligible for a safety part 450, because these terms, as under chapter III. A safety element element approval. The FAA would base discussed later in this section, have approval does not relieve its holder of its determination on criteria in proposed entirely different meanings. the duty to comply with all applicable part 450. The applicant would be requirements of law or regulation that required to specify the sections of the i. Part 414 and 415 Safety Approval may apply to the holder’s activities. license application that support its Clarification The ARC recommended that an application for a safety element As defined in current § 414.3, a safety applicant for a launch or reentry license approval. The technical criteria for approval is an FAA document be able to identify one or more safety reviewing a safety approval submitted containing an FAA determination that elements included in the applicant’s as part of a vehicle operator license one or more safety elements, when used license application and to request application would be limited to the or employed within a defined envelope, review of those safety elements for a requirements of proposed part 450. This parameter, or situation, will not safety element approval concurrent with limitation would simplify the safety jeopardize public health and safety or the license application review.171 element approval process by eliminating safety of property. As listed in the Act, The FAA agrees with the ARC’s the need to provide a Statement of safety elements include: (1) Launch recommendation. The FAA notes that Conformance letter, as required under vehicle, reentry vehicle, safety system, its practice has always been to accept current § 414.1(c)(3) for a safety element process, service, or any identified references to information provided in a approval separate from a vehicle component thereof; or (2) qualified and previous license application so long as operator license application. To avoid trained personnel, performing a process the applicant can demonstrate the this limitation to proposed part 450 or function related to licensed launch relevance of that information to the criteria, an applicant could apply for a activities or vehicles. In contrast, parts current application. The FAA also relies safety element approval separate from a 415, 431, and 435 reference ‘‘safety on previous evaluations where it vehicle operator license. However, there approval’’ to mean an FAA analyzed compliance with a particular is no difference between a safety determination that an applicant is requirement if the same operator element approval issued through a capable of launching a launch vehicle submits a more recent application using separate application or a vehicle and its payload without jeopardizing the same analysis. The proposed operator license application. public health and safety, and safety of changes would codify this approach for Finally, the FAA proposes to remove property. Other chapter III parts, safety element approval applications in the requirement stating that, for each including parts 431 and 435, reference proposed § 450.39 172 and the relevant grant of a safety element approval, the ‘‘safety approval’’ as described in part sections in part 414. FAA will publish in the Federal 415. This proposal would allow an Register a notice of the criteria that were The use of identical terms in parts applicant to request a safety element used to evaluate the safety element 414, 415, 431, and 435 to reference approval as part of its vehicle operator approval application, and a description different meanings has caused license application. Specifically, this of the criteria. The FAA provided the confusion. Therefore, the FAA proposes rule would provide a process in rationale for this notification in the to distinguish these terms by changing proposed § 414.13 to apply for a safety preamble to a proposed rule.173 The the part 414 term to ‘‘safety element FAA explained that the purpose of this approval.’’ This proposed term more 170 For readability and ease of understanding, this notification requirement was to make accurately reflects the substance of a section refers to a current part 414 safety approval clear the criteria and standards the FAA part 414 safety approval of a particular as a safety element approval, regardless of whether the discussion is referencing the current regulations used to assess a safety element. element that may be used to support the or the proposed regulations. For direct quotations, However, the FAA has found that this application review for one or more the FAA retains the previous term ‘‘safety requirement is unnecessary, and has launch or reentry licenses. Other than approval.’’ potentially discouraged applications for the addition of ‘‘element’’ to the current 171 ARC Report, p. 24–25. safety element approvals due to term, the part 414 definition and related 172 Proposed § 450.39 is similar to § 437.21(c) for experimental permits, which states that if an concerns that proprietary data may be references in parts 413 and 437 would applicant proposes to use any reusable suborbital disclosed. Going forward, a safety remain the same. The FAA would make rocket, safety system, process, service, or personnel element approval application submitted conforming changes throughout parts for which the FAA has issued a safety approval concurrently with a vehicle operator 413, 414, and 437, where a part 414 under part 414, the FAA will not reevaluate that safety element to the extent its use is within its license application would be evaluated safety approval is referenced, to change approved envelope. Parts 415 and 431 do not have those references to ‘‘safety element similar sections because they were developed 173 Safety Approvals, NPRM, 70 FR 32191, 32198 approval.’’ The term ‘‘safety approval’’ before part 414 was issued. (June 1, 2005).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00070 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15365

based only on criteria in proposed part application. If the FAA accepts an payload developers seeking early 450. For other safety element approvals, application as complete enough to assurances that their payload would be experience has shown that there is no review, the FAA works with applicants permitted to be launched. The FAA has need to publish the criteria because the to identify additional information and even conducted preliminary policy FAA’s determinations were not based documentation needed to demonstrate reviews to provide similar assurances to on any uniquely-derived standard. In regulatory compliance, and advises future applicants on a less formal basis. fact, all eight safety element approvals applicants when those materials are Despite these allowances, the vast granted by the FAA have been evaluated needed. If the additional materials are majority of FAA commercial space against regulations in 14 CFR chapter not provided within an appropriate time licensing evaluation time is spent on III. Therefore, the FAA proposes to frame, the FAA tolls the review period, evaluating the safety implications of a revise the requirement in current stopping the counting of time towards license application. Because this § 414.35 (re-designated as § 414.39) such the 180-day deadline. Once the FAA has proposed rule seeks to convert the that safety element approval evaluation completed its review, it issues a license, prescriptive safety requirements to criteria, whether related to an or informs the applicant, in writing, that performance-based criteria, the FAA application submitted concurrently with the license application is being denied believes that it may be possible to a license application or separately, and states the reasons for denial. develop a flexible safety review process would not require publication. Industry representatives have that can afford applicants early Given the FAA’s proposal to not expressed frustration both with a lack of determinations, providing an applicant require publication of evaluation clarity as to what is ‘‘complete enough’’ more flexibility and control over the criteria, the confidentiality provision for the FAA to accept an application timing of the licensing process. 174 and begin review and with the 180-day under current § 414.13(d) is no The ARC also recommended that the review period. The FAA seeks comment longer necessary. That provision notifies FAA reduce its application review time. on how the FAA can improve the clarity applicants that if proposed criteria is The ARC focused on differentiating of ‘‘complete enough’’ to address past secret, proprietary, or confidential, it between experienced and inexperienced frustrations. For an applicant that is in may not be used as a basis to issue a operators in order to decrease FAA the early stages of development, there safety approval. review time of license applications. are challenges with compiling all of the While the FAA agrees that experienced B. Incremental Review of a License documentation in parallel with their operators may require shorter Application vehicle development. First-time application review times, it should be In response to the ARC applicants regularly underestimate the noted that this would likely be due to recommendations, the FAA proposes to amount of time needed for licensing. familiarity with the application process, amend part 413 and to include language For nearly all applicants, much of the more streamlined application materials in proposed part 450 to allow an vehicle and mission information is only that lend themselves to a more efficient applicant the option for an incremental refined and finalized within the 180-day review, and established processes that review of the safety approval portion of review period, which may subject the have been through FAA review its application. application to tolling and business risk previously (such as ground safety Under 51 U.S.C. 50905(a)(1), the FAA to the applicant’s timeline for launch analyses). While the proposed is required by statute to issue or deny operations. The timing of the issuance incremental review process would a launch or reentry license not later than of an FAA authorization has never empower operators to better define 180 days after accepting an application. caused a delay to a launch or reentry when certain portions of an application Under the same statute, the FAA must operation, but the FAA is cognizant that are reviewed and would allow an inform the applicant of any pending there could be impacts on an operator operator that has satisfied certain issue and action required to resolve the even absent an operation delay. requirements early to receive credit for issue not later than 120 days after In part to address these issues, and those portions of its application in accepting an application. To ensure that bearing in mind that a written advance, other proposals in this the FAA has sufficient time to complete application is the means by which the rulemaking, such as safety element a thorough review to evaluate whether FAA determines whether a launch or approvals concurrent with a license the applicant complies with the FAA’s reentry operator can conduct a launch application, flexible time frames, and commercial space transportation or reentry safely, the FAA invited the reduced application burdens, would regulations in the prescribed time frame, ARC to describe how the FAA might probably serve to reduce review times § 413.11 states the FAA screens the modify its application process to more effectively than an incremental application to determine if it contains improve efficiency for both the FAA and application process. Nevertheless, the sufficient information for it to begin its applicants. The ARC suggested in part modular nature of payload review. It also states that if the that the FAA allow for an incremental determinations, policy approvals, application is so incomplete or or modular application and review environmental evaluations, and indefinite that the FAA cannot start to process. Specifically, the ARC financial responsibility requirements, evaluate it, the FAA will notify the recommended that the application and the more granular incremental applicant accordingly. In accordance review process should be modified to review of compliance with the safety with internal policy, the FAA aims to allow for incremental approvals of approval requirements would allow an make this complete enough subsections to guide a focused review applicant to seek partial approval of an determination within two calendar and avoid tolling. The recommendation application as soon as a portion is ready weeks after receiving the application. suggested further that, rather than 180 to be evaluated. These approvals would When the FAA accepts an application, days for review of an entire application, allow an operator to better manage its the 180-day review period begins on the the FAA should assign a brief period for timeline and any potential timeline risk. date that the FAA received the each subsection or module. The current application process is The flexible nature of this proposal would allow the FAA to further engage 174 Current § 414.13 would be renumbered in this already modular to an extent. The FAA proposal as § 414.17 to maintain sequential section has issued payload determinations with industry and establish new best numbering. outside of a license, primarily for practices and greater efficiencies for

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00071 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15366 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

both government evaluators and our The details of an applicant’s safety evaluation to inform and remain commercial partners. The option of incremental application process would consistent with other aspects. using an incremental approach would have to be approved by the FAA in Furthermore, operators generally provide more flexibility to operators accordance with proposed § 450.33(b) develop and define standards, who are able to provide portions of their prior to application submission and the methodologies, processes, preliminary application in advance. FAA could issue determinations designs, and plans for an aspect of their In proposed § 450.33 (Incremental towards a safety approval resulting from evaluation long before they are able to Review and Determinations), the FAA those reviews, in accordance with submit advanced analysis products or would revise the launch and reentry proposed § 450.33(c). An applicant testing results. The FAA seeks comment regulations to allow for an incremental would be able to propose sections of the on how a formal incremental review review application submission option safety approval portion of its process would account for the statutory for vehicle operator license applicants. application that the FAA could review 180-day review period, when Because the current regulations already independently. This process would application increments or modules are allow an operator to submit the payload, allow an applicant to submit completed likely to be submitted and reviewed at policy, environmental, and financial sections, for example the System Safety very different time periods. responsibility portions of its application Program, to the FAA early, rather than To enable incremental application independently, the FAA proposes that wait until the entire application was submission and review, the FAA is the incremental review process apply complete enough. The FAA would also proposing to amend § 413.1 to broaden specifically to the safety approval be able, where appropriate, to review the term application to encompass portion of a license application. Given and make determinations on these either a full application submitted for the large variety of applicant increments prior to a full licensing review or an application portion experience, proposed operations, and determination. It would also allow an submitted under the incremental review company timelines, the FAA recognizes applicant to identify more challenging process. In making this amendment, the a need for flexibility. Accordingly, the or lengthy portions of an application FAA would be able to accommodate FAA is proposing amendments to part that could be submitted earlier to avoid applications submitted under either 413 and regulatory language in delays and tolling closer to a launch process. The FAA proposes to retain the proposed part 450 to allow for date. The FAA believes this process pre-application consultation incremental application submission and would improve predictability for requirement of § 413.5, which is determinations. This incremental applicants seeking assurances against streamlined by the proposed removal of review application process would not business risks. As the FAA gains more § 415.105 and its duplicative replace the traditional review of a full, experience with the incremental requirement for a more prescriptive pre- complete application submitted at application process, the FAA may issue application consultation process. Under once—the incremental review would be guidance for the process or an example this proposal, an operator would be an optional path to obtaining an FAA of a process that has been found to required to identify whether it wants to license determination that allows an satisfy the intent of the regulation. enter into the incremental application applicant to choose an application The FAA considered the ARC’s process during pre-application submission process that suits their recommendations for predetermined consultation. Should an operator elect business model and program needs. modules, but identified several concerns to submit its application incrementally, The FAA is proposing in § 450.33(a) in attempting to model the practice of it would work with the FAA to detail that, prior to any submission, an such a process. The ARC provided a what is needed for each application applicant would be required to identify flow diagram that partitioned the portion to begin review. In proposing an to the FAA that it plans to avail itself evaluation process into nine conceptual approach to incremental review, the of the incremental review and 30-day modules, with the proposal that FAA expects that an applicant would determination application process. those modules could be reviewed in During pre-application consultation, the serial or in parallel. As noted earlier, the consider the following: FAA would work with an applicant FAA is statutorily limited to a 180-day 1. Application increments submitted towards an incremental review process review process, so any review of at different times should be not be that is aligned to both the development modules in serial could not exceed 180 dependent on other increments to the process for an applicant and the days. The ARC recommended that if the extent practicable. necessities of the FAA’s evaluation modules are submitted in parallel for 2. Application increments should be framework. The FAA proposes to concurrent review, extra time should be submitted in a workable chronological coordinate with applicants during pre- provided for FAA review up to 90 days order. In other words, an applicant application consultation to determine to allow for dependent analyses. The should not submit an application the following: (1) Appropriate portions ARC recommendation asserted the increment before a separate application of an operator’s application that could importance that the modules are increment on which it is dependent. For be submitted and reviewed independent in terms of content, when example, the FAA would not expect to independently; (2) the application and possible, but correctly acknowledged agree to review a risk analysis before review schedule with dates of key that some modules will necessarily reviewing a debris analysis or milestones; (3) the applicant’s planned depend on others.175 The FAA seeks to probability of failure analysis because approach to demonstrate compliance provide as much flexibility as the risk analysis is directly dependent with each applicable regulation, to practicable in the proposed process to on the other two analyses. include any foreseeable requests for enable innovative business practices 3. An applicant should be able to waiver; and (4) the scope of the and schedules that contemplate frequent clearly identify all the regulations and proposed action being applied for, the launches and reentries, but many associated application materials that identification of any novel safety aspects of the safety evaluation are would be required for each application approaches or other potentially interdependent, and the FAA requires increment, and should be able to complicating factors, and how those certain material from one aspect of a demonstrate to the FAA that all the will be addressed during the licensing applicable regulations are covered by process. 175 ARC Report, p. 61. the separately submitted portions.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00072 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15367

4. Examples of application increments provide the FAA’s expected review unlikely to generate payload-specific that may be suitable for incremental period to make its determination on the issues. As another example, the default review include: System Safety Program, proposed alternative time frame. The time frame in proposed § 450.213(d) for Preliminary Safety Assessment for proposed revisions to parts 415, 417, a licensee to submit to the FAA certain Flight, Flight Safety Analysis Methods, and 431 would be included in new flight safety system test data would be and FSS Design. proposed part 450. For ease of reference, no later than 30 days before flight. The The FAA seeks comment on the the FAA would list all revised chapter FAA may agree to a shorter time frame incremental approach generally. The III time frames in proposed appendix A for an experienced operator that uses a FAA further seeks comment on any to part 404. proven flight safety system. other useful guidelines that an applicant Proposed § 450.15(b) would inform the operator to submit its request for an D. Continuing Accuracy of License should consider when crafting an Application and Modification of License incremental approach. Finally, the FAA alternative time frame in writing. The also seeks comment on any other safety ‘‘in writing’’ provision could be in the The FAA proposes to consolidate approval sections of a license form of a formal letter or email sent continuing accuracy requirements application that would be appropriate electronically to the email address currently in §§ 417.11 and 431.73 in for incremental review. [email protected], with the proposed § 450.211. The proposed rule Finally, the FAA would amend subject line ‘‘Alternative Time Frame would preserve the standards in § 413.15 to provide that the time frame Request.’’ If an operator would like to §§ 417.11 and 431.73. In addition, it for any incremental review and send the request in hardcopy, it would would allow an applicant to request determinations would be established mail the request to the Federal Aviation approval of an alternate method for with an applicant on a case-by-case Administration, Associate requesting license modifications during basis during pre-application Administrator for Commercial Space the application process. This option consultation. The FAA would continue Transportation, Room 331, 800 currently only exists in § 437.85 for to work with applicants during the pre- Independence Avenue SW, Washington, experimental permits. application phase to assist applicants in DC 20591; Attention: Alternative Time Under the current regulations, an navigating the FAA’s regulations and Frame Request. The FAA anticipates operator must ensure that any identifying potential challenges. that an operator would submit these representation contained in a license requests during the pre-application application is accurate for the entire C. Time Frames consultation or during the application term of a license. After the FAA issues Chapter III regulations include a process, and not after a license has been a launch license, an operator must apply number of prescriptive time frame issued. At a minimum, the operator to the FAA for a license modification if requirements that the FAA proposes to would be required to submit its request any representation that is material to make more flexible. In 2016, the FAA before the time frame specified in the public health and safety or safety of conducted a review of the time frames regulations. Note, the FAA would need property is no longer accurate in chapter III and found that many time to process the request. For (commonly referred to as ‘‘material could be made more flexible without example, if a requirement states that an change’’). An application to modify a any discernable impact on safety. operator must submit a document 30 license must be prepared and submitted During meetings with the Commercial days before launch, the operator may in accordance with part 413. The Spaceflight Federation (CSF) 176 in 2017 not submit a request for an alternative licensee must indicate what parts of its and 2018, some members of industry time frame 30 days before launch or license application or license terms and expressed concern about the FAA’s later. Also, under the proposal, the conditions would be affected by a restrictive time frame requirements. The requested alternate time frame must be proposed modification. Although license applications are ARC also stated that the current specific. For example, an operator could often updated during the application regulatory time frames and requirements request to submit a document 15 days process, the application, as fixed at the for submission of changes is onerous before launch, but not ‘‘as soon as time of license issuance, becomes part and untenable for high flight rates.177 possible.’’ The FAA would provide the of the licensing record. After issuing the In consideration of the industry’s operator its decision in writing. license, the FAA deems any material comments and the FAA’s review of Proposed § 404.15(c) would provide change to a representation in the chapter III time frames, the FAA the conditions under which the application to be a modification to the proposes in § 450.15 to increase Administrator would agree to an license. However, changes may occur flexibility by allowing an operator the alternative time frame. That is, the FAA after a license is issued, particularly option to propose alternative time would review and agree to an among operators that are developing frames that better suit its operations. alternative time frame if the proposed new systems or incorporating The FAA would revise the time frame alternative time frame would allow time innovative technology. The FAA does requirements in parts 404, 413, 414, for the FAA to conduct its review and not wish for the material change 415, 417, 420, 431, 437, and 440 that are make the requisite findings. For example, the default time frame in requirement to deter those changes overly burdensome and may result in proposed § 450.213(b) for a licensee to intended to improve operations. waiver requests. Further, the FAA submit to the FAA certain payload Although the FAA and operators may would, after reviewing the operator’s information would be not less than 60 not always agree on what constitutes a request for an alternative time frame, days before each mission conducted material change, the FAA works with under a license. The FAA uses the the operator to resolve any issues and 176 The Commercial Spaceflight Federation (CSF) states that its mission is ‘‘to promote the information to verify that each payload reduce uncertainties. development of commercial human spaceflight, fits within any approved class of Regarding compliance with an issued pursue ever-higher levels of safety, and share best payload under the license, and to license, the ARC recommended that practices and expertise throughout the industry.’’ address any issues that may arise. The information needed prior to each Its member businesses and organizations include commercial spaceflight developers, operators, FAA may only need a shorter time launch, as long as it is within the spaceports, suppliers and service providers. frame for this effort if the approved approved flight envelope, should be 177 ARC Report, p. 48. payload classes are well defined and minimized and a centralized, automated

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00073 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15368 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

system for submitting preflight anomaly investigation, and requiring re- Other Changes information should be established. verification by test or inspection. A. Pre-Application Consultation Continuing accuracy reviews should be c. Rework or repair of a safety-critical limited to an assessment of the risks component after inspections or tests As discussed earlier, the ARC created by the change. The ARC further revealed fabrication or assembly recommended that the FAA require the recommended that if the regulations imperfections. pre-application process only for new continued to use the term ‘‘material operators or new vehicle programs. For d. Reuse, after an earlier launch or change,’’ then that term should be all other operations, the ARC reentry, of safety-critical systems or defined in the regulations, guidance, or recommended that pre-application components, requiring refurbishment, 180 pre-application agreement. occur at the operator’s discretion. re-qualification testing, and re- The FAA agrees with the ARC’s The FAA does not agree that pre- acceptance testing. recommendations. While there already application should be discretionary for exist avenues by which a licensee can 2. Hazard analysis changes that may anyone. In light of the various minimize the need for license affect public safety such as the validity flexibilities proposed in this rule, pre- modifications,178 this rule would adopt of the hazard analysis, mitigation application consultation would remain an approach from § 437.85 where the measure, or verification of a safety critical to assist operators with the FAA may identify the types of changes critical system or component. licensing process, especially those that that a permittee may make to a reusable 3. Flight safety rule changes that may choose to avail themselves of the suborbital rocket design without affect public safety such as flight flexibilities provided in this proposal. invalidating the permit. In proposed commit criteria associated with public These flexibilities include incremental § 450.211, the FAA may approve an safety. review, timelines, and the performance- based nature of many of the regulatory alternate method for requesting license 4. Hazard area changes that may affect requirements. Pre-application modifications if requested during the public safety, including the dimensions application process. The FAA envisions consultation eases the burden on both of the area. the applicant and the FAA during the that this approach would permit an 5. Maximum Probable Loss (MPL) applicant during the application process application process by identifying and related changes that affect the validity of resolving issues that allow applicants to to propose a method that is responsive the assumptions used to establish the to its anticipated types of changes after submit application materials the agency MPL (e.g., change in the number of can accept as complete enough for a license is issued. personnel within a hazard area, change Regarding the recommendation for the review. That being said, pre-application in trajectory resulting in more overflight development of a centralized automated consultation with an experienced of people or property, increase in system for submitting preflight operator conducting an operation vehicle size with more propellant, information, while the FAA has been substantively similar to one previously hazardous materials, or potential flexible in accepting application licensed would likely be an abbreviated debris). material and license updates submitted process. in electronic format, it recognizes that 6. Environmental Assessment related In response to the ARCs request for an improved system is desirable. The changes that affect the validity of an defined review times, the FAA FAA is exploring mechanisms to environmental assessment (e.g., changes considered an approach to pre- facilitate these submissions. to mitigation measures outlined in a application consultation that would Finally, the FAA agrees with the ARC record of decision or environmental culminate in a mutually agreeable recommendation that it should develop impact statement). ‘‘compliance plan.’’ Under this guidance on what constitutes a 7. Safety organization changes that approach, a compliance plan would be ‘‘material change’’ and has identified may affect public safety such as changes developed collaboratively between the the following areas that often constitute to the roles and responsibilities of the applicant and the FAA. Key milestones a material change: safety organization or personnel, that could be established by the 1. Safety-critical system or component including changes in contractual safety compliance plan would include, but changes (e.g., flight safety system) that services.179 would not be limited to, the planned may affect public safety, including— dates of the formal application 8. Critical documents or processes submittal, the FAA’s licensing a. Substitution of an existing safety- that may affect public safety. critical component with a component determination, and the submission of with a new part number or The FAA believes that this list any required information that is manufacturer (reflecting changed provides guidance to help operators unavailable at the time of formal dimensions, changed functional or better understand what constitutes a application submittal. The FAA chose performance specifications, or changed material change. As the industry not to propose this requirement because manufacturing process). continues to develop and the FAA it could be overly burdensome, possibly b. Modifications to a safety critical identifies material changes, it will delay an application submittal, and the component deemed necessary by an consider providing more detailed compliance plan could require frequent guidance. updates. However, the FAA would be 178 A license applicant may circumvent or lessen open to commenters’ views on how to the need for frequent license modification due to 179 As discussed earlier in the preamble, the best develop a voluntary pre-application material change by providing in its application a proposed rule would eliminate the current product, such as a compliance plan. range of payloads, flight trajectories, hazard areas, requirement to name a specific individual as the and orbital destinations, so as to encompass more safety official. Instead, the NPRM would allow for B. Policy Review and Approval flexibility in actual licensed operations. A license one person or several persons to perform the safety applicant may also create acceptable processes for official functions, and, the operator would be The FAA currently reviews a launch making changes to safety critical systems and their required to designate a position, not a specific and reentry license application to components, mission rules, hazard areas, and safety individual, to accomplish the safety official determine whether it presents any organization, that limit the need for license functions. Therefore, under this proposal, if the modifications. Part of these processes would operator changes the specific individual performing issues affecting national security include a mechanism for informing FAA of the the safety official functions, that would not change. constitute a material change. 180 ARC Report, p. 23.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00074 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15369

interests, foreign policy interests, or §§ 415.25 and 431.25 under proposed reviews of orbital missions, NASA and international obligations of the United § 450.41 (Policy Review and Approval). the Department of Defense have States. As part of its review and in In doing so, the FAA would retain the repeatedly, and specifically, requested accordance with section 50918 of the substance of the current requirements information from the FAA concerning Act, the FAA consults with the while further tailoring the informational the trajectories of upper stages after Department of State, Department of requirements toward a policy review. orbital insertion in order to determine Defense, and other executive agencies, Also, the FAA would replace the launch the potential for the proposed mission as appropriate. The Department of or reentry vehicle description to jeopardize the safety of government Defense assesses the effect of the launch requirements with vehicle description property in outer space or national on U.S. national security, and the requirements that are more appropriate security. Department of State assesses its effect for a policy review. Finally, the FAA Therefore, in addition to on foreign policy interests and would require the applicant to provide consolidating §§ 415.25(d)(2) and international obligations of the United flight azimuths, trajectories, and 431.25(d)(2) into proposed States. For good practice, the FAA also associated ground tracks and § 450.41(e)(4)(ii), the FAA would add consults with NASA, the Department of instantaneous impact points, and language to clarify that the requirement Commerce’s National Oceanic and contingency abort 182 profiles, if any, for to supply flight azimuths, trajectories, Atmospheric Administration (NOAA), the duration of the licensed activity. and associated ground tracks and and the Federal Communications Specifically, proposed § 450.41(e)(2) instantaneous impact points applies for Commission (FCC), for counsel on those would replace the current requirement the duration of the licensed activity (i.e., U.S. interests related to the primary to identify structural, pneumatic, lift off to the end of launch). This responsibilities of each agency. As such, propulsion, electrical, thermal, guidance clarification would eliminate the need the FAA coordinates with the FCC and and avionics systems with a for the FAA to request additional NOAA over matters related to frequency requirement to describe the launch or information from an applicant to satisfy licensing and Earth imaging, reentry vehicle and any stages, inquiries from NASA and the respectively, and with NASA for matters including their dimensions, type and Department of Defense during policy particularly related to its assets in space. amounts of all propellants, and reviews and prevent any unnecessary Section 415.25 currently contains maximum thrust. As previously delays to the policy review process. application requirements for a policy mentioned, currently required C. Payload Review and Determination review of the launch of a vehicle other information is not critical for a policy than an RLV, § 431.25 for the launch review because policy determinations The FAA proposes to consolidate the and reentry of an RLV, and § 435.23 for do not require the same level of payload review requirements. The the launch of a reentry vehicle other technical detail as a safety review and agency would also remove the than an RLV.181 To date, these do not need to delve into vehicle design requirement to identify the method of informational requirements have served specifics. Instead, the information securing the payload on an RLV, add their purpose well. However, the FAA required by proposed § 450.41(e)(2) application requirements to assist the believes that the current informational would provide the FAA and its interagency review, such as the requirements should be modified to interagency partners with the scope of identification of approximate transit relieve the applicant of unnecessary the proposed activity that is more time to final orbit and any encryption, burden and to improve the utility of the pertinent to a policy review. Moreover, clarify the FAA’s relationship with information requested for a policy the FAA anticipates that the proposed other federal agencies for payload review. Currently, §§ 415.25(b) and changes would be significantly less reviews, and modify the 60-day 431.25(b) both require an applicant to burdensome for an applicant, as the notification requirement currently identify structural, pneumatic, information is readily available and found in §§ 415.55 and 431.53. propellant, propulsion, electrical and requires minimal effort to provide. In While speaking of payload reviews, it avionics systems. Section 431.25(b) also contrast, the currently required is important to keep in mind the requires an applicant to identify thermal information, while also readily definitions of launch vehicle and and guidance systems used in the available, might be extensive and payload as defined in FAA regulations. launch vehicle, and all propellants. require more effort to compile. The FAA is not proposing to amend Although identifying the Additionally, it is unclear that the these definitions. A launch vehicle is a aforementioned systems is important for requirements to supply flight azimuths, vehicle built to operate in, or place a a safety review, the FAA believes that trajectories, and associated ground payload in, outer space or a suborbital this information is not critical for a tracks and instantaneous impact points, rocket. A payload is an object that a policy review, which addresses whether currently found in §§ 415.25(d)(2) and person undertakes to place in outer the launch or reentry presents issues 431.25(d)(2), apply for the duration of space by means of a launch vehicle, affecting national security interests, the licensed activity (i.e., from lift-off to including components of the vehicle foreign policy interests, or international the end of licensed activities). For specifically designed or adapted for that obligations of the United States. example, applicants previously have object. Thus, a payload can become a The FAA proposes to consolidate the interpreted the requirement to supply reentry vehicle. For example, the policy review requirements contained in flight azimuths and trajectories to end at Dragon is a payload when it is launched orbital insertion because that is when on the Falcon 9 and a reentry vehicle 181 These sections require an applicant to provide ground tracks and instantaneous impact when it reenters from Earth orbit. The basic information about the launch or reentry points vanish. However, during FAA believes that any component vehicle, its ownership, launch site, flight azimuths, trajectories, associated ground tracks and interagency coordination for policy attached to, or part of, a launch or instantaneous impact points, sequence of planned reentry vehicle that has an intended use events or maneuvers during flight, range of nominal 182 The FAA proposes to revise the definition in in space other than transporting itself or impact areas for all spent motors and other § 401.5 of ‘‘contingency abort’’ to mean a flight a payload, is in fact a payload. For discarded mission hardware, and for each orbital abort with a landing at a planned location that has mission, the range of intermediate and final orbits been designated in advance of vehicle flight. The example, the FAA has treated canisters of each vehicle upper stage, and their estimated proposed definition is discussed later in this of cremains attached to a stage left in orbital lifetimes. preamble. orbit as payloads.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00075 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15370 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

Pursuant to § 415.51, unless the information from the FAA for the the language exempting certain payload is exempt from review under amount of time a payload will take to payloads from review is overly § 415.53, the FAA reviews a payload reach its final orbital destination. This restrictive. The FAA has made payload proposed for launch to determine information allows the agencies to determinations for payloads that will whether an applicant, payload owner, or assess the payload’s potential to impact undoubtedly require FCC or NOAA operator has obtained all the required their operations. However, current licensing, but the proposed payload licenses, authorization, and permits. regulations do not contain an missions were beyond the scope of The FAA further determines whether a informational requirement that the communications or remote sensing. payload’s launch would jeopardize applicant provide this information. As a These payloads were examined in the public health and safety, safety of result, the FAA often must make interagency process and neither the FCC property, U.S. national security or additional requests to the applicant in nor NOAA took exception to the FAA’s foreign policy interests, or international order to provide the requesting agencies approach. obligations of the United States. with the information. Section 50918 of Title 51 of the U.S. Similarly, both § 431.51 for launch and In the past, most non-government Code mandates that the Secretary of reentry of an RLV and § 435.41 for payloads were telecommunications or Transportation consult with the reentry of a reentry vehicle other than remote sensing satellites for which there Secretary of Defense on matters affecting an RLV, require the FAA to review a were well-established regulatory national security, the Secretary of State payload to examine the policy and regimes. Operators are now proposing on matters affecting foreign policy, and safety issues related to the proposed payloads with new intended uses such the heads of other agencies when reentry of a payload. as servicing other satellites and appropriate. Section 50919(b) states that Current §§ 415.59 and 431.57 also mapping frequency use. The capabilities chapter 509 of Title 51 does not affect require the applicant to submit basic of payloads continue to grow; for the authority of the FCC or Department payload information to allow the FAA example, cubesats are appearing in great of Commerce. The language of FAA to conduct a payload review. While the numbers with unique capabilities. As a regulations exempting from review information requirements for payload result, it is possible that these new uses those payloads subject to the review in §§ 415.59 and 431.57 are may pose threats to national security, jurisdiction of the FCC, NOAA, and similar, they are not identical. Both such as the resolution of on-board other agencies, is more restrictive sections require that an applicant cameras that might be used to survey regarding the FAA’s authority than what provide the payload’s physical national security space assets. is required in the statutory mandate of dimensions and weight; owner and Consequently, payload reviews 51 U.S.C. 50918 and 50919. The genesis operator; orbital parameters for parking, increasingly need to address the threat of this more-limited role by the FAA transfer, and final orbits; and hazardous that these new uses and capabilities came from the Report of House of materials, as defined in § 401.5, and might pose to U.S. national security, Representatives, May 31, 1984, that radioactive materials, and the amounts either unintentional or malicious. accompanied H.R. 3942. Specifically, of each. However, § 415.59 requires an Additionally, § 415.53 provides that the report stated: ‘‘[t]he Committee applicant to provide the name and class the FAA does not review payloads intends that the Secretary not review or of the payload, the intended payload regulated by the FCC or the Department otherwise evaluate the merits of operations during the life of the of Commerce. Section 431.51 provides communications satellites licensed and payload, and the delivery point in flight that the FAA does not review payloads approved by the FCC, other than to at which the payload will no longer be subject to regulation by other federal assure the proper integration of such under the licensee’s control. Whereas, agencies. However, neither of these payload with the launch vehicle and its § 431.57 requires an applicant to regulations reflect current practice. In launch into orbit.’’ At that time, almost provide either the payload name or practice, the FAA includes payload all non-government payloads were payload class and function; the physical information in its interagency reviews communications or remote sensing characteristics of the payload in for all payloads, with the exception of satellites, regulated by the FCC and addition to the payload’s dimensions certain U.S. Government payloads for NOAA, respectively. and weight; the explosive potential of which information is unavailable due to When DOT published the initial payload materials, alone and in national security concerns, because licensing regulations in 1988, the combination with other materials found § 415.51 provides that the safety preamble noted that the payloads on the payload or RLV during reentry; requirements apply to all payloads, subject to existing payload regulation and the method of securing the payload regardless of whether the payload is included only telecommunications on the reusable launch vehicle. It also otherwise exempt. Even though the FAA satellites licensed by the FCC and replaces delivery point with designated conducts a review of all payloads, the remote sensing satellites licensed by reentry site(s); and requires the FAA does not impinge on the authority NOAA. It went on to state that payloads identification of intended payload of the FCC or the Department of that were not subject to review by DOT operations during the life of the Commerce, nor question the decision of included all domestic payloads not payload. With respect to hazardous the FCC or NOAA to approve presently regulated by the FCC or materials, § 431.57 also requires the communications or remote sensing NOAA and all foreign payloads. Almost applicant to identify the container of the satellites. It does not question the any domestic payload, even if it is not hazardous materials, in addition to the decision of another federal agency a telecommunications satellite, type and amount, because how the concerning its payloads. More however, requires FCC licensing hazardous materials are contained is accurately, while the FAA may conduct because it will invariably have a U.S.- important for reentry. a review of all payloads, the FAA does owned or -operated transmitter for The FAA believes that the current not make a payload determination on telemetry purposes. Therefore, it payload review informational what it considers an ‘‘exempt’’ payload. appears that the intention of the rule requirements necessitate modification to Changes in the types of payloads that was only to exclude from FAA improve the utility and efficiency of are being launched or proposed have regulation telecommunications satellites payload review. During interagency also complicated the scope of FAA licensed by the FCC and likewise, review, other agencies have requested payload reviews and demonstrated that remote sensing satellites licensed by

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00076 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15371

NOAA, and not any satellite with a launch or reentry vehicle does not likelihood of any issues once the transmitter licensed by the FCC or with change the function of the payload. The specific payload is identified. For series some incidental remote sensing payload’s intended use in space or of virtually identical payloads, the FAA capability. changes in the orbit of the vehicle to has authorized the entire series. A In recent years, there have been accommodate the payload operation payload or launch operator can work proposals for commercial payloads might present issues because it could with the FAA to facilitate and expedite where the primary purpose might be affect NASA or Department of Defense payload approvals by defining payload scientific or exploratory or even artistic. assets either due to its orbit or function. classes to accommodate possible Despite their primary purpose, these For example, the Department of Defense payloads. Also, payload classes payloads almost always require an FCC has concerns regarding payloads that authorized for one operator will usually license because they have transmitters may pass close enough to its assets to be authorized for another operator. The for telemetry. Similarly, some payloads photograph them. The FAA recognizes FAA acknowledges that the current 60- also require approval by NOAA even that some payloads, such as canisters of day notification requirement might be though remote sensing may be ancillary cremains, attached to an upper stage, unnecessary for certain well-defined to the main purpose. Without an might have little or no safety or policy payload classes and proposes to modify interagency review, the FAA has no implications. However, a review is still this requirement to permit a shorter direct means of knowing whether a necessary to make that determination. notification on a case-by-case basis. The payload is exempt from review and, as Obviously, the absence of hazardous FAA anticipates that the notification a result, has initiated interagency materials also removes some safety requirement would be specified either reviews. These reviews also serve the concerns; however, as previously in the separate payload determination or purpose of alerting the other agencies to discussed, hazardous materials are not in a vehicle operator license. launches of payloads that might the only concern addressed in the The ARC recommended that payloads jeopardize U.S. national security or payload review. that contain hazardous materials in foreign policy interests, or international While payloads that stay within a Federally-reportable quantities be obligations of the United States, even if vehicle, do not contain hazardous reviewed in 15 days. The FAA does not they are exempt from an FAA payload materials, or have previously been agree with the ARC’s recommendation review. Although the FAA has not to approved may require less scrutiny, a because there are other considerations date been faced with the Department of payload review is still required because regarding intended operations in space Defense or the Department of State the FAA is statutorily mandated under that might affect national security or the raising concerns through the 51 U.S.C. 50904(c) to determine whether safety of property. For example, a interagency review regarding national a license applicant or payload owner or payload may have the capability of security or foreign policy for an operator has obtained all required observing or interfering with U.S. ‘‘exempt’’ payload, the FAA believes licenses, authorization, and permits. If national security assets or violate a that it would be its responsibility to no license or authorization or permit is provision of a treaty. convey those concerns to the required by another federal agency, the The FAA proposes to consolidate the appropriate agencies for resolution. FAA must determine whether a launch requirements for a payload review The ARC asserts that the payload would jeopardize public health and currently contained in subparts D of reviews being conducted are more safety, safety of property, U.S. national parts 415, 431, and 435 in proposed detailed than necessary to assure the security or foreign policy interests, or § 450.43 (Payload Review and protection of ‘‘public health and safety.’’ international obligations of the United Determination). The proposed The ARC recommended that payloads States. Similarly, while potentially it consolidation would retain most of the that stay within the vehicle, have non- might be more cost effective to regulate current payload review requirements. hazardous materials, or those that have only hazardous payloads ejected from a The limited changes the FAA proposes previously been approved for flight, launch vehicle in reportable quantities to the payload requirements are should not require reviews. It using existing standards in 49 CFR discussed in this section. recommended that safety goals can be 172.101, the FAA must still comply The FAA proposes to modify the met by only requiring reviews for with the statutory requirements relationship with other agencies by hazardous payloads that could impact imposed on it by 51 U.S.C. 50904(c). removing the misleading statement that ‘‘public health and safety.’’ The ARC Both the FAA’s current and proposed the FAA does not review payloads that also stated that it would be more cost regulations reflect this statutory are subject to regulation by the FCC or effective to regulate only hazardous requirement. the Department of Commerce. payloads ejected from the launch As for payloads that have previously Specifically, the FAA proposes to vehicle in reportable quantities using been approved for launch, the FAA modify the regulation to reflect that the existing standards in 49 CFR already authorizes classes of payloads while it does not review those aspects 172.101. It believes such an approach under §§ 431.53 and 415.55, but it still of payloads that are subject to regulation would reduce unnecessary paperwork requires identification of the specific by the FCC or the Department of and subsequent FAA review for ‘‘benign payload at least 60 days prior to the Commerce, it still reviews the payloads payloads,’’ and the reduction of burden launch in order to confirm that the to determine their effect on the safety of on the FAA to review ‘‘non-safety payload fits within the authorized class launch. The FAA also consults with related payloads’’ would support and to coordinate with other federal other agencies to determine whether industry’s increased flight tempo and agencies. The FAA currently does not their launch would jeopardize public reduce FAA review times. make a new payload determination if a health and safety, safety of property, The FAA does not agree with the ARC payload fits within a class of payloads U.S. national security or foreign policy recommendation that payloads that stay authorized under a particular license, interests, or international obligations of within the vehicle, payloads that are but the review is still necessary to the United States. Proposed § 450.43(b) non-hazardous materials, or those that confirm there are no issues that affect would provide that the FAA would not have previously been approved for flight public health and safety, the safety of make a payload determination over should not require reviews. The fact that property, or national security. The more those aspects of payloads that are a payload remains on or within the defined the payload class, the less the subject to regulation by the FCC or the

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00077 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15372 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

Department of Commerce. The FAA federal agencies because NASA and the D. Safety Review and Approval does not intend to interfere with any Department of Defense frequently have As part of its current licensing process requirement that these agencies might requested this information in response under parts 415 and 431, the FAA impose or with approvals or denials. to the FAA’s interagency review in conducts a safety review to determine This clarification is merely a recognition order to determine whether the whether a proposed launch or reentry of current practice regarding payloads proposed payload would jeopardize the will jeopardize public health and safety that do not easily fit into the existing safety of government property in outer and safety of property. The FAA would regulatory rubric. space, or U.S. national security. not change the philosophy or purpose of The FAA also proposes not to retain The FAA also proposes to add a a safety review in this rulemaking. As the specific reference to NOAA in general requirement that it may request with the current regulations, an § 415.53(a). Although commercial any other information necessary to make applicant would have to satisfy the remote sensing is currently licensed by a determination based on public health safety requirements in order to obtain a NOAA’s Office of Commercial Remote and safety, safety of property, U.S. license to conduct a launch or reentry. Sensing Regulatory Affairs (CRSRA), the national security or foreign policy Secretary of Commerce recently interests, or international obligations of Only a vehicle operator license proposed merging CRSRA with NOAA’s the United States. The FAA believes applicant would be eligible to apply for Office of Space Commerce and moving that it would rarely invoke this a safety approval, and may apply for a them directly under the Office of the provision but believes that it is crucial safety approval separately and Secretary of Commerce. As a result, to address unique payloads. incrementally. As with current proposed § 450.43(b) would revise the The FAA anticipates that for payload regulations, the FAA would advise an description of which payloads are classes—as distinguished from specific applicant, in writing, of any issues exempt, to clarify that a payload payloads—the applicant might only be raised during a safety review that would planning to conduct remote sensing able to provide a range of expected impede issuance of a license, and the operations would be exempt if licensed transit times and would find this applicant may respond in writing, or by any office within the Department of acceptable. Similarly, for classes of amend its license application in Commerce. payloads the FAA would find it accordance with § 413.17. This proposal In consolidating the informational appropriate to provide ranges for would also not change the process by requirements in parts 415, 431, and 435, information related to size of the which the FAA denies a license, and the the FAA proposes to eliminate payload and quantities of hazardous recourse afforded an applicant if a information requirements concerning materials. It also proposes to add the license is denied. the method of securing a payload that explosive potential of payload materials, For launches and reentries from, or to, was a requirement under § 431.57(g) for alone and in combination with other a Federal launch range or any launch or RLVs because that information is not materials on the payload for launches, reentry site where a Federal launch relevant to a payload review. The FAA as it already does for reentries because range provides safety-related launch or considered replacing that informational the information is equally relevant to reentry services or property by contract, requirement with a more general one to the safety of a launch as for a reentry. the FAA would accept the service or provide the potential of the payload to The FAA anticipates that these property as meeting the relevant affect the dynamics of the vehicle. additional data requirements would requirements of proposed part 450, as However, the FAA determined such impose minimal burden, if any, on the long as the FAA determines that the information was more pertinent to the applicant. For example, the payload Federal launch range’s safety vehicle operator and should instead be operator should already have detailed requirements for the launch or reentry included in systems safety analysis for plans for moving its payload to its final services or property provided satisfy the launch or reentry, if appropriate. destination, and the explosive those requirements. Note that a Federal Proposed § 450.43(i)(1) also would equivalent for most materials is easily launch range could, at the direction of require an applicant to provide an calculated using readily-available the operator, provide FSA products expanded description for the payload information. As another example, in such a debris risk analyses or flight that would include its composition and requesting information about what safety limits analyses, directly to the any hosted payloads in addition to the encryption, if any, is used, the FAA is FAA on behalf of an operator. current requirements of physical not asking for a detailed account of While the FAA is not proposing to dimensions and weight. The FAA encryption methodology. Many change the philosophy and purpose of proposes to ask for any foreign operators are already using 256-bit a safety review and approval, the FAA ownership of the payload or payload Advanced Encryption Standard is proposing changes to the operator. In addition, the FAA would encryption (AES–256) to protect requirements to obtain a safety add the approximate transit times to commercial telemetry, tracking, and approval. The FAA proposes to locate final orbit for the payload. The FAA control data links and mission data the application requirements for a safety proposes to elaborate what it means by transmission or storage. In this case, an approval in proposed § 450.45 (Safety intended payload operations during the operator would only need to state that Review and Approval), in paragraph (e), life of the payload by adding its it uses AES–256. These additional data and throughout proposed subpart C. anticipated life span and any planned requirements help inform the overall The application requirements in disposal. Further, it proposes a evaluation of a payload. proposed § 450.45(e) are general and not requirement to describe any encryption By specifying in its regulations what specific to any safety requirement, and associated with data storage on the is required to expedite the FAA’s would include information not covered payload and transmissions to or from payload review process without the explicitly in proposed subpart C. the payload. Encryption helps ensure need to make supplemental requests to Proposed § 450.45(e)(1) would address against cyber intrusion, loss of an applicant to address interagency basic requirements for an application, spacecraft control, and potential debris- concerns, and the applicant would such as the inclusion of a glossary of causing events. The FAA is proposing avoid having to respond to such terms and a listing of referenced these additions to the information requests. The FAA seeks comment on material. This proposed requirement is requirements for launches to assist other this proposed approach. similar to current § 415.107, although

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00078 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15373

the proposed regulation would not of the safety issues associated with a §§ 450.181 (Coordination with a Site include the requirement for an launch or reentry proposal. This Operator) through 450.189. application to be logically organized, independent analysis is particularly E. Environmental Review with a clear and consistent page important for novel systems or numbering system, and topics cross- operations. The FAA proposes to The FAA proposes to consolidate referenced. The FAA expects an continue this practice with this environmental review requirements for applicant to ensure its application meets rulemaking. launch and reentry operators in a single these basic organizational standards Proposed subpart C would contain the section, as proposed § 450.47 without explicitly requiring them. remainder of the application (Environmental Review). Currently, In proposed § 450.45(e)(2), the FAA requirements for a safety approval. With these requirements are set forth in would require an applicant to submit some exceptions, discussed later, each §§ 415.201, 415.203, 431.91, 431.93, and information about its launch or reentry safety requirement in proposed subpart 435.61. In addition, the FAA proposes site. This proposed requirement is C has application requirements to revise current §§ 420.15, 433.7, 433.9, similar to current § 415.109(a), with the articulated at the end of each section. and 437.21 to conform to the changes in addition of references to a reentry site. Under current regulations for ELVs, proposed § 450.47. Apart from In proposed § 450.45(e)(3), the FAA application requirements are contained consolidation, these proposed revisions would require an applicant to submit in part 415, while safety requirements would not alter the current information about its launch or reentry are contained in part 417. Under current environmental review process. vehicle, including safety critical regulations for RLVs contained in part The FAA is responsible for complying systems. This proposed requirement is 431, application requirements and with the National Environmental Policy similar to current § 415.109(b), but safety requirements are not Act (NEPA) and other applicable would include reentry vehicles in distinguished so clearly. The proposed environmental laws, regulations, and addition to launch vehicles. approach is designed to clearly separate Executive Orders prior to issuing a In proposed § 450.45(e)(4), the FAA safety requirements from application launch or reentry license. To comply would require an applicant to submit a requirements. with NEPA, the FAA must first generic launch or reentry processing However, the following proposed determine whether the licensing action schedule that identifies any readiness sections do not include application requires a Categorical Exclusion activities, such as reviews and requirements, either because they (CATEX), an Environmental Assessment rehearsals, each safety-critical preflight introduce other sections or because the (EA), or an Environmental Impact operation, and day of flight activities. FAA would not require a demonstration Statement (EIS). A CATEX is Although the proposed regulations do of compliance to obtain a license: appropriate when actions, individually not necessarily require reviews or 1. § 450.101: This section would or cumulatively, do not have a rehearsals, should the applicant propose address the core public safety criteria significant effect on the human them to meet readiness requirements, for launching a launch vehicle or environment. An EA broadly documents they should be included in the reentering a reentry vehicle. An evidence and analysis necessary to schedule. This proposed requirement is applicant would demonstrate that it can determine whether a proposed action similar to current § 415.119, but with meet these criteria in other parts of may significantly affect the human the addition of reentry vehicles. proposed subpart C. environment requiring the preparation Proposed § 450.45(e)(5) would apply 2. § 450.113 (Flight Safety Analysis of an EIS or results in a finding of no to any proposed launch or reentry with Requirements—Scope and significant impact (FONSI). If the action a human being on board the vehicle, Applicability): This section would may significantly affect the human and would require an applicant to address the scope and applicability of environment, NEPA requires demonstrate compliance with certain the FSA requirements contained in preparation of an EIS. An EIS is a safety requirements in part 460. This §§ 450.113 through 450.141. thorough analysis of a proposed action’s proposed requirement is similar to 3. § 450.157: This section would impacts on the environment, including current § 415.8, except that it would include requirements for a public involvement process. include reentry vehicles. communication procedures, but an Under current FAA practice, the Proposed § 450.45(e)(6) would applicant would not have to issuance of a new launch or reentry address the potential launch or reentry demonstrate compliance with this license does not fall within the scope of of radionuclides, similar to current section in order to obtain a license. a CATEX. However, an applicant may § 415.115(b) but with the addition of 4. § 450.159: This section would provide data and analysis to assist the reentries. Because such proposals are include requirements for preflight FAA in determining whether a CATEX rare, it is the current practice of the FAA procedures. Similar to proposed could apply (including whether an to address the public safety issues on a § 450.157, an applicant would not have extraordinary circumstance exists) to a case-by-case basis. This proposed rule to demonstrate compliance with this license modification. Examples include would not change this approach. section in order to obtain a license. modifications that are administrative in Lastly, in proposed § 450.45(e)(7), the 5. § 450.169: This section would nature or involve minor facility siting, FAA would reserve the right to request include requirements for launch and construction, or maintenance actions. If additional information if necessary. reentry collision avoidance analysis. An a CATEX does not apply to the This request would include information applicant would not have to proposed action, but it is not anticipated incorporated by reference in the license demonstrate compliance with this to have significant environmental application, such as a previous section in order to obtain a license, but effects, then NEPA requires the application submittal. The FAA could it would have to provide certain preparation of an EA instead. The FAA also request additional products that information to the FAA prior to a may prepare an EA using applicant- would allow the FAA to conduct an launch or reentry. provided information. In the alternative, independent safety analysis. The FAA 6. § 450.179 (Ground Safety— an applicant may prepare an EA with periodically conducts independent General): This section would address FAA oversight. When NEPA requires an system safety and flight safety analyses the scope and applicability of the EIS for commercial space actions, the in order to gain a deeper understanding ground safety requirements contained in FAA uses third-party contracting to

