otherwise agreed to by the Administrator based on demonstrated
reliability. Instead, Sec.  450.113(b) in the final rule addresses how
an operator demonstrates reliability, as discussed.
n. Flight Safety Analysis Methods (Sec.  450.115)
    In the NPRM, proposed Sec.  450.115 outlined the methods for
conducting FSA. The FAA did not receive comments on this proposal
unique to this section.
    In the final rule, the FAA adopts Sec.  450.115 as proposed with
one change. The term ``vehicle response mode'' is changed to ``failure
mode'' to be consistent with the changes to this term made elsewhere in
the final rule. Consistent with the NPRM, Sec.  450.115(c)(4) requires
that an FSA methodology must identify the evidence for validation and
verification required by Sec.  450.101(g), which addresses the required
accuracy and validity of data and scientific principles. For example,
the ``accounting for all known sources of uncertainty'' requirement
specified in Sec.  450.115(b)(1) must produce results consistent with
or more conservative than the results available from previous mishaps,
tests, or other valid benchmarks, such as higher-fidelity methods.
o. Trajectory Analysis for Normal Flight (Sec.  450.117)
    In the NPRM, proposed Sec.  450.117 (Trajectory Analysis for Normal
Flight) set requirements for an FSA for normal trajectories. The
proposed provision was meant to distinguish between variability in the
intended trajectory and uncertainties due to random sources of
dispersion such as winds and vehicle performance. The FAA explained
that all FSAs depend on some form of analysis of the trajectory under
normal conditions, otherwise known as a normal trajectory. That is, a
vehicle's trajectory when it performs as intended and under normal
conditions must be understood to determine the effects of malfunctions
along its flight path.
    Proposed Sec.  450.117(a)(1) required an FSA to include a
trajectory analysis that established, for any phase of flight within
the scope of proposed Sec.  450.113(a), the limits of a launch or
reentry vehicle's normal flight as defined by the nominal trajectory,
and sets of trajectories sufficient to characterize variability and
uncertainty during normal flight. First, proposed Sec.
450.117(a)(1)(i) required a set of trajectories to characterize
vulnerability. This set would be required to describe how the intended
trajectory could vary due to the conditions known prior to initiation
of flight. Second, proposed Sec.  450.117(a)(1)(ii) required a set of
trajectories to characterize uncertainty. This set would be required to
describe how the actual trajectory could differ from the intended
trajectory due to random uncertainties. The FAA also proposed to
require an FSA to include a trajectory analysis establishing a fuel
exhaustion trajectory in proposed Sec.  450.117(a)(2) and, for vehicles
with an

FSS, trajectory data or parameters that describe the limits of a useful
mission in proposed Sec.  450.117(a)(3).
    In the final rule, the FAA adopts proposed Sec.  450.117 with
revisions. The FAA makes clarifying changes for a number of
requirements regarding trajectory analysis; removes and relocates the
fuel exhaustion trajectory requirement to Sec.  450.119; and removes
and relocates references to ``limits of a useful mission'' to Sec.
450.119. The FAA also makes changes to remove prescriptiveness in favor
of more performance-based language.
    Boeing, Lockheed Martin, Northrop Grumman, Sierra Nevada, and ULA
recommended changing the term ``normal'' flight to ``nominal'' flight
in numerous parts of proposed Sec.  450.117. The FAA does not agree
with this recommendation because both of these terms are defined by the
FAA and are distinct. Section 401.7 defines ``nominal'' to mean, in
reference to launch vehicle performance, trajectory, or stage impact
point, a launch vehicle flight for which all vehicle aerodynamic
parameters are as expected, all vehicle internal and external systems
perform as planned, and there are no external perturbing influences
other than atmospheric drag and gravity. Section 401.7 defines ``normal
flight'' to mean the flight of a properly performing vehicle whose
real-time vacuum IIP does not deviate from the nominal vacuum
instantaneous impact point by more than the sum of the wind effects and
the three-sigma guidance and performance deviations in the uprange,
downrange, left-crossrange, or right-crossrange directions. Thus, in
simple terms, a nominal trajectory is a single trajectory that the
vehicle would fly in the absence of wind effects and guidance and
performance variability. Section 401.7 defines ``normal trajectory'' to
mean ``a trajectory that describes normal flight.'' The FAA retains the
definitions of these terms. It is virtually impossible for flights to
be nominal such that all aerodynamic parameters and systems are as
expected without the influence of any uncertainties. To replace
``normal'' with ``nominal'' would substantively change the meaning of
the rule, as uncertainty does not apply to a nominal trajectory.
Requiring normal flight trajectories is a more permissive range of
trajectories than nominal flight and allows the rule to be performance
based within safe parameters. The FAA retains the use of the terms as
proposed.
    In the final rule, the FAA narrows the scope of the set of
trajectories to characterize uncertainty due to random uncertainties
``in all parameters with a significant influence on the vehicle's
behavior through normal flight'' in Sec.  450.117(a)(2). Generally, the
FAA considers ``a significant influence'' to include any parametric
uncertainties within three-sigma that affect the crossrange IIP
location or downrange IIP rate by at least one percent because the IIP
location and rate is often a convenient surrogate for the potential
impact locations of hazardous debris. One percent is a typical
threshold value used in RCC 321-20 Standard and Supplement. Thus, the
final rule does not intend for applicants to characterize the influence
of all random uncertainties or variability, but only those with a
significant influence on the potential impact locations for hazardous
debris.
    The FAA removes the NPRM requirements for a fuel exhaustion
trajectory in proposed Sec.  450.117(a)(2) and its associated
application requirement in proposed Sec.  450.117(d)(3)(ii). The
requirements for this analysis are more appropriately located in the
malfunction flight section because a fuel exhaustion trajectory is a
malfunction trajectory that results when thrust termination does not
occur as planned. A fuel exhaustion trajectory is not always required;
however, such an analysis could be necessary for certain operations.
For example, a fuel exhaustion trajectory will be necessary under the
final rule Sec.  450.119(a)(2) for a return to launch site scenario. As
a result of this removal, the FAA combines proposed Sec.  450.117
paragraph (a) with paragraph (a)(1) as a new paragraph (a), and re-
designates proposed Sec.  450.117(a)(1)(i) and (a)(1)(ii) as Sec.
450.117(a)(1) and (a)(2), respectively.
    The NPRM referenced the limits of a useful mission in proposed
Sec.  450.117(a)(3). In the final rule, the FAA moves all references to
the limits of a useful mission from Sec.  450.117, including proposed
Sec.  450.117(a)(3), to Sec.  450.119 (Trajectory Analysis for
Malfunction Flight). The FAA finds that the requirements associated
with the limits of a useful mission belong in the malfunction flight
section because limits of a useful mission can exceed the bounds of
normal flight.
    The FAA received several comments on the proposed use of the term
``limits of a useful mission.'' A summary of the comments and FAA's
responses can be found in the preamble section on Trajectory Analysis
for Malfunction Flight.
    The FAA adopts Sec.  450.117(b) as proposed. A final trajectory
analysis must use a six-degree of freedom trajectory model to satisfy
the requirements of Sec.  450.117(a). The FAA did not receive comments
on this proposal.
    Proposed Sec.  450.117(c) would have required a trajectory analysis
to account for all wind effects including profiles of winds that are
not less severe than the worst wind conditions under which flight might
be attempted and for uncertainty of the wind conditions. In the final
rule, the FAA revises the requirement to state that a trajectory
analysis must account for ``atmospheric conditions that have an effect
on the trajectory'' rather than ``all wind effects.'' The FAA notes
that the revision captures the intent of (1) the proposed requirement
to account specifically for wind effects under all foreseeable
conditions within the flight commit criteria and consistent with the
flight abort rules, and (2) the proposed requirement in Sec.
450.117(a) to establish sets of trajectories sufficient to characterize
variability and uncertainty during normal flight.
    The FAA recognizes that wind is the primary atmospheric
consideration for most vehicles, but, for some (non-traditional)
vehicles, other atmospheric parameters such as density, humidity, or
temperature may affect trajectory and be part of the flight commit
criteria. Although these other conditions would have necessarily been
accounted for in the trajectory analysis for normal flight as
``uncertainties'' in the introductory language to Sec.  450.117(a), the
final rule expressly refers to all atmospheric conditions in Sec.
450.117(c). The FAA also notes that flight in the context of this
section refers to the period of launch or reentry within the scope of
Sec.  450.113.
    Boeing commented that it is impossible to account for all wind
effects, as wind models were local and limited in altitude. Boeing
recommended incorporating an altitude limit of 60,000 feet, and
modifying the requirement to state, ``a trajectory analysis must
account for launch and, if different, reentry site wind effects, as
applicable, including profiles of winds that are no less severe than
the worst wind conditions under which flight might be attempted, and
for uncertainty in the wind conditions.''
    The FAA notes that the proposed requirement concerning wind
effects, revised to ``atmospheric effects'' in the final rule,
specifies profiles under which flight may be attempted based on the
launch commit criteria and flight abort rules. The NPRM and the final
rule set performance level requirements that avoid placing an arbitrary
altitude limit that may not encompass all the conditions that may have
an effect on a

normal trajectory. Accordingly, the final rule requires a trajectory
analysis to account not for all wind effects, but instead for
atmospheric conditions that have an effect on the trajectory, including
any uncertainty. Accounting for atmospheric effects on the trajectory
will be addressed in guidance.
    Blue Origin stated the requirements in proposed Sec.  450.117(b)
through (d)(2) amount to translating complex vehicle trajectory models
into verbiage for delivery to FAA for licensing. Blue Origin proposed
revising the language to specify vehicle state vector parameters in
terms of position, attitude, velocity, thrust, and mass. In terms of a
statistical distribution of each parameter, Blue Origin recommends
providing a covariance matrix describing vehicle guidance and
performance uncertainty as meeting the intent of the requirement.
    The FAA notes Blue Origin's recommendation to specify the vehicle's
position and velocity during normal flight using covariance matrices
would satisfy the requirement in Sec.  450.117(a)(2) because that
approach was identified in Appendix A to part 417 under
A417.7(g)(7)(xiii). The approach in Appendix A to part 417 under
A417.7(g)(7)(xiii) meets the requirement in Sec.  450.117(a)(2) because
a set of covariance matrices for the vehicle position coordinates and
velocity component magnitudes are an acceptable means to describe how
the actual trajectory could differ from the intended trajectory due to
random uncertainties in all parameters with a significant influence on
the vehicle's behavior throughout normal flight. However, the FAA
recognizes that other approaches, including a sufficiently large \108\
set of Monte Carlo sample trajectories,\109\ may also satisfy the
requirement. The FAA does not intend to prescribe a specific method to
characterize normal flight. Therefore, the FAA declines Blue Origin's
recommendation to revise the requirement to specify vehicle state
vector and covariance parameters. Instead, the final rule implements
performance-based trajectory analysis requirements as proposed, such
that an applicant must submit a description of the methods and input
data used to characterize the vehicle's flight behavior throughout
normal flight.
---------------------------------------------------------------------------

    \108\ The FAA will determine what constitutes a sufficiently
large set of Monte Carlo trajectories pursuant to the level fidelity
of analysis requirements in Sec.  450.115(b).
    \109\ Monte Carlo methods include computational algorithms that,
for example, repeatedly sample from probability distributions that
characterize input parameters (such as the weight, thrust, and drag
of a vehicle) and perform physics-based (such as Newton's laws)
simulations to obtain numerical results (such as a set of
trajectories that characterize flight under normal or malfunction
conditions).
---------------------------------------------------------------------------

    The FAA proposed application requirements for trajectory analysis
for normal flight in Sec.  450.117(d). In the final rule, the FAA
adopts proposed Sec.  450.117(d) with revisions. Specifically, the FAA
removes the proposed requirement to describe the methodology used to
determine the limits of a useful mission in Sec.  450.117(d)(1).
Instead, an equivalent requirement appears in Sec.  450.119(c)(2) of
the final rule. The FAA also removes the items proposed in Sec.
450.117(d)(1)(i) through (d)(1)(iv) because they were redundant with
the performance-based requirements that apply to all FSA in accordance
with Sec.  450.115(c).\110\ The FAA removes the prescriptive
requirements in Sec.  450.117(d)(2)(ii) through (d)(2)(iv) proposed in
the NPRM because these requirements are captured with the final rule
requirement in Sec.  450.117(d)(2), as explained later in this preamble
section. In addition, the FAA re-designates proposed Sec.
450.117(d)(2)(i) as (d)(3), and 450.117(d)(3) as (d)(4) with a minor
revision. The FAA removed proposed Sec.  450.117(d)(4), which required
an applicant to submit additional products that allow an independent
analysis, as requested by the Administrator, because the requirement
was redundant with Sec.  450.45(e)(7)(ii).
---------------------------------------------------------------------------

    \110\ Section 450.115(c) requires an applicant to submit a
description of the FSA methodology, including identification of: (1)
The scientific principles and statistical methods used; (2) all
assumptions and their justifications; (3) the rationale for the
level of fidelity; (4) the evidence for validation and verification
required by Sec.  450.101(g); (5) the extent that the benchmark
conditions are comparable to the foreseeable conditions of the
intended operations; and (6) the extent that risk mitigations were
accounted for in the analyses.
---------------------------------------------------------------------------

