beneficial both to the commercial space transportation industry and
public safety to explicitly allow flight abort to be governed by
capable autonomous systems.
iii. Current Requirement for Reliability of a FSS
    Each FTS and command and control system must satisfy the predicted
reliability requirement of 0.999 at the 95 percent confidence level.
For FSSs on both ELVs and RLVs, there are effectively only two methods
of currently demonstrating that a system meets reliability standards.
The first method is to test 2,995 units at expected operating
environment levels with 0 failures to demonstrate a 0.999 design
reliability at a 95 percent confidence level. Given the cost of FSS
components, the cost of testing, and the time required to conduct such
tests, this is not practicable.
    The second method arises out of RCC 319. The FSS requirements
codified in part 417, including component performance requirements, and
acceptance and qualification testing, were originally written to align
FAA launch licensing requirements with the Federal launch range
standards in RCC 319. Like part 417, RCC 319 requires qualification
tests to demonstrate reliable operation in environments exceeding the
expected operating environment for the system components, acceptance
tests to demonstrate that the selected batch of components meets the
requirements of the design specifications, and other preflight testing
at the system or subsystem level to demonstrate functionality after
installation.
    The benefit of the part 417 and RCC 319 method is that for
qualification tests, generally only three test units are required.
Three units are required instead of many more because the units are
tested with margin above their predicted operating environment. Testing
three units with the margin specified achieves the required reliability
and confidence levels of 0.999 design reliability at 95 percent
confidence level, rather than having to test 2,995 units at the
predicted operating environment with no margin.
iv. Proposed Reliability Standards for FSS
    Given the FAA anticipates that most commercial space vehicles will
continue to control flight hazards through the use of FSSs, the FAA
proposes in Sec.  450.145 to continue to require a very reliable FSS in
most instances. Under the current regulations, FSS not only enable an
operation to meet the collective and individual risk criteria during
flight but also protect against low-probability but high-consequence
events near the launch site or when flying over populated areas. As
previously discussed, the FAA's proposal to quantify these low-
probability but high-consequence events as CEC in proposed
Sec.  450.101(c) would clearly delineate which operations are required
to use an FSS to control for risks and consequences.\92\ The
CEC calculation is the consequence, measured in terms of
EC, without regard to the probability of failure.
---------------------------------------------------------------------------

    \92\ As noted earlier, only operations that have a predicted
consequence of 1 x 10-3 CEC or above for
uncontrolled areas for each reasonably foreseeable vehicle response
mode in any one-second period of flight would be required to
implement an FSS to abort flight as a hazard control strategy. An
FSS would not be required for operations that can be shown to have a
predicted consequence of less than 1 x 10-3
CEC; however, a hazard analysis would be required for any
operations without a FSS or demonstrable physical containment.
---------------------------------------------------------------------------

    The underlying intent of the current prescriptive requirements was
to have an FSS that could reliably perform flight abort to restrict
hazards from reaching populated or otherwise protected areas. The FAA
also recognizes that vehicles operating in remote areas are less likely
to have significant consequences in the case of a flight failure. For
operations where the consequence of a flight failure is less, the FAA
has determined that, while still being highly reliable, the FSS may not
need to be as highly reliable as an FSS for a vehicle operating in an
area where the consequence of a flight failure is higher. Generally,
this proposed relaxation of the FSS reliability requirement--based on
reduced potential consequence--is expected to be applicable to
operations launching or reentering in remote locations or for stages
that do not overfly population centers. In order to achieve these
scalable, performance-based requirements, proposed Sec.  450.145(a)
would contain two reliability standards for an FSS.
    Proposed Sec.  450.145(a)(1) would require any operator with a
consequence of 1 x 10-2 CEC or greater in any
uncontrolled area for any vehicle response mode to employ an FSS with
the standard design reliability of 0.999 at 95 percent confidence and
commensurate design, analysis, and testing. This reliability standard
would be consistent with various sections of part 417, in particular
Sec.  417.309(b)(2), that require major FSS component systems, such as
onboard flight termination systems and ground-based command control
systems, to be tested to demonstrate 0.999 design reliability at 95
percent confidence. This reliability threshold would have to be
demonstrated for the operation of the entire system, including any
systems located on-board the launch or reentry vehicle, any ground-
based systems, and any other component or support systems.
    Alternatively, in order to make regulations adaptable to innovative
operations while maintaining appropriate levels of safety, operations
with lower potential consequences would require an FSS with less
demonstrated design reliability at the same confidence. Proposed Sec.
450.145(a)(2) would require any operator with a consequence of between
1 x 10-2 and 1 x 10-3 CEC in any
uncontrolled area for any vehicle response mode to only employ an FSS
with design reliability of at least 0.975 at 95 percent confidence and
commensurate testing. The FAA considered simply setting the proposed
Sec.  450.145(a)(2) threshold an order of magnitude lower, at 0.99
design reliability with a 95 percent confidence, to reflect the order
of magnitude less CEC from the consequence analysis. Absent
other standards to demonstrate compliance with the reliability
threshold, that would mean testing 299 units with 0 failures, instead
of testing 2,995 units with 0 failures. However, in consultation with
NASA and Air Force representatives in the CSWG, the FAA has elected to
propose that the reduced reliability threshold should be set at

0.975 design reliability with a 95 percent confidence for lower
consequence vehicles.
    While there are no established standards to demonstrate the 0.975
reliability number, that threshold is consistent with reliability
parameters in RCC 324 and represents existing single string flight
reliability requirements. The FAA is confident that industry
associations will develop consensus standards regarding design and
testing that sufficiently demonstrate that a novel FSS design meets
this reliability threshold. Until such time as an industry standard is
established, proposed Sec.  450.145(a)(2) in practice may result in
single string or equivalent FSSs being approved for operations in
remote areas or for phases of flight that do not overfly populated
areas. Similar to FSS that must meet the more reliable threshold, all
means of compliance would be required to be accepted by the FAA in
accordance with proposed Sec. Sec.  450.145(b) and 450.35.
    These proposed reliability requirements would replace the existing
launch and reentry FSS licensing requirements on all commercial space
transportation missions. However, the FAA anticipates that, with the
consequence analysis driving the requirement to have an FSS, most
reentry operations would continue to not require an FSS as is the
current case under part 435. For launch operators, applicants would
still be required to demonstrate the reliability by submitting to
review of their design, testing, and analysis. Operators would still be
required to monitor the flight environments actually experienced by
their FSSs in accordance with proposed Sec.  450.145(c) to corroborate
the qualification test data submitted to the FAA.
    Proposed part 450 would consolidate and clarify the performance
requirements for future FSSs. In doing so, the FAA anticipates that
some operations will be relieved of the burden of unnecessarily
stringent FSS reliability requirements and that some operations will be
able to utilize innovative concepts to achieve flight abort. By
appropriately scaling FSS reliability to consequence analysis, the FAA
expects to see the emergence of new industry standards, increased use
of autonomous FSSs, and no measurable adverse impact to public health
and safety or the safety of property. There is expected to be no
measurable adverse impact to public health and safety or the safety of
property because the lowered reliability threshold will only apply to
launches and reentries which would not create significant consequences,
given a flight failure. Furthermore, while rigorous tests and analysis
should still be expected for most FSSs, FAA regulations would no longer
prescribe a particular form of FSS. The proposed performance measure of
reliability to achieve safe flight abort to meet collective and
individual risk limits and to mitigate the possibility of low
probability but high consequence events is the best method for
maintaining safety while scoping FAA regulations to govern only the
function, not the form, of FSSs.
v. FSS Design, Testing, and Documentation Requirements
    Applicants using a FSS of any reliability threshold would be
required to meet the proposed Sec.  450.143 safety-critical system
design, test, and documentation requirements discussed previously. As
an FSS will always be considered a safety critical system, any operator
utilizing an FSS must comply with the requirements to design their
system as fault tolerant, conduct qualification and acceptance testing,
and provide evidence to validate predicted operating environments and
component life.
    Proposed Sec.  450.145(d) would include the application
requirements for an FSS. Similar to the current part 415 requirements,
proposed Sec.  450.145 would require applicants to describe the FSS,
including its proposed operation, and diagram the FSS in detail. The
FAA's intent is to make these requirements less prescriptive than
current regulations and also to allow more flexible time frames.
Proposed Sec.  450.145(d) would require applicants to submit any
analyses reports and acceptance, qualification, and preflight test
plans used to demonstrate that the reliability and confidence levels
are met. Any test plans or documentation would be required to detail
the planned test procedures and the test environments. Further, an
applicant would have to submit procedures for validating the accuracy
of any vehicle tracking data utilized by the flight safety crew or the
FSS to make the decision to abort flight. While proposed Sec.
450.145(d) consolidates these application requirements and removes
prescriptive component-level design requirements, the proposed
regulations would not require substantially different information than
the FAA requires today to demonstrate that FSSs meet performance
standards and will undergo the required testing prior to flight.
vi. Reporting Requirements
    Under the preflight reporting requirements in proposed Sec.
450.213(d), operators would be required to submit, or to provide the
FAA access to, any test reports associated with the flight safety
system test plans approved during the application process. These
reports must be submitted or made available no less than 30 days before
flight unless the Administrator agrees to a different time frame under
Sec.  404.15. In the reports, licensees would have to clearly show that
the testing results demonstrate compliance with the reliability
requirements in proposed Sec.  450.145(a). This is current practice
under Sec.  417.17(c)(1) and (4) through (6).
    To show the FSS is in compliance and can support the mission as
intended, FSS reports would continue to be required to include testing
reports that detail the results of the approved subsystem and
component-level testing, including any failures, any actions necessary
to correct for any failures, actual testing environment showing
sufficient margin to predicted operating environments, and a comparison
matrix of the actual qualification and acceptance test levels used for
each component compared against the predicted flight levels for each
environment. Proposed Sec.  450.213(d)(4) would require licensees to
report any components qualified by similarity analysis or some
combination of analysis and testing. Preflight reporting is necessary
to demonstrate compliance with the test plans approved in the
application and to demonstrate that the FSS meets the reliability
threshold prior to flight.
    Proposed Sec.  450.215 (Post-Flight Reporting) would continue to
require licensees to submit a post-flight report no later than 90 days
after an operation if there were any anomalies in the flight
environment material to public health and safety and the safety of
property, including those experienced by any FSS components; a practice
currently required by Sec.  417.25(c). RLV operators licensed under
part 431 are not currently required to submit a post-flight report
identifying anomalies that are material to public safety and corrective
actions, but the added burden is expected to be minimal. To accurately
report any such anomalies so that they may be corrected in future
flights, operators would also be required to monitor the FSS during
each flight, in accordance with proposed Sec.  450.145(c). Any
anomalies experienced by the FSS would be considered material to public
health and safety and the safety of property and, therefore, would need
to be included in post-flight reporting.