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00079 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15374 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

prepare the document. That is, the FAA and, that an applicant must submit a its application, an operator would need selects a contractor to prepare the EIS, license application to transfer a license to demonstrate that each unique safety and the license applicant pays the according to the provisions of part 413 policy, requirement, or practice contractor. Finally, if an EA or EIS was and the requirements of proposed part imposed by the FAA protects public previously developed, the FAA may 450. Also, like the current requirements, health and safety, safety of property, require a written re-evaluation of the the proposal would require an applicant and the national security and foreign environmental document to ensure the to satisfy all of the approvals and policy interests of the United States. document’s continued adequacy, determinations required under part 450 Proposed § 450.177 is largely the same accuracy and validity.183 before the FAA would transfer a license as § 417.127 with two differences. This proposed rule would not alter to an applicant, and the FAA would Section 417.127 requires an applicant to the current environmental review retain the ability to incorporate by file a request for license modification for requirements. However, the reference any findings made part of the any change to a unique safety policy, consolidation of the launch and reentry record to support the initial licensing requirement, or practice. The FAA regulations would require a determination and to modify a license to would not incorporate this requirement consolidation of the environmental reflect any changes necessary because of in proposed part 450 because it is review requirements. a license transfer. duplicative given the general license modification requirement in proposed F. Additional License Terms and 3. Rights Not Conferred by a Vehicle § 450.177. Also, § 417.127 applies only Conditions, Transfer of a Vehicle Operator License when necessary to protect the public, Operator License, Rights Not Conferred The FAA proposes to consolidate in whereas proposed § 450.177(b) would by a Vehicle Operator License proposed § 450.13 (Rights Not Conferred also apply to national security and As discussed earlier in this preamble, by a Vehicle Operator License) the foreign policy interests of the United the FAA proposes to consolidate, under requirements in current §§ 415.15, States. This is necessary to cover the full proposed part 450, the differing types of 431.15, and 435.15 regarding the rights scope of FAA’s licensing authority. launch and reentry licenses, currently in that are not conferred by issuance of a The purpose for this proposed section parts 415, 431, and 435, into a single license. Although the location of the is the same as for current § 417.127. As vehicle operator license. As part of this requirements would change, the the space transportation industry consolidation, the FAA would combine requirements themselves would not continues to grow, advances in specified sections of parts 415, 431, and substantively change. technology and implementation of 435 into proposed sections of part 450, The proposed requirements would innovations by launch and reentry such that the consolidated requirements continue to state that issuance of a operators will likely introduce new and would apply to a single vehicle operator vehicle operator license does not relieve unforeseen safety challenges. These license. Except for these changes, the a licensee of its obligation to comply unique challenges will require FAA current requirements would remain the with all applicable requirements of law officials and operators to collaborate on same. The specific proposed changes are or regulation that may apply to its a case-by-case basis to identify and identified below. activities. In addition, the proposal mitigate those unique hazards to public 1. Additional Terms and Conditions would state the issuance of a license health and safety, safety of property, does not confer any proprietary, and the national security and foreign The FAA proposes to consolidate the property or exclusive right in the use of policy interests of the United States not current additional terms and conditions any Federal launch range or related specifically addressed by proposed part requirements in §§ 415.11, 431.11, and facilities, airspace, or outer space. 450. 435.11 into proposed § 450.9 (Additional License Terms and G. Unique Safety Policies, H. Compliance Monitoring Conditions) without substantive change. Requirements, and Practices The FAA proposes to combine the Therefore, the proposed requirement Proposed § 450.177 (Unique Policies, compliance monitoring requirements of would state that the FAA may amend a Requirements and Practices) would parts 417 and 431 into § 450.209 vehicle operator license at any time by require an operator to review (Compliance Monitoring). In combining modifying or adding terms and operations, system designs, analysis, the requirements, the FAA would adopt conditions to the license to ensure and testing, and to identify any unique § 417.23. The FAA currently conducts compliance with the Act and launch or reentry hazards not otherwise safety inspections to ensure a licensee regulations. addressed by proposed part 450, complies with applicable regulations, 2. Transfer of a Vehicle Operator consistent with current regulations and the terms and conditions of its license, License practice. An operator would be required and representations the licensee made to implement any unique safety policy, in its application. The FAA proposes to consolidate the requirement, or practice needed to Compliance monitoring requirements requirements to transfer a license in protect the public from the unique are codified in §§ 417.23, 431.83, and current §§ 415.13, 431.13, and 435.13 hazard. In its application, an operator 435.51. Section 417.23 requires that a into proposed § 450.11 (Transfer of a would have to identify any unique launch operator cooperate with and Vehicle Operator License). Although the safety policy, requirement, or practice, allow Federal officers or employees location of the requirements would and demonstrate that each it protects access to observe any of its activities change, the requirements themselves public health and safety and the safety associated with the conduct of a would not substantively change. of property. licensed launch, and provide the FAA The proposed requirements would Proposed § 450.177 would also with a console for monitoring the continue to provide that only the FAA provide that the FAA may identify and countdown’s progress, and the may transfer a vehicle operator license; impose a unique policy, requirement, or communication on all channels of the practice, as needed, to protect the public countdown communication network. 183 FAA Order 1050.1F, Environmental Impacts: Policies and Procedures, provides a more detailed health and safety, safety of property, The requirements of §§ 417.23(a) and description of the FAA’s policies and procedures and the national security and foreign 431.83 are nearly identical in that both for NEPA and CEQ compliance. policy interests of the United States. In require a licensee to cooperate with and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00080 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15375

to allow Federal officers or employees phase, or potentially during a launch launch operations under current part access to observe any of its activities countdown. 417 and licensed RLV operations under associated with the conduct of a Regarding the contention that current part 431. Proposed § 450.209 licensed RLV mission. However, unlike personnel are less likely to discuss also codifies current FAA practice for § 417.23, § 431.83 does not require a problems if inspectors are monitoring conducting compliance monitoring of licensee to provide a console to the FAA their conversation, the FAA strives to be part 435 operations. for monitoring all the channels on the as unobtrusive as possible so as not to Proposed § 450.209(b) would require countdown communication network. affect operations. Additionally, the the licensee to provide the FAA with a Monitoring the communications purpose of compliance monitoring is console or other means for monitoring channels—including countdown, not to punish operators. Rather, channel the countdown and communication anomaly, range coordination, monitoring and on-site inspection network. This proposed requirement surveillance, and weather—is a vital allows inspectors to identify potential would alleviate the issues that result part of compliance monitoring and licensing issues and alert the operator, from extended negotiations. The option safety inspection operations, regardless so it can take action to maintain or for ‘‘other means’’ would provide the of operation type. Under part 417, a return to compliance. This approach operator with some flexibility, as the licensee cooperates with the FAA and ensures safety while minimizing FAA recognizes that operations may provides its inspectors with access and impacts to the operator. There have occur with temporary infrastructure and consoles to observe the activities been many instances where inspectors a console may be an unrealistic request. associated with the licensed launch. As noticed incorrect test setups for FSS In this case, the operator would be a result, the FAA is able to monitor all checks, for example, or other issues expected to provide the FAA with an communication channels, and has during compliance monitoring that alternative method to monitor access to the safety official and the would affect public safety, and informed communications that is approved by the mission director through the the operator so they could be corrected FAA prior to operations. communications panel and through a before safety was impacted. I. Registration of Space Objects phone line. FAA inspectors regularly Compliance monitoring is important monitor an operator’s communications for ensuring public safety and requires The FAA proposes to consolidate the channels. In doing so, an inspector can that FAA safety inspectors be exposed requirements for the registration of become aware of issues that arise during to actual operations in order to be space objects in proposed § 450.217 a countdown. These issues may include trained, qualified, and capable of (Registration of Space Objects). These vehicle health, ground operations, FSS performing their safety-critical role. requirements currently reside in health, range readiness, clearance of Because safety inspectors are trained to §§ 417.19 and 431.85 and are largely surveillance and hazard areas, weather, detect non-compliances, they need to identical. This proposal would not and countdown procedures. have access to, and the discretion to see change the substantive requirements of Additionally, listening to the and hear, as much of the operation as either section, except to add a communications channels also gives an they deem necessary. Observing registration requirement for objects inspector a sense of an operator’s safety activities for training and familiarization owned by a foreign entity. culture, rigor, and readiness. In purposes benefits both the inspectors The 1975 Convention on Registration addition, inspectors can communicate and the operator because the more of Objects Launched into Outer Space face-to-face with the safety official and familiar an inspector is with an (Registration Convention), to which the the mission director, if necessary, operation, the better he or she can United States is a signatory, requires because they are typically collocated. perform the inspection. Knowledgeable details about the orbit of each space Although there is a requirement in inspectors cause less operational object. To that end, current regulations part 431, and incorporated by reference impacts because they ask fewer require an applicant to provide in part 435, that an operator cooperate questions and are less likely to information on space objects that the with safety inspectors, there is no incorrectly identify a non-compliance. FAA forwards to the Department of specific requirement for the licensee to The FAA proposes to combine the State. The Department of State then provide access to all communication compliance monitoring requirements of registers the objects with the United channels. The FAA has had to discuss §§ 417.23 and 431.83 in proposed Nations as required by the Registration with the operator what channels will be § 450.209. The proposed regulation Convention. Since enacting these available for monitoring during these would primarily adopt those current regulations, the Department of operations. Some operators have requirements in § 417.23, but ‘‘launch State has requested that the FAA also contended that their employees will not operator’’ would be replaced by provide this information for objects be as forthcoming with information if ‘‘licensee’’, and ‘‘licensed launch’’ possibly owned by foreign entities. they know FAA inspectors are listening. would be replaced by ‘‘licensed launch Current registration of space objects However, being able to hear how the or reentry.’’ Additionally, the FAA requirements is codified in § 417.19, operator communicates during critical proposes to allow an operator the option applicable to ELVs, and § 431.85, operations is necessary for inspectors to to provide the FAA with means other applicable to RLVs. The two provisions determine compliance and to address than a console for monitoring the are substantively identical in all problems before they occur. Since communication and countdown respects but one. That is, they both inspectors cannot physically listen to all channels. For example, a smaller require the registration of any object channels concurrently, an inspector will company may operate without consoles, placed in space by a licensed mission, listen to one or more channels that can in which case the operator may provide unless the object is owned and provide situational awareness and the FAA with radio monitoring and a registered by the U.S. Government or information used to determine location in close proximity to the owned by a foreign entity. Similarly, compliance. The necessary discussions necessary data to monitor launch. As a both sections require the licensee to require additional time and may cause result, the compliance monitoring submit information about the space a delay, consume man-hours, and is a requirements of proposed § 450.209 object’s international designator, the cost to both the government and the would apply to all launch and reentry date and location of the mission, the operator during the license application operations, thereby capturing licensed general function of the space object, and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00081 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15376 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

the final orbital parameters. The sole in its license application, the 2. Financial Responsibility substantive distinction is that § 431.85 requirements of proposed part 450, The FAA would consolidate the also requires an operator to notify the subparts C and D, and the terms and current financial responsibility FAA when it removes a space object. conditions contained in the license. requirements in §§ 417.21 and 431.81 Proposed § 450.217 would deviate The proposed requirement for a into proposed § 450.205 (Financial from current §§ 417.19 and 431.85 by licensee to conduct a licensed launch or Responsibility Requirements). Although requiring the registration of foreign- reentry in accordance with the location of the requirements would owned space objects. The FAA would representations made in its license change, the requirements themselves not require the licensee to determine the application is the same, in substance, to would not change. owner’s nationality. The Department of §§ 417.11(a) and 431.71(b). Section As such, the proposed regulation State would use this information to 417.11(a) states that a launch operator ensure that other nations meet their would require a licensee to comply with must conduct a licensed launch and financial responsible requirements as obligations by registering their foreign carry out launch safety procedures in objects. Proper registration of all objects required by part 440, and as specified in accordance with its application. Section a license or license order. owned by foreign entities would allow 431.71(b) states that a licensee must for the protection of the United States conduct a licensed RLV mission and 3. Human Spaceflight from liability associated with these perform RLV safety procedures in The FAA would consolidate the objects. accordance with representations made human spaceflight requirements in Otherwise, the FAA would retain the in its license application. The fact that same informational requirements. It current §§ 415.8, 431.8, and 435.8 into representations made in a license proposed § 450.207 (Human Spaceflight would continue to require a licensee to application become binding on a submit information about the space Requirements). The proposal would licensee is discussed earlier in this require a licensee conducting a launch object’s international designator, the preamble. date and location of the mission, the or reentry with a human being on board The proposed requirement for a general function of the space object, and the vehicle to comply with human licensee to conduct a licensed launch or the final orbital parameters. spaceflight requirements as required by reentry in accordance with the Additionally, proposed § 450.217 would part 460 of this chapter and as specified requirements of proposed part 450, retain current § 431.85’s requirement in a license or license order. Although subparts C and D, is the same, in that an operator notify the FAA when it the location of the requirements would substance, to § 417.1(b)(2)’s treatment of removes a space object. change, the requirements themselves part 417 requirements. Section would not change. J. Public Safety Responsibility, 417.1(b)(2) states that the safety Compliance With License, Records, requirements of part 417, subparts B 4. Records Financial Responsibility, and Human through E, apply to all licensed The FAA would consolidate the Spaceflight Requirements launches of expendable launch vehicles. current record requirements in The FAA is not proposing any Part 431 does not have a similar §§ 417.15(a) and (b) and 431.77(a) and substantive changes to the requirements requirement because application (b) into proposed § 450.219(a) and (b). specified below. However, the agency is requirements and safety requirements However, the FAA would replace the proposing to consolidate these are interlinked, leaving uncertain the terms ‘‘launch accident’’ and ‘‘launch requirements into the new, proposed actual safety requirements under a incident’’ in § 417.15(b) and the terms part 450; clarify that the consolidated license. Note that in subpart C, the ‘‘launch accident,’’ ‘‘reentry accident,’’ requirements apply to any licensed application requirement paragraphs do ‘‘launch incident,’’ and ‘‘reentry launch or reentry; and make other not apply once a license is issued, incident’’ in § 431.77(b) with ‘‘class 1 or minor, clarifying edits. The following is unless a licensee applies for a class 2 mishap.’’ As discussed in more a summary of the proposed changes: modification. detail earlier in this preamble, the FAA The proposed requirement for a proposes to replace current part 401 1. Public Safety Responsibility and licensee to conduct a licensed launch or definitions involving ‘‘accident,’’ Compliance With License reentry in accordance with the terms ‘‘incident,’’ and ‘‘mishap’’ with The FAA would consolidate the and conditions contained in the license specified mishap classes. public safety responsibility is the same, in substance, to §§ 415.9(b) The proposed regulation would requirements in current §§ 417.7 and and 431.71(b). Section 415.9(b) states require an operator to maintain, for 3 431.71(a) into proposed § 450.201 that a launch license authorizes a years, all records, data, and other (Public Safety Responsibility). Also, the licensee to conduct a launch or material necessary to verify that a FAA would move the compliance launches subject to the licensee’s launch or reentry is conducted in requirement in current § 431.71(b) to its compliance with terms and conditions accordance with representations own section, proposed § 450.203, contained in license orders contained in the operator’s application, Compliance with License. Although the accompanying the license. Section the requirements of subparts C and D, location of these requirements would 431.71(b) states that a licensee’s failure and the terms and conditions contained change, the requirements themselves to comply with any license condition is in the license. To satisfy this would not change. sufficient basis for the revocation of a requirement, the FAA expects an Therefore, proposed § 450.201 would license or other appropriate operator to keep a record of the actual provide that a licensee is responsible for enforcement action. The FAA includes conditions at the time of flight and any ensuring public safety and safety of terms and conditions in a license to deviations outside of the flight commit property during the conduct of a address license-specific requirements. criteria as specified in the current licensed launch or reentry. Proposed Under the proposal, a licensee’s failure § 417.113(c). Similar to current § 450.203 (Compliance with License) to act in accordance with these items requirements, in the event of a class 1 would require that a licensee conduct a would be sufficient basis to revoke a or class 2 mishap, an operator would be licensed launch or reentry in license, or some other appropriate required to preserve all records related accordance with representations made enforcement action. to the event until the completion of any

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00082 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15377

Federal investigation (which could be would require that the probability of through technical rationale, that the greater than 3 years) and the FAA has loss of functionality for each critical proposed alternative approach provided notified the operator that the records asset must not exceed 1 × 10¥3 to a level of safety equivalent to the need no longer be retained. The operator protect national assets. For that reason, requirement it would replace. An ELOS would need to make all records required the FAA is proposing that all operators determination means an approximately to be maintained under the regulations would be required to comply with these equal level of safety as determined by available to Federal officials for two provisions on this rule’s effective qualitative or quantitative means. Under inspection and copying. date. § 450.37(b), an operator would not be Because many of the current able to use an ELOS determination to K. Applicability regulations would serve as a means of replace the public risk criteria set forth 1. General compliance for the proposed in § 450.101. Proposed § 450.1 (Applicability) regulations, the FAA would review In 2018, the FAA issued a final rule would state that part 450 prescribes license modifications that applied the that expanded the option to satisfy requirements for obtaining and current regulations as means of commercial space transportation maintaining a license to launch, reenter, demonstrating compliance with the requirements by demonstrating an or both launch and reenter, a launch or proposed regulations. Additionally, an equivalent level of safety in order to reentry vehicle. As discussed operator could use a means of provide more choice to operators and previously, proposed part 450 would compliance other than the current reduce the number of waivers that must regulations to demonstrate compliance be prepared by industry and processed consolidate licensing requirements 185 currently covered in parts 415, 417, 431, in a license modification request. The by the government. To utilize the and 435. FAA would determine the applicability option, operators are required to of proposed part 450 to an application demonstrate that they are achieving a 2. Grandfathering for a license modification submitted level of safety equivalent to any safety Under proposed § 450.1(b), proposed after the effective date of the part on a parameters specified in the regulations. part 450 would not apply to any launch case-by-case basis. The FAA does not The FAA evaluates every request for an or reentry that an operator elects to anticipate that a vehicle operator would alternative means of regulatory conduct pursuant to a license issued by have any greater difficulty meeting the compliance under the ELOS provisions the FAA or an application accepted by requirements under the proposed to ensure that the safety of the public, the FAA prior to the effective date of regulations than under the existing property, or any national security or proposed part 450, with two exceptions. regulations. In fact, the FAA believes foreign policy interest of the United The proposed requirements for collision that the proposed regulations are more States is maintained to be consistent avoidance analysis (COLA) and asset flexible because most allow for many with the requirements in 14 CFR protection would apply to all operators different means of compliance. chapter III. The FAA would preserve the subject to the FAA’s authority under 51 An applicant for a renewal would be process established in the 2018 U.S.C. chapter 509 who are conducting required to meet all the requirements of rulemaking, and would include its launches after the effective date of the proposed part 450. The FAA anticipates ELOS determination as part of any new regulations. The FAA would that this would not be burdensome for license issued applying this provision. determine the applicability of proposed operators seeking license renewals The FAA requests comment on the part 450 to an application for a license because there would be few, if any, potential use of ‘‘safety cases’’ when modification submitted after the additional application requirements that demonstrating an equivalent level of effective date of the part on a case-by- could not be fulfilled by reference to safety under proposed § 450.37. A safety case basis. previously submitted information. case is a structured argument, supported by a body of evidence that provides a The proposed regulations are more L. Equivalent Level of Safety performance based, and many of the compelling, comprehensive, and valid current requirements would serve as a In addition to developing case that a system is safe, for a given means of compliance to meet the performance-based requirements, this application in a given environment.186 proposed regulations. As a result, proposal would preserve the equivalent- The ARC report (at p. 25) suggested that activities authorized under the existing level-of-safety flexibility by relocating FAA review time could be minimize if regulations would be authorized under the provision to proposed § 450.37. applicant submittals were ‘‘structured as the proposed regulations. The FAA Unlike using a means of compliance, a reasonable safety case that the proposes to allow an operator to operate which requires demonstration of proposed actions are safe under all under the current regulations compliance with a performance-based plausible scenarios.’’ In fact, the ARC (specifically, parts 401, 415, 417, 431, regulation, the ELOS provision would suggested ‘‘safety cases’’ could be useful and 435) when conducting a launch continue to allow an applicant to options several times. With respect to after the effective date of new part 450 propose an alternative method to meet the proposed regulation, a safety case provided it holds a license or has had the safety intent of a current regulatory would potentially show that certain a license application accepted prior to requirement. For example, requirements identified by the the effective date of this regulation. § 450.117(d)(3) would require applicant, excluding the requirements of Pursuant to Space Policy Directive-3 184 representative normal flight trajectory § 450.101, need not be complied with (SPD–3), proposed § 450.169 and analysis outputs for each one second of per se in order to demonstrate that an proposed appendix A to part 450 would flight. An applicant may wish to request alternative approach provides an align the COLA criteria with current an ELOS determination to the one- equivalent level of safety to the common practice and provide better second interval, and the FAA would protection for inhabitable and active likely accept it if an alternative interval 185 Updates to Rulemaking and Waiver Procedures and Expansion of the Equivalent Level orbiting objects. Additionally, § 450.101 provides smooth and continuous individual P contours. of Safety Option, Final Rule, 83 FR 28528 (June 20, C 2018). 184 Space Policy Directive-3, National Space To demonstrate equivalent level of 186 This Safety Case definition is from the U.K. Traffic Management Policy, 83 FR 28969 (June 21, safety, an operator would provide a Ministry of Defence (MOD) Standard 00–56, ‘‘Safety 2018). clear and convincing demonstration, Management Requirements for Defence Systems.’’

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00083 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15378 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

requirements identified by the associated with a safety case approach, ensuring public health and safety and applicant. whether or not a third party would be the safety of property during reentry A–P–T Research, Inc., under contract involved. flight. The definition also includes to the FAA, recommended the use of a activities conducted on the ground after Additional Technical Justification and safety case approach as an alternate path vehicle landing on Earth to ensure the Rationale to securing a license.187 The FAA vehicle does not pose a threat to public considered proposing a safety case The sections below provide detailed health and safety or the safety of approach to demonstrating an discussions of flight safety analyses and property. In practice, the FAA has equivalent level of safety under software safety. Additionally, this required public risk assessments to proposed § 450.37 that would include a section discusses the numerous begin at the final health check prior to formal proposal process that must use a conforming changes the FAA proposes initiation of de-orbit burn and ending means of compliance accepted by the to the existing regulations in order to when flight stops, such as splashdown Administrator, unless the Administrator implement the proposed regulations. for a capsule. determines otherwise based on A. Flight Safety Analyses Further, for both ELVs and RLVs, the predicted public risks and current regulations do not expressly consequences, or demonstrated As discussed earlier, for purposes of address the potential public safety reliability. The formal proposal process this proposed rule, an FSA consists of hazards caused by the disposal of a would: (1) Facilitate an FAA audit of all a set of quantitative analyses used to launch vehicle stage or component from risk management methods proposed for determine flight commit criteria, flight orbit. That is, §§ 417.107(b) and use, including a demonstration of how abort rules, flight hazard areas, and 431.35(b)(1), in addressing the public the proposed methods can demonstrate other mitigation measures, and to verify risk criteria, do not specifically address compliance with § 450.101; (2) compliance with the public safety the disposal of launch vehicle stages or implement all the recommended criteria in proposed § 450.101. The FAA components. As discussed earlier, such improvements from the audit or justify proposes 15 sections for flight safety vehicle disposals have become more all deviations from the recommended analysis, as discussed below. common in recent years, reflecting the improvements; (3) document the risk 1. Scope and Applicability elevated priority put on orbital debris management methods used and the mitigation. The FAA explained in the Proposed § 450.113 establishes the verification evidence to demonstrate 2016 final rule 189 that when the FAA portions of flight for which an operator compliance with § 450.101; (4) facilitate requires that the quantitative risk would be required to perform and an audit by an FAA-approved third analysis account for the planned impact document an FSA, and would describe party of the risk management methods of a first stage (or any stage) jettisoned the analyses required for each type of used and the verification evidence to prior to orbital insertion, it includes operation. The portion of flight demonstrate compliance with § 450.101; accounting for stage impacts regardless governed by the public safety criteria is and (5) submit the results of the third of whether the actual impact occurs party audit for FAA review and central to the scope of the FSA. The current scope of FSA regulations before or after orbital insertion. approval. An applicant that sought to For reentry, proposed §§ 450.101(b) is laid out in §§ 417.201 and 417.107(b) use this safety case approach would and 450.113(a)(4) would clarify and for ELVs. Specifically, § 417.107(b)(1) need to submit: (1) A description of reduce the period FSAs must analyze currently requires that FSAs quantify their plan to facilitate an FAA audit of when quantifying the public risks posed the collective risks from lift-off through all risk management methods proposed by reentry operations. The proposal orbital insertion for orbital launches and for use, including a demonstration of would clarify that post-flight operations from lift-off to final impact for how the proposed methods can are not included in the safety analyses suborbital launches. Unfortunately, demonstrate compliance with § 450.101; necessary to quantify the public risks § 417.107(b)(2) does not clearly specify (2) a description of the improvements posed by reentry operations. In § 401.5, the portion of flight for which an FSA implemented based on the FAA audit the FAA proposes to include a must quantify the individual risks. In and detailed justifications for any definition for deorbit that clarifies that practice, the FAA has reconciled this deviations from the FAA recommended deorbit begins with the final command vagueness by requiring the same scope improvements; (3) a description of the to commit the vehicle to a perigee below for both collective and individual risks: risk management methods used and the 70 nautical miles, approximately 130 From lift-off through orbital insertion verification evidence to demonstrate km, and ends when all vehicle for orbital launches and from lift-off to compliance with § 450.101; (4) an components come to rest on the Earth. agreement to facilitate an audit by an final impact for suborbital launches. Proposed § 450.113 replaces § 417.201 It is also unclear in current FAA-approved third party of the risk to clarify the scope and applicability of regulations what portions of flight the management methods used and the FSAs. In proposed § 450.113(a)(1), an FSA needs to cover for RLVs. Section verification evidence to demonstrate operator would be required to perform 431.35(b)(1) simply states that the compliance with § 450.101; and (5) a and document an FSA for orbital collective public risk limit applies to description of the results of the third launch, from lift-off through orbital each proposed reentry, but does not party audit. The safety case approach insertion,190 including any component speak specifically to beginning and end recommended by APT included the use or stage landings. In proposed of the period of flight that an FSA must of a third party to review. The FAA sees § 450.113(a)(2), an operator would be potential complications, including analyze. Reentry means to return or attempt to return, purposefully, a liability considerations, when involving 189 Changing the Collective Risk Limits for reentry vehicle from earth orbit or from Launches and Reentries and Clarifying the Risk a third party in the licensing process. 188 The FAA seeks comments on the outer space to Earth. Reentry Limit Used to Establish Hazard Areas for Ships and Aircraft, Final Rule. 81 FR 47017 (July 20, 2016). potential usefulness and challenges includes activities conducted in Earth orbit or outer space to determine reentry 190 The FAA proposes orbital insertion to mean the point at which a vehicle achieves a minimum 187 A–P–T Research, Inc. ‘‘A New Path to Launch readiness and that are critical to 70-nautical mile perigee based on a computation Licenses,’’ Doc. No. CDSP–FL004–18–00402 that accounts for drag. This adopts the definition of (October 16, 2018). 188 14 CFR 401.5. orbital insertion in RCC 321–17 Standard.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00084 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15379

required to perform and document an suborbital launch vehicle (in paragraph Proposed § 450.115(a) sets the scope FSA for suborbital launch, from lift-off (b)(3)). for FSA methods. This section would through final impact. In proposed 2. Flight Safety Analysis Methods not materially change the scope of the § 450.113(a)(3), the FAA clarifies the FSA methods under current parts 417 scope of disposal FSA that would be Proposed § 450.115 (Flight Safety and 431, which account for the risk to necessary to demonstrate compliance Analysis Methods) would set the the public from hazards associated with methodology requirements for FSAs. with the disposal safety criteria in normal and malfunctioning vehicle This section would replace the proposed § 450.101(d). Specifically, for flight in accordance to § 417.205(a). disposal, an FSA would span from the prescriptive requirements currently in § 417.203 and appendices A, B, C and I However, proposed § 450.115(a) would beginning of the deorbit burn through add language currently not expressly final impact. to part 417. Currently, § 417.203(a) Proposed § 450.113(a)(4) would requires that FSAs meet the provided in § 417.205(a) that would require an operator to perform and requirements for methods of analysis require an operator’s FSA method to document an FSA for reentry, from the contained in appendices A (section account for all reasonably foreseeable beginning of the deorbit burn through A417) and B (section B417) to part 417 events and failure of safety-critical landing. The proposal is consistent with for a launch vehicle flown with an FSS, systems. This language is consistent current practice, but would clarify that and appendices B and C (section C417) with the current requirement in post-landing activities are not included for an unguided suborbital launch § 431.35(c) to account for any in the FSA. vehicle that uses a wind-weighting reasonably foreseeable hazardous event, Proposed § 450.113(a)(5) would safety system. Specifically, section A417 and safety-critical system failures explicitly address hybrid vehicles, provides prescriptive requirements on during launch flight or reentry that which include air-launch rockets the FSA methodologies and products for could result in a casualty to the public. released from carrier aircraft such as the a launch vehicle flown with an FSS. Proposed § 450.115(b) would establish Pegasus rocket carried by a modified L– Section B417 provides prescriptive the level of fidelity for FSAs. 1011 airliner. The proposal would requirements on the FSA for hazard area clarify that FSAs generally apply to analyses for ship and aircraft protection. Specifically, it would require a level of hybrid vehicles, for all phases of flight Section C417 provides prescriptive fidelity sufficient to demonstrate that unless the Administrator determines requirements on the FSA methodologies any risk to the public would satisfy the otherwise based on demonstrated and products for a launch vehicle flown public risk criteria of proposed reliability. Thus, the proposal would with a wind weighting safety system. § 450.101, including the use of enable an operator of a hybrid vehicle Section 417.203(b) specifically lists mitigations, accounting for all known with a high level of demonstrated the broad categories of approved sources of uncertainty, using a means of reliability for the entire flight or for a methods of analysis while § 417.203(c) compliance accepted by the phase of flight, to be exempt from addresses requirements for alternate Administrator. It would also require that performing some FSAs without seeking analysis methods. Section 417.203(c) the analysis identify the dominant a waiver for the flight or phase of flight. currently requires that an alternate FSA source of each type of public risk with Demonstrated reliability refers to method be based on accurate data and a criterion in proposed § 450.101(a) or statistically valid probability of failure scientific principles, and is statistically (b) in terms of phase of flight, source of estimates based on the outcomes of all valid. In practice, the FAA has hazard (such as toxic exposure, inert, or previous flights of the vehicle or stage. evaluated the validity of an applicant’s explosive debris), and vehicle response For example, if an applicant seeks to proposed methods by comparing the mode. Thus, this proposed rule would results to valid benchmarks such as data operate a hybrid vehicle that features an provide performance targets instead of from mishaps, test, or validated high- air-launch rocket released from a carrier the current part 417 approach that aircraft with minimal modification from fidelity methods. Section 417.203(e) mandates a single level of fidelity the original design certified as a requires that a launch operator equivalent to methods that comply with commercial transport aircraft, the FAA demonstrate to the FAA compliance would find certain FSAs not applicable with the requirements of part 417, the extensive requirements given in the if empirical data sufficiently showed subpart C. In its application, a launch appendices of part 417. that the demonstrated reliability and operator must include the analysis The requirements in proposed estimated public risks of the system are products required by parts 415, subpart § 450.115(b) would account for all equivalent to general aviation aircraft F, 417, subpart A, and appendices A, B, known sources of uncertainty and during a given phase of flight. C, and I, depending on whether the identify the dominant sources of risk. Specifically, the FAA foresees that such launch vehicle uses an FSS or a wind- The proposal would be consistent with an applicant could be exempt from weighting safety system. the best practices of other regulatory some of the normal flight trajectory Pursuant to § 431.35(c), the FSA for agencies that use quantitative risk analysis requirements during the an RLV is required to account for any analyses as part of a risk management reasonably foreseeable hazardous event captive carry phases of flight if the approach to ensure public safety. The and safety-critical system failures applicant could demonstrate Nuclear Regulatory Commission (NRC), during launch flight or reentry that compliance with the public safety which has a long history of criteria in proposed § 450.101 without could result in a casualty to the public. performance-based regulations with the benefit of some of the normal flight However, part 431 does not include quantitative risk analyses to ensure trajectory analysis outputs. requirements for the methods used to Proposed § 450.113(b) would identify provide an FSA, thus providing no public safety, has a long-standing policy the specific FSA actions applicable to standards for evaluating an FSA’s to ensure that the quantitative all launch and reentry vehicles (in validity or level of fidelity. The part 431 techniques used for regulatory decision- paragraph (b)(1)), a launch or reentry license applications approved by the making take into account the potential vehicle that relies on an FSS to comply FAA included FSA methodologies and uncertainties that exist so that an with proposed § 450.101 (in paragraph products comparable to those in 417 estimate can be made on the confidence (b)(2)), and launch of an unguided license applications. level to be ascribed to the quantitative

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00085 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15380 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

results.191 The NRC has also found that, analysis may not be necessary under available approaches to address through use of quantitative techniques, conditions where the best mean uncertainties in public risk assessments, important uncertainties have been, and estimate of the public risk is low including the approach identified in the continue to be, brought into better focus relative to the collective risk criterion. draft means of compliance on and may even be reduced as compared For this rulemaking, the FAA uncertainty and level of fidelity in FSA to those that would remain with sole considered adopting an approach to the methods. reliance on deterministic decision- treatment of uncertainty following RCC Proposed § 450.115(b) would require making. The NRC found that direct lack 321 Standard and Supplement. The that an operator account for all known of severe accident experience makes it FAA requests comment on whether this sources of uncertainty in various FSAs. necessary that proper attention be given treatment of uncertainty is reasonable. The FAA intends to ensure that FSA not only to the range of uncertainty Specifically, the FAA solicits input on methods account for known sources of surrounding probabilistic estimates, but the process whereby the uncertainty aleatory (random) uncertainties that are also to the phenomenology that most does not have to be considered if the the result of inherently random influences the uncertainties. In other computed risk is less than one-third of processes. An example of aleatory words, the NRC found the need to the primary aggregated collective risk uncertainty is the influence of identify the dominant sources of public criterion.193 Current Air Force practice prevailing weather conditions on the risks and their uncertainties when using is to include implementation of results of collective and individual risk quantitative risk analyses to ensure measures to improve risk analyses to analyses for launch or reentry. The true public safety.192 reduce the level of uncertainty when the EC is often highly influenced by the × ¥5 The FAA would require that operators predicted risks exceed 3 10 EC. prevailing weather conditions during use a means of compliance accepted by Examples of that could include refined the proposed operation. The uncertainty the Administrator for FSA methods. The input data or a higher-fidelity method in the true EC due to weather conditions FAA plans to publish a draft version of for the risk computations. is substantial for a typical baseline risk that AC concurrently with this NPRM. Similarly, if the estimated risk level analysis that accounts for the × ¥5 An important aspect of that AC is the exceeds 3 10 EC, the RCC 321 foreseeable weather conditions in a use of approaches generally consistent Standard states that the range should given month based upon historical data with the consensus U.S. Government compute the uncertainty to ensure that and assumes that an operation is equally standards on launch and reentry risk a launch is not allowed that would feasible under any of those likely assessments (e.g., RCC 321). The RCC violate the criterion based on best weather conditions given all the safety 321 Standard (paragraph 2.4) recognizes estimates that account for uncertainty. and mission assurance constraints. For that there is significant uncertainty in There are published examples of example, most vehicles would not the computed risks of rocket launches uncertainty analyses for launch risks attempt to fly through certain wind that explicitly account for uncertainties and notes that confidence bounds of 90 conditions due to the potential for the associated with the input data (e.g., the percent describing the uncertainty in vehicle to break up or veer off-course, probability of failure associated with a the computed risk can span multiple leading to a violation of safety or given break-up state vector), and biases orders of magnitude. Thus, the mission assurance constraints. The and uncertainties in key sub-models consensus U.S. Government standards uncertainty in the true EC for a day-of- (e.g., the sub-model used to compute the on launch and reentry risk assessments launch risk analysis is much smaller, P given an impact with a given piece contains a policy statement that C but the uncertainty in any forecast or of debris on a specific structure type). measured weather input data will still uncertainty cannot be ignored. The RCC However, the end effect of the RCC 321 produce some uncertainty in the E due 321 Supplement further concurred with C Standard approach to uncertainty to measurement errors and variability in several statements originally made by treatment is that a range or range user the weather measurements and the NRC, including the following three: could continue operating under current forecasts. There are several other (1) The use of mean estimates does not, practice, using their current tools potentially important sources of aleatory however, resolve the need to quantify without formal uncertainty uncertainty in an E analysis, and there (to the extent reasonable) and C quantification for missions with a are various valid approaches to account understand those important ¥ collective risk no greater than 3 × 10 5 for these aleatory uncertainties. This uncertainties involved in risk EC. Under the RCC approach, only proposed rule would require that predictions; (2) sensitivity studies missions that pose collective risks above aleatory uncertainties are accounted for, should be performed to determine those ¥5 3 × 10 EC based on point estimates including known sources of randomness uncertainties most important to the would be required to perform formal in critical input data. These would probabilistic estimates; and (3) the uncertainty quantification. The FAA include normal and malfunction results of sensitivity studies should be requests comment on whether the trajectories, weather conditions, displayed showing, for example, the current approaches to uncertainty population and sheltering range of variation together with the treatment employed by the RCC or the characteristics (e.g., between day and underlying science or engineering Air Force are viable in the FAA’s night), velocities induced during break- assumptions that dominate this regulatory framework. The FAA further up, aerodynamic properties of the variation. Even so, the RCC went on to requests comments on any currently vehicle and debris, any yield from an conclude that a formal uncertainty explosive impact, and the amount of 193 The choice of one-third was consistent with debris that burns up due to aero-thermal 191 Nuclear Regulatory Commission, Nuclear the recommendation in AFSPCMAN 91–710 Vol.1, Regulatory Safety Policy Goals. 51 FR 28044 heating during re-entry. 1 July 2004. Attachment 5 states that if risk to all Proposed § 450.115(c) would establish (August 21, 1986). individuals from a single hazard exceeds an EC of 192 The Department of the Interior (DOI), Bureau 30 × 10¥6, a range user may have to take additional application requirements for methods of of Reclamation, uses risk criteria for achieving measures to protect personnel and resources. analysis. Specifically, the proposed rule public protection in dam safety decision-making in Examples include to fix, correct, or improve would require that an applicant submit a manner consistent with this proposed rule. existing non-compliances, improve risk analyses to Specifically, the DOI uses mean values calculated reduce the level of uncertainty, require a day-of- a description of the FSA methodology from Monte Carlo or similar analyses that include launch risk analysis, or establish disaster aversion for each launch or reentry approved by explicit treatment of input uncertainty. criteria. the FAA, including identification of the

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00086 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15381

scientific principles and statistical launch occurs for a rendezvous any time the operator intends to initiate methods used, and all assumptions and mission). launch or re-entry flight. their justifications. However, if the FAA In terms of current RLV regulations in Section 450.117(a)(2) would require a determines that the range’s FSA part 431, they describe flight trajectory fuel exhaustion trajectory that produces methods meets FAA safety analyses requirements in a single instantaneous impact points with the requirements, then the operator would paragraph in § 431.35(d)(8). Specifically, greatest range for any given time after not be required to provide the FAA with the FAA requires that applicants liftoff for any stage that has the potential a description of the FSA methodology. provide flight trajectory analyses to impact the Earth and does not burn Also, an applicant would be required to covering launch or ascent of the vehicle to propellant depletion before a include the rationale for the level of through orbital insertion and reentry or programmed thrust termination. This is fidelity, the evidence for validation and descent of the vehicle through landing, the same as current § 417.207(a)(2). The verification required by proposed including its three-sigma dispersion. FAA is unaware of any challenges with § 450.101(g), the extent that the This regulation is silent as to the the current regulation regarding a fuel benchmark conditions are comparable specific uncertainties for which the exhaustion trajectory. to the foreseeable conditions of the analysis must account. In practice, part For vehicles with an FSS, proposed intended operations, and the extent the 431 license applicants have provided § 450.117(a)(3) would establish a new analyses accounted for risk mitigations. normal trajectory data consistent with requirement for trajectory data or The FAA intends for assumptions to be the part 417 regulations. parameters that describe the limits of a useful mission. The FAA proposes in justified using logic, historical flight Proposed § 450.117 would retain the § 401.5 to define the ‘‘limits of a useful experience data, relevant test data, and substantive normal trajectory analysis mission’’ as the trajectory data or other the results from physics-based requirements currently in § 417.207 and parameters that describes the limits of a simulations. the definitions of key terms such as mission that can attain the primary ‘‘normal flight’’ and ‘‘normal trajectory.’’ 3. Trajectory Analysis for Normal Flight objective, including but not limited to Proposed § 450.117(a)(1) would require The FAA proposes a single regulation flight azimuth limits. Thus, the proposal a trajectory analysis that establishes the governing an FSA for normal would require an operator to establish limits of a vehicles normal flight. The trajectories, applicable to all launch and the limits of a useful mission based on reentry vehicles, in proposed § 450.117 proposal would retain the requirement the values of trajectory parameters (Trajectory Analysis for Normal Flight). in § 417.207(a)(1) to establish a nominal necessary to attain the primary mission The provision would distinguish trajectory where the vehicle performs as objective, including flight azimuth between variability in the intended designed without any deviation due to limits. Note that the azimuth limit data trajectory and uncertainties due to winds, propulsion performance, or mass is currently required by the Air Force in random sources of dispersion such as properties but would add clarity about Air Force Space Command Manual winds and vehicle performance. It the sources of uncertainty that a (AFSPCMAN) 91–710 Vol. 2. The limits would also clarify application trajectory analysis must account for by of a useful mission are essential input requirements. distinguishing between variability and data for the flight safety limits analysis, All the FSAs depend on some form of random uncertainty. and for an evaluation of whether a analysis of the trajectory under normal Specifically, the proposal would vehicle should be allowed to pass conditions, otherwise known as a expressly require a trajectory analysis to through a gate, as discussed later in this normal trajectory. That is, one must first establish two separate sets of trajectories preamble. understand a vehicle’s trajectory when to characterize distinct sources of Proposed § 450.117(b) would require a it performs as intended and under uncertainty, including variability and final trajectory analysis to use a six- normal conditions before one can random uncertainty. One set of normal degree of freedom trajectory model, and determine the effects of malfunctions trajectories in § 450.117(a)(1)(ii) would proposed § 450.117(c) would require a along its flight path. characterize the uncertainty during trajectory analysis to account for all Current regulations for normal normal flight due to random deviations wind effects, including profiles of winds trajectory analyses are found in from ideal conditions, such as wind that are no less severe than the worst §§ 417.207 and 431.35(d) and appendix conditions, vehicle mass, and wind conditions under which flight A to part 417. Section 417.207 sets the performance characteristics. Another set might be attempted, and for uncertainty current trajectory analysis requirements of normal trajectories in in the wind conditions. These are for ELVs. Section 417.207(a)(1) requires § 450.117(a)(1)(i) would characterize similar to § 417.207(b) and (c), an analysis that establishes the limits of how the intended trajectory could vary respectively. a launch vehicle’s normal flight, as due to conditions known prior to Proposed § 450.117(d) would provide defined by the normal trajectory and initiation of flight. An example of application requirements for trajectory potential three-sigma trajectory variability is how the intended analyses that address the proposed dispersions about the normal trajectory trajectory would change due to different methodology, input data, and output for any time after lift-off. Although this times for lift-off within a launch data. In paragraph (d)(1), an applicant requirement is generally clear, the window that lasts several minutes for a would be required to describe the uncertainties the analysis must consider mission with an orbital rendezvous as methodology used to characterize could be clearer. For example, the the primary objective. Another example normal flight and the limits of a useful current requirement does not of variability is how the intended mission, including the scientific distinguish between inherently random trajectory would change due to wind principles and statistical methods used, uncertainties that could cause the actual conditions. In such cases, the nominal all assumptions and their justifications, trajectory to differ from the nominal trajectory represents the most likely lift- the rationale for the level of fidelity of trajectory, and variability in the known off time. An FSA must distinguish the methods, and the evidence for conditions immediately prior to the between variability and random validation and verification that would initiation of the operation (e.g., weather uncertainty in the normal trajectory in be required by proposed § 450.101(g). In conditions at the time of the launch or order to demonstrate that the criteria in paragraph (d)(2), the FAA proposes to the time into a launch window that the proposed § 450.101 would be satisfied at require that the applicant describe the

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00087 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15382 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

input data used in normal trajectory necessary to determine how far a through orbital insertion and reentry or analyses and provides a list of the vehicle can deviate from its normal descent of the vehicle through landing, minimum input data an applicant must flight path in case of a malfunction. This including its three-sigma dispersion. In describe. In paragraph (d)(3), the FAA analysis helps determine impact points practice, part 431 license applicants proposes to require that an applicant in case of a malfunction and is therefore have provided malfunction trajectory describe a representative normal a vital input for the analyses needed to analyses consistent with the part 417 trajectory analysis outputs (e.g., demonstrate compliance with risk regulations. However, the lack of clarity position, velocity, and vacuum criteria. The FAA’s current regulations regarding the malfunction trajectory instantaneous impact point) for each covering trajectory analyses in case of analysis requirements and ensuing second of flight for (1) the nominal malfunction are in § 417.209 discussions between the FAA and trajectory, (2) a fuel exhaustion (Malfunction turn analysis), appendix A operators has resulted in inefficiencies trajectory under otherwise nominal to part 417, and § 431.35(d)(8). and delays in the licensing process. conditions, (3) a set of trajectories that Current § 417.209 sets forth the Proposed § 450.119 would consolidate characterize variability in the intended trajectory analysis requirements in case all trajectory analysis requirements for a trajectory based on conditions known of a malfunction applicable to ELVs. malfunctioning flight which would be prior to initiation of flight, (4) a set of Section 417.209(a)(1) requires a applicable to any launch or reentry trajectories that characterize how the trajectory analysis to establish the vehicle. Based on the noted actual trajectory could differ from the launch vehicle’s turning capability in advancements in computational intended trajectory due to random the event of a malfunction during flight capabilities that have rendered the uncertainties, and (5) a set of trajectories using a set of turn curves. Appendix A current use of turn curves outdated and that characterize the limits of a useful to part 417 (section A417.9) also over simplistic, the FAA proposes to mission as described in proposed provides more detailed and prescriptive remove the § 417.209(b) requirements § 450.117(a). The proposed application requirements for analyzing ‘‘turn related to turn curves in favor of more requirements provide regulatory clarity curves.’’ Turn curve data offered a modern Monte Carlo methods. Proposed regarding the normal trajectory reasonable way to simulate failures that § 450.119(b) would provide characterization necessary to ensure produce trajectory departures, performance-based requirements compliance with proposed § 450.101. particularly in response to thrust offsets regarding what a malfunction trajectory Note that in this proposed section, when computational limitations made it analysis must account for, including and other proposed flight safety analysis impractical to perform six degrees of applicable times in flight and valid application requirements, the FAA freedom (6–DOF) simulations of trajectory time intervals. Specifically, requires representative data. This allows malfunction trajectories. the proposal would require the analysis the FAA to evaluate an applicant’s In the past, turn curves produced a to account for (1) all trajectory times methodologies. Representative data reasonable way to model the classic during the thrusting phases or when the should be the best, meaning the most cornus spiral behavior associated with a lift vector is controlled during flight, (2) realistic, data available given the constant thrust offset or nozzle burn- the duration starting when a intended flight parameters. through. Thus, § 417.209(b) requires a malfunction begins to cause each flight The applicant would also be required set of turn curves to establish the launch deviation throughout the thrusting to submit additional products that allow vehicle velocity vector turn angle from phases of flight, and (3) trajectory time the FAA to conduct an independent the nominal launch vehicle velocity intervals between malfunction turn start analysis, if requested by the vector, and to establish the vehicle times that are sufficient to establish Administrator. This same application velocity turn magnitude from the flight safety limits, if any, and requirement would also be in proposed nominal velocity magnitude. There are individual risk contours that are smooth §§ 450.119 through 450.141. At times, two fundamental types of malfunction and continuous. The proposal would the FAA conducts independent flight turn curves: (1) One that shows how the retain in § 450.119(b)(4) the safety analyses which usually require magnitude velocity changes during the performance-based requirement additional information than is normally turn; and (2) the other for the direction currently in § 417.209(a)(3) to establish required of an applicant. Instead of of the velocity. Given advancements in the relative probability of occurrence of attempting to list out what is needed for computational capabilities, the use of each malfunction turn of which the every independent analysis, which is turn curves as mandated by the current vehicle is capable. In proposed usually case-specific, the FAA proposes regulations constitutes an outdated and § 450.119(b)(5), the analysis would also to simply state that more information unnecessarily simplified analysis have to account for the probability may be necessary. The FAA’s conduct of technique. For instance, through current distribution of position and velocity of an independent analysis is usually computational capabilities, particularly the vehicle when each malfunction will reserved for new vehicle concepts, new the prevalence of 6–DOF trajectory terminate due to vehicle breakup, along analysis methods, or proposals that models, it is generally more efficient with the cause of termination and the involve unique public safety issues. and more accurate for an applicant to state of the vehicle.194 Finally, in provide sets of Monte Carlo trajectories proposed § 450.119(b)(6), the analysis 4. Trajectory Analysis for Malfunction that characterize a given type of would establish the vehicle’s flight Flight malfunction, even for the thrust vector behavior from the time when a Proposed § 450.119 (Trajectory offsets and nozzle burn-through, than to malfunction begins to cause a flight Analysis for Malfunction Flight) would provide turn curve data. deviation until ground impact or consolidate trajectory analysis The current RLV regulations in part predicted structural failure, with requirements for all launch and reentry 431 do not explicitly address trajectory time intervals that are vehicles. In consolidating, the FAA malfunction trajectory analyses. Section would also update its requirements to 431.35(d)(8) describes flight trajectory 194 The proposed § 450.119(b)(5) requirement reflect advancements in trajectory analysis requirements in a single would be equivalent to the § 417.209(a)(4) through analysis capabilities and clarify paragraph. It requires that applicants (9) requirements. Under § 417.209, the FAA prescribed the use of ‘‘turn curves’’ that were a application requirements. A provide flight trajectory analyses particular way to compute the position and velocity malfunction trajectory analysis is covering launch or ascent of the vehicle at the end of a malfunction trajectory.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00088 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15383

sufficient to establish individual risk Although part 431 does not expressly waterborne vessels, or those that pose a contours that are smooth and ask for a debris analysis, the FAA has toxic or fire hazard. The debris analysis continuous. deemed § 431.35(b) to require one, would also be required to identify any Finally, proposed § 450.119(c) would applying the same standards as those in explosive debris. provide application requirements for part 417. However, this lack of Proposed § 450.121(d) would provide malfunction trajectory analyses that regulatory specificity in part 431 has led the debris analysis application address the proposed methodology, to longer pre-application consultation requirements. This paragraph would input data, and output data. An periods as the FAA and operators inherit, in a less detailed and applicant would be required to describe worked to ascertain the applicable prescriptive manner, the requirements the methodology used to characterize requirements. in appendix A to part 417, section malfunction flight including the same Proposed § 450.121 would provide A417.11. It would expressly identify the elements required for the normal performance-based regulations information and data needed by the trajectory analyses. The FAA proposes regarding the level of fidelity required FAA to evaluate compliance with the to require that an applicant describe the for key elements of a valid debris regulatory requirements. Proposed input data used in malfunction analysis. Proposed § 450.121(a) would § 450.121(d) would describe the level of trajectory analyses and provides a list of include a debris analysis that fidelity required for the products of a the minimum data an applicant must characterizes the debris generated for debris analysis including (1) a describe. The FAA also proposes to each foreseeable vehicle response mode description of the debris analysis require that an applicant describe as a function of vehicle flight time, methodology, including input data, representative malfunction trajectory accounting for the effects of fuel burn assumptions, and justifications for the analysis outputs (e.g., position, velocity, and any configuration changes. assumptions; (2) a description of all and vacuum instantaneous impact The FAA proposes to add the vehicle breakup modes and the point) for each second of flight and for references to fuel burn and development of debris lists; and (3) all the probability of each trajectory that configuration changes that are absent debris fragment lists necessary to characterizes a type of malfunction from current part 417 because an quantitatively describe the physical, flight. Finally, the FAA may also request operator’s debris list will change over aerodynamic, and harmful additional products to conduct an time with variations to the amount of characteristics of each debris fragment independent analysis. These proposed available propellant and with the or fragment class. Finally, as discussed application requirements are consistent jettisoning of hardware. earlier, the applicant would be required or less burdensome than current Proposed § 450.121(b) would require to provide additional products as requirements. that the debris analysis account for each requested by the FAA to conduct an foreseeable cause of vehicle breakup, independent analysis to ensure that 5. Debris Analysis including any breakup caused by an public safety criteria are satisfied. Proposed § 450.121 (Debris Analysis) FSS activation or by impact of an intact would set the requirements for debris vehicle. This proposal would include 6. Flight Safety Limits Analysis analysis by revising current debris from a vehicle’s jettisoned Proposed § 450.123 would set the requirements in § 417.211 (Debris components and payloads because such requirements to identify uncontrolled analysis), accounting for part 431 debris could cause a casualty due to areas and establish flight safety limits practices not fully expressed in the impact with an aircraft or waterborne that define when an operator must regulatory language, consolidating vessel or could pose a toxic or fire initiate flight abort to (1) ensure requirements from § 417.107 (Flight hazard. This proposal is consistent with compliance with the public safety Safety), and removing overly the ARC recommendation to develop a criteria of proposed § 450.101 and (2) prescriptive and burdensome process for a debris catalogue. prevent debris capable of causing a requirements from Appendix A to part Foreseeable causes of vehicle breakup casualty from impacting in uncontrolled 417. would include engine or motor areas if the vehicle is outside the limits Under § 417.211(a), a debris analysis explosion, or exceeding structural limits of a useful mission. must identify the inert, explosive, and due to aerodynamic loads, inertial Current § 417.213(a) requires that a other hazardous vehicle debris that loads, or aerothermal heating. flight safety limits analysis identify the results from normal and malfunctioning Proposed § 450.121(c) is substantively location of populated or other protected flight. Section 417.211(b) specifies that the same as § 417.107(c). The section areas and establish flight safety limits to a debris analysis must account for contains the debris thresholds define when an FSS must terminate a various causes of a launch vehicle requirements. It would adopt the launch vehicle’s flight to prevent breakup. This analysis includes debris references to inert, explosive, and other hazardous impacts from reaching any from any flight termination system hazardous vehicle debris currently in protected area and ensure that the activation, launch vehicle explosion, § 417.211(a). The inert debris public risk criteria of § 417.107(b) are aerodynamic loads, inertial loads, requirement would include all debris satisfied. Section 417.3 currently atmospheric reentry heating, and impact that could impact a human being with defines a flight safety limit as criteria to of an intact vehicle. Section 417.211(c) a mean expected kinetic energy at ensure a set of impact limit lines asks for a list of debris fragments for impact greater than or equal to 11 ft-lbs, established for the flight of a launch each cause of breakup and any planned or mean impact kinetic energy per unit vehicle flown with an FSS bound the jettison of debris, launch vehicle area of 34 ft-lb/in2. The required area where debris with a ballistic components, or payload. Also, thresholds are well-established coefficient of 3 psf or more is allowed § 417.107(c) contains debris threshold standards used by Federal launch to impact when an FSS functions. Thus, requirements for debris analysis and ranges. In general, the 11 ft-lb § 417.213(a) and the definition of flight appendix A to part 417 (section requirement is the primary threshold for safety limit require that any populated A417.11) provides detailed direction on debris, whereas the 34 ft-lb/in2 is for area be protected by flight safety limits the debris analysis constraints, debris penetrating injuries. This paragraph also from where the FSS must be activated. models, and other debris analysis would clarify the need to consider the This requirement is not consistent with products. effects of all inert debris on aircraft or operations on Federal launch ranges