    In the NPRM, proposed Sec.  450.117(d)(2) required an applicant to
submit a description of the input data used to characterize the
vehicle's flight behavior throughout normal flight and limits of a
useful mission. The proposal would have required a description of the
wind input data, including uncertainties (Sec.  450.117(d)(2)(ii)); a
description of the parameters with a significant influence on the
vehicle's behavior throughout normal flight, including a quantitative
description of the nominal value for each significant parameter
throughout normal flight (Sec.  450.117(d)(2)(iii)); and a description
of the random uncertainties with a significant influence on the
vehicle's behavior throughout normal flight, including a quantitative
description of the statistical distribution for each significant
parameter (Sec.  450.117(d)(2)(iv)).
    Commenters asserted these proposed requirements were too
prescriptive, and the FAA agrees. The FAA revises Sec.  450.117(d)(2)
to require an applicant to submit the quantitative input data,
including uncertainties, used to model the vehicle's normal flight in
six degrees of freedom. This revision in the final rule captures the
parameters of the proposed requirements in Sec.  450.117(d)(2)(ii)
through (d)(2)(iv), while allowing for more flexibility in the
application of the regulatory requirements. Quantitative input data
used to model the vehicle's normal flight in six degrees of freedom
includes comprehensive sets of aerodynamic and mass properties.
Explanation and details on how to comply with these requirements will
be included in Advisory Circular 450.117-1, ``Trajectory Analysis.''
    The FAA retains the requirement proposed in Sec.  450.117(d)(2)(i)
and re-designates it as Sec.  450.117(d)(3) in the final rule. In
addition, the FAA changes the term ``wind effects'' to ``atmospheric
effects'' to be consistent with Sec.  450.117(c) of the final rule.
    The FAA revises proposed Sec.  450.117(d)(3) as discussed in this
paragraph and re-designates it as Sec.  450.117(d)(4) in the final
rule. The proposal required an applicant to submit representative
normal flight trajectory analysis outputs, including the position,
velocity, and vacuum IIP, for each second of flight. Blue Origin
commented that this requirement created an unnecessary burden to
calculate vacuum IIP for potentially hundreds or thousands of normal
and malfunction vehicle trajectories. Blue Origin stated that vacuum
IIP was not representative of where vehicle hazards may impact the
Earth and believed this requirement should only apply to the nominal
trajectory.
    The FAA disagrees that the IIP application requirement would have
created an unnecessary burden; however, the final rule removes the
application requirement because vacuum IIP can be readily computed if
necessary from the position and velocity vectors, which are a part of
the application materials. In the final rule, Sec.  450.117(d)(4)
specifies that the representative normal flight trajectory analysis
outputs include orientation of the vehicle in addition to the position
and velocity data specified in the proposal. The FAA notes that
orientation is inherent in any six-degree of freedom trajectory model,
as required by both the proposed and final Sec.  450.117(b).
Orientation is important to

public safety when the induced velocities have a preferred direction.
    The FAA also removes the requirement proposed in Sec.
450.117(d)(3)(ii) that applies to fuel exhaustion trajectory under
otherwise nominal conditions, because a fuel exhaustion trajectory is
merely one specific type of malfunction trajectory and is not
necessarily required for all applicants. For example, a fuel exhaustion
trajectory would be necessary under the final rule for a return to
launch site scenario but not for a typical unguided suborbital rocket.
The requirement in Sec.  450.119(a)(2) of the final rule is used to
determine whether an applicant must include a fuel exhaustion
trajectory.
p. Trajectory Analysis for Malfunction Flight (Sec.  450.119)
    In the NPRM, the FAA proposed requirements associated with
trajectory analysis for malfunction flight in Sec.  450.119. As stated
in the NPRM, a malfunction trajectory analysis is necessary to
determine how far a vehicle can deviate from normal flight. This
analysis helps determine potential impact points in the case of a
malfunction and is therefore a vital input for the analyses needed to
demonstrate compliance with risk criteria.
    In the final rule, the FAA adopts proposed Sec.  450.119 with
revisions. The FAA removes, as unnecessary, proposed Sec.
450.119(a)(1), which required that an FSA include a trajectory analysis
that establishes the vehicle's capability to depart from normal flight,
formally defined in terms of IIP in Sec.  401.7. Proposed Sec.
450.119(a)(2) is re-designated (a)(1) and requires that a trajectory
analysis establish the vehicle's deviation capability in the event of a
malfunction during flight. The FAA adds a new requirement, designated
as Sec.  450.119(a)(2), which requires that an FSA must include a
trajectory analysis that establishes the trajectory dispersion
resulting from reasonably foreseeable malfunctions. This language
retains the concept of proposed Sec.  450.119(a)(1), but revises the
regulatory language to allow for a medium-fidelity FSA approach (e.g.,
corridor method) for which the vehicle vacuum IIP during a malfunction
is not specified, as explained in the FAA's Flight Safety Analysis
Handbook.\111\ More specifically, the proposed requirement in Sec.
450.119(a)(1) to establish the vehicle's capability to depart from
normal flight would have required the analysis to account for the IIP
in modeling of a malfunction trajectory because normal flight is
defined in terms of IIP. Thus, the proposed requirement in Sec.
450.119(a)(1) would have foreclosed a valid medium-fidelity FSA
approach. In the final rule, Sec.  450.119(a)(1) and Sec.
450.119(a)(2) provide flexibility and permit at least one approach that
allows a simpler computation of risk but still preserves safety. Not
all operations are eligible for this corridor method, but it is valid
when the vehicle debris risks are due to flight phases where the IIP is
moving steadily downrange, and when the failure modes do not involve
distorted impact distributions.\112\ In the final rule, the FAA amended
the requirement to allow this and other simplified methods for those
operations for which they may be valid.
---------------------------------------------------------------------------

    \111\ See Flight Safety Analysis Handbook, V1.0, August 2009
(available at https://www.faa.gov/about/office_org/headquarters_offices/ast/media/Flight_Safety_Analysis_Handbook_final_9_2011v1.pdf).
    \112\ Distorted impact distributions are often caused by actions
taken in response to abort criteria.
---------------------------------------------------------------------------

    The FAA adds Sec.  450.119(a)(3) in the final rule. Section
450.119(a)(3) states that an FSA must include a trajectory analysis
that establishes, for vehicles using flight abort as a hazard control
strategy under Sec.  450.108, trajectory data or parameters that
describe the limits of a useful mission. This requirement was found in
Sec.  450.117(a)(3) of the NPRM. The FAA finds that trajectory analysis
requirements associated with the limits of a useful mission belong in
the malfunction flight section because presumably normal flight can
attain the one or more objectives within the flight azimuth limits.
    The requirement in Sec.  450.119(a)(3) is related to the
requirement proposed in Sec.  450.119(a)(1) because trajectories that
are outside of the normal envelope can still be ``useful,'' even though
they involve a malfunction.\113\ The FAA notes that an operator can
elect to designate the normal mission trajectories as the limits of a
useful mission and meet the application requirement to submit data that
describes the limits of a useful mission, but this may result in the
termination of a flight that could still achieve a mission objective.
---------------------------------------------------------------------------

    \113\ Publicly available information indicates that the flight
of the Ariane 5 VA241 that occurred from the Guiana Space Centre on
January 25, 2018 may be a potential empirical example. There the
flight path anomaly was evident from the beginning of flight and the
payloads were deployed into an orbital inclination that was
approximately 18 degrees from the intended orbit, yet the payloads
were still able to deliver useful data.
---------------------------------------------------------------------------

    The FAA received several comments on the NPRM's proposal to use the
``limits of a useful mission'' to inform the development of flight
safety limits and when flight abort was necessary, and to establish the
width of a gate. Microcosm requested that the FAA define ``a useful
mission.'' Boeing, Lockheed Martin, Northrop Grumman, and ULA
recommended changing the definition of ``limits of a useful mission''
to mean the trajectory or other parameters that bound performance of a
mission that can attain its primary objective. Blue Origin disagreed
with the addition of ``limits of a useful mission'' to the regulation
and stated that regulating what is considered a useful mission was
outside of the FAA's jurisdiction.
    In the final rule, the FAA adopts a new definition of a ``useful
mission'' in Sec.  401.7 and amends the proposed definition of ``limits
of a useful mission'' to mean the trajectory data or other parameters
that bound the performance of a useful mission, including flight
azimuth limits. A ``useful mission'' means a mission that can attain
one or more objectives and is based on the definition of ``limits of a
useful mission'' proposed in the NPRM. The definition of ``limits of a
useful mission'' adopted in the final rule removes the language
``describe the limits of a mission that can attain the primary
objective'' and replaces it with ``bound the performance of a useful
mission,'' consistent with the commenters' recommendation. In this
context, bounding the performance will include flight azimuth limits
and could include limits on the altitude versus distance downrange or
other physics-based limits depending on the nature of the operation.
The FAA makes these changes because it recognizes that pursuit of
objectives other than the primary objective may be considered a useful
mission. However, when all other objectives can no longer be achieved
the FAA does not consider the collection of data related to a failure
in and of itself to be a useful mission. This is because mere failure
data collection alone does not justify continued risk to the public.
Therefore, the final rule states in Sec.  450.119(a)(3) that the FAA
does not consider the collection of data related to a failure to be a
useful mission.
    The FAA finds the requirements associated with ``useful mission''
and ``limits of a useful mission'' are central to the hazard control
strategies. The FAA is not attempting to regulate what the operator or
its customer considers a useful mission. The FAA instead is simply
requiring that the applicant identify which missions are useful so that
vehicles that fly outside of these parameters erroneously are not
permitted to threaten the public. The FAA finds it necessary to include
a

requirement that would prevent a launch or reentry vehicle from
continued flight that would increase risk to the public if that vehicle
can no longer achieve an objective of the operator, outside of the
collection of data related to a failure.
    Blue Origin recommended replacing ``limits of a useful mission''
with ``limits to meet public risk criteria.'' The FAA does not agree
with this recommendation. As described in the section on
CEC, public risk criteria alone are inadequate to establish
the need for an FSS, the reliability of the FSS, or the timing of an
FSS activation to ensure public safety. Similarly, while some might
consider risk-based flight safety limits as a reasonable approach to
risk management when a vehicle is on a potentially useful mission, once
a malfunction results in a mission that can no longer achieve an
objective, then hazard containment should be the goal and flight abort
must be used to protect the public against high consequence events.
Application of the limits of a useful mission benefits the operator
because flights with trajectories that are outside of the normal
envelope, but still useful according to the operator, will be permitted
to continue without flight abort as long as they comply with Sec.
450.108(d)(7), including trajectories that overfly the public. This was
the intent of proposed Sec.  450.123(b)(6) in the NPRM, and remains the
intent of Sec.  450.108(d)(7) in the final rule.
    Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that
limits of a useful mission were already addressed in flight termination
triggers, and that proposed Sec.  450.117(a)(3) requiring trajectory
data or parameters that describe the limits of a useful mission should
be replaced with limits that trigger flight termination.
    The FAA declines to adopt this recommendation because of the
relationship between the limits of a useful mission and flight safety
limits. Pursuant to Sec.  450.108(c)(2) in the final rule (similar to
proposed Sec.  450.123(a)(2) of the NPRM), flight safety limits define
when an operator must initiate flight abort to prevent continued flight
from increasing public risk in uncontrolled areas if the vehicle is
unable to achieve a useful mission. Under the final rule, flight safety
limits will be developed after the limits of a useful mission are
identified. An operator can elect to designate the normal mission
trajectories as the limits of a useful mission and meet the application
requirement to submit data describing the limits of a useful mission,
but this may result in the termination of a flight that could still
achieve a mission objective. As an example, during an operation for
which a gate width was determined using only a vehicle's normal
trajectory envelope, a failure before the gate resulted in the flight
nearly being terminated at the gate, even though it went on to achieve
the mission's primary objective. In that instance, if the limits of a
useful mission data included flight azimuth limits, this vehicle would
have had more margin in the form of a wider gate. Under the final rule,
if an operator decides that placing a payload in any orbit or
withholding abort for crewed flights is more useful than terminating a
flight, it may declare that flight is useful at any azimuth or altitude
and may fly the vehicle on any trajectory that meets Sec.
450.108(d)(7). However, flight safety limits that terminate flights
that are no longer useful should be placed so that they do not increase
risk compared to continued flight, pursuant to Sec.  450.108(d)(6).
    The FAA found it necessary to move all references to the limits of
a useful mission from Sec.  450.117 to Sec.  450.119 (Trajectory
Analysis for Malfunction Flight), including proposed Sec.
450.117(a)(3). The FAA finds that the requirements associated with the
limits of a useful mission belong in the malfunction flight section
because limits of a useful mission can exceed the bounds of normal
flight.
    In the NPRM, the FAA proposed in Sec.  450.119(b) that a
malfunction trajectory analysis must account for each cause of a
malfunction flight, including software and hardware failures. For each
cause of a malfunction trajectory, the analysis would have been
required to characterize the foreseeable trajectories resulting from a
malfunction. The proposal included six items in Sec.  450.119(b)(1)
through (b)(6) that would be required to be included in the analysis.
    In the final rule, the FAA adopts proposed Sec.  450.119(b) with
revisions. The FAA removes proposed Sec.  450.119(b)(1) through (b)(3)
because they are no longer needed due to the adoption of performance-
based standards and re-designates proposed Sec.  450.119(b)(4) through
(b)(6) as (b)(1) through (b)(3). Also, the FAA revises the introductory
language in Sec.  450.119(b) to improve clarity and remove prescriptive
language.
    Blue Origin commented that it was not feasible to model a
malfunction turn trajectory for each software or hardware cause, only
for vehicle responses to the cause as proposed in Sec.  450.119(b).
Blue Origin recommended striking the phrase, ``for each cause of a
malfunction trajectory,'' and instead indicate that a malfunction
trajectory analysis must characterize the foreseeable trajectories
resulting from a malfunction.
    The FAA partially agrees with Blue Origin's recommendations. The
FAA deletes the proposed language in Sec.  450.119(b), ``for each cause
of a malfunction trajectory, the analysis must characterize the
foreseeable trajectories resulting from a malfunction,'' but retains
the phrase ``for each cause of a malfunction flight'' in the first
sentence of Sec.  450.119(b). The FAA notes the analysis must account
for the probability of each set of trajectories that characterize a
type of malfunction flight, and that probability must account for each
cause of a malfunction flight, including software and hardware
failures, for every period of normal flight.
    The FAA notes that use of the phrase ``for each type of
malfunction'' in Sec.  450.119(b) of the final rule addresses Blue
Origin's comment that it is not feasible to model a malfunction turn
trajectory for each cause, but only for vehicle responses to the cause.
The term ``each type of malfunction'' refers to the vehicle response to
the cause and multiple causes could result in a similar vehicle
response. For example, under part 417 a malfunction turn analysis would
account for a series of ``tumble turns,'' as enumerated in Appendix A
to part 417 under A417.9(d)(5), which result in the launch vehicle
rotating due to a constant thrust vector offset angle. The FAA
recognizes that there could be multiple causes for a constant thrust
vector offset, such as a jammed mechanism, loss of electrical power, or
loss of hydraulic fluid pressure. Thus, the probability of a tumble
turn must account for ``each cause of a malfunction flight, including
software and hardware failures,'' in accordance with Sec.  450.119(b).
Furthermore, the FAA recognizes that multiple sets of trajectories are
necessary to characterize the vehicle behavior in response to a
malfunction. An example is a malfunction that results in a constant
thrust vector offset, because a range of thrust vector offsets is
reasonably foreseeable (from very small angles that would cause a slow
departure from normal flight up to the maximum feasible thrust offset
that would typically result in a rapid tumble of the vehicle). Thus,
there is a natural question regarding the appropriate resolution of the
malfunction trajectory analysis. The intent of the requirements in
Sec.  450.119 is to produce sets of trajectories that are sufficient to
characterize the public risks posed by each type of malfunction. Thus,
the final rule sets a performance standard in Sec.  450.119(b) that the
analysis for each