vii. ARC Recommendations
    The ARC suggested that, in a performance-based licensing scheme,
the regulations should be flexible with regard to FSSs and allow an
operator to propose a means of achieving the performance metric without
dictating a specific hardware approach. For example, the ARC
recommended that an operator should be able to propose an alternative
to having a destruct flight termination system. While, the FAA believes
that the current regulations allow for non-destructive FSSs, it
acknowledges that the preponderance of the existing prescriptive
requirements address FSSs that terminate flight through destructive
means. The ARC recommended the current prescriptive requirements be
moved to a guidance document. As discussed previously, the FAA intends
to recognize RCC 319 as the accepted means of compliance in
demonstrating that a FSS has a design reliability of 0.999 at 95
percent confidence. The RCC 319 document would maintain the common
standards between all Federal launch and reentry safety authorities but
also would be updated periodically to address the evolving space
transportation industry. Industry could also develop new means of
compliance in the future, as discussed below.
    The ARC also recommended that an FSS should not be required,
proposing instead that an operator should only be required to meet risk
calculations in the FSA and may do so by utilizing a FSS. The FAA
disagrees that an FSS should not be required, as there are other safety
factors to be considered beyond simple individual or collective risk,
namely, the consequence of a failure as discussed earlier. However, the
FAA has attempted to propose more flexible regulations that would allow
some operations to be licensed without an FSS, or with novel concepts
of FSS, or an FSS that may require less extensive demonstration of
reliability. In quantifying the low probability but high consequence
events that necessitate an FSS beyond collective and individual risk
limits, the FAA intends to more clearly delineate when it would be
appropriate for an operation to forego an extremely reliable FSS or an
FSS completely. If an FSS is not required, the applicant would be
required to demonstrate that hazards are contained or mitigated through
a hazard analysis and system safety principles. In addition to
proposing the acceptability of FSSs with a design reliability of 0.975
at 95 percent confidence, under certain situations, the FAA proposes to
indicate more clearly that FSS concept and design is flexible and open
to innovation as long as the reliability thresholds for flight abort
are met.
    The ARC also discussed a number of concepts that industry believes
should be considered in scaling an FSS's necessary reliability as
determined through the FSA. The ARC pointed specifically to population
density, the realm of reasonably foreseeable failures, trajectory,
size, and explosive capabilities of the vehicle. The FAA proposes that
these factors would be contemplated as a part of the consequence
analysis required in the public safety criteria of proposed Sec.
450.101(c), alongside traditional measures of risk. In identifying FSS
reliability thresholds pegged to potential consequence, or
CEC, the reliability of FSSs is determined through analysis
that accounts for factors such as what population centers a vehicle or
debris can reach and potential failure modes. The FAA anticipates that
this would address the ARC's recommendation that vehicles with low risk
to the public, especially vehicles operating in remote and sparsely
populated areas, may require a lower demonstrated reliability.
    To the question of how an applicant might demonstrate the
reliability of an FSS with a less than extremely reliable design that
does not otherwise meet current common standards like RCC 319, such as
the FAA proposed threshold of 0.975 at 95 percent confidence, the ARC
advised that several approaches may already exist. As previously
discussed, the less reliable FSS can be demonstrated by testing several
hundred units under expected environments, instead of the 2,995 tests
required to demonstrate design reliability of 0.999 at 95 percent--but
it is still likely that neither is practical or viable for most
operators. In their place, alternative standards are necessary to
approximate the demonstration of the reliability threshold through less
burdensome means. The ARC report pointed to the Air Force Space
Command's Space and Missile Systems Center Standard SMC-S-016, ``Test
Requirements For Launch, Upper-Stage and Space Vehicles,'' as an
example of a standard that allows for one unit of qualification
testing, instead of the standard three units required by RCC-319.\93\
The ARC noted that standard may be useful for heritage systems that are
already considered reliable. The FAA maintains that for 0.999 design
reliability at 95 percent, the qualification testing of three or more
units may be required to reduce the likelihood of either anomalous test
passes or failures. The FAA seeks comment on this approach. The FAA
also seeks comment on how SMC-S-016 could be incorporated as an
accepted means of compliance for reliability demonstration of the lower
reliability criteria.
---------------------------------------------------------------------------

    \93\ As one company pointed out in the ARC report, SMC-S-016 and
similar standards are for general vehicle testing and do not
consider the higher reliability required for FSS, whereas RCC 319
and AFSPCMAN91-710 require additional margins and certainty. The
company believes that testing a single unit is not sufficient,
unless there was a tradeoff that increased the required test margin.
---------------------------------------------------------------------------

    In discussions with Federal launch range personnel, it has been
suggested that testing and analysis requirements in RCC 324 may be a
more appropriate basis for evaluating a FSS meeting the lower
reliability threshold. The FAA remains interested in identifying
standards that are applicable or could be drawn upon to develop means
of compliance to the proposed regulations.
    The FAA is also not foreclosing the idea that vehicles can
demonstrate the reliability of the FSS or vehicle through flight
history. The ARC pointed out in their report that certain aspects of
FSSs can be tested in flight--for example using an autonomous FSS in
``shadow mode'' on-board a vehicle and testing the system's function
with no ordnance or other active destruct capabilities. The FAA
ultimately decided to not propose any explicit requirements pertaining
to acceptable flight testing as a means of allowing industry applicants
and the FAA to develop new accepted means of compliance in the
demonstration of reliability. While the FAA wishes to encourage the
innovation and development of novel reliability demonstration
standards, the FAA also recognizes that such standards are not
currently developed and would require extensive evaluation before they
could be accepted as demonstrating fidelity and safety. Because the FSS
is so critical to flight safety in the instances where it is required,
new reliability and compliance demonstration strategies must be
accepted by the FAA prior to application acceptance.
    In discussing the scalability of FSS requirements, the ARC proposed
that the FAA delineate categories of operators and vehicles. The
suggested categories included a new vehicle by a new operator, a proven
vehicle by an experienced operator, a derived vehicle by an experienced
operator, and considerations for vehicle hazard class and population
density in operating areas. The FAA considered operator and vehicle
categories as a means of scaling FSS reliability requirements as an
alternative to consequence analysis, but determined that the relevant
measure of public protection indicating the need for

an FSS is not experience, but risk and possible consequence. While less
experienced operators will likely pose a higher risk, as accounted for
in the probability of failure, experience does not account for the
potential consequences of a vehicle failure. Experienced operators with
experienced vehicle designs can propose operations that still pose a
high risk to the public, or an operation with low risk but high
potential consequences in the event of a failure. The FAA seeks comment
on the proposal to use consequence, not operator experience, as a
factor in level-of-rigor.

K. Other Prescribed Hazard Controls

1. Agreements
    The FAA proposes to streamline the existing agreement requirements
by removing specific requirements for a variety of agreements and
procedures and allowing an operator to determine what agreements would
be needed for its particular operation. In Sec.  450.147 (Agreements),
a vehicle operator would be required to have written agreements with
any entity that provides a service or use of property to meet a
requirement in part 450.
    Current Sec.  417.13 requires a launch operator to enter into an
agreement with a Federal launch range to have access to and the use of
U.S. Government property and services required to support a licensed
launch from the facility and for public-safety related operations and
support before conducting a licensed launch from a Federal launch
range. The Federal launch range arranges for the issuances of
notifications to mariners and airmen.
    Currently, for launches from a non-Federal launch site in the
United States, a launch operator must ensure that launch processing at
the launch site satisfies the requirements of part 417. For a launch
from a launch site licensed under part 420, a launch operator must
conduct its operations in accordance with any agreements that the
launch site operator has entered into with any Federal and local
authorities. These include agreements with the local U.S. Coast Guard
district to establish procedures for the issuance of a Notice to
Mariners (NTM) prior to a launch and with the FAA air traffic control
(ATC) facility having jurisdiction over the airspace through which the
launch will take place to establish procedures for the issuance of a
Notice to Airmen (NOTAM) prior to the launch and for the closing of air
routes during the launch window. For a launch from an exclusive-use
site, where there is no licensed launch site operator, a launch
operator must satisfy the requirements of part 420. In addition, a
launch operator must: (1) Describe its procedures for informing local
authorities of each designated hazard area near the launch site
associated with a launch vehicle's planned trajectory and any planned
impacts of launch vehicle components and debris; (2) provide any hazard
area information to the local U. S. Coast Guard, or equivalent local
authority, for the issuance of NTMs and to the FAA ATC office, or
equivalent local authority, that have jurisdiction over the airspace
through which the launch will take place for the issuance of NOTAMs;
and (3) coordinate with any other local agency that supports the
launch, such as local law enforcement agencies, emergency response
agencies, fire departments, the National Park Service, and the Mineral
Management Service.
    For launches of RLVs under part 431 and reentries under part 435,
an operator must enter into launch and reentry site use agreements with
a Federal launch range or a licensed launch or reentry site operator
that provide for access to and the use of property and services
required to support a licensed RLV mission or reentry and public
safety-related operations and support. Additionally, an operator must
enter into agreements with the U.S. Coast Guard and the FAA regional
office that has jurisdiction over the airspace through which a launch
and reentry will take place to establish procedures for the issuance of
NTMs and NOTAMs.
    As discussed earlier, there are currently similar requirements
under parts 417 and 431 and, by reference, part 435, for agreements to
ensure that NTMs and NOTAMs are implemented. Part 417 references part
420, which also contains requirements for these notices and requires
operators to describe procedures to ensure that these and other
notifications are accomplished. Part 417 requires an operator to
execute agreements with multiple entities. None of the current
requirements adequately addresses NTMs and NOTAMs when the U.S. Coast
Guard or the FAA does not have jurisdiction, such as with launches or
reentries from or to foreign or international territories. Currently,
these agreements must be in place before a license is issued. However,
in practice, the FAA sometimes accepts draft agreements or makes the
submission of the executed agreements a condition of the license.
    Under proposed Sec.  450.147, a vehicle operator would be required
to enter into a written agreement with any entity that provides a
service or property that meets a requirement in part 450. Such entities
would include a Federal launch range operator, a licensed launch or
reentry site operator, any party that provides access to or use of
property and services required to support a safe launch or reentry
under part 450, the U.S. Coast Guard, and the FAA. Other entities that
provide a service or property could also include local, state, or
federal agencies, or private parties. For instance, a local fire
department might provide a standby service to control a possible fire,
a state agency could provide any number of services such as road
closures, and NASA might provide telemetry capability. Although
agreements with local agencies, for example, may be necessary to ensure
public safety, the FAA believes that it is overly prescriptive to list
in regulation the specific entities with which each operator must enter
into an agreement.
    This proposal would require an operator to enter into only those
agreements necessary for its particular operation. If an operator works
with multiple entities to satisfy requirements in proposed part 450, it
would need multiple agreements. However, if agreements required under
this proposed section are already addressed in agreements executed by
the site operator, an operator would only need to enter into agreements
with either the Federal launch range or other site operator and any
entity with which the site operator does not perform the necessary
coordination. In particular, Federal launch ranges almost always
arrange for the issuance of NTMs and NOTAMs for launches.\94\
---------------------------------------------------------------------------

    \94\ Typically, Federal ranges do not arrange for the issuance
of NTMs and NOTAMs for the disposal of a launch vehicle from orbit
or the reentry of a reusable launch or reentry vehicle.
---------------------------------------------------------------------------

    The proposal also contemplates agreements between a maritime or
aviation authority other than the U.S. Coast Guard or the FAA. Unless
otherwise addressed in agreements with the site operator, the proposed
rule would require an operator to enter into such agreements for a
launch or reentry that crosses airspace or impacts water not under the
jurisdiction or authority of the U.S. Coast Guard or the FAA.
    Section 450.147(b) would require all agreements to clearly
delineate the roles and responsibilities of each party in order to
avoid confusion concerning responsibility for executing safety-related
activities. Section 450.147(c) would require all agreements to be in
effect before a license can be issued. However, as noted earlier, the
FAA recognizes that agreements might not be finalized by the time the
FAA is

