to limit or restrict the hazards to public health and safety, and
the safety of property, presented by a launch vehicle or reentry
vehicle, including any payload, while in flight by initiating and
accomplishing a controlled ending to vehicle flight. Flight abort is
discussed more fully in the discussion of Sec.  450.108.
---------------------------------------------------------------------------

    The FAA received extensive comments on this proposal and, as a
result, has made significant changes in the final rule to allow for
additional flexibility in measuring and mitigating high consequence
events. The following subsections provide an overview of the finalized
CEC requirements in Sec.  450.101(c), the FAA's rationale
for making the change, and specific responses to comments. The FAA
notes that this section of the preamble focuses on CEC as a
means to measure the potential for high consequence events under Sec.
450.101(c). CEC will be discussed further in the preamble
sections addressing Sec. Sec.  450.108 (Flight Abort) and 450.145
(Highly Reliable Flight Safety System).
i. Sec.  450.101(c)
    In the NPRM, proposed Sec.  450.101(c) would require an operator to
use flight abort as a hazard control strategy if the consequence of any
reasonably foreseeable vehicle response mode, in any one-second period
of flight, is greater than 1 x 10-\3\ CEC for
uncontrolled areas. The FAA further proposed that the requirement would
apply to all phases of flight, unless otherwise agreed to by the
Administrator based on the demonstrated reliability of the launch or
reentry vehicle during that phase of flight. Although not specifically
spelled out in the regulatory text, the FAA explained in the preamble
that Sec.  450.101(c) was designed to ensure the public was
sufficiently protected against low probability, high consequence events
using CEC as a measure of the potential for high consequence
events.
    In the final rule, the FAA retains the use of CEC as a
quantitative criteria that an applicant may use to measure the
potential for high consequence events. However, as explained in the
preamble section addressing Sec.  450.101(c)(2), the FAA revises Sec.
450.37(b) (Equivalent Level of Safety) to allow an applicant to propose
an alternative way to measure high consequence events other than by
CEC. The final rule also allows multiple ways an applicant
may protect against a low probability, high consequence event in
uncontrolled areas for each phase of flight in Sec.  450.101(c)(1)
through (3). As discussed in more detail later in this section, an
operator sufficiently protects against a high consequence event by (1)
using flight abort in accordance with Sec.  450.108; (2) demonstrating
that CEC is below a certain threshold without any FSS; or
(3) demonstrating sufficient vehicle reliability and in consideration
of CEC.\54\ The FAA changes the heading of Sec.  450.101(c)
from ``Flight Abort'' in the NPRM to ``High Consequence Event
Protection'' in the final rule because this section allows an operator
in certain circumstances to use a method other than flight abort to
protect against high consequence events.
---------------------------------------------------------------------------

    \54\ A CEC value is calculated as the mean number of
casualties predicted to occur given a specified failure mode in a
given time interval with a probability of 1.
---------------------------------------------------------------------------

    Multiple commenters, including CSF, Sierra Nevada, and SpaceX,
stated that the NPRM requirements in Sec.  450.101(c) were too
prescriptive and objected to the lack of an explicit provision allowing
an applicant to propose another approach to address a high consequence
event, absent a waiver. The FAA agrees that the final rule should
provide additional flexibility and discusses those changes in more
detail later in this section.
    Multiple commenters, including CSF and Virgin Galactic, indicated
that the EC collective risk criteria alone should be enough
to establish the need for an FSS, the reliability of the FSS, and when
an FSS would be required to be activated to ensure public safety.\55\
The FAA finds that the use of collective risk through analyses of
EC and individual risk through analysis of Probability of
Casualty (PC) is inherently inadequate to establish
sufficient protection against low probability, high consequence events
during launch and reentry operations. Whereas PC limits the
maximum risk to an individual and EC limits the average
outcome in terms of casualties in a group of people, both PC
and EC are indifferent to the risk of events that involve
multiple casualties. This indifference means that, if the risk of a
potential event that could result in a high number of casualties is low
enough, the PC and EC criteria would not act to
prevent that event. As explained in the NPRM, the purpose of
CEC is to protect the public from certain high consequence
events, regardless of the probability of those events. Thus, the final
rule includes specific provisions, such as in Sec. Sec.  450.101,
450.108, and 450.145, to ensure adequate protection against low
probability but high consequence events during launch and reentry.
---------------------------------------------------------------------------

    \55\ As proposed, Sec.  450.101(c) simply used CEC to
determine whether flight abort would be required as a hazard control
strategy. Other proposed regulations relied on CEC to
establish FSS reliability and activation of FSS. These regulations
and the response to commenters' concern with using CEC for those
purposes are discussed later in the preamble.
---------------------------------------------------------------------------

    In addition, a conditional risk assessment ensures adequate
mitigation measures are in place to protect against a low probability,
high consequence event in circumstances in which EC and Pc
may not dictate the need for mitigation. As explained in the NPRM,
unlike collective risk that determines the expected casualties
factoring in the probability that a dangerous event will occur,
conditional risk determines the expected casualties assuming the
dangerous event will occur.\56\ This assumption means that using
EC alone may result in a lack of mitigations, such as flight
abort capability and preparedness, for certain high consequence events
because the low probability of occurrence would translate into an
EC below the 1 x 10-\4\ limit. Conversely, using
a conditional risk assessment ensures that, if a high consequence event
is reasonably foreseeable, such as an incorrect azimuth at lift-off,
then an operator will have a mitigation in place to prevent that event
from producing catastrophic results. This result is assured because the
decision to activate an FSS is always made in response to a system
failure in the operational environment, as no operator plans to
implement a flight abort unless the mission objectives include an
intentional test of the FSS.
---------------------------------------------------------------------------

    \56\ See 84 FR at 15298.

---------------------------------------------------------------------------

    Calculating CEC ensures an operator correctly recognizes
certain system failures that may have catastrophic consequences and
builds mitigations into the system to account for those failures. As
such, an FSS is generally activated in the following context: (1) The
vehicle is no longer performing nominally; (2) the vehicle is outside
the limits of a useful mission; \57\ and (3) continued flight would
increase public risks in uncontrolled areas. Hence, the risk to the
public associated with the decision to activate an FSS is inherently
conditioned on the fact that a system failure has occurred. An operator
would only identify a system failure for low probability, high
consequence events if the operator used a CEC-based
analysis, rather than an EC calculation, because a
CEC analysis assumes that the event will occur. Therefore,
relying on the collective risk criteria alone would not adequately
protect against low probability, high consequence events that could
result in multiple public casualties.
---------------------------------------------------------------------------

    \57\ Limits of a useful mission are defined in the final rule as
the trajectory data or other parameters that bound the performance
of a useful mission, including flight azimuth limits. This concept
is discussed in greater detail in Sec.  450.119.
---------------------------------------------------------------------------

    The FAA received several comments regarding the potential for
various launch operations to comply with the proposed CEC
thresholds in the NPRM. Rocket Lab USA, Inc. (``Rocket Lab'') commented
that it would be ``nearly impossible'' for any orbital launch vehicle
to meet the CEC thresholds defined in the proposal and
recommended the use of cumulative risk and individual risk metrics as
additional or alternative means of determining the reliability required
for the flight abort system. Blue Origin also stated that most, if not
all operators, including those operating smaller suborbital launch
vehicles in remote locations, would be forced to implement an FSS that
complies with an unmodified set of USAF requirements. SpaceX
recommended that the FAA gather more detail on CEC for
different launch vehicles and trajectory profiles to evaluate
appropriate lower tiers of reliability.
    The FAA sponsored a series of tasks, performed by ACTA, LLC (ACTA),
to investigate the potential conditional risks associated with a wide
array of past and foreseeable future launch operations using the best
available information and tools. The study \58\ provided an independent
evaluation of the potential for the CEC-related requirements
in the NPRM to necessitate changes to current practice for more than a
dozen missions involving large, medium, and small launch vehicles from
a wide variety of sites. The results of this study demonstrate that the
required reliability of an FSS for relatively small rockets depends
greatly on the launch site. Specifically, the ACTA study found that a
small ELV launched from Cape Canaveral or Wallops Island would need a
highly reliable FSS compliant with proposed Sec.  450.145 to meet the
NPRM requirements, but that a less reliable FSS, such as an FSS
compliant with proposed Sec.  450.143, would suffice for the same
vehicle launched from more remote locations, such as the Mahia
Peninsula and Kodiak Island. To the extent that commenters suggested
proposed Sec.  450.101(c) would require currently licensed operators to
use an FSS, the ACTA study results indicate that no changes would be
required under the final rule regarding the need for an FSS for any
currently licensed launch vehicle launched from a Federal launch or
reentry site.\59\ The ACTA study also indicates that, for operators who
currently employ an FSS to meet the FAA's public risk criteria, their
current practices regarding FSS reliability and activation criteria
would be sufficient to demonstrate compliance with the requirements in
Sec.  450.108.
---------------------------------------------------------------------------

    \58\ The report can be found in docket number FAA-2019-0229.
    \59\ The ACTA study made four notable conclusions:
    1. For two current launch vehicles launched from outside the
continential US, the 1 x 10-\3\ CEC threshold
is not exceeded. Thus, part 450 will not require an FSS for either
of these two launches, yet both are designed to employ an FSS (as
required by part 417).
    2. For ten launch vehicles launched from within the continential
US9, the part 450 CEC requirements are consistent with
current practice, where part 417 requires the highly reliable FSS.
    3. For two piloted launch vehicles, one would require no
changes, and the other would require no FSS although a flight abort
capability is currently employed under part 431.
    4. One current reentry poses CEC well above the 1 x
10-\2\ threshold. Thus, under part 450 this reentry
operation would either need to be modified to reduce the consequence
of failure modes that would result in an intact impact, or be
granted a waiver.
---------------------------------------------------------------------------

    A number of commenters asserted that the proposed CEC
requirements would increase cost for operators, particularly for
current RLV operators.
    CEC analysis is not mandatory. If an operator chooses to
use a Sec.  450.145 compliant FSS, it does not need to do the
CEC analysis to establish if a Sec.  450.145 compliant FSS
is necessary or if a Sec.  450.143 compliant FSS would suffice. A
CEC analysis to establish compliant Flight Safety Limits is
unnecessary if the operator chooses to demonstrate compliance with
Sec.  450.108(c)(6).
    The FAA does not agree that the cost of a CEC analysis
is prohibitively expensive. The FAA provides estimates in the final
Regulatory Impact Assessment of the costs of the CEC
analyses as well as estimates of cost savings on those launches that
will not need an FSS.
    The ACTA study calculated CEC for a sample of licensed
RLVs and the results indicate that the final rule will not require any
changes regarding the FSS robustness and FSS activation criteria
currently used for the operations at the Mojave Air and Space Port. The
ACTA study results suggest that launches from Spaceport America would
not need to use flight abort as a hazard control strategy to meet the
CEC requirements in the final rule. Thus, the ACTA study
suggests the final rule could facilitate a reduction in costs for RLV
launches from non-Federal launch sites for current part 431 licenses
that include flight abort as a hazard control strategy. Ultimately, the
ACTA study indicates that CEC will not drive a requirement
for flight abort for currently licensed RLVs operating from non-Federal
sites and is therefore not expected to drive costs for RLV operators.
In the final Regulatory Impact Analysis, the FAA discusses in detail
estimated voluntary costs to perform CEC analyses as well as
cost savings that result when an FSS is not required.
    Several commenters, including CSF, Rocket Lab, Sierra Nevada,
SpaceX, and an individual commenter, expressed a need for clarification
of acceptable methodologies to compute CEC. CSF and Sierra
Nevada commented that there are no publicly available methodologies or
background for conducting CEC analysis. CSF noted that the
CEC analysis is computationally intensive and approved risk
analysis tools and input data were not readily available. SpaceX stated
it needed guidance on several specific technical issues on the
computation of CEC. Rocket Lab stated that, without
standardized methods and input data, results would vary widely.
    The FAA notes that CEC is inherent in the calculation of
EC for launch or reentry operations. There are extensive
guidance documents available currently that explain methodologies that
can be used to compute EC and, as a byproduct,
CEC as well.\60\ The FAA is aware of at least one operator
that has used these guidelines to develop and implement its own safety
analysis tools to demonstrate

compliance with the current public risk criteria under part 417. Some
tools have already been modified to compute CEC with only a
few hours of effort. Even so, the FAA remains dedicated to improving
the guidance materials available to applicants and plans to provide
additional advisory materials to explain acceptable safety analysis
methods, including those that address any unique aspects of
CEC computations.
---------------------------------------------------------------------------