type of malfunction must have sufficient temporal and spatial
resolution to establish flight safety limits, if any, and individual
risk contours that are smooth and continuous.
    In order to be less prescriptive, the FAA further amends Sec.
450.119(b) in response to Blue Origin's comment. The NPRM proposed in
Sec.  450.119(b)(1) through (b)(3) that the malfunction trajectory
analysis must account for (1) all trajectory times during the thrusting
phases, or when the lift vector is controlled, during flight; (2) the
duration, starting when a malfunction begins to cause each flight
deviation throughout the thrusting phases of flight; and (3) trajectory
time intervals between malfunction turn start times that are sufficient
to establish flight safety limits, if any, and individual risk contours
that are smooth and continuous. The FAA removes proposed Sec.
450.119(b)(1) through (b)(3) and consolidates these requirements into
Sec.  450.119(b). This revision sets more performance-based
requirements for the scope and resolution of the malfunction trajectory
analysis to create flexibility in demonstrating the trajectory
dispersion resulting from reasonably foreseeable malfunctions. In the
final rule, Sec.  450.119(b) will require the analysis for each type of
malfunction to have sufficient temporal and spatial resolution to
establish flight safety limits, if any, and individual risk contours
that are smooth and continuous.
    In the NPRM, proposed Sec.  450.119(b)(2) required that a
malfunction trajectory analysis account for the duration, starting when
a malfunction begins to cause each flight deviation throughout the
thrusting phases of flight. Virgin Galactic commented that a
malfunction turn analysis would not apply to operations for which a
pilot is in control of a winged vehicle because the pilots act as an
FSS.
    The FAA is aware that having pilots onboard and in control of a
vehicle during flight may mitigate the need for certain malfunction
analyses; however, there may still be instances when pilots may become
incapacitated during flight. In any such instances, a trajectory
analysis for malfunction flight would still potentially be necessary to
identify impact points as an essential input for risk analyses to
demonstrate compliance with risk criteria in Sec.  450.101. The FAA
notes that flight simulators can facilitate the development of
representative malfunction trajectory analysis outputs in cases in
which pilot responses have a significant influence on the trajectory
dispersion resulting from reasonably foreseeable malfunctions.
    Virgin Galactic also recommended a wording change to Sec.
450.119(b)(2) to define the duration as, ``starting when a malfunction
begins . . . until such time the effects of the malfunction are
mitigated.'' As previously discussed, the FAA does not adopt proposed
Sec.  450.119(b)(2) in the final rule. However, the FAA notes in the
final rule, the combination of the requirement for sufficient temporal
resolution to establish smooth and continuous individual risk contours,
along with the requirement to account for the timing of each
malfunction trajectory's termination due to means other than flight
abort, including vehicle breakup, ground impact, or orbital insertion,
provide a sufficient performance-based specification to establish the
duration of the malfunction trajectory analysis. In addition, the FAA
finds that the commenter's suggestion that the duration of the analysis
continue only ``until such time the effects of the malfunction are
mitigated'' would not analyze both the success and the failure of the
mitigation necessary to quantify the risk and consequence in the event
that the FSS fails.
    As a result of removing proposed Sec.  450.119(b)(1) through
(b)(3), the FAA re-designates proposed Sec.  450.119(b)(4) as Sec.
450.119(b)(1) in the final rule. Proposed Sec.  450.119(b)(4) required
that a trajectory analysis for malfunction flight account for the
relative probability of occurrence of each malfunction turn for which
the vehicle is capable. In the final rule, the FAA revises Sec.
450.119(b)(1) to reflect that the analysis must account for the
relative probability of occurrence of each malfunction, and not
specifically a malfunction turn. The FAA views the term ``malfunction
turn'' as outdated. The requirement in the final rule is consistent
with the proposal.
    The FAA re-designates proposed Sec.  450.119(b)(5) as Sec.
450.119(b)(2) in the final rule. The FAA also revises Sec.
450.119(b)(2) to correct an omission of the word ``trajectory.''
Furthermore, the FAA adds ground impact and orbital insertion as
potential termination states. The FAA found the exclusion of these
states in the NPRM to be a deficiency that would have resulted in an
operator's inability to meet regulatory requirements for quantifying
the risk because malfunctions can result in trajectories that result in
ground impact or orbital insertion, as well as vehicle break-up, and
those additional outcomes can pose significant public risks as well.
    The FAA re-designates proposed Sec.  450.119(b)(6) as Sec.
450.119(b)(3) in the final rule and revises the requirements. Section
450.119(b)(3) requires that a malfunction trajectory analysis account
for the parameters with a significant influence on a vehicle's flight
behavior from the time when a malfunction begins to cause a flight
deviation until each malfunction trajectory will terminate due to
vehicle breakup, ground impact, or orbital insertion. The FAA adds the
phrase ``parameters with a significant influence on vehicle's flight
behavior'' because the analysis must account for these parameters to
characterize sufficiently the vehicle's flight behavior. This language
was proposed in the application requirements in Sec.
450.119(c)(2)(iii) and has been added to paragraph (b)(3) in the final
rule. The FAA received no comments on this language. The FAA also
clarifies that a malfunction trajectory can terminate due to orbital
insertion, not just ground impact or predicted structural failure
(vehicle breakup), as specified in the NPRM, for the same reason that
those outcomes were added to Sec.  450.119(b)(2). Finally, the FAA
replaces the proposed term ``predicted structural failure'' with the
term ``vehicle break-up'' in the final rule. This change is consistent
with the terminology used in Sec.  450.121 (Debris Analysis).
    Blue Origin commented that smooth and continuous contours were not
typically feasible unless flight limits were also included in the
malfunction turn analysis. Blue Origin also recommended adding flight
abort to the list of vehicle end state conditions.
    The FAA did not add flight abort to the list of vehicle end state
conditions based on Blue Origin's comment because of the relationship
between trajectory analysis for malfunction flight and risk analyses
that produce risk contours. Risk analyses must consider outcomes of
flight abort and FSS inaction, whether through failure of the FSS or
because no flight abort rules were violated, which could result in
vehicle breakup, ground impact, or orbital insertion. If the
trajectories for malfunction flight were terminated when flight abort
was predicted, no trajectory data would exist for cases when the FSS
failed. The rule ensures that complete trajectory data exists to
account for flight abort action and inaction in risk analyses. More
specifically, ending the malfunction trajectories at the flight safety
limits conflicts with the requirement in Sec.  450.108(d)(5) to account
for proper functioning of the FSS and failure of the FSS in individual,
collective, and conditional risk evaluations. It was not necessary to
amend the rule according

to Blue Origin's comment because flight abort is already a necessary
end case to be analyzed when producing risk contours in accordance with
Sec.  450.133(e)(2)(iii), which is a separate analysis from producing
trajectories for malfunction flight.
    Section 450.119(b)(4) explicitly requires a malfunction trajectory
analysis to account for potential FSS failure, if an FSS is used,
because that can also influence the termination condition of a
malfunction trajectory. For example, if a malfunction trajectory
triggers a flight abort rule, potential outcomes of the trajectory are
abort (through destruct, thrust termination, or other method) or
continued flight resulting in aerodynamic breakup, intact impact, or
orbital insertion if the FSS fails. The requirement in Sec.
450.119(b)(4) is consistent with the proposal because both the proposed
and final Sec.  450.115(a) explicitly require that an operator's FSA
method must account for all failures of safety-critical systems during
nominal and non-nominal launch or reentry that could jeopardize public
health and safety and the safety of property. Furthermore, any FSS
required to comply with Sec.  450.143 or Sec.  450.145 necessarily will
meet the definition of a safety-critical system. Therefore, the
proposed requirement Sec.  450.123(a) would have necessitated that the
malfunction trajectory analysis account for the potential failure of
the FSS.
    In the NPRM, Sec.  450.119(c) addressed the application
requirements associated with trajectory analysis for malfunction
flight. In the final rule, the FAA adopts the application requirements
in proposed Sec.  450.119(c) with revisions. The revisions include
adding a new Sec.  450.119(c)(2), re-designating proposed Sec.
450.119(c)(2) through (c)(4), and removing proposed Sec.
450.119(c)(1)(i) through (c)(1)(iv).
    Proposed Sec.  450.119(c)(1) required an applicant to submit a
description of the methodology used to characterize the vehicle's
flight behavior throughout malfunction flight. In the final rule, the
FAA adopts the proposal and adds a reference to the requirements in
Sec.  450.115(c), which sets the standards for the methodologies used
in the FSA. Also, the FAA removes the items proposed in Sec.
450.119(c)(1)(i) through (c)(1)(iv) because they were redundant with
the performance-based requirements that apply to all FSA in accordance
with Sec.  450.115(c).
    In the final rule, a new Sec.  450.119(c)(2) requires an applicant
to submit a description of the methodology used to determine the limits
of a useful mission, in accordance with Sec.  450.115(c). This
requirement was proposed as Sec.  450.117(d)(1) in the NPRM. Moving
this application requirement to Sec.  450.119 is consistent with the
relocation of its associated analysis requirement to Sec.
450.119(a)(3). The FAA re-designates proposed Sec.  450.119(c)(2) as
Sec.  450.119(c)(3) in the final rule. The FAA captures the
requirements of proposed Sec.  450.119(c)(2)(i) and (c)(2)(ii) and
relocates them in Sec.  450.119(c)(3)(i) and (c)(3)(ii).
    The FAA re-designates proposed Sec.  450.119(c)(2)(iii) as Sec.
450.119(c)(3)(iii) in the final rule and revises the final Sec.
450.119(c)(3)(iii) to specify the need for an applicant to submit a
quantitative description of the parameters, including uncertainties,
with significant influence on the vehicle's malfunction behavior for
each type of malfunction flight characterized. Proposed Sec.
450.119(c)(2)(iii) required an applicant to submit a description of the
input data used to characterize the vehicle's malfunction flight
behavior, including a description of the parameters with a significant
influence on the vehicle's behavior throughout malfunction flight for
each type of malfunction flight characterized. Proposed Sec.
450.119(c)(2)(iii) also required a quantitative description of the
nominal value for each significant parameter throughout normal flight.
The FAA specifically replaces the proposed requirements in Sec.
450.119(c)(2)(iii) and (c)(2)(iv) \114\ with the requirement in Sec.
450.119(c)(3)(iii) in the final rule. This revision retains the intent
of the requirements proposed in the NPRM but is more flexible in its
application because, although it still requires a quantitative
description, the regulation permits something other than the
statistical distribution that would have been required by the proposal.
---------------------------------------------------------------------------