prepared to make a licensing determination. Therefore, the regulation
would allow an operator to request a later effective date, contingent
upon the Administrator's approval. An operator could do this by
providing the FAA the status of the negotiations involving the
agreement including any significant issues that require resolution and
the expected date for its execution.
    Under proposed Sec.  450.147(d), an applicant would be required to
describe each agreement in its vehicle operator license application. An
applicant should clearly delineate the roles and responsibilities of
each party to the agreement to support a safe launch or reentry. The
applicant would also need to provide a copy of any agreement, or
portion thereof, to the FAA upon request. The FAA recognizes that some
portions of agreements may contain business-related provisions that do
not pertain to FAA requirements. Those portions would not be required.
The FAA seeks comment on its proposed approach to agreements.
2. Safety-Critical Personnel Qualifications
    The FAA proposes to remove the certification requirements found in
Sec. Sec.  417.105, 417.311, and 415.113 and replace them with
performance-based requirements in Sec.  450.149 (Safety-Critical
Personnel Qualifications). Section 450.149 would require qualified
personnel to perform safety-critical tasks for launch and reentry
operations. The FAA also proposes to expand personnel qualification
requirements to ensure that safety-critical personnel are qualified to
perform their assigned safety tasks.
    An operator must qualify and train its safety-critical personnel in
performing their safety-critical tasks for all vehicle and license
types because training mitigates the potential for human error during
safety-critical operations. Currently, the FAA requires a personnel
certification program in part 417 for personnel that perform safety-
related tasks. Specifically, Sec.  417.105 requires that a launch
operator employ a personnel certification program that documents the
qualifications, including education, experience and training, for each
member of the launch crew. The launch operator's certification program
must include annual reviews and revocation of certifications for
negligence or failure to satisfy certification requirements. Section
415.113 requires an operator to submit a safety review document that
describes how the applicant will satisfy the personnel certification
program requirements of Sec.  417.105 and identify by position
individuals who implement the program. The document must also
demonstrate how the launch operator implements the program, contain a
table listing each hazardous operation or safety critical task
certified personnel must perform, and include the position of the
individual who reviews personnel qualifications and certifies the
personnel performing the task. In Sec.  417.105(b), an operator is
required to review personnel qualifications and issue individual
certifications. The intent behind this requirement was to ensure that
qualified people perform the required safety tasks.
    Neither part 431 nor part 435 have a personnel certification
program requirement or any personnel training requirement; however, the
need for personnel qualifications is a natural outcome of the system
safety process.
    The FAA recognizes that the current regulations in part 417 are
inflexible and that using a certification program is not the only
method to ensure qualified personnel perform safety-critical tasks.
Operators may use other methods to verify all training and experience
required for personnel to perform a task is current. For example, an
operator may maintain training records to document internal training
and currency requirements or completion standards for its safety
critical personnel. An operator's issuance of individual certifications
does not itself enhance public safety. If the personnel are qualified
through training and experience for each safety task performed,
additional certification is unnecessary because no additional training
is required for an individual to be issued a certification. Removing
the certification requirement would also reduce cost to the industry by
removing the two-step process to allow qualified personnel to perform
safety-related tasks.
    Additionally, the flight safety crew roles and qualifications
requirements in Sec.  417.311, are prescriptive. Section 417.311(a)
requires a flight safety crew to document each position description and
maintain documentation of individual crew qualifications, including
education, experience, and training, as part of the personnel
certification program of Sec.  417.105. Section 417.311(b) describes
the roles of the flight safety crew and explicitly states subjects and
tasks that the crew must be trained in and references the certification
program. Finally, Sec.  417.311(c) requires the flight safety crew
members to complete a training and certification program to ensure
familiarization with launch site, launch vehicle, and FSS functions,
equipment, and procedures related to a launch prior to being called on
to support a launch. It also requires a preflight readiness training
and certification program be completed and prescribes the content that
must be included in such training. The current regulations are a burden
to operators because they focus on FSSs and do not account for evolving
technologies, including autonomous FSSs. Removing the prescriptive
requirements in Sec.  417.311 and replacing them with performance-based
requirements would alleviate this burden.
    The ARC recommends that the proposed regulation ensure that the
applicant has a structure in place to protect public safety, and that
the FAA use current requirements as guidelines for evaluation and
approval when necessary. The FAA agrees that the regulations should
ensure that personnel performing tasks that impact public safety are
qualified to perform those tasks. As the industry grows and operations
become more frequent and varied, operators need greater flexibility in
operational practices. Employing a qualification program to ensure
personnel performing safety-critical tasks are trained is one factor in
protecting safety of public and public property.
    Therefore, the FAA proposes to remove the requirements for a
certification program described in Sec. Sec.  415.113 and 417.105 and
replace the prescriptive requirements of Sec.  417.311 with
performance-based requirements that capture the intent of the current
regulations--to ensure that an operator's safety-critical personnel are
trained, qualified, and capable of performing their safety critical
tasks, and that their training is current. Under proposed Sec.
450.149, an applicant would be required to identify in its application
the safety-critical tasks that require qualified personnel and provide
its internal training and currency requirements, completion standards,
or any other means of demonstrating compliance with proposed Sec.
450.149(a).
    The proposed performance-based requirements would allow each
operator to identify the safety-critical operations and personnel
needed for the operation. It would also allow an operator to determine
what training, experience, and qualification should be required for
each safety-critical task. The FAA would consider any task that may
have an effect on public safety and meets the definition of safety-
critical found in Sec.  401.5 subject to the requirements of Sec.
450.149. These tasks would include, but are not limited to, operating
and installing flight safety system hardware,

operating safety support systems, monitoring vehicle performance,
performing flight safety analysis, conducting launch operations,
controlling public access, surveillance, and emergency response. With
the many different kinds of operations currently underway, an operator
is in the best position to identify the operations, personnel, and
training needed for its operation.
    The FAA would also require that an operator ensure personnel are
qualified, and that those qualifications are current, without requiring
certification. The regulation would require proper training of
personnel and verification that each person performing safety critical
tasks is qualified. Under Sec.  450.149, an applicant would be required
to document all safety-critical tasks and internal requirements or
standards for personnel to meet prior to performing the identified
tasks during the application phase. The applicant would be required to
provide internal training and currency requirements, completion
standards, or any other means of demonstrating compliance with the
requirements of Sec.  450.149 in its application. The applicant would
also be required to describe the process for tracking training
currency. In the event that a person's qualification was not current,
either because their qualification does not meet the training currency
requirements detailed in the application or because a new process or
procedure has been instituted that has made the training inaccurate or
incomplete, the individual would not be qualified to perform safety-
related tasks specific to the expired qualification.
    Lastly, part 460 contains training and qualification requirements
for flight crew. Compliance with these requirements would meet the
training and qualification requirements in proposed Sec.  450.149 for
flight crew.
3. Work Shift and Rest Requirements
    The FAA proposes to combine the rest requirements of Sec. Sec.
417.113(f) and 431.43(c)(4)(i) through (iv) into proposed Sec.  450.151
(Work Shift and Rest Requirements) which would require an applicant to
document and implement rest requirements that ensure personnel are
physically and mentally capable of performing tasks assigned. An
applicant would be required to submit its rest rules during the
application phase.
    Personnel involved in the launch or reentry of expendable and
reusable vehicles need to be physically and mentally capable of
performing their duties, especially those people making decisions or
performing operations that affect public safety. Fatigue can degrade a
person's ability to function and make the necessary decisions to
conduct a safe launch or reentry operation. Since the FAA started
requiring rest rules, there have been no incidents resulting from
fatigue during a licensed launch or reentry. To maintain this level of
safety, the FAA proposes to continue requiring rest rules in order to
prevent fatigue and ensure operator personnel can perform their duties
safely.
    A 1993 NTSB investigation of an anomaly that occurred during a
commercial launch from a Federal launch range found a high probability
that fatigue and lack of rest prior to launch operations contributed to
mistakes that resulted in the vehicle initiating flight while the range
was in a no-go condition.\95\ Launching in a no-go condition increases
risk to the public because the vehicle operates outside of established
boundaries and analysis. The NTSB found that the person who decided to
proceed with the launch was not given enough time to rest after working
extra hours the previous day. In addition, the launch was scheduled for
early in the morning so the on-console time was around 2:00 a.m. The
NTSB report recommended instituting rest rules that allow for
sufficient rest before the launch operation.
---------------------------------------------------------------------------

    \95\ Special Investigation Report: Commercial Space Launch
Incident, Launch Procedure Anomaly Orbital Sciences Corporation,
Pegasus/SCD-1, 80 Nautical Miles East of Cape Canaveral, Florida,
February 9, 1993. Report PB 93-917003/NTSB/SIR93-02, July 23, 1993;
(https://www.ntsb.gov/safety/safety-studies/Documents/SIR9302.pdf).
---------------------------------------------------------------------------

    As a result of the 1993 NTSB report, the FAA issued rest rules in
its 1999 final rule. The 1999 final rule required an applicant to
ensure that its flight safety personnel adhere to Federal launch range
rest rules. In its 2000 final rule for RLVs, the FAA required rest
rules, in Sec.  431.43(c)(4), similar to the Air Force work and rest
standards for launches and the FAA's ELV requirements.\96\ The specific
and detailed requirements set forth in Sec.  431.43(c)(4) fail to
account for the various factors that can affect crew rest such as the
time of day of an operation, length of preflight operations, and travel
to and from the launch or reentry site.
---------------------------------------------------------------------------

    \96\ Section 431.43(c)(4) contains requirements that are
detailed and prescriptive. It requires vehicle safety operations
personnel to adhere to specific work and rest standards. These
requirements prescribe the maximum length of workshift and the
minimum rest period after such work shift preceding initiation of an
RLV reentry mission or during the conduct of the mission. It also
prescribes the maximum hours permitted to be worked in the 7 days
preceding initiation of an RLV mission, the maximum number of
consecutive work days, and the minimum rest period after 5
consecutive days of 12-hour shifts.
---------------------------------------------------------------------------

    The 2006 final rule adopted the current Sec.  417.113(f), which is
more performance-based than Sec.  431.43(c)(4). Section 417.113(f)
requires that for any operation that has the potential to have an
adverse effect on public safety, the launch rules must ensure that the
launch crew is physically and mentally capable of performing all
assigned tasks. It also requires those rules to govern the length,
number, and frequency of work shifts, and the rest afforded to launch
crew between shifts.
    The ARC recommended the FAA use the Sec.  417.113(f) approach as a
basis for the proposed rest rules. The ARC recommended that the
regulations should require each license applicant and operator to
establish crew rest requirements applicable to their individual
operation and suggested that the FAA consider each operator's rules
through the application review and approval process. The FAA agrees
with this approach. Additionally, the ARC suggested that the rest rules
apply to specific personnel with direct control of the vehicle or
launch or reentry decision making. While the FAA agrees with the intent
of requiring all safety critical personnel to adhere to rest rules, it
does not want to limit safety critical personnel to the roles the ARC
identified because it is prescriptive and does not allow for
operational flexibility.
    The FAA also agrees with the ARC that it is up to the company to
monitor compliance with its rest rules. The FAA does not have an
explicit requirement for an operator to monitor its employees, only
that it documents and implements rest requirements. The FAA seeks
comment on whether a specific requirement for operator monitoring would
be necessary. Regardless, the FAA would monitor compliance on occasion
with its inspection program, as it does today with current crew rest
rules.
    The FAA recognizes that launch and reentry operations are varied.
The FAA considered using prescriptive requirements like those in Sec.
431.43(c)(4) to address rest rules. However, there are many factors
that can affect crew rest that make a prescriptive regulation
impracticably complex and inflexible for allowing alternate methods of
compliance that take into account mitigations and unique circumstances.
    Section 450.151 would retain the current performance-based
requirements of Sec.  417.113(f) with modifications to include launch
and reentry operations. The proposed requirements would cover
operations of expendable, reusable, and reentry vehicles and allow an
operator flexibility to employ rest rules that fit

the particular operations. Current Sec.  417.113(f) requires that crew
rest rules govern the length, number, and frequency of work shifts,
including the rest afforded the launch crew between shifts. Similarly,
proposed Sec.  450.151(a) would require an operator to document and
implement rest requirements that ensure safety-critical personnel are
physically and mentally capable of performing all assigned tasks.
Proposed Sec.  450.151(b) would provide additional requirements
regarding the aspects of work shifts and rest periods critical to
public safety, and would add a process for extending work shifts.
    Proposed Sec.  450.151(b)(1) would require an operator's rest rules
to include the duration of each work shift and the process for
extending this shift; including the maximum allowable length of any
extension. This requirement would provide each operator with the
flexibility to identify the duration of each work shift most suited to
the operation such that safety-critical personnel are physically and
mentally capable of performing all assigned tasks. It would also
require a process for extending a work shift. Work shift length is
important because performance decreases and fatigue increases as the
length of the work shift increases. An operator should determine the
optimum length for a work shift that ensures personnel are capable of
performing their assigned tasks. Unforeseen circumstances can require
personnel to work beyond the established work shift length. In such
cases, under this proposal, the operator would be required to have a
process for extending the work shift length up to a limit where
personnel are no longer considered capable of performing their duties.
    Proposed Sec.  450.151(b)(2) would require an operator's rest rules
to include the number of consecutive work shift days allowed before
rest is required. This requirement would provide each operator with the
flexibility to identify the number of consecutive work shift days
safety-critical personnel may work such that they remain physically and
mentally capable of performing all assigned tasks. Proposed Sec.
450.151(b)(3) would require an operator's rest rules to include the
minimum rest period required between each work shift, including the
period of rest required immediately before the flight countdown work
shift. An operator would also be required to identify the minimum rest
period required after the maximum number of work shift days allowed.
Having enough rest between work shifts is important to ensure personnel
are able to perform critical tasks. The rest period before a countdown
is particularly important because it can be affected by time of launch,
reviews, and work needed to get a vehicle ready for operation.
    The FAA also proposes to remove the term ``crew'' from the rest
requirements. The use of ``crew'' can be misleading and limiting.
Operators could interpret crew to be flight crew only, whereas the rest
rules are intended to apply to any position affecting public safety.
Under this proposal, an applicant would be required to submit rest
rules to the FAA that demonstrate compliance with proposed Sec.
450.151. The FAA would evaluate an operator's rest rules in the same
way as it currently does under Sec.  417.113(f) to ensure that
personnel affecting public safety are mentally and physically capable
of performing their duties during launch or reentry operations, and
that the rest rules satisfy the requirements of proposed Sec.  450.151.
    While an operator would be able to create its own rest rules under
proposed Sec.  450.151, an applicant would also be able to use current
rest rules. That is, Sec.  431.43(c)(4) would be an acceptable means of
compliance to proposed Sec.  450.151. The FAA would evaluate other rest
rules against this benchmark and relevant standards.
4. Radio Frequency Management
    The FAA proposes to maintain the current substantive requirements
of Sec.  417.111(f) for radio frequency management and to expand the
applicability of these requirements to RLVs and reentry vehicles in
proposed Sec.  450.153 (Radio Frequency Management). The FAA also would
remove the current requirements to implement a frequency management
plan and to identify agreements for coordination of use of radio
frequencies with any launch site operator and local and federal
authorities.
    Under Sec.  415.119 and appendix B of part 415, an applicant for a
launch license is required to include a frequency management plan \97\
in its application, and that plan must satisfy the requirements of
Sec.  417.111(f). Specifically, current Sec.  417.111(f) requires an
operator to implement a frequency management plan that identifies each
frequency, all allowable frequency tolerances, and each frequency's
intended use, operating power, and source. The plan must also provide
for the monitoring of frequency usage and enforcement of frequency
allocations and identify agreements and procedures for coordinating use
of radio frequencies with any launch site operator and any local and
Federal authorities, including the FCC.
---------------------------------------------------------------------------