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00089 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15384 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

that allow potential debris impact in other entity by agreement. This change Government consensus standard that a populated areas inside the impact limit reflects the fact that all members of the conditional risk management process lines, as long as the individual and public, even those in areas of land should be implemented to ensure that collective public risks remain within controlled by a launch operator, are mission rules do not induce acceptable limits. protected to the extent that collective unacceptable consequences when they The requirements in § 417.213(b) are and individual public risk limits apply are implemented.197 In the flight safety specific about potential contributors to everywhere. Specifically, proposed context, a flight abort is a good example the vehicle and debris dispersions for § 450.123(a) would require protection of of a safety intervention intended to which the flight safety limits analysis uncontrolled areas by flight safety limits mitigate public risks, but that typically must account including time delays, all and ensure compliance with the public induces a conditional risk (e.g., a wind effects, velocity imparted to safety criteria of proposed § 450.101, consequence associated with the debris vehicle fragments by breakup, all lift while controlled areas would be event triggered by the flight abort). A and drag forces on the malfunctioning required to meet only the collective and flight safety limits analysis would vehicle and falling debris, all launch individual risk requirements (also in ideally minimize all foreseeable vehicle guidance and performance accordance with proposed § 450.101). consequences, not just those to people errors, all launch vehicle malfunction The FAA intends to assess the need on the ground or to the extent necessary turn capabilities, and any uncertainty for flight safety limits to protect to meet the public safety criteria. For due to map errors and launch vehicle environmentally-sensitive areas in the example, placing flight safety limits in tracking errors. environmental review process of areas where flight abort might place Section 417.213(d) requires that the proposed § 450.47. The FAA anticipates debris on a busy shipping lane or air analysis establish designated impact that not all environmentally-sensitive corridor is not an ideal solution when limit lines to bound the area where areas will need this protection. For other locations for the limits could meet debris with a ballistic coefficient of 3 example, current practice for launches the public safety criteria and psf is allowed to impact, assuming the from the Western Range protects a consequence criteria, and still provide FSS functions properly. In contrast, part National Marine Sanctuary in the space for the vehicle to fly a useful 431 does not contain any express Pacific Ocean against planned impacts mission. Also, as a malfunctioning requirements for a flight safety limits of jettisoned items, but not against vehicle’s debris footprint migrates analysis to set flight safety limits. That debris from a flight abort. towards a populated area, the being said, part 431 license applicants Proposed § 450.123(a) would require consequence to people on the ground have performed a flight safety limits an FSA to identify the location of from a flight abort will increase from a analysis mirroring part 417 uncontrolled areas and establish flight low number and possibly reach the requirements in cases where an FSS was safety limits that would define when an proposed consequence limit. The ideal employed to satisfy the public risk operator must initiate flight abort to location for a flight safety limit on such criteria in § 431.35(b). prevent debris capable of causing a trajectory is not at the last location The FAA proposes to move the casualty from impacting in uncontrolled where an abort would still result in definition of ‘‘flight safety limit’’ from areas if the vehicle is outside the limits meeting the consequence criteria, which current § 417.3 to § 401.5 and update the of a useful mission, and to ensure would presumably result in a definition to mean criteria to ensure that compliance with the public safety consequence close to the limit, but at a public safety is protected from the flight criteria of proposed § 450.101. Given location that minimizes the of a vehicle when an FSS functions flight safety limits are only required to consequence. This proposed approach properly. Thus, the proposal would protect people in uncontrolled areas and could result in flight safety limits that remove any ballistic coefficient not people in controlled areas, the provide debris containment, or nearly threshold from the definition of a flight proposal would reconcile the current so, while also allowing normal flight safety limit. As previously discussed, inconsistency between the part 417 and flight within the limits of a useful the Air Force has permanently waived requirements versus the current practice mission without triggering an abort. In its previous requirement that embedded at some Federal launch ranges that summary, the design of the flight safety a specific ballistic coefficient threshold allows the public’s exposure to debris limits and the associated flight safety into the flight safety limits, and the FAA hazards as long as the collective and rules would be required to avoid an has also waived the corresponding individual risk criteria are met. increase in risk induced by a flight requirement in § 417.213(d).195 When Proposed § 450.123(b) would require a abort, compared to inaction or action at the FAA adopted the 3 psf ballistics flight safety limits analysis to identify a different time. This is relevant to areas coefficient standard (in 2006), the FAA flight safety limits for use in where debris containment is not recognized that ballistic coefficient is establishing flight abort rules. The flight possible, as discussed in greater length not well correlated with the probability safety limits would be required to in the next section on proposed of a casualty producing impact.196 account for temporal and geometric § 450.125. Simply put, ballistic coefficient is an extents on the Earth’s surface of any Proposed § 450.123(c) would require imperfect surrogate that was adopted vehicle hazards resulting from any the flight safety analysis to include a based on past practice when computers planned or unplanned event for all gate analysis for an orbital launch, or were less capable than today. times during flight, and account for any launch or reentry where one or In § 401.5, the proposal would also potential contributions to the debris more trajectories that represents a useful replace the term ‘‘protected area’’ with impact dispersions. This is the same as mission intersects a flight safety limit ‘‘uncontrolled area,’’ defined as an area § 417.213(b). Proposed § 450.123(b)(3) that provides containment of debris of land not controlled by a launch or would add a requirement to design capable of causing a casualty. This is reentry operator, a launch or reentry site flight safety limits to avoid flight abort also discussed in more detail in the next operator, an adjacent site operator, or under conditions that result in section on gate analysis. increased collective risk to people in Proposed § 450.123(d) would provide 195 81 FR 1470 (January 12, 2016). uncontrolled areas, compared to flexibility to allow the computation of 196 Licensing and Safety Requirements for continued flight. The proposed Launch, NPRM. 67 FR 49464 (October 28, 2002). requirement is equivalent to the U.S. 197 RCC 321–10 at p. 2–7.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00090 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15385

flight safety limits in real-time in lieu of discussed earlier, adding a definition of even when the flight is along a trajectory computing flight safety limits preflight. the ‘‘limits of a useful mission.’’ The that crosses a gate. This alternative would reduce the proposal would also add an option to The current gate regulations imply number of assumptions used in the relax flight safety criteria without using that gates are the only option when flight safety limits analysis and allow a gate. debris containment is not possible along a trajectory that represents a useful for a computation that uses the best Current § 417.3 defines a ‘‘gate’’ as the mission, whether it is normal or outside available data on the vehicle state. The portion of a flight safety limit boundary of the normal trajectory envelope. This proposal would allow the computation through which the tracking icon of a of flight safety limits in real-time to be requirement does not reflect current launch vehicle flown with an FSS may performed on the ground or onboard the practice at the Federal launch ranges. pass without flight termination. As vehicle. Federal launch ranges sometimes relax The FAA proposes to remove the discussed earlier, a gate is an opening in flight safety limits to allow continued requirement for a straight-up time a flight safety limit through which a flight for these trajectories without the analysis currently in § 417.215. A vehicle may fly, provided the vehicle use of a gate, as long as the operations straight-up time analysis establishes meets certain pre-defined conditions satisfies the collective risk criterion. when to terminate the flight of a vehicle such that the vehicle performance Also, some Federal launch ranges do not that fails to pitch over, and thus flies indicates an ability to continue safe currently require explicit identification straight up, to achieve debris flight. If the vehicle fails to meet the of the conditional risk posed by a containment. The straight-up time is not required conditions to pass a gate, then vehicle that flies on a trajectory within the only method of limiting the risks flight abort would occur at the flight the normal trajectory envelope or the and consequences to the launch area in safety limit. In other words, the gate limits of a useful mission. The preflight the case of a vehicle that flies a straight- would be closed. risk due to such a trajectory is often up trajectory. Although the express The FAA has requirements for an small because the vehicle is not likely provision is being removed in the overflight gate analysis in § 417.217 and to deviate far from nominal. However, a proposed rule, the new performance- appendix A, section A417.17, and for a gate or relaxed flight safety limit to based analysis permitted under hold-and-resume gate analysis in allow flight on such a trajectory implies § 450.213 would allow the straight-up § 417.218. An overflight gate analysis that the risk must be acceptable given time approach to control the hazards determines whether a vehicle can that the vehicle does fly on such a from a straight-up flight, but its use overfly populated areas. This analysis trajectory. Such a failure to identify the would not be required. requires a launch operator determine conditional risk associated with such a Proposed § 450.123(e) lays out the why it is safe to allow flight through a trajectory as part of the gate analysis is application requirements for flight flight safety limit—the limit that inconsistent with the U.S. Government safety limits analyses. The FAA would protects populated or protected areas— consensus standard (RCC 321–17 require an applicant to submit: (1) A without terminating a flight. This paragraph 2.3.6) that a conditional risk description of how each flight safety analysis accounts for the fact that it is management process should be limit will be computed; (2) potentially more dangerous to implemented to ensure that mission representative flight safety limits and populated or protected areas to destroy rules do not induce unacceptable levels associated parameters; (3) an indication a malfunctioning vehicle during certain of risk when they are implemented. of which flight abort rule from proposed portions of a launch than not to destroy Although part 431 has no § 450.165(c) is used in conjunction with it. In some circumstances, a destroyed requirements related to gate analysis, each example flight safety limit; (4) a vehicle may disperse debris over a the one orbital RLV operation licensed graphic depiction or series of depictions wider area affecting more people than if to date employed an FSS and performed of representative flight safety limits, the the vehicle were to impact intact. a gate analysis. launch or landing point, all The FAA’s proposed § 450.125 would uncontrolled area boundaries, and The primary purpose of flight safety establish a single set of performance- vacuum instantaneous impact point limits and gates is to establish safe based gate analysis requirements traces for the nominal trajectory, extents locations and conditions to abort the applicable to all launch and reentry of normal flight, and limits of a useful flight prior to the vehicle entering a vehicles. The gate analysis requirements mission trajectories; (5) if the region or condition where it may in §§ 417.217 and 417.218 would be requirement for flight abort is computed endanger populated or other protected combined. Proposed § 450.125 would in real-time in lieu of precomputing areas if flight were to continue. From an remove prescriptive requirements on the flight safety limits, a description of how operator’s perspective, a gate should types of gates, standardize the the real-time flight abort requirement is allow the vehicle to fly through a flight requirements for establishing a gate, and computed including references to public safety limit when the trajectory open the possibility of relaxing flight 198 safety criteria of § 450.101; and (6) corresponds to a useful mission. safety limits. The FAA believes an additional products requested by the Otherwise, a flight abort would be operator should have the freedom to FAA for an independent analysis when required for every flight that intersects select risk mitigation methods that will necessary to demonstrate compliance with a flight safety limit even if the present the best safety posture rather with risk criteria. The proposed mission can still have a successful than prescribing certain strategies that application requirements are consistent outcome. The optimal use of flight may not be the best for all scenarios and with current practice under parts 417 safety limits and gates would be to vehicles. The FAA also proposes to and 431. prevent vehicles that cannot achieve a revise the existing definition of ‘‘gate’’ useful mission from continuing flight, in § 401.5 to replace the term ‘‘flight 7. Gate Analysis termination’’ with ‘‘flight abort’’ and to The FAA proposes § 450.125 to make 198 As discussed earlier in this preamble, the FAA add language to reflect that the flight regulations governing gate analyses proposes in § 401.5 to define the ‘‘limits of a useful must remain within specified mission’’ as the trajectory data or other parameters more performance-based, flexible, and that describes the limits of a mission that can attain parameters to avoid flight abort. clear. This change would include the primary objective, including but not limited to Proposed § 450.125(a) would require a revising the definition of ‘‘gate’’ and, as flight azimuth limits. gate analysis for an orbital launch, or

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00091 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15386 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

any launch or reentry where one or a flight safety limit while within the allow a non-normal flight to continue as more trajectories that represents a useful normal trajectory envelope. long as the mission does not pose an mission intersects a flight safety limit Another requirement of the proposed unacceptable conditional risk given the that provides containment of debris gate analysis would be that the present trajectory. A good example of capable of causing a casualty. predicted average consequence from missions that fall into this category are flight abort resulting from any Proposed § 450.125(b) would set the missions that lift-off on an incorrect reasonably foreseeable vehicle response flight azimuth, usually due to a software gate analysis requirements. The FAA mode, in any one-second period of input error, such as the Ariane 5 failure would require an analysis to establish a flight, using any modified flight safety on January 25, 2018, during its 97th relaxation of flight safety limits to allow ¥2 limits must not exceed 1 × 10 CEC. mission (VA241). Apart from the continued flight or a gate where a The goal of this requirement is to ensure programming error, these vehicles may decision will be made to abort the that flight safety limits do not create an be healthy and are not expected to fail launch or reentry, or allow continued unacceptable consequence when used, more frequently than a flight without flight. If a gate is established, the since debris containment is no longer the programming error, so these flights analysis should establish a measure of provided. A gate that does not have should be allowed to continue if they performance at the gate that would flight safety limits after the gate would meet the individual and collective risk enable the flight abort crew or not need to meet this consequence criteria on the present azimuth (unless autonomous FSS to determine whether criterion since it would be placed at the the risk from planned debris impacts the vehicle is able to complete a useful same location as flight safety limits that was unacceptable on the present flight mission, and abort the flight if it is not. do provide debris containment. Under azimuth). If they do not, such flights Further, the analysis should establish the proposal, any intersections of flight would be required to implement an accompanying flight abort rules. Finally, safety limits with normal trajectories abort. This proposal is consistent with for an orbital launch, the analysis would result in flight safety limits that the ARC’s recommendation to expand should establish a gate at the last are relaxed enough to allow passage, or part 431 to include flight abort rules that opportunity to determine whether the an open gate in the flight safety limit as apply when the vehicle is performing vehicle’s flight is in compliance with long as there is enough data available to outside of its profile and is unable to the flight abort rules and can make a confirm that the vehicle is healthy (i.e., reach a useful orbit or survive, and useful mission, and abort the flight if appears capable of reaching a minimum needs to be terminated prior to not. This last requirement would safe perigee). Flight on normal overflight of a populated area. achieve the goal of assuring that only trajectories must still meet the public Proposed § 450.125(d) would missions that can be useful are allowed safety criteria in proposed § 450.101, so establish the application requirements to proceed to orbit, thereby limiting the this practice would ensure acceptable for gate analyses. Specifically, the potential for space debris. In addition, risks and use the best available data to proposal would require an applicant to when the vehicle performance does not confirm that a vehicle is unlikely to fail submit a description of the methodology demonstrate an ability to reach a before being allowed to fly through a used to establish each gate or relaxation minimum safe orbit (without an gate, if one is present. Whether flight of a flight safety limit; a description of imminent random reentry), meaning it safety limits would be relaxed enough to the measure of performance used to cannot pass the useful mission let a vehicle fly through that area, or be determine whether a vehicle will be requirement, the regulation would gated, is optional. A gate is preferred if allowed to cross a gate without flight require that flight abort occur. it would reduce risk, given that there is abort, the acceptable ranges of the sufficient information available to make measure of performance, and how these In proposed § 450.125(c), the FAA a decision on whether the vehicle is ranges were determined; a graphic would require the extents of any gate or sufficiently healthy to pass. This depiction showing representative flight relaxation of the flight safety limits to be practice would align with the Federal safety limits, any protected uncontrolled based on normal trajectories, trajectories launch range’s current practice and area overflight regions, and that may achieve a useful mission, meet the intent of the current instantaneous impact point traces for collective risk, and consequence requirement in § 417.107(a)(2). the nominal trajectory, extents of criteria. In proposed § 450.125(c)(1), the In proposed § 450.125(c)(2), normal flight, and limits of a useful FAA proposes to require a gate or trajectories that are outside of normal mission trajectories; and any additional relaxation of flight safety limits flight but within the limits of a useful products requested by the FAA to anywhere a flight safety limit intersects mission would be evaluated as potential conduct an independent analysis when with a normal trajectory if that trajectory normal trajectories. Proposed necessary to ensure that public risk would meet the individual and § 450.125(c)(2) would allow flight safety criteria are not exceeded. The proposed collective risk criteria of proposed limits to be gated or relaxed where they application requirements are consistent § 450.101(a)(1) and (2) or (b)(1) and (2) intersect with any trajectory within the with current practice under parts 417 when treated like a nominal trajectory limits of a useful mission, if the and 431. with normal trajectory dispersions.199 trajectory would meet the individual 8. Data Loss Flight Time and Planned Requiring all normal trajectories to be and collective risk criteria of proposed Safe Flight State Analyses treated like a nominal trajectory with § 450.101(a)(1) and (2) or (b)(1) and (2), dispersions as input to a conditional assuming that the trajectory flown The FAA proposes to consolidate and risk analysis (given a sample normal would be treated like a nominal update data loss flight times and trajectory) for the gate analysis would trajectory with normal trajectory planned safe flight states requirements resolve the issue of an incomplete dispersions. The predicted average in proposed § 450.127 (Data Loss Flight characterization of the conditional risk consequence from flight abort resulting Time and Planned Safe Flight State of a vehicle that flies through what was from a failure in any one-second period Analyses). of flight, using any modified flight Data loss flight time analyses are used 199 The FAA would retain the definitions of safety limits, would be required to not to establish when an operator must × ¥2 ‘‘normal flight’’ and ‘‘normal trajectory’’ currently exceed 1 10 CEC. The philosophy abort a flight following the loss of found in § 417.3. behind proposed § 450.125(c)(2) is to vehicle tracking information. In § 417.3,

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00092 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15387

the FAA currently defines ‘‘data loss licensed to date employed an FSS and command destruct or autonomous flight flight time’’ as the shortest elapsed established data loss flight times. safety system is used. thrusting time during which a launch The FAA’s proposed § 450.127(a) In proposed § 450.127(c), the vehicle flown with an FSS can move would require an FSA to establish data requirements regarding the planned safe from its normal trajectory to a condition loss flight times and a planned safe flight state would be consistent with where it is possible for the launch flight state for each flight to establish those currently in § 417.219(c), only vehicle to endanger the public. This each flight abort rule that applies when generalized to apply to reentry as well definition is unclear as to what vehicle tracking data is not available for as launch. Proposed § 450.127(c)(1) constitutes a condition where it is use by the flight abort crew or would update the § 417.219(c)(1) possible for the launch vehicle to autonomous FSS. Substantively, this requirement using new terminology endanger the public. Given the overall proposal is consistent with the current without any change to the meaning. approach to impact limit lines in rule in § 417.219(a). However, the FAA’s Proposed § 450.127(d) lays out the § 417.213(d) and the treatment of data proposal would update language to application requirements for data loss loss flight times in appendix A to part account for autonomous FSS and the flight time and planned safe flight state 417, section A417.19, the FAA has use of the term flight abort in place of analyses. Specifically, the proposal interpreted the definition to mean any flight termination. would require an applicant to submit a impact on a protected area with debris Proposed § 450.127(b)(1) would retain description of the methodology used to greater than 3 psf ballistic coefficient. the data loss flight time analysis determine data loss flight times; tabular With this proposal, the FAA would requirements consistent with § 417.219, data describing the data loss flight times move the definition of ‘‘data loss flight but with the addition of gliding flight as from a representative mission; the safe time’’ from current § 417.3 to § 401.5 a means of moving a vehicle towards flight state and methodology used to and update the definition to mean the flight safety limits (in lieu of protected determine it; and any additional shortest elapsed thrusting or gliding areas in accordance with § 417.219). The products requested by the FAA to time during which a vehicle flown with proposal would replace the subjective conduct an independent analysis. method of establishing the safe flight an FSS can move from its trajectory to 9. Time Delay Analysis a condition where it is possible for the state with a more straightforward vehicle to violate a flight safety limit. method of analyzing when the vehicle’s For ELVs, § 417.221(a) requires a time An important change in the definition state vector reaches a state where the delay analysis that establishes the mean would be the replacement of ‘‘move vehicle is no longer required to have a elapsed time between the violation of a from its normal trajectory’’ with ‘‘move flight safety system. This is to avoid flight termination rule and the time from its trajectory.’’ Computing data loss aborting a flight due to loss of track data when the flight safety system is capable flight times initialized using normal during a phase of flight in which track of terminating flight for use in trajectories or nominal trajectories data is not required to ensure safe flight. establishing flight safety limits. Section would both be acceptable means of Thus, the proposal would encourage 417.221(b) requires the analysis to compliance with the proposed operators to avoid a flight abort, which determine a time delay distribution that regulation, since using the former often correlates with creating debris, accounts for the variance of all time should be more conservative. This due to loss of track data when in an area delays for each potential failure resolves the issue of varying practices at where flight abort is not required to scenario, a flight safety official’s different ranges and provides additional meet the regulations. decision and reaction time, and flight flexibility. Proposed § 450.127(b)(2) would termination hardware and software In § 417.219(a), the FAA requires a require data loss flight times to account delays which includes all delays launch operator to establish data loss for forces that may stop the vehicle inherent in tracking systems, data flight times and a planned safe flight before reaching a flight safety limit, processing systems, display systems, state. In § 417.219(b), the FAA requires such as aerodynamic forces that exceed command control systems, and flight that thrust be considered as a means of the structural limits of the vehicle. termination systems. moving a vehicle towards a protected When more conservative methods are The FAA has also required time delay area, but some vehicles can also glide a used, such as assuming an analyses for RLVs under the current significant distance using lift. Further, instantaneous turn towards the nearest regulatory scheme. Specifically, § 417.219(b) requires the data loss flight flight safety limit, data loss flight times § 431.39(a) requires an RLV license time to be relative to reaching protected can be underestimated in that a vehicle applicant to submit contingency abort areas, not flight safety limits. The could not physically perform the turn plans, if any, that ensure safe conduct requirements in § 417.219(c) also without breaking up. Data loss flight of mission operations during nominal include a method of establishing the times that are unrealistically low create and non-nominal vehicle flight. In planned safe flight state that includes the risk of an unnecessary abort (and practice, a time delay analysis has been the subjective phrase ‘‘the absence of a thus, an unnecessary debris event) if necessary to ensure safe conduct of an flight safety system would not track is lost, since track may return and RLV that uses flight abort. significantly increase the accumulated allow flight to continue if the data loss The FAA proposes to streamline the risk from debris impacts.’’ Data loss flight times are greater. regulations governing the analysis of times are currently computed in Proposed § 450.127(b)(3) would allow time delay in proposed § 450.129 (Time different ways at Federal launch ranges, the computation of data loss flight times Delay Analysis). Proposed § 450.129(a) with some initializing the computation in real-time in lieu of only computations would use language identical to from the nominal trajectory and some made preflight. This proposal would § 417.221(a), except that the term from trajectories within the normal allow for a computation using the last- ‘‘terminating’’ would be replaced with trajectory envelope, sometimes referred known state vector of the vehicle before the term ‘‘aborting.’’ The proposal to as ‘‘dispersed’’ trajectories. track was lost. Proposed § 450.127(b)(3) would replace the list of time delay Part 431 has no requirements related would allow the computation of data contributions prescribed in § 417.221(b) to analysis to establish data loss flight loss flight times to be performed on the with a performance-based requirement times or planned safe flight state. ground or onboard the vehicle, in proposed § 450.129(a), that the time However, the one orbital RLV operation depending on whether a traditional delay analysis would be required to

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00093 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15388 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

determine a time delay distribution that motion of the launch vehicle with launch and reentry vehicles, including accounts for all foreseeable sources of respect to the launch platform. cases where an operator uses a carrier delay. Although the § 417.224 definitions aircraft. Thus, ‘‘previous flight’’ for the Proposed § 450.129(b) would list have generally served the FAA and the purposes of an FSA would cover the application requirements. Specifically, industry well, § 417.224 lacks flight of a launch vehicle beginning the proposal would require an applicant requirements to address allocation to when the vehicle normally or to submit a description of the flight times and vehicle response modes inadvertently lifts off from a launch methodology used in the time delay (VRMs), even though these allocations platform. Liftoff would still occur with analysis, a tabular listing of each time are necessary to determine the public any motion of the launch vehicle with delay source and the total delay, with risks posed by various VRMs at various respect to the launch platform. The FAA uncertainty, and any additional times in flight. Given POF is a primary would clarify that this would include a products the FAA would request to factor in any risk computation, it is carrier aircraft as a launch platform, and conduct an independent analysis. impossible for an applicant to would include any intentional or demonstrate compliance with the 10. Probability of Failure unintentional separation from the quantitative public risk criteria without launch platform. In terms of a reentry Proposed § 450.131 (Probability of an analysis to determine the probability vehicle, the flight of a reentry vehicle or Failure Analysis) would cover of any reasonably foreseeable outcome, deorbiting upper stage would begin probability of failure (POF) analysis such as an on-trajectory loss of thrust or when a vehicle attempts to initiate a requirements for all launch and reentry a malfunction turn ending in deorbit. vehicles. The proposal would also make aerodynamic break-up. Proposed § 450.131(d), titled application requirements clearer and The FAA would retain the substantive ‘‘Allocation,’’ would establish implement performance-based § 417.224 POF analysis requirements in performance requirements to address requirements to address allocation to proposed § 450.131, including the POF allocation to flight times and flight times and vehicle response definitions of key terms such as VRMs. The proposal would require that modes. The proposed POF performance ‘‘failure’’ and ‘‘previous flight’’. a vehicle POF be distributed across requirements would allow an operator However, the proposal would apply to flight times and vehicle response modes to employ alternative, potentially all launch and reentry vehicles. In consistent with the data available from innovative methodologies so long as the addition, it would clarify the data a POF all previous flights of vehicles results satisfy proposed requirements analysis must use to establish a valid developed and launched or reentered in such as valid input data. allocation to flight times and vehicle similar circumstances; and data from Current regulations covering POF response modes. previous flights of vehicles, stages, or analysis requirements for ELVs are Proposed § 450.131(a) would retain components developed and launched or found in § 417.224. Part 431 does not the same substantive requirements reentered by the subject vehicle have requirements for a POF analysis. regarding the an operator’s estimation of developer or operator. Such data may Even so, a POF analysis is necessary to the POF for vehicles with fewer than include previous experience involving demonstrate compliance with the public two flights. However, for vehicles with similar vehicle, stage, or component risk criteria set for RLV operations in two or more previous flights, the design characteristics; development and § 431.35(b). proposal would change the § 417.224(a) integration processes, including the Section 417.224(a) requires that POF provision by requiring that the extent of integrated system testing; and analyses use accurate data, scientific outcomes of all previous flights of the level of experience of the vehicle principles, and a method that is vehicle or vehicle stage account for data operation and development team statistically or probabilistically valid. on partial failures and anomalies members. These requirements were not For vehicles with fewer than two flights, including Class 3 and Class 4 mishaps. in § 417.224 or part 431. In this context, the POF must account for the outcome Thus, the proposal would require an phases of flight would be defined by of all previous launches of vehicles analysis to account for partial failures planned events affecting the vehicle developed and launched in similar and anomalies. These changes should configuration and its failure rate, such circumstances. If a vehicle has more improve the credibility of POF analyses as ignition, first stage flight, stage than two flights, the POF analysis must by giving due credit to stages that separation, second stage ignition, account for the outcomes of all previous succeed even though a subsequent stage second stage flight, payload fairing flights of the vehicle in a statistically fails. For example, consider a vehicle separation, etc. This proposal would valid manner. Section 417.224(a) does launched two times, with a failure require what is already necessary and not address the use of data on partial during the second stage on the first thus done in current practice. failures and anomalies, which is a launch and no failures during the In proposed § 450.131(e), the FAA shortcoming the FAA seeks to correct. second launch. For the third launch, the would require that a POF allocation Section 417.224(b) defines failure to proposal would allow a probability of account for significant differences in the mean when a launch vehicle does not failure analysis to account for the fact observed failure rate and the conditional complete any phase of normal flight, or that the first stage flew twice without a failure rate. The conditional failure rate when any anomalous condition exhibits failure, while the second stage flew represents the failure rate conditional the potential for a stage or its debris to twice with one failure. on the vehicle or subsystem having impact the Earth or reenter the Proposed § 450.131(b) would retain survived, without a failure as defined atmosphere during the mission, or any essentially the same definition of earlier, to a given time in flight. The future mission, of similar launch vehicle ‘‘failure’’ used in § 417.224(b), with observed failure rate is the product of capability. The paragraph makes clear a changes using the proposed mishap the conditional failure rate and the launch incident or accident also terminology (Class 1 or Class 2) and to reliability function, which is commonly constitutes a failure. Finally, Section cover other vehicles beyond ELVs. defined as the probability that the 417.224(c) explains that previous flights Proposed § 450.131(c) would retain vehicle or subsystem has not failed prior begin when the launch vehicle normally essentially the same definition of to a given time in flight. For high or inadvertently lifts off from a launch ‘‘previous flight’’ for FSA purposes, reliability systems where the reliability platform and that liftoff occurs with any with changes intended to encompass all function is close to one (by definition),

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00094 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15389

the observed failure rate can be An FSA would include a flight hazard stages can liberate small fragments with approximated as the conditional failure area analysis to identify regions of land, a negligible probability of creating a rate. If the overall vehicle or stage POF sea, or air where an operation poses a casualty, depending on the nature of the is below 10 percent (over the entire potential hazard to the public. The exposed population. For example, period of time corresponding to a phase proposal would reduce the size of the people in aircraft are often more of flight), then this simplified approach regions of land, sea, and air requiring vulnerable than people on the ground produces a relative error less than hazard warnings from normal flight because a fragment that impacts an approximately 0.5 percent, which is events and would reduce the size of aircraft has a much higher kinetic generally not considered a significant regions requiring surveillance prior to energy due to the velocity of the aircraft. difference. For lower reliability systems, initiating a commercial space Both the ELV and RLV regulations this approximation does produce a transportation operation. These changes require public risk controls, such as significant difference between the would be consistent with practices at evacuation or surveillance, to ensure observed failure rate and the conditional Federal launch ranges. that no individual member of the public failure rate. Here again, the proposal The current FAA regulations most is exposed to greater one-in-a-million (1 ¥6 would clarify what is already necessary pertinent to flight hazard area analysis × 10 ) PC, irrespective of their location and thus done in current practice. are found in §§ 417.107(b) (Flight safety) on land, sea, or air, to satisfy risk Proposed § 450.131(e) would also and 417.223 (Flight hazard analysis) for criterion in §§ 417.107(b) and 431.35(b). require that a POF analysis use a ELVs, and §§ 431.35(b) (Acceptable The part 417 regulations address the constant conditional failure rate for each reusable launch vehicle mission risk) identification and surveillance of flight phase of flight, unless there is clear and and 431.43(b) (Reusable launch vehicle hazard areas explicitly in several convincing evidence of a different mission operational requirements and sections, including §§ 417.111(b)(5), conditional failure rate for a particular restrictions) for RLVs. Both the ELV and 417.121(f), and 417.223 as discussed vehicle, stage, or phase of flight. Thus, RLV regulations require flight hazard below. Part 431 regulations do not the proposal would require a POF areas to protect against hazards posed expressly address flight hazard areas. analysis to assume that the conditional by vehicle malfunctions (e.g., an in- However, the preamble to the 2000 final failure rate can be represented as a flight break-up) and normal flight events rule stated that the individual risk limit ¥6 piece-wise constant function of time for that create hazards (e.g., any planned of 1 × 10 PC would dictate whether each phase of flight, absent clear and jettison of debris, launch vehicle or not an area must be evacuated for convincing evidence to the contrary. components, or vehicle stages). launch or reentry activity along that The points that define transitions to a The FAA currently sets requirements trajectory to occur safely, and clarified potentially different conditional failure to warn of, or limit the operations of, that limit applied for any person not rate must include staging events or other ELVs and RLVs in regions where involved in the licensed activity. Hence, vehicle configuration changes, such as planned debris impacts are likely, for the current RLV regulations clearly ignition of other engines or rocket example, due to jettisoned stages. In intended the evacuation, and motors. In some cases, the FAA § 417.223(b), the FAA currently requires surveillance by inference, of any area anticipates that there will be sufficient flight hazard area analyses to establish where a person not involved in the evidence to justify a different failure ship and aircraft hazard area warnings licensed activity would otherwise ¥6 rate, for example during a start-up or to mariners and airman in regions that experience more than 1 × 10 PC. shut-down/burnout transient for a encompass the three-sigma impact Only § 417.223 and associated rocket motor compared to steady state dispersion area for each planned debris appendices provide specific direction operation of a stage, engine, or motor. impact. Similar language appears in on conducting flight hazard area Proposed § 450.131(f) would lay out § 431.43(b), which states that a nominal analyses. In § 417.223(a), the FAA the FAA’s application requirements for landing location is suitable if the area of requires launch operators to perform a POF analyses that address the proposed the predicted three-sigma dispersion of flight hazard area analysis that identifies methodology, assumptions and the vehicle impacts can be wholly any regions of land, sea, or air that must justification, input data, and output contained within the designated be surveyed, publicized, controlled, or data. An applicant would also be location. In the 2000 final rule, the FAA evacuated in order to control the risk to required to provide a complete set of explained that it intended the three- the public from debris impact hazards. tabular data and graphs of the predicted sigma to refer a location where the In addition, the current regulation notes failure rate and cumulative failure vehicle or stage landing would be that the risk management requirements probability for each foreseeable VRM. contained 997 times out of 1000 of § 417.205(a) apply to the flight hazard The proposed requirements are attempts, or 99.7 percent probability of area analyses. Lastly, § 417. 223(a) consistent with current practice to the containment.200 Hence, these paragraph lists factors that the analysis extent that any valid FSA must include regulations used the term ‘‘three-sigma’’ must account for. the probability of failure assigned to to refer to a univariate Gaussian Regarding aircraft hazard areas, the each VRM as a function of time into distribution,201 despite the fact that preamble to part 431 stated that the flight. impact dispersions are bivariate, and FAA also reserves discretion to impose not necessarily Gaussian. Notably, measures deemed necessary by that 11. Flight Hazard Areas neither § 417.223 nor § 431.43 stipulate office to protect public safety.202 This The FAA proposes to streamline its whether these warning areas must deference to regional offices for aircraft regulations on flight hazard area in account for all debris or only debris protection resulted in a lack of clarity proposed § 450.133, applicable to all capable of causing a casualty. There is and potential unevenness to the aircraft launch and reentry vehicles. The FAA evidence that the separation of large protection requirements potentially would codify its working definition of imposed on RLV operators. ‘‘flight hazard area’’ to mean any region 200 65 FR 56618 (September 9, 2000), at 56629. Proposed § 450.133 would establish of land, sea, or air that must be 201 Gaussian distribution (also known as normal general requirements for the flight surveyed, publicized, controlled, or distribution) is a bell-shaped curve, and it is assumed that during any measurement values will hazard area analysis as well as evacuated in order to protect the public follow a normal distribution with an equal number health and safety and safety of property. of measurements above and below the mean value. 202 65 FR 56618 (September 19, 2000), at 56646.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00095 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15390 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

requirements specific to waterborne what constitutes ‘‘in the vicinity of the area analysis. Note that the proposal vessel hazard areas, land hazard areas, launch site;’’ by eliminating that phrase, would require hazard area results to airspace hazard volumes, and the and thus ensuring equal protection for identify the regions of land, sea, and air license application. The proposal would all public exposures. Finally, the considered hazardous, regardless of make uniform to launch and reentry the proposal would clarify that valid flight location or ownership.203 The proposed requirement in current § 417.223(a) that hazard area analyses would be required requirement to show contours of operators must identify any regions of to treat all planned debris hazards, probability of impact (PI) and PC that are land, sea, or air that must be surveyed, planned impacts, and planned landings an order of magnitude lower than those publicized, controlled, or evacuated to as a virtual certainty, consistent with used to define the flight hazard areas is the extent necessary to ensure current practice and the regulations in necessary to demonstrate sufficient acceptable individual and collective sections A417.23 and B417.13. Again, computational resolution and analysis risks. However, as discussed later in this part 431 does not address flight hazard fidelity for the results that are critical to section, the proposed regulations would areas, but current practice for RLVs is public safety. Furthermore, the FAA Air allow operators to reduce, or otherwise generally consistent with the ELV Traffic Organization currently requires optimize, the size of the warning regions regulations. identification of regions of air where the ¥7 for hazards resulting from normal flight Proposed § 450.133(b)(1), (c)(1), and PI exceeds 1 × 10 for all debris events. (d)(1) would align FAA regulations with capable of causing a casualty to persons The proposal would add a definition practices at the Federal launch ranges on an aircraft, in order to facilitate safe of ‘‘flight hazard area’’ to § 405.1 to by allowing operators to reduce or and efficient integration of launch and mean any region of land, sea, or air that otherwise optimize the size of the reentry operations into the NAS. must be surveyed, publicized, regions for warnings of potential Proposed § 450.133(e)(3) would controlled, or evacuated in order to hazardous debris resulting from normal specifically provide that applicants protect the public health and safety, and flight events. Specifically, in must provide additional products if safety of property. This definition is § 417.223(b), the FAA currently requires requested by the FAA to conduct an consistent with the current requirement hazard area analyses to establish ship independent analysis. in § 417.223(a). Note that the proposed and aircraft hazard area warnings in definition would allow for the fact that regions that encompass the three-sigma 12. Debris Risk Analysis it may be appropriate to issue a public impact dispersion area for each planned The FAA proposes to streamline, warning for a flight hazard area, but debris impact. Similar language appears clarify, and make consistent its unnecessary to survey or evacuate the in § 431.43(b), and the FAA previously regulations on debris risk analysis used area to ensure the public risks are took the position that ‘‘three-sigma’’ in to evaluate compliance with the public within the criteria given in proposed this context referred to 99.7 percent safety criteria in proposed § 450.101. § 450.101, as explained in the probability of containment (as explained The proposal would require launch and discussion of hazard area surveillance earlier). However, the current reentry operators to conduct a debris and publication. regulations do not specify if the risk analysis that demonstrates Proposed § 450.133(a) would also confidence of containment applies to all compliance with proposed § 450.101 revise the technical factors for which planned debris or only debris capable of either prior to the day of the operation, the hazard area analysis must account to causing a casualty. In any case, current accounting for all foreseeable conditions remove language limiting those factors practice includes the establishment of within the flight commit criteria, or to launch activity alone, thus making flight hazard areas sufficient for 97 during the countdown using the best consistent the regulations for all types of percent probability of containment of available input data. commercial space transportation debris capable of causing a casualty. operations. The proposal would merge Thus, the proposed requirements in A debris risk analysis determines the current § 417.223(a)(2), (3), and (4) with § 450.133 (b)(1), (c)(1), and (d)(1) would expected average number of casualties slight changes into § 450.133(a)(1) to be revised to include language reflecting to the public, individually and require an operator to account for the that the provision applies to debris collectively, due to inert and explosive ‘‘regions of land, sea, and air potentially capable of causing a casualty to any debris hazards. This analysis includes exposed to debris impact resulting from person located on land, sea, or air. an evaluation of risk to populations on normal flight events and from debris Finally, proposed § 450.133(e) would land, including areas following passage hazards resulting from any potential list flight hazard area application through any gate in a flight safety limit malfunction.’’ Proposed § 450.133(a)(5) requirements. An applicant would need boundary. The current FAA regulations would also clarify that the analysis must to submit a description of the require a debris risk analysis, but only account for all foreseeable sources of methodology to be used in the flight part 417 provides any specificity about debris dispersion during freefall, hazard area analysis, including all what constitutes a valid analysis including wind effects, guidance and assumptions and justifications for the including prescriptive requirements in control, velocity imparted by break-up assumptions, vulnerability models, section A417.25 of appendix A. Part 431 or jettison, lift, and drag forces with analysis methods, and input data. This provides no requirements to clarify winds that are no less severe than the information would include the worst what constitutes a valid debris risk worst wind conditions under which wind conditions under which flight analysis. In practice though, RLV flight might be attempted, and might be attempted accounting for license applicants often abided by uncertainty in the wind conditions. In uncertainty in the wind conditions, the debris risk performance requirements § 417.223(a)(4), the current regulation classes of waterborne vessels and set in part 417, such as the need to use implies that the analysis only needed to vulnerability criteria employed, and the trajectory time intervals sufficient to account for some exposed populations classes of aircraft and vulnerability in the vicinity of the launch site. The criteria employed. Section 450.133(e)(2) 203 However, as provided in proposed proposed § 450.133(a) would further would require an applicant to submit § 450.161(c), an operator would only be required to publicize warnings for flight hazard areas that clarify that all sources of debris representative hazard area analysis exclude any regions of land, sea, or air under the dispersion must be accounted for by outputs to include tabular data and control of the vehicle or site operator or other entity removing any ambiguity associated with graphs of the results of the flight hazard by agreement.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00096 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15391

produce smooth and continuous where debris impacts are likely to occur input data would be required to be individual risk contours. in the case of a debris event while the regularly updated to account for recent Section A417.1 states that the vehicle is in flight, such as jettison of a land-use changes, population growth, appendix applies to the methods for vehicle stage or an explosion. As migration, and construction. Finally, it performing analysis required by mentioned previously, section A417 would be required to account for §§ 417.107 and 417.225, and provides provides some requirements regarding uncertainty in the source data and (1) an acceptable means of compliance, the sources of debris impact dispersions modeling approach. and (2) a standard and a measure of that must be accounted for, but in some In § 450.135(d), the proposal would fidelity against which the FAA will cases that was either overly prescriptive provide performance-based regulations measure any proposed alternative or incomplete. A debris risk analysis that set forth the features of a valid analysis approach. However, in some must compute statistically-valid debris casualty area and consequence analysis. cases the 417 appendices are overly impact probability distributions using The proposal would include a definition prescriptive and unduly burdensome. the input data produced by FSAs of casualty area in § 401.5. ‘‘Casualty For example, section A417.25(c) required in proposed §§ 450.117 area’’ would mean the area surrounding requires an operator to file with the through 450.133. The propagation of each potential debris or vehicle impact FAA a debris risk analysis report that debris from each predicted breakup point where serious injuries, or worse, includes all populated areas included in location to impact would be required to can occur. A debris risk analysis would the debris risk analysis, which typically account for all foreseeable forces that be required to model the casualty area translates into many thousands of can influence any debris impact and compute the predicted population centers for an orbital launch, location, and all foreseeable sources of consequences of each reasonably as well as the values of probability of impact dispersion. At a minimum, the foreseeable vehicle response mode in impact and expected casualty for each foreseeable sources of impact dispersion terms of conditional expected populated area. In other cases, the part must include the uncertainties in casualties. The casualty area and 417 appendices mistakenly neglected to atmospheric conditions, debris consequence analysis would be required direct an applicant to account for aerodynamic parameters, pre-breakup to account for all relevant debris important phenomena, such as the position and velocity, and breakup- fragment characteristics and the influence of uncertainties in imparted velocities.204 characteristics of a representative atmospheric conditions on the Proposed § 450.135(c) would provide person exposed to any potential debris propagation of debris from each performance-based regulations that hazard; any direct impacts of debris predicted breakup location to impact. specify features of a valid exposure fragments, intact impact, or indirect The FAA proposes to streamline, model. An exposure model provides impact effects; and vulnerability of clarify, and make consistent its critical input data on the geographical people and critical assets to debris regulations regarding debris risk location of people and critical assets at impacts. The vulnerability of people analyses to determine if public risks various times when the launch or and critical assets to debris impacts posed by a proposed launch or reentry reentry operation could occur. A debris would be required to account for the can comply with the public safety risk analysis must use an exposure effects of buildings, ground vehicles, criteria in proposed § 450.101. The model that accounts for the distribution waterborne vessel, and aircraft upon the proposal would provide performance- of people and critical assets. The vulnerability of any occupants; for all based regulations regarding the level of exposure input data would be required hazard sources, such as the potential for fidelity required for key elements of a to include the entire region where there any toxic or explosive energy releases; valid debris risk analysis, including is a significant probability of impact of and for indirect or secondary effects analyses for the propagation of debris, hazardous debris, to characterize the such as bounce, splatter, skip, slide or public exposure and critical assets distribution and vulnerability of people ricochet, including accounting for model, and casualty areas. The and critical assets both geographically terrain. It would also be required to proposed debris risk analysis and temporally, and to account for the account for the effect of wind on debris requirements in § 450.135 would distribution of people in various impact vector and toxic releases, and for supplement the more generic structure and vehicle types with a impact speed and angle (also accounting requirements for flight safety methods resolution consistent with the for motion of vehicles). Finally, it would proposed in § 450.115. The proposal characteristic size of the impact be required to account for uncertainty in would also align FAA regulations with probability distributions for relevant fragment impact parameters, and practices at the Federal launch ranges. fragment groups. It would be required to uncertainty in modeling methodology. Proposed § 450.135(a) provides These broad performance-based items applicants an option to perform a debris have sufficient temporal and spatial resolution that a uniform distribution of would replace the unduly narrow and risk analysis that demonstrates prescriptive requirements in appendix people within each defined region can compliance with public safety criteria in A which would give operators more be treated as a single average set of § 450.101, either prior to the day of the flexibility in demonstrating that public characteristics without degrading the operation, by accounting for all risk criteria have been met. foreseeable conditions within the flight accuracy of any debris analysis output, In order to provide adequate commit criteria, or during the and to use accurate source data from protection from public safety risks such countdown using the best available demographic sources, physical surveys, as the risk of casualties, it is important input data. Thus, the proposal provides or other methods. As well, the exposure that analyses used to protect public flexibility that was lacking in both parts safety account for all known influences 204 The level of fidelity of the analysis would be 417 and 431. subject to the requirements in proposed § 450.101(g) on the vulnerability of people and Proposed § 450.135(b) would include which, as proposed, requires an operator’s flight critical assets. At the same time, the performance-based requirements to safety analysis method to use accurate data and proposal recognizes in § 450.101(g) that clarify the phenomena the propagation- scientific principles and be statistically valid. The a valid method must produce results method must produce results consistent with or of-debris portion of the analysis must more conservative than the results available from consistent with or more conservative consider. The propagation of debris is a previous mishaps, tests, or other valid benchmarks, than the results available from previous physics-based analysis that predicts such as higher-fidelity methods. mishaps, tests, or other valid

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00097 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15392 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

benchmarks. Hence, the proposal would proposed § 450.101. Proposed depending on the size and thickness of not require a vulnerability model to § 450.135(e)(9) would require an windows and the number of account explicitly for each known operator to submit a list of the windowpanes. Moreover, levels of influence on the empirical results per conditional collective casualty overpressure will change depending on se, but the proposal would require that expectation for each vehicle response distance, atmospherics, and a vehicle’s a valid vulnerability model produce mode for each one-second interval of explosive yield. results that are either consistent with flight under representative conditions Multiple historical events involving the standard in proposed § 450.101(g). and the worst foreseeable conditions. large explosions, including rocket Proposed § 450.135(e) would list Finally, in all FSAs, the applicant must failures, have shown that under application requirements, which are also submit additional products that unfavorable atmospheric conditions, a designed to be more balanced and less allow an independent analysis, if shock wave may focus to produce prescriptive and ambiguous than requested by the FAA, in order to assure significant peak overpressures at current requirements in appendix A to that the public risk criteria are satisfied. communities beyond the boundaries of part 417, section A417. The proposal the launch site, potentially causing would require an application to describe 13. Far-field Overpressure Blast Effects window breakage and injuries. In light the methods used to compute debris The FAA proposes to consolidate its of the historical evidence of blast impact distributions, population regulations on far-field overpressure damage due to overpressure focusing, exposure data, atmospheric data, as well blast effects analyses in proposed and building on the legacy of U.S. as how the operator proposes to account § 450.137 (Far-Field Overpressure Blast agency efforts to protect against the for the conditions immediately prior to Effect Analysis), used to demonstrate potential public risks associated with enabling the launch or reentry flight, per compliance with the public safety rocket explosions, the FAA adopted § 450.135(e)(1) through (5). criteria in proposed § 450.101. This regulations to protect the public from Proposed § 450.135(e)(6) and (7) analysis looks at the potential public the DFO phenomena in § 417.229 (Far- would require an applicant to submit hazard from broken windows as a result field overpressure blast effect analysis) sample debris risk analysis outputs, of impacting explosive debris, including and appendix A to part 417 (section including the effective unsheltered impact of an intact launch vehicle. A417.29.) In § 417.229, the FAA casualty area for all fragment classes, The near-field effects of explosions requires an FSA to establish flight assuming a representative impact are covered under debris risk analysis, commit criteria that protect the public vector; and the effective casualty area where meteorological conditions do not from any hazard associated with DFO for all fragments classes for a significantly influence the attenuation effects and demonstrate compliance representative type of building, ground of overpressure. However, the FAA with the public risk criterion. Section vehicle, waterborne vessel, and aircraft, would require a far-field blast effect 417.229(b) currently lists appropriate assuming a representative impact analysis for peak incident overpressures constraints on the analysis and section vector. This is not a new requirement below 1 pound per square inch (psi,) the A417.29 provides an acceptable means because the effective casualty area was point where meteorological conditions of compliance. Section A417.29 always necessary for computing the EC. can significantly influence the includes hazard controls based on ANSI The proposal would define effective attenuation of explosive overpressures. S2.20–183 Standard,205 as well as a casualty area in § 401.5 as the aggregate A launch and reentry operator would be standard and a measure of fidelity used casualty area of each piece of debris required to conduct a far-field to assess any proposed alternative created by a vehicle failure at a overpressure blast effects analysis (also analytic approach. Section A417.29 also particular point on its trajectory. The known as distance focusing lists the products of a valid DFO effective casualty area for each piece of overpressure, or DFO) that demonstrates analysis. debris is a modeling construct in which compliance with public safety criteria in However, current regulations lack the area within which 100 percent of the proposed § 450.101. An operator would clarity on when a day-of-launch DFO population are assumed to be a casualty, need to complete the analysis either analysis is necessary. Specifically, and outside of which 100 percent of the prior to the day of the operation section A417.29(c) requires that an population are assumed not to be a accounting for all foreseeable conditions operator conduct a risk analysis that casualty. within the flight commit criteria or accounts for ‘‘current meteorological In proposed § 450.135(e)(8), an during the countdown using the best conditions,’’ unless the operator applicant would be required to submit available input data. An applicant complies with the prescriptive sample collective and individual would be required to describe the requirements in § 417.229(b) that outputs under representative conditions critical input data, such as the include the extremely conservative and the worst foreseeable conditions, meteorological measurements, and method prescribed by the ANSI S2.20– including the total collective casualty develop flight commit criteria to include 183 Standard. These requirements have expectation for the proposed operation; any hazard controls derived from this led to situations where an operator was a list of the collective risk contribution FSA in accordance with proposed technically required to perform a day-of- for at least the top ten population § 450.165(b)(6). launch risk analysis to protect against centers and all centers with collective Impacting explosive materials, both the DFO hazard, when in fact the public risk exceeding 1 percent of the liquid and solid, have the potential to risks due to the DFO phenomena were collective risk criterion in proposed explode. Given the appropriate insignificant based on every weather § 450.101; a list of the maximum combination of atmospheric pressure condition measured over a period of individual PC for the top ten population and temperature gradients, the impact many years. centers and all centers that exceed 10 explosion can produce distant focus Part 431 does not explicitly address percent of the individual risk criterion overpressure at significant distance from the potential public hazard posed by in proposed § 450.101. The applicant the original blast point. Overpressures would also be required to submit a list from as low as 0.1 psi may cause 205 ANSI S2.20–1983, Estimating Air Blast of the probability of loss of functionality windows to break. However, other forms Characteristics for Single Point Explosions in Air, with a Guide to Evaluation of Atmospheric of any critical asset that exceeds 1 of overpressure, such as multiple Propagation and Effects, Acoustical Society of percent of the critical asset criterion in pulses, may also prove hazardous America, New York (1983).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00098 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15393

