2020-22042. Streamlined Launch and Reentry License Requirements

AGENCY:

FAA Aviation Administration (FAA), Department of Transportation (DOT).

ACTION:

Final rule.

SUMMARY:

This rule streamlines and increases flexibility in the FAA's commercial space launch and reentry regulations, and removes obsolete requirements. It consolidates and revises multiple regulatory parts and applies a single set of licensing and safety regulations across several types of operations and vehicles. The rule describes the requirements to obtain a vehicle operator license, the safety requirements, and the terms and conditions of a vehicle operator license.

DATES:

Effective date: This rule is effective March 10, 2021, except for amendatory instructions 3, 11, 17, 20, 27, 44 and 54, concerning §§ 401.5, 413.1, and 413.23, the removal of parts 415, 417, 431, and 435, and instructions 68 and 73 amending §§ 440.3 and 460.45, respectively, which are effective March 10, 2026.

Compliance: Affected parties, however, are not required to comply with the information collection requirements in part 450 until the Office of Management and Budget (OMB) approves the collection and assigns a control number under the Paperwork Reduction Act of 1995. The FAA will publish in the Federal Register a notice of the control number assigned by the Office of Management and Budget (OMB) for these information collection requirements.

ADDRESSES:

For information on where to obtain copies of rulemaking documents and other information related to this final rule, see “How To Obtain Additional Information” in the SUPPLEMENTARY INFORMATION section of this document.

FOR FURTHER INFORMATION CONTACT:

For technical questions concerning this action, contact Randy Repcheck, Office of Commercial Space Transportation, Federal Aviation Administration, 800 Independence Avenue SW, Washington, DC 20591; telephone [phone]; email [e-mail].

SUPPLEMENTARY INFORMATION:

Authority for This Rulemaking

The Commercial Space Launch Act of 1984, as amended and codified at 51 U.S.C. 50901-50923 (the Act), authorizes the Secretary of Transportation to oversee, license, and regulate commercial launch and reentry activities, and the operation of launch and reentry sites within the United States or as carried out by U.S. citizens. Section 50905 directs the Secretary to exercise this responsibility consistent with public health and safety, safety of property, and the national security and foreign policy interests of the United States. In addition, § 50903 requires the Secretary to encourage, facilitate, and promote commercial space launches and reentries by the private sector. As codified at 49 CFR 1.83(b), the Secretary has delegated authority to carry out these functions to the FAA Administrator.

This rulemaking amends the FAA's launch and reentry requirements, consolidating and revising multiple regulatory parts to set forth a single set of licensing and safety regulations across several types of operations and vehicles. It also streamlines the commercial space regulations by, among other things, replacing many prescriptive regulations with performance-based rules, and giving industry greater flexibility to develop means of compliance that maximize their objectives while maintaining public safety.

List of Abbreviations and Acronyms Frequently Used in This Document

AC—Advisory Circular

CE_C—Conditional expected casualty

E_C—Expected casualty

ELOS determination—Equivalent-level-of-safety determination

ELV—Expendable launch vehicle

FSA—Flight safety analysis

FSS—Flight safety system

RLV—Reusable launch vehicle

Table of Contents

I. Overview

II. Background

III. Discussion of the Rule

A. Safety Framework

B. Detailed Discussion of the Final Rule

1. Prescriptive vs Performance-Based Regulations, ELOS, Safety Case

2. Part 450 Subpart A—General Discussion

a. Pre-Application Consultation

b. Application Process

c. Compliance Period for Legacy Licenses (§ 450.1(b))

d. Definition and Scope of Launch (§ 450.3)

e. Safety Element Approval (Part 414)

f. Vehicle Operator License—Issuance, Duration, Additional License Terms and Conditions, Transfer, and Rights Not Conferred (§§ 450.5 Through 450.13)

3. Part 450 Subpart B—Requirements To Obtain a Vehicle Operator License

a. Incremental Review and Determinations (§ 450.33)

b. Means of Compliance (§ 450.35)

c. Use of Safety Element Approval (§ 450.39)

d. Policy Review (§ 450.41)

e. Payload Reviews (§ 450.43)

f. Safety Review and Approval (§ 450.45)

g. Environmental Review (§ 450.47)

4. Part 450 Subpart C—Safety Requirements

a. Neighboring Operations Personnel (§ 450.101(a) and (b))

b. High Consequence Event Protection (§ 450.101(c))

c. Critical Asset and Critical Payload Protection

d. Other Safety Criteria (§ 450.101(d), (e), (f), and (g))

e. System Safety Program (§ 450.103)

f. Hazard Control Strategies (§ 450.107)

g. Hazard Control Strategy Determination (§ 450.107(b))

h. Flight Abort (§ 450.108)

i. Flight Hazard Analysis (§ 450.109)

j. Physical Containment (§ 450.110)

k. Wind Weighting (§ 450.111)

l. Flight Safety Analysis (§§ 450.113 to 450.139)

m. Flight Safety Analysis Requirements—Scope (§ 450.113)

n. Flight Safety Analysis Methods (§ 450.115)

o. Trajectory Analysis for Normal Flight (§ 450.117)

p. Trajectory Analysis for Malfunction Flight (§ 450.119)

q. Debris Analysis (§ 450.121)

r. Population Exposure Analysis (§ 450.123)

s. Probability of Failure Analysis (§ 450.131)

t. Flight Hazard Area Analysis (§ 450.133)

u. Debris Risk Analysis (§ 450.135)

v. Far-Field Overpressure Blast Effect Analysis, or Distant Focus Overpressure (DFO) (§ 450.137)

w. Toxic Hazards (§§ 450.139 and 450.187)

x. Computing Systems (§ 450.141)

y. Safety-Critical Systems Design, Test, and Documentation (§ 450.143)

z. Flight Safety Systems (§§ 450.143 and 450.145)

aa. Hybrid Vehicles

bb. Agreements and Airspace (§ 450.147)

cc. Safety-Critical Personnel Qualifications (§ 450.149)

dd. Work Shift and Rest Requirements (§ 450.151)

ee. Radio Frequency (§ 450.153)

ff. Readiness and Rehearsals (§ 450.155)

gg. Communications (§ 450.157)

hh. Pre-Flight Procedures (§ 450.159)

ii. Control of Hazard Areas (§ 450.161)

jj. Lightning Hazard Mitigation (§ 450.163)

kk. Flight Commit Criteria (§ 450.165)

ll. Tracking (§ 450.167)

mm. Launch and Reentry Collision Avoidance Analysis Requirements (§ 450.169)

nn. Safety at End of Launch (§ 450.171)

oo. Mishap (Definition, §§ 450.173 and 450.175)

pp. Unique Safety Policies, Requirements and Practices (§ 450.177)

qq. Ground Safety (§ 450.179 to § 450.189)

5. Part 450 Subpart D—Terms and Conditions of a Vehicle Operator License

a. Public Safety Responsibility, Compliance With License, Financial Responsibility, Human Spaceflight Requirements (§§ 450.201 to 450.207)

b. Compliance Monitoring (§ 450.209)

c. Continuing Accuracy of License Application; Application for Modification of License (§ 450.211)

d. Pre-Flight Reporting (§ 450.213)

e. Post-Flight Reporting (§ 450.215)

f. Registration of Space Objects (§ 450.217)

6. Changes to Parts 401, 413, 414, 420, 433, 437, and 440

7. Miscellaneous Comments

8. Responses to Regulatory Impact Analysis Comments

IV. Regulatory Notices and Analyses

A. Regulatory Evaluation

B. Regulatory Flexibility Act

C. International Trade Impact Assessment

D. Unfunded Mandates Assessment

E. Paperwork Reduction Act

F. International Compatibility

G. Environmental Analysis

V. Executive Order Determinations

A. Executive Order 13771, Reducing Regulation and Controlling Regulatory Costs

B. Executive Order 13132, Federalism

C. Executive Order 13211, Regulations That Significantly Affect Energy Supply, Distribution, or Use

VI. How To Obtain Additional Information

Rulemaking Documents

Comments Submitted to the Docket

Small Business Regulatory Enforcement Fairness Act

I. Overview

Overview of Final Rule

This rule amends 14 CFR parts 415, 417, 431, and 435 by consolidating, updating, and streamlining all launch and reentry regulations into a single part 450. After March 10, 2026, parts 415, 417, 431, and 435 will be removed. This rule also revises multiple regulatory parts to apply a single set of licensing and safety regulations across several types of operations and vehicles. In addition, this rule replaces many prescriptive regulations with performance-based rules, giving industry greater flexibility to develop means of compliance that meet their objectives while maintaining public safety. Where possible, the FAA has adopted performance standards, and considered the prescriptive requirements for placement in advisory circulars (AC) that will identify possible means of compliance, but not the only means of compliance, with this rule. The goal of this approach is to afford the industry and the FAA the added flexibility of using new methods to better enable future innovative concepts and operations. While some of the provisions in this rule may increase the risk to public safety compared to the current regulations, such as the provisions that apply to neighboring operations personnel, the FAA has ensured that the increased risk is minimal and there is a corresponding public interest benefit.

Part 450 accommodates all vehicle operators, including hybrid vehicle operators. The revisions include more performance-based requirements, alternatives to flight abort and flight safety analysis (FSA) requirements based on demonstrated reliability, use of equivalent level of safety (ELOS) for the measurement of a high consequence event, and allowing application process alternatives as agreed to by the FAA.

Part 450 is divided into subparts A through D. Part 450 is organized by sections that have both safety requirements for what an operator must do to be safe and application requirements for what must be submitted in an application. By “applicant,” the FAA intends to reference an applicant for either a vehicle operator license, an incremental approval, a payload determination, a policy approval, or an environmental determination. By “operator,” the FAA intends to reference the holder of a license, which is consistent with the definition of “operator” in § 401.7.

This preamble will discuss in detail the safety framework encapsulated in part 450, part 450 requirements in sequential order, followed by corresponding and related changes to other parts, and cost implications for this rule.

i. Subpart A

Subpart A includes a general discussion on the application process, licensing scope and duration, and compliance dates. Pre-application consultation, which may include discussion of any applicable flexibilities in the application process, scope of license, and means of compliance, is required by part 413.

Figure 1 illustrates the licensing process. The licensing process begins with pre-application consultation, which sets the stage for an applicant to submit a license application. The application evaluation consists of five major components: (1) A policy review, (2) a payload review, (3) a safety review, (4) a determination of maximum probable loss (MPL) for establishing financial responsibility requirements, and (5) an environmental review. The license specifies the range of activities the licensee may undertake along with any limitations. Requirements after a license is issued encompass the licensee's responsibility for public safety and compliance with its license, representations in the license application, and FAA regulations. An important component of this compliance is the FAA's authority to perform safety inspections.

In the final rule, the FAA does not make any changes to the existing pre-application consultation provision, except to update the term “safety approval” to the newly adopted “safety element approval.” The FAA makes this change to delineate between the safety approval portion of a license application and a safety element approval that the FAA grants under Part 414. This distinction between terms will not affect industry.

During the pre-application consultation stage, an applicant will work with the FAA to develop an application and licensing process that best fits its proposed operation. This stage will focus on compliance planning and positioning the applicant to prepare an acceptable application, which will increase the efficiency of the licensing process. The length of pre-application consultation will vary based on the proposed operation. For example, pre-application consultations may be lengthy when involving new launch vehicles that are under development or with operators inexperienced with the FAA's regulations. Alternatively, pre-application consultation with experienced operators using proven vehicles from established sites may be considerably shorter.

During this stage, the FAA expects to discuss the following topics with an applicant: Entrance and exit criteria for pre-application consultation, the intended means of compliance to meet the regulatory requirements in part 450, the scope of the license, safety element approvals, incremental review, review period for license evaluation, compliance expectations, and time frames an operator is required to meet to satisfy part 450. Some of the topics allow for flexibility that can result in a more efficient licensing process for both the applicant and the FAA.

The rule allows an applicant and the FAA flexibility to establish the scope of the license. Determining the point at which launch begins will be discussed during pre-application consultation. The applicant will describe to the FAA its launch site and its intended concept of operations leading up to a launch, including any operations that are hazardous to the public. Once the FAA and the applicant have a mutual understanding of the applicant's intended concept of operations, the FAA will determine what constitutes hazardous pre-flight operations and thus the beginning of launch. The applicant will then scope its application materials based on this starting point.

In the Notice of Proposed Rulemaking (NPRM), the FAA proposed to set the scope of activity authorized by a vehicle operator license by identifying the beginning and end of launch and reentry. The final rule provides flexibility to scale the beginning of launch to the operation. Specifically, the FAA will identify the beginning and end of launch on a case-by-case basis and in consultation with an applicant. The final rule does not adopt the proposed default that hazardous ground pre-flight operations commence when a launch vehicle or its major components arrive at a U.S. launch site. Instead, the final rule identifies certain activities that qualify as hazardous pre-flight operations, including, but not limited to, pressurizing or loading of propellants into the vehicle or launch system, operations involving a fueled launch vehicle, the transfer of energy necessary to initiate flight, or any hazardous activity preparing the vehicle for flight. This rule also clarifies that hazardous pre-flight operations do not include the period between the end of the previous launch and launch vehicle reuse when the vehicle is in a safe and dormant state.

For the end of launch and reentry, the FAA replaces each use of “vehicle stage” in the proposed rule with “vehicle component” in the final rule. The FAA adopts this change in recognition that components other than vehicle stages may return to Earth. Also, the FAA now includes “impact or landing” in the end of launch and reentry sections in the scope of license requirements to accommodate increasing efforts to reuse components.

ii. Subpart B

Subpart B contains the requirements to obtain a vehicle operator license. The topics include incremental review and determinations, means of compliance, policy review, payload review, safety review and approval, and environmental review. This rule retains the key components of a license application review: The policy review, payload review, safety review, MPL determination, and environmental review. This rule continues to allow operators to submit the payload, policy, environmental, and financial responsibility portions of its application independently of each other.

The final rule will also allow an applicant to submit an application for a safety review in modules using an incremental approach approved by the FAA. The safety review is typically the most complex part of the license application and usually involves submission of numerous documents. In this rule, the FAA has concluded that a structured approach agreed to during pre-application consultation will reduce regulatory uncertainty by allowing the FAA to affirm at an early stage of development that the proposed safety measure or methodology meets the FAA's requirements. An applicant must have its incremental review approach approved by the FAA prior to submitting its application so that the FAA can ensure that the modules can be reviewed independently and in a workable order under an agreed time frame.

The rule makes it easier for an applicant to seek a safety element approval in conjunction with its license application. A safety element approval is an FAA document containing the FAA determination a safety element, when used or employed within a defined envelope, parameter, or situation, will not jeopardize public health and safety or safety of property. A safety element includes a launch vehicle, reentry vehicle, safety system, process, service, or any identified component thereof; and qualified and trained personnel, performing a process or function related to licensed activities or vehicles. An applicant may also leverage existing safety element approvals by citing a safety element approval in another license application, thus streamlining the subsequent licensing process.

After the final rule becomes effective on March 10, 2021, operators holding an active launch or reentry license, or who have an accepted launch or reentry license application within 90 days after the effective date, may choose to operate under parts 415 and 417 for expendable launch vehicles (ELVs), part 431 for reusable launch vehicles (RLVs), or part 435 for reentry vehicles, until five years after the effective date of this rule.^[1] All operators, including those exercising this provision, must come into compliance with this regulation's requirements for critical asset protection and collision avoidance (COLA) analysis beginning from the effective date of this rule. Any operator may also choose to operate under part 450 on the effective date of this rule. Operators conducting operations under parts 415, 417, 431 or 435 may submit requests for license renewals such that their license remains valid for up to five years after the effective date of this rule. A license renewal issued after the effective date of this rule will be valid for no longer than five years after the effective date of this rule.^[2] All operators will need to comply with all parts of this rule five years after its effective date. Any operator may also choose to operate under part 450 on the effective date of this rule.

For an application for a license modification submitted after this rule becomes effective and within five years of the effective date, the FAA will determine the applicability of part 450 on a case-by-case basis. In determining whether to apply part 450 in evaluating a license modification under this scenario in consultation with the applicant, the FAA will consider the extent and complexity of the modification, whether the applicant proposes to modify multiple parts of the application, and if the application requires significant reevaluation.

The final rule allows most time frames to be determined during pre-application consultation, or during the application review process. An operator may propose alternative time frames for any of the requirements listed in the newly created Appendix A to part 404.

Compliance with the performance requirements in this rule may be demonstrated by using a means of compliance that is accepted by the FAA. Means of compliance may be government standards, industry consensus standards, or unique means of compliance developed by an individual applicant. During pre-application consultation, the FAA will work with applicants on compliance planning. The FAA will review the submitted means of compliance to determine whether they satisfy the regulatory safety standard.

For five requirements, an applicant must use a means of compliance the FAA has accepted in advance of submitting an application. Those requirements for which an applicant must use an accepted means of compliance in advance are identified in § 450.35 and include FSA methods, airborne toxic concentration and duration thresholds for any toxic hazards for flight, highly reliable flight safety systems (FSS), lightning commit criteria, and airborne toxic concentration and duration thresholds toxic hazard mitigation for ground operations. For all other requirements, an applicant may include an accepted means of compliance or a means of compliance the FAA has not yet accepted as part of its application for the FAA to review during application evaluation. The FAA will publish any publicly available means of compliance that it accepts. In addition, an operator may request that the FAA publish the operator's unique means of compliance, once reviewed and accepted.

The FAA evaluates five major components in an application for a vehicle operator license. The FAA adopts the proposed requirements for the policy review without modification. For the FAA to conduct a policy review, an applicant must identify the launch or reentry vehicle and its proposed flight profile, and describe the vehicle by characteristics that include individual stages and their dimensions, the type and amounts of all propellants, and maximum thrust. The final rule clarifies that a payload review is not required when the proposed launch or reentry vehicle will not carry a payload or when the payload is owned or operated by the U.S. Government. The FAA will continue to conduct safety reviews to determine whether an applicant is capable of conducting a launch or reentry without jeopardizing public health and safety and safety of property as specified in §§ 415.103, 431.31(a), and 435.31. Finally, the FAA adopts with revisions the proposed requirements for environmental review. The revisions include clarification on the FAA requirements for an Environmental Assessment (EA) and the FAA's responsibility to determine whether a Categorical Exemption (CATEX) applies, in accordance with current regulations. The MPL calculation and financial responsibility requirements are discussed under Subpart D.

iii. Subpart C

Subpart C addresses safety requirements. In the final rule, the FAA revises numerous sections under subpart C in response to public comments on the proposed rule, so that the rule is more performance-based. Subpart C includes regulations for key areas of concern to Federal launch or reentry sites that had not been covered in previous FAA regulations (e.g., the treatment of neighboring operations personnel and critical assets, including critical payloads). Throughout this document, the terms “Federal launch or reentry sites” and “Federal sites” replace the NPRM's use of “Federal launch range.”

The FAA structured the rule to facilitate elimination of duplication of the requirements of Federal launch or reentry sites by incorporating critical asset protections, to avoid the need for Federal sites to impose this requirement. The rule also creates a path for the FAA to determine that a Federal launch or reentry site's ground safety processes, requirements, and oversight are not inconsistent with the Secretary's statutory authority over commercial space activities.

The safety criteria in § 450.101 (Safety Criteria) set the public and property safety criteria that must be met before an operator may initiate the flight of a launch or reentry vehicle.^[3] The quantitative safety criteria continue to be the linchpin requirement for flight safety, which is fundamental for all operators. There are quantitative risk criteria for collective risk, individual risk, and aircraft risk. The final rule applies collective and individual risk criteria to people on waterborne vessels, enabling risk management techniques that previously required a waiver. The rule carves out neighboring operations personnel on a launch or reentry site as a separate category of the public subject to different risk criteria. This rule also adds risk criteria for the protection of critical assets essential to the national interests of the United States, including a more stringent requirement for the protection of critical payloads. The final rule uses conditional risk management to ensure (1) mitigations, such as flight abort, will be implemented to protect against high consequence events, and (2) implementation of mitigations will produce reasonable conditional risks.

The rule allows for neighboring operations personnel to be protected as members of the public, but to a less stringent risk threshold as compared to other members of the public. In the final rule, the FAA adopts the proposed requirements on neighboring operations personnel in §§ 401.7, 440.3, 450.101(a) and (b), and 450.137 (Far-field Overpressure Blast Effect Analysis) paragraph (c)(6), but removes the phase “as determined by the Federal or licensed launch or reentry site operator” from the definition of “neighboring operations personnel” in § 401.7. Instead, the Federal or licensed site operator will determine those persons who are eligible for neighboring operations personnel status in coordination with the operators at the site and in accordance with definition in § 401.7. A site operator at a non-Federal site will have the option to designate certain personnel as neighboring operations personnel.

In the final rule, critical assets include property, facilities, or infrastructure necessary to maintain national security, or assured access to space for national priority missions. In the final rule, the FAA does not adopt the proposed requirement for operators to calculate the risks to critical assets in preparing a flight hazard analysis, debris analysis, and debris risk analysis. The FAA anticipates that it will perform all critical asset and critical payload risk assessments for commercial space transportation operations involving non-Federal sites.

Under § 450.101(c) of the NPRM, the FAA proposed to require an operator to use flight abort as a hazard control strategy if the consequence of any reasonably foreseeable vehicle response mode, in any one-second period of flight, is greater than 1 × 10⁻³ CE_C for uncontrolled areas. The FAA amends the title of § 450.101(c) from “Flight Abort” in the NPRM to “High Consequence Event Protection” in the final rule, because the final rule allows an operator to use a method other than flight abort in certain situations in which the operator can show sufficient protection against high consequence events. The FAA retains the CE_C requirement as a quantitative criterion that an applicant must use to measure high consequence events, but revises the final rule to allow ELOS for the CE_C requirement. The final rule also allows options for how an applicant may protect against a low likelihood, high consequence event in uncontrolled areas for each phase of flight, such as using flight abort in accordance with § 450.108 (Flight Abort) or demonstrating that CE_C is below a certain threshold without using flight abort.

The FAA adopts with revisions the proposal that an operator must implement and document a system safety program throughout the operational lifecycle of a launch or reentry system in § 450.103 (System Safety Program). The system safety program includes a safety organization, hazard management, configuration management and control, and post-flight data review. In the final rule, the FAA removes the proposed term “operational” to clarify that the regulation applies to hazards throughout the lifecycle of a launch or reentry system—not just to operational hazards. The FAA also does not adopt the proposed requirement in § 450.105 to conduct a preliminary safety assessment, because that requirement has been replaced with a requirement to conduct a functional hazard analysis under the Hazard Control Strategies section in the final rule.

In the NPRM, the FAA proposed under the Hazard Control Strategies section (§§ 450.107 to 450.111) that, for each phase of a vehicle's flight, an operator would not need to conduct a flight hazard analysis for that phase of flight if the public safety and safety of property hazards identified in the preliminary safety assessment could be mitigated adequately to meet the requirements of proposed § 450.101 using physical containment, wind weighting, or flight abort. In the final rule, the FAA concludes that an operator must use one or more of the hazard control strategies defined in §§ 450.108 through 450.111 to meet the safety criteria. The FAA also adds a new paragraph to this section to address how an operator determines its hazard control strategy or strategies for any phase of flight during a launch or reentry.

The FAA adopts proposed § 450.108, which is a consolidation and revision of several proposed sections associated with flight abort requirements in the NPRM. As a result of this consolidation, the FAA removes the flight abort related requirements in §§ 450.123, 450.125, 450.127, and 450.129. The requirements in these sections have been revised to be performance-based standards included in § 450.108(c), which addresses flight safety limits objectives, and § 450.108(d), which addresses flight safety limits constraints.

Section 450.109 (Flight Hazard Analysis) details requirements for an operator using a flight hazard analysis as its hazard control strategy for one or more phases of flight. A flight hazard analysis must identify, describe, and analyze all reasonably foreseeable hazards to public safety and safety of property resulting from the flight of a launch or reentry vehicle, mitigate hazards as appropriate, and validate and verify the hazard mitigations. The FAA revises the final rule to reflect that performing a flight hazard analysis is included as a hazard control strategy to derive hazard controls for the flight, or phase of flight, of a launch or reentry vehicle.

Regardless of the hazard control strategy chosen or mandated an operator must conduct an FSA to demonstrate quantitatively that a launch or reentry meets the safety criteria for debris, far-field overpressure, and toxic hazards. An operator may be required to conduct additional analyses to use flight abort or wind weighting hazard control strategies. The FAA anticipates that an operator will be required to conduct some FSA for at least some phases of flight, regardless of the hazard control strategy chosen or mandated. For example, an FSA must determine flight hazard areas for any vehicle with planned debris impacts capable of causing a casualty.

The FAA revises the FSA requirements in § 450.113 (Flight Safety Analysis Requirements—Scope), which establish the portions of flight for which an operator would be required to perform and document an FSA. An operator must perform and document an FSA for all phases of flight, unless otherwise agreed to by the FAA. The FAA may agree there is no need for an FSA for certain phases of flight based on demonstrated reliability for any launch or reentry vehicle, instead of just for hybrid vehicles as proposed in the NPRM. The FAA expands this exception because, conceivably, an operation involving a vehicle other than a hybrid could have an extensive and safe enough flight history to demonstrate compliance with the risk criteria in § 450.101 based on empirical data in lieu of the traditional risk analysis.

An FSA generally consists of a set of quantitative analyses used to determine flight commit criteria, flight abort rules, flight hazard areas, and other mitigation measures, and to demonstrate compliance with the safety criteria in § 450.101. In the NPRM, the FAA proposed 15 sections associated with FSA requirements in §§ 450.113 to 450.141. The final rule moves requirements associated with flight safety limits to § 450.108 and condenses the remaining FSA requirements into 11 performance-based sections that cover the scope of the analyses, general methodology requirements, and specific sections on normal trajectories, malfunction trajectories, hazardous debris characterization, population exposure, probability of failure, flight hazard areas, debris risks, and far-field overpressure blast effects. The FAA moved some of the proposed FSA requirements such that an operator could generally perform the analyses in the order that they appear in the final rule, if they choose.

The FAA revises the FSA sections to be more performance-based than what was proposed in the NPRM. Specifically, the FAA revises the FSA requirements to identify their fundamental purpose, the essential constraints, and the objectives in each section. The FSA requirements in the final rule are consistent with current practice, but the rule articulates important, often misunderstood, aspects of flight analysis such as the creation of hazard areas and other operating constraints necessary to protect public health and safety and safety of property.

Sections 450.139 (Toxic Hazards for Flight) and 450.187 (Toxic Hazards Mitigation for Ground Operations) contain the requirements for toxic release analysis. In the final rule, the FAA adopts §§ 450.139 and 450.187 with some revisions. The FAA clarifies that operators are not required to perform a toxic release hazard analysis for kerosene-based fuels unless directed by the FAA. Also, the FAA revises the requirements for performing toxic containment.

In the NPRM, § 450.111 contained computing systems and software requirements. In the final rule, the FAA revises and relocates the requirements for computing systems and software to § 450.141 (Computing Systems and Software). In response to comments, the FAA revises the requirements of § 450.141 to be more performance-based, and levies requirements for computing system safety items in proportion to their criticality instead of the item's level of autonomy. The final rule also requires independent verification and validation for computing system safety items that meet the definition of “safety-critical” in § 401.7.

The requirements of § 450.143 (Safety-Critical System Design, Test, and Documentation) apply to all safety-critical systems except highly reliable FSS and safety-critical software items, which are regulated by the requirements in §§ 450.145 and 450.141 respectively. In the final rule, the FAA revises the reference to FSS requirements in § 450.143(a); amends § 450.143(b) to include other means of compliance and broader safe design concepts; and removes the term “vehicle” in § 450.143(c) because safety-critical systems can be located off-vehicle. In addition, the FAA amends the application requirements in § 450.143(f) to require that applicants describe the method used to validate predicted operating environments and any standards used for each safety-critical system.

Section 450.145 (Highly Reliable Flight Safety System) contains the requirements for certain FSS. The FAA revises § 450.145 to apply to a highly reliable FSS, which consists of any onboard portion and if used, any ground-based, space-based, or otherwise not onboard portion of the system. Conventional FSS with airborne flight termination receivers and ground-based command transmitter systems will have both airborne and ground-based subsystems. The final rule provides additional flexibility for operations where the CE_C is between 1 × 10⁻² and 1 × 10⁻³ and exempts the FSS for such operations from the requirements of § 450.145; however, the FSS for such operations must still meet the requirements of § 450.143. The FAA makes these changes to scope the FSS design, testing, and analysis more closely to potential consequence and risk. These changes will reduce burden on operators that have a lower potential for causing high consequence events. The FAA also removes the reliability threshold required of an FSS for operations where CE_C is between 1 × 10⁻² and 1 × 10⁻³. The final rule provides that an FSS required for operations for which the CE_C is between 1 × 10⁻² and 1 × 10⁻³ must meet the requirements of § 450.143.

Section 450.147 (Agreements) requires a vehicle operator to have a written agreement with any entity that provides a service or use of property to meet a requirement in part 450. In the final rule, the FAA requires an operator to enter into multiple agreements if the operator works with multiple entities. Also, operators will continue to be required to enter into agreements with the appropriate entities for launches and reentries that cross airspace or impact water not under U.S. jurisdiction.

Section 450.153 contains the requirements for radio frequency. In the NPRM, the FAA proposed that an operator would be required to identify each frequency, all allowable frequency tolerances, and each frequency's intended use, operating power, and source; and provide for the monitoring of frequency usage and enforcement of frequency allocations. In the final rule, the FAA adopts the proposed requirements with modifications to the performance-based objectives central to radio frequency management. Operators will be required to ensure that radio frequency does not adversely affect the performance of FSS or safety-critical systems, and to coordinate radio frequency with local and Federal authorities.

Section 450.157 contains the requirements for communications. In the NRPM, the FAA proposed that personnel that have authority to issue “hold/resume,” “go/no go,” and abort commands must monitor each common intercom channel during countdown and flight. The FAA does not adopt the proposal because it was overly prescriptive.

Section 450.161 (Control of Hazard Areas) contains the control of hazard areas. In the final rule, the FAA does not remove the requirement for an operator to verify that warnings have been issued when the operator relies on another party to publicize those warnings. Instead, the FAA clarifies that the requirement may be met by demonstrating due diligence pursuant to agreements that the operator has with that party and notifying the FAA of any deviations from the agreements by any party. The FAA also adds an application requirement for the applicant to give a description of how the applicant will provide for any publication of flight hazard areas.

In the final rule, the FAA does not adopt the four mishap categories proposed in the NPRM. The FAA agrees with commenters that the regulatory requirements for the proposed mishap classes, from most severe (Class 1) to least severe (Class 4), were largely the same, and concludes that the mishap classes are not needed to achieve the objective of consolidating mishap-related terms and streamlining the requirements to report, respond to, and investigate mishaps. Instead, the FAA combines the substantive criteria of Mishap Classes 1-4 under the definition of “mishap.” The revised definition in the final rule describes events that constitute a mishap. The requirements to report, respond to, and investigate mishaps are incumbent upon an operator regardless of a mishap's severity.

Section 450.173 (Mishap Plan—Reporting, Response, and Investigation Requirements) contains the requirements for the mishap plan. In the final rule, the FAA does not adopt the proposed requirement for a licensee to cooperate with FAA and NTSB investigations contained in the NPRM. The FAA finds this requirement duplicative of § 450.13, which states that a vehicle operator license does not relieve a licensee of its obligations to comply with all applicable requirements of law or regulation that may apply to its activities. Also, the final rule standardizes criteria for mishap plans across all of 14 CFR Chapter III by making § 450.173 applicable to launch and reentry licensees, experimental permittees, and site operators.

The FAA proposed to give license applicants and licensees the option to pre-coordinate testing activities with the FAA. In the final rule, the FAA clarifies that § 450.175 (Test-induced Damage) will only apply to licensees or license applicants who choose to apply for the exception. The final rule also allows an operator to coordinate the possibility of test-induced damage prior to an operation and exclude damage meeting certain requirements from constituting a mishap, thereby reducing unnecessary reporting.

v. Subpart D

Subpart D addresses the terms and conditions of a vehicle operator license. This includes compliance monitoring (§ 450.209), material changes and continuing accuracy (§ 450.211), pre-flight reporting (§ 450.213), post-flight reporting (§ 450.215), and registration of space objects (§ 450.217). In the final rule, the FAA adopts these sections as proposed with the exception of revisions to § 450.213 (Pre-flight Reporting) as described below.

The final rule makes few changes to the post-licensing requirements, for which the final rule standardizes requirements for all launches and reentries from Federal sites and commercial spaceports or exclusive use launch sites. In line with the previous requirements, operators will provide information and comply with reported collision avoidance closures. A Federal agency will continue to provide operators the appropriate launch or reentry closures, but the rule allows the possibility of some other entity's providing this service in the future. The final rule offers operators flexibility, in coordination with the FAA, to use different timelines for the submission of pre-flight and post-flight reports. The FAA revises § 450.213(d) to allow an operator the flexibility to identify an appropriate time frame in coordination with the FAA. The FAA also revises § 450.217(c) so that licensees will only need to notify the FAA that they removed an object from orbit if removal occurs during or immediately after licensed activities.

II. Background

This rulemaking arose from work by the National Space Council that led to President Donald J. Trump's Space Policy Directive-2 (SPD-2) in May 2018, directing the U.S. Department of Transportation to streamline the regulations governing commercial space launch and reentry licensing. The goals of this streamlining include creating a single licensing regime for all types of commercial space flight launch and reentry operations, and replacing prescriptive requirements with performance-based criteria. The final rule is consistent with DOT's regulations under 49 CFR 5.5(e), which instruct that regulations should be technologically neutral, and, to the extent feasible, should specify performance objectives, rather than prescribing specific conduct that regulated entities must adopt.

On March 8, 2018, the FAA chartered the Streamlined Launch and Reentry Licensing Requirements Aviation Rulemaking Committee (ARC) to provide a forum for a broad range of stakeholders from the aviation and space communities to discuss regulations to set forth procedures and requirements for commercial space transportation launch and reentry licensing. The FAA tasked the ARC with developing recommendations for a performance-based regulatory approach in which the regulations set forth the safety objectives to be achieved while providing the applicant flexibility to produce tailored and innovative means of compliance.

On April 30, 2018, the ARC submitted its final recommendation report to the FAA.^[4] The FAA addressed the recommendations in more detail throughout the NPRM. This final rule incorporates recommendations provided by the ARC.

On March 26, 2019, the FAA posted on its website an NPRM titled “Launch and Reentry Licensing Requirements” that would revise parts 401, 404, 413, 414, 415, 417, 420, 431, 433, 435, 437, and 440, and create a new part 450. In the NPRM, the FAA proposed to streamline and increase flexibility in the FAA's commercial space launch and reentry regulations, remove obsolete requirements, consolidate and revise multiple regulatory parts, and apply a single set of licensing and safety regulations across several types of operations and vehicles.

On April 15, 2019, the FAA published this NPRM in the Federal Register (85 FR 15296). The initial comment period was 60-days from the date of publication, ending on June 14, 2019.

In the ensuing month, commenters submitted fifty-six requests for an extension of the comment period to a total of 120 days, or until August 13, 2019.

In response, on May 31, 2019, the FAA published an extension of the comment period on the NPRM (84 FR 25207), for an additional 45-days to July 30, 2019, to allow commenters more time to analyze the proposed rule.

On June 14, 2019, the FAA posted to the docket a response ^[5] to MLA Space, LLC, which had requested that the FAA reconvene the ARC to engage in dialogue regarding the NPRM. In the response, the FAA stated its belief that engagement with industry in the form of an ARC, a public meeting, or through a special session of Commercial Space Transportation Advisory Committee (COMSTAC) would not be beneficial at that point in the rulemaking process. The FAA encouraged members of industry to submit any questions requesting clarification regarding the NPRM to the docket.

On July 16, 2019, the FAA posted to the docket the first of its responses ^[6] to commenters' questions requesting clarification. Also on July 16, 2019, the FAA posted a statement ^[7] to the docket encouraging commenters to post any further requests for clarification in the docket as soon as possible. That statement reasserted the FAA's judgment that further engagement with industry through a public meeting to have clarifying dialogue regarding the NPRM would not be beneficial, but also offered to entertain meetings in the month of July 2019 with members of the public who wished to provide to the FAA their information bearing on the proposed rule.

Subsequently, the FAA met with Blue Origin,^[8] the Coalition for Deep Space Exploration,^[9] Space Exploration Technologies Corp. (SpaceX),^[10] Virgin Galactic,^[11] and Virgin Orbit ^[12] to receive their clarifying questions and a preview of their comments on the NPRM.^[13]

On July 22, 2019, the FAA published a second extension of the comment period to the NPRM (84 FR 35051). To provide commenters with sufficient time to review the FAA's clarifications in response to the commenter's questions, the FAA extended the comment period to August 19, 2019.^[14]

On August 16, 2019, the FAA posted its response to the docket ^[15] to commenters' questions for clarification received by July 12, 2020, and July 29, 2019.

On August 19, 2019, the comment period closed, with a total of 155 submissions from 85 commenters, and two submissions containing proprietary information. Of these comments, 62 requested an extension of the comment period, 10 requested to reconvene the ARC, 29 requested a public meeting, 18 requested a Supplemental Notice of Proposed Rulemaking (SNPRM), 18 contained clarifying questions for parts of the NPRM, and 53 comments contained substantive feedback regarding the proposed rule. The FAA discusses the adjudication of these comments in more detail later in the preamble.

III. Discussion of the Rule

A. Safety Framework

General. The final rule relies on a safety framework that provides the flexibility needed to accommodate current and future launch and reentry operations. The safety framework encompasses both ground safety and flight safety. Acceptable safety for ground operations is achieved primarily through a process-based hazard analysis and certain prescribed hazard controls. Acceptable safety for flight operations is achieved through several elements discussed further in this preamble section. The FAA identifies specific safety criteria and requirements in § 450.101 that must be met before a launch or reentry can take place, including collective risk, individual risk, aircraft risk, risk to critical assets, protection against high consequence events, disposal of orbiting stages, risk to people and property on orbit, and notification of planned impacts.

System Safety Program. All operators are required to have a system safety program that establishes system safety management principles for both ground safety and flight safety throughout the operational lifecycle of a launch or reentry system. The system safety program includes a safety organization, hazard management, configuration management and control, and post-flight data review.

Hazard Control Strategies. To address the wide variety of commercial launch and reentry systems and operations concepts, the final rule includes four hazard control strategies. An operator can use multiple hazard control strategies during flight because different strategies may be appropriate for different phases of flight. Different hazard control strategies may also be appropriate during any one phase of flight to protect different sets of people and property. The hazard control strategies are physical containment, wind weighting, flight abort, and flight hazard analysis.

• Physical containment would most likely be used for low energy test flights, when a launch vehicle does not have sufficient energy for any hazards associated with its flight to reach the public or critical assets.
• Wind weighting is traditionally used in the launch of unguided suborbital launch vehicles, otherwise known as sounding rockets, where the operator adjusts launcher azimuth and elevation settings to correct for the effects of wind conditions at the time of flight to provide impact locations for the launch vehicle or its components that will ensure compliance with the safety criteria in § 450.101.
• Flight abort is the traditional safety approach for expendable launch vehicles, and is a process to limit or restrict the hazards to public safety and the safety of property presented by a launch vehicle or reentry vehicle, including any payload, while in flight by initiating and accomplishing a controlled ending to vehicle flight. With the exception of phases of flight with demonstrated reliability, flight abort is mandated as a hazard control strategy if the potential for a high consequence event is above a certain threshold.
• Flight hazard analysis is the traditional safety approach for reusable launch vehicles, and is the most flexible hazard control strategy because an operator derives specific hazard controls unique to its launch or reentry vehicle system and operations concept. Flight hazard analysis is mandated as a hazard control strategy if the other three hazard control strategies cannot mitigate the safety hazards sufficient to meet the safety criteria of § 450.101.

An operator determines the appropriate hazard control strategy by conducting a functional hazard analysis.

Flight Safety Analyses. Regardless of the hazard control strategy chosen or mandated, an operator is required to conduct several FSA. These include trajectory analyses for normal and malfunction flight, a debris analysis, a population exposure analysis, and a probability of failure analysis. These analyses provide input to a debris risk analysis, a far-field overpressure blast effects analysis, and a toxic hazard analysis that together demonstrate compliance with the safety criteria of § 450.101, and provide input to a flight hazard area analysis.

Derived Hazard Controls. With respect to flight operations, an operator would derive several hazard controls by conducting the FSA and, if necessary, a flight hazard analysis. Because hazard controls are derived from these analyses, they are not specifically addressed in part 450.

Prescribed Hazard Controls for Computing Systems and Software and Safety-Critical Hardware. Regardless of the hazard controls derived from a flight hazard analysis and FSA, the FAA requires many other hazard controls. The first set of hazard controls includes requirements for computing systems and software, safety-critical systems, and highly reliable FSS.

Other Prescribed Hazard Controls. The second set of hazard controls have historically been necessary to achieve acceptable flight safety. These include requirements for (1) written agreements, (2) safety-critical personnel qualifications, (3) work shift and rest requirements, (4) radio frequency management, (5) readiness, (6) communications, (7) pre-flight procedures, (8) control of hazard areas, (9) lightning hazard mitigation, (10) flight commit criteria, (11) tracking, (12) collision avoidance, (13) safety at the end of launch, and (14) mishap plans.

Ground Safety. With respect to the safety of ground operations, the safety framework includes (1) coordination with a site operator, (2) explosive siting, (3) a ground hazard analysis, (4) toxic hazard mitigations, and (5) prescribed hazard controls addressing visitors, countdown aborts, fire suppression, and emergency procedures. These together provide an acceptable set of public safety considerations for ground operations.

B. Detailed Discussion of the Final Rule

1. Prescriptive vs Performance-Based Regulations, ELOS, Safety Case

i. Prescriptive

The FAA sought in the NPRM to propose changes that would convert many of its prescriptive requirements to more performance-based requirements that would allow for different means of compliance. The FAA received several comments stating generally that the proposed rule was still too prescriptive. The Commercial Spaceflight Federation (CSF) and SpaceX commented that some of the proposed requirements would unnecessarily drive applicants to a burdensome equivalent level of safety (ELOS) process as a default. Blue Origin recommended broadly that the FAA remove all prescriptive portions of the proposed rule.^[16]

The FAA agrees that some of the requirements in proposed part 450 were unnecessarily prescriptive, particularly those for software and FSA. The FAA has modified those requirements to remove unnecessary prescriptiveness and provide additional flexibility while still preserving safety and providing regulatory clarity. For many of the requirements amended for this purpose in the final rule, the prescriptive parts of the proposal will be moved to a corresponding AC as guidance on means of compliance. Specific changes to the requirements are discussed later in this preamble.

Several commenters, including Blue Origin, CSF, and SpaceX, also stated that the FAA should base its new requirements on parts 431 and 435 and add details on how to comply through guidance. CSF also stated that the FAA ignored the draft regulatory text provided by the ARC, which used parts 431 and 435 as a basis for updated rules.

The FAA disagrees that parts 431 and 435 should be used as the sole basis for part 450. Part 431 depends on an operator to use the system safety process to derive hazard controls, which as reflected in part 450, is appropriate for some launch and reentry vehicle systems and operations. However, as also reflected in part 450, not all launch and reentry vehicle systems and operations require an operator to derive hazard controls through the system safety process. Specifically, physical containment, wind weighting, and, most importantly, flight abort are often sufficient. Part 450 incorporates the flexibility of part 431, but acknowledges the acceptability of other hazard control strategies. Part 450 also builds on the precedent set by part 431's limits on the foreseeable consequences of a failure in terms of conditional expected casualties and establishes a less stringent threshold.^[17] Furthermore, the FAA stated in the NPRM that it would not specifically address the ARC's proposed regulatory text because that regulatory text did not receive broad consensus within the ARC.

One individual commenter noted that streamlining was long overdue. Another individual commenter noted that the proposed rule is longer and more complicated than the rule it proposes to replace, and that past FAA approaches led to codifying Federal launch and reentry site requirements, which the Federal sites subsequently changed such that they no longer matched the FAA requirements.

In response, the FAA notes that the proposed regulation combined elements from parts 415, 417, 431, and 435. Part 450 is shorter than parts 415 and 417 and more performance-based. Although it is longer than parts 431 and 435, part 450 is more flexible and encompasses more types of launch and reentry operations. This final rule allows operators to use a means of compliance that will accommodate customized operations, changing technologies, and innovation.

ii. Equivalent Level of Safety (§ 450.37)

In the NPRM, the FAA proposed in § 450.37 (Equivalent Level of Safety) that for all requirements in part 450, except § 450.101, an applicant may clearly and convincingly demonstrate that an alternative approach provides an equivalent level of safety (ELOS) to the requirement.

In the final rule, the FAA revises § 450.37 so that only some portions of § 450.101—specifically § 450.101(a), (b), (c)(1), (c)(3), (d), (e)(1), and (g)—are excluded from eligibility for an ELOS approach. This change allows an applicant to propose an equivalent level of safety to the orbital debris requirement in § 450.101(e)(2) and the notification of planned impacts requirement in § 450.101(f). Most significantly, this change also allows an applicant to propose an equivalent level of safety to the use of a CE_C of 1 × 10⁻³ as the measure of a high consequence event in § 450.101(c)(2). Section 450.101(c) is discussed more fully later in this preamble.

Virgin Galactic commented that ELOS determinations should be part of the license application process. The FAA agrees with the comment and incorporates ELOS determinations into the license application process. To exercise this option, an applicant must demonstrate, through technical rationale, that the proposed alternative provides a level of safety equivalent to the requirement it would replace. The FAA will evaluate the proposal during the application evaluation.

CSF stated that, if the FAA adopted the parts 431 and 435 framework, ELOS would be unnecessary because the ELOS process does not exist under those regulations.^[18] Blue Origin urged the FAA to consider the need for an ELOS option in this rule.

In response to CSF's comments, the FAA acknowledges that, in theory, a performance-based regulation like part 450 could function without an ELOS provision, because, in concept, a performance-based rule allows many different means of compliance with the required safety standard. The FAA considered eliminating the ELOS provision from the final rule, but decided that eliminating the ELOS provision would remove a useful regulatory tool that provides flexibility. Unlike means of compliance, which demonstrate compliance with the regulation, ELOS allows an applicant to propose and demonstrate a method that ensures an ELOS to the requirement, but not necessarily compliance with the requirement itself. The FAA has chosen to retain the option of ELOS to allow operators to propose unique processes and procedures that this rule may not have contemplated.

Blue Origin stated that it supports the use of safety cases as a means to establish an ELOS under proposed § 450.37. A safety case is a structured argument, supported by a body of evidence that provides a compelling, comprehensive, and valid case that a system is safe, for a given application in a particular setting. Regarding process, Blue Origin recommended requiring only one layer of external-to-applicant audit, and that the audit criteria be transparently developed with industry input to ensure understanding of the scope of compliance with the ELOS proposal process. Another individual commenter stated that the FAA should add a provision that would allow use of an alternate process for obtaining a license based on the use of a “safety case” methodology. This methodology would consist of voluntary audits of an applicant's safety and risk management program, followed by development of a safety case showing how the public would be protected during licensed activities.

The FAA finds that the proposed regulation is flexible in allowing an applicant to propose a means of compliance. It also affords the possibility of meeting most requirements by demonstrating an ELOS.^[19] An applicant may wish to use a safety case to demonstrate that it is has satisfied the ELOS standard; however, the FAA declines to add prescriptive audit requirements for its use. An applicant could, but is not required to, use a safety case to show that a certain method satisfies an ELOS to a regulatory requirement, excluding the requirements of § 450.101(a), (b), (c)(1), (c)(3), (d), (e)(1), and (g). A safety case is not required to demonstrate ELOS. It is one way to provide rationale for ELOS. An applicant could use a safety case or other justification for ELOS.

Virgin Galactic recommended that safety cases be counted as an alternative to CE_C in § 450.101(c). The Boeing Company (Boeing), Lockheed Martin Corporation (Lockheed Martin), Northrop Grumman Corporation (Northrop Grumman), and United Launch Alliance (ULA) sought clarification as to why § 450.37 would not apply to § 450.101. Similarly, Blue Origin, CSF, SpaceX, and Virgin Galactic commented that ELOS should be allowed for § 450.101(c).

The FAA agrees with allowing ELOS for § 450.101(c)(2). This allows an operator to make a safety case or provide some other justification for an ELOS determination for an alternative method to protect against a high consequence event, such as safeguards other than flight abort, or an alternative to CE_C as a measurement of the potential for a high consequence event, such as a risk profile, both of which are described more in the preamble section discussing § 450.101(c). Section 450.101(a), (b), (c)(1), (c)(3), (d), (e)(1), and (g) contain the core safety requirements to protect people and property on land, at sea, in the air, and in space. Any proposed non-compliance with these risk requirements will require a waiver and are not eligible for a demonstration of ELOS. By contrast, all other flight safety requirements in part 450 subpart C, which can be demonstrated through ELOS, support the achievement of these underlying risk criteria. To use an ELOS, an operator may demonstrate that an alternative approach provides an equivalent level of safety to a requirement in accordance with § 450.37. A petition for waiver must be submitted at least 60 days in advance and address why granting the request for relief is in the public interest and will not jeopardize the public health and safety, safety of property, and national security and foreign policy interests of the United States in accordance with § 404.5.

Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that the FAA should accept a Federal launch or reentry site's safety processes as providing an ELOS to the FAA's own safety standards without any additional safety requirements.

The FAA disagrees. FAA regulations apply to licensed launches and, in accordance with § 450.45(b) (Safety Review and Approval), the FAA will accept any safety-related launch or reentry service provided by a Federal launch or reentry site or other Federal entity by contract, if the FAA determines that the launch or reentry service satisfies part 450. Although it is possible for the FAA to find that a service provided by a Federal launch or reentry site does not satisfy a requirement in part 450 but does provide an ELOS, the FAA needs to make that determination on a case-by-case basis.

iii. “As agreed to by the Administrator”

Throughout the NPRM, the FAA used the clause “as agreed to by the Administrator.” The term was used in all time frame requirements, as well as in proposed §§ 450.3(a) and (b)(1), 450.33, 450.101(c), 450.113(a)(5), 450.107(b)(2), 450.107(d), 450.147(c), 450.173(g), 450.213(a), and 450.215(b). As stated in the proposal, this clause is used to mean that an operator may submit an alternative to the proposed requirement to the FAA for review. The FAA must agree to the operator's proposal for the operator to use the alternative.

CSF and SpaceX commented that it was unclear how the clause “as agreed to by the Administrator” differed from an ELOS determination. CSF and SpaceX requested that the FAA describe its expectations and capture any process associated with this option in guidance. CSF and SpaceX also recommended adding “unless otherwise agreed to by the Administrator” to the beginning of proposed § 450.101(c).

The clause “as agreed to by the Administrator” means that an operator may submit an alternative to a regulatory requirement. The FAA must agree to the operator's proposal for the operator to use this alternative. Unlike an ELOS determination, an applicant need not demonstrate that this alternative satisfies an ELOS to the requirement. Each use of the term “as agreed to by the Administrator” includes criteria or considerations by which the FAA will agree to a different approach than the regulatory requirement. An applicant should look to these criteria or considerations to determine what the FAA would expect from an applicant when providing an alternative proposal.

For most of the requirements in part 450, an applicant may demonstrate an equivalent level of safety if the applicant is unable to meet a requirement. In addition, an operator may request a waiver to any requirement. An ELOS may be submitted in a license application and must clearly and convincingly demonstrate that an alternative approach provides an equivalent level of safety to the requirement. A petition for waiver must be submitted 60 days in advance and address why granting the request for relief is in the public interest and will not jeopardize the public health and safety, safety of property, and national security and foreign policy interests of the United States.

For some requirements, the FAA anticipated the need for additional regulatory flexibility without the burden of providing an equivalent level of safety or applying for a separate waiver. For those requirements, the FAA has incorporated the clause “as agreed to by the Administrator” to mean that an operator may submit an alternative to the proposed requirement to the FAA for review. For each requirement where the FAA has provided additional flexibility by including the “as agreed to by the Administrator” clause, the FAA has also provided criteria that the Administrator will consider in determining whether to approve the alternative approach, including safety considerations when appropriate. For example, an alternative time frame will generally be accepted if it provides sufficient time for the FAA to review the submittal. These alternatives will typically be agreed to in pre-application consultation.

The FAA addresses the recommendation from CSF and SpaceX by including ELOS in § 450.101(c)(2). The use of ELOS and “agreed to by the Administrator” for § 450.101(c) is discussed in more detail in the preamble section addressing CE_C.

iv. Time frames

In the NPRM, the FAA proposed to allow an operator to propose different time frames for certain regulatory sections if “agreed to by the Administrator”. Blue Origin, CSF, and SpaceX disagreed with this approach and requested that the FAA remove any requirement to submit such a request in a specific time frame other than as soon as the operator understands that a different time frame is necessary. Virgin Galactic recommended that alternate time frames should be spelled out within an operator's license application documents and suggested alternative regulatory text.

The FAA disagrees with the approach to remove specific time frames because the time frames are designed to ensure the FAA has sufficient time to conduct its review and make the requisite public health and safety, safety of property, and national security and foreign policy findings. The FAA notes that the time frames proposed in the NPRM and adopted in the final rule are default time frames. An applicant can propose and the FAA can accept an alternative time frame. The FAA expects alternative time frames to be proposed and accepted during pre-application consultation or during the application process so that the agreed to time frames are then reflected in the license once issued. Time frames can be adjusted after a license is issued through the license modification process, as opposed to the waiver process under the current regulations. However, in most cases, the FAA expects flexible time frames to be negotiated for all the launches or reentries under the license prior to the first licensed activity.

v. Level of Rigor Based on Experience

An individual commenter stated startup launch operators should not operate under the same regimen as experienced operators. This individual stated that startup operators should be subject to strict and precise regulations. Similarly, another individual expressed concern that the proposed rule would apply performance-based requirements to launch vehicles with no prior launch history. SpinLaunch, Inc. (SpinLaunch) commented that the correct regulatory framework should consist of an applicant's demonstrating the necessary skills and knowledge to perform safe and accepted operations.

The FAA disagrees that startup launch operators should operate under a different regulatory regime than experienced operators, and that performance-based requirements should not apply to launch vehicles with no prior launch history. Performance-based requirements provide flexibility to all operators. Means of compliance located in ACs and other standards that have been identified as accepted means of compliance to part 450 provide detailed guidance to those new operators that have not yet established safety processes and procedures. In response to SpinLaunch's comment, the final rule is structured such that an applicant must demonstrate to the FAA the necessary skills and knowledge to perform safe operations in its launch or reentry license application.

2. Part 450 Subpart A—General Discussion

a. Pre-Application Consultation

In the NPRM, the FAA proposed to retain the requirement for pre-application consultation from § 413.5 (Pre-Application Consultation) because the various flexibilities proposed in this rule would benefit from pre-application discussions. These include incremental review, timelines, and the performance-based nature of the regulatory requirements. In the final rule, the FAA adopts the proposal with no changes to the existing pre-application consultation provision.

As proposed, this rule retains pre-application consultation for vehicle operators seeking a license. The FAA will also publish a pre-application consultation Advisory Circular, which will provide additional guidance but will not establish new regulatory requirements. Pre-application consultation will continue to focus on compliance planning and ensuring the applicant can prepare an acceptable application, which will increase the efficiency of the licensing process. The length of pre-application consultation will vary based on the proposed operation. For example, pre-application consultations may be longer when involving new launch vehicles that are under development or with operators inexperienced with FAA's regulations. Alternatively, pre-application consultations with operators who demonstrate knowledge of FAA regulations and/or use proven vehicles from established sites should be considerably shorter. The FAA expects to discuss the following topics with an applicant during pre-application consultation, to the extent they are relevant to the applicant's proposed operation: Entrance and exit criteria for pre-application consultation, the intended means of compliance to meet the regulatory requirements in part 450, the scope of the license, safety element approvals, incremental review, review period for license evaluation, compliance expectations, and time frames an operator is required to meet to satisfy part 450. Some of the topics allow for flexibility that can result in a more efficient licensing process for both the applicant and the FAA.

The FAA will continue to consider the following factors to determine if a prospective applicant is ready to begin pre-application consultation: Whether the concept of operations is realistic and whether the prospective applicant is able to provide a program schedule that includes definition of significant milestones and a funding source or sources. The regulatory requirements for a launch and reentry license are the same for all applicants; however, FAA expects it will take longer for less experienced operators to meet all of the requirements. As currently required, to exit pre-application consultation and begin the license evaluation period, an application must be complete enough in accordance with § 413.11 (Acceptance of an application). A complete enough application must include enough information for the FAA to start its review. The FAA will screen an application in its entirety or in modules to determine whether it is complete enough for the FAA to start its review. The components of a vehicle operator license application are listed in § 450.31 (General) and include a policy review, a payload review, a safety review that complies with Subpart C, an environmental review, and information necessary to satisfy the maximum probable loss analysis required by part 440.

For the five sections listed in § 450.35(a), an applicant must use a means of compliance that has been accepted by the Administrator prior to application acceptance. An applicant may propose another standard or a unique means of compliance for these five sections before submitting its application.^[20] Furthermore, many requirements throughout the final rule allow an operator to use an alternative method if that method has been agreed to by the Administrator. This allowance maximizes flexibility and will reduce the need for the applicant and the FAA to use process waivers. During pre-application consultation, the FAA anticipates that applicants will discuss the means of compliance they plan to use for the remaining sections of the rule, and any alternative means they plan to use for those sections that allow alternative means of compliance. While the FAA anticipates that this pre-application consultation will expedite license review times and aid both FAA and applicant, it is only required for the sections listed in § 450.35(a).

The final rule has built-in flexibilities for determining the beginning and end of launch such that the launch is scoped to an individual operator's unique circumstances. It is important that the applicant and the FAA come to a mutual understanding during pre-application consultation about the beginning and end of launch for the license. The beginning and end points of a launch operation define the extent of a number of requirements, including, but not limited to, indemnification and FAA oversight. Therefore, an applicant should define the beginning and end of its operation during pre-application consultation, and should coordinate with the FAA before finalizing and submitting its application.^[21] In this way, the applicant can ensure that the FAA will evaluate the complete scope of its proposed operation.

If an applicant is planning to seek a safety element approval, the applicant must continue to consult with the FAA before submitting its application in accordance with § 414.9 (Pre-Application Consultation). Doing so will help ensure that the FAA and the applicant have a thorough understanding of how the applicant will comply with the regulatory requirements surrounding a safety element approval before submitting an application. During pre-application consultation, the FAA would expect an applicant to be able to discuss, at a minimum, the following information as outlined in § 414.15: (1) How the applicant will meet the applicable requirements of part 450; (2) the information required in § 414.13(b)(3), (c)(2), and (c)(3); and (3) the sections of the license application that support the application for a safety element approval.

If an applicant is proposing an incremental review of its application, the applicant must have its approach approved by the FAA prior to submitting its application, in accordance with § 450.33 (Incremental Review and Determinations). Incremental review is intended primarily to give additional flexibility to the applicant, by allowing the applicant to separate the safety review into sections so that those sections can be approved independently. In many ways, the incremental review process is similar to the independent payload review or a safety element approval process because it allows the applicant to comply with the safety approval portion of the regulation in modules or sections rather than all at once. An applicant considering the use of the incremental review process should indicate to the FAA during pre-application consultation which portions of its application will be evaluated under the incremental review process. See the Incremental Review section of this preamble for further discussion.

Finally, part 450 allows an operator to propose alternative time frames for certain requirements, which are listed in Appendix A to part 404. If an operator knows in advance of application submittal that it will propose an alternative time frame, the applicant should raise this proposal during pre-application consultation. The FAA would also be able to discuss during pre-application consultation the FAA's expected review period to make its determination on the proposed alternative time frame. Flexible time frames are discussed at length later in this preamble.

The FAA received several comments on the pre-application consultation process. An individual commenter stated that pre-application consultation may not provide substantial benefits for an existing program and suggested allowing the FAA to request a pre-application consultation process with a 30-day completion timeline for any “material changes” to existing programs deemed as posing a significant risk to the safety of the vehicle. The commenter also suggested the FAA could request this process at least 60 days before the integration of the launch vehicle. The commenter stated that past performance of space flights and aircraft should be taken into consideration for the level of rigor for the pre-application process.

The FAA will not attach a schedule to pre-application consultation but agrees with the commenter that a material change can be discussed as part of pre-application consultation. The FAA acknowledges that pre-application consultation should be minimal for experienced operators using proven vehicles from established sites. This type of abbreviated consultation period for experienced operators would be consistent with the pre-application process prior to issuance of this final rule. The FAA disagrees with a 30-day completion timeline for pre-application consultation for any material change to existing programs. The FAA also disagrees with the suggestion that the FAA request pre-application consultation at least 60 days before integration of the launch vehicle or that pre-application consultation be tied to the flight safety risk of the vehicle. These timelines and criteria may be inadequate in some cases to prepare a complete application properly; in others, they might result in unnecessary delays in addressing and implementing critical safety changes. In addition, the FAA will not tie pre-application consultation to risk to the vehicle because the FAA does not oversee risk to the vehicle but rather risk to the public.

Sierra Nevada noted that operators could work with the FAA to develop a program schedule and define anticipated data submissions during pre-application consultation. Sierra Nevada noted that this use of the consultation process was not specifically codified in the proposed regulations and recommended including it expressly in an AC.

The FAA agrees and will include guidance on application scheduling and data submissions in the pre-application consultation AC. The FAA considered including more robust requirements for pre-application consultation in the final rule, however, the FAA concluded that the current regulation both prepares the applicant to submit a complete application and the FAA to accept it, while also providing flexibility to the applicant to approach pre-application consultation in a manner that best fits the proposed operation.

b. Application Process

In the NPRM, the FAA proposed to clarify in § 413.1 (Scope of this Part) that the term “application” means either an application in its entirety or a portion of an application for incremental review. In § 413.21 (Denial of a License or Permit Application), the FAA proposed to remove “license” from paragraph (c) so the regulation applied to both license and permit applications. In part 414 (Safety Element Approvals), the FAA proposed to change the term “sufficiently complete” to “complete enough,” as used in § 413.11 (Acceptance of an Application), because the two terms both described the point at which the FAA determined it had sufficient information to accept an application and begin its evaluation. Finally, the FAA proposed to amend § 413.7 (Application Submission) paragraph (a)(3) to allow an applicant the option to submit its application by email as a link to a secure server and remove the requirement that an application be in a format that cannot be altered. In the final rule, the FAA adopts these changes as proposed.

A joint set of comments submitted by Boeing, Lockheed Martin, Northrop Grumman, and ULA expressed support for the proposal to allow the submission of an application using physical electronic storage.

In addition, the FAA received suggested changes to the generic application process. The American Association of Airport Executives (AAAE) and the Denver International Airport commented on the need for further engagement with stakeholders during an operator's application process. These commenters said the FAA should provide an opportunity for affected stakeholders to provide input on an operator's application regarding issues such as impacts to the National Airspace System (NAS). Denver International Airport stated that stakeholders should be able to submit comments on license applications.

The FAA does not agree that an application should be open to a public input process. The FAA issues a license based on whether the applicant's proposal will not jeopardize public health and safety, the safety of property, and the national security and foreign policy interests of the United States. The FAA coordinates with government or private entities as necessary to make this determination. A broad public input process outside the environmental review process is unnecessary for the FAA to make its licensing determination. While commenters may seek the opportunity to raise issues such as non-safety impacts to the NAS or the economic impact to land adjacent to a launch, the FAA cannot consider such issues in the licensing determination.

The NPRM specifically sought comments on how the FAA could standardize and better implement the “complete enough” application standard. Sierra Nevada inquired whether the FAA will still conduct a complete enough review. Sierra Nevada concurred with the FAA's approach in conducting complete enough reviews but commented that the FAA should specify a timeline for these reviews. SpaceX commented that the FAA should aim to conduct its complete enough review within ten days of receipt of submission and apply that standard to submissions for continuing accuracy, renewals, and modifications. Furthermore, Sierra Nevada asserted that the review should be included in the FAA's statutory 180-day review period or a new, defined timeline. CSF and SpaceX recommended that the complete enough standard in current § 413.11 be expanded to apply to any application submission, including the initial license application, continuing accuracy submissions, and modification submissions. CSF and SpaceX suggested regulatory text changes to § 413.11 to this end. Both commenters also requested the FAA issue an AC that that explains how the agency makes the complete enough determination, including a checklist comprising regulatory sections that require submissions. Virgin Galactic recommended that what constitutes “complete enough” be agreed upon by both the applicant and the FAA during the pre-application consultation phase and provided several changes to the regulatory text.

The FAA will continue to use the complete enough standard to determine whether a license is sufficiently complete to begin review. The FAA endeavors to make these determinations within 14 calendar days of receiving an application. Limiting the FAA to ten days, as suggested by SpaceX, may not provide adequate time for review. The FAA begins the calculation of the 180-day statutory review period on the date that it receives the information needed to make the application complete enough, regardless of how long it takes to make that determination. The FAA does not base this calculation on the date it determines that the application is complete enough. The complete enough standard applies to any submission, including those for license modifications for consistency. The FAA has applied this standard to submissions for license modifications and, when necessary, requested additional information and clarifications to allow it to proceed with its evaluation. Section 450.211(c) states that an application to modify a license must be prepared and submitted in accordance with part 413. Therefore, § 413.11 is applicable to an initial license application submission and license modification submissions and does not need to be modified to apply to any application submission. The FAA will work closely with applicants on a case-by-case basis to determine what changes may be made without invalidating the license. In accordance with § 450.211(c), the licensee must apply to the FAA for modification of the license once a license has been issued, except for the allowable changes identified by the FAA. An operator may propose an alternate method from part 413 to request a license modification. This alternate method could include an agreed-upon submittal schedule and FAA review period.

It should be noted that § 450.211 (Continuing Accuracy of License Application; Application for Modification of License) also covers license modification submissions related to continuing accuracy. The FAA will provide an AC that includes application checklists that an applicant can choose to use to help guide application submittal. However, additional information may be needed depending on the type of operation.

In response to Virgin Galactic's comments, the FAA agrees that dialogue as to what constitutes “complete enough” can be part of the pre-application consultation, but disagrees that any change in the regulatory text is required. One of the primary purposes of pre-application consultation is to provide the applicant guidance in preparing its license application. Although the FAA determines when an application is complete enough to begin its review, the FAA expects to develop collaboratively agreed upon criteria with an applicant for determining “complete enough” during pre-application consultation. By allowing applicants and the FAA to negotiate criteria for “complete-enough” during pre-application, the FAA anticipates applicants will be able to more predictably track their progress toward completing the application.

CSF and SpaceX also suggested that the FAA provide a substantive response to submittals within 30 days of receiving the application. CSF also suggested the FAA provide status updates to an applicant every two weeks.

The FAA already typically provides written response to submittals within 30 days, often much sooner. In some instances, however, the FAA requires more than 30 days to draft a response, especially for highly technical analyses. The FAA also provides a substantive response to an applicant in writing whenever additional information is required and, therefore, does not see a compelling rationale for a requirement to provide status updates on a predetermined schedule. However, FAA recognizes the concerns expressed by operators regarding extended delays between communications in certain circumstances. While the FAA does not believe establishing a specific time period for communication to applicants is a necessary component of its regulatory framework, it also recognizes the need for applicants to stay informed and anticipates communicating with applicants throughout the application process, including procedural changes to ensure applicants will be provided a status update within 14 days of receipt of an application.

c. Compliance Period for Legacy Licenses (§ 450.1(b))

In the NPRM, under proposed § 450.1(b) and subject to two exceptions, the FAA would permit an operator to conduct a launch or reentry pursuant to a license issued by the FAA under parts 415,^[22] 431, and 435 before the effective date of the new part 450 or an application accepted by the FAA before the effective date of part 450. Even though the operator could continue to conduct operations under the regulations in effect at the time of license or application as referenced above, the proposed requirements under §§ 450.169 for collision avoidance analysis (COLA) and 450.101(a)(4) and (b)(4) for critical asset protection would apply to all operators subject to the FAA's authority under 51 U.S.C. chapter 509 conducting launches after the effective date of the new regulations. The FAA would determine the applicability of part 450 to an application for a license modification submitted after the effective date of the part on a case-by-case basis based on the extent and complexity of the modification, whether the applicant proposes to modify multiple parts of the application, or if the application requires significant reevaluation.

The FAA adopts § 450.1 (Applicability) with revisions. The FAA does not adopt § 450.1(b) as proposed in the NPRM. While the FAA adopts the concept as proposed in § 450.1(b) in parts 415, 417, 431, and 435, it also makes corresponding changes to §§ 413.23 and 415.3 to limit the duration of all licenses issued or renewed to no more than five years after the effective date of part 450. The FAA refers to these licenses as “legacy licenses” throughout this preamble. After that time, all operators must come into compliance with the new regulations. In the final rule, the FAA makes numerous revisions to certain regulations that apply to operators conducting operations under parts 415, 417, 431, and 435. These revisions include amending § 401.5 title to read “Definitions as Applied to Parts 415, 417, 431, 435,” adding new § 401.7 for definitions, updating § 413.1, and amending parts 415, 417, 431, 435, 440, and 460 to reference compliance with part 450.

The FAA notes that certain definitions in § 401.5 apply to parts 415, 417, 431, and 435. Therefore, because the FAA will allow operators that hold an approved license at the time this rule goes into effect, or an accepted license application within 90 days after the effective date of the final rule, to operate under parts 415, 417, 431, and 435 for up to five years, this rule preserves § 401.5 without change. Section 401.5 will be removed five years after the effective date of the final rule.

The FAA adds § 401.7, which contains the definitions that apply to Chapter III other than parts 415, 417, 431, and 435, and which broadly captures those changes proposed in § 401.5 in the NPRM. The FAA notes that parts 415, 417, 431, and 435 and § 401.5 will be removed five years after the effective date of the final rule.

Part 413 explains how to apply for a license or experimental permit. In the final rule, the FAA amends the table in § 413.1(b) to identify that the requirements in parts 415, 417, 431, and 435 apply only to applicants whose launch or reentry license has been approved or license application has been accepted by the FAA no later than 90 days after the effective date of the final rule. As previously mentioned, operators holding an approved launch or reentry license, or who have an accepted launch or reentry license application may choose to continue to operate under parts 415 and 417, part 431, and part 435, until five years after the effective date of this rule. The FAA also adds “Launch and Reentry License Requirements” as a subject in the table in § 413.1(b). Finally, the FAA adopts the provision that the FAA may grant a request to renew a license issued under parts 415, 417, 431 or with a non-standard duration in proposed § 450.1(b) and re-designates it as § 413.23(a)(2) in the final rule. Specifically, the FAA may grant a request to renew a under parts 415, 431, and 435 with a non-standard duration so as not to exceed five years after the effective date of this rulemaking. The FAA adds an applicability section to parts 415, 431, and 435. These parts apply to such licenses issued before the effective date of the final rule and licenses issued on or after the effective date of the final rule if the FAA accepted the application under § 413.11 no later than 90 days after the effective date. All operators must comply with the COLA and critical asset protection requirements in part 450.

In the final rule, the FAA adds the phrase “pursuant to a license issued under part 415 of this chapter” to the scope in § 417.1(a). The FAA also removes § 417.1(e), which addresses grandfathering that is no longer used from when part 417 was first established. For the same reason, the FAA also removes the grandfathering reference to paragraph (e) in § 417.1(f). As a result of this amendment, the FAA re-designates § 417.1(f) and (g) as § 417.1(e) and (f) in the final rule.

The FAA further revises §§ 417.11 and 431.73 in the final rule. The FAA adds a paragraph stating that the Administrator may determine that a modification to a license issued under these parts must comply with the requirements in part 450. The Administrator will base the determination on the extent and complexity of the modification, whether the applicant proposes to modify multiple parts of the application, or if the application requires significant evaluation.

The FAA revises § 440.3, which addresses definitions. In the final rule, § 440.3 references the definitions contained in §§ 401.5 and 401.7. The reference to § 401.5 will be removed from § 440.3 five years after the effective date of the final rule.

Finally, the FAA revises § 460.45 to identify which mishap definitions an operator should apply in the description of the safety record of the vehicle to each space flight participant. Specifically, § 460.45(d)(1) addresses licenses issued under part 450. For these licenses, the operator's safety record must cover events that meet paragraphs (1), (4), (5), and (8) of the definition of a “mishap” in § 401.7 that occurred during and after vehicle verification performed in accordance with § 460.17. Section 460.45(d)(2) addresses licenses issued under parts 415, 431, or 435. For these licenses, the operator's safety record must cover launch and reentry accidents and human space flight incidents as defined by § 401.5. Section 460.45(d)(1) will be re-designated to §§ 460.45(d) and 460.45(d)(2) will be removed from § 460.45 five years after the effective date of the final rule.

Several commenters asked for clarity on the FAA's approach in § 450.1(b) to legacy licenses issued under the current regulations. CSF objected to requiring renewals of licenses issued under the current regulations to meet the requirements of proposed part 450, as this would result in significant cost and regulatory burdens for the operator and the FAA.

As previously noted, the FAA does not adopt § 450.1(b) in the final rule. However, the FAA implements the concept as proposed in § 450.1(b) in parts 415, 417, 431, and 435. In the final rule, the FAA establishes a five-year period after the effective date of this rule. Operators holding either an active license or an accepted license application no later than 90 days after the effective date of this rule may operate under the applicable regulatory provisions upon which the licensing determination was made. In addition, these operators may submit requests for license renewals within that five-year period and will be required to comply with the regulations under which the license determination was made.^[23] The FAA has revised §§ 413.23 and 415.3 to reflect that no license issued under parts 415, 431 or 435 will be renewed with an expiration date that extends beyond the five-year period. As such, applications for renewal submitted near the end of the five-year period will be valid only for a short time. All operators will need to comply with this rule in its entirety five years after its effective date.

CSF noted that operators under current parts 431 and 435 would need to come into compliance with the proposed part 450. Similarly, Virgin Galactic requested that FAA allow currently licensed operators to be grandfathered into part 450 for vehicles that cannot meet certain part 450 requirements as long as the current public safety requirements are met. Virgin Galactic stated that, unlike ELV operators, RLV operators use their vehicles repeatedly, and the FAA has not shown why it is necessary for current operators to undergo new analyses and possible design changes. Virgin Galactic noted that the FAA's aviation regulations allow for “true” grandfathering. Virgin Galactic commented that if the FAA chooses not to allow for “true” grandfathering, it should work with each licensee during pre-application consultation to determine applicability of the new rule to modifications to current licenses.

The FAA notes that as the final rule is more performance-based than the rule as proposed in the NPRM, many of the current requirements would serve as a means of compliance to meet the new regulations. The FAA anticipates that there would be few, if any, additional requirements that will not be fulfilled by previously submitted information. The FAA will not allow operating under parts 415, 417, 431, and 435 indefinitely because the current rule is more streamlined, performance-based, and up-to-date than the previous regulations. Therefore, the FAA will require all operators to come into compliance with the new rule five years after the effective date. The FAA will consult with existing licensees shortly after the final rule is published to assist operators with the transition to part 450 so they may take advantage of the significant number of new flexibilities.

CSF objected to the lack of clarity on grandfathering and recommended that the FAA make clear that a licensee approved under the current licensing regime may continue to renew its approvals, with no significant changes, without having to apply under part 450. License renewals without significant changes may continue to be renewed, but not to exceed the five-year compliance period.

Operators currently holding an active, valid license will have five years after the effective date of this rule to come into compliance with the entirety of part 450. If a license expires before the end of this period, an applicant may seek a renewal under the previous provisions in parts 415, 417, 431, and 435, but the renewal will only be valid for however much time remains between the time of issuance of the renewal and the end of the five-year period.

Virgin Galactic recommended the FAA hold a pre-application phase for all current license holders to ensure that licensees and the FAA are in agreement as to whether the FAA would require part 450 requirements or parts 415, 417, 431, and 435 requirements when an operator requests to modify a legacy license once part 450 becomes effective.

During the five-year compliance period, an operator may need to modify its legacy license. The provisions that relate to modification are contained in §§ 417.11 and 431.73. Whether or not new license modifications need to comply with part 450 is subject to Administrator approval on a case-by-case basis, which can be determined during consultation with the FAA before the applicant requests the modification. In making the determination as to whether a license modification is necessary to comply with the new requirements, the Administrator will consider the extent and complexity of the modification, whether the licensee would need to modify multiple parts of the application, or if the license requires significant reevaluation. The FAA encourages licensees to consult with the FAA on transitioning to part 450 in advance of the compliance period deadline.

d. Definition and Scope of Launch (§ 450.3)

In the NPRM, the FAA proposed to set the scope of activity authorized by a vehicle operator license by identifying the beginning and end of launch in § 450.3 (Scope of Vehicle Operator License).^[24]

i. Beginning of Launch

In § 450.3(b)(1) and (b)(2), the FAA proposed that launch begins under a license with the start of hazardous activities that pose a threat to the public at a U.S. launch site. The proposed rule further stated that, unless agreed to by the Administrator, those hazardous pre-flight ground operations would commence when a launch vehicle or its major components arrive at a U.S. launch site. For a non-U.S. launch site, the FAA proposed that launch begins at ignition or first movement that initiates flight.

In the final rule, the FAA adopts proposed § 450.3(b)(1) and (b)(2) with revisions. First, the FAA does not adopt the proposed default that hazardous ground pre-flight operations commence when a launch vehicle or its major components arrive at a U.S. launch site. The final rule identifies certain activities that qualify as hazardous pre-flight operations, including but not limited to, pressurizing or loading of propellants into the vehicle or launch system, operations involving a fueled launch vehicle, the transfer of energy necessary to initiate flight, or any hazardous activity preparing the vehicle for flight. Second, this rule also clarifies that hazardous pre-flight operations do not include the period between the end of the previous launch and launch vehicle reuse when the vehicle is in a safe and dormant state. Finally, this rule adds language in § 450.3(a) that allows the Administrator to agree to a scope of license different from that laid out in § 450.3(b), as discussed later in this document. An applicant wishing to deviate from the scope of license parameters laid out in § 450.3(b) would discuss the deviation during pre-application consultation. The FAA would only allow a deviation for unique operations where the scope of license continued to cover those hazardous launch activities identified by statute.

CSF, SpaceX, and Virgin Galactic suggested proposed § 450.3(b)(1) be revised to remove reference to the arrival of major components at a U.S. launch site as beginning of launch. Virgin Galactic noted that the beginning of hazardous pre-flight ground operations should be determined only on a case-by-case basis and commented that the arrival of components at a launch site was an inappropriate prescriptive default limit chosen for administrative convenience. CSF, SpaceX, and Virgin Galactic also requested that the FAA limit the beginning of hazardous pre-flight operations only to include potential threats to the public over which no other Federal regulatory agency has jurisdiction.

The FAA agrees that the beginning of pre-flight ground operations should be determined on a case-by-case basis because each operation is unique. The FAA recognizes that with this flexibility comes some ambiguity as to when launch will begin for each unique operation. The designation of when launch begins is important for both operators and the FAA. Among other things, the financial responsibility protections apply from beginning to end of launch. Therefore, a clear understanding of when launch begins is essential for an operator to understand fully its responsibilities under chapter III and for the FAA to satisfy its obligations, including the calculation of maximum probable loss (MPL).

Because the proposed default beginning of launch, phrased as “arrival of major components at a U.S. launch site,” is removed from § 450.3(b)(1) in the final rule, an application requirement is added to § 450.3(d) to require an operator to identify the scope of the license being sought in the application, specifically pre- and post-flight ground operations. The final rule requires an applicant intending to launch from a U.S. launch site to identify pre- and post-flight ground operations such that the FAA is able to determine when the launch operation would begin and end. This requirement applies only to launches from a U.S. launch site, as launches from a non-U.S launch site begin at ignition or first movement that initiates flight. The FAA anticipates that an applicant would identify hazardous pre- and post-flight operations that are reasonably expected to pose a risk to the public. During pre-application consultation, the applicant is expected to describe to the FAA its launch site and its intended concept of operations leading up to a launch, including any operations that are potentially hazardous to the public. Once the FAA and the applicant have a clear, mutual understanding of the applicant's concept of operations, the FAA and the applicant will agree on a starting point for hazardous pre-flight operations, and thus, the beginning of launch. The applicant will provide that information in its application and scope its application materials based on this starting point. The scope of the license lends itself to the first module of an incremental review.

The FAA also agrees that the arrival of components at the launch site is an unnecessarily prescriptive baseline that may not constitute the threshold for hazardous pre-flight operations for all launches. Therefore, the FAA revises § 450.3(b)(1) to remove the reference to arrival of components at a launch site. Because the beginning of launch is an important designation upon which many licensee responsibilities rely, the FAA has added to the regulatory text certain activities that constitute hazardous pre-flight operations. The list of hazardous pre-flight operations added to the final regulatory text is derived from the preamble text in the NPRM explaining the proposal.^[25] Hazardous pre-flight operations include, but are not limited to, pressurizing or loading of propellants into the vehicle or launch system, operations involving a fueled launch vehicle, the transfer of energy necessary to initiate flight, or any hazardous activity preparing the vehicle for flight. This list is not exhaustive, and during pre-application consultation the FAA or an applicant may identify an activity not included in this list that poses a hazard to the public and may constitute the beginning of launch. The FAA retains the ability to determine that licensed oversight is unnecessary for certain activities if the Administrator determines that they do not jeopardize public health and safety, safety of property, and the national security and foreign policy interests of the United States.

The FAA further amends § 450.3(b)(1) to indicate clearly that activities occurring between launches of reusable vehicles will not be considered hazardous pre-flight activities if the vehicle is in a safe and dormant state. Generally, a launch system is in a safe and dormant state when it is not undergoing the pressurizing or loading of propellants, a transfer of energy necessary to initiate flight, operations involving a fueled launch vehicle, or any other hazardous activity preparing the vehicle for flight. The NPRM preamble discussed the exemption of RLVs if a vehicle is in a safe and dormant state.^[26]

One commenter suggested the definition of beginning of flight for hybrid vehicles be changed to include the first forward motion of the vehicle with the intent for takeoff.

The FAA agrees that the beginning of flight for a hybrid vehicle is the first forward motion of the vehicle with the intent to takeoff. However, the FAA will continue to use “first movement that initiates flight” to define beginning of the flight phase of launch because it better accommodates all vehicle types.

Regarding the FAA's jurisdiction over launch activities at a non-U.S. launch site, CSF stated that proposed § 450.3(b)(2) could be problematic for captive carry technologies for which an operator must comply with the oversight of foreign aviation authorities. CSF suggested removing reference to “the first movement that initiates flight.”

The FAA does not adopt CSF's recommendation because the current regulation is flexible enough to accommodate all launch vehicle technologies at non-U.S. sites, as well as comprehensive enough to protect public safety. Starting launch at ignition will not capture the full flight of the captive carry hybrid vehicle system. The FAA regulates all of the components of a hybrid vehicle system, including any captive carry operations under a license; however, as discussed earlier, the flexibility in § 450.3(a) for the Administrator to adjust the scope of license applies to § 450.3(b)(2) as well. In the case of a unique operation for which hazardous activities begin later than first movement or ignition, the Administrator may agree to a different beginning of launch for that operation.

Virgin Galactic recommended that the FAA continue to avoid duplicating oversight and memorialize that commitment in its description of the beginning of launch as starting when hazardous pre-flight ground operations commence at a U.S. launch site that pose a threat to the public and over which no other Federal regulatory agency has jurisdiction.

The FAA has amended the regulation to address duplicative oversight at Federal launch or reentry sites in the final rule. These changes are discussed in the preamble section addressing launch and rentries from a Federal launch or reentry site. The FAA does not agree with the comment that launch under this chapter may only begin at a site over which no other Federal agency has jurisdiction. In fact, many sites, such as Federal sites or launch sites co-located at airports, may be subject to the jurisdiction of multiple Federal agencies depending on the types of activities that are conducted.

ii. End of Launch

In the NPRM, the FAA proposed to amend the definition of end of launch to remove reference to RLVs and ELVs. Although it did not receive comment on this proposal specifically, the FAA makes the following additional changes to the end of launch language: The addition of “vehicle component” and “impact or landing” throughout to ensure the definition captures a broader variety of operations; and the addition of “deployment” in § 450.3(b)(3) to include operations for which a payload remains on the vehicle. Under § 450.3(b)(3) and (c), the FAA replaces each use of “vehicle stage” in the proposed rule in recognition of the fact that components other than vehicle stages may return to Earth. Examples include a discarded engine or payload fairing. In addition, throughout § 450.3(b)(3) and (c), the FAA includes “impact or landing” in the end of launch and reentry sections in the scope of license requirements where the proposal only referred to one or the other or failed to reference either. With the increasing efforts to reuse components, including both impact and landing throughout § 450.3(b)(3) and (c) encompasses a broader range of activities because landing includes a soft vertical landing or runway landing of a vehicle or component, whereas impact is more accurate to describe a hard landing of a stage or component. Under § 450.3(b)(3)(ii), the FAA adds that, for an orbital launch of a vehicle with a reentry of the vehicle, launch may also end “after vehicle component impact or landing on Earth, after activities necessary to return the vehicle or component to a safe condition on the ground after impact or landing.” This additional language accommodates a carrier vehicle landing after the completion of the orbital part of the launch.

CSF, SpaceX, and Virgin Galactic expressed confusion regarding proposed § 450.3(b)(3), and requested clarity regarding proposed § 450.3(b)(3)(iv), including when reentry applies to suborbital vehicles and end of launch. The FAA introduced suborbital reentry in its experimental permit final rulemaking in 2007. In that rulemaking, the FAA stated that:

A suborbital rocket may engage in reentry. For most suborbital launches, whether the flight entails a reentry will not matter from a regulatory perspective. The FAA will authorize the flight under a single license or permit, implementing safety requirements suitable to the safety issues involved. Recognizing suborbital reentry matters for two reasons. First, if a suborbital rocket is flown from a foreign country by a foreign entity into the United States, that entity may require a reentry license or permit from the FAA, depending on whether the planned trajectory of the rocket includes flight in outer space. Second, a permanent site that supports the landing of suborbital rockets may now be considered a reentry site depending, once again, on whether the planned trajectory reaches outer space.^[27]

The NPRM did not propose any change to this framework, and no change is made in the final rule.

Virgin Galactic commented that the FAA should include specific parameters for suborbital reentry. Virgin Galactic also recommended additional regulatory language specifying that, for a suborbital reentry, reentry ends when each vehicle has returned to Earth and has been returned to a safe condition as defined in the operator's application documents. As noted earlier, a suborbital reentry requires flight into outer space.

This distinction does not change when launch ends for a suborbital vehicle because, whether a vehicle or vehicle component impacts or lands on Earth due to a launch or reentry, the launch or reentry would end at the same point in time; namely, after activities necessary to return the vehicle or vehicle component to a safe condition on the ground after landing. (See § 450.3(b)(3)(iv) and (c)).

CSF and SpaceX suggested that orbital launch without a reentry in proposed § 450.3(b)(3)(i) did not need to be separately defined by the regulation, stating that, regardless of the type of launch, something always returns: Boosters land or are disposed, upper stages are disposed. CSF and SpaceX further requested that the FAA not distinguish between orbital and suborbital vehicles for end of launch.

The FAA does not agree because the distinctions in § 450.3(b)(3)(i) and (ii) are necessary due to the FAA's limited authority on orbit. For a launch vehicle that will eventually return to Earth as a reentry vehicle, its on-orbit activities after deployment of its payload or payloads, or completion of the vehicle's first steady-state orbit if there is no payload, are not licensed by the FAA. In addition, the disposal of an upper stage is not a reentry under 51 U.S.C. Chapter 509, because the upper stage does not return to Earth substantially intact.

The FAA proposed in § 450.3(b)(3)(ii) that for an orbital launch of a vehicle with a reentry of the vehicle, launch ends after deployment of all payloads, upon completion of the vehicle's first steady-state orbit if there is no payload, after vehicle component impact or landing on Earth, after activities necessary to return the vehicle or component to a safe condition on the ground after impact or landing, or after activities necessary to return the site to a safe condition, whichever occurs later. The final rule changes “if there is no payload” to “if there is no payload deployment” to clarify the FAA's intent on how to determine the end of launch for a vehicle carrying no payload or payloads that stay onboard a vehicle.

Both CSF and SpaceX proposed “end of launch” should be defined on a case-by-case basis in pre-application consultation and specified in the license. The FAA disagrees, in part. The FAA only regulates on a case-by-case basis if the nature of an activity makes it impossible for the FAA to promulgate rules of general applicability. This need has not arisen, as evidenced by decades of FAA oversight of end-of-launch activities. That said, because the commercial space transportation industry continues to innovate, § 450.3(a) gives the FAA the flexibility to adjust the scope of license, including end of launch, based on unique circumstances as agreed to by the Administrator. Unique circumstances may include, but are not limited to, unconventional technologies like railguns that may use innovative launch and reentry procedures requiring adjustments to a scope of license.

Finally, CSF pointed out that in the proposed rule, for hybrid vehicles, end of launch did not mention the recovery of carrier aircraft.

Section 450.3(b)(3) distinguishes orbital vehicles with and without a reentry, and suborbital vehicles with and without a reentry. A separate section for end of launch for hybrid vehicles is unnecessary because the same parameters apply to hybrids as apply to non-hybrid vehicles regarding end of launch. The FAA also acknowledges that the end-of-launch parameters do not mention the recovery of a carrier aircraft. Again, it is unnecessary to include this distinction because, during launch, a carrier aircraft is considered part of the launch vehicle.^[28] Therefore, to the extent that § 450.3(b)(3) refers to activities necessary to return the vehicle or component to a safe condition on the ground after impact or landing, this reference will include returning the carrier aircraft to a safe condition after impact or landing.^[29]

Blue Origin asked how the FAA plans to prevent disparate impacts of the proposed rule on those operators at multiuse facilities and at U.S. facilities. While the meaning of disparate impacts is unclear, the FAA construes the commenter as asking how the FAA will distinguish between launch and non-launch (e.g., manufacturing or refurbishment of pre-flown stages) activities at a launch site. Because launch begins with the start of hazardous pre-flight ground operations that prepare a vehicle for flight, an operator may manufacture or refurbish launch vehicle components or perform certain other activities on a launch site without requiring an FAA authorization during the time after the end of the launch and before hazardous operations begin for the next launch. This treatment is consistent with existing practice prior to this rule: a vehicle operator could theoretically perform non-launch related activities on a launch site without needing a license as long as those activities are not in the scope of the license and do not pose a risk to public safety.

The Airline Pilots Association (ALPA) suggested the FAA define “family of vehicles.”

The FAA does not define “family of vehicles” in this final rule because the industry continues to innovate and it would be premature to attempt to classify all types of vehicle families for the emerging and still-evolving commercial space industry. As discussed in the NPRM, launch operators often define “family of vehicles” themselves. Usually, the vehicles have similar base operational characteristics, but each member of the family may be capable of different performance characteristics.

AAAE and Denver International Airport believed that operating at a specific site should necessitate a separate and thorough review from the FAA, and that operators should not be able to receive one license covering multiple sites.

The FAA will perform a thorough and complete review of all sites where a vehicle is authorized to operate. An applicant will not be able to add another location to its license “with a lesser review standard” as described by the commenter. A licensee will have to meet all applicable regulations for all sites authorized in a license. Denver International Airport cited 49 U.S.C 50904(d) to argue the FAA lacked statutory authority to grant a vehicle operator permission to operate from multiple launch and/or reentry sites on a single license. The FAA believes Denver International Airport meant to cite 51 U.S.C. 50904(d), which states that the Secretary of Transportation (the “Secretary”) shall ensure that only 1 license or permit is required from the DOT to conduct activities, including launch and reentry. The law does not prohibit the FAA from issuing a license that allows an operator to conduct an approved operation from various sites. Rather, section 50904(d) merely prevents the FAA from requiring multiple licenses for the same type of activity for which a license or permit is required under title 51 chapter 509.

e. Safety Element Approval (Part 414)

In the NPRM, the FAA proposed to change the part 414 term from “safety approval” to “safety element approval” to distinguish it from “safety approval” as used in parts 415, 431, 435, and 450. Also, the NPRM proposed to modify part 414 to streamline the process by enabling applicants to request a safety element approval in conjunction with a license application. The final rule adopts the changes as proposed.

Several commenters expressed general support for the FAA's proposed regulations regarding safety element approvals in part 414. Blue Origin concurred with the FAA's proposal and anticipated many benefits to an applicant's ability to submit a separate safety element approval. One individual commented that more extensive use of these approvals could increase operator flexibility and significantly simplify the licensing process for future launches.

Virgin Galactic recommended an operator that already holds a license be able to use previously submitted data to apply for a safety element approval. Virgin Galactic also noted that the language in the first sentence of proposed § 414.23 should be changed from “safety approval” to “safety element approval” to reflect the updated terminology.

The FAA agrees that an operator that already holds a license may use previously submitted data to apply for a safety element approval. Just as is the case with a license application or modification, an applicant can reference previously submitted data in its safety element approval application. The applicant will need to specify clearly what it is referencing and indicate the referenced material is still valid. In addition, the FAA has corrected “safety approval” to “safety element approval” in §§ 414.23 and 414.3.

An individual commenter suggested a new definition for safety element approvals for hybrid vehicles. The commenter suggested the definition include a reference to hybrid vehicle components that are critical to avoiding or mitigating hazards to the public, including vehicle characteristics.

The FAA does not agree that it should add a separate definition of “safety element approvals” specifically for hybrid vehicles. The definition of “safety element approval” is broad enough to encompass approvals for hybrid and non-hybrid vehicle systems. The definition already includes the phrase “any identified component thereof,” which includes a carrier vehicle. The FAA agrees that it is possible to craft a safety element approval for the types of hazard control strategies employed by hybrid vehicles. The FAA notes that the definition of a “safety element” includes launch vehicle, reentry vehicle, safety system, process, service, or any identified component thereof; or qualified and trained personnel performing a process or function related to licensed activities or vehicles. This definition would allow a hybrid operator to apply for a wide range of safety element approvals.

Regarding process, a joint set of comments submitted by Boeing, Lockheed Martin, Northrop Grumman, and ULA stated an operator should not be required to apply to the FAA to transfer a safety element approval under proposed § 414.33 when the transfer is due to a corporate transaction, reorganization, or restructure that does not affect the material content of the original application.

The FAA will apply the same standard for application, transfer, and issuance of a safety element approval as it does for a license. Name changes and internal corporate restructuring do not typically require a license transfer and therefore will not require a safety element approval transfer.

Microcosm, Inc. (Microcosm), inquired as to how the FAA will issue a safety element approval. The FAA will issue a safety element approval applied for concurrently with a part 450 license in accordance with part 414.

f. Vehicle Operator License—Issuance, Duration, Additional License Terms and Conditions, Transfer, and Rights Not Conferred (§§ 450.5 Through 450.13)

In the NPRM, the FAA proposed requirements addressing the issuance, duration, and transfer of a vehicle operator license in proposed §§ 450.5 (Issuance of a Vehicle Operator License), 450.7 (Duration of a Vehicle Operator License), and 450.11 (Transfer of a Vehicle Operator License), respectively. The FAA also proposed requirements addressing the addition and modification of licensing terms in proposed § 450.9 (Additional License Terms of Conditions). Finally, the FAA proposed requirements describing those rights that would not be conferred by a vehicle operator license in proposed § 450.13 (Rights Not Conferred by a Vehicle Operator License). The FAA proposed these rules to consolidate the requirements for different types of launch and reentry licenses in parts 415, 431, and 435 into a single vehicle operator license.

AIA and Sierra Nevada commented that the FAA should not be allowed to make modifications to the terms and conditions of a license except within a limited time frame and subject to specified procedures to ensure reasonable notice and due process to the vehicle operator. The FAA will not adopt this recommendation and retains the provision in § 450.9 that allows the FAA to modify a vehicle operator license at any time by modifying or adding license terms and conditions to ensure compliance with the Act and its implementing regulations. This provision was introduced in 1999 in 14 CFR 415.11 because the FAA recognized that a particular licensee's launch (or reentry) may present unique circumstances that were not covered by the license terms and conditions in place. Because such a modification would be based on unique circumstances, the FAA is unable to specify a timeline as requested by the commenter.

In the final rule, the FAA adopts these requirements as proposed and adds specificity to § 450.11 to indicate that either the holder of a vehicle operator license or the prospective transferee may request a vehicle operator license transfer, both the holder and prospective transferee must agree to the transfer, and the FAA will provide written notice of its determination to the person requesting the vehicle operator license transfer. These additions mirror the language used for the transfer of a safety element approval and reflect current practice.

The FAA did not receive any comments on these proposed requirements.

3. Part 450 Subpart B—Requirements To Obtain a Vehicle Operator License

a. Incremental Review and Determinations (§ 450.33)

In the NPRM, the FAA proposed to amend part 413 and to include provisions in part 450 to allow an applicant the option for an incremental review of all portions of its application. This proposal was in response to the ARC recommendations. Specifically, the FAA proposed to amend § 413.15 (Review Period) to provide that the time frame for any incremental review and determinations would be established with an applicant on a case-by-case basis during pre-application consultation. As stated in the NPRM, the FAA did not propose to reduce by regulation the statutory review period of 180 days.

In the final rule, the FAA provides clarification on the basis the Administrator would consider when approving an incremental approach.

In the NPRM, the FAA sought comment on how a formal incremental review process would account for the statutory 180-day review period when application increments or modules are likely to be submitted and reviewed at different times, other useful guidelines for applicants crafting incremental approaches, and any safety approval sections that would be appropriate for incremental review. The FAA did not receive any comments with feasible solutions on any of these topics.

Several commenters expressed support for the FAA's proposed incremental review process, stating that it would increase flexibility. Virgin Galactic supported the FAA's proposed approach to incremental review and commented that it aligned with many other approval processes in other divisions of the FAA.