    \97\ A radio frequency management plan describes how an operator
manages radio frequencies to meet termination or tracking
requirements.
---------------------------------------------------------------------------

    While parts 431 and 435 do not contain explicit frequency
management requirements, an operator is required to identify and
mitigate hazards, including hazards associated with frequency
management as part of the system safety process in Sec.  431.35(c) and
(d). Section 431.35(c) requires operators to perform a hazard analysis
and identify, implement, and verify mitigations are in place.\98\
---------------------------------------------------------------------------

    \98\ One such hazard is radio interference that could disable a
commanded FSS. An operator might mitigate such a hazard by ensuring
that the power level of the command transmitter is sufficient to
ensure termination with high reliability (i.e., 0.999 at 95
percent). For reentry vehicles, radio frequencies for tracking are
coordinated to ensure there is coverage where needed as well as
communication with the vehicle.
---------------------------------------------------------------------------

    Section 450.153 would replace the current requirement in Sec.
417.111(f) to implement a frequency management plan. In proposed Sec.
450.153(a), the FAA proposes to make these radio frequency management
requirements applicable to any radio frequency used. This proposed
requirement would include radio frequencies used not only in launch
vehicles, but also in RLVs and reentry vehicles. Because radio
frequency requirements are a mitigation for hazards associated with
frequency management, the proposed requirements would not necessarily
be new requirements for RLVs or reentry vehicles but would codify the
need for radio frequency management for RLVs and reentry vehicles.
    The FAA also proposes to maintain the substantive radio frequency
requirements of current Sec.  417.111(f) in proposed Sec.  450.153(a).
Although the increased use of autonomous termination systems makes
frequency management less critical for flight termination, there are
still many operators that use command termination systems. Moreover,
these requirements remain applicable to autonomous termination systems
because operators still need to allocate radio frequencies to telemetry
and tracking. There are also other hazards, such as electromagnetic
interference and induced currents, that can result from radio frequency
interference and that require mitigation. Therefore, an operator would
continue to be required to: (1) Identify each frequency, all allowable
frequency tolerances and each frequency's intended use, operating power
and source; (2) provide for monitoring of frequency usage and
enforcement of frequency allocations; and (3)

coordinate the use of radio frequencies with any site operator and any
local and Federal authorities.
    While no substantive changes are proposed to the radio frequency
requirements, this proposal would remove the current requirement that
an operator's frequency management plan identify agreements and
procedures for coordinating the use of radio frequencies with any
launch site operator and any local or federal authorities. Many of the
agreements necessary for radio frequency management would be covered in
proposed Sec.  450.147.
    In proposed Sec.  450.153(b), an applicant would be required to
submit procedures or other means to demonstrate compliance with the
requirements of Sec.  450.153(a) as part of its application. This
requirement would provide an applicant flexibility in the manner of
demonstrating compliance, such as using checklists or continuing to use
a frequency management plan.
5. Readiness: Reviews and Rehearsals
    The FAA proposes to revise and consolidate the readiness
requirements of parts 417 and 431 into a performance-based regulation
that would require an operator to document and implement procedures to
assess readiness to proceed with the flight of a launch or reentry
vehicle. The FAA currently requires an operator to be ready to perform
launch or reentry operations. Readiness, which is currently addressed
through readiness reviews and rehearsals, has three components--
readiness of the vehicle, of the personnel, and of the equipment. In
consolidating these parts, the FAA proposes to remove the current
requirements to conduct rehearsals, to poll the FAA at the launch
readiness review, and to provide a signed written decision to proceed.
The FAA also proposes to eliminate the specific review requirements of
Sec. Sec.  417.117 and 431.37.
    Launch rates have increased substantially since the adoption of
parts 417 and 431. In 2007, an operator might only launch one to three
times a year. Currently, there are operators that have launch rates
exceeding 20 launches per year. Readiness requirements have become
overly burdensome as operators spend time on rehearsals and reviews
that were meant to ensure readiness. Timing requirements have resulted
in additional reviews or non-compliances. Operators in a high launch
rate environment may not benefit much from rehearsals and added
reviews.
    Currently, Sec.  417.117 requires that a launch operator (1) review
the status of operations, systems, equipment and personnel required by
part 417, (2) maintain and implement documented criteria for successful
completion of each review, (3) track and document corrective actions or
issues identified during the review, and (4) ensure that launch
operator personnel overseeing the review attest to successful
completion of the reviews criteria in writing. Section 417.117(b)(3)
requires an operator to conduct a launch readiness review for flight
within 48 hours of flight. The decision to proceed with launch must be
in writing and signed by the launch director and any launch site
operator or Federal launch range. The launch operator must also poll
the FAA to verify that the FAA has not identified any issues related to
the launch operator's license.
    For RLV operations, Sec.  431.37 requires an applicant to submit
procedures that ensure readiness of the vehicle, personnel, and
equipment as part of the application process. These procedures must
involve the vehicle safety operations personnel and the launch site and
reentry site personnel involved in the mission. The procedures must
include a mission readiness review and specify that the individual
responsible for the conduct of the licensed activities is provided
specific information upon which he or she can make a judgement as to
mission readiness.
    Additionally, as part of the readiness requirements, Sec.  417.119
requires an operator to rehearse its launch crew and systems to
identify corrective actions necessary to ensure public safety that
cover the countdown, communications, and emergency procedures, and it
specifically directs the launch operator in how to conduct its
rehearsals. Section 431.33(c)(1) similarly requires an applicant to
monitor and evaluate operational dress rehearsals to ensure they are
conducted in accordance with procedures required by Sec.  431.37 to
ensure the readiness of vehicle safety operations personnel.
    The requirements of both parts 417 and 431 are prescriptive and do
not provide an operator with much flexibility as to compliance. The
lack of flexibility is evidenced by the issuance of waivers and
documentation of non-compliances. This requirement has created a burden
on operators because they must spend extra resources requesting waivers
and responding to enforcement actions. Processing waivers and
conducting additional reviews costs time and money for the FAA, as
well. For example, Sec.  417.117(b)(3) requires a flight operator to
hold a launch readiness review no earlier than 48 hours before flight.
Since 2007, the FAA has processed over 20 waivers to the 48-hour
requirement. In situations where ELV operators have not requested a
waiver to the timing requirement, they have held additional reviews
just to meet the timing requirement of the flight readiness review.
Additionally, the FAA has issued at least three enforcement letters
because operators did not meet the timing requirement.
    The ARC recommended that the FAA distill reviews down to intent,
list the minimum items the FAA reviews, and let the operator inform the
FAA in the license application where those items are and how they would
be reported. The FAA agrees that specific reviews are not required and
proposes a list of items required to address readiness. The FAA also
agrees that specific rehearsals are not required because there are a
variety of methods by which an operator could meet readiness
requirements. As discussed later, the FAA proposes to remove the
specific requirement for rehearsals.
    The FAA proposes to revise and consolidate the readiness
requirements of parts 417 and part 431 into proposed Sec.  450.155,
which would require an operator to document and implement procedures to
assess readiness to proceed with the flight of a launch or reentry
vehicle. The FAA anticipates that under this proposal an operator would
be able to achieve readiness by various methods including, but not
limited to, readiness meetings, tests, rehearsals, static fire tests,
wet dress rehearsals,\99\ training, and experience.
---------------------------------------------------------------------------

    \99\ A wet dress rehearsal includes at least a partial fueling
of a vehicle with a liquid propellant.
---------------------------------------------------------------------------

    While current regulations require specific readiness reviews,
proposed Sec.  450.155 (Readiness) would remove the requirement for
flight readiness reviews, including the requirements for a launch
readiness review no earlier than 15 days before flight and the flight
readiness review no earlier than 48 hours before flight. The FAA
proposes to remove these requirements because it has found that
multiple readiness reviews may not be necessary to demonstrate
readiness. For instance, readiness can be determined by a single
meeting close enough in time to the launch or reenty to ensure there
have been no material changes to readiness, such as failure of a radar
or telemetry system. Under the proposed rule, it would be up to the
operator to propose how it would ensure readiness, and whether such
procedures would include one or more readiness reviews, testing, or
some other means. By eliminating the timing requirements, operators
with high launch rates could propose how they