DFO. However, since 2016, those currently in § 417.229(b). Note (8) a description of the meteorological § 431.35(b)(1)(i) has required an that the level of fidelity of the DFO measurements used as input to any real- applicant to demonstrate that the total analysis would be subject to the time far-field overpressure analysis. It collective risk does not exceed 1 × 10¥4 requirements in proposed § 450.101(g), would also require the submission of EC, where the total risk consists of risk so that the analysis methods used must any additional products that allow an posed by impacting inert and explosive produce results consistent with, or more independent analysis, as requested by debris, toxic release, and far-field blast conservative than, the results available the Administrator. overpressure. Because the RLVs from valid benchmarks. 14. Toxic Hazards for Flight licensed to date under part 431 have Proposed § 450.137(c) would clarify The FAA proposes to replace current relatively low potential explosive yields the materials an operator must submit § 417.227 and appendix I to part 417 (compared to large ELVs), some part 431 with its license application, which are with the following two performance- license applicants were able to perform generally consistent with those based regulations: § 450.139 for toxic hazard analyses based on the extremely currently required to comply with part hazard analyses for flight operations and conservative method prescribed by the 417. This paragraph would clarify the § 450.187 for toxic hazards mitigation ANSI S2.20–183 Standard to level of fidelity required for the demonstrate that the public risks due to for ground operations. products of a DFO analysis by Currently, the requirements for a toxic the DFO phenomena were insignificant. specifying the key input data and The FAA proposes to streamline and release hazard analysis are specified in critical model elements that an § 417.227. Section 417.277 requires that clarify its regulations on DFO analyses. application would be required to Whereas part 417 regulations and an FSA establish flight commit criteria describe. The proposal would require an relevant appendices contain that protect the public from any hazard application to include: (1) A description prescriptive methodology requirements associated with toxic release and of the population centers, terrain, in Appendix A, the proposal would demonstrate compliance with the public building types, and window distill these sections into performance risk criteria of § 417.107(b). This characteristics used as input to the far- requirements applicable to both launch analysis must account for any toxic field overpressure analysis; (2) a and reentry flight operations. release that will occur during the Proposed § 450.137(a) would provide description of the methods used to proposed flight of a launch vehicle or applicants an option to perform a DFO compute the foreseeable explosive yield that would occur in the event of a flight risk analysis that demonstrates probability pairs, and the complete set mishap, and for all members of the compliance with public safety criteria in of yield-probability pairs, used as input public that may be exposed to toxic proposed § 450.101, either prior to the to the far-field overpressure analysis; (3) release. Additionally, § 417.405 sets day of the operation, by accounting for a description of the methods used to forth the requirements for a ground all foreseeable conditions within the compute peak incident overpressures as safety analysis, and, although toxic flight commit criteria, or during the a function of distance from the release is not explicitly enumerated, a countdown using the best available explosion and prevailing meteorological launch operator must identify each input data. If an operator could satisfy conditions, including sample potential hazard including the sudden § 450.137(a)(1), then it would not be calculations for a representative range of release of a hazardous material. required to satisfy § 450.137(a)(2). There the foreseeable meteorological Appendix I to part 417 provides are at least two different screening conditions, yields, and population methodologies for performing toxic analyses that would demonstrate center locations; (4) a description of the release hazard analysis for the flight of compliance with § 450.137(a)(1). methods used to compute the a launch vehicle and for launch Method one would be a very simple probability of window breakage, processing at a launch site in the U.S. deterministic window breakage including tabular data and graphs for as required by § 417.407(f). screening analysis. Method two would the probability of breakage as a function Similarly, § 431.35 requires that for a be a simplified risk-based screening of the peak incident overpressure for a reusable launch vehicle mission, an analysis. If either screening analysis representative range of window types, applicant must demonstrate that the indicates no potential hazards or building types, and yields accounted proposed mission does not exceed the insignificant risks, with or without for; (5) a description of the methods acceptable risk defined in mitigations, then an operator would not used to compute the PC for a § 417.107(b)(1) that includes the risk be required to comply with representative individual, including associated with toxic release. Further, § 450.137(a)(2). Conversely, an operator tabular data and graphs for the PC, as a § 431.35(c) requires that an applicant would be required to satisfy proposed function of location relative to the employ a system safety process to § 450.137(a)(2) if it could not window and the peak incident identify the hazards and assess the risks demonstrate compliance with overpressure for a representative range to public health and safety of property § 450.137(a)(1). Thus, the proposal of window types, building types, and associated with the mission. Although would provide clarity regarding how to yields accounted for; (6) tabular data parts 431 and 435 have the same risk determine if a day-of-operations risk and graphs showing the hypothetical criteria for toxic release as are contained analysis is necessary, and flexibility to location of any member of the public in part 417, unlike part 417, they have establish flight commit criteria to limit that could be exposed to a PC of 1 × no explicit requirements for establishing the contribution of DFO public risks 10¥5 or greater for neighboring toxic thresholds. Instead, toxic hazards based on analysis done prior to the day operations personnel, and 1 × 10¥6 or are addressed as part of the systems of the operation. This clarity and greater for other members of the public, safety process. The lack of definitive flexibility were lacking in both parts 417 given foreseeable meteorological requirements in parts 431 and 435 has and 431. conditions, yields, and population created a lack of clarity as to the Proposed § 450.137(b) would set exposures; (7) the maximum expected requirements for toxic release hazard required performance outcomes and the casualties that could result from far- analysis during the system safety specific factors that a DFO FSA must field overpressure hazards greater given process. consider. Substantively, § 450.137(b) foreseeable meteorological conditions, The current toxic hazard requirements would contain the same requirements as yields, and population exposures; and have a number of shortcomings. The

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00099 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15394 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

requirements of § 417.227 are not Other prescriptive examples in launch and reentry of an RLV in part sufficiently definitive for an operator to Appendix I include section I417.3(c)(3) 431, and the launch of a reentry vehicle establish the toxic concentration and which requires the launch operator to other than a reusable launch vehicle in exposure duration threshold for a toxic use only one formulation to determine part 435. Specifically, the FAA proposes propellant, to evaluate toxic hazards for the toxic concentration threshold for to replace current § 417.227 and flight or for ground operations, to mixtures of two or more toxicants, and appendix I to part 417, with two determine a toxic hazard area in the section I417.5(c)(2), which prescribes a performance-based regulations— event of a release during flight or from set of single-valued worst-case proposed §§ 450.139 and 450.187. The a ground operations mishap, or to conditions that a launch operator must proposed requirements would apply to require toxic containment or evacuation apply in an analysis of toxic hazard all launches and reentries, and would of the public from a toxic hazard area. conditions for uncommon or unique provide more definitive application Conversely, the existing appendix I to propellants. Other sections of the requirements for the toxic release part 417 is overly prescriptive in appendix mandate specific hazard analysis. defining permissible values for assumptions.206 Both proposed §§ 450.139 and assumptions and data inputs to analyses In addition to being overly 450.187 would apply to launch and but, as discussed later, lacks important prescriptive, Appendix I also contains reentry vehicles, including all items. In many instances, appendix I inaccuracies and out of date components and payloads that have requires specific methods, formulas, information. For example, section toxic propellants or other toxic acceptable sources, specific conditions, I417.7(b) (Process hazards analysis) chemicals, making it explicitly clear and assumptions. However, often these provides that an analysis that complies that reentry operations require a toxic are not the only ways in which the with 29 CFR 1910.119(e) satisfies hazard release analysis where the requirements or required section I417.7(b)(1) and (2). However, requirement was not previously explicit demonstrations can be made. the specific requirements of 29 CFR in parts 431 and 435. The FAA decided There are numerous examples of the 1910.119(e) are not completely to split the toxic release analysis prescriptive nature of appendix I to part congruent with the specific regulations into two sections, one for 417. For example, section I417.3(c)(1) requirements of section I417.7(b)(1) and flight and the other for ground identifies only three agencies of the U.S. (2). In particular, the following operations, because ground operations Government, namely, the requirements of section I417.7(b)(2) do and flight operations have different Environmental Protection Agency, the not have counterparts in § 1910.119(e): criteria available to establish an Federal Emergency Management location of the source of the release; acceptable level of public safety. Agency, and the Department of each opportunity for equipment Specifically, the FAA proposes to apply Transportation, that the launch operator malfunction or human error that can a quantitative public risk acceptability is permitted to use as sources of toxicant cause an accidental release; and each criteria for flight consistent with the risk levels of concern (LOC). There are no safeguard used or needed to control criteria in § 450.101 and to apply a common standards in toxicological each hazard or prevent equipment qualitative hazard acceptability criterion dose-response data. The data bases of malfunctions or human error. Thus, if for ground hazards that is consistent concentration thresholds are different an operator chooses to satisfy with the standard in § 450.109(a)(3).207 from agency to agency. Specific toxic § 1910.119(e), important parts of section Proposed § 450.139(b)(1) would chemicals that are released may not be I417.7(b)(2) may not be addressed, such require an operator to conduct a toxic included in some or many lists, and as the location of the source of the release hazard analysis. Additionally, some databases account for exposure release which is needed to determine under paragraph (b)(2) an operator durations where others do not. the toxic hazard area necessary to would be required to manage the risk of Additionally, some databases account achieve toxic containment. casualties that could arise from for differences in the age and The tables in appendix I are also exposure to toxic release either through vulnerability of populations exposed, problematic and in many cases omit containing hazards in accordance with while others do not. Furthermore, some important information. For example, proposed § 450.139(d) or performing a databases account for differences in the Table I417–1, Commonly Used Non- toxic risk assessment under proposed severity of physiological responses to Toxic Propellants, contains only three paragraph (e) that protects the public in exposure, when others do not. propellants, designated as commonly compliance with proposed § 450.101, Therefore, excluding available dose- used non-toxic propellants. However, including toxic release. Furthermore, response databases limits the capability this list leaves other non-toxic liquid under proposed § 450.139(b)(3) an of the operator to select the most propellants such as liquid methane or operator would be required to establish appropriate LOC. Other U.S liquefied natural gas without an explicit flight commit criteria based on the Government agencies that have exemption from performing a toxic results of its toxic release hazard established airborne toxic concentration release hazard analysis. analysis, containment analysis, or toxic The FAA proposes to consolidate the thresholds of exposure, including the risk assessment for any necessary requirements for toxic release analysis National Research Council (NRC), the evacuation of the public from any toxic for the launch of an ELV currently U.S. Occupational Safety and Health hazard area. Administration (OSHA), the National contained in parts 415 and 417, the Section 450.139(c) would contain the Institute for Occupational Safety and requirements for a toxic release hazard 206 Health (NIOSH), the National Oceanic For example, section I417.7(e)(2), the worst- analysis, which are currently lacking in and Atmospheric Administration case release scenario for toxic liquids, requires an assumption that liquid spreads to one centimeter (NOAA), the American Conference of deep, and that the volatilization rate must account 207 Section 450.109(a)(3) would require that the Government Industrial Hygienists for the highest daily maximum temperature risk associated with each hazard meets the (ACGIH), the U.S. Department of occurring the past 3 years precluding more severe following criteria: (i) The likelihood of any Defense, the National Institutes of or more realistic worst-case conditions, such as hazardous condition that may cause death or assuming the liquid spreads to a lesser depth, serious injury to the public must be extremely Health (NIH), the U.S. National Institute exposing a greater surface area for evaporation. This remote and (ii) the likelihood of any hazardous of Medicine, and the U.S. National may not be conservative enough to provide condition that may cause major damage to public Library of Medicine. acceptable public safety in some cases. property or critical assets must be remote.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00100 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15395

§ 417.227. Specifically, under proposed If an operator chose to comply with each toxic propellant or other chemical § 450.139(c) the toxic release hazard proposed § 450.139(b)(2) by conducting based on the amount and toxicity of the analysis would require an operator to a toxic risk assessment that protects the propellant or other chemical, the account for any toxic releases that could public in compliance with proposed exposure duration, and the occur during nominal or non-nominal § 450.101, in accordance with meteorological conditions involved. launch or reentry for flight operation. § 450.139(e), the toxic risk assessment Finally, under proposed § 450.139(e)(4) Furthermore, an operator’s toxic release would require the operator to account and (5) the toxic assessment would be hazard analysis would be required to for airborne concentration and duration required to account for all members of include a worst-case release scenario thresholds of toxic propellants or other the public that may be exposed to the analysis or a maximum-credible release chemicals. For any toxic propellant, toxic release, including all members of scenario analysis for each process that other chemicals, or combustion product, the public on land and on any involves a toxic propellant or other an operator would be required to use waterborne vessels, populated offshore chemical; determine if toxic release can airborne toxic concentration and structures, and aircraft that are not occur based on an evaluation of the duration thresholds identified in a operated in direct support of the launch chemical compositions and quantities of means of compliance accepted by the or reentry, and for any risk mitigation propellants, other chemicals, vehicle Administrator. Currently, the thresholds measures applied in the risk assessment. materials, and projected combustion set by the Acute Exposure Guideline In many respects, proposed products, and the possible toxic release Level 2 (AEGL–2), the Emergency §§ 450.139 and 450.187 are nearly scenarios; account for both normal Response Planning Guidelines Level 2 identical, and the rationale behind the combustion products and any unreacted (ERPG–2), or the Short-term Public revisions proposed in § 450.139 would propellants and phase change or Emergency Guidance Level (SPEGL) 208 be the same for proposed § 450.187. As molecular derivatives of released would be accepted means of compliance discussed previously, proposed chemicals; and account for any for proposed § 450.139(e)(1) (and § 450.187 would apply to any launch or operational constraints and emergency § 450.187(d)(1)). These are thresholds reentry vehicle, including all vehicle procedures that provide protection from designed to anticipate casualty-causing components and payloads, that uses toxic release. While the proposed health effects from exposure to certain toxic propellants or other toxic § 450.139(c) would contain more airborne chemical concentrations. The chemicals. Like § 450.139, § 450.187(b) definitive requirements than current FAA anticipates, as discussed earlier, would require a toxic hazard analysis. regulations, it would also provide the that additional agencies’ threshold Under the proposed rule an operator operator more flexibility in the analysis values could satisfy the requirements would be required to manage risk from because unlike the current regulations it and would identify any additional a toxic release hazard or demonstrate would not require an operator to make accepted thresholds. By requiring an compliance with proposed specific assumptions when performing a operator to use airborne toxic § 450.109(a)(3) 209 with a toxic risk worst-case release scenario analysis to concentration thresholds identified in a assessment. The requirements for a toxic determine worst-case released quantities means of compliance accepted by the risk assessment under proposed of toxic propellants, toxic liquids, or Administrator under proposed § 450.35, § 450.187(e) are substantially similar to toxic gases from ground operations. the FAA anticipates that operators those of proposed § 450.139, except that ground operations use a qualitative Proposed § 450.139(b)(2) would would be provided with some flexibility acceptability criteria and flight require an operator to manage the risk to utilize toxic concentration thresholds operations can use quantitative risk of casualties arising from toxic release identified by agencies other than the criteria. FAA has not proposed either by containing the hazards in three currently identified in appendix I quantitative criteria for ground accordance with paragraph (d) or by to part 417 thereby enhancing the operations because there are no performing a toxic risk assessment in capability of the operator to select the commonly accepted criteria. accordance with paragraph (e) that most appropriate LOC for its operation. The proposed application protects the public in compliance with An operator also would be required requirements under § 450.139(f) toxic the risk criteria of § 450.101. If an under § 450.139(e)(2) to account for hazards for flight and under § 450.187(e) operator chose toxic containment to physical phenomena (such as for ground operations would be similar. comply with proposed § 450.139(b)(2), meteorological conditions and The FAA believes that the proposed the operator would be required to characterization of the terrain) expected approach will provide applicants with a manage the risk of casualties by either to influence any toxic concentration and clear understanding of what the FAA (1) evacuating, or being prepared to duration in the area surrounding the requires in order to avoid repeated evacuate, the public from a toxic hazard potential release site instead of requests for clarifications and additional area, where an average member of the prescribing a set of single-valued wind information. Both would require the public would be exposed to greater than speed and atmospheric stability classes and dictating how an operator must applicant to submit: (1) The identity of one percent conditional individual PC in derive the variance of the mean wind the toxic propellant, chemical, or toxic the case of worst-case release or combustion products or derivatives in maximum credible release scenario, or directions. Hence, under proposed § 450.139(e)(2) the toxic assessment the possible toxic release; (2) its selected (2) by employing meteorological airborne toxic concentration and constraints to limit a launch operation would likely be more appropriate for the actual situation. Proposed duration thresholds; (3) meteorological to times when the prevailing winds conditions for the atmospheric would transport a toxic release away § 450.139(e)(3) would require an from populated areas otherwise at risk. operator to determine a toxic hazard area for the launch or reentry, 209 As discussed earlier, § 450.109(a)(3) would The conditional individual PC would be require that the risk associated with each hazard computed assuming that (1) a maximum surrounding the potential release site for meets the following criteria: (i) The likelihood of credible release event occurs, and (2) any hazardous condition that may cause death or 208 AEGLs are used by EPA, the American serious injury to the public must be extremely average members of the public are Industrial Hygiene Association’s ERPGs are used by remote and (ii) the likelihood of any hazardous present along the boundary of the toxic NOAA, and the National Research Council’s SPEGL condition that may cause major damage to public hazard area. is used by the DOD. property or critical assets must be remote.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00101 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15396 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

transport, and buoyant cloud rise of any it lays out provisions for a flight safety flown with a wind weighting safety toxic release from its source to system, a wind weighting safety system, system. These includes methodologies downwind receptor locations; (4) public risk criteria, stability, tracking, and products for a trajectory analysis, a characterization of the terrain; (5) the and post launch review. Section wind weighting analysis, a debris identity of the toxic dispersion model 417.125(b) requires an applicant to use analysis, a risk analysis, and a collision used, and any other input data; (6) an FSS if the vehicle can reach a avoidance analysis. Section C417.3 representative results of toxic dispersion populated area and the applicant does requires the launch operator perform a modeling to predict concentrations and not use an effective wind weighting six-degrees-of-freedom trajectory durations at selected downwind system. Section 417.125(c) sets simulation in order to determine a receptor locations; (7) a description of requirements for a wind weighting nominal trajectory, impact point, and the failure modes and associated system if that system is used in place of potential three-sigma dispersions about relative probabilities for potential toxic an FSS. It provides that the vehicle must the nominal impact point. Section release scenarios used in the risk not contain a guidance or directional C417.5 is related to wind weighting and evaluation; (8) the methodology and control system. It also requires the describes the methodology an applicant representative results of the worst-case launcher azimuth and elevation setting must use to measure winds and or maximum-credible quantity of any to be wind weighted to correct for the incorporate them into the trajectory toxic release; (9) a demonstration that effects of wind conditions at the time of simulation in order to determine launch the public will not be exposed to flight in compliance with § 417.233’s elevation angle and azimuth settings. airborne concentrations above the toxic FSA requirements, and requires specific The debris (section C417.7) and risk concentration and duration thresholds; nominal launcher elevation angle for (section C417.9) analyses describe (10) the population density in receptor proven (85°, and 86° with wind methodologies and analysis products locations that are identified by toxic correction) and unproven (80°, and 84° applicable to all launch vehicles for dispersion modeling as toxic hazard with wind correction) unguided calculating EC. The parts of appendix C areas; and (11) a description of any risk suborbital launch vehicles. These that are covered elsewhere in the mitigations applied in the toxic risk prescriptive launch elevation angles are proposed rule because they are assessment; and (12) the identity of the used so that the vehicle does not fly applicable to all vehicles have not been population database used. Like other uprange. In other words, the rocket transferred to proposed § 450.141. This risk analyses, the FAA may request should not be angled so vertically that includes the debris, risk, and collision additional products that allow the FAA winds could force the rocket uprange avoidance analyses. to conduct an independent analysis. instead of the intended downrange Proposed § 450.141 would consolidate direction. Section 417.125(d) expressly the requirements of §§ 417.125 and 15. Wind Weighting for the Flight of an requires unguided suborbital launch 417.233 and appendix C, but would not Unguided Suborbital Launch Vehicle vehicles to fly in accordance with the carry over the detailed methodological The FAA proposes to consolidate public risk criteria required for all and prescriptive requirements. Proposed three current part 417 provisions launch vehicles under part 417. § 450.141(a) would explain that the expressly regulating unguided In addition, the current rule has section applies to the flight of an suborbital launch vehicle operations stability, tracking, and post-launch unguided suborbital launch vehicle into § 450.141. The proposed rule would review requirements that are specific to using a wind weighting safety system to retain the performance requirements unguided suborbital launch vehicles. meet the public safety criteria of and remove the prescriptive provisions Section § 417.125(e) requires specific proposed § 450.101. The FAA proposes in §§ 417.125 and 417.233. The FAA stability requirements measured in to define a wind weighting safety also proposes to incorporate the calibers to ensure that the unguided system as equipment, procedures, overarching safety performance suborbital launch vehicle is stable analysis, and personnel functions used requirements in appendix C to part 417 throughout flight. The tracking to determine the launcher elevation and related to wind weighting analysis requirements in § 417.125(f) require that azimuth setting that correct for wind products. This proposal applies a launch operator track impact locations effects that an unguided suborbital specifically to the flight of unguided after launch to verify that the preflight launch vehicle will experience during suborbital launch vehicles using wind wind weighting analysis was accurate. flight. The FAA proposes the wind weighting to meet the public safety Section 417.125(g) is related to post- weighting safety system be a means to criteria of proposed § 450.101. launch review and states that the launch satisfy the safety requirements in An unguided suborbital launch operator must provide these impact proposed § 450.101. vehicle is a suborbital rocket that does locations, a comparison of actual to Proposed § 450.141(b) would set the not contain active guidance or a predicted nominal performance, and requirements for the wind weighting directional control system. Unlike the investigation results of any launch safety system. It would require that the launch of a guided launch vehicle, an anomaly. launcher azimuth and elevation angle unguided suborbital launch vehicle may Current § 417.233 describes the FSA settings (1) be wind weighted to correct safely fly by adjusting the launcher requirements particular to unguided for the effects of wind conditions at the azimuth and elevation (aiming the suborbital launch vehicles with wind time of flight to provide a safe impact rocket) shortly before launch to correct weighting systems. The analyses must location, and (2) ensure the rocket will for the effects of wind conditions at the establish flight commit criteria, wind not fly in an unintended direction given time of flight. This process limits impact constraints under which launch may wind uncertainties. This section would locations to those that minimize public occur, and launcher azimuth and replace current § 417.125(b), which exposure. The FAA refers to this safety elevation settings that correct for wind requires a flight safety system unless the process as ‘‘wind weighting,’’ which effects on the launch vehicle. This last vehicle uses wind weighting or does not involves unique organizational and requirement is known as the wind have sufficient energy to reach a operational safety requirements. weighting analysis. populated area. Rather than the blanket Section 417.125 provides the broad Appendix C to part 417 contains flight FSS requirement in current § 417.125(b), requirements for launching an unguided safety methodologies and products for the consequence analysis in proposed suborbital launch vehicle. Specifically, an unguided suborbital launch vehicle § 450.135(d) would determine the need

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00102 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15397

for an FSS. This section also eliminates is a prescriptive methodology. The vehicle) in three separate sections.210 the requirement in § 417.125(c)(3) methodologies for debris analysis from Current software safety regulations in regarding specific nominal launcher section C417.7 are not in the proposal parts 415, 417, and 431 are flexible. elevation angle for proven (85° and 86° and the debris analysis proposal would With this flexibility comes uncertainty. with wind correction) and unproven now be in proposed § 450.121. For example, § 415.123(b) requires that (80° and 84° with wind correction) Similarly, section C417.9 would be a launch operator provide all plans for vehicles to prevent the vehicle from covered by proposed § 450.135 without software development, the results of flying uprange. Rather than requiring the prescribed methodologies. Lastly, software hazard analyses, and plans and specific launcher elevation angles to the collision avoidance section of the results of software validation and prevent a vehicle from flying uprange, appendix, section C417.11 would be verification, but does not give guidance the FAA would require an operator to covered by proposed § 450.169. on the minimum-acceptable levels of determine what angles would ensure the rigor for those products or guidance on rocket not fly in unintended direction B. Software their contents. The FAA and the given wind uncertainties. This operator must determine the appropriate As discussed earlier, the FAA flexibility would allow a licensee to level of rigor, scope, and content of each proposes software safety requirements determine the best angle to both plan and result for each operation. This in § 450.111. The risk mitigation maximize mission objectives given the process can be labor-intensive, requiring particularities of their operation while measures that result from this rule are multiple meetings over a period of simultaneously ensuring safety. meant to be minimums, and software weeks or months. Proposed § 450.141(c) would contain development processes tend to benefit Also, § 417.123(c), applicable to ELVs, FSA performance requirements that from consistency across projects, so an requires that a launch operator conduct apply only to the launch of an unguided applicant may apply the requirements computing system and software hazard suborbital launch vehicle flown with a from its most critical software to all of analyses for the integrated system. This wind weighting safety system. It is its software, but the FAA does not requirement does not specify the necessary to establish the flight commit require that an applicant do so. requisite forms of the analyses, the criteria and other flight safety rules to Software can contribute to accidents scope and contents of the analyses, or control risk to the public and satisfies or losses in several ways. Software may the application data required to the public safety criteria in proposed contain errors that, in certain system demonstrate compliance with the § 450.101. Proposed § 450.141(c) would conditions, cause unintended behaviors requirement. The FAA and the require an operator to establish any or prevent intended behaviors. Software applicant must negotiate the specifics wind constraints under which launch may also perform actions that while for each of those items for every could occur, and conduct a wind correct and intended in isolation, cause application. Similarly, § 417.123(d) weighting analysis that establishes the hazards when interacting with other requires that a launch operator develop launcher azimuth and elevation settings. components or the system as a whole. and implement computing system and Proposed § 450.141(c) is, in essence, the Software may provide accurate software validation and verification same as § 417.233. information to an operator in a manner plans, but is silent regarding the Proposed § 450.141(d) would require contents of the plans. This again an unguided suborbital launch vehicle that confuses the operator, leading to a requires that the FAA and the applicant to remain stable in all configurations software-human interaction error. discuss, often at length, the software test throughout each stage of powered flight. Software safety therefore typically plans for every operation. This performance outcome would requires separate analyses of the software, software and computing Unlike §§ 415.123 and 417.123, eliminate the need for the specific § 431.35 does not contain any explicit prescriptive stability requirements of system interaction, and the integration references to software safety. However, current § 417.125(e), which requires a of software, hardware, and humans into in practice, the FAA has set software suborbital launch vehicle be stable in the entire system. safety requirements under the current flexible body to 1.5 calibers and rigid Software becomes safety-critical when system safety process requirements in body to 2.0 calibers throughout each the applicant uses its outputs in safety § 431.35(c). Pursuant to § 431.35(c), the stage of powered flight. decisions. The development, validation, FAA has required applicants satisfy Finally, proposed § 450.141(e) would and evaluation of safety-critical software establish the agency’s application § 417.123 or demonstrate an equivalent requires a level of rigor commensurate level of safety, in order to meet § 431.35 requirements specific to unguided with the severity of the potential suborbital launch vehicles. The FAA for software safety. This lack of detail hazards and the software’s degree of forces the FAA and applicant to work would require a description of wind control over those hazards. Reliance on weighting analysis methods, description collaboratively to develop the system software differs among operators. For safety process criteria on a case-by-case of wind weighting system and example, some launch systems employ equipment, and a sample wind basis. Autonomous Flight Safety Systems Operators have offered consistent weighting analysis, all derived from part (AFSS) that rely on rigorously- 417, appendix C, section C417.5(d). The feedback on the FAA’s software safety developed and thoroughly-tested requirements. Applicants frequently remainder of appendix C was not software to make safety decisions to included in the proposal because these asked whether §§ 417.123(b) and protect the public without human 431.35(c)’s verification and validation are all prescriptive methodologies, or intervention. Other systems require are requirements applying to all launch plan requirement included a human intervention to make safety requirement for independent vehicles covered in other sections of the decisions, such as when a pilot or proposal. For instance, the Trajectory verification and validation. Independent ground transmitter operator must make verification and validation is a common Analysis of section C417.3 would be decisions for launch systems. covered by proposed §§ 450.117 and 210 450.119. Except for section C417.5(d) as Current FAA licensing regulations Part 415 covers launch license application segregate software safety requirements procedures for ELVs; part 417 addresses launch described earlier, section C417.5 was safety requirements for ELVs, and part 431 sets not included in the proposal since this by type of vehicle (ELV, RLV, or reentry launch license and safety requirements for RLVs.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00103 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15398 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

and effective method of mitigating software safety determinations. and coordinated standards maintained software hazards for high-criticality Configuration management, including by the Federal launch ranges into FAA software, one for which there is no version control, then ensures the licensing in order to avoid duplication known substitute. Thus, although not operator uses the intended processes of effort. The Federal launch ranges explicitly stated in the regulations, the and functionality for the correct have an extensive launch safety history, FAA has required independent software in the system’s operation. and their standards meet or exceed the verification and validation as part of the Applicants have often sought help in level of safety required by the FAA. The verification and validation requirements determining whether software is safety- FAA intends to retain the ability to in §§ 417.123(b) and 431.35(c). The FAA critical in accordance with §§ 417.123(b) apply Federal launch range safety considers software testers independent and 415.123(a). For instance, operators standards toward license evaluation and when the test organization is sometimes use software to generate issuance. independent of the development information used in safety-critical In developing this proposed rule, the organization up to the senior-executive decisions, such as initiating a deorbit FAA has tried to remain consistent with level. Generally, an in-house software burn. The FAA has consistently found prevalent industry standards related to testing team can be sufficiently software that generates information used the ‘‘level of rigor’’ approach to software independent to perform a credible in safety-critical decisions to be safety- safety. Specifically, the FAA has used independent verification and validation critical software, albeit with a low the level of rigor approaches applied by function when rigorously insulated from degree of control over the system. the Department of Defense and NASA to software development authorities and Applicants have also asked whether inform the FAA’s proposed level of rigor incentives. Still more independence the FAA requires redundant processing approach to software safety regulation. may be required for highly safety- such as running a second instance of a The FAA proposes to use the critical autonomous software, such as an software component on a second Department of Defense’s MIL–STD– independent contractor, depending on independent computer, and if so, the 882E concept of ‘‘level of rigor’’ to the risks and the other mitigation required level of risk. The FAA has categorize software according to the measures implemented by the applicant. made such determinations based on the amount of risk it presents to the The FAA has required at least hazards involved and on the software’s operation and use its ‘‘level of rigor independence up to the senior- degree of control over those hazards. tasks’’ to derive appropriate regulatory management level and expected an The FAA has chosen not to prescribe a requirements for each level of rigor. applicant to show evidence of this requirement for redundant processing MIL–STD–882E uses a software hazard independence in its application. because such a requirement is best severity category with a software control Applicants have also often asked derived from the applicant’s individual category to assign level of rigor tasks to whether the FAA requires submissions approach to hazard mitigation at the software. This method has proven of software code. The FAA has not system level. Redundant copies of successful in achieving an acceptable historically required executable code identical software contain identical level of safety for space operations. submissions and does not plan to do so software faults, so redundant processing The FAA also used RCC 319, Flight in this proposal. Instead, the FAA’s is best described as a mitigation for Termination Systems Commonality requirements focus on the software hardware failures. The proposal would Standard, to develop the requirements development and testing processes, allow for software without redundant for autonomous software in proposed combined with analysis of the processing whenever processing § 450.111(d). RCC 319–14 provides software’s use in the context of the redundancy is not necessary to achieve detailed software requirements for system as a whole. Firstly, the FAA acceptable risk. For example, the FAA autonomous flight safety systems, which seeks to understand the software may not require redundant processing have been extensively reviewed by the development processes used for the in fail-safe systems, low-criticality space community. RCC 319–14 creates design, production, verification, and systems, or where hardware ensures software categories that combine hazard qualification of software to determine software processing integrity by using severity and degree of control in a single the code quality. Proposed § 450.111(a), hardware features such as watchdog step, and provides deep detail on the (b), and (c) would provide these general timers or error-correcting memory. appropriate risk reduction tasks for each software process requirements that are In light of the range of design category. AFSPCMAN 91–712 (draft) is independent of the degree of control strategies between commercial space the source of RCC 319–14’s software exercised by a given software operators, the FAA realized that a one- categories and risk reduction tasks. component. Secondly, the FAA must size-fits-all approach to software safety The FAA also reviewed NASA’s understand the impacts of the software would not be practical. Instead, in Software Safety Standard (NASA–STD– on the system as a whole. It is important proposed § 450.111(d) through (g) the 8719.13C), which provides standards to understand design risks, which are FAA would establish requirements for applicable to defining the requirements those risks inherent to the software each safety category of software. The for implementing a systematic approach design and architecture; and also safety categories, commonly known in to software safety. Like RCC 319–14, process risks, which arise from the the software safety industry as ‘‘levels of NASA–STD–8719.13C combines software development processes and rigor’’ or ‘‘software criticality indexes,’’ software hazard’s severity with the standards of the applicant. The FAA would range from autonomous software software’s degree of control to assign uses these two components, process and with catastrophic hazards to software analysis and testing tasks. However, implementation, to evaluate software with no safety impact. NASA expands its software control components and processes for the Applicants may rely upon Federal category definitions to include software appropriate level of rigor. launch range standards to show autonomy, software complexity, time- The FAA must also understand the compliance with the proposed rule, criticality, and degree of hazard control. relationship between software actions provided the standards meet the The FAA also considered NASA’s and system risks to set the appropriate regulations. The FAA maintains Software Assurance Standard (NASA– level of rigor. Establishing the required awareness of the Federal launch range STD–8739.8), which provides criticality, level of rigor and understanding its safety standards through the CSWG. The risk, resource investment, and financial implementation form the basis of FAA currently incorporates the known impact categorizations and correlates

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00104 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15399

these to levels of software assurance This proposal would address faults in software development cycle and are effort. These two NASA documents software requirements by analytical used together to determine that software provided the FAA with a wealth of means in proposed § 450.111. meets its intended purpose. In this potential software safety requirements Specifically, the proposal would require context, verification refers to ensuring and methods to determine the an applicant to describe the functions software meets the software requirements that would be most and features, including interfaces, of the requirements and design specifications. appropriate for a variety of space software. The FAA has interpreted the Validation ensures that the software systems. These documents also need to describe software to include achieves its intended purpose.214 While provided a checklist of key aspects of providing the software requirements for testing does not ensure the absence of software projects that enable software each safety-critical software component software faults, it helps detect and safety. The FAA has drawn from these even though not explicitly required by therefore reduce their presence. documents the minimum set of § 431.35 or § 417.123. The proposal The proposal would address faults in requirements that would enable space therefore codifies current practice. configuration with explicit requirements operators to protect the public, and the Software requirements are an to establish and verify software minimum set of data that would enable excellent, even indispensable, means of configuration management processes. the FAA to verify that space operators understanding any software Configuration management is the set of will protect the public in the course of component’s safety implications. processes that ensure that the flight their innovations. Software requirements, both components, including software Finally, the FAA reviewed the Air documented and implied, are the basis components, are the correct components Force Space Command’s draft 91–712, of the software design and constitute a with the appropriate development and Launch Safety Software and Computing key part of § 417.123(a) through (e) test heritage. Faults in configuration System Requirements. The Air Force requirement for software designs. The management can lead to unsuitable or has successfully used 91–712 for FAA proposes to clarify the necessity incompatible components in a system, military space projects and it is the and scope of software requirements that resulting in an increased potential for source of many RCC 319–14 would be required to be included in an unintended and unsafe system actions. requirements. 91–712, and the standards application in proposed § 450.111(h). Proposed § 450.111(a) would require discussed earlier, all prescribe Software requirements would need to be operators to document a process that increasing the effort devoted to software documented and analyzed whenever identifies the risks to the public health safety in proportion to the severity of safety-critical software is present.212 and safety and the safety of property the hazards that software can create and Software requirements are frequently arising from computing systems and in proportion to the degree of control inherited from system requirements, software. This is consistent with the that software exercises over those and both must be internally and § 417.123(a) requirement for a hazards. mutually consistent and valid for the description of the computing system The proposed software safety resulting software to work safely. A and software system safety process. It regulations would categorize software system-level hazard analysis finds out adds no more requirements than part and computing functions into the what hazards software presents to the 415 because § 415.123(b)(6) requires an following degrees of control as defined system. The software analyses can use applicant to describe the computing in proposed § 450.111(d) through (g): the system-level analyses as initial system and software system safety Autonomous software, semi- assessments of software’s criticality process as required by § 417.123(a). autonomous software, redundant fault- when starting software safety analyses. Unlike § 431.35(c), proposed tolerant software, influential software, If software requirements are flawed, the § 450.111(a) specifically mentions and no safety impact. software written to those software computing systems and software as This proposal for software safety requirements will be flawed as well. items to be included in the system would address the causes of software This causal path, where software faults safety process. faults and software failures. Software originate in software requirements, is Proposed § 450.111(b) would require faults are design flaws in software that the reason for the proposal’s focus on an operator to identify all safety-critical cause unintended behaviors or prevent identification, documentation, functions associated with its computing intended behaviors. Software faults validation, and verification of software systems and software. The 10 listed include errors in syntax, definitions, requirements. functions are a minimum set of items to steps, or processes that can cause a This proposal addresses faults in include whenever they are present in a program to produce an unintended or implementation by requiring specific system, because they represent the most unanticipated result. The presence of types of software verification and common safety-critical roles in which software faults might not always result validation testing in proposed software can be employed. For example, in an observable software failure that is § 450.111(d)(4), (e)(4), (f)(3), and (g)(2). software used to control or monitor evident to the user because it may This proposal would clarify the required safety-critical systems is capable of appear to be behaving properly. A types of software verification and hazardous actions by definition. software failure, in contrast, is an validation testing that are required Similarly, software that accesses safety- unintended or undesirable event caused under current §§ 417.123(d) and critical data is safety-critical because it by, or unintentionally allowed by, one 415.123(b)(8).213 Verification and may alter safety-critical data or prevent or more software faults. A software fault validation are standard aspects of a other components from accessing safety- is a defect or vulnerability in software critical data at required times. The while a software failure results from the function was written in English units while the rest software safety process must then execution of faulty software.211 were written in metric. demonstrate that the software that 212 Implied or undocumented software 211 An example of a software failure is the ‘‘blue requirements are common sources of software accesses safety-critical data cannot screen of death,’’ which causes a computer to end faults. all processing. An example of software fault is a 213 Examples of testing include unit testing to 214 Verification takes place while the software is fault in requirements for measurement units and a verify some of the smallest units of code, such as under development while validation is performed fault in test procedures. The Mars Climate Orbiter functions, and acceptance testing to validate high- after completing software development and was lost as a result of these two faults when one level software requirements. implementation.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00105 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15400 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

cause a hazard by doing so. These language is different from § 431.35, this associated with safety-critical computer requirements are the same as in the is not a new requirement. system functions, assesses their risk, current § 417.123(b), with the addition The requirements in the proposal vary identifies methods for mitigating them, of one new criterion for software that based on the software degree of control and specifies evidence of the displays safety-critical information. and degree of hazard presented. The implementation of those mitigation Proposed § 450.111 would retain the first and highest degree of control is measures. This requirement is currently requirement of § 417.123(b) for the autonomous software. Autonomous in §§ 415.123(b)(7), 417.123(c), and identification of safety-critical software would mean software that 431.35(d)(4). All software components, functions. The proposal would add exercises autonomous control over regardless of degree of control, require detail and clarity to this requirement, safety-critical systems, subsystems, or this analysis for the integrated system. specifying that the identified functions components such that a control entity This analysis is also required for each must be accompanied by assessments of cannot detect or intervene to prevent a autonomous, safety-critical software the criticality of each software function. hazard that may impact public health component. Hazard analyses provide This is normally done by assessing the and safety or the safety of property. It is the essential foundation for risk consequences of a functional failure or any software that can act without an assessment and management of any error and assessing the degree of control opportunity for meaningful human system. This analysis is necessary that the software can exercise to intervention. The FAA would impose throughout the lifecycle of the system, implement the function. The proposal the most stringent requirements for from development to disposal. As a would retain the examples of software autonomous software with potential system is modified during design, that may have safety-critical functions, catastrophic public safety consequences. operation, and maintenance, changes to with the expectation that the full list of Proposed § 450.111(d) would set forth any part of the system can lead to safety-critical functions is not limited to five criteria specific to autonomous unexpected consequences that may the examples. It differs from software. incur new hazards to public safety. It is § 415.123(b), which describes the Under proposed § 450.111(d)(1), the important to consider risks that result documents and materials that the software component would be required from software and computing errors as applicant must provide, whereas to undergo full path coverage testing a class or subsystem, as well as those proposed § 450.111(b) would list the and any inaccessible code must be resulting from the operation and safety-critical computing system and documented and addressed. Full path interaction of software with all other software functions that must be coverage testing is a systematic components of the system. identified and would not list the technique for ensuring that all routes Proposed § 450.111(d)(4) would application requirements in the same through the code have been tested. Path require an operator to validate and coverage testing includes decision, section. The proposal would depart verify any computing systems and statement, and entry and exit coverage. from § 431.35(d)(3) by specifically software. Current §§ 415.123(b)(8) and Proposed § 450.111(d)(1) would retain requiring the applicant to identify all 417.123(d) already require verification and clarify the current requirements in safety-critical functions associated with and validation although this proposed § 431.35(d). Full path coverage testing its computing systems and software rule would add the requirement that and documentation of inaccessible code instead of implicitly requiring the testing be conducted by testers who are would be required for autonomous identification of safety-critical software independent from the software components because the presence of developers. Independence is essential as part of the process of identifying inaccessible code segments presents a because it enables testing of cases and safety-critical systems. potential for the execution of untested conditions that the software developers Proposed § 450.111(c) would require instructions, which is obviously may not have considered or may have the identification of safety-critical deleterious for an autonomous system inadvertently omitted. software functions by consequence and that, by definition, depends on the Under proposed § 450.111(d)(5), an degree of control. It would elaborate on correctness of its instructions for safe operator would be required to develop the requirements of §§ 415.123(a) and operation. and implement software development 417.123(a), which require the Under proposed § 450.111(d)(2), the plans as currently required in identification and assessment of the software component’s functions would §§ 415.123(b)(9) and 417.123(e)(1) software risks to public safety by be required to be tested on flight-like through (5). A software development specifying that the assessments must hardware. Testing would be required plan is a means to consolidate and include the public safety consequences also to include nominal operation and standardize the management of a of each safety-critical software function fault responses for all functions. The software development process. These and the degree of control that software proposal would retain and clarify the plans would include descriptions of exercises over the performance of that current requirements in §§ 431.35(d) coding standards used, configuration function. Proposed § 450.111(c) would and 415.123(b)(8). Testing software control, programmable logic controllers, provide the classification for the components on flight-like hardware, and policies on use of commercial-off- applicants to use while the application including nominal operation and fault the-shelf software and software reuse. It requirements are contained in proposed responses, is an industry standard for would be updated as necessary § 450.111(h). Requiring software degree ensuring that the software interfaces throughout the lifecycle of the project, of control would allow the FAA to with the hardware as designed. All and may be comprised of one or several request less information for software autonomous safety-critical components documents. components with reduced or no require this testing. The configuration control of a influence on public safety. The proposal Under proposed § 450.111(d)(3), an software development project is would differ from § 431.35 by explicitly operator would be required to conduct particularly important to ensure and requiring identification of software hazard analyses of computing systems facilitate an efficient and accurate hazards by function and specifying the and software for the integrated system development process. Therefore, the documentation requirements related to and for each autonomous, safety-critical proposal would retain the existing, if computing systems and software in software component. A software hazard implicit, requirements of § 417.123(e)(2) proposed § 450.111(h). Even though this analysis identifies those hazards to limit faults in configuration by

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00106 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15401

requiring robust configuration system. The rationale for proposed the current §§ 415.123(b)(7), 417.123(c), management. Proper configuration § 450.111(e)(3) and (d)(3) are identical. and 431.35(d)(4). All software management ensures consistency and Under proposed § 450.111(e)(4), an components, regardless of level of accuracy throughout a system’s design, operator would need to verify and control, would require this analysis for development, operation, and validate any computing systems and the integrated system. The rationale for maintenance. In software engineering software related to semi-autonomous this part is the same as that for proposed terms, it is a fundamental aspect of a software as described earlier, with the § 450.111(d)(3). disciplined approach to the software associated rationale, for autonomous Under proposed § 450.111(f)(3), an lifecycle that provides a continuously software relative to proposed operator would be required to verify and current baseline for the system. The § 450.111(d)(4). This verification and validate any computing systems and FAA would set configuration validation would be required to include software related to redundant fault- management requirements for all safety- testing by a test team independent of the tolerant software as described earlier, critical documentation and code, software development division or with associated rationale, for including but not limited to software organization. This would retain the autonomous software related to requirements, hazard analysis, test requirement for verification and proposed § 450.111(d)(4) and semi- plans, test results, change requests, and validation of computing systems and autonomous software in proposed development plans. Tools, processes, software, including testing by an § 450.111(e)(4). This verification and and procedures for configuration independent test team, as currently validation would be required to include management are employed throughout required in §§ 415.123(b)(8) and testing by a test team independent of the the software industry. 417.123(d). software development division or Proposed § 450.111(e) would apply to Under proposed § 450.111(e)(5), an organization. This would retain the semi-autonomous software, with a operator would be required to develop requirement for verification and definition nearly identical to that stated and implement software development validation of computing systems and in MIL–STD–882E. The FAA regards plans as currently required in software, including testing by an semi-autonomous software as software §§ 415.123(b)(9) and 417.123(e)(1) independent test team, as currently that exercises control over safety-critical through (5). The rationale for proposed required under §§ 415.123(b)(8) and hardware systems, subsystems, or § 450.111(e)(5) and (d)(5) are identical. 417.123(d). components, allowing time for safe Proposed § 450.111(f) would apply to Under proposed § 450.111(f)(4), an detection and intervention by a control redundant fault-tolerant software, which operator would be required to develop entity. The software safety requirements is defined as software that exercises and implement software development for semi-autonomous software are a control over safety-critical hardware plans as currently required under subset of those required for autonomous systems, subsystems, or components, for §§ 415.123(b)(9) and 417.123(e)(1) software as described in proposed which a non-software component must through (5). The same rationale applies § 450.111(d). also fail in order to impact public health here as for proposed § 450.111(d)(5) and Under proposed § 450.111(e)(1), the and safety or the safety of property.215 (e)(5). software component’s safety-critical There are redundant sources of safety- Proposed § 450.111(g) would apply to functions, as categorized by the process significant information, and mitigating software that provides information to a in proposed § 450.111(a), (b), and (c), functionality can respond within any person who uses the information to take would be required to be subjected to full time-critical period. The proposal actions or make decisions that can path coverage testing and any would include four criteria for impact public health and safety or the inaccessible code must be documented redundant fault-tolerant software. safety of property, but does not require and addressed. Proposed § 450.111(e)(1) Proposed § 450.111(f)(1) is consistent operator action to avoid a mishap. would retain and clarify current with the second criteria for autonomous Influential software provides § 431.35(d) as described in proposed and semi-autonomous software in information that is used in safety- § 450.111(d)(1). The rationale for proposed § 450.111(d)(2) and (e)(2), in critical decisions, but cannot cause a proposed § 450.111(e)(1) and (d)(1) are that the software component’s safety- hazard on its own. The proposal would identical. critical functions would be required to include three criteria for influential Under proposed § 450.111(e)(2), the be tested on flight-like hardware, software. semi-autonomous software component’s including testing of nominal operation Proposed § 450.111(g)(1) would safety-critical functions would be and fault responses for all safety-critical require an operator to conduct required to be tested on flight-like functions. The proposal would retain computing system and software hazard hardware, including testing of nominal and clarify the current requirements in analyses for the integrated system. The operation and fault responses for all § 431.35(d). proposed rule would retain the safety-critical functions. Proposed Proposed § 450.111(f)(2) would repeat requirement of conducting computing § 450.111(e)(2) would also retain and the third criteria for autonomous and system and software hazard analyses clarify the current requirements in semi-autonomous software as described that exists in the current § 431.35(d) as described in proposed in proposed § 450.111(d)(3) and (e)(3). It §§ 415.123(b)(7), 417.123(c), and § 450.111(d)(2). would require that an operator conduct 431.35(d)(4). All software components, Under proposed § 450.111(e)(3), an computing system and software hazard regardless of level of control, would operator would be required to conduct analyses for the integrated system. The require this analysis for the integrated computing system and software hazard proposal would retain the requirement system. The rationale for this proposed analyses for the integrated system. The of conducting computing system and section is the same as that for proposed proposal would retain the requirement software hazard analyses that exists in § 450.111(d)(3). of conducting computing system and Proposed § 450.111(g)(2) would software hazard analyses that exists in 215 MIL–STD–882E elaborates that the definition require an operator to verify and current §§ 415.123(b)(7), 417.123(c), and of redundant fault-tolerant assumes that there is validate any computing systems and adequate fault detection, annunciation, tolerance, 431.35(d)(4). All software components, and system recovery to prevent the hazard software related to influential software. regardless of level of control, would occurrence if software fails, malfunctions, or This verification and validation would require this analysis for the integrated degrades. be required to include testing by a test

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00107 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15402 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

team independent of the software would be necessary additions to definition of ‘‘Public Safety’’ would be development division or organization. accompany the proposed part 450 removed from § 401.5 and the definition This would retain the requirement for requirements, especially in the area of of ‘‘Public’’ would be removed from verification and validation of computing flight safety analysis. Proposed § 420.5, and a new definition for systems and software, including testing §§ 450.113 through 450.139 would ‘‘Public’’ would be added to § 401.5. by an independent test team, as require the addition of ‘‘Casualty Area,’’ ‘‘Launch’’ and ‘‘Reenter; Reentry’’ currently required under ‘‘Critical Asset,’’ ‘‘Deorbit,’’ ‘‘Dose- would be modified to remove language §§ 415.123(b)(8) and 417.123(d). The Response Relationship,’’ ‘‘Disposal,’’ that further scopes what aspects of rationale for this proposed section is the ‘‘Effective Casualty Area,’’ ‘‘Expected space transportation are licensed, as same as that for proposed Casualty,’’ ‘‘Flight Abort,’’ ‘‘Flight Abort discussed earlier. Scoping language § 450.111(d)(4). Rules,’’ ‘‘Flight Hazard Area,’’ ‘‘Liftoff,’’ would be transferred to proposed Proposed § 450.111(g)(3) would ‘‘Limits of a Useful Mission,’’ ‘‘Orbital § 450.3. ‘‘Safety Critical’’ would be require an operator to develop and Insertion,’’ and ‘‘Probability of modified to remove the last sentence implement software development plans Casualty.’’ Most important within that because it is unnecessary. The as required in existing §§ 415.123(b)(9) group are ‘‘Critical Asset,’’ which is definition for ‘‘State and United States’’ and 417.123(e)(1) through (5). The same driven by proposed protection criteria would fix a minor printing error. rationale applies here as for proposed for assets that are essential to the Section 417.3 contains the definitions § 450.111(d)(5), (e)(5), and (f)(4). national interests of the United States, for part 417, only some of which would Proposed § 450.111(h) would retain and ‘‘Disposal,’’ which is driven by be preserved and added to § 401.5 by the application requirements of proposed upper stage disposal risk this proposed rulemaking. These are §§ 415.123 and 417.123, but would vary criteria. The other terms and associated ‘‘Command Control System,’’ in the required amount of detail definitions that would be added to ‘‘Countdown,’’ ‘‘Crossrange,’’ ‘‘Data Loss according to the level of control of the support proposed §§ 450.113 through Flight Time,’’ ‘‘Downrange,’’ ‘‘Explosive software. The amount of application 450.139 are referenced in the proposed Debris,’’ ‘‘Flight Abort Crew,’’ ‘‘Flight materials would depend on the software FSA requirements. Safety Limit,’’ ‘‘Gate,’’ ‘‘Launch component’s risk to safety. The proposal The proposed system safety Window,’’ ‘‘Normal Flight,’’ ‘‘Normal would differ from § 431.35 by expressly regulations would require the addition Trajectory,’’ ‘‘Operating Environment,’’ requiring documentation related to of the following terms and associated ‘‘Operation Hazard,’’ ‘‘Service Life,’’ computing systems and software. This definitions: ‘‘Hazard Control’’ and ‘‘System Hazard,’’ ‘‘Sub-Vehicle Point,’’ requirement was implicit in § 431.35 ‘‘Launch or Reentry System.’’ Proposed ‘‘Tracking Icon,’’ and ‘‘Uprange.’’ A and the FAA has requested these § 450.101(a)(1) and (b)(1) would require number of changes have been made as documents in practice. The FAA would a definition for ‘‘Neighboring follows: require descriptions of software Operations Personnel’’; proposed • ‘‘Command Control System’’ would components with no safety impact but § 450.107(b) would require a clear be modified to take out unnecessary would not impose process requirements. definition of ‘‘Physical Containment’’; detail. proposed § 450.111 would require a This information would be required to • ‘‘Countdown,’’ ‘‘Downrange,’’ definition for ‘‘Control Entity’’ and supplement the vehicle description ‘‘Explosive Debris,’’ and ‘‘Normal ‘‘Software Function’’; proposed requirements contained elsewhere in Flight’’ would be modified to add §§ 450.139 and 450.187 would require a this proposal. It would also lead to a reentry. definition for ‘‘Toxic Hazard Area.’’ shared understanding of the systems • ‘‘Crossrange,’’ ‘‘Launch Window,’’ and components that do not have Proposed § 450.101(c) would require the addition of ‘‘Vehicle Response Mode.’’ ‘‘Normal Trajectory,’’ ‘‘Service Life,’’ known safety significance allowing the and ‘‘System Hazard’’ would be FAA only cursorily to review those The collision avoidance requirements in proposed § 450.169 would require the unchanged. systems during the license application • The term ‘‘Flight Abort Crew’’ evaluation without undue concern over addition of ‘‘Reentry Window’’ and ‘‘Window Closure’’ to § 401.5, while the would be changed from ‘‘Flight Safety undocumented systems, functions, or Crew,’’ and would be simplified. features. unguided suborbital requirements in • proposed § 450.141 would require the ‘‘Operating Environment’’ would be C. Changes to Parts 401, 413, 414, 420, addition of ‘‘Unguided Suborbital changed to add reentry, and would use 437, 440 Launch Vehicle’’ and ‘‘Wind Weighting the term ‘‘lifecycle’’ within the Safety System.’’ definition instead of the limiting 1. Part 401—Definitions These new definitions are discussed reference to acceptance testing, launch The FAA proposes to modify in detail in corresponding sections of countdown, and flight. definitions in parts 401, 414, 417, 420, this preamble, including the proposed • ‘‘Operation Hazard’’ would be 437, and 440. This would include meaning and usage. modified to clarify that a system hazard adding new definitions to or modifying Current § 401.5 definitions that would is not an operation hazard. current definitions in § 401.5 be modified by this rule are as follows: • The term ‘‘Protected Area’’ would (Definitions) to align with the new ‘‘Contingency Abort,’’ which would be be removed, and the term ‘‘Uncontrolled proposed regulations. The FAA also simplified; ‘‘Flight Safety System,’’ Area’’ would be added to § 401.5 but proposes to clarify and move some of which would be simplified to with the inclusion of a launch or reentry the definitions that are currently in part incorporate the new term ‘‘Flight site operator, an adjacent site operator, 417 to proposed part 450. Also, the Abort;’’ and ‘‘Instantaneous Impact or other entity by agreement who can proposal would not retain some of the Point,’’ which would remove drag control an area of land. definitions currently in part 417. effects and clarify that this term means • The term ‘‘Service life’’ would be Finally, the FAA proposes to remove a predicted impact point. ‘‘Mishap’’ changed to replace reference to a flight various current definitions from would be defined as having four classes termination system component with any §§ 401.5 and 420.5. or categories, from most to least severe, safety-critical system component. The FAA proposes to add new based on lessons learned as discussed • The last sentence in ‘‘Sub-Vehicle definitions to § 401.5. These definitions earlier in this preamble. The current Point’’ and ‘‘Uprange’’ would be