Many commenters, including Leo Aerospace, Microcosm, Sierra Nevada, SpaceX, and Virgin Orbit asked about the duration of incremental review periods. Noting the FAA's statutory mandate to issue a license determination not later than 180 days after accepting an application, commenters inquired whether each module would be subject to this 180-day review period. Several commenters, including CSF and Sierra Nevada, stated they interpret the 180-day statutory requirement to mean that the sum total of all module reviews must not exceed 180 days. Commenters noted that if every module was subject to a 180-day review, the process would be very time-intensive.

Until the FAA has more experience with the incremental review process, the FAA will review each module in accordance with a schedule discussed with the prospective applicant during pre-application consultation. In developing the incremental review schedule, the FAA will consider the interdependence of parts of the evaluation and the sequence of their submissions. The FAA makes these criteria explicit in this rule in § 450.33 (Incremental Review and Determinations) paragraphs (b)(1) and (b)(2).^[30]

Review of any modules prior to submittal of an application in its entirety will not initiate or be bound by the statutory 180-day review period. Rather, an agreed upon review period will begin once the FAA has a complete enough application in its entirety. During pre-application consultation, an applicant seeking an incremental review may negotiate a time frame shorter than the statutory 180-day review period. As the FAA gains more experience with the incremental review process, it may develop guidance concerning expected timelines for various sequences of modular submissions.

Sierra Nevada commented that, if a module is denied, proposed § 413.21 (Denial of a License or Permit Application) should allow the FAA to extend the review period by up to 60 days to consider a revised application. The commenter noted it supports the FAA's practice of tolling the review period in the case of a deficient application as long as the applicant understands the deficiency and what must be submitted for the FAA to continue its review. Leo Aerospace inquired whether an application would be considered accepted after the incremental process is defined, or after the last step of the incremental process is completed, and asked how an operator would be notified if its safety review was accepted.

Sierra Nevada's interpretation of incremental review is incorrect because a module cannot be denied under § 413.21. If the FAA determines a module does not contain sufficient information, the FAA and the applicant will discuss amending the agreed upon incremental review schedule to allow time for the applicant to submit a revised module. An applicant will be notified in writing when its complete application has been accepted.

Sierra Nevada noted the primary concern with module time frames was the transparency of the FAA's license application process and the ability for operators to reduce operational risk associated with the various time frames. To that end, a number of commenters, including Sierra Nevada, Leo Aerospace, and SpaceX, requested the FAA provide an outline of acceptance and review timelines and example timelines for incremental applications. CSF and Sierra Nevada agreed with the FAA's proposal to establish the timeline for incremental submissions in the pre-application phase but suggested the FAA include in an AC its goal for maximum review time frames for particular modules. CSF and Sierra Nevada recommended the AC include the following time frames: 60 days for policy approval; 30 days for payload review; 60 days for safety approval; 5 days for environmental assessment; and 15 days for financial responsibility assessment. CSF and Sierra Nevada noted that the FAA's review of the environmental assessment should only take 5 days because the FAA has had insight into the contractor used to conduct the environmental assessment, and the FAA's review should therefore simply be a verification that the applicant has submitted the final product. CSF and Sierra Nevada acknowledged that the financial responsibility assessment could take longer than 15 days for methods other than obtaining insurance, but stated that this possibility could be mitigated by the FAA's providing guidance that addresses the type of information that a licensee would need to submit to satisfy FAA review under § 440.9(f).

Commenters suggested that time frames for incremental review should be based on the complexity of the review and that they should be shorter than the statutory limit for the review of a complete application. Specifically, Virgin Galactic commented time frames should be based on the complexity of the item being reviewed. Sierra Nevada recommended modules be subject to a shorter review time frame than full application reviews and to define that time frame in § 413.15. Sierra Nevada stated the FAA should consider a shorter timeline of 90 days for review of a license application in order to meet the direction in Space Policy Directive-2 to streamline the review process.

The FAA declines to incorporate the suggested time frame changes because they will not provide adequate time for the FAA to assess application materials for completeness in all situations and for all potential applications. The FAA agrees that modules will likely be reviewed faster than an entire application, and that review times will depend largely on complexity; however, at this point it is premature to define those time frames until FAA has more experience with incremental reviews. The FAA will not at this time adopt maximum time frames, because each evaluation is a unique review that must be adjusted to each operation. The FAA's evaluation of the safety implications of an application typically requires the most effort and time, usually far more than the 60 days suggested by the commenters. The MPL is derived from the safety analysis and cannot be completed independently of it. An environmental review must be completed before a license can be issued. Particularly for new operations, the environmental process can be lengthy, and the FAA advises applicants to begin it early, even before a license application is submitted. For example, an applicant must submit a completed environmental impact statement (EIS) prepared by the FAA (or an FAA-selected and managed consultant contractor), FAA-approved environmental assessment (EA), categorical exclusion determination, or written re-evaluation as part of its application materials. The 180-day statutory application review period is not intended to encompass the time needed for the applicant to develop the necessary application materials, including environmental documentation. Five days may not be enough time to evaluate an environmental document, such as a complex EA.

For conventional operations that do not pose substantial policy-related challenges, policy and payload reviews can be conducted in less time than the safety review. However, these reviews are often performed concurrently with the safety review so their completion typically does not reduce the overall time required to reach a license determination. As the FAA gains more experience with the incremental review process, it may elect to update guidance to reflect timelines that have consistently proven effective.

Submitting an application incrementally affords an applicant the approval of various systems and processes earlier than the current non-incremental review process. The FAA expects that the central value of an incremental approach is regulatory certainty for components of the application and flexibility for applicants rather than a reduction in overall review time. However, the FAA anticipates that a determination of an accepted application that utilizes safety element approvals or approved modules will be completed faster than a similar application that does not use safety element approvals or incremental review.

Sierra Nevada recommended that an AC should also address the type of information a licensee would need to submit for the FAA's financial responsibility review. The financial responsibility requirements contained in part 440 are beyond the scope of this rulemaking. However, the financial responsibility requirements are adequately addressed in Appendix A to Part 440—Information Requirements for Obtaining a Maximum Probable Loss Determination for Licensed or Permitted Activities. Virgin Galactic recommended the FAA take into account FAA AVS^[31] Project Specific Certification Plans to inform the incremental review process in proposed part 414. The FAA will discuss project-specific information, including AVS documents, during pre-application consultation.

Virgin Galactic also inquired how the operator would be notified when the operator's safety review has been accepted or rejected. The FAA will inform an applicant in writing as to whether each module is accepted or rejected.

b. Means of Compliance (§ 450.35)

In the NPRM, the FAA proposed that an applicant would be required to use an accepted means of compliance for the following requirements: Highly reliable FSS, FSA methods, lightning flight commit criteria, and airborne toxic concentration and duration thresholds for both flight and ground hazards. For these requirements, the means of compliance would need to be accepted by the FAA prior to the submission of an application. For all other performance-based requirements, an applicant would be able to use a means of compliance proposed in an application.

While the final rule maintains that an applicant must use an accepted means of compliance in an application for specified requirements, the FAA has made amendments to the structure of the regulatory text to identify more clearly that the use of accepted means of compliance is an application requirement. This requirement is now specified in § 450.35(a) of the final rule.

As stated above, for those five sections now identified in § 450.35, an applicant must use a means of compliance in its application that has been reviewed and accepted by the Administrator. The FAA will not accept an application that uses a means of compliance that has not already been accepted by the Administrator for any of the five requirements listed in § 450.35. The five requirements listed in § 450.35 are essential to public safety and involve well-established and complex methodologies, thresholds, or practices. Because of the complex nature and public safety impact of these requirements, the FAA would be unable to review unique means of compliance for these five requirements during its application evaluation within its review time frame. Rather, an applicant could choose to use an accepted means of compliance in its evaluation, or could submit a unique means of compliance for review and acceptance prior to submitting its application. Unique means of compliance for the requirements identified in § 450.35 may require evaluation before they are accepted as demonstrating fidelity and safety, however this rule allows unique means of compliance for these sections to be submitted in advance of a license application in order to provide flexibility and enable innovative concepts. For all other sections of part 450, an applicant may propose in its application a means of compliance that has not been previously accepted by the Administrator, and the FAA will review the means of compliance as part of its application review process. It is worth noting that an applicant who uses means of compliance that have already been accepted by the FAA in its license application will likely experience a more expeditious license review and determination.

A means of compliance is one means, but not the only means, by which a requirement can be met and may be used to demonstrate compliance with any of the performance-based requirements. For all performance-based requirements other than those listed in § 450.35, an applicant may include a unique means of compliance in an application for the FAA to review during the application evaluation. In the NPRM docket,^[32] the FAA included a table listing all publicly available means of compliance for each proposed performance-based requirement (the “Means of Compliance Table”) in subpart C that the FAA has accepted to date. An applicant need not include the entirety of an accepted means of compliance standard in an application, but may instead reference the accepted means of compliance using identifying features such as title and date or version.

Several commenters interpreted the NPRM as only allowing the means of compliance listed in the Means of Compliance Table. Conversely, the CSF commented that applying means of compliance flexibility only to the regulations cited in the Means of Compliance Table would be too limited, and should be expanded. The CSF also requested that the FAA remove or correct the preamble text to reflect that any applicant can seek to add an accepted means of compliance to the Means of Compliance table. The CSF specifically mentioned that the FAA should allow flexible means of compliance to meet the conditional expected casualty calculation in proposed § 450.101(c). SpaceX also commented that the FAA should expand the scope of flexible means of compliance and specifically identified proposed § 450.101(c).

The FAA emphasizes that any requirement in part 450 can have one or more means of compliance. The Means of Compliance Table provides one way, but not the only way, to meet the requirements in part 450. The conditional expected casualty thresholds in proposed § 450.101(c) were intended as safety criteria to measure and protect against potential high consequence events. In the final rule, the FAA has clarified § 450.101(c) to allow alternative demonstrations of high consequence event mitigation. This change is discussed in detail later in the preamble. The FAA will review the submitted means of compliance to determine whether they satisfy the regulatory safety standard. These means of compliance may be government standards, industry consensus standards, or unique means of compliance developed by an individual applicant. For government standards or means of compliance developed by a consensus standards body, the FAA will provide public notice of those accepted means of compliance that it determines satisfy the corresponding regulatory requirement. The FAA will also review unique means of compliance developed by an individual applicant to determine whether they satisfy the regulatory requirement.

Once a means of compliance is accepted by the FAA, it may be used to demonstrate compliance with the corresponding regulatory requirement. An updated Means of Compliance Table will be placed on the docket once the final rule publishes. This updated table identifies the means of compliance accepted by the FAA at this time for the corresponding regulation. This table will be made available on the FAA website and updated as additional means of compliance are accepted by the FAA. Unique individual operator-developed means of compliance will not be included in the Means of Compliance Table to protect proprietary information, unless the operator that developed the means of compliance requests that its means of compliance be included.

CSF requested that the FAA clarify that it would not require compliance with an untailored RCC 319 ^[33] in order to demonstrate reliability. Blue Origin commented that the preamble does not address accepted means of compliance as a standalone flexibility measure. CSF and SpaceX commented that the proposed rule risks being quickly outdated and could discourage innovation because it does not allow tailoring of the requirements.

This rule does not require compliance with an untailored RCC 319 in order to demonstrate reliability; however, at this time, RCC 319 is the only accepted means of compliance for flight abort with a highly reliable FSS under § 450.145. An applicant may propose a tailored version of any accepted means of compliance, including RCC 319. If an applicant wishes to tailor RCC 319, the applicant must propose its tailored means of compliance as a unique means of compliance in advance of its license application. An applicant may include any unique means of compliance as part of its license application, other than those sections identified in § 450.35(a) that require a means of compliance to be accepted prior to application submittal. An applicant may also propose a unique means of compliance to meet these requirements in advance of its license application.

An individual commenter recommended that the FAA allow tailoring and include a clause to attend United States Air Force (USAF) tailoring meetings as part of meeting parts 415 and 417 requirements. As noted earlier, the FAA does allow tailoring. Part 450 will not change the FAA's current practice of attending tailoring meetings.

Virgin Galactic also recommended that the current part 417 appendices and range analyses continue to satisfy the requirements in part 450, and that the FAA complete its Launch Site Safety Assessments (LSSAs) in order for operators to know which Federal launch or reentry site's analyses and processes the FAA would find acceptable as means of compliance. ULA commented that the rule should more clearly allow work performed by another Federal agency to meet FAA requirements.

The part 417 appendices that can be used as an accepted means of compliance to part 450 requirements are listed in the Means of Compliance Table in the docket. The FAA agrees that it needs to determine and communicate to the industry which Federal launch or reentry site analyses and processes satisfy part 450. As noted earlier, the FAA will accept any safety-related launch or reentry service provided by a Federal launch or reentry site or other Federal entity by contract, as long as the FAA determines that the launch or reentry service satisfies part 450.

The New Zealand Space Agency (NZSA) and Virgin Galactic asked what process and standards the Administrator would employ for accepting means of compliance. Virgin Galactic asked what accepted means of compliance would be and whether the Administrator would use means of compliance that have not been published. Virgin Galactic also stated that means of compliance would need to be published prior to any work being performed that would require the means of compliance. Northrup Grumman supported the publication of newly accepted means of compliance.

The FAA will provide public notice of each publicly available means of compliance that the Administrator has accepted by posting the acceptance on its website. This notification will communicate to the public and the industry that the FAA has accepted a means of compliance or any revision to an existing means of compliance. The FAA will not post unique means of compliance documents with proprietary information submitted by applicants, unless specifically authorized by the applicant. The applicant may wish to consider offering its unique means of compliance to a consensus standards body for inclusion as part of an industry-developed consensus standard. The final rule does not adopt proposed § 450.35(b), which stated that the FAA would provide public notice of each means of compliance that the Administrator has accepted. The FAA removes this requirement because it is not a licensing requirement.

Proposed § 450.35(c) is amended and renumbered as § 450.35(b). The provision is renumbered because the final rule removes the proposed § 450.35(b), as discussed previously. In the final rule, § 450.35(b) allows a person to submit a means of compliance to the FAA for review outside the licensing process. The means of compliance must be submitted in a form and manner acceptable to the Administrator. The proposed rule limited this provision to applicants, whereas the final rule would allow any person to request acceptance of a proposed means of compliance. This is because the FAA anticipates other people or entities other than applicants may wish to submit a proposed means of compliance, such as operators that plan to be applicants in the future, and voluntary consensus standards bodies. The FAA wants to enable this. Section 450.35(b) is limited to requests for acceptance of a proposed means of compliance outside a license application, because the license application process is already defined in parts 413 and 450. Lastly, the FAA changes the modifier in front of “means of compliance” from “alternative” to “proposed.” The term “proposed” is better suited to the types of means of compliance the FAA would expect from this provision.

The process the FAA employs to accept a means of compliance will be set forth in guidance. ^[34] When submitting a unique means of compliance, an applicant's proposal should identify the regulation that the proposed means of compliance will address and provide the rationale as to why it demonstrates compliance with the applicable regulation. When reviewing a unique means of compliance, the FAA will consider past engineering practices, the technical quality of the proposal to demonstrate compliance with the part 450 regulations, the safety risk of the proposal, best practice history, and consultations with technical specialists for additional guidance.

NZSA and Virgin Galactic asked how the FAA would protect an operator's proprietary information when publishing means of compliance. NZSA recommended that the FAA retain the ability to share, with consent of the applicant, information about the means of compliance used to issue a license that may include proprietary information.

As a general matter, the FAA does not share proprietary data with the public. The FAA will treat any proprietary data linked to a unique means of compliance in the same manner as it protects proprietary data that an applicant uses to support a license application.

An individual commenter suggested the development of a Space Safety Institute to develop industry consensus standards. A consensus standards body, any individual, or any organization would be able to submit means of compliance documentation to the FAA for consideration and potential acceptance. The FAA recommends that in developing standards, a voluntary consensus standards body consider the processes outlined in OMB Circular A-119.

c. Use of Safety Element Approval (§ 450.39)

In the NPRM, the FAA proposed §  450.39 (Use of Safety Element Approval) to allow an applicant to use any vehicle, safety system, process, service, or personnel for which the FAA has issued a safety element approval under part 414 without the FAA's reevaluation of that safety element during a license application evaluation to the extent its use is within its approved envelope. The proposed rule would also change the part 414 term from “safety approval” to “safety element approval” to distinguish it from “safety approval” as used in parts 415, 431, and 435, and proposed part 450, because these terms have different meanings.

In the final rule, the FAA replaces the word “envelope” with the word “scope.” “Scope” more accurately captures “envelope, parameter, or situation” as used in the definition of “safety element approval.” For consistency, the same change is made in § 437.21.

d. Policy Review (§ 450.41)

In the NPRM, the FAA proposed to remove the requirement that applications include, for the purpose of conducting a policy review, information related to the structural, pneumatic, propulsion, electrical, thermal, guidance, and avionics systems used in the launch vehicle and all propellants. Instead, in order for the FAA to conduct its policy review, the FAA proposed that an applicant identify the launch or reentry vehicle and its proposed flight profile and describe the vehicle by characteristics that include individual stages, its dimensions, type and amounts of all propellants, and maximum thrust. In the final rule, the FAA adopts § 450.41 (Policy Review and Approval) as proposed.

Boeing, Lockheed Martin, Northrop Grumman, Sierra Nevada, and ULA suggested the FAA change the word “normal” in proposed § 450.41(e)(4)(iv) to “nominal” to be consistent with industry vernacular.

The FAA disagrees with this suggestion because the FAA seeks a range of possible impact areas in this section, not a particular impact point inferred by the use of “nominal.”

Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the FAA add to § 450.41(b)(3) the phrase “but not limited to” in order to allow the FAA to consult Federal agencies other than the National Aeronautics and Space Administration (NASA).

The FAA disagrees that the additional language is needed to clarify that the FAA may consult Federal agencies other than NASA pursuant to § 450.41(b)(3). The term “include” implies the phrase “but not limited to.”

The FAA notes, consistent with current practice, that if a launch or reentry proposal would potentially jeopardize U.S. national security or foreign policy interests, or international obligations of the United States, the FAA may seek additional information from an applicant in support of interagency consultation to protect U.S. Government interests.

An individual commenter recommended the FAA require licensees to comply with the Committee on Space Research's planetary protection policy (COSPAR PPP) as a means of ensuring that commercial launches comply with the Outer Space Treaty and of resolving existing gaps in the statutory prohibition on obtrusive advertising in outer space.

The FAA acknowledges the commenter's concerns, but the scope of this rulemaking does not encompass COSPAR's PPP or the statutory prohibition on obtrusive advertising.

e. Payload Reviews (§ 450.43)

In the NPRM, the FAA proposed to consolidate payload review requirements, remove the requirement to identify the method of securing the payload on an RLV, add application requirements to assist the interagency review, such as the identification of approximate transit time to final orbit and any encryption, clarify the FAA's relationship with other Federal agencies for payload reviews, and modify the 60-day notification requirements currently found in §§ 415.55 and 431.53.

The FAA stated in the NPRM preamble that, while it would review all payloads to determine their effect on the safety of launch, the FAA will not make a determination on those aspects of payloads that are subject to regulation by the Federal Communications Commission (FCC) or the Department of Commerce or on payloads owned or operated by the U.S. Government. In addition, the proposed rule added informational requirements that would include the composition of the payload and any hosted payloads, anticipated life span of the payload in space, any planned disposal, and any encryption associated with data storage on the payload and transmissions to or from the payload. Finally, the NPRM proposed to preserve the ability of payload operators to request a payload review independent of a launch license application. The FAA sought comments on the approach of including more requirements for a payload review in the regulation in order to expedite payload review application processing, but received none.

In the final rule, the FAA adopts § 450.43 (Payload Review and Determination) with revisions. The FAA adds the term, “if applicable,” to §§ 450.31(a)(3) and 450.43(a) to clarify that a payload review is not always required. The FAA notes that all payloads include any hosted or secondary payloads.

The Commercial Smallsat Spectrum Management Association (CSSMA) suggested that the FAA adopt a sixty (60) day timeline for independent payload review. CSSMA found little incentive for a payload owner or operator to use the independent payload review process, absent a fixed timeline for such payload reviews. CSSMA also recommended language that would render § 413.21(a) (Denial of a License or Permit) applicable to independent payload reviews.

The FAA declines to revise § 413.21(a) as suggested because the payload review is a requirement to obtain a launch or reentry license under part 450. The FAA notes that a favorable payload determination does not itself constitute a license. As such, the procedures set forth in § 413.21(a) do not apply to payload reviews, whether conducted independently of or in conjunction with a license application.

The FAA also declines to incorporate CSSMA's suggested timeline for review. The FAA has not specified a timeline to complete payload reviews independent of a license application because, historically, payload owners or operators have requested such reviews for unique missions that have raised novel concerns regarding public health and safety, safety of property, or national security or foreign policy interests of the United States. Because independent payload reviews often raise complex issues and often require extensive interagency consultation, the FAA cannot anticipate a standard timeline for payload reviews conducted independently from a license application. Accordingly, FAA will not establish a standard timeline for such reviews in its regulations. Applicants are encouraged to discuss timelines to review their particular proposals during pre-application consultation.

NZSA requested the FAA include in the final rule all legislative or regulatory standards by which the FAA will assess payloads at the application stage. NZSA stated that doing so would give owners of novel payloads and non-U.S. operators regulatory certainty on the standards they must meet to be launched on a vehicle licensed by the FAA. As one example of a rule that would affect payload review but did not appear in proposed § 450.41, NZSA cited the prohibition on launching payloads for “Obtrusive Space Advertising.”

The FAA declines to expand the bases for issuing an unfavorable payload determination beyond those set forth in § 450.43(a). It would not be practical to list every law, regulation, and policy that may possibly affect a proposed payload under § 450.43. Rather, applicants are required to complete a pre-application consultation during which the FAA can learn about the proposed action and advise the applicant on a path forward, including any U.S. regulations, laws, or policies that may impact its proposal. Payload owners and operators may also use the independent payload review process set forth in § 450.43(d), which provides greater regulatory certainty for novel payloads.

Virgin Galactic suggested the FAA treat payloads that stay within a vehicle as additional equipment on the launch vehicle, subject only to the safety analysis required of any other piece of equipment on board a launch vehicle. Virgin Galactic commented that requiring a payload review for items not ejected from a launch vehicle places an unnecessary burden on operators and the FAA. Virgin Galactic also requested clarification on seemingly contradictory language in the NPRM preamble regarding a payload placed in outer space versus a payload that remained on or within the vehicle.

The FAA disagrees with Virgin Galactic's suggestion. Payloads that (1) stay within a vehicle, (2) do not contain hazardous materials, or (3) have previously been approved may require less scrutiny but are still being placed in outer space and therefore meet the 14 CFR 401.5 definition of “payload” and require a payload review. Under 51 U.S.C. 50904(c), the FAA must verify that all licenses, authorizations, and permits required for a payload have been obtained; and that the proposed launch or reentry will not jeopardize public health and safety, safety of property, U.S. national security or foreign policy interests, or international obligations of the United States. The FAA therefore declines to exclude from the requirement to obtain a payload review any payload that remains on the vehicle.

Virgin Galactic recommended the FAA amend proposed § 450.31(a)(3), which seemed to require favorable payload determinations for any launch or reentry, noting that not all vehicles carry payloads. Absent this amendment, Virgin Galactic commented it would need to seek a waiver for each non-payload flight, creating an unnecessary burden.

The FAA agrees that an applicant does not need to seek a payload determination if the proposed launch or reentry will not involve a payload. Therefore, the FAA revises § 450.31(a)(3) by adding the phrase, “if applicable.”

Space Logistics, LLC (Space Logistics) urged the FAA to coordinate with other Federal agencies before expanding its payload review process in order to avoid duplicating activities. Space Logistics noted that the requirements to describe encryption associated with a payload's data storage and transmissions and to provide any information deemed necessary by the FAA under proposed § 450.43(i) were open-ended and may duplicate requirements of the FCC, NASA, the National Oceanic and Atmospheric Administration (NOAA), or Office of Space Commerce (OSC).

The FAA agrees with Space Logistics's comment that Federal agencies must continue to streamline requirements applicable to commercial space activities and work closely to eliminate duplicative requirements and minimize review times for policy and payload issues. The FAA has engaged its Federal partners in this rulemaking process in order to minimize duplication. For instance, the FAA proposed to require that applicants provide encryption data (in § 450.43(i)(1)(x)) in part to support the Department of Defense (DOD) review of payloads for impacts to national security. Encryption information allows the DOD to assess impacts on national security due to potential cyber intrusion or loss of vehicle control. Through its interagency coordination, the FAA endeavors not to request information already provided to other Federal agencies.

Boeing, Lockheed Martin, Northrop Grumman, and ULA suggested adding to proposed § 450.43(a) a requirement for FAA coordination with the applicable Federal agency to ensure that the payload will not interfere with or impede launch, on‐orbit operations, or reentry of other approved missions. The commenters stated this addition would avoid adverse impacts to other federally-approved missions or operating systems.

Although the FAA agrees that coordination with applicable Federal agencies is important to ensure a payload or payload class will not interfere with agency operations, the FAA disagrees that the recommended addition to § 450.43(a) is necessary. The interagency coordination required for both payload and license application review, coupled with the criteria set forth in § 450.43(a)(1) and (a)(2), adequately addresses the commenters' concerns. Those provisions direct that the FAA will issue a favorable payload determination if (1) the applicant, payload owner, or payload operator has obtained all required licenses, authorizations, and permits; and (2) the launch or reentry of the payload would not jeopardize public health and safety, safety of property, U.S. national security or foreign policy interests, or international obligations of the United States. The FAA notes, consistent with current practice, that if a payload or payload class presents a potential risk to an agency's asset or other mission, the FAA may seek additional information from an applicant on behalf of the agency to protect U.S. Government interests and assets consistent with these two objectives. However, in light of commenters' concerns, the FAA is working with the appropriate agencies to increase transparency and support the development of agency guidance on the interagency consultation process during a payload review. The FAA also plans to publish its own guidance on payload review, in the form of an Advisory Circular, which will reference NASA, DOD, or other agency guidance. Insight into the interagency process will help operators anticipate what questions and concerns may arise during interagency consultation, which may vary depending on the operation, and will allow operators to be better prepared to address any potential issues during payload review. To the extent the commenters intended to address space traffic management or access-to-space issues, such matters exceed the scope of this rulemaking.

Boeing suggested the FAA refrain, in proposed § 450.43(b)(2), from issuing a determination on payload components owned, sponsored, or operated by the U.S. Government. Similarly, Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the FAA exclude from the review requirement in proposed § 450.31(a)(3) any payloads that have undergone safety review or received approval by another Federal agency.

The FAA declines to exclude from review under § 450.43(b) payloads that are sponsored by the U.S. Government. Section 450.43(b)(2) excludes payloads owned or operated by the U.S. Government. Payloads that are not owned or operated by the U.S. Government may not have undergone the same scrutiny, and hence the FAA review is warranted. The FAA also disagrees with the recommended change to § 450.31(a)(3). Although the FAA does not make a determination on those aspects of payloads that are subject to regulation by other Federal agencies, the FAA does review all payloads to determine their effect on the safety of launch, which may differ from the purpose of another agency's payload review. As such, no change from the proposal is made.

Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended adding to the agencies listed in proposed § 450.43(e)(3) the FCC, NOAA, and the National Telecommunications and Information Administration. The commenters also proposed adding to the interagency consultation process set forth in proposed § 450.43(e) a requirement that the FAA consult with Federal launch or reentry sites to coordinate facility information for MPL determination, and to coordinate collision avoidance analysis with the cognizant Federal agency, when the launch or reentry activity is not on a Federal launch or reentry site. The commenters stated that operators should not have to obtain and provide Federal site facility information, which is often sensitive and not available to commercial operators.

The FAA disagrees that the recommended addition to § 450.43(e)(3) is necessary. The list of agencies that the FAA consults with under § 450.43(e) is not exhaustive and does not preclude consultation with any other Federal entity in order to ensure that a payload meets the criteria set forth in § 450.43. With respect to the recommendation for the FAA to add the interagency consultation process to its MPL determination, current regulations address coordination. In addition, changes to part 440 are outside the scope of the rulemaking. In accordance with 14 CFR 440.7(b), the FAA consults with Federal agencies that are involved in, or whose personnel or property are exposed to risk of damage or loss as a result of, a licensed activity and obtains any information needed to determine financial responsibility requirements. Similarly, collision avoidance analysis is conducted wholly outside of the payload review. Part 450 provides for coordination of collision avoidance analyses with the cognizant Federal agency, though this coordination is primarily conducted on a launch-by-launch basis, and well after the payload review process, which often occurs during the application review process.

f. Safety Review and Approval (§ 450.45)

i. Launch and Reentries From a Federal Launch or Reentry Site (§ 450.45(b))

In the NPRM, to address concerns regarding duplicative government requirements at Federal launch or reentry sites, the FAA proposed largely performance-based requirements for both ground and flight safety that an operator could meet using Air Force and NASA practices as means of compliance. The FAA pointed out that it issues a safety approval to a license applicant proposing to launch from a Federal launch or reentry site if the applicant satisfies the requirements of part 415, Subpart C (Safety Review and Approval for Launch from a Federal Launch Range), and has contracted with the Federal site for the provision of safety-related launch services and property, as long as an FAA LSSA shows that the site's launch services and launch property satisfy part 417. The FAA did not refer to the LSSA process in the regulatory text in proposed part 450. The FAA did propose, in § 450.45 (Safety Review and Approval) paragraph (b), that the FAA would accept any safety-related launch or reentry service or property provided by a Federal launch or reentry site or other Federal entity by contract, as long as the FAA determined that the launch or reentry services or property provided satisfy part 450.

The FAA adopts § 450.45(b) as proposed, with one revision. The FAA changes the reference to “Federal range” to “Federal launch or reentry site” throughout part 450, to include NASA and DOD launch and reentry sites.

As discussed in the NPRM preamble, the FAA assesses each Federal launch or reentry site and determines if the Federal site meets FAA safety requirements. If the FAA assessed a Federal launch or reentry site and found that an applicable safety-related launch service or property satisfies FAA requirements, then the FAA treats the Federal site's launch service or property as that of a launch operator's, and there is no need for further demonstration of compliance to the FAA. The FAA reassesses a site's practices only when the site changes its practice. The final rule maintains the position discussed in the NPRM, namely that these performance-based regulations allow an operator to use DOD and NASA practices as a means of compliance. In addition, this rule introduces a provision that allows operators operating from certain Federal sites to opt out of demonstrating compliance with the FAA's ground safety requirements.

CSF and Space Florida submitted comments indicating their dissatisfaction with the NPRM's approach to reducing duplication regarding launch from a Federal launch or reentry site. ULA encouraged the FAA to reduce duplication between the FAA and Federal sites.

Northrop Grumman commented that the FAA should accept the Federal launch or reentry site safety processes as satisfying FAA requirements because it was reasonable to presume changes to launch range regulations would continue to provide for safe pre-flight and flight operations on Federal launch or reentry sites. Similarly, SpaceX stated that part 450 or its supporting documents should reference agreements between the FAA and other Federal entities, including the USAF, which allow each agency to accept the analyses and technical determinations of the other. Blue Origin commented that it looks forward to understanding the contents of any agreements between the ranges and the FAA.

Another individual commenter raised similar concerns that the FAA's proposed licensing regulations do not resolve long-standing issues with duplicative and overlapping rules burdening commercial launch operators at the KSC and CCAFS. CSF stated that duplicative or conflicting rules among overlapping Federal jurisdictions create a barrier to entry for small startups and unnecessarily increase the cost of space access to all users by forcing all providers either to pass those costs on to their customers (including the U.S. Government) or to be denied the availability of new capabilities due to lack of bandwidth and resources. CSF argued that this burden will drive internationally-competed business to other countries to avoid the cost or schedule impacts arising from duplicative, conflicting, and overlapping sets of rule. CSF also argued the FAA did not address the overlapping jurisdiction of the FAA and other Federal and State agencies (the Occupational Safety and Health Administration (OSHA), the Environmental Protection Agency (EPA), the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), and their State and local equivalents) for hazardous ground operations.

The FAA does not agree with the comment that the FAA is duplicating oversight with other agencies such as OSHA, EPA, and ATF. Commercial space activities may be subject to the jurisdiction of multiple Federal agencies depending on the types of activities that are being conducted. OSHA, EPA, and ATF may regulate or provide oversight for different aspects of an operation without duplicating FAA oversight. The authority for protecting public health and safety, safety of property, and national security and foreign policy interests of the United States during commercial space launches and reentries remains solely with the FAA.

In the interest of removing duplicative authorities, CSF suggested the FAA should acknowledge when other agencies have jurisdiction over activities and not duplicate that oversight. SpaceX recommended that instead of the FAA's determining that the launch or reentry services or property provided by a Federal launch or reentry site or other Federal entity satisfy part 450, the FAA should just determine that the site operations are in good standing.

In the final rule, an operator may meet part 450's performance-based requirements using DOD and NASA practices that have been accepted by the FAA as a means of compliance. An applicant would reference in its application those DOD or NASA requirements or procedures accepted as means of compliance. The 2015 Commercial Space Launch Competitiveness Act directed the Secretary of Transportation to consult with the Secretary of Defense, Administrator of NASA, and other agencies, as appropriate, to identify and evaluate requirements imposed on commercial space launch and reentry operators to protect the public health and safety, safety of property, national security interests, and foreign policy interests of the United States. It also directed the Secretary of Transportation to resolve any inconsistencies and remove any outmoded or duplicative Federal requirements or approvals applicable to any commercial launch of a launch vehicle or commercial reentry of a reentry vehicle.^[35] The FAA has worked closely with DOD and NASA in developing part 450 to minimize any need for a DOD or a NASA facility to impose additional requirements.^[36] The FAA will continue to work with DOD and NASA in reviewing means of compliance that involve these Federal entities' practices to ensure those practices continue to satisfy the FAA's part 450 requirements. The FAA expects that there will be few, if any, instances in which DOD or NASA practices do not satisfy part 450's performance-based requirements. In addition, part 450 should provide enough flexibility to accommodate changes in DOD and NASA practices in the future.

In addition to issuing performance-based requirements that an operator could meet using DOD and NASA practices as means of compliance, the FAA has addressed concerns regarding duplicative government requirements by modifying its approach to ground safety at certain Federal sites. For ground safety, the Administrator may determine that the Federal launch or reentry site's ground safety processes, requirements, and oversight are not inconsistent with the Secretary's statutory authority over commercial space activities. Therefore, under § 450.179 (Ground Safety—General) paragraph (b), an operator is not required to comply with the ground safety requirements of part 450 if:

(1) The launch or reentry is being conducted from a Federal launch or reentry site;

(2) The operator has contracted with the Federal launch or reentry site for ground safety services or oversight; and

(3) The Administrator has determined that the Federal launch or reentry site's ground safety processes, requirements and oversight are not inconsistent with the Secretary's statutory authority over commercial space activities.

In making the determination to accept the Federal site's processes without specific compliance with ground safety regulations, under § 450.179(c), the Administrator will consider the nature and frequency of launch and reentry activities conducted from the Federal launch or reentry site, coordination between the FAA and the Federal launch or reentry site safety personnel, and the Administrator's knowledge of the Federal site's requirements. The FAA will consider the nature and frequency of the activity in order to evaluate a site's level of experience with different types of launch and reentry operations. An example of the “nature” of the launch and reentry activities would be that a site's experience with non-toxic or non-explosive propellant might not qualify the site for an exemption from FAA ground safety requirements involving toxic or explosive materials. The FAA makes this change to respond to the direction of SPD-2, the National Space Council, and the recommendation of the ARC to address duplicative requirements across Federal agencies for commercial space licensing.

In the final rule, an operator need not comply with the ground safety requirements contained in §§ 450.181 (Coordination with a Site Operator) through 450.189 (Ground Safety Prescribed Hazard Controls) if the conditions in § 450.179(b) are met. In making this change, the FAA preserves its statutory jurisdiction over those ground safety activities that are part of launch and reentry, but recognizes certain Federal processes and procedures as sufficient to meet the FAA's mandate.

For § 450.179(b) to apply, an operator must conduct launch or reentry activities from a Federal launch or reentry site. The FAA limits the applicability of this provision to certain Federal sites, such as Kennedy Space Center and Cape Canaveral Air Force Station, because they have a long history of conducting launches and reentries in a manner consistent with FAA regulations. In addition, an operator must contract with the Federal launch or reentry site for ground safety services or oversight. The FAA would require that the operator have a written agreement with the Federal site to use its ground safety services or oversight and comply with its ground safety processes and requirements. Finally, the Administrator must have determined, consistent with the considerations in § 450.179(c), that the Federal launch or reentry site's ground safety processes, requirements, and oversight are not inconsistent with the Secretary's statutory authority over commercial space activities. In considering the site's ground safety record, the Administrator will consider the extent and sophistication of both its ground safety procedures and the frequency with which the site uses them during FAA-licensed activities.

In making the determination to accept a Federal site's ground safety procedures, the Administrator generally will accept only those sites that have a regular cadence of both commercial and government launches and highly developed, well-understood processes and procedures. In considering the coordination between the FAA and the Federal site safety personnel, the Administrator generally will approve only those sites with which the FAA has a long-term working relationship through the Common Standards Working Group (CSWG). Familiarity with a Federal site's ground safety practices and procedures is the only means by which the FAA can ensure it has met its statutory obligation to ensure public health and safety, safety of property, and national security and foreign policy interests of the United States. When the Administrator finds that a site meets the conditions in § 450.179(b), the FAA will develop a Memorandum of Agreement (MOA) with the approved site and publish the MOA on the FAA's website. If these conditions are met, then the operator can seek FAA permission during pre-application consultation to comply only with the ground safety regulations imposed by the Federal site. The FAA will publish, maintain, and update the Federal launch and reentry site ground safety MOAs on its website.

For Federal launch or reentry sites or other Federal entities that do not satisfy the conditions in § 450.179(b), the final rule retains the LSSA-like process in accordance with § 450.45(b). As noted earlier, the FAA believes that because of the performance-based nature of part 450, Federal launch or reentry sites will typically satisfy most or all FAA requirements.

ii. Radionuclides (§ 450.45(e)(6))

In the NPRM, the FAA proposed in § 450.45(e)(6) that the FAA would evaluate the launch or reentry of any radionuclide on a case-by-case basis, and issue an approval if the FAA finds that the launch or reentry is consistent with public health and safety, safety of property, and national security and foreign policy interests of the United States. For any radionuclide on a launch or reentry vehicle, an applicant would need to identify the type and quantity, include a reference list of all documentation addressing the safety of its intended use, and describe all approvals by the Nuclear Regulatory Commission for pre-flight ground operations.

SpaceX requested that the FAA clarify the intent of this regulation, as this topic is heavily regulated by other Federal entities. In addition, SpaceX recommended that the FAA defer to and accept results from other Federal entities when applicable, and stated that processes for acceptance and deferral should be provided in an AC.

As discussed in the NPRM preamble, § 450.45(e)(6) will address the potential launch or reentry of radionuclides, similar to current § 415.115(b), but with the addition of reentries. It is the current practice of the FAA to address novel public safety issues on a case-by-case basis because such proposals are so rarely encountered in commercial space transportation. When applicable, FAA will work closely with other Federal entities to avoid duplicative requirements. Moving forward however, the Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Systems ^[37] directs the Secretary to issue public guidance for applicants seeking a license for launch or reentry of a space nuclear system. The FAA is currently developing this guidance.

g. Environmental Review (§ 450.47)

In the NPRM, the FAA proposed to consolidate and clarify environmental review requirements for launch and reentry operators in a single section, § 450.47 (Environmental Review). In addition, the FAA proposed to revise §§ 420.15, 433.7, 433.9, and 437.21 to conform to the changes in proposed § 450.47. These revisions codify the environmental review process as currently conducted, in accordance with FAA Order 1051.F, in which applicants for a launch or reentry license provide the FAA with the information needed to comply with the National Environmental Policy Act (NEPA) and other applicable environmental laws, regulations, and Executive Orders.

In the final rule, the FAA adopts § 450.47 as proposed with revisions. The FAA revises § 450.47(b) to affirmatively state that an applicant must prepare an Environmental Assessment (EA), assume financial responsibility for preparation of an Environmental Impact Statement (EIS), or provide information to support a written re-evaluation of a previously submitted EA or EIS, when directed by the FAA. The FAA revised this section to clarify that the FAA, not the applicant, determines which environmental documentation is required by NEPA. If the FAA determines that under NEPA an EIS is required, the FAA will select a contractor to prepare the EIS for the license applicant who will pay the contractor. The FAA also revised §§ 420.15(b), 433.7(c), 437.21(b)(1)(iii), and 450.47(c) to clarify that it is the FAA's responsibility to determine whether a Categorical Exemption (CATEX) applies under NEPA.

An applicant may provide data and analysis to assist the FAA in determining whether a CATEX could apply (including whether an extraordinary circumstance exists) to a license action. Examples include modifications that are administrative in nature or involve minor facility siting, construction, or maintenance actions. In the final rule, the FAA revises §§ 420.15(b), 433.7(c), 437.21(b)(1)(iii), and 450.47(c) to state affirmatively that it is the FAA's responsibility to determine whether a CATEX applies rather than an applicant's responsibility to request a CATEX.

If a CATEX does not apply to the proposed action, but it is not anticipated to have significant environmental effects, then NEPA requires the preparation of an EA. When directed by the FAA, an applicant must prepare an EA with FAA oversight. When NEPA requires an EIS for commercial space actions, the FAA uses third-party contracting to prepare the document. That is, the FAA selects a contractor to prepare the EIS, and the license applicant pays the contractor. Finally, if an EA or EIS was previously developed, the FAA may require an applicant to submit information to support a written re-evaluation of the environmental document by an FAA-selected contractor to ensure the document's continued adequacy, accuracy, and validity.^[38]

This rule will not alter the current environmental review requirements. However, as explained in the NPRM preamble, the consolidation of the launch and reentry regulations necessitates a consolidation of the environmental review requirements.

CSF asked the FAA to explain why it added the requirement that applicants prepare EAs with FAA oversight, assume financial responsibility for preparation of an EIS, or submit a written re-evaluation of a previously submitted EA or EIS. CSF requested clarification on the phrase “under FAA oversight” in proposed § 450.47, versus the current language in FAA Order 1050.1 that requires FAA approval of an applicant-prepared EA. CSF requested further that the FAA clarify when and for what purpose the FAA might require an applicant to prepare a written re-evaluation of a previously-submitted EA or EIS, noting that the costs and schedule impacts of this requirement are unclear.

As noted in the NPRM, the changes to the regulatory text on environmental review do not represent a substantive change to past regulations or to current practice. Section 450.47 reflects the existing environmental review process that §§ 415.201 and 415.203 broadly described, in which applicants must provide sufficient information to enable the FAA to comply with NEPA. Section 450.47 replaces this general requirement by identifying the specific documents that the FAA may require applicants to provide and the process to prepare those documents. The language added to § 450.47 reflects current practice and is consistent with NEPA and FAA policy. According to FAA Order 1050.1, unless the FAA determines that a categorical exclusion applies, the FAA may prepare an EA, EIS, or written re-evaluation, or direct an applicant to provide the information as described in §§ 450.47(b)(1), (2), and (3).^[39] In response to CSF's comment, the FAA revises § 450.47(b), as well as §§ 420.15(b), 433.7(b), and 437.21(b)(1)(ii), from the language proposed in the NPRM to state expressly that an applicant must provide the documents set forth in paragraph (b) “when directed by the FAA.” The modified text clarifies the applicant's responsibilities in accordance with FAA Order 1050.1 (Paragraph 2-2-2). These responsibilities are consistent with current practice and will not increase the cost, impact schedules, or alter the burden under the previous regulations.

With respect to § 450.47(b)(1), “with FAA oversight” means the FAA will guide the work of an applicant or an applicant's contractor. In order to use an applicant or contractor-prepared document for compliance with NEPA or other environmental requirements, the FAA must evaluate and take responsibility for the document. The FAA's oversight ensures that: (1) The applicant's potential conflict of interest does not impair the objectivity of the document; and (2) the EA meets the requirements of FAA Order 1050.1. The FAA may require an applicant to submit information to support a written re-evaluation of a previously prepared environmental document (i.e., a draft or final EA or EIS) to determine whether the document remains valid or a new or supplemental environmental document is required. Applicants should work closely with the FAA to determine the documentation requirements of NEPA and other applicable environmental requirements.^[40] In response to CSF's comment, the FAA revises § 450.47(b)(3), as well as §§ 420.15(b), 433.7(b), and 437.21(b)(1)(ii), to clarify that an applicant would submit “information to support” a written re-evaluation of a previously submitted EA or EIS, rather than the re-evaluation document itself, as proposed. The contractor selected by the FAA will use the information provided by the applicant to prepare the re-evaluation document.

CSF commented that the FAA should adopt, to the greatest extent possible, NEPA documentation from other Federal agencies or licensed site operators.

The FAA notes that it may adopt, in whole or in part, another Federal agency's draft or final EA, the EA portion of another agency's EA/FONSI, ^[41] or EIS in accordance with applicable regulations and authorities implementing NEPA.^[42] Whenever possible, the FAA will adopt the other Federal agency's NEPA documents to support the issuance of launch and reentry licenses. Further, the FAA encourages early coordination with the FAA to benefit applicants that are seeking approvals from other Federal agencies related to the FAA-issued license (e.g., an applicant seeking approval from a Federal agency to make modifications on a Federal launch or reentry site in anticipation of receiving a launch license from the FAA). This coordination will increase the likelihood of a more efficient environmental review process as the applicant seeks different but related approvals from multiple Federal agencies. The applicant should consult with the FAA early in the project's development phase, prior to the development of the NEPA document, to determine environmental review responsibilities, and the appropriate level of review, and to foster efficient procedures to develop documentation to meet the agencies' legal requirements.

CSF also encouraged the FAA to request appropriations to fund regional or area EAs. This recommendation is beyond the scope of this rulemaking.

The Aircraft Owners and Pilots Association (AOPA) stated its concern that, under the proposed regulations, existing Special Use Airspace approvals (SUAs) would be activated for purposes that may not align with the original environmental determinations that led to approval of the SUAs. AOPA noted that the environmental process for establishing SUAs includes detailed studies of the intended activity, its frequency, and its effect on the public. Many of the SUAs activated in support of commercial space activity originally underwent environmental review and approval on the assumption that they were supporting military or governmental activity, not commercial civil space operators.

This rule will not affect the environmental determination process for establishing or altering SUAs. Environmental review concerns associated with the designation or activation of SUAs are not the subject of this rulemaking. The FAA notes that all environmental impacts associated with a proposed launch or reentry will be addressed in the NEPA document prepared for that activity.

AOPA urged the FAA to ensure that the documentation for commercial space operations is complete and transparent so that the public can understand and identify potential impacts.

This rule will not alter the current environmental review process, which requires documentation of environmental impacts. The FAA remains responsible for complying with NEPA and other applicable environmental laws, regulations, and Executive Orders prior to issuing a launch or reentry license. The FAA ensures transparency of the potential environmental impacts by publishing all draft and final EAs and EISs, and associated Findings of No Significant Impact and Records of Decisions.

CSF and Denver International Airport requested clarification on how the environmental reviews required under NEPA would apply to multiple sites. In accordance with applicable regulations and authorities implementing NEPA, the FAA's decision-making process must consider and disclose the potential impacts of a proposed action and its alternatives on the quality of the human environment. This process includes considering the impacts of launches from multiple sites, which may be covered in a single NEPA document when appropriate. In some instances, one single NEPA document may not be possible and individual site-specific NEPA documents could be developed. The FAA is examining the use of programmatic NEPA documents to analyze the impacts of launches from multiple sites. Under such an approach, applicants could tier their individual, site-specific NEPA analyses from the programmatic document.^[43] The FAA will conduct programmatic EA analyses consistent with FAA Order 1050.1 and CEQ regulations.

SpinLaunch stated the environmental review process is lengthy, sometimes taking as long as 2 years or more. To facilitate the process, it recommended (1) including the environmental review within the statutory period, thereby forcing an expedited process; and (2) establishing limited environmental approval for proposed activities (e.g., non-rocket launch systems) that do not have the adverse environmental impacts of a traditional rocket.

The FAA does not consider the 180-day statutory review period to include NEPA document preparation. Specifically, the applicant must submit a completed EIS prepared by the FAA (or an FAA-selected and managed consultant contractor) or an FAA-approved EA, categorical exclusion determination from the FAA, or written re-evaluation as part of its application materials. The statutory application review period is not intended to encompass the time needed for the applicant to develop the necessary application materials, including environmental documentation. Regarding the commenter's second recommendation, the FAA is bound by CEQ's NEPA regulations. There are three levels of NEPA review: CATEX, EA, and EIS. Each of the three levels of review is described in FAA Order 1050.1. The required level of review depends on the nature of the commercial space action. Applicants should coordinate with the FAA early in the application process to determine the appropriate level of NEPA review based on the potential for significant impact.

Boeing, Lockheed Martin, Northrop Grumman, and ULA jointly recommended adding to proposed § 450.47(a) a statement requiring the FAA to coordinate with other government entities to assist the applicant in completing EAs, in order to alleviate the cost impact on operators who currently have to negotiate multiple sets of requirements by Federal, State, and local governments. The joint commenters also recommended amending §§ 420.15(b)(ii), 433.7(b)(2), and 450.47(b)(2) to allow EISs to be prepared by an FAA-approved consultant contractor, in addition to one selected and managed by the FAA. The commenters suggested these changes would provide flexibility and allow an operator to use qualified EIS contractors at the State- or local-level as long as the contractor meets the qualifications for completing an EIS in accordance with the law.

The FAA declines the suggested regulatory text changes.

Section 1506.5(c) of the CEQ Regulations for Implementing the Provisions of NEPA and Appendix C of FAA Order 1050.1 state that EISs must be prepared by a contractor selected by the lead agency to avoid a conflict of interest.

Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the FAA craft an additional section to proposed § 450.47 to address space environmental impacts such as debris, collision risk, and interference.

The FAA does not agree with this recommendation. The applicability of NEPA to space debris is outside the scope of this rulemaking.

One individual commenter expressed concern that the proposed part 450 may cause companies to forgo environmental considerations or somehow bypass compliance requirements. The proposal does not alter NEPA and will continue to require potential licensees to comply with all policies and procedures implementing NEPA, as well as other applicable environmental laws, regulations, and Executive Orders intended to protect the environment.

4. Part 450 Subpart C—Safety Requirements

a. Neighboring Operations Personnel (§ 450.101(a) and (b))

In the NPRM, the FAA proposed to carve out separate individual and collective risk criteria for neighboring operations personnel. The proposal was intended to reduce the need to clear or evacuate other launch operator personnel during a commercial launch or reentry operation. Under the current regulations, an operator may be required to clear anywhere from a handful of employees to over a thousand employees from a neighboring site for a significant portion of a day. To address this issue, the NPRM proposed to define “public” and “neighboring operations personnel” in § 401.5. Under the proposal, neighboring operations personnel would still be members of the public, but would be subject to different individual and collective risk criteria. These proposed regulations were intended to enable neighboring operations personnel to remain within safety clear zones and hazardous launch areas during flight as long as their risk did not exceed the newly designated thresholds.

In the final rule, the FAA adopts the proposal for neighboring operations personnel in §§ 401.7, 440.3, 450.101(a) and (b), and 450.137(c)(6). The FAA revises the § 401.7 definition of “neighboring operations” by removing the phrase “as determined by the Federal or licensed launch or reentry site operator” because the phrase is not relevant to the definition of neighboring operations personnel. The FAA also revises § 450.133 (Flight Hazard Area Analysis) paragraph (e)(2) to require that an applicant provide the hypothetical location of any member of the public that could be exposed to a probability of casualty of 1 × 10⁻⁵ or greater for neighboring operations personnel, in response to a comment to clarify representative probability contours.

The FAA sought comment on the proposed approach, as well as on proposals (1) not to require that neighboring operations personnel be specially trained, (2) not to designate ground operations hazard criteria for neighboring operations personnel, and (3) for the purpose of determining MPL, to align the individual risk threshold for neighboring operations personnel with the threshold for losses to government property and involved government personnel. Many commenters agreed with the FAA's proposal to change the risk threshold for neighboring operations personnel, stating that a higher risk threshold is necessary to allow for co-processing of multiple operations at a single facility. Despite this general agreement, some commenters disagreed with the specifics of the proposal. Several commenters pointed out that the FAA's approach to neighboring operations personnel differs from the ARC recommendation to exclude permanently badged personnel and neighboring launch operations from the definition of “public” but still to employ mitigation measures for uninvolved neighboring operations personnel when a hazardous operation or launch is scheduled.

Several commenters, including Blue Origin, Boeing, CSF, Lockheed Martin, Northrop Grumman, Space Florida, SpaceX, ULA, and Virgin Orbit, commented that neighboring operations personnel should not be included as members of the public. CSF stated that neighboring operations personnel should not be considered members of the public because they have essential, on-going requirements to conduct neighboring space transportation activities. CSF further stated that the FAA has the flexibility to exclude neighboring operations personnel from its definition of “public.” Blue Origin similarly stated that neighboring operations personnel are more familiar with the hazardous operations present at a launch site and may have a relationship or engagement with their neighboring operators and, therefore, should be treated differently from the public who are completely uninvolved and are not knowledgeable about launch and reentry operations. Space Florida also commented that employees of the licensee who may be working on a test program or a different launch or reentry program are not members of the public and raised the question whether the FAA should have statutory authority over launch essential personnel of a neighboring operator for other launch, reentry, or associated operations. Virgin Orbit commented that it would be better to include neighboring operations personnel under launch personnel, rather than requiring a new and possibly burdensome expected casualty analysis.

The FAA agrees that neighboring operations personnel are a unique category of people because of their essential, ongoing tasks. The FAA disagrees, however, with commenters' assertions that neighboring operations personnel should be excluded from the definition of “public” because of their involvement in launch operations or the tasks they are expected to perform. The FAA has a statutory obligation to protect the health and safety of members of the public. Prior to this rulemaking, the FAA defined public safety, for a particular licensed launch, as the safety of people and property that are not involved in supporting the launch, including those people and property that may be located within the boundary of a launch site, such as visitors, individuals providing goods or services not related to launch processing or flight, and any other launch operator and its personnel. The FAA's definition of “public” is derived from the definition of “public safety” in § 401.5 and the definition of “public” in § 420.5.^[44]

The FAA's definition of “public” encompasses neighboring operations personnel because they are not involved in supporting the specific launch or reentry they are neighboring. The FAA agrees that neighboring operations personnel are more familiar with the hazardous operations present at a launch site and may have a relationship or engagement with their neighboring operators, but the FAA does not find that to be sufficient to exclude them from the definition of “public.” It was a factor, however, in the FAA's decision to apply a risk requirement to neighboring operations personnel different from the requirement applied to other members of the public. Although this rule includes neighboring operations personnel in the definition of “public,” the FAA recognizes that neighboring operations personnel are aware of the inherent risks associated with launch and reentry activities and are likely trained and prepared to respond to hazards present at these sites. Because of these differences, as well as their unique role in performing safety, security, and critical tasks, the FAA considers neighboring operations personnel a separate category of public, whose collective exposure to risk may not exceed 2 × 10⁻⁴ and for whom the risk to any individual may not exceed 1 × 10⁻⁵.

The FAA disagrees with Virgin Orbit's comment that neighboring operations personnel should be included as launch personnel so as to be exempted from risk calculations and eliminate the burden of the additional risk calculation. Neighboring operations personnel are not supporting the licensed activity and are members of the public; therefore, they must be protected under the FAA's statutory mandate. The FAA acknowledges that this conclusion requires risk analysis for the neighboring operations personnel; however, the FAA expects that this analysis will involve little additional effort because the operator already has to perform a similar analysis for the other members of the public and will only need to account for the population of neighboring operations personnel, if any. For these reasons, the FAA adopts the proposal without amendment.

In addition to comments recommending that neighboring operations personnel be excluded from the definition of “public,” several commenters had other recommendations for the proposed definition of “public.” CSF commented that the proposal does not specify how involved in a licensed operation a person needs to be to fall outside public risk protections. CSF also proposed that the definition of “public” should allow for a risk threshold for those who have been briefed on the risks and hazards and chosen to participate to the same level as neighboring operations personnel, and that historic NASA operations have followed this model. CSF further stated that the definition of “public” should not include persons who have a passive involvement in the licensed activity, such as invited guests of the operator, customers, families of astronauts, and other stakeholders with a legitimate enough interest in the launch or reentry activity to be on-site. SpaceX echoed CSF's comments on this issue, and further suggested that the definition of “public” should generally include only those people who reside and work outside the controlled areas of a launch or reentry site. Blue Origin, CSF, and SpaceX recommended excluding invited guests of the launch or reentry operator from the definition of “public.”

As discussed earlier, the FAA's definition of “public” was derived from the definition of “public safety” in § 401.5 and the definition of “public” in § 420.5. Historically, the FAA has considered “public” to include all people and property that are not involved in supporting a licensed or permitted launch and in the final rule extends the same definition to reentry. While neighboring operations personnel or invited guests ^[45] may accept a higher level of background risk, they are not involved in supporting the particular licensed operation and this rule continues the FAA's longstanding practice of protecting them as members of the “public.” While the FAA expects that certain members of the public may be briefed and aware of hazards, the FAA does not agree with CSF's rationale that being informed is a sufficient condition for such persons to be treated under the higher risk threshold for neighboring operations personnel. In addition to being informed of potential hazards, neighboring operations personnel are required to perform safety, security, or critical tasks at the neighboring site. The FAA finds that the necessity of these tasks justifies the minimal increase in risk to which neighboring operations personnel are exposed. Informed members of the public do not meet this criterion and, therefore, will continue to be protected at the public threshold rather than the higher threshold for neighboring operations personnel.

The FAA considered potential regulatory mechanisms for allowing public stakeholders with a legitimate enough interest in the launch or reentry activity to be on-site as requested by commenters. However, the FAA identified certain statutory and regulatory challenges with making these changes as a part of this final rule. Given the inherent risks associated with commercial space activity, Congress established a framework for liability insurance and financial responsibility that distinguishes individuals involved in launch or reentry activities from third parties. Section 50902 defines third party as persons other than launch or reentry participants.^[46] Section 50914 states that a licensee must obtain liability insurance to protect launch or reentry participants from third party claims, based on maximum probable loss calculations.^[47] Additionally, section 50914(b) establishes a reciprocal waiver of claims regime for applicable parties whereby each party to the waiver agrees to be responsible for personal injury to, death of, or property damage or loss sustained by it or its own employees resulting from an activity carried out under the applicable license. This regime includes certain parties waiving claims against the U.S. Government.^[48] The FAA has codified these requirements in the part 440 regulations.

While the FAA may waive certain risk requirements in order to allow members of the public to be present in hazard areas during launch or reentry activities, these individuals are third parties under title 51 and will therefore be included in maximum probable loss calculations. This would likely increase insurance costs, which would be borne by the licensee. Additionally, these individuals are not currently included in title 51's cross-waiver framework nor has the FAA gone beyond the scope of title 51 in part 440 to expand the cross-waiver framework to include them. As such, their presence in hazard areas during launch or reentry activities may increase the liability of the United States (and others involved in the launch who have executed cross-waivers with the operator) because of the increased potential for third party claims. Finally, any regulatory changes would need to be effectuated in part 440 where the FAA's financial responsibility requirements for commercial space transportation are located; however, the FAA did not contemplate substantial changes to part 440 in this rulemaking. Because of these challenges, the FAA elects to proceed with a waiver regime rather than a regulatory change at this time.The FAA notes that operators may request waivers to allow members of the public to be present in areas where risk requirements under part 450 would not otherwise allow them to be during launch and reentry activities.^[49] Such requests can serve a purpose of encouraging, facilitating, or promoting commercial space launches and reentries by the private sector, facilitating private sector involvement in commercial space transportation activity, and promoting public-private partnerships. However, the FAA expects operators to articulate more specifically the reasons why allowing particular individuals to be in areas they otherwise would be prohibited from entering is in the public interest. In considering such waiver requests, the FAA would be mindful of its role in protecting the public and accounting for any additional liability such a waiver would impose on the U.S. Government. Some factors that would affect the FAA's decision may include the number of people an operator seeks to have present and the strength of association between those people and the launch or reentry activity. Individuals that have an employment or contractual arrangement with the licensee, or are otherwise part of the cross-waiver framework of the license, may pose minimal, if any, liability for the U.S. Government. This could include high-level company officials and U.S. Government officials. Members of the public for whom a waiver is requested should have a strong connection to the launch, reentry, or licensee; for example, future customers, major investors, or invited press might qualify.

The operator bears the burden of providing adequate justification for this relief through the waiver process. The operator should include in its waiver application an assessment of the risks to the individuals covered by the requested waiver,^[50] information on how the operator will assume liability and hold the U.S. Government harmless, and the individuals' association to the launch, reentry, or licensee. The FAA anticipates using its experience in considering waivers to accommodate the presence of additional members of the public during commercial space launch and reentry activities to inform potential future rulemaking in this area.

The FAA also received several comments on the proposed definition of “neighboring operations personnel.” Blue Origin requested that the FAA further define the term “critical tasks” referenced in the new definition to include “tasks that are critical to normal business operations.”

The FAA does not agree that adding Blue Origin's definition of “critical tasks” is necessary. In the absence of a regulatory definition, the plain language definition applies and is sufficient here. In addition, the FAA gave context in the preamble to the NPRM for the types of activity that may qualify as “safety, security, or critical tasks.” The plain language definition maintains flexibility to include various tasks as industry practices evolve over time. These tasks include maintaining the security of a site or facility or performing critical launch processing tasks such as monitoring pressure vessels or testing safety-critical systems of a launch vehicle for an upcoming mission. These tasks also include business operations that cannot be reasonably conducted off site, such as onsite hardware work as well as data processing that must be conducted in a secure facility. Neighboring operations personnel do not include individuals conducting normal business operations that need not be conducted in hazardous areas, individuals in training for any job, or individuals performing routine activities such as administrative, office building maintenance, human resource functions, or janitorial work. This flexibility accommodates practices like those USAF and NASA follow at their launch sites and is intended to allow critical operations to proceed at neighboring locations without jeopardizing those operations. As explained in the NPRM, neighboring operations personnel are members of the public. The FAA allows a slightly increased risk to these personnel over that permissible to other members of the public. The FAA does not believe that an increase in risk is justified for reasons other than to facilitate performing safety, security, or critical tasks at the site. The FAA estimates that the collective risk criteria in the final rule for neighboring operations personnel will enable, on average, approximately forty additional personnel to operatate in this capacity, which the FAA believes will ensure that neighboring operators can maintain operations with minimum disruption.

Virgin Galactic commented that the definition of “neighboring operations personnel” should include all personnel who have been properly trained to respond to hazards present at a launch or reentry site and who are notified of hazardous operations occurring by other licensed operators at that site. Virgin Galactic objected to including in the definition a requirement that neighboring operations personnel be notified of the operation, stating that a lack of notification should not exclude individuals from qualifying as neighboring operations personnel. Similarly, ULA commented that the requirement appeared to be mostly in the definition, which “removes the definition's objectivity.”

FAA disagrees with Virgin Galactic that training and notification are sufficient to justify the inclusion of personnel in the neighboring operations personnel category. Training alone does not justify placing personnel at a raised level of risk. Only those personnel performing safety, security, or critical tasks qualify as neighboring operations personnel who may be subjected to a higher risk threshold because of the nature of those tasks, as discussed previously and in the NPRM. Furthermore, as explained in the NPRM, requiring a licensee to ensure neighboring operations personnel are trained would be burdensome and is not necessary to justify the increase in risk allowed for workers performing safety, security, or critical tasks.

The FAA does not agree with Virgin Galactic and ULA that the definition of “neighboring operations personnel” imposes a regulatory requirement. Rather, it enables neighboring operations to continue by describing which individuals qualify as neighboring operations personnel. Notification of an operation is a precondition to qualify as neighboring operations personnel. Personnel cannot be designated as neighboring operations personnel and be subject to the higher risk thresholds, if they have not been notified of the operation. For these reasons, the FAA declines to accept these particular changes to the proposed definition.

A number of commenters focused on which authority designates personnel as neighboring operations personnel. Many commenters, including CSF, Space Florida, and SpaceX, noted their agreement that the designation of neighboring operations personnel should be coordinated and determined by the site operator, but urged the FAA to remove its proposed neighboring operations personnel risk thresholds and instead allow site operators to designate what mitigations would be necessary to protect neighboring operations personnel. CSF urged the FAA generally to defer to Federal, State, local, or private site owners and operators as the sole decision-makers responsible for determining which personnel would be considered essential to ongoing operations and what hazard mitigation measures should be observed.

Other commenters, including ULA and Virgin Galactic, commented that the FAA should designate neighboring operations personnel. These commenters argued that a site operator should not determine who qualifies as neighboring operations personnel, because it would be tantamount to the FAA's reassigning its decision-making authority on the matter. Sierra Nevada recommended that the FAA collect the neighboring operations personnel information and calculate the risk on behalf of the applicant so that the proprietary nature of workforce numbers can be maintained between competitive companies. The Aerospace Industry Association (AIA), Blue Origin, Virgin Galactic, and other commenters also raised concerns about how proprietary data would be shared after neighboring operations are designated. Virgin Galactic commented that those best suited to know which employees are required for safety, security, or critical tasks are the other launch operators, not the site operator.

As previously described, the FAA maintains that the separate risk thresholds are the appropriate protections for neighboring operations personnel, and the FAA does not agree with removing its proposed neighboring operations personnel risk thresholds and instead allowing site operators to designate what mitigations would be necessary to protect neighboring operations personnel. The FAA does not agree with ULA and Virgin Galactic that the FAA or the launch operator should determine what individuals are appropriately classified as neighboring operations personnel. Site operators are in the best position to know what operations occur on their sites and which individuals are appropriately designated as neighboring operations personnel. The FAA expects that the site operator (i.e., an operator of a Federal site or FAA-licensed launch or reentry site) would work with operators of neighboring sites to identify these personnel because the site operator is in the best position to identify which personnel are required to perform safety, security, or critical tasks at the launch site. The site operator has a formal relationship with all operators on its site and has an interest in enabling continued and unimpeded operations amongst its tenants. At Federal sites, the site operator already fulfills this function, and thus enabling neighboring operations personnel does not impose any additional costs on the site operator. The designation of neighboring operations personnel is optional for FAA-licensed or exclusive use site operators. The FAA will monitor a launch site operator's designation and vehicle operator's implementation of neighboring operations personnel to ensure the appropriateness of these designations, thereby retaining its authority to determine which individuals are properly characterized as neighboring operations personnel.

Further, site operators are best positioned to adjudicate between tenants, to coordinate acceptable numbers of neighboring operations personnel during licensed operations, and to protect their tenants' proprietary information and furnish the necessary information to the licensed operator. The FAA expects that the coordination of the necessary data transfer will be collaborative between the licensed operator, the site operator, and the neighboring operators. Neighboring operators have the option of removing their personnel during the flight of a neighboring flight or reentry. As discussed above, neighboring operators have the option of discussing with the site operator which personnel they believe need to remain present in order to maintain safety, security, or other critical tasks. The accommodation of neighboring operations personnel through the risk thresholds benefits the launch or reentry operator by reducing the possibility that their presence without evacuation could result in a violation of the public risk criteria. It also benefits the neighboring operators to allow safety, security, or critical tasks to continue in cases where the site operator might otherwise require evacuation of personnel. Hence, the FAA believes that generally, as is current practice at Federal sites, neighboring operations personnel can be accommodated with little direct intervention by the FAA.

Blue Origin, CSF, and SpaceX all commented that the neighboring operations personnel provisions should apply to exclusive-use or private sites. Blue Origin asked whether the FAA intended to exclude such sites from its proposal because, although these are sites that the FAA does not license, launch and reentry activities at these sites can cause disruptions to non-licensed neighboring activities, such as developmental or test programs.

The FAA does not license exclusive-use sites, but it does license launch and reentry activities that occur at exclusive-use sites. The FAA does not anticipate that many exclusive-use sites would have personnel within a launch or reentry site, or an adjacent launch or reentry site, that qualify as neighboring operations personnel. Nevertheless, the FAA may accept the designation of neighboring operations personnel at an exclusive-use site if they are designated by the licensed vehicle operator that operates the site. Such designations will only apply to members of the public located within the site or an adjacent launch or reentry site who are not associated with the specific hazardous licensed or permitted operation being conducted, but who are required to perform safety, security, or critical tasks at the site and are notified of the operation. This approach is accommodated by the proposed regulations without change.

The FAA recognizes that there are activities that currently take place at launch sites that are not explicitly associated with launch or reentry operations. For example, payload processing typically occurs at launch sites. The Reagan Test Site at Kwajalein also has facilities that are essential for tracking objects in space. The U.S. Navy has a presence at Cape Canaveral Air Force Station (CCAFS). These activities may sometimes require critical personnel to remain on site during neighboring launch activities to ensure the continuation of operations. While the FAA envisioned primarily facilitating launch operations by proposing a carve out for neighboring operations personnel, it will allow other personnel conducting non-licensed activities on a launch or reentry site or an adjacent launch or reentry site to qualify as neighboring operations personnel as long as they meet the criteria enumerated in the definition.

ALPA and Space Florida questioned whether the neighboring operations personnel provisions would apply at joint spaceport/airport facilities to allow airport staff to stay in the hazard area or clear zone based on risk assessments during licensed space operations. In the NPRM, the FAA took into account that neighboring operations personnel are more likely than the rest of the public to be specially trained and prepared to respond to hazards present at a launch or reentry site. The USAF and NASA definitions specify that these personnel are either trained in mitigation techniques or accompanied by a properly trained escort. However, the FAA did not require that neighboring operations personnel be trained or accompanied by a trained escort because such a requirement would be burdensome, and training is not necessary to justify the slight increase in risk allowed for workers performing safety, security, or critical tasks. Although in developing the NPRM, the FAA did not contemplate airport personnel at co-located sites as neighboring operations personnel, the proposed definition did not preclude the possibility. In response to commenters, the FAA finalizes the definition of “neighboring operations personnel” as proposed, and agrees that the definition may include airport personnel working at a launch site.

Many commenters expressed concerns about the impact of designating neighboring operations personnel on the MPL calculation and the associated financial responsibility requirements. Northrup Grumman, Sierra Nevada, SpaceX, and ULA all commented that the inclusion of neighboring operations personnel would likely raise MPL, even at the proposed lower threshold in the NPRM. CSF, Space Florida, and SpaceX requested that neighboring operations personnel should be excluded from MPL calculations via waivers of liability.

Section 50914(c) of title 51 of the U.S. Code states that the Secretary of Transportation shall determine the maximum probable losses for which a licensee must obtain liability insurance or demonstrate financial responsibility. This amount must include the maximum probable loss from claims by, in relevant part, third parties. 51 U.S.C. 50914(a)(1)(A). Neighboring operations personnel are third parties under chapter 509 of title 51.^[51] Therefore, the FAA must include neighboring operations personnel in its MPL calculations.

The FAA agrees with the comments that MPL calculations could be affected by the designation of neighboring operations personnel because the proposed rule allowed more people to stay inside the 1 × 10⁻⁵ probability of casualty hazard area. While the FAA must include neighboring operations personnel in the MPL calculation, it does not expect the inclusion to affect materially the MPL amount. This expectation is based on the adoption in the proposed rule, for the purpose of determining MPL, of setting the threshold for neighboring operations personnel at the same threshold for losses to government property and involved government personnel. The MPL will determine losses to property and personnel of neighboring operators that have a probability of occurrence of no less than one in one hundred thousand (1 × 10⁻⁵), instead of the more stringent requirement of one in ten million (1 × 10⁻⁷) used for other third party losses. This threshold is appropriate for neighboring operations personnel because, unlike other third parties, except for involved government personnel, the presence of neighboring operations personnel at a launch or reentry site is necessary either for security reasons or to avoid the disruption of co-located activities at neighboring sites. The MPL methodology captures catastrophic events that, while extremely unlikely, still fall within the probability threshold.

The FAA's examination of past MPL determinations gives it confidence that these other events will generally drive MPL amounts more than the limited presence of neighboring operations personnel.^[52] While additional insurance costs are expected to be minimal, these minimal cost burdens are more appropriately placed on the launch or reentry operator creating the hazards, rather than the neighboring operator who otherwise must halt its operation. The FAA notes, however, that these regulations do not prevent a launch operator from entering into an agreement with a neighboring operator to recover costs as a result of any increase in the required amount of third party liability insurance due to the presence of neighboring operations personnel. Should a launch operator choose to enter into such an agreement, the launch operator would still be required to purchase insurance to cover all third parties, to include any neighboring operations personnel, and could seek reimbursement as a secondary measure. Therefore, the FAA adopts the proposal without amendment.

b. High Consequence Event Protection (§ 450.101(c))

In the NPRM, the FAA proposed to expand the FAA's use of consequence criteria to protect the public from an unlikely but catastrophic event. Specifically, the FAA proposed to use conditional expected casualties (CE_C) as the quantitative metric for: (1) Determining the need for flight abort ^[53] as a hazard control strategy in proposed § 450.101(c); (2) setting reliability standards for an FSS required by § 450.101(c) in proposed § 450.145(a); and (3) determining when to initiate a flight abort in proposed § 450.125(c)(1) and (c)(2). The proposed use of CE_C represented the most significant change in the NPRM because it introduced a new safety criteria pertaining to low probability, high consequence events and provided a means by which an operator could demonstrate that expensive, highly reliable FSS design and testing may be unnecessary to protect public safety. As explained in the NPRM, consequence can be measured in terms of CE_C without regard to the probability of failure.

The FAA received extensive comments on this proposal and, as a result, has made significant changes in the final rule to allow for additional flexibility in measuring and mitigating high consequence events. The following subsections provide an overview of the finalized CE_C requirements in § 450.101(c), the FAA's rationale for making the change, and specific responses to comments. The FAA notes that this section of the preamble focuses on CE_C as a means to measure the potential for high consequence events under § 450.101(c). CE_C will be discussed further in the preamble sections addressing §§ 450.108 (Flight Abort) and 450.145 (Highly Reliable Flight Safety System).

i. § 450.101(c)

In the NPRM, proposed § 450.101(c) would require an operator to use flight abort as a hazard control strategy if the consequence of any reasonably foreseeable vehicle response mode, in any one-second period of flight, is greater than 1 × 10⁻³ CE_C for uncontrolled areas. The FAA further proposed that the requirement would apply to all phases of flight, unless otherwise agreed to by the Administrator based on the demonstrated reliability of the launch or reentry vehicle during that phase of flight. Although not specifically spelled out in the regulatory text, the FAA explained in the preamble that § 450.101(c) was designed to ensure the public was sufficiently protected against low probability, high consequence events using CE_C as a measure of the potential for high consequence events.

In the final rule, the FAA retains the use of CE_C as a quantitative criteria that an applicant may use to measure the potential for high consequence events. However, as explained in the preamble section addressing § 450.101(c)(2), the FAA revises § 450.37(b) (Equivalent Level of Safety) to allow an applicant to propose an alternative way to measure high consequence events other than by CE_C. The final rule also allows multiple ways an applicant may protect against a low probability, high consequence event in uncontrolled areas for each phase of flight in § 450.101(c)(1) through (3). As discussed in more detail later in this section, an operator sufficiently protects against a high consequence event by (1) using flight abort in accordance with § 450.108; (2) demonstrating that CE_C is below a certain threshold without any FSS; or (3) demonstrating sufficient vehicle reliability and in consideration of CE_C.^[54] The FAA changes the heading of § 450.101(c) from “Flight Abort” in the NPRM to “High Consequence Event Protection” in the final rule because this section allows an operator in certain circumstances to use a method other than flight abort to protect against high consequence events.

Multiple commenters, including CSF, Sierra Nevada, and SpaceX, stated that the NPRM requirements in § 450.101(c) were too prescriptive and objected to the lack of an explicit provision allowing an applicant to propose another approach to address a high consequence event, absent a waiver. The FAA agrees that the final rule should provide additional flexibility and discusses those changes in more detail later in this section.

Multiple commenters, including CSF and Virgin Galactic, indicated that the E_C collective risk criteria alone should be enough to establish the need for an FSS, the reliability of the FSS, and when an FSS would be required to be activated to ensure public safety.^[55] The FAA finds that the use of collective risk through analyses of E_C and individual risk through analysis of Probability of Casualty (P_C) is inherently inadequate to establish sufficient protection against low probability, high consequence events during launch and reentry operations. Whereas P_C limits the maximum risk to an individual and E_C limits the average outcome in terms of casualties in a group of people, both P_C and E_C are indifferent to the risk of events that involve multiple casualties. This indifference means that, if the risk of a potential event that could result in a high number of casualties is low enough, the P_C and E_C criteria would not act to prevent that event. As explained in the NPRM, the purpose of CE_C is to protect the public from certain high consequence events, regardless of the probability of those events. Thus, the final rule includes specific provisions, such as in §§ 450.101, 450.108, and 450.145, to ensure adequate protection against low probability but high consequence events during launch and reentry.

In addition, a conditional risk assessment ensures adequate mitigation measures are in place to protect against a low probability, high consequence event in circumstances in which E_C and Pc may not dictate the need for mitigation. As explained in the NPRM, unlike collective risk that determines the expected casualties factoring in the probability that a dangerous event will occur, conditional risk determines the expected casualties assuming the dangerous event will occur.^[56] This assumption means that using E_C alone may result in a lack of mitigations, such as flight abort capability and preparedness, for certain high consequence events because the low probability of occurrence would translate into an E_C below the 1 × 10⁻⁴ limit. Conversely, using a conditional risk assessment ensures that, if a high consequence event is reasonably foreseeable, such as an incorrect azimuth at lift-off, then an operator will have a mitigation in place to prevent that event from producing catastrophic results. This result is assured because the decision to activate an FSS is always made in response to a system failure in the operational environment, as no operator plans to implement a flight abort unless the mission objectives include an intentional test of the FSS.

Calculating CE_C ensures an operator correctly recognizes certain system failures that may have catastrophic consequences and builds mitigations into the system to account for those failures. As such, an FSS is generally activated in the following context: (1) The vehicle is no longer performing nominally; (2) the vehicle is outside the limits of a useful mission; ^[57] and (3) continued flight would increase public risks in uncontrolled areas. Hence, the risk to the public associated with the decision to activate an FSS is inherently conditioned on the fact that a system failure has occurred. An operator would only identify a system failure for low probability, high consequence events if the operator used a CE_C-based analysis, rather than an E_C calculation, because a CE_C analysis assumes that the event will occur. Therefore, relying on the collective risk criteria alone would not adequately protect against low probability, high consequence events that could result in multiple public casualties.

The FAA received several comments regarding the potential for various launch operations to comply with the proposed CE_C thresholds in the NPRM. Rocket Lab USA, Inc. (“Rocket Lab”) commented that it would be “nearly impossible” for any orbital launch vehicle to meet the CE_C thresholds defined in the proposal and recommended the use of cumulative risk and individual risk metrics as additional or alternative means of determining the reliability required for the flight abort system. Blue Origin also stated that most, if not all operators, including those operating smaller suborbital launch vehicles in remote locations, would be forced to implement an FSS that complies with an unmodified set of USAF requirements. SpaceX recommended that the FAA gather more detail on CE_C for different launch vehicles and trajectory profiles to evaluate appropriate lower tiers of reliability.

The FAA sponsored a series of tasks, performed by ACTA, LLC (ACTA), to investigate the potential conditional risks associated with a wide array of past and foreseeable future launch operations using the best available information and tools. The study ^[58] provided an independent evaluation of the potential for the CE_C-related requirements in the NPRM to necessitate changes to current practice for more than a dozen missions involving large, medium, and small launch vehicles from a wide variety of sites. The results of this study demonstrate that the required reliability of an FSS for relatively small rockets depends greatly on the launch site. Specifically, the ACTA study found that a small ELV launched from Cape Canaveral or Wallops Island would need a highly reliable FSS compliant with proposed § 450.145 to meet the NPRM requirements, but that a less reliable FSS, such as an FSS compliant with proposed § 450.143, would suffice for the same vehicle launched from more remote locations, such as the Mahia Peninsula and Kodiak Island. To the extent that commenters suggested proposed § 450.101(c) would require currently licensed operators to use an FSS, the ACTA study results indicate that no changes would be required under the final rule regarding the need for an FSS for any currently licensed launch vehicle launched from a Federal launch or reentry site.^[59] The ACTA study also indicates that, for operators who currently employ an FSS to meet the FAA's public risk criteria, their current practices regarding FSS reliability and activation criteria would be sufficient to demonstrate compliance with the requirements in § 450.108.

A number of commenters asserted that the proposed CE_C requirements would increase cost for operators, particularly for current RLV operators.

CE_C analysis is not mandatory. If an operator chooses to use a § 450.145 compliant FSS, it does not need to do the CE_C analysis to establish if a § 450.145 compliant FSS is necessary or if a § 450.143 compliant FSS would suffice. A CE_C analysis to establish compliant Flight Safety Limits is unnecessary if the operator chooses to demonstrate compliance with § 450.108(c)(6).

The FAA does not agree that the cost of a CE_C analysis is prohibitively expensive. The FAA provides estimates in the final Regulatory Impact Assessment of the costs of the CE_C analyses as well as estimates of cost savings on those launches that will not need an FSS.

The ACTA study calculated CE_C for a sample of licensed RLVs and the results indicate that the final rule will not require any changes regarding the FSS robustness and FSS activation criteria currently used for the operations at the Mojave Air and Space Port. The ACTA study results suggest that launches from Spaceport America would not need to use flight abort as a hazard control strategy to meet the CE_C requirements in the final rule. Thus, the ACTA study suggests the final rule could facilitate a reduction in costs for RLV launches from non-Federal launch sites for current part 431 licenses that include flight abort as a hazard control strategy. Ultimately, the ACTA study indicates that CE_C will not drive a requirement for flight abort for currently licensed RLVs operating from non-Federal sites and is therefore not expected to drive costs for RLV operators. In the final Regulatory Impact Analysis, the FAA discusses in detail estimated voluntary costs to perform CE_C analyses as well as cost savings that result when an FSS is not required.

Several commenters, including CSF, Rocket Lab, Sierra Nevada, SpaceX, and an individual commenter, expressed a need for clarification of acceptable methodologies to compute CE_C. CSF and Sierra Nevada commented that there are no publicly available methodologies or background for conducting CE_C analysis. CSF noted that the CE_C analysis is computationally intensive and approved risk analysis tools and input data were not readily available. SpaceX stated it needed guidance on several specific technical issues on the computation of CE_C. Rocket Lab stated that, without standardized methods and input data, results would vary widely.

The FAA notes that CE_C is inherent in the calculation of E_C for launch or reentry operations. There are extensive guidance documents available currently that explain methodologies that can be used to compute E_C and, as a byproduct, CE_C as well.^[60] The FAA is aware of at least one operator that has used these guidelines to develop and implement its own safety analysis tools to demonstrate compliance with the current public risk criteria under part 417. Some tools have already been modified to compute CE_C with only a few hours of effort. Even so, the FAA remains dedicated to improving the guidance materials available to applicants and plans to provide additional advisory materials to explain acceptable safety analysis methods, including those that address any unique aspects of CE_C computations.

Sierra Nevada commented that CE_C analysis was not a widely accepted practice, nor had it been subject to rigorous testing, and it was not ready to be implemented. In response, the FAA notes that RCC 321 Standard and Supplement has included conditional risk standards and guidelines since 2010. Moreover, CE_C analysis has been used to help inform important decisions regarding the safety of commercial space transportation operations since 2016, when the FAA first cited CE_C as part of a formal waiver evaluation.^[61] As noted in the NPRM preamble, in granting these waivers, the FAA has adopted the conditional risk management approach, noting that the predicted consequence was below a threshold of 1 × 10^−[2] CE_C.^[62] The FAA further stated in the preamble that measuring the consequence from reasonably foreseeable, albeit unlikely, failures is an appropriate metric to assess prudent mitigations of risks to public health and safety and the safety of property. In recent years, the USAF has also used CE_C analyses to establish appropriate FSS activation criteria for launch operations from both CCAFS and VAFB. Most recently, the FAA considered the results of CE_C analyses in granting waivers to the debris containment requirements in § 417.213(a) and (d) that enabled the SAOCOM-1B mission to be conducted safely.

Several commenters, including CSF, Sierra Nevada, and SpaceX, recommended that the proposed CE_C-related requirements be moved to a guidance document as an accepted means of compliance to a more performance-based regulation to preserve flexibility. CSF stated that, at a minimum, the quantitative criteria should be moved to a guidance document.

The FAA considered replacing the proposed quantitative CE_C criteria with a qualitative standard and moving the quantitative criteria to a guidance document as one acceptable means of compliance. However, the FAA finds that a qualitative approach to determine the three key CE_C-related issues (i.e., the need for flight abort with a reliable FSS as a hazard control strategy, the reliability standards for any required FSS, and the criteria for activation of an FSS) would lack regulatory clarity necessary to ensure a consistent level of public protection, given the wide variety of launch and reentry operations. As noted by Rocket Lab and other commenters, even the results of quantitative high consequence event assessments can vary significantly from operator to operator without standardized methods and input data.

Although quantitative CE_C is retained in the final rule, the FAA adds flexibility in both the manner in which a high consequence may be measured and the manner in which an operator can sufficiently protect against a high consequence event. First, in the NPRM, ELOS would not have been allowed for the requirements in § 450.101. As noted in the discussion of ELOS earlier in the preamble, the FAA has revised § 450.37 in the final rule to allow operators to use ELOS to measure a high consequence event under § 450.101(c)(2). Second, § 450.101(c)(2) permits an operator whose CE_C is greater than 1 × 10⁻³ to propose safeguards other than flight abort to reduce the CE_C below 1 × 10⁻³. These revisions are discussed in greater detail later in this section.

Virgin Galactic recommended the FAA provide a definition of CE_C. In addition, Virgin Galactic commented that, in the NPRM preamble, CE_C was described using the phrase, “without regard to the probability of failure,” which appeared to Virgin Galactic to translate to “assume 100% failure probability.” Virgin Galactic recommended the FAA use the terminology “assuming the failure will occur” and clearly state the probability of failure would be 1, if that was what was intended.

The FAA does not agree that CE_C should be defined in the final rule. Rather, the preamble and associated AC (on High Consequence Event Protection) discuss in detail what the requirement entails and how to calculate CE_C. A CE_C value is calculated as the mean number of casualties predicted to occur given a specified failure mode in a given time interval with a probability of 1. As previously mentioned, there are extensive guidance documents currently available that explain methodologies that can be used to compute E_C and, as a byproduct, CE_C as well.^[63] The term “high consequence” appears in § 417.107(a)(1)(ii), but the FAA chose not to define this term formally at this time to allow for operational flexibility. High consequence events include incidents that could involve multiple casualties, massive toxic exposures, extensive property or environmental damage, or events that jeopardize the national security or foreign policy interests of the United States.

Boeing, Lockheed Martin, Northrop Grumman, and ULA provided regulatory text recommendations for § 450.101(c) including removal of “flight abort,” stating that a distinction needed to be made from flight abort that was not initiated based on threat to public health and safety because not all abort systems are considered FSS.

The FAA understands that the term “flight abort” has been used in other U.S. Government contexts to mean something different, but the FAA finds that “flight abort” accurately describes the required hazard mitigations while remaining flexible as to implementation. For these reasons, the FAA will not amend the rule to remove the term “flight abort.” The final rule adopts the proposed definition of flight abort in § 401.7, which means the process to limit or restrict the hazards to public health and safety, and the safety of property, presented by a launch vehicle or reentry vehicle, including any payload, while in flight by initiating and accomplishing a controlled ending to vehicle flight. The final rule also adopts in § 401.7 the proposed definition of “flight safety system,” which means a system used to implement flight abort, for which a human can be a part of an FSS.

The FAA finds that the definition of “flight abort” is consistent with current practice for licensed launches and reentries. Most RLVs use some method to achieve flight abort reliably, either in the form of a pilot that can safely abort flight using system controls or an automated system to terminate thrust. Traditional FSS for ELVs are comprised of an onboard flight termination system, a ground-based command and control system, and tracking and telemetry systems. Historically, the flight safety crew monitoring the course of a vehicle would send a command to self-destruct, thus aborting the flight, if the vehicle crossed flight safety limits and in doing so threatened a protected area. Redundant transceivers in the launch vehicle would receive the destruct command from the ground, set off charges in the vehicle to destroy the vehicle and disperse the propellants so that an errant vehicle's hazards would not impact populated areas. While this method of flight abort through ordnance is conventional, the existing definition in § 417.3 and the definition in the final rule do not require an FSS to be destructive.

In response to commenters' concerns, the FAA finds that the definitions of “flight abort” and “flight safety system” adopted in the final rule remove any perceived confusion over the use of these terms for the purpose of FAA licensing under part 450.

ii. § 450.101(c)(1)

Section 450.101(c)(1) states that an operator must protect against a high consequence event in uncontrolled areas for each phase of flight by using flight abort as a hazard control strategy in accordance with the requirements of § 450.108. The FAA has not included the reference to the CE_C threshold of 1 × 10^−[3] in § 450.101(c)(1) because an operator who uses flight abort in accordance with § 450.108 has demonstrated compliance with § 450.101(c)'s requirement to protect against a high consequence event without further inquiry into CE_C beyond the requirements in § 450.108(c). This change is consistent with the concept proposed in § 450.101(c) of the NPRM that required an operator to use flight abort with a reliable FSS ^[64] if CE_C was greater than 1 × 10⁻³ for any phase of flight. Under the proposal, if an operator elected to use flight abort with an FSS that met the reliability requirements in § 450.145, the FAA would not have required the operator to calculate CE_C for the purposes of determining compliance with proposed § 450.101(c) because the operator opted into flight abort as a hazard control strategy irrespective of CE_C.

As such, in the final rule, there is no need to reference a CE_C threshold in § 450.101(c)(1) because an operator who elects to use flight abort as its hazard control strategy and complies with § 450.108 does not need to calculate CE_C (beyond the requirements in § 450.108(c) discussed later in the preamble) to determine that it has sufficiently protected against a high consequence event. Rather, use of flight abort consistent with the requirements in § 450.108 by itself demonstrates compliance with § 450.101(c).

As explained in the next two sections, operators who do not elect to use flight abort consistent with the requirements of § 450.108 must demonstrate they can protect against a high consequence event by means other than flight abort. If an operator cannot demonstrate compliance with § 450.101(c)(2)—including through ELOS—or (c)(3), the operator would be required to rely on § 450.101(c)(1) as the only remaining means to protect against a high consequence event.

iii. § 450.101(c)(2)

In the final rule, § 450.101(c)(2) states that an operator must protect against a high consequence event in uncontrolled areas for each phase of flight by ensuring the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is not greater than 1 × 10⁻³ CE_C. As noted, proposed § 450.101(c) would have required an operator with a CE_C greater than 1 × 10⁻³ to use flight abort with an FSS that meets the reliability requirements of proposed § 450.145 except for a single exception explained in greater detail in the discussion of § 450.101(c)(3).

The FAA recognizes that flight abort is not the only method to protect against low probability, high consequence events. Therefore, in the final rule, § 450.101(c)(2) allows an operator with CE_C greater than 1 × 10⁻³ in any significant period of flight to demonstrate protection against a low probability, high consequence event through means other than flight abort. This added flexibility in the final rule allows operators to implement other safeguards that sufficiently protect against a high consequence event. For example, one company included a design feature in a system so that a launch failure during downrange overflight would result in break-up and demise and thus mitigate the risk from the potential for the capsule to survive intact to impact.

In addition, although this provision retains the quantitative CE_C threshold proposed in § 450.101(c), the FAA provides additional flexibility by modifying § 450.37 to allow applicants to propose alternative approaches that provide an equivalent level of safety, which can be approved by the FAA without a waiver. The FAA added this flexibility because it is aware of methods other than using CE_C to measure high consequence events, such as conditional risk profile. If an operator chooses to propose an alternative means of measuring a high consequence event, the FAA would expect the alternative means to account for the potential for any event that would be expected to produce multiple casualties,^[65] using a method that demonstrates equivalent level of safety to a CE_C analysis. The operator must ensure that the alternative means accurately assesses that the operation would not exceed an acceptable threshold for high consequence events. In order to determine whether an alternative threshold for high consequence events is acceptable, the FAA will compare the alternative measurement to the CE_C threshold. Alternatively, the applicant would be expected to demonstrate that either the consequence of any failure during any significant period of flight is at least an order of magnitude less than the average results from a fixed-wing general aviation aircraft fatal accident.^[66]

For example, the Range Commanders Council Document 321-17, “Common Risk Criteria Standards for National Test Ranges” (RCC 321) includes catastrophic risk protection provisions that use a “risk profile.” ^[67] In fact, the FAA currently uses a modified risk profile method to establish the insurance requirements for certain launch or reentry operations.^[68] The FAA understands that risk profiles are currently in use in other industries ^[69] and could be a useful means to quantify the probability of high consequence events associated with a wide variety of hazardous operations. However, the computation of a risk profile generally entails significantly more effort than the CE_C evaluation because a risk profile involves more sophisticated computations and additional input data. Specifically, the development of a risk profile for a launch or reentry operation would consist of an evaluation of the absolute probability of each foreseeable failure mode and the relative probability of each outcome of each failure mode in terms of the number of public casualties that could result in uncontrolled areas. The RCC 321 Supplement describes a more simplified and conservative method to screen for excessive catastrophic risk, which the FAA finds as another acceptable method to measure high consequence events.^[70] In contrast, a CE_C analysis is independent of the probability of each failure mode and requires an assessment of only the average outcome of each failure mode. In addition, the FAA is publishing an AC that describes how an applicant can demonstrate compliance with § 450.101(c)(2) by showing that the conditional risk profile for its proposed launch or reentry mission is comparable with the conditional risk profile empirically derived from evidence from a set of past fixed-wing general aviation fatal accidents. Finally, the FAA recognizes that industry may develop new innovative and less burdensome methods, and therefore the final rule allows applicants to propose methods other than CE_C to measure high consequence events.

In § 450.101(c)(2), the FAA replaces the term “one-second period of flight” in proposed § 450.101(c) with “significant period of flight.” A period of flight would be significant if it is long enough for a mitigation, such as flight abort, to decrease the public risks or consequences materially from any reasonably foreseeable failure mode. The FAA makes this change because it recognizes that for some launch and reentry concepts, such as relatively slow-moving vehicles like balloons, a “significant” period of flight could exceed one second. In addition, the FAA foresees circumstances in which an elevated CE_C in a single second of flight would not warrant additional mitigation, such as when no additional mitigation would improve public safety meaningfully in terms of the public risks and consequences. The preamble discussion of § 450.108 contains further explanation of what constitutes a material decrease.

Finally, the final rule replaces the phrase “any reasonably foreseeable vehicle response mode” proposed in § 450.101(c) with “any reasonably foreseeable failure mode” in § 450.101(c)(2) of the final rule. The NPRM defined “vehicle response mode” as a mutually exclusive scenario that characterizes foreseeable combinations of vehicle trajectory and debris generation. Thus, the NPRM would have required an evaluation of CE_C for each foreseeable combination of vehicle trajectory and debris generation. By replacing the term “vehicle response mode” (VRM) with “failure mode,” the final rule is both less prescriptive and consistent with the current requirements.^[71]

In the NPRM, the FAA defined a VRM as a mutually exclusive scenario that characterizes foreseeable combinations of vehicle trajectory and debris generation. As stated in the NPRM, proposed § 450.101(c) would have required, at a minimum, that an operator compute the effective casualty area and identify the population density that would be impacted for each reasonably foreseeable vehicle response mode in any one-second period of flight in terms of CE_C. The NPRM further explained that the casualty area, population density, and predicted consequence for each vehicle response mode are intermediate quantities that are necessary to demonstrate compliance with the individual and collective risk criteria currently; thus, these new requirements would not necessarily impart significant additional burden on operators.

The draft AC 450.115-1 on High Fidelity Flight Safety Analysis published for comment in conjunction with the NPRM further explained that “VRMs are a combination of debris list and failure modes” and provided a description of typical failure modes for launch and reentry systems, including loss of thrust, engine explosion, attitude control failure, structural failure, separation failure, guidance or navigation failure, etc. Because the final rule replaces the term “vehicle response mode” with “failure mode,” an operator is no longer required to evaluate CE_C for each foreseeable combination of failure mode and debris generation. Instead, an operator is required to evaluate CE_C for each reasonably foreseeable failure mode in any significant period of flight.^[72]

Boeing suggested changing the term “reasonably foreseeable” to “credible” vehicle response modes. The FAA does not agree that the term “reasonably foreseeable” should be replaced by the term “credible” in this section. As previously noted, the term “reasonably foreseeable” is used in § 431.35 and commonly used in system safety. In the absence of a compelling reason to change, the FAA prefers to continue to use language consistent with previous regulations instead of introducing a new term at this time. Furthermore, the FAA finds that the term “credible” is prone to errors in judgment whereas the term “reasonably foreseeable” is more readily discerned by analysis (e.g., fault trees).

iv. § 450.101(c)(3)

In the NPRM, in instances in which CE_C was greater than 1 × 10⁻³, proposed § 450.101(c) provided relief from the use of flight abort if the Administrator agreed that flight abort was not necessary based on the demonstrated reliability of the launch or reentry vehicle during a phase of flight. The NPRM preamble cited the flight of a certificated aircraft carrying a rocket to a drop point as an example of a phase of flight when the use of an FSS would likely not be necessary, even though the CEC could be above the threshold because the aircraft would have demonstrated reliability.

While the final rule retains the “demonstrated reliability concept” proposed in the § 450.101(c) of the NPRM, it has been revised and relocated to § 450.101(c)(3). Section 450.101(c)(3) of the final rule states that an operator must protect against a high consequence event in uncontrolled areas for each phase of flight by establishing the launch or reentry vehicle has sufficient demonstrated reliability based on the CE_C during that phase of flight.