will ensure they are ready for launch and whether that involves one or
more readiness reviews held close enough in time to the launch to
ensure no significant changes occur between the review and the launch.
Removing the specific requirements for reviews and tests would not
relieve the operator from having to perform a test or hold a review
that is necessary for determining readiness, rather it would provide
the operator with flexibility to develop and propose those tests and
reviews most suitable for the operation in order to ensure readiness.
The FAA would evaluate and make a determination on the adequacy of the
proposed procedures during the licensing process. The FAA plans to
publish a draft means-of-compliance guide with the publication of the
proposed rule, which should include acceptable approaches. In the long
term, the FAA plans to refer to an AC or standard for every
performance-based requirement.
    Instead of requiring specific readiness reviews, proposed Sec.
450.155 would require that an operator document and implement
procedures to assess readiness to proceed with the flight of a launch
or reentry vehicle. As part of the application requirements, the
operator would be required to demonstrate compliance with the
requirements of proposed Sec.  450.155 through procedures that may
include a readiness meeting close in time to flight. Unlike Sec. Sec.
417.117 and 431.37, proposed Sec.  450.155 would not specify
particulars of what the procedures must contain. However, the operator
would be required to document and implement procedures that at a
minimum address: (1) Readiness of vehicle and launch, reentry, or
landing site, including any contingency abort location; (2) readiness
of safety-critical personnel, systems, software, procedures, equipment,
property and services; and (3) readiness to implement a mishap plan.
The FAA proposes to require that the procedures address these
particular areas because the FAA has determined that a safe launch or
reentry, at a minimum, requires the vehicle, site, and safety personnel
to be ready and all safety systems and safety support equipment to be
working properly. Additionally, being prepared to implement a mishap
plan would ensure that public safety is maintained during a mishap
because personnel would be familiar with their roles and ready to
perform their duties in order to return the vehicle and site to a safe
condition after the mishap.
    The FAA also proposes to remove the requirement that an operator
poll the FAA at the launch readiness review and provide a signed
certificate of the decision to proceed contained in Sec.  417.117. This
polling is unnecessary because the FAA will always inform the operator
of any licensing issues as soon as the FAA becomes aware of them. The
FAA also proposes to remove the requirement that an operator provide a
signed certificate of the decision to proceed with launch or reentry
operations because the FAA has not used any signed certificate required
under Sec.  417.117 for any launch or reentry. All the certificates
have been filed and have not served any purpose other than to comply
with the requirement under Sec.  417.117. The FAA believes that
removing the requirements to poll the FAA and to have a signed
certificate to proceed would not affect public safety and would relieve
burdens to comply with those requirements from the operator and the
FAA.
    The FAA proposes to remove the requirements in Sec.  417.119
because rehearsals are not always needed to achieve readiness. It is
important that the launch team be familiar with operations. Rehearsals
are a good way to ensure proficiency with procedures, exercise
communications and critical safety positions as a team, and identify
areas where the operator needs to improve. However, the FAA
acknowledges that rehearsals are not the only way to ensure the
readiness performance requirement is met. This proposal would allow an
operator to determine what methods would be best suited to ensure
readiness for its operation. Operators that have high launch rates may
not need to rehearse personnel that were involved in a similar launch
days or weeks earlier. However, licensees that have not launched for a
long time or that are launching for the first time may need rehearsals
to meet some of the readiness requirements. Operators with high launch
rates could demonstrate readiness with a readiness review and would not
have to hold rehearsals, and training could fill gaps where actual
operations do not provide familiarity with certain aspects of
operations. For example, if no anomalies are experienced during actual
operations, the operator could hold a rehearsal or provide additional
training to exercise the anomaly resolution process.
    Current Sec.  417.117(b)(3)(xi) requires an operator to review
launch failure initial response actions and investigation roles and
responsibilities and Sec.  417.119(c) requires an operator to have a
mishap plan rehearsal; current Sec.  431.45 contains the requirements
for a mishap plan for RLVs. Section 450.155(a)(3) would require an
operator to document and implement procedures to ensure readiness to
implement a mishap plan in the event of a mishap. The proposal would
allow flexibility to meet the readiness requirement for implementing a
mishap plan by allowing an operator to propose a procedure acceptable
to the FAA. Thus, an operator would have the ability to develop
procedures to ensure readiness through training, rehearsals, or other
means that might be more applicable to its vehicle and mission. The FAA
would still expect an operator to review any lesson learned, corrective
action, or changes to procedures resulting from any mishap plan
rehearsals or mishap investigations.
    Under Sec.  450.155(b), an applicant would need to demonstrate
compliance with the requirements through procedures that may include a
readiness meeting close in time to flight and describe the criteria for
establishing readiness to proceed with the flight of a launch or
reentry vehicle.
6. Communications
    Currently, the FAA requires operators to implement communications
plans to ensure that clear lines of authority and situational awareness
are maintained during countdown operations. The communications plan was
the result of a 1993 NTSB investigation discussed earlier. One of the
contributing factors identified in the investigation was the lack of
clear communications between different ranges and the operator. The FAA
requirements for communications plans are currently found in Sec. Sec.
417.111(k) and 431.41 and are nearly identical. Currently, Sec. Sec.
417.111(k) and 431.41 require an operator to implement a communications
plan. Part 435 requires a reentry vehicle operator to comply with the
safety requirements of part 431, including Sec.  431.41. Both
Sec. Sec.  417.111(k) and 431.41 require an operator's communications
plan to define the authority of personnel, by individual or position
title, to issue ``hold/resume,'' ``go/no-go,'' and abort commands;
assign communication networks so that personnel have direct access to
real-time safety-critical information required to issue ``hold/
resume,'' ``go/no-go,'' and any abort decisions and commands; ensure
personnel monitor common intercom channels during countdown and flight;
and implement a protocol for using defined radio telephone
communications terminology.
    Additionally, Sec.  431.41(b) requires that the applicant submit
procedures to ensure that the licensee and reentry site personnel
receive copies of the communications plan, and that the reentry site
operator concurs with the plan. For launches from a Federal

launch range, Sec.  417.111(k) also requires the Federal launch range
to concur with the communications plan.
    Operators launching from Federal launch ranges comply with Sec.
417.111(k). Operators submit a communications plan during the
application process and coordinate with the Air Force. The
communications plan includes lines of authority, identification of who
has access to which channels, protocols for communication and
procedures for decision processes. Often, the communication plan is not
fully developed at the time the operator applies for a license, so
operators often submit a representative plan during the application
process and then provide a final plan prior to the first launch under a
license.
    The FAA proposes to retain the substantive communications
requirements in Sec. Sec.  417.111(k) and 431.41 in Sec.  450.157
(Communications), in paragraph (a), and remove the specific requirement
to implement a communications plan. Section 450.157(b) would also
require an operator to ensure currency of the communication procedures,
similar to the current requirement in Sec.  417.111(e). The FAA would
preserve these requirements because all key participants must work from
the same communications procedures in order to avoid miscommunication
that could lead to a mishap.\100\
---------------------------------------------------------------------------

    \100\ NTSB Special Investigation Report: Commercial Space Launch
Incident, Launch Procedure Anomaly Orbital Science Corporation,
Pegasus/SCD-1, 80 Nautical Miles East of Cape Canaveral, Florida
(February 9, 1993); at p. 53.
---------------------------------------------------------------------------

    Section 450.157(c) would require an operator during each countdown
to record all safety-critical communications network channels that are
used for voice, video, or data transmissions to support safety-critical
systems. This is substantially the same requirement as in Sec. Sec.
417.111(l)(5)(vii) and 431.41. The FAA would retain this requirement
because communications recording is often critical to mishap
investigations.
    Lastly, the FAA would not require operators to submit communication
procedures during the application process because generally such
procedures are not mature at the time of application, and hence are
unlikely to be the ones used during the actual countdown. Under the
proposal, the FAA would not approve the communications procedures prior
to licensing and would rely instead on an inspection process that
ensures the operator is following the requirements for communications
procedures. These inspections would be consistent with current
practice, where FAA inspectors often review the operator's final
communications procedures. Given that the FAA would no longer require
demonstrations of compliance at the application stage for
communications and preflight procedures, operators may be required to
make revisions to those procedures to resolve issues identified during
compliance monitoring.
7. Preflight Procedures
    Under Sec.  417.111(l), an operator is required to develop and
implement a countdown plan that verifies each launch safety rule and
launch commit criterion is satisfied, personnel can communicate during
the countdown, the communication is available after the flight, and a
launch operator will be able to recover from a launch abort or delay.
This countdown plan must cover the period of time when any launch
support personnel are required to be at their designated stations
through initiation of flight. It also must include procedures for
handling anomalies that occur during countdown and any constraints to
initiation of flight, for delaying or holding a launch when necessary,
and for resolving issues. It must identify each person by position who
approves the corrective actions, and each person by position who
performs each operation or specific action. It also must include a
written countdown checklist that must include, among other items,
verification that all launch safety rules and launch commit criteria
have been satisfied. In case of a launch abort or delay, the countdown
plan must identify each condition that must exist in order attempt
another launch, including a schedule depicting the flow of tasks and
events in relation to when the abort or delay occurred and the new
planned launch time, and identify each interface and entity needed to
support recovery operations. Currently Sec.  415.37(a)(2) requires that
the applicant file procedures that ensure mission constraints, rules
and abort procedures are listed and consolidated in a safety directive
or notebook. Similarly, the mission readiness requirements of Sec.
431.37(a)(2) require that procedures that ensure mission constraints,
rules, and abort plans are listed and consolidated in a safety
directive notebook.
    Currently some operators have paper notebooks containing all the
checklists and countdown plans. These notebooks are updated frequently,
even up to the day before a launch with change pages by every member of
the launch team. This process can sometimes lead to confusion and
configuration issues. Other operators have electronic systems that
contain all the checklists and countdown procedures. There are many
advantages to electronic records, such as ease of dissemination and
configuration control. As electronic file use becomes more common, the
need for a physical notebook becomes unnecessary. What is critical for
safety is that all launch personnel have the same set of procedures.
Due to the dynamic nature of countdown procedures, operators provide
checklists and procedures used in prior launches to meet the
application requirements. The FAA evaluates these checklists and
procedures during the license evaluation. However, because the
checklists and procedures being evaluated are not final, operators must
submit all updates to these documents as part of the continuing
accuracy of the license requirements. FAA inspectors ensure the
checklists and procedures are the most current, and that configuration
control is maintained.
    The FAA proposes to streamline the current countdown procedures and
requirements in Sec. Sec.  415.37(a)(2), 417.111(l), and 431.39(a)(2)
and replace them in Sec.  450.159 (Preflight Procedures). In doing so,
the FAA proposes to remove the requirements for safety directives or
safety notebooks and for a countdown plan, and the requirement to file
such plans because there are many methods of documenting the preflight
procedures that do not involve a plan or notebook. Although the
proposed preflight procedures would not be required to be submitted as
part of the license application process, FAA inspectors would still
ensure that such preflight procedures are implemented.
    Unlike the current regulations, the FAA proposes a performance-
based requirement where an operator would need to implement preflight
procedures would verify that all flight commit criteria are satisfied
before flight and that ensure the operator is capable of returning the
vehicle to a safe state after a countdown abort or delay.\101\ This
aligns with the intent of current regulations while permitting
flexibility on how the safety goal is achieved. As a result, there
would be no impact on safety resulting from the removal of the current
prescriptive requirements.
---------------------------------------------------------------------------

    \101\ A countdown abort includes launch scrubs, recycle
operations, hang-fires, or any instance in which the launch vehicle
does not lift-off after a command to initiate flight has been sent.
---------------------------------------------------------------------------

    Additionally, proposed Sec.  450.159(b) would require an operator
to ensure the currency of the preflight procedures, and that all
personnel are working with the approved version of the preflight

procedures, similar to the current requirement in Sec. Sec.
415.37(a)(3) and 431.39(c). The FAA would preserve these requirements
because all key participants must work from the same preflight
procedures in order to avoid a mishap.
    The FAA anticipates that the current requirements of Sec.
417.111(l)(1) through (6) would be a means of compliance under the
proposal, but not the only means of compliance. By allowing alternative
means of compliance, the proposed regulations would provide greater
operational flexibility and procedure streamlining across all operation
types.
8. Surveillance and Publication of Hazard Areas
    The FAA proposes to adopt surveillance of a flight hazard area
regulations based on recent granted waivers and to better align with
current practices at the Federal launch ranges, where most commercial
launches take place, and to codify current practice that eliminates
unnecessary launch delays while maintaining public safety. This
proposal would only alter the substantive requirements applicable to
the surveillance of ship (waterborne vessel) hazard areas not the
surveillance of land or aircraft hazard areas. Therefore, this
discussion will focus primarily on the proposal's effect on the
surveillance of waterborne vessel hazard areas. The specific
requirements for conducting a flight hazard area analysis are discussed
later in the preamble.
    Current regulations on establishing and surveilling hazard areas,
including ship hazard areas, for ELVs are found in Sec. Sec.  417.205
\102\ and 417.223 \103\ and part 417, appendix B.\104\ Part 431 does
not set explicit requirements for the surveillance of waterborne vessel
hazard areas, and the FAA has not yet issued a license under part 431
over water. However, both Sec. Sec.  417.107(b)(2) and 431.35(b)(1)(ii)
require that an operator ensure all members of the public are cleared
of all regions, whether land, sea, or air, where any individual would
be exposed to more than 1 x 10-6 PC. Although not
explicit, the current regulations for ELV and RLV operations
effectively require surveillance and evacuation of all regions where
the individual risk criterion would be violated by the presence of any
member of the public.
---------------------------------------------------------------------------

    \102\ Section 417.205 requires the flight safety analysis to
employ risk assessment, hazard isolation, or a combination of risk
assessment and partial isolation of the hazards to demonstrate
control of risk to the public.
    \103\ Section 417.223 requires, in part, that an FSA include a
flight hazard area analysis that identifies any regions of land,
sea, or air that must be surveyed, publicized, controlled, or
evacuated in order to control the risk to the public from debris
impact hazards.
    \104\ Section B417.5(a) of appendix B to part 417 states that a
launch operator must perform a launch site hazard area analysis that
protects the public, aircraft, and ships from the hazardous
activities in the vicinity of the launch site.
---------------------------------------------------------------------------