    \114\ Proposed Sec.  450.119(c)(2)(iv) required an applicant to
submit a description of the random uncertainties with a significant
influence on the vehicle's behavior throughout malfunction flight
for each type of malfunction flight characterized, including a
quantitative description of the statistical distribution for each
significant parameter.
---------------------------------------------------------------------------

    The FAA re-designates proposed Sec.  450.119(c)(3) as Sec.
450.119(c)(4) in the final rule. The FAA also removes the need for the
vacuum IIP for each second of flight. The FAA makes this change in
response to Blue Origin's comment on computing vacuum IIP for a large
number of trajectories, as addressed in the preamble section on Sec.
450.117.
    The FAA adopts the requirements in Sec.  450.119(c)(4)(i) as
proposed in Sec.  450.119(c)(3)(i) in the NPRM. The FAA received no
comments on proposed Sec.  450.119(c)(3)(i). The FAA adopts, with
revisions, the requirements in Sec.  450.119(c)(4)(ii) as proposed in
Sec.  450.119(c)(3)(ii) in the NPRM. Proposed Sec.  450.119(c)(3)(ii)
required submission of the probability of each trajectory that
characterizes a type of malfunction flight. Blue Origin commented that
delivering probabilities for each trajectory modelled was not practical
or useful for independent assessment. Instead, Blue Origin proposed
revising the regulatory language to require the applicant to submit the
probability of each set of malfunction trajectories. The FAA agrees
with this comment and revises Sec.  450.119(c)(4)(ii) in the final rule
to reflect Blue Origin's recommendation.
    In the final rule, Sec.  450.119(c)(4)(iii) requires an applicant
to submit a representative malfunction flight trajectory analysis
output, including the position and velocity as a function of flight
time for a set of trajectories that characterize the limits of a useful
mission as described in Sec.  450.119(a)(3) of this section. This
requirement was proposed as Sec.  450.117(d)(3)(v) in the NPRM. As
discussed earlier, the FAA moves the limits of a useful mission
requirement from proposed Sec.  450.117 to Sec.  450.119 in the final
rule.
    Lastly, similar to other sections in this rule, the FAA removes the
requirement for an applicant to provide additional products that allow
an independent analysis, as requested by the Administrator. The FAA
finds the requirement redundant with Sec.  450.45(e)(7)(ii). Blue
Origin and the CSF objected to proposed Sec.  450.119(c)(4). Blue
Origin strongly disagreed that the FAA should be in the business of
recreating analysis completed by operators. It submitted that the FAA
should vet the process used by the operator to conduct the analysis,
along with the products of the analysis, to determine whether approval
was warranted. Blue Origin further stated that such independent
recreation of the analysis could lead to protracted back and forth
between an operator and the FAA that was unnecessary if the FAA had
vetted the process used by the operator to conduct the analysis. Blue
Origin proposed to delete this requirement in order to limit the scope
to what was required to establish confidence in the validity of an
operator's analysis. CSF stated that the FAA's practice of recreating
an applicant's analysis should be ended, as it was expensive and
burdensome. CSF recommended that an AC should guide and inform this
analysis.
    Virgin Galactic noted that numerous regulations under part 450,
including proposed Sec.  450.119(c)(4), call for additional products
that allow an

independent analysis, as requested by the Administrator. Virgin
Galactic stated that ``additional products'' was neither defined nor
constrained, permitting the FAA to request any information from
operators at any time. This would create uncertainty regarding the kind
of products an applicant or operator would need to prepare for the FAA.
Virgin Galactic recommended striking the above references in their
entirety. Virgin Galactic commented that, based on prior experience
under part 431 with the FAA requesting additional information, these
regulations may have a significant time and monetary impact on an
operator, if implemented.
    The FAA does not agree with the commenters' recommendation to
delete this requirement in its entirety from the final rule. The goal
is for the FAA to evaluate, in an efficient and thorough manner, the
validity of an analysis, along with the products of the analysis
submitted by an operator. The FAA finds that at times it may be
necessary to conduct an independent analysis of the process used by the
operator in order to ensure safety. Additional product requests under
part 431 may have been more frequent due to a lack of well-defined
application requirements. However, under part 450, the FAA expects the
application requirements are sufficient and will generally not request
additional products beyond those that are necessary to protect public
safety. Furthermore, as noted in the NPRM, the FAA has evaluated the
validity of an applicant's proposed methods by comparing the results to
valid benchmarks such as data from mishaps, tests, or validated high-
fidelity methods. Once that has occurred, the FAA can issue an
operator's license for a repeatable operation at a specific site for a
specified range of trajectory azimuths.
    Using published benchmarks, the FAA intends to facilitate the
validation and verification of FSA methods to alleviate some of the
needs for the FAA to perform independent analyses. However, the FAA
finds that relying on an approved process alone is insufficient when
certain critical variables may change that affect flight safety or the
MPL determination, or in cases in which the operator proposes launch or
reentry operations that are so unique that relevant benchmarks are
unavailable. Also, the FAA will continue to verify flight operations
for new vehicles, for existing vehicles conducting operations at new
sites, for vehicles flying a trajectory outside the accepted range of
trajectory azimuths, and vehicles that have undergone significant
modifications to vehicle design or flight safety critical systems.
Thus, the FAA foresees continuing to perform independent analyses in
certain circumstances to assure that it has met its statutory
obligation to ensure public health and safety and safety of property.
    Although the FAA declines to remove the ``additional products''
reference in Sec.  450.45(e)(7)(ii) of the final rule, the FAA does not
include the redundant references proposed in other sections.
``Additional products'' refers to data that will allow the FAA to
conduct an independent safety analysis in support of its application
assessment and licensing determination. It would be impractical to list
everything needed for every independent analysis. As explained in the
NPRM, the FAA's decision to conduct an independent analysis is usually
reserved for new vehicle concepts, new analysis methods, or proposals
involving unique public safety cases. In all instances, the request for
information is bounded by the regulatory requirements for obtaining a
license and the FAA's need to ensure compliance with the safety
criteria. The FAA adopts the requirement that an applicant submit
additional products to facilitate an independent analysis, as requested
by the Administrator in Sec.  450.45(e)(7)(ii).
q. Debris Analysis (Sec.  450.121)
    The NPRM proposed in Sec.  450.121 to require a debris analysis
that characterized the debris generated for each foreseeable vehicle
response mode as a function of vehicle flight time, accounting for the
effects of fuel burn and any configuration changes. The proposal
required that the debris analysis account for each foreseeable cause of
vehicle breakup, including any breakup caused by an FSS activation or
by impact of an intact vehicle. As noted in the NPRM, this would
include debris from a vehicle's jettisoned components and payloads
because such debris could cause a casualty due to impact with an
aircraft or waterborne vessel or could pose a toxic or fire
hazard.\115\ Under proposed Sec.  450.121(c), the debris analysis would
include inert, explosive, and other hazardous vehicle debris from both
normal and malfunctioning flight during launch or reentry.
---------------------------------------------------------------------------

    \115\ 84 FR 15383.
---------------------------------------------------------------------------

    In the final rule, the FAA adopts proposed Sec.  450.121 with
revisions. Specifically, the FAA preserves the scope of the debris
analysis from the NPRM but consolidates, clarifies, and increases the
flexibility of the regulations in this section. The final rule's
revisions include (1) replacing the requirement to characterize the
debris from ``each foreseeable vehicle response mode'' with ``debris
generated from normal and malfunctioning vehicle flight,'' (2) relying
upon a new definition for ``hazardous debris,'' (3) replacing ``flight
time'' with ``flight sequence,'' and (4) removing prescriptive
thresholds for various debris hazards in favor of a performance-based
standard of ``capable of causing a casualty or loss of functionality to
a critical asset.'' Each of these changes is discussed in the following
paragraphs.
    Proposed Sec.  450.121(a) required that an FSA include a debris
analysis that characterizes the debris generated for each foreseeable
vehicle response mode as a function of vehicle flight time, accounting
for the effects of fuel burn and any configuration changes. The NPRM
noted that an operator's debris list generally changes over time with
variations in the amount of available propellant and the jettisoning of
hardware.
    In the final rule, the FAA adopts proposed Sec.  450.121(a) with
revisions. The FAA replaces the proposed requirement to characterize
``the debris generated for each foreseeable vehicle response mode as a
function of vehicle flight time, accounting for the effects of fuel
burn and any configuration changes'' with a more flexible and
performance-based requirement to characterize ``the hazardous debris
generated from normal and malfunctioning vehicle flight as a function
of vehicle flight sequence.''
    Several commenters suggested changing the term ``foreseeable''
vehicle response modes in Sec.  450.121(a) of the NPRM to ``credible''
vehicle response modes. The commenters stated that credibility was
determined during the system safety analysis, and that the debris
analysis should not have to include extremely improbable, non-credible
failure modes.
    The FAA does not agree that the term ``foreseeable'' should be
replaced by the term ``credible'' in this section or throughout the
final rule. The term ``foreseeable'' is used in Sec.  431.35 and also
commonly used in system safety; therefore, the FAA is not changing
these references. The FAA finds that the term ``credible'' is
unacceptably prone to errors in judgment whereas the term
``foreseeable'' is more readily discerned by analysis (e.g., fault
trees). With regard to Sec.  450.121(a) of the final rule, the FAA
adopts the more flexible and performance-based requirement recommended
by the commenters to characterize the hazardous debris generated from
normal and malfunctioning vehicle flight as a

function of vehicle flight sequence. With the removal of the reference
to ``each foreseeable vehicle response mode'' in Sec.  450.121(a), the
final rule standard for the scope is set by the language in Sec.
450.115(a), specifically by the reference to reasonably foreseeable
events. In addition, the resolution of the failure modes accounted for
in the debris analysis is set by the level of fidelity necessary to
comply with Sec.  450.115(b). The FAA also notes that, in the context
of Sec.  450.121, reasonably foreseeable events that can generate
hazardous debris during malfunctioning vehicle flight generally include
engine/motor explosion, exceeding structural limits due to aerodynamic
loads, inertial loads, aerothermal heating, and activation of a flight
termination system.
    In reference to the use of the term ``hazardous debris'' in Sec.
450.121(a), the final rule in Sec.  401.7 includes a definition of this
term. Hazardous debris means any object or substance capable of causing
a casualty or loss of functionality to a critical asset. Hazardous
debris includes inert debris and explosive debris such as an intact
vehicle, vehicle fragments, any detached vehicle component, whether
intact or in fragments, payload, and any planned jettisoned bodies.
This definition is based on proposed Sec.  450.121(c)(1), which
required a debris analysis to identify all inert debris that could
cause a casualty or loss of functionality of a critical asset. The FAA
clarifies that the clause ``whether intact or in fragments'' applies to
the payload and jettisoned bodies as well.
    The final rule's definition of ``hazardous debris'' facilitated
streamlining in proposed Sec. Sec.  450.113 through 450.139. For
example, the term hazardous debris in Sec.  450.121(a) establishes a
performance-based threshold, which resulted in the elimination of the
prescriptive debris thresholds proposed in Sec.  450.121(c)(1)(i)
through (v).\116\ Section 450.121(a) retains the essential performance
standards in proposed Sec.  450.121(c)(1) and (c)(2) (i.e., that the
analysis must identify all inert and explosive debris capable of
causing a casualty or loss of functionality to a critical asset), and
allows operators to propose impact vulnerability models appropriate for
the materials used in their licensed operations.
---------------------------------------------------------------------------

    \116\ As proposed, an operator would have been required to
include all debris that could impact a human being with a mean
expected kinetic energy at impact greater than or equal to 11 ft-
lbs; impact a human being with a mean impact kinetic energy per unit
area at impact greater than or equal to 34 ft-lb/in2; cause a
casualty due to impact with an aircraft; cause a casualty due to
impact with a waterborne vessel; or pose a toxic or fire hazard.
---------------------------------------------------------------------------

    For example, recent research and development sponsored by the FAA
demonstrates that the threshold kinetic energy capable of causing a
casualty from a collision with a rigid object is substantially lower
than for a collision with an object made of certain composite
materials.\117\ The FAA will provide an AC with valid debris impact
thresholds, such as those proposed in Sec.  450.121(c)(1)(i) and (ii).
Thus, in the final rule, Sec.  450.121(a) uses the definition of
``hazardous debris'' in a way that will enable those debris impact
thresholds to be updated as appropriate based on future research and
development. In addition, the definition of ``hazardous debris'' is
used in Sec.  450.121(a) in a way that replaces the relatively verbose
requirement in proposed Sec.  450.121(c) that ``a debris analysis must
account for all inert, explosive, and other hazardous vehicle, vehicle
component, and payload debris foreseeable from normal and
malfunctioning vehicle flight.''
---------------------------------------------------------------------------

    \117\ ``The crash test results and subsequent analysis strongly
suggest that RCC-based thresholds are overly conservative because
they do not accurately represent the collision dynamics of
elastically-deformable sUAS with larger contact areas in comparison
to the metallic debris analysis methods for high speed missiles on
the national test ranges.'' Final Report for the FAA UAS Center of
Excellence Task A4; UAS Ground Collision Severity Evaluation
Revision 2, Arterburn et al, 2017. http://www.assureuas.org/projects/deliverables/a4/ASSURE_A4_Final_Report_UAS_Ground_Collision_Severity_Evaluation.pdf.
---------------------------------------------------------------------------