Because demonstrated reliability provides an alternative to flight abort when CE_C is greater than 1 × 10^−[3] , it is appropriate to assess it consistent with the approach to flight abort and FSS reliability, which depends on CE_C with a 1 × 10^−[2] threshold.^[73] Notably, the ARC recommended that the need for an FSS should be determined by taking into account population density, the realm of reasonably foreseeable failures, trajectory, size, and explosive capabilities of the vehicle. CE_C accounts for all those factors. As such, the CE_C computed for a proposed operation is inherent in determining whether the vehicle has sufficient demonstrated reliability to protect against a high consequence event. This revision informs operators on the approach the FAA will take in determining whether the launch or reentry vehicle has sufficient demonstrated reliability to protect against a high consequence event.

More specifically, the FAA will use the demonstrated reliability and average ground consequence results from fatal accidents involving U.S. civil aviation aircraft with standard airworthiness certificates to establish what constitutes sufficient demonstrated reliability to protect against a high consequence event based on CE_C. For example, a carrier vehicle with a CE_C near 1 × 10^−[2] in a given phase of flight would need to have demonstrated reliability during that phase of flight on par with the subset of fixed-wing general aviation aircraft that empirically produce CE_F ^[74] near 1 × 10^−[2] . However, the same carrier vehicle operated in a more densely populated area could have a CE_C near 1 in a given phase of flight and thus would need to have demonstrated reliability during that phase of flight on par with commercial transport aircraft that empirically produce CE_F near 1.^[75] This approach is consistent with the longstanding and often cited principle that launch and reentry should be no more hazardous to the public than over-flight of conventional aircraft, as explained in the NPRM preamble.

The FAA received multiple comments seeking clarification of the provision to use demonstrated reliability as a means to ensure a low probability, high consequence event is sufficiently mitigated. In the NPRM, the FAA noted that “demonstrated reliability” in this context refers to statistically valid probability of failure estimates based on the outcomes of all previous flights of the vehicle or stage. For example, a probability of failure analysis that complies with § 450.131 will provide a valid basis to establish the demonstrated reliability of a launch or reentry vehicle in a given phase of flight. That concept is also applicable to § 450.101(c)(3) of the final rule. Furthermore, the FAA will consider the magnitude of the high consequence event in determining what level of reliability will be sufficient to ensure that the high consequence event is mitigated. One way to show that a vehicle has demonstrated reliability during a phase of flight is to show that it has demonstrated reliability during that phase of flight equivalent to a specific aircraft type or an average aircraft of similar size and performance characteristics with a standard airworthiness certificate.^[76] The FAA notes an average aircraft of similar size would have less uncertainty than a specific type aircraft because there would be more data collected for an average aircraft, and thus the demonstrated reliability of an average aircraft could be more readily characterized with a reasonable level of confidence. Furthermore, both a specific aircraft type and an average aircraft with a standard airworthiness certificate generally will not need additional flight abort capability unless the addition of the rocket substantially increased the risk from a high consequence event. However, aside from some carrier aircraft used as a component of a launch vehicle, no launch vehicle, including U.S. government owned and operated vehicles, to date has a significant amount of historical flights to ensure sufficient protection against a high consequence event based on demonstrated reliability in accordance with § 450.101(c)(3).

c. Critical Asset and Critical Payload Protection

Commercial space transportation operations occur increasingly in close proximity to critical assets. In order to maintain the continuing functionality of critical assets, the FAA proposed to define “critical assets” in § 401.5 (§ 401.7 in the final rule) and add a quantitative risk criterion (1 × 10⁻³) for the protection of critical assets during launch or reentry activity under § 450.101 in the NPRM.

In the final rule, the FAA adopts the “critical asset” definition in § 401.7 with modification, as discussed below. The FAA adopts the risk criterion as proposed but removes the requirement for operators to assess the risks to critical assets in preparing a flight hazard analysis (proposed § 450.109(a)(3)(ii)), debris analysis (proposed § 450.121(c)(1) and (c)(2)), debris risk analysis (§ 450.135), and ground hazard analysis (§ 450.185(c)). Instead, in accordance with § 450.101(a)(4)(iii) and (b)(4)(iii), either the FAA or a Federal launch or reentry site operator will determine whether the proposed activity would expose critical assets to a risk of loss of functionality that exceeds the risk criterion in § 450.101(a)(4) or (b)(4) and convey any necessary constraints to the operator. The operator must receive confirmation from the FAA or Federal launch or reentry site operator that the risk to critical assets satisfies the risk criterion in § 450.101(a)(4) or (b)(4) prior to launch or reentry. The FAA anticipates that most critical assets for a given launch site will be known when an applicant begins pre-application consultation. Current practice demonstrates that the critical asset evaluation can often be completed using preliminary flight safety data (during pre-application or during the license evaluation), sufficient to show critical assets risks are acceptable. Where the prevailing weather conditions are important to the critical asset risks, an assessment is performed either close to or on the day-of-launch.

In the final rule, the FAA also clarified in § 450.101(a)(4)(ii) and (b)(4)(ii) the Federal procedure by which critical assets will be identified. To identify critical assets, the FAA will consult with relevant Federal agencies, and each agency will identify, for purposes of part 450, any critical assets that the agency owns or otherwise depends on. The FAA will accept any identification by the Secretary of Defense that an asset is critical to national security. For critical assets identified by other relevant Federal agencies, such as NASA, the FAA will work with the agency to ensure its identification of critical assets aligns with the requirements of part 450.

The FAA also adds in § 450.165(a)(5) (Flight Commit Criteria) a requirement that operators' flight commit criteria include confirmation from the FAA that the risk to critical assets satisfies the requirements of § 450.101(a)(4) or (b)(4). Lastly, the FAA sought comments in the NPRM on its proposal to add to the final rule a definition for “critical payload” and a requirement that the probability of loss of functionality not exceed 1 × 10⁻⁴ for each critical payload. The FAA adopts the proposed definition and requirement in the final rule.

In the final rule, the FAA adopts the risk criterion proposed for critical assets in the NPRM. The property protection criteria in § 450.101(a)(4) and (b)(4) are consistent with current practice at Federal sites. Launch operations from NASA-operated ranges are currently subject to requirements that limit the probability of debris impact to less than or equal to 1 × 10⁻³ for designated assets. The USAF requirement in AFI 91-202 and the Guidance Memorandum to AFSPCI 13-610 match those proposed by the FAA. The FAA also adopts its proposal to extend the protection of critical assets to non-Federal launch or reentry sites because the protection of critical assets is necessary irrespective of the location of the launch.

As proposed in the NPRM, a critical asset is an asset that is essential to the national interests of the United States. The proposed definition noted that critical assets include property, facilities, or infrastructure necessary to maintain national defense, or assured access to space for national priority missions.^[77] In the final rule, the FAA replaces “necessary to maintain national defense” with “necessary for national security” to be more consistent with the rest of 14 CFR Chapter III. The FAA also adds that critical assets may include those necessary for high priority civil space purposes, for clarity. An example of this would be infrastructure necessary to support launch and reentry services to deliver cargo to and from the International Space Station.

CSF and SpaceX noted that critical assets are frequently located on or near Federal launch or reentry sites, and that the current practice at Federal launch or reentry sites is to allow a site operator or neighboring operator to waive the critical asset requirement for its own facilities. The commenters requested the regulation provide a similar allowance to reduce the frequency with which operators would need to apply for waivers. SpaceX recommended revising the regulation to allow for the waiver of an operator's own designated critical assets, as well as assets that may be shared or used as common infrastructure at a range.

The FAA acknowledges that critical assets located on a launch site, including the launch facility itself, may be exposed to a risk of loss of functionality that exceeds 1 × 10^−[3] during launch activity. The FAA finds that it would be burdensome to require a waiver of the critical asset protection requirement when a launch site operated by the U.S. Government or licensed by the FAA allows an operator to use its facility for launch. Therefore, the FAA revises § 450.101(b)(4) to not apply the critical asset risk criteria to property, facilities, or infrastructure supporting the launch that are within the public area distance, as defined in part 420 Appendix E, Tables E1 and E2 or associated formulae, of the vehicle's launch point.^[78] Assets that fall within this exception, located at § 450.101(b)(4)(v), are exempt from the critical asset protection requirements in § 450.101(a)(4)(i) and (b)(4)(ii) for a licensed launch.

Assets excepted from risk criteria are determined by the required distance to a public area specified in Table E-1 or E-2 or associated formulae in Appendix E to part 420, using the quantities of propellants or other explosives on the vehicle, including any payloads. These distances are equivalent to Inhabited Building Distances commonly observed on Federal launch or reentry sites to protect critical assets. The exception limits consideration to quantities of propellants on the vehicle, including any payloads. Any critical assets within this area that are not supporting the activity would be subject to the risk criteria. This exclusion would be applicable from ignition or at the first movement that initiates flight, whichever occurs earlier, and end when the launch ends.

The FAA received many comments on the definition of “critical asset.” ULA expressed support for the proposed definition. A number of commenters, including CSF and Sierra Nevada, asked who will determine whether an asset is “critical” and how the determination would be communicated to an applicant. Virgin Galactic commented that the proposed definition is vague and did not provide enough information to the operator to ensure protection of critical assets because the definition could potentially apply to all property at a Federal site. Virgin Orbit commented that the lack of clarity could result in Federal agencies incorrectly concluding their assets were protected. CSF and SpaceX commented that there was no limit on the number or location of assets for which an operator would need to perform a risk analysis. CSF and SpaceX recommended the definition of “critical asset” be limited to U.S. Government assets located on Federal property that the Secretary of Defense or Administrator of NASA determines to be essential to the national interests of the United States. Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended critical assets be defined as assets for which incapacitation or destruction would have a very serious, debilitating effect on national defense, or assured access to space for national priority missions. The commenters noted this change would be consistent with the definition in DCMA-MAN 3401-02, Defense Industrial Base Critical Asset Identification and Prioritization. Furthermore, the commenters stated that classification as a critical asset should be determined by minimum criteria (not specified in the comment) and an assessment by the asset owner.

The FAA disagrees that the definition of “critical asset” is vague or overbroad. The proposed definition, along with the examples provided in the NPRM preamble, bound the scope of critical assets appropriately and provide sufficient clarity for operators. Only those facilities, property, or infrastructure that are necessary for national security purposes, high priority civil space purposes, or assured access to space for national priority missions will be deemed critical assets under § 401.7. Critical assets will also include certain military, intelligence, and civil payloads, including essential infrastructure when directly supporting the payload at the launch site. The FAA provided several examples of critical assets in the NPRM. Critical assets include assets that, if incapacitated or destroyed, would have a serious, debilitating effect on national security or assured access to space for national security missions, but the FAA disagrees that the additional words proposed by the commenters add clarity beyond the proposed definition.

Virgin Orbit's concern that Federal agency may assume incorrectly that a critical asset was protected is alleviated by the fact that critical assets will be identified by Federal agencies that own or otherwise depend on assets that are essential to the national interests of the United States. The FAA will work with operators to identify any measures that operators may need to undertake in order to protect critical assets to the level required by § 450.101(a)(4) or (b)(4).

With respect to the concern that Federal agencies might be inclined to overestimate their assets as critical, the FAA does not find that experience at Federal launch or reentry sites warrants such a concern. In fact, discussions with safety officials at CCAFS indicate that the risk to critical assets or critical payloads has rarely exceeded the risk thresholds adopted by the FAA. Federal launch or reentry sites have not excessively designated assets as critical, nor have they imposed significant restrictions on launch activity. When approving the use of their sites for launch activity, Federal sites consider the potential of launch activities endangering other facilities. Similarly, other users of the site do not knowingly put their assets at risk. The FAA maintains that similar considerations would hold at non-Federal sites. Non-Federal launch or reentry site operators will consider the siting and scheduling of activities to avoid one user's activity threatening the assets of another user. Occasionally, delays in one site user's activity may necessitate rescheduling another user's activity. Otherwise, a new activity that was not anticipated when siting decisions were made, such as fly-back of a stage, is most likely to expose a critical asset to risk exceeding the criterion.

Only property, facilities, or infrastructure located close to the launch point might typically be expected to exceed the criteria, and those assets are generally associated with the subject launch operation. As discussed in this section, the FAA revised § 450.101(a)(4) to eliminate the need to seek waivers for assets located within the immediate vicinity of a launch point during the launch. Although many of these assets may be critical, meeting the critical asset criteria would be impractical during a launch from the particular launch point. Hence, assets located within the public area distance required by part 420 during a licensed launch are exempt from the critical asset protection requirements in § 450.101(a)(4)(i) and (b)(4)(i). As such, the FAA anticipates that operations exceeding the risk criteria for critical assets will continue to be few, resulting in minimal restrictions on launch activity.

The FAA maintains that establishing explicit risk criteria for protecting critical assets in this final rule provides a level of certainty. Launch and reentry site operators will have a metric to determine what activities are appropriate for various locations on their sites. Either the FAA or Federal site will perform any necessary analysis, and will provide written confirmation to the operator that the criteria in § 450.101(a)(4) or (b)(4) have been met. If the risk to critical assets posed by the proposed activity exceeds the criteria in § 450.101(a)(4) or (b)(4), then the FAA will work with asset owners and operators to reach solutions that allow operations without sacrificing safety to the critical assets or mission objectives.

The FAA does not adopt the suggestion by CSF and SpaceX to limit critical assets to U.S. Government assets located on Federal property that the Secretary of Defense or the Administrator of NASA determines to be essential to the national interests of the United States. Federal entities other than the DOD and NASA might own or otherwise depend on critical assets, such as NOAA. Thus, it would be inappropriate to assign the determination of critical assets to only these agencies. However, as noted earlier, critical assets will be identified by Federal agencies, such as DOD and NASA, which own or otherwise depend on assets that are essential to the national interests of the United States, and the FAA will accept any identification by the Secretary of Defense that an asset is critical to national security. Note also that the FAA does not limit the definition of “critical assets” to assets that are owned or located on property owned by the U.S. Government. As stated in the NPRM, the FAA extended the protection of critical assets to non-Federal launch or reentry sites, which previously had no regulatory assurance of protection from loss of functionality of critical assets. The FAA maintains the same safety standards for critical assets for launches that take place on a Federal launch or reentry site as those that take place on a non-Federal launch or reentry site, some of which are dual use, supporting both commercial and military operations. Similarly, as explained in the NPRM the FAA will deem any commercial property that meets the definition set forth in § 401.7 a critical asset.

Blue Origin asked the FAA to provide examples of critical infrastructure. The FAA notes that in the past, the launch complexes at CCAFS that support Atlas V and Delta IV launches have been designated as critical assets because they support missions essential to the interests of the United States.

An individual commenter recommended the FAA define categories of national security interests, including cybersecurity, security controls, and classification level. Although these are important national interests, they are not by themselves critical assets, and the FAA does not find it necessary to add categories of national security interests.

Airlines for America (A4A) recommended the FAA extend the safety protections of critical assets to include critical aviation infrastructure, including airports. The FAA notes that the definition of “critical asset” does not preclude aviation infrastructure from being a critical asset. More generally, the definition of “critical asset” can include non-space associated assets, including those not located at or adjacent to a launch or reentry site. However, the criterion for loss of functionality likely limits aviation infrastructure assets from being subject to protection.

Commenters were divided on the need for critical asset protection. ULA acknowledged the need for protection of critical assets. Virgin Galactic questioned whether the FAA's proposed critical asset requirements were within the FAA's statutory authority, as title 51 did not reference “national interests” or “national priority missions.” Blue Origin acknowledged the FAA's statutory authority to protect property and asked the FAA to explain how it will interpret and implement this authority. An individual commenter stated only assets directly related to national security should be given heightened protection. CSF, Spaceport Strategies, LLC (Spaceport Strategies), and SpaceX commented that critical assets were already protected by current requirements at Federal launch and reentry sites, rendering the FAA's regulations duplicative. SpaceX added that NASA or DOD may not agree with the FAA's proposed critical asset requirements, which may lead to further duplication of requirements at Federal sites.

The FAA has the authority to protect critical assets. The Commercial Space Launch Act authorizes the DOT, and the FAA by delegation, to protect public health and safety, safety of property, and national security and foreign policy interests of the United States. In carrying out its responsibility to protect property, the FAA has established a quantitative requirement to protect assets that are essential to the national interests of the United States. As noted in the NPRM, national interests go beyond national security and include infrastructure such as that used to support high priority NASA missions. As noted earlier, an example of this would be infrastructure necessary to support launch and reentry services to deliver cargo to and from the International Space Station.

As CSF, Spaceport Strategies, and SpaceX noted, the FAA's critical asset requirements codify current practice at Federal launch or reentry sites, but also extend the same regulatory protection for launch or reentry activity at non-Federal launch or reentry sites. Although critical assets are primarily located on Federal launch or reentry sites at this time, the FAA foresees increased commercial space activity at non-Federal sites that may result in the presence of critical assets at those sites. In licensing commercial launch or reentry activities, the FAA safeguards critical assets—which by definition are essential to the national interests of the United States—irrespective of their location.

The FAA does not find the critical asset requirements to be unnecessarily duplicative of requirements at Federal launch or reentry sites. As discussed in the NPRM, the FAA proposed these requirements to further the goal of common standards for launches from any U.S. launch or reentry site, Federal or non-Federal. Inclusion of critical asset protection in FAA regulations aligns FAA licensing with Federal launch or reentry site requirements and removes duplication of effort. The FAA closely coordinated the critical asset requirements with the CSWG and its interagency partners, including NASA and DOD. As a result of this coordination, the FAA anticipates that the methodologies used by the Federal launch or reentry sites will satisfy the FAA's requirements for critical asset protection.

Many commenters, including AIA, Blue Origin, Boeing, CSF, Lockheed Martin, Northrop Grumman, Sierra Nevada, SpaceX, Virgin Galactic, and ULA raised concerns about how an applicant would obtain the information necessary to perform the proposed critical asset analysis, including proprietary or confidential information. CSF and SpaceX noted the same data should be provided to all operators to ensure the fair and unbiased application of this regulation. Sierra Nevada recommended the FAA provide a method of acceptable means of compliance that does not require a commercial company to contract with DOD to complete this analysis. Alternatively, Sierra Nevada recommended the FAA provide the analysis instead of the applicant. CSF and SpaceX also recommended the FAA publish an AC that would provide an acceptable means for analyzing critical assets, describe how the FAA would obtain a definitive list of critical assets, and how the FAA would provide operators the data necessary to conduct the analysis. Blue Origin stated that, by requiring information that includes data from other entities, the FAA would become responsible for facilitating acquisition of this data or would risk implementing a requirement that would not be possible to comply with or a requirement that would establish a sole source provider of a service.

The FAA acknowledges the practical problems an applicant would likely encounter in collecting the input data necessary to identify and perform a risk assessment for critical assets, especially critical payloads. The FAA agrees with Sierra Nevada that it would be better for the U.S. Government to perform all critical asset and critical payload risk assessments necessary to ensure operators comply with the risk criteria in part 450. The FAA therefore removes the requirement for operators to assess the risks to critical assets in preparing a flight hazard analysis, debris analysis, and debris risk analysis. The FAA also removes from § 450.185 (Ground Hazard Analysis) the requirement that the ground hazard analysis ensure that the likelihood of any hazardous condition that may cause damage to critical assets is remote. The FAA notes that the input data and analysis tools necessary to perform a risk assessment for critical assets are often a subset of those the FAA uses to establish the MPL values. The FAA will perform all critical asset and critical payload risk assessments for commercial space transportation operations involving non-Federal sites. Hence, operators should not bear additional cost for the analyses associated with critical assets.

Blue Origin asked how the FAA will address overflight of critical assets. The FAA notes that overflight of a critical asset is possible if the safety criteria set forth in § 450.101 are satisfied. Past experience demonstrates that the critical asset criteria in § 450.101 are satisfied except in occasional cases involving critical assets located within the same launch site. Historically, the risk to critical assets from overflight outside the launch site is negligible.

Virgin Galactic asked how an operator would have input on or dispute the determination of a critical asset. The FAA will discuss with operators any concerns they may have about ensuring protection of critical assets during their licensed activities, but the FAA is not proposing a formal dispute mechanism to adjudicate its determination that an asset is critical or threatened within the risk criterion. Often, it might not be possible to share such information due to national security issues and proprietary interests. The FAA notes, however, that if the FAA denies an application for a license based on its determination that the proposed activity exceeds the risk threshold for critical assets, an applicant may request reconsideration under § 413.21 or a hearing in accordance with part 406 of this chapter.

CSF asked how the FAA will manage proprietary and national security concerns among operators and asset-owners. The FAA does not foresee a need to share proprietary data with non-Federal entities because the Federal Government will conduct the assessment of critical asset risk on behalf of the licensee. Based on discussions with relevant Federal agencies, it is also possible to perform an assessment of critical assets without disclosing the precise location or nature of each asset, thereby eliminating the need to share proprietary and national security information. For example, the USAF 45th Space Wing/Wing Safety identifies what facilities are threatened within the thresholds and shares that information with the appropriate tenants. The tenant can then inform the USAF, or another entity performing the analysis, that an asset is threatened without divulging sensitive information to any entity outside the U.S. Government. The FAA will work with the entities responsible for critical assets to ensure any necessary coordination, taking into account the need to protect proprietary and confidential data.

Several commenters, including CSF, SpaceX, and Virgin Galactic requested clarification as to the meaning of “loss of functionality” and how the FAA or other entity would determine what could result in the “loss of functionality” of a critical asset. CSF sought clarification on whether infrastructure was “critical” if it was needed to support full functionality of a critical asset and on the standard for determining whether an asset's function had been lost. It inquired whether it would matter if the function could be restored in a timely manner or met with an alternative asset.

CSF and SpaceX also recommended that “loss of functionality” be defined in § 401.7 as an asset designated critical by the Secretary of Defense or Administrator of NASA that (a) has been rendered unable to support a specific mission or program deemed critical to the national interest; (b) for which the loss of function will preclude the assurance of a time-critical mission or program unless promptly restored; or (c) for which the asset's function cannot be restored by an accelerated recovery strategy or replaced by an alternate means of mission/program execution. SpaceX and Virgin Galactic requested the FAA include this new definition in an SNPRM, along with a clear rationale for the FAA's proposed requirements for protecting critical assets.

Under the final rule, the party responsible for the critical asset would determine what constitutes loss of functionality. The FAA recognizes that the threshold conditions that cause loss of functionality will be different depending on the type of asset and its robustness. For example, infrastructure is typically more robust than a payload that may be more fragile. For this reason, the FAA does not elect to incorporate a specific standard for what may constitute loss of functionality into the final rule. Likewise, the FAA does not find that it is useful to create a more detailed definition of “loss of functionality” but agrees that considerations such as those suggested by CSF and SpaceX (e.g., ability to support missions critical to national interests, or ability to repair or restore function through alternative means in a timely manner) would be relevant and appropriate to determining loss of functionality.

An individual commenter stated that critical asset protection should not compromise protection of the public and neighboring operation personnel. The commenter stated that an operator's required insurance should already cover losses to critical assets.

The FAA notes that the critical asset protection requirements will not compromise the protection of the public or neighboring operation personnel. The FAA retains stringent requirements for protecting the public, including neighboring operations personnel, which are independent of the requirements protecting critical assets. The FAA also disagrees with the commenter that an operator's financial responsibility requirements are adequate to protect critical assets. The FAA is limited by statute to imposing no more than $100 million in financial responsibility to compensate for losses to U.S. Government property. The value of many critical assets easily exceeds that limit, with some critical payloads reportedly costing over a billion dollars. More importantly, financial compensation for a loss may not address the delay before repairs or replacement, during which time national security might be jeopardized or the opportunity to accomplish important national interests missed.

The FAA sought comments on its proposal to require a more stringent criterion for critical assets of utmost importance to the U.S., to be defined as “critical payloads” in § 401.7. The FAA proposed to require that the probability of loss of functionality for critical payloads, including essential infrastructure when directly supporting the payload, not exceed 1 × 10⁻⁴. In the past, Federal launch or reentry sites have, on occasion, applied a more stringent requirement, limiting the probability of debris impact caused by launch or reentry hazards to less than or equal to 1 × 10⁻⁴ for national security payloads, including essential infrastructure when directly supporting the payload at the launch site. The FAA asked commenters to identify (1) the impacts a 1 × 10⁻⁴ risk criterion would have on their operations if applied to critical payloads; (2) whether a more stringent risk criterion should be imposed on any commercial payload; and (3) potential additional costs and benefits associated with applying a 1 × 10⁻⁴ risk criterion to critical payloads.

In the final rule, the FAA adopts the risk criterion and definition as discussed in the NPRM preamble, with minor clarifications.

ULA supported the 1 × 10⁻⁴ risk criterion for critical payloads, stating that given the time and expense associated with replacing these assets, it was essential they receive the greatest protection possible. It further commented that this risk criterion should also apply to infrastructure and booster hardware in direct support of critical payloads, beginning when booster hardware for that particular critical payload was received and began processing at the launch site. Under ULA's suggestion, at the completion of the launch campaign, the risk criterion should revert to 1 × 10⁻⁴. Virgin Galactic, however, commented that it was not necessary to adopt a heightened risk criteria for critical payloads. It saw no benefit to the discussed 1 × 10⁻⁴ requirement over the 1 × 10⁻⁴ requirement. It also inquired whether the criterion would apply to payloads on the vehicle of the operator that might be subject to this new risk threshold. If so, Virgin Galactic stated this would constitute managing mission success. Virgin Galactic also inquired whether this risk criterion would apply to payloads at neighboring launch sites. If so, Virgin Galactic believes the FAA must demonstrate need and a nexus to statutorily obligated concerns. It further stated that a more stringent criterion for commercial payloads would place undue burden on operators, potentially requiring additional analyses or redesign. Virgin Galactic noted that it did not intend to carry critical payloads, so impacts to its operations from this requirement would be negligible.

In the final rule, the FAA defines a critical payload as a payload and essential infrastructure directly supporting such a payload that is a critical asset (1) that is so costly or unique that it cannot be readily replaced, or (2) for which the time frame for its replacement would adversely affect the national interests of the United States. As noted in the NPRM, a commercial payload that meets this definition will be treated as a critical payload. The critical payload protection requirement does not apply to payloads on the vehicle of the operator regulated under part 450 but will apply to payloads on neighboring launch sites. The FAA agrees with ULA that the 1 × 10⁻³ risk criterion should apply to essential infrastructure directly supporting the critical payload, and notes that it will likely apply to booster hardware in direct support of the launch of a critical payload. After a launch of a critical payload, the infrastructure supporting the launch will be critical only if it is essential to the national interests of the United States. The risk criterion determines the protection required for critical assets and payloads. It is not necessary to specify in the regulation that this requirement does not apply during activities that do not exceed the risk threshold.

The FAA disagrees with Virgin Galactic that there is no benefit in applying a 1 × 10⁻⁴ risk criterion to critical payloads. As explained in the NPRM, during the interagency review process, DOD requested that the FAA consider specifying a more stringent criterion for certain critical assets of utmost importance. The FAA considers a critical payload a type of critical asset. The FAA finds it necessary to protect payloads such as vital national security payloads and high-priority NASA and NOAA payloads. The NPRM noted that a payload such as NASA's Curiosity rover would likely be afforded this protection. In the final rule, the FAA adopts this higher protection criterion to safeguard those payloads of utmost importance to the U.S. meriting a greater degree of protection than other critical assets. While the FAA is providing for heightened protection for critical payloads, it expects the protection to have minimal effects on commercial launch and reentry operations. Currently there are few commercial payloads that would rise to the level of being considered critical payloads, although the FAA recognizes that might change in the future, if for instance, DOD were to rely on a commercial service for critical communication support.

Virgin Galactic requested the FAA adopt neither 1 × 10⁻³ nor a more stringent criterion. It argued the proposed requirement contradicted the requirement in 51 U.S.C. § 50901(a)(7) that the FAA regulate only to the extent necessary. Virgin Galactic stated the FAA did not show why these requirements were necessary, given that Federal launch or reentry sites already protect their own property. Furthermore, Virgin Galactic commented that the FAA would be enforcing a more stringent, but undisclosed criterion and argued the proposed regulation was non-transparent and would deprive the public of the opportunity to comment on this criterion as required by the Administrative Procedure Act. The commenter asserted this undisclosed criterion could prevent operators from planning ahead and would create two standards that might conflict.

As articulated in the NPRM, the FAA finds it necessary to codify current practice at Federal launch or reentry sites to protect critical assets that are of utmost importance to the U.S. and to extend the same protections for launch or reentry activity conducted at non-Federal sites. For launches from Federal sites, this rule does not change current practice; rather it incorporates that practice in a regulation. This regulation consolidates the FAA's requirements for protection of critical assets and critical payloads in all commercial launch or reentry operations, in accordance with the FAA's statutory authority. This rule reduces the need for a Federal or non-Federal site operator to impose critical asset protection requirements on operators as a contractual condition for the use of its facility. The FAA expects that the instances in which a more stringent criterion will be necessary will be rare. Preserving the flexibility to protect particularly vital assets at a more stringent criterion in a license, as proposed in the NPRM, is consistent with current practice at Federal launch and reentry sites and will reduce the need for a Federal or non-Federal launch site operator to impose a more stringent criterion on operators through contract.

CSF and SpaceX commented that the FAA did not assess the cost burden on industry for compliance with the critical asset requirements. Virgin Orbit commented that critical asset calculations would require additional analysis and resources.

In the final rule, the FAA's removal of the requirements for operators to assess impacts to critical assets in flight hazard, ground hazard, debris or debris risk analyses assuages the commenters' concerns for costs associated with performing those analyses. As compared to the proposal, there will be much reduced administrative burden on the operator. The FAA will coordinate as necessary with critical assets owners, and either the FAA or the Federal site operator will provide written confirmation to the operator that the criteria in § 450.101(a)(4) or (b)(4) have been met. If the FAA or Federal site operator determines that the criteria have not been met, either the FAA or Federal site operator will work with the operator to identify any measures that operators may need to undertake in order to protect critical assets to the level required by § 450.101(a)(4) or (b)(4).

An individual commenter stated that the proposed regulation would require companies to perform trade studies to determine if additional controls would be needed to reduce the likelihood of critical asset loss of functionality. The commenter requested the FAA require a cost-benefit analysis to ensure that upfront investment of controls to protect critical assets would be less than the cost of replacing that asset.

When determining whether an asset is a critical asset, the cost of an asset is a factor. However, ultimately an asset is critical if it is essential to the national interests of the United States. If it cannot be replaced in a time frame that satisfies those interests, the cost of the asset is irrelevant. Furthermore, the FAA does not find that most mitigations will impose significant cost.

Virgin Galactic indicated the need for FAA assistance in planning hazard control strategies pursuant to proposed § 450.107(e)(2)(ii) ^[79] due to the secrecy of some critical assets. If an operator is using physical containment as a hazard control strategy, the FAA or Federal launch or reentry site operator will work with the operator to ensure no critical assets are within the flight hazard area. The most likely mitigation is shifting the launch point or, if the critical asset is mobile, changing in the launch schedule.

Sierra Nevada requested the FAA conduct a publicly-available assessment to determine if the proposed critical asset protection requirements would impact an operator's MPL calculation. CSF requested the FAA engage industry on the topic of critical assets.

The FAA does not find that the protection of critical assets will increase MPL. The designation of an asset as critical is unrelated to financial responsibility. In performing its MPL calculation for U.S. Government property, the FAA ascertains the financial responsibility required so that the likelihood of exceeding losses to government property involved in a licensed activity (taken to mean such property on a Federal launch or reentry site) that are reasonably expected to result from that activity does not exceed 1 × 10⁻⁵; or, in the rarer situation in which a critical asset might not be U.S. Government property on a Federal launch or reentry site, 1 × 10⁻⁷. Critical assets are protected to a less stringent 1 × 10⁻³, or in the case of certain critical payloads, 1 × 10⁻⁴, and financial responsibility and protection are not directly related. If anything, the requirement to protect critical assets has the potential to lower MPL for U.S. Government property because the mitigation employed may well remove the possibility that the asset can be damaged even within the more stringent MPL threshold. This would be the case if, to avoid placing the critical asset at risk a launch was rescheduled, its trajectory adjusted, or the critical asset was moved or physically protected. The FAA finds that it is unlikely that a mitigation employed to protect critical assets will change the MPL for third-party liability.

d. Other Safety Criteria (§ 450.101(d), (e), (f), and (g))

The FAA adopts the criteria in § 450.101(d), (e), (f), and (g) with no changes. Section 450.101(d) addresses disposal safety criteria, § 450.101(e) is the requirement for the protection of people and property on orbit, § 450.101(f) requires the notification of planned impacts, and § 450.101(g) addresses the validity of analyses.

The FAA received public comments from Virgin Galactic on the notification of planned impacts. Specifically, Virgin Galactic advised that a carrier aircraft operating under an airworthiness certificate should be exempt from proposed § 450.101(f). This comment is discussed in further detail in the preamble section on hybrid vehicles. The FAA will not exempt all hybrid vehicle operators from the requirement in § 450.101(f). If an operation has no planned impacts from debris capable of causing a casualty, then no notification will be necessary to comply with § 450.101(f). The regulation is adopted as proposed.

e. System Safety Program (§ 450.103)

In the NPRM, the FAA proposed in § 450.103 that an operator must implement and document a system safety program throughout the operational lifecycle of a launch or reentry system. The system safety program was proposed to include a safety organization (§ 450.103(a)), procedures to evaluate the operational lifecycle of the launch or reentry system (§ 450.103(b)), configuration management and control (§ 450.103(c)), and post-flight data review (§ 450.103(d)).

In the final rule, the FAA adopts proposed § 450.103 with revisions. The FAA replaced the term “operational lifecycle” in the introductory paragraph of § 450.103 with simply “lifecycle” to clarify that the regulation applies to hazards throughout the lifecycle of a launch or reentry system, not just operational changes to the system. This change is consistent with the statements in the NPRM indicating that, due to the complexity and variety of vehicle concepts and operations, a system safety program would be necessary to ensure that an operator considers and addresses all risks to public safety, which include both design and operational changes to a system.

i. Safety Organization

In the NPRM, the FAA proposed that the system safety program would require an operator to maintain and document a safety organization that has clearly defined lines of communication and approval authority for all public safety decisions, and that includes a mission director and safety official. In the final rule, the FAA adopts the proposed rule with a revision. The FAA removes “and document” from the proposed requirement because the first sentence in § 450.103 already requires a system safety program to be documented.

Proposed § 450.103(a)(1) stated that for each launch or reentry, an operator would be required to designate a position responsible for the safe conduct of all licensed activities and authorized to provide final approval to proceed with licensed activities. This position is referred to as the mission director. In the final rule, the FAA adopts § 450.103(a)(1) as proposed. The FAA did not receive comments on this section.

Proposed § 450.103(a)(2) stated that, for each launch or reentry, an operator would be required to designate a position with direct access to the mission director who would be responsible for communicating potential safety and noncompliance issues to the mission director and would be authorized to examine all aspects of the operator's ground and flight safety operations, and to independently monitor compliance with the operator's safety policies, safety procedures, and licensing requirements. This position would be referred to as a safety official. The FAA noted in the NPRM preamble that the absence of a safety official could result in a lack of independent safety oversight and a potential for a breakdown in communications of important safety-related information. The FAA also noted that a safety organization that included a safety official was essential to public safety; however, identifying that individual by name was not necessary. In the final rule, the FAA adopts § 450.103(a)(2) as proposed. Thus, a safety official will need to be in place prior to and throughout any licensed activity.

Rocket Lab supported the proposed safety organization documentation requirements in proposed § 450.103(a), noting the requirements would provide improved flexibility for the industry and support growth in operations, while maintaining clear lines of communication and independence in safety decision making. Virgin Galactic noted that it agreed with the FAA's approach not to require a specific person be listed as the safety official. Microcosm inquired if a specific named safety official would be required for each launch site for operators with licensed activity at multiple sites, and how far in advance that information would need to be provided to the FAA.

The FAA notes that a safety official must be named and in place prior to the initiation of any licensed activity, and an operator may use the same safety official for multiple launch or reentry sites. It may be difficult for a single individual to serve as a safety official for multiple sites if launch or reentry activities were to occur close in time to each other. In those instances, an operator may choose to have multiple safety officials. An operator needs to provide the name of the safety official to the FAA only when requested. The FAA may request the name of the individual who will act as a safety official as part of a compliance monitoring action. As is current practice, the FAA will coordinate in advance with the operator prior to a compliance monitoring action.

ALPA concurred with the requirement for operators to develop a general system safety program. It also recommended that that embedding FAA representatives within commercial space companies would assist the commercial space community in growing robust system safety procedures. The FAA notes that embedding FAA representatives within commercial space companies is outside the scope of this rulemaking.

Proposed § 450.103(a)(3) requires the mission director to ensure that all of the safety official's concerns are addressed. In the final rule, the FAA adopts § 450.103(a)(3) as proposed. The FAA did not receive any comments on this section.

ii. Hazard Management

Proposed § 450.103(b) would have required an operator to establish procedures to evaluate the operational lifecycle of the launch or reentry system, including methods to review and assess the validity of the proposed preliminary safety assessment and any flight hazard analysis throughout the operational lifecycle of the launch or reentry system, methods for updating the preliminary safety assessment and flight hazard analysis, and methods for communicating and implementing the updates throughout the organization. For operators that would need to conduct a flight hazard analysis, the proposed rule would also require an operator's system safety program to include a process for tracking hazards, risks, mitigation and hazard control measures, and verification activities.

In the final rule, the FAA adopts proposed § 450.103(b) with revisions. The FAA renames this section “Hazard management” to be more descriptive than the proposed name of “Procedures.” The FAA also does not adopt the proposed requirement in § 450.103(b)(1) to conduct a preliminary safety assessment because that requirement has been replaced with the requirement to conduct a hazard control strategy determination in § 450.107(b) in the final rule, as will be discussed later.

As noted, proposed § 450.103(b)(1) would have required the system safety program to include: (i) Methods to review and assess the validity of the preliminary safety assessment throughout the operational lifecycle of the launch or reentry system; (ii) methods for updating the preliminary safety assessment; and (iii) methods for communicating and implementing the updates throughout the organization. For those operators required to conduct a flight hazard analysis, proposed § 450.103(b)(2) would have required the system safety program to include the same methods for the flight hazard analysis and a process for tracking hazards, risks, mitigation and hazard control measures, and verification activities.

In the final rule, the FAA consolidates the requirements in proposed § 450.103(b)(1) and (b)(2) into § 450.103(b)(1) of the final rule. Section 450.103(b)(1) requires a system safety program to include methods to assess the system to ensure the validity of the hazard control strategy determination and any flight hazard or FSA throughout the lifecycle of the launch or reentry system.^[80] The FAA added FSA to this requirement because, as proposed in § 450.101(g) and adopted in the final rule, any analysis used to demonstrate compliance with § 450.101 must use accurate data. This is consistent with the proposal because proposed § 450.103(b)(1)(i) would have required methods to review and assess the validity of the preliminary safety assessment, which would have included components of FSA such as vehicle response modes, public safety hazards associated with vehicle response modes, population exposed to hazards, and CE_C. As previously noted, the final rule in § 450.103(b)(1) uses the term “lifecycle” by itself to clarify that the regulation applies to hazards throughout the lifecycle of a launch or reentry system, not just operations hazards.

Proposed § 450.103(b)(1)(iii) and (b)(2)(iii) would have required the system safety program to include methods for communicating and implementing the updates throughout the organization. In the final rule, the FAA consolidates the requirements in proposed § 450.103(b)(1)(iii) and (b)(2)(iii) into § 450.103(b)(2) of the final rule with a revision. The FAA changes the term “the updates” to “any updates” to clarify the intent for comprehensiveness.

Proposed § 450.103(b)(2)(iv) would have required the system safety program, for operators that must conduct a flight hazard analysis, to include a process for tracking hazards, risks, mitigation and hazard control measures, and verification activities. The FAA adopts the language proposed in § 450.103(b)(2)(iv) of the NPRM in § 450.103(b)(3) of the final rule with a revision. The FAA deletes the terms “hazard control,” because it is duplicative with the existing term “mitigation measures.”

iii. Configuration Management and Control

Proposed § 450.103(c) would have required an operator to (1) employ a process that tracks configurations of all safety-critical systems and documentation related to the operation; (2) ensure the use of correct and appropriate versions of systems and documentation tracked under the subsection; and (3) maintain records of launch or reentry system configurations and document versions used for each licensed activity, as required by the requirement for records in proposed § 450.219.

In the final rule, the FAA adopts § 450.103(c)(1) and (c)(2) as proposed and revises § 450.103(c)(3) as discussed later.

Blue Origin commented that tracking and maintaining records of individual configurations and associated operations documentation for completed operations does not, by itself, enhance public safety. Blue Origin believes that changes should be evaluated for safety impact according to a configuration management plan, which is a deliverable under the current regulations. Blue Origin stated that an approved configuration management plan, coupled with continued accuracy of the application, should suffice without additional requirements for increased documentation and storage of records.

The FAA agrees that tracking and maintaining records for completed operations in isolation does not directly enhance public safety, but tracking and maintaining records for completed operations is an important component of configuration management, which, as a whole, does enhance public safety. The FAA agrees with Blue Origin that an approved configuration management plan coupled with continued accuracy of the application should suffice, but does not agree that current requirements are sufficient. Part 431 does not have any requirements for configuration management, and § 417.111(e) is more general in its requirement to define the launch operator's process for managing and controlling any change to a safety-critical system to ensure its reliability. Section 450.103(c) adds necessary detail.

Blue Origin also stated that proposed § 450.103(c) is repetitive of the recordkeeping requirements in proposed § 450.219, making it unnecessary. Blue Origin added that if the FAA were to maintain the requirement, it should be written in the context of safety-critical systems, which would tie directly to FAA's responsibility to protect public safety.

While the FAA considers § 450.103(c) necessary, proposed § 450.103(c)(3) could be perceived as repetitive. Proposed § 450.103(c)(3) would have required an operator to maintain records of launch or reentry system configurations and document versions used for each licensed activity, as required by § 450.219 (Records). Section 450.219 requires a licensee to maintain for 3 years all records, data, and other material necessary to verify that a launch or reentry is conducted in accordance with representations contained in the licensee's application, the requirements of part 450 subparts C and D, and the terms and conditions contained in the license. The FAA removes the reference to maintaining records in § 450.103(c)(3) and revises the provision to require an operator to document the configurations and versions identified in paragraph (c)(2) for each licensed activity. This is a more focused requirement than § 450.219 and limits the documentation requirement specifically to safety-critical systems, consistent with Blue Origin's recommendation.

iv. Post-Flight Data Review

Proposed § 450.103(d) would have required an operator to employ a process for evaluating post-flight data to (1) ensure consistency between the assumptions used for the preliminary safety assessment, any hazard or flight safety analysis, and associated mitigation and hazard control measures; (2) resolve any identified inconsistencies prior to the next flight of the vehicle; (3) identify any anomaly that may impact any flight hazard analysis, FSA, or safety-critical system, or would otherwise be material to public health and safety and the safety of property; and (4) address any anomaly identified in (3) prior to the next flight, including updates to any flight hazard analysis, FSA, or safety-critical system. The FAA explained in the NPRM that this requirement was consistent with industry practice to review post-flight data to address vehicle reliability and mission success and that this requirement imposes no additional burden. The FAA sought comment on whether proposed § 450.103(d) would change an operator's approach to reviewing post-flight data.

In the final rule, the FAA adopts proposed § 450.103(d)(1), (d)(2), and (d)(4) with revisions, and adopts § 450.103(d)(3) as proposed. Section 450.103(d)(1) was modified to replace “preliminary safety assessment” with “hazard control strategy determination” as discussed earlier. The FAA also added the word “flight” in front “hazard or flight safety analysis” to make clear that the requirement addresses any flight hazard analysis or FSA.

CSF, Rocket Lab, and Sierra Nevada commented that proposed § 450.103(d) should be deleted because it was overly burdensome and inconsistent with the directive to streamline the regulations. The commenters stated that the requirement would extend the industry practice beyond the typical analysis for reliability and mission success. Sierra Nevada suggested that the section could be re-written to address only post-flight data of safety-critical systems.

As discussed in the NPRM, operator review of post-flight data provides valuable safety information on future operations. The inconsistencies that need to be resolved in this subsection are only those that affect safety analyses and associated mitigation and hazard control measures, such as greater population in the launch area than modeled. The anomalies that need to be addressed are only those that may impact any flight hazard analysis, FSA, or safety-critical system, or are otherwise material to public health and safety and the safety of property, such as the momentary drop-out of an FSS. Therefore, while the FAA revises § 450.103(d)(2) to narrow its applicability, as discussed below, it declines to remove proposed § 450.103(d)(2).

Blue Origin proposed a revision of § 450.103(d)(2) to specify “public safety.” Virgin Galactic recommended removing the word “any” in front of “identified inconsistencies,” and recommended limiting applicable inconsistencies to those that have an effect on the safety criteria of § 450.101.

The FAA agrees that proposed § 450.103(d)(2) could be read to reach more broadly than public safety, so the FAA has revised the section to require that an operator resolve any inconsistencies “identified in paragraph (d)(1) of this section” prior to the next flight of the vehicle. This language would explicitly limit the applicability of the provision to the hazard control strategy determination, and any hazard or flight safety analyses and associated mitigation and hazard control measures, as opposed to mission success. The FAA does not agree with Virgin Galactic's suggestion to limit applicable inconsistencies to those that have an effect on the safety criteria of § 450.101. That change would imply that a quantitative analysis is all that is required. As discussed earlier in the hazard management section, the hazard control strategy determination and the hazard and flight safety analyses must be kept up to date throughout the lifecycle of the launch and reentry system, so inconsistencies need to be addressed. The FAA also does not agree with Virgin Galactic to remove the word “any” in front of “inconsistencies” because it would not change the scope of the requirement, because § 450.103(d)(2) explicitly refers to the analyses in § 450.103(d)(1).

Virgin Galactic recommended that proposed § 450.103(d)(4)—which would have required an operator to address any anomaly identified in paragraph (d)(3) prior to the next flight, including updates to any flight hazard analysis, FSA, or safety-critical system—be revised to state the FAA should review and provide a determination on an operator's post-flight data to approve the operator's ability to launch according to schedule, rather than delaying until all anomalies are resolved.

The FAA notes that proposed § 450.103(d)(4) would not have required FAA approval of the methodology an operator uses to address anomalies in general or a specific anomaly in particular. In order to avoid Virgin Galactic's interpretation that all anomalies must be resolved prior to the next flight, the FAA revised the final rule to require an operator to address any anomaly identified in paragraph (d)(3) prior to the next flight as necessary to ensure public safety. As proposed, this would include updates to any flight hazard analysis, FSA, or safety-critical system. To ensure public safety, the FAA would expect an operator to reassess its safety analyses to determine any potentially new public safety hazards or increased risks to known public safety hazards due to the anomaly and, if necessary, determine the need for any additional mitigation strategies or updates to its safety analyses.

v. Application Requirements

An applicant under proposed § 450.103(e) would have to submit (1) a description of the applicant's safety organization, identifying the applicant's lines of communication and approval authority, both internally and externally, for all public safety decisions and the provision of public safety services; and (2) a summary of the processes and products identified in the system safety program requirements.

In the final rule, the FAA adopts § 450.103(e) as proposed. The FAA did not receive any comments on this section.

f. Hazard Control Strategies (§ 450.107)

In the NPRM, the FAA proposed in § 450.107 that, for each phase of a vehicle's flight, an operator does not need to conduct a flight hazard analysis for that phase of flight if the public safety hazards identified in the preliminary safety assessment (PSA) can be mitigated adequately to meet the requirements of proposed § 450.101 using physical containment, wind weighting, or flight abort, in accordance with § 450.107(b), (c), and (d). If the public safety hazards identified in the PSA could not be adequately mitigated using these methods, an operator would be required to conduct a flight hazard analysis in accordance with proposed § 450.109 to derive hazard controls for that phase of flight.

The FAA has restructured § 450.107 in the final rule to require an operator to use a functional hazard analysis to make a hazard control strategy determination. This requirement is based on the requirements for the PSA that was proposed, but not adopted, in § 450.105. In addition, the FAA has removed from § 450.107 specific details for each hazard control strategy available to operators and instead directs operators to §§ 450.108, 450.109, 450.110, and 450.111, which provide requirements for flight abort,^[81] flight hazard analysis, physical containment,^[82] and wind weighting, respectively.

Section 450.107 also characterizes flight hazard analysis as a hazard control strategy. Although a flight hazard analysis is different from the other hazard control strategies in that it does not lay out specific hazard controls, it does lay out a process by which hazard controls can be derived. The hazard controls that are derived from the flight hazard analysis, like those defined in the other three hazard control strategies, are then used as part of the input to the FSA that is used to show compliance with § 450.101(a), (b), and (c). Therefore, because a flight hazard analysis is a means by which an operator derives the appropriate hazard controls, the FAA has characterized it as a hazard control strategy in this final rule. As such, throughout the final rule, a flight hazard analysis is listed with physical containment, wind-weighting, and flight abort as a hazard control strategy.^[83] Further, § 450.107(c) retains the proposed requirement that an operator must conduct a flight hazard analysis if the public safety hazards for that phase of flight cannot be mitigated adequately to meet the requirements of § 450.101 through physical containment, wind weighting, or flight abort.^[84]

Lastly, the final rule fixes an error in proposed § 450.107, which referenced § 450.101 in its entirety as being relevant to the hazard control strategies, even though certain requirements in § 450.101 regarding the disposal of upper stages, protection of people and property on orbit, and notification of planned impacts, are not relevant to the hazard control strategies defined in § 450.107. Section 450.107 refers instead to § 450.101(a), (b), or (c).

The FAA adds paragraph (b) to § 450.107 to address how an operator determines its hazard control strategy or strategies for any phase of flight during a launch or reentry. This paragraph is based on and replaces a portion of the preliminary safety assessment in proposed § 450.105 of the NPRM. Because an operator determines a hazard control strategy or strategies based on an assessment of potential hazards, the requirements for such an assessment are better suited for this section. The next preamble section discusses the revision to § 450.107(b) more fully.

Proposed § 450.107(e) would have required an applicant in its application to describe its hazard control strategy for each phase of flight. The application requirements in the final rule, in § 450.107(d), similarly require an applicant to provide a description of its hazard control strategy or strategies for each phase of flight. The FAA added the phrase “or strategies” to reflect the fact that an operator may use one or more hazard control strategies for any given phase of flight. In addition, because the requirements for physical containment have been relocated to § 450.110, the FAA has likewise relocated the application requirements for physical containment proposed in § 450.107(e) to § 450.110(c).^[85] These requirements have been adopted as proposed.

Lastly, § 450.107(d) in the final rule requires an applicant to submit in its application the results of its hazard control strategy determination, including all functional failures identified under § 450.107(b)(1), the identification systems, and a timeline of all safety-critical events. These relate to the hazard control strategy determination, which is discussed in the next section of this preamble.

The FAA received a few comments for proposed § 450.107. One individual commenter supported the additional flexibility inherent in allowing an operator to select its hazard control strategy and noted that this flexibility would help to reduce overall design costs for the private enterprise. Virgin Galactic requested that the FAA define “traditional hazard controls” and provide opportunity for public comment through the issuance of an SNPRM. Blue Origin proposed that the FAA amend proposed § 450.107(e)(2)(ii) to require that an applicant describe the methods used to ensure that risk to the public and critical assets in flight hazard areas meet allowable criteria. This latter comment is discussed later in the preamble section titled Physical Containment.

To the extent that Virgin Galactic commented that the term “traditional hazard controls” should be defined and comment allowed through publication of an SNPRM, the FAA notes that the NPRM stated that traditional hazard controls included physical containment, wind weighting, and flight abort.^[86]

g. Hazard Control Strategy Determination (§ 450.107(b))

In the NPRM, the FAA proposed in § 450.105 to require that every operator conduct and document a PSA for the flight of a launch or reentry vehicle to identify potential public safety impacts early in the design process. The FAA intended the PSA to be a top-level assessment of the potential public safety impacts identifiable early in the design process and broad enough that minor changes in vehicle design or operations would not have a significant impact on, or invalidate the products produced by, the PSA. As proposed, the PSA would have required the operator to identify a number of items, including: A preliminary hazard list that documents all hardware, operational, and design causes of vehicle response modes that, excluding mitigation, have the capability to create a hazard to the public; safety-critical systems; and a timeline of all safety-critical events.^[87] An applicant would have been required to submit the PSA result, including the items identified above, in its application for a license.

The final rule removes proposed § 450.105 in its entirety but relocates certain items from the PSA section into § 450.107(b) as part of the hazard control strategy determination. The final rule replaces the requirement for a PSA with a functional hazard analysis and replaces the term “vehicle response mode” with “reasonably foreseeable hazardous events.” The FAA finds these changes are less prescriptive and burdensome on an operator, while preserving the intended benefits and level of safety of the proposed requirements.

Blue Origin and Microcosm commented that requiring operators to develop a preliminary hazard list that identifies all causes of hazards and vehicle response modes for a PSA, prior to analysis or testing of their vehicle systems, was unreasonable. Blue Origin stated it would be infeasible to document in a preliminary hazard list all hardware, operational, and design causes of vehicle response modes capable of causing a hazard to the public at the preliminary design phase. The commenters noted that operators identify potential hazards, but not all causes of vehicle response modes, prior to the detailed design phase. Blue Origin added that identification of causes was a continuous process that evolves as hardware and operations design matures, and recommended the PSA be limited to analyzing and identifying all functional failures that could have the capability to create a hazard to the public, rather than analyzing the detailed design, which may still be maturing. Blue Origin also noted that early engagement with the FAA through the pre-application process, before a design is mature, was beneficial to both parties.

The FAA concurs that the detailed design may not be mature enough at a preliminary stage such that an operator could define all hardware, operational, and design causes of vehicle response modes with minimal changes downstream in the development process in a preliminary hazard list. Although the preliminary hazard list would not have been provided to the FAA until an applicant submitted an application, the FAA agrees with the commenters that the proposed rule would have required a launch or reentry operator to complete the preliminary hazard list early in the design process, to enable the operator to then carry out its hazard control strategy or strategies. This, as noted by Blue Origin, would not have been practicable as proposed. Accordingly, the FAA does not adopt the proposed requirement for an operator to identify a preliminary hazard list. Instead, the FAA requires an operator, in § 450.107(b), to determine its hazard control strategy or strategies for any phase of flight during a launch or reentry, based on a functional hazard analysis accounting for all functional failures associated with reasonably foreseeable hazardous events, safety-critical systems, and safety-critical events. Even with this change, the FAA also agrees with Blue Origin that this approach will encourage operators to engage early with the FAA, prior to the design becoming mature.

In the final rule, the FAA eliminates proposed § 450.105, but moves, with some revision, the requirements in proposed §§ 450.105(a)(6) through (a)(8) into § 450.107(b). Section 450.107(b), titled “Hazard Control Strategy Determination,” requires that for any phase of flight during a launch or reentry, an operator must use a functional hazard analysis to determine a hazard control strategy or strategies accounting for (1) all functional failures associated with reasonably foreseeable hazardous events that, excluding mitigation, have the capability to create a hazard to the public, (2) safety-critical systems, and (3) a timeline of all safety-critical events.

In the NPRM, proposed § 450.105(a)(6) would have required a preliminary hazard list documenting all hardware, operational, and design causes of vehicle response modes that, excluding mitigation, have the capability to create a hazard to the public. The final rule requires an operator to use a functional hazard analysis that accounts for, among other things, all functional failures associated with reasonably foreseeable hazardous events that, excluding mitigation, have the capability to create a hazard to the public. A functional failure is a condition of a system, subsystem, or component function derived by assessing each function against multiple potential failure modes during each phase of the system's mission. This addresses Blue Origin's concerns about the preliminary hazard list because identifying functional failures does not require detailed design information that may not be finalized at the stage of design when a hazard control strategy is being considered.

A functional hazard analysis is a common system safety tool that, as articulated in DOD's MIL-STD-882E, is used to identify and classify the system functions and the safety consequences of functional failure or malfunction.^[88] A functional hazard analysis is a foundational tool useful throughout the lifecycle of the launch or reentry system that helps drive the design and development process at a preliminary stage by identifying safety-critical functions of which launch and reentry vehicle developers should be cognizant throughout the process to ensure public safety. The requirement to perform a functional hazard analysis instead of a preliminary hazard list, as proposed in § 450.105, should reduce the burden on operators, for the reasons cited by Blue Origin.

The FAA finds that a functional hazard analysis will preserve the benefits of the preliminary safety assessment proposed in the NPRM, but reduce the burden on applicants by not requiring detailed design information that may not be finalized at the stage of design when a hazard control strategy is being considered. Like the PSA, a functional hazard analysis should help an operator identify specific information relevant to public safety, scope the analyses that must be conducted to ensure that the launch or reentry operation satisfies safety criteria, identify the effect of design and operational decisions on public safety, and provide the operator with an appropriate hazard control strategy for its proposed operation.

Section 450.107(b)(1) in the final rule requires an operator to use a functional hazard analysis to determine a hazard control strategy accounting for all functional failures associated with reasonably foreseeable hazardous events that, excluding mitigation, have the capability to create a hazard to the public. As noted earlier, a functional failure is a condition of a system, subsystem, or component function derived by assessing each function against multiple potential failure modes during each phase of the system's mission. The failure end-effect is the resulting system behavior from each functional failure. Failure end-effects that result in impacts to public safety should in turn identify the safety-critical systems and can be grouped to identify the system hazards to the public. Thus, the inability of a safety-critical system, subsystem, or component to function as designed, or to function erroneously, may potentially result in a hazard to the public. It is important to note that public exposure to a hazard should only be accounted for after determining the potential hazards to the public. That is, limits to public exposure can be a mitigation when considering hazards at the overall system or mission level, and thus not considered when determining what constitutes a hazard to the public (i.e., functional sources of the hazard) for the purposes of § 450.107(b)(1).

The FAA does not retain in § 450.107(b) the items in proposed § 450.105(a)(1) through (a)(5) for an operator to identify (1) vehicle response modes, (2) public safety hazards associated with vehicle response modes, (3) geographical areas where vehicle response modes could jeopardize public safety, (4) any population exposed to public safety hazards in or near the identified geographical areas, and (5) the CE_C. These are addressed in the four hazard control strategies and in FSA.

Finally, the FAA replaces the term “vehicle response mode” in the NPRM with “reasonably foreseeable hazardous events” in § 450.107(b)(1) in the final rule. As explained in the preamble section discussing § 450.101(c), the NPRM defined “vehicle response mode” as a mutually-exclusive scenario that characterizes foreseeable combinations of vehicle trajectory and debris generation. The final rule is less prescriptive by requiring that an operator account for reasonably foreseeable hazardous events, instead of each foreseeable combination of vehicle trajectory and debris generation. Accounting for reasonably foreseeable hazardous events in a functional hazard analysis is consistent with common industry standards. This change also means the FAA does not adopt the proposed definition of “vehicle response mode” in § 401.7.

Blue Origin also requested clarification from the FAA on its interpretation of the requirement proposed in § 450.105(a)(8) to provide “a timeline of all safety-critical events.” Blue Origin noted that it interprets “safety” to mean meeting the collective and individual risk requirements for launch and reentry and, in essence, suggested that the PSA should be limited in scope based on the collective risk criteria resulting from the FSA.

The FAA does not agree with Blue Origin's interpretation nor with its suggestion that this requirement, now in § 450.107(b)(3) in the final rule, be limited by the results of FSA. The FAA will consider any event that occurs during a phase of flight of a launch or reentry vehicle that meets the definition of “safety critical” in § 401.7 to be a “safety-critical event.”

As noted earlier, proposed § 450.105 would have required that every operator conduct and document a PSA for the flight of a launch or reentry vehicle and submit its results. Virgin Galactic inquired as to when the PSA would be due to the FAA, as well as the timeline for the review. The final rule replaces the requirement to conduct a PSA with the requirement to conduct a functional hazard analysis in § 450.107(b). The application requirements for § 450.107(b) are in § 450.107(d) and are due with the application, even though a launch or reentry operator will conduct the functional hazard analysis early in the design phase, well before it applies for a license. This approach is consistent with Blue Origin's recommendation that the analysis be limited to analyzing and identifying all functional failures that could have the capability to create a hazard to the public, rather than analyzing the detailed design, which may still be maturing. As such, in the final rule an applicant is required to provide the results of the functional hazard analysis, including all functional failures, the identification of all safety-critical systems, and a timeline of all safety-critical events.

h. Flight Abort (§ 450.108)

As discussed, if an operator cannot ensure by means other than flight abort ^[89] that it has sufficiently protected against a high consequence event (as measured by CE_C), the only remaining way to satisfy § 450.101(c) is to use flight abort consistent with the requirements in § 450.108.

In the NPRM, the FAA proposed to address flight abort in several sections. As proposed, to implement flight abort as a hazard control strategy, an operator would have been required to:

(1) Establish flight safety limits and gates in accordance with proposed §§ 450.123 (Flight Safety Limits Analysis) and 450.125 (Gate Analysis);

(2) establish when an operator must abort a flight following the loss of vehicle tracking information with proposed § 450.127 (Data Loss Flight Time and Planned Safe Flight State Analyses);

(3) establish the mean elapsed time between the violation of a flight abort rule and the time when the FSS is capable of aborting flight for use in establishing flight safety limits in accordance with proposed § 450.129 (Time Delay Analysis);

(4) establish flight abort rules in accordance with § 450.165(c) (Flight Abort Rules); and

(5) employ an FSS in accordance with § 450.145 and software in accordance with § 450.111.

Many of these requirements were derived from existing requirements in part 417 and retained a more prescriptive approach to flight abort than the final rule adopts.

Blue Origin, CSF, and SpaceX commented that the FSA requirements in proposed §§ 450.117 through 450.141 were too prescriptive and should be replaced with a performance standard. The commenters cited a lack of flexibility and the use of an approach directed at large orbital launches from Federal launch or reentry sites.

In the final rule, the FAA consolidates the requirements for flight abort in § 450.108 and revises the more prescriptive requirements from the proposal into a single performance-based regulation. As a result of this consolidation, proposed §§ 450.123, 450.125, 450.127, and 450.129 are not included in the final rule. The requirements in these sections have been revised to reflect the performance-based standards in § 450.108(c), which establishes flight safety limits objectives, and § 450.108(d), which establishes flight safety limits constraints. The FAA adds § 450.108(e) in the final rule to relieve the operator from the requirement to use flight abort in certain situations in which high consequence events are possible but would not be effectively mitigated by an FSS. In addition, the flight abort rule requirements proposed in § 450.165(c) have been revised and relocated to § 450.108(f) to reflect the revisions to the flight safety limits requirements. The FAA also moves the reference to FSS reliability from proposed § 450.101(c) to § 450.108(b).

The FAA will provide guidance to illustrate how operators may demonstrate compliance with these requirements. The guidance will encompass many of the traditional means of developing flight safety limits, but operators can develop other means of demonstrating compliance with the performance-based objectives and constraints. As discussed in more detail throughout this section of the preamble, the revisions in the final rule allow for greater flexibility for operators while maintaining the same level of safety as proposed in the NPRM.

i. FSS Thresholds Using CE_C

In the NPRM, an operator required to use flight abort under proposed § 450.101(c) was referred to proposed § 450.145 to determine the required reliability of its FSS based on CE_C. Section 450.145(a)(1) proposed to require an operator to employ an FSS with design reliability of 0.999 at 95 percent confidence and commensurate design, analysis, and testing if the consequence of any vehicle response mode is 1 × 10^−[2] CE_C or greater. This is the reliability standard for a highly reliable FSS under part 417. Section 450.145(a)(2) proposed to require that, if the consequence of any vehicle response mode is between 1 × 10^−[2] and 1 × 10^−[3] CE_C for uncontrolled areas, an operator must employ an FSS with a design reliability of 0.975 at 95 percent confidence and commensurate design, analysis, and testing. The FAA explained that, for operations for which the consequence of a flight failure is less, an FSS—while still being reliable—may not need to be as highly reliable as an FSS for a vehicle operating in an area where the consequence of a flight failure is higher.^[90]

In the final rule, the CE_C thresholds for establishing the reliability or other requirements for an FSS proposed in § 450.145(a) have been moved to § 450.108(b). The requirements for a highly reliable FSS proposed in § 450.145(a)(1) remain in § 450.145.^[91] However, the requirements for an FSS proposed in § 450.145(a)(2) have been revised and relocated to § 450.143.^[92]

Rocket Lab agreed with the concept of quantifying consequence as a key metric in determining the reliability of a flight abort system. Other commenters were critical of the proposed use of CE_C thresholds to set reliability standards for any required FSS, particularly in situations in which a lower reliability FSS may be sufficient to protect the public. For example, SpaceX commented that the requirement in RCC 319 for an FSS with 0.999 at 95 percent confidence reliability was overly prescriptive for low-risk mission profiles. CSF noted that, by “binning” the CE_C of a vehicle and then prescribing a fixed reliability requirement for the FSS, risk of an unmitigated (by FSS) CE_C event was not consistent. CSF commented that such an approach requires the same FSS even though the risk varies by an order of magnitude between the extreme values. Several other commenters, including CSF and Sierra Nevada commented that the FAA should not preclude applicants from making a “safety case” to justify a certain level of rigor for their FSS.

As noted in the discussion of § 450.101(c), the FAA has retained CE_C as the appropriate regulatory standard for measuring high consequence events. Likewise, for the reasons set forth in that section of the preamble, the FAA has retained the use of CE_C in § 450.108(b) to determine the level of reliability required for an FSS. However, in response to comments, the FAA has added flexibility for FSS that do not need to meet the standard for highly reliable FSS in proposed § 450.145(a)(1) based on the CE_C. The FAA notes that an operator does not need to calculate CE_C for the purposes of determining reliability under § 450.108(b) if it elects to use a highly reliable FSS that meets the requirements of § 450.145.

In the final rule, the FAA removes the prescribed reliability threshold proposed in § 450.145(a)(2) of the NPRM for operations with a maximum CE_C value between 1 × 10⁻² and 1 × 10⁻³. Accordingly, an operator does not need to employ an FSS with a design reliability of 0.975 at 95 percent confidence and commensurate design, analysis, and testing. Rather, under § 450.108(b)(2), an operator must use an FSS that meets the requirements of § 450.143 if the consequence of any reasonably foreseeable failure mode in any significant period of flight is between 1 × 10⁻² and 1 × 10⁻³ CE_C for uncontrolled areas.

The requirements for the two types of FSS, as well as the removal of the proposed requirements, are discussed in more detail later in this preamble in the discussion of §§ 450.143 and 450.145.

ii. Flight Safety Limits Objectives

Proposed § 450.123(a) stated an FSA must identify the location of uncontrolled areas and establish flight safety limits that define when an operator must initiate flight abort to: (1) Ensure compliance with the safety criteria of § 450.101; and (2) prevent debris capable of causing a casualty from impacting in uncontrolled areas if the vehicle is outside the limits of a useful mission.

The introductory language of § 450.108(c) is a revision of proposed § 450.123(a).^[93] In the final rule, § 450.108(c), titled “Flight Safety Limits Objectives,” requires an operator to determine and use flight safety limits that define when an operator must initiate flight abort if the conditions enumerated in § 450.108(c)(1) through (c)(5) are met. Alternatively, an operator could meet § 450.108(c)(6) to satisfy the requirements of § 450.108(c)(2) and (c)(4).

The following sections provide additional detail on the performance-based flight safety limits objectives derived from the more prescriptive requirements proposed in the NPRM and respond to public comments on the proposals in the NPRM to the extent they are relevant to compliance with the final rule.

Section 450.108(c)(1)

Section 450.108(c)(1) requires that an operator initiate flight abort to ensure compliance with the safety criteria of § 450.101(a) and (b). The FAA proposed a related requirement in § 450.123(a)(1), which stated that an FSA must identify the location of uncontrolled areas and establish flight safety limits that define when an operator must initiate flight abort to ensure compliance with the safety criteria of § 450.101. In the final rule, § 450.108(c)(1) specifies the relevant subparagraphs in § 450.101 to which this requirement applies. The FAA makes this change in the final rule because the requirement in § 450.101(c)(1) is met through use of flight abort as a hazard control strategy, and § 450.101(d), (e), and (f) are not relevant to flight abort.

Section 450.108(c)(2)

In the NPRM, proposed § 450.123(a)(2) required the operator to prevent debris capable of causing a casualty from impacting in uncontrolled areas if the vehicle is outside the limits of a useful mission. In the final rule, § 450.108(c)(2) requires that an operator initiate flight abort to prevent continued flight from increasing risk in uncontrolled areas if the vehicle is unable to achieve a useful mission.

Although proposed § 450.123(a)(2) focused on debris impacts in uncontrolled areas to define when an operator must initiate flight abort, § 450.108(c)(2), as finalized, acknowledges that debris impact is not the only risk contributor that must be accounted for in determining flight safety limits. For example, a release of toxic propellant following a debris impact may also contribute to risk. Therefore, in § 450.108(c)(2), an operator must determine and use flight safety limits to prevent continued flight from increasing risk once a vehicle can no longer achieve a useful mission. The FAA recognizes that a vehicle may deviate from the limits of a useful mission during a period when hazard containment through flight abort is not possible. In this case, the requirement is not to allow continued flight to increase risk, though some risk from either flight abort or continued flight may be unavoidable.

For example, a vehicle may begin an unplanned turn away from a nominal trajectory while overflying an island. Once the vehicle leaves the limits of a useful mission, the operator should initiate flight abort if continued flight would result in an increase in risk. Pursuant to § 450.108(c)(2), depending on the risk to the public, it may be better to withhold flight abort until the hazards resulting from the abort would not affect the island. However, if the turn is towards a major population center on the island, it may pose less of a risk to the public to abort the flight as soon as it leaves the limits of a useful mission, even if it might result in a hazard posed to less-dense populated areas.

The concepts of “useful mission” and “limits of a useful mission” ^[94] are discussed in greater detail in the preamble section on FSA methods (specifically, in § 450.119 (Trajectory Analysis for Malfunction Flight)).

The FAA also notes that the maximum extents of a gate,^[95] determined by the limits of a useful mission in proposed § 450.125(c)(2), are addressed by § 450.108(c)(2) in the final rule, which requires flight abort to prevent continued flight from increasing risk in uncontrolled areas if the vehicle is unable to achieve a useful mission. Therefore, trajectories outside the limits of a useful mission that intersect flight safety limits that prevent increased risk in uncontrolled areas must trigger flight abort.

Virgin Galactic recommended that the term “prevent” in proposed § 450.123(a)(2) be qualified, as it could be taken to mean many probabilistic values. Although proposed § 450.123(a)(2) has been removed from the final rule, § 450.108(c) uses the term “prevent” in five places including § 450.108(c)(2). In § 450.108 (c)(2), (3), (5), and (6), prevention is dependent on the proper functioning of the FSS. There is no expectation that these objectives will be met if the FSS fails to function properly. In § 450.108(c)(4), when the reliability of the FSS is accounted for pursuant to § 450.108(d)(5), prevention is considered to be achieved.

Section 450.108(c)(3)

As noted earlier, the FAA proposed in § 450.125 to establish the requirements for a gate analysis. The FAA explained that the primary purpose of gates is to establish safe locations and conditions to abort the flight prior to the vehicle entering a region or condition where it may endanger populated or other protected areas if flight were to continue. A gate should be placed where a trajectory within the limits of a useful mission intersects a flight safety limit as long as that trajectory meets the risk criteria in § 450.101. In response to comments that the proposed gate analysis requirements created confusion and should be more performance-based, § 450.125 is not included in the final rule.

In the final rule, the concept of gate analysis in proposed § 450.125 is captured in a more performance-based manner in § 450.108(c)(3).^[96] Section 450.108(c)(3) requires that an operator initiate flight abort to prevent the vehicle from entering a period of materially increased public exposure in uncontrolled areas, including before orbital insertion, if a critical vehicle parameter is outside its pre-established expected range or indicates an inability to complete flight within the limits of a useful mission. The FAA removes the term “gate” in the final rule to allow operators to use another method to comply with the requirements. Furthermore, the term “gate” can have different meanings within the industry, which can cause confusion. However, although the term “gate” is not used in the final rule, the FAA expects a similar approach to a gate analysis will be used by many operators and by Federal launch or reentry sites. With the removal of explicit gate requirements, the term “tracking icon” is no longer required, and the FAA therefore removes the term from the final rule.

The FAA notes that a period of materially increased public exposure would include the beginning of a period when the vehicle will overfly a major landmass prior to orbital insertion (e.g., Europe, Africa, or South America). Overflight of large islands with substantial population may also constitute a period of materially increased public exposure, while overflight of islands with small populations or other areas of sparse population will not constitute a period of materially increased public exposure. Consequence may be used to determine if an exposed area should be considered an area of materially increased public exposure. Orbital insertion also results in a material increase in public exposure due to the possibility of a random reentry from a vehicle that cannot achieve a minimum safe orbit. A vehicle intended for orbit that cannot achieve a minimum safe orbit would require flight abort under § 450.108(c)(3). The FAA will provide guidance on what constitutes materially increased public exposure.^[97]

The FAA notes that, for purposes of § 450.108(c)(3), a “critical vehicle parameter” is a parameter that demonstrates the vehicle is capable of completing safe flight through the upcoming phase of flight for which population is exposed to hazardous debris effects from reasonably foreseeable failure modes. An example of a critical vehicle parameter outside its pre-established expected range is a tank pressure that is higher than the normal operating range and could lead to a rupture. An example of a critical vehicle parameter that indicates an inability to complete flight within the limits of a useful mission is an acceleration that is too low and would result in a vehicle failing to reach orbit. The operator must select parameters and their acceptable ranges that are appropriate for the vehicle and mission, with consideration of the ability to measure and act on the parameters, and describe in the application the parameters that will be used and how their ranges were determined, pursuant to the application requirement in § 450.108(g)(3).

The intent of the gate analysis in proposed § 450.125 was to prevent unnecessarily exposing the public to hazards from a mission that can no longer be useful. Proposed § 450.125(a) required that an FSA include a gate analysis for an orbital launch or any launch or reentry where one or more trajectories that represent a useful mission intersect a flight safety limit that provides containment of debris capable of causing a casualty. Gate analysis was necessary if a vehicle on a useful mission needed to fly in an area where population could be exposed to hazards in the event of a vehicle failure. As long as a trajectory met the individual and collective risk criteria of § 450.101(a)(1) and (a)(2) for a launch, or (b)(1) and (b)(2) for a reentry, when treated like a nominal trajectory with normal trajectory dispersions, the flight safety limit with which it intersected would be removed (or “relaxed,” as described in the NPRM),^[98] so flight of the vehicle would not be aborted. Alternatively, under proposed § 450.125(b)(1), the flight safety limit could be replaced with a gate that allowed continued flight as long as a real-time measure of performance indicated that the vehicle was able to complete a useful mission.

Section 450.108(c)(3) achieves the intent in proposed § 450.125(a) because it codifies the goals achieved by gate analysis but allows for alternative approaches to achieve the same objective. Similar to the gate analysis in proposed § 450.125(a), the analysis in § 450.108(c)(3) is required when a trajectory that represents a useful mission approaches an uncontrolled area.

Proposed § 450.125(b)(1) required that a gate analysis establish a relaxation of the flight safety limits that allows continued flight or a gate where a decision will be made to abort the launch or reentry or allow continued flight. This proposed requirement is addressed in § 450.108(c)(3) because it also either allows continued flight without a check of critical vehicle parameters if the upcoming population exposure is not materially increased, or requires a check of critical vehicle parameters before continued flight if the upcoming population exposure is materially increased. In this respect, the final rule provides clarity on the point at which the check of critical vehicle parameters is required, whereas the proposal was ambiguous on when a gate would be required.

Proposed § 450.125(b)(2) stated that, if a gate is established, a gate analysis must include a measure of performance at the gate that enables the flight abort crew or autonomous FSS to determine whether the vehicle is able to complete a useful mission or abort the flight if it is not. In the final rule, this requirement is addressed in § 450.108(c)(3), which states, “if a critical vehicle parameter is outside its pre-established expected range or indicates an inability to complete flight within the limits of a useful mission.” The pre-established expected range of the critical vehicle parameters are those values that do not predict the vehicle will fail or exit the limits of a useful mission, or simply those that indicate the vehicle is performing as intended. Accordingly, as with gate analysis under the proposal, the operator will establish the measure of performance—referred to as the critical vehicle parameter(s) and pre-established expected range(s) in the final rule—that will determine whether flight abort must be initiated.

Proposed § 450.125(b)(4) stated that a gate analysis must establish, for an orbital launch, a gate at the last opportunity to determine whether the vehicle's flight is in compliance with the flight abort rules and can make a useful mission, and to abort the flight if it is not. This requirement is addressed by the § 450.108(c)(3) requirement that critical vehicle parameters must be checked before orbital insertion. Therefore, § 450.108(c)(3) is a more performance-based requirement that is consistent with the proposed § 450.125(b)(4).

The FAA notes that certain concepts in proposed § 450.125 are also captured in § 450.108(c)(2), (c)(4), and (d)(7), as discussed in the preamble associated with those sections. The FAA finds that the intent of the proposed gate analysis requirements would be clearer if these requirements are included as separate flight safety limits objectives and constraints because they can also be applied outside of a traditional gate analysis.

The FAA received several comments on proposed § 450.125 focused on the proposed definition of the term “gate,” the prescriptive nature of the requirements for a gate analysis, and the manner in which gates would be applied. Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that the gate analysis must establish a relaxation of the flight safety limits that allows continued flight or a gate where a decision will be made to abort the launch or reentry or allow continued flight. The commenters asserted that flight rules and placards can constrain allowable trajectories, and that it is appropriate to disapprove a trajectory if the nominal trajectory is beyond the flight safety limits. The FAA declined to make the recommended change because § 450.108(c)(3) allows a nominal vehicle to overfly a populated area, which is current practice. A flight safety limit that intersects the nominal trajectory trace can only be enforced if the vehicle has experienced a malfunction before reaching the limit. These limits are common, such as gates protecting downrange landmasses before overflight.

Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended replacing “flight abort” with “flight termination” to distinguish between a flight abort for a reason unrelated to public safety. The FAA did not adopt this change because the term “flight abort” is meant to encompass hazard control strategies that may not include destruction of a vehicle or termination of thrust. For example, flight abort for a captive carry mission may entail aborting the mission and returning to base or landing at a contingency site. The FAA finds that the term “flight termination” has connotations that are inconsistent with the FAA's intent.

Boeing, Lockheed Martin, Northrop Grumman, and ULA requested clarification on the term “relaxation of a flight safety limit” in the NPRM and questioned whether it is appropriate for an operator to relax a flight safety limit.

The FAA agrees that the proposed language “relaxation of a flight safety limit” lacked clarity and that the regulation should be clear about when a vehicle may overfly population without a performance check. The final rule removes terms related to relaxed flight safety limits and states in § 450.108(c)(3) that the critical vehicle parameter check is required prior to entering a period of materially increased public exposure in uncontrolled areas, including before orbital insertion. The meaning of “materially increased public exposure” is discussed earlier in this section.

Rocket Lab inquired whether a gate analysis is required for when a trajectory intersects a flight safety limit, if an operator was using flight abort only as a hazard control strategy.

In the final rule, pursuant to § 450.108(c)(3), this performance check is not necessary if the vehicle is not approaching an area of materially increased public exposure regardless of how the operator develops flight safety limits, as long as it meets requirements in § 450.108(c) and (d). The FAA also notes that if flight abort is not required as a hazard control strategy to meet the safety criteria of § 450.101, an operator may still choose to use flight abort at its discretion. Compliance with § 450.108(c)(3) is only required for an operator required to use flight abort as a hazard control strategy to meet the safety criteria of § 450.101.

Section 450.108(c)(4)

As noted earlier, proposed § 450.125(c) would have required the extent of any gate or relaxation of the flight safety limits to be based on normal trajectories, trajectories that may achieve a useful mission, collective risk, and consequence criteria. Section 450.108(c)(4) in the final rule is related to proposed § 450.125(c)(1) and (c)(2) in that it describes the consequence requirements for flight safety limits; however, it contains differences as explained in this section of the preamble.

In the final rule, § 450.108(c)(4) requires that an operator initiate flight abort to prevent conditional expected casualties greater than 1 × 10⁻² in uncontrolled areas due to flight abort or due to flight outside the limits of a useful mission from any reasonably foreseeable off-trajectory failure mode initiating in any significant period of flight. The purpose of § 450.108(c)(4) is to ensure that, when an operator cannot develop flight safety limits that prevent hazards from affecting uncontrolled areas, the failure modes that result in deviations from the planned trajectory will not result in a high consequence event if the vehicle is unable to achieve a useful mission. This scenario can arise when some public exposure must be accepted to allow useful vehicles to continue during a phase of flight when flight abort is still used as a hazard control strategy.

This situation frequently occurs, for example, on northeasterly missions launched from the Eastern Range that are permitted to overfly some portions of Nova Scotia and Newfoundland on trajectories within the limits of a useful mission. If the vehicle fails after the overflight has begun and reaches flight safety limits protecting more westerly portions of the uncontrolled areas from flight outside the limits of a useful mission, the consequence from flight abort must meet the criteria in § 450.108(c)(4).

Proposed § 450.125(c)(1) and (c)(2) included the consequence requirements as a part of gate analysis. In the final rule, the consequence requirements are a standalone flight safety limits objective in § 450.108(c)(4). The final rule also makes several revisions. First, the final rule expressly states flight safety limits are required only to prevent high consequence events in uncontrolled areas. This concept was implied in the NPRM because, per proposed § 450.123(a)(2), flight safety limits must prevent debris capable of causing a casualty from impacting in uncontrolled areas if the vehicle is outside the limits of a useful mission. The consequence criteria in proposed § 450.125(c)(1) and (c)(2) were applicable to flight safety limits that did not prevent debris from impacting in uncontrolled areas following a gate or relaxation in a flight safety limit developed per § 450.123(a)(2). Therefore, the proposed consequence criteria only applied to uncontrolled areas.

Second, the requirement in the final rule applies in cases of flight abort and in cases where the vehicle is outside the limits of a useful mission. The consequence criteria in proposed § 450.125(c)(1) and (c)(2) were only applicable in cases of flight abort. If only flight abort action were considered, a high consequence event resulting from other outcomes (intact impacts, structural breakup, etc.) outside the limits of a useful mission might not be identified.

Vehicle failures within the limits of a useful mission are excluded from the consequence criteria in § 450.108(c)(4) in the final rule because flight abort cannot prevent a failure from affecting uncontrolled areas that must be exposed to allow a vehicle on a useful mission to continue flight. For example, if a vehicle begins an unplanned turn from the nominal trajectory while overflying uncontrolled areas and breaks up aerodynamically before exiting the limits of a useful mission, this failure would not count against the consequence criteria because the vehicle was within the limits of a useful mission when the outcome of the failure occurred. Collective risk requirements still apply in these scenarios and ensure that the risk is met for any trajectory that the operator declares as representing a useful mission, pursuant to § 450.108(d)(7).

Third, whereas proposed § 450.125(c)(1) and (c)(2) concerned the consequence from flight abort “resulting from any reasonable vehicle response mode,” § 450.108(c)(4) concerns the consequence from any “reasonably foreseeable off-trajectory failure mode.” The replacement of “vehicle response mode” with “failure mode” is discussed in the preamble section on § 450.101(c)(2).^[99] The term “off-trajectory” was added to explain further which types of failures must result in the consequence criteria being met. Off-trajectory failures are those for which the vehicle deviates from its intended flight path—for example due to failures of the guidance, navigation, or control systems. Outcomes from on-trajectory failures, such as an explosion or loss of thrust along the intended flight path, are not able to be fully mitigated by an FSS because once the failure occurs the hazard cannot be prevented from affecting uncontrolled areas if the failure occurred during a period in which the uncontrolled areas were exposed. At best, the hazard can be reduced for some failure modes such as a loss of thrust that may result in an intact impact unless a destructive abort that disperses propellants is implemented. In this case, flight abort may still be required to reduce risk per § 450.108(c)(2) since the vehicle is unable to achieve a useful mission, but the consequence criteria would not apply.

Boeing, Lockheed Martin, Northrop Grumman, and ULA requested clarification on the intent of the CE_C limits in proposed § 450.125(c)(1) and (c)(2). In the final rule, the FAA retained the CE_C limits related to flight abort. The intent of these limits is to ensure that, when flight abort or a flight outside the limits of a useful mission resulting from an off-trajectory failure mode produces debris capable of causing a casualty, it nonetheless protects against a high consequence event. In other words, flight abort provides sufficient protection against a high consequence event when flight abort is implemented to prevent the CE_C from any reasonably foreseeable off-trajectory failure mode initiating in any significant period of flight from exceeding 1 × 10⁻² casualties, even though the public in uncontrolled areas might be exposed to debris from a flight abort.

SpaceX asked if there were restrictions to using flight safety limits that met the risk requirements of proposed § 450.101 but did not meet the 1 × 10⁻² CE_C requirement.

Under § 450.108(c)(4), flight safety limits must not allow CE_C greater than

1 × 10⁻² unless the consequence resulted from a vehicle within the limits of a useful mission and therefore could not be mitigated by flight abort without aborting a vehicle on a useful mission, or the consequence resulted from an on-trajectory failure mode.

An example of when the consequence requirement would not apply is when a vehicle on a normal trajectory suffers a spontaneous breakup. This on-trajectory event cannot be mitigated by flight abort without terminating a useful vehicle before it overflies uncontrolled areas. An operator would not be required to initiate flight abort under the final rule for this scenario. An example of when the consequence requirement would apply is if a malfunction causes the vehicle to depart from the limits of a useful mission. If CE_C is used to measure high consequence events, the flight safety limits must prevent the consequence from such a failure mode (i.e., a malfunction that causes the vehicle to depart from the limits of a useful mission) from exceeding 1 × 10⁻² CE_C, whether produced by flight abort or other reasonably foreseeable outcomes (such as aerodynamic/structural breakup, intact impact, etc.).

SpaceX requested guidance on how an operator should balance E_C and CE_C when designing flight safety limits and expressed concern that E_C may increase as an operator attempts to reduce CE_C. SpaceX also recommended removing all numerical values associated with CE_C and requiring the consequence of flight abort at the flight safety limits to be minimized.

Regarding the balance of E_C and CE_C, the FAA notes that flight safety limits must be designed to meet the E_C and CE_C requirements as described in § 450.108(c)(1) and (c)(4), respectively. If the flight safety limits must be modified to reduce the CE_C to acceptable levels, E_C must still be kept within acceptable levels. The FAA does not agree with the recommendation to remove the numerical value associated with the CE_C requirement because this could allow flight safety limits that result in a high consequence through flight abort or through flight abort inaction. However, the final rule does allow for methods of measuring consequence other than CE_C that provide an equivalent level of safety under § 450.37.

Section 450.108(c)(5)

Section 450.108(c)(5) requires that an operator initiate flight abort to prevent the vehicle state from reaching identified conditions that are anticipated to compromise the capability of the FSS if further flight has the potential to violate a flight safety limit. For example, if a roll rate of a particular magnitude would preclude ground-based flight abort commands from being received by the vehicle, a flight safety limit should be developed that triggers flight abort before the roll rate reaches this value.

Section 450.108(c)(5) is related to the flight abort rule in proposed § 450.165(c)(3)(ii), which required that flight abort rules include that the FSS must abort flight when the vehicle state approaches conditions that are anticipated to compromise the capability of the FSS and further flight has the potential to violate the FSS. In the NPRM, the FAA did not include a flight safety limit objective that corresponded with the flight abort rule in proposed § 450.165(c)(3)(ii). The FAA adds this flight safety limit objective in § 450.108(c)(5). The flight abort rule in proposed § 450.165(c)(3)(ii) is in § 450.108(f)(2)(ii) and is discussed further under Flight Abort Rules in the following paragraphs.

Section 450.108(c)(6)

Section § 450.108(c)(6) states that, in lieu of meeting § 450.108(c)(2) and § 450.108(c)(4), an operator may initiate flight abort to prevent debris capable of causing a casualty due to any hazard from affecting uncontrolled areas using an FSS that complies with § 450.145. The FAA adds this regulation to clarify that a CE_C analysis is not required if an FSS that complies with § 450.145 provides hazard containment. Hazard containment is a means of achieving the goals of § 450.108(c)(2) and (c)(4) because, if an operator provides for hazard containment, continued flight will not increase risk in uncontrolled areas and hazard containment would prevent conditional expected casualties greater than 1 × 10⁻² in uncontrolled areas. This requirement is consistent with the NPRM because if an operator is able to contain hazards throughout the period when flight abort is used, the proposed consequence requirements in § 450.125(c)(1) and (c)(2) would not apply since a gate analysis would not be necessary.

In developing the NPRM, the FAA considered alternatives to a conditional risk limit, including the current approach employed in § 417.213.^[100] The FAA rejected using the approach in § 417.213 as a requirement in part 450 because it is unnecessarily restrictive to require designated impact limit lines to bound the area where debris with a ballistic coefficient of three pounds per square foot or more is allowed to impact if the FSS functions properly, as evidenced by the need for the FAA to grant waivers to allow innovative missions to proceed safely, such as return of boosters to the launch site.^[101] However, if an operator satisfies the current requirements in § 417.213, it would meet the requirement in § 450.108(c)(6). This strategy is not an option when hazard containment is not possible during a phase of flight when flight abort must be used as a hazard control strategy. For example, if an area of overflight occurs on the nominal trajectory during a phase of flight when flight abort is still used as a hazard control strategy, an operator cannot claim containment during this phase and must meet § 450.108(c)(2) and (c)(4). The FAA notes that its approach in § 450.108(c) to employing conditional risk limits is consistent with a recommendation made by the National Academy of Sciences.^[102]

Virgin Galactic recommended adding an exclusion to the requirement for flight safety limits in proposed § 450.123 for vehicles that already meet the public risk criteria, as flight safety limits analysis amounts to an additional layer of regulation that Virgin Galactic believed was redundant and unneeded.

The FAA determined that a clarification is required in response to this recommendation. Pursuant to § 450.108(a), flight safety limits are only required in phases of flight in which flight abort is used as a hazard control strategy to meet the safety criteria of § 450.101. The FAA does not agree that meeting public risk criteria, or just collective and individual risk, are the only objectives of flight abort, as explained in the preamble section on CE_C. The FAA finds it necessary to include additional objectives for flight abort in § 450.108(c) to protect public safety adequately. Lastly, the preamble section on CE_C describes why a conditional risk assessment is appropriate to provide the public protection from unlikely but catastrophic events in the context of launch and reentry operations.

iii. Flight Safety Limits Constraints

Section 450.108(d) in the final rule describes flight safety limits constraints. This subsection consolidates the flight safety limits constraints in proposed §§ 450.123 through 450.129.

Section 450.108(d)(1)

Proposed § 450.123(b)(1) required flight safety limits to account for temporal and geometric extents on the Earth's surface of any vehicle hazards resulting from any planned or unplanned event for all times during flight.

In the final rule, § 450.108(d)(1) requires that flight safety limits account for temporal and geometric extents on the Earth's surface of any reasonably foreseeable vehicle hazards under all reasonably foreseeable conditions during normal and malfunctioning flight. The FAA adds “reasonably foreseeable” before “vehicle hazards” to be consistent with language elsewhere in the regulation. As noted earlier, “reasonably foreseeable” is a term commonly used in system safety. The FAA also replaces “from any planned or unplanned event for all times during flight” in proposed § 450.123(b)(1) with “under all reasonably foreseeable conditions during normal and malfunctioning flight” in § 450.108(d)(1). This revision does not result in a substantive change from the proposal, but the FAA finds the revised language to be clearer and consistent with language elsewhere in the regulation through use of the term “reasonably foreseeable conditions” in place of the proposed “planned or unplanned event.” This standard does not hold the operator responsible for unforeseeable events.

Section 450.108(d)(2)

Section 450.108(d)(2) requires that flight safety limits account for the physics of hazard generation and transport including uncertainty. This articulation represents a revision of proposed § 450.123(b)(2), which stated flight safety limits must account for potential contributions to debris impact dispersions. The FAA finds the NPRM language was unclear as to the scope of the requirement. The NPRM would have required an operator to consider how factors like winds, imparted velocities, and uncertainty in mass properties affect where debris from a failed vehicle may impact. However, direct debris impacts are not the only hazards posed by vehicle failures. For example, an intact impact of a vehicle may lead to a blast wave or release of toxic propellant, both of which must be considered when developing flight safety limits. Hazard generation and transport are factors that apply to all hazards, unlike factors that only apply to determining debris impact dispersions. Hazard generation refers to the process by which a vehicle becomes a hazard, and transport is how the hazard moves from the source to an exposed person or asset. Simply accounting for potential contributions to debris impact dispersions would not encompass all hazards, though debris impact dispersions also need to be accounted for under § 450.108(d)(2).

Blue Origin requested clarification of the term “potential contributions” in proposed § 450.123(b)(2). The FAA notes the term “potential contributions” to debris impact dispersions are those that influence the propagation of debris following a vehicle breakup, such as explosion-induced velocities, winds, uncertainty in aerodynamic properties, etc. The FAA further notes the term “potential contributions” does not appear in the final rule. The FAA will address development of debris impact dispersions in guidance, similar to the existing Flight Safety Analysis Handbook.

Section 450.108(d)(3)

In the NPRM, the FAA proposed to consolidate and update data loss flight times and planned safe flight states requirements in proposed § 450.127 (Data Loss Flight Time and Planned Safe Flight State Analyses). As explained in the proposal, data loss flight time analysis is necessary to establish when an operator must abort a flight following the loss of vehicle tracking information. In the NPRM, the FAA explained that data loss flight time would be the shortest elapsed thrusting or gliding time during which a vehicle flown with an FSS can move from its trajectory to a condition in which it is possible for the vehicle to violate a flight safety limit. Data loss flight times would have been required from the initiation of flight until the minimum elapsed thrusting or gliding time was no greater than the time it would take for a normal vehicle to reach the final gate crossing or the planned safe flight state.

Section 450.108(d)(3) revises the prescriptive requirements in § 450.127 to require that flight safety limits account for the potential to lose valid data necessary to evaluate the flight abort rules. Data is valid when it is of sufficient quality to be used to make flight abort decisions. Data used to make flight abort decisions can be missing or invalid for a number of reasons, but resulting from an unplanned event, such as disruption or loss of communication pathways with ground-based or onboard tracking sensors. Despite an operator's or launch site's best efforts, the potential to lose track data is a contingency for which operators must plan.

Section 450.108(d)(3) requires an operator to account for the potential to lose valid data necessary to evaluate the flight abort rules because the loss of valid data does not absolve the operator from attempting to meet the flight safety limits requirements in § 450.108(c) and (d). Section 450.108(d)(3) captures the performance-based intent of proposed § 450.127 (Data Loss Flight Time and Planned Safe Flight State Analyses). The FAA finds that this revision allows for the use of data loss flight times as a means of satisfying § 450.108(d)(3), but also allows operators to propose other methods of meeting the requirement.

Microcosm and SpaceX requested clarification of the intent for proposed § 450.127. The FAA notes that the purpose of proposed § 450.127 was to determine when flight abort is required if track data used to evaluate the flight abort rules is lost. If a vehicle is able to reach a flight safety limit when track data is lost, then a countdown begins that would indicate, upon reaching zero, that a flight safety limit may have been reached. Under proposed § 450.165(c)(3)(iii), flight abort would have to occur no later than when the countdown reaches zero. Throughout flight, the time for the countdown to reach zero is the data loss flight time. If reliable tracking sources are regained before the countdown reaches zero, then flight abort rule evaluation resumes and the countdown resets. In Federal launch site parlance, data loss flight times are known as “green numbers.”

In the NPRM, data loss flight times would not be used if a vehicle's tracking icon has potentially passed a final gate when the countdown reaches zero because this could result in introducing hazards in uncontrolled areas that the gate protects. As described in proposed § 450.127(b)(1), there are no data loss flight times when the minimum elapsed thrusting or gliding time is greater than the time it would take for a normal vehicle to reach the final gate crossing, to preclude abort from occurring after a gate crossing.

Proposed § 450.127(c)(1) through (c)(3) described other phases of flight when data loss flight times would be unnecessary. If a vehicle cannot reach a flight safety limit, then a data loss flight time cannot be computed and would be unnecessary. It may seem futile to have a flight safety limit that cannot be reached, but for purposes of data loss flight times a flight safety limit is considered unreachable if the vehicle cannot reach it starting from within normal trajectory limits when track data is lost. The flight safety limit may still be reachable if the vehicle was outside of normal trajectory limits at the time data was lost. Therefore, these flight safety limits may still have value.

Finally, in the NPRM, data loss flight times would not be necessary in phases of flight when an FSS is not required. There may still be flight safety limits during such phases if an operator retains an FSS and active flight abort rules even though they are not required. Loss of track data would not require flight abort since the flight safety limits themselves are unnecessary. This approach would allow operators to be conservative in the use of flight safety limits in phases of flight when they are unnecessary, with no threat of flight abort from loss of track data.

Proposed § 450.127(b)(3) would have permitted the real-time computation and application of data loss flight times during vehicle flight, in which case the state vector just prior to loss of data should be used as the nominal state vector. The FAA finds that § 450.108(d)(3) provides the same level of safety as the proposed requirement in § 450.127 and provides additional flexibility. The FAA will provide guidance on compliance with § 450.108(d)(3). The proposed requirement in § 450.127 can be part of a viable means of compliance with § 450.108(d)(3). An operator may propose other means of compliance with § 450.108(d)(3). Microcosm and SpaceX requested clarification of the intent for proposed § 450.127. The FAA notes that the purpose of proposed § 450.127 was to determine when flight abort is required if track data used to evaluate the flight abort rules is lost.

Section 450.108(d)(4)

Proposed § 450.129 (Time Delay Analysis) would have required an operator to perform a time delay analysis to establish the mean elapsed time between the violation of a flight abort rule and the time when the FSS is capable of aborting flight for the purpose of establishing flight safety limits. The time delay analysis would have been required to determine a time delay distribution that accounts for all foreseeable sources of delay.