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00108 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15403

removed because these sentences are 2. Part 413—Application Procedures email as a link to a secure server, and unnecessary. i. § 413.1 Clarification of the Term remove the requirement that an • ‘‘Tracking Icon’’ would be modified ‘‘Application’’ application be in a format that cannot be to include autonomous flight safety altered. systems. The FAA proposes to modify § 413.1 In 2015, the FAA published the • ‘‘Data Loss Flight Time,’’ ‘‘Flight to clarify the term ‘‘application.’’ ‘‘Electronic Applications for Licenses, Safety Limit,’’ and ‘‘Gate’’ would be Specifically, the FAA would add to Permits, and Safety Approvals’’ rule.216 changed as discussed earlier in this § 413.1 that the term application means In that rule, the FAA made the preamble. either an application in its entirety, or application process more flexible and In part 414, ‘‘Safety Approval’’ would a portion of an application for efficient by providing an applicant with be changed to ‘‘Safety Element incremental review and determination the option to submit applications to the Approval,’’ so that a part 414 approval in accordance with § 450.33. This FAA electronically, either via email or is not confused with a proposed part change is necessary to enable on an electronic storage device, rather 450 safety approval. Its meaning, incremental review as discussed earlier. than submitting a paper application. however, would remain the same as Specifically, § 413.7(a)(3) requires that ii. § 413.21 Denial of a License or discussed earlier in this preamble. an application made via email be Permit Application The definition of ‘‘Maximum Probable submitted as an email attachment to Loss (MPL)’’ in § 440.3 would be The FAA proposes to correct the [email protected] in a format modified to include Neighboring section heading of § 413.21 to reflect the that cannot be altered. The FAA’s intent Operations Personnel. content of the section, and also correct was to allow applicants to transact with The definition of ‘‘Anomaly’’ would paragraph (c) of this section to reference the agency electronically, in accordance be removed from part 437 and added to both license and permit applications. with the Government Paperwork § 401.5 with a revised meaning. Section 413.21 applies to a license or Elimination Act. However, since the Definitions that would not be retained permit application. However, the rule published, the FAA has found that from part 417 are ‘‘Command Destruct section heading and paragraph (c) of many of the files containing the Systems,’’ ‘‘Conjunction on Launch,’’ this section only reference ‘‘license.’’ To necessary application materials are too ‘‘Destruct,’’ ‘‘Drag Impact Point,’’ correct this oversight, the FAA proposes large to be transmitted successfully by ‘‘Dwell Time,’’ ‘‘Fail-Over,’’ ‘‘Family to revise the section heading to read, email. When this occurs, applicants Performance Data,’’ ‘‘Flight Safety ‘‘Denial of a license or permit have transmitted an email message with System,’’ ‘‘Flight Termination System,’’ application.’’ In addition, the FAA a File Transfer Program (FTP) link or a ‘‘Inadvertent Separation Destruct proposes to remove the reference to link to a digital repository where the System,’’ ‘‘In-Family,’’ ‘‘Launch ‘‘license’’ from paragraph (c) so that it materials can be downloaded by the Azimuth,’’ ‘‘Launch Crew,’’ ‘‘Launch would apply to both license and permit FAA. The FAA has found this to be an Wait,’’ ‘‘Meets Intent Certification,’’ applications. acceptable means of submitting an ‘‘Non-Operating Environment,’’ application. Because the FAA proposes ‘‘Operating Life,’’ ‘‘Out-of-Family,’’ iii. ‘‘Complete Enough’’ and ‘‘Sufficiently Complete’’ to amend application procedures in this ‘‘Passive Component,’’ ‘‘Performance rulemaking, the FAA also proposes to Specifications,’’ ‘‘Safe-Critical Computer The FAA proposes to change the term align the regulations with the current System Function,’’ ‘‘Storage Life,’’ and ‘‘sufficiently complete’’ in part 414 to acceptable practice of allowing this form ‘‘Waiver.’’ These would no longer be a ‘‘complete enough,’’ as used in § 413.11, of electronic application submission. part of commercial space regulations because the two terms mean the same Accordingly, the FAA proposes to because they have been replaced with thing. That is, they both describe the amend § 413.7(a)(3) to allow an different terms (i.e., ‘‘Conjunction on point at which the FAA has determined applicant the option to submit its Launch’’ and ‘‘Launch Wait’’), are it has sufficient information to accept an application by email as a link to a already defined in § 401.5 (i.e., ‘‘Flight application and begin its evaluation to secure server. Safety System’’), or are simply not used make findings regarding issuing a Additionally, the 2015 rulemaking (all others). license or permit. identified that in requiring a file format This proposed rule would also Section 413.11 uses ‘‘complete that could not be altered, the FAA remove from § 401.5, ‘‘Human Space enough’’ to describe when the FAA will would accept a PDF document or a read- Flight Incident,’’ ‘‘Launch Accident,’’ accept an application and begin its only Word file. Because both of these ‘‘Launch Incident,’’ ‘‘Reentry Accident,’’ review for a launch license or permit. file types can actually be modified, the and ‘‘Reentry Incident.’’ In addition, it The original intent was to use the same FAA has found it is impossible to would remove ‘‘Launch Site Accident’’ term in other chapter III sections. comply with the requirement in from § 420.5. These definitions would However, the term ‘‘sufficiently § 413.7(a)(3)(ii). However, the need for be removed because of the proposed complete’’ in §§ 414.15(a), 415.107(a), document and version control of changes in definitions related to and 417.203(c) was never changed to applications still exists for accurate mishaps. The proposed rule would also ‘‘complete enough.’’ record keeping and to ensure that the remove from § 401.5 ‘‘Emergency Therefore, the agency proposes to application materials the FAA evaluates Abort,’’ because it is no longer in use, change the term ‘‘sufficiently complete’’ and enforces represent the final and and ‘‘Vehicle Safety Operations to ‘‘complete enough’’ for consistency accurate submission from the applicant Personnel,’’ because those personnel are and clarity. The proposed change would and have not been altered in any way. referred to as ‘‘Safety Critical be made in part 414 and in proposed As nearly every form of electronic file Personnel’’ in proposed part 450. part 450, since parts 415 and 417 would submitted could be altered in some way The FAA also proposes to remove the be consolidated under this new part. or another, the FAA proposes to replace definition of ‘‘Instantaneous Impact the current § 413.7(a)(3)(ii) with a new Point’’ from § 420.5. This definition iv. Electronic Submission would be removed because a new This rule proposes to amend 216 Electronic Applications for Licenses, Permits, definition with a modified meaning § 413.7(a)(3) to allow an applicant the and Safety Approvals, Direct Final Rule. 80 FR would be added to § 401.5. option to submit its application by 30147 (May 27, 2015).

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00109 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15404 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

requirement that an applicant’s email ‘‘Mishap Plan,’’ and modify the section 104–4) requires agencies to prepare a submission would be required to as discussed earlier. Further, it would written assessment of the costs, benefits, identify each document appended to the make a minor edit in § 420.51. and other effects of proposed or final email, including any that are included rules that include a Federal mandate 5. Part 433—License To Operate a likely to result in the expenditure by as an attachment or that are stored on Reentry Site a secure server. The FAA further State, local, or tribal governments, in the proposes to include a new As discussed earlier, the proposal aggregate, or by the private sector, of § 413.7(a)(3)(iii) which would require all would modify the environmental $100 million or more annually (adjusted electronic files be date stamped and requirements in §§ 433.7 and 433.9 to for inflation with base year of 1995). include version control documentation. align them with the environmental The FAA has provided a more detailed The replacement of § 413.7(a)(3)(ii) and requirements in proposed § 450.47. Preliminary Regulatory Impact Analysis the addition of § 413.7(a)(3)(iii) would 6. Part 437—Experimental Permits of the benefits and costs of this further the FAA’s intent to prevent any proposed rule in the docket of this As discussed earlier, the FAA unrecognized alteration. rulemaking. This portion of the The proposed amendments to proposes to modify part 437 preamble summarizes this analysis. (Experimental Permits) in six ways. § 414.13(a)(3) would mirror the In conducting these analyses, the FAA First, the proposal would remove the proposed text of § 413.7(a)(3). The FAA has determined that this proposed rule: definition of ‘‘anomaly’’ from § 437.3 also proposes to remove § 414.11(a)(3) (1) Has benefits that justify its costs, (2) and include a modified version in because those requirements would be is not an economically ‘‘significant § 401.5. Second, the proposal would addressed in the proposed text of regulatory action’’ as defined in section modify the environmental requirements § 414.13(a)(3). These changes would 3(f) of Executive Order 12866, (3) is in § 437.21(b)(1) to match the remove unactionable application ‘‘significant’’ as defined in DOT’s environmental requirements proposed requirements and replace them with Regulatory Policies and Procedures, (4) in § 450.47. Third, it would change the regulations that align with current will have a significant economic impact name of ‘‘safety approval’’ to ‘‘safety practice and practicable compliance. on a substantial number of small element approval’’ in § 437.21. Fourth, The FAA also proposes to change the entities, (5) will not create unnecessary it would modify the mishap plan heading of part 413 from ‘‘License obstacles to the foreign commerce of the requirements in §§ 437.41 and 437.75. Application Procedures’’ to United States, and (6) will not impose Fifth, it would change the requirements ‘‘Application Procedures.’’ The an unfunded mandate on state, local, or for collision avoidance to match tribal governments, or on the private proposed heading change reflects the proposed § 450.169. Sixth, it would multiple application procedures under sector by exceeding the threshold allow for alternate time frames in identified earlier. These analyses are part 413, which includes launch and § 437.89. reentry licenses, launch and reentry site summarized below. licenses, and experimental permits. The 7. Part 440—Financial Responsibility Baseline Problem and Statement of FAA proposes this title change to As discussed earlier, the FAA Need improve the regulatory clarity for future proposes to modify § 440.15 to allow for The FAA is proposing this experimental permit applicants. alternate time frames, and modify the deregulatory action to comply with 3. Part 414—Safety Element Approvals definition of ‘‘maximum probable loss’’ President Donald J. Trump’s Space in § 440.3 to align it with the new, As discussed earlier, the FAA Policy Directive-2 (SPD–2) proposed definition of ‘‘neighboring ‘‘Streamlining Regulations on proposes to change the part 414 term operations personnel.’’ from ‘‘safety approval’’ to ‘‘safety Commercial Use of Space.’’ The element approval’’ to distinguish it from IV. Regulatory Notices and Analyses directive instructed the Secretary of Transportation to publish for notice and ‘‘safety approval’’ as used in parts 415, A. Regulatory Evaluation comment, proposed rules rescinding or 431, and 435, and proposed part 450. revising the launch and reentry Also, the FAA proposes to modify part Changes to Federal regulations must licensing regulations. Section 2 of SPD– 414 to enable applicants to request a undergo several economic analyses. 2 charged the Department of safety element approval in conjunction First, Executive Order 12866 and Transportation with revising regulations with a license application as provided Executive Order 13563 direct that each federal agency shall propose or adopt a to require a single license for all types in proposed part 450.217 regulation only upon a reasoned of commercial space flight operations 4. Part 420—License To Operate a determination that the benefits of the and replace prescriptive requirements Launch Site intended regulation justify its costs. with performance-based criteria. The As discussed earlier, the proposal Second, the Regulatory Flexibility Act subject proposed rule would implement would modify the environmental of 1980 (Pub. L. 96–354) requires this section of SPD–2. The FAA’s existing regulations have requirements in § 420.15 to match the agencies to analyze the economic been criticized as overly-prescriptive, environmental requirements in impact of regulatory changes on small lacking sufficient clarity, outdated, and proposed § 450.47. Also, the proposal entities. Third, the Trade Agreements inconsistent with the requirements of would remove the definitions of Act (Pub. L. 96–39 as amended) other Government agencies. The ‘‘instantaneous impact point,’’ ‘‘launch prohibits agencies from setting regulations for ELV launches in parts site accident,’’ and ‘‘public’’ from standards that create unnecessary obstacles to the foreign commerce of the 415 and 417 have proven to be too § 420.5, and allow alternate time frames United States. In developing U.S. prescriptive and one-size-fits-all. The in § 420.57. In addition, it would change standards, the Trade Agreements Act requirements of these parts were written the heading of § 420.59 from ‘‘Launch requires agencies to consider in a very detailed fashion, which has Site Accident Investigation Plan’’ to international standards and, where caused some sections to become 217 Discussion on safety element approval appropriate, that they be the basis of outdated or obsolete. In contrast, the changes to part 414 can be found in the Process U.S. standards. Fourth, the Unfunded regulations for RLV launches have Improvements section A portion of this preamble. Mandates Reform Act of 1995 (Pub. L. proven to be too general, lacking

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00110 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15405

regulatory clarity. For example, part 431 replace many prescriptive regulations rate of 3%). These cost savings are does not contain specificity regarding with performance-based regulations, described in more detail below. the qualification of flight safety systems, giving industry greater flexibility to The FAA proposes to move from acceptable methods for flight safety develop a means of compliance that prescriptive flight safety system analysis, and ground safety maximizes their business objectives. requirements to performance-based requirements. This proposed rule would result in net requirements. As a result, the proposed The purpose of the proposed rule is cost savings for industry and enable rule would not require all launch to streamline and simplify the licensing future innovation in U.S. commercial vehicles to have a full flight safety of launch and reentry operations by space transportation. system. Launch vehicles that have a relying on performance-based Affected Operators and Launches very low probability of multiple regulations rather than prescriptive casualties even if vehicle control fails regulations. This action would At the time of writing based on FAA would not be required to have a flight consolidate and revise multiple license data, the FAA estimates this safety system. In addition, vehicles that commercial space launch and reentry proposed rule would affect 12 operators have moderately low probability of regulations addressing licensing into a that have an active license or permit to casualty even if vehicle control fails single regulatory part that states safety conduct launch or reentry operations. In would not be required to have robust objectives to be achieved for the launch addition, the FAA estimates this flight safety systems.219 These of suborbital and orbital expendable and proposed rule would affect performance-based requirements would reusable launch vehicles, and the approximately 276 launches over the reduce costs for some vehicle operators, reentry of reentry vehicles. This action next 5 years based on actual launch and especially for small vehicles or those would also enable flexible timeframes, reentry numbers and forecasted operating in remote locations. remove unnecessarily burdensome numbers.218 The FAA anticipates that The proposed rule would provide a ground safety regulations, redefine the proposed rule would reduce the new definition of neighboring when launch begins to allow specified costs of current and future launch operations personnel and establish new pre-flight operations prior to license operations by removing current criteria for neighboring launch site approval, and allow applicants to seek prescriptive requirements that are often personnel for the purposes of risk and a license to launch from multiple sites. burdensome to meet or require a waiver. financial responsibility. The change This proposal is necessary to reduce the The FAA expects these changes would would allow affected operators to need to file and process waivers, lead to more efficient launch operations potentially reduce the number of improve clarity of the regulations, and and have a positive effect on expanding personnel that have to evacuate and relieve administrative and cost burdens the number of future launch and reentry enable more concurrent operations by on industry and the FAA. The intended operations. accepting a small safety risk tradeoff. effect of this action is to make The FAA has monetized the value of commercial space transportation Summary of Impacts this small increased safety risk as regulations more efficient and effective, Over a 5-year period of analysis, this while maintaining public safety. summarized in the following tables. The Since the last comprehensive update proposed rule would result in net FAA estimates the present value of to the regulations in 2006, the present value cost savings to industry of these small increased safety risks to be differences between ELVs and RLVs about $19 million using a 7% discount about $1.4 million discounted at 7% or have blurred. Vehicles that utilize rate or about $21 million using a 3% about $1.5 discounted at 3% over the traditional flight safety systems now are discount rate, with annualized net cost five years. partially reusable. For example, the savings to industry of about $4.6 million The FAA estimates some small costs Falcon 9 first stage, launched by Space using either discount rate. This to industry that would assist both Exploration Technologies Corp. proposed rule would also result in net industry and the FAA in the (SpaceX), routinely returns to the present value savings for FAA of about implementation of this proposed rule, launch site or lands on a barge and other $0.8 million using a 7% discount rate or such as providing information to the operators are developing launch about $1 million using a 3% discount FAA that other agencies frequently vehicles with similar capabilities. rate, with annualized net cost savings to request or performing one-time updates Although the reuse of safety critical FAA of about $0.2 million using either of flight safety limit analyses and systems or components can have public discount rate. ground hazard analyses that would be safety implications, labeling a launch The largest quantified cost savings for used to determine performance-based vehicle as expendable or reusable has industry would result from eliminating means of compliance that provide future not shown to impact the primary or relaxing requirements for a flight savings. In addition, there may be approach necessary to protect public safety system on some launches (about additional costs for the modification of safety, certainly not to the extent $11 million in present value savings existing licenses to benefit from the cost suggested in the differences between over 5 years at a discount rate of 7% or saving provisions of this proposed rule. part 431 and parts 415 and 417. about $12 million at a discount rate of The FAA would also incur small costs This deregulatory action would 3%) and from reducing the number of for payload review, ground hazard consolidate and revise multiple personnel that would have to be analysis, and the review of commercial space regulatory parts to evacuated from neighboring launch sites modifications to existing licenses. apply a single set of licensing and safety (about $8 million in present value The following table summarizes total regulations across several types of savings over 5 years at a discount rate quantified savings, costs, and net operations and vehicles. It would also of 7% or about $9 million at a discount impacts.

218 See the Preliminary Regulatory Impact by this proposed rule for a 5-year period of analysis 219 See discussion in the preamble regarding Analysis of this proposed rule in the docket for due to the rapidly changing environment of being compliant with the flight safety systems of more information. The FAA Office of Commercial commercial space transportation. part 417. Space Transportation derived the launches affected

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00111 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15406 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

SUMMARY OF TOTAL 5-YEAR QUANTIFIED SAVINGS, COSTS AND NET IMPACTS [Presented in thousands of dollars]

Industry Industry FAA present FAA present Impact present value present value value value (7%) (3%) (7%) (3%)

Cost Savings ...... $19,386.1 $21,844.5 $1,045.7 $1,208.9 Costs ...... ¥542.6 ¥569.5 ¥222.3 ¥237.0

Net Cost Savings ...... 18,843.5 21,275.0 823.4 971.8

Annualized Net Cost Savings ...... 4,595.7 4,645.5 200.8 212.2

Increased Safety Risks ...... ¥1,370.2 ¥1,540.6 ......

Net Cost Savings less Increased Safety Risks ...... 17,473.3 19,734.4 823.4 971.8

Annualized Net Cost Savings less Increased Safety Risks ...... 4,261.6 4,309.1 200.8 212.2 Table notes: The sum of individual items may not equal totals due to rounding. Negative signs are used to indicate costs and increased safety risks in this table. Present value estimates provided at 7% and 3% per OMB guidance.

The following table summarizes quantified impacts by provision category.

SUMMARY OF 5-YEAR QUANTIFIED SAVINGS, COSTS AND NET IMPACTS BY PROVISIONS [Presented in thousands of dollars]

Industry Industry FAA FAA Provision category/impact present value present value present value present value (7%) (3%) (7%) (3%)

Waiver Avoidance: —Definition of Launch ...... $32.8 $36.7 $10.3 $11.5 —Waterborne Vessel Hazard Areas ...... 65.6 73.3 20.5 22.9 —Waiver for 48 Hour Readiness ...... 41.0 45.8 12,8 14.3 System Safety Program—Safety Official ...... 39.1 43.7 45.7 51.0 Duration of a Vehicle License ...... 50.6 56.5 104.3 116.5 Readiness—Elimination of pre-launch meeting 15 days prior ...... 709.9 799.0 127.7 143.6 Flight Safety System—Not required for all launches ...... 10,612.6 11,981.3 572.5 679.2 Flight Safety Analysis no longer required for hybrids ...... 22.1 25.0 2.8 3.2 Neighboring Operations * ...... 7,698.9 8,656.7 ...... Ground Hazard Analysis...... 113.3 126.6 149.2 166.6

Total Cost Savings ...... 19,386.1 21,844.5 1,045.7 1,208.9

Payload Review and Determination ...... ¥45.6 ¥51.2 ¥46.4 ¥52.2 Flight Safety Limit Analysis ...... ¥157.7 ¥163.8 ...... Ground Hazard Analysis ...... ¥24.0 ¥26.8 ¥27.2 ¥30.4 Modification Costs for Existing Licenses ...... ¥315.4 ¥327.6 ¥148.7 ¥154.5

Total Costs ...... ¥542.6 ¥569.5 ¥222.3 ¥237.0

Net Cost Savings ...... 18,843.5 21,275.0 823.4 971.8

Annualized Net cost Savings ...... 4,595.7 4,645.5 200.8 212.2

Increased Safety Risks: Neighboring Operations * ...... ¥1,370.2 ¥1,540.6 ......

Net Cost Savings less Increased Safety Risks ...... 17,473.3 19,734.4 823.4 971.8

Annualized Net Cost savings Less Increased Safety Risks ...... 4,261.6 4,309.1 200.8 212.2 * Changes to Neighboring Operations requirements result in net savings less increased safety risks. Table notes: The sum of individual items may not equal totals due to rounding. Negative signs are used to indicate costs and increased safety risks in this table. Present value estimates provided at 3% and 7% per OMB guidance.

The FAA also expects industry will requirements that would reduce the The following table summarizes some gain additional unquantified savings future cost of innovation and improve of the proposed changes that would and benefits from the proposed rule, the efficiency and productivity of U.S. result unquantified savings. since it provides flexibility and commercial space transportation. scalability through performance-based

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00112 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15407

UNQUANTIFIED SAVINGS

Change Savings

Time Frames ...... The proposal would revise time frames in parts 404, 413, 414, 415, 417, 420, 431, 437, and 440 that may be bur- densome for some operators. This would increase flexibility by allowing an operator the option to propose alter- native time frames that better suit their operations. Eligible time frames include preflight and post-flight reporting among others listed in proposed Appendix A to Part 404—Alternative Time Frames. Safety Element Approval The proposal would remove the requirement in part 414 to publish in the Federal Register the criteria upon which safety element approvals were based. The purpose of this notification requirement was to make clear the criteria and standards the FAA used to assess a safety element, particularly when no clear regulatory requirement existed and there could be other potential users of the safety approval. However, the FAA has found that this requirement is unnecessary, and has potentially discouraged applications for safety element approvals due to concerns that propriety data may be disclosed. FAA anticipates that removing this requirement will lead to increased use of safe- ty element approvals, reducing industry burden and potentially improving safety. Mishaps ...... The proposal would provide the following mishap-related enhancements, which FAA expects to better tailor mishap responses. • Replace current part 400 mishap related definitions with a consolidated mishap classification system (streamlines and reduces confusion). • Consolidate existing part 400 mishap/accident investigation and emergency response plan requirements into a single part (streamlines and reduces confusion). • Exempt pre-coordinated test-induced property damage from being a mishap (removes need to consider test-in- duced property damages from mishap requirements and likely results in fewer investigations of minor mishaps). • This proposal also eliminates the small $25,000 monetary threshold from the current mishap and accident inves- tigation requirements potentially reducing the number of mishaps being investigated that do not pose a threat to public safety. A minor damage that does not pose a threat to public safety can easily exceed the $25,000 mone- tary threshold, triggering potentially costly and burdensome notification, reporting, and investigation requirements. Toxics ...... The proposal would replace part 417 toxic release hazard analysis requirements with performance-based regulations that would provide flexibility for operators to comply with the required risk criteria in varied and innovative ways rel- ative to their operations. Lightning protection re- The proposal would remove appendix G to part 417, Natural and Triggered Lightning Flight Commit Criteria, and re- quirement. place it with the performance-based requirements. The current requirements are outdated, inflexible, overly con- servative, and not explicitly applicable to RLVs and RVs. The proposed revision would provide an operator with more flexibility, and allow it to take into account the vehicle’s mission profile when determining how to mitigate the direct and indirect effects of a lightning discharge.

The FAA intends to update its including small businesses, not-for- days with a plan to remove barriers to analysis with additional information profit organizations, and small commercial space enterprises. and data identified during the comment governmental jurisdictions. The Council approved four period to better assess the impacts of Agencies must perform a review to recommendations, including the this deregulatory action. Estimates may determine whether a rule will have a Department of Transportation’s change for the final rule as a result. significant economic impact on a recommendation that the launch and The FAA invites comments on the substantial number of small entities. If reentry regulations should be reformed benefits, savings, or costs of this the agency determines that it will, the into a consolidated, performance-based proposed rule. Send comments by any agency must prepare a regulatory licensing regime. of the methods identified under flexibility analysis as described in the Codifying the recommendations of the Addresses in this proposed rule. RFA. Council, SPD–2 was issued on May 24, Specifically, the FAA requests Under Section 603(b) of the RFA, the 2018. SPD–2 instructed the Secretary of information and data that can be used initial regulatory flexibility analysis for Transportation to publish for notice and a proposed rule must: to quantify the additional savings of this • comment proposed rules rescinding or proposed rule. Please provide references Describe reasons the agency is revising the launch and reentry considering the action; and sources for information and data. • licensing regulations, no later than State the legal basis and objectives; February 1, 2019. SPD–2 charged the B. Regulatory Flexibility Determination • Describe the recordkeeping and Department with revising the other compliance requirements; The Regulatory Flexibility Act of 1980 • State all federal rules that may regulations such that they would require (Pub. L. 96–354) (RFA) establishes ‘‘as a duplicate, overlap, or conflict; a single license for all types of principle of regulatory issuance that • Describe an estimated number of commercial space flight operations and agencies shall endeavor, consistent with small entities impacted; and replace prescriptive requirements with the objectives of the rule and of • Describe alternatives considered. performance-based criteria. The current applicable statutes, to fit regulatory and action is complying with this informational requirements to the scale 1. Description of Reasons the Agency Is recommendation. of the businesses, organizations, and Considering the Action Current regulations setting forth governmental jurisdictions subject to The Chair of the National Space procedures and requirements for regulation. To achieve this principle, Council, the Vice President, directed the commercial space transportation agencies are required to solicit and Secretaries of Transportation and licensing were based largely on the consider flexible regulatory proposals Commerce, and the Director of the distinction between expendable or and to explain the rationale for their Office of Management and Budget, to reusable launch vehicles. Specifically, actions to assure that such proposals are conduct a review of the U.S. regulatory 14 CFR parts 415 and 417 address the given serious consideration.’’ The RFA framework for commercial space launch of expendable launch vehicles, covers a wide-range of small entities, activities and report back within 45 part 431 addresses the launch and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00113 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15408 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

reentry of reusable launch vehicles, and specified below. However, the agency is the completion of any Federal part 435 addresses the reentry of reentry proposing to consolidate these investigation and the FAA has notified vehicles. requirements into a new, proposed part the licensee that the records need not be The regulations in parts 415 and 417 450 (Launch and Reentry License retained. The licensee would be are based on the Federal launch range Requirements); clarify that the required to make all records required to standards developed in the 1990s. Parts consolidated requirements apply to any be maintained under the regulations 431 and 435 are primarily process- licensed launch or reentry; and make available to Federal officials for based, relying on a license applicant to other minor, clarifying edits. The inspection and copying. derive safety requirements through a following is a summary of the proposed ‘‘system safety’’ process. While these changes: 4. All Federal Rules That May regulations satisfied the need of the Duplicate, Overlap, or Conflict commercial launch industry at the time i. Public Safety Responsibility and No other federal rules duplicate, Compliance With License they were issued, the industry has overlap, or conflict with FAA’s launch changed and continues to evolve, thus The FAA would consolidate the and reentry licensing requirements. rendering the current regulatory public safety responsibility structure cumbersome and outdated. requirements in current §§ 417.7 and 5. Description and an Estimated Number 431.71(a) into proposed § 450.201, of Small Entities Impacted 2. Statement of the Legal Basis and Public Safety Responsibility. Also, the The FAA has identified two potential Objectives FAA would move the compliance small entities that this proposed rule The Commercial Space Launch Act of requirement in current § 431.71(b) to its would impact, Vector Launch, Inc. and 1984, as amended and re-codified at 51 own section, proposed § 450.203 Generation Orbit. Both operators U.S.C. 50901–50923 (the Act), (Compliance with License). Although employ fewer than 1,500 people and authorizes the Department of the location of these requirements both were in pre-application Transportation, and the FAA through would change, the requirements consultation to launch under parts 415 delegation, to oversee, license, and themselves would not change. and 417 at the time of this writing.220 regulate commercial launch and reentry Therefore, proposed § 450.201 would These two companies are the only small activities, and the operation of launch provide that a licensee is responsible for entities identified in this analysis that and reentry sites as carried out by U.S. ensuring public safety and safety of may be directly affected by this citizens or within the United States. property during the conduct of a proposed rule. Section 50905 directs the FAA to licensed launch or reentry. And exercise this responsibility consistent proposed § 450.203 would require that a 6. Alternatives Considered with public health and safety, safety of licensee conduct a licensed launch or The FAA considered three property, and the national security and reentry in accordance with alternatives to the proposed rule. foreign policy interests of the United representations made in its license i. No Change to Current Regulations States. The FAA is authorized to application, the requirements of part regulate only to the extent necessary to 450, subparts C and D, and the terms This alternative was not chosen protect the public health and safety, and conditions contained in the license. because the current regulations are safety of property, and national security A licensee’s failure to act in accordance outdated, prescriptive, and do not and foreign policy interests of the with these items would be sufficient adequately reflect industry current United States. In addition, section basis to revoke a license, or some other practices or technology development. 50903 requires that the FAA encourage, appropriate enforcement action. The inefficiency of the licensing process facilitate, and promote commercial due to current regulations risks stifling ii. Records. space launches and reentries by the innovation and growth of the industry, private sector. The FAA would consolidate the especially for small operators. If adopted as proposed, this current record requirements in ii. Propose a More Process-Based rulemaking would streamline and §§ 417.15(a) and (b) and 431.77(a) and Regulatory Approach increase flexibility in the FAA’s (b) into proposed § 450.219(a) and (b). commercial space regulations. This However, the FAA would replace the With this alternative, the FAA would action would consolidate and revise term ‘‘launch accident’’ in paragraph (b) propose less detailed regulations that multiple regulatory parts to apply a with ‘‘class 1 or class 2 mishap.’’ As would rely primarily on the outcome of single set of licensing and safety discussed in more detail in the Part an operator’s system safety process to regulations across several types of 401—Definitions section of this protect public safety. This alternative operations and vehicles. It would also preamble, the FAA is proposing to was not chosen because it would lack replace many prescriptive regulations replace current part 401 definitions regulatory clarity without adding any with performance-based rules, giving involving ‘‘accident,’’ ‘‘incident,’’ and additional flexibility for a launch or industry greater flexibility to develop ‘‘mishap’’ with specified mishap reentry operator which may be more means of compliance that maximize classes. burdensome to small operators their business objectives while As such, the proposed regulation compared to large operators. would require a licensee to maintain, for maintaining an equivalent level of safety iii. Propose a Defined Modular 3 years, all records, data, and other to the agency’s current regulations. Application Process Because this rulemaking would amend material necessary to verify that a the FAA’s launch and reentry launch or reentry is conducted in With this alternative, the FAA would requirements, it falls under the accordance with representations propose similar safety requirements but authority delegated by the Act. contained in the licensee’s application. would add a more defined incremental The exception would be for a class 1 or 3. Description of the Recordkeeping and class 2 mishap, where a licensee would 220 The FAA uses the current Small Business Other Compliance Requirements Administration size standard of 1,500 employees be required to preserve all records for passenger and freight air transportation. This The FAA is not proposing any related to the event. These records information is found in https://www.sba.gov/sites/ substantive changes to the requirements would be required to be retained until default/files/files/Size_Standards_Table_2017.pdf.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00114 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15409

or modular application process. The Costs Implicit Price Deflator for Gross current proposal enables an incremental i. Payload Review and Determination Domestic Product from the U.S. Bureau application process, but does not define (§ 450.43) of Economic Analysis. This proposed one with explicit modules and time rule does not contain such a mandate; frames. This alternative was not chosen The proposed rule could cause small therefore, the requirements of Title II of because the FAA has no experience operators to incur about $204 more per the Act do not apply. launch than due to additional payload with an incremental or modular E. Paperwork Reduction Act application process with which to base review and determination costs. The Paperwork Reduction Act of 1995 a proposal. In addition, a more defined ii. Ground Hazard Analysis (§ 450.185) incremental or modular application (44 U.S.C. 3507(d)) requires that the RLV applicants might incur about process may be less flexible and scalable FAA consider the impact of paperwork $3,000 more per application due to and therefore more burdensome to small and other information collection having to perform ground hazard operators. burdens imposed on the public. analyses under the proposal. According to the 1995 amendments to The FAA expects this proposed rule The FAA invites comments on this the Paperwork Reduction Act (5 CFR would provide regulatory relief to small initial regulatory flexibility analysis for 1320.8(b)(2)(vi)), an agency may not entities from current prescriptive the proposed rule. Send comments by collect or sponsor the collection of requirements and result in net savings. any of the methods identified under information, nor may it impose an As discussed previously in this Addresses in this proposed rule. information collection requirement section, the FAA identified two possible Specifically, the FAA requests unless it displays a currently valid small entities that would be affected by information and data that can be used Office of Management and Budget this proposed rule but they are in the to quantify savings and costs to small (OMB) control number. pre-application stage for potential ELV operators directly affected by this This action contains the following and RLV launches and we have little proposed rule. Please provide references proposed consolidation of two existing information on how they may comply and sources for information and data. information collection requirements, previously approved under OMB with existing or proposed requirements. C. International Trade Impact Control Numbers 2120–0608 and 2120– As these entities have not begun Assessment operations, we do not have estimates of 0643, under a new OMB control The Trade Agreements Act of 1979 the costs savings or costs that would number. As required by the Paperwork (Pub. L. 96–39), as amended by the reliably apply. However, the following Reduction Act of 1995 (44 U.S.C. Uruguay Round Agreements Act (Pub. are some estimates of per entity cost 3507(d)), the FAA will submit the L. 103–465), prohibits federal agencies savings and costs based on data proposed information collection from establishing standards or engaging representing existing ELV and RLV requirements to OMB for its review. In in related activities that create operators. We note that some of the addition, the FAA has published a unnecessary obstacles to the foreign estimated savings and costs of this separate notice of the proposed commerce of the United States. proposed rule may not apply to these requirements for public comment, and Pursuant to these Acts, the entities. has included the notice in the docket for establishment of standards is not this rulemaking. The notice includes Cost Savings considered an unnecessary obstacle to instructions on how to submit the foreign commerce of the United comments specifically to the proposed i. Readiness—Elimination of Pre-Launch States, so long as the standard has a information collection requirements. Meeting 15 Days Prior (§ 450.155) legitimate domestic objective, such as Additional details on assumptions and ELV operators might save $4,600 per the protection of safety, and does not calculations used in this section are avoided launch readiness meeting, operate in a manner that excludes presented in the Preliminary Regulatory however this assumes the average imports that meet this objective. The Impact Analysis available in the docket number of people at each meeting statute also requires consideration of of this rulemaking. The following would be 25 and this might not apply international standards and, where estimates are included in the total to a small business. appropriate, that they be the basis for savings and costs summarized in the U.S. standards. The FAA has assessed Regulatory Evaluation section and ii. Flight Safety System—Not Required the potential effect of this proposed rule considered in the Regulatory Flexibility for All Launches (§ 450.145) and determined that it will not create Determination section of this proposed unnecessary obstacles to the foreign rule. For launches where an FSS would not commerce of the United States. Summary: The FAA proposes to be required under the proposal, RLV consolidate under a new part 450, the operators might save $195,000 per D. Unfunded Mandates Assessment requirements currently contained in launch vehicle for a vehicle using an Title II of the Unfunded Mandates parts 415 and 417 for the launch of an existing design. An ELV operator might Reform Act of 1995 (Pub. L. 104–4) ELV, in part 431 for the launch and save $680,000 per launch. Both ELV and requires each federal agency to prepare reentry of an RLV, and in part 435 for RLV operators might save an estimated a written statement assessing the effects the reentry of a reentry vehicle other $1.3 million for new vehicle designs by of any Federal mandate in a proposed or than an RLV. The result of this effort not having to incur all the research, final agency rule that may result in an would be streamlined regulations design, testing, materials and expenditure of $100 million or more (in designed to be more flexible and installation costs for an FSS. 1995 dollars) in any one year by State, scalable, with reduced timelines and iii. Ground Hazard Analysis (§ 450.185) local, and tribal governments, in the minimal duplicative jurisdiction. The aggregate, or by the private sector; such net result would be reduced paperwork An ELV operator might save $28,000 a mandate is deemed to be a ‘‘significant for operators, although for some per application by not having to do a regulatory action.’’ The threshold after provisions paperwork would increase. ground hazard analysis under this adjustment for inflation is $150 million Use: The information would be used proposal. using the most current annual (2017) by FAA to evaluate the launch and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00115 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15410 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

reentry operators’ applications and to reduced because an operator would not rate, annual hours, and the cost for each ensure safety. have to modify a license if the specific cost saving provision. Response safety official were to change. In frequency is provided for the estimated Paperwork Impact to Industry addition, with the extension of RLV number of waivers avoided (§ 450.3), Respondents (including number of): licenses to up to five years, it is likely estimated reduction in annual number The information collection would that fewer licenses would be issued, of licenses modified (§ 450.103), potentially affect 12 operators based on resulting in less paperwork. Due to the estimated reduction in annual license available data at the time of writing. change in launch scope, the renewals, and the estimated annual Annual Burden Estimate: Most documentation accompanying a ground number of launches for which there changes in part 450 would result in a hazard analysis for ELV operators would would be a reduction in ground hazard reduction in the paperwork burden. The be reduced. analysis paperwork (§ 450.185). An paperwork associated with industry estimated time for each response is also Industry Cost Savings requesting waivers to certain provisions indicated below, as are burdened hourly would be alleviated. Paperwork The following table indicates the wage rates for the specific personnel associated with industry requesting frequency of responses, the estimated associated with each provision and license modifications would also be time per response, the burdened wage annual hours and total cost savings.

INDUSTRY PAPERWORK COST SAVINGS

Estimated Response time per Industry Annual Cost Description frequency response wage rate hours savings (hours)

Waiver Avoidance (§ 450.3) ...... 17 20 $100.03 340 $34,010 System Safety Program—Safety Official (§ 450.103) ...... 5.6 24 71.01 134.4 9,544 Duration of a Vehicle License (§ 450.7) ...... 1.2 126.5 81.28 151.8 12,338 Ground Safety (§ 450.185) ...... 1 340 81.28 340 27,634

Total Annual Savings ...... 966 83,526

Cost savings includes paperwork alone and in combination with other rate, annual hours, and the cost for each related to waivers avoided due to the materials on the payload for launches, provision that would add burden. definition of launch, waterborne vessel as well as the appropriate transit time to Response frequency is provided for the protection, and removal of 48-hour final orbit for payloads with significant estimated number of explosive potential readiness requirement. transit time after release from vehicle. and transit time calculations, and the The FAA is adding requirements for estimated number of annual RLV Industry Paperwork Burden ground hazard analysis (§ 450.185) for applications which would require Other changes would result in an RLV launches. The proposed rule would ground hazard analysis. An estimated increase in paperwork burden. The require RLVs to submit information to time per response is also indicated Payload Review and Determination the FAA. below, as are burdened hourly wage section (§ 450.43) would add The table below indicates the rates for the specific personnel requirements for applicants to provide frequency of responses, estimated time associated with each provision and explosive potential of payload materials, per response, burdened hourly wage annual hours and total cost savings.

INDUSTRY PAPERWORK BURDEN

Estimated Response time per Industry Annual Cost Description frequency response wage rate hours (hours)

Explosive Potential (§ 450.43) ...... 50 2 $81.28 100 $8,128 Transit time (§ 450.43) ...... 50 0.5 81.28 25 2,032 Ground Safety (§ 450.185) ...... 2 36 81.28 72 5,852

Total Cost Burden ...... 197 16,012

The following table summarizes the savings, total annual burden and the net industry total annual paperwork annual savings.

INDUSTRY NET PAPERWORK SAVINGS

Annual Cost Description hours savings

Total Annual Savings ...... 966 $83,526 Total Annual Burden ...... 197 16,012

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00116 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15411

INDUSTRY NET PAPERWORK SAVINGS—Continued

Annual Cost Description hours savings

Net Annual Savings ...... 769 67,514

Paperwork Burden to the Federal to industry burden savings, the FAA requirement. See the Regulatory Impact Government would receive burden relief from Analysis available in the docket for waivers avoided due to the definition of more details on these estimates and The following tables summarizes FAA launch, waterborne vessel protection, calculations. paperwork savings and burden. Similar and removal of the 48-hour readiness

FAA PAPERWORK COST SAVINGS

Estimated time per FAA Annual Cost Description response wage rate hours savings (hours)

Waiver Avoidance (§ 450.3) ...... 7.5 $83.26 127.5 $10,616 System Safety Program—Safety Official (§ 450.103) ...... 24 82.88 134.4 11,139 Duration of a Vehicle License (§ 450.7) ...... 253.5 83.61 304.2 25,434 Ground Safety (§ 450.185) ...... 439 82.88 439 36,384

Total Annual Savings ...... 1,005 83,573

FAA PAPERWORK BURDEN

Estimated time per FAA Annual Cost Description response wage rate hours savings (hours)

Explosive Potential (§ 450.43) ...... 2.0 $82.88 100 $8,288 Transit time (§ 450.43) ...... 0.5 82.88 25 2,072 Ground Safety (§ 450.185) ...... 40 82.88 80 6,630

Total Annual Burden ...... 205 16,990

FAA NET PAPERWORK SAVINGS

Annual Cost Description hours savings

Total Annual Savings ...... 1,005 $83,573 Total Annual Burden ...... 205 16,990

Net Annual Savings ...... 800 66,583

Voluntary One-Time Modification of license. The FAA assumes overestimates paperwork costs, since Existing Licenses modifications of licenses would occur some operators may not find it within the first year after the rule is advantageous to modify their existing There are currently 24 active licenses effective. The FAA assumes it would licenses. The FAA requests comment on held by 12 operators. Once the rule is take about one month for an industry these assumptions and the following in effect, existing licenses would be aerospace engineer to develop estimates to apply for applications to grandfathered under the current documentation and analysis to apply for modify existing licenses. Specifically, provisions, unless the licenses are a modification of an existing license and the FAA requests information if licenses modified. Operators may choose to about two weeks for an FAA employee holders would modify existing licenses modify their licenses to benefit from the to review an application for a for changes from this proposed rule or cost saving provisions of the proposed modification of an existing license. wait to apply for new licenses. The FAA rule—some operators may choose also The following estimates assume all may revise these assumptions and to wait until they apply for a new licenses would be modified. This estimates for the final rule.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00117 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15412 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

INDUSTRY BURDEN COSTS FOR APPLICATIONS TO MODIFY EXISTING LICENSES

Time Year Wage rate (one month of Cost per Number of Total burden Total costs work hours) * license licenses hours

1 ...... $81.28 173 $14,061 24 4,152 $337,457 * One month of work hours based on the following calculations: 52 work weeks/year × 40 work hours/week = 2,080 work hours/year; and, 2,080 work hours/year ÷ 12 months = 173 work hours/month (rounded).