    In summary, the final rule uses the performance-based definition of
``hazardous debris'' that currently equates to the same debris
thresholds as proposed in the NPRM because ``hazardous debris'' means
any object or substance capable of causing a casualty, including people
in aircraft or waterborne vessels or loss of functionality to a
critical asset. Thus, by relying on the definition of ``hazardous
debris,'' the final rule retains the standard in proposed Sec.
450.121(c) of debris capable of causing a casualty or loss of
functionality to a critical asset and allows operators to propose
impact vulnerability models appropriate for the materials used in their
vehicle.
    In the final rule, the FAA replaces the term ``flight time'' in
Sec.  450.121(a) with the more flexible term ``flight sequence''
because it is a better independent variable. For example, during a
reentry operation, the transitions between phases of flight, which
generally produce substantially different hazardous debris, such as
prior to and after peak aero-thermal heating, can occur at widely
variable flight times. Also, imparted velocities due to break-up
typically correlate with propellant load better than flight time does.
Therefore, the final rule uses ``flight sequence'' as a less
prescriptive and more accurate independent variable. The FAA notes that
the term ``sequence'' is used in the common meaning of the word, which
is a series of related things or events, or the order in which things
or events follow each other. The phrase ``as a function of vehicle
flight sequence'' would naturally include ``accounting for the effects
of fuel burn and any configuration changes,'' so the final rule deletes
those elements of the proposed requirement as redundant.
    In Sec.  450.121(b) of the NPRM, the FAA proposed to require that
the debris analysis account for each foreseeable cause of vehicle
breakup, including any breakup caused by FSS activation, and for impact
of an intact vehicle. Consistent with Sec.  450.133(a)(4), this
proposal included debris from a vehicle's jettisoned components and
payloads because such debris could cause a casualty due to impact with
an aircraft or waterborne vessel or could pose a toxic or fire
hazard.\118\
---------------------------------------------------------------------------

    \118\ The preamble to the NPRM stated that ``this proposal would
include debris from a vehicle's jettisoned components and payloads
because such debris could cause a casualty due to impact with an
aircraft or waterborne vessel or could pose a toxic or fire
hazard,'' but the proposed regulatory text did not include that
specific language.
---------------------------------------------------------------------------

    Section 450.121(b) retains the requirement that a debris analysis
account for each reasonably foreseeable cause of vehicle breakup and
intact impact. As explained in the NPRM, this would include ``engine or
motor explosion, or exceeding structural limits due to aerodynamic
loads, inertial loads, or aerothermal heating.'' \119\
---------------------------------------------------------------------------

    \119\ 84 FR 15383.
---------------------------------------------------------------------------

    In addition, the final rule requires an operator to account for
vehicle structural characteristics and materials and energetic effects
during break-up or at impact. Although these items would be necessary
considerations in any debris analysis, the FAA has added them expressly
in Sec.  450.121(b). The requirement to account for energetic effects
in Sec.  450.121(b)(3) is consistent with the requirement in proposed
Sec.  450.135(d)(3)(iii) which addresses ``indirect or secondary
effects such as bounce, splatter, skip, slide, or ricochet.'' \120\
Moreover, accounting for the fundamental physical phenomena identified
in Sec.  450.121(b)(2) of the final rule would logically be necessary
to comply with the requirement in

proposed Sec.  450.135(d) to ``model the casualty area, and compute the
predicted consequences of each reasonably foreseeable vehicle response
mode.'' As explained in the NPRM, ``the casualty area and consequence
analysis would be required to account for all relevant debris fragment
characteristics.'' The characteristics of all relevant debris
fragments, such as the size and kinetic energy at impact, depend on the
three fundamental physical phenomena identified in the final rule.
---------------------------------------------------------------------------

    \120\ This language in proposed Sec.  450.135(d)(3)(iii) is
removed in the final rule, as discussed in the preamble associated
with that section.
---------------------------------------------------------------------------

    As noted earlier, the NPRM proposed to require in Sec.  450.121(c)
that a debris analysis account for all inert, explosive, and other
hazardous vehicle, vehicle component, and payload debris foreseeable
from normal and malfunctioning vehicle flight. The NPRM also specified
a set of items for which a debris analysis would be required to
account, at a minimum. These items included highly specific and
prescriptive debris thresholds requirements. With the addition of the
hazardous debris definition, Sec.  450.121 no longer requires a
specific subsection establishing debris thresholds.
    In the final rule, new Sec.  450.121(c) contains requirements
associated with the propagation of debris that are relocated from the
proposed debris risk analysis requirements in Sec.  450.135(b).
Specifically, a debris analysis must compute statistically valid debris
impact probability distributions. The propagation of debris from each
predicted breakup location to impact must account for all foreseeable
forces that can influence any debris impact location, and all
foreseeable sources of impact dispersion, including, at a minimum: The
uncertainties in atmospheric conditions; debris aerodynamic parameters,
including uncertainties; pre-breakup position and velocity, including
uncertainties; and breakup-imparted velocities, including
uncertainties. The FAA notes that a quantitative description of the
physical, aerodynamic, and harmful characteristics of hazardous debris
is a prerequisite to compute statistically valid debris impact
probability distributions and to quantify the risks to the public.
    The propagation of debris is a physics-based analysis that predicts
where debris impacts will occur given a debris event while the vehicle
is in flight, such as jettison of a vehicle stage or an explosion. The
FAA moves the requirements in proposed Sec.  450.135(b) to Sec.
450.121(c) because the computation of statistically-valid debris impact
distributions naturally depends on the nature of the debris and the
trajectory analysis products from Sec. Sec.  450.117 and 450.119.
Similarly, the final rule requirements in Sec.  450.121(c) are nearly
identical to those in proposed Sec.  450.135(b), except that the final
rule removes the term ``including uncertainties'' from the regulation.
The FAA finds inclusion of this term to be superfluous, as accounting
for foreseeable sources of impact dispersion naturally includes the
uncertainties in the debris aerodynamic parameters, pre-breakup state
vectors, and breakup-imparted velocities. The FAA notes that the debris
analysis must compute statistically valid debris impact probability
distributions of all hazardous debris to be consistent with the scope
identified in Sec.  450.121(a).
    Virgin Galactic recommended that the FAA allow operators to provide
their own assessments of casualty causing debris. The FAA agrees that
the specific impact vulnerability thresholds specified in the NPRM were
overly prescriptive and potentially overly conservative for some non-
rigid debris impacts. Thus, the final rule removes these proposed
requirements in Sec.  450.121(c) entirely.
    In the NPRM, Sec.  450.121(d) provided the debris analysis
application requirements. In the final rule, the FAA relocates and
revises proposed Sec.  450.121(d)(1), which was a requirement to submit
a description of the debris analysis methodology, to Sec.
450.121(d)(2). The FAA re-designates and revises proposed Sec.
450.121(d)(2) as Sec.  450.121(d)(1) in the final rule. In the NPRM,
proposed Sec.  450.121(d)(2) required an operator submit a description
of all vehicle breakup modes and the development of debris lists. In
the final rule, the re-designated Sec.  450.121(d)(1) makes use of the
formal definition of ``hazardous debris,'' requiring a description of
all scenarios that can lead to hazardous debris.
    In the final rule, Sec.  450.121(d)(2) and (d)(3) require an
operator to submit a description of the methods used to perform the
vehicle impact and breakup analysis in accordance with Sec.
450.115(c), which is consistent with similar changes in other FSA
sections. The final rule also moves the requirements relevant to the
debris propagation analysis from proposed Sec.  450.135(e)(2) and
(e)(5) to Sec.  450.121(d)(3) and (d)(4).
    The FAA re-designates and revises proposed Sec.  450.121(d)(3) as
Sec.  450.121(d)(5). In the NPRM, proposed Sec.  450.121(d)(3) required
an applicant to submit all debris fragment lists necessary to describe
the physical, aerodynamic, and harmful characteristics of each debris
fragment or fragment class quantitatively. Section 450.121(d)(5) of the
final rule requires a quantitative description of the physical,
aerodynamic, and harmful characteristics of hazardous debris. The FAA
finds that ``quantitative description'' will allow alternative
approaches for the applicant to demonstrate compliance with this
section.
    Virgin Galactic stated the proposal would introduce additional
workload to the company. Virgin Galactic raised concern that proposed
Sec.  450.121 introduced requirements for waterborne vessels that were
not referenced in other parts of the rule. The NPRM proposed, and the
final rule requires in Sec.  450.133(b), that a flight hazard area
analysis must determine waterborne vessel hazard areas. Also, the NPRM
preamble explained that the requirement includes people on ships in the
collective risk computation (see proposed Sec.  450.101(a)(1) and
(b)(1)), and thus explicitly allows the application of risk management
principles to protect people on waterborne vessels. The FAA finds that
the scope of the FSA requirements in the final rule are consistent with
current practice and will not introduce additional workload.
    Virgin Galactic stated that the FAA should quantify the debris that
could cause a casualty on a waterborne vessel. The FAA notes that it
provided guidance on debris thresholds for waterborne vessels in Table
10 of the draft AC on High-Fidelity FSA published with the NPRM.
r. Population Exposure Analysis (Sec.  450.123)
    In the NPRM, the exposure model requirements were addressed in the
debris risk analysis section in proposed Sec.  450.135(c) and (d)
because a complete risk analysis must account for the distribution of
people and how those people may be sheltered. The FAA received numerous
comments stating the proposed requirements were too prescriptive. The
FAA agrees and has revised the requirements to be more performance-
based.
    In the final rule, the FAA revises the exposure model requirements
and moves them from proposed Sec.  450.135(c) and (d) to Sec.  450.123
(Population Exposure Analysis). The FAA moves the population exposure
analysis requirements out of the proposed debris risk analysis section
because this analysis informs other sections of the FSA. A population
exposure analysis must also be used to provide input to other public
risk analyses to address toxic hazards and far-field overpressure blast
effects, if any. This change does

not an expand the scope of the final rule beyond what was proposed in
the NPRM because the NPRM identified the need for population exposure
input to address toxic hazards for flight and far-field overpressure
blast effects.\121\ The rationale for the final rule requirements
remains the same as proposed in the NPRM: An exposure model provides
critical input data on the geographical location of people and critical
assets at various times when the launch or reentry operation could
occur. While the rationale remains the same, the FAA makes two changes
in Sec.  450.123. Consistent with the change discussed in the critical
assets section of the preamble, the FAA removes the requirement for an
operator to characterize the distribution and vulnerability of critical
assets. The FAA also revises the population exposure analysis to
require that input data must account for the vulnerability of people to
hazardous debris effects. The FAA will issue a Population Exposure
Assessment AC to describe a possible means of compliance.
---------------------------------------------------------------------------

    \121\ Specifically, in Sec.  450.139(f) the FAA proposed to
require an applicant submit (ii) the population density in receptor
locations that are identified by toxic dispersion modeling as toxic
hazard areas; and (iv) the identity of the population database used.
Also, in Sec.  450.137(c)(1) the FAA proposed to require an
applicant submit a description of the population centers, terrain,
building types, and window characteristics used as input to the far-
field overpressure analysis.
---------------------------------------------------------------------------

    Section 450.123(a) requires that an FSA must account for the
distribution of people for the entire region where there is a
significant probability of impact of hazardous debris. This final rule
is consistent with the requirement in proposed Sec.  450.135(c)(1) that
the population exposure data would be required to include the entire
region where there is a significant probability of impact of hazardous
debris. The definition of ``hazardous debris'' in Sec.  401.7 informs
the scope of this requirement. In Sec.  450.123(a), the standard of
``significant'' means that the scope of the population exposure
analysis is bounded by what is necessary to demonstrate compliance with
the risk criteria in Sec.  450.101(a) and (b), consistent with the
scope requirements set in Sec. Sec.  450.113 and 450.115.
    Section 450.123(b) sets constraints on the population exposure
analysis consistent with proposed Sec.  450.135(c)(2) through (c)(7).
Specifically, Sec.  450.123(b) requires that the exposure analysis must
characterize the distribution of people both geographically and
temporally; account for the distribution of people among structures and
vehicle types; and use reliable, accurate, and timely source data.
    Section 450.123(b)(1) relocates the requirements in proposed Sec.
450.135(c)(2), but removes the term ``vulnerability'' and the reference
to critical assets, as discussed earlier.\122\ The final rule removes
proposed Sec.  450.135(c)(4), which would have required the exposure
model to have sufficient temporal and spatial resolution that a uniform
distribution of people within each defined region can be treated as a
single average set of characteristics without degrading the accuracy of
any debris analysis output. By removing this requirement, an operator
may demonstrate compliance with Sec.  450.123(b) in the manner set
forth in proposed Sec.  450.135(c)(4), but also has flexibility to
demonstrate compliance through other means.
---------------------------------------------------------------------------

    \122\ However, the proposed requirement in Sec.  450.135(c)(4)
to characterize the vulnerability of people both geographically and
temporally is effectively preserved in the final rule requirement in
Sec.  450.123(b)(4) to account for vulnerability of people to
hazardous debris effects in the population exposure analysis.
---------------------------------------------------------------------------