While proposed § 450.129 does not appear in the final rule, the objective of proposed § 450.129 is captured by § 450.108(d)(4). Section 450.108(d)(4) requires that flight safety limits account for the time delay, including uncertainties, between the violation of a flight abort rule and the time when the FSS is expected to activate. The term in the final rule “time delay including uncertainties” is consistent in intent with the NPRM language “mean elapsed time” and “determine a time delay distribution.”

The time delay distribution in proposed § 450.129 is distribution in a statistical sense. The uncertainties referred to in § 450.108(d)(4) are the same as the time delay distribution referred to in proposed § 450.129. To meet § 450.108(d)(4), the operator must consider the range of values that the actual time delay could fall between. While proposed § 450.129 stated that the time delay analysis would be used in establishing flight safety limits, the final rule specifies that the time delay is a constraint in developing flight safety limits. Time delays are important in a flight safety limits analysis because the decision to abort flight must be made in time to achieve the flight safety limits objectives. This is not possible unless the time delay between the violation of a flight abort rule and the time when the FSS is expected to activate is known. The FAA finds that including this requirement in the flight safety limits constraints provides more clarity regarding the relation between this requirement and the flight safety limits.

Section 450.108(d)(5)

Section 450.108(d)(5) requires an operator to determine flight safety limits that account for individual, collective, and conditional risk evaluations both for proper functioning of the FSS and failure of the FSS. To satisfy this requirement, an operator must account for the reliability of the FSS under two scenarios when determining whether individual, collective, or conditional risk requirements are met with the flight safety limits objectives. The applicable flight safety limits objectives are located in § 450.108(c)(1), which addresses individual and collective risk, and § 450.108(c)(4), which addresses conditional risk. Although § 450.108(c)(2) is also associated with risk, it is independent of the FSS reliability because it is a comparison between the risk if the FSS is activated and the risk if it is not activated.

To comply with § 450.108(d)(5), first, the FSS must be assumed to have a reliability of one, meaning it is presumed to function without error. The risk evaluations using an FSS reliability of one ensure that the criteria are met if the FSS functions as intended. This requirement is important because an FSS failure should not be relied upon to make flight safety limits compliant with risk requirements. The decision to implement a flight abort is a deliberate safety intervention. The FAA wants to be sure that the public is safe given any deliberate safety intervention. This objective is consistent with proposed § 450.125(c)(1) and (c)(2), which contain requirements for consequence from flight abort, implying that the flight abort action occurs, and is also consistent with current practice for all risk evaluations.

Second, the risk evaluations must consider the predicted reliability of the FSS. Predicted reliability of the FSS is important because even low probabilities of FSS failures can have significant impacts on risk. This consideration is consistent with the NPRM because FSS reliabilities are a fundamental component of the viability of flight abort as a hazard control strategy, and it is expressly stated in the final rule for clarity. Consideration of the FSS reliability in risk evaluations is also consistent with current practice.

The final rule allows an operator flexibility to establish the design, analysis, and testing of its FSS and the conditions that require initiation of flight abort as long as the CE_C is no greater than 1 × 10⁻² for any reasonably foreseeable failure mode in any significant period of flight that could require the operator to initiate flight abort, accounting for the reliability of the FSS pursuant to § 450.108(d)(5).

Section 450.108(d)(6)

Proposed § 450.123(b)(3) would have added a requirement to design flight safety limits to avoid flight abort under conditions that result in increased collective risk to people in uncontrolled areas, compared to continued flight. In the NPRM, the FAA explained that the proposed requirement is equivalent to the U.S. Government consensus standard that a conditional risk management process should be implemented to ensure that mission rules do not induce unacceptable consequences when they are implemented.

Section 450.108(d)(6) requires that flight safety limits be designed to avoid flight abort that results in increased collective risk to the public in uncontrolled areas, compared to continued flight. This language is very similar to proposed § 450.123(b)(3), with one change. The FAA changes the term “people” in the proposed rule to “the public” in the final rule because the FAA regulates the safety of the public. The term “people” could be construed as meaning something broader than “public,” such as mission essential personnel who may be in uncontrolled areas.

Blue Origin stated that proposed §§ 450.123(d), 450.125(b)(2), 450.125(c), and 450.125(c)(3) were in conflict and commented on the definition of a “useful mission.” Blue Origin explained that, even though the intent was to meet the public safety requirements in proposed § 450.101, terminating a vehicle that may not meet the definition of a “useful mission” may result in an increase in risk to the public, including those on ships and aircraft, compared to continued flight that may result in reaching orbit. Blue Origin commented that, if the limits were defined only with respect to the risk criteria in proposed § 450.101, allowing the vehicle to continue flight may result in a safer risk profile.

The FAA agrees that the risk to the public must not be increased by flight abort. However, if a vehicle intended for orbit is outside the limits of a useful mission and approaching populated uncontrolled areas, there is likely an optimum location to abort the flight without increasing risk. For launches where the instantaneous impact point (IIP) ^[103] approaches a landmass from the ocean, aborting flight before the resulting debris would encroach on the landmass and dense coastal shipping traffic would be compliant with § 450.108(d)(6). Current practice for orbital launches from Federal launch sites is to allow the vehicle to continue to orbit if it can achieve a minimum safe orbit and is within the limits of a useful mission in the IIP projection. This practice is consistent with the requirements in § 450.108. If an operator proposes to allow a vehicle outside the IIP limits of a useful mission to overfly population to proceed to orbit, it must demonstrate that this option presents lower risk than aborting the flight before the overflight begins.

The FAA agrees that a discrepancy existed in the NPRM in proposed § 450.123(d) but is uncertain if this is the conflict to which Blue Origin referred. The proposed § 450.123(d) referred to risk criteria in § 450.101, but mistakenly omitted the requirement to prevent debris capable of causing a casualty from impacting in uncontrolled areas if the vehicle is outside the limits of a useful mission. The option to determine the need for flight abort in real time as described in proposed § 450.123(d) does not appear in the final rule because it is just one means of meeting the requirements for flight safety limits. However, this does not preclude an operator from determining the need for flight abort entirely in real-time, as long as requirements in § 450.108 are met.

Section 450.108(d)(7)

As noted in the section on flight safety limits objectives, proposed § 450.125(c)(1) stated that flight safety limits would be required to be gated or relaxed where they intersect with a normal trajectory if that trajectory would meet the individual and collective risk criteria of proposed § 450.101(a)(1) and (a)(2) or (b)(1) and (b)(2) when treated like a nominal trajectory with normal trajectory dispersions. Proposed § 450.125(c)(2) stated that flight safety limits may be gated or relaxed where they intersect with a trajectory within the limits of a useful mission if that trajectory would meet the individual and collective risk criteria of proposed § 450.101(a)(1) and (a)(2) or (b)(1) and (b)(2) when treated like a nominal trajectory with normal trajectory dispersions.

In the final rule, § 450.108(d)(7) requires an operator to determine flight safety limits that ensure that any trajectory within the limits of a useful mission that is permitted to be flown without abort would meet the collective risk criteria of § 450.101(a)(1) or (b)(1) when analyzed as if it were the planned mission pursuant to § 450.213(b)(2).^[104] The relocation of requirements in proposed § 450.125 to § 450.108(c)(2) through (c)(4) and § 450.108(d)(7) necessitated a revision to the language in § 450.108(d)(7). Section 450.108(d)(7) requires only that any trajectory within the limits of a useful mission that is permitted to be flown without abort would meet the collective risk criteria of § 450.101(a)(1) or (b)(1) when analyzed as if it were the planned mission pursuant to § 450.213(b)(2). As stated in the NPRM, the philosophy behind proposed § 450.125(c)(2) was to allow a non-normal flight to continue as long as the mission does not pose an unacceptable conditional risk given the present trajectory. The intent of § 450.108(d)(7) is similar but is stated in a different context than in the NPRM and also revised for clarity. In the final rule, the FAA removes the individual risk criterion from the requirement because the intent of the requirement was not to potentially create flight hazard areas along every azimuth within the limits of a useful mission wherever an individual risk contour exceeds 1 × 10⁻⁶.

The FAA found that the phrase “when analyzed as if it were the planned mission pursuant to § 450.213(b)(2)” was more precise than “when treated like a nominal trajectory with normal trajectory dispersions.” A planned mission must be characterized with uncertainties and assessed for risk from planned events and reasonably foreseeable failure modes; therefore, trajectories must be within the limits of a useful mission that are permitted to be flown without abort, pursuant to § 450.108(d)(6).

Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended replacing the terms “normal trajectories” and “limits of a useful mission trajectories” in proposed § 450.123(c) and § 450.125(c) with “nominal trajectories.” The FAA finds that such a change would restrict severely the allowable flight corridor of vehicles that could achieve a potentially useful mission by requiring that a vehicle be on a nominal trajectory to enter a period of materially increased public exposure in uncontrolled areas. As such, §§ 450.108(c)(3) and 450.108(d)(7) in the final rule allow vehicles within the limits of a useful mission to enter a period of materially increased public exposure in uncontrolled areas, provided the trajectory meets the collective risk requirement.

iv. End of Flight Abort

The FAA adds § 450.108(e) in the final rule, which states that a flight does not need to be aborted to protect against high consequence events in uncontrolled areas beginning immediately after critical vehicle parameters are validated, if the vehicle is able to achieve a useful mission and certain conditions are met for the remainder of flight. Specifically, the conditions which must be present are: (1) Flight abort would not materially decrease the risk from a high consequence event, and (2) there are no key flight safety events. Section 450.108(e) relieves the operator from the requirement to use flight abort in certain situations in which high consequence events are possible but would not be effectively mitigated by an FSS. This change responds to comments and addresses a common occurrence during a period of planned overflight of an uncontrolled area before orbital insertion.

Section 450.108(e) applies to a flight beginning immediately after critical vehicle parameters are validated, if the vehicle is able to achieve a useful mission. As discussed in the section on flight safety limits objectives, “critical vehicle parameters” are those parameters that demonstrate the vehicle is capable of completing safe flight through the upcoming phase of flight where population is exposed to hazardous debris effects from reasonably foreseeable failure modes. Due to the wide variety of launch and reentry vehicles that could be licensed, there is a wide variety of vehicle parameters that could be considered critical in this context. For example, recent state vector history data, as well as vehicle health indicators such as motor chamber pressure, generally will qualify as critical vehicle parameters.

Section 450.108(e) only applies when the following conditions are met. The first condition is that flight abort would not decrease the risk from a high consequence event materially as measured by CEC or other means identified through ELOS. The FAA expects that the requirement in § 450.108(e)(1) can be met by implementation of the current practices at the 45th SW, specifically, performing a comparison of the CE_C and E_C in uncontrolled areas with and without flight abort from each reasonably foreseeable failure mode in any significant period of flight during the subject phase of flight. If flight abort would not reduce the CE_C and E_C associated with each failure mode materially, then this condition is met.

A material decrease would exclude any best estimate of the mean value that is already two orders of magnitude or more below the criteria in § 450.101(a) and (b). As the best estimate approaches the established limits in § 450.101(a) and (b) on the mean predicted values, a material decrease would be smaller, including: (1) Any reduction that brings the operation into compliance with § 450.101(a) and (b) limits, (2) any half-order of magnitude reduction in the best estimate of the mean value of E_C, or (3) a reduction by an amount at least as large as the coefficient of variation due to uncertainty in the population distribution. Section 450.108(e)(1) uses the phrase “risk from a high consequence event” deliberately so that other measures of collective risk and consequences, not just CE_C and E_C, can be considered in evaluating compliance with this requirement, absent a waiver. The FAA will provide guidance on what constitutes material decrease.

The second condition in § 450.108(e) requires that there are no key flight safety events for the remainder of flight. The FAA currently has a formal definition of the term “key flight-safety event” in part 437 (Experimental Permits). Section 437.3 states that key flight-safety event means a permitted flight activity that has an increased probability of causing a launch accident compared with other portions of flight. In addition, § 437.59(a) states that, at a minimum, a key flight-safety event includes: (1) Ignition of any primary rocket engine, (2) any staging event, or (3) any envelope expansion. The current description of key flight safety events in the permit regulation conveys what the FAA may consider a key flight safety event in the context of part 450.

Section 401.7 of the final rule has added a definition of “key flight safety events” and states that a key flight safety event means a flight activity that has an increased probability of causing a failure compared with other portions of flight. The term key flight safety event in the context of part 450 includes events that could compromise any safety-critical system, or otherwise increase the risk from high consequence events, such as events that subject a safety-critical system to environments at or near the maximum predicted environment.

SpaceX commented that launches that overfly major landmasses (e.g., Europe, Africa, or South America) prior to orbital insertion would violate the CE_C requirement in proposed § 450.101(c) during overflight. SpaceX urged the FAA to update the regulation to clarify that an operator would not have to perform a CE_C analysis for the ”overflight” phase of flight. SpaceX also recommended that the CE_C requirement apply only to vehicle response modes that are mitigated by the FSS.

The FAA acknowledges that some launches that overfly major landmasses prior to orbital insertion produce CE_C levels in excess of the 1 × 10⁻² threshold and that flight abort will not mitigate the consequences associated with those failure modes. The FAA modifies the final rule to address such circumstances by adopting requirements proposed in the NPRM, such as § 450.125(c). Specifically, § 450.108(e) identifies conditions that, if met, demonstrate a high consequence event is sufficiently mitigated. These conditions are met generally by U.S. launches that overfly downrange landmasses prior to orbital insertion. Thus, the final rule includes specific provisions designed to allow the current practice where some launches proceed through a phase of flight, such as the downrange overflight of a major landmass just prior to orbital insertion, without additional protections against low probability, high consequence events.

The FAA finds that meeting the requirements in § 450.108(e) demonstrates sufficient protection against the probability of high consequence events, even though the CE_C may exceed the 1 × 10⁻³ or 1 × 10⁻² thresholds during the subject phase of flight. The use of collective risk to determine acceptability of downrange overflight is consistent with current practice.

Blue Origin, CSF, and SpaceX commented that flight abort may actually increase risk during overflight where vehicle hazards cannot be contained. Even for vehicles that implement an FSS with a reliability of 0.999 at 95 percent, it would still be possible to fall into the highest risk bin and not improve a risk posture measured by CE_C.

The FAA agrees with the commenters. In the final rule in § 450.108(e), the FAA sets conditions that demonstrate that a high consequence event is sufficiently mitigated, including if flight abort in that phase of flight would not materially decrease the risk from a high consequence event.

vi. Flight Abort Rules

Proposed § 450.165(c) (Flight Commit Criteria) contained the requirements for flight abort rules. As explained in the NPRM, an operator would identify the conditions under which an FSS, including the functions of any flight abort crew, must abort the flight to ensure compliance with § 450.101. An operator would be required to abort a flight if a flight safety limit is violated or if some condition exists that could lead to a violation, such as a compromised FSS or loss of data.

In the final rule, the FAA revised and relocated the flight abort rules to § 450.108 consistent with the objective of consolidating relevant flight abort requirements into a single section in the final rule. In § 450.108(f), an operator must establish and observe flight abort rules that govern the conduct of launch and reentry.

Section 450.108(f)(1) requires that vehicle data required to evaluate flight abort rules must be available to the FSS under all reasonably foreseeable conditions during normal and malfunctioning flight. A similar requirement appeared in proposed § 450.165(c)(2), which required vehicle data necessary to evaluate flight abort rules to be available to the FSS across the range of normal and malfunctioning flight. The FAA adds “under all reasonably foreseeable conditions” to § 450.108(f)(1) to acknowledge that some conditions that prevent vehicle data from being available to evaluate flight abort rules might be unforeseeable and therefore unpreventable through planning and design.

Section 450.108(f)(2) describes when the FSS must abort flight, similar to proposed § 450.165(c)(3). Section 450.108(f)(2)(i) requires that the FSS must abort flight when valid, real-time data indicate the vehicle has violated any flight safety limit developed pursuant to this section. In the final rule, the FAA revised the language from proposed § 450.165(c)(3)(i) to add “developed pursuant to this section” because the flight safety limits requirements now appear in the same section as this flight abort rule.

As proposed in § 450.165(c)(3)(ii), the flight abort rules would have required the FSS to abort flight when the vehicle state approaches conditions that are anticipated to compromise the capability of the FSS and further flight has the potential to violate a flight safety limit.

Blue Origin commented that, while it is possible to write flight abort rules to account for specific cases, there was not currently a practical means of writing general rules that would abort flight when the vehicle state approaches conditions that could result in a compromise of the FSS for every circumstance proposed in § 450.165(c)(3)(ii). It also commented that the potential to violate a flight safety limit is vague and outside the capability of current generation autonomous FSS. Blue Origin recommended the rule be reworded as “the flight safety system must abort flight when the vehicle state approaches identified conditions from the system safety analysis that are anticipated to compromise the capability of the flight safety system and the flight safety system is required to contain the risk to an acceptable level (as analyzed in the flight safety analysis).”

In the final rule, the revised requirement in § 450.108(f)(2)(ii) adopts Blue Origin's recommendation to add “identified” before “conditions that are anticipated to compromise the capability of the flight safety system.” The FAA finds this addition reasonable because it avoids requiring protections against unknown conditions. As revised, § 450.108(f)(2)(ii) requires that the FSS must abort flight when the vehicle state approaches identified conditions that are anticipated to compromise the capability of the FSS and further flight has the potential to violate a flight safety limit. This requirement is used in conjunction with the flight safety limits objective in § 450.108(c)(5).

The FAA declines to adopt Blue Origin's recommendation to limit this requirement to the system safety analysis because a system safety analysis is not the only means to identify these conditions. For example, an FSS survivability analysis or a link analysis for a command destruct architecture may identify conditions anticipated to compromise the capability of the FSS. The FAA also does not adopt Blue Origin's recommendation to change § 450.165(c)(3)(ii) by replacing “and further flight has the potential to violate a flight safety limit” with “and the flight safety system is required to contain the risk to an acceptable level (as analyzed in the flight safety analysis).”

The FAA finds an acceptable level of risk might be interpreted as only meeting collective and individual risk requirements, while flight safety limits must meet other requirements as described in § 450.108 in the final rule. The FAA recognizes that a real-time determination of whether a particular failure may evolve to reach a flight safety limit is not possible. The operator must determine in pre-flight analyses (system safety analysis, link analysis, etc.) which failure modes can compromise the capability of the FSS. The operator must then use FSA to determine if those failure modes can potentially violate a flight safety limit. If it finds a failure mode that can potentially violate a flight safety limit, the operator must develop flight abort rules that protect against those modes. If the ability to reach a flight safety limit via a particular failure mode is uncertain, the assumption should be made that it is possible during any phase of flight where flight abort is used as a hazard control strategy. This approach is consistent with acceptable methods of compliance with proposed § 450.165(c)(3)(ii).

Section 450.108(f)(2)(iii) requires that the FSS must abort flight in accordance with methods used to satisfy § 450.108(d)(3) if tracking data is invalid and further flight has the potential to violate a flight safety limit. This requirement is similar to proposed § 450.165(c)(3)(iii), which stated that the FSS must incorporate data loss flight times to abort flight at the first possible violation of a flight safety limit, or earlier, if valid tracking data is insufficient for evaluating a minimum set of flight abort rules required to maintain compliance with proposed § 450.101.

As noted in the discussion of flight abort constraints, the FAA has replaced proposed § 450.127, which contained requirements for a data loss flight time analysis, with the more performance-based approach in § 450.108(d)(3). Consistent with that change, the FAA revises the language in proposed § 450.165(c)(3)(iii) in final § 450.108(f)(2)(iii). Data loss flight times are not the only means of compliance with the performance-based requirement in § 450.108(d)(3) to account for the potential to lose valid data necessary to evaluate the flight abort rules. The FAA also removes the requirement to abort flight at the first possible violation of a flight safety limit, or earlier, if valid tracking data is insufficient for evaluating a minimum set of flight abort rules required to maintain compliance with proposed § 450.101. This statement was associated with implementation of data loss flight times, but the performance-based requirement in § 450.108(d)(3) will allow other methods of compliance that may not be consistent in all cases with the NPRM language in § 450.165(c)(3)(iii). The FAA will provide guidance on compliance with §§ 450.108(d)(3) and 450.108(f)(2)(iii). The FAA also does not adopt the proposed definition for “data loss flight time” in § 401.7 in the final rule. The relation between §§ 450.108(d)(3) and 450.108(f)(2)(iii) in the final rule is substantively the same as that between proposed §§ 450.127 and 450.165(c)(3)(iii).

The FAA removes proposed § 450.165(c)(1), which required that for a vehicle that uses an FSS, the flight abort rules must identify the conditions under which the FSS, including the functions of any flight abort crew, must abort the flight. These included proposed § 450.165(c)(1)(i), to ensure compliance with proposed § 450.101, and proposed § 450.165(c)(1)(ii), to prevent debris capable of causing a casualty from impacting in uncontrolled areas if the vehicle is outside the limits of a useful mission. The FAA finds this requirement to be unnecessary, as flight safety limits requirements and flight abort rules requirements are clearly stated in § 450.108(c) through (f). In addition, in the final rule the FAA does not adopt the proposed definition for “flight abort crew” in § 401.7 because the term is no longer used in the final rule.

Virgin Galactic commented that proposed § 450.165(c)(ii) seems unachievable for an operator with a nominal trajectory that meets E_C requirements but can result in debris outside of the controlled area. Virgin Galactic recommended deleting the requirement or excluding the requirement if E_C was met.

The FAA finds, based on the context of the comment, that Virgin Galactic meant to refer to proposed § 450.165(c)(1)(ii). The FAA acknowledges that a mission that flies over uncontrolled areas on the nominal trajectory cannot always prevent debris impacts on the uncontrolled area, but the requirement only applies to vehicles outside the limits of a useful mission. A nominal vehicle is on a useful mission; therefore, this requirement would not apply to the scenario in Virgin Galactic's comment. In the final rule, the intent of proposed § 450.165(c)(1)(ii) is covered in § 450.108(f)(2)(i).

The FAA removes the requirement proposed in § 450.165(c)(3)(iv) that a flight may continue past any gate established under proposed § 450.125 only if the parameters used to establish the ability of the vehicle to complete a useful mission are within limits. The replacement of proposed § 450.125 with performance-based requirements in § 450.108(c) and (d) makes this requirement unnecessary.

SpinLaunch commented that the FAA should simplify the proposed flight safety limits analysis (§ 450.123), gate analysis (§ 450.125), and time delay analysis (§ 450.129) regulations by stating that the safety analyses must address certain goals and relying on a training and evaluation structure to assure applicants are knowledgeable and capable of performing the analyses in a manner that sufficiently addresses those goals. The FAA revises the requirements in proposed §§ 450.123, 450.125, and 450.129 to be more performance-based. However, the FAA does not agree that training applicants to be capable of performing the subject analyses is sufficient to ensure compliance with the regulations.

v. Application Requirements

Section 450.108(g) contains application requirements for flight abort. Section 450.108(g)(1) requires an applicant to submit a description of the methods used to demonstrate compliance with § 450.108(c), including descriptions of how each analysis constraint in § 450.108(d) is satisfied in accordance with § 450.115 (Flight Safety Analysis Methods). This rule is similar to proposed § 450.123(e)(1), which required that an applicant submit in its application a description of how each flight safety limit would be computed, including references to the safety criteria of proposed § 450.101.^[105] The intent of the requirement in the final rule is similar to the proposal. However, the reference to § 450.101 is excluded in the final rule because not all flight safety limits objectives in § 450.108(c) refer directly to § 450.101.

Section 450.108(g)(2) requires that an applicant must submit in its application a description of how each flight safety limit and flight abort rule is evaluated and implemented during vehicle flight, including the quantitative criteria that will be used, a description of any critical parameters, and how the values required in § 450.108(c)(3) and 450.108(e) are identified. This provision is derived from three requirements in the NPRM. First, proposed § 450.123(e)(2) would have required an applicant to submit representative flight safety limits and associated parameters. Second, proposed § 450.125(d)(2) would have required an applicant to submit a description of the measure of performance used to determine whether a vehicle would be allowed to cross a gate without flight abort, the acceptable ranges of the measure of performance, and how these ranges were determined. Third, proposed § 450.165(d)(2)(i) would have required an applicant to submit, for flight abort rules, a description of each rule and the parameters that would be used to evaluate each rule.

As discussed earlier, the FAA has removed §§ 450.123 and 450.125 from the final rule and relocated the flight abort rules from § 450.165 to reflect a more performance-based approach to flight abort and allow greater flexibility than would have been possible under the flight safety limits analysis and traditional gate analysis proposed in the NPRM. Accordingly, the application requirements associated with those sections have been combined in § 450.108(g)(2) in the final rule. This approach improves organization and increases flexibility with regard to how an operator demonstrates compliance with § 450.108.

Section 450.108(g)(3) requires an applicant to submit a graphic depiction or series of depictions of flight safety limits for a representative mission, together with the launch or landing point, all uncontrolled area boundaries, the nominal trajectory, extents of normal flight, and limits of a useful mission trajectories, with all trajectories in the same projection as each of the flight safety limits. This rule is similar to proposed § 450.123(e)(4), which required that an applicant submit a graphic depiction or series of depictions of representative flight safety limits, the launch or landing point, all uncontrolled area boundaries, and vacuum IIP traces for the nominal trajectory, extents of normal flight, and limits of a useful mission trajectories.

The final rule clarifies that an applicant will need only to submit flight safety limits for a representative mission. Also, the FAA finds that the requirement for depictions of vacuum IIP trajectories would not be appropriate for flight safety limits in different projections (such as present position) and revises the final rule to require all trajectories in the same projection as each of the flight safety limits. This change will not result in an increased burden compared to the NPRM because the applicant would have to depict the trajectories in either case; the final rule simply states explicitly that the trajectories must be depicted in the appropriate projection.

Section 450.108(g)(4) requires an applicant to submit a description of the vehicle data that will be available to evaluate flight abort rules under all reasonably foreseeable conditions during normal and malfunctioning flight. This section is similar to proposed § 450.165(d)(2)(iii), which required an applicant to submit a description of the vehicle data that would be available to evaluate flight abort rules across the range of normal and malfunctioning flight. In the final rule, the FAA replaces “across the range of normal and malfunctioning flight” with “under all reasonably foreseeable conditions during normal and malfunctioning flight” to be consistent with language elsewhere in the regulation. It results in no increased burden on the operator from the application requirement proposed in the NPRM.

Microcosm requested clarification of proposed § 450.165(d)(2)(i) and (iii), which would require that the applicant submit, for flight abort rules, a description of each rule, and the parameters that would be used to evaluate each rule; and a description of the vehicle data that would be available to evaluate flight abort rules across the range of normal and malfunctioning flight.

The FAA provides the following examples in response to Microcosm's comment. An example of a flight abort rule would be a line on the Earth's surface that, when crossed by an IIP (the parameter), would trigger flight abort. In this example, the vehicle data would be position and velocity data necessary to compute the IIP, as provided by external (such as ground-based) or onboard sensors. The operator should consider the availability of this data during normal and malfunctioning flight and the effect on the operator's ability to evaluate the applicable flight abort rule—which in this example is that flight abort be initiated if the IIP crosses the line on the Earth's surface.

Another example would be an altitude versus downrange distance constraint. If the vehicle is outside of a range of altitudes as a function of the downrange distance, flight abort would be triggered. The ranges of altitudes and downrange distances are the parameters in this example. In this example, the vehicle data would be position data, similarly reported by external or onboard sensors.

Other examples of parameters used in flight abort rules could be chamber pressure, body rates, health and status of critical systems, etc. In the final rule, the requirements in proposed § 450.165(d)(2)(i) and (d)(2)(iii) are addressed by § 450.108(g)(2) and § 450.108(g)(4), respectively.

i. Flight Hazard Analysis (§ 450.109)

In the NPRM, the FAA proposed in § 450.109 that, unless an operator uses physical containment, wind weighting, or flight abort as a hazard control strategy, an operator would be required to perform and document a flight hazard analysis and continue to maintain it throughout the lifecycle of the launch or reentry system. As explained in the NPRM, the use of a flight hazard analysis to derive hazard controls would provide flexibility that does not currently exist under the prescriptive requirements in part 417 and is broadly consistent with the practice in parts 431 and 435.

As proposed in § 450.109(a), the flight hazard analysis would need to identify, describe, and analyze all reasonably foreseeable hazards to public safety and safety of property resulting from the flight of a launch or reentry vehicle. Each flight hazard analysis would need to: (1) Identify all reasonably foreseeable hazards, and the corresponding vehicle response mode for each hazard, associated with the launch or reentry system relevant to public safety and safety of property; (2) assess each hazard's likelihood and severity; (3) ensure that the risk associated with each hazard would meet certain defined criteria; (4) identify and describe the risk elimination and mitigation measures required to satisfy the criteria; and (5) demonstrate that the risk elimination and mitigation measures would achieve the necessary risk levels through validation and verification.

In the final rule, the FAA revises § 450.109 by adding a new applicability paragraph (a) and by re-designating proposed § 450.109(a) through (e) as § 450.109(b) through (f).^[106] The FAA adds an applicability paragraph in § 450.109(a) that applies to the use of a flight hazard analysis as a hazard control strategy to derive hazard controls for the flight, or phase of flight, of a launch or reentry vehicle. Hazards associated with computing systems and software are further addressed in § 450.141. This revised language reflects that performing a flight hazard analysis is included as one of the hazard control strategies in § 450.107(c) of the final rule.

Proposed § 450.109 included several provisions that required the flight hazard analysis to address hazards to property. For instance, the FAA proposed in the introductory language to § 450.109(a) that operators identify, describe, and analyze all reasonably foreseeable hazards to public safety and safety of property. The FAA proposed in § 450.109(a)(1) that an operator identify all reasonably foreseeable hazards, and the corresponding vehicle response mode for each hazard, associated with the launch or reentry system relevant to public safety and safety of property. The FAA also proposed in § 450.109(a)(3)(ii) that the likelihood of any hazardous condition that may cause major damage to public property or critical assets must be remote.

Blue Origin and Virgin Galactic commented on the property protection requirements in proposed § 450.109. Blue Origin acknowledged the FAA's statutory authority to protect property but noted that FAA regulations do not define property nor the criteria for the safety of property. Blue Origin also expressed concern that the requirements in § 450.109 extended to critical assets and property located in controlled areas. Blue Origin requested clarity on these issues. Virgin Galactic commented that the protection of property was a new requirement and also expressed concerns about the criteria requiring an operator to mitigate the likelihood of any hazardous condition that can cause a major property damage to “remote.”

In response, the FAA has not adopted the requirement to identify, describe, and analyze all reasonably foreseeable hazards to property resulting from the flight of a launch or reentry vehicle. Although property protection is codified in current licensing requirements for reusable launch vehicles in § 431.35(c), launch and reentry operators have not in the past been required to account for hazards to property due to flight. However, the FAA retains in the final rule specific requirements for critical assets and property on orbit, which have specific safety criteria in § 450.101 and § 450.169, respectively. The FAA notes that the emergency response requirements in § 450.173(d), which address fire hazards, may also mitigate hazards to property. The FAA may address other property and property hazards in a future rulemaking if launch and reentry flight operations dictate such a need.

Blue Origin also recommended proposed § 450.109(a) be revised to require that a flight hazard analysis identify, describe, and analyze all reasonably foreseeable hazards to public safety and safety of critical assets and safety of property resulting from the flight of a launch or reentry vehicle.

The FAA declines to adopt this recommended language because, as discussed in the preamble section dedicated to critical assets, the FAA will determine whether an asset is critical in consultation with the entity responsible for the asset, and either the FAA or a Federal launch or reentry site will determine whether the proposed activity would expose critical assets to a risk of loss of functionality that exceeds the risk criterion in § 450.101(a)(4) or (b)(4), and convey any necessary constraints to the operator.

Virgin Galactic commented on proposed § 450.109(a)(1)(i) through (a)(1)(x) and noted the list of error sources, or very similar, shows up in four other locations: (1) § 437.55, (2) AC 431.35-2A, (3) FAA Flight Safety Handbook, and (4) the AIAA Safety Critical RLV guide. Virgin Galactic noted that the wording differed slightly from one source to another and recommended that the FAA harmonize the various lists. The FAA notes this comment is outside the scope of this rulemaking.

Proposed § 450.109(a)(3) stated that a flight hazard analysis must ensure that the risk associated with each hazard would meet the following criteria: (1) The likelihood of any hazardous condition that may cause death or serious injury to the public must be extremely remote; and (2) the likelihood of any hazardous condition that may cause major damage to public property or critical assets must be remote.

In the final rule, the FAA revises this requirement to remove the property protection requirement in proposed § 450.109(a)(3)(ii), as discussed earlier. Section 450.109(b)(3) states that a flight hazard analysis must ensure that the likelihood of any hazardous condition that may cause death or serious injury to the public is extremely remote.

Proposed § 450.109(a)(5) stated a flight hazard analysis must demonstrate that the risk elimination and mitigation measures would achieve the risk levels of proposed § 450.109(a)(3) through validation and verification. Verification includes analysis, test, demonstration, or inspection. The FAA adopts and re-designates proposed § 450.109(a)(5) as § 450.109(b)(5) in the final rule, with one revision. In § 450.109(b)(5), the FAA changes the term “demonstrate” in the introductory paragraph to “document.”

Virgin Galactic noted that the NPRM used the term “demonstrate” as both part of the introductory paragraph in proposed § 450.109(a)(5) and as a verification method in proposed § 450.109(a)(5)(iii). Virgin Galactic commented that demonstration is a standard verification method, and use of the word in both places could drive confusion. Virgin Galactic recommended changing the term “demonstrate” in § 450.109(a)(5) to “verify and validate” to clarify that demonstration is not the only method of completing validation and verification.

The FAA agrees that the proposed language could cause confusion, and that demonstration is not the only method of completing validation and verification. The FAA changes “demonstrate” to “document” to avoid that confusion. The FAA does not adopt Virgin Galactic's specific suggestion because “verification” and “validation” are terms used later in the sentence, and are defined in § 401.7.

Virgin Galactic commented on proposed § 450.109(c) and recommended that there be an exclusion for vehicles that follow the same standard trajectory each flight.

The FAA disagrees with Virgin Galactic's recommendation. Even if an operator follows a stable trajectory, vehicle design changes or other operational changes may introduce new hazards. An operator must confirm that the flight hazard analysis is valid for each mission in order to ensure that all hazards are identified and mitigated to an acceptable level. That said, the FAA expects that operators with stable vehicle designs and operations will typically not have major updates to their flight hazard analyses.

The FAA re-designates proposed § 450.109(d) as § 450.109(e) in the final rule, and removes the term “operational” to reflect that an operator must continually update the flight hazard analysis throughout the lifecycle of the launch or reentry system, rather than just address operational changes. As discussed in the preamble discussion on the system safety program (§ 450.103), design and operational changes to a system can have an impact on public safety.

Virgin Galactic commented that the term “continually” in § 450.109(d) is not defined and is vague. In addition, Virgin Galactic noted that the requirement appears to duplicate the current continuing accuracy requirements in part 413 and the proposed continuing accuracy requirements in proposed § 450.211. Virgin Galactic recommends this requirement be removed.

The FAA notes that, for the purposes of the flight hazard analysis, “continually” means that the operator must update the flight hazard analysis as aspects of the mission change or as new information is learned about an operation, if potential impacts to the analysis are identified. Although somewhat redundant with the requirement in § 450.211 for a licensee to maintain the continuing accuracy of representations in its application, proposed § 450.109(d) (re-designated § 450.109(e) in the final rule) provides the specific expectation that the flight hazard analysis must be complete and all hazards must be mitigated to an acceptable level for every launch or reentry.

SpinLaunch commented that the requirements in proposed § 450.109(c) and (d) were an onerous burden, and that to achieve a regulatory framework that can effectively and efficiently oversee multi-site, multi-vehicle operations, a shift away from the traditional regulatory verification of each component to a more practical method would be necessary. SpinLaunch recommended that an applicant just demonstrate knowledge and skills to perform safe and accepted operations.

Operators have a responsibility to ensure that public safety analyses are consistent with their proposed operations and that all hazards are mitigated to an acceptable level. This practice is consistent with system safety practices and current commercial space regulations. The framework recommended by SpinLaunch would not achieve these public safety outcomes because it is too broad and lacks performance metrics.

In the final rule, the FAA re-designates proposed § 450.109(e) as § 450.109(f), (Application requirements). Except for number re-designations, the FAA adopts the requirements as proposed.

j. Physical Containment (§ 450.110)

As discussed earlier, unlike other hazard control strategies, the FAA did not propose a separate section for the physical containment hazard control strategy in the NPRM. Rather, proposed § 450.107(b) simply contained the requirements for physical containment as a hazard control strategy. The FAA proposed that, to use physical containment as a hazard control strategy, an operator would be required to ensure that the launch vehicle does not have sufficient energy for any hazards associated with its flight to reach outside the flight hazard area developed in accordance with proposed § 450.133 (Flight Hazard Area Analysis), and would be required to apply other mitigation measures to ensure no public exposure to hazards as agreed to by the Administrator on a case-by-case basis. In addition, proposed § 450.107(e) included specific application requirements for an operator using physical containment as a hazard control strategy; namely, that it must (1) demonstrate that the launch vehicle does not have sufficient energy for any hazards associated with its flight to reach outside the flight hazard area developed in accordance with § 450.133, and (2) describe the methods used to ensure that flight hazard areas are cleared of the public and critical assets.

In the final rule, the FAA places the requirements for the physical containment hazard control strategy in a separate section, § 450.110. With one exception, the proposed requirements are unchanged in the final rule. The one exception, as discussed next in response to a comment, is that the FAA clarifies that the hazard area must be clear of the public and critical assets.

As noted earlier in the discussion of § 450.107, Blue Origin commented that the FAA amend proposed § 450.107(e)(2)(ii), which proposed to require an applicant to describe the methods used to ensure that flight hazard areas are cleared of the public and critical assets, and to require that an applicant describe the methods used to ensure that risk to the public and critical assets in flight hazard areas meet allowable criteria. Blue Origin pointed out that critical assets cannot be cleared from a flight hazard area. In addition, Blue Origin stated that the proposed definition of “flight hazard area” in § 401.5 already captured that the area would be controlled to risk limits and that can be achieved through methods other than clearing the area.

The FAA disagrees with Blue Origin that proposed § 450.107(e)(2)(ii), now § 450.110(c)(2), should be amended to require an applicant to describe the methods used to ensure that risk to the public and critical assets in flight hazard areas meet allowable criteria, as opposed to ensuring that the area is cleared of the public and critical assets. Although Blue Origin is correct in noting that the definition of “flight hazard area” is not limited to clearing the area,^[107] the physical containment hazard control strategy is designed to be a simple method of protecting public safety by launching within an area that is cleared of the public and critical assets, and within an area that contains hazards based on the potential energy of the vehicle. The FAA modifies what was proposed in § 450.107(b)(1) and (b)(2), now § 450.110(b)(1) and (b)(2), from what was proposed in the NPRM, to clarify that the hazard area must be clear of the public and critical assets.

The FAA also modifies the definition of “flight hazard area” in § 401.7 to change the language from “in order to protect public health and safety and the safety of property” to “in order to ensure compliance with the safety criteria in § 450.101.” The FAA makes this change to tie flight hazard areas to the safety criteria in § 450.101.

k. Wind Weighting (§ 450.111)

In the NPRM, the FAA proposed wind weighting requirements in § 450.141. As discussed earlier, the wind weighting requirements have been moved to § 450.111 in order to group all hazard control strategies together. Although the FAA did not receive any comments on this hazard control strategy, the FAA has made a few changes in the final rule.

In the applicability section, the FAA specifies that an operator may use wind weighting as a hazard control strategy to meet the safety criteria of § 450.101 to § 450.101(a), (b), and (c), which address launch risk criteria, reentry risk criteria, and high consequence event protection. The FAA makes this change because the criteria in § 450.101(d), (e), (f), and (g)—addressing disposal safety criteria, the protection of people and property on orbit, the notification of planned impacts, and the validity of analyses, respectively—are not relevant to wind weighting. Therefore, an operator does not need to demonstrate that wind weighting satisfies these requirements.

In the NPRM, proposed § 450.141(b) would require that for the flight of an unguided suborbital launch vehicle that uses a wind weighting safety system, the launcher azimuth and elevation settings must be wind weighted to correct for the effects of wind conditions at the time of flight to provide a safe impact location. The FAA has replaced “to provide a safe impact location” with “to provide impact locations that will ensure compliance with the safety criteria in § 450.101.” This change removes any ambiguity as to the meaning of “safe impact location.”

Also in the NPRM, proposed § 450.141(b) would require that for the flight of an unguided suborbital launch vehicle that uses a wind weighting safety system, an operator must use launcher azimuth and elevation angle settings that ensures the rocket will not fly in an unintended direction given wind uncertainties. The FAA has replaced “given wind uncertainties” with “accounting for uncertainties in vehicle and launcher design and manufacturing, and atmospheric uncertainties.” This change acknowledges that the uncertainties that affect an unguided suborbital launch vehicle's ability to fly in an unintended direction are broader than just wind uncertainties—they include uncertainties in vehicle and launcher design and manufacturing, and other atmospheric uncertainties. The FAA makes two grammatical changes to the application requirements, which in the final rule are in § 450.111(e). First, in § 450.111(e)(2), the FAA replaces “and identify” with “including.” In § 450.111(e)(3), the FAA removes the word “provide.”

Lastly, similar to other sections in this rule, the FAA removes the proposed requirement for an applicant to provide additional products that allow an independent analysis as requested by the Administrator because the requirement was redundant with § 450.45(e)(7)(ii).

l. Flight Safety Analysis (§§ 450.113 to 450.139)

Regardless of the hazard control strategy chosen or mandated, the FAA anticipates that an operator will be required to conduct an FSA for at least some phases of flight. For example, an FSA must determine flight hazard areas for any vehicle with planned debris impacts capable of causing a casualty. Also, an FSA must quantitatively demonstrate that a launch or reentry meets the safety criteria for debris, far-field overpressure, and toxic hazards. An operator may be required to conduct additional analyses to use flight abort or wind weighting hazard control strategies.

Generally, an FSA consists of a set of quantitative analyses used to determine flight commit criteria, flight abort rules, flight hazard areas, and other mitigation measures and to demonstrate compliance with the safety criteria in § 450.101. In the NPRM, the FAA proposed 15 sections associated with FSA requirements in §§ 450.113 through 450.141. The final rule moves requirements associated with flight safety limits to § 450.108, such that 11 interrelated sections remain component parts of an FSA.

There are 11 performance-based sections with FSA requirements that fall into three groups. The first group, §§ 450.113 and 450.115, provides requirements on the scope and fidelity of the analyses required by the remaining nine sections. The second group, which consists of five sections from § 450.117 through § 450.131, specifies the requirements for analyses necessary to develop quantitative input data used by the last four sections. The last group consists of four sections that specify quantitative risk analyses with products necessary to evaluate compliance with the safety criteria in § 450.101. All of the FSA sections must use methods that comply with § 450.101(g) because they are essential to demonstrating compliance with the safety criteria in § 450.101.

To aid in holistically understanding the substance of, and relationships between, the FSA sections, the following provides a brief overview, before a more detailed discussion of each FSA section. Section 450.113 specifies the overall scope of the subsequent analyses in terms of the period of flight for which the public risks must be quantified. For example, for an orbital launch, an FSA must account for all phases of flight from liftoff through orbital insertion and through all component impacts or landings. Section 450.115 specifies that the operator's analysis methods must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public health and safety, and the safety of property. Section 450.115 also specifies that the operator's methods must have a level of fidelity sufficient (1) to demonstrate compliance with the safety criteria of § 450.101, accounting for all known sources of uncertainty, using means of compliance accepted by the Administrator; and (2) to identify the dominant source of each type of public risk with a criterion in § 450.101(a) or (b) in terms of phase of flight, source of hazard (such as toxic exposure, inert, or explosive debris), and failure mode. An operator must comply with these foundational sections when performing any of the separate analyses that together comprise the FSA.

Sections 450.117 and 450.119 specify the constraints and objectives of analyses sufficient to characterize the trajectory of the vehicle during normal and malfunction flight. Section 450.121 specifies the constraints and objectives of an analysis sufficient to quantify the physical, aerodynamic, and harmful characteristics of hazardous debris, including impact probability distributions generated from normal and malfunction flight. Section 450.123 specifies requirements to characterize the population exposed to a significant probability of impact by hazardous debris, including the vulnerability of people in various structure types. Section 450.131 specifies requirements for statistically valid estimates of the probability of reasonably foreseeable failures based on the outcomes of previous flights. Depending on the type of operation or the hazard control strategy used, an operator may be required to perform some or all of these analyses in developing its FSA.

Finally, §§ 450.133, 450.135, 450.137, and 450.139 specify the requirements for quantitative risk analyses to demonstrate that the risks to the public from debris, far-field overpressure, and toxic hazards are consistent with the safety criteria in § 450.101. Generally, the analyses conducted under §§ 450.117 through 450.131 are used to inform the analyses for these final portions of the FSA. Flight commit criteria, flight hazard areas, flight abort rules, and other mitigation measures are typically derived as necessary to demonstrate compliance with the safety criteria in § 450.101, and thus are typical byproducts of the risk analyses performed to satisfy the requirements in §§ 450.133, 450.135, 450.137, and 450.139. The requirements for each of the FSA sections are described in more detail in the following sections.

m. Flight Safety Analysis Requirements—Scope (§ 450.113)

In the NPRM, proposed § 450.113 stated the scope and applicability of FSA requirements. Proposed § 450.113(a), which covered scope, stated an operator would be required to perform and document an FSA: (1) For orbital launch, from liftoff through orbital insertion, and any component or stage landings; (2) for suborbital launch, from liftoff through final impact; (3) for disposal, from the beginning of the deorbit burn through final impact; (4) for reentry, from the beginning of the deorbit burn through landing; and (5) for hybrid vehicles, for all phases of flight, unless the Administrator determines otherwise based on demonstrated reliability. Proposed § 450.113(b), which covered applicability, identified what sections needed to be included in an FSA depending on the type of operation or hazard control strategy being used.

In the final rule, the FAA has removed the proposed applicability provision and adopted the scope provisions with some changes and reorganization. The FAA revised § 450.113(a) to state that an operator must perform and document an FSA for all phases of flight, except as specified in § 450.113(b). The FAA also revised § 450.113 to add in paragraph (b) an operator is not required to perform and document an FSA for a phase of flight if agreed to by the Administrator based on demonstrated reliability. An operator demonstrates reliability by using operational and flight history to show compliance with the risk criteria in § 450.101(a) and (b). Operational history includes the flight time and/or cycles of an aircraft, which may have an airworthiness certificate, operating under part 91, part 135 or part 121 as an example. Flight history could be represented by flight time accumulated through a period of developmental and flight tests of a vehicle that does not have an airworthiness certificate. Although the demonstrated reliability language was limited to hybrid vehicles in the proposed rule, the FAA is providing additional flexibility by expanding it to all vehicles. Some vehicles other than hybrids could conceivably have an extensive and safe enough flight history to demonstrate compliance with the risk criteria in § 450.101(a) and (b) based on empirical data in lieu of the traditional risk analysis.

In the final rule, the FAA modifies § 450.113(a)(1), which addresses orbital launches, to clarify that an FSA covers from liftoff through orbital insertion and through “all component impacts or landings” instead of proposed “any component or stage landings or final impacts.” Likewise, for the scope of an FSA for suborbital launches, the FAA changes § 450.113(a)(2) to “through all component impacts or landings” instead of proposed “through final impact.” These changes reflect the reality that orbital and suborbital launch vehicles often have multiple components that can either impact the Earth or land intact. An FSA should address all such impacts or landings.

The FAA modifies § 450.113(a)(4) for a similar reason. For the scope of a reentry analysis, the FAA changes § 450.113(a)(4) to include “through all component impacts or landings” instead of proposed “through landing.” This change reflects the reality that reentry vehicles often have multiple components that can either impact the Earth or land intact.

The FAA modifies § 450.113(a)(3) and (4) by replacing the term “the beginning of the deorbit burn” with “the initiation of the deorbit.” The FAA notes not all deorbit operations will include a “burn.” The FAA notes that, for a disposal, an operator could discontinue the analysis prior to final impact and demonstrate an equivalent level of safety by presenting evidence of complete demise due to aerothermal heating. The scope of the FSA is consistent with the risk criteria in § 450.101 and the long-standing definition of “reentry” in § 401.7. The FAA clarifies here that, for the purposes of the FSA and risk criteria, the initiation of the deorbit for a reentry or disposal from orbit generally coincides with the final health check prior to the final command to commit the vehicle to a perigee below 70 nautical miles.

The final rule removes the language proposed in § 450.113(b) covering applicability, because the reorganization of the flight abort related sections means that all FSA sections are applicable, unless otherwise agreed to by the Administrator based on demonstrated reliability. Instead, § 450.113(b) in the final rule addresses how an operator demonstrates reliability, as discussed.

n. Flight Safety Analysis Methods (§ 450.115)

In the NPRM, proposed § 450.115 outlined the methods for conducting FSA. The FAA did not receive comments on this proposal unique to this section.

In the final rule, the FAA adopts § 450.115 as proposed with one change. The term “vehicle response mode” is changed to “failure mode” to be consistent with the changes to this term made elsewhere in the final rule. Consistent with the NPRM, § 450.115(c)(4) requires that an FSA methodology must identify the evidence for validation and verification required by § 450.101(g), which addresses the required accuracy and validity of data and scientific principles. For example, the “accounting for all known sources of uncertainty” requirement specified in § 450.115(b)(1) must produce results consistent with or more conservative than the results available from previous mishaps, tests, or other valid benchmarks, such as higher-fidelity methods.

o. Trajectory Analysis for Normal Flight (§ 450.117)

In the NPRM, proposed § 450.117 (Trajectory Analysis for Normal Flight) set requirements for an FSA for normal trajectories. The proposed provision was meant to distinguish between variability in the intended trajectory and uncertainties due to random sources of dispersion such as winds and vehicle performance. The FAA explained that all FSAs depend on some form of analysis of the trajectory under normal conditions, otherwise known as a normal trajectory. That is, a vehicle's trajectory when it performs as intended and under normal conditions must be understood to determine the effects of malfunctions along its flight path.

Proposed § 450.117(a)(1) required an FSA to include a trajectory analysis that established, for any phase of flight within the scope of proposed § 450.113(a), the limits of a launch or reentry vehicle's normal flight as defined by the nominal trajectory, and sets of trajectories sufficient to characterize variability and uncertainty during normal flight. First, proposed § 450.117(a)(1)(i) required a set of trajectories to characterize vulnerability. This set would be required to describe how the intended trajectory could vary due to the conditions known prior to initiation of flight. Second, proposed § 450.117(a)(1)(ii) required a set of trajectories to characterize uncertainty. This set would be required to describe how the actual trajectory could differ from the intended trajectory due to random uncertainties. The FAA also proposed to require an FSA to include a trajectory analysis establishing a fuel exhaustion trajectory in proposed § 450.117(a)(2) and, for vehicles with an FSS, trajectory data or parameters that describe the limits of a useful mission in proposed § 450.117(a)(3).

In the final rule, the FAA adopts proposed § 450.117 with revisions. The FAA makes clarifying changes for a number of requirements regarding trajectory analysis; removes and relocates the fuel exhaustion trajectory requirement to § 450.119; and removes and relocates references to “limits of a useful mission” to § 450.119. The FAA also makes changes to remove prescriptiveness in favor of more performance-based language.

Boeing, Lockheed Martin, Northrop Grumman, Sierra Nevada, and ULA recommended changing the term “normal” flight to “nominal” flight in numerous parts of proposed § 450.117. The FAA does not agree with this recommendation because both of these terms are defined by the FAA and are distinct. Section 401.7 defines “nominal” to mean, in reference to launch vehicle performance, trajectory, or stage impact point, a launch vehicle flight for which all vehicle aerodynamic parameters are as expected, all vehicle internal and external systems perform as planned, and there are no external perturbing influences other than atmospheric drag and gravity. Section 401.7 defines “normal flight” to mean the flight of a properly performing vehicle whose real-time vacuum IIP does not deviate from the nominal vacuum instantaneous impact point by more than the sum of the wind effects and the three-sigma guidance and performance deviations in the uprange, downrange, left-crossrange, or right-crossrange directions. Thus, in simple terms, a nominal trajectory is a single trajectory that the vehicle would fly in the absence of wind effects and guidance and performance variability. Section 401.7 defines “normal trajectory” to mean “a trajectory that describes normal flight.” The FAA retains the definitions of these terms. It is virtually impossible for flights to be nominal such that all aerodynamic parameters and systems are as expected without the influence of any uncertainties. To replace “normal” with “nominal” would substantively change the meaning of the rule, as uncertainty does not apply to a nominal trajectory. Requiring normal flight trajectories is a more permissive range of trajectories than nominal flight and allows the rule to be performance based within safe parameters. The FAA retains the use of the terms as proposed.

In the final rule, the FAA narrows the scope of the set of trajectories to characterize uncertainty due to random uncertainties “in all parameters with a significant influence on the vehicle's behavior through normal flight” in § 450.117(a)(2). Generally, the FAA considers “a significant influence” to include any parametric uncertainties within three-sigma that affect the crossrange IIP location or downrange IIP rate by at least one percent because the IIP location and rate is often a convenient surrogate for the potential impact locations of hazardous debris. One percent is a typical threshold value used in RCC 321-20 Standard and Supplement. Thus, the final rule does not intend for applicants to characterize the influence of all random uncertainties or variability, but only those with a significant influence on the potential impact locations for hazardous debris.

The FAA removes the NPRM requirements for a fuel exhaustion trajectory in proposed § 450.117(a)(2) and its associated application requirement in proposed § 450.117(d)(3)(ii). The requirements for this analysis are more appropriately located in the malfunction flight section because a fuel exhaustion trajectory is a malfunction trajectory that results when thrust termination does not occur as planned. A fuel exhaustion trajectory is not always required; however, such an analysis could be necessary for certain operations. For example, a fuel exhaustion trajectory will be necessary under the final rule § 450.119(a)(2) for a return to launch site scenario. As a result of this removal, the FAA combines proposed § 450.117 paragraph (a) with paragraph (a)(1) as a new paragraph (a), and re-designates proposed § 450.117(a)(1)(i) and (a)(1)(ii) as § 450.117(a)(1) and (a)(2), respectively.

The NPRM referenced the limits of a useful mission in proposed § 450.117(a)(3). In the final rule, the FAA moves all references to the limits of a useful mission from § 450.117, including proposed § 450.117(a)(3), to § 450.119 (Trajectory Analysis for Malfunction Flight). The FAA finds that the requirements associated with the limits of a useful mission belong in the malfunction flight section because limits of a useful mission can exceed the bounds of normal flight.

The FAA received several comments on the proposed use of the term “limits of a useful mission.” A summary of the comments and FAA's responses can be found in the preamble section on Trajectory Analysis for Malfunction Flight.

The FAA adopts § 450.117(b) as proposed. A final trajectory analysis must use a six-degree of freedom trajectory model to satisfy the requirements of § 450.117(a). The FAA did not receive comments on this proposal.

Proposed § 450.117(c) would have required a trajectory analysis to account for all wind effects including profiles of winds that are not less severe than the worst wind conditions under which flight might be attempted and for uncertainty of the wind conditions. In the final rule, the FAA revises the requirement to state that a trajectory analysis must account for “atmospheric conditions that have an effect on the trajectory” rather than “all wind effects.” The FAA notes that the revision captures the intent of (1) the proposed requirement to account specifically for wind effects under all foreseeable conditions within the flight commit criteria and consistent with the flight abort rules, and (2) the proposed requirement in § 450.117(a) to establish sets of trajectories sufficient to characterize variability and uncertainty during normal flight.

The FAA recognizes that wind is the primary atmospheric consideration for most vehicles, but, for some (non-traditional) vehicles, other atmospheric parameters such as density, humidity, or temperature may affect trajectory and be part of the flight commit criteria. Although these other conditions would have necessarily been accounted for in the trajectory analysis for normal flight as “uncertainties” in the introductory language to § 450.117(a), the final rule expressly refers to all atmospheric conditions in § 450.117(c). The FAA also notes that flight in the context of this section refers to the period of launch or reentry within the scope of § 450.113.

Boeing commented that it is impossible to account for all wind effects, as wind models were local and limited in altitude. Boeing recommended incorporating an altitude limit of 60,000 feet, and modifying the requirement to state, “a trajectory analysis must account for launch and, if different, reentry site wind effects, as applicable, including profiles of winds that are no less severe than the worst wind conditions under which flight might be attempted, and for uncertainty in the wind conditions.”

The FAA notes that the proposed requirement concerning wind effects, revised to “atmospheric effects” in the final rule, specifies profiles under which flight may be attempted based on the launch commit criteria and flight abort rules. The NPRM and the final rule set performance level requirements that avoid placing an arbitrary altitude limit that may not encompass all the conditions that may have an effect on a normal trajectory. Accordingly, the final rule requires a trajectory analysis to account not for all wind effects, but instead for atmospheric conditions that have an effect on the trajectory, including any uncertainty. Accounting for atmospheric effects on the trajectory will be addressed in guidance.

Blue Origin stated the requirements in proposed § 450.117(b) through (d)(2) amount to translating complex vehicle trajectory models into verbiage for delivery to FAA for licensing. Blue Origin proposed revising the language to specify vehicle state vector parameters in terms of position, attitude, velocity, thrust, and mass. In terms of a statistical distribution of each parameter, Blue Origin recommends providing a covariance matrix describing vehicle guidance and performance uncertainty as meeting the intent of the requirement.

The FAA notes Blue Origin's recommendation to specify the vehicle's position and velocity during normal flight using covariance matrices would satisfy the requirement in § 450.117(a)(2) because that approach was identified in Appendix A to part 417 under A417.7(g)(7)(xiii). The approach in Appendix A to part 417 under A417.7(g)(7)(xiii) meets the requirement in § 450.117(a)(2) because a set of covariance matrices for the vehicle position coordinates and velocity component magnitudes are an acceptable means to describe how the actual trajectory could differ from the intended trajectory due to random uncertainties in all parameters with a significant influence on the vehicle's behavior throughout normal flight. However, the FAA recognizes that other approaches, including a sufficiently large ^[108] set of Monte Carlo sample trajectories,^[109] may also satisfy the requirement. The FAA does not intend to prescribe a specific method to characterize normal flight. Therefore, the FAA declines Blue Origin's recommendation to revise the requirement to specify vehicle state vector and covariance parameters. Instead, the final rule implements performance-based trajectory analysis requirements as proposed, such that an applicant must submit a description of the methods and input data used to characterize the vehicle's flight behavior throughout normal flight.

The FAA proposed application requirements for trajectory analysis for normal flight in § 450.117(d). In the final rule, the FAA adopts proposed § 450.117(d) with revisions. Specifically, the FAA removes the proposed requirement to describe the methodology used to determine the limits of a useful mission in § 450.117(d)(1). Instead, an equivalent requirement appears in § 450.119(c)(2) of the final rule. The FAA also removes the items proposed in § 450.117(d)(1)(i) through (d)(1)(iv) because they were redundant with the performance-based requirements that apply to all FSA in accordance with § 450.115(c).^[110] The FAA removes the prescriptive requirements in § 450.117(d)(2)(ii) through (d)(2)(iv) proposed in the NPRM because these requirements are captured with the final rule requirement in § 450.117(d)(2), as explained later in this preamble section. In addition, the FAA re-designates proposed § 450.117(d)(2)(i) as (d)(3), and 450.117(d)(3) as (d)(4) with a minor revision. The FAA removed proposed § 450.117(d)(4), which required an applicant to submit additional products that allow an independent analysis, as requested by the Administrator, because the requirement was redundant with § 450.45(e)(7)(ii).

In the NPRM, proposed § 450.117(d)(2) required an applicant to submit a description of the input data used to characterize the vehicle's flight behavior throughout normal flight and limits of a useful mission. The proposal would have required a description of the wind input data, including uncertainties (§ 450.117(d)(2)(ii)); a description of the parameters with a significant influence on the vehicle's behavior throughout normal flight, including a quantitative description of the nominal value for each significant parameter throughout normal flight (§ 450.117(d)(2)(iii)); and a description of the random uncertainties with a significant influence on the vehicle's behavior throughout normal flight, including a quantitative description of the statistical distribution for each significant parameter (§ 450.117(d)(2)(iv)).

Commenters asserted these proposed requirements were too prescriptive, and the FAA agrees. The FAA revises § 450.117(d)(2) to require an applicant to submit the quantitative input data, including uncertainties, used to model the vehicle's normal flight in six degrees of freedom. This revision in the final rule captures the parameters of the proposed requirements in § 450.117(d)(2)(ii) through (d)(2)(iv), while allowing for more flexibility in the application of the regulatory requirements. Quantitative input data used to model the vehicle's normal flight in six degrees of freedom includes comprehensive sets of aerodynamic and mass properties. Explanation and details on how to comply with these requirements will be included in Advisory Circular 450.117-1, “Trajectory Analysis.”

The FAA retains the requirement proposed in § 450.117(d)(2)(i) and re-designates it as § 450.117(d)(3) in the final rule. In addition, the FAA changes the term “wind effects” to “atmospheric effects” to be consistent with § 450.117(c) of the final rule.

The FAA revises proposed § 450.117(d)(3) as discussed in this paragraph and re-designates it as § 450.117(d)(4) in the final rule. The proposal required an applicant to submit representative normal flight trajectory analysis outputs, including the position, velocity, and vacuum IIP, for each second of flight. Blue Origin commented that this requirement created an unnecessary burden to calculate vacuum IIP for potentially hundreds or thousands of normal and malfunction vehicle trajectories. Blue Origin stated that vacuum IIP was not representative of where vehicle hazards may impact the Earth and believed this requirement should only apply to the nominal trajectory.

The FAA disagrees that the IIP application requirement would have created an unnecessary burden; however, the final rule removes the application requirement because vacuum IIP can be readily computed if necessary from the position and velocity vectors, which are a part of the application materials. In the final rule, § 450.117(d)(4) specifies that the representative normal flight trajectory analysis outputs include orientation of the vehicle in addition to the position and velocity data specified in the proposal. The FAA notes that orientation is inherent in any six-degree of freedom trajectory model, as required by both the proposed and final § 450.117(b). Orientation is important to public safety when the induced velocities have a preferred direction.

The FAA also removes the requirement proposed in § 450.117(d)(3)(ii) that applies to fuel exhaustion trajectory under otherwise nominal conditions, because a fuel exhaustion trajectory is merely one specific type of malfunction trajectory and is not necessarily required for all applicants. For example, a fuel exhaustion trajectory would be necessary under the final rule for a return to launch site scenario but not for a typical unguided suborbital rocket. The requirement in § 450.119(a)(2) of the final rule is used to determine whether an applicant must include a fuel exhaustion trajectory.

p. Trajectory Analysis for Malfunction Flight (§ 450.119)

In the NPRM, the FAA proposed requirements associated with trajectory analysis for malfunction flight in § 450.119. As stated in the NPRM, a malfunction trajectory analysis is necessary to determine how far a vehicle can deviate from normal flight. This analysis helps determine potential impact points in the case of a malfunction and is therefore a vital input for the analyses needed to demonstrate compliance with risk criteria.

In the final rule, the FAA adopts proposed § 450.119 with revisions. The FAA removes, as unnecessary, proposed § 450.119(a)(1), which required that an FSA include a trajectory analysis that establishes the vehicle's capability to depart from normal flight, formally defined in terms of IIP in § 401.7. Proposed § 450.119(a)(2) is re-designated (a)(1) and requires that a trajectory analysis establish the vehicle's deviation capability in the event of a malfunction during flight. The FAA adds a new requirement, designated as § 450.119(a)(2), which requires that an FSA must include a trajectory analysis that establishes the trajectory dispersion resulting from reasonably foreseeable malfunctions. This language retains the concept of proposed § 450.119(a)(1), but revises the regulatory language to allow for a medium-fidelity FSA approach (e.g., corridor method) for which the vehicle vacuum IIP during a malfunction is not specified, as explained in the FAA's Flight Safety Analysis Handbook.^[111] More specifically, the proposed requirement in § 450.119(a)(1) to establish the vehicle's capability to depart from normal flight would have required the analysis to account for the IIP in modeling of a malfunction trajectory because normal flight is defined in terms of IIP. Thus, the proposed requirement in § 450.119(a)(1) would have foreclosed a valid medium-fidelity FSA approach. In the final rule, § 450.119(a)(1) and § 450.119(a)(2) provide flexibility and permit at least one approach that allows a simpler computation of risk but still preserves safety. Not all operations are eligible for this corridor method, but it is valid when the vehicle debris risks are due to flight phases where the IIP is moving steadily downrange, and when the failure modes do not involve distorted impact distributions.^[112] In the final rule, the FAA amended the requirement to allow this and other simplified methods for those operations for which they may be valid.

The FAA adds § 450.119(a)(3) in the final rule. Section 450.119(a)(3) states that an FSA must include a trajectory analysis that establishes, for vehicles using flight abort as a hazard control strategy under § 450.108, trajectory data or parameters that describe the limits of a useful mission. This requirement was found in § 450.117(a)(3) of the NPRM. The FAA finds that trajectory analysis requirements associated with the limits of a useful mission belong in the malfunction flight section because presumably normal flight can attain the one or more objectives within the flight azimuth limits.

The requirement in § 450.119(a)(3) is related to the requirement proposed in § 450.119(a)(1) because trajectories that are outside of the normal envelope can still be “useful,” even though they involve a malfunction.^[113] The FAA notes that an operator can elect to designate the normal mission trajectories as the limits of a useful mission and meet the application requirement to submit data that describes the limits of a useful mission, but this may result in the termination of a flight that could still achieve a mission objective.

The FAA received several comments on the NPRM's proposal to use the “limits of a useful mission” to inform the development of flight safety limits and when flight abort was necessary, and to establish the width of a gate. Microcosm requested that the FAA define “a useful mission.” Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended changing the definition of “limits of a useful mission” to mean the trajectory or other parameters that bound performance of a mission that can attain its primary objective. Blue Origin disagreed with the addition of “limits of a useful mission” to the regulation and stated that regulating what is considered a useful mission was outside of the FAA's jurisdiction.

In the final rule, the FAA adopts a new definition of a “useful mission” in § 401.7 and amends the proposed definition of “limits of a useful mission” to mean the trajectory data or other parameters that bound the performance of a useful mission, including flight azimuth limits. A “useful mission” means a mission that can attain one or more objectives and is based on the definition of “limits of a useful mission” proposed in the NPRM. The definition of “limits of a useful mission” adopted in the final rule removes the language “describe the limits of a mission that can attain the primary objective” and replaces it with “bound the performance of a useful mission,” consistent with the commenters' recommendation. In this context, bounding the performance will include flight azimuth limits and could include limits on the altitude versus distance downrange or other physics-based limits depending on the nature of the operation. The FAA makes these changes because it recognizes that pursuit of objectives other than the primary objective may be considered a useful mission. However, when all other objectives can no longer be achieved the FAA does not consider the collection of data related to a failure in and of itself to be a useful mission. This is because mere failure data collection alone does not justify continued risk to the public. Therefore, the final rule states in § 450.119(a)(3) that the FAA does not consider the collection of data related to a failure to be a useful mission.

The FAA finds the requirements associated with “useful mission” and “limits of a useful mission” are central to the hazard control strategies. The FAA is not attempting to regulate what the operator or its customer considers a useful mission. The FAA instead is simply requiring that the applicant identify which missions are useful so that vehicles that fly outside of these parameters erroneously are not permitted to threaten the public. The FAA finds it necessary to include a requirement that would prevent a launch or reentry vehicle from continued flight that would increase risk to the public if that vehicle can no longer achieve an objective of the operator, outside of the collection of data related to a failure.

Blue Origin recommended replacing “limits of a useful mission” with “limits to meet public risk criteria.” The FAA does not agree with this recommendation. As described in the section on CE_C, public risk criteria alone are inadequate to establish the need for an FSS, the reliability of the FSS, or the timing of an FSS activation to ensure public safety. Similarly, while some might consider risk-based flight safety limits as a reasonable approach to risk management when a vehicle is on a potentially useful mission, once a malfunction results in a mission that can no longer achieve an objective, then hazard containment should be the goal and flight abort must be used to protect the public against high consequence events. Application of the limits of a useful mission benefits the operator because flights with trajectories that are outside of the normal envelope, but still useful according to the operator, will be permitted to continue without flight abort as long as they comply with § 450.108(d)(7), including trajectories that overfly the public. This was the intent of proposed § 450.123(b)(6) in the NPRM, and remains the intent of § 450.108(d)(7) in the final rule.

Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that limits of a useful mission were already addressed in flight termination triggers, and that proposed § 450.117(a)(3) requiring trajectory data or parameters that describe the limits of a useful mission should be replaced with limits that trigger flight termination.

The FAA declines to adopt this recommendation because of the relationship between the limits of a useful mission and flight safety limits. Pursuant to § 450.108(c)(2) in the final rule (similar to proposed § 450.123(a)(2) of the NPRM), flight safety limits define when an operator must initiate flight abort to prevent continued flight from increasing public risk in uncontrolled areas if the vehicle is unable to achieve a useful mission. Under the final rule, flight safety limits will be developed after the limits of a useful mission are identified. An operator can elect to designate the normal mission trajectories as the limits of a useful mission and meet the application requirement to submit data describing the limits of a useful mission, but this may result in the termination of a flight that could still achieve a mission objective. As an example, during an operation for which a gate width was determined using only a vehicle's normal trajectory envelope, a failure before the gate resulted in the flight nearly being terminated at the gate, even though it went on to achieve the mission's primary objective. In that instance, if the limits of a useful mission data included flight azimuth limits, this vehicle would have had more margin in the form of a wider gate. Under the final rule, if an operator decides that placing a payload in any orbit or withholding abort for crewed flights is more useful than terminating a flight, it may declare that flight is useful at any azimuth or altitude and may fly the vehicle on any trajectory that meets § 450.108(d)(7). However, flight safety limits that terminate flights that are no longer useful should be placed so that they do not increase risk compared to continued flight, pursuant to § 450.108(d)(6).

The FAA found it necessary to move all references to the limits of a useful mission from § 450.117 to § 450.119 (Trajectory Analysis for Malfunction Flight), including proposed § 450.117(a)(3). The FAA finds that the requirements associated with the limits of a useful mission belong in the malfunction flight section because limits of a useful mission can exceed the bounds of normal flight.

In the NPRM, the FAA proposed in § 450.119(b) that a malfunction trajectory analysis must account for each cause of a malfunction flight, including software and hardware failures. For each cause of a malfunction trajectory, the analysis would have been required to characterize the foreseeable trajectories resulting from a malfunction. The proposal included six items in § 450.119(b)(1) through (b)(6) that would be required to be included in the analysis.

In the final rule, the FAA adopts proposed § 450.119(b) with revisions. The FAA removes proposed § 450.119(b)(1) through (b)(3) because they are no longer needed due to the adoption of performance-based standards and re-designates proposed § 450.119(b)(4) through (b)(6) as (b)(1) through (b)(3). Also, the FAA revises the introductory language in § 450.119(b) to improve clarity and remove prescriptive language.

Blue Origin commented that it was not feasible to model a malfunction turn trajectory for each software or hardware cause, only for vehicle responses to the cause as proposed in § 450.119(b). Blue Origin recommended striking the phrase, “for each cause of a malfunction trajectory,” and instead indicate that a malfunction trajectory analysis must characterize the foreseeable trajectories resulting from a malfunction.

The FAA partially agrees with Blue Origin's recommendations. The FAA deletes the proposed language in § 450.119(b), “for each cause of a malfunction trajectory, the analysis must characterize the foreseeable trajectories resulting from a malfunction,” but retains the phrase “for each cause of a malfunction flight” in the first sentence of § 450.119(b). The FAA notes the analysis must account for the probability of each set of trajectories that characterize a type of malfunction flight, and that probability must account for each cause of a malfunction flight, including software and hardware failures, for every period of normal flight.

The FAA notes that use of the phrase “for each type of malfunction” in § 450.119(b) of the final rule addresses Blue Origin's comment that it is not feasible to model a malfunction turn trajectory for each cause, but only for vehicle responses to the cause. The term “each type of malfunction” refers to the vehicle response to the cause and multiple causes could result in a similar vehicle response. For example, under part 417 a malfunction turn analysis would account for a series of “tumble turns,” as enumerated in Appendix A to part 417 under A417.9(d)(5), which result in the launch vehicle rotating due to a constant thrust vector offset angle. The FAA recognizes that there could be multiple causes for a constant thrust vector offset, such as a jammed mechanism, loss of electrical power, or loss of hydraulic fluid pressure. Thus, the probability of a tumble turn must account for “each cause of a malfunction flight, including software and hardware failures,” in accordance with § 450.119(b). Furthermore, the FAA recognizes that multiple sets of trajectories are necessary to characterize the vehicle behavior in response to a malfunction. An example is a malfunction that results in a constant thrust vector offset, because a range of thrust vector offsets is reasonably foreseeable (from very small angles that would cause a slow departure from normal flight up to the maximum feasible thrust offset that would typically result in a rapid tumble of the vehicle). Thus, there is a natural question regarding the appropriate resolution of the malfunction trajectory analysis. The intent of the requirements in § 450.119 is to produce sets of trajectories that are sufficient to characterize the public risks posed by each type of malfunction. Thus, the final rule sets a performance standard in § 450.119(b) that the analysis for each type of malfunction must have sufficient temporal and spatial resolution to establish flight safety limits, if any, and individual risk contours that are smooth and continuous.

In order to be less prescriptive, the FAA further amends § 450.119(b) in response to Blue Origin's comment. The NPRM proposed in § 450.119(b)(1) through (b)(3) that the malfunction trajectory analysis must account for (1) all trajectory times during the thrusting phases, or when the lift vector is controlled, during flight; (2) the duration, starting when a malfunction begins to cause each flight deviation throughout the thrusting phases of flight; and (3) trajectory time intervals between malfunction turn start times that are sufficient to establish flight safety limits, if any, and individual risk contours that are smooth and continuous. The FAA removes proposed § 450.119(b)(1) through (b)(3) and consolidates these requirements into § 450.119(b). This revision sets more performance-based requirements for the scope and resolution of the malfunction trajectory analysis to create flexibility in demonstrating the trajectory dispersion resulting from reasonably foreseeable malfunctions. In the final rule, § 450.119(b) will require the analysis for each type of malfunction to have sufficient temporal and spatial resolution to establish flight safety limits, if any, and individual risk contours that are smooth and continuous.

In the NPRM, proposed § 450.119(b)(2) required that a malfunction trajectory analysis account for the duration, starting when a malfunction begins to cause each flight deviation throughout the thrusting phases of flight. Virgin Galactic commented that a malfunction turn analysis would not apply to operations for which a pilot is in control of a winged vehicle because the pilots act as an FSS.

The FAA is aware that having pilots onboard and in control of a vehicle during flight may mitigate the need for certain malfunction analyses; however, there may still be instances when pilots may become incapacitated during flight. In any such instances, a trajectory analysis for malfunction flight would still potentially be necessary to identify impact points as an essential input for risk analyses to demonstrate compliance with risk criteria in § 450.101. The FAA notes that flight simulators can facilitate the development of representative malfunction trajectory analysis outputs in cases in which pilot responses have a significant influence on the trajectory dispersion resulting from reasonably foreseeable malfunctions.

Virgin Galactic also recommended a wording change to § 450.119(b)(2) to define the duration as, “starting when a malfunction begins . . . until such time the effects of the malfunction are mitigated.” As previously discussed, the FAA does not adopt proposed § 450.119(b)(2) in the final rule. However, the FAA notes in the final rule, the combination of the requirement for sufficient temporal resolution to establish smooth and continuous individual risk contours, along with the requirement to account for the timing of each malfunction trajectory's termination due to means other than flight abort, including vehicle breakup, ground impact, or orbital insertion, provide a sufficient performance-based specification to establish the duration of the malfunction trajectory analysis. In addition, the FAA finds that the commenter's suggestion that the duration of the analysis continue only “until such time the effects of the malfunction are mitigated” would not analyze both the success and the failure of the mitigation necessary to quantify the risk and consequence in the event that the FSS fails.

As a result of removing proposed § 450.119(b)(1) through (b)(3), the FAA re-designates proposed § 450.119(b)(4) as § 450.119(b)(1) in the final rule. Proposed § 450.119(b)(4) required that a trajectory analysis for malfunction flight account for the relative probability of occurrence of each malfunction turn for which the vehicle is capable. In the final rule, the FAA revises § 450.119(b)(1) to reflect that the analysis must account for the relative probability of occurrence of each malfunction, and not specifically a malfunction turn. The FAA views the term “malfunction turn” as outdated. The requirement in the final rule is consistent with the proposal.

The FAA re-designates proposed § 450.119(b)(5) as § 450.119(b)(2) in the final rule. The FAA also revises § 450.119(b)(2) to correct an omission of the word “trajectory.” Furthermore, the FAA adds ground impact and orbital insertion as potential termination states. The FAA found the exclusion of these states in the NPRM to be a deficiency that would have resulted in an operator's inability to meet regulatory requirements for quantifying the risk because malfunctions can result in trajectories that result in ground impact or orbital insertion, as well as vehicle break-up, and those additional outcomes can pose significant public risks as well.

The FAA re-designates proposed § 450.119(b)(6) as § 450.119(b)(3) in the final rule and revises the requirements. Section 450.119(b)(3) requires that a malfunction trajectory analysis account for the parameters with a significant influence on a vehicle's flight behavior from the time when a malfunction begins to cause a flight deviation until each malfunction trajectory will terminate due to vehicle breakup, ground impact, or orbital insertion. The FAA adds the phrase “parameters with a significant influence on vehicle's flight behavior” because the analysis must account for these parameters to characterize sufficiently the vehicle's flight behavior. This language was proposed in the application requirements in § 450.119(c)(2)(iii) and has been added to paragraph (b)(3) in the final rule. The FAA received no comments on this language. The FAA also clarifies that a malfunction trajectory can terminate due to orbital insertion, not just ground impact or predicted structural failure (vehicle breakup), as specified in the NPRM, for the same reason that those outcomes were added to § 450.119(b)(2). Finally, the FAA replaces the proposed term “predicted structural failure” with the term “vehicle break-up” in the final rule. This change is consistent with the terminology used in § 450.121 (Debris Analysis).

Blue Origin commented that smooth and continuous contours were not typically feasible unless flight limits were also included in the malfunction turn analysis. Blue Origin also recommended adding flight abort to the list of vehicle end state conditions.

The FAA did not add flight abort to the list of vehicle end state conditions based on Blue Origin's comment because of the relationship between trajectory analysis for malfunction flight and risk analyses that produce risk contours. Risk analyses must consider outcomes of flight abort and FSS inaction, whether through failure of the FSS or because no flight abort rules were violated, which could result in vehicle breakup, ground impact, or orbital insertion. If the trajectories for malfunction flight were terminated when flight abort was predicted, no trajectory data would exist for cases when the FSS failed. The rule ensures that complete trajectory data exists to account for flight abort action and inaction in risk analyses. More specifically, ending the malfunction trajectories at the flight safety limits conflicts with the requirement in § 450.108(d)(5) to account for proper functioning of the FSS and failure of the FSS in individual, collective, and conditional risk evaluations. It was not necessary to amend the rule according to Blue Origin's comment because flight abort is already a necessary end case to be analyzed when producing risk contours in accordance with § 450.133(e)(2)(iii), which is a separate analysis from producing trajectories for malfunction flight.

Section 450.119(b)(4) explicitly requires a malfunction trajectory analysis to account for potential FSS failure, if an FSS is used, because that can also influence the termination condition of a malfunction trajectory. For example, if a malfunction trajectory triggers a flight abort rule, potential outcomes of the trajectory are abort (through destruct, thrust termination, or other method) or continued flight resulting in aerodynamic breakup, intact impact, or orbital insertion if the FSS fails. The requirement in § 450.119(b)(4) is consistent with the proposal because both the proposed and final § 450.115(a) explicitly require that an operator's FSA method must account for all failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public health and safety and the safety of property. Furthermore, any FSS required to comply with § 450.143 or § 450.145 necessarily will meet the definition of a safety-critical system. Therefore, the proposed requirement § 450.123(a) would have necessitated that the malfunction trajectory analysis account for the potential failure of the FSS.

In the NPRM, § 450.119(c) addressed the application requirements associated with trajectory analysis for malfunction flight. In the final rule, the FAA adopts the application requirements in proposed § 450.119(c) with revisions. The revisions include adding a new § 450.119(c)(2), re-designating proposed § 450.119(c)(2) through (c)(4), and removing proposed § 450.119(c)(1)(i) through (c)(1)(iv).

Proposed § 450.119(c)(1) required an applicant to submit a description of the methodology used to characterize the vehicle's flight behavior throughout malfunction flight. In the final rule, the FAA adopts the proposal and adds a reference to the requirements in § 450.115(c), which sets the standards for the methodologies used in the FSA. Also, the FAA removes the items proposed in § 450.119(c)(1)(i) through (c)(1)(iv) because they were redundant with the performance-based requirements that apply to all FSA in accordance with § 450.115(c).

In the final rule, a new § 450.119(c)(2) requires an applicant to submit a description of the methodology used to determine the limits of a useful mission, in accordance with § 450.115(c). This requirement was proposed as § 450.117(d)(1) in the NPRM. Moving this application requirement to § 450.119 is consistent with the relocation of its associated analysis requirement to § 450.119(a)(3). The FAA re-designates proposed § 450.119(c)(2) as § 450.119(c)(3) in the final rule. The FAA captures the requirements of proposed § 450.119(c)(2)(i) and (c)(2)(ii) and relocates them in § 450.119(c)(3)(i) and (c)(3)(ii).

The FAA re-designates proposed § 450.119(c)(2)(iii) as § 450.119(c)(3)(iii) in the final rule and revises the final § 450.119(c)(3)(iii) to specify the need for an applicant to submit a quantitative description of the parameters, including uncertainties, with significant influence on the vehicle's malfunction behavior for each type of malfunction flight characterized. Proposed § 450.119(c)(2)(iii) required an applicant to submit a description of the input data used to characterize the vehicle's malfunction flight behavior, including a description of the parameters with a significant influence on the vehicle's behavior throughout malfunction flight for each type of malfunction flight characterized. Proposed § 450.119(c)(2)(iii) also required a quantitative description of the nominal value for each significant parameter throughout normal flight. The FAA specifically replaces the proposed requirements in § 450.119(c)(2)(iii) and (c)(2)(iv) ^[114] with the requirement in § 450.119(c)(3)(iii) in the final rule. This revision retains the intent of the requirements proposed in the NPRM but is more flexible in its application because, although it still requires a quantitative description, the regulation permits something other than the statistical distribution that would have been required by the proposal.

The FAA re-designates proposed § 450.119(c)(3) as § 450.119(c)(4) in the final rule. The FAA also removes the need for the vacuum IIP for each second of flight. The FAA makes this change in response to Blue Origin's comment on computing vacuum IIP for a large number of trajectories, as addressed in the preamble section on § 450.117.

The FAA adopts the requirements in § 450.119(c)(4)(i) as proposed in § 450.119(c)(3)(i) in the NPRM. The FAA received no comments on proposed § 450.119(c)(3)(i). The FAA adopts, with revisions, the requirements in § 450.119(c)(4)(ii) as proposed in § 450.119(c)(3)(ii) in the NPRM. Proposed § 450.119(c)(3)(ii) required submission of the probability of each trajectory that characterizes a type of malfunction flight. Blue Origin commented that delivering probabilities for each trajectory modelled was not practical or useful for independent assessment. Instead, Blue Origin proposed revising the regulatory language to require the applicant to submit the probability of each set of malfunction trajectories. The FAA agrees with this comment and revises § 450.119(c)(4)(ii) in the final rule to reflect Blue Origin's recommendation.

In the final rule, § 450.119(c)(4)(iii) requires an applicant to submit a representative malfunction flight trajectory analysis output, including the position and velocity as a function of flight time for a set of trajectories that characterize the limits of a useful mission as described in § 450.119(a)(3) of this section. This requirement was proposed as § 450.117(d)(3)(v) in the NPRM. As discussed earlier, the FAA moves the limits of a useful mission requirement from proposed § 450.117 to § 450.119 in the final rule.

Lastly, similar to other sections in this rule, the FAA removes the requirement for an applicant to provide additional products that allow an independent analysis, as requested by the Administrator. The FAA finds the requirement redundant with § 450.45(e)(7)(ii). Blue Origin and the CSF objected to proposed § 450.119(c)(4). Blue Origin strongly disagreed that the FAA should be in the business of recreating analysis completed by operators. It submitted that the FAA should vet the process used by the operator to conduct the analysis, along with the products of the analysis, to determine whether approval was warranted. Blue Origin further stated that such independent recreation of the analysis could lead to protracted back and forth between an operator and the FAA that was unnecessary if the FAA had vetted the process used by the operator to conduct the analysis. Blue Origin proposed to delete this requirement in order to limit the scope to what was required to establish confidence in the validity of an operator's analysis. CSF stated that the FAA's practice of recreating an applicant's analysis should be ended, as it was expensive and burdensome. CSF recommended that an AC should guide and inform this analysis.

Virgin Galactic noted that numerous regulations under part 450, including proposed § 450.119(c)(4), call for additional products that allow an independent analysis, as requested by the Administrator. Virgin Galactic stated that “additional products” was neither defined nor constrained, permitting the FAA to request any information from operators at any time. This would create uncertainty regarding the kind of products an applicant or operator would need to prepare for the FAA. Virgin Galactic recommended striking the above references in their entirety. Virgin Galactic commented that, based on prior experience under part 431 with the FAA requesting additional information, these regulations may have a significant time and monetary impact on an operator, if implemented.

The FAA does not agree with the commenters' recommendation to delete this requirement in its entirety from the final rule. The goal is for the FAA to evaluate, in an efficient and thorough manner, the validity of an analysis, along with the products of the analysis submitted by an operator. The FAA finds that at times it may be necessary to conduct an independent analysis of the process used by the operator in order to ensure safety. Additional product requests under part 431 may have been more frequent due to a lack of well-defined application requirements. However, under part 450, the FAA expects the application requirements are sufficient and will generally not request additional products beyond those that are necessary to protect public safety. Furthermore, as noted in the NPRM, the FAA has evaluated the validity of an applicant's proposed methods by comparing the results to valid benchmarks such as data from mishaps, tests, or validated high-fidelity methods. Once that has occurred, the FAA can issue an operator's license for a repeatable operation at a specific site for a specified range of trajectory azimuths.

Using published benchmarks, the FAA intends to facilitate the validation and verification of FSA methods to alleviate some of the needs for the FAA to perform independent analyses. However, the FAA finds that relying on an approved process alone is insufficient when certain critical variables may change that affect flight safety or the MPL determination, or in cases in which the operator proposes launch or reentry operations that are so unique that relevant benchmarks are unavailable. Also, the FAA will continue to verify flight operations for new vehicles, for existing vehicles conducting operations at new sites, for vehicles flying a trajectory outside the accepted range of trajectory azimuths, and vehicles that have undergone significant modifications to vehicle design or flight safety critical systems. Thus, the FAA foresees continuing to perform independent analyses in certain circumstances to assure that it has met its statutory obligation to ensure public health and safety and safety of property.

Although the FAA declines to remove the “additional products” reference in § 450.45(e)(7)(ii) of the final rule, the FAA does not include the redundant references proposed in other sections. “Additional products” refers to data that will allow the FAA to conduct an independent safety analysis in support of its application assessment and licensing determination. It would be impractical to list everything needed for every independent analysis. As explained in the NPRM, the FAA's decision to conduct an independent analysis is usually reserved for new vehicle concepts, new analysis methods, or proposals involving unique public safety cases. In all instances, the request for information is bounded by the regulatory requirements for obtaining a license and the FAA's need to ensure compliance with the safety criteria. The FAA adopts the requirement that an applicant submit additional products to facilitate an independent analysis, as requested by the Administrator in § 450.45(e)(7)(ii).

q. Debris Analysis (§ 450.121)

The NPRM proposed in § 450.121 to require a debris analysis that characterized the debris generated for each foreseeable vehicle response mode as a function of vehicle flight time, accounting for the effects of fuel burn and any configuration changes. The proposal required that the debris analysis account for each foreseeable cause of vehicle breakup, including any breakup caused by an FSS activation or by impact of an intact vehicle. As noted in the NPRM, this would include debris from a vehicle's jettisoned components and payloads because such debris could cause a casualty due to impact with an aircraft or waterborne vessel or could pose a toxic or fire hazard.^[115] Under proposed § 450.121(c), the debris analysis would include inert, explosive, and other hazardous vehicle debris from both normal and malfunctioning flight during launch or reentry.

In the final rule, the FAA adopts proposed § 450.121 with revisions. Specifically, the FAA preserves the scope of the debris analysis from the NPRM but consolidates, clarifies, and increases the flexibility of the regulations in this section. The final rule's revisions include (1) replacing the requirement to characterize the debris from “each foreseeable vehicle response mode” with “debris generated from normal and malfunctioning vehicle flight,” (2) relying upon a new definition for “hazardous debris,” (3) replacing “flight time” with “flight sequence,” and (4) removing prescriptive thresholds for various debris hazards in favor of a performance-based standard of “capable of causing a casualty or loss of functionality to a critical asset.” Each of these changes is discussed in the following paragraphs.

Proposed § 450.121(a) required that an FSA include a debris analysis that characterizes the debris generated for each foreseeable vehicle response mode as a function of vehicle flight time, accounting for the effects of fuel burn and any configuration changes. The NPRM noted that an operator's debris list generally changes over time with variations in the amount of available propellant and the jettisoning of hardware.

In the final rule, the FAA adopts proposed § 450.121(a) with revisions. The FAA replaces the proposed requirement to characterize “the debris generated for each foreseeable vehicle response mode as a function of vehicle flight time, accounting for the effects of fuel burn and any configuration changes” with a more flexible and performance-based requirement to characterize “the hazardous debris generated from normal and malfunctioning vehicle flight as a function of vehicle flight sequence.”

Several commenters suggested changing the term “foreseeable” vehicle response modes in § 450.121(a) of the NPRM to “credible” vehicle response modes. The commenters stated that credibility was determined during the system safety analysis, and that the debris analysis should not have to include extremely improbable, non-credible failure modes.

The FAA does not agree that the term “foreseeable” should be replaced by the term “credible” in this section or throughout the final rule. The term “foreseeable” is used in § 431.35 and also commonly used in system safety; therefore, the FAA is not changing these references. The FAA finds that the term “credible” is unacceptably prone to errors in judgment whereas the term “foreseeable” is more readily discerned by analysis (e.g., fault trees). With regard to § 450.121(a) of the final rule, the FAA adopts the more flexible and performance-based requirement recommended by the commenters to characterize the hazardous debris generated from normal and malfunctioning vehicle flight as a function of vehicle flight sequence. With the removal of the reference to “each foreseeable vehicle response mode” in § 450.121(a), the final rule standard for the scope is set by the language in § 450.115(a), specifically by the reference to reasonably foreseeable events. In addition, the resolution of the failure modes accounted for in the debris analysis is set by the level of fidelity necessary to comply with § 450.115(b). The FAA also notes that, in the context of § 450.121, reasonably foreseeable events that can generate hazardous debris during malfunctioning vehicle flight generally include engine/motor explosion, exceeding structural limits due to aerodynamic loads, inertial loads, aerothermal heating, and activation of a flight termination system.

In reference to the use of the term “hazardous debris” in § 450.121(a), the final rule in § 401.7 includes a definition of this term. Hazardous debris means any object or substance capable of causing a casualty or loss of functionality to a critical asset. Hazardous debris includes inert debris and explosive debris such as an intact vehicle, vehicle fragments, any detached vehicle component, whether intact or in fragments, payload, and any planned jettisoned bodies. This definition is based on proposed § 450.121(c)(1), which required a debris analysis to identify all inert debris that could cause a casualty or loss of functionality of a critical asset. The FAA clarifies that the clause “whether intact or in fragments” applies to the payload and jettisoned bodies as well.

The final rule's definition of “hazardous debris” facilitated streamlining in proposed §§ 450.113 through 450.139. For example, the term hazardous debris in § 450.121(a) establishes a performance-based threshold, which resulted in the elimination of the prescriptive debris thresholds proposed in § 450.121(c)(1)(i) through (v).^[116] Section 450.121(a) retains the essential performance standards in proposed § 450.121(c)(1) and (c)(2) (i.e., that the analysis must identify all inert and explosive debris capable of causing a casualty or loss of functionality to a critical asset), and allows operators to propose impact vulnerability models appropriate for the materials used in their licensed operations.

For example, recent research and development sponsored by the FAA demonstrates that the threshold kinetic energy capable of causing a casualty from a collision with a rigid object is substantially lower than for a collision with an object made of certain composite materials.^[117] The FAA will provide an AC with valid debris impact thresholds, such as those proposed in § 450.121(c)(1)(i) and (ii). Thus, in the final rule, § 450.121(a) uses the definition of “hazardous debris” in a way that will enable those debris impact thresholds to be updated as appropriate based on future research and development. In addition, the definition of “hazardous debris” is used in § 450.121(a) in a way that replaces the relatively verbose requirement in proposed § 450.121(c) that “a debris analysis must account for all inert, explosive, and other hazardous vehicle, vehicle component, and payload debris foreseeable from normal and malfunctioning vehicle flight.”

In summary, the final rule uses the performance-based definition of “hazardous debris” that currently equates to the same debris thresholds as proposed in the NPRM because “hazardous debris” means any object or substance capable of causing a casualty, including people in aircraft or waterborne vessels or loss of functionality to a critical asset. Thus, by relying on the definition of “hazardous debris,” the final rule retains the standard in proposed § 450.121(c) of debris capable of causing a casualty or loss of functionality to a critical asset and allows operators to propose impact vulnerability models appropriate for the materials used in their vehicle.

In the final rule, the FAA replaces the term “flight time” in § 450.121(a) with the more flexible term “flight sequence” because it is a better independent variable. For example, during a reentry operation, the transitions between phases of flight, which generally produce substantially different hazardous debris, such as prior to and after peak aero-thermal heating, can occur at widely variable flight times. Also, imparted velocities due to break-up typically correlate with propellant load better than flight time does. Therefore, the final rule uses “flight sequence” as a less prescriptive and more accurate independent variable. The FAA notes that the term “sequence” is used in the common meaning of the word, which is a series of related things or events, or the order in which things or events follow each other. The phrase “as a function of vehicle flight sequence” would naturally include “accounting for the effects of fuel burn and any configuration changes,” so the final rule deletes those elements of the proposed requirement as redundant.

In § 450.121(b) of the NPRM, the FAA proposed to require that the debris analysis account for each foreseeable cause of vehicle breakup, including any breakup caused by FSS activation, and for impact of an intact vehicle. Consistent with § 450.133(a)(4), this proposal included debris from a vehicle's jettisoned components and payloads because such debris could cause a casualty due to impact with an aircraft or waterborne vessel or could pose a toxic or fire hazard.^[118]

Section 450.121(b) retains the requirement that a debris analysis account for each reasonably foreseeable cause of vehicle breakup and intact impact. As explained in the NPRM, this would include “engine or motor explosion, or exceeding structural limits due to aerodynamic loads, inertial loads, or aerothermal heating.” ^[119]

In addition, the final rule requires an operator to account for vehicle structural characteristics and materials and energetic effects during break-up or at impact. Although these items would be necessary considerations in any debris analysis, the FAA has added them expressly in § 450.121(b). The requirement to account for energetic effects in § 450.121(b)(3) is consistent with the requirement in proposed § 450.135(d)(3)(iii) which addresses “indirect or secondary effects such as bounce, splatter, skip, slide, or ricochet.” ^[120] Moreover, accounting for the fundamental physical phenomena identified in § 450.121(b)(2) of the final rule would logically be necessary to comply with the requirement in proposed § 450.135(d) to “model the casualty area, and compute the predicted consequences of each reasonably foreseeable vehicle response mode.” As explained in the NPRM, “the casualty area and consequence analysis would be required to account for all relevant debris fragment characteristics.” The characteristics of all relevant debris fragments, such as the size and kinetic energy at impact, depend on the three fundamental physical phenomena identified in the final rule.

As noted earlier, the NPRM proposed to require in § 450.121(c) that a debris analysis account for all inert, explosive, and other hazardous vehicle, vehicle component, and payload debris foreseeable from normal and malfunctioning vehicle flight. The NPRM also specified a set of items for which a debris analysis would be required to account, at a minimum. These items included highly specific and prescriptive debris thresholds requirements. With the addition of the hazardous debris definition, § 450.121 no longer requires a specific subsection establishing debris thresholds.

In the final rule, new § 450.121(c) contains requirements associated with the propagation of debris that are relocated from the proposed debris risk analysis requirements in § 450.135(b). Specifically, a debris analysis must compute statistically valid debris impact probability distributions. The propagation of debris from each predicted breakup location to impact must account for all foreseeable forces that can influence any debris impact location, and all foreseeable sources of impact dispersion, including, at a minimum: The uncertainties in atmospheric conditions; debris aerodynamic parameters, including uncertainties; pre-breakup position and velocity, including uncertainties; and breakup-imparted velocities, including uncertainties. The FAA notes that a quantitative description of the physical, aerodynamic, and harmful characteristics of hazardous debris is a prerequisite to compute statistically valid debris impact probability distributions and to quantify the risks to the public.

The propagation of debris is a physics-based analysis that predicts where debris impacts will occur given a debris event while the vehicle is in flight, such as jettison of a vehicle stage or an explosion. The FAA moves the requirements in proposed § 450.135(b) to § 450.121(c) because the computation of statistically-valid debris impact distributions naturally depends on the nature of the debris and the trajectory analysis products from §§ 450.117 and 450.119. Similarly, the final rule requirements in § 450.121(c) are nearly identical to those in proposed § 450.135(b), except that the final rule removes the term “including uncertainties” from the regulation. The FAA finds inclusion of this term to be superfluous, as accounting for foreseeable sources of impact dispersion naturally includes the uncertainties in the debris aerodynamic parameters, pre-breakup state vectors, and breakup-imparted velocities. The FAA notes that the debris analysis must compute statistically valid debris impact probability distributions of all hazardous debris to be consistent with the scope identified in § 450.121(a).