    \60\ See e.g., the FAA Flight Safety Analysis Handbook v 1.0,
2009 and the Range Commanders Council Risk Committee of the Range
Safety Group, Common Risk Criteria for National Test Ranges--
Supplement, RCC 321-20, White Sands Missile Range, New Mexico, 2020.
---------------------------------------------------------------------------

    Sierra Nevada commented that CEC analysis was not a
widely accepted practice, nor had it been subject to rigorous testing,
and it was not ready to be implemented. In response, the FAA notes that
RCC 321 Standard and Supplement has included conditional risk standards
and guidelines since 2010. Moreover, CEC analysis has been
used to help inform important decisions regarding the safety of
commercial space transportation operations since 2016, when the FAA
first cited CEC as part of a formal waiver evaluation.\61\
As noted in the NPRM preamble, in granting these waivers, the FAA has
adopted the conditional risk management approach, noting that the
predicted consequence was below a threshold of 1 x 10-\2\
CEC.\62\ The FAA further stated in the preamble that
measuring the consequence from reasonably foreseeable, albeit unlikely,
failures is an appropriate metric to assess prudent mitigations of
risks to public health and safety and the safety of property. In recent
years, the USAF has also used CEC analyses to establish
appropriate FSS activation criteria for launch operations from both
CCAFS and VAFB. Most recently, the FAA considered the results of
CEC analyses in granting waivers to the debris containment
requirements in Sec.  417.213(a) and (d) that enabled the SAOCOM-1B
mission to be conducted safely.
---------------------------------------------------------------------------

    \61\ See Waiver of Debris Containment Requirements for Launch.
81 FR 1470, 1470-1472 (January 12, 2016).
    \62\ 84 FR 15312.
---------------------------------------------------------------------------

    Several commenters, including CSF, Sierra Nevada, and SpaceX,
recommended that the proposed CEC-related requirements be
moved to a guidance document as an accepted means of compliance to a
more performance-based regulation to preserve flexibility. CSF stated
that, at a minimum, the quantitative criteria should be moved to a
guidance document.
    The FAA considered replacing the proposed quantitative
CEC criteria with a qualitative standard and moving the
quantitative criteria to a guidance document as one acceptable means of
compliance. However, the FAA finds that a qualitative approach to
determine the three key CEC-related issues (i.e., the need
for flight abort with a reliable FSS as a hazard control strategy, the
reliability standards for any required FSS, and the criteria for
activation of an FSS) would lack regulatory clarity necessary to ensure
a consistent level of public protection, given the wide variety of
launch and reentry operations. As noted by Rocket Lab and other
commenters, even the results of quantitative high consequence event
assessments can vary significantly from operator to operator without
standardized methods and input data.
    Although quantitative CEC is retained in the final rule,
the FAA adds flexibility in both the manner in which a high consequence
may be measured and the manner in which an operator can sufficiently
protect against a high consequence event. First, in the NPRM, ELOS
would not have been allowed for the requirements in Sec.  450.101. As
noted in the discussion of ELOS earlier in the preamble, the FAA has
revised Sec.  450.37 in the final rule to allow operators to use ELOS
to measure a high consequence event under Sec.  450.101(c)(2). Second,
Sec.  450.101(c)(2) permits an operator whose CEC is greater
than 1 x 10-\3\ to propose safeguards other than flight
abort to reduce the CEC below 1 x 10-\3\. These
revisions are discussed in greater detail later in this section.
    Virgin Galactic recommended the FAA provide a definition of
CEC. In addition, Virgin Galactic commented that, in the
NPRM preamble, CEC was described using the phrase, ``without
regard to the probability of failure,'' which appeared to Virgin
Galactic to translate to ``assume 100% failure probability.'' Virgin
Galactic recommended the FAA use the terminology ``assuming the failure
will occur'' and clearly state the probability of failure would be 1,
if that was what was intended.
    The FAA does not agree that CEC should be defined in the
final rule. Rather, the preamble and associated AC (on High Consequence
Event Protection) discuss in detail what the requirement entails and
how to calculate CEC. A CEC value is calculated
as the mean number of casualties predicted to occur given a specified
failure mode in a given time interval with a probability of 1. As
previously mentioned, there are extensive guidance documents currently
available that explain methodologies that can be used to compute
EC and, as a byproduct, CEC as well.\63\ The term
``high consequence'' appears in Sec.  417.107(a)(1)(ii), but the FAA
chose not to define this term formally at this time to allow for
operational flexibility. High consequence events include incidents that
could involve multiple casualties, massive toxic exposures, extensive
property or environmental damage, or events that jeopardize the
national security or foreign policy interests of the United States.
---------------------------------------------------------------------------

    \63\ The FAA notes that CEC is inherent in the
calculation of EC because the total EC for the
operation is the sum of all EC contributions from each
failure mode and failure time, and each EC contribution
for a failure mode and failure time is the probability of failure
multiplied by CEC. Therefore, CEC for a given
failure mode and failure time can be found by dividing the
EC contribution by the probability of failure for that
failure mode and failure time.
---------------------------------------------------------------------------

    Boeing, Lockheed Martin, Northrop Grumman, and ULA provided
regulatory text recommendations for Sec.  450.101(c) including removal
of ``flight abort,'' stating that a distinction needed to be made from
flight abort that was not initiated based on threat to public health
and safety because not all abort systems are considered FSS.
    The FAA understands that the term ``flight abort'' has been used in
other U.S. Government contexts to mean something different, but the FAA
finds that ``flight abort'' accurately describes the required hazard
mitigations while remaining flexible as to implementation. For these
reasons, the FAA will not amend the rule to remove the term ``flight
abort.'' The final rule adopts the proposed definition of flight abort
in Sec.  401.7, which means the process to limit or restrict the
hazards to public health and safety, and the safety of property,
presented by a launch vehicle or reentry vehicle, including any
payload, while in flight by initiating and accomplishing a controlled
ending to vehicle flight. The final rule also adopts in Sec.  401.7 the
proposed definition of ``flight safety system,'' which means a system
used to implement flight abort, for which a human can be a part of an
FSS.
    The FAA finds that the definition of ``flight abort'' is consistent
with current practice for licensed launches and reentries. Most RLVs
use some method to achieve flight abort reliably, either in the form of
a pilot that can safely abort flight using system controls or an
automated system to terminate thrust. Traditional FSS for ELVs are
comprised of an onboard flight termination system, a ground-based
command and control system, and tracking and telemetry systems.
Historically, the flight safety crew monitoring the course of a vehicle
would send a command to self-destruct,

thus aborting the flight, if the vehicle crossed flight safety limits
and in doing so threatened a protected area. Redundant transceivers in
the launch vehicle would receive the destruct command from the ground,
set off charges in the vehicle to destroy the vehicle and disperse the
propellants so that an errant vehicle's hazards would not impact
populated areas. While this method of flight abort through ordnance is
conventional, the existing definition in Sec.  417.3 and the definition
in the final rule do not require an FSS to be destructive.
    In response to commenters' concerns, the FAA finds that the
definitions of ``flight abort'' and ``flight safety system'' adopted in
the final rule remove any perceived confusion over the use of these
terms for the purpose of FAA licensing under part 450.
ii. Sec.  450.101(c)(1)
    Section 450.101(c)(1) states that an operator must protect against
a high consequence event in uncontrolled areas for each phase of flight
by using flight abort as a hazard control strategy in accordance with
the requirements of Sec.  450.108. The FAA has not included the
reference to the CEC threshold of 1 x 10-\3\ in
Sec.  450.101(c)(1) because an operator who uses flight abort in
accordance with Sec.  450.108 has demonstrated compliance with Sec.
450.101(c)'s requirement to protect against a high consequence event
without further inquiry into CEC beyond the requirements in
Sec.  450.108(c). This change is consistent with the concept proposed
in Sec.  450.101(c) of the NPRM that required an operator to use flight
abort with a reliable FSS \64\ if CEC was greater than 1 x
10-\3\ for any phase of flight. Under the proposal, if an
operator elected to use flight abort with an FSS that met the
reliability requirements in Sec.  450.145, the FAA would not have
required the operator to calculate CEC for the purposes of
determining compliance with proposed Sec.  450.101(c) because the
operator opted into flight abort as a hazard control strategy
irrespective of CEC.
---------------------------------------------------------------------------

    \64\ Proposed Sec.  450.101(c) required an operator to use fight
abort with an FSS that met the reliability requirements set forth in
Sec.  450.145. The reference to reliability requirements for FSS has
been moved to Sec.  450.108(b) and will be discussed in that section
of the preamble.
---------------------------------------------------------------------------

    As such, in the final rule, there is no need to reference a
CEC threshold in Sec.  450.101(c)(1) because an operator who
elects to use flight abort as its hazard control strategy and complies
with Sec.  450.108 does not need to calculate CEC (beyond
the requirements in Sec.  450.108(c) discussed later in the preamble)
to determine that it has sufficiently protected against a high
consequence event. Rather, use of flight abort consistent with the
requirements in Sec.  450.108 by itself demonstrates compliance with
Sec.  450.101(c).
    As explained in the next two sections, operators who do not elect
to use flight abort consistent with the requirements of Sec.  450.108
must demonstrate they can protect against a high consequence event by
means other than flight abort. If an operator cannot demonstrate
compliance with Sec.  450.101(c)(2)--including through ELOS--or (c)(3),
the operator would be required to rely on Sec.  450.101(c)(1) as the
only remaining means to protect against a high consequence event.
iii. Sec.  450.101(c)(2)
    In the final rule, Sec.  450.101(c)(2) states that an operator must
protect against a high consequence event in uncontrolled areas for each
phase of flight by ensuring the consequence of any reasonably
foreseeable failure mode, in any significant period of flight, is not
greater than 1 x 10-\3\ CEC. As noted, proposed
Sec.  450.101(c) would have required an operator with a CEC
greater than 1 x 10-\3\ to use flight abort with an FSS that
meets the reliability requirements of proposed Sec.  450.145 except for
a single exception explained in greater detail in the discussion of
Sec.  450.101(c)(3).
    The FAA recognizes that flight abort is not the only method to
protect against low probability, high consequence events. Therefore, in
the final rule, Sec.  450.101(c)(2) allows an operator with
CEC greater than 1 x 10-\3\ in any significant
period of flight to demonstrate protection against a low probability,
high consequence event through means other than flight abort. This
added flexibility in the final rule allows operators to implement other
safeguards that sufficiently protect against a high consequence event.
For example, one company included a design feature in a system so that
a launch failure during downrange overflight would result in break-up
and demise and thus mitigate the risk from the potential for the
capsule to survive intact to impact.
    In addition, although this provision retains the quantitative
CEC threshold proposed in Sec.  450.101(c), the FAA provides
additional flexibility by modifying Sec.  450.37 to allow applicants to
propose alternative approaches that provide an equivalent level of
safety, which can be approved by the FAA without a waiver. The FAA
added this flexibility because it is aware of methods other than using
CEC to measure high consequence events, such as conditional
risk profile. If an operator chooses to propose an alternative means of
measuring a high consequence event, the FAA would expect the
alternative means to account for the potential for any event that would
be expected to produce multiple casualties,\65\ using a method that
demonstrates equivalent level of safety to a CEC analysis.
The operator must ensure that the alternative means accurately assesses
that the operation would not exceed an acceptable threshold for high
consequence events. In order to determine whether an alternative
threshold for high consequence events is acceptable, the FAA will
compare the alternative measurement to the CEC threshold.
Alternatively, the applicant would be expected to demonstrate that
either the consequence of any failure during any significant period of
flight is at least an order of magnitude less than the average results
from a fixed-wing general aviation aircraft fatal accident.\66\
---------------------------------------------------------------------------

    \65\ High consequence events include incidents that could
involve multiple casualties, massive toxic exposures, extensive
property or environmental damage, or events that jeopardize the
national security or foreign policy interests of the United States.
    \66\ The FAA computed this risk profile using NTSB accident data
between 1982 and 2019 for fixed-wing aircraft operated under FAR
parts 91, 135, and 137, excluding aircraft type certificated under
part 25.
---------------------------------------------------------------------------

    For example, the Range Commanders Council Document 321-17, ``Common
Risk Criteria Standards for National Test Ranges'' (RCC 321) includes
catastrophic risk protection provisions that use a ``risk profile.''
\67\ In fact, the FAA currently uses a modified risk profile method to
establish the insurance requirements for certain launch or reentry
operations.\68\ The