    Section 450.123(b)(2) replaces the more prescriptive requirements
in proposed Sec.  450.135(c)(3) by removing the requirement that, in
accounting for the distribution of people among structures and vehicle
types, an exposure analysis includes ``a resolution consistent with the
characteristic size of the impact probability distributions for
relevant fragment groups.'' The language removed from the final rule
remains a valid means for an operator to demonstrate compliance with
Sec.  450.123(b)(2) in the final rule.
    Section 450.123(b)(3) replaces the more prescriptive requirements
in proposed Sec.  450.135(c)(5) and (c)(6) so that an exposure analysis
must use reliable, accurate, and timely source data.
    Section 450.123(b)(4) consolidates and replaces the requirements to
account for the vulnerability of people to hazardous debris effects
that were proposed in Sec.  450.135(d)(3)(i) and (ii), as well as
proposed in Sec.  450.137(b)(4). In the final rule, the FAA removes the
requirement in proposed Sec.  450.135(c)(7) altogether. Proposed Sec.
450.135(c)(7) is redundant in conjunction with the requirements in
Sec.  450.115(b), which specify the necessary fidelity of any FSA, and
the requirement in Sec.  450.101(g) that an operator must use accurate
data and scientific principles and the analysis must be statistically
valid.
    The FAA moves and revises the application requirements in proposed
Sec.  450.135(e)(3) as Sec.  450.123(c)(1) in the final rule. The FAA
revises the final Sec.  450.123(c)(1), which requires an applicant to
submit a description of the FSA methodology, to reference Sec.
450.115(c). As previously noted, the population exposure analysis must
also be used to provide input to other public risk analyses to address
toxic hazards and far-field overpressure blast effects, if any. Section
450.123(c)(2) requires an applicant to submit complete population
exposure data, in tabular form, which is a more concise statement
equivalent to proposed Sec.  450.135(e)(4). In the final rule, the FAA
specifies that the complete population exposure data must be in tabular
form and deletes the requirement that the description of the exposure
input data include, for each population center, a geographic definition
and the distribution of population among shelter types as a function of
time of day, week, month, or year. The population exposure data
provided under Sec.  450.123(c)(2) may reflect some or all of the
information described in proposed Sec.  450.135(e)(4).
s. Probability of Failure Analysis (Sec.  450.131)
    In the NPRM, proposed Sec.  450.131 covered probability of failure
analysis requirements for all launch and reentry vehicles. In the final
rule, the FAA adopts proposed Sec.  450.131 with minor revisions
codifying current practices and eliminating the proposed classes of
mishaps referenced in Sec.  450.131.
    Section 450.131(a) proposed that for each hazard and phase of
flight, an FSA for a launch or reentry would be required to account for
vehicle failure probability. The probability of failure would be
required to be consistent for all hazards and phases of flight. For a
vehicle stage with fewer than two flights, the failure probability
estimate would be required to account for the outcome of all previous
flights of vehicles developed and launched or reentered in similar
circumstances. For a vehicle or vehicle stage with two or more flights,
vehicle failure probability estimates would be required to account for
the outcomes of all previous flights of the vehicle or vehicle stage in
a statistically valid manner. The outcomes of all previous flights of
the vehicle or vehicle stage would be required to account for data on
any partial failure and anomalies, including Class 3 and Class 4
mishaps, as defined in proposed Sec.  401.5. The FAA adopts Sec.
450.131(a) as proposed with a minor change to the language pertaining
to mishaps to reflect revisions to the definition of ``mishap'' in
Sec.  401.7. The FAA notes that the final rule replaced the term
``partial failures'' with ``mishap'' in Sec.  450.131(a)(2)

 because the proposed language referenced both anomalies and mishaps,
and ``partial failure'' is redundant since any partial failure could
qualify as an anomaly or a mishap under Sec.  401.7, depending on the
nature of the failure.
    Virgin Galactic commented that the proposed requirements to gather
and account for anomaly data in the probability of failure analysis
introduced additional workload compared to the current regulation. It
recommended the FAA adopt a performance-based standard in an SNPRM.
    The FAA does not agree that this requirement results in additional
workload from current regulations. The FAA notes that the final rule
requirement in Sec.  450.101(g) is relevant here because it requires
that a method must produce results consistent with, or more
conservative than, the results available from previous mishaps, tests,
or other valid benchmarks, such as higher-fidelity methods.\123\ Hence,
an operator has the option to use a more conservative approach to avoid
any unnecessary additional workload. For example, an operator can
assume one more failure than the actual outcomes of all previous
flights of the vehicle or vehicle stage. Therefore, the FAA does not
find that the requirements in the final rule constitute additional
workload compared to current regulations.
---------------------------------------------------------------------------

    \123\ Because the FSA is necessary to demonstrate compliance
with the risk criteria in Sec.  450.101, the requirements set forth
in that section regarding the validity of analysis apply to all
parts of the FSA.
---------------------------------------------------------------------------

    Boeing requested clarification on what is meant by a ``consistent''
probability of failure in this section. The FAA clarifies that the
vehicle or vehicle stage probability of failure must be consistent
internally with outcomes of previous flights, as described in Sec.
450.131(a)(1) and (a)(2). Furthermore, the probability of failure input
data must be consistent for all phases of flight and hazards. In this
context, ``consistent'' does not mean identical and does not preclude
an operator from varying the probability of failure within statistical
confidence limits for the same event in different contexts, in order to
bias an analysis towards a conservative outcome.\124\ The probability
of failure input data should be reasonably conservative and consistent
across phases of flight and for various hazards given the uncertainty
in each probability of failure.
---------------------------------------------------------------------------

    \124\ Section 450.115(b)(1) requires an operator to demonstrate
that any risk to the public satisfies the safety criteria of Sec.
450.101 accounting for all known sources of uncertainty.
---------------------------------------------------------------------------

    A hypothetical example is a proposed launch of a two-stage launch
vehicle from both CCAFS and Vandenberg Air Force Base (VAFB). In this
case, the best-available data indicates the mean conditional
probability of a failure during first stage and second stages of flight
are both 50 percent, with plus or minus 10 percent uncertainty at a
minimal level of confidence (e.g., 60 percent lower and upper bound
confidence limits at 40 percent and 60 percent based on the binomial
distribution).
    Given the fact that the public exposure to hazardous debris effects
for launches from VAFB is relatively high during stage one, and the
opposite is true for launches from CCAFS, a consistent and reasonably
conservative probability of failure analysis would use a 60-40 split in
the conditional probability of failure during stage one and stage two
flight for launches from VAFB, but a 40-60 split in the conditional
probability of failure during stage one and stage two flight for
launches from CCAFS. Furthermore, the conditional probability of a
failure applied to different hazards, such as debris and toxics, must
be consistent with each other. More details on means of compliance are
provided in the High Fidelity FSA Methods AC published with this rule,
and a future AC on probability of failure.
    Leo Aerospace asked if the FAA would consider a balloon platform to
be a stage.
    The FAA will discuss project-specific information, including
whether a balloon platform is part of a launch vehicle stage, during
pre-application consultation.
    Boeing, Blue Origin, and Sierra Nevada commented on the lack of
availability of previous flight information for vehicles not operated
or owned by the applicant.
    The FAA responded to this comment in the FAA's ``Responses to the
Public's Clarifying Questions Received by July 12, 2019,'' \125\ which
is posted in the docket. An operator should use the best-available
data, which in many cases would be limited to publicly available data.
The FAA will also provide data and guidance on failure mode and phase
of flight allocations in the High Fidelity FSA Methods AC, which will
be finalized with this rule.
---------------------------------------------------------------------------

    \125\ See FAA-2019-02290-0134.
---------------------------------------------------------------------------

    In the final rule, the FAA replaces all references to Class 3 and
Class 4 mishaps in Sec.  450.131 with the term ``mishap.'' As
previously noted, the FAA eliminates the proposed classes of mishaps in
the revised definition of mishap in Sec.  401.7 of the final rule.
    In the NPRM, the FAA proposed that, for FSA purposes, a failure
occurs when a vehicle does not complete any phase of normal flight or
when any anomalous condition exhibits the potential for a stage or its
debris to impact the Earth or reenter the atmosphere outside the normal
trajectory envelope during the mission or any future mission of similar
vehicle capability. It further stated that Class 1 or Class 2 mishaps
would constitute failures.
    Blue Origin commented that defining failure as not completing any
phase of normal flight is ``overly punitive'' as proposed in Sec.
450.131(b). Operators may define secondary mission objectives for
research and development purposes that, if not achieved, do impact
mission success but do not impact safety. Blue Origin proposed deleting
the language ``when a vehicle does not complete any phase of normal
flight or'' and anchor the definition in impacts outside the normal
envelope. Virgin Galactic recommended that the FAA should only account
for failures, partial failures, and anomalies that affect public
safety. Blue Origin also commented that including anomalies that might
impact a future mission conflicts with the causal logic that an anomaly
experienced on a given mission will be subject to corrective actions
prior to the next mission.
    The FAA understands the concerns raised by the commenters but finds
it unnecessary to change the regulatory text to address these concerns.
An operator may adjust its final failure probability estimates to
account for various extenuating circumstances, as will be described in
a future Probability of Failure Analysis AC. For example, the
probability of failure may be adjusted based on extenuating
circumstances with justification (e.g., if the failure is not public
safety related or if corrective actions implemented after a failure
were demonstrated to be successful). If an operator makes any
adjustments to the final failure probability estimates to account for
various extenuating circumstances, it can update its FSA in accordance
with Sec.  450.103(d).
    The FAA notes that, for FSA purposes, the vehicle failure
probability accounts for any failure of the launch or reentry system
because of the way failure is defined in Sec.  450.131(b).
Specifically, for FSA purposes, a failure occurs when a vehicle does
not complete any phase of normal flight or when any anomalous condition
exhibits the potential for a stage or its debris to impact the Earth or
reenter the atmosphere outside the normal trajectory envelope during
the mission or any future mission of similar vehicle

capability. Therefore, in the context of FSA, any failure of the launch
or reentry system, including pilot error, that produced vehicle failure
as defined in Sec.  450.131(b) must be taken into account.\126\
---------------------------------------------------------------------------

    \126\ The SpaceShipTwo accident on October 31, 2014, is an
example of this situation.
---------------------------------------------------------------------------

    Proposed Sec.  450.131(c) defined ``previous flight'' by stating
that the flight of a launch vehicle begins at a time when a launch
vehicle normally or inadvertently lifts off from a launch platform and
the flight of a reentry vehicle or deorbiting upper stage begins at a
time when a vehicle attempts to initiate a deorbit. The FAA adopts
Sec.  450.131(c)(1) as proposed with a minor change. The FAA strikes
the words ``normally or inadvertently'' as redundant, since any lift
off, whether normal or inadvertent, would count as a flight under the
proposed and final rule requirements in Sec.  450.131(c)(1).
    Boeing, Lockheed Martin, Northrop Grumman, ULA, and Virgin Galactic
requested explanation on whether the proposed requirement in Sec.
450.131(c) would apply to hybrid vehicles.
    In the final rule, the FAA revises the regulatory text in response
to these comments. The FAA changes ``launch platform'' to ``surface of
the Earth'' as the point at which flight begins for a probability of
failure analysis. This change reflects the fact that various types of
vehicles, such as hybrids, do not lift off from launch platforms. The
probability of failure analysis must account for the probability of
failure during all phases of flight to ensure public safety, including
captive carry, unless the exception in Sec.  450.113(b) applies to that
phase of flight. For example, an aircraft crash with a rocket attached
can present much higher risks to the public from an explosion, toxic
release, or inert impact, than the risks posed by an aircraft crash
without a rocket attached.
    For the purposes of Sec.  450.131(c)(1) and (c)(2), a previous
flight may include flights conducted outside FAA licensed activity,
such as amateur, permitted, U.S. government, or foreign launches,
reentries, or flights. For the purposes of Sec.  450.131(c)(1) and
(c)(2), a previous flight may include FAA-licensed activity, such as
the Falcon 9 launch vehicle anomaly which destroyed the vehicle and its
AMOS-6 payload,\127\ if the outcome exhibited the potential for a stage
or its debris to impact the Earth or reenter the atmosphere outside the
normal trajectory envelope during the mission or any future mission of
similar vehicle capability. The FAA also changes the word ``deorbit''
to ``reentry'' to accommodate a reentry that starts on a suborbital
trajectory.
---------------------------------------------------------------------------

    \127\ On September 1, 2016.
---------------------------------------------------------------------------