Virgin Galactic recommended that the FAA allow operators to provide their own assessments of casualty causing debris. The FAA agrees that the specific impact vulnerability thresholds specified in the NPRM were overly prescriptive and potentially overly conservative for some non-rigid debris impacts. Thus, the final rule removes these proposed requirements in § 450.121(c) entirely.

In the NPRM, § 450.121(d) provided the debris analysis application requirements. In the final rule, the FAA relocates and revises proposed § 450.121(d)(1), which was a requirement to submit a description of the debris analysis methodology, to § 450.121(d)(2). The FAA re-designates and revises proposed § 450.121(d)(2) as § 450.121(d)(1) in the final rule. In the NPRM, proposed § 450.121(d)(2) required an operator submit a description of all vehicle breakup modes and the development of debris lists. In the final rule, the re-designated § 450.121(d)(1) makes use of the formal definition of “hazardous debris,” requiring a description of all scenarios that can lead to hazardous debris.

In the final rule, § 450.121(d)(2) and (d)(3) require an operator to submit a description of the methods used to perform the vehicle impact and breakup analysis in accordance with § 450.115(c), which is consistent with similar changes in other FSA sections. The final rule also moves the requirements relevant to the debris propagation analysis from proposed § 450.135(e)(2) and (e)(5) to § 450.121(d)(3) and (d)(4).

The FAA re-designates and revises proposed § 450.121(d)(3) as § 450.121(d)(5). In the NPRM, proposed § 450.121(d)(3) required an applicant to submit all debris fragment lists necessary to describe the physical, aerodynamic, and harmful characteristics of each debris fragment or fragment class quantitatively. Section 450.121(d)(5) of the final rule requires a quantitative description of the physical, aerodynamic, and harmful characteristics of hazardous debris. The FAA finds that “quantitative description” will allow alternative approaches for the applicant to demonstrate compliance with this section.

Virgin Galactic stated the proposal would introduce additional workload to the company. Virgin Galactic raised concern that proposed § 450.121 introduced requirements for waterborne vessels that were not referenced in other parts of the rule. The NPRM proposed, and the final rule requires in § 450.133(b), that a flight hazard area analysis must determine waterborne vessel hazard areas. Also, the NPRM preamble explained that the requirement includes people on ships in the collective risk computation (see proposed § 450.101(a)(1) and (b)(1)), and thus explicitly allows the application of risk management principles to protect people on waterborne vessels. The FAA finds that the scope of the FSA requirements in the final rule are consistent with current practice and will not introduce additional workload.

Virgin Galactic stated that the FAA should quantify the debris that could cause a casualty on a waterborne vessel. The FAA notes that it provided guidance on debris thresholds for waterborne vessels in Table 10 of the draft AC on High-Fidelity FSA published with the NPRM.

r. Population Exposure Analysis (§ 450.123)

In the NPRM, the exposure model requirements were addressed in the debris risk analysis section in proposed § 450.135(c) and (d) because a complete risk analysis must account for the distribution of people and how those people may be sheltered. The FAA received numerous comments stating the proposed requirements were too prescriptive. The FAA agrees and has revised the requirements to be more performance-based.

In the final rule, the FAA revises the exposure model requirements and moves them from proposed § 450.135(c) and (d) to § 450.123 (Population Exposure Analysis). The FAA moves the population exposure analysis requirements out of the proposed debris risk analysis section because this analysis informs other sections of the FSA. A population exposure analysis must also be used to provide input to other public risk analyses to address toxic hazards and far-field overpressure blast effects, if any. This change does not an expand the scope of the final rule beyond what was proposed in the NPRM because the NPRM identified the need for population exposure input to address toxic hazards for flight and far-field overpressure blast effects.^[121] The rationale for the final rule requirements remains the same as proposed in the NPRM: An exposure model provides critical input data on the geographical location of people and critical assets at various times when the launch or reentry operation could occur. While the rationale remains the same, the FAA makes two changes in § 450.123. Consistent with the change discussed in the critical assets section of the preamble, the FAA removes the requirement for an operator to characterize the distribution and vulnerability of critical assets. The FAA also revises the population exposure analysis to require that input data must account for the vulnerability of people to hazardous debris effects. The FAA will issue a Population Exposure Assessment AC to describe a possible means of compliance.

Section 450.123(a) requires that an FSA must account for the distribution of people for the entire region where there is a significant probability of impact of hazardous debris. This final rule is consistent with the requirement in proposed § 450.135(c)(1) that the population exposure data would be required to include the entire region where there is a significant probability of impact of hazardous debris. The definition of “hazardous debris” in § 401.7 informs the scope of this requirement. In § 450.123(a), the standard of “significant” means that the scope of the population exposure analysis is bounded by what is necessary to demonstrate compliance with the risk criteria in § 450.101(a) and (b), consistent with the scope requirements set in §§ 450.113 and 450.115.

Section 450.123(b) sets constraints on the population exposure analysis consistent with proposed § 450.135(c)(2) through (c)(7). Specifically, § 450.123(b) requires that the exposure analysis must characterize the distribution of people both geographically and temporally; account for the distribution of people among structures and vehicle types; and use reliable, accurate, and timely source data.

Section 450.123(b)(1) relocates the requirements in proposed § 450.135(c)(2), but removes the term “vulnerability” and the reference to critical assets, as discussed earlier.^[122] The final rule removes proposed § 450.135(c)(4), which would have required the exposure model to have sufficient temporal and spatial resolution that a uniform distribution of people within each defined region can be treated as a single average set of characteristics without degrading the accuracy of any debris analysis output. By removing this requirement, an operator may demonstrate compliance with § 450.123(b) in the manner set forth in proposed § 450.135(c)(4), but also has flexibility to demonstrate compliance through other means.

Section 450.123(b)(2) replaces the more prescriptive requirements in proposed § 450.135(c)(3) by removing the requirement that, in accounting for the distribution of people among structures and vehicle types, an exposure analysis includes “a resolution consistent with the characteristic size of the impact probability distributions for relevant fragment groups.” The language removed from the final rule remains a valid means for an operator to demonstrate compliance with § 450.123(b)(2) in the final rule.

Section 450.123(b)(3) replaces the more prescriptive requirements in proposed § 450.135(c)(5) and (c)(6) so that an exposure analysis must use reliable, accurate, and timely source data.

Section 450.123(b)(4) consolidates and replaces the requirements to account for the vulnerability of people to hazardous debris effects that were proposed in § 450.135(d)(3)(i) and (ii), as well as proposed in § 450.137(b)(4). In the final rule, the FAA removes the requirement in proposed § 450.135(c)(7) altogether. Proposed § 450.135(c)(7) is redundant in conjunction with the requirements in § 450.115(b), which specify the necessary fidelity of any FSA, and the requirement in § 450.101(g) that an operator must use accurate data and scientific principles and the analysis must be statistically valid.

The FAA moves and revises the application requirements in proposed § 450.135(e)(3) as § 450.123(c)(1) in the final rule. The FAA revises the final § 450.123(c)(1), which requires an applicant to submit a description of the FSA methodology, to reference § 450.115(c). As previously noted, the population exposure analysis must also be used to provide input to other public risk analyses to address toxic hazards and far-field overpressure blast effects, if any. Section 450.123(c)(2) requires an applicant to submit complete population exposure data, in tabular form, which is a more concise statement equivalent to proposed § 450.135(e)(4). In the final rule, the FAA specifies that the complete population exposure data must be in tabular form and deletes the requirement that the description of the exposure input data include, for each population center, a geographic definition and the distribution of population among shelter types as a function of time of day, week, month, or year. The population exposure data provided under § 450.123(c)(2) may reflect some or all of the information described in proposed § 450.135(e)(4).

s. Probability of Failure Analysis (§ 450.131)

In the NPRM, proposed § 450.131 covered probability of failure analysis requirements for all launch and reentry vehicles. In the final rule, the FAA adopts proposed § 450.131 with minor revisions codifying current practices and eliminating the proposed classes of mishaps referenced in § 450.131.

Section 450.131(a) proposed that for each hazard and phase of flight, an FSA for a launch or reentry would be required to account for vehicle failure probability. The probability of failure would be required to be consistent for all hazards and phases of flight. For a vehicle stage with fewer than two flights, the failure probability estimate would be required to account for the outcome of all previous flights of vehicles developed and launched or reentered in similar circumstances. For a vehicle or vehicle stage with two or more flights, vehicle failure probability estimates would be required to account for the outcomes of all previous flights of the vehicle or vehicle stage in a statistically valid manner. The outcomes of all previous flights of the vehicle or vehicle stage would be required to account for data on any partial failure and anomalies, including Class 3 and Class 4 mishaps, as defined in proposed § 401.5. The FAA adopts § 450.131(a) as proposed with a minor change to the language pertaining to mishaps to reflect revisions to the definition of “mishap” in § 401.7. The FAA notes that the final rule replaced the term “partial failures” with “mishap” in § 450.131(a)(2) because the proposed language referenced both anomalies and mishaps, and “partial failure” is redundant since any partial failure could qualify as an anomaly or a mishap under § 401.7, depending on the nature of the failure.

Virgin Galactic commented that the proposed requirements to gather and account for anomaly data in the probability of failure analysis introduced additional workload compared to the current regulation. It recommended the FAA adopt a performance-based standard in an SNPRM.

The FAA does not agree that this requirement results in additional workload from current regulations. The FAA notes that the final rule requirement in § 450.101(g) is relevant here because it requires that a method must produce results consistent with, or more conservative than, the results available from previous mishaps, tests, or other valid benchmarks, such as higher-fidelity methods.^[123] Hence, an operator has the option to use a more conservative approach to avoid any unnecessary additional workload. For example, an operator can assume one more failure than the actual outcomes of all previous flights of the vehicle or vehicle stage. Therefore, the FAA does not find that the requirements in the final rule constitute additional workload compared to current regulations.

Boeing requested clarification on what is meant by a “consistent” probability of failure in this section. The FAA clarifies that the vehicle or vehicle stage probability of failure must be consistent internally with outcomes of previous flights, as described in § 450.131(a)(1) and (a)(2). Furthermore, the probability of failure input data must be consistent for all phases of flight and hazards. In this context, “consistent” does not mean identical and does not preclude an operator from varying the probability of failure within statistical confidence limits for the same event in different contexts, in order to bias an analysis towards a conservative outcome.^[124] The probability of failure input data should be reasonably conservative and consistent across phases of flight and for various hazards given the uncertainty in each probability of failure.

A hypothetical example is a proposed launch of a two-stage launch vehicle from both CCAFS and Vandenberg Air Force Base (VAFB). In this case, the best-available data indicates the mean conditional probability of a failure during first stage and second stages of flight are both 50 percent, with plus or minus 10 percent uncertainty at a minimal level of confidence (e.g., 60 percent lower and upper bound confidence limits at 40 percent and 60 percent based on the binomial distribution).

Given the fact that the public exposure to hazardous debris effects for launches from VAFB is relatively high during stage one, and the opposite is true for launches from CCAFS, a consistent and reasonably conservative probability of failure analysis would use a 60-40 split in the conditional probability of failure during stage one and stage two flight for launches from VAFB, but a 40-60 split in the conditional probability of failure during stage one and stage two flight for launches from CCAFS. Furthermore, the conditional probability of a failure applied to different hazards, such as debris and toxics, must be consistent with each other. More details on means of compliance are provided in the High Fidelity FSA Methods AC published with this rule, and a future AC on probability of failure.

Leo Aerospace asked if the FAA would consider a balloon platform to be a stage.

The FAA will discuss project-specific information, including whether a balloon platform is part of a launch vehicle stage, during pre-application consultation.

Boeing, Blue Origin, and Sierra Nevada commented on the lack of availability of previous flight information for vehicles not operated or owned by the applicant.

The FAA responded to this comment in the FAA's “Responses to the Public's Clarifying Questions Received by July 12, 2019,” ^[125] which is posted in the docket. An operator should use the best-available data, which in many cases would be limited to publicly available data. The FAA will also provide data and guidance on failure mode and phase of flight allocations in the High Fidelity FSA Methods AC, which will be finalized with this rule.

In the final rule, the FAA replaces all references to Class 3 and Class 4 mishaps in § 450.131 with the term “mishap.” As previously noted, the FAA eliminates the proposed classes of mishaps in the revised definition of mishap in § 401.7 of the final rule.

In the NPRM, the FAA proposed that, for FSA purposes, a failure occurs when a vehicle does not complete any phase of normal flight or when any anomalous condition exhibits the potential for a stage or its debris to impact the Earth or reenter the atmosphere outside the normal trajectory envelope during the mission or any future mission of similar vehicle capability. It further stated that Class 1 or Class 2 mishaps would constitute failures.

Blue Origin commented that defining failure as not completing any phase of normal flight is “overly punitive” as proposed in § 450.131(b). Operators may define secondary mission objectives for research and development purposes that, if not achieved, do impact mission success but do not impact safety. Blue Origin proposed deleting the language “when a vehicle does not complete any phase of normal flight or” and anchor the definition in impacts outside the normal envelope. Virgin Galactic recommended that the FAA should only account for failures, partial failures, and anomalies that affect public safety. Blue Origin also commented that including anomalies that might impact a future mission conflicts with the causal logic that an anomaly experienced on a given mission will be subject to corrective actions prior to the next mission.

The FAA understands the concerns raised by the commenters but finds it unnecessary to change the regulatory text to address these concerns. An operator may adjust its final failure probability estimates to account for various extenuating circumstances, as will be described in a future Probability of Failure Analysis AC. For example, the probability of failure may be adjusted based on extenuating circumstances with justification (e.g., if the failure is not public safety related or if corrective actions implemented after a failure were demonstrated to be successful). If an operator makes any adjustments to the final failure probability estimates to account for various extenuating circumstances, it can update its FSA in accordance with § 450.103(d).

The FAA notes that, for FSA purposes, the vehicle failure probability accounts for any failure of the launch or reentry system because of the way failure is defined in § 450.131(b). Specifically, for FSA purposes, a failure occurs when a vehicle does not complete any phase of normal flight or when any anomalous condition exhibits the potential for a stage or its debris to impact the Earth or reenter the atmosphere outside the normal trajectory envelope during the mission or any future mission of similar vehicle capability. Therefore, in the context of FSA, any failure of the launch or reentry system, including pilot error, that produced vehicle failure as defined in § 450.131(b) must be taken into account.^[126]

Proposed § 450.131(c) defined “previous flight” by stating that the flight of a launch vehicle begins at a time when a launch vehicle normally or inadvertently lifts off from a launch platform and the flight of a reentry vehicle or deorbiting upper stage begins at a time when a vehicle attempts to initiate a deorbit. The FAA adopts § 450.131(c)(1) as proposed with a minor change. The FAA strikes the words “normally or inadvertently” as redundant, since any lift off, whether normal or inadvertent, would count as a flight under the proposed and final rule requirements in § 450.131(c)(1).

Boeing, Lockheed Martin, Northrop Grumman, ULA, and Virgin Galactic requested explanation on whether the proposed requirement in § 450.131(c) would apply to hybrid vehicles.

In the final rule, the FAA revises the regulatory text in response to these comments. The FAA changes “launch platform” to “surface of the Earth” as the point at which flight begins for a probability of failure analysis. This change reflects the fact that various types of vehicles, such as hybrids, do not lift off from launch platforms. The probability of failure analysis must account for the probability of failure during all phases of flight to ensure public safety, including captive carry, unless the exception in § 450.113(b) applies to that phase of flight. For example, an aircraft crash with a rocket attached can present much higher risks to the public from an explosion, toxic release, or inert impact, than the risks posed by an aircraft crash without a rocket attached.

For the purposes of § 450.131(c)(1) and (c)(2), a previous flight may include flights conducted outside FAA licensed activity, such as amateur, permitted, U.S. government, or foreign launches, reentries, or flights. For the purposes of § 450.131(c)(1) and (c)(2), a previous flight may include FAA-licensed activity, such as the Falcon 9 launch vehicle anomaly which destroyed the vehicle and its AMOS-6 payload,^[127] if the outcome exhibited the potential for a stage or its debris to impact the Earth or reenter the atmosphere outside the normal trajectory envelope during the mission or any future mission of similar vehicle capability. The FAA also changes the word “deorbit” to “reentry” to accommodate a reentry that starts on a suborbital trajectory.

In the NPRM, § 450.131(d) proposed to require that a vehicle probability of failure be distributed across flight times and vehicle response modes. The distribution would be consistent with the data available from all previous flights of vehicles developed and launched or reentered in similar circumstances and data from previous flights of vehicles, stages, or components developed and launched or reentered by the subject vehicle developer or operator. As proposed, the data could include previous experience involving, among other things, a similar level of experience of the vehicle operation and development team members.

The FAA adopts § 450.131(d) with revisions. Specifically, the FAA changes “flight time” to “flight phase.” “Flight phase” gives applicants more flexibility in their analysis because it is less specific than “flight time.” The FAA also changes “vehicle response mode” to “failure mode,” consistent with similar changes throughout the final rule. Finally, the FAA replaces the phrase “launched or reentered” in § 450.131(d)(2) to “launched, reentered, flown, or tested.” This change will enable the probability of failure allocation across flight phases and failure modes to account for data from previous flights of vehicles, stages, or components by the subject vehicle developer or operator that did not qualify as launch or reentry operations, such as drop tests or glide flights. The FAA also revises “flight phases” and “failure modes” to be plural in the final rule. This amended language is a minor grammatical change and is consistent with the intent of the proposed requirement.

Virgin Galactic commented that the FAA should not employ a subjective measure of “level of experience” and requested this language be stricken.

The FAA asserts that this measure is not subjective. The High Fidelity FSA Methods draft AC contained specific quantitative thresholds that have been used for many years as guidelines to distinguish new versus experienced developers for the purposes of probability of failure analyses. Because the quantitative thresholds are in guidance, the FAA may consider other quantitative thresholds as appropriate. Furthermore, the data available from previous flights of ELVs developed by experienced and inexperienced operators demonstrates a statistically significant difference between the relative frequency of failures during the first and second phases of flight. Therefore, because the required input data may involve a similar level of experience of the vehicle operation and development team members, the final rule in § 450.131(d)(2)(iii) retains that consideration.

The FAA adopts the observed and conditional failure rate requirements in § 450.131(e) as proposed and the application requirements in § 450.131(f) with revisions. Section 450.131(f)(1) to require methods used in probability of failure analysis be in accordance with § 450.115(c) because that section sets out the requirements for FSA methodologies. In § 450.131(f)(2), the FAA changes the term “vehicle response mode” to “failure mode,” which is consistent with similar changes throughout this final rule.

t. Flight Hazard Area Analysis (§ 450.133)

In § 450.133, the NPRM proposed general requirements for the flight hazard area analysis as well as requirements specific to waterborne vessel hazard areas, land hazard areas, airspace hazard volumes, and the license application. In the final rule, the FAA adopts § 450.133 with revisions. The revisions include changing terms proposed in the NPRM and removing redundant requirements.

Proposed § 450.133(a) stated that an FSA would be required to include a flight hazard area analysis that identifies any region of land, sea, or air that would be required to be surveyed, publicized, controlled, or evacuated in order to control the risk to the public. A flight hazard area analysis would be required to account for all reasonably foreseeable vehicle response modes during nominal and non-nominal flight that could result in a casualty. The NPRM specified six items that would be required to be included in a flight hazard area analysis, at a minimum.

The FAA adopts § 450.133(a) with revisions. The FAA moves the requirement in § 450.133(a) that a flight hazard area analysis must account for all reasonably foreseeable vehicle response modes during nominal and non-nominal flight that could result in a casualty to § 450.133(a)(1). This text is also revised, as discussed below. The replacement of “vehicle response modes” with “failure modes” was discussed in the preamble section on § 450.101(c)(2).

In § 450.133(a)(1), the FAA proposed that the flight hazard analysis must account for the regions of land, sea, and air potentially exposed to debris impact resulting from normal flight events and from debris hazards resulting from any potential malfunction. The FAA revises proposed § 450.133(a)(1) by adding the term “hazardous debris” as discussed in the preamble section for § 450.121 (Debris Analysis). As defined, hazardous debris includes any object or substance capable of causing a casualty or loss of functionality to a critical asset, such as an intact vehicle, vehicle fragments, any detached vehicle component, whether intact or in fragments, payload, and any planned jettison bodies. The FAA also replaces “vehicle response mode” with “failure modes” for consistency throughout the final rule.

In § 401.7, the FAA modifies the definition of “flight hazard area” as applied to part 450. The NPRM proposed that flight hazard area means any region of land, sea, or air that must be surveyed, publicized, controlled, or evacuated in order to “protect public health and safety and the safety of property.” This language was inconsistent with the language in § 450.133. As such, in the final rule, the definition has been revised in § 401.7 for consistency to state that a flight hazard area is any region of land, sea, or air that must be surveyed, publicized, controlled, or evacuated in order to “ensure compliance with the safety criteria in § 450.101.”

Boeing, Lockheed Martin, Northrop Grumman, and ULA suggested replacing “all reasonably foreseeable” with “credible” because credibility is established in the system safety analysis. As discussed previously, the FAA does not agree with the recommendation because the term credible is prone to errors in judgment whereas the term foreseeable is more readily discerned by analysis (e.g., fault trees). The final rule moves the term “reasonably foreseeable” from proposed § 450.133(a) to § 450.133(a)(1), where it more appropriately modifies the language in § 450.133(a)(1) that specifies the analysis must account for the regions of land, sea, and air potentially exposed to hazardous debris generated during normal flight events and all reasonably foreseeable failure modes.

The FAA adopts § 450.133(a)(2) with a minor correction. The FAA replaces “control risk to any hazard” in the NPRM with “control risk from any hazard” in the final rule.

In § 450.133(a)(3), the FAA proposed that the analysis account for the limits of a launch or reentry vehicle's normal flight, including winds that were no less severe than the worst wind conditions under which flight might be attempted and uncertainty in the wind conditions. The FAA adopts § 450.133(a)(3) with revisions. The FAA changes “wind conditions” to “atmospheric conditions” because in some cases, such as far-field overpressure blast and toxics analyses, the temperature profile is an atmospheric condition that may also be stipulated as part of the flight commit criteria (in addition to the wind profile). This change does not create any additional burden to the operator because the proposed and final requirements in § 450.135(e)(1) and § 450.165(b)(2) already require an operator to account for and identify the conditions immediately prior to enabling the flight of a launch vehicle or the reentry of a reentry vehicle that are necessary to demonstrate compliance with the safety criteria in § 450.101, such as the atmospheric conditions and any meteorological conditions. The final rule in § 450.133(a)(3) clarifies that all atmospheric conditions are considerations when the operator establishes the worst conditions under which flight might be attempted.

In § 450.133(a)(4), the FAA proposed that the analysis account for the debris identified for each foreseeable cause of breakup, and any planned jettison of debris, launch or reentry vehicle components, or payload. The FAA adopts § 450.133(a)(4) with a revision. For reasons previously discussed, the FAA replaces this section with “all hazardous debris,” which uses the term defined in § 401.7 of the final rule. This revision does not change the intent of the requirement.

In § 450.133(a)(5), the FAA proposed that the analysis account for all foreseeable sources of debris dispersion during freefall, including wind effects, guidance and control, velocity imparted by breakup or jettison, lift, and drag forces. The FAA adopts § 450.133(a)(5) with revisions. In the final rule, the analysis must account for sources of debris dispersion in accordance with § 450.121(c). The FAA makes this revision to avoid replication of requirements between §§ 450.133(a)(5) and 450.121(c) and to ensure consistency in the FSA.

AOPA commented that the FAA should provide the public an authoritative source of flight hazard area information as well as guidance on various flight hazard area analysis methodology. The FAA is working on the NOTAM/Aeronautical Information Service (AIS) Modernization effort, which will redesign the current NOTAM management information system with a single technology gateway for entering, processing, and retrieving all NOTAM data, making it easier for all users of the airspace to access safety-critical information. The FAA finds that the issue raised by AOPA is best addressed by the NOTAM/AIS Modernization effort rather than this rulemaking. Industry can provide input on this effort through the Aeronautical Information Systems Coalition. Information regarding temporary flight restrictions (TFR) can be found at: https://tfr.faa.gov/​tfr2/​list.html and is searchable by the type of TFR being implemented. The FAA plans to complete the NOTAM/AIS Modernization effort by late 2022. In addition, an acceptable flight hazard area analysis methodology is addressed in the High Fidelity FSA AC.

Boeing, Lockheed Martin, Northrop Grumman, and ULA also provided suggested regulatory text that stated the airspace hazard volume was only necessary for airspace up to 60,000 feet mean sea level. The FAA agrees that the analysis only needs to account for reasonably expected air traffic in a given region, but, in order to account for operations in different regions, does not change the text to a specific altitude.

The FAA adopts § 450.133(b), (c), and (d) as proposed. Section § 450.133(b)(1), (c)(1), and (d)(1) state that flight hazard areas must be determined as necessary to contain, with 97 percent probability of containment, all debris resulting from normal flight events capable of causing a casualty to any person located on land, sea, or air. In the NPRM, the FAA explained that proposed § 450.133(b)(1), (c)(1), and (d)(1) would align FAA regulations with practices at the Federal launch or reentry sites by allowing operators to reduce or otherwise optimize the size of the regions for warnings of potential hazardous debris resulting from normal flight events.

Virgin Galactic stated that, given the currently available information and tools regarding debris, the 97 percent probability of containment requirement in proposed § 450.133(b)(1), (c)(1), and (d)(1) would result in inflated hazard area determinations. Boeing, Lockheed Martin, Northrop Grumman, and ULA commented on proposed § 450.133(b)(1) and suggested it reference current 3-sigma standards. Boeing stated that, given the new limitation on debris, changing from 99.7 percent to 97 percent containment appeared less safe.

The final rule retains the 97 percent containment requirement proposed in the NPRM. The FAA notes that the comments demonstrate a difference of opinion in the industry regarding the appropriate probability of containment requirement for flight hazard areas, with Virgin Galactic claiming the proposal would result in inflated hazard area determinations, as opposed to the other commenters calling for more stringent hazard area requirements to maintain public safety. The FAA finds the 97 percent containment requirement strikes an appropriate balance, particularly when coupled with the requirement to include the collective risk contribution from people in waterborne vessels in the public risk criteria in § 450.101. As noted in the NPRM, the FAA adopts flight hazard area regulations for waterborne vessels consistent with past waivers that the FAA granted to ensure they align with current practices at the Federal launch ranges, where most commercial launches take place currently. Recent experience from commercial and U.S. Government launch and reentry operations demonstrates that the requirements adopted eliminate unnecessary launch delays while ensuring that the overall level of safety provided to the public remains consistent with the public risk criteria in § 450.101. The FAA notes that the application of a risk management approach to ensure the safety of people in waterborne vessels is consistent with recommendations made by the National Academy of Sciences.^[128] The FAA finds that public safety is not compromised by changing 99.7 percent containment to 97 percent containment because the overall public risk criteria must also be met, irrespective of the size of the hazard areas. From a policy perspective, the final rule approach to protect people in waterborne vessels achieves the goal of common standards for launches from any U.S. launch site, Federal or non-Federal. Both industry and the National Space Council have urged government agencies involved in the launch and reentry of vehicles by commercial operators to work towards common standards.

Boeing also requested clarification on how containment boxes for nominal impacts can use the same standard as hazard areas intended to contain debris in the much less likely event of a failure. The FAA notes that planned hazardous debris impacts must use a probability of 1 in the analysis in accordance with § 450.133(a)(6), while hazardous debris impacts due to a failure will have a probability applied as determined from the § 450.131 probability of failure analysis.

The FAA adopts § 450.133(b)(2), (c)(2), and (d)(2) as proposed. These sections use probability of impact contours or probability of casualty contours to meet the risk requirements in § 450.101 for sea, land, and air.

Blue Origin commented that the intent of these requirements seems to be to establish hazard areas for normal operations and mishaps, but the requirements do not explicitly state that the risk criteria applies to malfunction trajectories. Blue Origin proposed that the FAA should specify that risk contours should be conducted for malfunction trajectories.

The FAA notes the proposed requirement in § 450.133(a) that a flight hazard area analysis must account for all reasonably foreseeable vehicle response modes during nominal and non-nominal flight that could result in a casualty also specified that the risk contours required in proposed § 450.133(e)(2)(iii) through (v) must account for malfunction trajectories. However, the FAA revises the requirement to state in § 450.133(a)(1) that the flight hazard area analysis must account for the regions of land, sea, and air potentially exposed to hazardous debris generated during normal flight events and “all reasonably foreseeable failure modes,” which includes malfunction trajectories. In addition, the FAA revises the risk contour requirement in § 450.133(e)(2)(iii), which is explained below in the discussion on that requirement. The FAA notes that the High-Fidelity FSA Methods AC describes one acceptable methodology for flight hazard areas, which accounts for malfunction trajectories.

Virgin Galactic commented that requirements for waterborne vessels should also be in § 450.101. The FAA notes that the operator must meet individual and collective risk requirements, as stated in § 450.101. People on waterborne vessels are included in the collective and individual risk calculations. However, as explained in the NPRM, operators have the option to use the current approach in part 417 as a means of compliance, which requires surveillance to ensure no ship is exposed to more than 1 × 10⁻⁵ probability of impact, because that will be generally sufficient to ensure compliance with § 450.101.

In § 450.133(e)(1), the FAA proposed that the applicant submit a description of the methodology to be used in the flight hazard area analysis including all assumptions and justifications for the assumptions, vulnerability models, analysis methods, and input data. In the final rule, the FAA revises this requirement by adding that the analysis must be done in accordance with § 450.115(c) to avoid replication of requirements and ensure consistency throughout subpart C of part 450.

In § 450.133(e)(1)(i), the FAA proposed that an applicant provide input wind data and justification in the application. The FAA did not adopt this proposal in the final rule. Rather, the FAA deletes proposed § 450.133(e)(1)(i) because this application requirement is covered in § 450.117(c). Section 450.117(c) accounts for all atmospheric conditions that have an effect on the trajectory, including worst case atmospheric profile conditions under which flight might be attempted.

In § 450.133(e)(2), the FAA proposed that an applicant submit tabular data and graphs of the results of the flight hazard area analysis, including in § 450.133(e)(2)(iv) and (v) the following: if applicable, representative 1 × 10^−[5] and 1 × 10^−[6] probability of impact contours for all debris capable of causing a casualty to persons on a waterborne vessel regardless of location; and representative 1 × 10^−[6] and 1 × 10^−[7] probability of impact contours for all debris capable of causing a casualty to persons on an aircraft regardless of location.^[129]

Blue Origin commented that, by requiring 1 × 10⁻⁶ and 1 × 10⁻⁷ risk contours for waterborne vessels and aircraft, respectively, the FAA was extending application requirements beyond those either currently codified in part 400 or proposed in part 450.

The FAA notes that, as stated in the NPRM preamble, these contours are necessary for the applicant to demonstrate to the FAA sufficient computational resolution and analysis fidelity for the results that are critical to public safety. Thus, the FAA declines to adopt the recommended change. For these reasons, the FAA adopts § 450.133(e)(2)(iv) and (e)(2)(v) as proposed.

In § 450.133(e)(2)(iii), the FAA proposed that an applicant would be required to submit representative individual probability of casualty contours regardless of location.

Virgin Galactic requested clarification on the meaning of the term “regardless of location.” Based on the context in proposed § 450.133(a), which required the flight hazard area analysis to identify any region of land, sea, or air that must be surveyed, publicized, controlled, or evacuated in order to control the risk to the public, the term “regardless of location” referred to whether the contours are on land, sea, or air. In the final rule, the FAA changes the term “regardless of location” to “for all locations specified in paragraph (a)” for more specificity. The FAA further specifies that “representative probability of casualty contours” must account for both neighboring operations personnel (at the 1 × 10⁻⁵ probability of casualty level) and other members of the public (at the 1 × 10⁻⁶ probability of casualty level). Hence, the requirement in § 450.133(e)(2)(iii) of the final rule specifies that representative individual probability of casualty contours include tabular data and graphs showing the hypothetical location of any member of the public that could be exposed to a probability of casualty of 1 × 10⁻⁵ or greater for neighboring operations personnel, and 1 × 10⁻⁶ or greater for other members of the public, given all foreseeable conditions within the flight commit criteria.

The FAA adds this explicit language to the application requirement to reflect what is necessary to demonstrate compliance with the substantive requirements for flight hazard area analysis as proposed in the NPRM and as set forth in the final rule. Specifically, the substantive requirements proposed in § 450.133(b)(2) and (c)(2), which required an operator to determine the areas of water and land where the individual probability of casualty for any person on a vessel or on land would exceed the criterion in § 450.101(a)(2) or (b)(2), would necessarily have required a demonstration consistent with the revised application requirements.

u. Debris Risk Analysis (§ 450.135)

In the NPRM, the FAA proposed to require that a debris risk analysis be performed to determine whether the individual and collective risk of public casualties meet the safety criteria in § 450.101. The debris risk analysis would be required to compute statistically-valid debris impact probability distributions using the input data produced by FSAs required in proposed §§ 450.117 through 450.133. In the final rule, the FAA adopts § 450.135 with revisions.

Proposed § 450.135(a) stated that a debris risk analysis would be required to demonstrate compliance with safety criteria in proposed § 450.101, either prior to the day of the operation, by accounting for all foreseeable conditions within the flight commit criteria or during the countdown using the best available input data. The FAA adopts § 450.135(a) with revisions. Specifically, the FAA adds in § 450.135(a)(2) that the “best available input data” used during the countdown must include any applicable “flight commit criteria and flight abort rules” if such controls are necessary to ensure compliance with the public risks as required in proposed and final § 450.165(b).

There is no additional burden on the operator due to the updated language in § 450.135(a)(2), because this requirement is consistent with the proposed requirements in §§ 450.135(e)(1) and 450.165(b)(2). An operator is required to account for and identify the conditions immediately prior to enabling the flight of a launch vehicle or the reentry of a reentry vehicle that are necessary to demonstrate compliance with the safety criteria in § 450.101, such as the atmospheric conditions and any other commit criteria. The final rule in § 450.135(a)(2) now explicitly acknowledges that a valid debris risk analysis must account for any applicable flight commit criteria and flight abort rules when the operator establishes if the present conditions produce public risks consistent with the safety criteria in § 450.101.

In § 450.135(b), the FAA proposed performance-based requirements to address the physical phenomena that influence the propagation of debris, which the analysis would be required to account for to compute the probability of impact of debris on people and critical assets. In the final rule, the FAA adopts and moves these requirements with revisions to § 450.121(c), as discussed in the section of this preamble on Debris Analysis. There were two reasons for moving the proposed propagation of debris requirements in § 450.135(b) to § 450.121(c). First, the computation of valid impact probability distributions is relevant to more than the debris risk analyses; for example, valid impact probability distributions are necessary for the development of flight hazard areas and the yield-probability pairs used as input to the far-field overpressure analysis. Second, although the relationships between the FSA sections are complex and interdependencies exist, the FAA sought to lay out the FSA requirements in a sequential order.

In § 450.135(c), the FAA proposed the features of a valid population exposure analysis. In the final rule, the FAA adopts and moves these requirements with revisions to § 450.123, as discussed in the preamble associated with that section. As noted, the FAA moved the population exposure analysis requirements out of the proposed debris risk analysis section because a population exposure analysis must also be used to provide input to other public risk analyses to address toxic hazards and far-field overpressure blast effects, if any. As discussed earlier, this is not an expansion of the scope because the NPRM identified the need for population exposure input to address toxic hazards for flight and far-field overpressure blast effects.

In proposed § 450.135(d), the FAA set forth the features of a valid casualty area and consequence analysis. Proposed § 450.135(d) stated that a debris risk analysis would be required to model the casualty area and compute the predicted consequences of each reasonably foreseeable vehicle response mode in any one-second period of flight in terms of CE_C. The NPRM also specified that the contents of a casualty area and consequence analysis must account for, at a minimum, the items proposed in § 450.135(d)(1) through (d)(3).^[130]

In the final rule, the FAA revises and re-designates the requirements proposed in § 450.135(d) to § 450.135(b). In addition, the FAA replaces the term “vehicle response mode” with “failure mode,” consistent with similar changes made throughout the final rule and discussed further in § 450.101(c)(2) of this preamble. The FAA also replaces the term “one-second period of flight” with “significant period of flight,” as discussed in the preamble section associated with high consequence event protection.

In the NPRM, the FAA included a definition of “casualty area” in § 401.5, defined as the area surrounding each potential debris or vehicle impact point where serious injuries, or worse, can occur. The FAA adopts this definition as proposed.

SpaceX commented the FAA should modify proposed § 450.135(d) to require that the casualty area and consequence analysis not only account for the items in proposed § 450.135(d)(1) through (d)(3) but also model them conservatively. The FAA notes that the term “account for” already includes using conservative data or assumptions for all inputs and results of an analysis, pursuant to § 450.101(g). Thus, this change would be redundant.

As previously discussed, the requirements for debris propagation in § 450.135(b) have been relocated in the final rule to § 450.121(c). As a result, the FAA adds a requirement in § 450.135(b)(2) that a casualty area and consequence analysis must account for statistically-valid debris impact probability distributions. This requirement is derived from the requirements in proposed § 450.135(b). The FAA notes that without statistically-valid impact probability distributions it would be impossible to compute the predicted consequences of each reasonably foreseeable failure mode in any significant period of flight in terms of conditional expected casualties, as required in proposed § 450.135(d) and § 450.135(b) of the final rule, because the consequence of any failure depends on the characteristics of the debris (such as the casualty area) predicted to impact exposed populations. Thus, the FAA finds the final rule is consistent with the NPRM in requiring this information as part of a debris risk analysis.

In the NPRM, the FAA proposed to require that the casualty area and consequence analysis account for any direct impacts of debris fragments, intact impact, or indirect impact effects, in proposed § 450.135(d)(2). It also proposed that the analysis account for the vulnerability of people and critical assets to debris impacts including all hazard sources, such as the potential for any toxic or explosive energy releases, in proposed § 450.135(d)(3)(ii) and indirect or secondary effects such as bounce, splatter, skip, slide or ricochet, including accounting for terrain, in proposed § 450.135(d)(3)(iii).

In the final rule, the FAA consolidates the three proposed requirements into § 450.135(b)(3). Section 450.135(b)(3) more simply states that the analysis must account for “any impact or effects of hazardous debris,” because the new definition of “hazardous debris” in § 401.7 reflects the scope of the NPRM requirements. In the final rule, the use of the defined term “hazardous debris” in § 450.135(b)(3) replaces the requirement in proposed § 450.135(d)(3)(ii) to account for all hazard sources, such as the potential for any toxic or explosive energy releases. It also replaces the requirement in proposed § 450.135(d)(2) to account for any direct impacts of debris fragments, intact impact, or indirect impact effects. Also, the final rule uses the phrase “any impact or effects” of hazardous debris to replace the proposed requirements to account for any direct or indirect effects, including indirect or secondary effects such as bounce, splatter, skip, slide, or ricochet, including accounting for terrain. The FAA's use of the defined term hazardous debris, discussed previously, allows for consistency throughout the final rule with regard to the scope of the FSA requirements. This revision does not change the scope of the proposed requirements because the definition includes the concept of all hazard sources and the direct impacts of debris fragments, intact impact, or indirect impact effects.

In the NPRM, the FAA required in proposed § 450.135(d)(3) that the analysis account for the vulnerability of people and critical assets to debris impacts. In the final rule, the FAA moves proposed § 450.135(d)(3) as § 450.135(b)(4) and strikes the reference to critical assets, as explained in the preamble section on critical assets. The FAA also re-designates and adopts proposed § 450.135(d)(3)(i) as § 450.135(b)(4)(i) in the final rule. As discussed, the proposed requirements in § 450.135(d)(3)(ii) and (d)(3)(iii) are captured in § 450.135(b)(3) in the final rule.

In the NPRM, the FAA proposed in § 450.135(d)(3)(iv) that the analysis must account for the effect of wind on debris impact vector and toxic releases. In the final rule, the FAA re-designates proposed § 450.135(d)(3)(iv) as § 450.135(b)(4)(ii). The FAA also revises the requirement so that the analysis must account for the effect of atmospheric conditions on debris impact and effects known to influence the vulnerability of people to hazardous debris impacts. For example, wind can typically have a pronounced effect on the debris impact vector as illustrated in the FAA FSA Handbook. In addition, other atmospheric conditions, such as the presence of a temperature inversion can have a significant effect on the vulnerability of people to toxic releases.^[131]

The change from the proposed § 450.135(d)(3)(iv) implemented in the final rule in § 450.135(b)(4)(ii) does not create any additional burden to the operator because this requirement is consistent with the proposed requirements in §§ 450.135(e)(1) and 450.165(b)(2). An operator is required to account for and identify the conditions immediately prior to enabling the flight of a launch vehicle or the reentry of a reentry vehicle that are necessary to demonstrate compliance with the safety criteria in § 450.101, such as the atmospheric conditions and any meteorological conditions. Furthermore, given the proposed requirement in § 450.135(d)(vi) to account for the uncertainty in fragment impact parameters in assessing the vulnerability of people to debris impacts, an operator already would have contemplated the need to account for the effect of atmospheric conditions on debris impact effects now explicitly required under § 450.135(b)(4)(ii).

In the NPRM, proposed § 450.135(d)(3)(vi) specified that the analysis account for uncertainty in fragment impact parameters. In the final rule, the FAA re-designates proposed § 450.135(d)(3)(vi) as § 450.135(b)(4)(iv). The FAA also requires in the final rule that the analysis account for uncertainty in the input data, such as fragment impact parameters. Although the uncertainty in fragment impact parameters typically has a pronounced effect, it is conceivable that uncertainties in the input data more generally could affect the vulnerability of people to hazardous debris effects. The FAA finds these changes consistent with the proposed and final requirements in § 450.115(b)(1) that an operator's FSA method must have a level of fidelity sufficient to account for all known sources of uncertainty.^[132]

In the NPRM, proposed § 450.135(e) listed the application requirements associated with the debris risk analysis, including the casualty area and consequence analysis. Proposed § 450.135(e)(1) required an applicant to submit a description of the methods used to compute the parameters required to demonstrate compliance with the safety criteria in proposed § 450.101, including a description of how the operator would account for the conditions immediately prior to enabling the flight of a launch vehicle or the reentry of a reentry vehicle, such as the final trajectory, atmospheric conditions, and the exposure of people and critical assets.

In the final rule, the FAA re-designates and adopts proposed § 450.135(e)(1) as § 450.135(c)(1) with revisions. The FAA removes the proposed requirement to submit a description of the methods “used to compute the parameters” required to demonstrate compliance with the safety criteria in § 450.101. Instead, the FAA replaces this requirement with a requirement to submit a description of the methods used to demonstrate compliance with the safety criteria in § 450.101, in accordance with § 450.115(c). This change is consistent with other FSA sections. Also, the FAA strikes the reference to critical assets as explained in the preamble section associated with critical assets.

In the NPRM, the application requirements in § 450.135(e)(2) addressed the methods used to compute debris impact distributions. In the final rule, the FAA moves proposed § 450.135(e)(2) to § 450.121(d)(3). Proposed § 450.135(e)(3) and (e)(4) addressed population exposure data. In the final rule, those requirements are moved to § 450.123(c). These changes are described in the preamble sections associated with those sections.^[133]

The FAA moves the application requirements in proposed § 450.135(e)(8)(i) through (iii) regarding the collective and individual debris risk outputs to § 450.135(c)(5)(i) through (iii) and removes the proposed requirement to report critical asset results in § 450.135(e)(8)(iv), as discussed further in the critical asset section of this preamble.

The FAA revises and re-designates the application requirements in proposed § 450.135(e)(9) on the collective and individual debris risk outputs as § 450.135(c)(6). The FAA replaces the term “vehicle response mode” with “failure mode.” This revision is consistent with changes throughout the final rule. The FAA also changes the term “one-second interval” to “significant period,” as explained in the preamble section on CE_C.

SpaceX commented that it was not clear why proposed § 450.135(e)(8) and (9) would require debris risk analysis to include both representative conditions and the worst foreseeable conditions, arguing that if the worst foreseeable conditions meet requirements, then representative conditions are of no consequence. The FAA responds that, for the purposes of § 450.135(c)(5) and (c)(6), worst foreseeable conditions means those conditions that produce the highest individual, collective, and conditional risks under which the operator would initiate the launch or reentry. An operator can submit the same debris risk analysis results for representative conditions and the worst foreseeable conditions in cases where there is no difference between representative conditions and the worst foreseeable conditions that are significant to public safety.

However, the FAA foresees the potential for situations where the differences between the representative conditions and the worst foreseeable conditions would require additional operational mitigations. An example would be running the debris risk analysis using input data for atmospheric conditions that lead to risks just below the limits set in § 450.101 (i.e., worst foreseeable conditions) and running the debris risk analysis using more typical atmospheric conditions that produce risks clearly below the limits. Under the worst foreseeable conditions, the collective risk results for people on land could be such that the operator would need to perform additional surveillance of areas to ensure the absence of waterborne vessels, whereas under representative conditions such surveillance would not be necessary to ensure compliance with collective risk limits in § 450.101(a)(1) and (b)(1). The FAA does not anticipate that there will be significant additional burden in providing the analysis for representative conditions.

v. Far-Field Overpressure Blast Effect Analysis, or Distant Focus Overpressure (DFO) (§ 450.137)

In the NPRM, § 450.137 proposed requirements for far-field overpressure blast effects analysis. Proposed § 450.137(a) required that a far-field overpressure blast effect analysis demonstrate compliance with safety criteria in proposed § 450.101 either prior to the day of the operation, accounting for all foreseeable conditions within the flight commit criteria, or during the countdown using the best available input data. In the final rule, the FAA adopts § 450.137(a) with one revision.

The final rule in § 450.137(a)(2) specifies that far-field overpressure analysis performed during the countdown using the best available input data must also include flight commit criteria and flight abort rules. The FAA notes that the best available input data specified in proposed § 450.137(a)(2) would naturally include flight commit criteria and flight abort rules because those would generally have a significant influence on the public risks posed by hazardous debris effects. Hence, the phrase “including flight commit criteria and flight abort rules” is consistent with the requirement for a debris risk analysis in § 450.135(a)(2).

Virgin Galactic commented that § 450.137(a)(1) appeared to require an FSA the day before launch for the portion of its launches involving its carrier aircraft's captive carriage of the spaceship. Virgin Galactic expressed a concern about the operational impact and additional workload of a day of launch analysis. Microcosm requested clarification on whether the regulations required a day of launch analysis if meteorological conditions did not present an environment conducive to far-field overpressure.

Section 450.137(a)(1) does not require a full FSA the day before launch. Instead, § 450.137(a) requires the far-field overpressure blast effect analysis be performed either as a “screening” analysis prior to the day of the operation, accounting for all foreseeable conditions within the flight commit criteria, or during the countdown using the best available input data. The requirement in § 450.137(a)(1) does not have a time constraint for when the “screening analysis” must be completed. In response to Microcosm's comment, the FAA notes that, in order to determine that local meteorological conditions do not present an environment conducive to far-field overpressure, an operator would necessarily be required to perform an analysis under § 450.137(a)(1). As such, § 450.137(a)(1), as proposed and adopted without change, allows an operator to demonstrate that a far-field overpressure analysis need not be performed during the countdown if the flight commit criteria are sufficient to ensure compliance with § 450.101.

In the NPRM, the FAA proposed requirements associated with analysis constraints in § 450.137(b) that set required performance outcomes and the specific factors that a far-field overpressure blast effect analysis must consider. Blue Origin commented that the proposed requirements in § 450.137(b) were prescriptive. The FAA agrees that the proposal was unnecessarily specific in § 450.137(b)(3) through (5) and revises these requirements.

In the NPRM, § 450.137(b)(3) proposed that the analysis account for the explosive capability of the vehicle at impact and at altitude, and potential explosions resulting from debris impacts, including the potential for mixing of liquid propellants. In the final rule, the FAA revises the language in proposed § 450.137(b)(3) and relocates it to § 450.137(b)(1) to reflect the order in which the FAA expects the analysis will be conducted. As rewritten, § 450.137(b)(1) in the final rule requires the analysis to account for the explosive capability of the vehicle and hazardous debris at impact and at altitude. As discussed previously, the FAA uses the definition for “hazardous debris” to reflect the scope of the NPRM requirements. The final rule also removes the phrase “potential for mixing of liquid propellant” because it is redundant with “explosive capability,” which is already included in the requirement. The FAA has also removed reference to solid propellant impacts because they are part of the explosive capability.

In the NPRM, proposed § 450.137(b)(1) required that the analysis account for the potential for distant focus overpressure or overpressure enhancement given current meteorological conditions and terrain characteristics. In the final rule, the FAA re-designates proposed § 450.137(b)(1) as § 450.137(b)(2). The FAA also requires in § 450.137(b)(2) that the analysis must account for the influence of meteorological conditions and terrain characteristics. The FAA notes meteorological conditions are known to have a potentially substantial influence on the propagation and attenuation of blast waves with peak incident overpressures at or below 1.0 psi. In the final rule, the FAA removes the reference to current meteorological conditions in proposed § 450.137(b)(1) to reflect that an applicant may use a screening analysis pursuant to § 450.137(a)(1) to demonstrate additional analysis is not required by accounting for all foreseeable conditions within the flight commit criteria.

In the NPRM, proposed § 450.137(b)(2) required that the analysis account for the potential for broken windows due to peak incident overpressures below 1.0 psi and related casualties. In the final rule, the FAA re-designates proposed § 450.137(b)(2) as § 450.137(b)(3) and adds the essential elements from proposed § 450.137(b)(4) through (b)(6). Those sections contained unnecessary details regarding shelter types, time of day, characteristics of potentially affected windows including size, location, glazing material, and characteristics of potential glass shards.

Section 450.137(b)(3) removes these details and captures the concept of the requirements proposed in § 450.137(b)(4) through (b)(6) by adding language to reflect that the potential for broken windows due to peak incident overpressures below 1.0 psi and related casualties must “be based on the characteristics of exposed windows and the population's susceptibility to injury, with considerations including, at a minimum, shelter types, window types, and the time of day of the proposed operation.”

Blue Origin commented that the constraints could be accomplished by an analysis tool available only to the government. The FAA disagrees that the far-field overpressure analyses can only be accomplished using a tool available to the U.S. government. Currently available materials contain a detailed technical description of a valid approach.^[134] Furthermore, the FAA confirms that the analysis tool in use by the U.S. government has been used by the U.S. commercial space transportation industry at non-Federal sites as well.

The FAA adopts § 450.137(c) with only two minor modifications. In the NPRM, § 450.137(c)(6) explicitly identified that an applicant would be required to submit the analysis results given foreseeable meteorological conditions, yields, and population exposures.

In the final rule, § 450.137(c)(6) requires that the application include the individual risk data given foreseeable conditions. The FAA also revises § 450.137(c)(7) in this manner. The FAA notes generally that the same elements of the foreseeable conditions listed in the NPRM influence the results of the far-field overpressure blast effects analysis. Thus, the reworded final rule maintains the same scope and intent of the NPRM application requirements. The FAA adds this language because the proposal was unnecessarily limited.

w. Toxic Hazards (§§ 450.139 and 450.187)

In the NPRM, the FAA proposed to consolidate requirements for toxic release analysis into two performance-based regulations: §§ 450.139 (Toxic Hazards for Flight) and 450.187 (Toxic Hazards Mitigation for Ground Operations). Although the two proposed sections contained a number of similarities, the FAA divided them into two sections because ground operations and flight operations had different proposed criteria to establish an acceptable level of public safety.

Proposed §§ 450.139(a) and 450.187(a) made the sections applicable to any launch or reentry vehicle, including all vehicle components and payloads, that use toxic propellants or other toxic chemicals.

Virgin Galactic requested that the FAA create an exception to §§ 450.139 and 450.187 for carrier aircraft on hybrid systems that already possess a standard airworthiness certificate or experimental airworthiness certificate from FAA, as these aircraft most commonly carry jet fuel. Virgin Galactic commented that, although jet fuel may be considered a toxic substance, it is carried by thousands of aircraft every day and thus performing a toxic release hazard analysis for jet fuel would not have a material effect on public safety.

The FAA acknowledges that, historically, no toxic release hazard analysis has been required for kerosene-based fuels, such as jet fuel, and agrees that such an analysis would be unnecessary in most instances. Therefore, in the final rule, the FAA revises the applicability language in §§ 450.139(a) and 450.187(a) to create an exception from the toxic release hazard analysis for kerosene-based fuels unless the Administrator determines that an analysis is necessary to protect the public safety. The FAA anticipates that such an analysis will be required for uses of kerosene-based fuels that are novel or inconsistent with standard industry practices. The FAA will work with operators during pre-application consultation to identify any kerosene-based propellants requiring a toxic release hazard analysis under §§ 450.139 or 450.187.

Proposed § 450.139(b) required an operator to conduct a toxic release hazard analysis and manage the risk of casualties from exposure to toxic release either through containing hazards in accordance with proposed § 450.139(d) or by performing a toxic risk assessment, under proposed § 450.139(e), that protects the public consistent with the safety criteria proposed in § 450.101. Furthermore, proposed § 450.139(b)(3) required an operator to establish flight commit criteria based on the results of its toxic release hazard analysis, containment analysis, or toxic risk assessment for any necessary evacuation of the public from any toxic hazard area. The FAA adopts § 450.139(b) as proposed.

In the NPRM, paragraph (b) was inadvertently omitted from the regulatory text to § 450.187; however, the preamble discussed that proposed § 450.187(b) would, like proposed § 450.139(b), require an operator to manage the risk of casualties from exposure to toxic release by either containing the hazards or performing a toxic risk assessment. The preamble stated that for ground operations, an operator using a toxic risk assessment must demonstrate compliance with proposed § 450.109(a)(3), rather than § 450.185(c).^[135] The FAA adds paragraph (b) to § 450.187 in the final rule. As discussed later in this section, the FAA revises the toxic risk assessment criteria for ground operations by replacing the reference to proposed § 450.109(b)(3) with a reference to § 450.185(c). The FAA also revises § 450.139(b)(3) to refer to “toxic containment,” rather than a “toxic containment analysis,” as this term does not appear in the regulation.

Proposed §§ 450.139(c) and 450.187(b) set forth the requirements for toxic release hazard analysis. The FAA adopts the substance of those provisions in the final rule, but re-designates proposed § 450.187(b) as § 450.187(c), to account for the addition of new § 450.187(b).

As noted, §§ 450.139(b) and 450.187(b) in the final rule require an operator to manage the risk of casualties that could arise from the exposure to toxic release through toxic containment or by using a toxic risk assessment. Toxic containment, as proposed in §§ 450.139(d) and 450.187(c), required an operator to manage the risk of casualty from the exposure to toxic release either by evacuating, or being prepared to evacuate, the public from a toxic hazard area, or by employing meteorological constraints. In either scenario—evacuation or employment of meteorological constraints—the operator would be required to demonstrate that an average member of the public would not be exposed to greater than one percent conditional individual probability of casualty in the event of a worst-case release or maximum credible release scenario. The FAA received a formal comment from NASA during the interagency review on proposed § 450.139(d) and § 450.187(c). The FAA revised these provisions in the final rule consistent with the updated definition of toxic hazard area described below. Specifically, § 450.139(d)(1) and § 450.187(c)(1) require an operator using toxic containment to manage the risk of casualty from the exposure to toxic release either by evacuating, or being prepared to evacuate, the public from any toxic hazard area. These revisions are consistent with current practice. The FAA also re-designates proposed § 450.187(c) as § 450.187(d) to account for the addition of new § 450.187(b).

The FAA proposed to define “toxic hazard area” in § 401.5 (§ 401.7 in the final rule) as “a region on the Earth's surface where toxic concentrations and durations may be greater than approved toxic thresholds for acute casualty, in the event of a release during launch or reentry.”

In the final rule, the FAA revises the proposed definition of “toxic hazard area” to include the language from proposed §§ 450.139(d) and 450.187(c) regarding the “a worst-case toxic or maximum credible release scenario.” Thus, in the final rule, a “toxic hazard area” means “a region on the Earth's surface where toxic concentrations and durations may be greater than accepted toxic thresholds for acute casualty in the event of a worst-case toxic or maximum credible release scenario during launch or reentry.” The FAA revises this definition to ensure that the toxic hazard area is consistent whether the operator performs a toxic risk assessment or toxic containment. The revised definition of “toxic hazard area” is consistent with the approach taken in current regulation in Appendix I to part 417 under I417.5(c), which directly links the toxic concentration thresholds to the size of the toxic hazard area. The FAA anticipates that the toxic concentration thresholds used in an accepted means of compliance for §§ 450.139 and 450.187 will generally be consistent with those in Appendix I to part 417 under I417.5(c).

The final rule's requirements for a toxic risk assessment under § 450.139(e) are unchanged from the proposal. A toxic risk assessment must meet the safety criteria of § 450.101 and account for: Airborne concentration and duration thresholds of toxic propellants or other chemicals; physical phenomena expected to influence any toxic concentration and duration; the toxic hazard area and the meteorological conditions involved; and all members of the public that may be exposed to the toxic release.

In the final rule, § 450.187(e), which contains the requirements for a toxic risk assessment for ground operations, includes one revision from the proposal. As mentioned, proposed § 450.187(d) required an operator using toxic risk assessment to manage the risk from any toxic release hazard and demonstrate compliance with the criteria in § 450.109(a)(3). The FAA replaces the reference to proposed § 450.109(a)(3) with a reference to § 450.185(c) because the flight hazard analysis risk criteria were removed from § 450.109. The standard in § 450.185(c) is the same as in proposed § 450.109(a)(3); therefore, there is no substantive change in the criteria. As a result, an operator complies with the requirements for a toxic risk assessment by demonstrating no more than an extremely remote likelihood of toxic exposure causing death or serious injury to the public, using toxic concentration and duration thresholds accepted by the Administrator as a means of compliance.

In the final rule, the FAA amends the application requirements proposed in §§ 450.139(f) and 450.187(e). Although proposed §§ 450.139(d) and 450.187(c) detailed the two ways in which an operator could perform toxic containment, the NPRM did not specify how an operator would demonstrate compliance with the toxic containment requirements in their application. In the final rule, the FAA adds an application requirement for toxic containment, in §§ 450.139(f)(8)(i) and 450.187(f)(8), which reflects the substantive requirements for performing toxic containment. That is, if toxic containment is selected, the applicant must identify the evacuation plans or meteorological constraints and associated launch commit criteria or ground hazard controls that it will employ to ensure that the public will not be within a toxic area in the event of a worst-case or maximum credible release scenario. The FAA notes that an applicant will need to submit the information required by this subsection in order to demonstrate compliance with the substantive requirements for toxic containment in §§ 450.139(d) and 450.187(c).

The FAA revises the application requirements, in §§ 450.139(f)(8)(ii) and 450.187(f)(9), to reflect the substantive requirements of toxic risk assessment. If a toxic risk assessment is performed, then the applicant must account for the public that may be exposed to airborne concentrations above the toxic concentration and duration thresholds, describe any risk mitigations applied in the toxic risk assessment, describe the population exposure input data used in accordance with § 450.123 (Population Exposure Analysis), and demonstrate compliance with the applicable public risk criteria (for flight, the risk criteria in § 450.101; for ground operations, the risk criteria in § 450.185(c)). Lastly, the FAA replaced the term “population density” with “population characteristics” in § 450.139(f)(8)(ii)(2) and § 450.187(f)(9)(ii) because characteristics other than density (e.g., vulnerability of population) would be relevant to assessing potential effects of toxic release, as indicated by the Population Exposure Analysis criteria in § 450.123.

Blue Origin commented that toxic risk analysis tools were not currently available to operators, and that, unless the FAA facilitated access to these tools, a sole-source provider of this service may arise. One individual commenter asked what dispersion models were acceptable to the FAA and commented that the FAA should provide specific examples of allowable and acceptable toxic release and dispersion mitigations.

The FAA disagrees that the tools needed to analyze risks associated with a potential release of toxic substances during launch or reentry are not currently available to operators. However, the FAA will issue an AC entitled, “Toxic Hazards for Flight,” that will provide guidance and examples of publicly available tools for conducting the required toxic release hazard analyses, as well as a toxic risk assessment and toxic containment. This guidance will include information on:

• Determining the airborne toxic concentration threshold or level of concern (LOC) for each toxic propellant or toxic combustion by-product;
• Determining the worst-case quantity of any toxic release that might occur during the proposed flight of a launch vehicle, or that might occur in the event of a flight mishap;
• Determining the worst-case quantity of any toxic release that might occur during normal launch processing, and that might occur in the event of a mishap during launch processing;
• Characterizing the terrain, as a precursor for modeling the atmospheric transport of a toxic release from its source to downwind receptor locations;
• Determining the meteorological conditions for the atmospheric transport of any toxic release from its source to downwind receptor locations;
• Performing air quality dispersion modeling to predict concentrations at selected downwind receptor locations (by characterizing the atmospheric processes that disperse a toxic substance emitted by a source); and
• Determining the population density in receptor locations that could potentially be identified by air quality dispersion modeling as toxic hazard areas.^[136]

x. Computing Systems (§ 450.141)

In the NPRM, the FAA proposed in § 450.111 (Computing Systems and Software) to require operators to develop a process that identifies and assesses hazards to public safety and the safety of property arising from computing systems and software. Operators would have needed to identify all safety-critical functions associated with its computing systems and software and to classify software based on degree of autonomy. In the NPRM, software safety requirements would have increased in rigor with the rise in the degree of autonomy of the software. Conversely, software safety requirements would have decreased in rigor with reductions in the software's degree of autonomy.

In the final rule, the FAA revises proposed § 450.111 and re-designates it as § 450.141 (Computing Systems). Although the scope of the requirements for operators under § 450.141 does not differ substantially from the proposed version, the FAA replaces prescriptive requirements with performance-based standards and provides increased flexibility for operators to demonstrate compliance with § 450.141. The final rule levies requirements for computing system safety items in proportion to their criticality rather than their autonomy; requires independent verification and validation for safety-critical computing system safety items; and retains the NPRM's focus on development and testing processes instead of direct inspection of software by the FAA. The FAA removed the term, “software,” from the section heading since “computing systems” would include software. The FAA also removes the definition of “control entity” proposed in § 401.5 because the term is no longer used in the final rule.

A number of commenters stated the requirements proposed in § 450.111 were overly prescriptive or difficult to meet. SpaceX stated that the proposed software process would be more burdensome and costly for applicants than it had been under current regulations and would prevent applicants from utilizing safer methods to construct a safety case. Blue Origin and SpaceX argued the proposed requirement would hinder technological advances that could improve safety. Blue Origin stated the proposal threatened innovation towards lower cost, higher quality, and safer software approaches, but did not specify the approaches that would be impeded by the NPRM. Rocket Lab similarly asserted that the proposal would hinder the development of software for FSS, the automation of which is currently a major area for innovation. Rocket Lab commented that the proposal did not allow flexibility to use other means of functional system safety from equivalent industries or government standards, and that the requirements would become quickly outdated as software technologies and best practices evolve. CSF also viewed the proposal as highly prescriptive and uneconomical for the FAA or for industry.

CSF and SpaceX specifically rejected the degree of autonomy approach proposed in § 450.111, noting that human involvement did not always produce a safer system. CSF suggested the FAA scale the levels of rigor based on hazard effects and architectural mitigations. Virgin Galactic stated that software need not be categorized by levels of consequence and degrees of control if the software development process was linked to a system safety program.

The FAA agrees that some of the requirements proposed in § 450.111 were too prescriptive, potentially overly burdensome, and could have the effect of discouraging technological innovation to improve safety.^[137] The FAA also agrees with the commenters' discussion of the limitations of autonomy as a criterion for level of rigor. In the final rule, the FAA revises the requirements for computing systems, which are now located in § 450.141 to address the commenters' concerns. Section 450.141 scales level of rigor for computing system requirements based on system-level criticality rather than on degree of autonomy, and is designed to parallel the requirements of computing system safety responses to the existing regulations. The existing regulations require plans for software development and validation and verification plans but remain silent on the acceptable content of those plans. The final rule requirements are designed to align with current software safety submissions. The FAA also removes prescriptive requirements from § 450.141, as detailed in the following paragraphs, to increase flexibility in application to current and future computing system designs.

Section 450.141 requires the identification and assessment of the public safety-related computing system requirements, functions, and data items, in order to streamline the evaluation of computing system safety. The final rule retains the requirement proposed in § 450.111 to identify and assess the public safety implications of computing systems, which derives from the current requirements in §§ 417.123(a) and 431.35(c) to perform this assessment as part of a system safety process. The explicit identification of the public safety related aspects of computing systems enables a reduction in the scope of FAA's evaluation compared to the current regulations.

In the final rule, § 450.141(a) requires an operator to identify computing system safety items, meaning any software or data that implements a capability that could present a hazard to the public, and the criticality of each computing system safety item, commensurate with its degree of control over hazards to the public and the severity of those hazards. For purposes of this section, a computing system safety item is any item that is a computing system or software that has some degree of control over hazards to the public; a computing system that is either a cause of or a mitigation for a hazard that can affect the public. Computing system safety items include not only software, but also software elements, including data, and interfaces that present or control risks to the public (e.g., software/hardware interfaces, and software/human interfaces). The FAA uses the term “computing system safety item” in order to provide a clean interface between software safety, which controls risks due to flaws in logic, and system safety, which controls risk. Software runs on hardware in response to commands and inputs, so a computing system safety item is often more than just software. “Level of criticality” here means the combination of a computing system safety item's importance in the causal chain for a given hazard, which is commensurate to its degree of control, and the severity of that hazard. Computing system safety items that are more influential on a causal chain for a hazard of a given severity would be subject to a proportionally higher level of rigor in development and testing. The degree of control may be evident in (1) a system's tolerance to a given computing system fault, (2) the computing system's autonomy in causing or preventing a hazard, (3) the number and characteristics of other system faults or failures required for the hazard to manifest itself, or (4) some other measure devised by the applicant.

The requirement proposed in § 450.111(c) to allocate development process rigor according to degree of autonomy has been replaced with the requirement in § 450.141(a)(2) to use system-level criticality to set the minimum level of rigor in developing and testing each computing system safety item. The FAA agrees with the comments received on the shortcomings of allocation by degree of autonomy and the recommendation to use a system safety approach to computing system safety. System safety allocates level of rigor according to the criticality of each item in the system, and the revised regulation aligns software and computing system level of rigor allocation with system safety's level of rigor allocation, erasing a difference between the two safety analyses.^[138] For some systems, system-level criticality and degree of autonomy will produce the same or similar allocations of rigor in computing system development. An applicant can propose to use degree of autonomy as a proxy for system-level criticality based on that similarity, as it is an industry standard method of determining level of rigor allocation. This revision achieves the objective stated in the NPRM of tailoring safety requirements based on criticality but eliminates the prescriptive criticality levels proposed in the NPRM. The criticality of each computing system or function must be assessed at the system level so the applicant can clearly demonstrate to the FAA how the system uses computing systems and the influence of each computing system safety item on public safety.

Section 450.141(b) requires an operator to develop safety requirements for each computing system safety item. A safety requirement specifies the implementation of one or more public safety-related functions, capabilities, or attributes in a computing system safety item. The FAA notes that it uses the phrase “safety requirements” in the final rule differently than it did in the NPRM. In the NPRM, “software safety requirements” referred to regulatory requirements for software. In § 450.141 of the final rule, “safety requirements” means computing system requirements that specify computing system attributes or functionality that have public safety significance. Identification of this subset of computing system requirements related to public safety is essential to focus an operator's safety efforts on those parts of the computing system safety item that have public safety consequences. It will also streamline the scope and depth of data required of applicants and the FAA's evaluation process relative to current requirements, to the same extent as proposed § 450.111.

Section 450.141(b)(1) requires an operator to identify and evaluate safety requirements for each computing system safety item. Safety requirements are the subset of requirements that define features, capabilities, or behaviors that have public safety implications. This identification and evaluation process may identify new computing system safety items if safety requirements are identified for items that did not previously have known safety requirements.

Section 450.141(b)(2) requires an operator to ensure the safety requirements are complete and correct. A computing system requirement set is complete if it contains all of the requirements necessary to specify all of the functions and attributes needed for the computing system to perform its required tasks. A computing system requirement is correct if it specifies the correct functionality or attributes for the item to perform its intended system-level functions. This can be accomplished as part of an applicant's normal software and computing system requirement review process. The FAA does not require the applicant to conduct a separate public safety-specific review, provided the applicant's computing system requirement review process accomplishes the intent of § 450.141(b)(2).

Section 450.141(b)(3) requires an operator to implement each safety requirement. That is, the safety requirements reviewed in accordance with § 450.141(b)(2) must be built into the system for verification in § 450.141(b)(4). Requirements are normally implemented by operators, and no special implementation process is required for safety requirements.

Section 450.141(b)(4) requires that the applicant verify and validate the implementation of each safety requirement using a method appropriate for the level of criticality of the computing system safety item. Computing system requirements are normally verified and validated by a combination of testing, analysis, and inspection. The NPRM proposed to require specific testing and verification methods that have not been retained in the final rule due to the removal of specific criticality levels for software. The final rule allows sufficient flexibility for operators to implement methods and levels of rigor appropriate for their operations. For example, a development process that traces from computing system requirements to verification and validation evidence is necessary but may not be the only process for adequate verification and validation; a process that traces from verification and validation tests to the intended computing system functionality may be more appropriate for third-party products. Operators may use many different processes that accomplish traceability as long as the process demonstrates that the verification and validation evidence is sufficient to verify and validate all of the computing system safety requirements.

Section 450.141(b)(4) further specifies that, for each computing system safety item that meets the definition of “safety critical” in § 401.7, verification and validation must include testing by a test team independent of the development division or organization. As defined in § 401.7, a safety-critical item means a system, subsystem, component, condition, event, operation, process, or item, whose proper recognition, control, performance, or tolerance, is essential to ensuring public safety. A safety-critical computing system safety item is a computing system safety item of which proper recognition, control, performance, or tolerance is essential to ensuring public safety. As described in the NPRM, the FAA uses the term “independent” to designate a verification and validation group that has substantial and credible independence from the development team. This independent group has a separate personnel structure through at least senior leadership, operates under distinct performance, technical, schedule, and incentive pressures, and has the latitude to develop and test requirements independently. This independent verification and validation group can be a third party or an in-house group but in either case must have the technical, managerial, schedule, and incentive independence ^[139] to carry out its functions without undue pressure from the development team. The requirement for independent verification and validation of safety-critical computing system safety items is broadly aligned with current practices for verification and validation. Specifically, the minimum expectation is that safety-critical computing systems, such as autonomous FSS, are subjected to a level of verification and validation rigor that can only be achieved by verification and validation staff that are independent of the development organization.

The requirement in proposed § 450.111(b) to identify all safety-critical functions involving software is revised and included in § 450.141(b) of the final rule. Section 450.141(b) requires the applicant to identify all safety requirements performed by computing system safety items, check that the safety requirements are complete and correct, implement the safety requirements, and verify and validate their implementation including independent verification and validation for safety-critical computing system safety items. These regulatory requirements have the net effect of identifying all safety-critical functions involving computing systems, since safety requirements necessarily include all safety-critical functions, capabilities, and attributes of computing systems.

Section 450.141(c) requires operators to implement and document a development process for computing system safety items identified in § 450.141(a) appropriate for the level of criticality of the computing system safety item. The requirement to implement and document such a development process for all computing system safety items is substantially similar to both existing rules and the requirements proposed in § 450.111, except in the final rule the requirement is no longer contained in separate subsections for each level of autonomy (proposed § 450.111(d) through (g)). As explained in the NPRM preamble, the FAA needs to understand the computing system development processes used for each computing system safety item, relative to its effect on public safety, in order to assess computing system safety. The final rule calls for a development “process,” rather than a “plan,” that achieves the same objectives key to a development plan but affords applicants greater flexibility to structure their processes as needed to satisfy § 450.141(c). Operators need not employ a separate development process for each computing system item. However, the development process must be appropriate to the level of criticality of each computing system safety item to which it is applied, and must satisfy the criteria listed in § 450.141(c), at a minimum.

In order to demonstrate that a development process is appropriate to the level of criticality of each computing system safety item, an operator would need to identify the tasks associated with each safety item, along with its processes for reviewing, verifying, and validating computing system safety requirements. Section 450.141(c)(1) requires a development process to define responsibilities for each task associated with a computing system safety item. This requirement derives from the requirement proposed in § 450.111(d)(5) for a software development plan; in order to be acceptable, the development process must assign responsibilities for its execution. This requirement intends to ensure that development tasks for computing system safety items are carried out by defined personnel in the organization, though not necessarily individuals by name.

Under § 450.141(c)(2), a development process must include processes for internal review and approval, including review that evaluates the implementation of all safety requirements, such that no person approves their own work. This is consistent with proposed § 450.111(d)(4), which required independent verification and validation, and proposed § 450.111(d)(5)(i), which required coding standards. Neither of those requirements could be met in absence of a review and approval process that meets § 450.141(c)(2) of the final rule, since acceptable performance of those tasks inherently includes review and approval by a person independent of those who did the work. Software and computing system development is a complex set of actions, and some subsets of those actions are milestones that require review and approval. This requirement means that those reviews and approvals must have some degree of independence such that no person approves their own work, and requires that the minimum set of reviews and approvals contains reviews of the implementation of safety requirements. This association is defined by generation, such as code written to implement a safety requirement, or by interaction, such as code that must function in order for a safety requirement to be met. Code reviews conducted to meet this requirement need not be single events but may be modularized in a manner similar to the code itself as long as comprehensive understanding is communicated between modular reviews. Computing system development efforts that use pre-commit and post-commit reviews to conduct a modularized code review process could meet § 450.141(c)(2). The intent is that code developed to implement safety requirements should be checked by at least one independent technical reviewer prior to its release.

Section 450.141(c)(3) requires the operator to ensure that development personnel are trained, qualified, and capable of performing their roles. This is consistent with § 450.111(d)(5)(i) of the NPRM, which required coding standards, which are an implicit part of the training of development personnel. The final rule makes this implicit requirement in the NPRM explicit. Personnel responsible for public safety tasks must have training and experience that enables them to discharge their responsibilities effectively. In its application review, the FAA does not intend to verify the qualifications of individual development personnel, but rather to verify that the operator has a process in place to put appropriately-trained and experienced personnel in public safety roles.

Section 450.141(c)(4) requires a development process to define processes that trace requirements to verification and validation evidence. This requirement is a performance criterion that was implicit in the proposed § 450.111(d)(5) software development plan; FAA is making this criterion explicit and performance-based in the final rule to address commenters' concerns. Traceability from computing system requirement to verification and validation evidence significantly streamlines computing system safety evaluations by connecting the requirements that define a computing system's capabilities to evidence of their implementation. Importantly, this requirement applies to all requirements for computing system safety items, as a lack of rigor inmanaging requirements on any computing system safety item is an opportunity for undocumented or unintended computing system safety requirements to be introduced into the system.

Section 450.141(c)(5) requires a development process to define processes for configuration management that specify the content of each released version of a computing system safety item. This requirement is a performance-based version of proposed § 450.111(d)(5)(ii), which required configuration control. Configuration management at this level of performance is the baseline expectation for any computing system safety item because a known configuration with a known history is required to provide adequately for safety. The revised requirement contains the performance criteria that were implicit in the NPRM.

Section 450.141(c)(6) requires a development process to define processes for testing that verify and validate all safety requirements to the extent required by § 450.141(b)(4). This means that safety requirements must be tested in a manner consistent with their level of criticality. The FAA removed a prescriptive requirement proposed in the NPRM for testing on flight-like hardware ^[140] to increase flexibility. The FAA requires verification and validation that is appropriate for the level of criticality of the computing system safety item, and allows the operator to define the levels of criticality that are appropriate for its operations. The operator must determine, and the FAA will verify, which of the operator's levels of criticality affect public safety and which of the computing systems described in the proposed operation are in each of those public safety levels. Operators must then define verification and validation procedures to test computing system safety items in appropriately representative environments.

Section 450.141(c)(7) requires a development process to define reuse policies that verify and validate the safety requirements for reused computing system safety items. This requirement was retained from proposed § 450.111(d)(5)(v), which similarly required an operator to develop and implement software development plans, to include descriptions of a policy on software reuse. In essence, the applicant is required to have processes in place to understand the safety implications of any computing system safety item developed for a different project or purpose.

Section 450.141(c)(8) requires a development process to define third-party product use policies that verify and validate the safety requirements for any third-party product. This requirement was retained from proposed § 450.111(d)(5)(iv), which required an operator to develop and implement software development plans, to include a description of a policy on use of any commercial-off-the-shelf software. The FAA replaces the term “commercial-off-the-shelf software” in the proposal with “third-party product” because commercial software is not the only kind of third-party computing system that an applicant could use; government-off-the-shelf and free, open source products need strategies for safe use, and the policy does not need to vary based on the nature of the third party. The important characteristic is that the computing system was not developed by the applicant, so FAA now uses “third-party” to describe it. The final rule sets performance criteria for this requirement with the addition of the phrase “that verify and validate the safety requirements in any third-party product.” This means that the safety requirements implemented by third-party products must be subjected to verification and validation just like applicant-developed computing system safety items.

Section 450.141(d) contains the application requirements for this section. Each of the first five requirements in paragraph (d) mirrors a key aspect of computing system safety, allowing the applicant and FAA to understand the rigor of development in terms of public safety. This structure is meant to reflect the typical formats of computing system safety data submissions received by the FAA to date. The regulation requires an applicant to describe the computing system safety items, identify the safety requirements implemented by each computing system safety item, provide the development processes that generated them, provide evidence that the development process was followed, and provide data verifying the correct implementation of the safety requirements. These application requirements need not be met in separate documents.

The application requirements of § 450.141(d) essentially replicate those proposed in § 450.111(h), except that the revised regulation allows greater latitude to implement development processes that achieve the same goals by different means. An example of such an alternative process would be a formal mathematical proof that the code will function only as designed and that the design meets all of its requirements. A formal proof is preferable to an iterative development and testing process, whenever practical, because a formal proof demonstrates that every possible action that a computing system system can take is safe whereas iterative development can only approximate that demonstration. A formal proof would have required waivers under proposed § 450.111 but will not under § 450.141.

Several commenters recommended that hazards associated with computing systems and software be addressed through other sections in part 450, rather than in a dedicated section on computing systems and software. CSF, SpaceX, Virgin Galactic, and Virgin Orbit stated that hazards associated with computing systems and software should be addressed through the system safety requirements for flight hazard analyses, proposed § 450.109. CSF commented that a computing system was just one of many critical subsystems integrated into a larger complex system, that all systems and subsystems should be analyzed and controlled for hazards, and that the fact that a particular system may contain software should be irrelevant to top level performance-based safety requirements. Blue Origin and CSF recommended that the requirements for safety-critical systems in § 450.143 be used for software systems. SpaceX recommended that hazard analyses be limited to demonstrating one fault tolerance for safety-critical functions, including tolerance to faults in any inputs to the functions (e.g., data loss, data corruption) and any downstream hardware or software effects required for public safety (e.g., effecting thrust termination).

The FAA will retain a separate section for computing system requirements in the final rule. As stated in the NPRM preamble, the FAA consolidated the computing system safety requirements applicable to launch or reentry operations under a single section in § 450.141 of the final rule to address software, firmware, and data, and the way they operate in computing systems. The FAA based this approach on a determination that software safety cannot be evaluated outside of the computing system in which it operates. Software and computing systems are decision engines that, like humans, control other vehicle systems that can present hazards to the public and therefore merit analysis of their control logic. Although computing systems and software must be factored into an operator's system safety process and hazard control strategies, the FAA has determined that computing systems warrant separate consideration due to distinct characteristics that make them uniquely ill-suited to most traditional system safety methods.

Software assurance is often a more appropriate mitigation strategy than fault tolerance for software faults. The FAA anticipates that any emergent method for system safety analysis that handles software and computing systems well will meet § 450.141 because such a method would necessarily produce the essential elements of computing system safety embodied in the regulation. That is, § 450.141 applies equally well to dedicated computing system safety analyses and to system safety analyses that handle computing systems in an integrated manner.

Furthermore, although computing systems can be “safety critical,” as defined in § 401.7, the FAA declines to apply the requirements set forth in § 450.143 regarding safety-critical system design, test, and documentation to computing systems because those requirements do not adequately address the idiosyncrasies of computing systems. For example, § 450.143(b) in the final rule requires an operator to design safety-critical systems to be fault-tolerant, fail safe, damage-tolerant, or otherwise designed such that no fault can lead to increased risk to the public beyond nominal safety-critical system operation. Fault tolerance is not achievable for many software faults. Similarly, the predicted environments are defined and evaluated very differently for software than for other safety-critical systems under § 450.143. The predicted operating environment for computing systems is defined in computing system requirements, but those requirements are derived from the mathematical relationships that the software must embody, so the requirement to provide predicted environments for computing systems is indistinguishable from providing the computing system requirements and design documentation for computing systems.

Blue Origin, CSF, Sierra Nevada, Virgin Galactic, and Virgin Orbit commented that any prescription in the regulation should be moved to an AC as a means of compliance. Virgin Galactic commented that guidance material should be based on industry standard development assurance processes. CSF suggested that ACs reference industry standards and to refer to new or existing FAA ACs, such as AC 20-115C, AC 20-152, AC 20-153, AC 20-170, and AC 20-174, to provide a detailed means of compliance to performance-based regulations for computing systems.

As discussed, the FAA has revised the proposed requirements to be less prescriptive in the final rule. The FAA regulates software assurance only to the extent that it is used as a mitigation strategy for computing system hazards. The FAA plans to issue guidance that will provide further clarity on the requirements in § 450.141, including the integration of existing software assurance standards, such as the referenced ACs, with computing system safety processes. The FAA considers these changes in the final rule to be consistent with the comments received.

Blue Origin, CSF, Rocket Lab, SpaceX, and Virgin Galactic commented that the requirements in proposed § 450.111 did not integrate well with most industry applications and best practices. CSF and SpaceX commented that the methods prescribed by the proposal were incompatible with proven industry standards such as ISO 26262 ^[141] and DO-178C.^[142]

The FAA revises the regulation in a way that aligns better with the system safety process and replaces the prescriptive requirements identified by commenters with performance-based metrics. The final rule also aligns better with industry standards, including ISO 26262 and DO-178C. Virgin Galactic noted similarities between proposed § 450.111 and existing standards, and this similarity is intentional as the FAA was attempting to codify those parts of industry standards that were well suited to standardization. The final rule bears less similarity to existing standards, instead specifying the goals of those standards as requirements in § 450.141. The FAA has revised the computing systems and software safety requirements to contain the minimum set of performance requirements necessary to address the public safety implications of a given operation. The FAA also removed many prescriptive requirements from the regulation. This revision allows for more flexibility and thus consistency with industry standards.

CSF, SpaceX, and Virgin Galactic commented that the proposed rule was not comprehensive enough and was missing items such as aeronautical databases, integrated modular avionics, regression testing, and other details. Blue Origin, CSF, and SpaceX stated that the proposal failed to address object-oriented technology, model-based development, machine learning, tool qualification, load control, formal methods, robust protection and partitioning, integrated modular avionics, and integration with the system process.

As discussed, the final rule has been revised to remove prescriptiveness and increase flexibility. Therefore, because such prescription was removed from the final rule, the FAA does not find the changes recommended by these comments to be necessary. The FAA will address items like aeronautical databases, integrated modular avionics, regression testing, and other details in guidance documents. These items will be addressed by § 450.141(c), which implements safety requirements for these and all other computing system safety items.

An individual commenter suggested that all hardware dependent on software be vertically integrated and signal proof to protect against issues posed by cyber security or signal interference. The FAA does not believe a change to the regulations is necessary. Issues posed by cyber security or signal interference that could pose a threat to public safety are adequately addressed by the hazard identification and mitigation requirements in § 450.141.

SpinLaunch recommended that the proposed set of software requirements, compliance plans, and test data be replaced with the requirement either to submit a software plan and sample results or to demonstrate the capability of the software to perform as required.

The requirement that an operator either submit a software plan and sample results or demonstrate the capability of the software would not protect public safety adequately for three reasons. First, a software plan is insufficient without evidence of its execution. Section 450.141 requires an operator to document a development process for all computing system safety items and provide evidence of its execution. Second, the minimum set of sample results that would be sufficient to verify protection of the public is the set that meets the requirements in § 450.141(b)(4) for verification of public safety-related functionality. Third, an adequate demonstration of software capability necessarily will include the level of testing specified by § 450.141. For these reasons, the FAA does not see a distinction between § 450.141 and either the submission of a software plan and sample results or a demonstration of software capability.

y. Safety-Critical Systems Design, Test, and Documentation (§ 450.143)

In the NPRM, the FAA proposed standalone performance-based requirements for safety-critical systems in § 450.143. The proposed requirements covered fault tolerance, qualification testing, acceptance of hardware, and lifecycle management for all safety-critical systems including FSS.^[143] In the NPRM, the FAA noted that applicants using an FSS of any reliability threshold would be required to meet the proposed § 450.143 safety-critical system design, test, and documentation requirements.^[144] In addition, under proposed § 450.143(a), operators required to use an FSS under § 450.101(c) would be required to meet the standards in § 450.145.

The FAA also proposed to revise the definition of “safety critical” in § 401.5. As proposed, “safety critical” retained the longstanding definition of being something “essential to safe performance or operation,” and the proposed definition further explained that a safety-critical system, subsystem, component, condition, event, operation, process, or item, is one whose proper recognition, control, performance, or tolerance, is essential to ensuring public safety. The FAA proposed to remove language in the existing definition stating that something is “safety critical” if it creates a safety hazard or provides protection from a safety hazard, because that language is redundant.

In the final rule, the FAA adopts § 450.143 with some revisions discussed later in this section. The FAA also adopts the proposed definition of “safety critical” without substantive change and relocates it to § 401.7. Based on the change to the definition of “public” in the final rule, the FAA changes the reference to “public safety” in the definition of “safety critical” to “public safety and the safety of property.”

Blue Origin, CSF, and one individual commented that the term “safety critical” was ambiguous in light of the proposed revision to § 401.5.

A system is safety critical if its performance is essential to safe performance or operation. If the failure of a system can create a hazard to the public, then the system is a safety-critical system. Section 450.143 would apply to a safety-critical system unless an operator demonstrates through its flight hazard analysis that the likelihood of any hazardous condition associated with the system that may cause death or serious injury to the public is extremely remote, pursuant to § 450.109(b)(3). Due to the inherent risk to the public, an operator must demonstrate the reliability of a safety-critical system by meeting the requirements of § 450.143.^[145]

The applicant's identification and proper management of safety-critical systems is fundamental to mitigating potential hazards and ensuring public safety, and the FAA will work with an applicant if it believes the applicant has failed to identify all safety-critical systems. The potential failure of safety-critical systems is integral to the FSA, and the vulnerabilities of safety-critical systems must be accounted for in the flight commit criteria, hazard analyses, lightning protection criteria, management of radio frequency to prevent interference, and communications plans.

Virgin Galactic commented that the requirements of § 450.143 are costly, time-consuming, burdensome, and contrary to the Commercial Space Launch Act requirement to only regulate to the extent necessary. Virgin Galactic requested that an applicant not be mandated to comply with § 450.143 if it can provide proof that a safety-critical system meets the safety criteria.

The FAA acknowledges that, under certain circumstances, an operator could demonstrate that a safety-critical system would not need to have the robust design and testing required of § 450.143. The FAA considered relieving an operator from the requirements in § 450.143 if the safety criteria in § 450.101 were met. However, the FAA found that use of the safety criteria for this purpose is not appropriate because whereas the requirements in § 450.143 apply to safety critical systems—which, as defined, can be a system, subsystem, component, condition, event, operation, process, or item—the safety criteria in § 450.101 measure the effects of the failure modes of the vehicle as a whole, as analyzed in the FSA. Therefore, demonstrating compliance with the safety criteria in § 450.101 is not sufficient to relieve an operator from the requirements in § 450.143, because that alternative would relieve the operator from analyzing the vehicle's discrete systems, subsystems, components, conditions, events, operations, processes, and items. The FAA finds that analysis at this more discrete level is necessary to ensure safety of the public.

The FAA finds that a more appropriate method to provide flexibility and be responsive to Virgin Galactic's concern is to rely on the flight hazard analysis in § 450.109. Specifically, the FAA revises § 450.143(a) to exclude safety-critical systems for which an operator demonstrates through its flight hazard analysis that the likelihood of any hazardous condition specifically associated with the system that may cause death or serious injury to the public is extremely remote, pursuant to § 450.109(b)(3). As explained in the preamble section associated with § 450.109, the flight hazard analysis focuses on the reasonably foreseeable hazards to public safety resulting from the flight of a launch or reentry vehicle. In performing the flight hazard analysis, the operator is required in § 450.109(b)(1)(ii) to identify reasonably foreseeable hazards and corresponding failure modes relevant to public safety resulting from system, subsystem, and component failures or faults. Therefore, unlike the safety criteria in § 450.101, the flight hazard analysis explicitly requires the operator to examine the hazards associated with the discrete systems, subsystems, and components of the vehicle.

Thus, to provide increased flexibility without reducing safety, the final rule excludes certain safety-critical systems from the requirements of § 450.143 if an operator demonstrates through its flight hazard analysis that the likelihood of any hazardous condition specifically associated with the system that may cause death or serious injury to the public is extremely remote, pursuant to § 450.109(b)(3). That is, the operator must show that specific requirements in § 450.143, which ensure that the system will function reliably, are not entirely necessary to mitigate the hazards specifically associated with the system to an extremely remote level.

For example, an operator's launch vehicle may have a number of systems whose failure could potentially cause hazardous debris to impact the public. If an operator chooses to launch in a sparsely populated area and limit propellant loading to minimize risk to the public to an extremely remote level despite the failure of one or more safety-critical systems, then those systems would not need to be designed or tested to the level set forth in § 450.143. The operator must show that the exception in § 450.143(a)(2) applies for a particular safety-critical system through its flight hazard analysis. If the operator cannot show that all hazards involving the system are sufficiently mitigated to an extremely remote level despite a failure of that system, then that system must meet the design and testing requirements in § 450.143.

However, the FAA anticipates that certain systems will not qualify for the exception in § 450.143(a)(2). Specifically, safety critical systems that prevent hazards from reaching the public given other system failures would likely be required to meet § 450.143. This is also true of systems that create hazards to the public that are not otherwise mitigated by other hazard controls. The FAA anticipates that it is unlikely that an operator would be able to demonstrate that the hazards associated with these systems meet the “extremely remote” standard in § 450.109(b)(3) without subjecting them to the reliability requirements in § 450.143. Furthermore, FSS required by § 450.108(b)(2) must meet § 450.143 without exception.

The FAA also revises § 450.143(a) and removes the proposed requirement that all FSS required by § 450.101(c) must meet §§ 450.143 and 450.145. Instead, § 450.143(a) requires all safety-critical systems except for the highly reliable FSS required by § 450.108(b)(1) to meet the requirements in § 450.143. As discussed in the flight abort section of this preamble, an FSS required by § 450.108(b)(2) must comply only with § 450.143 rather than meeting the additional requirements proposed in § 450.145. Likewise, an operator who chooses to use flight abort as a hazard control strategy for reasons other than protecting against a high consequence event under § 450.101(c)(1) must also satisfy the requirements of § 450.143 for its FSS. For reasons explained later in this section, highly reliable FSS under § 450.145 do not need to comply with the general safety-critical systems requirements of § 450.143 as was proposed in the NPRM.

The FAA proposed in § 450.143(b) to require that all safety-critical systems follow reliable design principles. Specifically, an operator would be required to design those systems to be fault-tolerant so that no single credible fault could lead to increased risk to the public.

Both Sierra Nevada and Virgin Galactic commented that requiring fault tolerance would be so burdensome to the applicant that several current operators would not be able to meet the requirement for systems on existing vehicles. Sierra Nevada commented that using fault tolerance as a catch-all hazard control can add risk in certain cases, and the determination regarding whether something is fault-tolerant is not straightforward.

Fault tolerance ^[146] is the idea that a system must be designed so that it is able to perform its function in the event of a failure of one or more of its components. In a fault-tolerant design of a safety-critical system, no single credible fault should be capable of increasing the risk to public safety beyond that of a nominal operation. Although the FAA proposed fault tolerance for the design of safety-critical systems in the regulatory text, the FAA intended to accept other methods of safety design, including fail-safe ^[147] and damage-tolerant ^[148] systems like primary structures that generally cannot be redundant. This broader view of safe design allows an operator to factor planned operational restrictions, testing, and inspection into the design to demonstrate that a system is broadly fault-tolerant.

The FAA acknowledges that its articulation of a fault-tolerant design requirement in the proposed regulation did not accurately reflect the FAA's statements in the NPRM preamble allowing other methods of safe design, like fail-safe systems, damage-tolerant systems, or other designs for graceful degradation.^[149] A system that is designed to be fail-safe or degrade gracefully, whether it functions at a reduced level or fails completely, does so in a way that protects people and property from injury or damage, or generally prevents a more serious failure event. Such design is desirable, and was intended to be captured in the FAA's design requirements for safety-critical systems. In the final rule, the FAA amends § 450.143(b) to state only that safety-critical systems must be designed such that no credible fault can lead to increased risk to the public beyond nominal safety-critical system operation. The final rule gives the operator flexibility to achieve this requirement through a design that is fault-tolerant, fail-safe, damage-tolerant, or any other solution.

The FAA views design for reduced risk as a necessary characteristic of any reliable system. The FAA recognizes there may be other acceptable design principles that protect the public adequately from or in spite of a credible fault. In the final rule, the FAA removed the word “single” from § 450.143(b) to clarify that some design concepts may allow faults, but that the faults should not lead to increased risk to the public. The FAA also removed “safety” from § 450.143(b) because ensuring no increased risk to the public necessarily addresses public safety. An applicant may demonstrate that no credible fault can lead to increased risk through analysis, identification of possible failure modes, implementation of redundant systems or other mitigation measures, and verification that the mitigation measures will not fail simultaneously.

Safety-critical systems requirements necessitate testing that accounts for the operating environment the system will encounter. For that reason, the FAA proposed to define “operating environment” in § 401.5 (§ 401.7 in the final rule) as “an environment that a launch or reentry vehicle component will experience during its lifecycle.” The proposed definition further stated that operating environments include shock, vibration, thermal cycle, acceleration, humidity, and thermal vacuum.

In the final rule, the FAA adopts the proposed definition with additional language indicating that operating environments also include other environments relevant to system or material degradation. As stated in the NPRM, the list of examples in the definition is not exhaustive, and the additional language in the final rule establishes a standard for operators to consider in assessing relevant environmental factors when qualifying an FSS or other safety-critical system design through testing and analysis.

In addition to meeting the design requirements of § 450.143(b), the FAA proposed qualification testing ^[150] requirements in § 450.143(c) that required, in part, that an operator demonstrate the design of the vehicle's safety-critical systems functionally at conditions beyond its predicted operating environment. An operator must select environmental test levels that ensure the design is sufficiently stressed to demonstrate that system performance is not degraded due to design tolerances, manufacturing variances, or uncertainties in the environment. Qualification testing will demonstrate margin over all operating and non-operating environments to which the flight unit can be exposed, including margin over all component acceptance tests. Valid qualification testing environments should—

• Account for material variation, because all materials have properties that have a variance from nominal values.
• Account for manufacturing variation, because the functionality of a system is not only dictated by the quality of materials used, but also the quality of the manufacturing processes employed.
• Account for environmental variation, because environmental predictions can have a great deal of uncertainty, particularly early in a program.
• Demonstrate margin against failure, because safety-critical systems often fail in complex and unpredictable ways.

The FAA also proposed requirements for acceptance ^[151] of hardware in § 450.143(d) that required, in part, an operator to demonstrate any safety-critical system functionally while exposed to its predicted operating environment with margin to demonstrate that it is free of defects, free of integration and workmanship errors, and ready for operational use. Acceptance testing on flight units should uncover critical workmanship errors, and damaged, weak, or out-of-specification components before they fail in flight. Because this testing is done on flight units, valid acceptance testing should avoid over-testing safety-critical components. This avoidance is accomplished by testing significantly under qualification levels and durations, but still over nominal operation levels and durations. The FAA adopts these requirements as proposed, with minor editorial corrections.

Lastly, the FAA proposed requirements pertaining to the lifecycle of safety-critical systems in § 450.143(e), which required an operator to monitor the flight environments experienced by safety-critical system components to the extent necessary to validate the predicted operating environment.^[152]

In the final rule, the FAA makes one minor revision to § 450.143(c), (d), and (e). In each of those subsections, the FAA has changed the term “operating environment” to “operating environments” because all systems will experience multiple operating environments. As stated in the NPRM preamble,^[153] applicants must account for all operating environments that any safety-critical system is expected to encounter throughout the lifecycle of the system in accordance with § 450.143(e), including storage, transportation, installation, and flight, which generally are built into qualification and acceptance testing levels. Other than this minor revision, the FAA adopts these subsections as proposed. Note also that in the means of compliance table released with the NPRM, the FAA identified SMC-S-016, “Test Requirements For Launch, Upper-Stage and Space Vehicles,” as an acceptable means of compliance with § 450.143. SMC-S-016 is an Air Force standard that defines environmental test requirements for launch vehicles, upper-stage vehicles, space vehicles, and their subsystems and units. The FAA maintains that the environmental test levels in that standard are acceptable for safety-critical systems under § 450.143, except, as noted in the means of compliance table, protoqualification testing testing found in 4.2.3 and B.1.3-4, and protoqualification by similarity in 4.10.1.^[154]

As noted earlier, FSS required pursuant to § 450.108(b)(2), when the consequence of any reasonably foreseeable failure mode in any significant period of flight is between 1 × 10^−[2] and 1 × 10^−[3] CE_C for uncontrolled areas, must satisfy the requirements in § 450.143. This approach is consistent with the NPRM, which required all safety-critical systems including all FSS to satisfy the general requirements in § 450.143. For the reasons explained more fully in the next section, the final rule does not adopt the additional requirements for such an FSS that were proposed in § 450.145(a)(2), which would have required the FSS to have a design reliability of 0.975 at 95 percent confidence and commensurate design, analysis, and testing. The FAA no longer finds this reliability value necessary because, as a commenter noted, it was unnecessarily prescriptive.^[155] Moreover, as discussed in the NPRM, there are no established standards to demonstrate the 0.975 reliability number, other than a single string FSS that otherwise meets the requirements of RCC 319.