FAA understands that risk profiles are currently in use in other
industries \69\ and could be a useful means to quantify the probability
of high consequence events associated with a wide variety of hazardous
operations. However, the computation of a risk profile generally
entails significantly more effort than the CEC evaluation
because a risk profile involves more sophisticated computations and
additional input data. Specifically, the development of a risk profile
for a launch or reentry operation would consist of an evaluation of the
absolute probability of each foreseeable failure mode and the relative
probability of each outcome of each failure mode in terms of the number
of public casualties that could result in uncontrolled areas. The RCC
321 Supplement describes a more simplified and conservative method to
screen for excessive catastrophic risk, which the FAA finds as another
acceptable method to measure high consequence events.\70\ In contrast,
a CEC analysis is independent of the probability of each
failure mode and requires an assessment of only the average outcome of
each failure mode. In addition, the FAA is publishing an AC that
describes how an applicant can demonstrate compliance with Sec.
450.101(c)(2) by showing that the conditional risk profile for its
proposed launch or reentry mission is comparable with the conditional
risk profile empirically derived from evidence from a set of past
fixed-wing general aviation fatal accidents. Finally, the FAA
recognizes that industry may develop new innovative and less burdensome
methods, and therefore the final rule allows applicants to propose
methods other than CEC to measure high consequence events.
---------------------------------------------------------------------------

    \67\ RCC 321-17 defines a risk profile as ``a plot that shows
the probability of N or more casualties (vertical axis) as a
function of the number of casualties, N (horizontal axis),'' such
that the area under a risk profile is equal to the EC. Unlike the
single valued EC, risk profiles illustrate whether the collective
risk is from a relatively low probability, high consequence event or
from more frequent, smaller consequence outcomes.
    \68\ See, e.g., the 2016 Report to Congress ``FAA's Development
of an Updated Maximum Probable Loss Method'' in response to Public
Law 114-90, Section 102. An MPL analysis must model each accident
scenario as a discrete event with discrete results, e.g., no
casualties, exactly one casualty, two casualties, etc. Each accident
scenario also has a quantitative probability of occurrence. The MPL
analysis process involves simulation of many thousands of discrete
accident scenarios that cover the parameter space of the problem
(i.e., all foreseeable accident scenarios for each and every failure
time and vehicle failure mode). The predicted results of all
foreseeable accident scenarios are accumulated into a histogram and
the risk profile is computed as the complementary cumulative
distribution. For details, see Collins, Brinkman, and Carbon paper
``Determination of Maximum Probable Loss'' presented at 2nd IAASS
conference in Chicago, May 2007.
    \69\ For example, Santa Barbara County, California (where
Vandenberg AFB is located) uses risk profiles as part of their
management of public casualty risks from activities that involve
significant quantities of hazardous materials as explained in the
County of Santa Barbara, Planning and Development, Environmental
Thresholds and Guidelines Manual, October 2008. Several European
countries, including the UK and Netherlands, use risk profiles as
part of their governance of a wide array of industries that pose
public risks.
    \70\ For example, the catastrophic risk averse pseudo-
EC contribution from people in ships may be computed
using a standard EC computation but replacing the number
of casualties contributed by type of ship, N, with N raised to an
exponent of 1.5.
---------------------------------------------------------------------------

    In Sec.  450.101(c)(2), the FAA replaces the term ``one-second
period of flight'' in proposed Sec.  450.101(c) with ``significant
period of flight.'' A period of flight would be significant if it is
long enough for a mitigation, such as flight abort, to decrease the
public risks or consequences materially from any reasonably foreseeable
failure mode. The FAA makes this change because it recognizes that for
some launch and reentry concepts, such as relatively slow-moving
vehicles like balloons, a ``significant'' period of flight could exceed
one second. In addition, the FAA foresees circumstances in which an
elevated CEC in a single second of flight would not warrant
additional mitigation, such as when no additional mitigation would
improve public safety meaningfully in terms of the public risks and
consequences. The preamble discussion of Sec.  450.108 contains further
explanation of what constitutes a material decrease.
    Finally, the final rule replaces the phrase ``any reasonably
foreseeable vehicle response mode'' proposed in Sec.  450.101(c) with
``any reasonably foreseeable failure mode'' in Sec.  450.101(c)(2) of
the final rule. The NPRM defined ``vehicle response mode'' as a
mutually exclusive scenario that characterizes foreseeable combinations
of vehicle trajectory and debris generation. Thus, the NPRM would have
required an evaluation of CEC for each foreseeable
combination of vehicle trajectory and debris generation. By replacing
the term ``vehicle response mode'' (VRM) with ``failure mode,'' the
final rule is both less prescriptive and consistent with the current
requirements.\71\
---------------------------------------------------------------------------

    \71\ As part of the demonstration required under Sec.
431.35(c), a part 431 applicant is required in Sec.  431.35(d)(4) to
identify and describe all safety-critical failure modes and their
consequences.
---------------------------------------------------------------------------

    In the NPRM, the FAA defined a VRM as a mutually exclusive scenario
that characterizes foreseeable combinations of vehicle trajectory and
debris generation. As stated in the NPRM, proposed Sec.  450.101(c)
would have required, at a minimum, that an operator compute the
effective casualty area and identify the population density that would
be impacted for each reasonably foreseeable vehicle response mode in
any one-second period of flight in terms of CEC. The NPRM
further explained that the casualty area, population density, and
predicted consequence for each vehicle response mode are intermediate
quantities that are necessary to demonstrate compliance with the
individual and collective risk criteria currently; thus, these new
requirements would not necessarily impart significant additional burden
on operators.
    The draft AC 450.115-1 on High Fidelity Flight Safety Analysis
published for comment in conjunction with the NPRM further explained
that ``VRMs are a combination of debris list and failure modes'' and
provided a description of typical failure modes for launch and reentry
systems, including loss of thrust, engine explosion, attitude control
failure, structural failure, separation failure, guidance or navigation
failure, etc. Because the final rule replaces the term ``vehicle
response mode'' with ``failure mode,'' an operator is no longer
required to evaluate CEC for each foreseeable combination of
failure mode and debris generation. Instead, an operator is required to
evaluate CEC for each reasonably foreseeable failure mode in
any significant period of flight.\72\
---------------------------------------------------------------------------

    \72\ As an example of the distinction between ``vehicle response
mode'' in the NPRM and ``reasonably foreseeable failure mode,'' in
the final rule consider, a loss of thrust (LoT) failure mode. Under
the NPRM, LoT failure mode would need to be accounted for by three
VRMs: A LoT resulting in an intact impact, a LoT resulting in
aerodynamic break-up, and a LoT resulting in explosion due to FSS
activation. Under the NPRM's proposal, the operator would have been
required to compute CEC for three VRMs associated with
LoT, but under the same circumstances the final rule will require
only one CEC for the LoT. The final rule CEC
for LoT will equal the average CEC for the three VRMs
that the NPRM would have required.
---------------------------------------------------------------------------

    Boeing suggested changing the term ``reasonably foreseeable'' to
``credible'' vehicle response modes. The FAA does not agree that the
term ``reasonably foreseeable'' should be replaced by the term
``credible'' in this section. As previously noted, the term
``reasonably foreseeable'' is used in Sec.  431.35 and commonly used in
system safety. In the absence of a compelling reason to change, the FAA
prefers to continue to use language consistent with previous
regulations instead of introducing a new term at this time.
Furthermore, the FAA finds that the term ``credible'' is prone to
errors in judgment whereas the term ``reasonably foreseeable'' is more
readily discerned by analysis (e.g., fault trees).
iv. Sec.  450.101(c)(3)
    In the NPRM, in instances in which CEC was greater than
1 x 10-\3\, proposed Sec.  450.101(c) provided relief from
the use of flight abort if the Administrator agreed that flight abort
was not necessary based on the demonstrated reliability of the launch
or reentry vehicle during a phase of flight. The NPRM preamble cited
the flight of a certificated aircraft carrying a rocket to a drop point
as an example of a phase of flight when the use of an FSS would likely
not be necessary, even though the CEC could be above the threshold
because the aircraft would have demonstrated reliability.
    While the final rule retains the ``demonstrated reliability
concept'' proposed in the Sec.  450.101(c) of the

NPRM, it has been revised and relocated to Sec.  450.101(c)(3). Section
450.101(c)(3) of the final rule states that an operator must protect
against a high consequence event in uncontrolled areas for each phase
of flight by establishing the launch or reentry vehicle has sufficient
demonstrated reliability based on the CEC during that phase
of flight.
    Because demonstrated reliability provides an alternative to flight
abort when CEC is greater than 1 x 10-\3\, it is
appropriate to assess it consistent with the approach to flight abort
and FSS reliability, which depends on CEC with a 1 x
10-\2\ threshold.\73\ Notably, the ARC recommended that the
need for an FSS should be determined by taking into account population
density, the realm of reasonably foreseeable failures, trajectory,
size, and explosive capabilities of the vehicle. CEC
accounts for all those factors. As such, the CEC computed
for a proposed operation is inherent in determining whether the vehicle
has sufficient demonstrated reliability to protect against a high
consequence event. This revision informs operators on the approach the
FAA will take in determining whether the launch or reentry vehicle has
sufficient demonstrated reliability to protect against a high
consequence event.
---------------------------------------------------------------------------

    \73\ In the proposal and the final rule, the FAA uses
CEC not only as a basis to determine whether flight abort
is required but also as a basis to determine the appropriate FSS
requirements. As noted, FSS requirements are discussed later in the
preamble.
---------------------------------------------------------------------------

    More specifically, the FAA will use the demonstrated reliability
and average ground consequence results from fatal accidents involving
U.S. civil aviation aircraft with standard airworthiness certificates
to establish what constitutes sufficient demonstrated reliability to
protect against a high consequence event based on CEC. For
example, a carrier vehicle with a CEC near 1 x
10-\2\ in a given phase of flight would need to have
demonstrated reliability during that phase of flight on par with the
subset of fixed-wing general aviation aircraft that empirically produce
CEF \74\ near 1 x 10-\2\. However, the same
carrier vehicle operated in a more densely populated area could have a
CEC near 1 in a given phase of flight and thus would need to
have demonstrated reliability during that phase of flight on par with
commercial transport aircraft that empirically produce CEF
near 1.\75\ This approach is consistent with the longstanding and often
cited principle that launch and reentry should be no more hazardous to
the public than over-flight of conventional aircraft, as explained in
the NPRM preamble.
---------------------------------------------------------------------------

    \74\ CEF represents conditional expected fatalities
and is used to measure the mean number of fatalities predicted to
occur given an event with a probability of 1. As noted in the NPRM,
the FAA found that about one ground fatality resulted on average
from one-hundred fatal accidents involving US aircraft operated
under part 91 between 1984 and 2013 based on NTSB data. A comparison
of CEC to CEF is appropriate here because the
CEF values cited here are empirical results from aviation
accidents, whereas the CEC values used here are the
results of physics-based computer simulations for launch and reentry
operations. In addition, the differences between aviation and space
operations justify some margin in the tolerability of the
conditional risks predicted for space transportation operations.
    \75\ As noted in the NPRM, the FAA found that about one ground
fatality resulted on average from a fatal accident involving US
aircraft operated under part 121 between 1984 and 2013 based on NTSB
data.
---------------------------------------------------------------------------

    The FAA received multiple comments seeking clarification of the
provision to use demonstrated reliability as a means to ensure a low
probability, high consequence event is sufficiently mitigated. In the
NPRM, the FAA noted that ``demonstrated reliability'' in this context
refers to statistically valid probability of failure estimates based on
the outcomes of all previous flights of the vehicle or stage. For
example, a probability of failure analysis that complies with Sec.
450.131 will provide a valid basis to establish the demonstrated
reliability of a launch or reentry vehicle in a given phase of flight.
That concept is also applicable to Sec.  450.101(c)(3) of the final
rule. Furthermore, the FAA will consider the magnitude of the high
consequence event in determining what level of reliability will be
sufficient to ensure that the high consequence event is mitigated. One
way to show that a vehicle has demonstrated reliability during a phase
of flight is to show that it has demonstrated reliability during that
phase of flight equivalent to a specific aircraft type or an average
aircraft of similar size and performance characteristics with a
standard airworthiness certificate.\76\ The FAA notes an average
aircraft of similar size would have less uncertainty than a specific
type aircraft because there would be more data collected for an average
aircraft, and thus the demonstrated reliability of an average aircraft
could be more readily characterized with a reasonable level of
confidence. Furthermore, both a specific aircraft type and an average
aircraft with a standard airworthiness certificate generally will not
need additional flight abort capability unless the addition of the
rocket substantially increased the risk from a high consequence event.
However, aside from some carrier aircraft used as a component of a
launch vehicle, no launch vehicle, including U.S. government owned and
operated vehicles, to date has a significant amount of historical
flights to ensure sufficient protection against a high consequence
event based on demonstrated reliability in accordance with Sec.
450.101(c)(3).
---------------------------------------------------------------------------