    In the NPRM, Sec.  450.131(d) proposed to require that a vehicle
probability of failure be distributed across flight times and vehicle
response modes. The distribution would be consistent with the data
available from all previous flights of vehicles developed and launched
or reentered in similar circumstances and data from previous flights of
vehicles, stages, or components developed and launched or reentered by
the subject vehicle developer or operator. As proposed, the data could
include previous experience involving, among other things, a similar
level of experience of the vehicle operation and development team
members.
    The FAA adopts Sec.  450.131(d) with revisions. Specifically, the
FAA changes ``flight time'' to ``flight phase.'' ``Flight phase'' gives
applicants more flexibility in their analysis because it is less
specific than ``flight time.'' The FAA also changes ``vehicle response
mode'' to ``failure mode,'' consistent with similar changes throughout
the final rule. Finally, the FAA replaces the phrase ``launched or
reentered'' in Sec.  450.131(d)(2) to ``launched, reentered, flown, or
tested.'' This change will enable the probability of failure allocation
across flight phases and failure modes to account for data from
previous flights of vehicles, stages, or components by the subject
vehicle developer or operator that did not qualify as launch or reentry
operations, such as drop tests or glide flights. The FAA also revises
``flight phases'' and ``failure modes'' to be plural in the final rule.
This amended language is a minor grammatical change and is consistent
with the intent of the proposed requirement.
    Virgin Galactic commented that the FAA should not employ a
subjective measure of ``level of experience'' and requested this
language be stricken.
    The FAA asserts that this measure is not subjective. The High
Fidelity FSA Methods draft AC contained specific quantitative
thresholds that have been used for many years as guidelines to
distinguish new versus experienced developers for the purposes of
probability of failure analyses. Because the quantitative thresholds
are in guidance, the FAA may consider other quantitative thresholds as
appropriate. Furthermore, the data available from previous flights of
ELVs developed by experienced and inexperienced operators demonstrates
a statistically significant difference between the relative frequency
of failures during the first and second phases of flight. Therefore,
because the required input data may involve a similar level of
experience of the vehicle operation and development team members, the
final rule in Sec.  450.131(d)(2)(iii) retains that consideration.
    The FAA adopts the observed and conditional failure rate
requirements in Sec.  450.131(e) as proposed and the application
requirements in Sec.  450.131(f) with revisions. Section 450.131(f)(1)
to require methods used in probability of failure analysis be in
accordance with Sec.  450.115(c) because that section sets out the
requirements for FSA methodologies. In Sec.  450.131(f)(2), the FAA
changes the term ``vehicle response mode'' to ``failure mode,'' which
is consistent with similar changes throughout this final rule.
t. Flight Hazard Area Analysis (Sec.  450.133)
    In Sec.  450.133, the NPRM proposed general requirements for the
flight hazard area analysis as well as requirements specific to
waterborne vessel hazard areas, land hazard areas, airspace hazard
volumes, and the license application. In the final rule, the FAA adopts
Sec.  450.133 with revisions. The revisions include changing terms
proposed in the NPRM and removing redundant requirements.
    Proposed Sec.  450.133(a) stated that an FSA would be required to
include a flight hazard area analysis that identifies any region of
land, sea, or air that would be required to be surveyed, publicized,
controlled, or evacuated in order to control the risk to the public. A
flight hazard area analysis would be required to account for all
reasonably foreseeable vehicle response modes during nominal and non-
nominal flight that could result in a casualty. The NPRM specified six
items that would be required to be included in a flight hazard area
analysis, at a minimum.
    The FAA adopts Sec.  450.133(a) with revisions. The FAA moves the
requirement in Sec.  450.133(a) that a flight hazard area analysis must
account for all reasonably foreseeable vehicle response modes during
nominal and non-nominal flight that could result in a casualty to Sec.
450.133(a)(1). This text is also revised, as discussed below. The
replacement of ``vehicle response modes'' with ``failure modes'' was
discussed in the preamble section on Sec.  450.101(c)(2).
    In Sec.  450.133(a)(1), the FAA proposed that the flight hazard
analysis must account for the regions of land, sea, and air potentially
exposed to debris impact resulting from normal flight events and from
debris hazards resulting from any

potential malfunction. The FAA revises proposed Sec.  450.133(a)(1) by
adding the term ``hazardous debris'' as discussed in the preamble
section for Sec.  450.121 (Debris Analysis). As defined, hazardous
debris includes any object or substance capable of causing a casualty
or loss of functionality to a critical asset, such as an intact
vehicle, vehicle fragments, any detached vehicle component, whether
intact or in fragments, payload, and any planned jettison bodies. The
FAA also replaces ``vehicle response mode'' with ``failure modes'' for
consistency throughout the final rule.
    In Sec.  401.7, the FAA modifies the definition of ``flight hazard
area'' as applied to part 450. The NPRM proposed that flight hazard
area means any region of land, sea, or air that must be surveyed,
publicized, controlled, or evacuated in order to ``protect public
health and safety and the safety of property.'' This language was
inconsistent with the language in Sec.  450.133. As such, in the final
rule, the definition has been revised in Sec.  401.7 for consistency to
state that a flight hazard area is any region of land, sea, or air that
must be surveyed, publicized, controlled, or evacuated in order to
``ensure compliance with the safety criteria in Sec.  450.101.''
    Boeing, Lockheed Martin, Northrop Grumman, and ULA suggested
replacing ``all reasonably foreseeable'' with ``credible'' because
credibility is established in the system safety analysis. As discussed
previously, the FAA does not agree with the recommendation because the
term credible is prone to errors in judgment whereas the term
foreseeable is more readily discerned by analysis (e.g., fault trees).
The final rule moves the term ``reasonably foreseeable'' from proposed
Sec.  450.133(a) to Sec.  450.133(a)(1), where it more appropriately
modifies the language in Sec.  450.133(a)(1) that specifies the
analysis must account for the regions of land, sea, and air potentially
exposed to hazardous debris generated during normal flight events and
all reasonably foreseeable failure modes.
    The FAA adopts Sec.  450.133(a)(2) with a minor correction. The FAA
replaces ``control risk to any hazard'' in the NPRM with ``control risk
from any hazard'' in the final rule.
    In Sec.  450.133(a)(3), the FAA proposed that the analysis account
for the limits of a launch or reentry vehicle's normal flight,
including winds that were no less severe than the worst wind conditions
under which flight might be attempted and uncertainty in the wind
conditions. The FAA adopts Sec.  450.133(a)(3) with revisions. The FAA
changes ``wind conditions'' to ``atmospheric conditions'' because in
some cases, such as far-field overpressure blast and toxics analyses,
the temperature profile is an atmospheric condition that may also be
stipulated as part of the flight commit criteria (in addition to the
wind profile). This change does not create any additional burden to the
operator because the proposed and final requirements in Sec.
450.135(e)(1) and Sec.  450.165(b)(2) already require an operator to
account for and identify the conditions immediately prior to enabling
the flight of a launch vehicle or the reentry of a reentry vehicle that
are necessary to demonstrate compliance with the safety criteria in
Sec.  450.101, such as the atmospheric conditions and any
meteorological conditions. The final rule in Sec.  450.133(a)(3)
clarifies that all atmospheric conditions are considerations when the
operator establishes the worst conditions under which flight might be
attempted.
    In Sec.  450.133(a)(4), the FAA proposed that the analysis account
for the debris identified for each foreseeable cause of breakup, and
any planned jettison of debris, launch or reentry vehicle components,
or payload. The FAA adopts Sec.  450.133(a)(4) with a revision. For
reasons previously discussed, the FAA replaces this section with ``all
hazardous debris,'' which uses the term defined in Sec.  401.7 of the
final rule. This revision does not change the intent of the
requirement.
    In Sec.  450.133(a)(5), the FAA proposed that the analysis account
for all foreseeable sources of debris dispersion during freefall,
including wind effects, guidance and control, velocity imparted by
breakup or jettison, lift, and drag forces. The FAA adopts Sec.
450.133(a)(5) with revisions. In the final rule, the analysis must
account for sources of debris dispersion in accordance with Sec.
450.121(c). The FAA makes this revision to avoid replication of
requirements between Sec. Sec.  450.133(a)(5) and 450.121(c) and to
ensure consistency in the FSA.
    AOPA commented that the FAA should provide the public an
authoritative source of flight hazard area information as well as
guidance on various flight hazard area analysis methodology. The FAA is
working on the NOTAM/Aeronautical Information Service (AIS)
Modernization effort, which will redesign the current NOTAM management
information system with a single technology gateway for entering,
processing, and retrieving all NOTAM data, making it easier for all
users of the airspace to access safety-critical information. The FAA
finds that the issue raised by AOPA is best addressed by the NOTAM/AIS
Modernization effort rather than this rulemaking. Industry can provide
input on this effort through the Aeronautical Information Systems
Coalition. Information regarding temporary flight restrictions (TFR)
can be found at: https://tfr.faa.gov/tfr2/list.html and is searchable
by the type of TFR being implemented. The FAA plans to complete the
NOTAM/AIS Modernization effort by late 2022. In addition, an acceptable
flight hazard area analysis methodology is addressed in the High
Fidelity FSA AC.
    Boeing, Lockheed Martin, Northrop Grumman, and ULA also provided
suggested regulatory text that stated the airspace hazard volume was
only necessary for airspace up to 60,000 feet mean sea level. The FAA
agrees that the analysis only needs to account for reasonably expected
air traffic in a given region, but, in order to account for operations
in different regions, does not change the text to a specific altitude.
    The FAA adopts Sec.  450.133(b), (c), and (d) as proposed. Section
Sec.  450.133(b)(1), (c)(1), and (d)(1) state that flight hazard areas
must be determined as necessary to contain, with 97 percent probability
of containment, all debris resulting from normal flight events capable
of causing a casualty to any person located on land, sea, or air. In
the NPRM, the FAA explained that proposed Sec.  450.133(b)(1), (c)(1),
and (d)(1) would align FAA regulations with practices at the Federal
launch or reentry sites by allowing operators to reduce or otherwise
optimize the size of the regions for warnings of potential hazardous
debris resulting from normal flight events.
    Virgin Galactic stated that, given the currently available
information and tools regarding debris, the 97 percent probability of
containment requirement in proposed Sec.  450.133(b)(1), (c)(1), and
(d)(1) would result in inflated hazard area determinations. Boeing,
Lockheed Martin, Northrop Grumman, and ULA commented on proposed Sec.
450.133(b)(1) and suggested it reference current 3-sigma standards.
Boeing stated that, given the new limitation on debris, changing from
99.7 percent to 97 percent containment appeared less safe.
    The final rule retains the 97 percent containment requirement
proposed in the NPRM. The FAA notes that the comments demonstrate a
difference of opinion in the industry regarding the appropriate
probability of containment requirement for flight hazard areas, with
Virgin Galactic claiming the proposal would result in inflated hazard
area determinations, as opposed to the other commenters calling for
more stringent

hazard area requirements to maintain public safety. The FAA finds the
97 percent containment requirement strikes an appropriate balance,
particularly when coupled with the requirement to include the
collective risk contribution from people in waterborne vessels in the
public risk criteria in Sec.  450.101. As noted in the NPRM, the FAA
adopts flight hazard area regulations for waterborne vessels consistent
with past waivers that the FAA granted to ensure they align with
current practices at the Federal launch ranges, where most commercial
launches take place currently. Recent experience from commercial and
U.S. Government launch and reentry operations demonstrates that the
requirements adopted eliminate unnecessary launch delays while ensuring
that the overall level of safety provided to the public remains
consistent with the public risk criteria in Sec.  450.101. The FAA
notes that the application of a risk management approach to ensure the
safety of people in waterborne vessels is consistent with
recommendations made by the National Academy of Sciences.\128\ The FAA
finds that public safety is not compromised by changing 99.7 percent
containment to 97 percent containment because the overall public risk
criteria must also be met, irrespective of the size of the hazard
areas. From a policy perspective, the final rule approach to protect
people in waterborne vessels achieves the goal of common standards for
launches from any U.S. launch site, Federal or non-Federal. Both
industry and the National Space Council have urged government agencies
involved in the launch and reentry of vehicles by commercial operators
to work towards common standards.
---------------------------------------------------------------------------

    \128\ In 2001, the NRC published a report on ``Streamlining
Space Launch Range Safety,'' which included a recommendation that
``safety procedures based on risk avoidance should be replaced with
procedures consistent with the risk management philosophy specified
by EWR 127-1.'' See p. 44 of IBSN 0-309-51648-X available at http://www.nap.edu/catalog/9790.html.
---------------------------------------------------------------------------