Instead, the FAA requires § 450.108(b)(2) FSS to meet the requirements in § 450.143. This regulatory approach should support ongoing innovation in the development of FSS. As noted in the NPRM, the commercial space transportation industry has continued to mature and operators have proposed FSS alternatives. These alternative approaches include fail-safe single string systems that trade off mission assurance and redundancy, other fail-safe consequence mitigation systems, and dual-purpose systems such as FSS that reuse the output of safety-critical GPS components for primary navigation avionics. The FAA is publishing a “Safety-Critical Systems” AC to provide an acceptable means of compliance with § 450.143. However, the FAA does not claim that an FSS approved under § 450.143 necessarily has a reliability of 0.975. Although some standard in the future may be able to establish a reliability of 0.975 at 95 percent confidence, that standard does not exist today. FSS are discussed more fully in the next section of this preamble.

The FAA amends the proposed application requirements in § 450.143(f) for safety-critical systems to require that applicants describe the methods used to validate the predicted operating environments. In order to comply with § 450.143(e)(2)(i), applicants must validate the predicted operating environments for their safety-critical systems. However, the NPRM inadvertently omitted the corresponding application requirement from proposed § 450.143(f). This change results in no additional burden as an operator would have to demonstrate compliance with the substantive provision by providing this information.

The FAA also adds new § 450.143(f)(7) to the application requirements, which requires an applicant to describe the standards used in each phase of a safety-critical system's lifecycle. This addition is consistent with current practice and will not increase the burden on operators, because an operator would likely provide this information to support its finding that a safety-critical system is designed such that no credible fault can lead to increased risk to the public beyond nominal safety-critical system operation. In addition, this description of standards is necessary to help identify previous flights of a vehicle developed and launched or reentered in similar circumstances, as required under § 450.131(d)(1).

Virgin Galactic asked how the requirements of § 450.143 would apply to safety-critical systems that have been licensed previously. Virgin Galactic generally objected to proposed § 450.143, arguing its requirements were similar to aircraft certification rules and would be appropriate for a more mature industry. Virgin Galactic requested an exclusion from proposed § 450.143 for hybrid vehicles that have been issued an experimental airworthiness certificate by the FAA and operate as aircraft.

As discussed in the preamble section on Hybrid Vehicles, the FAA does not agree that an airworthiness certificate issued by the FAA should automatically exempt a vehicle used in a launch or reentry from the safety-critical system requirements in § 450.143. An applicant may make an ELOS case for a component of a launch vehicle, such as a carrier aircraft, if it holds a airworthiness certificate with an acceptable flight test history. Section 450.143 is flexible and broad enough that the FAA is not aware of any currently licensed vehicles or operators in formal pre-application consultation that would not meet the new requirements. For example, operators licensed under parts 431 or 435 use a system safety process to verify and validate the reliability and mitigation of hazards for any safety-critical system. The treatment of safety-critical systems under part 431 and 435 provides an ELOS to the safety-critical systems requirements in § 450.143. Flight Safety Systems (§§ 450.143 and 450.145)

z. Flight Safety Systems (§§ 450.143 and 450.145)

As previously discussed, proposed § 450.101(c) would have required an operator to use flight abort with an FSS that meets the requirements of § 450.145 if the consequence of any reasonably foreseeable vehicle response mode, in any one-second period of flight, was greater than 1 × 10^−[3] CE_C for uncontrolled areas.^[156]

As proposed in § 450.145(a)(1), if the consequence of any vehicle response mode was 1 × 10⁻² CE_C or greater for uncontrolled areas, an operator would have been required to employ an FSS with design reliability of 0.999 at 95 percent confidence and commensurate design, analysis, and testing. The FAA noted that RCC 319 is the only government standard that would meet the requirement for a design reliability of 0.999 at 95 percent confidence and commensurate design, analysis, and testing.

Proposed § 450.145(a)(2) required that, if the consequence of any vehicle response mode was between 1 × 10^−[2] and 1 × 10^−[3] CE_C for uncontrolled areas, an operator would have been required to employ an FSS with a design reliability of 0.975 at 95 percent confidence and commensurate design, analysis, and testing. In the NPRM, the FAA acknowledged that, although no standard exists for an FSS with this design reliability, it expected individual applicants to create their own FSS requirements based on RCC 319 and have them approved as an accepted means of compliance by the FAA prior to application submittal.^[157] The FAA anticipated the industry would develop voluntary consensus standards for FSS, particularly for those FSS that are only required to have a design reliability of 0.975 at 95 percent confidence.

The FAA explained the proposed lower reliability by noting that, for operations in which the consequence of a flight failure is lower, the FSS, while still being reliable, may not need to be as highly reliable as an FSS for a vehicle operating in an area where the consequence of a flight failure is higher. As such, in order to make regulations adaptable to innovative operations while maintaining appropriate levels of safety, the FAA proposed to allow an FSS with less demonstrated design reliability for operations with lower potential consequences. In the final rule, the FAA removes the proposed requirement for an FSS with design reliability of 0.975 at 95 percent confidence, as will be discussed later in this preamble section.

In the final rule, the FAA has maintained the proposed requirement for an operator to employ an FSS with design reliability of 0.999 at 95 percent confidence and commensurate design, analysis, and testing if the consequence of any reasonably foreseeable failure mode in any significant period of flight is greater than 1 × 10^−[2] CE_C in uncontrolled areas.^[158] Operators currently meet this requirement for launches conducted under legacy regulations by tailoring RCC 319, and an operator could submit a tailored version of RCC 319 to the FAA as a means of compliance for § 450.145(b).

In the final rule, the FAA has revised the section heading for § 450.145 from “Flight safety system” to “Highly reliable flight safety system” because it now contains only those requirements for an FSS required by § 450.108(b)(1) when the consequence of any reasonably foreseeable failure mode in any significant period of flight is greater than 1 × 10⁻² CE_C in uncontrolled areas. The FAA has also reorganized the section and moved the reliability requirements in proposed § 450.145(a) to § 450.145(b) with revisions.

While the design reliability required for a highly reliable FSS remains 0.999 at 95 percent confidence and commensurate design, analysis, and testing, the FAA has specified in § 450.145(b)(1) of the final rule that this reliability applies to the portion of the FSS onboard the vehicle. In addition, if a portion of an operator's FSS is ground-based, space-based, or otherwise not onboard the vehicle, the FAA has specified in § 450.145(b)(2) of the final rule that it must have the same reliability as the onboard portion; that is, 0.999 at 95 percent confidence and commensurate design, analysis, and testing. Although not all FSS have a ground portion, this requirement reflects past and current practice for launches from both Federal and non-Federal sites, in which the ground portion of an FSS and the airborne portion of an FSS are independently designed, tested, and operated to rigorous standards. This independence ensures that the appropriate command is sent by the ground-based system with a high reliability, and received and acted upon with high reliability by the onboard portion of the system, to result in the desired termination action.

The reference in § 450.145(a) to an FSS “on the launch or reentry vehicle” did not reflect the FAA's intention accurately, as stated in the NPRM, to include FSS not onboard the vehicle in the design reliability requirements in § 450.145.^[159] Conventional FSS with onboard flight termination receivers and not-onboard command transmitter systems will have both onboard and not-onboard subsystems. Many current autonomous FSS only have onboard systems. As discussed previously, the final rule requires both onboard and not-onboard FSS systems independently to demonstrate 0.999 at 95 percent reliability. This requirement is because FSS with both onboard and not onboard systems that individually meet 0.999 at 95 percent reliability could have a combined reliability as low as 0.998 at 95 percent confidence, whereas FSS with only onboard systems would be required to have a reliability of at least 0.999 at 95 percent confidence. To ensure that FSS all meet the same standard required to protect public safety, the final rule requires that onboard systems and not onboard independently meet the 0.999 at 95 percent confidence level of reliability. The collective FSS design reliability requirement is not specifically stated in the final rule since the onboard FSS and not-onboard FSS design reliability requirements are independently defined in § 450.145 and the overall FSS design reliability is dependent on the type of FSS employed.^[160]

For § 450.108(b)(1) FSS that must meet the requirements of § 450.145, unless alternative methods are accepted by the Administrator, the FAA has identified RCC 319 as an existing means of compliance to demonstrate FSS reliability. This standard is currently used by applicants that employ traditional flight abort under part 417. The FAA expects to continue the current practice of working with applicants to tailor RCC 319 in order to comply with § 450.145. A tailored RCC 319 that is used as a means of compliance for § 450.145(b) must be submitted to the FAA for acceptance prior to being included in a license application.

As noted in the previous preamble section, the FAA has removed the additional requirements proposed in § 450.145(a)(2), and is relying on requirements in § 450.143 to ensure that an FSS required by § 450.108(b)(2) is sufficiently reliable. As with the NPRM, the final rule reduces the burden on operators that have a lower potential for causing high consequence events. This change maintains the intent of the proposal to protect against high consequence events using a means different from the traditional highly reliable FSS.

As noted in the previous section, the Safety-Critical Systems AC will provide an approach to compliance with § 450.143 that modifies the provisions in RCC 319. The approach uses a menu of potential options that, when met, would demonstrate that an operator has met § 450.143. The AC will provide combinations of various tailored RCC 319 requirements that the FAA has determined demonstrate compliance with § 450.143. Some of the tailored requirements include:

• Reducing the random vibration and thermal cycle qualification test margins to a level and duration that remains above acceptance test levels;
• Reducing the number of required qualification test units;
• Reducing the minimum required sample size for ordnance lot acceptance testing and ordnance qualification testing;
• Allowing qualification by similarity with deviations to RCC 319 qualification by similarity criteria;
• Reducing the required number of thermal cycles for component level qualification thermal cycle test requirements;
• Reducing the radio frequency link margin requirements for traditional commanded FSS;
• Allowing single string fail-safe FSS;
• Reducing electronic piece parts requirements; and
• Allowing use of vehicle components or systems for FSS use such as vehicle power source or flight computer.

An operator could work with the FAA to determine what combination of options would satisfy § 450.143 for specific FSS. In addition, an operator could develop its own combination of tailored RCC requirements to demonstrate compliance, or could elect to use a different means of compliance outside of the RCC 319 requirements.

An operator may demonstrate compliance with § 450.143 through other means that adequately establish design, qualification testing, and acceptance testing. As mentioned earlier, the environmental test levels in SMC-S-016 are acceptable for safety-critical systems under § 450.143, including some FSS components, except protoqualification testing found in 4.2.3 and B.1.3-4, and protoqualification by similarity in 4.10.1.

Lastly, the FAA also makes minor changes to the application requirements in § 450.145. In the NPRM, § 450.145(d) stated that an FSS includes any FSS located onboard a launch or reentry vehicle; any ground based command control system; any support system, including telemetry subsystems and tracking subsystems, necessary to support a flight abort decision; and the functions of any personnel who operate the FSS hardware or software. This provision has been moved to the definition of “flight safety system” and deleted from § 450.145(d).^[161]

The FAA received several comments on the limited means of compliance available to demonstrate compliance with the FSS reliability requirements. Blue Origin commented that the industry had only been given one means of compliance for both tiers of FSS reliability. Blue Origin also commented that the proposal indicated the only accepted means of complying with § 450.145 would be an untailored RCC 319. Blue Origin and CSF suggested that there exist other industry and government standards that should be accepted means of compliance with the reliability requirements of § 450.145. Blue Origin and Microcosm stated that a tailored RCC 319 or SMC-S-016 should also be an accepted means of compliance. SpaceX commented that RCC 319 was an acceptable standard, but only if the document may be tailored for each operator.

The FAA clarifies that RCC 319 is a means of compliance the FAA has identified to date that ensures compliance with § 450.145, but RCC 319 is not the only possible means of compliance that the FAA will consider. The performance-based nature of § 450.145 allows an operator to submit its own unique means of compliance to the FAA. An applicant may propose a tailored version of RCC 319 prior to submitting its application as a unique means of compliance to be accepted by the Administrator. As discussed earlier, the Safety-Critical Systems AC will provide guidance to operators on how to comply with the requirements for § 450.108(b)(2) FSS. This approach uses RCC 319 as one starting point. The AC will also refer to SMC-S-016, as discussed earlier. The FAA notes that, unlike for highly reliable FSS required to meet § 450.145, for an FSS required by § 450.108(b)(2) an operator is not required to have a means of compliance with § 450.143 accepted in advance of application submittal. However, it would be advisable for an operator to consult with the FAA early in its program's development on the approach to compliance with § 450.143, whether for an FSS or other safety-critical systems.

The performance-based nature of §§ 450.143 and 450.145 also allows an industry consensus standards body to submit a proposed means of compliance to the FAA for general use. This process is discussed in more detail in the Means of Compliance section of the preamble. Applicants are encouraged to work with the FAA in pre-application consultation to discuss potential unique means of compliance. For example, for § 450.108(b)(1) FSS, an applicant could work with the FAA during pre-application consultation to tailor RCC 319 to the operation while still ensuring compliance with § 450.145. The FAA will review the documents tailored to vehicle programs and mission-specific applications as unique means of compliance for a given license.

Blue Origin, CSF, and Virgin Galactic expressed concern that a vehicle that did not require an FSS under parts 431 or 435 might require one under part 450. The FAA disagrees. This rule maintains the level of safety required under parts 415, 417, 431, and 435 for FSS. Furthermore, as discussed in the High Consequence Event Protection section of this preamble, the ACTA study results indicate that no changes would be required under the final rule regarding the need for an FSS for any currently licensed launch vehicle launched from a Federal or commercial launch or reentry site. Therefore, the FAA does not expect to require an FSS under part 450 for any launch vehicle that would not have been required to have an FSS under parts 431 and 435.

CSF commented that the NPRM's proposed structure for requiring flight abort was overly prescriptive and would not give an operator flexibility to define the type of FSS to implement. CSF recommended requiring operators to make a safety case and moving CE_C and the reliability requirements for FSS of the NPRM to an AC.

The FAA disagrees that a safety case should take the place of discrete CE_C thresholds and the requirements for FSS in §§ 450.143 and 450.145. Although a safety case is a potential approach to applying for an ELOS determination for many of the regulatory requirements, the FAA does not believe that requiring a safety case, by itself, provides sufficient regulatory clarity as to what is expected of a launch or reentry operator to obtain and maintain a license.

Blue Origin commented that the means of compliance for FSS requirements in the NPRM was unclear, particularly for systems not on the launch vehicle such as tracking systems, ground systems, and flight abort crew. As examples, Blue Origin mentioned RCC 324 ^[162] and EWR 127-1 ^[163] for tracking systems, AFSPCI 91-701 ^[164] for ground systems, and AF 13-602 ^[165] for flight abort crew.

As discussed above, § 450.145(b) has been amended to address more clearly the part of the FSS onboard the vehicle and the part not onboard the vehicle, such as ground-based and space-based systems. In addition, this preamble addresses means of compliance for FSS requirements specifically, as well as means of compliance used to meet the requirements of part 450 more generally. As discussed previously, an untailored RCC 319-19 is currently the only means of compliance the FAA has reviewed and accepted to meet the § 450.145 FSS requirements; however, the FAA anticipates operators will provide unique tailored versions of RCC 319-19 to the FAA for acceptance under part 450. In addition, RCC 324 is an acceptable means of compliance for the airborne tracking sources such as C-Band transponders used with ground based command systems and for GPS receivers and inertial measurement units used as airborne tracking data sources. EWR 127-1 is not a current means of compliance for tracking systems because it is out of date. AFSPCI 91-701 is an acceptable means of compliance for FSS-related ground systems. Lastly, AFI 13-602 is an acceptable means of compliance for flight abort crew.

Blue Origin noted that proposed § 450.143 appeared to be appropriately performance-based and applicable to all safety-critical systems, including software. Except for § 450.108(b)(1) FSS and software, the FAA agrees with Blue Origin that § 450.143 is appropriately performance-based and applicable to all safety-critical systems. The requirements in § 450.143 are not sufficient for § 450.108(b)(1) FSS because those systems require a higher reliability due to the potential for high consequence events, as measured by CE_C. As discussed earlier, the unique hazards due to software have a separate set of requirements in § 450.141. Otherwise, § 450.143 is sufficient for safety-critical systems and FSS that do not fall under § 450.145 because it includes performance standards for design, testing, and lifecycle management. Note that § 450.143 covers a § 450.108(b)(2) FSS that an operator uses to comply with the high consequence protection requirements of § 450.101(c), as well as an FSS that an operator uses when it chooses flight abort as a hazard control strategy under § 450.107, notwithstanding § 450.101(c). The requirements are the same for either FSS because, although the potential for a high consequence event is less of a concern in the latter case, each FSS is critical to meeting the collective, individual, aircraft, and critical asset risk criteria in § 450.101(a) and (b).

Blue Origin sought clarification as to whether an operator would need to comply with the software requirements of RCC 319 under the requirements proposed for § 450.145, in addition to the software requirements under § 450.141. An operator is not required to comply with the software requirements of RCC 319 under the requirements for § 450.145. Section 450.141 applies to any software or data that implements a capability that, by intended operation, unintended operation, or non-operation, can present a hazard to the public. Section 450.141 applies to FSS under either § 450.108(b)(1) or (b)(2). An operator is not required to meet RCC 319 in order to satisfy § 450.141, but RCC 319 is an acceptable means of demonstrating compliance with § 450.141.

Blue Origin and CSF commented that the NPRM's assertion that to get a 0.999 design reliability at 95 percent confidence by testing at predicted environment levels, an operator would have to test 2,995 units was incorrect because it did not take into account the dual redundant string architecture traditionally implemented for an FSS. The FAA concurs that its statement in the NPRM was an oversimplification that did not describe typical FSS component testing adequately. FSS testing generally consists of testing a certain number of units of an individual component to determine its reliability and confidence level, and that testing is part of determining the overall FSS system reliability. The FAA maintains that, for most operators, testing a few units at greater than expected operating environments is significantly less burdensome than testing many units at expected operating environments. Operating environments include shock, vibration, thermal cycle, acceleration, humidity, and thermal vacuum, or other environments relevant to system or material degradation. The opportunity for operators to submit new means of compliance to be accepted by the Administrator prior to application submission will allow applicants to propose their own means of compliance if they believe that another method of FSS design reliability, testing, and analysis is less burdensome than a means of compliance currently accepted by the FAA.

Microcosm asked if all orbital operators launching from the United States would be required to have a 0.999 design reliability FSS in accordance with proposed § 450.145. The FAA does not expect that all orbital operators launching from the U.S. will have operations with a potential consequence of a reasonably foreseeable failure mode in any significant period of flight that is greater than 1 × 10⁻² CEC in uncontrolled areas. The FAA notes that, as described in reference to the high consequence event protection requirements of § 450.101(c), operators will be required to have an FSS if the consequence of any reasonably foreseeable failure mode in any significant period of flight is greater than 1 × 10⁻³ CE_C in uncontrolled areas, and, as proposed, that FSS will need to have the high design reliability of 0.999 at 95 percent confidence if the consequence of any reasonably foreseeable failure mode in any significant period of flight is greater than 1 × 10⁻² CE_C in uncontrolled areas. However, the FAA has removed the additional requirements proposed in § 450.145(a)(2) in the final rule if the consequence of any reasonably foreseeable failure mode is between 1 × 10⁻² and 1 × 10⁻³ CE_C, and in that scenario will only require an operator to use an FSS that complies with § 450.143.

SpaceX commented that RCC 319, section 1.10, allowed previously approved components and systems to be grandfathered such that they not be required to meet subsequent versions of RCC 319 unless certain criteria apply. SpaceX suggested that this approach be taken by the FAA in accepting previously tailored documents. SpaceX further recommended allowing such grandfathered acceptance of different standards such as AFSPCMAN 91-710.

The FAA's current practice is to accept FSS that have been approved under a standard such as AFSPCMAN 91-710 and RCC 319 even after updated versions of those standards are released. Licensing under part 450 should be consistent with that practice; a licensee should be able to renew its license without changes to its FSS simply because a standard that was used as a means of compliance has evolved with time. There would be exceptions, however, if a significant flaw was discovered in the earlier version of the standard.

SpaceX also commented on proposed § 450.145(d)(3), which stated that an applicant must submit any analyses and detailed analysis reports of all FSS subsystems necessary to demonstrate the reliability and confidence levels required by proposed § 450.145. SpaceX pointed out that while other government requirements, such as RCC 319, provide guidance on what analyses and reports are necessary, the proposed rule was unclear as to what specific analyses and reports are necessary.

As noted earlier, RCC 319 is an accepted means of compliance for § 450.145. An FSS design, testing, and analysis process that complies with the analysis requirements for RCC 319, or other accepted means of compliance, will satisfy the FSS analysis requirements of § 450.145.

Rocket Lab requested clarification as to whether the FSS design reliability is for hardware components only, and how to apply reliability requirements to safety systems that include software. The FAA notes that design reliability is for hardware only. The computing system safety requirements in § 450.141 do not provide an estimated reliability, but instead establish process controls that prevent or mitigate computing system faults.

The International Space Safety Foundation commented that FSS is the only system of a launcher for which the operational experience did not provide reliability significant data, because the system was ready but rarely operated. The FAA concurs with the comment that there is a lack of operational experience with FSS as far as terminating vehicles. However, operational parameters are captured throughout flights, whether the result is termination or not, and this data verifies many of the expected operating modes. Also, reliability is gained from design and thorough test programs, as well as review of post-flight data.

The International Space Safety Foundation also commented that to base the approval of a safety-critical system on reliability predictions was not advisable considering the key role played by software, which cannot be taken into account in the reliability prediction. The International Space Safety Foundation recommended that the FAA should instead define fault tolerance requirements for the FSS, and specific software and computing system requirements in addition to generic software development processes.

The FAA disagrees, noting that FSS reliability is also based on design architecture, component selection, and testing that accounts for fault tolerance and the overall system. Recognizing that there are some difficulties in establishing reliability standards below a design reliability of 0.999 at 95 percent confidence and commensurate design, analysis, and testing, the FAA removes the proposed additional requirements for § 450.108(b)(2) FSS and instead relies solely on § 450.143 for design, testing, and monitoring requirements. In addition, recognizing the importance of computing systems to system reliability and public safety, the FAA proposed, and is including in the final rule robust computing system requirements in § 450.141. Computing system requirements are further discussed in the preamble section on Computing Systems and Software.

The International Space Safety Foundation recommended that the FAA set up a multidisciplinary team of design and operation experts to draw a strategy for the definition of FSS design performance requirements, and for addressing the above issues. The FAA believes that standards for FSS should continue to evolve and that industry should be significantly involved in their development. An industry-led development of a voluntary consensus standard or standards addressing design, analysis, or testing of FSS would be particularly beneficial. These standards could become new acceptable means of compliance with FAA regulations.

aa. Hybrid Vehicles

In the NPRM, the FAA proposed one set of requirements for all vehicle types without distinction between traditional and hybrid vehicles. Hybrid vehicles are launch or reentry vehicles that have some characteristics of aircraft and other characteristics of traditional launch or reentry vehicles.

The FAA acknowledges that hybrid operations differ from traditional rocket launches. Part 450 has been revised to accommodate better all vehicle operators, including hybrid vehicle operators. The accommodations include more performance-based requirements, alternatives to flight abort, FSA requirements based on demonstrated reliability, use of equivalent level of safety, and allowing application process alternatives as agreed to by the Administrator. The regulations allow currently licensed hybrid vehicle operators to continue to use a flight hazard analysis as a hazard control strategy. However, one or more hazard control strategies may be required to meet the safety criteria in § 450.101.

The FAA received numerous comments from industry regarding safety requirements for hybrid vehicles, hybrid configurations, component systems, and related operations. The FAA addresses the hybrid vehicle comments that would be applicable to other operators in the applicable topic area sections of this preamble. This section of the preamble addresses the comments that are specific to hybrid operations, such as aircraft certification, piloted vehicles, part 91 applicability, and space support vehicles.

Two commenters stated that the applicability of hybrid systems should be clarified and consolidated in a separate section of the regulation. An individual commenter recommended that the preamble material include a discussion of how the regulations would be applied to hybrid configurations since their characteristics and operations are significantly different from the more traditional RLV or ELV vertical launch systems.

The FAA notes that the final rule provides flexible performance-based regulations that work for all vehicle types, including hybrid vehicles and other innovative architectures. Like all operators, an operator of a hybrid launch or reentry vehicle must choose one or more hazard control strategies for each phase of flight in accordance with § 450.107. The FAA anticipates that hybrid vehicle operators will elect to use a flight hazard analysis as their hazard control strategy for at least some phases of flight because the flight hazard analysis is most similar to the existing system safety process in part 431.

An individual commenter stated that for hybrid vehicles, flying qualities should be identified as safety critical and as a safety element eligible for a safety element approval.

The FAA will work with operators during pre-application consultation and throughout the application review to understand a specific operation to determine what systems are safety critical as defined in § 401.7. All launch vehicles, reentry vehicles, safety systems, processes, services, or personnel are eligible for safety element approvals. The FAA will consider safety element approvals on a case-by-case basis for hybrid vehicles. This concept is discussed in the Safety Element Approval section of the preamble.

An individual commenter recommended that the FAA consider other demonstrated measures of reliability for carrier aircraft to estimate the public risk, such as “attributed reliability” and “validated reliability.”

In the final rule, the FAA uses the term “demonstrated reliability” in §§ 450.101(c)(3) and 450.113(b). The use of this phrase in § 450.101(c)(3) allows an operator to protect against a high consequence event in uncontrolled areas for each phase of flight by establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on CE_C criteria during that phase of flight. The use of this phrase in § 450.113(b) provides an exception for an operator from performing and documenting an FSA for a phase of flight, if agreed to by the Administrator, based on demonstrated reliability. These requirements are discussed in more detail in the High Consequence Event Protection and FSA preamble sections, respectively.

As discussed in the Conditional Expected Casualties section of this preamble and in the NPRM, demonstrated reliability refers to statistically valid probability of failure estimates based on the outcomes of all previous flights of the vehicle or stage in accordance with § 450.131, which is discussed later in the preamble. The draft High Fidelity FSA Methods AC,^[166] published with the NPRM, described acceptable methods, including Bayesian and binomial methods, to calculate demonstrated reliability and demonstrate compliance with § 450.131. As discussed in the draft AC, the prior estimate for the probability of failure during a captive carry phase of flight could be based on a different flight history database ^[167] compared to traditional ELVs. For example, the prior estimate for the probability of failure during a captive carry phase of flight could be based on the flight history of aircraft that also used certain proven or industry standard design, manufacturing, or quality methods. Similarly, if a carrier vehicle were based on or modified from a type certificated commercial aircraft or used certified aircraft components, then the carrier vehicle could be considered a derived vehicle.^[168] In this example, the certification results and operational history for the unmodified components of the aircraft would be accounted for in the calculation of the demonstrated reliability. Under a performance-based regulation, an applicant is free to propose a unique means of compliance with other methods to calculate demonstrated reliability. The FAA will consider other methods to calculate demonstrated reliability for hybrid vehicles such as binomial methods consistent with Appendix A to part 417 under A417.25(b)(5), and other methods used in the past for launch and reentry vehicles.

The FAA notes that other vehicle characteristics, such as flying qualities, do not lend themselves to analysis with statistical reliability measures. For example, acceptable flying qualities in one portion of the envelope do not necessarily predict good flying qualities throughout the full operational envelope, and small aerodynamic modifications or changes to the flight control system can lead to disproportionally large and potentially hazardous changes in flying qualities. In these cases, the FAA would consider flight test results using proven flight test techniques and data analysis methods as validated reliability.

An individual commenter urged the FAA to consider more than just the fact that a vehicle holds an airworthiness certificate as evidence of demonstrated reliability.

The FAA agrees that possession of an airworthiness certificate alone does not guarantee that a vehicle or operation will have a level of reliability sufficient to meet the part 450 public safety requirements. The FAA considers other factors to determine reliability. The FAA will consider the aircraft's original certification, its current certification, and any modifications introduced through issuance of supplemental type certificates. For example, a transport category aircraft that has held a standard airworthiness certificate and then been recertified to a restricted or experimental category. Any modifications to the aircraft design certification may affect the aircraft's reliability for the purposes of part 450, and the FAA therefore will take these modifications into consideration. An understanding of an aircraft's past and current operating environments and its maintenance history are also relevant to the current reliability estimate.

In addition, the FAA may consider other factors outside of certification, such as a rigorous flight test program. Some launch operators have or are developing new, purpose-built launch vehicles that may serve as a component of a hybrid launch or may be designed as rocket-powered aircraft and transitioned to licensed launch operations following flight testing. These operators may hold experimental airworthiness certificates for testing design concepts and aircraft operating techniques. Experimental airworthiness certificates may also be offered as part of a hybrid operator's application to establish the vehicle's demonstrated reliability. The FAA's Office of Commercial Space Transportation will continue to coordinate with the FAA's Aviation Safety organization on issuance of an experimental airworthiness certificate and the vehicle's developmental program to understand its demonstrated reliability.

The FAA will also consider each crewmember's level of pilot certification and flight experience, as well as the recency of that experience as evidence of demonstrated reliability of the launch or reentry system.^[169] While part 460 requires flight crew to hold at least a private pilot certificate with an instrument rating, operators using flight crew with higher levels of certification, operationally related flight experience, and recent flight experience and training can demonstrate higher reliability. For example, a crewmember holding commercial and airline transport pilot certificates have more flight experience and have been tested to a higher level of proficiency than a crewmember who holds a private pilot certificate. In addition, crewmembers with operationally related flight experience will have an understanding of the decision-making required for high-altitude flight and airspeed regimes, and the recent flight experience and training of all crewmembers is recognized as foundational to ensuring a safe operating environment of an aircraft or launch vehicle.

An individual commenter stated that the phase of a hybrid vehicle operation in which the carrier vehicle is alone would be required to take into account any potential aggressive maneuvers the vehicle may have to make to clear a just-released rocket. The commenter further stated that a civil airworthiness certificate may not be adequate to cover the risks posed to the public by these unusual maneuvers.

The FAA agrees that the entirety of a launch or reentry operation must be analyzed for hybrid operations. The FAA notes that once a rocket is released, the carrier vehicle remains in the launch phase until all components of the launch system have impacted or landed on the earth and been rendered safe. Therefore, any maneuvers the carrier vehicle makes after a rocket is released but before both components have impacted or landed and been returned to a safe condition will occur under the license and be assessed consistent with the requirements of part 450.

Virgin Galactic expressed concerns that rather than streamlining the requirements to create performance-based standards, the FAA is combining its requirements for ELVs and hybrid RLVs so that each type of operator might be subject to inappropriate or ambiguous requirements. Virgin Galactic commented that it appreciated the flexibility that some of the new regulations would provide but noted that others seem too vague.

The FAA finds the final rule provides sufficient flexibility for hybrid vehicles. The performance-based regulations in the final rule allow operators like Virgin Galactic to propose an alternate approach by demonstrating an equivalent level of safety or use a unique means of compliance. To retain the maximum flexibility to adjust to dynamic industry changes, the FAA will continue to offer operators the choice to request ELOS determinations. In addition, 51 U.S.C. 50905(b)(3) allows the Secretary to waive a requirement in the public interest and will not jeopardize public health and safety, safety of property, and national security and foreign policy interests of the United States. Rather than explicitly reference hybrid vehicles, the final rule provides the flexibilities to all operators, including operators of hybrid vehicles and other innovative concepts.

Virgin Galactic also stated that the intent of the requirement should be publicly articulated in the regulations and not reside in the preamble. The FAA notes both the preamble and the regulations are publicly available. The intent behind the regulations correctly resides in the preamble because the regulations contain only the regulatory requirements by which regulated entities are bound. The preamble provides further explanation as to why the FAA has elected to adopt the regulatory requirements in order to provide transparency and further elaborate on the agency's intent.

An individual commenter stated that hybrid configurations, carrier aircraft flying alone, and reentry vehicles using aerodynamic controls should follow controller instructions and abide by the general operating and flight rules of aviation found in 14 CFR part 91. The individual commented that hybrid launch vehicles with pilot-in-the-loop control systems spend much more time than RLV and ELV systems in restricted airspace and overflying populated areas and that this requires hybrid configurations to have the capability to operate safely in a controlled airspace environment like other aircraft.

The FAA agrees and notes that applicants may elect to mitigate hazards to the public by proposing applicable sections of part 91 to demonstrate compliance with specific requirements in part 450. However, all components of a hybrid vehicle operate solely under a license when the intent of flight is to conduct a launch or reentry.

Virgin Galactic stated that the FAA should have a narrowly tailored CE_C exemption from the flight abort requirements of proposed §§ 450.101(c) and 450.145 for piloted aircraft because the pilot would already provide an FSS with abort capability. Virgin Galactic further stated that a carrier aircraft in a hybrid system that operated safely under its experimental airworthiness certificate should not be subjected to the CE_C requirement in proposed § 450.101(c).

The FAA does not agree with Virgin Galactic's comment to include an exemption from demonstrating protection against a high consequence event for a piloted carrier vehicle because the operation of such a vehicle may result in a high consequence event. As discussed earlier in this preamble, operators must protect against a high consequence event because such an event could result in a large number of casualties. The FAA notes that the final rule allows an operator to seek an ELOS determination for § 450.101(c)(2). However, an exemption for all piloted carrier vehicles would not be appropriate for launch or reentry vehicle systems that have not yet been evaluated. Hence, an applicant can use another method of measuring the potential for a high consequence event that demonstrates an equivalent level of safety in accordance with § 450.37. Reusable vehicles and other innovative architectures may be required by § 450.101(c) to have a method to achieve flight abort reliably to mitigate flight risks and consequences fully, either in the form of a pilot that can safely abort flight using system controls or a more traditional FSS. A pilot may provide protection against a high consequence event. The FAA may consider a pilot to be an FSS performing a flight abort if the pilot can initiate and accomplish a controlled ending to vehicle flight reliably to limit or restrict the hazards to public health and safety, and the safety of property. Under the provision in § 450.101(c)(3), the flight of a carrier vehicle carrying a rocket to a drop point could be an example of sufficient protection against a high consequence event, even if the CE_C were above the 1 × 10⁻³ threshold, if the carrier vehicle has sufficient demonstrated reliability. Demonstrated reliability and other flexibilities are discussed more fully in the High Consequence Protection section of this preamble.

Virgin Galactic noted that a carrier aircraft operating under an airworthiness certificate should be exempt from proposed § 450.101(f), which, for any launch, reentry, or disposal, requires an operator to notify the public of any region of land, sea, or air that contains, with 97 percent probability of containment, all debris resulting from normal flight events capable of causing a casualty. Virgin Galactic stated that the requirement was unclear because it discussed debris resulting from normal flight events. Virgin Galactic requested further clarification on the purpose of public notification if the proposed requirement was intended to address returning vehicles that remain intact and on a nominal trajectory to the intended reentry site. Virgin Galactic recommended that, if this regulation was intended to apply to jettisoning of orbital rocket stages and the return/disposal of upper stages, it should state as much.

The FAA agrees that returning vehicles on a normal trajectory do not constitute “debris” as the term is used in § 450.101(f). However, the FAA will not exempt all hybrid vehicle operators from the requirement in § 450.101(f) because future hybrid operators could possibly generate debris capable of causing a casualty from normal vehicle flight. If an operation has no planned impacts from debris capable of causing a casualty, then no notification will be necessary to comply with § 450.101(f).

Several commenters, including ALPA, Starfighters, and Virgin Galactic, submitted comments regarding the applicability of FSA requirements for hybrid vehicles under proposed § 450.113(a)(5). Virgin Galactic noted that, for the captive carry phase of a hybrid vehicle mission, the FAA should exempt operators from performing an FSA for a piloted aircraft that operated in accordance with aviation regulations. Virgin Galactic stated the FAA should include such an exemption because the pilot would already provide abort capability as an FSS. Starfighters commented that an FSA should be required only for the air-release launch phase of a hybrid vehicle mission, not the earlier captive-carry phase, which might be many miles away from the actual release point. However, ALPA stated that the FAA should require an FSA for all phases of flight until sufficient quantitative data for hybrid commercial space vehicles becomes available for analysis and to conduct a regulatory process to standardize airworthiness requirements for hybrid commercial space vehicles. An individual commenter noted airworthiness certificates issued by the FAA are part of a safety analysis but are not conclusive evidence of demonstrated reliability for the purpose of proposed § 450.113(a)(5). ALPA noted that flight test results using proven flight test techniques and data analysis methods should serve to validate reliability of hybrid vehicles' carrier aircraft under proposed § 450.113(a)(5), without requiring documentation and statistical analysis of all previous flights.

In the final rule, the FAA is not providing a blanket exemption to the FSA requirements for hybrid operations. The final rule removes § 450.113(a)(5) but maintains the flexibility proposed in the NPRM to enable an operator of a hybrid vehicle with a high level of demonstrated reliability to be exempt from performing some FSAs for some phases of flight without seeking a waiver. The FAA will work with hybrid vehicle applicants during pre-application consultation on how to comply with FSA, CE_C, and FSS requirements utilizing the flexibilities that may be applicable depending on the applicant's vehicle and concept of operations. For example, the FAA might determine the quantitative FSA requirements for those portions of an operation for which the vehicle operates similarly to a civil aviation aircraft governed by civil aviation regulations are unnecessary because the vehicle has demonstrated reliability for operations using a certificated aircraft or a valid airworthiness certificate with an acceptable flight test history.

The FAA expands the flexibility for hybrid vehicles in proposed § 450.113(a)(5) to all vehicle operators in the final rule in § 450.113, as discussed in more detail in the preamble section for FSA Requirements Scope and Applicability. The FAA finds this flexibility should be available to all operators if agreed to by the Administrator based on demonstrated reliability. This wider availability will provide a common regulatory construct across different operators to identify the phases of flight for which FSA must be performed. Based on current licensed operations, the FAA anticipates that initially only carrier vehicles that have an airworthiness certificate and extensive flight history would be able to meet the demonstrated reliability standard. Aside from some carrier aircraft used as a component of a launch vehicle, no existing launch vehicle has enough history to ensure sufficient protection against a high consequence event based on demonstrated reliability in accordance with § 450.101(c) or enough empirical evidence to demonstrate compliance with the public risk criteria in § 450.101(a) or (b).^[170]

Virgin Galactic asked about the applicability of the rule for hybrid vehicles, including certain operational exemptions. Virgin Galactic commented that the safety-critical system requirements in § 450.143 should not apply to hybrid carrier aircraft that operate under an FAA-issued license and hold an airworthiness certificate issued by the FAA. Virgin Galactic noted the requirements of this section were akin to aircraft certification, which are spelled out in the applicable parts of 14 CFR Chapter 1 that have been developed over decades as the aviation industry matured. Virgin Galactic stated that the commercial space industry is not at the state of maturity as commercial aviation, and applying these similar “certification” requirements is contrary to the requirement in the Commercial Space Launch Act to promote the commercial space launch industry and only regulate to the extent necessary.

The FAA does not agree that carrier vehicles operating under an FAA-issued license with an airworthiness certificate issued by the FAA should be exempt from the safety-critical system requirements in § 450.143. While airworthiness certification likely indicates increased reliability because a certificated aircraft has satisfied many separate FAA regulations, the satisfaction of those regulations does not alone demonstrate that the carrier vehicle will meet the applicable requirements under chapter III. However, an applicant may make a safety case supporting an equivalent level of safety for a component of a launch system if it holds a valid airworthiness certificate with an acceptable flight test history. In the final rule, § 450.143 includes the requirements for all safety-critical system components and eliminates the ambiguity that existed in the part 431 regulations regarding required testing of safety-critical systems. Section 450.143(e)(3) also requires a summary of the analysis detailing how applicants arrived at the predicted operating environment and duration for all qualification and acceptance testing. Such a summary is current practice, and § 450.143(e) makes this requirement explicit for all vehicles. In response to Virgin Galactic's comments regarding the relative maturity of commercial aviation versus the commercial space industry and the appropriate approach to regulating the commercial space industry, the FAA believes that the performance-based requirements of the final rule fulfill statutory mandates and are appropriate for the commercial space industry's capabilities now and as they will evolve in the future.

An individual commenter stated that the carrier aircraft portion of their launch system would also be capable of conducting operations as a space support vehicle (SSV). The commenter sought clarification as to whether part 450 would require adjustment to be consistent with new SSV operations. SSVs and SSV flight are defined in section 50902 of title 51. Requirements to conduct the flight of a space support vehicle would be promulgated pursuant to Section 44737, and are beyond the scope of this rulemaking.

bb. Agreements and Airspace (§ 450.147)

In the NPRM, the FAA proposed to streamline the existing requirements for agreements by removing specific requirements for a variety of agreements and procedures and allowing an operator to determine what agreements would be needed for its particular operation. As proposed in § 450.147, a vehicle operator would be required to have written agreements with any entity that provides a service or use of property to meet a requirement in part 450. The regulation identified various entities for which agreements may be required including a Federal launch range operator, a licensed launch or reentry site operator, any party that provides access to or use of property and services required to support a safe launch or reentry under part 450, the U.S. Coast Guard, and the FAA.

In the final rule, the FAA adopts the proposal with one minor change. The FAA has replaced the words “Federal launch range” in § 450.147(a)(1) with “Federal launch or reentry site” to encompass all Federal sites used for licensed activities.

AAAE asked whether proposed § 450.147(a)(1) would require agreements with alternative or contingent landing sites and requested that the FAA expressly require such agreements to ensure that they are included in the licensing and launch preparation process. In § 450.147(a)(1), the FAA requires agreements with any entity that provides access to property required to support a safe launch or reentry. Contingency abort locations are taken into consideration by the applicant as part of its public safety analyses and by the FAA in its environmental review. Because contingency abort locations necessarily involve planned access to property, the FAA will not revise the regulation to expressly require agreements with alternative or contingent landing sites. The language in § 450.147(a)(1) is sufficient to ensure agreements are in place for all planned locations. The FAA will not require such agreements for emergency landing sites or other locations that are being considered, but have not been finalized by the operator.^[171]

Section 450.147(a)(3) requires operators to have written agreements with FAA's Air Traffic Organization (ATO) or foreign air navigation service providers (ANSP) to establish procedures for the issuance of a Notices to Airmen (NOTAM) prior to a launch or reentry.

AOPA recommended that the FAA establish procedures for the issuance of a Notices to Airmen (NOTAM) at least 72 hours prior to a launch or reentry to forewarn the public about activation of different airspace.

It would not be appropriate within this commercial space rulemaking to impose a requirement on the FAA ATO or a foreign ANSP to issue NOTAMs within a particular time frame. Each ANSP is responsible for the safe and efficient use of its airspace and can be expected to provide notification consistent with its obligations. As such, notification requirements necessary to protect the public, including any minimum times for notification, should be determined as part of the agreement development process with the FAA ATO or foreign ANSP.

Section 450.147(a)(4) requires an operator to enter into such agreements with emergency response providers, including local government authorities, as necessary to satisfy the requirements of § 450.173 (Mishap plan—reporting, response, and investigation requirements).

SpaceX recommended that proposed § 450.147(a)(4) exclude government installations where responsibilities and mutual aid protocol rendered separate agreements with local authorities unnecessary. SpaceX believes this addition would manage expectations where multiple Federal entities may have overlapping jurisdiction for addressing mishap response.

Because § 450.173(d)(5) requires an operator to implement agreements with government authorities and emergency responders “as necessary” to satisfy the requirements of § 450.173, no change to the proposed language in § 450.147(a)(4) is required. An operator that is launching from a Federal launch site is not required to execute agreements with local authorities if the Federal site already has the necessary coordination in place to satisfy the requirements in § 450.173.

Section 450.147(b) requires that agreements clearly delineate the roles and responsibilities of each party to support the safe launch or reentry under part 450. SpaceX suggested adding language to require parties to delineate roles and responsibilities “within their jurisdiction.” Indeed, an entity may only enter into an agreement to the extent they are authorized, but the FAA disagrees that this language is needed in the regulation.

Section 450.147(d) requires operators to describe each agreement submitted in accordance with the section.

SpaceX asked the FAA to clarify in a guidance document the intent of proposed § 450.147(d) and allow operators to provide other acceptable documentation (e.g., business processes like the Universal Documentation System) to avoid literal interpretations of requirements. To comply with this requirement, the operator will enumerate those services that the site operator is providing through various agreements. The FAA may request a specific agreement that the site operator has established to provide such a service. As long as each agreement required by this section meets the criteria set forth in § 450.147, the operator may choose the format of the agreement. Therefore, the FAA adopts the proposed rule without change.

Virgin Galactic asked whether an agreement would be required with local authorities to ensure that the area is cleared of the public and critical assets if an operator cannot meet conditional risk factor criteria for an uncontrollable area of land. The FAA notes that conditional risk does not trigger the need for an agreement with a local authority. Instead, it is related to the need for an FSS. However, such an agreement might be a means of mitigating conditional risk, potentially to a degree at which the operator does not need to employ an FSS.

A number of commenters expressed concern that the NPRM did not require that airspace efficiency be taken into consideration as part of a launch or reentry operation. AAAE, A4A, ACI, ALPA, AOPA, CAA, NATCA, RAA, and Southwest Airlines recommended the FAA incorporate airspace efficiency consideration into the licensing process to minimize negative operational and financial impacts for airlines, passengers, cargo shippers, and the public that will result from this rulemaking. A4A, AAAE, and Southwest Airlines advocated increased transparency and collaboration with airspace stakeholders in developing agreements pursuant to proposed § 450.147. A4A, AAAE, ACI, ALPA, AOPA, CAA, NATCA, and RAA recommended the FAA ensure the safety requirements for commercial space operations, particularly those addressing risks to other aviation users, are commensurate with the expectations of the flying public. AOPA recommended the FAA prioritize funding and implementation of the Aeronautical Information Management Modernization program, which would provide real-time airspace information. A4A, AAAE, ACI, and AOPA recommended the FAA incorporate and implement various recommendations from the Airspace Access Priorities ARC and Spaceport Categorization ARC.

The FAA acknowledges the commenters' concerns regarding airspace efficiency, but these issues are not within the scope of this rulemaking. Operational oversight and management of airspace impacts are managed at the FAA Air Traffic Control System Command Center. As noted in the Flight Hazard Area Analysis section of this preamble, FAA is working to address this issue through the Airspace Access ARC and other initiatives.

cc. Safety-Critical Personnel Qualifications (§ 450.149)

In the NPRM, the FAA proposed to remove the certification requirements found in §§ 417.105, 417.311, and 415.113 and replace them with performance-based requirements in proposed § 450.149 (Safety-Critical Personnel Qualifications). Section 450.149(a) would require an operator to ensure safety-critical personnel are trained, qualified, and capable of performing their safety-critical tasks, and that their training is current. Under proposed § 450.149, an applicant would be required to identify in the application all safety-critical tasks and internal requirements or standards for personnel to meet prior to performing the identified tasks. The application would be required to identify internal training and currency requirements, completion standards, or any other means of demonstrating compliance with the requirements of proposed § 450.149. The applicant would also be required to describe the process for tracking training currency.

Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended that the FAA require that safety-critical personnel comply with the Federal Drug-Free Workplace requirements set forth in 14 CFR 120. These commenters noted that the Federal Drug-Free Workplace requirements apply to government contractors, but commercial operators are only subject to company policy, which may not address the use of drugs and alcohol. The FAA did not propose to require drug and alcohol testing and finds that such a requirement would exceed the scope of this rulemaking. The FAA may consider proposing such action in a future rulemaking.

The FAA received a comment from Blue Origin supporting the changes to the safety-critical personnel qualifications requirements. In the final rule, the FAA adopts § 450.149 as proposed.

dd. Work Shift and Rest Requirements (§ 450.151)

In the NPRM, the FAA proposed to combine the rest requirements of §§ 417.113(f) and 431.43(c)(4) into § 450.151 (Work Shift and Rest Requirements), which would require an applicant to document and implement rest requirements that ensure safety-critical personnel are physically and mentally capable of performing assigned tasks. These requirements would apply to operations of all launch and reentry vehicles and would allow operators flexibility to employ rest rules that fit their particular operations. Section 450.151(b)(1) would require an operator's rest rules to include the duration of each work shift and the process for extending this shift, including the maximum allowable length of any extension. An operator's rest rules would be required to include the number of consecutive work shift days allowed before rest is required. Section 450.151(b)(3) would also require an operator's rest rules to include the minimum rest period required between each work shift, including the period of rest required immediately before the flight countdown work shift. Applicants would be required to submit their rest rules during the license application. In the final rule, the FAA adopts § 450.151 as proposed.

The FAA received seven comments on its proposed work shift and rest requirements. Blue Origin, Rocket Lab, Virgin Galactic, and an individual commenter agreed with FAA's proposed requirements permitting greater flexibility in ensuring sufficient rest for safety-critical personnel. Rocket Lab commented that the proposed approach would enable operators to develop work shift and rest requirements that are appropriate for the individual operating conditions, environment, and mitigations that exist.

Virgin Galactic requested the FAA provide further guidance of what would satisfy proposed § 450.151 beyond the example of § 431.43(c)(4). Section 431.43(c)(4) or the crew rest requirements of AFSPCMAN 91-710 are two possible, but not the only, means of compliance with § 450.151.

ALPA opposed the performance-based approach to work shift and rest requirements, stating that prescriptive duty limits were necessary to reduce the likelihood of human error related to fatigue. ALPA indicated the proposed rule made it possible for a commercial space operator “to set unrealistic crew rest requirements for cost management (doing more with less) instead of safety.” ALPA recommended the FAA adopt the rest rules contained in § 437.51.

The FAA elected a performance-based requirement over a prescriptive one akin to § 437.51 in order to allow operators to develop requirements that are suited to their particular operations. In addition, prescriptive requirements fail to account for the various factors that can affect crew rest, such as the time of day of an operation, length of pre-flight operations, and travel to and from the launch or reentry site. The performance-based requirement set forth in § 450.151 allows operators to take into account such factors affecting crew rest and adopt mitigations and procedures unique to each launch operation. The FAA also disagrees that § 450.151 will enable operators to set unrealistic crew rest requirements in the interest of cutting costs. Although operators can develop rest rules that fit their operations, operators must demonstrate in their application that their rest rules ensure safety-critical personnel are physically and mentally capable of performing assigned tasks. The FAA will evaluate the rest rules during review of the license application, and, if accepted, they will become part of the license. The FAA finds that no change to the proposed regulation is warranted.

ALPA and Blue Origin stated the commercial space operator should be responsible for monitoring compliance with work shift and rest requirements. Blue Origin noted the companies should be responsible for monitoring compliance after the FAA accepts an operator's rules through the application and approval process. Rocket Lab commented that a specific requirement for operators to monitor compliance with work shift and rest requirements was unnecessary as the regulation explicitly required that the rest rules implemented ensure safety-critical personnel are physically and mentally capable of performing all assigned tasks.

Operators are expected to monitor compliance with their approved crew rest rules so that personnel are fit to perform safety-critical tasks and to provide records of compliance with those rules, as required by § 450.219(a), where requested by the FAA. The FAA finds that a specific requirement for operators to monitor compliance with work shift and rest requirements is unnecessary. The rest requirements in § 450.151(b) ensure safety-critical personnel are physically and mentally capable of performing all tasks. It is up to the company to monitor compliance with its work shift and rest rules to ensure personnel are mentally and physically capable of performing safety-critical tasks. An operator must comply with the rest rules accepted by the FAA as part of the license because it must comply with the representations in its application. Therefore, even absent an express requirement, an operator must monitor compliance with its rest rules in order to ensure that the objectives of § 450.151 are met and that the operator does not act contrary to its application.

Blue Origin asked the FAA to clarify the time period to which the rest rules apply in finalizing the rest requirements and the scope of license rule (§ 450.3). Blue Origin suggested the rest requirements should only apply during the period an action could present a distinct impact to safety, akin to how NASA closely monitors astronauts' rest/work periods but does not mandate crew rest requirements for aerospace employees in manufacturing plants or NASA mission control staff.

Although the FAA declines to limit the scope of § 450.151 as Blue Origin recommends, the FAA clarifies that § 450.151 is intended to ensure safety-critical personnel are prepared to perform tasks that have an inherent impact on public safety. Operators must document and implement rest rules to ensure that safety-critical personnel have received adequate rest before they perform any safety-critical task. Operators would not be able to ensure that personnel are physically and mentally prepared to perform safety-critical tasks if the rest rules set forth in § 450.151 applied only during activities that could distinctly affect safety (i.e., during safety-critical tasks). For example, the rest rules apply to safety-critical tasks such as end to end testing and safety-critical hardware installation that may occur before hazardous pre-flight operations trigger the start of launch. Operators must therefore comply with § 450.151 for the duration of their license. The regulation is flexible enough that an operator can develop rules that treat different parts of launch activity differently. The FAA finds that no change to the regulation is warranted.

Blue Origin suggested removing the definition of “vehicle safety operations personnel,” as it has caused confusion in the industry. The FAA agrees and does not adopt the definition.

Boeing, Lockheed Martin, Northrop Grumman, and ULA asserted the requirements proposed in § 450.151(b) reflect a relaxation of work rule standards compared to the current FAA and range policies. They further noted other DOT-regulated industries have explicit rest criteria and recommended that the FAA publish the acceptable criteria rather than having operators negotiate the hours deemed safe.

The requirements proposed in § 450.151(b) are not a relaxation of work rule standards compared to current FAA and range policies because, as previously stated, two of the ways an operator can show compliance with § 450.151 are to meet current FAA rules (§ 431.43(c)(4)) or AFSPCMAN 91-710, and the FAA retains oversight to determine that an operator's rules achieve the standard.

As previously stated, the FAA will issue an AC on a means of compliance for § 450.151. The crew rest requirements previously set forth in part 431 and the current crew rest requirements in AFSPCMAN 91-710 will satisfy § 450.151.

ee. Radio Frequency (§ 450.153)

In the NPRM, the FAA proposed that, for any radio frequency used, an operator would be required to: (1) Identify each frequency, all allowable frequency tolerances, and each frequency's intended use, operating power, and source; (2) provide for the monitoring of frequency usage and enforcement of frequency allocations; and (3) coordinate use of radio frequencies with any site operator and local and Federal authorities. Proposed § 450.153(b) contained application requirements and required an applicant to submit procedures or other means to demonstrate compliance with the radio frequency requirements.

Blue Origin, SpaceX, and Sierra Nevada commented the proposed requirements were duplicative of Federal Communications Commission (FCC) licensing requirements and, according to Blue Origin, were an unnecessary burden on operators. Blue Origin explained that operators coordinate frequency management through the FCC licensing process, which is robust in its technical review of transmitter capabilities. Blue Origin also noted FCC licenses are public information that the FAA can verify. Sierra Nevada suggested the regulation should either require only that the applicant demonstrate it has coordinated with the FCC or be omitted altogether.

The FAA agrees that the proposed requirements in § 450.153(a)(1) and (a)(2) are duplicative of FCC requirements for radiating systems and overly burdensome. The FCC requires in Section 308(b) of the Communications Act of 1934, as amended, all the items in proposed § 450.153(a)(1) and (a)(2) as part of an FCC license for radiating systems that an operator must obtain to operate radiating equipment as part of a launch. The purpose of radio frequency management, as stated in the NPRM,^[172] is to mitigate hazards associated with radio frequency usage including interference that could adversely affect the FSS or any safety-critical system of a vehicle, including RLVs and reentry vehicles. The intent of proposed § 450.153 (a)(1) and (a)(2) was to ensure radio transmissions would not interfere with commanded flight termination systems and would be compatible with the receiving system on the vehicle. The FAA finds that operators can identify and mitigate hazards affecting FSS or safety-critical systems effectively without duplicating information required by the FCC. In the final rule, the FAA amends § 450.153(a) by replacing (a)(1) and (a)(2) with the performance-based objective central to § 450.153 that requires operators to ensure radio frequency interference does not adversely affect performance of any FSS or safety-critical system. Proposed § 450.153(a)(3) is re-designated as (a)(2) and continues to require operators to coordinate use of radio frequencies with any site operator and any local and Federal authorities, including any State, tribal, or territorial authorities.

Blue Origin commented that proposed § 450.153 added to the burden previously placed on operators under part 431, which ought to be included in the FAA's cost analysis. Blue Origin explained an applicant would be required to submit to FAA the substantive content of a frequency management plan and submit procedures to demonstrate compliance with that plan. Blue Origin pointed out that under part 431, the FAA did not require operators to prove they acquired FCC licenses for a mission or that they coordinated the use of radio frequencies.

As previously explained, the FAA has removed the duplicative provisions from § 450.153, which would have amounted to a greater burden on operators than has previously been required under part 431. As such, in the final rule, § 450.153 requires no more of operators than what part 431 required for analysis of hazards associated with licensed activities, creating no additional cost to operators.

Blue Origin recommended proposed § 450.153 be removed since applicants were already required to address and mitigate hazards associated with frequency coordination or radiation exposure or power limits as part of their hazard analysis. Blue Origin added that, for launches at Federal launch or reentry sites, proposed § 450.153 would duplicate much of the information submitted to the Federal site, whose frequency management office typically works with range scheduling to regulate radiation and power limits to prevent exceeding radiation exposure and power limits while on the pad and harming the vehicle or payload. For operations that do not occur on Federal sites, Blue Origin indicated an operator would proceed as under the current part 431 by identifying hazards and mitigation measures required to meet the public safety limits. According to Blue Origin, operators should incorporate hazards associated with this issue in their hazard analysis, including identifying mitigation issues.

The FAA disagrees that § 450.153 is unnecessary or duplicative of hazard analysis requirements. As stated in the NPRM, the FAA has determined that the public safety risks posed by radio frequency interference warrant specific attention apart from the general requirement that operators identify and mitigate hazards associated with licensed activity. To the extent Federal launch or reentry site procedures provide for coordination of radio frequencies used, an operator may rely on those procedures to demonstrate compliance with § 450.153. The FAA does not prescribe the manner in which an operator ensures that radio frequency interference does not adversely affect a vehicle's FSS or any safety-critical system. The FAA merely requires that operators set forth in their applications a means of complying with § 450.153 so that the FAA can ensure that radio interference issues are appropriately addressed.

In an effort to streamline radio frequency requirements, SpaceX recommended the FAA revise proposed § 450.153(a)(2) to require that operators ensure frequency utilization according to frequency authorization parameters. SpaceX also recommended the FAA revise proposed § 450.153(b) to require coordination with site operators and local and Federal authorities only for launches that do not occur on a Federal launch or reentry site with existing radio frequency policies and procedures.

The FAA disagrees that any frequency authorization parameters issued by the FCC, which are geared toward managing frequency use and operation, would be sufficient to assess hazards to public safety posed by radio frequency interference, which are properly within the FAA's purview. As previously discussed, the FAA has removed the prescriptive requirements that it deemed duplicative of FCC requirements in proposed § 450.153(a) and replaces them with a central performance-based objective. The FAA declines to accept SpaceX's suggestion to amend § 450.153(b). The coordination required by § 450.153(b) allows an operator to operate a command transmitter at a frequency and power that ensures a flight termination system signal can be successfully transmitted, and thereby prevent harmful radio interference, in the interest of public safety. The FAA declines to remove the requirement that all operators coordinate use of radio frequencies with any site operator and local and Federal authorities in order to protect the public and public property, because such coordination is necessary to prevent radio interference that could affect public safety. Users of Federal launch or reentry sites may use Federal site procedures for radio frequency to demonstrate compliance with § 450.153.

Virgin Galactic asked if an operator could contract a third party to meet the frequency management requirements.

The FAA does not prescribe the means by which an operator complies with § 450.153. An operator could therefore enter into an agreement in accordance with § 450.147 to have a third party, such as a spaceport or Federal launch or reentry site, satisfy the radio frequency management requirements contained in § 450.153.

As noted, the FAA adopts § 450.153 (Radio Frequency Management) with revisions. The FAA replaces paragraphs (a)(1) and (a)(2) with performance-based objectives central to radio frequency management. Operators will be required to ensure that radio frequency does not adversely affect the performance of FSS or safety-critical systems and to coordinate use of radio frequencies with any site operator and local and Federal authorities.

ff. Readiness and Rehearsals (§ 450.155)

In the NPRM, the FAA proposed an operator would be required to document and implement procedures to assess readiness to proceed with the flight of a launch or reentry vehicle. As part of the application requirements, proposed § 450.155(b)(2) would require an applicant to describe the criteria for establishing readiness to proceed with the flight of a launch or reentry vehicle.

Rocket Lab expressed support for the proposed requirements as reducing the risk of unintended consequences that resulted from stringent time requirements. SpaceX recommended that the FAA clarify its intent for flight commit criteria in proposed § 450.155(b)(2) to ensure that mission success is not a factor by having applicants describe the criteria “to ensure public safety” for establishing readiness to proceed with the flight of a launch or reentry vehicle.

The FAA agrees that a change to the proposed regulatory language would clarify the scope of the requirement. Therefore, the FAA revises § 450.155(b)(2) by adding the phrase “so that public safety is maintained” to the end of the paragraph. The FAA did not adopt the language recommended by SpaceX because the requirement calls for criteria that establish readiness to proceed with flight or reentry while ensuring public safety. The FAA's revision maintains the emphasis on developing criteria to determine readiness to proceed with launch or reentry, and clarifies that the operator need only identify those criteria that affect public safety.

gg. Communications (§ 450.157)

In the NPRM, the FAA proposed to preserve the substantive communications requirements from parts 417 and 431 but eliminate the requirement to implement a communications plan. Proposed § 450.157(a) would require an operator to define the authority of personnel to issue “hold/resume,” “go/no go,” and abort commands, assign communication networks so those personnel have direct access to real-time safety-critical information, ensure those personnel monitor each common intercom channel during countdown and flight, and implement a protocol for using defined radio telephone communications terminology. Proposed § 450.157(c) would also require an operator during each countdown to record all safety-critical communications network channels that are used for voice, video, or data transmissions to support safety-critical systems. This requirement is substantially the same requirement in §§ 417.111(l)(5)(vii) and 431.41. In the final rule, with the exception of proposed § 450.157(a)(3) as discussed later in this preamble section, the FAA adopts § 450.157 as proposed.

As explained in the NPRM, operators would not need to submit their communication procedures during the application process as those procedures generally are not mature at that time. The FAA will verify compliance with § 450.157 during inspections.^[173] The inspections will be consistent with current practice, in which FAA inspectors often review the operator's final communications procedures. Given that operators do not need to demonstrate compliance with § 450.157 at the application stage, operators may be required to revise their communication procedures to resolve issues identified during compliance monitoring.

The FAA received three comments addressing the communications requirements proposed in § 450.157. AAAE recommended the FAA require procedures and protocols on how the operator would communicate with contingency or alternative landing sites, and emergency responders. AAAE also suggested the FAA consider providing these same stakeholders with the ability to monitor countdown and communications channels, just as operators would be required to provide the FAA with such access under proposed § 450.209.

The FAA finds no additional requirements are necessary, as the accident investigation and agreement requirements address AAAE's concerns. Operators must include emergency response procedures in their mishap plans pursuant to § 450.173, which could, in many instances include communication procedures with emergency response service providers. In addition, operators must enter into and implement any necessary agreements with local authorities and emergency response services, such as first responders. Any other stakeholder, such as a contingency abort site, may request to monitor channels as part of its agreement with the operator, but the FAA does not find it necessary for safety to mandate this type of monitoring in all situations.

Sierra Nevada commented that the requirement to monitor each common intercom channel is excessive and would decrease the safety of an operation. It noted that, for operators with multiple channels (e.g., more than 10), monitoring each channel would serve to decrease the overall situational awareness of the controller. Sierra Nevada recommended the FAA revise proposed § 450.157(a)(3) to require that personnel monitor only the applicable intercom channels during countdown and flight.

The FAA agrees with Sierra Nevada's recommendation and removes § 450.157(a)(3). The persons responsible for the launch need to maintain situational awareness and have all safety-critical information in order to make decisions that affect public safety. In cases in which there are multiple channels, all channels do not have to be monitored at the same time. It is common practice to turn down or turn off channels in order to listen to a channel that has critical information. Each person identified in paragraph (a)(1) of this section is not required to listen actively at all times. Operator personnel other than those listed in (a)(1) may listen to channels as necessary to relay critical information to the personnel listed in (a)(1).

Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the FAA qualify the requirement to record safety-critical communications channels in § 450.157(c) as “subject to records retention requirements of § 450.219.” The FAA agrees that an operator must record all safety-critical channels and retain them for the time periods specified in § 450.219, but does not agree that a change to the regulatory text is necessary.

hh. Pre-Flight Procedures (§ 450.159)

In the NPRM, the FAA proposed to streamline countdown procedures and requirements. Specifically, the FAA proposed not to include in part 450 the requirements for safety directives or safety notebooks in § 431.37(a)(2) and for a countdown plan in § 417.111(l), as well as the requirement to file such plans, because there are many methods of documenting pre-flight procedures that do not involve a plan or notebook. In addition, the FAA proposed a performance-based requirement in which an operator who needs to implement pre-flight procedures would verify that all flight commit criteria are satisfied before flight and ensure the operator is capable of returning the vehicle to a safe state after a countdown abort or delay. In the final rule, the FAA adopts § 450.159 (Pre-flight Procedures) as proposed.

Virgin Galactic commented that, if the FAA knows which events must take place as a part of a countdown, it should require them in proposed § 450.159(a)(1). Virgin Galactic recommended the FAA require operators to identify the sequence of events that must take place to initiate flight in order to verify that flight commit criteria are satisfied.

Flight commit criteria involve much more than the launch sequence of events, including interdependent conditions such as meteorological conditions, lightning protection equipment measurements, and status of safety system components. Therefore, the requirements of § 450.159 cannot be satisfied by merely having operators identify the launch sequence of events. Furthermore, the FAA does not think a prescriptive requirement listing which events must take place as part of a countdown is necessary to ensure safety. Rather, this section takes a performance based approach that focuses more comprehensively on verification of flight commit criteria and the operator's ability to ensure that it can return the vehicle to a safe state after a countdown abort or delay. The FAA notes that the requirements for the flight commit criteria itself are clearly provided in § 450.165(b).

ii. Control of Hazard Areas (§ 450.161)

In the NPRM, the FAA proposed that an operator would be required to publicize, survey, and evacuate each flight hazard area before initiating flight or reentry to the extent necessary to ensure compliance with proposed § 450.101. Proposed § 450.161(a) did not change the need for surveillance relative to the current requirements in parts 417 and 431 ^[174] for people on land or aircraft because an operator must continue to ensure all regions where any individual member of the public would be exposed to more than 1 × 10⁻⁶ P_C (probability of casualty) are evacuated. However, the FAA proposed to revise the requirement to evacuate and monitor areas where a waterborne vessel would be exposed to greater than 1 × 10⁻⁵ P_I (probability of impact) currently required by Appendix B to part 417 under B417.5(a). The NPRM allowed an operator to include people in waterborne vessels in collective risk computations, rather than clearing a waterborne vessel from a hazard area because the vessel is exposed to 1 × 10⁻⁵ P_I. The NPRM proposal to include people on ships in the collective risk computation in § 450.101(a)(1) and (b)(1) would allow the application of risk management principles to protect people on waterborne vessels. In the final rule, the FAA adopts § 450.161 with revisions. It updates § 450.161 to be consistent with the language in flight hazard area analysis section, § 450.133, and adds an application requirement for a description of how the applicant will provide for any publication of flight hazard areas.

The FAA changes the title of this section from “Surveillance and Publication of Hazard Areas” to “Control of Hazard Areas” to describe the contents of this section fully, as the requirements cover more than surveillance and publication. The FAA also changed the proposed wording in § 450.161(a) from “publicize, survey, and evacuate” to “survey, publicize, control or evacuate” to match the language in § 450.133(a), which describes flight hazard area analysis. The term “control” is used to describe the overall management of hazard areas, including control of entry and exit points such as roadblocks and security checkpoints. The FAA also adds language in § 450.161(a) that references the flight hazard area requirements in § 450.133, which requires an applicant to identify the flight hazard areas it needs to control.

The FAA notes that the requirements in § 450.161 are consistent with the recommendations made by the National Academy of Sciences National Research Council.^[175] An applicant could apply conservative estimates of the ship traffic and vulnerability to demonstrate acceptable public risks. However, as explained in the NPRM, the operators still have the option to use the current approach in part 417, where surveillance is required to ensure no ship is exposed to more than 1 × 10⁻⁵ P_I, because that would be sufficient to ensure compliance with § 450.101.

Boeing, Lockheed Martin, Northrop Grumman, and ULA proposed that the phrase “unless otherwise assigned through agreement with a launch or reentry facility” be added to proposed § 450.161(a) for clarification. Virgin Galactic also recommended that this requirement be handled through Letters of Agreement. Although the operator may contract with another party for the provision of services to meet this requirement, the licensee remains responsible for complying with the requirement. As such, the FAA does not agree that this recommended addition is necessary.

SpinLaunch commented that the goals of the NOTAM required under proposed § 450.161 can be addressed through area designations on Sectional Aeronautical Charts, controlled airspace designation, and coordination with Air Traffic Control. The FAA is responsible for the management of the NAS and establishes the regulations, processes, and procedures for restricting airspace including airspace restrictions for commercial space activity. Under § 450.147, when an operator enters into a letter of agreement with the FAA, the airspace needed to accomplish the proposed operation safely is notionally identified and air traffic control coordination procedures are established accordingly. The FAA did not propose changes to airspace management regulations or processes, so SpinLaunch's comment is beyond the scope of this rulemaking.

AOPA commented that airspace hazard volumes are not communicated in a standardized manner today, nor are pilots educated on what to do with this information. AOPA further commented that a publicly accessible, authoritative source for launch information would greatly increase awareness and mitigate adverse impacts caused by short notice announcements of launches. The commenter also suggested that prospective users of the system should be part of this capability's development process.

As discussed more fully in the preamble section associated with Flight Hazard Area Analysis, the FAA finds that the issue raised by AOPA is best addressed by the NOTAM/AIM Modernization effort rather than this rulemaking.

Boeing commented that, currently, not all areas that are publicized are also surveyed, controlled, and evacuated. Boeing stated that the need to survey and evacuate should be scalable and dependent upon the risk magnitude and area, remoteness of the hazard areas, capabilities for monitoring, and overall risk/benefit tradeoff. The FAA does not believe a change to the proposed rule is necessary to address these concerns. The requirement to survey, publicize, control, and evacuate each flight hazard area is scalable, as these measures are required “to the extent necessary to ensure compliance with § 450.101.” This reference to § 450.101 means that the need to control the hazard areas is dependent on the public risk criteria, as well as the inputs and assumptions used in the FSA.

Sierra Nevada commented that § 450.161 would be an increase in regulatory burden due to surveillance over a large area being cost-prohibitive and nearly impossible to implement for smaller companies. Sierra Nevada recommended that operators only be required to ensure NOTAMs and Notices to Mariners are in place prior to operation, and should not bear consequences if the public breaches those areas. Sierra Nevada also asked how an operator could reasonably survey an aircraft hazard area over a large area of ocean.

The FAA disagrees with this comment and notes that this requirement codifies current practice. The FAA further notes that the only change to current practice—the inclusion of people on ships in collective risk—actually decreases regulatory burden for waterborne vessel hazard areas. An operator is no longer required to evacuate and monitor areas where a waterborne vessel would be exposed to greater than 1 × 10^−[5] P_I. In issuing its first waiver of the existing requirement in § 417.107(b)(3),^[176] the FAA explained that successful application of the public risk management for the protection of people in waterborne vessels has the potential for reducing launch costs by reducing delays due to ship traffic in warning areas while maintaining a high level of public safety. For example, prior to the waiver of § 417.107(b)(3), a launch from Cape Canaveral Air Force Station was delayed, in order to meet the requirements of § 417.107(b)(3), by the presence of a tug boat towing a large barge inside the ship hazard area. The final rule addresses Sierra Nevada's concerns regarding surveillance of a large portion of ocean by including people on ships in the collective risk criterion. Furthermore, the FAA notes that this requirement could be met a number of ways, including through an operator agreement with a Federal launch or reentry site or the FAA.

Virgin Galactic asked whether it is necessary to require an operator to meet the E_C criteria if the operator is using a flight hazard area, thus ensuring no member of the public is in the area. The FAA addressed this issue during the public comment period in “Responses to the Public's Clarifying Questions Received by July 12, 2019.” An E_C analysis is still required even if launch hazards are contained over regions of land, sea, or air that are completely void of members of the public because the systems necessary to achieve such containment, such as an FSS, may fail. If an FSS fails, debris may fall outside of hazard areas where members of the public are present. The E_C analysis ensures that the potential failure of those systems is accounted for when calculating risk to the public.

In the NPRM, proposed § 450.161(b) would have required an operator to perform surveillance sufficient to verify or update the assumptions, input data, and results of the FSA. The NPRM preamble stated that, given that there are numerous assumptions and input data that are critical to the validity of the FSA, this requirement could have a variety of surveillance implications beyond the surveillance necessary to ensure the public exposure at the time of the operation is consistent with the assumptions and input data for the FSA. As described in the NPRM preamble, an example would be that an FSA could assume that a jettisoned stage remains intact to impact or breaks up into pieces that are not all capable of causing casualties to people on the ground but could still be capable of causing casualties to people in a particularly vulnerable class of aircraft, such as helicopters.

In the final rule, the FAA maintains the requirement that an operator employ some type of surveillance (e.g., telemetry data, or remote sensors such as a camera or radar) to verify that the jettisoned stage behaves in a manner consistent with the FSA if that behavior is germane to the size of the aircraft hazard area. The FAA clarifies that if an FSA includes conservative assumptions and inputs, or a sensitivity analysis to demonstrate that the assumptions regarding break-up of a jettisoned stage are not germane to the size of the aircraft hazard area, the operator will only be required under § 450.161(b) to demonstrate surveillance sufficient to verify the accuracy of the FSA. If the assumptions and inputs are sufficiently conservative, this contingency could mean an operator does not need to employ surveillance at all.

Blue Origin provided suggested text for § 450.161(b) related to vehicle tracking rather than surveillance. The FAA declines to adopt this change because vehicle tracking requirements in § 450.167 (Tracking) are distinct from the requirement to surveil the flight hazard areas in § 450.161. The requirements and comments regarding vehicle tracking are discussed in the preamble section associated with § 450.167.

CSF, Sierra Nevada, and SpaceX also commented that if a member of the public or another Federal agency chooses to breach a hazard area and put itself at risk, the operator should not bear the consequences. Many commenters identified this possibility as a problem in the case of a hazard area violation that occurs after the decision to commit to a reentry.

The FAA understands the unique challenges of reentry operations with respect to the control of hazard areas because of the long time lag between the commitment to reenter and the planned or potential unplanned vehicle presence in a hazard area. The FAA will work with operators during the license application process in applying this requirement to ensure verification procedures protect the public adequately for each unique operation.

In the NPRM, proposed § 450.161(c) would require an applicant to publicize warnings for each flight hazard area, except for regions of land, sea, or air under the control of the vehicle or site operator or other entity by agreement. If the operator relies on another entity to publicize these warnings, the proposed rule required the operator to verify that the warnings have been issued. CSF and SpaceX commented that operators would have very little ability to ensure and enforce closures when launching from a Federal launch or reentry site or if the hazard area falls within a foreign country's airspace.

The FAA agrees with these comments. To address this issue, the FAA changes the language in proposed § 450.161(c) from “verify that the warnings have been issued” to “determine whether the warnings have been issued” in § 450.161(c)(1) in the final rule. The FAA recognizes that an operator would be unable to meet the proposed regulation to verify the warnings have been issued if the foreign Air Navigation Service Provider (ANSP) fails to publicize the warnings. The FAA also adds in § 450.161(c)(2) of the final rule that the operator must notify the FAA if the warnings have not been issued so that the FAA can determine if the launch or reentry can be conducted in a manner that protects the public sufficiently, and that this notification must provide sufficient information to enable the FAA to issue warnings to U.S. aircraft. An involved party could determine whether the warnings have been issued pursuant to the agreements the operator has with, for example, a Federal launch or reentry site or a foreign government. In cases in which a foreign ANSP does not issue the warnings in a timely manner, the operator must notify the FAA in accordance with a means of compliance accepted by the FAA. The means of compliance will describe information that the operators should communicate to the FAA to (1) show due diligence in the fulfillment of their requirements in accordance with agreements in place, and (2) enable FAA to issue warnings to U.S. aircraft. The FAA finds that the final rule requirement in § 450.161(c)(2) is responsive to the comment that operators have very little ability to enforce closures when launching from a Federal launch or reentry site or if the hazard area falls within a foreign country's airspace.

The FAA proposed in § 450.161(d)(1) that an applicant must submit a description of how the applicant will provide for day-of-flight surveillance of flight hazard areas, if necessary, to ensure that the presence of any member of the public in or near a flight hazard area is consistent with flight commit criteria developed for each launch or reentry as required by § 450.165(b). In the final rule, the FAA adds in § 450.161(d)(1) that the applicant must also provide for day-of-flight control of flight hazard areas. The FAA notes that the nature of any surveillance (in terms of extent and frequency) necessary to ensure conditions consistent with flight commit criteria is naturally linked to the level of control an operator can exercise to limit access to a flight hazard area.

In § 450.161(d)(2), the FAA adds as an application requirement that the applicant must submit a description of how they will provide for any publication of flight hazard areas necessary to meet the requirements of § 450.161(c). This application requirement is necessary for the FAA to evaluate compliance with the requirements of § 450.161(c), including verifying whether the warnings have been issued.

jj. Lightning Hazard Mitigation (§ 450.163)

In the NPRM, the FAA proposed to require operators to mitigate natural and triggered lightning by (1) implementing flight commit criteria that avoid and mitigate the potential for intercepting or initiating lightning strike or encountering discharge; (2) using a vehicle designed to continue safe flight if struck by lightning or encountering a nearby discharge; or (3) ensuring satisfaction of the safety criteria set forth in proposed § 450.101 in the event of a lightning strike on the vehicle.

In the final rule, the FAA adopts § 450.163 (Lightning Hazard Mitigation) with modification. It revises § 450.163 to remove paragraphs (a)(3) and (b)(3). It adds the modifier “direct” to “lightning strike” in paragraph (a)(1), to match the application requirement in paragraph (b)(1). The FAA also modifies § 450.163(a)(2) in response to a comment as described below.

Blue Origin commented that proposed § 450.163(a)(3) diverged from the preamble to § 450.163 and the rest of the proposed rule, which clearly convey that satisfaction of the safety criteria in proposed § 450.101 was not optional. An operator would be required to satisfy proposed § 450.101 regardless of whether it chooses to implement flight commit criteria or utilize a lightning-resistant vehicle.

The FAA agrees with Blue Origin's comment and revises § 450.163(a) by removing proposed § 450.163(a)(3). Proposed § 450.163(a)(3) was intended to cover an operator's use of physical containment as a hazard control strategy when damage to a vehicle caused by a lightning strike would not impact the safety of the launch. The FAA has found this section to be unnecessary because lightning would not be a concern for an operator using physical containment as a hazard control strategy since, by definition, the launch vehicle does not have sufficient energy for any hazards associated with its flight to reach outside the flight hazard area.

Blue Origin requested that the FAA define “continue safe flight” in proposed § 450.163(a)(2). In response, the FAA modifies § 450.163(a)(2) to require the operator to use a vehicle designed to protect safety-critical systems in the event of a direct lightning strike or nearby discharge. Thus, the final rule requirement in § 450.163(a)(2) mirrors the proposed application requirement in § 450.163(b)(2) to submit documentation providing evidence that the vehicle is designed to protect safety-critical systems against the effects of a direct lightning strike or nearby discharge.

Virgin Galactic expressed concern for the amount of time it would take operators to redesign their vehicles to satisfy proposed § 450.163(a)(2) and asked that the FAA “grandfather” currently licensed operators out of this requirement. The FAA notes that § 450.163(a) provides two ways for an operator to mitigate natural and triggered lightning and does not mandate a lightning-related design change. The decision to pursue flight commit criteria versus a lightning-resistant vehicle rests with the operator.

The performance-based standards set forth in § 450.163 will be accompanied by AC 450.163-1 “Lighting Hazard Mitigation” in the future, which will contain one, but not the only, acceptable means of compliance for § 450.163(a)(1). The AC will include references to NASA-STD-4010, as well as relevant standards for the design of a vehicle to withstand the direct and indirect effects of a lightning discharge. Commenters largely supported this approach. Blue Origin noted that, while the Lightning Flight Commit Criteria adopted by the FAA have successfully prevented lightning attachment to vehicles in the past, operators may demonstrate that the avoidance criteria can be satisfied with their specific mission profile and vehicle design. Aerospace Corporation echoed support for enabling operators to develop new methods and evaluations for lighting avoidance and mitigation.

Regarding proposed § 450.163(a)(1), two commenters expressed concern that the FAA, in adopting only NASA-STD-4010 as an accepted means of compliance for now, may not accept unique means of compliance in the future. The Aerospace Corporation and Weather Modification International argued the FAA should adopt prelaunch in situ measurement of electric fields as a means of demonstrating compliance with § 450.163, noting that NASA-STD-4010 is imperfect because it relies exclusively on observable ground data.

The FAA considered using direct measurement of the electric field within a cloud as an option for compliance with § 450.163. However, the ambient electrostatic field within and near electrified clouds can vary rapidly in both space and time because of the charge separation and redistribution processes inside and around the clouds, and because lightning can rearrange this charge abruptly over distances of many kilometers. Because no measuring technique today can be applied everywhere simultaneously and it is difficult to prove that electric field measurements taken near the flight path at an earlier time will remain valid at the time of launch or landing, this option is not viable on its own.

The FAA agrees that the optimal standards for avoiding and mitigating natural and triggered lightning may be achieved through technological advancement in the future. Currently, NASA-STD-4010 is the only standard of which the FAA is aware that will satisfy the requirements of § 450.163(a)(1). However, ongoing research efforts could soon allow for modifications of the NASA's Lightning Launch Commit Criteria, providing additional means of compliance. As stated in the NPRM, the FAA anticipates that industry will develop and submit new standards to the FAA to serve as unique means of compliance under § 450.35(b).

The FAA also acknowledges the suggestion of Weather Modification International that the FAA take the lead in developing a definitive set of lightning standards. The FAA has traditionally relied upon the Lightning Advisory Panel, with its technical expertise in mitigating lightning hazards, to develop lightning standards. The FAA relied upon the lightning standards recommended by the Lightning Advisory Panel in developing the lightning requirements in part 417. Given the performance-based nature of this rule, the FAA is not prescribing a particular standard for mitigating lightning hazards, but instead will allow applicants to develop their own means of complying with § 450.163. The FAA notes, however, that the means of compliance identified, NASA-STD-4010, was developed by the Lightning Advisory Panel, and thus, would achieve the same result that the commenter requests.

Blue Origin commented that, to the extent the FAA looks to aircraft lightning protection standards (e.g., AC 20-136B, AC 20-107B) to determine the appropriate industry standards applicable to § 450.163(a)(2), the agency should adopt only those standards clearly applicable to space vehicles. The commenter added that the use of SAE recommended practices would create an undue burden on applicants since the SAE protection rules apply to transport aircraft, which require a much higher level of safety than that prescribed by part 450.

The FAA agrees that only those aircraft standards which are appropriate to apply to space vehicles should be used to assess compliance with § 450.163(a)(2).

kk. Flight Commit Criteria (§ 450.165)

In the NPRM, the FAA proposed in § 450.165 that an operator establish and observe flight safety rules in order to initiate flight. The proposed rule also required an operator to establish and observe flight abort rules in order to end flight. Proposed § 450.165 would require that an operator's flight safety rules include flight commit criteria identifying each condition necessary to satisfy proposed § 450.101 prior to initiating flight. These flight commit criteria would include: (1) Surveillance; (2) monitoring of meteorological conditions; (3) implementing window closures for the purpose of collision avoidance; (4) monitoring the status of any FSS; and (5) any other hazard controls derived from system safety, computing system safety, or FSA.

In the final rule, the FAA adopts proposed § 450.165 with revisions. The FAA moves the flight abort rules proposed in § 450.165(c) to § 450.108. The discussion of the revisions related to abort rules in proposed § 450.165 is in the Flight Abort Rules section of the preamble. The FAA combines proposed § 450.165(a) and (b) into a single paragraph (a) to reflect that this section now only relates to flight commit criteria.

In addition, the FAA adds a requirement that the flight commit criteria must include confirmation from the FAA that the risk to critical assets satisfies the requirements of § 450.101(a)(4) or (b)(4). This requirement is consistent with the changes to the critical asset requirements discussed earlier in the preamble and ensures that a flight is not initiated if it does not meet the risk criteria. The FAA will work with the applicant to create a streamlined process to achieve this confirmation. The FAA anticipates that it will generally be able to provide this confirmation well before the actual flight countdown.

Sierra Nevada commented that the use of the term “surveillance” may be broader than the FAA intended. The FAA discusses surveillance in the preamble section for Control of Hazard Areas (§ 450.161).

ll. Tracking (§ 450.167)

In the NPRM, the FAA proposed vehicle tracking requirements, including that an operator would be required to measure and record in real time the position and velocity of the vehicle. The system used to track the vehicle would be required to provide data to determine the actual impact locations of all stages and components, and to obtain vehicle performance data for comparison with the pre-flight performance predictions. The FAA intended the proposed requirements to capture current practice. As explained in the NPRM, tracking data sufficient to identify the location of any vehicle impacts following an unplanned event are necessary to ensure a proper response to an emergency.^[177]

CSF, SpaceX, SpinLaunch, and Virgin Orbit commented that the proposed language in § 450.167(a) could be interpreted as tracking stages and components all the way down to the earth or body of water. CSF also sought clarity regarding the intent of the requirement to “provide data to determine the actual impact locations of all stages and components,” and whether this requirement would mean that operators must predict the expected impact locations or actual impact locations. To clarify this point, CSF, SpaceX, and Virgin Orbit suggested using the phrase “predict the expected impact locations” rather than “determine the actual impact locations.” The FAA concurs and adopts the recommended change in the final rule. The change more accurately reflects the intent of the requirement.

Blue Origin commented that RCC 321 requirements to coordinate with the FAA to ensure timely notification of any expected air traffic hazard do not actually mention vehicle tracking, and that it may be possible to provide notification of traffic hazards without the need for tracking (such as a straight up suborbital trajectory ^[178] ).

Tracking data is an important element of current practice used to ensure the safety of people in aircraft. In the past, tracking vehicles was inherently a part of flight abort and an important means to ensure safety in the event of a mishap in which hazardous debris falls outside of designated hazard areas. During launch or reentry operations that lack the ability to inform the FAA rapidly of the volume and duration of airspace for which an aircraft hazard is predicted following a mishap, the FAA must close inordinately large regions of airspace to provide a sufficient level of safety to aircraft flying in regions where hazardous debris could fall in the event of a break-up. Although RCC 321 does not call for tracking per se, the FAA finds tracking essential to the safe and efficient integration of launch and reentry operations into the NAS. For example, the Columbia accident in 2003 ^[179] demonstrated that there is often a significant period of time between a vehicle break-up and when hazardous debris reaches aircraft altitudes. The time between vehicle break-up and when hazardous debris reaches aircraft altitudes enables the FAA to close a minimum amount of airspace while ensuring a high level of safety for aircraft flying in regions where hazardous debris could fall in the event of a break-up. As explained in the NPRM preamble, tracking data are generally necessary to ensure a proper response to an emergency, facilitate flight abort, obtain vehicle performance data for comparison with the preflight performance predictions in accordance with § 450.103(d), and facilitate safe and efficient integration of launch and reentry operations into the NAS. Therefore, the final rule is consistent with the NPRM and current practice.

CSF, Leo Aerospace, Microcosm, Sierra Nevada, and SpaceX commented that the proposed language regarding tracking was too broad and would seem to require an operator to track pieces of debris to impact during an off-nominal event. As clarified by the FAA during the public comment period in “Answers to Clarifying Questions Received by June 28, 2019” and “Answers to Clarifying Questions Received by July 29, 2019,” the term “all stages and components” does not mean that all debris must be tracked to the ground after a vehicle breakup.

CSF and SpaceX suggested adding the word “nominal” to this requirement when referring to flight tracking. The FAA declines to adopt this change because it is important to track during off-nominal trajectories as well, including during normal flight and for off-trajectory malfunctions at least until flight abort is initiated or vehicle break-up occurs. Tracking data can enable an appropriate response to an off-nominal situation, such as where to evacuate the public to protect against predicted toxic fumes or where to apply fire suppression resources.

Blue Origin, CSF, and SpaceX commented that real time telemetry is often not possible for the entire mission, such as when a vehicle passes over the horizon or during a reentry blackout period. The FAA concurs with the commenters that real time telemetry is not always possible. In the past, there were times during reentry that the presence of plasma typically blocked vehicle-to-ground communications. More recently, space-based tracking and communications have made it feasible to overcome reentry plasma and over the horizon limitations. However, the final rule does not require operators to use space-based tracking and communications to meet § 450.167 unless it is necessary to protect public safety, safety of property, and national security and foreign interests of the United States. The FAA does not currently foresee any licensed launch or reentry activity that will require the use of space-based tracking to protect public safety, safety of property, and national security and foreign interests of the United States. Furthermore, “real time” does not mean “zero lag time.” The tracking must be sufficient to meet the requirements in § 450.167(a) to predict the expected impact locations and obtain vehicle performance data for comparison with pre-flight predictions. The FAA would not hold an operator accountable if there was some lag for reasons outside of the operator's control. The FAA believes that this leeway answers Blue Origin's recommendation that tracking requirements be limited to phases of launch or reentry vehicle flight identified in § 450.113(a), since on-orbit tracking is not practical.

mm. Launch and Reentry Collision Avoidance Analysis Requirements (§ 450.169)

In the NPRM, the FAA proposed to update the information required for launch collision avoidance (LCOLA) and expand the analysis requirements to determine launch and reentry window closures, including updated protections for human spaceflight and additional closures to protect active payloads and prevent orbital debris generation. The FAA proposed that all operators would be required to come into compliance with the LCOLA requirements by the effective date of the rulemaking.

In the final rule, the FAA adopts § 450.169 with revisions. The finalized LCOLA rules better align with the existing processes used at Federal sites, provide adequate orbital safety measures for launch and reentry operations, and incorporate updated options for collision avoidance analysis. The FAA maintains that all operators must come into compliance with the LCOLA requirements by the effective date of this rule. The FAA adds the words “are met” to § 450.169(b) to fix a typographical error in the NPRM.

For an orbital or suborbital launch or reentry, § 450.169(a) requires an operator to establish window closures needed to ensure that the launch or reentry vehicle, any jettisoned components, or payloads, meet the identified requirements with respect to orbiting objects, not including objects being launched or reentered as part of the same launch or reentry activity (e.g., dual manifested payloads). In performing a launch or reentry collision avoidance analysis against inhabitable objects, an operator may choose to stipulate an ellipsoidal separation distance, a spherical separation distance, or satisfy the probability of collision threshold (1 × 10⁻⁶). Collision avoidance analyses must also account for other orbital objects, such as spacecraft, and tracked debris. For these uninhabitable active objects, operators must satisfy either a less restrictive probability of collision threshold (1 × 10⁻⁵) or a spherical separation distance of 25 km. As discussed more fully later, in response to comments, the FAA revises § 450.169(a)(3), which covers all other known orbital debris, so that operators must maintain either a spherical separation distance of 2.5 km or a less restrictive probability of collision threshold (1 × 10⁻⁵) from orbital debris that is medium or large in size (radar cross section greater than 0.1m²), as identified by the FAA or another Federal Government entity.

The FAA also received a number of comments to proposed § 450.169(d), which identified when LCOLA analysis would not be required. This section was not a new requirement, but a consolidation of the existing regulations, § 417.231(d) and Appendix C to part 417 under C417.11. As proposed, an LCOLA analysis would not be required if the maximum altitude attainable by a launch operator's suborbital launch vehicle and any released debris is less than 150 km. The proposed requirement stated that the maximum altitude attainable is an optimized trajectory, assuming maximum performance within 99.7 percent confidence bounds, extended through fuel exhaustion of each stage, to achieve a maximum altitude.

SpaceX opposed the requirement that LCOLA exclusions (launch and reentry window closures) be based on fuel depletion trajectories or the maximum attainable altitude of a launch vehicle. SpaceX commented that both bases exceeded the scope of past requirements and requested that LCOLA exclusions be based exclusively on the maximum performance case. SpaceX also recommended the FAA delete proposed § 450.169(d) due to unclear technical or public safety benefits. Blue Origin recommended that fuel exhaustion from each stage be excluded from proposed § 450.169(d) because remaining fuel will always be required to land RLVs.

The FAA disagrees with the recommendation to remove § 450.169(d). The FAA notes that, without this subsection, operators would need to conduct LCOLA analyses for all launches, regardless of altitude. The FAA has determined that no LCOLA analysis is needed for missions that do not exceed 150 km in altitude because orbital objects below this level are exceedingly sparse and usually are not present for long durations. Furthermore, launch operators currently do not provide trajectories for stages or objects that do not exceed 150 km. As such, it is appropriate to specify in the regulation when the LCOLA analysis is not required.

The FAA agrees, however, that the language proposed in § 450.169(d) did not reflect current practice and could prove impracticable. The requirement for accomplishing LCOLA for all objects launched over 150 km was complicated by existing regulatory language on maximum altitude calculations. LCOLA is accomplished using only the nominal trajectory provided by the launch or reentry operator. No screening is accomplished using maximum possible altitudes because there is no planned trajectory to screen, and the FAA did not intend for operators to develop alternate trajectories. Therefore, the FAA revises § 450.169(d) so that no LCOLA is required if the object's maximum planned altitude is less than 150 km.

Similarly, the FAA revises § 450.169(b)(1) to require LCOLA analysis only for the entire segment of flight of a suborbital launch vehicle above 150 km. The FAA agrees with SpaceX's comment that requiring operators to conduct LCOLA analyses below 150 km is unnecessary and would prove burdensome. This revision is consistent with the requirements for orbital vehicles and acknowledges that only the portions of flight above 150 km are screened in either case.

Virgin Galactic recommended that proposed § 450.169(d) be retitled, “Applicability.” SpaceX recommended the regulation refer to a “body” or “object,” rather than “suborbital” or “debris.” The FAA agrees with Virgin Galactic and SpaceX that these terms and the title could be clearer and more consistent with current usage. The FAA retitles § 450.169(d) “Exception,” which more accurately describes this subsection, and substitutes “object” in place of suborbital vehicle in § 450.169(d).

Regarding requirements proposed in § 450.169(a) and (b), the FAA received numerous comments questioning the need for a 200 km keep-away distance for human spaceflight and the absence of probability of collision screening for debris. Numerous commenters also recommended a narrower trajectory data requirement for suborbital launches.

An individual commenter stated that a spherical separation distance of 200 km from inhabitable objects, as set forth in proposed § 450.169(a)(1)(ii) and (a)(1)(iii), may not be appropriate due to advances in spaceflight systems such as autonomous flight termination systems (AFTS) and autonomous flight systems (AFS). The commenter recommended the FAA allow the 200-km limit to be tailored depending on the reaction time of the flight termination system. The commenter also suggested the 200-km limit could be tailored if the launch vehicle contains a traffic collision avoidance system (TCAS) (akin to what aircraft use to avoid planes) that can reasonably avoid nearby crewed vehicles.

The FAA disagrees that a spherical separation distance of less than 200 km is appropriate for inhabitable objects. No termination systems are currently used in orbit, and termination systems are not likely to be viable safety measures in orbit. The 200 km safety standoff distance is only for orbital spaceflight protection; it is not a separation standard for airspace integration. An orbital termination system would increase the danger to human spaceflight and increase the orbital debris population. Safety and efficiency must be accomplished with a screening prior to launch. Launch vehicles do not have TCAS-like operations and are not expected to acquire such capabilities.

SpaceX asked the FAA to explain why § 450.169(a)(3) requires operators to screen orbital debris greater than 10 cm² against a spherical miss distance of 2.5 km, rather than meet a probability of collision threshold, as the FAA allows for inhabitable objects and active payloads. SpaceX stated that the requirement to maintain a spherical miss distance, without the option to evaluate probability of collision, is more restrictive than current requirements and inconsistent with USAF practices. SpaceX argued there should be an option to waive miss distance less than 2.5 km if probability of collision is sufficiently low, as is done for active payloads.

The FAA agrees with SpaceX that probability of collision could be used for medium and large orbital debris because those objects are routinely well-tracked and have valid orbital covariances available. This option would provide for higher fidelity screening of collisions that could produce significant amounts of orbital debris. As such, the FAA revises § 450.169(a)(3) to allow operators to screen for orbital debris identified by the FAA or other Federal Government entity using either a spherical separation distance of 2.5 km or a less restrictive probability of collision threshold (1 × 10⁻⁵). The use of probability of collision will require realistic covariance data on both the launching object and the screened orbital object to produce meaningful results. Operators who do not provide realistic covariance will be required to have the launch or reentry screened with stand-off distance. The probability of collision threshold required for debris is the same as that required for active payloads in § 450.169(a)(2), which mirrors current USAF requirements. The USAF requirements for debris screening use the same probability of collision as a high-fidelity analysis in place of both 25 km and 2.5 km standoff screening. The FAA slightly relaxed the debris screening size requirement to include only medium (0.1 m² to 1 m²) and large objects (greater than 1 m²) in order to provide for accurate use of probability of collision analysis. Medium and large debris objects are well-tracked, and the U.S. Government maintains accurate covariance on these objects. This requirement achieves the objectives stated in the NPRM of avoiding conjunction analysis with micro-debris, while preventing the generation of space debris since these objects are well-tracked and capable of creating significant amounts of persistent space debris in the event of a collision.