FAA BURDEN COSTS TO REVIEW APPLICATIONS TO MODIFY EXISTING LICENSES

Hours Year Wage rate (two weeks of Cost per Number of Total burden Total costs work hours) license licenses hours

1 ...... $82.88 80 $6,630 24 1,920 $159,130

The agency is soliciting comments Environmental Policy Act in the agency responsibilities of Executive to— absence of extraordinary circumstances. Order 13609, and has determined that (1) Evaluate whether the proposed The FAA has determined this this action would have no effect on information requirement is necessary for rulemaking action qualifies for the international regulatory cooperation. the proper performance of the functions categorical exclusion identified in D. Executive Order 13771, Reducing of the agency, including whether the paragraph 5–6.6 and involves no Regulation and Controlling Regulatory information will have practical utility; extraordinary circumstances. (2) Evaluate the accuracy of the Costs agency’s estimate of the burden; V. Executive Order Determinations This proposed rule is expected to be (3) Enhance the quality, utility, and A. Executive Order 13132, Federalism a deregulatory action under Executive clarity of the information to be Order 13771 and would result in net The FAA has analyzed this proposed collected; and cost savings for industry that would rule under the principles and criteria of (4) Minimize the burden of collecting likely reduce the future cost of Executive Order 13132, Federalism. The information on those who are to innovation in U.S. commercial space agency has determined that this action respond, including by using appropriate transportation. The Preliminary would not have a substantial direct automated, electronic, mechanical, or Regulatory Impact Analysis for the effect on the States, or the relationship other technological collection proposed rule provides additional between the Federal Government and techniques or other forms of information information. technology. the States, or on the distribution of Individuals and organizations may power and responsibilities among the VI. Additional Information various levels of government, and, send comments on the information A. Comments Invited collection requirement to the address therefore, would not have Federalism listed in the ADDRESSES section at the implications. The FAA invites interested persons to participate in this rulemaking by beginning of this preamble by June 14, B. Executive Order 13211, Regulations 2019. Comments also should be submitting written comments, data, or That Significantly Affect Energy Supply, views. Also, the agency invites submitted to the Office of Management Distribution, or Use and Budget, Office of Information and comments regarding potential overlap Regulatory Affairs, Attention: Desk The FAA analyzed this proposed rule with the regulatory requirements of Officer for FAA, New Executive under Executive Order 13211, Actions other agencies not addressed in this Building, Room 10202, 725 17th Street Concerning Regulations that proposed rule. In addition, the FAA NW, Washington, DC 20053. Significantly Affect Energy Supply, invites comments relating to the Distribution, or Use (May 18, 2001). The economic, environmental, energy, or F. International Compatibility agency has determined that it would not federalism impacts that might result In keeping with U.S. obligations be a ‘‘significant energy action’’ under from adopting the proposals in this under the Convention on International the executive order and would not be document. The most helpful comments Civil Aviation, it is FAA policy to likely to have a significant adverse effect reference a specific portion of the conform to International Civil Aviation on the supply, distribution, or use of proposal, explain the reason for any Organization (ICAO) Standards and energy. recommended change, and include Recommended Practices to the supporting data. To ensure the docket C. Executive Order 13609, International does not contain duplicate comments, maximum extent practicable. The FAA Cooperation has determined that there are no ICAO commenters should send only one copy Standards and Recommended Practices Executive Order 13609, Promoting of written comments, or if comments are that correspond to these proposed International Regulatory Cooperation, filed electronically, commenters should regulations. promotes international regulatory submit only one time. cooperation to meet shared challenges The FAA will file in the docket all G. Environmental Analysis involving health, safety, labor, security, comments it receives, as well as a report FAA Order 1050.1F identifies FAA environmental, and other issues and to summarizing each substantive public actions that are categorically excluded reduce, eliminate, or prevent contact with FAA personnel concerning from preparation of an environmental unnecessary differences in regulatory this proposed rulemaking. Before acting assessment or environmental impact requirements. The FAA has analyzed on this proposal, the FAA will consider statement under the National this action under the policies and all comments it receives on or before the

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00118 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15413

closing date for comments. The FAA List of Subjects ■ e. Add, in alphabetical order, the will consider comments filed after the definition of ‘‘Expected casualty,’’ 14 CFR Part 401 comment period has closed if it is ‘‘Explosive debris,’’ ‘‘Flight abort,’’ possible to do so without incurring Organization and functions ‘‘Flight abort crew,’’ ‘‘Flight abort expense or delay. The agency may (Government agencies), Space rules,’’ ‘‘Flight hazard area,’’ and ‘‘Flight change this proposal in light of the transportation and exploration. safety limit’’; ■ comments it receives. 14 CFR Part 404 f. Revise the definition of ‘‘Flight safety system’’; Proprietary or Confidential Business Administrative practice and ■ g. Add, in alphabetical order, the Information: Commenters should not procedure, Space transportation and definitions of ‘‘Gate’’ and ‘‘Hazard file proprietary or confidential business exploration. control’’; information in the docket. Such ■ 14 CFR Part 413 h. Remove the definition of ‘‘Human information must be sent or delivered space flight incident’’; directly to the person identified in the Confidential business information, ■ i. Revise the definitions of FOR FURTHER INFORMATION CONTACT Space transportation and exploration. ‘‘Instantaneous impact point’’ and section of this document, and marked as 14 CFR Part 414 ‘‘Launch’’; ■ proprietary or confidential. If submitting Airspace, Aviation safety, Space j. Remove the definitions of ‘‘Launch information on a disk or CD ROM, mark transportation and exploration. accident’’ and ‘‘Launch incident’’; the outside of the disk or CD ROM, and ■ k. Add, in alphabetical order, the identify electronically within the disk or 14 CFR Part 420 definitions of ‘‘Launch or reentry CD ROM the specific information that is Environmental protection, Reporting system,’’ ‘‘Launch window,’’ ‘‘Liftoff,’’ proprietary or confidential. and recordkeeping requirements, Space and ‘‘Limits of a useful mission’’; transportation and exploration. ■ l. Revise the definition of ‘‘Mishap’’; Under 14 CFR 11.35(b), if the FAA is ■ m. Add, in alphabetical order, the aware of proprietary information filed 14 CFR Part 437 definitions of ‘‘Mishap, Class 1,’’ with a comment, the agency does not Aircraft, Aviation safety, Reporting ‘‘Mishap, Class 2,’’ ‘‘Mishap, Class 3’’, place it in the docket. It is held in a and recordkeeping requirements, Space ‘‘Mishap, Class 4,’’ ‘‘Neighboring separate file to which the public does transportation and exploration. operations personnel,’’ ‘‘Normal flight,’’ not have access, and the FAA places a ‘‘Normal trajectory,’’ ‘‘Operating note in the docket that it has received 14 CFR Part 440 environment,’’ and ‘‘Operation hazard’’; it. If the FAA receives a request to Indemnity payments, Insurance, ■ n. Revise the definition of ‘‘Operator’’; examine or copy this information, it Reporting and recordkeeping ■ o. Add, in alphabetical order, the treats it as any other request under the requirements, Space transportation and definitions of ‘‘Orbital insertion,’’ Freedom of Information Act (5 U.S.C. exploration. ‘‘Physical containment,’’ ‘‘Probability of casualty,’’ and ‘‘Public’’; 552). The FAA processes such a request 14 CFR Part 450 under Department of Transportation ■ p. Remove the definition of ‘‘Public procedures found in 49 CFR part 7. Aircraft, Aviation safety, safety’’; Environmental protection, ■ q. Revise the definition of ‘‘Reenter; B. Availability of Rulemaking Investigations, Reporting and reentry’’; Documents recordkeeping requirements, Space ■ r. Remove the definitions of ‘‘Reentry transportation and exploration. accident’’ and ‘‘Reentry incident’’; An electronic copy of rulemaking ■ s. Add, in alphabetical order, the The Proposed Amendment documents may be obtained from the definition of ‘‘Reentry window’’; internet by—Searching the Federal In consideration of the foregoing, the ■ t. Revise the definition of ‘‘Safety eRulemaking Portal (http:// Federal Aviation Administration critical’’; www.regulations.gov); proposes to amend chapter III of title 14, ■ u. Add, in alphabetical order, the Visiting the FAA’s Regulations and Code of Federal Regulations as follows: definitions of ‘‘Service life’’ and ‘‘Software function’’; Policies web page at http:// PART 401—ORGANIZATION AND www.faa.gov/regulations_policies or ■ v. Revise the definition of ‘‘State and DEFINITIONS United States’’; Accessing the Government Printing ■ w. Add, in alphabetical order, the Office’s web page at http:// ■ 1. The authority citation for part 401 continues to read as follows: definitions of ‘‘Sub-vehicle point,’’ www.gpo.gov/fdsys/. ‘‘System hazard,’’ ‘‘Toxic hazard area,’’ Copies may also be obtained by Authority: 51 U.S.C. 50101–50923. ‘‘Tracking icon,’’ ‘‘Uncontrolled area,’’ sending a request to the Federal ■ 2. In § 401.5: ‘‘Unguided suborbital launch vehicle,’’ Aviation Administration, Office of ■ a. Add, in alphabetical order, the ‘‘Uprange,’’ and ‘‘Vehicle response Rulemaking, ARM–1, 800 Independence definitions of ‘‘Anomaly,’’ ‘‘Casualty modes’’; Avenue SW, Washington, DC 20591, or area,’’ and ‘‘Command control system’’; ■ x. Remove the definition of ‘‘Vehicle by calling (202) 267–9680. Commenters ■ b. Revise the definition of safety operations personnel’’; and must identify the docket or notice ‘‘Contingency abort’’; ■ y. Add, in alphabetical order, the ■ number of this rulemaking. c. Add, in alphabetical order, the definitions of ‘‘Wind weighting safety definitions of ‘‘Control entity,’’ system’’ and ‘‘Window closure’’. All documents the FAA considered in ‘‘Countdown,’’ ‘‘Critical asset,’’ The additions and revisions read as developing this proposed rule, ‘‘Crossrange,’’ ‘‘Data loss flight time,’’ follows: including economic analyses and ‘‘Deorbit,’’ ‘‘Disposal,’’ ‘‘Dose-response technical reports, may be accessed from relationship,’’ ‘‘Downrange,’’ and § 401.5 Definitions. the internet through the Federal ‘‘Effective casualty area’’; * * * * * eRulemaking Portal referenced in item ■ d. Remove the definition of Anomaly means any condition during (1) above. ‘‘Emergency abort’’; licensed or permitted activity that

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00119 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15414 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

deviates from what is standard, normal, Downrange means the distance Hazard control means a preventative or expected, during the verification or measured along a line whose direction measure or mitigation put in place for operation of a system, subsystem, is parallel to the projection of a vehicle’s systems or operations to reduce the process, facility, or support equipment. planned nominal velocity vector severity of a hazard or the likelihood of * * * * * azimuth into a horizontal plane tangent the hazard occurring. Casualty area means the area to the ellipsoidal Earth model at the * * * * * surrounding each potential debris or vehicle sub-vehicle point. The term Instantaneous impact point means a vehicle impact point where serious downrange may also be used to indicate predicted impact point, following thrust injuries, or worse, can occur. direction. termination of a vehicle. Command control system means the Effective casualty area means the Launch means to place or try to place portion of a flight safety system that aggregate casualty area of each piece of a launch vehicle or reentry vehicle and includes all components needed to send debris created by a vehicle failure at a any payload or human being from Earth a flight abort control signal to the on- particular point on its trajectory. The in a suborbital trajectory, in Earth orbit board portion of a flight safety system. effective casualty area for each piece of in outer space, or otherwise in outer Contingency abort means a flight debris is a modeling construct in which space, including activities involved in abort with a landing at a planned the area within which 100 percent of the the preparation of a launch vehicle or location that has been designated in population are assumed to be a casualty, payload for launch, when those advance of vehicle flight. and outside of which 100 percent of the Control entity means a person or activities take place at a launch site in population are assumed not to be a the United States. device that can control another device casualty. or process. * * * * * Countdown means the timed * * * * * Launch or reentry system means the sequence of events that must take place Expected casualty means the mean integrated set of subsystems, personnel, to initiate flight of a launch vehicle or number of casualties predicted to occur products, and processes that, when reentry of a reentry vehicle. per flight operation if the operation combined together, safely carries out a were repeated many times. * * * * * launch or reentry. Critical asset means an asset that is * * * * * * * * * * essential to the national interests of the Explosive debris means solid Launch window means a period of United States. Critical assets include propellant fragments or other pieces of time during which the flight of a launch property, facilities, or infrastructure a vehicle or payload that result from vehicle may be initiated. necessary to maintain national defense, breakup of the vehicle during flight and Liftoff means any motion of the or assured access to space for national that explode upon impact with the launch vehicle with intention to initiate priority missions. Earth’s surface and cause overpressure. flight. Crossrange means the distance * * * * * Limits of a useful mission means the measured along a line whose direction Flight abort means the process to limit trajectory data or other parameters that is either 90 degrees clockwise (right or restrict the hazards to public health describe the limits of a mission that can crossrange) or counter-clockwise (left and safety, and the safety of property, attain the primary objective, including crossrange) to the projection of a presented by a launch vehicle or reentry flight azimuth limits. vehicle’s planned nominal velocity vehicle, including any payload, while in Mishap means any event, or series of vector azimuth onto a horizontal plane flight by initiating and accomplishing a events associated with a licensed or tangent to the ellipsoidal Earth model at controlled ending to vehicle flight. permitted activity, that meets the the vehicle’s sub-vehicle point. The Flight abort crew means the personnel criteria of a Class 1, 2, 3 or 4 mishap. terms right crossrange and left who make a flight abort decision. Mishap, Class 1 means any event crossrange may also be used to indicate Flight abort rules means the resulting in one or more of the direction. conditions under which a flight safety following: Data loss flight time means the system must abort the flight to ensure (1) A fatality or serious injury (as shortest elapsed thrusting or gliding compliance with public safety criteria. time during which a vehicle flown with defined in 49 CFR 830.2) as a result of a flight safety system can move from its * * * * * licensed or permitted activity to any trajectory to a condition where it is Flight hazard area means any region person who is not associated with the possible for the vehicle to violate a of land, sea, or air that must be licensed or permitted activity, including flight safety limit. surveyed, publicized, controlled, or ground activities at a launch or reentry Deorbit means the flight of a vehicle evacuated in order to protect public site; or that begins with the final command to health and safety and the safety of (2) A fatality or serious injury to any commit to a perigee below 70 nautical property. space flight participant, crew, or miles (approximately 130 kilometers), Flight safety limit means criteria to government astronaut. and ends when all vehicle components ensure that public safety is protected Mishap, Class 2 means any event, come to rest on the Earth. from the flight of a vehicle when a flight other than a Class 1 mishap, resulting in Disposal means the return or attempt safety system functions properly. one or more of the following: to return, purposefully, a launch vehicle Flight safety system means a system (1) A malfunction of a flight safety stage or component, not including a used to implement flight abort. A system or safety-critical system; or reentry vehicle, from Earth orbit to human can be a part of a flight safety (2) A failure of the licensee’s or Earth, in a controlled manner. system. permittee’s safety organization, safety Dose-response relationship means a Gate means the portion of a flight operations, safety procedures; or quantitative methodology used to assign safety limit boundary through which the (3) High risk, as determined by the a probability of casualty within a tracking icon of a vehicle flown with a FAA, of causing a serious or fatal injury population group given exposure to a flight safety system may pass without to any space flight participant, crew, toxic chemical of known or predicted flight abort, provided the flight remains government astronaut, or member of the concentration and duration. within specified parameters. public; or

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00120 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15415

(4) Substantial damage, as determined 70-nautical mile perigee based on a exists even when no operation is by the FAA, to property not associated computation that accounts for drag. occurring. with licensed or permitted activity. * * * * * * * * * * Mishap, Class 3 means any unplanned Physical containment means a launch Toxic hazard area means a region on event, other than a Class 1 or Class 2 vehicle does not have sufficient energy the Earth’s surface where toxic mishap, resulting in one or more of the for any hazards associated with its flight concentrations and durations may be following: to reach the public or critical assets. greater than approved toxic thresholds for acute casualty, in the event of a (1) Permanent loss of a launch or * * * * * reentry vehicle during licensed activity; release during launch or reentry. Probability of casualty means the or Tracking icon means the likelihood that a person will suffer a representation of a vehicle’s (2) The impact of a licensed or serious injury or worse, including a fatal permitted launch or reentry vehicle, its instantaneous impact point, debris injury, due to all hazards from an footprint, or other vehicle performance payload, or any component thereof operation at a specific location. outside the planned landing site or metric used during real-time tracking of Public means, for a particular licensed designated hazard area. the vehicle’s flight. or permitted launch or reentry, people Uncontrolled area is an area of land Mishap, Class 4 means an unplanned and property that are not involved in event, other than a Class 1, Class 2, or not controlled by a launch or reentry supporting the launch or reentry and operator, a launch or reentry site Class 3 mishap, resulting in one or more includes those people and property that of the following: operator, an adjacent site operator, or may be located within the launch or other entity by agreement. (1) Permanent loss of a vehicle during reentry site, such as visitors, individuals Unguided suborbital launch vehicle permitted activity; providing goods or services not related means a suborbital rocket that does not (2) Failure to achieve mission to launch or reentry processing or flight, contain active guidance or a directional objectives; or and any other operator and its control system. (3) Substantial damage, as determined personnel. * * * * * by the FAA, to property associated with Reenter; reentry means to return or Uprange means the distance licensed or permitted activity. attempt to return, purposefully, a measured along a line that is 180 Neighboring operations personnel reentry vehicle and its payload or degrees to the downrange direction. means, as determined by the Federal or human being, if any, from Earth orbit or * * * * * licensed launch or reentry site operator, from outer space to Earth. Vehicle response modes means those members of the public located * * * * * mutually exclusive scenarios that within a launch or reentry site, or an Reentry window means a period of characterize foreseeable combinations of adjacent launch or reentry site, who are vehicle trajectory and debris generation. not associated with a specific hazardous time during which the reentry of a licensed or permitted operation reentry vehicle may be initiated. * * * * * Wind weighting safety system means currently being conducted but are * * * * * equipment, procedures, analysis and required to perform safety, security, or Safety critical means essential to safe personnel functions used to determine critical tasks at the site and are notified performance or operation. A safety- the launcher elevation and azimuth of the operation. critical system, subsystem, component, settings that correct for wind effects that * * * * * condition, event, operation, process, or item, is one whose proper recognition, an unguided suborbital launch vehicle Normal flight means the flight of a will experience during flight. properly performing vehicle whose real- control, performance, or tolerance, is essential to ensuring public safety. Window closure means a period of time vacuum instantaneous impact time when launch or reentry is not Service life means, for a safety-critical point does not deviate from the nominal permitted in order to avoid a collision system component, the sum total of the vacuum instantaneous impact point by with an object in orbit. A window component’s storage life and operating more than the sum of the wind effects closure may occur within a launch or life. and the three-sigma guidance and reentry window, may delay the start of performance deviations in the uprange, * * * * * a window, or terminate a window early. downrange, left-crossrange, or right- Software function means a collection crossrange directions. of computer code that implements a PART 404—REGULATIONS AND Normal trajectory means a trajectory requirement or performs an action. This LICENSING REQUIREMENTS that describes normal flight. includes firmware and operating ■ 3. The authority citation for part 404 systems. Operating environment means an continues to read as follows: environment that a launch or reentry * * * * * vehicle component will experience State and United States means, when Authority: 51 U.S.C. 50901–50923. ■ during its lifecycle. Operating used in a geographical sense, the several 4. Revise § 404.5 to read as follows: environments include shock, vibration, States, the District of Columbia, the § 404.5 Filing a petition for waiver. thermal cycle, acceleration, humidity, Commonwealth of Puerto Rico, (a) A petition for waiver must be and thermal vacuum. American Samoa, the United States submitted at least 60 days before the Operation hazard means a hazard Virgin Islands, Guam, and any other proposed effective date of the waiver, created by an operating environment or commonwealth, territory, or possession unless the Administrator agrees to a by an unsafe act. of the United States. different time frame in accordance with * * * * * Sub-vehicle point means the location § 404.15. Operator means a holder of a license on an ellipsoidal Earth model where the (b) The petition for waiver must or permit under 51 U.S.C. Subtitle V, normal to the ellipsoid passes through include: chapter 509. the vehicle’s center of gravity. (1) The specific section or sections of Orbital insertion means the point at System hazard means a hazard this chapter from which the petitioner which a vehicle achieves a minimum associated with a system and generally seeks relief;

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00121 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15416 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

(2) The extent of the relief sought and FAA to propose an alternative time account the complexity of the request the reason the relief is being sought; frame to any of the time frames included and whether it allows sufficient time for (3) The reason why granting the in the sections listed in appendix A to the FAA to conduct its review and make request for relief is in the public interest this part. The request must be— the requisite public health and safety, and will not jeopardize the public (1) Submitted no later than the safety of property, and national security health and safety, safety of property, specific time frame included in the and foreign policy findings; and and national security and foreign policy regulation; and (2) The FAA will provide its decision (2) Emailed to ASTApplications@ interests of the United States; and in writing. (4) Any additional facts, views, and faa.gov; or data available to the petitioner to (3) Mailed to the Federal Aviation ■ 6. Add appendix A to part 404 the support the waiver request. Administration, Associate read as follows: ■ Administrator for Commercial Space 5. Add § 404.15 to read as follows: Appendix A to Part 404—Alternative Transportation, Room 331, 800 Time Frames § 404.15 Alternative time frames. Independence Avenue SW, Washington, (a) General. Unless otherwise DC 20591. Attention: Alternative Time A404.1 GENERAL approved by the Administrator, an Frame Request. Alternative time frames. This appendix applicant, a licensee, a permittee, or a (c) Administrator review. The lists the sections and corresponding safety element approval holder must Administrator will review and make a paragraphs in this chapter that provide the meet the time frames set forth in this decision or grant a request for an eligible time frames for an applicant, chapter. alternative time-frame as follows: licensee, permittee or a safety element (b) Request to change a time frame. A (1) The FAA will conduct its review approval holder, as applicable, to request an person may file a written request to the on a case-by-case basis, taking into alternative time frame.

TABLE A404.1—ELIGIBLE TIME FRAMES

49 CFR Paragraphs

§ 404.5—Filing a petition for waiver ...... (a) § 413.23—License or permit renewal ...... (a) § 414.31—Safety element approval renewal ...... (a) § 420.57—Notifications ...... (d) § 437.89—Preflight reporting ...... (a), (b) § 440.15—Demonstration of compliance ...... (a)(1), (a)(2), (a)(3), (a)(4) § 450.169— Launch and Reentry Collision Avoidance Analysis Requirements ...... (f)(1) § 450.213—Preflight reporting ...... (b), (c), (d), (e) § 450.215—Post-flight reporting ...... (a)

PART 413—APPLICATION ■ 9. Revise § 413.1 to read as follows: license or permit. In this part, the term PROCEDURES application means either an application § 413.1 Scope of this part. in its entirety, or a portion of an ■ 7. The authority citation for part 413 (a) This part explains how to apply for application for incremental review and continues to read as follows: a license or experimental permit. These determination in accordance with Authority: 51 U.S.C. 50901–50923. procedures apply to all applications for § 450.33 of this chapter. ■ 8. Revise the heading for part 413 to obtaining a license or permit, (b) Use the following table to locate read as set forth above. transferring a license, and renewing a specific requirements:

TABLE 1 TO PARAGRAPH (b)

Subject Part

License to Operate a Launch Site ...... 420 License to Operate a Reentry Site ...... 433 Experimental Permits ...... 437 Launch And Reentry License Requirements ...... 450

■ 10. Amend § 413.7 by revising the application is attached or linked must (iii) The electronic files must be date- section heading and paragraph (a)(3) to also satisfy the following criteria: stamped and have version control read as follows: (i) The email to which the application documentation. § 413.7 Application submission. is attached or linked must be sent from * * * * * an email address controlled by the ■ 11. Amend § 413.11 by revising (a) * * * person who signed the application or by paragraph (a) to read as follows: (3) For an application submitted by an authorized representative of the § 413.11 Acceptance of an application. email, an applicant must send the applicant; application as an email attachment, or (ii) The email must identify each * * * * * as a link to a secure server, to document that is included as an (a) The FAA accepts the application [email protected]. The attachment or that is stored on a secure and will initiate review; or application and the email to which the server; and * * * * *

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00122 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15417

■ 12. Revise § 413.15 to read as follows: request a hearing in accordance with Safety element approval. A safety paragraph (b)(2) of this section. element approval is an FAA document § 413.15 Review period. ■ 14. Revise part 414 to read as follows: containing the FAA determination that (a) Review period duration. Unless one or more of the safety elements listed otherwise specified in this chapter, the PART 414—SAFETY ELEMENT in paragraphs (1) and (2) of this FAA reviews and makes a license or APPROVALS definition, when used or employed permit determination on an application within a defined envelope, parameter, within 180 days of receiving an Sec. or situation, will not jeopardize public accepted license application or within Subpart A—General health and safety or safety of property. 120 days of receiving an accepted 414.1 Scope. A safety element approval may be permit application. The FAA will 414.3 Definitions. issued independent of a license, and it establish the time frame for any 414.5 Applicability. does not confer any authority to conduct incremental review and determination 414.7 Eligibility. activities for which a license is required with an applicant on a case-by-case Subpart B—Application Procedures under this chapter. A safety element basis during pre-application approval does not relieve its holder of consultation. 414.9 Pre-application consultation. 414.11 Application. the duty to comply with all applicable (b) Review period tolled. If an requirements of law or regulation that accepted application does not provide 414.13 Application separate from a vehicle operator license application. may apply to the holder’s activities. sufficient information to continue or 414.15 Application concurrent with vehicle (1) Launch vehicle, reentry vehicle, complete the reviews or evaluations operator license application. safety system, process, service, or any required by this chapter for a license, 414.17 Confidentiality. identified component thereof; or permit, or incremental determination, or 414.19 Processing the initial application. (2) Qualified and trained personnel, an issue exists that would affect a performing a process or function related determination, the FAA notifies the 414.21 Maintaining the continued accuracy of the initial application. to licensed activities or vehicles. applicant, in writing, and informs the Safety element. A safety element is applicant of any information required to Subpart C—Safety Element Approval any one of the items or persons complete the application. If the FAA Review and Issuance (personnel) listed in paragraphs (1) and cannot review an accepted application 414.23 Technical criteria for reviewing a (2) of the definition of ‘‘safety approval’’ because of lack of information or for any safety element approval application. in this section. other reason, the FAA will toll the 414.25 Terms and conditions for issuing a review period until the FAA receives safety element approval; duration of a § 414.5 Applicability. the information it needs or the applicant safety element approval. This part applies to an applicant that resolves the issue. 414.27 Maintaining the continued accuracy wants to obtain a safety element of the safety element approval approval for any of the safety elements (c) Notice. Unless applying under application. incremental review and determination 414.29 Safety element approval records. defined under this part and to persons in accordance with § 450.33 of this 414.31 Safety element approval renewal. granted a safety element approval under chapter, if the FAA does not make a 414.33 Safety element approval transfer. this part. Any person eligible under this decision within 120 days of receiving an 414.35 Monitoring compliance with the part may apply to become the holder of accepted license application or within terms and conditions of a safety element a safety element approval. 90 days of receiving an accepted permit approval. application, the FAA informs the 414.37 Modification, suspension, or § 414.7 Eligibility. applicant, in writing, of any outstanding revocation of a safety element approval. (a) There is no citizenship 414.39 [Reserved] information needed to complete the requirement to obtain a safety element review, or of any issues that would Subpart D—Appeal Procedures approval. affect the decision. 414.41 Hearings in safety element approval (b) You may be eligible for a safety ■ 13. Amend § 413.21 by revising the actions. element approval if you are— section heading and paragraphs (b) and 414.43 Submissions; oral presentations in (1) A designer, manufacturer, or (c) to read as follows: safety element approval actions. operator of a launch or reentry vehicle 414.45 Administrative law judge’s or component thereof; § 413.21 Denial of a license or permit recommended decision in safety element (2) The designer or developer of a application. approval actions. safety system or process; or * * * * * Authority: 51 U.S.C. 50901–50923. (3) Personnel who perform safety (b) If the FAA has denied an critical functions in conducting a application in its entirety, the applicant Subpart A—General licensed launch or reentry. may either— (c) A safety element approval (1) Attempt to correct any deficiencies § 414.1 Scope. applicant must have sufficient identified and ask the FAA to This part establishes procedures for knowledge and expertise to show that reconsider the revised application. The obtaining a safety element approval and the design and operation of the safety FAA has 60 days or the number of days renewing and transferring an existing element for which safety element remaining in the review period, safety element approval. Safety element approval is sought qualify for a safety whichever is greater, within which to approvals issued under this part may be element approval. reconsider the decision; or used to support the application review (d) Only the safety elements defined (2) Request a hearing in accordance for one or more vehicle operator license under this part are eligible for a safety with part 406 of this chapter, for the requests under other parts of this element approval. The applicant must purpose of showing why the application chapter. consult with the FAA before submitting should not be denied. an application. Unless the applicant or (c) An applicant whose application is § 414.3 Definitions. the FAA requests another form of denied after reconsideration under For purposes of this part the following consultation, consultation is oral paragraph (b)(1) of this section may definitions apply: discussion with the FAA about the

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00123 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15418 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

application process and the potential [email protected]. The (2) For a partnership or a sole issues relevant to the FAA’s safety application and the email to which the proprietorship, a general partner or element approval decision. application is attached must also satisfy proprietor, respectively. the following criteria: (3) For a joint venture, association, or Subpart B—Application Procedures (i) The email to which the application other entity, an officer or other § 414.9 Pre-application consultation. is attached must be sent from an email individual duly authorized to act for the address controlled by the person who joint venture, association, or other entity The applicant must consult with the signed the application or by an in licensing matters. FAA before submitting an application. authorized representative of the (e) Failure to comply with any of the Unless the applicant or the FAA applicant; and requirements set forth in this section is requests another form of consultation, (ii) The email must identify each sufficient basis for denial of a safety consultation is oral discussion with the document that is included as an element approval application. FAA about the application process and attachment or that is stored on a secure the potential issues relevant to the § 414.15 Application concurrent with server; and FAA’s safety approval decision. vehicle operator license application. (iii) The electronic files must be date- (a) An applicant for a vehicle operator § 414.11 Application. stamped and have version control documentation. license may also identify one or more An applicant may submit an sections of its application for which it application for a safety element (b) The application must identify the following basic information: seeks to obtain a safety element approval in one of two ways: approval concurrently with a license. (a) Separate from a vehicle operator (1) Name and address of the An applicant applying for a safety license application in accordance with applicant. element approval concurrently with a § 414.13; or (2) Name, address, and telephone (b) Concurrent with a vehicle operator number of any person to whom license must— (1) Meet the applicable requirements license application in accordance with inquiries and correspondence should be of part 450 of this chapter; § 414.15. directed. (2) Provide the information required (3) Safety element as defined under in § 414.13(b)(3) and (c)(2) and (3); and § 414.13 Application separate from a this part for which the applicant seeks vehicle operator license application. (3) Specify the sections of the license a safety element approval. application that support its application (a) An applicant must make an (c) The application must contain the application in writing and in English. for a safety element approval. following technical information: (b) The scope of the safety element The applicant must file the application (1) A Statement of Conformance letter, with the Federal Aviation approval will be limited to what the describing the specific criteria the application supports. The technical Administration either by paper, by use applicant used to show the adequacy of of physical electronic storage, or by criteria for reviewing a safety element the safety element for which a safety submitted as part of a vehicle operator email in the following manner: element approval is sought, and (1) For an application submitted on license application are limited to the showing how the safety element paper, an applicant must send two applicable requirements of part 450 of complies with the specific criteria. copies of the application to the Federal this chapter. (2) The specific operating limits for Aviation Administration, Associate which the safety element approval is § 414.17 Confidentiality. Administrator for Commercial Space sought. Transportation, Room 331, 800 (a) To ensure confidentiality of data or (3) The following as applicable: Independence Avenue SW, Washington, information in the application, the (i) Information and analyses required DC 20591. Attention: Application applicant must— under this chapter that may be Review. (1) Send a written request with the (2) For an application submitted by applicable to demonstrating safe application that trade secrets or use of physical electronic storage, the performance of the safety element for proprietary commercial or financial data applicant must either mail the which the safety element approval is be treated as confidential, and include application to the address specified in sought. in the request the specific time frame paragraph (a)(1) of this section or hand- (ii) Engineering design and analyses confidential treatment is required. deliver the application to an authorized that show the adequacy of the proposed (2) Mark data or information that FAA representative. The application safety element for its intended use, such require confidentiality with an and the physical electronic storage that the use in a licensed launch or identifying legend, such as ‘‘Proprietary containing the application must also reentry will not jeopardize public health Information,’’ ‘‘Proprietary Commercial satisfy all of the following criteria: or safety or the safety of property. Information,’’ ‘‘Trade Secret,’’ or (i) The application must include a (iii) Relevant manufacturing ‘‘Confidential Treatment Requested.’’ cover letter that is printed on paper and processes. Where this marking proves signed by the person who signed the (iv) Test and evaluation procedures. impracticable, attach a cover sheet that application or by an authorized (v) Test results. contains the identifying legend to the representative of the applicant; (vi) Maintenance procedures. data or information for which (ii) The cover letter must identify each (vii) Personnel qualifications and confidential treatment is sought. document that is included on the training procedures. (b) If the applicant requests physical electronic storage; and (d) The application must be legibly confidential treatment for previously (iii) The physical electronic storage signed, dated, and certified as true, submitted data or information, the FAA must be in a format such that its complete, and accurate by one of the will honor that request to the extent contents cannot be altered. following: practicable in case of any prior (3) For an application submitted by (1) For a corporation, an officer or distribution of the data or information. email, an applicant must send the other individual authorized to act for (c) Data or information for which application as an email attachment, or the corporation in licensing or safety confidential treatment is requested or as a link to a secure server, to element approval matters. data or information that qualifies for

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00124 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15419

exemption under 5 U.S.C. 552(b)(4) will Subpart C—Safety Element Approval (b) If any representation contained in not be disclosed to the public unless the Review and Issuance the application that is material to public Associate Administrator determines that health and safety or safety of property withholding the data or information is § 414.23 Technical criteria for reviewing a ceases to be accurate and complete, the safety element approval application. contrary to the public or national safety element approval holder must interest. The FAA will determine whether a prepare and submit a revised safety element is eligible for and may be application according to § 414.13 or § 414.19 Processing the initial application. issued a safety approval. We will base § 414.15. The safety element approval our determination on performance- holder must point out any part of the (a) The FAA will initially screen an based criteria, against which we may application to determine if the safety element approval or the assess the effect on public health and associated application that would be application is complete enough for the safety and on safety of property, in the changed or affected by a proposed FAA to start its review. following hierarchy: modification. The FAA will review and (b) After completing the initial (a) FAA or other appropriate Federal make a determination on the revised screening, the FAA will inform the regulations. application under the terms of this part. applicant in writing of one of the (b) Government-developed or adopted following: standards. § 414.29 Safety element approval records. (1) The FAA accepts the application (c) Industry consensus performance- The holder of a safety element and will begin the reviews or based criteria or standard. approval must maintain all records (d) Applicant-developed criteria. necessary to verify that the holder’s evaluations required for a safety element Applicant-developed criteria are activities are consistent with the approval determination under this part. performance standards customized by representations contained in the (2) The FAA rejects the application the manufacturer that intends to application for which the approval was because it is incomplete or indefinite produce the system, system component, issued for the duration of the safety making initiation of the reviews or or part. The applicant-developed criteria element approval plus one year. evaluations required for a safety element must define— approval determination under this part (1) Design and minimum § 414.31 Safety element approval renewal. inappropriate. performance; (a) Eligibility. A holder of a safety element approval may apply to renew it (c) The written notice will state the (2) Quality assurance system by sending the FAA a written reason(s) for rejection and corrective requirements; application at least 90 days before the actions necessary for the application to (3) Production acceptance test expiration date of the approval, unless be accepted. The FAA may return a specifications; and (4) Continued operational safety the Administrator agrees to a different rejected application to the applicant or monitoring system characteristics. time frame in accordance with § 404.15 may hold it until the applicant provides of this chapter. more information. § 414.25 Terms and conditions for issuing (b) Application. (1) A safety element (d) The applicant may withdraw, a safety element approval; duration of a approval renewal application must meet safety approval. amend, or supplement an application all the requirements under § 414.13 or any time before the FAA makes a final (a) The FAA will issue a safety § 414.15. determination on the safety element element approval to an applicant that (2) The application may incorporate approval application by making a meets all the requirements under this by reference information provided as part. written request to the Associate part of the application for the expiring (b) The scope of the safety element Administrator. If the applicant amends safety element approval or any approval will be limited by the scope of or supplements the initial application, modification to that approval. the safety demonstration contained in (3) Any proposed changes in the the revised application must meet all the application on which the FAA based conduct of a safety element for which the applicable requirements under this the decision to grant the safety element the FAA has issued a safety element part. approval. approval must be described and must (c) The FAA will determine specific § 414.21 Maintaining the continued include any added information terms and conditions of a safety element accuracy of the initial application. necessary to support the fitness of the approval individually, limiting the proposed changes to meet the criteria The applicant is responsible for the safety element approval to the scope for upon which the FAA evaluated the continuing accuracy and completeness which it was approved. The terms and safety element approval application. of information provided to the FAA as conditions will include reporting (c) Review of application. The FAA part of the safety element approval requirements tailored to the individual conducts the reviews required under application. If at any time after safety element approval. this part to determine whether the safety submitting the application, (d) A safety element approval is valid element approval may be renewed. We circumstances occur that cause the for five years and may be renewed. may incorporate by reference any information to no longer be accurate and § 414.27 Maintaining the continued findings that are part of the record for complete in any material respect, the accuracy of the safety element approval the expiring safety element approval. applicant must submit a written application. (d) Grant of safety element approval statement to the Associate (a) The holder of a safety element renewal. If the FAA makes a favorable Administrator explaining the approval must ensure the continued safety element approval determination, circumstances and providing the new or accuracy and completeness of the FAA issues an order that amends the corrected information. The revised representations contained in the safety expiration date of the safety element application must meet all requirements element approval application, on which approval or issues a new safety element under § 414.13 or § 414.15. the approval was issued, for the entire approval. The FAA may impose added term of the safety element approval. or revised terms and conditions

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00125 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15420 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

necessary to protect public health and § 414.37 Modification, suspension, or determination on the record after an safety and the safety of property. revocation of a safety element approval. opportunity for a hearing. (e) Written notice. The FAA will (a) The safety element approval holder. The safety element approval § 414.43 Submissions; oral presentations provide written notice to the applicant in safety element approval actions. of our determination on the safety holder may submit an application to the (a) Determinations in safety element element approval renewal request. FAA to modify the terms and conditions of the holder’s safety element approval. approval actions under this part will be (f) Denial of a safety element approval made on the basis of written renewal. If the FAA denies the renewal The application must meet all the applicable requirements under this part. submissions unless the administrative application, the applicant may correct law judge, on petition or on his or her any deficiency the FAA identified and The FAA will review and make a determination on the application using own initiative, determines that an oral request a reconsideration of the revised presentation is required. application. The applicant also has the the same procedures under this part applicable to an initial safety element (b) Submissions must include a right to appeal a denial as set forth in detailed exposition of the evidence or subpart D of this part. approval application. If the FAA denies the request to modify a safety element arguments supporting the petition. § 414.33 Safety element approval transfer. approval, the holder may correct any (c) Petitions must be filed as soon as deficiency the FAA identified and practicable, but in no event more than (a) Only the FAA may approve a 30 days after issuance of decision or transfer of a safety element approval. request reconsideration. The holder also has the right to appeal a denial as set finding under § 414.37. (b) Either the holder of a safety forth in subpart D of this part. element approval or the prospective § 414.45 Administrative law judge’s (b) The FAA. If the FAA finds it is in recommended decision in safety element transferee may request a safety element the interest of public health and safety, approval actions. approval transfer. safety of property, or if the safety (a) The Associate Administrator, who (c) Both the holder and prospective element approval holder fails to comply will make the final decision on the transferee must agree to the transfer. with any applicable requirements of this matter at issue, will review the (d) The person requesting the transfer part, any terms and conditions of the recommended decision of the must submit a safety element approval safety approval, or any other applicable administrative law judge. The Associate application according to § 414.13 or requirement, the FAA may— Administrator will make such final § 414.15, must meet the applicable (1) Modify the terms and conditions decision within 30 days of issuance of requirements of this part, and may of the safety element approval; or the recommended decision. incorporate by reference relevant (2) Suspend or revoke the safety (b) The authority and responsibility to portions of the initial application. element approval. review and decide rests solely with the (e) The FAA will approve a transfer of (c) Effective date. Unless otherwise Associate Administrator and may not be a safety element approval only after all stated by the FAA, any modification, delegated. the approvals and determinations suspension, or revocation of a safety required under this chapter for a safety element approval under paragraph (b) of PART 415 [REMOVE AND RESERVE] this section— element approval have been met. In ■ 15. Remove and reserve part 415. conducting reviews and issuing (1) Takes effect immediately; and approvals and determinations, the FAA (2) Continues in effect during any PART 417 [REMOVE AND RESERVE] may incorporate by reference any reconsideration or appeal of such action findings made part of the record to under this part. ■ 16. Remove and reserve part 417. support the initial safety element (d) Notification and Right to Appeal. PART 420—LICENSE TO OPERATE A approval determination. The FAA may If the FAA determines it is necessary to LAUNCH SITE modify the terms and conditions of a modify, suspend, or revoke a safety safety element approval to reflect any element approval, we will notify the ■ 17. The authority citation for part 420 changes necessary because of a safety safety element approval holder in continues to read as follows: element approval transfer. writing. If the holder disagrees with the Authority: 51 U.S.C. 50901–50923. (f) The FAA will provide written FAA’s determination, the holder may notice to the person requesting the correct any deficiency the FAA § 420.5 [Amended] safety element approval transfer of our identified and request a reconsideration ■ 18. Amend § 420.5 by removing the determination. of the determination. The applicant also definitions for ‘‘Instantaneous impact has the right to appeal the point,’’ ‘‘Launch site accident,’’ and § 414.35 Monitoring compliance with the determination as set forth in subpart D ‘‘Public.’’ terms and conditions of a safety element of this part. ■ approval. 19. Amend § 420.15 by revising § 414.39 [Reserved] paragraph (b) to read as follows: Each holder of a safety element approval must allow access by, and Subpart D—Appeal Procedures § 420.15 Information requirements. cooperate with, Federal officers or * * * * * employees or other individuals § 414.41 Hearings in safety element (b) Environmental. The FAA is authorized by the Associate approval actions. responsible for complying with the Administrator to inspect manufacturing, (a) The FAA will give the safety procedures and policies of the National production, testing, or assembly element approval applicant or holder, as Environmental Policy Act (NEPA) and performed by a holder of a safety appropriate, written notice stating the other applicable environmental laws, element approval or its contractor. The reason for issuing a denial or for regulations, and Executive Orders prior FAA may also inspect a safety element modifying, suspending, or revoking a to issuing a launch site license. An approval process or service, including safety element approval under this part. applicant must provide the FAA with training programs and personnel (b) A safety element approval information needed to comply with qualifications. applicant or holder is entitled to a such requirements. The FAA will

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00126 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15421

consider and document the potential (c) Emergency response and PART 435 [REMOVED AND environmental effects associated with investigation procedures developed in RESERVED] issuing a launch site license. accordance with 29 CFR 1910.119 and ■ (1) Environmental Impact Statement 40 CFR part 68 will satisfy the 27. Remove and reserve part 435. or Environmental Assessment. An requirements of § 450.173(d) and (e) to PART 437—EXPERIMENTAL PERMITS applicant must— the extent that they include the (i) Prepare an Environmental elements required by § 450.173(d) and ■ 28. The authority citation for part 437 Assessment with FAA oversight; (e). continues to read as follows: (ii) Assume financial responsibility Authority: 51 U.S.C. 50901–50923. for preparation of an Environmental PART 431 [REMOVE AND RESERVE] Impact Statement by an FAA-selected § 437.3 [Amended] ■ and -managed consultant contractor; or 23. Remove and reserve part 431. ■ 29. Amend § 437.3 by removing the (iii) Submit a written re-evaluation of definition for ‘‘Anomaly.’’ a previously submitted Environmental PART 433—LICENSE TO OPERATE A ■ REENTRY SITE 30. Amend § 437.21 by revising Assessment or Environmental Impact paragraphs (b) and (c) to read as follows: Statement when requested by the FAA. ■ (2) Categorical exclusion. An 24. The authority citation for part 433 § 437.21 General. continues to read as follows: applicant may request a categorical * * * * * exclusion determination from the FAA Authority: 51 U.S.C. 50901–50923. (b) Other regulations—(1) by submitting the request and ■ 25. Revise § 433.7 to read as follows: Environmental—(i) General. The FAA is supporting rationale. responsible for complying with the (3) Environmental information. An § 433.7 Environmental. procedures and policies of the National application must include an approved Environmental Policy Act (NEPA) and FAA Environmental Assessment, (a) General. The FAA is responsible for complying with the procedures and other applicable environmental laws, Environmental Impact Statement, regulations, and Executive Orders to categorical exclusion determination, or policies of the National Environmental Policy Act (NEPA) and other applicable consider and document the potential written re-evaluation covering all environmental effects associated with planned licensed activities in environmental laws, regulations, and Executive Orders prior to issuing a proposed reusable suborbital rocket compliance with NEPA and the Council launches or reentries. An applicant on Environmental Quality Regulations reentry site license. An applicant must provide the FAA with information must provide the FAA with information for Implementing the Procedural needed to comply with such Provisions of NEPA. needed to comply with such requirements. The FAA will consider requirements. The FAA will consider * * * * * and document the potential and document the potential ■ 20. Revise § 420.51 to read as follows: environmental effects associated with environmental effects associated with proposed reusable suborbital rocket § 420.51 Responsibilities—general. issuing a license for a reentry site. launches or reentries. A licensee must operate its launch (b) Environmental Impact Statement (ii) Environmental Impact Statement site in accordance with the or Environmental Assessment. An or Environmental Assessment. An representations in its application. applicant must— ■ applicant must— 21. Amend § 420.57 by revising (1) Prepare an Environmental (A) Prepare an Environmental paragraph (d) to read as follows: Assessment with FAA oversight; Assessment with FAA oversight; § 420.57 Notifications. (2) Assume financial responsibility for (B) Assume financial responsibility for preparation of an Environmental * * * * * preparation of an Environmental Impact (d) At least 2 days prior to flight of a Statement by an FAA-selected and Impact Statement by an FAA-selected launch vehicle, unless the -managed consultant contractor; or and -managed consultant contractor; or (C) Submit a written re-evaluation of Administrator agrees to a different time (3) Submit a written re-evaluation of a previously submitted Environmental frame in accordance with § 404.15 of a previously submitted Environmental Assessment or Environmental Impact this chapter, the licensee must notify Assessment or Environmental Impact Statement when requested by the FAA. local officials and all owners of land Statement when requested by the FAA. (iii) Categorical exclusion. An adjacent to the launch site of the flight (c) Categorical exclusion. An applicant may request a categorical schedule. applicant may request a categorical ■ 22. Revise § 420.59 to read as follows: exclusion determination from the FAA exclusion determination from the FAA by submitting the request and § 420.59 Mishap plan. by submitting the request and supporting rationale. (a) A licensee must submit a mishap supporting rationale. (iv) Information requirements. An response plan that meets the (d) Environmental information. An application must include an approved requirements of § 450.173 of this application must include an approved FAA Environmental Assessment, chapter. FAA Environmental Assessment, Environmental Impact Statement, (b) A launch site operator’s mishap Environmental Impact Statement, categorical exclusion determination, or plan must also contain— categorical exclusion determination, or written re-evaluation covering all (1) Procedures for participating in an written re-evaluation covering all planned licensed activities in investigation of a launch mishap for planned licensed activities in compliance with NEPA and the Council launches launched from the launch site; compliance with NEPA and the Council on Environmental Quality Regulations and on Environmental Quality Regulations for Implementing the Procedural (2) Require the licensee to cooperate for Implementing the Procedural Provisions of NEPA. with FAA or National Transportation Provisions of NEPA. (2) Financial responsibility. An Safety Board (NTSB) investigations of a applicant must provide the information mishap for launches launched from the § 433.9 [Removed and Reserved] required by part 3 of appendix A of part launch site. ■ 26. Remove and reserve § 433.9. 440 of this chapter for the FAA to

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00127 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15422 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

conduct a maximum probable loss PART 440—FINANCIAL permitted activity, unless the analysis. RESPONSIBILITY Administrator agrees to a different time (3) Human space flight. An applicant frame in accordance with § 404.15 of proposing launch or reentry with flight ■ 35. The authority citation for part 440 this chapter; and crew or a space flight participant on continues to read as follows: (4) Evidence of renewal of insurance board a reusable suborbital rocket must Authority: 51 U.S.C. 50901–50923. or other form of financial responsibility must be submitted at least 30 days in demonstrate compliance with §§ 460.5, ■ 36. Amend § 440.3 by revising the advance of its expiration date, unless 460.7, 460.11, 460.13, 460.15, 460.17, definition for ‘‘Maximum probable loss’’ the Administrator agrees to a different 460.51 and 460.53 of this subchapter. to read as follows: (c) Use of a safety element approval. time frame in accordance with § 404.15 If an applicant proposes to use any § 440.3 Definitions. of this chapter. reusable suborbital rocket, safety * * * * * * * * * * system, process, service, or personnel Maximum probable loss (MPL) means ■ 38. Add part 450 to read as follows: for which the FAA has issued a safety the greatest dollar amount of loss for element approval under part 414 of this bodily injury or property damage that is PART 450—LAUNCH AND REENTRY chapter, the FAA will not reevaluate reasonably expected to result from a LICENSE REQUIREMENTS that safety element to the extent its use licensed or permitted activity: Sec. is within its approved envelope. As part (1) Losses to third parties, excluding of the application process, the FAA will Government personnel and other launch Subpart A—General Information evaluate the integration of that safety or reentry participants’ employees 450.1 Applicability. element into vehicle systems or involved in licensed or permitted 450.3 Scope of a vehicle operator license. operations. activities and neighboring operations 450.5 Issuance of a vehicle operator license. 450.7 Duration of a vehicle operator license. * * * * * personnel, that are reasonably expected 450.9 Additional license terms and ■ 31. Revise § 437.41 to read as follows: to result from a licensed or permitted conditions. activity are those that have a probability § 437.41 Mishap plan. 450.11 Transfer of a vehicle operator of occurrence of no less than one in ten license. An applicant must submit a mishap million. 450.13 Rights not conferred by a vehicle plan that meets the requirements of (2) Losses to Government property operator license. § 450.173 of this chapter. and Government personnel involved in ■ Subpart B—Requirements to Obtain a 32. Revise § 437.65 to read as follows: licensed or permitted activities and Vehicle Operator License § 437.65 Collision avoidance analysis. neighboring operations personnel that 450.31 General. For a permitted flight with a planned are reasonably expected to result from 450.33 Incremental review and maximum altitude greater than 150 licensed or permitted activities are those determinations. that have a probability of occurrence of 450.35 Accepted means of compliance. kilometers, a permittee must obtain a 450.37 Equivalent level of safety. collision avoidance analysis in no less than one in one hundred thousand. 450.39 Use of safety element approval. accordance with § 450.169 of this 450.41 Policy review and approval. chapter. * * * * * 450.43 Payload review and determination. ■ 37. Amend § 440.15 by revising 450.45 Safety review and approval. § 437.75 [Removed and Reserved] paragraphs (a)(1) through (4) to read as 450.47 Environmental review. ■ 33. Remove and reserve § 437.75. follows: Subpart C—Safety Requirements ■ 34. Amend § 437.89 by: ■ a. Revising paragraph (a) introductory § 440.15 Demonstration of compliance. Public Safety Criteria text; (a) * * * 450.101 Public safety criteria. ■ b. In paragraphs (a)(1) through (3), (1) All reciprocal waiver of claims removing the comma at the end of the agreements required under § 440.17(c) System Safety Program paragraphs and adding a semicolon in must be submitted at least 30 days 450.103 System safety program. its place; and before the start of any licensed or Preliminary Safety Assessment for Flight ■ c. Revise paragraph (b). permitted activity involving a customer, and Hazard Control Strategies The revisions read as follows: crew member, or space flight 450.105 Preliminary safety assessment for participant; unless the Administrator flight. § 437.89 Pre-flight reporting. agrees to a different time frame in 450.107 Hazard control strategies. (a) Not later than 30 days before each accordance with § 404.15 of this flight or series of flights conducted Flight Hazard Analyses for Hardware and chapter; Software under an experimental permit, unless (2) Evidence of insurance must be the Administrator agrees to a different submitted at least 30 days before 450.109 Flight hazard analysis. 450.111 Computing systems and software. time frame in accordance with § 404.15 commencement of any licensed launch of this chapter, a permittee must or permitted activity, and for licensed Flight Safety Analyses provide the FAA with the following reentry no less than 30 days, before 450.113 Flight safety analysis information: commencement of launch activities requirements—scope and applicability. * * * * * involving the reentry licensee, unless 450.115 Flight safety analysis methods. (b) Not later than 15 days before each the Administrator agrees to a different 450.117 Trajectory analysis for normal permitted flight planned to reach greater time frame in accordance with § 404.15 flight. than 150 km altitude, unless the of this chapter; 450.119 Trajectory analysis for malfunction flight. Administrator agrees to a different time (3) Evidence of financial 450.121 Debris analysis. frame in accordance with § 404.15, a of responsibility in a form other than 450.123 Flight safety limits analysis. this chapter permittee must provide the insurance, as provided under § 440.9(f) 450.125 Gate analysis. FAA its planned trajectory for a must be submitted at least 60 days 450.127 Data loss Flight time and planned collision avoidance analysis. before commencement of a licensed or safe flight state analyses.