    \76\ As discussed in the preamble section on Hybrid Vehicles,
the FAA agreed with a comment that the FAA should not similarly find
that an aircraft with only an experimental airworthiness certificate
(EAC) would satisfy the demonstrated reliability standard. An
aircraft with an EAC may demonstrate sufficient reliability through
the use of a rigorous flight test program or numerous flights
without a failure as defined in Sec.  450.131.
---------------------------------------------------------------------------

c. Critical Asset and Critical Payload Protection
    Commercial space transportation operations occur increasingly in
close proximity to critical assets. In order to maintain the continuing
functionality of critical assets, the FAA proposed to define ``critical
assets'' in Sec.  401.5 (Sec.  401.7 in the final rule) and add a
quantitative risk criterion (1 x 10-\3\) for the protection
of critical assets during launch or reentry activity under Sec.
450.101 in the NPRM.
    In the final rule, the FAA adopts the ``critical asset'' definition
in Sec.  401.7 with modification, as discussed below. The FAA adopts
the risk criterion as proposed but removes the requirement for
operators to assess the risks to critical assets in preparing a flight
hazard analysis (proposed Sec.  450.109(a)(3)(ii)), debris analysis
(proposed Sec.  450.121(c)(1) and (c)(2)), debris risk analysis (Sec.
450.135), and ground hazard analysis (Sec.  450.185(c)). Instead, in
accordance with Sec.  450.101(a)(4)(iii) and (b)(4)(iii), either the
FAA or a Federal launch or reentry site operator will determine whether
the proposed activity would expose critical assets to a risk of loss of
functionality that exceeds the risk criterion in Sec.  450.101(a)(4) or
(b)(4) and convey any necessary constraints to the operator. The
operator must receive confirmation from the FAA or Federal launch or
reentry site operator that the risk to critical assets satisfies the
risk criterion in Sec.  450.101(a)(4) or (b)(4) prior to launch or
reentry. The FAA anticipates that most critical assets for a given
launch site will be known when an applicant begins pre-application
consultation. Current practice demonstrates that the critical asset
evaluation can often be completed using preliminary flight safety data
(during pre-application or during the license evaluation), sufficient
to show critical assets risks are acceptable. Where the prevailing
weather conditions are important to the critical asset risks, an
assessment is performed either close to or on the day-of-launch.

    In the final rule, the FAA also clarified in Sec.
450.101(a)(4)(ii) and (b)(4)(ii) the Federal procedure by which
critical assets will be identified. To identify critical assets, the
FAA will consult with relevant Federal agencies, and each agency will
identify, for purposes of part 450, any critical assets that the agency
owns or otherwise depends on. The FAA will accept any identification by
the Secretary of Defense that an asset is critical to national
security. For critical assets identified by other relevant Federal
agencies, such as NASA, the FAA will work with the agency to ensure its
identification of critical assets aligns with the requirements of part
450.
    The FAA also adds in Sec.  450.165(a)(5) (Flight Commit Criteria) a
requirement that operators' flight commit criteria include confirmation
from the FAA that the risk to critical assets satisfies the
requirements of Sec.  450.101(a)(4) or (b)(4). Lastly, the FAA sought
comments in the NPRM on its proposal to add to the final rule a
definition for ``critical payload'' and a requirement that the
probability of loss of functionality not exceed 1 x 10-\4\
for each critical payload. The FAA adopts the proposed definition and
requirement in the final rule.
    In the final rule, the FAA adopts the risk criterion proposed for
critical assets in the NPRM. The property protection criteria in Sec.
450.101(a)(4) and (b)(4) are consistent with current practice at
Federal sites. Launch operations from NASA-operated ranges are
currently subject to requirements that limit the probability of debris
impact to less than or equal to 1 x 10-\3\ for designated
assets. The USAF requirement in AFI 91-202 and the Guidance Memorandum
to AFSPCI 13-610 match those proposed by the FAA. The FAA also adopts
its proposal to extend the protection of critical assets to non-Federal
launch or reentry sites because the protection of critical assets is
necessary irrespective of the location of the launch.
    As proposed in the NPRM, a critical asset is an asset that is
essential to the national interests of the United States. The proposed
definition noted that critical assets include property, facilities, or
infrastructure necessary to maintain national defense, or assured
access to space for national priority missions.\77\ In the final rule,
the FAA replaces ``necessary to maintain national defense'' with
``necessary for national security'' to be more consistent with the rest
of 14 CFR Chapter III. The FAA also adds that critical assets may
include those necessary for high priority civil space purposes, for
clarity. An example of this would be infrastructure necessary to
support launch and reentry services to deliver cargo to and from the
International Space Station.
---------------------------------------------------------------------------

    \77\ ``Property'' includes launch vehicles, reentry vehicles,
and payloads.
---------------------------------------------------------------------------

    CSF and SpaceX noted that critical assets are frequently located on
or near Federal launch or reentry sites, and that the current practice
at Federal launch or reentry sites is to allow a site operator or
neighboring operator to waive the critical asset requirement for its
own facilities. The commenters requested the regulation provide a
similar allowance to reduce the frequency with which operators would
need to apply for waivers. SpaceX recommended revising the regulation
to allow for the waiver of an operator's own designated critical
assets, as well as assets that may be shared or used as common
infrastructure at a range.
    The FAA acknowledges that critical assets located on a launch site,
including the launch facility itself, may be exposed to a risk of loss
of functionality that exceeds 1 x 10 -\3\ during launch
activity. The FAA finds that it would be burdensome to require a waiver
of the critical asset protection requirement when a launch site
operated by the U.S. Government or licensed by the FAA allows an
operator to use its facility for launch. Therefore, the FAA revises
Sec.  450.101(b)(4) to not apply the critical asset risk criteria to
property, facilities, or infrastructure supporting the launch that are
within the public area distance, as defined in part 420 Appendix E,
Tables E1 and E2 or associated formulae, of the vehicle's launch
point.\78\ Assets that fall within this exception, located at Sec.
450.101(b)(4)(v), are exempt from the critical asset protection
requirements in Sec.  450.101(a)(4)(i) and (b)(4)(ii) for a licensed
launch.
---------------------------------------------------------------------------

    \78\ Part 420 defines public area distance as ``the minimum
distance permitted between a public area and an explosive hazard
facility.''
---------------------------------------------------------------------------

    Assets excepted from risk criteria are determined by the required
distance to a public area specified in Table E-1 or E-2 or associated
formulae in Appendix E to part 420, using the quantities of propellants
or other explosives on the vehicle, including any payloads. These
distances are equivalent to Inhabited Building Distances commonly
observed on Federal launch or reentry sites to protect critical assets.
The exception limits consideration to quantities of propellants on the
vehicle, including any payloads. Any critical assets within this area
that are not supporting the activity would be subject to the risk
criteria. This exclusion would be applicable from ignition or at the
first movement that initiates flight, whichever occurs earlier, and end
when the launch ends.
    The FAA received many comments on the definition of ``critical
asset.'' ULA expressed support for the proposed definition. A number of
commenters, including CSF and Sierra Nevada, asked who will determine
whether an asset is ``critical'' and how the determination would be
communicated to an applicant. Virgin Galactic commented that the
proposed definition is vague and did not provide enough information to
the operator to ensure protection of critical assets because the
definition could potentially apply to all property at a Federal site.
Virgin Orbit commented that the lack of clarity could result in Federal
agencies incorrectly concluding their assets were protected. CSF and
SpaceX commented that there was no limit on the number or location of
assets for which an operator would need to perform a risk analysis. CSF
and SpaceX recommended the definition of ``critical asset'' be limited
to U.S. Government assets located on Federal property that the
Secretary of Defense or Administrator of NASA determines to be
essential to the national interests of the United States. Boeing,
Lockheed Martin, Northrop Grumman, and ULA recommended critical assets
be defined as assets for which incapacitation or destruction would have
a very serious, debilitating effect on national defense, or assured
access to space for national priority missions. The commenters noted
this change would be consistent with the definition in DCMA-MAN 3401-
02, Defense Industrial Base Critical Asset Identification and
Prioritization. Furthermore, the commenters stated that classification
as a critical asset should be determined by minimum criteria (not
specified in the comment) and an assessment by the asset owner.
    The FAA disagrees that the definition of ``critical asset'' is
vague or overbroad. The proposed definition, along with the examples
provided in the NPRM preamble, bound the scope of critical assets
appropriately and provide sufficient clarity for operators. Only those
facilities, property, or infrastructure that are necessary for national
security purposes, high priority civil space purposes, or assured
access to space for national priority missions will be deemed critical
assets under Sec.  401.7. Critical assets will also include certain
military, intelligence, and civil payloads, including essential
infrastructure when directly supporting the payload at the launch site.
The FAA provided several examples of critical

assets in the NPRM. Critical assets include assets that, if
incapacitated or destroyed, would have a serious, debilitating effect
on national security or assured access to space for national security
missions, but the FAA disagrees that the additional words proposed by
the commenters add clarity beyond the proposed definition.
    Virgin Orbit's concern that Federal agency may assume incorrectly
that a critical asset was protected is alleviated by the fact that
critical assets will be identified by Federal agencies that own or
otherwise depend on assets that are essential to the national interests
of the United States. The FAA will work with operators to identify any
measures that operators may need to undertake in order to protect
critical assets to the level required by Sec.  450.101(a)(4) or (b)(4).
    With respect to the concern that Federal agencies might be inclined
to overestimate their assets as critical, the FAA does not find that
experience at Federal launch or reentry sites warrants such a concern.
In fact, discussions with safety officials at CCAFS indicate that the
risk to critical assets or critical payloads has rarely exceeded the
risk thresholds adopted by the FAA. Federal launch or reentry sites
have not excessively designated assets as critical, nor have they
imposed significant restrictions on launch activity. When approving the
use of their sites for launch activity, Federal sites consider the
potential of launch activities endangering other facilities. Similarly,
other users of the site do not knowingly put their assets at risk. The
FAA maintains that similar considerations would hold at non-Federal
sites. Non-Federal launch or reentry site operators will consider the
siting and scheduling of activities to avoid one user's activity
threatening the assets of another user. Occasionally, delays in one
site user's activity may necessitate rescheduling another user's
activity. Otherwise, a new activity that was not anticipated when
siting decisions were made, such as fly-back of a stage, is most likely
to expose a critical asset to risk exceeding the criterion.
    Only property, facilities, or infrastructure located close to the
launch point might typically be expected to exceed the criteria, and
those assets are generally associated with the subject launch
operation. As discussed in this section, the FAA revised Sec.
450.101(a)(4) to eliminate the need to seek waivers for assets located
within the immediate vicinity of a launch point during the launch.
Although many of these assets may be critical, meeting the critical
asset criteria would be impractical during a launch from the particular
launch point. Hence, assets located within the public area distance
required by part 420 during a licensed launch are exempt from the
critical asset protection requirements in Sec.  450.101(a)(4)(i) and
(b)(4)(i). As such, the FAA anticipates that operations exceeding the
risk criteria for critical assets will continue to be few, resulting in
minimal restrictions on launch activity.
    The FAA maintains that establishing explicit risk criteria for
protecting critical assets in this final rule provides a level of
certainty. Launch and reentry site operators will have a metric to
determine what activities are appropriate for various locations on
their sites. Either the FAA or Federal site will perform any necessary
analysis, and will provide written confirmation to the operator that
the criteria in Sec.  450.101(a)(4) or (b)(4) have been met. If the
risk to critical assets posed by the proposed activity exceeds the
criteria in Sec.  450.101(a)(4) or (b)(4), then the FAA will work with
asset owners and operators to reach solutions that allow operations
without sacrificing safety to the critical assets or mission
objectives.
    The FAA does not adopt the suggestion by CSF and SpaceX to limit
critical assets to U.S. Government assets located on Federal property
that the Secretary of Defense or the Administrator of NASA determines
to be essential to the national interests of the United States. Federal
entities other than the DOD and NASA might own or otherwise depend on
critical assets, such as NOAA. Thus, it would be inappropriate to
assign the determination of critical assets to only these agencies.
However, as noted earlier, critical assets will be identified by
Federal agencies, such as DOD and NASA, which own or otherwise depend
on assets that are essential to the national interests of the United
States, and the FAA will accept any identification by the Secretary of
Defense that an asset is critical to national security. Note also that
the FAA does not limit the definition of ``critical assets'' to assets
that are owned or located on property owned by the U.S. Government. As
stated in the NPRM, the FAA extended the protection of critical assets
to non-Federal launch or reentry sites, which previously had no
regulatory assurance of protection from loss of functionality of
critical assets. The FAA maintains the same safety standards for
critical assets for launches that take place on a Federal launch or
reentry site as those that take place on a non-Federal launch or
reentry site, some of which are dual use, supporting both commercial
and military operations. Similarly, as explained in the NPRM the FAA
will deem any commercial property that meets the definition set forth
in Sec.  401.7 a critical asset.
    Blue Origin asked the FAA to provide examples of critical
infrastructure. The FAA notes that in the past, the launch complexes at
CCAFS that support Atlas V and Delta IV launches have been designated
as critical assets because they support missions essential to the
interests of the United States.
    An individual commenter recommended the FAA define categories of
national security interests, including cybersecurity, security
controls, and classification level. Although these are important
national interests, they are not by themselves critical assets, and the
FAA does not find it necessary to add categories of national security
interests.
    Airlines for America (A4A) recommended the FAA extend the safety
protections of critical assets to include critical aviation
infrastructure, including airports. The FAA notes that the definition
of ``critical asset'' does not preclude aviation infrastructure from
being a critical asset. More generally, the definition of ``critical
asset'' can include non-space associated assets, including those not
located at or adjacent to a launch or reentry site. However, the
criterion for loss of functionality likely limits aviation
infrastructure assets from being subject to protection.
    Commenters were divided on the need for critical asset protection.
ULA acknowledged the need for protection of critical assets. Virgin
Galactic questioned whether the FAA's proposed critical asset
requirements were within the FAA's statutory authority, as title 51 did
not reference ``national interests'' or ``national priority missions.''
Blue Origin acknowledged the FAA's statutory authority to protect
property and asked the FAA to explain how it will interpret and
implement this authority. An individual commenter stated only assets
directly related to national security should be given heightened
protection. CSF, Spaceport Strategies, LLC (Spaceport Strategies), and
SpaceX commented that critical assets were already protected by current
requirements at Federal launch and reentry sites, rendering the FAA's
regulations duplicative. SpaceX added that NASA or DOD may not agree
with the FAA's proposed critical asset requirements, which may lead to
further duplication of requirements at Federal sites.