    Boeing also requested clarification on how containment boxes for
nominal impacts can use the same standard as hazard areas intended to
contain debris in the much less likely event of a failure. The FAA
notes that planned hazardous debris impacts must use a probability of 1
in the analysis in accordance with Sec.  450.133(a)(6), while hazardous
debris impacts due to a failure will have a probability applied as
determined from the Sec.  450.131 probability of failure analysis.
    The FAA adopts Sec.  450.133(b)(2), (c)(2), and (d)(2) as proposed.
These sections use probability of impact contours or probability of
casualty contours to meet the risk requirements in Sec.  450.101 for
sea, land, and air.
    Blue Origin commented that the intent of these requirements seems
to be to establish hazard areas for normal operations and mishaps, but
the requirements do not explicitly state that the risk criteria applies
to malfunction trajectories. Blue Origin proposed that the FAA should
specify that risk contours should be conducted for malfunction
trajectories.
    The FAA notes the proposed requirement in Sec.  450.133(a) that a
flight hazard area analysis must account for all reasonably foreseeable
vehicle response modes during nominal and non-nominal flight that could
result in a casualty also specified that the risk contours required in
proposed Sec.  450.133(e)(2)(iii) through (v) must account for
malfunction trajectories. However, the FAA revises the requirement to
state in Sec.  450.133(a)(1) that the flight hazard area analysis must
account for the regions of land, sea, and air potentially exposed to
hazardous debris generated during normal flight events and ``all
reasonably foreseeable failure modes,'' which includes malfunction
trajectories. In addition, the FAA revises the risk contour requirement
in Sec.  450.133(e)(2)(iii), which is explained below in the discussion
on that requirement. The FAA notes that the High-Fidelity FSA Methods
AC describes one acceptable methodology for flight hazard areas, which
accounts for malfunction trajectories.
    Virgin Galactic commented that requirements for waterborne vessels
should also be in Sec.  450.101. The FAA notes that the operator must
meet individual and collective risk requirements, as stated in Sec.
450.101. People on waterborne vessels are included in the collective
and individual risk calculations. However, as explained in the NPRM,
operators have the option to use the current approach in part 417 as a
means of compliance, which requires surveillance to ensure no ship is
exposed to more than 1 x 10-\5\ probability of impact,
because that will be generally sufficient to ensure compliance with
Sec.  450.101.
    In Sec.  450.133(e)(1), the FAA proposed that the applicant submit
a description of the methodology to be used in the flight hazard area
analysis including all assumptions and justifications for the
assumptions, vulnerability models, analysis methods, and input data. In
the final rule, the FAA revises this requirement by adding that the
analysis must be done in accordance with Sec.  450.115(c) to avoid
replication of requirements and ensure consistency throughout subpart C
of part 450.
    In Sec.  450.133(e)(1)(i), the FAA proposed that an applicant
provide input wind data and justification in the application. The FAA
did not adopt this proposal in the final rule. Rather, the FAA deletes
proposed Sec.  450.133(e)(1)(i) because this application requirement is
covered in Sec.  450.117(c). Section 450.117(c) accounts for all
atmospheric conditions that have an effect on the trajectory, including
worst case atmospheric profile conditions under which flight might be
attempted.
    In Sec.  450.133(e)(2), the FAA proposed that an applicant submit
tabular data and graphs of the results of the flight hazard area
analysis, including in Sec.  450.133(e)(2)(iv) and (v) the following:
if applicable, representative 1 x 10-\5\ and 1 x
10-\6\ probability of impact contours for all debris capable
of causing a casualty to persons on a waterborne vessel regardless of
location; and representative 1 x 10-\6\ and 1 x
10-\7\ probability of impact contours for all debris capable
of causing a casualty to persons on an aircraft regardless of
location.\129\
---------------------------------------------------------------------------

    \129\ The FAA received no comments on Sec.  450.133(e)(2)(i) and
(ii) and adopts Sec.  450.133(e)(2)(i) as proposed and Sec.
450.133(e)(2)(ii) a revision include a cross-reference to the hazard
area publication requirement in Sec.  450.161.
---------------------------------------------------------------------------

    Blue Origin commented that, by requiring 1 x 10-\6\ and
1 x 10-\7\ risk contours for waterborne vessels and
aircraft, respectively, the FAA was extending application requirements
beyond those either currently codified in part 400 or proposed in part
450.
    The FAA notes that, as stated in the NPRM preamble, these contours
are necessary for the applicant to demonstrate to the FAA sufficient
computational resolution and analysis fidelity for the results that are
critical to public safety. Thus, the FAA declines to adopt the
recommended change. For these reasons, the FAA adopts Sec.
450.133(e)(2)(iv) and (e)(2)(v) as proposed.
    In Sec.  450.133(e)(2)(iii), the FAA proposed that an applicant
would be required to submit representative individual probability of
casualty contours regardless of location.
    Virgin Galactic requested clarification on the meaning of the term
``regardless of location.'' Based on the context in proposed Sec.
450.133(a), which required the flight hazard area analysis to identify
any region of land, sea, or air that must be surveyed, publicized,
controlled, or evacuated in order to control the risk to the public,
the term ``regardless of location'' referred to whether the contours
are on land, sea,

or air. In the final rule, the FAA changes the term ``regardless of
location'' to ``for all locations specified in paragraph (a)'' for more
specificity. The FAA further specifies that ``representative
probability of casualty contours'' must account for both neighboring
operations personnel (at the 1 x 10-\5\ probability of
casualty level) and other members of the public (at the 1 x
10-\6\ probability of casualty level). Hence, the
requirement in Sec.  450.133(e)(2)(iii) of the final rule specifies
that representative individual probability of casualty contours include
tabular data and graphs showing the hypothetical location of any member
of the public that could be exposed to a probability of casualty of 1 x
10-\5\ or greater for neighboring operations personnel, and
1 x 10-\6\ or greater for other members of the public, given
all foreseeable conditions within the flight commit criteria.
    The FAA adds this explicit language to the application requirement
to reflect what is necessary to demonstrate compliance with the
substantive requirements for flight hazard area analysis as proposed in
the NPRM and as set forth in the final rule. Specifically, the
substantive requirements proposed in Sec.  450.133(b)(2) and (c)(2),
which required an operator to determine the areas of water and land
where the individual probability of casualty for any person on a vessel
or on land would exceed the criterion in Sec.  450.101(a)(2) or (b)(2),
would necessarily have required a demonstration consistent with the
revised application requirements.
u. Debris Risk Analysis (Sec.  450.135)
    In the NPRM, the FAA proposed to require that a debris risk
analysis be performed to determine whether the individual and
collective risk of public casualties meet the safety criteria in Sec.
450.101. The debris risk analysis would be required to compute
statistically-valid debris impact probability distributions using the
input data produced by FSAs required in proposed Sec. Sec.  450.117
through 450.133. In the final rule, the FAA adopts Sec.  450.135 with
revisions.
    Proposed Sec.  450.135(a) stated that a debris risk analysis would
be required to demonstrate compliance with safety criteria in proposed
Sec.  450.101, either prior to the day of the operation, by accounting
for all foreseeable conditions within the flight commit criteria or
during the countdown using the best available input data. The FAA
adopts Sec.  450.135(a) with revisions. Specifically, the FAA adds in
Sec.  450.135(a)(2) that the ``best available input data'' used during
the countdown must include any applicable ``flight commit criteria and
flight abort rules'' if such controls are necessary to ensure
compliance with the public risks as required in proposed and final
Sec.  450.165(b).
    There is no additional burden on the operator due to the updated
language in Sec.  450.135(a)(2), because this requirement is consistent
with the proposed requirements in Sec. Sec.  450.135(e)(1) and
450.165(b)(2). An operator is required to account for and identify the
conditions immediately prior to enabling the flight of a launch vehicle
or the reentry of a reentry vehicle that are necessary to demonstrate
compliance with the safety criteria in Sec.  450.101, such as the
atmospheric conditions and any other commit criteria. The final rule in
Sec.  450.135(a)(2) now explicitly acknowledges that a valid debris
risk analysis must account for any applicable flight commit criteria
and flight abort rules when the operator establishes if the present
conditions produce public risks consistent with the safety criteria in
Sec.  450.101.
    In Sec.  450.135(b), the FAA proposed performance-based
requirements to address the physical phenomena that influence the
propagation of debris, which the analysis would be required to account
for to compute the probability of impact of debris on people and
critical assets. In the final rule, the FAA adopts and moves these
requirements with revisions to Sec.  450.121(c), as discussed in the
section of this preamble on Debris Analysis. There were two reasons for
moving the proposed propagation of debris requirements in Sec.
450.135(b) to Sec.  450.121(c). First, the computation of valid impact
probability distributions is relevant to more than the debris risk
analyses; for example, valid impact probability distributions are
necessary for the development of flight hazard areas and the yield-
probability pairs used as input to the far-field overpressure analysis.
Second, although the relationships between the FSA sections are complex
and interdependencies exist, the FAA sought to lay out the FSA
requirements in a sequential order.
    In Sec.  450.135(c), the FAA proposed the features of a valid
population exposure analysis. In the final rule, the FAA adopts and
moves these requirements with revisions to Sec.  450.123, as discussed
in the preamble associated with that section. As noted, the FAA moved
the population exposure analysis requirements out of the proposed
debris risk analysis section because a population exposure analysis
must also be used to provide input to other public risk analyses to
address toxic hazards and far-field overpressure blast effects, if any.
As discussed earlier, this is not an expansion of the scope because the
NPRM identified the need for population exposure input to address toxic
hazards for flight and far-field overpressure blast effects.
    In proposed Sec.  450.135(d), the FAA set forth the features of a
valid casualty area and consequence analysis. Proposed Sec.  450.135(d)
stated that a debris risk analysis would be required to model the
casualty area and compute the predicted consequences of each reasonably
foreseeable vehicle response mode in any one-second period of flight in
terms of CEC. The NPRM also specified that the contents of a
casualty area and consequence analysis must account for, at a minimum,
the items proposed in Sec.  450.135(d)(1) through (d)(3).\130\
---------------------------------------------------------------------------

    \130\ The FAA received no comments on Sec.  450.135(d)(1), which
requires the casualty and consequence analysis to account for all
relevant debris fragment characteristics and the characteristics of
a representative person exposed to any potential hazard. The FAA
adopts this requirement without change.
---------------------------------------------------------------------------

    In the final rule, the FAA revises and re-designates the
requirements proposed in Sec.  450.135(d) to Sec.  450.135(b). In
addition, the FAA replaces the term ``vehicle response mode'' with
``failure mode,'' consistent with similar changes made throughout the
final rule and discussed further in Sec.  450.101(c)(2) of this
preamble. The FAA also replaces the term ``one-second period of
flight'' with ``significant period of flight,'' as discussed in the
preamble section associated with high consequence event protection.
    In the NPRM, the FAA included a definition of ``casualty area'' in
Sec.  401.5, defined as the area surrounding each potential debris or
vehicle impact point where serious injuries, or worse, can occur. The
FAA adopts this definition as proposed.
    SpaceX commented the FAA should modify proposed Sec.  450.135(d) to
require that the casualty area and consequence analysis not only
account for the items in proposed Sec.  450.135(d)(1) through (d)(3)
but also model them conservatively. The FAA notes that the term
``account for'' already includes using conservative data or assumptions
for all inputs and results of an analysis, pursuant to Sec.
450.101(g). Thus, this change would be redundant.
    As previously discussed, the requirements for debris propagation in
Sec.  450.135(b) have been relocated in the final rule to Sec.
450.121(c). As a result, the FAA adds a requirement in Sec.
450.135(b)(2) that a casualty area and consequence analysis must
account for

statistically-valid debris impact probability distributions. This
requirement is derived from the requirements in proposed Sec.
450.135(b). The FAA notes that without statistically-valid impact
probability distributions it would be impossible to compute the
predicted consequences of each reasonably foreseeable failure mode in
any significant period of flight in terms of conditional expected
casualties, as required in proposed Sec.  450.135(d) and Sec.
450.135(b) of the final rule, because the consequence of any failure
depends on the characteristics of the debris (such as the casualty
area) predicted to impact exposed populations. Thus, the FAA finds the
final rule is consistent with the NPRM in requiring this information as
part of a debris risk analysis.
    In the NPRM, the FAA proposed to require that the casualty area and
consequence analysis account for any direct impacts of debris
fragments, intact impact, or indirect impact effects, in proposed Sec.
450.135(d)(2). It also proposed that the analysis account for the
vulnerability of people and critical assets to debris impacts including
all hazard sources, such as the potential for any toxic or explosive
energy releases, in proposed Sec.  450.135(d)(3)(ii) and indirect or
secondary effects such as bounce, splatter, skip, slide or ricochet,
including accounting for terrain, in proposed Sec.  450.135(d)(3)(iii).
    In the final rule, the FAA consolidates the three proposed
requirements into Sec.  450.135(b)(3). Section 450.135(b)(3) more
simply states that the analysis must account for ``any impact or
effects of hazardous debris,'' because the new definition of
``hazardous debris'' in Sec.  401.7 reflects the scope of the NPRM
requirements. In the final rule, the use of the defined term
``hazardous debris'' in Sec.  450.135(b)(3) replaces the requirement in
proposed Sec.  450.135(d)(3)(ii) to account for all hazard sources,
such as the potential for any toxic or explosive energy releases. It
also replaces the requirement in proposed Sec.  450.135(d)(2) to
account for any direct impacts of debris fragments, intact impact, or
indirect impact effects. Also, the final rule uses the phrase ``any
impact or effects'' of hazardous debris to replace the proposed
requirements to account for any direct or indirect effects, including
indirect or secondary effects such as bounce, splatter, skip, slide, or
ricochet, including accounting for terrain. The FAA's use of the
defined term hazardous debris, discussed previously, allows for
consistency throughout the final rule with regard to the scope of the
FSA requirements. This revision does not change the scope of the
proposed requirements because the definition includes the concept of
all hazard sources and the direct impacts of debris fragments, intact
impact, or indirect impact effects.
    In the NPRM, the FAA required in proposed Sec.  450.135(d)(3) that
the analysis account for the vulnerability of people and critical
assets to debris impacts. In the final rule, the FAA moves proposed
Sec.  450.135(d)(3) as Sec.  450.135(b)(4) and strikes the reference to
critical assets, as explained in the preamble section on critical
assets. The FAA also re-designates and adopts proposed Sec.
450.135(d)(3)(i) as Sec.  450.135(b)(4)(i) in the final rule. As