In proposed § 450.169(f), the FAA would require an operator to prepare a collision avoidance analysis worksheet for each launch or reentry using a standardized format that contains the input data required by Appendix A to part 450. Proposed § 450.169(f)(1) would require an operator to file the input data with a Federal entity identified by the FAA and with the FAA at least 15 days before the first attempt at the flight of a launch vehicle or the reentry of a reentry vehicle or in a different time frame in accordance with proposed § 404.15. Proposed § 450.169(f)(2) would require an operator to obtain a collision avoidance analysis performed by a Federal entity identified by the FAA 6 hours before the beginning of a launch or reentry window.

CSF and SpaceX requested the FAA alter proposed § 450.169(f)(1) to require operators to file input data 7 days before launch or reentry rather than 15 days. The commenters stated the 15-day requirement conflicts with current processes at Federal launch or reentry sites, which allow submissions 7 to 10 days before launch or reentry. CSF and SpaceX stated that 7 days prior to launch has proven sufficient to produce screening results by 6 hours before launch. CSF and SpaceX also indicated that the requirement to obtain final results 6 hours before launch was inconsistent with current practice. The Federal entity performing LCOLA screenings delivers the final data hours before launch. CSF and SpaceX recommended adding a clause to proposed § 450.169(f)(2) allowing trajectory data to be delivered within timelines agreed to by the launch operator and the entity performing the screening. Alternatively, SpaceX recommended the FAA either require the data be submitted 3 hours before launch in § 450.169(f)(2), as currently practiced by the USAF, or allow operators flexibility to obtain LCOLA data “within” 6 hours of the launch or reentry window beginning, but no later than 3 hours before launch.

The FAA partially agrees with CSF's and SpaceX's recommended changes to the timelines established in § 450.169(f)(1) and (f)(2). For launch or reentry operations that have successfully developed an internal process that results in repeatable LCOLA data submission, the FAA recognizes that 7 days prior to launch is an adequate time for Federal entities to process the LCOLA data based on recent LCOLA submissions reviewed for the last year. The FAA revises § 450.169(f)(1) to require that most operators submit LCOLA data at least 7 days in advance of launch or reentry. However, the FAA disagrees that a shorter time frame would be appropriate for operators that have not yet conducted launch or reentry activities. The FAA has repeatedly noted that LCOLA data submitted from first-time launch or reentry operators often require significant reiterative work to achieve an acceptable submission. As such, the FAA will require operators that have not yet received conjunctive assessments to submit LCOLA data at least 15 days in advance of launch or reentry. This approach is similar to that of the USAF, which requires entities that have not yet received conjunctive assessments to submit LCOLA data 30 days in advance of launch. The FAA revises § 450.169(f)(1)(i) to require that entities that have not yet received conjunctive assessments to submit LCOLA data at least 15 days in advance of launch. All other operators must submit LCOLA data at least 7 days in advance of launch.

The FAA agrees that the requirement to receive results within 6 hours before beginning of the launch or reentry window could be reduced to 3 hours. Later delivery will produce LCOLA results that are timelier and therefore more accurate for orbital safety purposes. Therefore, the FAA revises § 450.169(f)(2) to alter delivery to 3 hours before beginning of the launch or reentry window.

Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that much of proposed § 450.169(a) focused on analysis that was not applicable to operators since applicants do not have the data and tools to perform LCOLA analysis, but merely provide inputs and implement operational windows based on closures provided. The commenters advocated for a streamlined commercial process for licensed launches or reentries that do not occur at a Federal launch or reentry site, in which the FAA would take the applicant's trajectory inputs to the Federal agency responsible for LCOLA analysis and establish stay-out windows. The commenters argued a standardized process would eliminate the need for multiple applicants to establish interfaces and procedures with an agency that rarely deals with commercial (space transportation) entities.

The FAA declines to streamline the LCOLA process further by removing the analysis requirements of § 450.169(a), such that applicants only need to provide data and abide by results. Transparency in LCOLA analysis provides confidence and understanding of the LCOLA process for launch, reentry, and payload, for operators as well as the public.

The same commenters noted that the FAA could act as a go-between entity for all operators in a similar manner to Federal sites' processes. The FAA agrees that operators could use the FAA or the Federal sites as conduits to the LCOLA processing entity and recognizes that this flexibility remains in the final rule language. This type of activity is appropriately coordinated during the launch operator or reentry operator pre-application discussions. The FAA disagrees with requiring the FAA to act as a pass-through because the FAA believes that removing launch operators from direct contact with the USAF 18th Space Control Squadron could have unintended negative consequences. For instance, an early orbit breakup emergency may require prompt exchange of data between launch operators and on-orbit support services providers using processes already tested during LCOLA development and adding a pass-through element could hamper or slow analysis, notifications, and potential mitigation actions. Moreover, the FAA does not place orbital safety analysts on duty during launch or reentry operations. To adequately support the passthrough, the FAA would need to establish launch support teams and exercise the team in advance of emergency operations.

Blue Origin and SpaceX recommended the FAA allow LCOLA analyses to be conducted by non-Federal entities. Blue Origin recommended that proposed § 450.169(e) require LCOLA analyses be obtained from Federal entities, unless otherwise agreed to by the Administrator. SpaceX recommended proposed § 450.169(f) allow operators to file input data and obtain LCOLA analyses from approved third parties, as opposed to Federal entities. SpaceX argued the FAA should foster a competitive market and allow flexibility in using commercial services as commercial entities enter the space situational awareness (SSA) market and aim to provide the same services as Federal entities. Virgin Galactic asked if the FAA anticipated a cost associated with obtaining the analysis from the Federal entity.

The FAA declines to remove the reference to Federal entities in § 450.169. Although commercial entities are developing space traffic support services that could eventually provide adequate safety for launch collision avoidance, to date, only Federal entities have full access to the authoritative catalog maintained by the DOD. Rather than remove this clause, the FAA adds the phrase, “or another entity agreed to by the Administrator,” to § 450.169(e) in order to provide flexibility should the space traffic authority and framework change over time. The Administrator may allow another entity to provide this service based on a demonstration that the data includes a complete and accurate catalogue of all identifiable objects in the relevant space environment. Currently, the DOD is the only entity that meets this criterion. In response to Virgin Galactic's question regarding cost, the current LCOLA analysis from the U.S. Government is provided free of charge.

SpaceX recommended the FAA defer to or allow operators to use the LCOLA processes and standards of Federal launch or reentry sites for launches from Federal sites as means of compliance. SpaceX argues that doing so would minimize confusion regarding the applicable standards and procedures at different operating sites. SpaceX also suggested that § 450.169(e) be revised to state that operators may use Federal launch or reentry site services with existing policies and processes to ensure acceptable compliance.

The FAA declines to defer to the Federal launch or reentry sites. The FAA and Federal sites have different waiver requirements and processes. The FAA finds the language as proposed in the NPRM is adequate when coupled with the existing waiver process and equivalent level of safety process. In addition, the FAA notes that launches from non-Federal sites are not required to follow Federal site practices, and using a single FAA standard minimizes confusion both on and off Federal launch or reentry sites.

Citing the discrepancy between the proposed collision avoidance analysis and current USAF practice, CSF stated the proposed rule attempted to “fix” parts of the licensing process that were not broken.

The FAA disagrees that the collision avoidance analysis process is incompatible with the current USAF practice. The procedures for launch collision avoidance under §§ 417.107, 417.231, 417.31, and 417.43 did not reflect current practice as they excluded any probability of collision, referenced outdated processes and agencies, and required outdated adjustments to closures. The updated LCOLA process is compatible with USAF practices where appropriate (e.g., LCOLA timelines, screening options for human spaceflight protection, and active payload protection), noting that the FAA regulation must also guide operations of launch and reentry operations at non-Federal sites.

nn. Safety at End of Launch (§ 450.171)

In the NPRM, the FAA proposed in § 450.171 (Safety at End of Launch) requirements for the prevention of creating orbital debris, with which an applicant would be required to demonstrate compliance in its application.

In the final rule, the FAA adopts § 450.171 as proposed. The FAA did not receive comments on these proposed requirements.

oo. Mishap (Definition, §§ 450.173 and 450.175)

i. Mishap Definition

In the NPRM, the FAA proposed to consolidate the definitions of “Mishap,” “Launch Accident,” “Launch Incident,” “Reentry Accident,” “Reentry Incident,” “Human Spaceflight Incident,” and “Launch Site Accident” under the definition of “Mishap” in § 401.5. The FAA proposed four mishap categories, from most severe (Class 1) to least severe (Class 4).

In the final rule, the FAA does not adopt the proposed classification system. Instead, the FAA combines the substantive criteria of Mishap Classes 1 through 4 under the definition of “mishap” in § 401.7. The revised definition describes events that constitute a mishap in a straightforward manner that better corresponds to regulatory requirements. The FAA incorporates additional changes to the final rule as discussed in the following paragraphs.

Numerous commenters from industry expressed confusion about the types of activities that would fall under each class. The commenters questioned the necessity of classifying mishaps based on severity since the regulatory requirements were largely the same for all mishaps.

The FAA reviewed the regulatory requirements associated with each of the proposed mishap classes and agrees there were no significant differences among the regulatory requirements for each class. The requirements to report, respond to, and investigate mishaps are incumbent upon an operator regardless of a mishap's severity. Mishap classes are not needed to achieve the objective of consolidating mishap-related terms and streamlining the requirements to report, respond to, and investigate mishaps. Accordingly, the FAA removes the proposed classification system. Except as discussed later in this preamble, the criteria proposed under each mishap class have been consolidated under “mishap” in § 401.7.

In the NPRM, the FAA proposed that a Class 1 mishap would include any event resulting in (1) a fatality or serious injury (as defined in 49 CFR 830.2) resulting from licensed or permitted activity to any person who is not associated with the licensed or permitted activity, or (2) a fatality or serious injury to any space flight participant, crew, or government astronaut. This proposal was consistent with longstanding definitions of “launch accident” and “reentry accident” in § 401.5.

A fatality or serious injury to a person associated with licensed or permitted activity constitutes a mishap under § 401.5, rather than a launch or reentry accident. The FAA proposed to incorporate each of the mishap-related terms found in § 401.5 under the definition of “mishap.” ^[180] As such, save for the removal of the $25,000 monetary threshold, all events that meet the current accident, incident, and mishap definitions would continue to be mishaps under the consolidated definition.^[181] In combining the mishap-related terms, the FAA inadvertently excluded from the proposed definition a fatality or serious injury to persons associated with licensed or permitted activity, which has been covered by the term “mishap” in § 401.5. The FAA did not intend to depart from current practice by excluding these serious events from the definition, as evidenced by the NPRM preamble. In revising the definition of “mishap,” the FAA stated its intent to streamline and clarify existing definitions, eliminate the monetary threshold, and consolidate the accident and incident investigation sections of parts 417, 420, 431, 435, 437 into one section applicable to all licenses, permits, and vehicles.^[182] In proposing to consolidate existing definitions, the FAA did not propose to narrow the scope of activities deemed a mishap. In the final rule, the FAA revises the definition of “mishap” to include any fatality or serious injury resulting from licensed or permitted activity, irrespective of the person's involvement in the launch activity.

The FAA consolidates under paragraph (1) of the definition those criteria proposed for Mishap Class 1 and the previous definition of “mishap” in § 401.5. This revision is consistent with the mishap reporting requirements under § 450.173(c)(1) for the occurrence of a fatality or serious injury during FAA-authorized activities. The FAA removes the phrase “including ground activities at a launch or reentry site” from the criterion addressing fatality or serious injury because the phrase “events associated with a licensed or permitted activity” adequately covers such activities.

In the final rule, the FAA re-designates criterion (1) of proposed Mishap Class 2 as paragraph (2) of the definition, which applied to the malfunction of an FSS or safety-critical system. The FAA notes that it removed the term “flight safety system” from paragraph (2) because an FSS is a safety-critical system.

Paragraph (7) of the definition consolidates two criteria proposed under Class 3 and 4 for permanent loss of a vehicle during licensed and permitted activity, respectively. Since the FAA is discarding the mishap classification system, there is no longer a need to differentiate loss of a launch or reentry vehicle during licensed versus permitted activity. Nor does the FAA intend to differentiate loss of a “vehicle” from loss of a “launch or reentry vehicle.”

The FAA proposed to replace the clause, “failure to complete a launch or reentry as planned,” in the previous definition of “mishap” in § 401.5, with the clause, “failure to achieve mission objectives.” AIA, Sierra Nevada, and SpaceX objected to this criterion, arguing that failure to achieve mission objectives related to mission assurance and exceeded the FAA's authority to ensure public safety.

Based on industry comments, the FAA reverts to the original phrase, “failure to complete a launch or reentry as planned,” but adds a citation to a regulatory requirement that narrows the scope of this criterion. Failure to complete a launch or reentry according to the parameters provided by the operator under the pre-flight reporting requirements of § 450.213(b) ^[183] will constitute a mishap. This criterion more accurately reflects the scope of activities that the FAA deems to be a mishap and alleviates the commenters' concerns about mission assurance.

The FAA removes from the final rule all references to the proposed mishap classes. The FAA revises § 450.131(a)(2) to clarify that a probability of failure analysis must account for data on any mishap and anomaly. While the NPRM stated that the probability analysis must account for all partial failures and anomalies, “including Class 3 and Class 4 mishaps,” the language implied that it would also apply to Class 1 and Class 2 mishaps—the more severe events. The FAA replaces the mishap classes referenced in § 450.173(a) with the term, “mishap.” Finally, the FAA replaces the mishap classes referenced in § 450.219(b) with a reference to the portion of the mishap definition that corresponds to the proposed requirement: Events listed in paragraphs (1) through (5) and (8).

The removal of the mishap classes dispenses with commenters' requests for clarification or guidance in ACs on applying and differentiating the proposed mishap classes.

The final rule adds three changes to sections that cross-reference the mishap-related terms that the FAA proposed to replace with the revised mishap definition: §§ 420.61(b), 437.87(b), and 460.45(d). The FAA replaces the term “launch or launch site accident” in § 420.61(b) with a reference to the portions of the mishap definition that replace these terms: Paragraphs (1), (5), and (8). The FAA also replaces the word “shall” with the word “must” in § 420.61 because “shall” is no longer used in FAA regulations. Similarly, in § 437.87(b), the FAA replaces the phrase, “launch or reentry accident or incident,” with a reference to corresponding portions of the mishap definition in paragraphs (1) through (3), (5), and (8). As noted in the section of this preamble discussing the compliance period for legacy licenses (§ 450.1(b)), the FAA revises § 460.45(d) to require part 415, 431, and 435 licensees to apply the mishap-related definitions in § 401.5, and part 450 licensees to apply the definitions in § 401.7 when describing the safety record of the vehicle to space flight participants. Specifically, § 460.45(d)(1) requires that part 450 licensees identify events that meet paragraphs (1), (4), (5), and (8) of the definition of a mishap in § 401.7, which occur during and after vehicle verification performed in accordance with § 460.17.

The FAA also revises § 420.59 to identify the portions of the mishap definition applicable to launch site operators licensed under part 420. Not all of the events described under the definition of “mishap” apply to part 420 licenses, which do not authorize launch or reentry activities, though the NPRM did not state this fact expressly. Nor did the FAA intend the revised definition of “mishap” to expand the scope of the previous “launch site accident” definition under part 420. The FAA therefore revises § 420.59(a) to state that a licensee must report, respond to, and investigate mishaps that meet paragraph (1) or (5) of the definition of “mishap” in § 401.7. The FAA specified in the final rule that part 420 licensees must prepare mishap plans that meet § 450.173(b) through (f), including allocation of roles and responsibilities between the launch operator and site operator for reporting, responding to, and investigating any mishap during ground activities at the site, to specify the scope of the mishap plan more accurately. The FAA also deletes the word “response” in § 420.59(a) since § 450.173 and the rest of § 420.59 refer to a “mishap plan,” not a “mishap response plan.”

AIA and Virgin Galactic commented that the term “failure of a safety organization” in the “mishap” definition was unclear. The FAA notes this term previously appeared under “launch incident” and “reentry incident” in § 401.5. “Failure of a safety organization” occurs when an operator fails to complete an action expected or required by the safety organization, or when the organization stops functioning normally, such that it creates a public safety risk. For example, the FAA would consider an operator's failure to follow existing safety processes or procedures, thereby placing the public at risk, a failure of a safety organization. Additional examples include (1) the failure of operator personnel to communicate a hold condition upon a violation of launch commit criteria, (2) a safety official failing to report potential safety matters to the mission director, or (3) the failure of an organization to recognize and mitigate a hazard, resulting in a public safety risk. No change was made to the regulation based on this comment.

SpaceX and Virgin Galactic sought clarification on the meaning of “high risk” of causing serious or fatal injury and “substantial damage” to property. SpaceX requested examples of high risk versus non-high risk events. AIA asked how the FAA would determine whether an event rises to the level of “high risk.” Virgin Galactic recommended “high risk” be defined in § 401.5 as an event that would have caused a casualty had one or more humans been present.

The FAA has used “high risk” of causing serious or fatal injury to define “human space flight incident” in § 401.5. As stated in the FAA's “Answers to Clarifying Questions Received by June 28, 2019,” ^[184] the FAA would consider any off-nominal event during pre-flight or flight operations that posed a high probability of fatality or serious injury to spaceflight participants, crew, government astronauts, or the public, to be “high risk.” The FAA stated in the NPRM that it would determine on a case-by-case basis whether damage to property not associated with the licensed activity is “substantial damage,” based on such factors as direct replacement cost, repair cost, and the property's intended use and functionality. When making a substantial damage determination, the FAA will include damage caused by debris impacts, toxic plumes, and fires ignited by the vehicle or its debris. The FAA provided, as an example, structural damage to public property exceeding 50 percent of its market value, such as a failed launch attempt with debris impacts outside a defined hazard area resulting in a post-impact fire and loss of a residential structure. The FAA will evaluate unplanned damage to property associated with a licensed or permitted activity on the same bases. Examples might include a major repair or replacement of launch facilities due to an unsuccessful launch attempt, including processing facilities, launch pads, or propellant tanks, based on cost of repair or replacement or loss of use. Similar to the NTSB's definition of “substantial damage” (49 CFR 830.2), under paragraph (6) of the “mishap” definition in § 401.7, the FAA may deem any damage that adversely affects the structural strength, performance, or flight characteristics of a launch or reentry vehicle which normally require major repair or replacement of the affected component, to be substantial.

The FAA declines Virgin Galactic's suggested definition of “high risk” because the suggested standard is too narrow and would exclude serious injury short of fatality. As noted above, the FAA would consider any off-nominal event during pre-flight or flight operations that pose a high probability of fatality or serious injury to spaceflight participants, crew, government astronauts, or the public, to be high risk. The FAA intends “high risk” to cover events akin to a near miss or close-call. This approach is consistent with USAF and NASA practices. Virgin Galactic's suggestion would prove impracticable, requiring near certainty that a casualty would have occurred.

Virgin Galactic recommended the FAA prescribe a timeline and specific process for determining whether “high risk” or “substantial damage” occurred. Virgin Galactic suggested the FAA develop such a process and incorporate it elsewhere in the regulations, not in the definition of “mishap.” Virgin Galactic argued the FAA should have no more than 14 days to make these determinations in order to minimize operational impacts.

It would not be appropriate to limit the time frame or implement procedures to determine whether an event posed a high risk of causing serious or fatal injury or resulted in substantial damage to property. Although the FAA will begin to evaluate a mishap upon receiving notice and details of the event, the rate at which the FAA can make these determinations will necessarily depend on the attendant circumstances and information supplied by the licensee. Moreover, the FAA retains the ability to modify its determination upon receipt of new information about the mishap.

SpaceX recommended the FAA remove “government astronauts” from the “mishap” definition because, unlike the uninvolved public, those individuals accept risk by virtue of their informed involvement in a vehicle's flight. Acceptance of risk does not preclude a fatality or serious injury from being considered a mishap. The FAA removes the references to space flight participants, government astronauts, and crew from the “mishap” definition to make it clear that the FAA will deem any fatality or serious injury associated with licensed or permitted activity a mishap irrespective of whether persons are involved in the licensed activity.

SpaceX recommended the Class 2 definition be limited to events “during a licensed or permitted activity,” rather than events “associated with” licensed or permitted activity. The commenter offered no rationale for temporally limiting the criteria now described in paragraphs (2) through (5) of the “mishap” definition, and the FAA sees no reason to do so. The FAA would only deem a mishap those events that are within the scope of the FAA's statutory authority. No change to the regulation is made based on this comment.

Sierra Nevada commented that treating the impact of a vehicle, payload, or components thereof “outside the designated area” as a mishap was overly prescriptive and unrealistic. Sierra Nevada commented that since hazard areas are generated as probability contours, not contours of total containment, debris could realistically exist outside the hazard area that would not warrant segregation in the event of a breakup scenario. Sierra Nevada also recommended removing from proposed § 450.173(d) the requirement to report vehicle or debris impact points outside the hazard area to the FAA, which it claimed was burdensome, cost prohibitive, and unreasonable.

The criterion cited by Sierra Nevada, now captured in paragraph (8) of the mishap definition, does not require licensees to track every possible piece of debris in an off-nominal scenario, but rather only debris that presents a hazard to the public. The proposed criterion closely followed the definitions of “launch accident” and “reentry accident” in § 401.5, but used “hazard area” in lieu of “impact limit lines” and “designated” landing or reentry site, to be consistent with the hazard analysis framework set forth in part 450. To clarify the scope of this mishap criterion, the FAA replaces the term “vehicle or debris” in paragraph (8) with the term “hazardous debris,” which is defined in § 401.7. Thus, this criterion applies to the impact of hazardous debris (i.e., debris capable of causing a casualty or loss of functionality to a critical asset) outside the planned landing site or hazard area. The occurrence of debris outside the hazard area that does not meet the definition of “hazardous debris” in § 401.7 is not a mishap.

The FAA similarly revises § 450.173(c)(3)(iv) to require that operators identify “hazardous debris” impact points as part of a preliminary mishap report, so that the FAA can assess potential public safety risks. The FAA makes this change to be consistent with the new definition of “hazardous debris,” and it is consistent with the intent of the proposed regulation. The FAA also replaces the term “impact area” with the term “designated hazard area” to be consistent with the terminology used in the mishap definition. This revision does not change the scope of the requirement from the NPRM; the FAA only requires an operator to report the hazardous debris impact locations, not all debris impact locations. Use of the term “hazard area” is also consistent with requirements for an operator to establish “hazard areas” under part 450 to protect the public from hazards associated with their operations.

The requirement to track and report hazardous debris is reasonable, given that operators must employ vehicle tracking for normal flight, and hazardous debris falling outside the designated area poses a serious risk to public safety. In the event of a vehicle breakup, operators should be able to approximate any hazardous debris impacts in relation to the designated landing site or hazard area based on the vehicle's last-known state vector or other tracking resources required for normal flight.

ii. Mishap Plan (§ 450.173)

In the NPRM, the FAA proposed to consolidate mishap planning, reporting, response, and investigation requirements under proposed § 450.173. The FAA also proposed to revise §§ 420.59 and 437.41 to require an applicant to submit a mishap plan that meets the requirements of § 450.173. Proposed § 450.173(c) required an operator to report to and cooperate with FAA and NTSB investigations and designate one or more points of contact for the FAA and NTSB. Proposed § 450.173(d) required operators to notify the FAA of mishaps and submit a preliminary report within certain time frames. Proposed § 450.173(f) required that, in the event of a mishap, an operator must investigate the root causes of the mishap and report investigation results to the FAA.

Virgin Galactic broadly expressed support for the proposed rule. Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended adding to proposed § 450.173(f) a requirement for licensees to support any NTSB or government agency-led mishap investigation and to cooperate with any other government investigative agencies.

The FAA declines to incorporate the suggested addition. Upon review of the NPRM and comments received, the FAA determines that the requirement originally proposed in § 450.173(c) regarding NTSB and FAA cooperation is unnecessary. Section 450.13 (Rights Not Conferred by a Vehicle Operator License) plainly states that issuance of a license does not relieve a licensee of its obligation to comply with all applicable requirements of law or regulation. The duty of operators to comply with lawful investigations, whether conducted by the FAA or another entity with investigative authority, exists irrespective of the language proposed in § 450.173(c). Accordingly, the FAA removes proposed § 450.173(c) from the final rule. For the same reason, the FAA also removes paragraph (b)(2) from proposed § 420.59 (Mishap Plan). Operators remain responsible for reporting investigation results to the FAA under § 450.173(e).

Sierra Nevada asked whether licensees must coordinate with the FAA and NTSB for all mishaps. For the reasons stated above, the FAA removed the requirement proposed in § 450.173(c).

The National Fire Protection Association (NFPA) recommended the FAA revise proposed § 450.173(e), which contained emergency response requirements, to require a level of safety based on its spaceport fire safety and emergency response standards. The FAA supports the development of industry consensus standards for fire safety and emergency response, but disagrees that it would be appropriate to prescribe such a code or standard in this performance-based rule.

In addition to removing proposed § 450.173(c), the FAA replaces the term “vehicle and debris impact points, including those outside a planned landing or impact area” in proposed § 450.173(d)(3)(iv) with the term “hazardous debris impact points, including those outside a planned landing site or designated hazard area” in § 450.173(c)(3)(iv).^[185] This change is consistent with changes previously discussed in the preamble. Lastly, the FAA revises the emergency response requirements in § 450.173(d)(1) to include the term “property” because, as discussed in this preamble, the FAA removed the reference to “property” from the definition of “public” in § 401.7. The FAA adopts the rest of this section of the proposed rule without change.

iii. Test-Induced Damage (§ 450.175)

In the NPRM, the FAA proposed to give license applicants and licensees the option to pre-coordinate testing activities with the FAA. This pre-coordination would take place during FAA-licensed activities to prevent the FAA from labeling test failures or associated damage as mishaps.

In the final rule, the FAA adopts § 450.175 with a modification. Section 450.175 will only apply to licensees or license applicants seeking this exception. The FAA will consider test failures and damage covered by this section, including damage to ground support equipment, ground support systems, and flight hardware, as test-induced damage and not a mishap, so long as the failure falls within the pre-coordinated scope and FAA-approved testing profile. Any mishap resulting in a serious injury or fatality, damage to property not associated with the licensed activity, or hazardous debris leaving the pre-defined hazard area, will be treated as a mishap and not test-induced damage, and will be subject to the reporting, response, and investigation requirements of § 450.173.

Several commenters expressed confusion about the effect of proposed § 450.175 on the part 450 licensing process. Boeing, Leo Aerospace, Lockheed Martin, Northrop Grumman, and ULA asked how test-induced damage would impact the licensing process. Boeing also commented that all planned test operations within the scope of a license should be assessed for public risk during the application process. Blue Origin asked what type of test is contemplated by “test-induced damage,” and if it would include tests conducted at a launch site with co-located test facilities, as opposed to integrated vehicle tests that traditionally happen at a launch site. Sierra Nevada and Microcosm commented that testing was outside the FAA's jurisdiction, and the proposed regulation should only apply to damage induced by a test performed under a license.

The test-induced damage exception set forth in § 450.175 only applies to license applicants or licensees seeking a mishap exception for test activities conducted during licensed activities. The test-induced damage exception is optional. To clarify that the test-induced damage exception is optional, the FAA adds paragraph (a) (Applicability), which states that § 450.175 only applies to license applicants or licensees who choose to pre-coordinate and apply for an optional test-induced damage exception. The FAA also replaces the word “operator” with the term “license applicants or licensees” to clarify that this provision is only available through the part 450 licensing process. Experimental permittees under part 437, by contrast, cannot seek to pre-coordinate test-induced damage with the FAA.

The exception does not apply to test activities that are not associated with FAA-licensed activities, nor to any activities outside FAA jurisdiction. The information submitted by the applicant will define the scope and type of test activities considered for test-induced damage. The FAA confirms that all planned test operations occurring during the scope of a license will be assessed for public safety risks. As stated in the FAA's “Answers to Clarifying Questions Received by June 28, 2019,” test-induced damage refers to damage expected to occur as part of a licensed activity approved by the FAA prior to the operation. An applicant must identify expected outcomes and potential risks associated with the proposed test activity. The FAA expects an applicant to identify potential failure outcomes and their consequences or risks, and plan for them appropriately. In order to except damage from becoming a mishap, the applicant needs to identify that potential damage to the FAA. Unanticipated test damage may be excepted if it results from activities conducted within the scope of the FAA approval, and does not result in any of the events listed in § 450.175(b)(2).

To seek an exception, an applicant must submit the information listed in § 450.175(c) to the FAA in advance with sufficient time to evaluate the proposal. Although the FAA anticipates the amount of time required to evaluate an applicant's proposal will be minimal, the scope of review required will vary based on the proposed test activities and completeness of information provided.

Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended without explanation that the subheading for proposed § 450.175(a) be changed to, “Coordination of risk of test-induced damage.” The FAA declines to incorporate this recommendation, as it does not accurately describe the coordination set forth in § 450.175. The possibility of test-induced damage is assumed under § 450.175. Identification of potential risks associated with a testing activity is but one of the items applicants must submit to seek an exception under this section. The FAA agrees, however, that the proposed text was unclear, as the heading used the term, “anticipated,” which does not appear in § 450.175. Accordingly, the FAA revises the subheading for § 450.175(b) to clarify that operators would be coordinating “potential,” rather than “anticipated,” test-induced damage.

Boeing, Lockheed Martin, Northrop Grumman, and ULA also recommended, without explanation, that applicants be required to coordinate test-induced damage with any affected third parties or public authorities, in addition to the FAA. The FAA declines to incorporate this recommendation. Section 450.175 provides a process for license applicants and licensees to pre-coordinate with the FAA test-induced damage that would otherwise fall under the FAA's definition of “mishap.” The FAA is the only entity with whom coordination will be needed to seek exception from the FAA's “mishap” definition. It should be noted, however, that pre-coordination of test-induced damage under this section will not affect the duty of licensees to comply with all other requirements of their license, and with all other applicable laws and regulations.

In reference to what is now § 450.175(b)(2), Boeing recommended the FAA take into consideration insight gleaned from near-misses, noting that while a test may not have resulted in damage, the same anomaly could induce significant damage in a similar operational sequence. The FAA acknowledges the commenter's concern for the net effect of unreported anomalies but finds it unnecessary to change the regulatory text. Section 450.175 provides an exception to the “mishap” definition. Test-induced damage that exceeds the scope of FAA-approved activities will be treated as a mishap. It is possible for an anomaly to occur during pre-coordinated test activities. Any condition during licensed or permitted activity (including pre-coordinated test activity) that deviates from what is standard, normal, or expected during verification or operation of a system, process, facility, or equipment is an anomaly under § 401.7. Given that § 450.215 (Post-flight Reporting) requires operators to identify anomalies and corrective actions taken in response in their post-flight report, the FAA finds it will have notice of the “near-miss” anomalies referenced by the commenter.

Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended that proposed § 450.175(c) be made consistent with ground hazard analysis requirements in proposed § 450.185 or be deleted altogether. The FAA disagrees with this comment because the requirements of § 450.185 apply to the entire launch and reentry vehicle lifecycle, and are therefore much more comprehensive than the information requirements for test-induced damage. Imposing ground hazard analysis requirements would place an undue burden on applicants seeking a test-induced damage exception. Moreover, the test-induced paradigm is intended for the testing of a specific system, function, or component during licensed activities. As stated in the NPRM, the test-induced damage exception is not available for the operation of an entire vehicle, but rather the testing of specific components and systems. Lastly, unlike the ground hazard analysis requirements, the information requirements of § 450.175(c) only apply to applicants seeking a mishap exception for damage resulting from specific test activities taking place within a defined time-period, as coordinated with and approved by the FAA.

pp. Unique Safety Policies, Requirements and Practices (§ 450.177)

In the NPRM, the FAA proposed requirements under § 450.177 for operators to implement unique policies, requirements, and practices needed to protect the public health and safety, safety of property, and the national security and foreign policy interests of the United States. Proposed § 450.177(a) would require an operator to review operations, system designs, analysis, and testing, and to identify any unique launch or reentry hazards not otherwise addressed by proposed part 450. Proposed § 450.177(b) would provide that the FAA may identify and impose a unique policy, requirement, or practice, as needed, to protect the public health and safety, safety of property, and the national security and foreign policy interests of the United States.

In the final rule, the FAA adopts § 450.177 (Unique Safety Policies, Requirements and Practices) with two revisions. For the reasons discussed below, the FAA removes the references to property protection and national security and foreign policy interests of the United States, and adds “safety” to the section title.

CSF, Sierra Nevada, and Spaceport Strategies commented that proposed § 450.177(b) expanded regulatory uncertainty by allowing the FAA to impose new requirements when needed to protect public health and safety, safety of property, and national security or U.S. foreign policy interests. CSF noted that part 417 previously allowed the FAA to impose new requirements when needed “to protect the public.” CSF and Sierra Nevada commented that proposed § 450.177(b) expanded the FAA's ability to impose requirements on an operator outside of regulatory process even if the operator met all other criteria. The commenters suggested that the ability to impose unknown requirements as a result of innovation will adversely impact costs and could have a chilling effect on innovation and investments in U.S. space industries if the FAA's discretion under proposed § 450.177 was unbounded. They further contended that the proposed requirement would give the FAA discretion to impose new requirements “as-needed” and result in no cost savings. CSF also expressed concern that such requirements could be inequitably imposed on a singular licensee or disparately among licensees developing similar technologies or operational approaches. CSF recommended the FAA be required to collaborate with the operator or with industry before requiring a unique policy, rule, or practice. CSF and Sierra Nevada recommended the rule be bounded to limit the scope and timeline for the FAA to impose restrictions, and give applicants due process.

The FAA agrees that it is unnecessary to include hazards to the national security and foreign policy interests of the United States under this section because those considerations are adequately covered under policy and payload reviews in part 450. In the final rule, the FAA removes “national security and foreign policy interests of the United States” from § 450.177(b) and (c)(2).

In the final rule, the FAA also removes “safety of property” from § 450.177(b) and (c). As explained in other parts of this preamble, the FAA is retaining in the final rule only specific requirements for property protection (e.g. critical assets, property on orbit), which have specific safety criteria. Operators may be required to mitigate hazards to property through emergency response requirements in § 450.173(d), but otherwise, the FAA declines to impose a more specific property protection requirement at this time. Removal of the references to property protection and national security and foreign policy interests largely dispenses with the commenters' concerns that § 450.177 would expand the scope of § 417.127. Although the final rule retains the provision in § 450.177(b) regarding FAA's ability to impose a unique requirement, policy, or practice needed to protect public health and safety, the FAA does not foresee a substantive change for operators from § 417.127, which provides that FAA may impose such unique requirements as needed to protect the public.

The FAA's authority to impose a unique requirement, policy, or practice is bounded, as it is in § 417.127, by the FAA's statutory authority to protect public health and safety. The FAA understands the concern expressed by Spaceport Strategies and others that the imposition of unique policies, requirements, or practices deemed necessary by the FAA to protect public health and safety has the potential to impose additional costs on the operator. However, given the rarity of the FAA's invocation of § 417.127, and the prosperity of today's commercial space industry under part 417, the FAA does not foresee any additional costs to operators or a chilling of innovation resulting from § 450.177.

Moreover, as discussed in the NPRM preamble, the necessity for § 450.177 is the same as that for § 417.127: The FAA expects that advances in technology and implementation of innovations by launch and reentry operators will likely introduce new and unforeseen safety challenges. These advances and innovations can present regulatory challenges that are unforeseen in existing regulations. In this case, the FAA must work with operators on a case-by-case basis to identify and mitigate those unique hazards posed to public health and safety, which are not addressed by part 450. The FAA expects the need for the use of this provision to be rare, as has the need to use § 417.127, due to the comprehensiveness and performance-based nature of part 450. In the rare instance that it is used, the FAA will work with the operator to reach a mutually satisfactory solution that allows the activity while protecting public health and safety, but the FAA declines to require collaboration in the regulation, as CSF suggests.

qq. Ground Safety (§ 450.179 to § 450.189)

i. Ground Safety General (§ 450.179)

In the NPRM, the FAA proposed that an operator would be required to protect the public from the adverse effects of hazardous operations and systems associated with preparing a launch vehicle for flight, returning a launch or reentry vehicle to a safe condition after flight, or after an aborted launch attempt, and returning a site to a safe condition.

In the final rule, the FAA adopts § 450.179 with revisions.^[186] This final rule moves proposed subsections (b) and (c) to § 450.179(a)(1) through (3) and adds new subsections (b) and (c). These additions are discussed in more detail in the preamble section addressing Launch and Reentries from a Federal Launch or Reentry Site.

ii. Coordination With a Licensed Launch or Reentry Site Operator (§ 450.181)

In the NPRM, the FAA proposed that an operator would be required to coordinate with site operators as both entities have public safety obligations during ground operations. Operators would be required to coordinate with site operators to ensure that access to public sites is controlled and prevent unsafe interference of ground hazards. For a launch or reentry conducted from or to an FAA licensed site, an operator would be required to coordinate mishap reporting, response, and investigations with the site operator for any mishap during ground activities at the site.

In the final rule, the FAA adopts § 450.181 as proposed with two exceptions. In § 450.181(a)(3), the ground hazard areas must be coordinated with a site operator during the designation of those ground hazard areas. In the final rule, the FAA changes the language used to describe this coordination to “[t]he designation of any ground hazard area that affects the operations of a launch or reentry site is coordinated with the Federal or licensed launch or reentry site operator.” This amended language is a minor grammatical change and is consistent with the intent of the proposed requirement. In addition, proposed § 450.181(a)(4) required an operator to coordinate with a site operator to ensure, in part, prompt and effective response in the event of a mishap that could impact “public safety.” In the final rule, the FAA changes this phrasing to require that a prompt and effective response “is undertaken” in the event of a mishap that could impact “the safety of the public and property.” The FAA changes “public safety” to “the safety of the public and property” in the final rule because, as discussed earlier in this preamble, property was removed from the definition of “public.” Thus, the FAA makes this wording change to keep the requirement equivalent to what was proposed. The FAA adds “is undertaken” as a minor grammatical change that is consistent with the intent of the proposed requirement.

Sierra Nevada commented that proposed § 450.181 seems to be duplicative of proposed § 450.147 (Agreements) and thus should be removed. While agreements made with a Federal or licensed site operator may satisfy the requirements of § 450.181, the FAA finds the requirement to coordinate with a site operator specifies what coordination must be in place to prevent unsafe interference among users of a site and ensure clear lines of responsibility for related aspects of public safety. The FAA concurs that an applicant may be able to show compliance with both requirements by providing an agreement that shows compliance with the specific criteria in § 450.181. However, the two requirements are different and intentionally separate. Specifically, § 450.181 provides additional detail about coordination that is necessary for public safety because improperly coordinated neighboring operations that occur on or near the launch site have the ability to create hazards to the public. In addition, the agreement required by § 450.147 is not an application deliverable, whereas § 450.181 requires an application deliverable. Accordingly, the FAA adopts both §§ 450.181 and 450.147.

Denver International Airport commented that, although it supported the proposed requirements for coordination with site operators, these requirements were too narrow to keep site operators and surrounding communities properly informed. Denver International Airport also commented that operators should be required to coordinate on launch and reentry activities and mishaps with a wider group of interested and affected stakeholders, including first responders and local governments. Similarly, AAAE proposed that licensed operators be required to notify contingent landing sites and nearby airports of safety hazards, including providing them with the ground safety hazard analysis. AAAE suggested such notifications could be accomplished as part of the notifications required in proposed § 450.147 or as part of a broader public disclosure.

The FAA notes that the notification requirements in § 420.57 require licensed site operators to notify local officials and adjacent landowners of flight schedules. In addition, § 450.147 requires vehicle operators to have agreements with any sites or services that are necessary to meet the safety requirements for a license. These requirements serve to notify the necessary entities about licensed operations. Including notification requirements beyond those in §§ 420.57 and 450.147 is outside the needs of this rulemaking to protect public health and safety, safety of property, and national security and foreign policy interests of the United States.

Boeing, Lockheed Martin, Northrop Grumman, and ULA recommended the FAA revise proposed §  450.181(a)(3) to require only that coordination ensure that any ground hazard areas are identified. The FAA does not find the commenters' recommendation sufficient to protect public safety and avoid adverse impacts on neighboring space operations. The vehicle operator must take an active role in ensuring the site operator is aware of ground hazard areas and how they may impact other site operations.

iii. Explosive Site Plan (§ 450.183)

In the NPRM, the FAA proposed to require an applicant to include an explosive site plan as part of its vehicle operator license application for a launch or reentry from or to a site exclusive to its own use. This plan would be required to demonstrate compliance with the explosive siting requirements in part 420.

In the final rule, the FAA adopts § 450.183 (Explosive Site Plan) as proposed. The FAA received no comments on this section.

iv. Ground Hazard Analysis (§ 450.185)

In the NPRM, the FAA proposed an operator would be required to complete a ground hazard analysis that would include an assessment of the launch or reentry vehicle, the launch or reentry integrated systems, ground support equipment, and other site hardware. In its analysis, an applicant must identify hazards; include a risk assessment; and identify and describe mitigations, controls, and provisions for hazard control verification and validation. Although the analysis might incorporate aspects of employee safety and mission assurance, an applicant would only be required to identify the hazards that affect the public and describe how those hazards are mitigated.

In the final rule, the FAA adopts § 450.185 as proposed, with minor edits to remove the reference to “public property” because “property” has been removed from the final rule's definition of “public,” as discussed in the preamble section for Neighboring Operations Personnel. Instead, the FAA refers to “property not associated with the launch or reentry.”

In response to the proposed requirements, NFPA suggested its own standards as guidance for complying with proposed §§ 450.179, 450.185, and 450.189. Space Florida also commented that the FAA did not provide clear guidance on what standards would be acceptable and how the agency would judge the sufficiency of the ground hazard analysis. Space Florida did not recommend a specific change to proposed § 450.185.

In response to NFPA's comment, the FAA notes that applicants are free to explore the use of any industry standard to demonstrate compliance with these sections. If the industry standard has not already been accepted by the FAA, the FAA would review the proposed standard as part of an applicant's application. NFPA is also welcome to submit its standards to the FAA for acceptance at any time.

In response to Space Florida, the FAA recommends that the applicant identify proposed standards and common practices during pre-application consultation to reach an agreement with the FAA on their applicability for proposed operations. For items that may deviate from current standards and practices, the FAA may seek additional justification or analysis to determine whether ground hazards pose a risk to public safety.

Virgin Galactic asked the FAA to retain the ground safety analysis practices used under part 431 and not to impose proposed § 450.185. Virgin Galactic also asked that existing launch vehicles be “grandfathered.” Finally, Virgin Galactic commented that conducting a ground hazard analysis would place a cost burden on hybrid vehicle operators and asked the FAA to outline its reasoning for imposing the requirement on hybrid operators.

The FAA discusses Virgin Galactic's question regarding cost burden in the preamble section addressing Responses to Regulatory Impact Analysis Comments. Part 431 does not have an explicit ground safety requirement, and as a result it is often difficult for applicants to ascertain how to meet the safety standard for pre-flight operations. Concurrently, the ground safety requirements in part 417 are overly prescriptive and onerous. The ground hazard analysis requirements in part 450 strike a balance between the two parts, providing additional guidance to applicants, while at the same time preserving flexibility.

An operation that was licensed prior to the effective date of this rulemaking will be permitted to continue under its license for five years from the effective date or when the license expires if the operator does not seek a renewal. For further discussion, please see the preamble section on Legacy Licenses. All regulated operators, including hybrid launch or reentry systems operators, will need to prepare a ground hazard analysis to ensure public safety is protected. Hybrid launch or reentry vehicles may still pose a risk to the public; therefore, the FAA imposes its ground hazard analysis requirements on hybrid launch vehicles in order to identify and mitigate those risks. Some launch or reentry systems will have very limited ground hazards, and thus the ground hazard analysis will be similarly limited. An operator would not need its ground hazard analysis to include carrier aircraft activities that do not constitute launch or reentry.^[187]

Boeing, Lockheed Martin, Northrop, and the ULA recommended the FAA modify proposed §  450.185(a) by adding that a ground hazard analysis must identify system and operation hazards posed by the vehicle “and any of its components.” The FAA does not adopt this change because any requirement levied on the vehicle also necessarily includes the vehicle's components.

CSF, Sierra Nevada, and Space Florida recommended that the FAA consider an alternative regulatory approach giving site operators more authority over ground safety. Specifically, CSF and Sierra Nevada recommended that the FAA consider an alternative regulatory approach that would give the responsibility for assessing and controlling ground safety and hazards mitigations to the site operator.

Historically, the launch or reentry operator has been responsible for ground safety and, as reflected in the NPRM, the FAA determined that this allocation of responsibility was appropriate given that the operator has the most comprehensive understanding of the parameters of the licensed activity. The FAA expects that the launch or reentry operator will work closely with the site operator to ensure all requirements are met. Accordingly, the FAA retains the proposed language in the final rule.

v. Ground Safety Prescribed Hazard Controls (§ 450.189)

In the NPRM, the FAA proposed that an operator would be required to implement certain prescribed hazard controls during the ground operations period of launch or reentry. These prescribed hazard controls would require that an operator document how it would protect members of the public who enter areas under the operator's control, and mitigate hazards created by a countdown abort. They would also require the operator to establish plans for controlling fires and emergency procedures. In the final rule, the FAA adopts § 450.189 as proposed.

AAAE suggested licensed operators be required to notify nearby airports and contingent landing sites of potential safety hazards and their controls, including those described under this section and proposed § 450.185. The notification requirements in § 420.57 require licensed site operators to notify local officials and adjacent landowners of flight schedules. In addition, § 450.147 requires vehicle operators to have agreements with any sites or services that are necessary to meet the safety requirements for a license. These requirements serve to notify the necessary entities about licensed operations.

5. Part 450 Subpart D—Terms and Conditions of a Vehicle Operator License

a. Public Safety Responsibility, Compliance With License, Financial Responsibility, Human Spaceflight Requirements (§§ 450.201 to 450.207)

In the NPRM, the FAA proposed requirements addressing how a licensee is responsible for ensuring public safety and safety of property during the conduct of a licensed launch or reentry in proposed § 450.201, how a licensee would be required to comply with a license in proposed § 450.203 (Compliance with License), with financial responsibility requirements of part 440 in proposed § 450.205 (Financial Responsibility Requirements), and with human spaceflight requirements in part 460 in proposed § 450.207 (Human Spaceflight Requirements).

In the final rule, the FAA adopts the requirements as proposed. The FAA received no comments on these proposals.

b. Compliance Monitoring (§ 450.209)

In the NPRM, the FAA proposed to combine the compliance monitoring requirements of §§  417.23 and 431.83 in §  450.209. The FAA also proposed to allow an operator the option to provide the FAA with means other than a console for monitoring the communication and countdown channels. The compliance monitoring requirements of proposed §  450.209 would apply to all launch and reentry operations. Finally, proposed §  450.209 codified the FAA practice for conducting compliance monitoring of part 435 operations. In final rule, the FAA adopts § 450.209 as proposed.

Virgin Galactic expressed concern regarding proposed § 450.209(b), which stated a licensee must provide the FAA with the capability to communicate with the mission director. Virgin Galactic suggested replacement language that gave the operator the responsibility for assigning a radio communications point-of-contact for the FAA during operations. The FAA does not adopt this suggestion because the FAA must have direct contact with the mission director during licensed operations to ensure any risk to public safety during ongoing operations is immediately addressed. It will continue to be FAA practice not to contact the mission director unless there is an immediate and urgent risk to public safety.

The FAA also deletes § 450.209(c) because it imposed a requirement only on the FAA and was unnecessary legacy language.

c. Continuing Accuracy of License Application; Application for Modification of License (§ 450.211)

In the NPRM, the FAA proposed to preserve the continuing accuracy requirements in §§ 417.11 and 431.73, and consolidate them in proposed § 450.211. In addition, the FAA proposed to allow an applicant to request approval of an alternate method for requesting license modifications during the application process.

In the final rule, the FAA adopts § 450.211 as proposed with only a minor revision to split the second requirement in proposed § 450.211(a) into a new § 450.211(b). Accordingly, proposed § 450.211(b) and (c) were renumbered to become § 450.211(c) and (d) in the final rule, respectively.

CSF and SpaceX suggested that the FAA could update § 413.17(a) to clarify that it would agree to a modification to an existing license when the FAA accepts and approves a continuing accuracy submission. CSF requested that the FAA clarify its use of these terms in an AC.

Virgin Galactic noted that operators may have separate definitions for continuing accuracy and license modifications. Virgin Galactic proposed what it believed to be simpler requirements for continuing accuracy updates and license modifications, which in Virgin Galactic's experience aligned with how the FAA has processed Virgin Galactic's license and license application updates over the past three years. Specifically, Virgin Galactic recommended that proposed § 450.211(a)(1) be rewritten to change the requirement so that after a license has been issued, a licensee would be required to apply to the FAA for modification of the license if the licensee proposes to make changes that affect the license, as issued by the FAA. It also proposed to add the term “continuing accuracy updates” for changes that a licensee proposes that do not affect the license but do affect the license application. Virgin Galactic maintained that this approach would provide schedule assurance for operators, as license modification usually involves time-intensive coordination between the FAA and an operator.

Sierra Nevada commented that general edits to the listed documents should not trigger the requirement of continuing accuracy, as such a requirement would create an extremely burdensome amount of document overhead an applicant would be required to maintain that is not necessary for maintaining public safety.

The FAA does not agree that the suggested changes are necessary; however, the FAA has split the two requirements in § 450.211(a) so that the application for modification of license is in § 450.211(b) for added clarity. The regulation states that a licensee is responsible for the continuing accuracy of representations contained in its application. A license modification is required only if the licensee proposes to conduct a launch or reentry in a manner not authorized by the license; or, if any representation contained in the license application that is material to public health and safety or the safety of property is no longer accurate and complete, or does not reflect the licensee's procedures governing the actual conduct of a launch or reentry. For representations that do not meet either of these criteria, such as administrative information, § 450.211(b) continues to require an applicant to inform the FAA of the change in order to ensure the representations made in the application are accurate.

The NPRM preamble identified the following as areas that constitute a material change: Reuse, after an earlier launch or reentry, of safety-critical systems or components, requiring refurbishment, re-qualification testing, and re-acceptance testing. Virgin Galactic believed performing refurbishment and pre-flight testing of reusable safety-critical systems or components would not constitute a material change that affects public safety. Both vehicles of a hybrid RLV launch system are reused, and pre-flight testing and refurbishment are performed prior to each mission. Virgin Galactic recommended this reuse language be stricken from the preamble because it is not a material change to public safety.

The FAA clarifies that normal pre-flight testing and refurbishment that are evaluated and accepted during a license application are not considered a material change. The FAA further clarifies that only pre-flight testing and refurbishment that is not evaluated during a licensing process will be considered a material change. As discussed above, a material change is a change that affects public safety that has not been evaluated and authorized by the FAA during the licensing process.

Virgin Orbit commented that some of the changes noted in preamble, such as retesting a valve or changing a safety officer, should not require a modification to a license. Virgin Orbit recommended that what constituted a material change should be based on how the change affected public safety elements contained within the FSA and PSA. Virgin Orbit further recommended that the FAA allow operators to determine how the areas that constituted a material change as identified in the preamble affected the public safety elements.

As noted earlier, a material change is a change that affects public safety that has not been evaluated and authorized by the FAA during the licensing process. These changes may go beyond just the FSA and any PSA ^[188] as suggested by Virgin Orbit. All public safety requirements in part 450 are applicable. The FAA does agree with Virgin Orbit that the burden lies on the operator to determine what constitutes a material change. The FAA notes, however, that an operator should consult with the FAA regarding those changes for which an operator is unsure whether the change is material or not.

Virgin Orbit requested a definition of a “minor” change. It further requested that minor changes would not require a full 180-day review period, and that the regulation define a maximum review time for minor changes. The FAA does not distinguish between major and minor changes, only those changes that will or will not have a material impact on public safety. Categorizing all potential changes that have a material impact on public safety into only two categories is problematic due to the variety of potential changes. The FAA does agree, however, that not all requests for modification would require extensive review. Although the statutory 180-day review period does not apply to modifications, the FAA makes every effort to act upon all requests for modifications in a timely manner. The FAA is able to respond quickly if a change is indeed minor.

d. Pre-Flight Reporting (§ 450.213)

In the NPRM, the FAA proposed to require a licensee to provide the FAA with the following information prior to each launch or reentry: Mission-specific information, FSA products, FSS test data, data required by the FAA to conduct a collision avoidance analysis, and a launch or reentry schedule.

In the final rule, the FAA adopts § 450.213 with four revisions. First, in § 450.213(d)(2), the FAA replaces the term “flight information” with “planned mission information” because the information required includes launch site information, and the term “planned mission information” is used in the final § 450.208(d)(6). Second, the FAA revises § 450.213(d) to allow an operator the flexibility to identify an appropriate time frame in coordination with the FAA. Third, in § 450.213(e) the FAA removes the reference to the time frames to submit LCOLA data, which the FAA has revised in the final rule, so that § 450.213(e) simply requires operators to submit LCOLA data in accordance with § 450.169(f). Lastly, the FAA replaces “operator” with “licensee” throughout the section to be consistent with the rest of subpart D. The FAA makes similar changes in § 450.450.215.

Boeing, Lockheed Martin, Northrop Grumman, and ULA commented that they appreciated the streamlining of pre-flight reporting. CSF recommended that the FAA allow the submittal of test reports in accordance with proposed § 450.213(d) less than 30 days before flight. SpinLaunch also stated that the proposed § 450.213(d) requirement to submit test reports 30 days prior to launch was too burdensome.

The FAA agrees that not all test reports for the FSS, such as end-to-end tests and pre-flight tests, can be delivered 30 days before flight. The FAA therefore revises § 450.213(d) to allow an operator the flexibility to identify an appropriate time frame in coordination with the FAA. The FAA discusses this flexibility in more detail in the preamble section on Time Frames.

AAAE noted that, under proposed § 450.213(f), launch schedules would be required to be provided to the FAA in advance. AAAE recommended that these schedules, including any changes to the schedule, should also be distributed to nearby airports (within at least five nautical miles of the launch site or along the vehicle's trajectory), contingent landing sites, and any emergency responders supporting the launch operation.

The FAA declines to adopt this recommendation. Section 450.147 requires that an operator establish written agreements with any entity that provides a service that meets a requirement. The FAA notes that these written agreements will include any agreements necessary to ensure the safety of airspace. The FAA has drafted § 450.147 to be as performance-based as possible; therefore, the specificity recommended by AAAE is unnecessary. That said, the FAA agrees that such notifications would usually be required.

CSF noted that proposed § 450.213 would require that the licensee provide payload details to the FAA 60 days in advance of a launch or reentry. CSF commented that operators often cannot meet that time frame due to changes in manifests for passive or minor payloads that occur inside of 60 days before flight. Proposed § 404.15 would not allow an operator to request that the time frame for payload notification be changed unless it knew more than 60 days in advance of flight that the manifest was going to change. CSF considered the proposal inflexible and requested that FAA allow proposed § 404.15 be made more flexible. The FAA disagrees with the comment, as § 404.15 currently allows for an applicant to request the FAA to relax the 60-day pre-flight reporting requirement for payload information.

e. Post-Flight Reporting (§ 450.215)

In the NPRM, the FAA proposed an operator be required to provide the actual trajectory flown by the vehicle and, for an unguided suborbital launch vehicle, the actual impact location of all impacting stages and impacting components, if requested by the FAA. In the final rule, the FAA adopts § 450.215 as proposed.

SpaceX generally agreed with the provisions of proposed § 450.215 but suggested that the FAA remove proposed § 450.215(b)(4) because it contended that post-flight auditing was already an option for the FAA and that the specific reference to a potential request for a flown trajectory was redundant and unnecessary. Although the FAA agrees with SpaceX that the FAA can request these data as part of its inspection, the FAA finds that the explicit reference in the regulatory text is necessary to ensure compliance. The FAA included this requirement in the proposed rule because some operators failed to provide flown trajectory information when the FAA requested it as part of an inspection or post-flight review. The FAA will only ask for flown trajectory data when necessary to verify models and assess vehicle performance.

f. Registration of Space Objects (§ 450.217)

In the NPRM, the FAA consolidated and updated the requirements for registration of space objects in proposed § 450.217. The FAA proposed to remove the caveat excluding foreign payloads and to add the requirement to notify the FAA when removing objects placed in orbit. The FAA noted that it is the responsibility of the U.S. Government to register objects and launch operator data is used to make relevant decisions on what to register. Proposed § 450.217(c) retained § 431.85's requirement that an operator notify the FAA when it removes a space object.

In the final rule, the FAA adopts § 450.217 as proposed.

NZSA asked if operators would have to report the reentry of an object due to atmospheric reentry, presumably much later than launch. NZSA supported the requirement of information on foreign-owned space objects to determine who would register the objects, which NZSA also requires. NZSA recommended the FAA clarify whether removal would relate only to active removal or if it would include passive deorbiting. NZSA viewed the latter to be in alignment with the terms of the Registration Convention.^[189]

The FAA did not intend the requirement to notify the FAA of objects removed from orbit to cover eventual decays through atmospheric reentry. NZSA is correct that the Registration Convention requires the notification of objects removed from space. Yet, the FAA does not believe there is a need to require launch operators to track the orbital status of all objects previously launched in perpetuity.

6. Changes to Parts 401, 413, 414, 420, 433, 437, and 440

Part 401—Organization and Definitions

i. § 401.5

In the NPRM, the FAA proposed new and amended definitions to § 401.5 (Definitions). The new proposed definitions in proposed § 401.5 were: “anomaly,” “casualty area,” “command control system,” “control entity,” “countdown,” “critical asset,” “crossrange,” “data loss flight time,” “deorbit,” “disposal,” “dose-response relationship,” “downrange,” “effective casualty area,” “expected casualty,” “explosive debris,” “flight abort,” “flight abort crew,” “flight abort rules,” “flight hazard area,” “flight safety limit,” “gate,” “hazard control,” “launch or reentry system,” “launch window,” “liftoff,” “limits of a useful mission,” “mishap, class 1,” “mishap, class 2,” “mishap, class 3”, “mishap, class 4,” “neighboring operations personnel,” “normal flight,” “normal trajectory,” “operating environment,” “operation hazard,” “orbital insertion,” “physical containment,” “probability of casualty,” “public,” “reentry window,” “service life,” “software function,” “sub-vehicle point,” “system hazard,” “toxic hazard area,” “tracking icon,” “uncontrolled area,” “unguided suborbital launch vehicle,” “uprange,” and “vehicle response modes,” “wind weighting safety system,” and “window closure.”

The amended definitions in proposed § 401.5 were “contingency abort,” “flight safety system,” “instantaneous impact point,” “launch,” “mishap,” “reenter; reentry,” “safety critical,” and “State and United States”. These new and revised definitions were necessary additions to accompany the proposed part 450 requirements.

The FAA also proposed to remove a number of definitions from § 401.5 that were no longer used in the regulations: “emergency abort,” “human space flight incident,” “launch accident,” “launch incident,” “public safety,” “reentry accident,” “reentry incident,” and “vehicle safety operations personnel.”

In the final rule, the FAA does not make any immediate changes to § 401.5. Instead, § 401.5 will remain in effect for five years after the effective date of this final rule, and its definitions will be applied to parts 415, 417, 431, and 435. After five years, § 401.5 will be removed from part 401 and all operators will use the definitions in the new § 401.7.

ii. § 401.7

In the final rule, existing and proposed definitions from § 401.5 are adopted as new § 401.7 (Definitions) specifically applicable to part 450 requirements, with the exception of the following proposed definitions: “control entity,” “data loss flight time,” “dose-response relationship,” “flight abort crew,” “gate,” “mishap, class 1,” “mishap, class 2,” “mishap, class 3”, “mishap, class 4,” “tracking icon,” and “vehicle response modes.” In addition, § 401.7 does not contain the definitions for “Federal launch range” and “launch site safety assessment” that exist in § 401.5. These definitions are not adopted because they are no longer used in the regulations. Section 401.7 will apply to all of Chapter III except parts 415, 417, 431, 435, and 440, where § 401.5 will continue to apply until five years after the effective date of this rule.

The FAA notes that the proposed definition of “probability of casualty” uses the phrase “serious injury or worse.” Consistent with current practice for launch and reentry safety analyses, as well as other DOT modal administrations, the FAA maintains that the use of the Abbreviated Injury Scale (AIS) Level 3 or greater (of the Association for the Advancement of Automotive Medicine) is appropriate for describing a medical condition sufficiently to allow modeling of casualties for purposes of determining whether a launch or reentry satisfies the public risk criteria. For additional information regarding casualty modeling, the FAA refers the reader to the preamble of a previous rulemaking.^[190]

The FAA adds new definitions for “critical payload,” “hazardous debris,” “key flight safety event,” and “useful mission,” which were not proposed in the NPRM. These definitions and the rationale to remove, adopt, or amend them are discussed in the relevant topic sections of this preamble.

Sierra Nevada suggested including a specific reference to ground safety for the public in the definition of “reentry.” The FAA declines to adopt this suggestion because public safety is the core of the FAA's statutory mission, and including additional reference to public safety for the definition of “reentry” is unnecessary.

Part 413—Application Procedures

In the NPRM, to enable incremental application submission and review, the FAA proposed to modify § 413.1 to clarify the term “application” to mean either an application in its entirety, or a portion of an application for incremental review and determination in accordance with proposed § 450.33.

In the final rule, the FAA adopts the provision as proposed. This decision is further discussed in the Incremental Review section of the preamble. The FAA did not receive any comments on this part.

In the NPRM, the FAA proposed to revise the table in § 413.1 by replacing parts 415, 417, 431, and 435, with part 450. The FAA adopts the proposed table with revisions as discussed in the preamble section for Compliance Period for Legacy Licenses.

In the NPRM, the FAA proposed to amend § 413.7(a)(3) to allow an applicant the option to submit its application by email as a link to a secure server and removed the requirement that an application be in a format that cannot be altered. The FAA adopts § 413.7(a)(3) as proposed and this decision is further discussed in the Application Process section of the preamble.

In the NPRM, the FAA proposed to revise § 413.11(a) by removing the reference to initiate a review “required to make a decision about the license or permit.” This revision would enable incremental application submission and review. In the final rule, the FAA adopts the change as proposed.

In the NPRM, the FAA proposed a change to § 413.15 to allow the FAA to establish a time frame for any incremental review with an applicant on a case-by-case basis during pre-application consultation. In the final rule, the FAA adopts this change with a revision. The FAA revises the explicit time frames in § 413.15 to reference the time frames specified in 51 U.S.C. 50905(a)(1) and 50906(a) so that a future rulemaking will not be required if the time frames are modified in the statute. This decision is further discussed in the Incremental Review section of the preamble.

In the NPRM, the FAA proposed to correct the section heading of § 413.21 to reflect the content of the section, and to correct § 413.21(c) to reference both license and permit applications. The FAA adopts these changes as proposed.

In the NPRM, the FAA included license and permit renewals in the flexible time frames table in Appendix A to Part 404. The FAA inadvertently omitted making the same change in the corresponding regulatory text in § 413.21. The FAA adopts the change as proposed, and revises § 413.21 to allow flexible time frames for license and permit renewals. This decision is further discussed in the Time Frames section of the preamble.

In the NPRM, the FAA proposed conforming changes in part 413 where a part 414 safety approval is referenced, to change those references to “safety element approval.” The FAA adopts the changes as proposed. This decision is further discussed in the Safety Element Approval section of the preamble.

Part 414—Safety Element Approvals

In the NPRM, the FAA proposed to change the part 414 term “safety approval” to “safety element approval,” to distinguish it from the term “safety approval” as used in parts 415, 431, and 435, and proposed part 450. Also, the FAA proposed to modify part 414 to enable applicants to request a safety element approval in conjunction with a license application in accordance with proposed part 450.

In the final rule, the FAA adopts the changes as proposed with minor editorial corrections. The FAA did not receive any comments on this part.

Part 420—License To Operate a Launch Site

In the NPRM, the FAA proposed multiple changes in part 420. Specifically, the FAA proposed changes in §§ 420.5, 420.15, 420.51, 420.57, 420.59, and 420.61 to align with requirements in part 450.

In § 420.5, the FAA proposed to remove the definitions of “instantaneous impact point,” “launch site accident,” and “public” from § 420.5. The FAA did not receive comments on these changes and adopts them as proposed.

In § 420.15(b), the FAA proposed to revise the environmental review requirements under part 420 to match the environmental review requirements proposed in § 450.47. As discussed in the Environmental Review section of this preamble, the FAA adopts this change as proposed, with revisions that affirmatively state the responsibilities of the FAA and an applicant in accordance with FAA Order 1050.1.

The FAA proposed a minor edit to § 420.51, and proposed to allow alternate time frames in § 420.57. The FAA adopts these changes as proposed.

In § 420.59, the FAA proposed changing the heading from “Launch Site Accident Investigation Plan” to “Mishap Plan,” and modifying the requirements for Mishap Plans to match the requirements for “mishap plans” in § 450.173. As discussed in the Mishap section of this preamble, the FAA revises § 420.59(a) to state that the requirements of this section only apply in the event of a mishap that meets paragraph (a)(1) or (a)(5) of the definition of “mishap” in § 401.7 and removes the requirement for the licensee to cooperate with an FAA or NTSB investigations of a mishap for launches launched from the launch site.

Lastly, in § 420.61(b), the FAA replaces the word “shall” with the word “must,” and replaces the term “launch or launch site accident” with a reference to the portions of the “mishap” definition that replace this term: paragraphs (1), (5), and (8). As explained in the Mishap section of this preamble, the NPRM inadvertently omitted these changes necessitated by the revised definition of “mishap” in § 401.7.

Part 433—License To Operate a Reentry Site

In the NPRM, the FAA proposed changes to the environmental requirements in § 433.7 to align them with the environmental requirements in proposed § 450.47 and removed and reserved § 433.9.

In the final rule, the FAA adopts the proposed requirements in § 433.7 with revisions to align with the revisions in § 450.47. The revisions are discussed in the Environmental Review section of the preamble. The FAA also adopts the proposal to remove and reserve § 433.9. The FAA did not receive any comments on these proposals.

Part 437—Experimental Permits

In the NPRM, the FAA proposed the following changes to part 437 (Experimental Permits).

• First, the FAA proposed to remove the definition of “anomaly” from § 437.3 and include a modified version in proposed § 401.5.
• Second, the FAA proposed to modify the environmental requirements in § 437.21(b)(1) to match the environmental requirements proposed in § 450.47.
• Third, the FAA proposed to change the name of “safety approval” to “safety element approval” in § 437.21.
• Fourth, the FAA proposed to modify the mishap plan requirements in § 437.41 to require that they meet the requirements of proposed § 450.173 and remove and reserve the requirements in § 437.75.
• Fifth, the FAA proposed to change the requirements in § 437.65 for collision avoidance to match proposed § 450.169.
• Finally, the FAA proposed allowing for alternate time frames for pre-flight reporting in § 437.89.

In the final rule, the FAA adopts the proposed requirements with the following exceptions. The FAA revises the environmental requirements in § 437.21 to align with § 450.47, and replaces the word “envelope” with the word “scope.” “Scope” more accurately captures “envelope, parameter, or situation” as used in the definition of “safety element approval.” The rationale for this revision is discussed in the Environmental Review section of the preamble. The FAA also aligns the recordkeeping requirements in § 437.87(b) for an event that meets paragraph (a)(1) through (a)(3), (a)(5), or (b)(3) of the definition of “mishap” in § 401.7, for which a permittee must preserve all records related to the mishap event. The FAA removes the definition of “anomaly” from § 437.3 and includes a revised definition of “anomaly” in § 401.7 instead of in § 401.5 as proposed. The FAA also amends the language in § 437.87(b) to state that records must be retained until completion of any Federal investigation and the FAA advises the permittee that the records need no longer be retained. These changes will clarify the records retention requirements and ensure consistency with part 450. The changes do not modify the scope of the requirements. The FAA did not receive any comments on this portion of the proposed rule.

Part 440—Financial Responsibility

In the NPRM, the FAA proposed to modify § 440.15 to allow for alternate time frames. The FAA also proposed to modify the definition of “maximum probable loss” in § 440.3 to exclude neighboring operations losses from losses to third parties that are reasonably expected to result from a licensed or permitted activity and that have a probability of occurrence of no less than one in ten million (1 × 10⁻⁸), and to include those losses to neighboring operations personnel that have a probability of occurrence of no less than one in one hundred thousand (1 × 10⁻⁵).

In the final rule, the FAA adopts these changes as proposed. The FAA did not receive any comments on this proposal.

7. Miscellaneous Comments

i. General Support/Opposition

Several commenters generally supported the proposed rule as a much-needed effort to consolidate and update the licensing process in a way that would foster innovation and growth of the space industry. Individual commenters supported streamlined licensing as a way for space startups to enter the industry.

The FAA also received comments stating the NPRM fell short in streamlining rules and procedures, as directed by SPD-2. The FAA received comments that the proposed rules made obtaining launch licenses too difficult or expensive for small companies because they require legal or technical experts for small, low-risk launches. An individual commenter asserted the FAA should ease restrictions for space startups. Another individual commenter stated the NPRM added administrative requirements that the FAA would not be able to manage. Virgin Galactic requested that the safety, efficiency, and clarity of the current regulatory regime for suborbital, reusable vehicles be maintained in any new rulemaking.

Individual commenters asserted the NPRM did not contain adequate standards to evaluate the adverse effects of licensed activities on public safety and the environment. The Center for a Sustainable Coast (Center) stated the FAA should require applicants to analyze risks to private or public property, including infrastructure and natural resources. Without such a requirement, the Center and other commenters argued the proposed rule would make it easier to launch over residential areas, environmental preserves, or other areas presenting a high risk of harm to persons, property, and natural resources. The FAA also received comments raising concerns about Camden Spaceport, citing the proposed rule's lack of noise limitations, emissions requirements, and attention to the effects on the environment and residential areas.

The FAA notes that the commenters did not recommend specific changes to the proposed rule, nor did they provide cost data to substantiate the economic concern for small companies. As such, the FAA cannot provide a specific response to these comments but notes its general disagreement with the claim that the new rule will make it too difficult or expensive for small companies to secure commercial space launch and reentry licenses from the FAA. In fact, publicly available means of compliance will assist small companies in entering the market by providing multiple options for complying with the regulations. Similarly, the FAA disagrees that it would be necessary or feasible to create an exception in the licensing process for “space startups.”

The FAA disagrees further that the administrative requirements to be placed on the FAA will prove impracticable to administer. The final rule upholds the FAA's responsibility to protect public safety and safety of property. In addition, the final rule makes no change to the FAA's assessment of environmental impacts. As such, the FAA disagrees that the final rule will enable operators to secure licenses for launches or reentries that do not satisfy the FAA's public safety or environmental review criteria.

Finally, commenters' concerns regarding Camden Spaceport are beyond the scope of this rulemaking.

ii. Miscellaneous Comments

Starfighters Aerospace asked if all present restrictions on compensation or hire would be removed for licenses and certificates developed collaboratively between AVS and AST.

The FAA notes that this rule will not change any current practice or regulation regarding compensation or hire restrictions under aviation regulations. Changes to compensation or hire are outside the scope of this rulemaking.

An individual commenter stated that the FAA should have incorporated the proposed regulatory text the ARC included at the end of its report, or, alternatively, the FAA should reconvene the SLR2 ARC. Two individuals commented that the FAA did not provide sufficient public engagement for this rule. SpaceX and two individuals commented that the proposed rule did not adequately address stakeholder concerns. Several commenters, including SpaceX and Virgin Orbit, requested a public meeting.

As noted in the NPRM, the FAA does not address the ARC's recommended regulatory text because the recommended text did not receive broad consensus within the ARC. The FAA also disagrees that commenters did not have sufficient opportunity to comment on the NPRM. Although the FAA did not hold a public meeting, as some commenters requested, the FAA accepted written questions seeking clarification on the NPRM and, upon publication of the FAA's responses to those questions, extended the comment period to allow commenters sufficient time to review the FAA's clarifications. Similarly, while the FAA did not reconvene the SLR2 ARC, the FAA relied heavily upon the recommendations of the ARC, in addition to industry and other public comments, in promulgating this rule.

Relativity Space commented that the NPRM preamble and proposed rule diverged from stakeholder expectations and appeared contradictory. Sierra Nevada requested that the FAA identify in the docket any contractor support used to develop and draft the NPRM.

The FAA generally disagrees that the preamble contradicted the proposed regulation, but notes that, as explained herein, the FAA has revised particular provisions that commenters specifically identified as unclear or impracticable. The question of contractor support is irrelevant to this rule or its promulgation by the FAA.

CSF and SpaceX commented that the FAA should revise § 440.15(c) so that operators would not need to submit proof of insurance, as required by § 440.9, more than once if the insurance policy covered multiple licensed activities.

CSF, Rocket Lab, and SpaceX requested the FAA revise § 440.15(c)(1)(iv) through (c)(1)(vi) to allow use of electronic signatures, in lieu of original signatures, for each party to the required waiver of claims.

Denver International Airport asked the FAA to broaden the scope of financial responsibility required by part 440 to include employees, site operators, neighboring communities, and other stakeholders.

Boeing and Northrop Grumman recommended the FAA add to § 404.5(b) a requirement that petitions for waivers specify the duration or specific mission for which petitioner seeks relief, noting the FAA should not assume a waiver applies to the entire license.

The FAA notes that the previous four issues raised by the commenters are all beyond the scope of this rule because they contained comments on areas of the commercial space transportation regulations that were not part of the proposal.

CSF commented that the NPRM was anti-competitive and discouraged operations from U.S. Government ranges, thereby favoring operators located elsewhere, including outside the United States.

The FAA notes that CSF does not explain why it thinks the rule will discourage operations from U.S. Government ranges and favor operators located elsewhere, including outside the United States. Based on applications received by the FAA, the locations of operations are ultimately determined by the scale and complexity of operations, including the size and type of launch vehicle, resource inputs, infrastructure requirements, and payload considerations. The net cost savings provided by this rule do not significantly change the relative costs of operating from U.S. Government ranges in favor of locations elsewhere given these considerations of scale and complexity of operations. In addition, U.S. companies need a license from the FAA for a commercial space launch regardless of where the launch occurs—this rule does not change that. Currently, and prior to this rule, U.S. companies operate at locations outside of U.S. Government ranges in remote locations and abroad, such as New Zealand.

iii. Advisory Circulars (ACs)

CSF, Sierra Nevada, Space Florida, SpaceX, and two individuals (including Congressman Steven M. Palazzo) commented that the FAA had failed to provide sufficient accompanying guidance documents and ACs to allow industry to provide meaningful input on the proposed regulations. CSF and SpaceX both commented that the FAA's approach to publish many ACs with the final rule did not allow industry to consider the proposed rules and the draft ACs as a complete package. Virgin Galactic recommended that the FAA release updated ACs and guidelines to coincide with the new rule's going into effect, or allow a grace period for applicants and currently licensed operators to be compliant.

The FAA acknowledges the commenters' concerns, but disagrees that the lack of draft ACs, which are necessarily rooted in the text of regulations, prevented commenters from substantively commenting on the proposed rule. The preamble and table of accepted means of compliance provided sufficient detail to support the proposal. The ACs will be non-binding guidance documents designed to provide specific examples of means of compliance and recognized practices without prescribing regulatory requirements. The public and interested parties will have an opportunity to provide comment on the ACs.

As noted under the performance-based regulations discussion, CSF and SpaceX stated that some of the proposed rules may be performance-based, but it was difficult to make that determination without reviewing the accompanying ACs. Space Florida commented that there was an absence of performance criteria and guidance providing acceptable approaches.

The FAA does not agree that the absence of additional draft ACs prevented members of the public from understanding the performance-based requirements as proposed. The proposed requirements, along with discussions in the preamble, provided ample notice to the public. An AC would provide one means, but not the only means, of meeting any particular requirement.

iv. Designated Engineering Representative Model

Blue Origin recommended the Designated Engineering Representative (DER) model to determine compliance with the FAA's launch and reentry regulations.

Delegating the agency's authority to make engineering compliance findings to qualified individuals (DERs) in the context of licensing commercial space transportation is beyond the scope of this rulemaking. The FAA may consider such a recommendation in the future.

v. Request for SNPRM

The FAA received a number of comments requesting that the FAA issue an SNPRM. Denver International Airport commented that the FAA should wait to issue this rule until Congress adopts the Space Frontier Act, and then, if required, issue an SNPRM.

One individual commenter asked the FAA to restart the rulemaking process and work closely with industry and the ARC to produce a final rule that would meet industry needs and would comply with the Commercial Space Launch Act and SPD-2.

The FAA disagrees that the final rule is inconsistent with either the Commercial Space Launch Act or SPD-2. Through this rule, the FAA streamlines the licensing process for commercial launch and reentry operations, and replaces many prescriptive requirements with performance-based criteria, as directed by SPD-2. To forego rulemaking until Congress passes additional legislation on commercial space operations, as Denver International Airport suggested, would contravene the President's policy directive.

The FAA finds no circumstances that would justify a second round of notice and comment or SNPRM. The FAA provided ample opportunity for members of the public to submit comments and supporting evidence to the administrative record, as shown by the large volume of substantive, diverse comments received. The FAA also provided two sets of written responses to clarifying questions, and extended the comment period following publication of those responses. Although the FAA has adjusted and revised parts of the NPRM in light of the comments received and interagency review, the final rule does not materially differ from the proposed rule such that an SNPRM would have been warranted. Nor does the FAA view the presence of the circumstances that might otherwise necessitate publishing an SNPRM (e.g., availability of new studies or experiments affecting the agency's analysis; supervening legal developments that significantly affect the rulemaking; or any other important change to the agency's analytical framework in the rulemaking).

vi. Airspace

The FAA received a number of comments on the effect of space operations on the NAS. A4A, AAAE, ACI, ALPA, AOPA, CAA, NATCA, and RAA recommended the FAA implement tools to integrate commercial space activities safely and expeditiously into the NAS and to harmonize the regulatory regime governing aviation and commercial space. These commenters argue that greater communication and coordination with NAS users was needed to reduce delays and obstacles faced by both industries (e.g., coordinated vehicle surveillance, traffic management, and hazard mitigation plans).

The same commenters recommended the FAA incorporate into the rule the recommendations of the ongoing Airspace Access ARC. AOPA stated the COMSTAC and SLR2 ARC should have included general aviation representation.

A4A and Southwest Airlines asked that aviation stakeholders be given an opportunity to identify potential NAS impacts during the licensing process. A4A, AAAE, ACI, ALPA, CAA, NATCA, and RAA recommended the FAA require licensees to identify and mitigate negative operational and financial impacts to NAS users resulting from licensed activities. A4A added that hazard mitigation plans and the FAA's accepted means of compliance should be subject to public comment, or otherwise allow NAS users the opportunity to identify airspace and ground safety risks.

The FAA did not propose any changes for the protection of aircraft other than the aircraft risk criteria proposed in § 450.101(a)(3). As such, these comments are beyond the scope of this rule. Recommendations from the Airspace Access ARC, which included commercial space and aviation industry representatives, may inform future actions addressing aircraft protection.

8. Responses to Regulatory Impact Analysis Comments

i. Compliance Period for Legacy Licenses

CSF commented that if the FAA required holders of licenses issued under current regulations to seek renewals under part 450, operators and the FAA would experience significant additional cost and regulatory burdens because currently licensed operators under parts 431 and 435 would have to come into compliance with certain additional requirements in part 450. Blue Origin also expressed concern that, without grandfathering, there would be a cost to transition a license to part 450. Blue Origin pointed out that, according to the NPRM, upon license renewal, an existing operation would have to comply with part 450. Blue Origin disagreed with the FAA's conclusion that operators would not have great difficulty transitioning existing programs to part 450. It cited, in particular, proposed CE_C and associated requirements in proposed § 450.145.

The FAA notes that any request to renew a current license submitted after the effective date of the rule will result in a license valid for no more than five years after the effective date of this rule. However, upon the effective date, the operator will be required to come into compliance with COLA and critical asset requirements. The FAA does not estimate additional costs for those two requirements because the operator will provide the same information the operator currently provides, and the U.S. Government will perform the necessary analyses, as discussed in the preamble sections for Critical Asset and COLA.

After five years from the effective date of the final rule, all vehicle operators must be in compliance with part 450, but information previously submitted to the FAA in obtaining a license under parts 417 and 431 may be referenced as means of compliance to meet the requirements of part 450. Concerns over costs of proposed CE_C and FSS requirements in § 450.145 are discussed in the remainder of this section. There may be costs to transition licenses following the 5-year period after the rule's effective date. However, as mentioned previously, the FAA anticipates few, if any, additional requirements that could not be fulfilled by referencing previous submittals.

ii. § 450.47 Environmental Review

Several commenters stated that the proposed requirements would impose added costs for which the FAA did not account. Space Florida expressed concern that the FAA may determine that new or supplemental environmental analyses would be necessary for operators opting for a single vehicle license with vehicle and site flexibility. The commenter was concerned that such analyses would be required before the determination to add multiple vehicle configurations, operational parameters, or launch site locations to an operator's single license. Spaceport Strategies also expressed concern that the FAA had not analyzed the cost to launch operators or to launch site operators for additional or redundant environmental reviews that the FAA would likely require of an operator under the new rule in order for an operator to obtain a single license covering multiple launch or reentry sites or multiple vehicle configurations and flight operations. Spaceport Strategies noted that the added costs of repetitive or redundant environmental reviews would cause unquantified cost impacts on licensees, including State and local launch site license applicants. CSF stated that applicants using the licensing option to include multiple sites under one license may be vulnerable to time and cost uncertainty resulting from these environmental review requirements.

The FAA does not agree that the final rule will impose additional costs beyond what is currently required of applicants for environmental reviews, including applications for a single vehicle license or licenses that include multiple sites, as the final rule codifies current practice. NEPA requires that an environmental review be completed for each site covered by the FAA license. As such, the final rule makes no change to the existing requirement that applicants submit information allowing the FAA to fulfill its responsibility under NEPA to assess the environmental impacts associated with the proposed activities, at each site where the licensed activities will occur. An applicant must submit these materials to allow the FAA to conduct site-specific reviews regardless of whether multiple sites or vehicles are covered under one license or several licenses. This could be accomplished by including multiple sites into one NEPA document, or separating them into individual NEPA documents.

Spaceport Strategies commented that the FAA did not consider the offsetting costs of environmental reviews for the new vehicles and launch sites for which cost savings were assessed. The FAA notes it did not include offsetting costs for new vehicles and launch sites because the same costs for environmental reviews will be imposed under the current regulations. There will be no change in costs.

Spaceport Strategies commented that the FAA's re-write of environmental review requirements was more than a simple “consolidation” as reported in the Preliminary Regulatory Impact Assessment. The commenter stated that the proposed requirements had unquantified cost impacts upon licensees, including State and local launch site license applicants, for the additive costs of repetitive or redundant environmental reviews.

As discussed in the Environmental Review section of this preamble, the final rule codifies existing environmental review requirements. The commenter did not identify the environmental reviews it deems repetitive or redundant. However, the FAA confirms that in codifying existing practice, the final rule will not impose additional costs for environmental review.

Spaceport Strategies commented that licensees would face significant costs to redo environmental analyses for previously studied and permitted sites. As an example, the commenter referred to Space Florida's being required to spend almost $239,000 for another environmental assessment for its Launch Site Operator License for horizontal launch at the former Shuttle Landing Facility, when NASA had completed two previous environmental assessments on the same facility.

The FAA notes this rule will impose no additional environmental reviews nor require a redo of an environmental assessment if an operator's operation remains within the scope of the original assessment. However, consistent with NEPA, an operator will be required to do additional environmental reviews if the scope of its operation has changed.

Spaceport Strategies commented that the FAA did not address environmental review regulations derived from practices and policies being codified into rules as potential federalism issues with the State and local jurisdictions that operate the part 420-licensed sites. The commenter stated that the FAA also did not consider that some, if not all, of the local and State authorities are small governmental entities for purposes of the Regulatory Flexibility Act.

The FAA determines that this rule codifies existing requirements in FAA Order 1050.1 and will not affect the applicability of NEPA or any other Federal environmental law to non-Federal launch or reentry sites. Therefore, the FAA finds that the final rule will not have an additional cost impact on small governmental jurisdictions.

iii. § 450.101(a)(b) Neighboring Operations

Virgin Orbit believed the costs of the additional E_C analysis to use in determination of neighboring operations personnel would be $10,000. As discussed in the preamble section for Neighboring Operations Personnel, the FAA acknowledges that this requirement will require additional analysis; however, the FAA expects that this analysis will involve minor additional effort because the operator already has to perform a similar analysis for the public and will only need to account for the population of neighboring operations personnel, if any.

Blue Origin expressed concern that the FAA might implement a requirement for which compliance would be impossible, or would lead to the creation of a sole source provider for a service necessary to demonstrate compliance, if the FAA does not explain how the transfer of neighboring operations personnel population data would take place. Sierra Nevada expressed concern regarding an applicant's ability to perform calculations to determine which neighboring operations personnel could remain on a launch site, because the applicant would need to get accurate data regarding the populations and locations of neighboring operations. Sierra Nevada pointed out that, because data could be on personnel performing operations for competing companies, the data could be proprietary or sensitive. Sierra Nevada suggested the FAA could perform this function to guard the proprietary nature of the data.

In the final rule, the FAA notes that the Federal or licensed site operator will determine those personnel who are eligible for neighboring operations personnel status in coordination with the launch operators, because the site operator is in the best position to identify which personnel are required to perform safety, security, or critical tasks at the launch site. Further, as previously discussed, both the launch or reentry operator and the neighboring site operator benefit from this treatment of neighboring operations personnel.

Spaceport Strategies faults the FAA for not comparing the estimated marginal productivity improvement created by allowing certain personnel of neighboring operators to remain at work during nearby operations with adverse schedule and competitiveness losses if the FAA did not adopt the alternative approaches suggested by the ARC and CSF.

The alternative chosen by the FAA provides cost savings compared to the current regulations, and the FAA believes that this approach is consistent with the intent of SPD-2. The FAA acknowledges that other approaches exist, and considered three alternatives that are discussed in the Regulatory Flexibility Act section of this preamble.

Spaceport Strategies commented that the labor categories used to calculate neighboring operations personnel savings (engineers and technicians) did not align with the restricted categories of work functions allowed to remain (such as personnel required for safety, security, or critical tasks), indicating that the FAA's savings estimates may not actually be realized.

The FAA received input from licensed operators on the labor categories that might be allowed to remain on the launch site and, based on that input, is confident that these are reasonable labor categories.

iv. § 450.101(a) Incorporate Waterborne Vessels Into Collective Risk Criteria

To incorporate waterborne vessels into collective risk assessment, Virgin Orbit requested the FAA and other regulators work with launch service providers by providing databases on global marine traffic. Virgin Orbit also requested guidance on debris size/fragment velocities that would result in injury to marine traffic, in an appendix or AC. Virgin Orbit asserted that this requirement is not found in the existing regulations, and estimated that the additional cost to analyze and document the effort would be approximately $20,000 per launch, which would become significant costs for a large number of launches.

The FAA does not agree that there will be additional costs of any significance from the requirement to incorporate waterborne vessels into collective risk criteria. The operator can continue its current practice and demonstrate compliance in accordance with the RCC 321-20 Supplement. The FAA does not find a need to provide databases on global marine traffic because there are several public sources of data on ship traffic available through the internet which aggregate near real-time Automatic Identification System (AIS) ^[191] data from satellites and ground stations. The FAA notes that all vessels over 300 tons on an international voyage, all domestic vessels over 500 tons, and all passenger carriers, are required to operate “Class A” AIS transponders, broadcasting continually-updated data, such as identity, position, course, speed, ship characteristics, cargo, and voyage information, to other vessels and the shore. The United States Coast Guard requires AIS Class A transponders on all U.S. vessels engaged in commercial service that are (1) self-propelled and over 65 feet in length, or (2) towing vessels of 26 feet or more in length and more than 600 horsepower. The USCG also requires AIS Class B transponders on smaller vessels, such as fishing industry vessels.^[192] Detection of smaller vessels, which tend to remain close to shore, can be accomplished without AIS by fixed ground-based and ship-board radar, as well as surveillance aircraft. The FAA will publish an AC on population exposure analyses that includes details about available databases that provide valid data on ship traffic, including near real-time ship traffic useful for E_C analyses. The forthcoming RCC 321 Supplement will also include this information.

The ship probability of impact contours (P_I) and individual risk contours are already required and computed based on current practice to establish ship hazard areas. The FAA Office of Commercial Space Transportation will facilitate access to the ship traffic densities so that the E_C contribution from ships can be computed with a spreadsheet.

v. § 450.101(a)(3) Aircraft Risk

Virgin Orbit commented on the proposed requirement for an operator to establish aircraft hazard areas necessary to ensure the probability of impact with debris capable of causing a casualty for aircraft does not exceed 1 × 10⁻⁶. To incorporate airborne vessels into the collective risk assessment, Virgin Orbit requested FAA databases on civil and general aircraft, predicted air traffic, and debris size and velocities that would result in aircraft casualties in order to comply with this requirement. Virgin Orbit stated guidance on debris size and fragment velocities could be added in an appendix or AC. Virgin Orbit indicated that this is a new requirement relative to the existing regulations and estimated that the additional cost to analyze and document the effort would be $20,000 per launch. While not significant by itself, Virgin Orbit stated that the additional cost for a large number of launches becomes significant.

The FAA does not agree that this is a new requirement. Current part 431 regulations require an operator to demonstrate that the risk level to an individual does not exceed 1 × 10⁻⁶ probability of casualty per mission. The part 431 requirement is equivalent to the corresponding part 450 requirement, which requires that the probability of impact with debris capable of causing a casualty for aircraft does not exceed 1 × 10⁻⁶. Because people in aircraft are not excluded from the part 431 requirement, part 450 is not adding a new requirement to demonstrate risk level for aircraft. In addition, § 417.107(b)(4) is identical to the requirement in § 450.101(a)(3). Part 450 does not require a collective risk assessment for aircraft, so aircraft traffic densities, data on civil and general aircraft, and predicted air traffic, are not necessary.

vi. § 450.101(a)(4) Critical Assets

Blue Origin commented that because operators on non-Federal launch or reentry sites would be required to comply with USAF Federal site requirements, the FAA would need either to confirm it had considered private and licensed spaceports in its cost assessment and that those operators would not need to complete any critical asset analyses, or to confirm they were not included. The commenter also stated that it was possible the new requirement would impose costs for operators not at Federal sites.

Spaceport Florida voiced concern about the creation of a new category of property designated as a “critical asset,” which would be required to be protected against “loss of functionality” by prescribed risk criteria limiting each designated asset's exposure to launch or reentry hazards. The commenter indicated concerns about extraordinary analysis requirements, unknown costs, and program risks asking what limits the types and numbers of assets that may be designated by multiple parties within proximity to a licensed launch activity.

Spaceport Strategies commented that the FAA had not conducted certain analyses. These included analyzing the cost to a licensee to perform a risk assessment on each FAA-identified critical asset to be incorporated into a flight safety risk analysis, analyzing the cost to identify critical assets to be evaluated as a property at risk, and analyzing operator time to process waivers required for an operator's own critical assets or for an asset that may be at risk for a particular critical licensed activity. Spaceport Strategies expressed concern that the proposed requirements duplicated existing standards imposed by NASA and the USAF, and noted that there was only brief mention of this newly proposed requirement in the FAA's Preliminary Regulatory Impact Analysis, which identified no costs associated with its implementation. As proposed, this requirement would apply to all licensed launches and reentries wherever they may occur, at any site in the United States. The commenter noted that in the Baseline Analysis of the cost impacts and cost savings of proposed § 450.101, the FAA claimed no cost impact for a new requirement that clearly would add cost burden to every licensee, as well as to the FAA itself.

The FAA notes that under the final rule the U.S. Government will perform the identification and analysis of critical assets. The FAA expects these costs to be relatively small. The Federal launch or reentry site will perform the analysis for launch or reentry operations from Federal sites, and the FAA will perform the analysis for operations from non-Federal launch or reentry sites. Therefore, operators should incur no costs for determination of critical assets.

vii. § 450.101(c) High Consequence Event Protection

Spaceport Strategies stated that the proposed requirement to use the CE_C analysis tool would be prohibitively expensive—even technologically infeasible—to use, and faulted the Preliminary Regulatory Impact Analysis for not including these costs. The commenter also criticized the FAA for not including the costs for operators to learn the skills or contract for the analysis. In addition, they stated that the FAA did not include its cost to hire in-house personnel or contractor skills to validate that the operator's analysis justifies not needing an FSS.

CSF found the CE_C to be a new and costly calculation that may require significant resources, including possible reliance on contracts for expensive modeling capabilities. The commenter feared that meeting the CE_C may result in substantial increase in cost to those operators currently able to show compliance. Based on its understanding of the proposed rule, CSF concluded that the majority, if not all, of the operators would be captured by proposed § 450.145(a)(1) and would be required to implement an FSS of the highest reliability. CSF disagreed with the FAA's estimated FSS cost savings and indicated there would be cost increases.

Virgin Orbit stated that CE_C, as a new requirement, would be burdensome to implement and would require changes to its in-house algorithm to compute flight corridors with associated E_C. According to Virgin Orbit, this new burden would impact timelines for future launches and would have significant costs to implement. The commenter recommended CE_C be included as one method to determine whether an FSS was needed and not as a required calculation. The commenter further noted that CE_C, as proposed, would be better suited in an AC. Blue Origin described the proposed CE_C as a complicated analysis with debatable accuracy. Several commenters disagreed with the FAA's conclusion that this new “consequence risk” methodology aligned with current practices.

Rocket Lab explained that, because proposed CE_C disregarded demonstrated reliability and experience, it appeared almost impossible for any orbital launch vehicle to meet the prescribed CE_C thresholds. Preliminary calculations suggested that the majority of orbital launch vehicle operators would be directed toward a flight abort system of the highest prescribed reliability.

The FAA does not agree that the cost to use CE_C is prohibitive or that Virgin Orbit will be required to make significant changes to its in-house algorithm. Additional costs associated with modifications of analysis tools, adjustments to data development, additional analysis runtime, and interpretation of the results as detailed below, should not be significant.

The modification of existing analysis tools is expected to take only a few hours. As explained earlier, CE_C is inherent in the calculation of total casualty expectation. If the capability to output the CE_C values is not already part of the calculation tool, adding the output of this value for each scenario should require no more than a few hours of effort. This estimate is included in the Regulatory Impact Analysis for those operators who choose to do the analysis.

Because the CE_C metric is more sensitive to the input data and to numerical sampling approaches than the collective E_C metric, more rigor needs to be applied to the analysis or more uncertainty accepted in the result. Some data development may need to be of higher fidelity and more computation samples run to achieve a statistically meaningful answer. Therefore, the FAA finds there will be additional cost to perform the analysis. To comply with § 450.101(c), the operator first calculates the CE_C, assuming no FSS is present, to determine whether flight abort with an FSS meeting the requirements of § 450.108(b) is needed. These calculations will incur 5 percent of the debris analysis costs.^[193] These estimates are included in the Regulatory Impact Analysis.

Applicants using an FSS can use hazard containment or analysis of CE_C as key criteria in the determination of flight safety limits. The cost to interpret CE_C results for flight safety limit development is expected (after the debris analysis is run) to reduce the costs nominally compared to existing containment approaches.

Using its CE_C tool, ACTA, under contract to the FAA, has identified several launches in the launch forecast that will not need an FSS. The Regulatory Impact Analysis includes more information on these launches, as well as an updated estimate of cost savings anticipated because these launches will not need an FSS.

The FAA notes that any operator that agrees to have a § 450.145-compliant FSS does not have to do a CE_C analysis to determine the required reliability level of the FSS. However, a CE_C analysis may still be needed to determine the flight safety limits. As discussed in the High Consequence Event Protection preamble section, the final rule now has a number of flexibilities in § 450.101(c). Nevertheless, an operator could opt to use the flight safety limits approach in current § 417.213 as a means of compliance with § 450.108(5), and thus avoid any costs associated with CE_C analysis.

viii. System Safety Program, Post-Flight Data Review, Post-Flight Reporting

CSF disagreed with the FAA's rationale that any added burden of this section would be minimal because industry practice was to review post-flight data for reliability and mission success. CSF maintained that the proposed post-flight data requirement extended beyond industry practice. The commenter also stated that it was not clear whether the process for evaluating post-flight data would be subject to FAA review and approval, which would create an even larger burden. Sierra Nevada also commented that the proposed requirements extended beyond the industry practice of reviewing post-flight data for reliability and mission success, to requiring an operator to develop and employ a process for evaluating post-flight data to ensure consistency between the assumptions used for preliminary safety assessment, any flight hazard or FSA, and associated mitigation and control measures. Rocket Lab and Sierra Nevada stated the proposed § 450.103(d) would require the operator to address any anomaly identified and resolve inconsistencies prior to the next flight of the vehicle. Rocket Lab pointed out that this was overly burdensome.

The FAA disagrees with the commenters. The FAA is only concerned with ensuring consistency between the assumptions used for any safety analysis and associated mitigation and hazard control measures. It is industry practice to review post-flight data to address vehicle reliability and mission success.

The FAA further notes that current regulations already require that any representation contained in the license application that is material to public health and safety or the safety of property be kept accurate and complete, therefore any additional burden from § 450.103(d) will be minimal. Currently, operators review the post-flight data because it provides valuable information on future operations. At a minimum, in the final rule, § 450.103(d)(1) will require that an operator employ a process for evaluating post-flight data to ensure consistency between the assumptions used for the hazard control strategy determination, any hazard or FSA, and associated mitigation and hazard control measures. With respect to § 450.103(d), the FAA will evaluate the post-flight data review process during the application evaluation. Applicants will not be required to provide information obtained from the post-flight data review to the FAA unless specifically requested to do so during the compliance monitoring process. The FAA finds that it has always been the operator's responsibility to ensure the accuracy of the relevant safety analyses. Operators must review flight data in order to ensure that the operation is conducted as predicted, and to inform necessary safety analysis changes for future flights.