    The net effects of the current ELV regulations are: (1) An operator
must establish a ship hazard area sufficient to ensure the
PI for any ship does not exceed 1 x 10-5 for any
debris that could cause a casualty, (2) an operator must monitor the
ship hazard area prior to initiating the flight operation, and (3) if a
large enough ship enters the waterborne vessel hazard area to exceed
the 1 x 10-5 PI criterion, then the launch must
be scrubbed or delayed until the ship exits the hazard area. Appendix B
to part 417 directs a launch operator to evacuate and monitor each
launch site hazard area to ensure compliance with the risk criteria in
Sec.  417.107(b)(2) and (3) and provide an adequate methodology to
achieve this end. The FAA designed this methodology to be consistent
with Air Force range safety requirements in 2006 and to ensure that the
cumulative PI to any ships would not exceed 1 x
10-5 for any debris expected to exceed the kinetic energy or
overpressure thresholds established by Sec.  417.107(c).
    Current Sec.  417.223(b) requires public notices for flight hazard
areas. A flight hazard area analysis must establish the ship hazard
areas for notices to mariners that encompass the three-sigma impact
dispersion area for each planned debris impact.\105\ Section 417.121(e)
contains procedural requirements for issuing notices to mariners (and
airmen). Furthermore, Sec.  417.111(j) requires a launch operator to
implement a plan that defines the process for ensuring that any
unauthorized persons, ships, trains, aircraft or other vehicles are not
within any hazard areas identified by the FSA or the ground safety
analysis. In the plan, the launch operator must list each hazard area
that requires surveillance to meet Sec. Sec.  417.107 and 417.223, as
well as describe how the launch operator will provide for day-of-flight
surveillance of the flight hazard area to ensure that the presence of
any member of the public in or near a flight hazard area is consistent
with flight commit criteria developed for each launch. In practice,
these regulations have been comprehensive enough to ensure public
safety, but at times overly prescriptive and unduly conservative.
---------------------------------------------------------------------------

    \105\ In addition, a flight hazard area analysis must establish
the aircraft hazard areas for notices to airmen that encompass the
3-sigma impact dispersion volume for each planned debris impact.
---------------------------------------------------------------------------

    The FAA has waived several waterborne vessel protection
requirements \106\ in light of advanced ship monitoring technology and
risk calculation models. The FAA's first waiver of the Sec.
417.107(b)(3) requirement illustrates the need for this proposed
change.\107\ In approving the first waiver and numerous subsequent
waivers to enable the proposed option, the FAA assessed the
technological advances previously discussed. In this assessment, the
FAA reviewed the Federal launch range input data and probabilistic
casualty models that the Air Force at the 45th Space Wing uses to
quantify individual and collective risks to people on waterborne
vessels during the launch countdown for space launch missions. The FAA
found that the 45th Space Wing's public risk analyses use accurate data
and scientific methods that are mathematically valid, with reasonably
conservative assumptions applied in areas where significant uncertainty
exists. In that instance, the FAA performed independent analyses using
alternative methods to estimate the casualty risks for multiple
foreseeable scenarios involving debris impacts on various types of
waterborne vessels and found that large passenger vessels anywhere
between the launch point and the first stage disposal zone can
contribute significantly to the estimated EC from a launch.
The FAA also found that small boats (too small to have Automatic
Identification System (AIS) required \108\) located close to the launch
point should not produce significant individual risks. However, no past
waivers involved changes in the areas where surveillance was mandatory
in current practice, only where ships were allowed to be present in
order for the launch to proceed.
---------------------------------------------------------------------------

    \106\ For example, see Waivers of Ship Protection Probability of
Impact Requirement, 81 FR 28930 (May 10, 2016).
    \107\ 81 FR 28930 (May 10, 2016).
    \108\ AIS is required on commercial vessels 65 feet in length or
more, towing vessels 26 feet in length or more, and other self-
propelled vessels certified to carry more than 150 passengers or
carrying dangerous cargo.
---------------------------------------------------------------------------

    Section 450.161 (Surveillance and Publication of Hazard Areas)
would require an operator to publicize, survey, and evacuate each
flight hazard area before initiating flight or reentry, to the extent
necessary to ensure compliance with proposed Sec.  450.101. Proposed
Sec.  450.161(a) does not change the need for surveillance relative to
the current requirements in parts 417 or 431 for people on land or
aircraft because the proposal would continue to require that

an operator ensure all regions where any individual member of the
public would be exposed to more than 1 x 10-6 PC
are evacuated. However, the proposal would remove the requirement to
evacuate and monitor areas where a waterborne vessel would be exposed
to greater than 1 x 10-5 PI currently required by
Appendix B to part 417, paragraph 417.5(a).
    The FAA proposal to include people on ships in the collective risk
computation (see proposed Sec.  450.101(a)(1) and (b)(1)) would
explicitly allow the application of risk management principles to
protect people on waterborne vessels. For example, an applicant could
apply conservative estimates of the ship traffic and vulnerability to
demonstrate acceptable public risks. In proposed Sec.  450.161(a),
surveillance would only be required to the extent necessary to ensure
compliance with the public safety criteria, including individual and
collective risks as well as notification of planned impacts from normal
flight events capable of causing a casualty. For instance, an operator
would not need to perform surveillance of areas where the risk to any
individual would be no more than 1 x 10-6 PC,
unless surveillance was necessary to ensure acceptable collective
risks.
    The proposal would generally allow operators the option to use the
current approach in part 417, where surveillance is required to ensure
no ship is exposed to more than 1 x 10-5 PI,
because that would generally be sufficient to ensure compliance with
proposed Sec.  450.101. In addition, the proposal would also provide
the option for launch and reentry operators to use the new technology,
including modern surveillance techniques, and include people in
waterborne vessels as part of the collective risk calculation as
approved by previous waivers.\109\ Current practice is to issue waivers
to operators as an alternative to scrubbing or delaying a launch or
reentry due to waterborne vessels in an area where the PI
exceeds 1 x 10-5. Thus, the proposal would curtail the need
for waivers.
---------------------------------------------------------------------------

    \109\ 81 FR 28930 (May 10, 2016).
---------------------------------------------------------------------------

    While the proposal would relax the current part 417 requirement to
ensure that no ship is exposed to more the 1 x 10-5 PI, the
FAA notes that the requirement to ensure no ships are present in areas
where the individual risk exceeds 1 x 10-6 PC is
consistent with international guidelines. The International Maritime
Organization (IMO) is the United Nations organization for safety and
environmental protection regulations for maritime activities. The IMO
has developed a risk-based approach to safety and environmental
protection regulations, which identifies a key threshold of one in a
million (1 x 10-6) probability of fatality per year for
individual crewmembers, passengers, and members of the public ashore
(considered third parties by the IMO). The IMO guidelines equate
individual risks at the 1 x 10-6 probability of fatality per
year as broadly acceptable for maritime activities, and specifically
state that individual risks below this level are negligible and no risk
reduction required. The proposed Sec.  450.101(a)(2) and (b)(2)
requirements would ensure that no person will be present on ships where
the individual risk exceeds 1 x 10-6 PC . This
requirement is consistent, and reasonably conservative, with respect to
the IMO guidelines as explained in the RCC 321-07 Supplement.\110\
Thus, the FAA proposes to codify requirements for the development and
surveillance of ship hazard area that are reasonably consistent with
IMO guidelines for formal safety assessments.
---------------------------------------------------------------------------

    \110\ Range Commanders Council Risk Committee of the Range
Safety Group, Common Risk Criteria for National Test Ranges:
Supplement. RCC 321-07 Supplement, White Sands Missile Range, New
Mexico, 2007, p. 5-50.
---------------------------------------------------------------------------

    As previously discussed, there were important advances in ship
surveillance techniques in recent years. In the past, observation
techniques posed significant risks to launch operators. For example,
the only known deaths related to launch operations at Cape Canaveral
were five occupants of a helicopter that crashed at sea shortly after 2
a.m. on April 7, 1984, while flying surface surveillance for the
scheduled launch of a Trident 1 missile from the USS Georgia.\111\ In
many cases, the proposal would relieve the requirement for the type of
surveillance that posed significant risks to launch operators in the
past.
---------------------------------------------------------------------------

    \111\ Air Force News Print Today (Apr. 8, 2011).
---------------------------------------------------------------------------

    Section 450.161(b) would require surveillance sufficient to verify
or update the assumptions, input data, and results of the flight safety
analyses. Given there are numerous assumptions and input data that are
critical to the validity of the flight safety analyses, this
requirement could have a variety of surveillance implications beyond
the surveillance necessary to ensure the public exposure at the time of
the operation is consistent with the assumptions and input data for the
flight safety analyses. For example, an FSA could assume that a
jettisoned stage remains intact to impact or breaks up into numerous
pieces that are all capable of causing casualties to people in a class
of aircraft (e.g., business jets). An operator would be required to
employ some type of surveillance (e.g., telemetry data, or remote
sensors such as a camera or radar) to verify that the jettisoned stage
behaves as assumed by the FSA if that behavior is germane to the size
of the aircraft hazard area.
    Additionally, Sec.  450.161(c) would require an applicant to
publicize warnings for each flight hazard area, except for regions of
land, sea, or air under the control of the vehicle or site operator or
other entity by agreement. If the operator relies on another entity to
publicize these warnings, the proposal requires the operator to verify
that the warnings have been issued. The FAA notes that some operators
already follow this practice. The proposed requirements would allow
warnings that are consistent with current practice but would also allow
more flexibility for warnings to mariners in accordance with proposed
Sec.  450.133(b). Notably, Sec.  450.133(b)(1) would be consistent with
current practice at the Federal launch ranges based on input from the
CSWG, and Sec.  450.133(b)(2) and (3) are based on current U.S.
Government consensus standards).\112\ Proposed Sec.  450.161(d) would
also require an applicant to describe how it will provide for day-of-
flight surveillance of flight hazard areas, if necessary, to ensure
that the presence of any member of the public in or near a flight
hazard area is consistent with flight commit criteria developed for
each launch or reentry.
---------------------------------------------------------------------------

    \112\ RCC 321-17 Standard.
---------------------------------------------------------------------------

    This proposal is consistent with the executive branch policy to
replace prescriptive requirements with performance-based criteria.\113\
Specifically, the FAA proposes to replace the ``one-size-fits-all''
approach to ship protection that effectively prevents launch or reentry
operations to proceed if ships are in identified hazard areas
irrespective of the estimated risks posed to people on those vessels.
For example, during the launch of the Falcon 9 from CCAFS to deliver
the SES-9 payload to orbit, SpaceX was delayed by the presence of a tug
boat towing a large barge inside the ship hazard area in compliance
with the FAA's requirement in Sec.  417.107(b) to limit the
PI for waterborne vessels to 1 x 10-5.\114\ Under
the proposal, delays such as this would be avoided without the need for
waivers. The FAA proposes to replace the ``one-size-fits-all'' approach
with the performance-based criteria of the collective and individual

risk limits in proposed Sec.  450.101, and in doing so would require an
operational delay only when necessary to ensure acceptable individual
and collective risks. This approach was safely and successfully used,
by waiver, for all Falcon 9 launches from the CCAFS and KSC starting in
2016. The FAA seeks comment on the proposed approach.
---------------------------------------------------------------------------

    \113\ SPD-2 (May 24, 2018), at Section 2b.
    \114\ 81 FR 28930 (May 10, 2016).
---------------------------------------------------------------------------

    Application of public risk management for the protection of people
in waterborne vessels has the potential for reducing launch costs by
reducing the number of operational delays and scrubs due to ships in
areas where the individual and collective risks are nevertheless
acceptable. Because it is a major procurer of launch services, reduced
launch costs would be of direct benefit to the U.S. Government. It
would also help to make the U.S. launch industry more competitive
internationally by reducing launch delays and scrubs.
9. Lightning Hazard Mitigation
    The FAA proposes to remove appendix G to part 417 and replace it
with the performance-based requirements of Sec.  450.163 (Lightning
Hazard Mitigation). The current requirements in appendix G to part 417
are outdated, inflexible, overly conservative, and not explicitly
applicable to many RLVs and reentry vehicles.
    Lightning is an atmospheric discharge of electricity, and can
either occur naturally or be ``triggered.'' Triggered lightning can be
initiated as a result of a launch vehicle and its electrically-
conductive exhaust plume passing through a strong pre-existing electric
field.\115\ However, the triggering phenomenon is unpredictable because
there are many conditions that must occur in order for the breakdown of
the electric field resulting in a lightning strike to occur. One
condition is the enhancement factor of the launch or reentry vehicle
that acts as a conductor. The extremities of the vehicle, such as the
nose radius of curvature coupled with the effective length of the
vehicle (taking into account the plume length) will establish the
viability of a lightning strike. Furthermore, a launch vehicle's
propellants will have different conductivity characteristics, leading
to varying lengths; \116\ as a result, not every vehicle will trigger a
lightning strike under the same environmental conditions. This
unpredictability is exacerbated further by the fact that a triggered
lightning strike can occur even when the vehicle is penetrating a
benign cloud, or is outside a cloud that is not producing lightning.
---------------------------------------------------------------------------