    The FAA has the authority to protect critical assets. The
Commercial Space Launch Act authorizes the DOT, and the FAA by
delegation, to protect public health and safety, safety of property,
and national security and foreign policy interests of the United
States. In carrying out its responsibility to protect property, the FAA
has established a quantitative requirement to protect assets that are
essential to the national interests of the United States. As noted in
the NPRM, national interests go beyond national security and include
infrastructure such as that used to support high priority NASA
missions. As noted earlier, an example of this would be infrastructure
necessary to support launch and reentry services to deliver cargo to
and from the International Space Station.
    As CSF, Spaceport Strategies, and SpaceX noted, the FAA's critical
asset requirements codify current practice at Federal launch or reentry
sites, but also extend the same regulatory protection for launch or
reentry activity at non-Federal launch or reentry sites. Although
critical assets are primarily located on Federal launch or reentry
sites at this time, the FAA foresees increased commercial space
activity at non-Federal sites that may result in the presence of
critical assets at those sites. In licensing commercial launch or
reentry activities, the FAA safeguards critical assets--which by
definition are essential to the national interests of the United
States--irrespective of their location.
    The FAA does not find the critical asset requirements to be
unnecessarily duplicative of requirements at Federal launch or reentry
sites. As discussed in the NPRM, the FAA proposed these requirements to
further the goal of common standards for launches from any U.S. launch
or reentry site, Federal or non-Federal. Inclusion of critical asset
protection in FAA regulations aligns FAA licensing with Federal launch
or reentry site requirements and removes duplication of effort. The FAA
closely coordinated the critical asset requirements with the CSWG and
its interagency partners, including NASA and DOD. As a result of this
coordination, the FAA anticipates that the methodologies used by the
Federal launch or reentry sites will satisfy the FAA's requirements for
critical asset protection.
    Many commenters, including AIA, Blue Origin, Boeing, CSF, Lockheed
Martin, Northrop Grumman, Sierra Nevada, SpaceX, Virgin Galactic, and
ULA raised concerns about how an applicant would obtain the information
necessary to perform the proposed critical asset analysis, including
proprietary or confidential information. CSF and SpaceX noted the same
data should be provided to all operators to ensure the fair and
unbiased application of this regulation. Sierra Nevada recommended the
FAA provide a method of acceptable means of compliance that does not
require a commercial company to contract with DOD to complete this
analysis. Alternatively, Sierra Nevada recommended the FAA provide the
analysis instead of the applicant. CSF and SpaceX also recommended the
FAA publish an AC that would provide an acceptable means for analyzing
critical assets, describe how the FAA would obtain a definitive list of
critical assets, and how the FAA would provide operators the data
necessary to conduct the analysis. Blue Origin stated that, by
requiring information that includes data from other entities, the FAA
would become responsible for facilitating acquisition of this data or
would risk implementing a requirement that would not be possible to
comply with or a requirement that would establish a sole source
provider of a service.
    The FAA acknowledges the practical problems an applicant would
likely encounter in collecting the input data necessary to identify and
perform a risk assessment for critical assets, especially critical
payloads. The FAA agrees with Sierra Nevada that it would be better for
the U.S. Government to perform all critical asset and critical payload
risk assessments necessary to ensure operators comply with the risk
criteria in part 450. The FAA therefore removes the requirement for
operators to assess the risks to critical assets in preparing a flight
hazard analysis, debris analysis, and debris risk analysis. The FAA
also removes from Sec.  450.185 (Ground Hazard Analysis) the
requirement that the ground hazard analysis ensure that the likelihood
of any hazardous condition that may cause damage to critical assets is
remote. The FAA notes that the input data and analysis tools necessary
to perform a risk assessment for critical assets are often a subset of
those the FAA uses to establish the MPL values. The FAA will perform
all critical asset and critical payload risk assessments for commercial
space transportation operations involving non-Federal sites. Hence,
operators should not bear additional cost for the analyses associated
with critical assets.
    Blue Origin asked how the FAA will address overflight of critical
assets. The FAA notes that overflight of a critical asset is possible
if the safety criteria set forth in Sec.  450.101 are satisfied. Past
experience demonstrates that the critical asset criteria in Sec.
450.101 are satisfied except in occasional cases involving critical
assets located within the same launch site. Historically, the risk to
critical assets from overflight outside the launch site is negligible.
    Virgin Galactic asked how an operator would have input on or
dispute the determination of a critical asset. The FAA will discuss
with operators any concerns they may have about ensuring protection of
critical assets during their licensed activities, but the FAA is not
proposing a formal dispute mechanism to adjudicate its determination
that an asset is critical or threatened within the risk criterion.
Often, it might not be possible to share such information due to
national security issues and proprietary interests. The FAA notes,
however, that if the FAA denies an application for a license based on
its determination that the proposed activity exceeds the risk threshold
for critical assets, an applicant may request reconsideration under
Sec.  413.21 or a hearing in accordance with part 406 of this chapter.
    CSF asked how the FAA will manage proprietary and national security
concerns among operators and asset-owners. The FAA does not foresee a
need to share proprietary data with non-Federal entities because the
Federal Government will conduct the assessment of critical asset risk
on behalf of the licensee. Based on discussions with relevant Federal
agencies, it is also possible to perform an assessment of critical
assets without disclosing the precise location or nature of each asset,
thereby eliminating the need to share proprietary and national security
information. For example, the USAF 45th Space Wing/Wing Safety
identifies what facilities are threatened within the thresholds and
shares that information with the appropriate tenants. The tenant can
then inform the USAF, or another entity performing the analysis, that
an asset is threatened without divulging sensitive information to any
entity outside the U.S. Government. The FAA will work with the entities
responsible for critical assets to ensure any necessary coordination,
taking into account the need to protect proprietary and confidential
data.
    Several commenters, including CSF, SpaceX, and Virgin Galactic
requested clarification as to the meaning of ``loss of functionality''
and how the FAA or other entity would determine what could result in
the ``loss of functionality'' of a critical asset. CSF sought
clarification on whether infrastructure was ``critical'' if it was
needed to support full functionality of a critical asset and on the
standard for

determining whether an asset's function had been lost. It inquired
whether it would matter if the function could be restored in a timely
manner or met with an alternative asset.
    CSF and SpaceX also recommended that ``loss of functionality'' be
defined in Sec.  401.7 as an asset designated critical by the Secretary
of Defense or Administrator of NASA that (a) has been rendered unable
to support a specific mission or program deemed critical to the
national interest; (b) for which the loss of function will preclude the
assurance of a time-critical mission or program unless promptly
restored; or (c) for which the asset's function cannot be restored by
an accelerated recovery strategy or replaced by an alternate means of
mission/program execution. SpaceX and Virgin Galactic requested the FAA
include this new definition in an SNPRM, along with a clear rationale
for the FAA's proposed requirements for protecting critical assets.
    Under the final rule, the party responsible for the critical asset
would determine what constitutes loss of functionality. The FAA
recognizes that the threshold conditions that cause loss of
functionality will be different depending on the type of asset and its
robustness. For example, infrastructure is typically more robust than a
payload that may be more fragile. For this reason, the FAA does not
elect to incorporate a specific standard for what may constitute loss
of functionality into the final rule. Likewise, the FAA does not find
that it is useful to create a more detailed definition of ``loss of
functionality'' but agrees that considerations such as those suggested
by CSF and SpaceX (e.g., ability to support missions critical to
national interests, or ability to repair or restore function through
alternative means in a timely manner) would be relevant and appropriate
to determining loss of functionality.
    An individual commenter stated that critical asset protection
should not compromise protection of the public and neighboring
operation personnel. The commenter stated that an operator's required
insurance should already cover losses to critical assets.
    The FAA notes that the critical asset protection requirements will
not compromise the protection of the public or neighboring operation
personnel. The FAA retains stringent requirements for protecting the
public, including neighboring operations personnel, which are
independent of the requirements protecting critical assets. The FAA
also disagrees with the commenter that an operator's financial
responsibility requirements are adequate to protect critical assets.
The FAA is limited by statute to imposing no more than $100 million in
financial responsibility to compensate for losses to U.S. Government
property. The value of many critical assets easily exceeds that limit,
with some critical payloads reportedly costing over a billion dollars.
More importantly, financial compensation for a loss may not address the
delay before repairs or replacement, during which time national
security might be jeopardized or the opportunity to accomplish
important national interests missed.
    The FAA sought comments on its proposal to require a more stringent
criterion for critical assets of utmost importance to the U.S., to be
defined as ``critical payloads'' in Sec.  401.7. The FAA proposed to
require that the probability of loss of functionality for critical
payloads, including essential infrastructure when directly supporting
the payload, not exceed 1 x 10-\4\. In the past, Federal
launch or reentry sites have, on occasion, applied a more stringent
requirement, limiting the probability of debris impact caused by launch
or reentry hazards to less than or equal to 1 x 10-\4\ for
national security payloads, including essential infrastructure when
directly supporting the payload at the launch site. The FAA asked
commenters to identify (1) the impacts a 1 x 10-\4\ risk
criterion would have on their operations if applied to critical
payloads; (2) whether a more stringent risk criterion should be imposed
on any commercial payload; and (3) potential additional costs and
benefits associated with applying a 1 x 10-\4\ risk
criterion to critical payloads.
    In the final rule, the FAA adopts the risk criterion and definition
as discussed in the NPRM preamble, with minor clarifications.
    ULA supported the 1 x 10-\4\ risk criterion for critical
payloads, stating that given the time and expense associated with
replacing these assets, it was essential they receive the greatest
protection possible. It further commented that this risk criterion
should also apply to infrastructure and booster hardware in direct
support of critical payloads, beginning when booster hardware for that
particular critical payload was received and began processing at the
launch site. Under ULA's suggestion, at the completion of the launch
campaign, the risk criterion should revert to 1 x 10-\4\.
Virgin Galactic, however, commented that it was not necessary to adopt
a heightened risk criteria for critical payloads. It saw no benefit to
the discussed 1 x 10-\4\ requirement over the 1 x
10-\4\ requirement. It also inquired whether the criterion
would apply to payloads on the vehicle of the operator that might be
subject to this new risk threshold. If so, Virgin Galactic stated this
would constitute managing mission success. Virgin Galactic also
inquired whether this risk criterion would apply to payloads at
neighboring launch sites. If so, Virgin Galactic believes the FAA must
demonstrate need and a nexus to statutorily obligated concerns. It
further stated that a more stringent criterion for commercial payloads
would place undue burden on operators, potentially requiring additional
analyses or redesign. Virgin Galactic noted that it did not intend to
carry critical payloads, so impacts to its operations from this
requirement would be negligible.
    In the final rule, the FAA defines a critical payload as a payload
and essential infrastructure directly supporting such a payload that is
a critical asset (1) that is so costly or unique that it cannot be
readily replaced, or (2) for which the time frame for its replacement
would adversely affect the national interests of the United States. As
noted in the NPRM, a commercial payload that meets this definition will
be treated as a critical payload. The critical payload protection
requirement does not apply to payloads on the vehicle of the operator
regulated under part 450 but will apply to payloads on neighboring
launch sites. The FAA agrees with ULA that the 1 x 10-\3\
risk criterion should apply to essential infrastructure directly
supporting the critical payload, and notes that it will likely apply to
booster hardware in direct support of the launch of a critical payload.
After a launch of a critical payload, the infrastructure supporting the
launch will be critical only if it is essential to the national
interests of the United States. The risk criterion determines the
protection required for critical assets and payloads. It is not
necessary to specify in the regulation that this requirement does not
apply during activities that do not exceed the risk threshold.
    The FAA disagrees with Virgin Galactic that there is no benefit in
applying a 1 x 10-\4\ risk criterion to critical payloads.
As explained in the NPRM, during the interagency review process, DOD
requested that the FAA consider specifying a more stringent criterion
for certain critical assets of utmost importance. The FAA considers a
critical payload a type of critical asset. The FAA finds it necessary
to protect payloads such as vital national security payloads and high-
priority NASA and NOAA payloads. The NPRM noted that a payload such as
NASA's Curiosity rover would likely be afforded this