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00128 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15423

450.129 Time delay analysis. this part does not apply to any launch activities necessary to return the site to 450.131 Probability of failure analysis. or reentry that an operator elects to a safe condition, whichever occurs later. 450.133 Flight hazard area analysis. conduct pursuant to a license issued by (c) A vehicle operator’s license 450.135 Debris risk analysis. the FAA or an application accepted by authorizes reentry, which includes 450.137 Far-field overpressure blast effects analysis. the FAA no later than [EFFECTIVE activities conducted in Earth orbit or 450.139 Toxic hazards for flight. DATE OF FINAL RULE]. The outer space to determine reentry 450.141 Wind weighting for the flight of an Administrator will determine the readiness and that are critical to unguided suborbital launch vehicle. applicability of this part to an ensuring public health and safety and application for a license modification the safety of property during reentry Prescribed Hazard Controls submitted after [EFFECTIVE DATE OF flight. Reentry also includes activities 450.143 Safety-critical system design, test, FINAL RULE] on a case-by-case basis. necessary to return the reentry vehicle and documentation. to a safe condition on the ground after 450.145 Flight safety system. § 450.3 Scope of a vehicle operator 450.147 Agreements. license. landing. 450.149 Safety-critical personnel (a) A vehicle operator license § 450.5 Issuance of a vehicle operator qualifications. authorizes a licensee to conduct one or license. 450.151 Work shift and rest requirements. 450.153 Radio frequency management. more launches or reentries using the (a) The FAA issues a vehicle operator 450.155 Readiness. same vehicle or family of vehicles. A license to an applicant who has 450.157 Communications. vehicle operator license identifies the obtained all approvals and 450.159 Preflight procedures. scope of authorization as defined in determinations required under this part 450.161 Surveillance and publication of paragraphs (b) and (c) of this section or for a license. hazard areas. as agreed to by the Administrator. (b) A vehicle operator license 450.163 Lightning hazard mitigation. (b) A vehicle operator license 450.165 Flight safety rules. authorizes a licensee to conduct authorizes launch, which includes the launches or reentries, in accordance 450.167 Tracking. flight of a launch vehicle and pre- and 450.169 Launch and reentry collision with the representations contained in avoidance analysis requirements. post-flight ground operations as follows: the licensee’s application, with subparts 450.171 Safety at end of launch. (1) Launch begins when hazardous C and D of this part, and subject to the 450.173 Mishap plan—reporting, response, preflight ground operations commence licensee’s compliance with terms and and investigation requirements. at a U.S. launch site that pose a threat conditions contained in license orders 450.175 Test-induced damage. to the public. Unless a later point is accompanying the license, including 450.177 Unique Policies, requirements, and agreed to by the Administrator, financial responsibility requirements. practices. hazardous preflight ground operations Ground Safety commence when a launch vehicle or its § 450.7 Duration of a vehicle operator major components arrive at a U.S. license. 450.179 Ground safety—general. 450.181 Coordination with a site operator. launch site. A vehicle operator license is valid for 450.183 Explosive site plan. (2) At a non-U.S. launch site, launch the period of time determined by the 450.185 Ground hazard analysis. begins at ignition or at the first Administrator as necessary to conduct 450.187 Toxic hazards mitigation for movement that initiates flight, the licensed activity but may not exceed ground operations. whichever occurs earlier. 5 years from the issuance date. 450.189 Ground safety prescribed hazard (3) Launch ends when any of the controls. following events occur: § 450.9 Additional license terms and conditions. Subpart D—Terms and Conditions of a (i) For an orbital launch of a vehicle Vehicle Operator License. without a reentry of the vehicle, launch The FAA may modify a vehicle ends after the licensee’s last exercise of 450.201 Public safety responsibility. operator license at any time by 450.203 Compliance with license. control over its vehicle on orbit, after modifying or adding license terms and 450.205 Financial responsibility vehicle stage impact on Earth, after conditions to ensure compliance with requirements. activities necessary to return the vehicle the Act (as defined in § 401.5 of this 450.207 Human Spaceflight Requirements. or stage to a safe condition on the chapter) and its implementing 450.209 Compliance monitoring. ground after landing, or after activities regulations in this chapter. 450.211 Continuing accuracy of license necessary to return the site to a safe application; application for modification condition, whichever occurs later; § 450.11 Transfer of a vehicle operator of license. (ii) For an orbital launch of a vehicle license. 450.213 Preflight reporting. with a reentry of the vehicle, launch (a) Only the FAA may transfer a 450.215 Post-flight reporting. vehicle operator license. 450.217 Registration of space objects. ends after deployment of all payloads, 450.219 Records. upon completion of the vehicle’s first (b) An applicant for transfer of a Appendix A to Part 450—Collision Analysis steady-state orbit if there is no payload, vehicle operator license must submit a Worksheet or after activities necessary to return the license application in accordance with part 413 of this chapter and must meet Authority: 51 U.S.C. 50901–50923. site to a safe condition, whichever occurs later; the requirements of part 450 of this Subpart A—General Information (iii) For a suborbital launch that chapter. The FAA will transfer a license includes a reentry, launch ends after to an applicant that has obtained all of § 450.1 Applicability. reaching apogee; or the approvals and determinations (a) General. This part prescribes (iv) For a suborbital launch that does required under this part for a license. In requirements for obtaining and not include a reentry, launch ends after conducting its reviews and issuing maintaining a license to launch, reenter, the vehicle or vehicle component approvals and determinations, the FAA or both launch and reenter, a launch or impact on Earth, after activities may incorporate by reference any reentry vehicle. necessary to return the vehicle or findings made part of the record to (b) Grandfathering. Except for vehicle component to a safe condition support the initial licensing §§ 450.169 and 450.101(a)(4) and (b)(4), on the ground after landing, or after determination. The FAA may modify a

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00129 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15424 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

license to reflect any changes necessary approved by the Administrator prior to under paragraph (a) of this section, as a result of a license transfer. submitting an application. associated with an applicant’s proposal. (c) The Administrator may make (c) Issues during policy review. The § 450.13 Rights not conferred by a vehicle incremental determinations as part of FAA will advise an applicant, in operator license. this review process. writing, of any issue raised during a Issuance of a vehicle operator license policy review that would impede does not relieve a licensee of its § 450.35 Accepted means of compliance. issuance of a policy approval. The obligation to comply with all applicable (a) An applicant must demonstrate applicant may respond, in writing, or requirements of law or regulation that compliance with applicable sections of amend its license application as may apply to its activities, nor does this part using a means of compliance required by § 413.17 of this chapter. issuance confer any proprietary, accepted by the Administrator. These (d) Denial of policy approval. The property or exclusive right in the use of applicable sections specify that only an FAA notifies an applicant, in writing, if any Federal launch range or related accepted means of compliance can be it has denied policy approval for a facilities, airspace, or outer space. used to demonstrate compliance. license application. The notice states (b) The FAA will provide public the reasons for the FAA’s determination. Subpart B—Requirements to Obtain a notice of each means of compliance that The applicant may respond in writing to Vehicle Operator License the Administrator has accepted. the reasons for the determination and § 450.31 General. (c) An applicant requesting request reconsideration in accordance acceptance of an alternative means of with § 413.21 of this chapter. (a) To obtain a vehicle operator compliance must submit the alternative (e) Application requirements for license, an applicant must— means of compliance to the FAA in a policy review. In its license application, (1) Submit a license application in form and manner acceptable to the an applicant must— accordance with the procedures in part Administrator. (1) Identify the model, type, and 413 of this chapter; configuration of any vehicle proposed (2) Obtain a policy approval from the § 450.37 Equivalent level of safety. for launch or reentry by the applicant; Administrator in accordance with (a) An applicant must demonstrate (2) Describe the vehicle by § 450.41; compliance with each requirement of characteristics that include individual (3) Obtain a favorable payload this part, unless the applicant clearly stages, their dimensions, type and determination from the Administrator in and convincingly demonstrates that an amounts of all propellants, and accordance with § 450.43; alternative approach provides an maximum thrust; (4) Obtain a safety approval from the equivalent level of safety to the (3) Identify foreign ownership of the Administrator in accordance with requirement of this part. applicant as follows: § 450.45; (b) Paragraph (a) of this section does (i) For a sole proprietorship or (5) Satisfy the environmental review not apply to the requirements of partnership, identify all foreign requirements of § 450.47; and § 450.101. ownership; (6) Provide the information required (ii) For a corporation, identify any by appendix A of part 440 of this § 450.39 Use of safety element approval. foreign ownership interests of 10 chapter for the Administrator to conduct If an applicant proposes to use any percent or more; and a maximum probable loss analysis for vehicle, safety system, process, service, (iii) For a joint venture, association, or the applicable licensed operation. or personnel for which the FAA has other entity, identify any participating (b) An applicant may apply for the issued a safety element approval under foreign entities; and approvals and determinations in part 414 of this chapter, the FAA will (4) Identify proposed vehicle flight paragraphs (a)(2) through (6) of this not reevaluate that safety element profile, including: (i) Launch or reentry site, including section separately or all together in one during a license application evaluation any contingency abort locations; complete application, using the to the extent its use is within its (ii) Flight azimuths, trajectories, and application procedures contained in approved envelope. associated ground tracks and part 413 of this chapter. § 450.41 Policy review and approval. instantaneous impact points for the (c) An applicant may also apply for a duration of the licensed activity, safety approval in an incremental (a) General. The FAA issues a policy including any contingency abort manner, in accordance with § 450.33. approval to an applicant unless the FAA determines that a proposed launch or profiles; (d) An applicant may reference (iii) Sequence of planned events or materials previously provided as part of reentry would jeopardize U.S. national security or foreign policy interests, or maneuvers during flight; a license application in order to meet (iv) Normal impact or landing areas the application requirements of this international obligations of the United States. for all mission hardware; and part. (v) For each orbital mission, the range (b) Interagency consultation. (1) The of intermediate and final orbits of each § 450.33 Incremental review and FAA consults with the Department of vehicle upper stage and their estimated determinations. Defense to determine whether a license orbital lifetimes. An applicant may submit its application presents any issues affecting application for a safety review U.S. national security. § 450.43 Payload review and incrementally using an approach (2) The FAA consults with the determination. approved by the Administrator. Department of State to determine (a) General. The FAA issues a (a) An applicant must identify to the whether a license application presents favorable payload determination for a Administrator, prior to submitting an any issues affecting U.S. foreign policy launch or reentry to a license applicant application, whether it will submit an interests or international obligations. or payload owner or operator if— incremental application for any (3) The FAA consults with other (1) The applicant, payload owner, or approval or determination. Federal agencies, including the National payload operator has obtained all (b) An applicant using an incremental Aeronautics and Space Administration, required licenses, authorizations, and approach must have the approach authorized to address issues identified permits; and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00130 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15425

(2) Its launch or reentry would not states the reasons for the FAA’s (iii) Payload owner and payload jeopardize public health and safety, determination. The applicant may operator, if different from the person safety of property, U.S. national security respond in writing to the reasons for the requesting the payload review and or foreign policy interests, or determination and request determination; international obligations of the United reconsideration in accordance with (iv) Type, amount, and container of States. § 413.21 of this chapter. hazardous materials and radioactive (b) Relationship to other executive (h) Incorporation of payload materials in the payload; agencies. The FAA does not make a determination in license application. A (v) Explosive potential of payload determination under paragraph (a)(2) of favorable payload determination issued materials, alone and in combination this section for— for a payload or class of payload may be with other materials found on the (1) Those aspects of payloads that are included by a license applicant as part payload or reentry vehicle during subject to regulation by the Federal of its application. However, any change reentry; and Communications Commission or the in information provided under (vi) Designated reentry site. Department of Commerce; or paragraph (i) of this section must be § 450.45 Safety review and approval. (2) Payloads owned or operated by the reported in accordance with § 413.17 of (a) General. The FAA issues a safety U.S. Government. this chapter. The FAA determines (c) Classes of payloads. The FAA may approval to an applicant if it determines whether a favorable payload that an applicant can conduct launch or review and issue findings regarding a determination remains valid in light of proposed class of payload, including reentry without jeopardizing public reported changes and may conduct an health and safety and safety of property. communications, remote sensing, or additional payload review. navigation. However, prior to a launch A license applicant must satisfy the (i) Application requirements. A application requirements in this section or reentry, each payload is subject to person requesting review of a particular verification by the FAA that its launch and subpart C of this part. payload or payload class must identify (b) Services or property provided by a or reentry would not jeopardize public the following: Federal launch range. The FAA will health and safety, safety of property, (1) For launch of a payload: accept any safety-related launch or U.S. national security or foreign policy (i) Payload name or class, and reentry service or property provided by interests, or international obligations of function; a Federal launch range or other Federal the United States. (ii) Description, including physical (d) Payload owner or payload entity by contract, as long as the FAA dimensions, weight, composition, and determines that the launch or reentry operator may apply. In addition to a any hosted payloads; services or property provided satisfy launch or reentry operator, a payload (iii) Payload owner and payload this part. owner or payload operator may request operator, if different from the person (c) Issues during safety review. The a payload review and determination. requesting payload review and FAA will advise an applicant, in (e) Interagency consultation. The FAA determination, writing, of any issues raised during a consults with other agencies as follows: (iv) Any foreign ownership of the (1) The Department of Defense to safety review that would impede payload or payload operator, as issuance of a safety approval. The determine whether launch or reentry of specified in § 450.41(e)(3); applicant may respond, in writing, or a proposed payload or payload class (v) Hazardous materials as defined in amend its license application as would present any issues affecting U.S. § 401.5 of this chapter, radioactive required by § 413.17 of this chapter. national security; materials, and the amounts of each; (d) Denial of a safety approval. The (2) The Department of State to (vi) Explosive potential of payload FAA notifies an applicant, in writing, if determine whether launch or reentry of materials, alone and in combination it has denied a safety approval for a a proposed payload or payload class with other materials found on the license application. The notice states would present any issues affecting U.S. payload; the reasons for the FAA’s determination. foreign policy interests or international (vii) For orbital launches, parameters The applicant may respond in writing to obligations; or for parking, transfer and final orbits, and the reasons for the determination and (3) Other Federal agencies, including approximate transit times to final orbit; request reconsideration in accordance the National Aeronautics and Space (viii) Delivery point in flight at which with § 413.21 of this chapter. Administration, authorized to address the payload will no longer be under the (e) Application requirements. An issues of public health and safety, safety licensee’s control; applicant must submit the application of property, U.S. national security or (ix) Intended operations during the requirements information in subpart C foreign policy interests, or international lifetime of the payload, including of this part, as well as the following: obligations of the United States, anticipated life span and any planned (1) General. An application must— associated with the launch or reentry of disposal; (i) Contain a glossary of unique terms a proposed payload or payload class. (x) Any encryption associated with and acronyms used in alphabetical (f) Issues during payload review. The data storage on the payload and order; FAA will advise a person requesting a transmissions to or from the payload; (ii) Contain a listing of all referenced payload determination, in writing, of and material; any issue raised during a payload (xi) Any other information necessary (iii) Use equations and mathematical review that would impede issuance of a to make a determination based on relationships derived from or referenced license to launch or reenter that payload public health and safety, safety of to a recognized standard or text, and or payload class. The person requesting property, U.S. national security or define all algebraic parameters; payload review may respond, in writing, foreign policy interests, or international (iv) Include the units of all numerical or amend its application as required by obligations of the United States; or values provided; and § 413.17 of this chapter. (2) For reentry of a payload: (v) Include a legend or key that (g) Denial of a payload determination. (i) Payload name or class and identifies all symbols used for any The FAA notifies an applicant, in function; schematic diagrams. writing, if it has denied a favorable (ii) Physical characteristics, (2) Site description. An applicant payload determination. The notice dimensions, and weight of the payload; must identify the proposed launch or

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00131 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15426 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

reentry site, including contingency abort (iii) Describe all approvals by the following criteria apply to each launch locations, and submit the following: Nuclear Regulatory Commission for from liftoff through orbital insertion for (i) Boundaries of the site; preflight ground operations. an orbital launch, and through final (ii) Launch or landing point locations, (7) Additional material. The FAA may impact or landing for a suborbital including latitude and longitude; also request— launch: (iii) Identity of any site operator; and (i) Any information incorporated by (1) Collective risk. The collective risk, (iv) Identity of any facilities at the site reference in the license application; and measured as expected number of that will be used for pre- or post-flight (ii) Additional products that allow the casualties (EC), consists of risk posed by ground operations. FAA to conduct an independent safety impacting inert and explosive debris, (3) Vehicle description. An applicant analysis. toxic release, and far field blast must submit the following: § 450.47 Environmental review. overpressure. The FAA will determine (i) A written description of the vehicle whether to approve public risk due to or family of vehicles, including (a) General. The FAA is responsible any other hazard associated with the structural, thermal, pneumatic, for complying with the procedures and proposed flight of a launch vehicle on propulsion, electrical, and avionics and policies of the National Environmental a case-by-case basis. guidance systems used in each vehicle, Policy Act (NEPA) and other applicable (i) The risk to all members of the and all propellants. The description environmental laws, regulations, and public, excluding persons in aircraft and must include a table specifying the type Executive Orders prior to issuing a neighboring operations personnel, must and quantities of all hazardous materials launch or reentry license. An applicant not exceed an expected number of 1 × on each vehicle and must include must provide the FAA with information 10¥4 casualties. propellants, explosives, and toxic needed to comply with such (ii) The risk to all neighboring materials; and requirements. The FAA will consider operations personnel must not exceed (ii) A drawing of each vehicle that and document the potential an expected number of 2 × 10¥4 identifies: environmental effects associated with casualties. (A) Each stage, including strap-on issuing a launch or reentry license (2) Individual risk. The individual motors; consistent with paragraph (b) of this risk, measured as probability of casualty (B) Physical dimensions and weight; section. (PC), consists of risk posed by impacting (C) Location of all safety-critical (b) Environmental Impact Statement inert and explosive debris, toxic release, systems; or Environmental Assessment. An and far field blast overpressure. The (D) Location of all major vehicle applicant must— FAA will determine whether to approve control systems, propulsion systems, (1) Prepare an Environmental public risk due to any other hazard pressure vessels, and any other Assessment with FAA oversight; associated with the proposed flight of a hardware that contains potential (2) Assume financial responsibility for launch vehicle on a case-by-case basis. hazardous energy or hazardous material; preparation of an Environmental Impact (i) The risk to any individual member and Statement by an FAA-selected and of the public, excluding neighboring (E) For an unguided suborbital launch -managed consultant contractor; or operations personnel, must not exceed a vehicle, the location of the rocket’s (3) Submit a written re-evaluation of probability of casualty of 1 × 10¥6 per center of pressure in relation to its a previously submitted Environmental launch. center of gravity for the entire flight Assessment or Environmental Impact (ii) The risk to any individual profile. Statement when requested by the FAA. neighboring operations personnel must (4) Mission schedule. An applicant (c) Categorical exclusion. An not exceed a probability of casualty of must submit a generic launch or reentry applicant may request a categorical 1 × 10¥5 per launch. processing schedule that identifies any exclusion determination from the FAA (3) Aircraft risk. A launch operator readiness activities, such as reviews and by submitting the request and must establish any aircraft hazard areas rehearsals, and each safety-critical supporting rationale. necessary to ensure the probability of preflight operation to be conducted. The (d) Application requirements. An impact with debris capable of causing a mission schedule must also identify day application must include an approved casualty for aircraft does not exceed 1 × of flight activities. FAA Environmental Assessment, 10¥6. (5) Human space flight. For a Environmental Impact Statement, (4) Risk to critical assets. The proposed launch or reentry with a categorical exclusion determination, or probability of loss of functionality for human being on board a vehicle, an written re-evaluation, which should each critical asset must not exceed 1 × applicant must demonstrate compliance address compliance with any other 10¥3, or a more stringent probability if with §§ 460.5, 460.7, 460.11, 460.13, applicable environmental laws, the FAA determines, in consultation 460.15, 460.17, 460.51, and 460.53 of regulations, and Executive Orders with relevant Federal agencies, it is this chapter. covering all planned licensed activities necessary to protect the national (6) Radionuclides. The FAA will in compliance with NEPA and the security interests of the United States. evaluate the launch or reentry of any Council on Environmental Quality (b) Reentry risk criteria. An operator radionuclide on a case-by-case basis, Regulations for Implementing the may initiate the deorbit of a vehicle only and issue an approval if the FAA finds Procedural Provisions of NEPA. if all risks to the public satisfy the that the launch or reentry is consistent criteria in paragraphs (b)(1) through (4) Subpart C—Safety Requirements with public health and safety, safety of of this section. The following criteria property, and national security and Public Safety Criteria apply to each reentry, from the final foreign policy interests of the United health check prior to the deorbit burn States. For any radionuclide on a launch § 450.101 Public safety criteria. through final impact or landing: or reentry vehicle, an applicant must— (a) Launch risk criteria. An operator (1) Collective risk. The collective risk, (i) Identify the type and quantity; may initiate the flight of a launch measured as expected number of (ii) Include a reference list of all vehicle only if all risks to the public casualties (EC), consists of risk posed by documentation addressing the safety of satisfy the criteria in paragraphs (a)(1) impacting inert and explosive debris, its intended use; and through (4) of this section. The toxic release, and far field blast

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00132 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15427

overpressure. The FAA will determine between a launch or reentry vehicle the safety official’s concerns are whether to approve public risk due to stage or component and people or addressed. any other hazard associated with the property on-orbit, in accordance with (b) Procedures. An operator must proposed deorbit of a reentry vehicle on the requirements in § 450.169(a). establish procedures to evaluate the a case-by-case basis. (2) For any launch vehicle stage or operational lifecycle of the launch or (i) The risk to all members of the component that reaches Earth orbit, a reentry system: public, excluding persons in aircraft and launch operator must prevent the (1) An operator must conduct a neighboring operations personnel, must creation of debris through the preliminary safety assessment as not exceed an expected number of 1 × conversion of energy sources into required by § 450.105, and the system 10¥4 casualties. energy that fragments the stage or safety program must include: (ii) The risk to all neighboring component, in accordance with the (i) Methods to review and assess the operations personnel must not exceed requirements in § 450.171. validity of the preliminary safety an expected number of 2 × 10¥4 (f) Notification of planned impacts. assessment throughout the operational casualties. For any launch, reentry, or disposal, an lifecycle of the launch or reentry (2) Individual risk. The individual operator must notify the public of any system; risk, measured as probability of casualty region of land, sea, or air that contain, (ii) Methods for updating the (PC), consists of risk posed by impacting with 97 percent probability of preliminary safety assessment; and inert and explosive debris, toxic release, containment, all debris resulting from (iii) Methods for communicating and and far field blast overpressure. The normal flight events capable of causing implementing the updates throughout FAA will determine whether to approve a casualty. the organization. public risk due to any other hazard (g) Validity of the analysis. For any (2) For operators that must conduct a associated with the proposed flight of a analysis used to demonstrate flight hazard analysis as required by launch vehicle on a case-by-case basis. compliance with this section, an § 450.109, the system safety program (i) The risk to any individual member operator must use accurate data and must include: of the public, excluding neighboring scientific principles and be statistically (i) Methods to review and assess the operations personnel, must not exceed a valid. The method must produce results validity of the flight hazard analysis probability of casualty of 1 × 10¥6 per consistent with or more conservative throughout the operational lifecycle of reentry. than the results available from previous the launch or reentry system; (ii) The risk to any individual mishaps, tests, or other valid (ii) Methods for updating the flight hazard analysis; neighboring operations personnel must benchmarks, such as higher-fidelity (iii) Methods for communicating and not exceed a probability of casualty of methods. × ¥5 implementing the updates throughout 1 10 per reentry. System Safety Program the organization; and (3) Aircraft risk. A reentry operator (iv) A process for tracking hazards, must establish any aircraft hazard areas § 450.103 System safety program. risks, mitigation and hazard control necessary to ensure the probability of An operator must implement and measures, and verification activities. impact with debris capable of causing a document a system safety program (c) Configuration management and casualty for aircraft does not exceed 1 × throughout the operational lifecycle of a ¥ control. An operator must— 10 6. launch or reentry system that includes (1) Employ a process that tracks (4) Risk to critical assets. The the following: configurations of all safety-critical probability of loss of functionality for (a) Safety organization. An operator systems and documentation related to each critical asset must not exceed 1 × must maintain and document a safety ¥ the operation; 10 3, or a more stringent probability if organization that has clearly defined (2) Ensure the use of correct and the FAA determines, in consultation lines of communication and approval appropriate versions of systems and with relevant Federal agencies, it is authority for all public safety decisions. documentation tracked in paragraph necessary to protect the national At a minimum, the safety organization (c)(1) of this section; and security interests of the United States. must have the following positions: (3) Maintain records of launch or (c) Flight abort. An operator must use (1) Mission director. For each launch reentry system configurations and flight abort with a flight safety system or reentry, an operator must designate a document versions used for each that meets the requirements of § 450.145 position responsible for the safe conduct licensed activity, as required by as a hazard control strategy if the of all licensed activities and authorized § 450.219. consequence of any reasonably to provide final approval to proceed (d) Post-flight data review. An foreseeable vehicle response mode, in with licensed activities. This position is operator must employ a process for any one-second period of flight, is referred to as the mission director in evaluating post-flight data to— ¥ greater than 1 × 10 3 conditional this part. (1) Ensure consistency between the expected casualties for uncontrolled (2) Safety official. For each launch or assumptions used for the preliminary areas. This requirement applies to all reentry, an operator must designate a safety assessment, any hazard or flight phases of flight, unless otherwise agreed position with direct access to the safety analysis, and associated to by the Administrator based on the mission director that is— mitigation and hazard control measures; demonstrated reliability of the launch or (i) Responsible for communicating (2) Resolve any identified reentry vehicle during that phase of potential safety and noncompliance inconsistencies prior to the next flight of flight. issues to the mission director; and the vehicle; (d) Disposal safety criteria. A launch (ii) Authorized to examine all aspects (3) Identify any anomaly that may operator must ensure that any disposal of the operator’s ground and flight safety impact any flight hazard analysis, flight meets the criteria of paragraphs (b)(1), operations, and to independently safety analysis, or safety critical system, (2), and (3) of this section, or targets a monitor compliance with the operator’s or is otherwise material to public health broad ocean area. safety policies, safety procedures, and and safety and the safety of property; (e) Protection of people and property licensing requirements. and on-orbit. (1) A launch or reentry (3) Addressing safety concerns. The (4) Address any anomaly identified in operator must prevent the collision mission director must ensure that all of paragraph (d)(3) of this section prior to

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00133 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15428 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

the next flight, including updates to any with paragraphs (b), (c), and (d) of this maintain it throughout the lifecycle of flight hazard analysis, flight safety section, an operator does not need to the launch or reentry system. Hazards analysis, or safety critical system. conduct a flight hazard analysis for that associated with computing systems and (e) Application requirements. An phase of flight. software are further addressed in applicant must submit in its application (2) If the public safety hazards § 450.111. the following: identified in the preliminary safety (a) Flight hazard analysis. A flight (1) A description of the applicant’s assessment cannot be mitigated hazard analysis must identify, describe, safety organization as required by adequately to meet the public risk and analyze all reasonably foreseeable paragraph (a) of this section, identifying criteria of § 450.101 using physical hazards to public safety and safety of the applicant’s lines of communication containment, wind weighting, or flight property resulting from the flight of a and approval authority, both internally abort, in accordance with paragraphs launch or reentry vehicle. Each flight and externally, for all public safety (b), (c), and (d) of this section, an hazard analysis must— decisions and the provision of public operator must conduct a flight hazard (1) Identify all reasonably foreseeable safety services; and analysis in accordance with § 450.109 to hazards, and the corresponding vehicle (2) A summary of the processes and derive hazard controls for that phase of response mode for each hazard, products identified in the system safety flight. associated with the launch or reentry program requirements in paragraphs (b), (b) Physical containment. To use system relevant to public safety and (c), and (d) of this section. physical containment as a hazard safety of property, including those control strategy, an operator must— resulting from: Preliminary Safety Assessment for (i) Vehicle operation, including Flight and Hazard Control Strategies (1) Ensure that the launch vehicle does not have sufficient energy for any staging and release; § 450.105 Preliminary safety assessment hazards associated with its flight to (ii) System, subsystem, and for flight. reach outside the flight hazard area component failures or faults; (a) Preliminary safety assessment. An developed in accordance with (iii) Software operations; (iv) Environmental conditions; operator must conduct and document a § 450.133; and (v) Human factors; preliminary safety assessment for the (2) Apply other mitigation measures (vi) Design inadequacies; flight of a launch or reentry vehicle that to ensure no public exposure to hazards (vii) Procedure deficiencies; identifies— as agreed to by the Administrator on a (viii) Functional and physical (1) Vehicle response modes; case-by-case basis. interfaces between subsystems, (2) Public safety hazards associated (c) Wind weighting. To use wind including any vehicle payload; with vehicle response modes, including weighting as a hazard control strategy— (ix) Reuse of components or systems; impacting inert and explosive debris, (1) The launch vehicle must be a and toxic release, and far field blast suborbital rocket that does not contain (x) Interactions of any of the items in overpressure; any guidance or directional control paragraphs (a)(1)(i) through (ix) of this (3) Geographical areas where vehicle system; and section. response modes could jeopardize public (2) An operator must conduct the (2) Assess each hazard’s likelihood safety; launch using a wind weighting safety and severity. (4) Any population exposed to public system in accordance with § 450.141. (3) Ensure that the risk associated safety hazards in or near the identified (d) Flight abort. To use flight abort as with each hazard meets the following geographical areas; a hazard control strategy an operator criteria: (5) The CEC, unless otherwise agreed must employ a flight safety system, or (i) The likelihood of any hazardous to by the Administrator based on the other safeguards agreed to by the condition that may cause death or demonstrated reliability of the launch or Administrator, that meets the serious injury to the public must be reentry vehicle during any phase of requirements of § 450.145. extremely remote; and flight; (e) Application requirement. An (ii) The likelihood of any hazardous (6) A preliminary hazard list which applicant must— condition that may cause major damage documents all hardware, operational, (1) Describe its hazard control strategy to public property or critical assets must and design causes of vehicle response for each phase of flight; and be remote. modes that, excluding mitigation, have (2) If using physical containment as a (4) Identify and describe the risk the capability to create a hazard to the hazard control strategy— elimination and mitigation measures public; (i) Demonstrate that the launch required to satisfy paragraph (a)(3) of (7) Safety-critical systems; and vehicle does not have sufficient energy this section. (8) A timeline of all safety-critical for any hazards associated with its flight (5) Demonstrate that the risk events. to reach outside the flight hazard area elimination and mitigation measures (b) Application requirements. An developed in accordance with achieve the risk levels of paragraph applicant must submit the result of the § 450.133; and (a)(3) of this section through validation preliminary safety assessment, (ii) Describe the methods used to and verification. Verification includes: including all of the items identified in ensure that flight hazard areas are (i) Analysis; paragraph (a) of this section. cleared of the public and critical assets. (ii) Test; (iii) Demonstration; or § 450.107 Hazard control strategies. Flight Hazard Analyses for Hardware (iv) Inspection. (a) General. For each phase of a and Software (b) Identification of new hazards. An launch or reentry vehicle’s flight— operator must establish and document (1) If the public safety hazards § 450.109 Flight hazard analysis. the criteria and techniques for identified in the preliminary safety Unless an operator uses physical identifying new hazards throughout the assessment can be mitigated adequately containment, wind weighting, or flight lifecycle of the launch or reentry to meet the requirements of § 450.101 abort as a hazard control strategy, an system. using physical containment, wind operator must perform and document a (c) Completeness for each flight. For weighting, or flight abort, in accordance flight hazard analysis, and continue to every launch or reentry, the flight

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00134 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15429

hazard analysis must be complete and (d) Autonomous software. This (4) An operator must verify and all hazards must be mitigated to an section applies to software that validate any computing systems and acceptable level in accordance with exercises autonomous control over software. Verification and validation paragraph (a)(3) of this section. safety-critical hardware systems, must include testing by a test team (d) Updates throughout the lifecycle. subsystems, or components, such that a independent of the software An operator must continually update control entity cannot detect and development division or organization; the flight hazard analysis throughout the intervene to prevent a hazard that may and operational lifecycle of the launch or impact public health and safety or the (5) An operator must develop and reentry system. safety of property. Autonomous implement software development plans, (e) Application requirements. An software must meet the following including descriptions of the following: applicant must submit in its application criteria: (i) Coding standards used; the following: (1) The software component must be (ii) Configuration control; (1) Flight hazard analysis products of subjected to full path coverage testing. (iii) Programmable logic controllers; (iv) Policy on use of any commercial- paragraphs (a)(1) through (5) of this Any inaccessible code must be section, including data that verifies the off-the-shelf software; and documented and addressed; (v) Policy on software reuse. risk elimination and mitigation (2) The software component’s (f) Redundant fault-tolerant software. measures resulting from the applicant’s functions must be tested on flight-like This section applies to software that flight hazard analyses required by hardware. Testing must include exercises control over safety-critical paragraph (a)(5) of this section; and nominal operation and fault responses hardware systems, subsystems, or (2) The criteria and techniques for for all functions; components, for which a non-software identifying new hazards throughout the (3) An operator must conduct component must also fail in order to lifecycle of the launch or reentry system computing system and software hazard impact public health and safety or the as required by paragraph (b) of this analyses for the integrated system and safety of property. Redundant fault- section. for each autonomous, safety-critical tolerant software must meet the § 450.111 Computing systems and software component; following criteria: software. (4) An operator must verify and (1) The software component’s safety- validate any computing systems and (a) General. An operator must critical functions must be tested on software. Verification and validation implement and document a process that flight-like hardware. Testing must must include testing by a test team identifies the hazards and assesses the include nominal operation and fault independent of the software risks to public health and safety and the responses for all safety-critical development division or organization; safety of property arising from functions; and (2) An operator must conduct computing systems and software. computing system and software hazard (b) Safety-critical functions. An (5) An operator must develop and analyses for the integrated system; operator must identify all safety-critical implement software development plans, including descriptions of the following: (3) An operator must verify and functions associated with its computing validate any computing systems and systems and software. Safety-critical (i) Coding standards used; (ii) Configuration control; software. Verification and validation computing system and software must include testing by a test team functions include the following: (iii) Programmable logic controllers; (iv) Policy on use of any commercial- independent of the software (1) Software used to control or development division or organization; monitor safety-critical systems; off-the-shelf software; and (v) Policy on software reuse. and (2) Software that transmits safety- (4) An operator must develop and critical data, including time-critical data (e) Semi-autonomous software. This section applies to software that implement software development plans, and data about hazardous conditions; including descriptions of the following: (3) Software that computes safety- exercises control over safety-critical hardware systems, subsystems, or (i) Coding standards used; critical data; (ii) Configuration control; (4) Software that accesses or manages components, allowing time for (iii) Programmable logic controllers; safety-critical data; predetermined safe detection and (iv) Policy on use of any commercial- (5) Software that displays safety- intervention by a control entity to detect off-the-shelf software; and critical data; and intervene to prevent a hazard that (v) Policy on software reuse. (6) Software used for fault detection may impact public health and safety or (g) Influential software. This section in safety-critical computer hardware or the safety of property. Semi-autonomous applies to software that provides software; software must meet the following information to a person who uses the (7) Software that responds to the criteria: information to take actions or make detection of a safety-critical fault; (1) The software component’s safety- decisions that can impact public health (8) Software used in a flight safety critical functions must be subjected to and safety or the safety of property, but system; full path coverage testing. Any does not require operator action to avoid (9) Processor-interrupt software inaccessible code in a safety-critical a mishap. Influential software must associated with safety-critical computer function must be documented and meet the following criteria: system functions; and addressed; (1) An operator must conduct (10) Software used for wind (2) The software component’s safety- computing system and software hazard weighting. critical functions must be tested on analyses for the integrated system; (c) Consequence and the degree of flight-like hardware. Testing must (2) An operator must verify and control. Safety-critical functions must include nominal operation and fault validate any computing systems and be identified by consequence and the responses for all safety-critical software. Verification and validation degree of control exercised by the functions; must include testing by a test team software component as defined by (3) An operator must conduct independent of the software paragraphs (d) through (h) of this computing system and software hazard development division or organization; section. analyses for the integrated system; and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00135 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15430 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

(3) An operator must develop and (5) For hybrid vehicles, for all phases normal flight as defined by the nominal implement software development plans, of flight, unless the Administrator trajectory, and the following sets of including descriptions of the following: determines otherwise based on trajectories sufficient to characterize (i) Coding standards used; demonstrated reliability. variability and uncertainty during (ii) Configuration control; (b) Applicability. (1) Sections 450.115 normal flight: (iii) Programmable logic controllers; through 450.121 and 450.131 through (i) A set of trajectories to characterize (iv) Policy on use of any commercial- 450.139 apply to all launch and reentry variability. This set must describe how off-the-shelf software; and vehicles; the intended trajectory could vary due (v) Policy on software reuse. (2) Sections 450.123 through 450.129 to conditions known prior to initiation (h) Application requirements. An apply to a launch or reentry vehicle that of flight; and applicant must document and include relies on flight abort to comply with (ii) A set of trajectories to characterize in its application the following: § 450.101; and uncertainty. This set must describe how (1) For autonomous software: (3) Section 450.141 applies to the the actual trajectory could differ from (i) Test plans and results as required launch of an unguided suborbital the intended trajectory due to random by paragraphs (d)(1) and (2) of this launch vehicle. uncertainties. section; (2) A fuel exhaustion trajectory that § 450.115 Flight safety analysis methods. (ii) All software requirements, and produces instantaneous impact points design and architecture documentation; (a) Scope of the analysis. An with the greatest range for any given (iii) The outputs of the hazard operator’s flight safety analysis method time after liftoff for any stage that has analyses as required by paragraph (d)(3) must account for all reasonably the potential to impact the Earth and of this section; and foreseeable events and failures of safety- does not burn to propellant depletion (iv) Computing system and software critical systems during nominal and before a programmed thrust termination. validation and verification plans as non-nominal launch or reentry that (3) For vehicles with a flight safety required by paragraph (d)(4) of this could jeopardize public health and system, trajectory data or parameters section. safety, and the safety of property. that describe the limits of a useful (2) For semi-autonomous software: (b) Level of fidelity of the analysis. An mission. (i) Test plans and results as required operator’s flight safety analysis method (b) Trajectory model. A final trajectory by paragraphs (e)(1) and (2) of this must have a level of fidelity sufficient analysis must use a six-degree of section; to— freedom trajectory model to satisfy the (ii) All software requirements, and (1) Demonstrate that any risk to the requirements of paragraph (a) of this design and architecture documentation; public satisfies the public safety criteria section. (iii) The outputs of the hazard of § 450.101, including the use of (c) Wind effects. A trajectory analysis analyses as required by paragraph (e)(3) mitigations, accounting for all known must account for all wind effects, of this section; and sources of uncertainty, using a means of including profiles of winds that are no (iv) Computing system and software compliance accepted by the less severe than the worst wind validation and verification plans as Administrator; and conditions under which flight might be required by paragraph (e)(4) of this (2) Identify the dominant source of attempted, and for uncertainty in the section. each type of public risk with a criterion wind conditions. (3) For redundant fault-tolerant in § 450.101(a) or (b) in terms of phase (d) Application requirements. An software: of flight, source of hazard (such as toxic applicant must submit the following: (i) Test plans and results as required exposure, inert, or explosive debris), (1) A description of the methodology by paragraph (f)(1) of this section; and and vehicle response mode. used to characterize the vehicle’s flight (ii) All software requirements and (c) Application requirements. An behavior throughout normal flight and design documents. applicant must submit a description of limits of a useful mission, including: (4) For influential software: the flight safety analysis methodology, (i) The scientific principles and (i) The software component’s including identification of: statistical methods used; (ii) All assumptions and their development and testing; and (1) The scientific principles and justifications; (ii) The software component’s statistical methods used; (iii) The rationale for the level of functionality. (2) All assumptions and their justifications; fidelity, and (5) For software that the applicant has (iv) The evidence for validation and determined to have no safety impact, (3) The rationale for the level of fidelity; verification required by § 450.101(g). the software component’s functionality (2) A description of the input data must be described in detail. (4) The evidence for validation and verification required by § 450.101(g); used to characterize the vehicle’s flight Flight Safety Analyses (5) The extent that the benchmark behavior throughout normal flight and conditions are comparable to the limits of a useful mission, including: § 450.113 Flight safety analysis foreseeable conditions of the intended (i) The worst wind conditions under requirements—scope and applicability. operations; and which flight might be attempted, and a (a) Scope. An operator must perform (6) The extent that risk mitigations description of how the operator will and document a flight safety analysis— were accounted for in the analyses. evaluate the wind conditions and (1) For orbital launch, from liftoff uncertainty in the wind conditions prior through orbital insertion, and any § 450.117 Trajectory analysis for normal to initiating the operation; component or stage landings; flight. (ii) A description of the wind input (2) For suborbital launch, from liftoff (a) General. A flight safety analysis data, including uncertainties; through final impact; must include a trajectory analysis that (iii) A description of the parameters (3) For disposal, from the beginning of establishes— with a significant influence on the the deorbit burn through final impact; (1) For any phase of flight within the vehicle’s behavior throughout normal (4) For reentry, from the beginning of scope as provided by § 450.113(a), the flight, including a quantitative the deorbit burn through landing; and limits of a launch or reentry vehicle’s description of the nominal value for

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00136 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15431

each significant parameter throughout (4) The relative probability of § 450.121 Debris analysis. normal flight; occurrence of each malfunction turn of (a) General. A flight safety analysis (iv) A description of the random which the vehicle is capable; must include a debris analysis that uncertainties with a significant (5) The probability distribution of characterizes the debris generated for influence on the vehicle’s behavior position and velocity of the vehicle each foreseeable vehicle response mode throughout normal flight, including a when each malfunction will terminate as a function of vehicle flight time, quantitative description of the statistical due to vehicle breakup, along with the accounting for the effects of fuel burn distribution for each significant cause of termination and the state of the and any configuration changes. parameter; and vehicle; and (b) Vehicle impact or breakup. A (v) The primary mission objectives (6) The vehicle’s flight behavior from debris analysis must account for each and the conditions that describe the the time when a malfunction begins to foreseeable cause of vehicle breakup, limits of a useful mission. cause a flight deviation until ground including any breakup caused by flight (3) Representative normal flight impact or predicted structural failure, safety system activation, and for impact trajectory analysis outputs, including with trajectory time intervals that are of an intact vehicle. the position, velocity, and vacuum sufficient to establish individual risk (c) Debris thresholds. A debris instantaneous impact point, for each contours that are smooth and analysis must account for all inert, second of flight for— continuous. explosive, and other hazardous vehicle, (i) The nominal trajectory; (c) Application requirements. An vehicle component, and payload debris (ii) A fuel exhaustion trajectory under applicant must submit— foreseeable from normal and otherwise nominal conditions; (1) A description of the methodology malfunctioning vehicle flight. At a (iii) A set of trajectories that used to characterize the vehicle’s flight minimum, the debris analysis must characterize variability in the intended behavior throughout malfunction flight, identify— trajectory based on conditions known including: (1) All inert debris that can cause a prior to initiation of flight; (i) The scientific principles and casualty or loss of functionality of a (iv) A set of trajectories that statistical methods used; critical asset, including all debris that characterize how the actual trajectory (ii) All assumptions and their could— could differ from the intended trajectory justifications; (i) Impact a human being with a mean due to random uncertainties, and (iii) The rationale for the level of expected kinetic energy at impact (v) A set of trajectories that fidelity; and greater than or equal to 11 ft-lbs; characterize the limits of a useful (iv) The evidence for validation and (ii) Impact a human being with a mission as described in paragraph (a)(3) verification required by § 450.101(g). mean impact kinetic energy per unit of this section. (2) A description of the input data area at impact greater than or equal to (4) Additional products that allow an used to characterize the vehicle’s 34 ft-lb/in2; independent analysis, as requested by malfunction flight behavior, including: (iii) Cause a casualty due to impact the Administrator. (i) A list of each cause of malfunction with an aircraft; flight considered; (iv) Cause a casualty due to impact § 450.119 Trajectory analysis for (ii) A list of each type of malfunction malfunction flight. with a waterborne vessel; or flight for which malfunction flight (v) Pose a toxic or fire hazard. (a) General. A flight safety analysis behavior was characterized; (2) Any explosive debris that could must include a trajectory analysis that (iii) A description of the parameters cause a casualty or loss of functionality establishes— with a significant influence on the of a critical asset. (1) The vehicle’s capability to depart vehicle’s behavior throughout (d) Application requirements. An from normal flight; and malfunction flight for each type of applicant must submit: (2) The vehicle’s deviation capability malfunction flight characterized, (1) A description of the debris in the event of a malfunction during including a quantitative description of analysis methodology, including input flight. the nominal value for each significant data, assumptions, and justifications for (b) Characterizing foreseeable parameter throughout normal flight; and the assumptions; trajectories. A malfunction trajectory (iv) A description of the random (2) A description of all vehicle analysis must account for each cause of uncertainties with a significant breakup modes and the development of a malfunction flight, including software influence on the vehicle’s behavior debris lists; and hardware failures. For each cause of throughout malfunction flight for each (3) All debris fragment lists necessary a malfunction trajectory, the analysis type of malfunction flight characterized, to quantitatively describe the physical, must characterize the foreseeable including a quantitative description of aerodynamic, and harmful trajectories resulting from a the statistical distribution for each characteristics of each debris fragment malfunction. The analysis must account significant parameter. or fragment class; and for— (3) Representative malfunction flight (4) Additional products that allow an (1) All trajectory times during the trajectory analysis outputs, including independent analysis, as requested by thrusting phases, or when the lift vector the position, velocity, and vacuum the Administrator. is controlled, during flight; instantaneous impact point for each (2) The duration, starting when a second of flight for— § 450.123 Flight safety limits analysis. malfunction begins to cause each flight (i) Each set of trajectories that (a) General. A flight safety analysis deviation throughout the thrusting characterizes a type of malfunction must identify the location of phases of flight; flight; and uncontrolled areas and establish flight (3) Trajectory time intervals between (ii) The probability of each trajectory safety limits that define when an malfunction turn start times that are that characterizes a type of malfunction operator must initiate flight abort to— sufficient to establish flight safety flight. (1) Ensure compliance with the public limits, if any, and individual risk (4) Additional products that allow an safety criteria of § 450.101; and contours that are smooth and independent analysis, as requested by (2) Prevent debris capable of causing continuous; the Administrator. a casualty from impacting in

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00137 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15432 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

uncontrolled areas if the vehicle is a flight safety limit that provides (1) A description of the methodology outside the limits of a useful mission. containment of debris capable of used to establish each gate or relaxation (b) Flight safety limits. The analysis causing a casualty. of a flight safety limit; must identify flight safety limits for use (b) Analysis requirements. The (2) A description of the measure of in establishing flight abort rules. The analysis must establish— performance used to determine whether flight safety limits must— (1) A relaxation of the flight safety a vehicle will be allowed to cross a gate (1) Account for temporal and limits that allows continued flight or a without flight abort, the acceptable geometric extents on the Earth’s surface gate where a decision will be made to ranges of the measure of performance, of any vehicle hazards resulting from abort the launch or reentry, or allow and how these ranges were determined; any planned or unplanned event for all continued flight; (3) A graphic depiction or depictions times during flight; (2) If a gate is established, a measure showing representative flight safety (2) Account for potential of performance at the gate that enables limits, any uncontrolled area overflight contributions to the debris impact the flight abort crew or autonomous regions, and instantaneous impact point dispersions; and flight safety system to determine traces for the nominal trajectory, extents (3) Be designed to avoid flight abort whether the vehicle is able to complete of normal flight, and limits of a useful that results in increased collective risk a useful mission, and abort the flight if mission trajectories; and to people in uncontrolled areas, it is not; (4) Additional products that allow an independent analysis, as requested by compared to continued flight. (3) Accompanying flight abort rules; the Administrator. (c) Gates. For an orbital launch, or any and launch or reentry where one or more (4) For an orbital launch, a gate at the § 450.127 Data loss flight time and planned trajectories that represents a useful last opportunity to determine whether safe flight state analyses. mission intersects a flight safety limit the vehicle’s flight is in compliance (a) General. For each flight, a flight that provides containment of debris with the flight abort rules and can make safety analysis must establish data loss capable of causing a casualty, the flight a useful mission, and abort the flight if flight times and a planned safe flight safety analysis must include a gate it is not. state to establish each flight abort rule analysis as required by § 450.125. (c) Gate extents. The extents of any that applies when vehicle tracking data (d) Real-time flight safety limits. As an gate or relaxation of the flight safety is not available for use by the flight alternative to flight safety limits limits must be based on normal abort crew or autonomous flight safety analysis, flight abort time can be trajectories, trajectories that may system. computed and applied in real-time achieve a useful mission, collective risk, (b) Data loss flight times. (1) A flight during vehicle flight as necessary to and consequence criteria as follows: safety analysis must establish a data loss meet the criteria in § 450.101. (1) Flight safety limits must be gated flight time for each trajectory time (e) Application requirements. An or relaxed where they intersect with a interval along the nominal trajectory applicant must submit: normal trajectory if that trajectory from initiation of the flight of a launch (1) A description of how each flight would meet the individual and or reentry vehicle through that point safety limit will be computed including collective risk criteria of § 450.101(a)(1) during nominal flight when the references to public safety criteria of and (2) or (b)(1) and (2) when treated minimum elapsed thrusting or gliding § 450.101; like a nominal trajectory with normal time is no greater than the time it would (2) Representative flight safety limits trajectory dispersions. The predicted take for a normal vehicle to reach the and associated parameters; final gate crossing, or the planned safe (3) An indication of which flight abort average consequence from flight abort resulting from any reasonable vehicle flight state established under paragraph rule from § 450.165(c) is used in (c) of this section, whichever occurs conjunction with each example flight response mode, in any one-second period of flight, using the modified earlier. safety limit; × (2) Data loss flight times must account (4) A graphic depiction or series of flight safety limits, must not exceed 1 ¥2 for forces that may stop the vehicle depictions of representative flight safety 10 conditional expected casualties; (2) Flight safety limits may be gated before reaching a flight safety limit. limits, the launch or landing point, all (3) Data loss flight times may be uncontrolled area boundaries, and or relaxed where they intersect with a trajectory within the limits of a useful computed and applied in real-time vacuum instantaneous impact point during vehicle flight in which case the traces for the nominal trajectory, extents mission if that trajectory would meet the individual and collective risk criteria of state vector just prior to loss of data of normal flight, and limits of a useful should be used as the nominal state § 450.101(a)(1) and (2) or (b)(1) and (2) mission trajectories; vector. when treated like a nominal trajectory (5) If the requirement for flight abort (c) Planned safe flight state. For a is computed in real-time in lieu of with normal trajectory dispersions. The vehicle that performs normally during precomputing flight safety limits, a predicted average consequence from all portions of flight, the planned safe description of how the real-time flight flight abort resulting from any flight state is the point during the abort requirement is computed reasonable vehicle response mode, in nominal flight of a vehicle where— including references to public safety any one-second period of flight, using (1) The vehicle cannot reach a flight criteria of § 450.101; and the modified flight safety limits, must safety limit for the remainder of the × ¥2 (6) Additional products that allow an not exceed 1 10 conditional flight; independent analysis, as requested by expected casualties; and (2) The vehicle achieves orbital the Administrator. (3) For an orbital launch, in areas insertion; or where no useful mission trajectories (3) The vehicle’s state vector reaches § 450.125 Gate analysis. intersect with flight safety limits, the a state where the vehicle is no longer (a) Applicability. The flight safety final gate may extend no further than required to have a flight safety system. analysis must include a gate analysis for necessary to allow vehicles on a useful (d) Application requirements. An an orbital launch or any launch or mission to continue flight. applicant must submit: reentry where one or more trajectories (d) Application requirements. An (1) A description of the methodology that represent a useful mission intersect applicant must submit: used to determine data loss flight times;

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00138 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15433

(2) Tabular data describing the data (1) The flight of a launch vehicle in a casualty. The analysis must account loss flight times from a representative begins at a time in which a launch for, at a minimum— mission; vehicle normally or inadvertently lifts (1) The regions of land, sea, and air (3) The safe flight state for a off from a launch platform; and potentially exposed to debris impact representative mission and methodology (2) The flight of a reentry vehicle or resulting from normal flight events and used to determine it; and deorbiting upper stage begins at a time from debris hazards resulting from any (4) Additional products that allow an in which a vehicle attempts to initiate potential malfunction; independent analysis, as requested by a deorbit. (2) Any hazard controls implemented the Administrator. (d) Allocation. The vehicle failure to control risk to any hazard; probability estimate must be distributed § 450.129 Time delay analysis. (3) The limits of a launch or reentry across flight time and vehicle response (a) General. A flight safety analysis vehicle’s normal flight, including winds mode. The distribution must be that are no less severe than the worst must include a time delay analysis that consistent with— establishes the mean elapsed time wind conditions under which flight (1) The data available from all might be attempted and uncertainty in between the violation of a flight abort previous flights of vehicles developed rule and the time when the flight safety the wind conditions; and launched or reentered in similar (4) The debris identified for each system is capable of aborting flight for circumstances; and use in establishing flight safety limits. foreseeable cause of breakup, and any (2) Data from previous flights of planned jettison of debris, launch or The time delay analysis must determine vehicles, stages, or components a time delay distribution that accounts reentry vehicle components, or payload; developed and launched or reentered by (5) All foreseeable sources of debris for all foreseeable sources of delay. the subject vehicle developer or (b) Application requirements. An dispersion during freefall, including operator. Such data may include applicant must submit: wind effects, guidance and control, (1) A description of the methodology previous experience involving similar— velocity imparted by break-up or (i) Vehicle, stage, or component used in the time delay analysis; jettison, lift, and drag forces; and (2) A tabular listing of each time delay design characteristics; (6) A probability of one for any source and the total delay, with (ii) Development and integration planned debris hazards or planned uncertainty; and processes, including the extent of impacts. (3) Additional products that allow an integrated system testing; and (b) Waterborne vessel hazard areas. (iii) Level of experience of the vehicle independent analysis, as requested by The flight hazard area analysis for operation and development team the Administrator. waterborne vessels must determine the members. areas and durations for regions of § 450.131 Probability of failure analysis. (e) Observed vs. conditional failure water— rate. Probability of failure allocation (a) General. For each hazard and (1) That are necessary to contain, with must account for significant differences phase of flight, a flight safety analysis 97 percent probability of containment, in the observed failure rate and the for a launch or reentry must account for all debris resulting from normal flight conditional failure rate. A probability of vehicle failure probability. The events capable of causing a casualty to probability of failure must be consistent failure analysis must use a constant persons on waterborne vessels; for all hazards and phases of flight. conditional failure rate for each phase of (2) That are necessary to contain (1) For a vehicle or vehicle stage with flight, unless there is clear and either where the probability of debris fewer than two flights, the failure convincing evidence of a different capable of causing a casualty impacting probability estimate must account for conditional failure rate for a particular on or near a vessel would exceed 1 × the outcome of all previous flights of vehicle, stage, or phase of flight. ¥5 vehicles developed and launched or (f) Application requirements. An 10 , accounting for all relevant reentered in similar circumstances. applicant must submit: hazards, or where the individual (2) For a vehicle or vehicle stage with (1) A description of the probability of probability of casualty for any person on two or more flights, vehicle failure failure analysis, including all board a vessel would exceed the probability estimates must account for assumptions and justifications for the criterion in § 450.101(a)(2) or (b)(2); and the outcomes of all previous flights of assumptions, analysis methods, input (3) Where reduced vessel traffic is the vehicle or vehicle stage in a data, and results; necessary to meet collective risk statistically valid manner. The outcomes (2) A representative set of tabular data criterion in § 450.101(a)(1) or (b)(1). of all previous flights of the vehicle or and graphs of the predicted failure rate (c) Land hazard areas. The flight vehicle stage must account for data on and cumulative failure probability for hazard area analysis for land must partial failures and anomalies, including each foreseeable vehicle response mode; determine the durations and areas Class 3 and Class 4 mishaps, as defined and regions of land— in § 401.5 of this chapter. (3) Additional products that allow an (1) That are necessary to contain, with (b) Failure. For flight safety analysis independent analysis, as requested by 97 percent probability of containment, purposes, a failure occurs when a the Administrator. all debris resulting from normal flight vehicle does not complete any phase of events capable of causing a casualty to normal flight or when any anomalous § 450.133 Flight hazard area analysis. any person on land; condition exhibits the potential for a (a) General. A flight safety analysis (2) Where the individual probability stage or its debris to impact the Earth or must include a flight hazard area of casualty for any person on land reenter the atmosphere outside the analysis that identifies any region of would exceed the criterion in normal trajectory envelope during the land, sea, or air that must be surveyed, § 450.101(a)(2) or (b)(2); and mission or any future mission of similar publicized, controlled, or evacuated in (3) Where reduced population is vehicle capability. Also, a Class 1 or order to control the risk to the public. necessary to meet the collective risk Class 2 mishap, as defined in § 401.5 of A flight hazard area analysis must criterion in § 450.101(a)(1) or (b)(1). this chapter, constitutes a failure. account for all reasonably foreseeable (d) Airspace hazard volumes. The (c) Previous flight. For flight safety vehicle response modes during nominal flight hazard area analysis for airspace analysis purposes— and non-nominal flight that could result must determine the durations and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00139 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15434 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

volumes for regions of air to be valid debris impact probability (3) The vulnerability of people and submitted to the FAA for approval— distributions using the input data critical assets to debris impacts, (1) That are necessary to contain, with produced by flight safety analyses including: 97 percent probability of containment, required in §§ 450.117 through 450.133. (i) Effects of buildings, ground all debris resulting from normal flight The propagation of debris from each vehicles, waterborne vessel, and aircraft events capable of causing a casualty to predicted breakup location to impact upon the vulnerability of any occupants; persons on an aircraft; and must account for— (ii) All hazard sources, such as the (2) Where the probability of impact on (1) All foreseeable forces that can potential for any toxic or explosive an aircraft would exceed the criterion in influence any debris impact location; energy releases; § 450.101(a)(3) or (b)(3). and (iii) Indirect or secondary effects such (e) Application requirements. An (2) All foreseeable sources of impact as bounce, splatter, skip, slide or applicant must submit: dispersion, including, at a minimum: ricochet, including accounting for (1) A description of the methodology (i) The uncertainties in atmospheric terrain; to be used in the flight hazard area (iv) Effect of wind on debris impact conditions; analysis including all assumptions and vector and toxic releases; (ii) Debris aerodynamic parameters; justifications for the assumptions, (v) Impact speed and angle, (iii) Pre-breakup position and vulnerability models, analysis methods, accounting for motion of impacted velocity; and input data, including: vehicles; (i) Input wind data and justification (iv) Breakup-imparted velocities. (vi) Uncertainty in fragment impact that those represent the worst wind (c) Exposure model. A debris risk parameters; and conditions under which flight might be analysis must account for the (vii) Uncertainty in modeling attempted accounting for uncertainty in distribution of people and critical methodology. the wind conditions; assets. The exposure input data must— (e) Application requirements. An (ii) Classes of waterborne vessel and (1) Include the entire region where applicant must submit: vulnerability criteria employed; and there is a significant probability of (1) A description of the methods used (iii) Classes of aircraft and impact of hazardous debris; to compute the parameters required to vulnerability criteria employed. (2) Characterize the distribution and demonstrate compliance with the public (2) Tabular data and graphs of the vulnerability of people and critical safety criteria in § 450.101, including a results of the flight hazard area analysis, assets both geographically and description of how the operator will including: temporally; account for the conditions immediately (i) Geographical coordinates of all (3) Account for the distribution of prior to enabling the flight of a launch hazard areas that are representative of people in various structures and vehicle vehicle or the reentry of a reentry those to be published prior to any types with a resolution consistent with vehicle, such as the final trajectory, proposed operation; the characteristic size of the impact atmospheric conditions, and the (ii) Representative 97 percent probability distributions for relevant exposure of people and critical assets; probability of containment contours for fragment groups; (2) A description of the methods used all debris resulting from normal flight (4) Have sufficient temporal and to compute debris impact distributions; events capable of causing a casualty, spatial resolution that a uniform (3) A description of the methods used regardless of location, including regions distribution of people within each to develop the population exposure of land, sea, or air; defined region can be treated as a single input data; (iii) Representative individual average set of characteristics without (4) A description of the exposure probability of casualty contours degrading the accuracy of any debris input data, including, for each regardless of location; analysis output; population center, a geographic × (iv) If applicable, representative 1 (5) Use accurate source data from definition and the distribution of ¥5 × ¥6 10 and 1 10 probability of impact demographic sources, physical surveys, population among shelter types as a contours for all debris capable of or other methods; function of time of day, week, month, or year; causing a casualty to persons on an (6) Be regularly updated to account waterborne vessel regardless of location; (5) A description of the atmospheric for recent land-use changes, population data used as input to the debris risk and growth, migration, and construction; × ¥6 × analysis; (v) Representative 1 10 and 1 and 10¥7 probability of impact contours for (6) The effective unsheltered casualty (7) Account for uncertainty in the area for all fragment classes assuming a all debris capable of causing a casualty source data and modeling approach. to persons on an aircraft regardless of representative impact vector; (d) Casualty area and consequence (7) The effective casualty area for all location. analysis. A debris risk analysis must (3) Additional products that allow an fragment classes for a representative model the casualty area, and compute type of building, ground vehicle, independent analysis, as requested by the predicted consequences of each the Administrator. waterborne vessel, and aircraft, reasonably foreseeable vehicle response assuming a representative impact § 450.135 Debris risk analysis. mode in any one-second period of flight vector; (a) General. A debris risk analysis in terms of conditional expected (8) Collective and individual debris must demonstrate compliance with casualties. The casualty area and risk analysis outputs under public safety criteria in § 450.101, consequence analysis must account representative conditions and the worst either— for— foreseeable conditions, including: (1) Prior to the day of the operation, (1) All relevant debris fragment (i) Total collective casualty accounting for all foreseeable conditions characteristics and the characteristics of expectation for the proposed operation; within the flight commit criteria; or a representative person exposed to any (ii) A list of the collective risk (2) During the countdown using the potential debris hazard. contribution for at least the top ten best available input data. (2) Any direct impacts of debris population centers and all centers with (b) Propagation of debris. A debris fragments, intact impact, or indirect collective risk exceeding 1 percent of risk analysis must compute statistically impact effects. the collective risk criterion in § 450.101;