    \115\ Roeder, William P. and Todd M. McNamara, A Survey Of The
Lightning Launch Commit Criteria, American Meteorological Society,
Aviation Range and Meteorology Conference.
    \116\ E. P. Krider, M. C. Noogle, M. A. Uman, and R. E. Orville.
``Lightning and the Apollo 17/Saturn V Exhaust Plume,'' Journal of
Spacecraft and Rockets, Vol. 11, No. 2 (1974), p. 72-75.
---------------------------------------------------------------------------

    Lightning can and has caused or necessitated the destruction of
launch and reentry vehicles in flight. This destruction may occur both
by physical damage (direct effect) to structural or electronic
components from lightning attachment to the vehicle and by damage or
upset to electronic systems from a nearby discharge (indirect effect).
The direct and indirect effects of a lightning discharge pose hazards
to the safety critical systems of launch and reentry vehicles, such as
the FSS. If damage to the vehicle's safety critical components renders
it inoperable or causes safety-critical systems to malfunction, there
may be no way to stop the vehicle from reaching the public. For
example, the damage may cause the command signal that instructs the
vehicle to stop thrusting, or to abort the mission, to not be received.
    Two such triggered lightning events occurred in 1969 and 1987,
during ascent. In 1969, when a manned Apollo XII \117\ vehicle lost
power to its Command Module, the launch was seconds away from beginning
initiation of its abort command. In 1987, an unmanned ELV lost its
guidance, navigation and control \118\ and began careening towards the
range safety impact limit lines. The range safety officer had to
terminate its flight.
---------------------------------------------------------------------------

    \117\ Merceret et al., ed., A History of the Lightning Launch
Commit Criteria and the Lightning Advisory Panel for America's Space
Program. NASA/TP-2010-216283, 10, Section 2.3 (August 2010).
    \118\ Merceret et al., ed., A History of the Lightning Launch
Commit Criteria and the Lightning Advisory Panel for America's Space
Program. NASA/TP-2010-216283, 31, Section 4.3.2 (August 2010).
---------------------------------------------------------------------------

    These two incidents led to the establishment of the present-day
lightning launch commit criteria (LLCC), which the Air Force and NASA
adhere to for all launches from a Federal launch range. The Lightning
Advisory Panel (LAP),\119\ an advisory body to the Air Force and NASA,
is responsible for reviewing and proposing modifications to the LLCC.
Adherence to the LLCC has resulted in zero lightning-caused launch
incidents for over thirty years.
---------------------------------------------------------------------------

    \119\ The LAP's expertise range from in-depth knowledge of the
physics of lightning, electric fields, and clouds, to lightning
impacts on launch vehicles and statistics of electric field strength
in specific environmental conditions. Its membership is primarily
academia, although the Air Force and NASA fund this organization.
---------------------------------------------------------------------------

    The FAA codified the LLCC into Appendix G to part 417 to address
concerns that the direct and indirect effects of a natural or triggered
lightning strike may disable a vehicle's FSS such that the launch
operator could not stop the vehicle if it veered outside the impact
limit lines (i.e., due to degraded signal). The FAA renamed these
requirements to ``Lightning Flight Commit Criteria'' (LFCC).
    The LFCC in appendix G to part 417 consist of 10 natural and
triggered lightning avoidance rules that provide criteria to minimize
the risk of a launch vehicle being struck by lightning or triggering
lightning. One rule contains criteria for avoiding natural lightning,
the remaining nine contain avoidance criteria for triggering or
initiating lightning when flying through, or near, specific cloud types
or phenomena known to produce natural or triggered lightning. Taking
into account the electrification process and the properties of electric
fields within clouds, the triggered lightning rules establish time and
distance requirements for distinct cloud types (e.g., cumulus cloud,
attached or detached anvil cloud, thick clouds) believed to contain the
necessary environmental conditions to produce elevated electric fields.
These time and distance criteria help mitigate the threat of triggering
lightning by increasing the probability that the electric field, at a
given distance or after a length of time, will be below the threshold
needed to produce lightning. Other rules contain prescriptive
requirements and thresholds for not launching if there are high-surface
electric fields as measured by a ground-based field mill, or if there
is a threat of a vehicle becoming charged if it penetrates a cloud that
contains frozen precipitation.\120\
---------------------------------------------------------------------------

    \120\ Triboelectrification is a phenomenon that can occur when a
launch vehicle flies through a region in a cloud that contains
frozen precipitation. Under the right conditions, frozen
precipitation can deposit a charge on the vehicle. If the launch
vehicle is not treated, an electrostatic discharge could result.
---------------------------------------------------------------------------

    Unfortunately, codifying the LLCC into appendix G of part 417 has
led to two major challenges. First, because the science behind
triggering lightning is not fully known, the criteria were developed
with a margin of safety for large ELVs, such as the Titan IV. As a
consequence, the criteria may be overly conservative for certain types
of vehicles. While the LAP has updated the LLCC to keep pace with the
advances in science and technology, the FAA rulemaking process is
lengthy, and does not permit appendix G to be updated with the
frequency necessary to keep up with the changes to the LLCCs. Revisions
to appendix G are likely to be

out-of-date by the time they are finalized and published. As a result,
appendix G preserves much of the original LLCCs outdated standards,
which leaves a discrepancy between the LLCC and appendix G.
    In an effort to address this issue, the FAA made four ELOS
determinations. The first ELOS determination permitted the use of a new
maximum radar reflectivity method \121\ to determine whether the radar
reflectivity values were below the risk threshold for triggering
lightning in the cloud. Because this new measurement technique was not
in appendix G, the launch operator could not benefit from this
improvement unless it requested and received approval to use this
technique rather than follow the criteria currently in appendix G. The
ELOS determination relieved the burden on the operator to seek approval
to use a different radar reflectivity measurement process; therefore,
allowing more opportunity for the launch operator to take advantage of
the improvement rather than wait until a final rulemaking incorporated
the change.
---------------------------------------------------------------------------

    \121\ This radar reflectivity method allowed measurement of a
hydrometeor by a radar with a wavelength of less than 5 centimeters
but greater than 3 centimeters if: (1) The surface of the radome of
the radar was hydrophobic and the precipitation rate at the radar
site was less than 15 mm/hr (0.59 in/hr) rainfall equivalent, and
(2) For each point that was measured, the horizontal extent of
composite radar reflectivity greater than lOdBZ along the line of
sight between the radar and the point did not exceed the
reflectivity extent in kilometers for a 3 cm radar due to radar beam
attenuation.
---------------------------------------------------------------------------

    When the LAP updated the LLCCs again, the FAA issued a second ELOS
determination reducing the distance requirement for the flight path of
the launch vehicle in relation to a thick cloud, if the radar
reflectivity thresholds were satisfied.\122\ The issuance of this ELOS
determination was necessary to enable operators to use the most recent
thick cloud rule without needing to seek individual ELOS determinations
from the FAA or waiting for the FAA to update appendix G through a
rulemaking.
---------------------------------------------------------------------------

    \122\ The Launch operator can launch within 5nm of a thick cloud
layer if the radar reflectivity is below 0 dBZ.
---------------------------------------------------------------------------

    The third ELOS determination also resulted from an update to the
LLCCs and allowed for use of a shorter radar wavelength to measure
radar reflectivity if the criteria for attenuation due to rainfall and
beam spreading were met. This modification allowed a launch operator to
make use of weather radars that have wavelengths between 3 and 5 cm, in
addition to radars with wavelengths of 5 cm or greater. Similar to the
other ELOS determinations, this relieved the burden from the operator
to seek approval from the FAA, and allowed the operator to immediately
use different radar wavelengths or wait until the FAA updated appendix
G.
    The fourth ELOS determination informed the launch operator that
satisfying NASA-STD-4010 would meet the requirements of appendix G to
part 417.\123\ This ELOS determination enabled an operator to use the
more up-to-date LLCC in place of the outdated LFCC in appendix G. It
also recognized that the NASA-STD-4010 contained the most current LLCCs
and removed the burden from the FAA to issue an ELOS determination for
every new update to the LLCC.
---------------------------------------------------------------------------

    \123\ The NASA-STD-4010 has been adopted by both NASA and the
Air Force. When NASA published the LLCCs in a NASA Standard document
it provided uniform engineering and technical requirements in one
location lessening confusion to which version of the LLCCs were
currently being applied.
---------------------------------------------------------------------------

    The FAA only codified the LFCCs into part 417, and not parts 431
and 435. While the LFCCs are not explicitly included in part 431 or
435, Sec.  431.35(c) requires an applicant to employ a system safety
process to identify and mitigate hazards, including lightning.
Additionally, while not all launch and reentry vehicles have the same
threshold to trigger lightning, they do have the potential to incur
direct or indirect effects that may impact their safety critical
systems. Therefore, in order to protect public health and safety, the
LFCCs are an appropriate mitigation strategy for suborbital RLVs and
reentry vehicles that can induce lightning that could affect public
safety. In 2006, the FAA sponsored a study to conduct a triggered
lightning risk assessment for five different concept suborbital RLVs,
from two different launch sites, to gain an understanding of the
potential risk of triggering lightning for these new categories of
vehicles.\124\ The study took into account the vehicle design, mission
profile, and propellants, as well as the lightning climatology of a
given launch site. In 2010,\125\ a follow-on study was performed for
four concept vehicles at a total of four different launch sites.\126\
The study showed that all concept vehicles had a much higher triggering
threshold (i.e., it was harder to initiate lightning) than that of a
Titan IV ELV and that they each had different triggering thresholds
within each concept vehicle and phase of mission. For instance, the
glide phase was shown to have a higher triggering threshold than a
powered phase. On the other hand, the study noted that many
uncertainties remain with understanding the triggering conditions.
Therefore, the results of the study recommended that until more
accurate triggering thresholds for the differing vehicle concepts can
be quantified, the avoidance criteria should be followed. The FAA
requests comments on this proposal.
---------------------------------------------------------------------------

    \124\ Krider, Phil, E. et al., Triggered Lightning Risk
Assessment for Reusable Launch Vehicles at the Southwest Regional
and Oklahoma Spaceports, Report No: ATR-2006(5195)-1, Jan 30, 2006
(https://www.faa.gov/about/office_org/headquarters_offices/ast/reports_studies/media/ATR-2006(5195)-1.pdf).
    \125\ Krider, Phil, E., et al., Triggered Lightning Risk
Assessment for Reusable Launch Vehicles at Four Regional Spaceports,
Report No: ATR-2010(4387)-1, Apr 30, 2010. (https://www.faa.gov/about/office_org/headquarters_offices/ast/reports_studies/media/ATR-2010%20(5387)-1.pdf).
---------------------------------------------------------------------------

    The ARC recommended the intent or performance goal of the current
LFCC be captured into performance-based requirements that allow for the
consideration of each launcher's mission profile, general vehicle and
flight safety system components, and other factors that may reduce the
currently-required 30-minute wait.\127\ The ARC also recommended that
the prescriptive requirements in Appendix G be placed in a guidance
document that provides acceptable means of meeting the performance-
based requirements. Finally, the ARC estimated that launch and site
operators could save hundreds of thousands of dollars, or more, for
each avoidance of launch scrubs and no-go calls due to unnecessarily
conservative weather restrictions.
---------------------------------------------------------------------------

    \127\ The ARC stated, ``intent or performance goal, of the
stated requirements.'' The FAA has interpreted the phrase ``of the
stated requirements'' to mean of the current LFCC found in appendix
G to part 417.
---------------------------------------------------------------------------

    The FAA generally agrees with the ARC's recommendation and proposes
to replace the detailed prescriptive LFCC in appendix G with
performance-based requirements in proposed Sec.  450.163. It would also
provide an AC that contains an accepted means of compliance with the
proposed Sec.  450.163(a)(1), including reference to NASA-STD-4010
\128\ and would also include other relevant standards for the design of
a vehicle to withstand the direct and indirect effects of a lightning
discharge. The FAA seeks comment on this approach.
---------------------------------------------------------------------------

    \128\ NASA-STD-4010 is the current lighting launch commit
criteria employed by NASA and the Air Force. The FAA uses this
standard as its basis for the requirements in Appendix G and has
issued a broad-based ELOS determination allowing an operator to
comply with the current NASA-STD-4010 instead of the existing
Appendix G which is outdated.
---------------------------------------------------------------------------