protection. In the final rule, the FAA adopts this higher protection
criterion to safeguard those payloads of utmost importance to the U.S.
meriting a greater degree of protection than other critical assets.
While the FAA is providing for heightened protection for critical
payloads, it expects the protection to have minimal effects on
commercial launch and reentry operations. Currently there are few
commercial payloads that would rise to the level of being considered
critical payloads, although the FAA recognizes that might change in the
future, if for instance, DOD were to rely on a commercial service for
critical communication support.
    Virgin Galactic requested the FAA adopt neither 1 x
10-\3\ nor a more stringent criterion. It argued the
proposed requirement contradicted the requirement in 51 U.S.C. Sec.
50901(a)(7) that the FAA regulate only to the extent necessary. Virgin
Galactic stated the FAA did not show why these requirements were
necessary, given that Federal launch or reentry sites already protect
their own property. Furthermore, Virgin Galactic commented that the FAA
would be enforcing a more stringent, but undisclosed criterion and
argued the proposed regulation was non-transparent and would deprive
the public of the opportunity to comment on this criterion as required
by the Administrative Procedure Act. The commenter asserted this
undisclosed criterion could prevent operators from planning ahead and
would create two standards that might conflict.
    As articulated in the NPRM, the FAA finds it necessary to codify
current practice at Federal launch or reentry sites to protect critical
assets that are of utmost importance to the U.S. and to extend the same
protections for launch or reentry activity conducted at non-Federal
sites. For launches from Federal sites, this rule does not change
current practice; rather it incorporates that practice in a regulation.
This regulation consolidates the FAA's requirements for protection of
critical assets and critical payloads in all commercial launch or
reentry operations, in accordance with the FAA's statutory authority.
This rule reduces the need for a Federal or non-Federal site operator
to impose critical asset protection requirements on operators as a
contractual condition for the use of its facility. The FAA expects that
the instances in which a more stringent criterion will be necessary
will be rare. Preserving the flexibility to protect particularly vital
assets at a more stringent criterion in a license, as proposed in the
NPRM, is consistent with current practice at Federal launch and reentry
sites and will reduce the need for a Federal or non-Federal launch site
operator to impose a more stringent criterion on operators through
contract.
    CSF and SpaceX commented that the FAA did not assess the cost
burden on industry for compliance with the critical asset requirements.
Virgin Orbit commented that critical asset calculations would require
additional analysis and resources.
    In the final rule, the FAA's removal of the requirements for
operators to assess impacts to critical assets in flight hazard, ground
hazard, debris or debris risk analyses assuages the commenters'
concerns for costs associated with performing those analyses. As
compared to the proposal, there will be much reduced administrative
burden on the operator. The FAA will coordinate as necessary with
critical assets owners, and either the FAA or the Federal site operator
will provide written confirmation to the operator that the criteria in
Sec.  450.101(a)(4) or (b)(4) have been met. If the FAA or Federal site
operator determines that the criteria have not been met, either the FAA
or Federal site operator will work with the operator to identify any
measures that operators may need to undertake in order to protect
critical assets to the level required by Sec.  450.101(a)(4) or (b)(4).
    An individual commenter stated that the proposed regulation would
require companies to perform trade studies to determine if additional
controls would be needed to reduce the likelihood of critical asset
loss of functionality. The commenter requested the FAA require a cost-
benefit analysis to ensure that upfront investment of controls to
protect critical assets would be less than the cost of replacing that
asset.
    When determining whether an asset is a critical asset, the cost of
an asset is a factor. However, ultimately an asset is critical if it is
essential to the national interests of the United States. If it cannot
be replaced in a time frame that satisfies those interests, the cost of
the asset is irrelevant. Furthermore, the FAA does not find that most
mitigations will impose significant cost.
    Virgin Galactic indicated the need for FAA assistance in planning
hazard control strategies pursuant to proposed Sec.  450.107(e)(2)(ii)
\79\ due to the secrecy of some critical assets. If an operator is
using physical containment as a hazard control strategy, the FAA or
Federal launch or reentry site operator will work with the operator to
ensure no critical assets are within the flight hazard area. The most
likely mitigation is shifting the launch point or, if the critical
asset is mobile, changing in the launch schedule.
---------------------------------------------------------------------------

    \79\ As proposed, an applicant using physical containment as a
hazard control strategy would have been required to describe the
methods used to ensure that flight hazard areas are cleared of the
public and critical assets. This requirement has been relocated to
Sec.  459.110(c)(2) in the final rule.
---------------------------------------------------------------------------

    Sierra Nevada requested the FAA conduct a publicly-available
assessment to determine if the proposed critical asset protection
requirements would impact an operator's MPL calculation. CSF requested
the FAA engage industry on the topic of critical assets.
    The FAA does not find that the protection of critical assets will
increase MPL. The designation of an asset as critical is unrelated to
financial responsibility. In performing its MPL calculation for U.S.
Government property, the FAA ascertains the financial responsibility
required so that the likelihood of exceeding losses to government
property involved in a licensed activity (taken to mean such property
on a Federal launch or reentry site) that are reasonably expected to
result from that activity does not exceed 1 x 10-\5\; or, in
the rarer situation in which a critical asset might not be U.S.
Government property on a Federal launch or reentry site, 1 x
10-\7\. Critical assets are protected to a less stringent 1
x 10-\3\, or in the case of certain critical payloads, 1 x
10-\4\, and financial responsibility and protection are not
directly related. If anything, the requirement to protect critical
assets has the potential to lower MPL for U.S. Government property
because the mitigation employed may well remove the possibility that
the asset can be damaged even within the more stringent MPL threshold.
This would be the case if, to avoid placing the critical asset at risk
a launch was rescheduled, its trajectory adjusted, or the critical
asset was moved or physically protected. The FAA finds that it is
unlikely that a mitigation employed to protect critical assets will
change the MPL for third-party liability.
d. Other Safety Criteria (Sec.  450.101(d), (e), (f), and (g))
    The FAA adopts the criteria in Sec.  450.101(d), (e), (f), and (g)
with no changes. Section 450.101(d) addresses disposal safety criteria,
Sec.  450.101(e) is the requirement for the protection of people and
property on orbit, Sec.  450.101(f) requires the notification of
planned impacts, and Sec.  450.101(g) addresses the validity of
analyses.
    The FAA received public comments from Virgin Galactic on the
notification of planned impacts. Specifically, Virgin

Galactic advised that a carrier aircraft operating under an
airworthiness certificate should be exempt from proposed Sec.
450.101(f). This comment is discussed in further detail in the preamble
section on hybrid vehicles. The FAA will not exempt all hybrid vehicle
operators from the requirement in Sec.  450.101(f). If an operation has
no planned impacts from debris capable of causing a casualty, then no
notification will be necessary to comply with Sec.  450.101(f). The
regulation is adopted as proposed.
e. System Safety Program (Sec.  450.103)
    In the NPRM, the FAA proposed in Sec.  450.103 that an operator
must implement and document a system safety program throughout the
operational lifecycle of a launch or reentry system. The system safety
program was proposed to include a safety organization (Sec.
450.103(a)), procedures to evaluate the operational lifecycle of the
launch or reentry system (Sec.  450.103(b)), configuration management
and control (Sec.  450.103(c)), and post-flight data review (Sec.
450.103(d)).
    In the final rule, the FAA adopts proposed Sec.  450.103 with
revisions. The FAA replaced the term ``operational lifecycle'' in the
introductory paragraph of Sec.  450.103 with simply ``lifecycle'' to
clarify that the regulation applies to hazards throughout the lifecycle
of a launch or reentry system, not just operational changes to the
system. This change is consistent with the statements in the NPRM
indicating that, due to the complexity and variety of vehicle concepts
and operations, a system safety program would be necessary to ensure
that an operator considers and addresses all risks to public safety,
which include both design and operational changes to a system.
i. Safety Organization
    In the NPRM, the FAA proposed that the system safety program would
require an operator to maintain and document a safety organization that
has clearly defined lines of communication and approval authority for
all public safety decisions, and that includes a mission director and
safety official. In the final rule, the FAA adopts the proposed rule
with a revision. The FAA removes ``and document'' from the proposed
requirement because the first sentence in Sec.  450.103 already
requires a system safety program to be documented.
    Proposed Sec.  450.103(a)(1) stated that for each launch or
reentry, an operator would be required to designate a position
responsible for the safe conduct of all licensed activities and
authorized to provide final approval to proceed with licensed
activities. This position is referred to as the mission director. In
the final rule, the FAA adopts Sec.  450.103(a)(1) as proposed. The FAA
did not receive comments on this section.
    Proposed Sec.  450.103(a)(2) stated that, for each launch or
reentry, an operator would be required to designate a position with
direct access to the mission director who would be responsible for
communicating potential safety and noncompliance issues to the mission
director and would be authorized to examine all aspects of the
operator's ground and flight safety operations, and to independently
monitor compliance with the operator's safety policies, safety
procedures, and licensing requirements. This position would be referred
to as a safety official. The FAA noted in the NPRM preamble that the
absence of a safety official could result in a lack of independent
safety oversight and a potential for a breakdown in communications of
important safety-related information. The FAA also noted that a safety
organization that included a safety official was essential to public
safety; however, identifying that individual by name was not necessary.
In the final rule, the FAA adopts Sec.  450.103(a)(2) as proposed.
Thus, a safety official will need to be in place prior to and
throughout any licensed activity.
    Rocket Lab supported the proposed safety organization documentation
requirements in proposed Sec.  450.103(a), noting the requirements
would provide improved flexibility for the industry and support growth
in operations, while maintaining clear lines of communication and
independence in safety decision making. Virgin Galactic noted that it
agreed with the FAA's approach not to require a specific person be
listed as the safety official. Microcosm inquired if a specific named
safety official would be required for each launch site for operators
with licensed activity at multiple sites, and how far in advance that
information would need to be provided to the FAA.
    The FAA notes that a safety official must be named and in place
prior to the initiation of any licensed activity, and an operator may
use the same safety official for multiple launch or reentry sites. It
may be difficult for a single individual to serve as a safety official
for multiple sites if launch or reentry activities were to occur close
in time to each other. In those instances, an operator may choose to
have multiple safety officials. An operator needs to provide the name
of the safety official to the FAA only when requested. The FAA may
request the name of the individual who will act as a safety official as
part of a compliance monitoring action. As is current practice, the FAA
will coordinate in advance with the operator prior to a compliance
monitoring action.
    ALPA concurred with the requirement for operators to develop a
general system safety program. It also recommended that that embedding
FAA representatives within commercial space companies would assist the
commercial space community in growing robust system safety procedures.
The FAA notes that embedding FAA representatives within commercial
space companies is outside the scope of this rulemaking.
    Proposed Sec.  450.103(a)(3) requires the mission director to
ensure that all of the safety official's concerns are addressed. In the
final rule, the FAA adopts Sec.  450.103(a)(3) as proposed. The FAA did
not receive any comments on this section.
ii. Hazard Management
    Proposed Sec.  450.103(b) would have required an operator to
establish procedures to evaluate the operational lifecycle of the
launch or reentry system, including methods to review and assess the
validity of the proposed preliminary safety assessment and any flight
hazard analysis throughout the operational lifecycle of the launch or
reentry system, methods for updating the preliminary safety assessment
and flight hazard analysis, and methods for communicating and
implementing the updates throughout the organization. For operators
that would need to conduct a flight hazard analysis, the proposed rule
would also require an operator's system safety program to include a
process for tracking hazards, risks, mitigation and hazard control
measures, and verification activities.
    In the final rule, the FAA adopts proposed Sec.  450.103(b) with
revisions. The FAA renames this section ``Hazard management'' to be
more descriptive than the proposed name of ``Procedures.'' The FAA also
does not adopt the proposed requirement in Sec.  450.103(b)(1) to
conduct a preliminary safety assessment because that requirement has
been replaced with the requirement to conduct a hazard control strategy
determination in Sec.  450.107(b) in the final rule, as will be
discussed later.
    As noted, proposed Sec.  450.103(b)(1) would have required the
system safety program to include: (i) Methods to review and assess the
validity of the preliminary safety assessment throughout the
operational lifecycle of