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00140 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15435

(iii) A list of the maximum individual window characteristics used as input to release through one of the following probability of casualty for the top ten the far-field overpressure analysis; means: population centers and all centers that (2) A description of the methods used (i) Contain hazards caused by toxic exceed 10 percent of the individual risk to compute the foreseeable explosive release in accordance with paragraph (d) criterion in § 450.101; and yield probability pairs, and the of this section; or (iv) A list of the probability of loss of complete set of yield-probability pairs, (ii) Perform a toxic risk assessment, in functionality of any critical asset that used as input to the far-field accordance with paragraph (e) of this exceeds 1 percent of the critical asset overpressure analysis; section, that protects the public in criterion in § 450.101; (3) A description of the methods used compliance with the risk criteria of (9) A list of the conditional collective to compute peak incident overpressures § 450.101, including toxic release casualty expectation for each vehicle as a function of distance from the hazards. response mode for each one-second explosion and prevailing meteorological (3) Establish flight commit criteria interval of flight under representative conditions, including sample based on the results of its toxic release conditions and the worst foreseeable calculations for a representative range of hazard analysis, containment analysis, conditions; and the foreseeable meteorological or toxic risk assessment for any (10) Additional products that allow an conditions, yields, and population necessary evacuation of the public from independent analysis, as requested by center locations; any toxic hazard area. the Administrator. (4) A description of the methods used (c) Toxic release hazard analysis. A to compute the probability of window toxic release hazard analysis must— § 450.137 Far-field overpressure blast breakage, including tabular data and (1) Account for any toxic release that effects analysis. graphs for the probability of breakage as could occur during nominal or non- (a) General. The far-field overpressure a function of the peak incident nominal flight; blast effect analysis must demonstrate overpressure for a representative range (2) Include a worst-case release compliance with public safety criteria in of window types, building types, and scenario analysis or a maximum- § 450.101, either— yields accounted for; credible release scenario analysis; (1) Prior to the day of the operation, (5) A description of the methods used (3) Determine if toxic release can accounting for all foreseeable conditions to compute the probability of casualty occur based on an evaluation of the within the flight commit criteria; or for a representative individual, chemical compositions and quantities of (2) During the countdown using the including tabular data and graphs for propellants, other chemicals, vehicle best available input data. the probability of casualty, as a function materials, and projected combustion (b) Analysis constraints. The analysis of location relative to the window and products, and the possible toxic release must account for— the peak incident overpressure for a scenarios; (1) The potential for distant focus representative range of window types, (4) Account for both normal overpressure or overpressure building types, and yields accounted combustion products and any unreacted enhancement given current for; propellants and phase change or meteorological conditions and terrain (6) Tabular data and graphs showing chemical derivatives of released characteristics; the hypothetical location of any member substances; and (2) The potential for broken windows of the public that could be exposed to (5) Account for any operational due to peak incident overpressures a probability of casualty of 1 × 10¥5 or constraints and emergency procedures below 1.0 psi and related casualties; greater for neighboring operations that provide protection from toxic (3) The explosive capability of the personnel, and 1 × 10¥6 or greater for release. vehicle at impact and at altitude and other members of the public, given (d) Toxic containment. An operator potential explosions resulting from foreseeable meteorological conditions, using toxic containment must manage debris impacts, including the potential yields, and population exposures; the risk of any casualty from the for mixing of liquid propellants; (7) The maximum expected casualties exposure to toxic release either by— (4) Characteristics of the vehicle flight that could result from far-field (1) Evacuating, or being prepared to and the surroundings that would affect overpressure hazards greater given evacuate, the public from a toxic hazard the population’s susceptibility to injury, foreseeable meteorological conditions, area, where an average member of the including shelter types and time of day yields, and population exposures; public would be exposed to greater than of the proposed operation; (8) A description of the one percent conditional individual (5) Characteristics of the potentially meteorological measurements used as probability of casualty in the event of a affected windows, including their size, input to any real-time far-field worst-case release or maximum credible location, orientation, glazing material, overpressure analysis; and release scenario; or and condition; and (9) Additional products that allow an (2) Employing meteorological (6) The hazard characteristics of the independent analysis, as requested by constraints to limit a launch operation potential glass shards, including falling the Administrator. to times during which prevailing winds from upper building stories or being and other conditions ensure that an propelled into or out of a shelter toward § 450.139 Toxic hazards for flight. average member of the public would not potentially occupied spaces. (a) Applicability. This section applies be exposed to greater than one percent (c) Application requirements. An to any launch or reentry vehicle, conditional individual probability of applicant must submit a description of including all vehicle components and casualty in the event of a worst-case the far-field overpressure analysis, payloads, that use toxic propellants or release or maximum credible release including all assumptions and other toxic chemicals. scenario. justifications for the assumptions, (b) General. An operator must— (e) Toxic risk assessment. An operator analysis methods, input data, and (1) Conduct a toxic release hazard using toxic risk assessment must results. At a minimum, the application analysis in accordance with paragraph establish flight commit criteria that must include: (c) of this section; demonstrate compliance with the public (1) A description of the population (2) Manage the risk of casualties that risk criterion of § 450.101. A toxic risk centers, terrain, building types, and could arise from the exposure to toxic assessment must—

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00141 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15436 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

(1) Account for airborne concentration (8) For toxic risk assessment in equipment used to perform the wind and duration thresholds of toxic accordance with paragraph (e) of this weighting analysis; propellants or other chemicals. For any section: (3) A representative wind weighting toxic propellant, other chemicals, or (i) A demonstration that the public analysis using actual or statistical winds combustion product, an operator must will not be exposed to airborne for the launch area and provide samples use airborne toxic concentration and concentrations above the toxic of the output; and duration thresholds identified in a concentration and duration thresholds, (4) Additional products that allow an means of compliance accepted by the based upon representative results of the independent analysis, as requested by Administrator; toxic release hazard analysis; the Administrator. (2) Account for physical phenomena (ii) The population density in receptor expected to influence any toxic locations that are identified by toxic Prescribed Hazard Controls concentration and duration in the area dispersion modeling as toxic hazard § 450.143 Safety-critical system design, surrounding the potential release site; areas; test, and documentation. (3) Determine a toxic hazard area for (iii) A description of any risk mitigations applied in the toxic risk (a) Applicability. This section applies the launch or reentry, surrounding the to all safety-critical systems. Flight potential release site for each toxic assessment; and (iv) The identity of the population safety systems that are required to meet propellant or other chemical based on the requirements of § 450.101(c) must the amount and toxicity of the database used; and (9) Additional products that allow an meet additional requirements in propellant or other chemical, the § 450.145. exposure duration, and the independent analysis, as requested by the Administrator. (b) Fault-tolerant design. An operator meteorological conditions involved; must design safety-critical systems to be (4) Account for all members of the § 450.141 Wind weighting for the flight of fault-tolerant such that there is no single public that may be exposed to the toxic an unguided suborbital launch vehicle. credible fault that can lead to increased release, including all members of the (a) Applicability. This section applies risk to public safety beyond nominal public on land and on any waterborne to the flight of an unguided suborbital safety-critical system operation. vessels, populated offshore structures, launch vehicle using wind weighting to (c) Qualification testing of design. An and aircraft that are not operated in meet the public safety criteria of operator must functionally demonstrate direct support of the launch or reentry; § 450.101. the design of the vehicle’s safety-critical and (b) Wind weighting safety system. The systems at conditions beyond its (5) Account for any risk mitigation flight of an unguided suborbital launch predicted operating environment. The measures applied in the risk assessment. vehicle that uses a wind weighting operator must select environmental test (f) Application requirements. An safety system must meet the following: levels that ensure the design is applicant must submit: (1) The launcher azimuth and sufficiently stressed to demonstrate that (1) The identity of toxic propellant, elevation settings must be wind chemical, or combustion products or system performance is not degraded due weighted to correct for the effects of to design tolerances, manufacturing derivatives in the possible toxic release; wind conditions at the time of flight to (2) The applicant’s selected airborne variances, or uncertainties in the provide a safe impact location; and environment. toxic concentration and duration (2) An operator must use launcher thresholds; (d) Acceptance of hardware. An azimuth and elevation angle settings operator must— (3) The meteorological conditions for that ensures the rocket will not fly in an the atmospheric transport and buoyant (1) Functionally demonstrate any unintended direction given wind safety-critical system while exposed to cloud rise of any toxic release from its uncertainties. source to downwind receptor locations; its predicted operating environment (c) Analysis. An operator must— with margin to demonstrate that it is (4) Characterization of the terrain, as (1) Establish flight commit criteria free of defects, free of integration and input for modeling the atmospheric and other flight safety rules that control workmanship errors, and ready for transport of a toxic release from its the risk to the public from potential operational use; or source to downwind receptor locations; adverse effects resulting from normal (2) Combine in-process controls and a (5) The identity of the toxic and malfunctioning flight; dispersion model used, and any other (2) Establish any wind constraints quality assurance process to ensure input data; under which flight may occur; and functional capability of any safety- (6) Representative results of an (3) Conduct a wind weighting analysis critical system during its service life. applicant’s toxic dispersion modeling to that establishes the launcher azimuth (e) Lifecycle of safety-critical systems. predict concentrations and durations at and elevation settings that correct for (1) The predicted operating selected downwind receptor locations, the windcocking and wind-drift effects environment must be based on to determine the toxic hazard area for a on the unguided suborbital launch conditions predicted to be encountered released quantity of the toxic substance; vehicle. in all phases of flight, recovery, and (7) For toxic release hazard analysis in (d) Stability. An unguided suborbital transportation. accordance with paragraph (c) of this launch vehicle, in all configurations, (2) An operator must monitor the section: must be stable throughout each stage of flight environments experienced by (i) A description of the failure modes powered flight. safety-critical system components to the and associated relative probabilities for (e) Application requirements. An extent necessary to— potential toxic release scenarios used in applicant must submit: (i) Validate the predicted operating the risk evaluation; and (1) A description of its wind environment; and (ii) The methodology and weighting analysis methods, including (ii) Assess the actual component life representative results of an applicant’s its method and schedule of determining remaining or adjust any inspection determination of the worst-case or wind speed and wind direction for each period. maximum-credible quantity of any toxic altitude layer; (f) Application requirements. An release that might occur during the (2) A description of its wind applicant must submit to the FAA the flight of a vehicle; weighting safety system and identify all following as part of its application:

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00142 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15437

(1) A list and description of each (1) Flight safety system description. the respective launch and reentry safety-critical system; An applicant must describe the flight windows, and for other measures (2) Drawings and schematics for each safety system and its operation in detail, necessary to protect public health and safety-critical system; including all components, component safety; and (3) A summary of the analysis to functions, and possible operational (4) Mishap response. Emergency determine the predicted operating scenarios. response providers, including local environment and duration to be applied (2) Flight safety system diagram. An government authorities, to satisfy the to qualification and acceptance testing applicant must submit a diagram that requirements of § 450.173. covering the service life of any safety- identifies all flight safety system (b) Roles and responsibilities. The critical system; subsystems and shows the agreements required in this section must (4) A description of any interconnection of all the elements of clearly delineate the roles and instrumentation or inspection processes the flight safety system. The diagram responsibilities of each party to support to monitor aging of any safety-critical must include any subsystems used to the safe launch or reentry under this system; and implement flight abort both on and off part. (5) The criteria and procedures for the vehicle, including any subsystems (c) Effective date. The agreements disposal or refurbishment for service life used to make the decision to abort required in this section must be in effect extension of safety-critical system flight. before a license can be issued, unless components. (3) Flight safety system analyses. An otherwise agreed to by the applicant must submit any analyses and Administrator. § 450.145 Flight safety system. detailed analysis reports of all flight (d) Application requirement. The (a) General. For each phase of flight safety system subsystems necessary to applicant must describe each agreement for which an operator must implement demonstrate the reliability and in this section. The applicant must flight abort to meet the requirement of confidence levels required by paragraph provide a copy of any agreement, or § 450.101(c), the operator must use a (a) of this section. portion thereof, to the FAA upon flight safety system, or other safeguards (4) Tracking validation procedures. request. An applicant must document and agreed to by the Administrator, on the § 450.149 Safety-critical personnel launch or reentry vehicle, vehicle submit the procedures for validating the qualifications. accuracy of any vehicle tracking data component, or payload with the (a) Qualification requirements. An utilized by the flight safety system to following reliability: operator must ensure safety-critical make the decision to abort flight. (1) If the consequence any vehicle personnel are trained, qualified, and response mode is 1 × 10¥2 conditional (5) Flight safety system test plans. An applicant must submit acceptance, capable of performing their safety- expected casualties or greater for critical tasks, and that their training is uncontrolled areas, an operator must qualification, and preflight test plans of any flight safety system, subsystems, current. employ a flight safety system with (b) Application requirements. An and components. The test plans must design reliability of 0.999 at 95 percent applicant must— include test procedures and test confidence and commensurate design, (1) Identify safety-critical tasks that environments. analysis, and testing; or require qualified personnel; (2) If the consequence of any vehicle § 450.147 Agreements. (2) Provide internal training and × ¥2 response mode is between 1 10 and (a) General. An operator must currency requirements, completion × ¥3 1 10 conditional expected casualties establish a written agreement with any standards, or any other means of for uncontrolled areas, an operator must entity that provides a service or demonstrating compliance with the employ a flight safety system with a property that meets a requirement in requirements of this section; and design reliability of 0.975 at 95 percent this part, including: (3) Describe the process for tracking confidence and commensurate design, (1) Launch and reentry site use training currency. analysis, and testing. agreements. A Federal launch range § 450.151 Work shift and rest (b) Accepted means of compliance. To operator, a licensed launch or reentry requirements. comply with paragraph (a) of this site operator, or any other person that (a) General. For any launch or reentry, section, an applicant must use a means provides services or access to or use of an operator must document and of compliance accepted by the property required to support the safe implement rest requirements that ensure Administrator. launch or reentry under this part; safety-critical personnel are physically (c) Monitoring. An operator must (2) Agreements for notices to and mentally capable of performing all monitor the flight environments mariners. Unless otherwise addressed in assigned tasks. experienced by any flight safety system agreements with the site operator, for (b) Specific items to address. An component. overflight of navigable water, the U.S. operator’s rest requirements must (d) Application requirements. An Coast Guard or other applicable address the following: applicant must submit the information maritime authority to establish (1) Duration of each work shift and identified in paragraphs (d)(1) through procedures for the issuance of a Notice the process for extending this shift, (5) of this section, for any flight safety to Mariners prior to a launch or reentry including the maximum allowable system including any flight safety and other measures necessary to protect length of any extension; system located on board a launch or public health and safety; (2) Number of consecutive work shift reentry vehicle; any ground based (3) Agreements for notices to airmen. days allowed before rest is required; command control system; any support Unless otherwise addressed in (3) Minimum rest period required— system, including telemetry subsystems agreements with the site operator, the (i) Between each work shift, including and tracking subsystems, necessary to FAA Air Traffic Organization or other the period of rest required immediately support a flight abort decision; and the applicable air navigation authority to before the flight countdown work shift; functions of any personnel who operate establish procedures for the issuance of and the flight safety system hardware or a Notice to Airmen prior to a launch or (ii) After the maximum number of software: reentry, for closing of air routes during work shift days allowed; and

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00143 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15438 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

(4) Approval process for any deviation resume,’’ ‘‘go/no go,’’ and any abort (2) A description of how it will from the rest requirements. commands; establish flight commit criteria based on (c) Application requirements. An (3) Ensure personnel, identified in the results of its toxic release hazard applicant must submit rest rules that paragraph (a)(1) of this section, monitor analysis, containment analysis, or toxic demonstrate compliance with the each common intercom channel during risk assessment for any necessary requirements of this section. countdown and flight; and evacuation of the public from any toxic (4) Implement a protocol for using hazard area. § 450.153 Radio frequency management. defined radio telephone (a) Frequency management. For any communications terminology. § 450.163 Lightning hazard mitigation. radio frequency used, an operator (b) Currency. An operator must ensure (a) Lighting hazard mitigation. An must— the currency of the communication operator must— (1) Identify each frequency, all procedures, and that all personnel are (1) Establish flight commit criteria allowable frequency tolerances, and working with the approved version of that mitigate the potential for a launch each frequency’s intended use, the communication procedures. or reentry vehicle intercepting or operating power, and source; (c) Communication records. An initiating a lightning strike, or (2) Provide for the monitoring of operator must record all safety-critical encountering a nearby discharge, using frequency usage and enforcement of communications network channels that a means of compliance accepted by the frequency allocations; and are used for voice, video, or data Administrator; (3) Coordinate use of radio transmissions that support safety critical (2) Use a vehicle designed to continue frequencies with any site operator and systems during each countdown. safe flight in the event of a direct lightning strike or nearby discharge; or any local and Federal authorities. § 450.159 Preflight procedures. (b) Application requirements. An (3) Ensure compliance with § 450.101, (a) Preflight procedures. An operator applicant must submit procedures or given any direct lightning strike or an must implement preflight procedures other means to demonstrate compliance encounter with a nearby discharge. that— (b) Application requirements. (1) An with the radio frequency requirements (1) Verify that each flight commit applicant electing to comply with of this section. criterion is satisfied before flight is paragraph (a)(1) of this section must § 450.155 Readiness. initiated; and submit flight commit criteria that (2) Ensure the operator can return the (a) Flight readiness. An operator must mitigate the potential for a launch or vehicle to a safe state after a countdown document and implement procedures to reentry vehicle intercepting or initiating abort or delay. assess readiness to proceed with the a direct lightning strike, or encountering (b) Currency. An operator must ensure a nearby lightning discharge. flight of a launch or reentry vehicle. the currency of the preflight procedures, These procedures must address, at (2) An applicant electing to comply and that all personnel are working with with paragraph (a)(2) of this section minimum, the following: the approved version of the preflight (1) Readiness of vehicle and launch, must submit documentation providing procedures. evidence that the vehicle is designed to reentry, or landing site, including any protect safety-critical systems against contingency abort location; § 450.161 Surveillance and publication of the effects of a direct lightning strike or (2) Readiness of safety-critical hazard areas. nearby discharge. personnel, systems, software, (a) General. The operator must (3) An applicant electing to comply procedures, equipment, property, and publicize, survey, and evacuate each with paragraph (a)(3) of this section services; and flight hazard area prior to initiating must submit documentation providing (3) Readiness to implement the flight of a launch vehicle or the reentry evidence that the safety criteria in mishap plan required by § 450.173. of a reentry vehicle to the extent § 450.101 will be met given any direct (b) Application requirements. An necessary to ensure compliance with lightning strike or an encounter with a applicant must— § 450.101. nearby discharge. (1) Demonstrate compliance with the (b) Verification. The launch or reentry requirements of paragraph (a) of this operator must perform surveillance § 450.165 Flight safety rules. section through procedures that may sufficient to verify or update the (a) General. For each launch or include a readiness meeting close in assumptions, input data, and results of reentry, an operator must establish and time to flight; and the flight safety analyses. observe flight safety rules that govern (2) Describe the criteria for (c) Publication. An operator must the conduct of the launch or reentry. establishing readiness to proceed with publicize warnings for each flight (b) Flight commit criteria. The flight the flight of a launch or reentry vehicle. hazard area, except for regions of land, safety rules must include flight commit sea, or air under the control of the criteria that identify each condition § 450.157 Communications. vehicle operator, site operator, or other necessary prior to flight of a launch (a) Communication procedures. An entity by agreement. If the operator vehicle or the reentry of a reentry operator must implement relies on another entity to publicize vehicle to satisfy the requirements of communication procedures during the these warnings, it must verify that the § 450.101, and must include: countdown and flight of a launch or warnings have been issued. (1) Surveillance of any region of land, reentry vehicle that— (d) Application requirements. An sea, or air in accordance with § 450.161; (1) Define the authority of personnel, applicant must submit: (2) Monitoring of any meteorological by individual or position title, to issue (1) A description of how it will condition necessary to— ‘‘hold/resume,’’ ‘‘go/no go,’’ and abort provide for day-of-flight surveillance of (i) Be consistent with any safety commands; flight hazard areas, if necessary, to analysis required by this part; and (2) Assign communication networks ensure that the presence of any member (ii) If necessary in accordance with so that personnel identified in of the public in or near a flight hazard § 450.163, mitigate the potential for a paragraph (a)(1) of this section have area is consistent with flight commit launch or reentry vehicle intercepting a direct access to real-time safety-critical criteria developed for each launch or lightning strike, or encountering a information required to issue ‘‘hold/ reentry as required by § 450.165(b); and nearby discharge;

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00144 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15439

(3) Implementation of any launch or (iii) A description of the vehicle data requirements of paragraph (a) of this reentry window closure in the launch or that will be available to evaluate flight section are follows: reentry window for the purpose of abort rules across the range of normal (1) Through the entire flight of a collision avoidance in accordance with and malfunctioning flight. suborbital launch vehicle; § 450.169; (2) For an orbital launch, during (4) Confirmation that any safety- § 450.167 Tracking. ascent from a minimum of 150 km to critical system is ready for flight; (a) Vehicle tracking. During the flight initial orbital insertion and for a (5) For any reentry vehicle, except a of a launch or reentry vehicle, an minimum of 3 hours from liftoff; suborbital vehicle, monitoring by the operator must measure and record in (3) For reentry, during descent from operator or an on board system that the real time the position and velocity of the initial reentry burn to 150 km altitude; status of safety-critical systems are vehicle. The system used to track the and healthy before enabling reentry flight, to vehicle must provide data to determine (4) For disposal, during descent from assure the vehicle can reenter safely to the actual impact locations of all stages initial disposal burn to 150 km altitude. Earth; and and components, and to obtain vehicle (c) Rendezvous. Planned rendezvous (6) Any other hazard controls derived performance data for comparison with operations that occur within the from any safety analysis required by this the preflight performance predictions. screening time frame are not considered part. (b) Application requirements. An a violation of collision avoidance if the (c) Flight abort rules. (1) For a vehicle applicant must identify and describe involved operators have pre-coordinated that uses a flight safety system, the flight each method or system used to meet the the rendezvous or close approach. safety rules must identify the conditions tracking requirements of paragraph (a) (d) Analysis not required. A launch under which the flight safety system, of this section. collision avoidance analysis is not including the functions of any flight § 450.169 Launch and reentry collision required if the maximum altitude abort crew, must abort the flight to: avoidance analysis requirements. attainable by a launch operator’s (i) Ensure compliance with § 450.101; (a) Criteria. For an orbital or suborbital launch vehicle and any and suborbital launch or reentry, an operator released debris is less than 150 km. The (ii) Prevent debris capable of causing must establish window closures needed maximum altitude attainable means an a casualty from impacting in to ensure that the launch or reentry optimized trajectory, assuming uncontrolled areas if the vehicle is vehicle, any jettisoned components, or maximum performance within 99.7% outside the limits of a useful mission. payloads meet the following confidence bounds, extended through (2) Vehicle data required to evaluate requirements with respect to orbiting fuel exhaustion of each stage, to achieve flight abort rules must be available to objects, not including any object being a maximum altitude. the flight safety system across the range launched or reentered. (e) Analysis. Collision avoidance of normal and malfunctioning flight. (1) For inhabitable objects, one of analysis must be obtained for each (3) The flight abort rules must include three criteria in paragraphs (a)(1)(i) launch or reentry from a Federal entity the following: through (iii) of this section must be met: identified by the FAA. (i) The flight safety system must abort (i) The probability of collision (1) An operator must use the results flight when valid, real-time data between the launching or reentering of the collision avoidance analysis to indicate the vehicle has violated any objects and any inhabitable object must establish flight commit criteria for flight safety limit; not exceed 1 × 10¥6; collision avoidance; and (ii) The flight safety system must abort (ii) The launching or reentering (2) Account for uncertainties flight when the vehicle state approaches objects must maintain an ellipsoidal associated with launch or reentry conditions that are anticipated to separation distance of 200 km in-track vehicle performance and timing, and compromise the capability of the flight and 50 km cross-track and radially from ensure that each window closure safety system and further flight has the the inhabitable object; or incorporates all additional time periods potential to violate a flight safety limit; (iii) The launching or reentering associated with such uncertainties. (iii) The flight safety system must objects must maintain a spherical (f) Timing and information required. incorporate data loss flight times to separation distance of 200 km from the An operator must prepare a collision abort flight at the first possible violation inhabitable object. avoidance analysis worksheet for each of a flight safety limit, or earlier, if valid (2) For objects that are neither orbital launch or reentry using a standardized tracking data is insufficient for debris nor inhabitable, one of the two format that contains the input data evaluating a minimum set of flight abort criteria in paragraphs (a)(2)(i) and (ii) of required by appendix A to this part, as rules required to maintain compliance this section must be met: follows: with § 450.101; and (i) The probability of collision (1) An operator must file the input (iv) Flight may continue past any gate between the launching or reentering data with a Federal entity identified by established under § 450.125 only if the objects and any object must not exceed the FAA and the FAA at least 15 days parameters used to establish the ability 1 × 10¥5; or before the first attempt at the flight of a of the vehicle to complete a useful (ii) The launching or reentering launch vehicle or the reentry of a mission are within limits. objects must maintain a spherical reentry vehicle, unless the (d) Application requirements. An separation distance of 25 km from the Administrator agrees to a different time applicant must submit: object. frame in accordance with § 404.15 of (1) For flight commit criteria, a list of (3) For all other known orbital debris this chapter; all flight commit criteria; and identified by the FAA or other Federal (2) An operator must obtain a (2) For flight abort rules: Government entity as 10 cm squared or collision avoidance analysis performed (i) A description of each rule, and the larger, the launching or reentering by a Federal entity identified by the parameters that will be used to evaluate objects must maintain a spherical FAA 6 hours before the beginning of a each rule; separation distance of 2.5 km from the launch or reentry window; and (ii) A list that identifies the rules object. (3) If an operator needs an updated necessary for compliance with each (b) Screening time. A launch or collision avoidance analysis due to a requirement in § 450.101; and reentry operator must ensure the launch or reentry delay, the operator

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00145 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15440 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

must file the request with the Federal serious injury (as defined in 49 CFR (1) Investigate the root causes of the entity and the FAA at least 12 hours 830.2); mishap; and prior to the beginning of the new launch (2) Notify within 24 hours the FAA (2) Report investigation results to the or reentry window. Washington Operations Center in the FAA. case of a mishap that does not involve (g) Preventative measures. An § 450.171 Safety at end of launch. a fatality or serious injury (as defined in operator must identify and implement (a) Debris mitigation. An operator 49 CFR 830.2); and preventive measures for avoiding must ensure for any proposed launch (3) Submit a written preliminary recurrence of the mishap prior to the that for all vehicle stages or components report to the FAA Office of Commercial next flight, unless otherwise approved that reach Earth orbit— Space Transportation within five days by the Administrator. (1) There is no unplanned physical of any mishap. The preliminary report (h) Mishap records. An operator must contact between the vehicle or any of its must include the following information, maintain records associated with the components and the payload after as applicable: mishap in accordance with § 450.219(b). payload separation; (i) Date and time of the mishap; (i) Application requirements. An (2) Debris generation does not result (ii) Description of the mishap and applicant must submit the plan or other from the conversion of energy sources sequence of events leading to the written means required by this section. into energy that fragments the vehicle or mishap, to the extent known; its components. Energy sources include (iii) Intended and actual location of § 450.175 Test-induced damage. chemical, pressure, and kinetic energy; the launch or reentry or other landing (a) Coordination of anticipated test- and on Earth; induced damage. Test-induced damage (3) For all vehicle stages or (iv) Vehicle or debris impact points, is not a mishap if all of the following are components that are left in orbit, stored including those outside a planned true: energy is removed by depleting residual landing or impact area; (1) An operator coordinates potential fuel and leaving all fuel line valves (v) Identification of the vehicle; test-induced damage with the FAA open, venting any pressurized system, (vi) Identification of any payload; before the planned activity, and with leaving all batteries in a permanent (vii) Number and general description sufficient time for the FAA to evaluate discharge state, and removing any of any fatalities or injuries; the operator’s proposal during the remaining source of stored energy. (viii) Description and estimated costs application process or as a license (b) Application requirements. An of any property damage; modification; and applicant must demonstrate compliance (ix) Identification of hazardous (2) The test-induced damage did not with the requirements in paragraph (a) materials, as defined in § 401.5 of this result in any of the following: of this section. chapter, involved in the event, whether (i) Serious injury or fatality (as on the vehicle, any payload, or on the defined in 49 CFR 830.2); § 450.173 Mishap plan—reporting, ground; (ii) Damage to property not associated response, and investigation requirements. (x) Action taken by any person to with the licensed activity; and (a) General. An operator must report, contain the consequences of the event; (iii) Hazardous debris leaving the pre- (xi) Weather conditions at the time of respond, and investigate class 1, 2, 3, defined hazard area; or and 4 mishaps, as defined in § 401.5 of the event; and (xii) Potential consequences for other (3) The test-induced damage falls this chapter, in accordance with within the scope of activities paragraphs (b) through (h) of this similar vehicles, systems, or operations. (e) Emergency response requirements. coordinated with the FAA in paragraph section using a plan or other written (a)(1) of this section. means. An operator must— (1) Activate emergency response (b) Application requirements. An (b) Responsibilities. An operator must applicant must submit the following document— services to protect the public following a mishap as necessary including, but not information: (1) Responsibilities for personnel (1) Test objectives; assigned to implement the requirements limited to: (i) Evacuating and rescuing members (2) Test limits; of this section; of the public, taking into account debris (3) Expected outcomes; (2) Reporting responsibilities for dispersion and toxic plumes; and (4) Potential risks, including the personnel assigned to conduct (ii) Extinguishing fires; applicant’s best understanding of the investigations and for anyone retained (2) Maintain existing hazard area uncertainties in environments, test by the licensee to conduct or participate surveillance and clearance as necessary limits, or system performance; in investigations; and to protect public safety; (5) Applicable procedures; (3) Allocation of roles and (3) Contain and minimize the (6) Expected time and duration of the responsibilities between the launch consequences of a mishap, including: test; and operator and any site operator for (i) Securing impact areas to ensure (7) Additional information as required reporting, responding to, and that no members of the public enter; by the FAA to ensure protection of investigating any mishap during ground (ii) Safely disposing of hazardous public health and safety, safety of activities at the site. materials; and property, and the national security and (c) Cooperation with FAA and NTSB. (iii) Controlling hazards at the site or foreign policy interests of the United An operator must report to, and impact areas; States. cooperate with, the FAA and NTSB (4) Preserve data and physical investigations and designate one or evidence; and § 450.177 Unique policies, requirements, more points of contact for the FAA and (5) Implement agreements with and practices. NTSB. government authorities and emergency (a) Operator identified unique (d) Mishap reporting requirements. response services, as necessary, to hazards. An operator must review An operator must— satisfy the requirements of this section. operations, system designs, analysis, (1) Immediately notify the FAA (f) Mishap investigation requirements. and testing, and identify any unique Washington Operations Center in case In the event of a mishap, an operator hazards not otherwise addressed by this of a mishap that involves a fatality or must— part. An operator must implement any

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00146 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15441

unique safety policy, requirement, or reporting, responding to, and (e) Validation and verification. practice needed to protect the public investigating any mishap during ground Demonstrate that the risk elimination from the unique hazard. activities at the site. and mitigation measures achieve the (b) FAA unique policy, requirement, (c) Application requirements. An risk levels of paragraph (c) of this or practice. The FAA may identify and applicant must describe how it is section through validation and impose a unique policy, requirement, or coordinating with a Federal or licensed verification. Verification includes: practice as needed to protect the public launch or reentry site operator in (1) Analysis; health and safety, safety of property, compliance with this section. (2) Test; and the national security and foreign (3) Demonstration; or policy interests of the United States. § 450.183 Explosive site plan. (4) Inspection. (c) Application requirements. (1) An (a) Exclusive use sites. For a launch or (f) Application requirements. An operator must identify any unique safety reentry conducted from or to a site applicant must submit— policy, requirement, or practice exclusive to its own use, an operator (1) A description of the methodology necessary in accordance with paragraph must comply with the explosive siting used to perform the ground hazard (a) of this section, and demonstrate that requirements of §§ 420.63, 420.65, analysis; each unique safety policy, requirement, 420.66, 420.67, 420.69, and 420.70 of (2) A list of all systems and operations or practice protects public health and this chapter. that may cause a hazard involving the safety and the safety of property. (b) Application requirements. An vehicle or any payload; and (2) An operator must demonstrate that applicant must submit an explosive site (3) The ground hazard analysis each unique safety policy, requirement, plan in accordance with paragraph (a) of products of paragraphs (a) through (e) of or practice imposed by the FAA in this section. this section, including data that verifies the risk elimination and mitigation accordance with paragraph (b) of this § 450.185 Ground hazard analysis. section, protects public health and measures. safety, safety of property, and the An operator must perform and national security and foreign policy document a ground hazard analysis, and § 450.187 Toxic hazards mitigation for ground operations. interests of the United States. continue to maintain it throughout the lifecycle of the launch or reentry (a) Applicability. This section applies Ground Safety system. The analysis must— to any launch or reentry vehicle, (a) Hazard identification. Identify including all vehicle components and § 450.179 Ground safety—general. system and operation hazards posed by payloads, that use toxic propellants or At a U.S. launch or reentry site, an the vehicle and ground hardware, other toxic chemicals. operator must protect the public from including site and ground support (b) Toxic release hazard analysis. An adverse effects of hazardous operations equipment. Hazards identified must operator must conduct a toxic release and systems associated with— include the following: hazard analysis that— (a) Preparing a launch vehicle for (1) System hazards, including: (1) Accounts for any toxic release that flight; (i) Vehicle over-pressurization; could occur during nominal or non- (b) Returning a launch or reentry (ii) Sudden energy release, including nominal launch or reentry ground vehicle to a safe condition after landing, ordnance actuation; operations; or after an aborted launch attempt; and (iii) Ionizing and non-ionizing (2) Includes a worst-case release (c) Returning a site to a safe condition. radiation; scenario analysis or a maximum- (iv) Fire or deflagration; § 450.181 Coordination with a site credible release scenario analysis for operator. (v) Radioactive materials; each process that involves a toxic (vi) Toxic release; propellant or other chemical; (a) General. For a launch or reentry (vii) Cryogens; conducted from or to a Federal launch (viii) Electrical discharge; and (3) Determines if toxic release can or reentry site or a site licensed under (ix) Structural failure; and occur based on an evaluation of the part 420 or 433 of this chapter, an (2) Operation hazards, including: chemical compositions and quantities of operator must coordinate with the site (i) Propellant handling and loading; propellants, other chemicals, vehicle operator to ensure— (ii) Transporting of vehicle or vehicle materials, and projected combustion (1) Public access is controlled where components; products, and the possible toxic release and when necessary to protect public (iii) Vehicle testing; and scenarios; safety; (iv) Vehicle or system activation. (4) Accounts for both normal (2) Launch or reentry operations are (b) Hazard assessment. Assess each combustion products and any unreacted coordinated with other launch and hazard’s likelihood and severity. propellants and phase change or reentry operators and other affected (c) Risk criteria. Ensure that the risk chemical derivatives of released parties to prevent unsafe interference; associated with each hazard meets the substances; and (3) Any ground hazard area that following criteria: (5) Accounts for any operational affects the operations of a launch or (1) The likelihood of any hazardous constraints and emergency procedures reentry site is coordinated with the condition that may cause death or that provide protection from toxic Federal or licensed launch or reentry serious injury to the public must be release. site operator; and extremely remote; and (c) Toxic containment. An operator (4) Prompt and effective response in (2) The likelihood of any hazardous using toxic containment must manage the event of a mishap that could impact condition that may cause major damage the risk of casualty from the exposure to public safety. to public property or critical assets must toxic release either by— (b) Licensed site operator. For a be remote. (1) Evacuating, or being prepared to launch or reentry conducted from or to (d) Risk elimination and mitigation. evacuate, the public from a toxic hazard a site licensed under part 420 or 433 of Identify and describe the risk area, where an average member of the this chapter, an operator must also elimination and mitigation measures public would be exposed to greater than coordinate with the site operator to required to satisfy paragraph (c) of this one percent conditional individual establish roles and responsibilities for section. probability of casualty in the event of a

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00147 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15442 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

worst-case release or maximum credible (7) For toxic release hazard analysis in (3) Maintain and verify that any flight release scenario; or accordance with paragraph (b) of this safety system remains operational until (2) Employing meteorological section: verification that the launch vehicle does constraints to limit a ground operation (i) A description of the failure modes not represent a risk of inadvertent flight. to times during which prevailing winds and associated relative probabilities for (d) Fire suppression. An operator and other conditions ensure that an potential toxic release scenarios used in must have reasonable precautions in average member of the public would not the risk evaluation; and place to report and control any fire be exposed to greater than one percent (ii) The methodology and results of an caused by licensed activities. conditional individual probability of applicant’s determination of the worst- (e) Emergency procedures. An casualty in the event of a worst-case case or maximum-credible quantity of operator must have general emergency release or maximum credible release any toxic release that might occur procedures that apply to any scenario. during ground operations; emergencies not covered by the mishap (d) Toxic risk assessment. An operator (8) For toxic risk assessment in plan of § 450.173 that may create a using toxic risk assessment must accordance with paragraph (d) of this hazard to the public. manage the risk from any toxic release section: (f) Application requirements. An hazard and demonstrate compliance (i) A demonstration that the public applicant must submit the process for with the criteria in § 450.109(a)(3). A will not be exposed to airborne protecting members of the public who toxic risk assessment must— concentrations above the toxic enter any area under the control of a (1) Account for airborne concentration concentration and duration thresholds, launch or reentry operator in and duration thresholds of toxic based upon the representative results of accordance with paragraph (b) of this propellants or other chemicals. For any the toxic release hazard analysis; section. toxic propellant, other chemicals, or (ii) The population density in receptor combustion product, an operator must locations that are identified by toxic Subpart D—Terms and Conditions of a use airborne toxic concentration and dispersion modeling as toxic hazard Vehicle Operator License duration thresholds identified in a areas; (iii) A description of any risk § 450.201 Public safety responsibility. means of compliance accepted by the mitigation measures applied in the toxic Administrator; A licensee is responsible for ensuring risk assessment; and (2) Account for physical phenomena public safety and safety of property (iv) The identity of the population expected to influence any toxic during the conduct of a licensed launch database used; and or reentry. concentration and duration in the area (9) Additional products that allow an surrounding the potential release site; independent analysis, as requested by § 450.203 Compliance with license. (3) Determine a toxic hazard area for the Administrator. A licensee must conduct a licensed each process, surrounding the potential launch or reentry in accordance with release site for each toxic propellant or § 450.189 Ground safety prescribed hazard representations made in its license other chemical based on the amount and controls. application, the requirements of subpart toxicity of the propellant or other (a) General. In addition to the hazard C of this part and this subpart, and the chemical, the exposure duration, and controls derived form an operator’s terms and conditions contained in the the meteorological conditions involved; ground hazard analysis and toxic hazard license. A licensee’s failure to act in (4) Account for all members of the analysis, an operator must comply with accordance with the representations public that may be exposed to the toxic paragraphs (b) through (e) of this made in the license application, the release; and section. requirements of subpart C of this part (5) Account for any risk mitigation (b) Protection of public on the site. An and this subpart, and the terms and measures applied in the risk assessment. operator must document a process for conditions contained in the license, is (e) Application requirements. An protecting members of the public who sufficient basis for the revocation of a applicant must submit: enter any area under the control of a license or other appropriate (1) The identity of the toxic launch or reentry operator, including: propellant, chemical, or toxic (1) Procedures for identifying and enforcement action. combustion products in the possible tracking the public while on the site; § 450.205 Financial responsibility toxic release; and requirements. (2) The applicant’s selected airborne (2) Methods the operator uses to A licensee must comply with toxic concentration and duration protect the public from hazards in financial responsibility requirements as thresholds; accordance with the ground hazard required by part 440 of this chapter and (3) The meteorological conditions for analysis and toxic hazard analysis. as specified in a license or license order. the atmospheric transport and buoyant (c) Countdown abort. Following a cloud rise of any toxic release from its countdown abort or recycle operation, § 450.207 Human spaceflight source to downwind receptor locations; an operator must establish, maintain, requirements. (4) Characterization of the terrain, as and perform procedures for controlling A licensee conducting a launch or input for modeling the atmospheric hazards related to the vehicle and reentry with a human being on board transport of a toxic release from its returning the vehicle, stages, or other the vehicle must comply with human source to downwind receptor locations; flight hardware and site facilities to a spaceflight requirements as required by (5) The identity of the toxic safe condition. When a launch vehicle part 460 of this chapter and as specified dispersion model used, and any other does not liftoff after a command to in a license or license order. input data; initiate flight was sent, an operator (6) Representative results of an must— § 450.209 Compliance monitoring. applicant’s toxic dispersion modeling to (1) Ensure that the vehicle and any (a) A licensee must allow access by, predict concentrations and durations at payload are in a safe configuration; and cooperate with, Federal officers or selected downwind receptor locations, (2) Prohibit entry of the public into employees or other individuals to determine the toxic hazard area for a any identified hazard areas until the site authorized by the FAA to observe any released quantity of the toxic substance; is returned to a safe condition; and of its activities, or of its contractors or

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00148 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules 15443

subcontractors, associated with the added, or deleted. An approval has the (d) Flight safety system test data. Any conduct of a licensed launch or reentry. full force and effect of a license order licensee that is required to use a flight (b) For each licensed launch or and is part of the licensing record. safety system to protect public safety as reentry, a licensee must provide the required by § 450.101(c) must submit to FAA with a console or other means for § 450.213 Preflight reporting. the FAA, or provide the FAA access to, monitoring the progress of the (a) Preflight reporting methods. An any test reports, in accordance with countdown and communication on all operator must send the information in approved flight safety system test plans, channels of the countdown this section as an email attachment to no less than 30 days before flight, unless communications network. A licensee [email protected], or other the Administrator agrees to a different must also provide the FAA with the method as agreed to by the time frame in accordance with § 404.15 capability to communicate with the Administrator in the license. of this chapter in the license. These mission director designated by (b) Mission information. A licensee reports must include: must submit to the FAA the following § 450.103(a)(1). (1) A summary of the system, mission-specific information not less (c) If the FAA finds a licensee has not subsystem, and component-level test than 60 days before each mission complied with any of the requirements results, including all test failures and conducted under the license, unless the in subpart C of this part or this subpart, corrective actions implemented; the FAA may require the licensee to Administrator agrees to a different time frame in accordance with § 404.15 of (2) A summary of test results revise its procedures to achieve demonstrating sufficient margin to compliance. this chapter in the license, except when the information was provided in the predicted operating environments; § 450.211 Continuing accuracy of license license application: (3) A comparison matrix of the actual application; application for modification of (1) Payload information in accordance qualification and acceptance test levels license. with § 450.43(i); and used for each component in each test (a) A licensee is responsible for the (2) Flight information, including the compared against the predicted flight continuing accuracy of representations vehicle, launch site, planned flight path, levels for each environment, including contained in its application for the staging and impact locations, each any test tolerances allowed for each test; entire term of the license. After a license payload delivery point, intended reentry and has been issued, a licensee must apply or landing sites including any (4) A clear identification of any to the FAA for modification of the contingency abort location, and the components qualified by similarity license if— location of any disposed launch or analysis or a combination of analysis (1) The licensee proposes to conduct reentry vehicle stage or component that and test. a launch or reentry in a manner not is deorbited. (e) Collision avoidance analysis. In authorized by the license; or (c) Flight safety analysis products. An accordance with § 450.169(f), at least 15 (2) Any representation contained in operator must submit to the FAA days before the first attempt at the flight the license application that is material updated flight safety analysis products, of a launch vehicle or the reentry of a to public health and safety or the safety using previously-approved reentry vehicle, or at least 12 hours of property is no longer accurate and methodologies, for each mission no less prior to the beginning of a new launch complete or does not reflect the than 30 days before flight, unless the or reentry window due to a launch or licensee’s procedures governing the Administrator agrees to a different time reentry delay, unless the Administrator actual conduct of a launch or reentry. A frame in accordance with § 404.15 of agrees to a different time frame in change is material to public health and this chapter in the license. accordance with § 404.15 of this (1) An operator is not required to safety or the safety of property if it alters chapter, a licensee must submit to a submit the flight safety analysis or affects the— Federal entity identified by the FAA products if— (i) Class of payload; and the FAA the collision avoidance (i) The analysis submitted in the (ii) Type of launch or reentry vehicle; information in appendix A to this part. license application satisfies all the (iii) Type or quantity of hazardous (f) Launch or reentry schedule. A requirements of this section; or licensee must file a launch or reentry material; (ii) The operator demonstrated during schedule that identifies each review, (iv) Flight trajectory; the application process that the analysis (v) Launch site or reentry site or other rehearsal, and safety-critical operation. does not need to be updated to account The schedule must be filed and updated landing site; or for mission-specific factors. (vi) Any system, policy, procedure, (2) If the operator is required to in time to allow FAA personnel to requirement, criteria, or standard that is submit the flight safety analysis participate in the reviews, rehearsals, safety critical. products, the operator— and safety-critical operations. (b) An application to modify a license (i) Must account for vehicle and § 450.215 Post-flight reporting. must be prepared and submitted in mission specific input data; accordance with part 413 of this (ii) Must account for potential (a) An operator must submit to the chapter. If requested during the variations in input data that may affect FAA the information in paragraph (b) of application process, the FAA may any analysis product within the final 30 this section no later than 90 days after approve an alternate method for days before flight; a launch or reentry, unless the requesting license modifications. The (iii) Must submit the analysis Administrator agrees to a different time licensee must indicate any part of its products using the same format and frame in accordance with § 404.15 of license or license application that organization used in its license this chapter. would be changed or affected by a application; and (b) An operator must send the proposed modification. (iv) May not change an analysis following information as an email (c) Upon approval of a modification, product within the final 30 days before attachment to [email protected], the FAA issues either a written approval flight unless the operator has a process, or other method as agreed to by the to the licensee or a license order approved in the license, for making a Administrator in the license: amending the license if a stated term or change in that period as part of the (1) Any anomaly that occurred during condition of the license is changed, operator’s flight safety analysis process. countdown or flight that is material to

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00149 Fmt 4701 Sfmt 4702 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2 15444 Federal Register / Vol. 84, No. 72 / Monday, April 15, 2019 / Proposed Rules

public health and safety and the safety the requirements of subpart C of this collects, analyzes, and distributes collision of property; part and this subpart, and the terms and avoidance analysis results. (2) Any corrective action conditions contained in the license. (b) Collision avoidance analysis results transmission medium. An operator must implemented or to be implemented after (b) In the event of a class 1 or class the flight due to an anomaly or mishap; identify the transmission medium, such as 2 mishap, as defined in § 401.5 of this voice or email, for receiving results. (3) The number of humans on board chapter, a licensee must preserve all (c) Deliverable schedule/need dates. An the vehicle; records related to the event. Records operator must identify the times before flight, (4) The actual trajectory flown by the must be retained until completion of referred to as ‘‘L-times,’’ for which the vehicle, if requested by the FAA; and any Federal investigation and the FAA operator requests a collision avoidance (5) For an unguided suborbital launch advises the licensee that the records analysis. The final collision avoidance vehicle, the actual impact location of all need not be retained. The licensee must analysis must be used to establish flight commit criteria for a launch. impacting stages and impacting make all records required to be components, if requested by the FAA. (d) Trajectory files. Individual position and maintained under the regulations velocity trajectory files, including: § 450.217 Registration of space objects. available to Federal officials for (1) The position coordinates in the Earth- (a) To assist the U.S. Government in inspection and copying. Fixed Greenwich (EFG) coordinates implementing Article IV of the 1975 coordinate system measured in kilometers Appendix A to Part 450—Collision and the EFG velocity components measured Convention on Registration of Objects Analysis Worksheet in kilometers per second, of each launch Launched into Outer Space, each vehicle stage or payload starting below 150 licensee must submit to the FAA the (a) Launch or reentry information. An operator must file the following information: km through screening time frame; information required by paragraph (b) of (1) Mission name and launch location. A (2) Radar cross section values for each this section for all objects placed in mnemonic given to the launch vehicle/ individual file; space by a licensed launch, including a payload combination identifying the launch (3) Covariance, if probability of impact launch vehicle and any components, mission from all others. Launch site location analysis option is desired; and except any object owned and registered in latitude and longitude; (4) Separate trajectory files identified by by the U.S. Government. (2) Launch or reentry window. The launch valid window time frames, if launch or (b) For each object that must be or reentry window opening and closing times reentry trajectory changes during launch or reentry window. registered in accordance with this in Greenwich Mean Time (referred to as ZULU time) and the Julian dates for each (e) Screening. An operator must select section, not later than 30 days following spherical, ellipsoidal, or collision probability the conduct of a licensed launch, an scheduled launch or reentry attempts including primary and secondary launch or screening as defined in this paragraph (e) for operator must file the following reentry dates; determining any conjunction: information: (3) Epoch. The epoch time, in Greenwich (1) Spherical screening. Spherical (1) The international designator of the Mean Time (GMT), of the expected launch screening centers a sphere on each orbiting space object; vehicle liftoff time; object’s center-of-mass to determine any (2) Date and location of launch; (4) Segment number. A segment is defined conjunction; (3) General function of the space as a launch vehicle stage or payload after the (2) Ellipsoidal screening. Ellipsoidal object; thrusting portion of its flight has ended. This screening utilizes an impact exclusion ellipsoid of revolution centered on the (4) Final orbital parameters, includes the jettison or deployment of any stage or payload. For each segment, an orbiting object’s center-of-mass to determine including: any conjunction. An operator must provide (i) Nodal period; operator must determine the orbital parameters; input in the UVW coordinate system in (ii) Inclination; (5) Orbital parameters. An operator must kilometers. The operator must provide delta- (iii) Apogee; and identify the orbital parameters for all objects U measured in the radial-track direction, (iv) Perigee; and achieving orbit including the parameters for delta-V measured in the in-track direction, (5) Ownership, and country of each segment after thrust end (such as SECO– and delta-W measured in the cross-track ownership, of the space object. 1 and SECO–2); direction; or (c) A licensee must notify the FAA (6) Orbiting objects to evaluate. An (3) Probability of Collision. Collision when it removes an object that it has operator must identify all orbiting object probability is calculated using position and velocity information with covariance in both previously placed in space. descriptions including object name, length, width, depth, diameter, and mass; position and velocity. § 450.219 Records. (7) Time of powered flight and sequence of Issued under authority provided by 49 (a) Except as specified in paragraph events. The elapsed time in hours, minutes, U.S.C. 106(f) and 51 U.S.C. chapter 509 in (b) of this section, a licensee must and seconds, from liftoff to passivation or Washington, DC, on March 22, 2019. disposal. The input data must include the Wayne R. Monteith, maintain for 3 years all records, data, time of powered flight for each stage or Associate Administrator, Office of and other material necessary to verify jettisoned component measured from liftoff; Commercial Space Transportation. that a launch or reentry is conducted in and accordance with representations (8) Point of contact. The person or office [FR Doc. 2019–05972 Filed 4–12–19; 8:45 am] contained in the licensee’s application, within an operator’s organization that BILLING CODE 4910–13–P

VerDate Sep<11>2014 18:49 Apr 12, 2019 Jkt 247001 PO 00000 Frm 00150 Fmt 4701 Sfmt 9990 E:\FR\FM\15APP2.SGM 15APP2 amozie on DSK9F9SC42PROD with PROPOSALS2