    The FAA anticipates that a performance-based regulation,
accompanied by an associated AC and government standards, would resolve

many of the issues with the current Appendix G. While a thorough
understanding of whether a given launch vehicle and its mission profile
will trigger lightning is far from being understood, a performance-
based requirement for mitigating natural and triggered lightning
strikes or encountering a nearby lightning discharge would allow an
operator to use up-to-date lightning avoidance criteria without having
to wait for the regulation to be updated, or for the FAA to issue an
ELOS determination or a waiver.
    The intent of the current requirements found in Appendix G to part
417 is to avoid and mitigate natural and triggered lightning. Under the
proposed regulations, the FAA would require operators to avoid and
mitigate the potential for intercepting or initiating lightning strike
or encountering discharge through implementation of flight commit
criteria. Alternatively, an operator would be able to use a vehicle
designed to continue safe flight if struck by lightning or encountering
a nearby discharge. Finally, an operator would be able to comply with
the proposed regulation by ensuring that compliance with public safety
criteria would be met in the event of a lightning strike on the
vehicle.
    Proposed Sec.  450.163(a)(1), would require an operator to mitigate
the potential for a vehicle to intercept or initiate a lightning strike
or encounter a nearby discharge through flight commit criteria using a
means of compliance accepted by the Administrator. Currently, the FAA
is only aware of one standard, NASA-STD-4010, that is currently
acceptable and would satisfy the requirements of proposed Sec.
450.163(a)(1). While FAA anticipates that industry might develop new
standards as technology advances, such standards would be required to
be submitted as alternative means of compliance under Sec.  450.35
(Accepted Means of Compliance) paragraph (c) and accepted by the
Administrator prior to use. If an operator were to submit an
alternative means of compliance to NASA-STD-4010, the proposed
lightning standard would need to be evaluated and accepted by the FAA,
including any consultation with outside expert, prior to being used in
any license application using the new standard.
    The FAA anticipates that this revision would provide more
flexibility to an operator than the current appendix G, which
prescribes the specific lightning flight commit criteria that an
operator must use. While the only method currently accepted by the
Administrator is NASA-STD-4010, operators would have the flexibility to
propose lightning flight commit criteria based on a certain vehicle's
mission profile (e.g., whether it is a piloted RLV launching a payload
to low Earth orbit, or a piloted suborbital reusable launch vehicle
with spaceflight participants on board).\129\ However, as previously
discussed, such a proposed means of compliance would need to be
accepted prior to being used in a license application to satisfy
proposed Sec.  450.165(a)(1).
---------------------------------------------------------------------------

    \129\ The piloted vehicles can control and maneuver the vehicle
leading up the release point or area thus limiting the exposure of
the vehicle to elevated electric fields upon its launch.
---------------------------------------------------------------------------

    An operator may choose instead to mitigate lightning strikes and
the initiation of lighting by using a vehicle designed to continue safe
flight in the event of a lightning strike, in accordance with proposed
Sec.  450.163(a)(2). To accomplish this, an operator would need to
demonstrate that the vehicle design adheres to design standards for
lightning protection of the vehicle and its safety critical systems.
The FAA is currently evaluating current aircraft lightning protection
standards, such as AC 20-136B and AC20-107B, to determine whether a
launch or reentry vehicle designed to those standards would allow for
the continued safe flight of the vehicle.\130\ The FAA anticipates that
it would accept other industry standards for lightning protection or
certification standards during vehicle design, such as SAE Aerospace
Recommended Practices, or European Organization for Civil Aviation
Equipment, as an acceptable means of compliance to proposed Sec.
450.163(a)(2).
---------------------------------------------------------------------------

    \130\ AC 20-136B, Aircraft Electrical and Electronic Lightning
System Lightning Protection, provides information and guidance on
the protection of aircraft electrical and electronic systems from
the effects of lightning. AC 20-107B, provides information and
guidance on composite aircraft structure.
---------------------------------------------------------------------------

    Finally, an operator would be able to choose to comply with
proposed Sec.  450.163(c) by ensuring that it would be in compliance
with the public safety criteria of proposed Sec.  450.101 should it
encounter discharge or take a direct lightning strike. The use of
physical containment as a hazard control strategy would be a prime
example, but other scenarios may also apply.
    Section 450.163 would apply to all launch and reentry vehicles,
including ELVs, RLVs, hybrids, and reentry vehicles. Because the
proposed requirement is performance based, each operator would be able
to provide lightning mitigation methods designed for a specific
vehicle's mission profile. Under Sec.  450.163, the FAA anticipates
that an operator would be able to apply new research findings or
methodologies in a more timely manner than under appendix G. Further,
the FAA would be able to update guidance materials in a timely manner
to include those means of compliance that result from advances in
science, information, or technology. Additionally, the FAA believes
that, by providing an operator with the flexibility to mitigate natural
and triggered lightning strikes through standards and best practices,
the operators could avoid costly delays resulting from compliance with
the requirements in the current appendix G.
    Section 450.163(b) would establish application requirements. To
comply with proposed Sec.  450.163(a)(1), an applicant would be
required to submit lightning flight commit criteria that mitigate the
potential for a launch or reentry vehicle intercepting or initiating a
lightning strike, or encountering a nearby discharge using a means of
compliance accepted by the Administrator. As previously discussed, the
only current method to comply with Sec.  450.165(a)(1) would be to use
NASA-STD-4010. If an applicant chooses instead to comply with Sec.
450.163(a)(2), it would be required to provide documentation
demonstrating that the vehicle is designed to protect safety critical
systems, such as electrical and electronic systems, or FSSs. The FAA
anticipates that this documentation would include proof and validation
that the vehicle has followed lightning protections standards that
would protect the vehicle's safety critical systems from a direct or
indirect lightning discharge. If an applicant chooses to comply with
Sec.  450.163(a)(3), it would be required to provide documentation
demonstrating compliance with Sec.  450.101 in the event of a lightning
discharge. As previously discussed, the FAA expects that this would be
demonstrated through any number of analyses that validate that the
vehicle is able to control individual and collective risk to the
public,
    The FAA considered using direct measurement of the electric field
within a cloud as an option for a launch operator to comply with
proposed Sec.  450.163. However, it is the FAA's understanding that
there is currently no consensus among the scientific community on the
electric field value threshold to initiate lightning. Without a
definite threshold value, the FAA would not be able to make a safety
determination if an operator were to take direct measurements of the
electric field. In addition, further research and data is required to
establish procedures for measuring within the cloud, for how many
measurements to make within a

period of time or distance from the cloud, and such other
considerations. Nevertheless, given the performance-based nature of
Sec.  450.163, it is possible that in the future, an accepted means for
obtaining real time electric field readings along the flight profile
could lead to less restrictive criteria.
10. Flight Safety Rules
    In proposed Sec.  450.165, an operator would be required to
establish and observe flight safety rules that govern the conduct of
each launch or reentry. These would include flight commit criteria and
flight abort rules.
i. Flight Commit Criteria
    The FAA proposes to consolidate the flight-commit criteria
requirements currently contained in parts 417, 431, and 435. Flight-
commit criteria are conditions necessary prior to the flight of a
launch vehicle or the reentry of a reentry vehicle to ensure that the
launch or reentry does not exceed the public safety criteria in
proposed Sec.  450.101. Although this proposal restates flight-commit
requirements differently than the current regulations, the changes
would not alter substantive requirements, and are intended solely for
clarification purposes.
    The ELV launch requirements for flight readiness are contained in
Sec. Sec.  415.37 and 417.113. Section 415.37 requires an applicant to
file procedures for verifying readiness for safe flight, which result
in flight-commit criteria. Section 417.113(c) requires that the launch
safety rules include flight-commit criteria that identify each
condition that must be met in order to initiate flight. The flight-
commit criteria must implement the FSA; for a launch that uses an FSS,
must ensure that the FSS is ready for flight; and for each launch, must
document the actual conditions used for the flight-commit criteria at
the time of lift-off and verify whether the flight-commit criteria are
satisfied.
    Flight-commit criteria for launch and reentry of a reusable launch
vehicle are contained in Sec. Sec.  431.37 and 431.39, and by extension
in Sec.  435.33 for the reentry of a reentry vehicle other than a RLV.
Unlike part 417, the parts 431 and 435 requirements are performance-
based and required as part of the system safety analysis requirements.
    Flight-commit criteria-related requirements appear throughout
proposed part 450. The main requirements would be found in Sec. Sec.
450.155, 450.159, and 450.165. Section 450.155 would require an
operator to document and implement procedures to assess readiness to
proceed with the flight of a launch or reentry vehicle. Proposed Sec.
450.159 would require an operator to implement preflight procedures to
verify that each flight-commit criterion has been met before initiating
flight.
    Proposed Sec.  450.165 would mandate that an operator's flight
safety rules include flight-commit criteria identifying each condition
necessary prior to initiating flight to satisfy proposed Sec.  450.101.
These commit criteria would include surveillance, monitoring of
meteorological conditions, implementing window closures for the purpose
of collision avoidance, monitoring the status of any flight safety
system, and any other hazard controls derived from system safety,
software safety, or flight safety analyses. Also, for any reentry
vehicle, the commit criteria would include monitoring the status of
safety-critical systems before enabling reentry flight.
    Part 450 also includes requirements to develop flight-commit
criteria based on the results of various analysis. For instance, Sec.
450.135 (Debris Risk Analysis) would require operators to demonstrate
compliance with public safety criteria in proposed Sec.  450.101. In
Sec.  450.137, the far-field overpressure blast effect analysis would
have to demonstrate compliance with public safety criteria in proposed
Sec.  450.101. Sections 450.139 (Toxic Hazards for Flight) and 450.187
(Toxic Hazards Mitigation for Ground Operations) would require an
operator to derive flight-commit criteria based on the results of its
toxic release hazard analysis, containment analysis, or toxic risk
assessment to ensure any necessary evacuation of the public from any
toxic hazard area prior to flight. Proposed Sec.  450.141 (Wind
Weighting for the Flight of an Unguided Suborbital Launch Vehicle)
would require an operator to establish flight-commit criteria that
control the risk to the public from potential adverse effects from
normal and malfunctioning flight. Proposed Sec.  450.161 would require
an applicant to describe how it will provide for day-of-flight
surveillance of flight hazard areas, if necessary, to ensure that the
presence of any member of the public in or near a flight hazard area is
consistent with flight-commit criteria. Section 450.163 would require
an operator to derive flight-commit criteria that mitigate the
potential for a launch or reentry vehicle intercepting or initiating a
lightning strike, or encountering a nearby discharge. Finally, Sec.
450.169 (Launch and Reentry Collision Avoidance Analysis) would require
an operator use the results of the collision avoidance analysis to
develop flight-commit criteria for collision avoidance.
ii. Flight Abort Rules
    The FAA proposes to include flight abort rules as part of proposed
flight safety rules in Sec.  450.165. Flight abort rules apply to a
vehicle that uses an FSS and are the conditions under which an FSS must
abort the flight to ensure compliance with flight safety criteria.
Current regulations in parts 417 and 431 address flight abort rules.
    Section 417.113(d) sets flight termination rules for ELVs. It
requires operators to identify the conditions under which the FSS,
including the functions of the flight safety system crew, must
terminate flight to ensure public safety. The flight termination rules
must implement the FSA, and specifically requires operators to
terminate flight in the following six scenarios:
    1. When real-time data indicate a flight safety limit has been
reached.
    2. At the straight-up time if the vehicle flies straight up.
    3. If the vehicle becomes erratic and may endanger protected areas,
while potentially losing control of the flight safety system.
    4. No later than at the expiration of the data loss flight time if
tracking data is lost.
    5. If a vehicle is performing erratically prior to entering an
overflight gate, or if the vehicle is not flying parallel to or
converging to the nominal trajectory prior to entering a gate.
    6. If a vehicle is performing erratically prior to entering a hold
gate, or if the vehicle is not flying parallel to or converging to the
nominal trajectory prior to entering a hold gate.
    Some of these current requirements may be overly prescriptive. For
example, flight abort at the straight-up time is only one method of
mitigating risk to the launch area in the event of a vehicle that fails
to program and flies straight up. Although other methods may mitigate
risk to an acceptable level, under the current requirements, an