the launch or reentry system; (ii) methods for updating the preliminary
safety assessment; and (iii) methods for communicating and implementing
the updates throughout the organization. For those operators required
to conduct a flight hazard analysis, proposed Sec.  450.103(b)(2) would
have required the system safety program to include the same methods for
the flight hazard analysis and a process for tracking hazards, risks,
mitigation and hazard control measures, and verification activities.
    In the final rule, the FAA consolidates the requirements in
proposed Sec.  450.103(b)(1) and (b)(2) into Sec.  450.103(b)(1) of the
final rule. Section 450.103(b)(1) requires a system safety program to
include methods to assess the system to ensure the validity of the
hazard control strategy determination and any flight hazard or FSA
throughout the lifecycle of the launch or reentry system.\80\ The FAA
added FSA to this requirement because, as proposed in Sec.  450.101(g)
and adopted in the final rule, any analysis used to demonstrate
compliance with Sec.  450.101 must use accurate data. This is
consistent with the proposal because proposed Sec.  450.103(b)(1)(i)
would have required methods to review and assess the validity of the
preliminary safety assessment, which would have included components of
FSA such as vehicle response modes, public safety hazards associated
with vehicle response modes, population exposed to hazards, and
CEC. As previously noted, the final rule in Sec.
450.103(b)(1) uses the term ``lifecycle'' by itself to clarify that the
regulation applies to hazards throughout the lifecycle of a launch or
reentry system, not just operations hazards.
---------------------------------------------------------------------------

    \80\ Proposed Sec.  450.103(b)(1)(ii) and (b)(2)(ii) would have
required the system safety program to include methods for updating
the preliminary safety assessment and flight hazard analysis. In the
final rule, the FAA simplifies the regulatory text of Sec.
450.103(b) in the final rule, which requires an operator to
implement methods to assess the system to ensure the validity of the
hazard control strategy determination and any flight hazard or
flight safety analysis throughout the lifecycle of the launch or
reentry system. Updating the safety analyses is a component of
ensuring their validity.
---------------------------------------------------------------------------

    Proposed Sec.  450.103(b)(1)(iii) and (b)(2)(iii) would have
required the system safety program to include methods for communicating
and implementing the updates throughout the organization. In the final
rule, the FAA consolidates the requirements in proposed Sec.
450.103(b)(1)(iii) and (b)(2)(iii) into Sec.  450.103(b)(2) of the
final rule with a revision. The FAA changes the term ``the updates'' to
``any updates'' to clarify the intent for comprehensiveness.
    Proposed Sec.  450.103(b)(2)(iv) would have required the system
safety program, for operators that must conduct a flight hazard
analysis, to include a process for tracking hazards, risks, mitigation
and hazard control measures, and verification activities. The FAA
adopts the language proposed in Sec.  450.103(b)(2)(iv) of the NPRM in
Sec.  450.103(b)(3) of the final rule with a revision. The FAA deletes
the terms ``hazard control,'' because it is duplicative with the
existing term ``mitigation measures.''
iii. Configuration Management and Control
    Proposed Sec.  450.103(c) would have required an operator to (1)
employ a process that tracks configurations of all safety-critical
systems and documentation related to the operation; (2) ensure the use
of correct and appropriate versions of systems and documentation
tracked under the subsection; and (3) maintain records of launch or
reentry system configurations and document versions used for each
licensed activity, as required by the requirement for records in
proposed Sec.  450.219.
    In the final rule, the FAA adopts Sec.  450.103(c)(1) and (c)(2) as
proposed and revises Sec.  450.103(c)(3) as discussed later.
    Blue Origin commented that tracking and maintaining records of
individual configurations and associated operations documentation for
completed operations does not, by itself, enhance public safety. Blue
Origin believes that changes should be evaluated for safety impact
according to a configuration management plan, which is a deliverable
under the current regulations. Blue Origin stated that an approved
configuration management plan, coupled with continued accuracy of the
application, should suffice without additional requirements for
increased documentation and storage of records.
    The FAA agrees that tracking and maintaining records for completed
operations in isolation does not directly enhance public safety, but
tracking and maintaining records for completed operations is an
important component of configuration management, which, as a whole,
does enhance public safety. The FAA agrees with Blue Origin that an
approved configuration management plan coupled with continued accuracy
of the application should suffice, but does not agree that current
requirements are sufficient. Part 431 does not have any requirements
for configuration management, and Sec.  417.111(e) is more general in
its requirement to define the launch operator's process for managing
and controlling any change to a safety-critical system to ensure its
reliability. Section 450.103(c) adds necessary detail.
    Blue Origin also stated that proposed Sec.  450.103(c) is
repetitive of the recordkeeping requirements in proposed Sec.  450.219,
making it unnecessary. Blue Origin added that if the FAA were to
maintain the requirement, it should be written in the context of
safety-critical systems, which would tie directly to FAA's
responsibility to protect public safety.
    While the FAA considers Sec.  450.103(c) necessary, proposed Sec.
450.103(c)(3) could be perceived as repetitive. Proposed Sec.
450.103(c)(3) would have required an operator to maintain records of
launch or reentry system configurations and document versions used for
each licensed activity, as required by Sec.  450.219 (Records). Section
450.219 requires a licensee to maintain for 3 years all records, data,
and other material necessary to verify that a launch or reentry is
conducted in accordance with representations contained in the
licensee's application, the requirements of part 450 subparts C and D,
and the terms and conditions contained in the license. The FAA removes
the reference to maintaining records in Sec.  450.103(c)(3) and revises
the provision to require an operator to document the configurations and
versions identified in paragraph (c)(2) for each licensed activity.
This is a more focused requirement than Sec.  450.219 and limits the
documentation requirement specifically to safety-critical systems,
consistent with Blue Origin's recommendation.
iv. Post-Flight Data Review
    Proposed Sec.  450.103(d) would have required an operator to employ
a process for evaluating post-flight data to (1) ensure consistency
between the assumptions used for the preliminary safety assessment, any
hazard or flight safety analysis, and associated mitigation and hazard
control measures; (2) resolve any identified inconsistencies prior to
the next flight of the vehicle; (3) identify any anomaly that may
impact any flight hazard analysis, FSA, or safety-critical system, or
would otherwise be material to public health and safety and the safety
of property; and (4) address any anomaly identified in (3) prior to the
next flight, including updates to any flight hazard analysis, FSA, or
safety-critical system. The FAA explained in the NPRM that this
requirement was consistent with industry practice to review post-flight
data to address

vehicle reliability and mission success and that this requirement
imposes no additional burden. The FAA sought comment on whether
proposed Sec.  450.103(d) would change an operator's approach to
reviewing post-flight data.
    In the final rule, the FAA adopts proposed Sec.  450.103(d)(1),
(d)(2), and (d)(4) with revisions, and adopts Sec.  450.103(d)(3) as
proposed. Section 450.103(d)(1) was modified to replace ``preliminary
safety assessment'' with ``hazard control strategy determination'' as
discussed earlier. The FAA also added the word ``flight'' in front
``hazard or flight safety analysis'' to make clear that the requirement
addresses any flight hazard analysis or FSA.
    CSF, Rocket Lab, and Sierra Nevada commented that proposed Sec.
450.103(d) should be deleted because it was overly burdensome and
inconsistent with the directive to streamline the regulations. The
commenters stated that the requirement would extend the industry
practice beyond the typical analysis for reliability and mission
success. Sierra Nevada suggested that the section could be re-written
to address only post-flight data of safety-critical systems.
    As discussed in the NPRM, operator review of post-flight data
provides valuable safety information on future operations. The
inconsistencies that need to be resolved in this subsection are only
those that affect safety analyses and associated mitigation and hazard
control measures, such as greater population in the launch area than
modeled. The anomalies that need to be addressed are only those that
may impact any flight hazard analysis, FSA, or safety-critical system,
or are otherwise material to public health and safety and the safety of
property, such as the momentary drop-out of an FSS. Therefore, while
the FAA revises Sec.  450.103(d)(2) to narrow its applicability, as
discussed below, it declines to remove proposed Sec.  450.103(d)(2).
    Blue Origin proposed a revision of Sec.  450.103(d)(2) to specify
``public safety.'' Virgin Galactic recommended removing the word
``any'' in front of ``identified inconsistencies,'' and recommended
limiting applicable inconsistencies to those that have an effect on the
safety criteria of Sec.  450.101.
    The FAA agrees that proposed Sec.  450.103(d)(2) could be read to
reach more broadly than public safety, so the FAA has revised the
section to require that an operator resolve any inconsistencies
``identified in paragraph (d)(1) of this section'' prior to the next
flight of the vehicle. This language would explicitly limit the
applicability of the provision to the hazard control strategy
determination, and any hazard or flight safety analyses and associated
mitigation and hazard control measures, as opposed to mission success.
The FAA does not agree with Virgin Galactic's suggestion to limit
applicable inconsistencies to those that have an effect on the safety
criteria of Sec.  450.101. That change would imply that a quantitative
analysis is all that is required. As discussed earlier in the hazard
management section, the hazard control strategy determination and the
hazard and flight safety analyses must be kept up to date throughout
the lifecycle of the launch and reentry system, so inconsistencies need
to be addressed. The FAA also does not agree with Virgin Galactic to
remove the word ``any'' in front of ``inconsistencies'' because it
would not change the scope of the requirement, because Sec.
450.103(d)(2) explicitly refers to the analyses in Sec.  450.103(d)(1).
    Virgin Galactic recommended that proposed Sec.  450.103(d)(4)--
which would have required an operator to address any anomaly identified
in paragraph (d)(3) prior to the next flight, including updates to any
flight hazard analysis, FSA, or safety-critical system--be revised to
state the FAA should review and provide a determination on an
operator's post-flight data to approve the operator's ability to launch
according to schedule, rather than delaying until all anomalies are
resolved.
    The FAA notes that proposed Sec.  450.103(d)(4) would not have
required FAA approval of the methodology an operator uses to address
anomalies in general or a specific anomaly in particular. In order to
avoid Virgin Galactic's interpretation that all anomalies must be
resolved prior to the next flight, the FAA revised the final rule to
require an operator to address any anomaly identified in paragraph
(d)(3) prior to the next flight as necessary to ensure public safety.
As proposed, this would include updates to any flight hazard analysis,
FSA, or safety-critical system. To ensure public safety, the FAA would
expect an operator to reassess its safety analyses to determine any
potentially new public safety hazards or increased risks to known
public safety hazards due to the anomaly and, if necessary, determine
the need for any additional mitigation strategies or updates to its
safety analyses.
v. Application Requirements
    An applicant under proposed Sec.  450.103(e) would have to submit
(1) a description of the applicant's safety organization, identifying
the applicant's lines of communication and approval authority, both
internally and externally, for all public safety decisions and the
provision of public safety services; and (2) a summary of the processes
and products identified in the system safety program requirements.
    In the final rule, the FAA adopts Sec.  450.103(e) as proposed. The
FAA did not receive any comments on this section.
f. Hazard Control Strategies (Sec.  450.107)
    In the NPRM, the FAA proposed in Sec.  450.107 that, for each phase
of a vehicle's flight, an operator does not need to conduct a flight
hazard analysis for that phase of flight if the public safety hazards
identified in the preliminary safety assessment (PSA) can be mitigated
adequately to meet the requirements of proposed Sec.  450.101 using
physical containment, wind weighting, or flight abort, in accordance
with Sec.  450.107(b), (c), and (d). If the public safety hazards
identified in the PSA could not be adequately mitigated using these
methods, an operator would be required to conduct a flight hazard
analysis in accordance with proposed Sec.  450.109 to derive hazard
controls for that phase of flight.
    The FAA has restructured Sec.  450.107 in the final rule to require
an operator to use a functional hazard analysis to make a hazard
control strategy determination. This requirement is based on the
requirements for the PSA that was proposed, but not adopted, in Sec.
450.105. In addition, the FAA has removed from Sec.  450.107 specific
details for each hazard control strategy available to operators and
instead directs operators to Sec. Sec.  450.108, 450.109, 450.110, and
450.111, which provide requirements for flight abort,\81\ flight hazard
analysis, physical containment,\82\ and wind weighting, respectively.
---------------------------------------------------------------------------

    \81\ In the NPRM, the requirements for flight abort had been
scattered throughout proposed Sec. Sec.  450.107, 450.123, 450.125,
450.127, 450.129, and 450.165. Section 450.108 is discussed more
fully later in the preamble section titled Flight Abort.
    \82\ The NPRM did not include a separate section for physical
containment. In the final rule, as will be discussed later, the
requirements from proposed Sec.  450.107(b) are relocated to a new
Sec.  450.110 (Physical Containment).
---------------------------------------------------------------------------

    Section 450.107 also characterizes flight hazard analysis as a
hazard control strategy. Although a flight hazard analysis is different
from the other hazard control strategies in that it does not lay out
specific hazard controls, it does lay out a process by which hazard
controls can be derived. The hazard controls that are derived from the
flight hazard analysis, like those defined in the other three hazard

control strategies, are then used as part of the input to the FSA that
is used to show compliance with Sec.  450.101(a), (b), and (c).
Therefore, because a flight hazard analysis is a means by which an
operator derives the appropriate hazard controls, the FAA has
characterized it as a hazard control strategy in this final rule. As
such, throughout the final rule, a flight hazard analysis is listed
with physical containment, wind-weighting, and flight abort as a hazard
control strategy.\83\ Further, Sec.  450.107(c) retains the proposed
requirement that an operator must conduct a flight hazard analysis if
the public safety hazards for that phase of flight cannot be mitigated
adequately to meet the requirements of Sec.  450.101 through physical
containment, wind weighting, or flight abort.\84\
---------------------------------------------------------------------------

    \83\ The FAA notes that, throughout the preamble, it uses the
phrase ``as a hazard control strategy'' to modify physical
containment, wind-weighting, flight abort, and flight hazard
analysis. For example, in the preamble, the FAA refers to operators
who use ``flight abort as a hazard control strategy.'' In such
instances, the FAA means that flight abort is being used as a hazard
control strategy consistent with the requirements in Sec.  450.108.
Likewise, when an operator uses flight hazard analysis as a hazard
control strategy, the operator is conducting a flight hazard
analysis consistent with the requirements set forth in Sec.
450.109.
    \84\ Although proposed Sec.  450.107 was written in the
negative, stating that an operator was not required to conduct a
flight hazard analysis if the public safety hazards identified in
the preliminary safety assessment for that phase of flight could be
mitigated adequately to meet the requirements of Sec.  450.101
through physical containment, wind weighting, or flight abort, the
final rule has revised this language to be more easily understood.
---------------------------------------------------------------------------

    Lastly, the final rule fixes an error in proposed Sec.  450.107,
which referenced Sec.  450.101 in its entirety as being relevant to the
hazard control strategies, even though certain requirements in Sec.
450.101 regarding the disposal of upper stages, protection of people
and property on orbit, and notification of planned impacts, are not
relevant to the hazard control strategies defined in Sec.  450.107.
Section 450.107 refers instead to Sec.  450.101(a), (b), or (c).
    The FAA adds paragraph (b) to Sec.  450.107 to address how an
operator determines its hazard control strategy or strategies for any
phase of flight during a launch or reentry. This paragraph is based on
and replaces a portion of the preliminary safety assessment in proposed
Sec.  450.105 of the NPRM. Because an operator determines a hazard
control strategy or strategies based on an assessment of potential
hazards, the requirements for such an assessment are better suited for
this section. The next preamble section discusses the revision to Sec.
450.107(b) more fully.
    Proposed Sec.  450.107(e) would have required an applicant in its
application to describe its hazard control strategy for each phase of
flight. The application requirements in the final rule, in Sec.
450.107(d), similarly require an applicant to provide a description of
its hazard control strategy or strategies for each phase of flight. The
FAA added the phrase ``or strategies'' to reflect the fact that an
operator may use one or more hazard control strategies for any given
phase of flight. In addition, because the requirements for physical
containment have been relocated to Sec.  450.110, the FAA has likewise
relocated the application requirements for physical containment
proposed in Sec.  450.107(e) to Sec.  450.110(c).\85\ These
requirements have been adopted as proposed.
---------------------------------------------------------------------------

    \85\ The proposed rule also required an applicant using physical
containment as a hazard control strategy to demonstrate that the
launch vehicle does not have sufficient energy for any hazards
associated with its flight to reach outside the flight hazard area
developed in accordance with Sec.  450.133, and to describe the
methods used to ensure that flight hazard areas are cleared of the
public and critical assets.
---------------------------------------------------------------------------

    Lastly, Sec.  450.107(d) in the final rule requires an applicant to
submit in its application the results of its hazard control strategy
determination, including all functional failures identified under Sec.
450.107(b)(1), the identification systems, and a timeline of all
safety-critical events. These relate to the hazard control strategy
determination, which is discussed in the next section of this preamble.
    The FAA received a few comments for proposed Sec.  450.107. One
individual commenter supported the additional flexibility inherent in
allowing an operator to select its hazard control strategy and noted
that this flexibility would help to reduce overall design costs for the
private enterprise. Virgin Galactic requested that the FAA define
``traditional hazard controls'' and provide opportunity for public
comment through the issuance of an SNPRM. Blue Origin proposed that the
FAA amend proposed Sec.  450.107(e)(2)(ii) to require that an applicant
describe the methods used to ensure that risk to the public and
critical assets in flight hazard areas meet allowable criteria. This
latter comment is discussed later in the preamble section titled
Physical Containment.
    To the extent that Virgin Galactic commented that the term
``traditional hazard controls'' should be defined and comment allowed
through publication of an SNPRM, the FAA notes that the NPRM stated
that traditional hazard controls included physical containment, wind
weighting, and flight abort.\86\
---------------------------------------------------------------------------

    \86\ See 84 FR 15316 (footnote 62).
---------------------------------------------------------------------------

g. Hazard Control Strategy Determination (Sec.  450.107(b))
    In the NPRM, the FAA proposed in Sec.  450.105 to require that
every operator conduct and document a PSA for the flight of a launch or
reentry vehicle to identify potential public safety impacts early in
the design process. The FAA intended the PSA to be a top-level
assessment of the potential public safety impacts identifiable early in
the design process and broad enough that minor changes in vehicle
design or operations would not have a significant impact on, or
invalidate the products produced by, the PSA. As proposed, the PSA
would have required the operator to identify a number of items,
including: A preliminary hazard list that documents all hardware,
operational, and design causes of vehicle response modes that,
excluding mitigation, have the capability to create a hazard to the
public; safety-critical systems; and a timeline of all safety-critical
events.\87\ An applicant would have been required to submit the PSA
result, including the items identified above, in its application for a
license.
---------------------------------------------------------------------------

    \87\ The operator would also have needed to identify (1) vehicle
response modes; (2) public safety hazards associated with vehicle
response modes, including impacting inert and explosive debris,
toxic release, and far field blast overpressure; (3) geographical
areas where vehicle response modes could jeopardize public safety;
(4) any population exposed to public safety hazards in or near the
identified geographical areas; and (5) the CEC, unless otherwise
agreed to by the Administrator based on the demonstrated reliability
of the launch or reentry vehicle during any phase of flight.
---------------------------------------------------------------------------

    The final rule removes proposed Sec.  450.105 in its entirety but
relocates certain items from the PSA section into Sec.  450.107(b) as
part of the hazard control strategy determination. The final rule
replaces the requirement for a PSA with a functional hazard analysis
and replaces the term ``vehicle response mode'' with ``reasonably
foreseeable hazardous events.'' The FAA finds these changes are less
prescriptive and burdensome on an operator, while preserving the
intended benefits and level of safety of the proposed requirements.
    Blue Origin and Microcosm commented that requiring operators to
develop a preliminary hazard list that identifies all causes of hazards
and vehicle response modes for a PSA, prior to analysis or testing of
their vehicle systems, was unreasonable. Blue Origin stated it would be
infeasible to document in a preliminary hazard list all hardware,
operational, and design causes of vehicle response modes capable of
causing a hazard to the public at the preliminary design phase.

The commenters noted that operators identify potential hazards, but not
all causes of vehicle response modes, prior to the detailed design
phase. Blue Origin added that identification of causes was a continuous
process that evolves as hardware and operations design matures, and
recommended the PSA be limited to analyzing and identifying all
functional failures that could have the capability to create a hazard
to the public, rather than analyzing the detailed design, which may
still be maturing. Blue Origin also noted that early engagement with
the FAA through the pre-application process, before a design is mature,
was beneficial to both parties.
    The FAA concurs that the detailed design may not be mature enough
at a preliminary stage such that an operator could define all hardware,
operational, and design causes of vehicle response modes with minimal
changes downstream in the development process in a preliminary hazard
list. Although the preliminary hazard list would not have been provided
to the FAA until an applicant submitted an application, the FAA agrees
with the commenters that the proposed rule would have required a launch
or reentry operator to complete the preliminary hazard list early in
the design process, to enable the operator to then carry out its hazard
control strategy or strategies. This, as noted by Blue Origin, would
not have been practicable as proposed. Accordingly, the FAA does not
adopt the proposed requirement for an operator to identify a
preliminary hazard list. Instead, the FAA requires an operator, in
Sec.  450.107(b), to determine its hazard control strategy or
strategies for any phase of flight during a launch or reentry, based on
a functional hazard analysis accounting for all functional failures
associated with reasonably foreseeable hazardous events, safety-
critical systems, and safety-critical events. Even with this change,
the FAA also agrees with Blue Origin that this approach will encourage
operators to engage early with the FAA, prior to the design becoming
mature.
    In the final rule, the FAA eliminates proposed Sec.  450.105, but
moves, with some revision, the requirements in proposed Sec. Sec.
450.105(a)(6) through (a)(8) into Sec.  450.107(b). Section 450.107(b),
titled ``Hazard Control Strategy Determination,'' requires that for any
phase of flight during a launch or reentry, an operator must use a
functional hazard analysis to determine a hazard control strategy or
strategies accounting for (1) all functional failures associated with
reasonably foreseeable hazardous events that, excluding mitigation,
have the capability to create a hazard to the public, (2) safety-
critical systems, and (3) a timeline of all safety-critical events.
    In the NPRM, proposed Sec.  450.105(a)(6) would have required a
preliminary hazard list documenting all hardware, operational, and
design causes of vehicle response modes that, excluding mitigation,
have the capability to create a hazard to the public. The final rule
requires an operator to use a functional hazard analysis that accounts
for, among other things, all functional failures associated with
reasonably foreseeable hazardous events that, excluding mitigation,
have the capability to create a hazard to the public. A functional
failure is a condition of a system, subsystem, or component function
derived by assessing each function against multiple potential failure
modes during each phase of the system's mission. This addresses Blue
Origin's concerns about the preliminary hazard list because identifying
functional failures does not require detailed design information that
may not be finalized at the stage of design when a hazard control
strategy is being considered.
    A functional hazard analysis is a common system safety tool that,
as articulated in DOD's MIL-STD-882E, is used to identify and classify
the system functions and the safety consequences of functional failure
or malfunction.\88\ A functional hazard analysis is a foundational tool
useful throughout the lifecycle of the launch or reentry system that
helps drive the design and development process at a preliminary stage
by identifying safety-critical functions of which launch and reentry
vehicle developers should be cognizant throughout the process to ensure
public safety. The requirement to perform a functional hazard analysis
instead of a preliminary hazard list, as proposed in Sec.  450.105,
should reduce the burden on operators, for the reasons cited by Blue
Origin.
---------------------------------------------------------------------------

    \88\ Department of Defense, Standard Practice for System Safety,
MIL-STD-882E, May 11, 2012.
---------------------------------------------------------------------------

    The FAA finds that a functional hazard analysis will preserve the
benefits of the preliminary safety assessment proposed in the NPRM, but
reduce the burden on applicants by not requiring detailed design
information that may not be finalized at the stage of design when a
hazard control strategy is being considered. Like the PSA, a functional
hazard analysis should help an operator identify specific information
relevant to public safety, scope the analyses that must be conducted to