Section 450.215 will continue to require licensees to submit a post-flight report no later than 90 days after an operation if there are any anomalies in the flight environment material to public health and safety and the safety of property, and if there is a need for associated corrective actions. This practice is currently required by § 417.25(c). While RLV operators licensed under part 431 are not currently required to submit a post-flight report, they are required to ensure that all assumptions and representations made in their application that are material to public health and safety or the safety of property are kept accurate and complete, in accordance with §§ 413.7 and 431.73(b)(2). As such, the FAA expects the added burden to be minimal because launch and reentry operators regularly track anomalies and implement corrective actions for mission assurance, continuing license accuracy, and safety purposes. The FAA is normally made aware of any anomalies and corrective actions that are material to public health and safety through its inspection program.

ix. § 450.141 (Proposed § 450.111) Computing Systems and Software Systems

Several commenters expressed concern that the NPRM proposed a prescriptive approach to the software hazard, which would impose a significant burden on operators to meet all of the proposed requirements and structure.

An individual commenter estimated that changing the review process and structure of software would require a substantial new effort and add costs of over $40,000 per launch. Blue Origin faulted the FAA for proposing overly prescriptive regulations governing how the operator would design and test software. Blue Origin also contended that the prescriptive proposed requirements did not integrate well with most industry applications and best practices and failed to address critical aspects of safety sufficiently for aeronautical databases, complex distributed software systems, new techniques, and machine learning. Blue Origin indicated that these would threaten progress being made towards safer, lower cost and higher quality software approaches. CSF maintained that the requirements of proposed § 450.111 prescribing how the operator would design and test software, and providing only one way to demonstrate that software was safe, failed to allow development of new technologies that could lead to safer solutions, and would greatly increase costs. Leo Aerospace stated that the testing requirements of proposed § 450.111(d)(2) and (f)(1) were so prescriptive that they would be cost-prohibitive.

In the final rule, the FAA revises § 450.111 to mirror the typical structure of computing system safety application data submissions and adds flexibility in the means of compliance for key aspects of safe computing system development. The FAA notes that these revisions address the key aspects of commenters' concerns. The final rule on computing and software systems, now located in § 450.141, aggregates the requirements in proposed § 450.111 into performance-based objectives set in the context of the appropriateness of each element for the system as a whole. This aggregation removes any prescriptive requirements and replaces them with the performance-based objectives. The performance-based objectives are the elements of software development and testing processes that enable an understanding of the public safety implications of each software component, and the objectives are structured to mirror typical software safety application data submissions to minimize or eliminate the need to adapt existing software safety processes to fit the new regulations. The final performance-based objectives expand the range of software safety approaches that could meet the regulation to enable more innovation while keeping the compliance burden at or below the level proposed in the NPRM.

x. Proposed § 450.113(a)(5) Flight Safety Analysis Requirements

Virgin Galactic commented that its launch system had an FSS in the form of its pilot, rendering the need for “demonstrated reliability” unnecessary. In addition, unlike the ELVs addressed by part 417, Virgin Galactic's launch system does not have a large effective casualty area, which raised the question of whether the risks truly justified the costs of the proposed requirement, particularly to small businesses.

Under this rule, currently licensed hybrid systems will not have to do an FSA for phases of flight that have a flight history to demonstrate reliability based on operational and flight history in lieu of a traditional risk analysis. This allowance is discussed in greater detail in the Hybrid Vehicles section of the preamble.

xi. § 450.115 Flight Safety Analysis Methods

CSF commented that prescriptive FSA requirements are inappropriate for some vehicles and operations. An applicant would have to propose an alternative method of compliance or submit a waiver request, resulting in an increase in the amount of work. The lack of tool-availability might also cause some applicants to incur costs of performing these analyses themselves. CSF noted these costs had not been included in the cost analysis. The FAA agrees that prescriptive requirements are not appropriate and revises the requirements to be more performance-based.

x. Independent Analyses

CSF stated that the NPRM's Flight Safety Analysis sections (proposed §§ 450.119 and 450.135) include multiple references to an applicant submitting any additional products that allow an independent analysis as requested by the Administrator. CSF stated that this behavior of recreating an applicant's analysis was already an expensive and burdensome aspect of the current rules that should be ended. A couple of commenters provided estimates of additional hours of work that might be required to conduct independent analyses.

As mentioned previously, the goal is for the FAA to evaluate, in an efficient and thorough manner, the validity of the analysis. The FAA finds that conducting an independent analysis is typically the most efficient and thorough means to verify compliance with the FSA requirements for novel launch or reentry operations or operators that propose to use substantially new FSA methods. Furthermore, the FAA plans to provide benchmarks for comparison purposes that operators can reference to as part of the validation and verification of their analysis methods.

Therefore, the FAA does not anticipate this rule will impose an additional cost burden for independent analyses because conducting independent analyses is current practice.

xi. § 450.135 Debris Risk Analysis

An individual commenter indicated that the proposed rule would add significant work in additional debris risk analysis beyond what the operator was doing to comply with the current regulations. The commenter specified that the proposed rule would add requirements on explosive debris, toxic release effects from the debris, accounting for sheltering of individual from buildings and vehicles, a casualty mode that included ricochet fragments, and impacts to critical assets. It would also add reporting requirements for the top ten impacted population centers and the need to perform conditional probability calculations in the FSA.

The FAA notes that an explosive debris or toxic release effects analysis will not be required if the vehicle does not have explosive debris and toxics. Explosive debris or toxic release effects analysis are currently required for ELVs under § 417.107(b)(1) and for RLVs under § 431.35(b)(1)(ii), so the requirement for those analyses under part 450 would not impose additional costs. The final rule requirements allow operators to determine how to conduct their debris risk analysis. For example, an operator will not need to update the debris risk analysis to account for sheltering or ricochet if it uses a conservative estimate of the casualty area for people in the open pursuant to § 450.101(g). Under the final rule, the FAA or Federal launch or reentry site will do any critical asset risk assessment. The cost of the CE_Cassessment is addressed in the High Consequence Event Protection preamble section. Reporting the top ten population centers is a minimal amount of additional paperwork.

xii. § 450.143 Safety-Critical System Design, Test, and Documentation

An individual commenter expressed concern that the proposed rule would constrain the design by prescribing fault tolerance where an operational mitigation solution might exist, and stated that this would result in a large burden.

The FAA finds that industry interpreted this regulation to be burdensome due to a misunderstanding of the breadth of possible means of compliance to the “fault-tolerant” requirement in § 450.143(b). In the NPRM, the FAA noted that while redundancy was a currently prescribed requirement for some safety-critical components, the intent of this requirement was to accept other methods, including fail safety and damage tolerance for systems like primary structures that could not be redundant. This flexibility permits operational restrictions, testing, and inspection to factor into the design to demonstrate that a system is fault-tolerant. The FAA resolves these concerns by revising § 450.143(b) to allow for other means of compliance.

xiii. § 450.145 Flight Safety System

Several commenters took issue with the FAA's assessment of cost savings associated with the new approach to FSS implementation. CSF disagreed there would be cost savings and expressed that the majority of operators would be required to implement an FSS of the highest reliability. CSF concluded that the result would be significant increases in cost and oversight burdens to every operator not already operating at a U.S. Federal site that has not yet implemented a RCC 319-4-compliant FSS. Rocket Lab stated that preliminary calculations suggested that the majority of orbital launch vehicle operators would be directed toward a flight abort system of the highest prescribed reliability. Blue Origin stated that most, if not all, operators (whether smaller suborbital launch vehicles operating in remote locations, or larger orbital launch vehicles operating at Federal sites) would be forced down a path of implementing an FSS that must comply with an unmodified set of prescriptive USAF requirements. Spaceport Strategies criticized the FAA's analysis of cost savings from launches not requiring an FSS as being speculative and not providing information on whether the vehicles would fly from existing or newly licensed or private launch sites. It expressed that the uncertainties made the projected savings an overstatement.

The FAA disagrees that most, if not all, operators will be required to implement an FSS of the highest reliability. For some launches, no FSS may be required; for others, an FSS will be required, but not of the highest reliability. The FAA sponsored an analysis performed by ACTA ^[194] using a CE_C model to evaluate selected ^[195] prospective launches and determine those which would not need a FSS to be in compliance with part 450. The FAA then determined which of these launches identified as not needing an FSS under part 450 would be required to employ an FSS under part 431 or current practice. Based on cost input received from industry on FSS costs, the FAA then estimated cost savings due to the fact that some launches would not need an FSS under part 450, as determined by the ACTA analysis. The cost savings calculations are in the Regulatory Impact Analysis.

xiv. § 450.161 Control of Hazard Areas

CSF stated that, in cases in which the hazard area locations were in extremely remote locations or significant distances away from the launch and reentry site, it was unreasonable for cost and logistics reasons to expect that a commercial company could provide such surveillance. The FAA notes that § 450.161 only requires surveillance to the extent necessary to ensure compliance with § 450.101. Hence, surveillance will be unnecessary in extremely remote locations.

xv. § 450.167 Tracking

Sierra Nevada expressed that, as written, the proposed rule seemed to imply that tracking would be required for every possible piece of debris in off-nominal scenarios. Sierra Nevada noted this would be burdensome, cost prohibitive, and increase the risk to the public. As clarified by the FAA in “Answers to Clarifying Questions Received by June 28, 2019” and “Answers to Clarifying Questions Received by July 29, 2019,” the term “all stages and components” does not imply that all debris must be tracked to the ground after a vehicle breakup. In the final rule, the FAA replaces the requirement to “determine the actual impact locations” with the phrase, “predict the expected impact locations,” in § 450.167. Hence, the FAA finds the final rule requirements are consistent with current practice and thus incur no additional costs.

xvi. § 450. 173 Mishap Plan—Reporting, Response and Investigating Requirements

Sierra Nevada recommended removing the mishap plan requirement to report debris impact points, including those outside a planned landing or impact area as proposed in § 450.173(d)(3)(iv), this requirement would be burdensome, cost prohibitive, and not reasonable. Sierra Nevada stated that this burden would follow because hazard areas are generated as probability contours and not contours of total containment. The commenter further stated it was realistic that, in the event of a breakup scenario, debris would exist outside the hazard area but not at a high enough probability to warrant segregation.

The FAA notes that the requirement to report hazardous debris impact points is consistent with the current 5-day reporting requirements for ELVs. It is not the FAA's intent to require tracking and surveillance for every possible piece of debris in off-nominal scenarios. However, based on the vehicle's last-known state vector, an operator should be able to calculate approximate hazardous debris impact points, including those points outside a planned landing site or designated hazard area. The FAA will consider an event that results in hazardous debris impact points outside a planned landing site or designated hazard area as a mishap. Considering the potential increased risk to public safety resulting from hazardous debris impacts outside planned landing site or designated hazard area, the FAA finds that this requirement is reasonable and necessary.

In addition to requiring submission of a 5 day report in all mishap cases, there might be some additional cost associated with submitting debris impact location data, which is not currently required under part 431. Part 417 requires submission of this data only for debris that lands outside the impact limit lines.

The FAA does not agree that this requirement will be costly or unreasonable for the following reasons. First, the requirement has been changed to require that only hazardous debris be reported. Second, operators currently must employ vehicle tracking for normal flight. In the event of a vehicle breakup, operators should be able to approximate any hazardous debris impacts in relation to the designated landing site or hazard area, based on the vehicle's last known state vector or other tracking resources required for normal flight. In other words, this requirement will involve only minimal costs because an operator can leverage vehicle tracking data it already collects in order to submit the debris impact location data. In addition, the FAA believes the operator will benefit from reporting this debris.^[196]

xvii. § 450.185 Ground Hazard Analysis

Virgin Galactic commented that the ground hazard analysis requirements proposed in the NPRM would represent new requirements and a new cost burden, creating new work outside of its existing license. Virgin Galactic requested that the FAA determine whether a ground hazard analysis would be necessary for hybrid operators, in accordance with the Congressional direction that the FAA regulate only to the extent necessary.

The FAA included estimated costs for ground hazard analyses in the NPRM. For the final rule, the FAA estimates that 75 percent of operators will spend no more than 80 hours on the ground hazard and 25 percent of the operators will spend no more than 160 hours (non-recurring one time per license).

IV. Regulatory Notices and Analyses

A. Regulatory Evaluation

Changes to Federal regulations must undergo several economic analyses. First, Executive Order 12866 and Executive Order 13563 direct that each Federal agency shall propose or adopt a regulation only upon a reasoned determination that the benefits of the intended regulation justify its costs. In addition, DOT rulemaking procedures in Subpart B of 49 CFR part 5 instruct DOT agencies to issue a regulation upon a reasoned determination that benefits exceed costs. Second, the Regulatory Flexibility Act of 1980 (Pub. L. 96-354) requires agencies to analyze the economic impact of regulatory changes on small entities. Third, the Trade Agreements Act (Pub. L. 96-39 as amended) prohibits agencies from setting standards that create unnecessary obstacles to the foreign commerce of the United States. In developing U.S. standards, the Trade Agreements Act requires agencies to consider international standards and, where appropriate, that they be the basis of U.S. standards. Fourth, the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4) requires agencies to prepare a written assessment of the costs, benefits, and other effects of proposed or final rules that include a Federal mandate likely to result in the expenditure by State, local, or tribal governments, in the aggregate, or by the private sector, of $100 million or more annually (adjusted for inflation with base year of 1995). The FAA has provided a more detailed Regulatory Impact Analysis of the benefits and costs of this final rule in the docket of this rulemaking. This portion of the preamble summarizes the findings of this analysis.

In conducting these analyses, FAA has determined that this rule will unleash economic benefits that will outweigh its costs. This rule is a significant regulatory action, as defined in section 3(f) of Executive Order 12866, as it raises novel policy issues. This rule is also significant under DOT's administrative procedure rule on rulemaking at 49 CFR 5.13 for the same reason. The rule will have a significant economic impact on a substantial number of small entities. It will not create unnecessary obstacles to the foreign commerce of the United States, and will not impose an unfunded mandate on State, local, or tribal governments, or on the private sector.

Changes to Regulatory Impact Analysis Since the Proposed Rule

The FAA updates its analysis for changes incorporated in the final rule and additional information and data identified during the comment period. The following is a summary of these changes (see the Regulatory Impact Analysis available in the docket for additional discussion and detail).

• Changes period of analysis from 5 to 10 years to capture the effects of a five-year compliance period and recurring impacts of the rule.
• Provides a range of net impacts from low to high based on launch forecast that includes base, low, and high scenarios. The FAA uses the base scenario as the primary estimate of the net impacts of this rule.
• Incorporates additional data to update savings estimates for changes to an FSS.
• Updates data and analysis of neighboring operations (number of personnel that evacuate) that decreased savings.
• Updates wage data and adds/clarifies small costs.

Statement of Need

In 2018, DOT was directed by the National Space Council and SPD-2 to streamline the regulations governing commercial space launch and reentry licensing. The purpose of the final rule is to streamline and simplify the licensing of launch and reentry operations by relying on performance-based regulations rather than prescriptive regulations. This action consolidates and revises multiple commercial space launch and reentry regulations addressing licensing into a single regulatory part that states safety objectives to be achieved for the launch of suborbital and orbital launch vehicles, and the reentry of reentry vehicles. This action also enables flexible time frames, removes unnecessarily burdensome ground safety regulations, redefines when launch begins to allow specified pre-flight operations prior to license approval, and allows applicants to seek a license to launch from multiple sites. This rule is necessary to reduce the need to file and process waivers, improve clarity of the regulations, and relieve unnecessary administrative and cost burdens on industry and the FAA. The intended effect of this action is to make commercial space transportation regulations more efficient and effective, while maintaining public safety.

Affected Operators and Launches

At the time of writing based on FAA license data, the FAA estimates this rule will affect 12 operators that have an active license or permit to conduct launch or reentry operations. In addition, the FAA estimates this rule will affect approximately 672 to 800 launches over the next 10 years, with a base or primary estimate of approximately 737 launches.^[197] The FAA anticipates this rule will reduce the costs of current and future launch operations by removing current prescriptive requirements that are often burdensome to comply with or require a waiver. The FAA expects these changes will lead to more efficient launch operations and have a positive effect on expanding the number of future launch and reentry operations.

Summary of Impacts

The FAA bases the analysis of this rule on a launch forecast that includes base, low, and high scenarios. Accordingly, this analysis provides a range of net impacts from low to high based on these forecast scenarios. The FAA uses the base scenario as the primary estimate of the net impacts of this rule.

For the primary estimate, over a 10-year period of analysis, the rule will result in present value net cost savings to industry of about $53.9 million at a seven percent discount rate with annualized net cost savings of about $7.7 million. At a three percent discount rate, the 10-year present value net cost savings to industry is about $68.3 million with annualized net cost savings of about $8.0 million. The rule will also result in net present value savings for the FAA of about $1.7 million at a seven percent discount rate over the same period of analysis, with annualized net cost savings of about $0.24 million. At a three percent discount rate, the net present value savings for the FAA is about $2.3 million with annualized net cost savings of about $0.27 million.

The largest quantified cost saving for industry will result from eliminating or modifying requirements for an FSS on some launches: About $52.6 million in present value savings over 10 years at a seven percent discount rate or about $66.6 million at a three percent discount rate. As previously discussed, the FAA will move from prescriptive FSS requirements to performance-based requirements. The rule will not require all launch vehicles to have an FSS. Launch vehicles that have a very low probability of multiple casualties even if vehicle control fails will not be required to have as robust an FSS. In addition, vehicles that have moderately low probability of casualty, even if vehicle control fails, will not be required to have robust FSS.^[198] These performance-based requirements will reduce costs for some vehicle operators, especially for small vehicles or those operating in remote locations.

The final rule will also generate another important area of quantified savings by providing a new definition of “neighboring operations personnel” and establishing new criteria for neighboring launch site personnel for the purposes of risk and financial responsibility. The change will allow affected operators to reduce the number of personnel that must evacuate and will enable operations that are more concurrent by accepting a small safety risk tradeoff. The FAA has monetized the value of this small increased safety risk as summarized in the following tables. The FAA estimates the present value of these small increased safety risks to be about $0.16 million discounted at seven percent or about $0.2 million discounted at three percent over ten years.

The FAA estimates some small costs to industry that will assist both industry and the FAA in the implementation of this final rule, such as providing information to the FAA that other agencies frequently request or performing one-time updates of flight safety limit analyses and ground hazard analyses that will be used to determine performance-based means of compliance that provide future savings. In addition, there may be additional costs for the modification of existing licenses to benefit from the cost saving provisions of this final rule. The FAA will also incur small costs for payload review, flight hazard analysis, ground hazard analysis, and the review of modifications to existing licenses.

The following tables present a summary of the primary, low, and high estimates of the quantified savings, costs, and the net impacts of the rule.

Summary of 10-Year Quantified Savings, Costs and Net Impacts—Base Scenario or Primary Estimate

[Presented in thousands of dollars]

Impact	Industry present value (7%)	Industry present value (3%)	FAA present value (7%)	FAA present value (3%)
Cost Savings	$54,634.8	$69,193.0	$1,864.2	$2,468.3
Costs	−733.3	−872.2	−162.7	−199.6
Net Cost Savings	53,901.5	68,320.7	1,701.5	2,268.7
Annualized Net Cost Savings	7,674.4	8,009.3	242.3	266.0
Increased Safety Risks	−158.5	−197.3
Net Cost Savings less Increased Safety Risks	53,743.0	68,123.5	1,701.5	2,268.7
Annualized Net Cost Savings less Increased Safety Risks	7,651.8	7,986.1	242.3	266.0
Notes: In this and the following tables, the sum of individual items may not equal totals due to rounding. Negative signs used to indicate costs and increased safety risks. Present value estimates provided at seven and three percent discount rates per OMB guidance.

Summary of 10-Year Quantified Savings, Costs and Net Impacts—Low Scenario

[Presented in thousands of dollars]

Impact	Industry present value (7%)	Industry present value (3%)	FAA present value (7%)	FAA present value (3%)
Cost Savings	$44,274.1	$56,404.8	$1,850.3	$2,449.5
Costs	−695.3	−828.0	−146.8	−180.6
Net Cost Savings	43,578.8	55,576.7	1,703.5	2,268.9
Annualized Net Cost Savings	6,204.6	6,515.3	242.5	266.0
Increased Safety Risks	−143.8	−179.6
Net Cost Savings less Increased Safety Risks	43,435.0	55,397.2	1,703.5	2,268.9
Annualized Net Cost Savings less Increased Safety Risks	6,184.2	6,494.2	242.5	266.0

Summary of 10-Year Quantified Savings, Costs and Net Impacts—High Scenario

[Presented in thousands of dollars]

Impact	Industry present value (7%)	Industry present value (3%)	FAA present value (7%)	FAA present value (3%)
Cost Savings	$64,993.7	$81,979.8	$1,878.4	$2,487.5
Costs	−769.6	−914.8	−179.2	−219.4
Net Cost Savings	64,224.1	81,065.0	1,699.3	2,268.1
Annualized Net Cost Savings	9,144.1	9,503.3	241.9	265.9
Increased Safety Risks	−172.5	−214.3
Net Cost Savings less Increased Safety Risks	64,051.6	80,850.7	1,699.3	2,268.1
Annualized Net Cost Savings less Increased Safety Risks	9,119.5	9,478.2	241.9	265.9

The following table summarizes quantified impacts by provision category for the primary estimate (see the Regulatory Impact Analysis in the docket for tables presenting low and high estimates of quantified impacts by provision category).

Summary of 10-Year Quantified Savings, Costs and Net Impacts by Provision Base Scenario—Primary Estimate

[Presented in thousands of dollars]

Provision category/impact	Industry present value (7%)	Industry present value (3%)	FAA present value (7%)	FAA present value (3%)
Waiver Avoidance:
—Definition of “Launch”	$23.7	$32.1	$7.5	$10.1
—Waterborne Vessel Hazard Areas	47.5	64.2	14.9	20.2
—Waiver for 48 Hour Readiness	29.7	40.1	9.3	12.6
System Safety Program—Safety Official	28.4	38.4	33.3	45.0
Duration of a Vehicle License	36.6	49.4	76.1	102.8
Readiness—Elimination of pre-launch meeting 15 days prior	860.7	1,169.5	155.9	211.8
Flight Safety System—Not required for all launches	52,618.2	66,554.4	1,453.9	1,912.7
Flight Safety Analysis no longer required for hybrids	34.4	46.7	4.4	6.0
Neighboring Operations *	873.6	1,087.4
Ground Hazard Analysis	81.9	110.7	108.8	147.0
Total Cost Savings	54,634.8	69,193.0	1,864.2	2,468.3
Payload Review and Determination	−52.5	−71.2	−54.0	−73.4
Safety criteria	−55.3	−64.1
Flight Hazard Analysis	−56.9	−68.0	−15.9	−19.0
Flight Abort—Flight Safety Limits Constraint	58.5	79.0
Flight Safety Limit Analysis	−114.0	−143.3
Far-field Overpressure Blast Effects Analysis	−2.9	−3.9
Safety-Critical System Design	−19.3	−26.1
Ground Hazard Analysis	−42.4	−57.3	−19.8	−26.8
Waivers for Neighboring Operations Personnel	−171.5	−192.9	−54.0	−60.7
Modification Costs for Existing Licenses	−160.2	−166.4	−19.0	−19.8
Total Costs	−733.3	−872.2	−162.7	−199.6
Net Cost Savings	53,901.5	68,320.7	1,701.5	2,268.7
Annualized Net Cost Savings	7,674.4	8,009.3	242.3	266.0
Increased Safety Risks: Neighboring Operations *	−158.5	−197.3
Net Cost Savings less Increased Safety Risks	53,743.0	68,123.5	1,701.5	2,268.7
Annualized Net Cost Savings less Increased Safety Risks	7,651.8	7,986.1	242.3	266.0
Table notes: The sum of individual items may not equal totals due to rounding. Negative signs used to indicate costs and increased safety risks in this table. Present value estimates are provided at seven and three percent discount rates per OMB guidance.
* Changes to Neighboring Operations requirements result in net savings are less increased safety risks.

The FAA also expects industry will gain additional unquantified savings and benefits from the final rule, because the rule provides flexibility and scalability through performance-based requirements that will reduce the future cost of innovation and improve the efficiency and productivity of U.S. commercial space transportation.

The following table summarizes some of the changes that will result in unquantified savings.

Unquantified Savings

Change	Savings
Time Frames	The rule revises time frames in parts 404, 413, 414, 415, 417, 420, 431, 437, and 440 that may be burdensome for some operators. This will increase flexibility by allowing an operator the option to propose alternative time frames that better suit its operations. Eligible time frames include preflight and post-flight reporting among others listed in Appendix A to Part 404—Alternative Time Frames.
Safety Element Approval	The rule removes the requirement in part 414 to publish in the Federal Register the criteria upon which safety element approvals were based. The purpose of this notification requirement was to make clear the criteria and standards the FAA used to assess a safety element, particularly when no clear regulatory requirement existed and there could be other potential users of the safety approval. However, the FAA finds that this requirement is unnecessary, and has potentially discouraged applications for safety element approvals due to concerns that proprietary data may be disclosed. The FAA anticipates that removing this requirement will lead to increased use of safety element approvals, reducing industry burden, and potentially improving safety.
Mishaps	The rule provides the following mishap-related enhancements, which will better tailor mishap responses.
	• Replaces current part 400 mishap related definitions with a consolidated mishap definition (streamlines and reduces confusion).
	• Consolidates existing part 400 mishap/accident investigation and emergency response plan requirements into a single part (streamlines and reduces confusion).
	• Exempts pre-coordinated test-induced property damage from being a mishap (removes need to consider test-induced property damages from mishap requirements and likely results in fewer investigations of minor mishaps).
	• Eliminates the small $25,000 monetary threshold from the current mishap and accident investigation requirements potentially reducing the number of mishaps investigated that do not pose a threat to public safety. Minor damage that does not pose a threat to public safety can easily exceed the $25,000 monetary threshold, triggering potentially costly and burdensome notification, reporting, and investigation requirements.
	• Clarifies that a mishap is triggered by hazardous debris falling outside a planned landing site or designated hazard area. As a result, non-hazardous debris, no matter where it falls, will not be considered a mishap potentially avoiding unnecessary notification, reporting, and investigation requirements.
Toxics	The rule replaces part 417 toxic release hazard analysis requirements with performance-based regulations that will provide flexibility for operators to comply with the required risk criteria in varied and innovative ways for their ground operations.
Lightning protection requirement	The rule removes Appendix G to part 417, Natural and Triggered Lightning Flight Commit Criteria, and replaces it with the performance-based requirements. The current requirements are outdated, inflexible, overly conservative, and not explicitly applicable to RLVs and reentry vehicles.

The FAA analyzed the impacts of this rule based on the best available data at the time of writing. The FAA acknowledges that there are uncertainties with the savings and costs of this rule given the variety of operators, locations of operations, and the scale and complexity of operations. In addition, there is uncertainty regarding how operators holding an active license, or who have an accepted license application, will choose to operate during the five-year compliance period after the effective date of the rule (i.e., choose to operate under part 450 or operate under the legacy parts 415 and 417 for expendable launch vehicles, part 431 for reusable launch vehicles, and part 435 for reentry vehicles). Lastly, there is uncertainty in the range and scope of future means of compliance, since this rule replaces many prescriptive regulations with performance-based rules, giving industry greater flexibility to develop means of compliance that meet their unique business objectives while maintaining public safety. All of these factors may result in variation of savings and costs for individual operators during and after the five-year compliance period. As previously discussed, the FAA will continue to work with industry to identify alternative means of compliance to provide future savings and efficiencies from this rule as industry continues to evolve.

B. Regulatory Flexibility Act

The Regulatory Flexibility Act of 1980 (Pub. L. 96-354) (RFA) establishes “as a principle of regulatory issuance that agencies shall endeavor, consistent with the objectives of the rule and of applicable statutes, to fit regulatory and informational requirements to the scale of the businesses, organizations, and governmental jurisdictions subject to regulation. To achieve this principle, agencies are required to solicit and consider flexible regulatory proposals and to explain the rationale for their actions to assure that such proposals are given serious consideration.” The RFA covers a wide-range of small entities, including small businesses, not-for-profit organizations, and small governmental jurisdictions.

Agencies must perform a review to determine whether a proposed or final rule would have a significant economic impact on a substantial number of small entities. If the determination is that it would, the agency must prepare a regulatory flexibility analysis as described in the RFA.

The FAA estimates this final rule will have a significant economic impact on a substantial number of small entities and therefore has performed the following Final Regulatory Flexibility Analysis in accordance with section 604(a)(1)-(a)(6).

(1) A statement of the need for, and objectives of, the rule.

The Department of Transportation was directed by the National Space Council in February 2018, and SPD-2 to streamline the regulations governing commercial space launch and reentry licensing. The goal of the streamlining rule is to create a single licensing regime for expendable and reusable launch vehicles and reentry vehicles.

The purpose of the final rule is to streamline and simplify the licensing of launch and reentry operations by relying on performance-based regulations rather than prescriptive regulations. This action consolidates and revises multiple commercial space launch and reentry regulations addressing licensing into a single regulatory part that states safety objectives to be achieved for the launch of suborbital and orbital expendable and reusable launch vehicles, and the reentry of reentry vehicles. This action also enables flexible time frames, removes unnecessarily burdensome ground safety regulations, redefines when launch begins to allow specified pre-flight operations prior to license approval, and allows applicants to seek a license to launch from multiple sites. This rule is necessary to reduce the need to file and process waivers, improve clarity of the regulations, and relieve administrative and cost burdens on industry and the FAA. The intended effect of this action is to make commercial space transportation regulations more efficient and effective, while maintaining public safety.

(2) A statement of the significant issues raised by the public comments in response to the initial regulatory flexibility analysis, a statement of the assessment of the agency of such issues, and a statement of any changes made in the proposed rule as a result of such comments.

Commenters indicated that the FAA only identified two small entities that will be affected by the rule and left out numerous small entities that will be affected. The FAA has reevaluated and identified at least five small entities that will be affected by the rule and indicates this fact in the description of small entities section in this Final Regulatory Flexibility Analysis.

An individual commenter also noted that beyond the small entities not addressed in the analysis as noted above, the FAA's proposal would also impact small companies that are subcontractors, suppliers, or service providers to licensed launch or reentry operators, both in regard to a particular event and in the activities of neighboring operations not involved in a particular licensed or permitted event.

The FAA finds these subcontractors, suppliers, or service providers to licensed launch and reentry operators are not directly impacted by the rule. The RFA requires an agency to perform a regulatory flexibility analysis of small entity impacts only when a rule directly regulates small entities. A commenter indicated that small State or local governmental jurisdictions might be affected by the rule and these were not mentioned by the FAA in the RFA. The commenter appeared to be referring to potential costs from environmental review practices and policies now being codified into rules. The FAA addresses concerns related to potential costs from this codification in the comment section of this preamble and finds that the potential costs are negligible.

An individual commenter claimed several proposed new flight safety requirements would impose complex and costly risk analyses on small entities, including the “consequence protection” requirement, the “critical assets” risk assessment requirement, and flight software requirements. Also, the commenter pointed out the duplicative or conflicting rules among overlapping Federal jurisdictions as creating a barrier for small startups.

The FAA finds the costs of these critical asset and consequence protection requirements will be small or nonexistent. Operators in remote locations will likely be able to avoid the higher costs of a highly reliable FSS by demonstrating through a CE_C analysis that the launch in question will not exceed a certain risk threshold. The initial CE_C analysis under § 450.101 that is estimated to cost $2,500 may relieve some operators from the expense of any FSS. If a determination is made that an FSS is necessary, further analysis under § 450.108 will be performed to determine the flight safety limits needed for the FSS. The FAA estimated the cost of the additional analysis to account for CE_C in the flight safety limit is $10,000. Of course, an operator could avoid these analysis costs simply by choosing to use a highly reliable FSS, but the FAA assumes that an operator would not perform these analyses if it expected that it would still need the most highly reliable FSS. The worst case would be that the operator would incur $12,500 in costs but still need an FSS, just not a highly reliable FSS. The final rule also allows an applicant to propose an alternative to CE_C that would measure or mitigate the potential for a high consequence event by use of other safeguards.

The identification of critical assets and the analysis to determine how to protect the critical assets will be performed by the ranges for launches from Federal sites and by the FAA for launches from non-Federal sites. Therefore, small entities will not bear these costs.

(3) The response of the agency to any comments filed by the Chief Counsel for Advocacy of the Small Business Administration in response to the proposed rule, and a detailed statement of any change made to the proposed rule in the final rule as a result of the comments.

The Chief Counsel for Advocacy of the Small Business Administration did not file comments in response to the proposed rule.

(4) A description of and an estimate of the number of small entities to which the rule will apply or an explanation of why no such estimate is available.

The FAA identifies at least five licensees that would qualify as small businesses. The rule will have a large effect in terms of cost savings on some of these small businesses. In addition to the five operators, there are two licensees that will be affected by the rule that may fall under the small business threshold in terms of number of employees, but they are subsidiaries of large parent companies and therefore are not considered small businesses.

(5) A description of the projected reporting, recordkeeping, and other compliance requirements of the rule, including an estimate of the classes of small entities that will be subject to the requirement and the type of professional skills necessary for preparation of the report or record.

The rule will result in a reduction in reporting requirements because there will be fewer requests for waivers to certain provisions, fewer requests to modify licenses when a safety officer changes, and fewer licenses having to be issued because there will be extension of RLV licenses up to five years. The documentation accompanying a ground hazard analysis for ELV operators will be reduced due to change in launch scope.

Some new requirements will result in additional reporting. This reporting includes the following:

(1) Paperwork associated with payload review and determination, and safety criteria analyses;

(2) Paperwork resulting from the flight safety limits analysis and the far-field overpressure blast effects analysis;

(3) Paperwork submitted by legacy license who would like to waive the higher conditional expected casualty level for neighboring operations under the current regulations, or the new ground safety requirements for RLV operators; and

(4) Paperwork costs for those operators who modify their licenses in the first five years to comply with the new regulations.

The paperwork costs are discussed in more detail in the Paperwork Reduction Analysis section of this preamble.

(6) A description of the steps the agency has taken to minimize the significant economic impact on small entities consistent with the stated objectives of applicable statutes, including a statement of the factual, policy, and legal reasons for selecting the alternative adopted in the final rule and why each one of the other significant alternatives to the rule considered by the agency which affect the impact on small entities was rejected.

a. Factual, Policy, and Legal Reasons for Selecting the Adopted Alternative

The Commercial Space Launch Act of 1984, as amended and re-codified at 51 U.S.C. 50901-50923 (the Act), authorizes the Department of Transportation, and the FAA through delegation, to oversee, license, and regulate commercial launch and reentry activities, and the operation of launch and reentry sites as carried out by U.S. citizens or within the United States. Section 50905 directs the FAA to exercise this responsibility consistent with public health and safety, safety of property, and the national security and foreign policy interests of the United States. The FAA is authorized to regulate only to the extent necessary to protect the public health and safety, safety of property, and national security and foreign policy interests of the United States. In addition, section 50903 requires that the FAA encourage, facilitate, and promote commercial space launches and reentries by the private sector.

This rulemaking streamlines and increases flexibility in the FAA's commercial space regulations. This action consolidates and revises multiple regulatory parts to apply a single set of licensing and safety regulations across several types of operations and vehicles. It also replaces many prescriptive regulations with performance-based rules, giving industry greater flexibility to develop means of compliance that maximize their business objectives while maintaining an equivalent level of safety to the agency's current regulations. Because this rulemaking amends the FAA's launch and reentry requirements, it falls under the authority delegated by the Act.

b. Alternatives Considered

The FAA considered three alternatives to the proposed rule. The FAA restates these alternatives below. The FAA did not receive comment convincing it that any of these alternatives would be better than the rule it proposed and is now finalizing.

i. No Change to Current Regulations

This alternative was not chosen because the current regulations are outdated, prescriptive, and do not adequately reflect industry current practices or technology development. The inefficiency of the licensing process due to current regulations risks stifling innovation and growth of the industry, especially for small operators.

ii. Propose a More Process-Based Regulatory Approach

With this alternative, the FAA would have proposed less detailed regulations that would have relied primarily on the outcome of an operator's system safety process to protect public safety. The FAA did not chose this alternative because it would have lacked regulatory clarity and hazard control flexibility. System safety process is one method to derive hazard controls; however, there are other hazard control strategies that are more appropriate for some operations. Specifically, physical containment, wind weighting, and, most importantly, flight abort are often sufficient. Part 450 incorporates the flexibility of part 431, but acknowledges the acceptability of other hazard control strategies. Part 450 also builds on the precedent set by part 431's limits on the foreseeable consequences of a failure in terms of conditional expected casualties and establishes a less stringent threshold.With this final rule, the FAA declines to adopt this alternative.

iii. Propose a Defined Modular Application Process

With this alternative, the FAA would have proposed similar safety requirements but would have added a more defined incremental or modular application process. The final rule enables an incremental application process, but does not define one with explicit modules and time frames. This alternative was not chosen because the FAA has no experience with an incremental or modular application process with which to base a rule. In addition, a more defined incremental or modular application process may be less flexible and scalable and therefore more burdensome to small operators.

The FAA expects this final rule will provide regulatory relief to small entities from current prescriptive requirements and result in net savings. Accordingly, the FAA declines to adopt this alternative.

c. Cost Savings to Small Entities

The following sections identifies key provisions of the rule that minimize impacts to and expand flexibilities for small entities.

i. Readiness—Elimination of Pre-Launch Meeting 15 Days Prior (§ 450.155)

ELV operators might save $4,683 per avoided launch readiness meeting; however, this assumes the average number of people at each meeting would be 25 and this might not apply to a small business.

ii. Flight Safety System—Not Required for All Launches (§ 450.145)

For launches for which an FSS would not be required under the proposal, ELV operators might save $100,000 to $680,000 per launch and RLV operators might save $20,000 per launch vehicle.

ELV operators might save between $479,000 and $1.4 million in non-recurring costs and RLV operators might save approximately $375,000 for new FSS designs by not having to incur all the research, design, testing, materials, and installation costs for an FSS. This is likely to benefit small operators launching from remote sites.

iii. Ground Hazard Analysis (§ 450.185)

An ELV operator might save approximately $28,026 per application by not having to do a ground hazard analysis under this final rule.

d. Costs to Small Entities

The following sections identify provisions of the rule that might result in additional costs for small entities. However, the rule provides a compliance period of five years for holders of current licenses at the effective date of the final rule and those who have an accepted application within 90 days of the effective date of the final rule. This will provide small operators more time to comply with the final rule and will reduce costs.

i. Payload Review and Determination (§ 450.43)

The final rule could cause small operators to incur about $206 more per launch than due to additional payload review and determination costs.

ii. Flight Hazard Analysis (§ 450.107)

Operators who do not need FSS, and choose to operate without one, will have to perform a flight hazard analysis. RLV operators currently do flight hazard analyses, while ELV operators do not. To save the costs of an FSS, an ELV operator will have to use another hazard control strategy which will likely be a flight hazard analysis. In the regulatory impact analysis, two small businesses have to perform a flight hazard analysis. However, the cost savings of not having to have an FSS will far exceed the costs of the flight hazard analysis.

iii. Flight Abort (§ 450.108(d)) Flight Safety Limits Constraint

Some operators will choose to do a CE_C analysis voluntarily as part of the flight safety limits analysis so they can expand the area their flights can pass through. These operators would only do this additional analysis if they expected the benefit to exceed the cost. The estimated voluntary cost of $10,000 per license could be incurred by small businesses.

iv. Far-Field Overpressure Blast Effects Analysis (§ 450.137)

Additional costs are $330 per application.

v. Safety-Critical System Design (§ 450.143)

Additional documentation costs are $1,649 per application.

vi. Ground Hazard Analysis (§ 450.185)

RLV applicants might incur about $7,254 more per application due to having to perform ground hazard analyses under the final rule.

As previously discussed, the FAA provides a compliance period of five years in the final rule for holders of current licenses at the effective date of the final rule and those who have an accepted application within 90 days of the effective date of the final rule. This will give all businesses, including the small operators, more time to comply with the final rule. This will reduce the burden on small entities.

C. International Trade Impact Assessment

The Trade Agreements Act of 1979 (Pub. L. 96-39), as amended by the Uruguay Round Agreements Act (Pub. L. 103-465), prohibits Federal agencies from establishing standards or engaging in related activities that create unnecessary obstacles to the foreign commerce of the United States. Pursuant to these Acts, the establishment of standards is not considered an unnecessary obstacle to the foreign commerce of the United States, if the standard has a legitimate domestic objective, such as the protection of safety, and does not operate in a manner that excludes imports that meet this objective. The statute also requires consideration of international standards and, where appropriate, that they serve as the basis for U.S. standards. The FAA has assessed the potential effect of this final rule and determined that it will not create unnecessary obstacles to the foreign commerce of the United States.

D. Unfunded Mandates Assessment

Title II of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4) requires each Federal agency to prepare a written statement assessing the effects of any Federal mandate in a proposed or final agency rule that may result in an expenditure of $100 million or more (in 1995 dollars) in any one year by State, local, and tribal governments, in the aggregate, or by the private sector; such a mandate is deemed to be a “significant regulatory action.” The threshold after adjustment for inflation is $150 million using the most current annual (2017) Implicit Price Deflator for Gross Domestic Product from the U.S. Bureau of Economic Analysis. This final rule does not contain such a mandate; therefore, the requirements of Title II of the Act do not apply.

E. Paperwork Reduction Act

The Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)) requires that the FAA consider the impact of paperwork and other information collection burdens imposed on the public. According to the 1995 amendments to the Paperwork Reduction Act (5 CFR 1320.8(b)(2)(vi)), an agency may not collect or sponsor the collection of information, nor may it impose an information collection requirement, unless it displays a currently valid Office of Management and Budget (OMB) control number.

This action contains the following proposed consolidation of two existing information collection requirements, previously approved under OMB Control Numbers 2120-0608 and 2120-0643, under a new OMB control number. As required by the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)), the FAA will submit the proposed information collection requirements to OMB for its review. In addition, the FAA has published a separate notice of the proposed requirements for public comment, and has included the notice in the docket for this rulemaking. The notice includes instructions on how to submit comments specifically to the proposed information collection requirements. Additional details on assumptions and calculations used in this section are presented in the Preliminary Regulatory Impact Analysis available in the docket of this rulemaking. The following estimates are included in the total savings and costs summarized in the Regulatory Evaluation section and considered in the Regulatory Flexibility Determination section of this proposed rule.

Because the FAA is allowing a five year compliance period for existing operators holding a license under parts 417, 431, or 435, OMB Control Numbers 2120-0608 and 2120-0643 will continue to be renewed for five years. After five years, all operators are expected to comply with part 450 and the new OMB number for collections.

Summary: The FAA proposes to consolidate under a new part 450, the requirements currently contained in parts 415 and 417 for the launch of an ELV, in part 431 for the launch and reentry of an RLV, and in part 435 for the reentry of a reentry vehicle other than an RLV. The result of this effort will be streamlined regulations designed to be more flexible and scalable, with reduced timelines and minimal duplicative jurisdiction. The net result will be reduced paperwork for operators, although for some provisions paperwork would increase.

Use: The information would be used by FAA to evaluate the launch and reentry operators' applications and to ensure safety.

Paperwork Impact to Industry

Respondents: The information collection will potentially affect 12 operators based on available data at the time of writing.

Annual Burden Estimate: Most changes in part 450 will result in a reduction in paperwork burden. The paperwork associated with industry requesting waivers to certain provisions will be alleviated. Paperwork associated with industry requesting license modifications would also be reduced because an operator will not have to modify a license if the specific safety official were to change. In addition, with the extension of RLV licenses to up to five years, it is likely that fewer licenses will be issued, resulting in less paperwork. Due to the change in launch scope, the documentation accompanying a ground hazard analysis for ELV operators would be reduced.

Industry Cost Savings

The following table indicates the frequency of responses, the estimated time per response, the burdened wage rate, annual hours, and the cost for each cost saving provision. Response frequency is provided for the estimated number of waivers avoided (§ 450.3), estimated reduction in annual number of licenses modified (§ 450.103), estimated reduction in annual license renewals, and estimated annual number of launches for which there would be a reduction in ground hazard analysis paperwork (§ 450.185). An estimated time for each response is also indicated below, as are burdened hourly wage rates for the specific personnel associated with each provision and annual hours and total cost savings.

Industry Paperwork Cost Savings

Description	Response frequency	Estimated time per response (hours)	Industry wage rate	Annual hours	Cost savings
Waiver Avoidance (§ 450.3)	17	20	$101.52	340	$34,518
System Safety Program—Safety Official (§ 450.103)	5.6	24	72.40	134.4	9,731
Duration of a Vehicle License (§ 450.7)	1.2	126.5	82.43	151.8	12,513
Ground Hazard Analysis (§ 450.185)	1	340	82.43	340	28,026
Total Annual Savings	24.8			966	84,788

Cost savings includes paperwork related to waivers avoided due to the definition of “launch,” waterborne vessel protection, and removal of the 48-hour readiness requirement.

Industry Paperwork Burden

Other changes will result in an increase in paperwork burden. The Payload Review and Determination section (§ 450.43) adds requirements for applicants to provide explosive potential of payload materials, alone and in combination with other materials on the payload for launches, as well as the appropriate transit time to final orbit for payloads with significant transit time after release from the vehicle. The FAA is adding requirements for ground hazard analysis (§ 450.185) for RLV launches. The provisions that will lead to additional paperwork burdens are listed in the table below. The final rule requires RLVs to submit information to the FAA.

The table below indicates the frequency of responses, estimated time per response, burdened hourly wage rate, annual hours, and the cost for each provision that would add burden. An estimated time per response is also indicated below, as are burdened hourly wage rates for the specific personnel associated with each provision and annual hours and total cost savings.

Industry Paperwork Burden

Description	Response frequency	Estimated time per response (hours)	Industry wage rate	Annual hours	Cost
Explosive Potential (§ 450.43)	82	2	$82.43	164	$13,519
Transit time (§ 450.43)	82	0.5	82.43	41.0	3,380
Ground Hazard Analysis (§ 450.185)	2	88	82.43	176	14,508
Safety criteria (§ 450.101(c))	4	60.66	82.43	80.88	6,667
Flight Hazard Analysis (§ 450.107)	2	53	82.43	106.67	8,793
Flight Abort (§ 450.108(d)) Flight Safety Limits Constraint	2	121	82.43	242.63	20,000
Flight Safety Limit Analysis (§ 450.123)	12	58	82.43	692	57,042
Far-field Overpressure Blast Effects Analysis (§ 450.137)	3	4	82.43	12	989
Safety-Critical System Design	4	20	82.43	80	6,594
Waivers for Neighboring Operations Personnel	18.9	20	101.52	378	38,375
Modification Costs for Existing Licenses	3	693	82.43	693	57,124
Records set up, record, archive	82	4	89.72	328	29,429
Records retrieve and present	1	8	74.15	8	593
Total Cost Burden	298			3,002	257,012

The following table summarizes the industry total annual paperwork savings, total annual paperwork burden and the net annual paperwork savings.

Industry Net Paperwork Savings

Description	Annual hours	Cost savings
Total Annual Savings	966	$84,787
Total Annual Burden	3,002	257,012
Net Annual Burden	2,036	172,225

Paperwork Burden to the Federal Government

The following tables summarizes FAA paperwork savings and burden. Similar to industry burden savings, the FAA receives burden relief from waivers avoided due to the definition of “launch,” waterborne vessel protection, and removal of the 48-hour readiness requirement. Other provisions the FAA receives relief from and provisions that will impose additional paperwork burden to the FAA are detailed in the tables below. See the Regulatory Impact Analysis available in the docket for more details on these estimates and calculations.

Description	Estimated time per response (hours)	FAA wage rate	Annual hours	Cost savings
FAA Paperwork Cost Savings
Waiver Avoidance (§ 450.3)	7.5	$85.17	127.5	$10,859
System Safety Program—Safety Official (§ 450.103)	24	84.79	134.4	11,396
Duration of a Vehicle License (§ 450.7)	253.5	85.54	304.2	26,021
Ground Safety (§ 450.185)	439	84.79	439	37,223
Total Annual Savings			1,005	85,499
FAA Paperwork Burden
Explosive Potential (§ 450.43)	2.0	84.79	164	13,906
Transit time (§ 450.43)	0.5	84.79	41	3,476
Ground Safety (§ 450.185)	40	84.79	80	6,783
Flight Hazard Analysis (§ 450.107)	47	78.27	31	2,452
Waivers for Neighboring Operations Personnel	8	85.17	142	12,094
Modification Costs for Existing Licenses	80	84.79	80	6,783
Records retrieve and present	20	84.79	20	1,696
Total Annual Burden			558	47,191

FAA Net Paperwork Savings

Description	Annual hours	Cost savings
Total Annual Savings	1,005	$85,499
Total Annual Burden	558	47,191
Net Annual Savings	447	38,308

Individuals and organizations may send comments on the information collection requirement to the address listed in the ADDRESSES section at the beginning of this preamble by March 10, 2021. Comments also should be submitted to the Office of Management and Budget, Office of Information and Regulatory Affairs, Attention: Desk Officer for FAA, New Executive Building, Room 10202, 725 17th Street NW, Washington, DC 20053.

F. International Compatibility

In keeping with U.S. obligations under the Convention on International Civil Aviation, it is FAA policy to conform to International Civil Aviation Organization (ICAO) Standards and Recommended Practices to the maximum extent practicable. The FAA has determined that there are no ICAO Standards and Recommended Practices that correspond to these proposed regulations.

G. Environmental Analysis

FAA Order 1050.1 identifies FAA actions that are categorically excluded from preparation of an environmental assessment or environmental impact statement under the National Environmental Policy Act in the absence of extraordinary circumstances. The FAA has determined this rulemaking action qualifies for the categorical exclusion identified in FAA Order 1050.1 paragraph 5-6.6 and involves no extraordinary circumstances.

V. Executive Order Determinations

A. Executive Order 13771, Reducing Regulation and Controlling Regulatory Costs

This final rule is considered an E.O. 13771 deregulatory action. Details on the estimated cost savings of this final rule can be found in the rule's economic analysis.

B. Executive Order 13132, Federalism

The FAA has analyzed this final rule under the principles and criteria of Executive Order 13132, “Federalism.” The agency determined that this action will not have a substantial direct effect on the States, or the relationship between the Federal Government and the States, or on the distribution of power and responsibilities among the various levels of government, and, therefore, does not have federalism implications.

C. Executive Order 13211, Regulations That Significantly Affect Energy Supply, Distribution, or Use

The FAA analyzed this final rule under Executive Order 13211, “Actions Concerning Regulations that Significantly Affect Energy Supply, Distribution, or Use” (May 18, 2001). The agency has determined that it is not a “significant energy action” under the executive order and it is not likely to have a significant adverse effect on the supply, distribution, or use of energy.

D. Executive Order 13609, International Cooperation

Executive Order 13609, “Promoting International Regulatory Cooperation,” promotes international regulatory cooperation to meet shared challenges involving health, safety, labor, security, environmental, and other issues and to reduce, eliminate, or prevent unnecessary differences in regulatory requirements. The FAA has analyzed this action under the policies and agency responsibilities of Executive Order 13609, and has determined that this action will not affect international regulatory cooperation.

VI. How To Obtain Additional Information

Rulemaking Documents

An electronic copy of a rulemaking document may be obtained by using the internet—

1. Search the Federal eRulemaking Portal at http://www.regulations.gov;​;

2. Visit the FAA's Regulations and Policies web page at http://www.faa.gov/​regulations_​policies/​; or

3. Access the Government Printing Office's web page at http://www.gpo.gov/​fdsys/​.

Copies may also be obtained by sending a request (identified by notice, amendment, or docket number of this rulemaking) to the Federal Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence Avenue SW, Washington, DC 20591, or by calling [phone].

Comments Submitted to the Docket

Comments received may be viewed by going to http://www.regulations.gov and following the online instructions to search the docket number for this action. Anyone may search the electronic form of all comments received into any of the FAA's dockets by the name of the individual submitting the comment (or signing the comment, if submitted on behalf of an association, business, labor union, etc.).

Small Business Regulatory Enforcement Fairness Act

The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 1996 requires FAA to comply with small entity requests for information or advice about compliance with statutes and regulations within its jurisdiction. A small entity with questions regarding this document, may contact its local FAA official, or the person listed under the FOR FURTHER INFORMATION CONTACT heading at the beginning of the preamble. To find out more about SBREFA on the internet, visit http://www.faa.gov/​regulations_​policies/​rulemaking/​sbre_​act/​.

List of Subjects

14 CFR Part 401

• Organization and functions (Government agencies)
• Space Transportation and exploration

14 CFR Part 404

• Administrative practice and procedure
• Space transportation and exploration

14 CFR Part 413

• Confidential business information
• Space transportation and exploration

14 CFR Part 414

• Airspace
• Aviation safety
• Space transportation and exploration

14 CFR Part 415

• Aviation safety
• Environmental protection
• Space transportation and exploration

14 CFR Part 417

• Aircraft
• Aviation safety
• Reporting and recordkeeping requirements
• Space transportation and exploration

14 CFR Part 420

• Environmental protection
• Reporting and recordkeeping requirements
• Space transportation and exploration

14 CFR Part 431

• Aviation safety
• Environmental protection
• Investigations
• Reporting and recordkeeping requirements
• Space transportation and exploration

14 CFR Part 435

• Aviation safety
• Environmental protection
• Investigations
• Reporting and recordkeeping requirements
• Space transportation and exploration

14 CFR Part 437

• Aircraft
• Aviation safety
• Reporting and recording keeping requirements
• Space transportation and exploration

14 CFR Part 440

• Indemnity payments
• Insurance
• Reporting and recordkeeping requirements
• Space transportation and exploration

14 CFR Part 450

• Aircraft
• Aviation safety
• Environmental protection
• Investigations
• Reporting and recordkeeping requirements
• Space transportation and exploration

In consideration of the foregoing, the Federal Aviation Administration amends chapter III for commercial space transportation rules of title 14, Code of Federal Regulations as follows:

PART 401—ORGANIZATION AND DEFINITIONS

1. The authority citation for part 401 continues to read as follows:

Authority: 51 U.S.C. 50101-50923.

2. Amend § 401.5 by revising the introductory text to read as follows:

§ 401.5

Definitions.

For the purposes of parts 415, 417, 431, 435, 440, and 460 of this chapter, the following definitions apply:

* * * * *

§ 401.5

[Removed and Reserved]

3. Effective March 10, 2026, remove and reserve § 401.5.

4. Add § 401.7 to read as follows:

§ 401.7

Definitions.

For the purposes of this chapter unless otherwise excepted, the following definitions apply:

Act means 51 U.S.C Subtitle V, Programs Targeting Commercial Opportunities, chapter 509—Commercial Space Launch Activities, 51 U.S.C. 50901-50923.

Anomaly means any condition during licensed or permitted activity that deviates from what is standard, normal, or expected, during the verification or operation of a system, subsystem, process, facility, or support equipment.

Associate Administrator means the Associate Administrator for Commercial Space Transportation, Federal Aviation Administration, or any person designated by the Associate Administrator to exercise the authority or discharge the responsibilities of the Associate Administrator.

Casualty means serious injury or death.

Casualty area means the area surrounding each potential debris or vehicle impact point where serious injuries, or worse, can occur.

Command control system means the portion of a flight safety system that includes all components needed to send a flight abort control signal to the on-board portion of a flight safety system.

Contingency abort means a flight abort with a landing at a planned location that has been designated in advance of vehicle flight.

Countdown means the timed sequence of events that must take place to initiate flight of a launch vehicle or reentry of a reentry vehicle.

Crew means any employee or independent contractor of a licensee, transferee, or permittee, or of a contractor or subcontractor of a licensee, transferee, or permittee, who performs activities in the course of that employment or contract directly relating to the launch, reentry, or other operation of or in a launch vehicle or reentry vehicle that carries human beings. A crew consists of flight crew and any remote operator.

Critical asset means an asset that is essential to the national interests of the United States. Critical assets include property, facilities, or infrastructure necessary for national security purposes, high priority civil space purposes, or assured access to space for national priority missions.

Critical payload means a payload and essential infrastructure directly supporting such a payload that is a critical asset that:

(1) Is so costly or unique that it cannot be readily replaced; or

(2) The time frame for its replacement would adversely affect the national interests of the United States.

Crossrange means the distance measured along a line whose direction is either 90 degrees clockwise (right crossrange) or counter-clockwise (left crossrange) to the projection of a vehicle's planned nominal velocity vector azimuth onto a horizontal plane tangent to the ellipsoidal Earth model at the vehicle's sub-vehicle point. The terms right crossrange and left crossrange may also be used to indicate direction.

Deorbit means the flight of a vehicle that begins with the final command to commit to a perigee below 70 nautical miles (approximately 130 kilometers), and ends when all vehicle components come to rest on the Earth.

Disposal means the return or attempt to return, purposefully, a launch vehicle stage or component, not including a reentry vehicle, from Earth orbit to Earth, in a controlled manner.

Downrange means the distance measured along a line whose direction is parallel to the projection of a vehicle's planned nominal velocity vector azimuth into a horizontal plane tangent to the ellipsoidal Earth model at the vehicle sub-vehicle point. The term downrange may also be used to indicate direction.

Effective casualty area means the aggregate casualty area of each piece of debris created by a vehicle failure at a particular point on its trajectory. The effective casualty area for each piece of debris is a modeling construct in which the area within which 100 percent of the population are assumed to be a casualty, and outside of which 100 percent of the population are assumed not to be a casualty.

Equivalent level of safety means an approximately equal level of safety as determined by qualitative or quantitative means.

Expected casualty means the mean number of casualties predicted to occur per flight operation if the operation were repeated many times.

Expendable launch vehicle means a launch vehicle whose propulsive stages are flown only once.

Experimental permit or permit means an authorization by the FAA to a person to launch or reenter a reusable suborbital rocket.

Explosive debris means solid propellant fragments or other pieces of a vehicle or payload that result from breakup of the vehicle during flight and that explode upon impact with the Earth's surface and cause overpressure.

Federal launch or reentry site means a launch or reentry site, from which launches routinely take place, that is owned and operated by the government of the United States.

Flight abort means the process to limit or restrict the hazards to public safety, and the safety of property, presented by a launch vehicle or reentry vehicle, including any payload, while in flight by initiating and accomplishing a controlled ending to vehicle flight.

Flight abort rules means the conditions under which a flight safety system must abort the flight to ensure compliance with the safety criteria in § 450.101.

Flight crew means crew that is on board a vehicle during a launch or reentry.

Flight hazard area means any region of land, sea, or air that must be surveyed, publicized, controlled, or evacuated to ensure compliance with the safety criteria in § 450.101.

Flight safety limit means criteria to ensure that public safety and critical assets are protected from the flight of a vehicle when a flight safety system functions properly.

Flight safety system means a system used to implement flight abort. A flight safety system includes any flight safety system located on board a launch or reentry vehicle; any ground based command control system; any support system, including telemetry subsystems and tracking subsystems, necessary to support a flight abort decision; and the functions of any personnel who operate the flight safety system hardware or software.

Hazard control means a preventative measure or mitigation put in place for systems or operations to reduce the severity of a hazard or the likelihood of the hazard occurring.

Hazardous debris means any object or substance capable of causing a casualty or loss of functionality to a critical asset. Hazardous debris includes inert debris and explosive debris such as an intact vehicle, vehicle fragments, any detached vehicle component whether intact or in fragments, payload, and any planned jettison bodies.

Hazardous materials means hazardous materials as defined in 49 CFR 172.101.

Instantaneous impact point means a predicted impact point, following thrust termination of a vehicle.

Key flight safety event means a flight activity that has an increased likelihood of causing a failure compared with other portions of flight.

Launch means to place or try to place a launch vehicle or reentry vehicle and any payload or human being from Earth in a suborbital trajectory, in Earth orbit in outer space, or otherwise in outer space, including activities involved in the preparation of a launch vehicle or payload for launch, when those activities take place at a launch site in the United States.

Launch operator means a person who conducts or who will conduct the launch of a launch vehicle and any payload.

Launch or reentry system means the integrated set of subsystems, personnel, products, and processes that, when combined, carries out a launch or reentry.

Launch site means the location on Earth from which a launch takes place (as defined in a license the Secretary issues or transfers under this chapter) and necessary facilities at that location.

Launch vehicle means a vehicle built to operate in, or place a payload in, outer space or a suborbital rocket.

Launch window means an approved period of time during which the flight of a launch vehicle may be initiated.

Liftoff means any motion of the launch vehicle with intention to initiate flight.

Limits of a useful mission means the trajectory data or other parameters that bound the performance of a useful mission, including flight azimuth limits.

Mishap means any event, or series of events associated with a licensed or permitted activity resulting in any of the following:

(1) A fatality or serious injury (as defined in 49 CFR 830.2);

(2) A malfunction of a safety-critical system;

(3) A failure of the licensee's or permittee's safety organization, safety operations, safety procedures;

(4) High risk, as determined by the FAA, of causing a serious or fatal injury to any space flight participant, crew, government astronaut, or member of the public;

(5) Substantial damage, as determined by the FAA, to property not associated with licensed or permitted activity;

(6) Unplanned substantial damage, as determined by the FAA, to property associated with licensed or permitted activity;

(7) Unplanned permanent loss of a launch or reentry vehicle during licensed activity or permitted activity;

(8) The impact of hazardous debris outside the planned landing site or designated hazard area; or

(9) Failure to complete a launch or reentry as planned as reported in § 450.213(b).

Neighboring operations personnel means those members of the public located within a launch or reentry site, or an adjacent launch or reentry site, who are not associated with a specific hazardous licensed or permitted operation currently being conducted, but are required to perform safety, security, or critical tasks at the site and are notified of the operation.

Nominal means, in reference to launch vehicle performance, trajectory, or stage impact point, a launch vehicle flight where all vehicle aerodynamic parameters are as expected, all vehicle internal and external systems perform exactly as planned, and there are no external perturbing influences other than atmospheric drag and gravity.

Normal flight means the flight of a properly performing vehicle whose real-time vacuum instantaneous impact point does not deviate from the nominal vacuum instantaneous impact point by more than the sum of the wind effects and the three-sigma guidance and performance deviations in the uprange, downrange, left-crossrange, or right-crossrange directions.

Normal trajectory means a trajectory that describes normal flight.

Operating environment means an environment that a launch or reentry vehicle component will experience during its lifecycle. Operating environments include shock, vibration, thermal cycle, acceleration, humidity, thermal vacuum, or other environments relevant to system or material degradation.

Operation hazard means a hazard created by an operating environment or by an unsafe act.

Operation of a launch site means the conduct of approved safety operations at a permanent site to support the launching of vehicles and payloads.

Operation of a reentry site means the conduct of safety operations at a permanent site on Earth at which a reentry vehicle and its payload, if any, is intended to land.

Operator means a holder of a license or permit under 51 U.S.C. Subtitle V, chapter 509.

Orbital insertion means the point at which a vehicle achieves a minimum 70-nautical mile perigee based on a computation that accounts for drag.

Payload means an object that a person undertakes to place in outer space by means of a launch vehicle, including components of the vehicle specifically designed or adapted for that object.

Person means an individual or an entity organized or existing under the laws of a State or country.

Physical containment means a launch vehicle does not have sufficient energy for any hazards associated with its flight to reach the public or critical assets.

Physical electronic storage means a physical device that can store electronic documents and files including but not limited to an optical disc, a memory card, a USB flash drive, or an external hard drive.

Pilot means a flight crew member who has the ability to control, in real time, a launch or reentry vehicle's flight path.

Populated area means—

(1) An outdoor location, structure, or cluster of structures that may be occupied by people;

(2) Sections of roadways and waterways that are frequented by automobile and boat traffic; or

(3) Agricultural lands, if routinely occupied by field workers.

Probability of casualty means the likelihood that a person will suffer a serious injury or worse, including a fatal injury, due to all hazards from an operation at a specific location.

Public means, for a particular licensed or permitted launch or reentry, people that are not involved in supporting the launch or reentry and includes those people who may be located within the launch or reentry site, such as visitors, individuals providing goods or services not related to launch or reentry processing or flight, and any other operator and its personnel.

Reenter; reentry means to return or attempt to return, purposefully, a reentry vehicle and its payload or human being, if any, from Earth orbit or from outer space to Earth.

Reentry operator means a person responsible for conducting the reentry of a reentry vehicle as specified in a license issued by the FAA.

Reentry site means the location on Earth where a reentry vehicle is intended to return. It includes the area within three standard deviations of the intended landing point (the predicted three-sigma footprint).

Reentry vehicle means a vehicle designed to return from Earth orbit or outer space to Earth substantially intact. A reusable launch vehicle that is designed to return from Earth orbit or outer space to Earth substantially intact is a reentry vehicle.

Reentry window means an approved period of time during which the reentry of a reentry vehicle may be initiated.

Remote operator means a crew member who—

(1) Has the ability to control, in real time, a launch or reentry vehicle's flight path; and

(2) Is not on board the controlled vehicle.

Reusable launch vehicle (RLV) means a launch vehicle that is designed to return to Earth substantially intact and therefore may be launched more than one time or that contains vehicle stages that may be recovered by a launch operator for future use in the operation of a substantially similar launch vehicle.

Risk means a measure that accounts for both the probability of occurrence of a hazardous event and the consequence of that event to persons or property.

Safety critical means essential to safe performance or operation. A safety-critical system, subsystem, component, condition, event, operation, process, or item, is one whose proper recognition, control, performance, or tolerance, is essential to ensuring public safety and the safety of property.

Service life means, for a safety-critical system component, the sum total of the component's storage life and operating life.

Sigma means a single standard deviation from a fixed value, such as a mean.

Software function means a collection of computer code that implements a requirement or performs an action. This includes firmware and operating systems.

Space flight participant means an individual, who is not crew, carried aboard a launch vehicle or reentry vehicle.

State and United States means, when used in a geographical sense, the several States, the District of Columbia, the Commonwealth of Puerto Rico, American Samoa, the United States Virgin Islands, Guam, and any other commonwealth, territory, or possession of the United States.

Suborbital rocket means a vehicle, rocket-propelled in whole or in part, intended for flight on a suborbital trajectory, and the thrust of which is greater than its lift for the majority of the rocket-powered portion of its ascent.

Suborbital trajectory means the intentional flight path of a launch vehicle, reentry vehicle, or any portion thereof, whose vacuum instantaneous impact point does not leave the surface of the Earth.

Sub-vehicle point means the location on an ellipsoidal Earth model where the normal to the ellipsoid passes through the vehicle's center of gravity.

System hazard means a hazard associated with a system and generally exists even when no operation is occurring.

Tether system means a device that contains launch vehicle hazards by physically constraining a launch vehicle in flight to a specified range from its launch point. A tether system includes all components, from the tether's point of attachment to the vehicle to a solid base, that experience load during a tethered launch.

Toxic hazard area means a region on the Earth's surface where toxic concentrations and durations may be greater than accepted toxic thresholds for acute casualty, in the event of a worst case release or maximum credible release scenario during launch or reentry.

Uncontrolled area is an area of land not controlled by a launch or reentry operator, a launch or reentry site operator, an adjacent site operator, or other entity by agreement.

Unguided suborbital launch vehicle means a suborbital rocket that does not contain active guidance or a directional control system.

United States citizen means:

(1) Any individual who is a citizen of the United States;

(2) Any corporation, partnership, joint venture, association, or other entity organized or existing under the laws of the United States or any State; and

(3) Any corporation, partnership, joint venture, association, or other entity which is organized or exists under the laws of a foreign nation, if the controlling interest in such entity is held by an individual or entity described in paragraph (1) or (2) of this definition. Controlling interest means ownership of an amount of equity in such entity sufficient to direct management of the entity or to void transactions entered into by management. Ownership of at least fifty-one percent of the equity in an entity by persons described in paragraph (1) or (2) of this definition creates a rebuttable presumption that such interest is controlling.

Uprange means the distance measured along a line that is 180 degrees to the downrange direction.

Useful mission means a mission that can attain one or more objectives.

Validation means an evaluation to determine that each safety measure derived from a system safety process is correct, complete, consistent, unambiguous, verifiable, and technically feasible. Validation ensures that the right safety measure is implemented, and that the safety measure is well understood.

Verification means an evaluation to determine that safety measures derived from a system safety process are effective and have been properly implemented. Verification provides measurable evidence that a safety measure reduces risk to acceptable levels.

Wind weighting safety system means equipment, procedures, analysis and personnel functions used to determine the launcher elevation and azimuth settings that correct for wind effects that an unguided suborbital launch vehicle will experience during flight.

Window closure means a period of time when launch or reentry is not permitted in order to avoid a collision with an object in orbit. A window closure may occur within a launch or reentry window, may delay the start of a window, or terminate a window early.

PART 404—REGULATIONS AND LICENSING REQUIREMENTS

5. The authority citation for part 404 continues to read as follows:

Authority: 51 U.S.C. 50901-50923.

6. Revise § 404.5 to read as follows:

§ 404.5

Filing a petition for waiver.

(a) A petition for waiver must be submitted at least 60 days before the proposed effective date of the waiver, unless the Administrator agrees to a different time frame in accordance with § 404.15.

(b) The petition for waiver must include:

(1) The specific section or sections of 14 CFR chapter III from which the petitioner seeks relief;

(2) The extent of the relief sought and the reason the relief is being sought;

(3) The reason why granting the request for relief is in the public interest and will not jeopardize the public health and safety, safety of property, and national security and foreign policy interests of the United States; and

(4) Any additional facts, views, and data available to the petitioner to support the waiver request.

7. Add § 404.15 to read as follows:

§ 404.15

Alternative Time Frames.

(a) General. Unless otherwise approved by the Administrator, an applicant, a licensee, a permittee, or a safety element approval holder must meet the time frames set forth in this chapter.

(b) Request to change a time frame. An applicant, a licensee, a permittee, or a safety element approval holder may file a written request to the FAA to propose an alternative time frame to any of the time frames included in the chapter III sections listed in Appendix A to part 404. The request must be—

(1) Emailed to [e-mail] in accordance with § 413.7; or

(2) Mailed to the Federal Aviation Administration, Associate Administrator for Commercial Space Transportation, Room 331, 800 Independence Avenue SW, Washington, DC 20591. Attention: Alternative Time Frame Request.

(c) Administrator review. The Administrator will review and make a decision or grant a request for an alternative time frame as follows:

(1) The FAA will conduct its review on a case-by-case basis, taking into account the complexity of the request, the timeliness of the request, and whether the requested alternative allows sufficient time for the FAA to conduct its review and make the requisite public health and safety, safety of property, and national security and foreign policy findings;

(2) The FAA will provide its decision in writing; and

(3) The FAA may grant the request, deny the request, or grant an alternative time frame that differs from what was requested.

8. Add appendix A to part 404 the read as follows:

Appendix A to Part 404—Alternative Time Frames

A404.1 General

Alternative time frames. This appendix lists the sections and corresponding paragraphs in this chapter that provide the eligible time frames for an applicant, licensee, permittee, or safety element approval holder, as applicable, to request an alternative time frame.

Table A404.1—Eligible Time Frames

Sections	Paragraphs
§ 404.5—Filing a petition for waiver	(a).
§ 413.23—License or permit renewal	(a).
§ 414.31—Safety element approval renewal	(a).
§ 420.57—Notifications	(d).
§ 437.89—Pre-flight reporting	(a), (b).
§ 440.15—Demonstration of compliance	(a)(1), (a)(2), (a)(3), (a)(4).
§ 450.169—Launch and Reentry Collision Avoidance Analysis Requirements	(f)(1).
§ 450.213—Pre-flight reporting	(b), (c), (d), (e).
§ 450.215—Post-flight reporting	(a)

PART 413—APPLICATION PROCEDURES

9. The authority citation for part 413 continues to read as follows:

Authority: 51 U.S.C. 50901-50923.

10. Revise § 413.1 to read as follows:

§ 413.1

Scope of this part.

(a) This part explains how to apply for a license or experimental permit. These procedures apply to all applications for obtaining a license or permit, transferring a license, and renewing a license or permit. In this part, the term application means either an application in its entirety, or a portion of an application for incremental review and determination in accordance with § 450.33 of this chapter.

(b) Use paragraphs (b)(1) through (7) in the following table to locate specific requirements:

Subject	Part
(1) Obtaining a Launch License (only applications accepted before June 8, 2021)	415
(2) License to Operate a Launch Site	420
(3) Launch and Reentry of a Reusable Launch Vehicle (RLV) (only applications accepted before June 8, 2021)	431
(4) License to Operate a Reentry Site	433
(5) Reentry of a Reentry Vehicle other than a Reusable Launch Vehicle (RLV) (only applications accepted before June 8, 2021)	435
(6) Experimental Permits	437
(7) Launch and Reentry License Requirements	450

11. Effective March 10, 2026, futher amend § 413.1 by revising paragraphs (b)(1) through (4) and removing paragraphs (b)(5) through (7).

The revisions read read as follows:

§ 413.1

Scope of this part.

* * * * *

(b) * * *

Subject	Part
(1) License to Operate a Launch Site	420
(2) License to Operate a Reentry Site	433
(3) Experimental Permits	437
(4) Launch and Reentry License Requirements	450

12. Amend § 413.7 by revising the section heading and paragraph (a)(3) to read as follows:

§ 413.7

Application submission.

(a) * * *

(3) For an application submitted by email, an applicant must send the application as an email attachment, or as a link to a secure server, to [e-mail]. The application and the email to which the application is attached or linked must also satisfy the following criteria:

(i) The email to which the application is attached or linked must be sent from an email address controlled by the person who signed the application or by an authorized representative of the applicant;

(ii) The email must identify each document that is included as an attachment or that is stored on a secure server; and

(iii) The electronic files must be date-stamped and have version control documentation.

* * * * *

13. Amend § 413.11 by revising paragraph (a) to read as follows:

§ 413.11

Acceptance of an application.

* * * * *

(a) The FAA accepts the application and will initiate review; or

* * * * *

14. Revise § 413.15 to read as follows:

§ 413.15

Review period.

(a) Review period duration. Unless otherwise specified in this chapter, the FAA reviews and makes a license or permit determination on an accepted application in accordance with the time frame specified in 51 U.S.C. 50905(a)(1). The FAA will establish the time frame for any incremental review and determination with an applicant on a case-by-case basis during pre-application consultation.

(b) Review period tolled. If an accepted application does not provide sufficient information to continue or complete the reviews or evaluations required by this chapter for a license, permit, or incremental determination, or an issue exists that would affect a determination, the FAA notifies the applicant, in writing, and informs the applicant of any information required to complete the application. If the FAA cannot review an accepted application because of lack of information or for any other reason, the FAA will toll the review period until the FAA receives the information it needs or the applicant resolves the issue.

(c) Notice. Except for applications under incremental review and determination in accordance with § 450.33, if the FAA does not make a decision in accordance with the time frame specified in 51 U.S.C. 50905(a)(1) for an accepted license application or 51 U.S.C. 50906(a) for an accepted permit application, the FAA informs the applicant, in writing, of any outstanding information needed to complete the review, or of any issues that would affect the decision.

15. Amend § 413.21 by revising pargraphs (b) and (c) to read as follows:

§ 413.21

Denial of a license or permit application.

* * * * *

(b) If the FAA has denied an application in its entirety, the applicant may either—

(1) Attempt to correct any deficiencies identified and ask the FAA to reconsider the revised application, in which case the FAA has 60 days or the number of days remaining in the review period, whichever is greater, within which to reconsider the decision; or

(2) Request a hearing in accordance with part 406 of this chapter, for the purpose of showing why the application should not be denied.

(c) An applicant whose application is denied after reconsideration under paragraph (b)(1) of this section may request a hearing in accordance with paragraph (b)(2) of this section.

16. Amend § 413.23 by revising paragraphs (a) and (d) to read as follows:

§ 413.23

License or permit renewal.

* * * * *

(a) Eligibility. (1) A licensee or permittee may apply to renew its license or permit by submitting to the FAA a written application for renewal at least 90 days before the license expires or at least 60 days before the permit expires, unless the Administrator agrees to a different time frame in accordance with § 404.15.

(2) A request to renew a licensed under parts 415, 431, and 435 may be granted with a non-standard duration so as not to exceed March 10, 2026.

* * * * *

(d) Renewal of license or permit. After the FAA finishes its reviews, the FAA issues an order modifying the expiration date of the license or permit. The FAA may impose additional or revised terms and conditions necessary to protect public health and safety and the safety of property and to protect U.S. national security and foreign policy interests. The renewal period for a license issued under parts 415, 431, or 435 of this chapter cannot extend beyond March 10, 2026.

* * * * *

17. Effective March 10, 2026, § 413.23 is further amended by revising paragraphs (a) and (d) to read as follows:

§ 413.23

License or permit renewal.

* * * * *

(a) Eligibility. A licensee or permittee may apply to renew its license or permit by submitting to the FAA a written application for renewal at least 90 days before the license expires or at least 60 days before the permit expires, unless the Administrator agrees to a different time frame in accordance with § 404.15.

* * * * *

(d) Renewal of license or permit. After the FAA finishes its reviews, the FAA issues an order modifying the expiration date of the license or permit. The FAA may impose additional or revised terms and conditions necessary to protect public health and safety and the safety of property and to protect U.S. national security and foreign policy interests.

* * * * *

18. Revise part 414 to read as follows:

PART 414—SAFETY ELEMENT APPROVALS

Subpart A—General

414.1

Scope

414.3

Definitions.

414.5

Applicability.

414.7

Eligibility.

Subpart B—Application Procedures

414.9

Pre-application consultation.

414.11

Application.

414.13

Application separate from a vehicle operator license application.

414.15

Application concurrent with vehicle operator license application.

414.17

Confidentiality.

414.19

Processing the initial application.

414.21

Maintaining the continued accuracy of the initial application.

Subpart C—Safety Element Approval Review and Issuance

414.23

Technical criteria for reviewing a safety element approval application.

414.25

Terms and conditions for issuing a safety element approval; duration of a safety element approval.

414.27

Maintaining the continued accuracy of the safety element approval application.

414.29

Safety element approval records.

414.31

Safety element approval renewal.

414.33

Safety element approval transfer.

414.35

Monitoring compliance with the terms and conditions of a safety element approval.

414.37

Modification, suspension, or revocation of a safety element approval.

Subpart D—Appeal Procedures

414.41

Hearings in safety element approval actions.

414.43

Submissions; oral presentations in safety element approval actions.

414.45

Administrative law judge's recommended decision in safety element approval actions.

Authority: 51 U.S.C. 50901-50923.

Subpart A—General

§ 414.1

Scope.

This part establishes procedures for obtaining a safety element approval and renewing and transferring an existing safety element approval. Safety element approvals issued under this part may be used to support the application review for one or more vehicle operator license requests under other parts of this chapter.

§ 414.3

Definitions.

Safety element. For purposes of this part, a safety element is any one of the items or persons (personnel) listed in paragraphs (1) and (2) of the definition of “safety element approval” in this section.

Safety element approval. For purposes of this part, a safety element approval is an FAA document containing the FAA determination that one or more of the safety elements listed in paragraphs (1) and (2) of this definition, when used or employed within a defined envelope, parameter, or situation, will not jeopardize public health and safety or safety of property. A safety element approval may be issued independent of a license, and does not confer any authority to conduct activities for which a license is required under 14 CFR chapter III. A safety element approval does not relieve its holder of the duty to comply with all applicable requirements of law or regulation that may apply to the holder's activities.

(1) Launch vehicle, reentry vehicle, safety system, process, service, or any identified component thereof; or

(2) Qualified and trained personnel, performing a process or function related to licensed activities or vehicles.

§ 414.5

Applicability.

This part applies to an applicant that wants to obtain a safety element approval for any of the safety elements defined under this part and to persons granted a safety element approval under this part. Any person eligible under this part may apply to become the holder of a safety element approval.

§ 414.7

Eligibility.

(a) There is no citizenship requirement to obtain a safety element approval.

(b) You may be eligible for a safety element approval if you are—

(1) A designer, manufacturer, or operator of a launch or reentry vehicle or component thereof;

(2) The designer or developer of a safety system or process; or

(3) Personnel who perform safety-critical functions in conducting a licensed launch or reentry.

(c) A safety element approval applicant must have sufficient knowledge and expertise to show that the design and operation of the safety element for which safety element approval is sought qualify for a safety element approval.

(d) Only the safety elements defined under this part are eligible for a safety element approval.

Subpart B—Application Procedures

§ 414.9

Pre-application consultation.

The applicant must consult with the FAA before submitting an application. Unless the applicant or the FAA requests another form of consultation, consultation is oral discussion with the FAA about the application process and the potential issues relevant to the FAA's safety element approval decision.

§ 414.11

Application.

An applicant may submit an application for a safety element approval in one of two ways:

(a) Separate from a vehicle operator license application in accordance with § 414.13; or

(b) Concurrent with a vehicle operator license application in accordance with § 414.15.

§ 414.13

Application separate from a vehicle operator license application.

(a) An applicant must make an application in writing and in English. The applicant must file the application with the Federal Aviation Administration either by paper, by use of physical electronic storage, or by email in the following manner:

(1) For an application submitted on paper, an applicant must send two copies of the application to the Federal Aviation Administration, Associate Administrator for Commercial Space Transportation, Room 331, 800 Independence Avenue SW, Washington, DC 20591. Attention: Application Review.

(2) For an application submitted by use of physical electronic storage, the applicant must either mail the application to the address specified in paragraph (a)(1) of this section or hand-deliver the application to an authorized FAA representative. The application and the physical electronic storage containing the application must also satisfy all of the following criteria:

(i) The application must include a cover letter that is printed on paper and signed by the person who signed the application or by an authorized representative of the applicant;

(ii) The cover letter must identify each document that is included on the physical electronic storage; and

(iii) The physical electronic storage must be in a format such that its contents cannot be altered.

(3) For an application submitted by email, an applicant must send the application as an email attachment, or as a link to a secure server, to [e-mail]. The application and the email to which the application is attached must also satisfy the following criteria:

(i) The email to which the application is attached must be sent from an email address controlled by the person who signed the application or by an authorized representative of the applicant; and

(ii) The email must identify each document that is included as an attachment or that is stored on a secure server; and

(iii) The electronic files must be date-stamped and have version control documentation.

(b) The application must identify the following basic information:

(1) Name and address of the applicant.

(2) Name, address, and telephone number of any person to whom inquiries and correspondence should be directed.

(3) Safety element as defined under this part for which the applicant seeks a safety element approval.

(c) The application must contain the following technical information:

(1) A Statement of Conformance letter, describing the specific criteria the applicant used to show the adequacy of the safety element for which a safety element approval is sought, and showing how the safety element complies with the specific criteria.

(2) The specific operating limits for which the safety element approval is sought.

(3) The following as applicable:

(i) Information and analyses required under this chapter that may be applicable to demonstrating safe performance of the safety element for which the safety element approval is sought.

(ii) Engineering design and analyses that show the adequacy of the proposed safety element for its intended use, such that the use in a licensed launch or reentry will not jeopardize public health or safety or the safety of property.

(iii) Relevant manufacturing processes.

(iv) Test and evaluation procedures.

(v) Test results.

(vi) Maintenance procedures.

(vii) Personnel qualifications and training procedures.

(d) The application must be legibly signed, dated, and certified as true, complete, and accurate by one of the following:

(1) For a corporation, an officer or other individual authorized to act for the corporation in licensing or safety element approval matters.

(2) For a partnership or a sole proprietorship, a general partner or proprietor, respectively.

(3) For a joint venture, association, or other entity, an officer or other individual duly authorized to act for the joint venture, association, or other entity in licensing matters.

(e) Failure to comply with any of the requirements set forth in this section is sufficient basis for denial of a safety element approval application.

§ 414.15

Application concurrent with vehicle operator license application.

(a) An applicant for a vehicle operator license may also identify one or more sections of its application for which it seeks to obtain a safety element approval concurrently with a license. An applicant applying for a safety element approval concurrently with a license must—

(1) Meet the applicable requirements of part 450;

(2) Provide the information required in § 414.13(b)(3) and (c)(2) and (3); and

(3) Specify the sections of the license application that support the application for a safety element approval.

(b) The scope of the safety element approval will be limited to what the application supports. The technical criteria for reviewing a safety element submitted as part of a vehicle operator license application are limited to the applicable requirements of part 450.

§ 414.17

Confidentiality.

(a) To ensure confidentiality of data or information in the application, the applicant must—

(1) Send a written request with the application that trade secrets or proprietary commercial or financial data be treated as confidential, and include in the request the specific time frame confidential treatment is required.

(2) Mark data or information that require confidentiality with an identifying legend, such as “Proprietary Information,” “Proprietary Commercial Information,” “Trade Secret,” or “Confidential Treatment Requested.” Where this marking proves impracticable, attach a cover sheet that contains the identifying legend to the data or information for which confidential treatment is sought.

(b) If the applicant requests confidential treatment for previously submitted data or information, the FAA will honor that request to the extent practicable in case of any prior distribution of the data or information.

(c) Data or information for which confidential treatment is requested or data or information that qualifies for exemption under section 552(b)(4) of title 5, U.S.C., will not be disclosed to the public unless the Associate Administrator determines that withholding the data or information is contrary to the public or national interest.

§ 414.19

Processing the initial application.

(a) The FAA will initially screen an application to determine if the application is complete enough for the FAA to start the review.

(b) After completing the initial screening, the FAA will inform the applicant in writing of one of the following:

(1) The FAA accepts the application and will begin the reviews or evaluations required for a safety element approval determination under this part.

(2) The FAA rejects the application because it is incomplete or indefinite, making initiation of the reviews or evaluations required for a safety element approval determination under this part inappropriate.

(c) The written notice will state the reason(s) for rejection and corrective actions necessary for the application to be accepted. The FAA may return a rejected application to the applicant or may hold it until the applicant provides more information.

(d) The applicant may withdraw, amend, or supplement an application any time before the FAA makes a final determination on the safety element approval application by making a written request to the Associate Administrator. If the applicant amends or supplements the initial application, the revised application must meet all the applicable requirements under this part.

§ 414.21

Maintaining the continued accuracy of the initial application.

The applicant is responsible for the continuing accuracy and completeness of information provided to the FAA as part of the safety element approval application. If at any time after submitting the application, circumstances occur that cause the information to no longer be accurate and complete in any material respect, the applicant must submit a written statement to the Associate Administrator explaining the circumstances and providing the new or corrected information. The revised application must meet all requirements under § 414.13 or § 414.15.

Subpart C—Safety Element Approval Review and Issuance

§ 414.23

Technical criteria for reviewing a safety element approval application.

The FAA will determine whether a safety element is eligible for and may be issued a safety element approval. The FAA will base its determination on performance-based criteria, against which it may assess the effect on public health and safety and on safety of property, in the following hierarchy:

(a) FAA or other appropriate Federal regulations.

(b) Government-developed or adopted standards.

(c) Industry consensus performance-based criteria or standard.

(d) Applicant-developed criteria. Applicant-developed criteria are performance standards customized by the manufacturer that intends to produce the system, system component, or part. The applicant-developed criteria must define—

(1) Design and minimum performance;

(2) Quality assurance system requirements;

(3) Production acceptance test specifications; and

(4) Continued operational safety monitoring system characteristics.

§ 414.25

Terms and conditions for issuing a safety element approval; duration of a safety element approval.

(a) The FAA will issue a safety element approval to an applicant that meets all the requirements under this part.

(b) The scope of the safety element approval will be limited by the scope of the safety demonstration contained in the application on which the FAA based the decision to grant the safety element approval.

(c) The FAA will determine specific terms and conditions of a safety element approval individually, limiting the safety element approval to the scope for which it was approved. The terms and conditions will include reporting requirements tailored to the individual safety element approval.

(d) A safety element approval is valid for five years and may be renewed.

§ 414.27

Maintaining the continued accuracy of the safety element approval application.

(a) The holder of a safety element approval must ensure the continued accuracy and completeness of representations contained in the safety element approval application, on which the approval was issued, for the entire term of the safety element approval.

(b) If any representation contained in the application that is material to public health and safety or safety of property ceases to be accurate and complete, the safety element approval holder must prepare and submit a revised application according to § 414.13 or § 414.15 under this part. The safety element approval holder must point out any part of the safety element approval or the associated application that would be changed or affected by a proposed modification. The FAA will review and make a determination on the revised application under the terms of this part.

§ 414.29

Safety element approval records.

The holder of a safety element approval must maintain all records necessary to verify that the holder's activities are consistent with the representations contained in the application for which the approval was issued for the duration of the safety element approval plus one year.

§ 414.31

Safety element approval renewal.

(a) Eligibility. A holder of a safety element approval may apply to renew it by sending the FAA a written application at least 90 days before the expiration date of the approval, unless the Administrator agrees to a different time frame in accordance with § 404.15.

(b) Application. (1) A safety element approval renewal application must meet all the requirements under § 414.13 or § 414.15.

(2) The application may incorporate by reference information provided as part of the application for the expiring safety element approval or any modification to that approval.

(3) Any proposed changes in the conduct of a safety element for which the FAA has issued a safety element approval must be described and must include any added information necessary to support the fitness of the proposed changes to meet the criteria upon which the FAA evaluated the safety element approval application.

(c) Review of application. The FAA conducts the reviews required under this part to determine whether the safety element approval may be renewed. We may incorporate by reference any findings that are part of the record for the expiring safety element approval.

(d) Grant of safety element approval renewal. If the FAA makes a favorable safety element approval determination, the FAA issues an order that amends the expiration date of the safety element approval or issues a new safety element approval. The FAA may impose added or revised terms and conditions necessary to protect public health and safety and the safety of property.

(e) Written notice. The FAA will provide written notice to the applicant of its determination on the safety element approval renewal request.

(f) Denial of a safety element approval renewal. If the FAA denies the renewal application, the applicant may correct any deficiency the FAA identified and request a reconsideration of the revised application. The applicant also has the right to appeal a denial as set forth in subpart D of this part.

§ 414.33

Safety element approval transfer.

(a) Only the FAA may approve a transfer of a safety element approval.

(b) Either the holder of a safety element approval or the prospective transferee may request a safety element approval transfer.

(c) Both the holder and prospective transferee must agree to the transfer.

(d) The person requesting the transfer must submit a safety element approval application according to § 414.13 or § 414.15, must meet the applicable requirements of this part, and may incorporate by reference relevant portions of the initial application.

(e) The FAA will approve a transfer of a safety element approval only after all the approvals and determinations required under this chapter for a safety element approval have been met. In conducting reviews and issuing approvals and determinations, the FAA may incorporate by reference any findings made part of the record to support the initial safety element approval determination. The FAA may modify the terms and conditions of a safety element approval to reflect any changes necessary because of a safety element approval transfer.

(f) The FAA will provide written notice to the person requesting the safety element approval transfer of our determination.

§ 414.35

Monitoring compliance with the terms and conditions of a safety element approval.

Each holder of a safety element approval must allow access by, and cooperate with, Federal officers or employees or other individuals authorized by the Associate Administrator to inspect manufacturing, production, testing, or assembly performed by a holder of a safety element approval or its contractor. The FAA may also inspect a safety element approval process or service, including training programs and personnel qualifications.

§ 414.37

Modification, suspension, or revocation of a safety element approval.

(a) The safety element approval holder. The safety element approval holder may submit an application to the FAA to modify the terms and conditions of the holder's safety element approval. The application must meet all the applicable requirements under this part. The FAA will review and make a determination on the application using the same procedures under this part applicable to an initial safety element approval application. If the FAA denies the request to modify a safety element approval, the holder may correct any deficiency the FAA identified and request reconsideration. The holder also has the right to appeal a denial as set forth in subpart D of this part.

(b) The FAA. If the FAA finds it is in the interest of public health and safety, safety of property, or if the safety element approval holder fails to comply with any applicable requirements of this part, any terms and conditions of the safety element approval, or any other applicable requirement, the FAA may—

(1) Modify the terms and conditions of the safety element approval; or

(2) Suspend or revoke the safety element approval.

(c) Effective date. Unless otherwise stated by the FAA, any modification, suspension, or revocation of a safety element approval under paragraph (b)—

(1) Takes effect immediately; and

(2) Continues in effect during any reconsideration or appeal of such action under this part.

(d) Notification and right to appeal. If the FAA determines it is necessary to modify, suspend, or revoke a safety element approval, we will notify the safety element approval holder in writing. If the holder disagrees with the FAA's determination, the holder may correct any deficiency the FAA identified and request a reconsideration of the determination. The applicant also has the right to appeal the determination as set forth in subpart D of this part.

Subpart D—Appeal Procedures

§ 414.41

Hearings in safety element approval actions.

(a) The FAA will give the safety element approval applicant or holder, as appropriate, written notice stating the reason for issuing a denial or for modifying, suspending, or revoking a safety element approval under this part.

(b) A safety element approval applicant or holder is entitled to a determination on the record after an opportunity for a hearing.

§ 414.43

Submissions; oral presentations in safety element approval actions.

(a) Determinations in safety element approval actions under this part will be made on the basis of written submissions unless the administrative law judge, on petition or on their own initiative, determines that an oral presentation is required.

(b) Submissions must include a detailed exposition of the evidence or arguments supporting the petition.

(c) Petitions must be filed as soon as practicable, but in no event more than 30 days after issuance of decision or finding under § 414.37.

§ 414.45

Administrative law judge's recommended decision in safety element approval actions.

(a) The Associate Administrator, who will make the final decision on the matter at issue, will review the recommended decision of the administrative law judge. The Associate Administrator will make such final decision within 30 days of issuance of the recommended decision.

(b) The authority and responsibility to review and decide rests solely with the Associate Administrator and may not be delegated.

PART 415—LAUNCH LICENSE

19. The authority citation for part 415 continues to read as follows:

Authority: 51 U.S.C. 50901-50923.

PART 415—[REMOVED AND RESERVED]

20. Effective March 10, 2026, remove and reserve part 415.

21. Revise § 415.1 to read as follows:

§ 415.1

Applicability and scope.

(a) Applicability. This part applies to the following:

(1) Licenses issued under this part before June 8, 2021; and

(2) Licenses issued on or after June 8, 2021, if the FAA accepted the application under § 413.11 of this chapter before that date.

(b) Scope. This part prescribes requirements for obtaining a license to launch an expendable launch vehicle and post-licensing requirements with which a licensee must comply to remain licensed. Requirements for preparing a license application are in part 413 of this subchapter.

22. Add § 415.2 to read as follows:

§ 415.2

Licenses issued under this part.

(a) Definitions. For the purposes of this part, the definitions of § 401.5 of this chapter apply.

(b) Compliance with part 450 of this chapter. Operations under this part must comply with launch and reentry collision avoidance requirements in § 450.169 of this chapter and critical asset protection requirements in §§ 450.101(a)(4) and (b)(4) of this chapter.

23. Amend § 415.3 by adding paragraph (c) to read as follows:

§ 415.3

Types of launch licenses.

* * * * *

(c) Notwithstanding the duration for a license established in paragraphs (a) and (b) of this section, no license issued under this part will be valid after March 10, 2026.

24. Amend § 415.35 by revising paragraph (d) to read as follows:

§ 415.35

Acceptable flight risk.

* * * * *

(d) Operation. A launch vehicle must be operated in a manner that ensures that flight risks meet the criteria of paragraph (a) of this section and in accordance with collision avoidance requirements in § 450.169 and critical asset protection requirements in § 450.101(a)(4) and (b)(4). An applicant must identify all launch operations and procedures that must be performed to ensure acceptable flight risk.

Appendix A to Part 415—[Removed and Reserved]

25. Remove and reserve appendix A to part 415.

PART 417—LAUNCH SAFETY

26. The authority citation for part 417 continues to read as follows:

Authority: 51 U.S.C. 50901-50923.

PART 417—[REMOVED AND RESERVED]

27. Effective March 10, 2026, remove and reserve part 417.

28. Revise § 417.1 to read as follows:

§ 417.1

General information.

(a) Scope. This part sets forth—

(1) The responsibilities of a launch operator conducting a licensed launch of an expendable launch vehicle pursuant to a license issued under part 415 of this chapter; and

(2) The requirements for maintaining a launch license obtained under part 415 of this chapter. Parts 413 and 415 of this chapter contain requirements for preparing a license application to conduct a launch, including information reviewed by the FAA to conduct a policy, safety, payload, and environmental review, and a payload determination

(b) Applicability. (1) The administrative requirements for filing material with the FAA in subpart A of this part apply to all licensed launches from a Federal launch range or a non-Federal launch site, except where noted.

(2) The safety requirements of subparts B through E of this part apply to all licensed launches of expendable launch vehicles. See paragraph (d) of this section for exceptions to this provision.

(c) “Meets intent” certification. For a licensed launch from a Federal launch range, a launch operator need not demonstrate to the FAA that an alternative means of satisfying a requirement of this part provides an equivalent level of safety for a launch if written evidence demonstrates that a Federal launch range has, by the effective date of this part, granted a “meets intent certification,” including through “tailoring,” that applies to the requirement and that launch. See paragraph (e) of this section for exceptions to this provision. Written evidence includes:

(1) Range flight plan approval,

(2) Missile system pre-launch safety package,

(3) Preliminary and final flight data packages,

(4) A tailored version of EWR 127-1,

(5) Range email to the FAA stating that the MIC was approved, or

(6) Operation approval.

(d) Waiver. For a licensed launch from a Federal launch range, a requirement of this part does not apply to a launch if written evidence demonstrates that a Federal launch range has, by the effective date of this part, granted a waiver that allows noncompliance with the requirement for that launch. See paragraph (e) of this section for exceptions to this provision. Written evidence includes:

(1) Range flight plan approval,

(2) Missile system pre-launch safety package,

(3) Preliminary and final flight data packages,

(4) A tailored version of EWR 127-1,

(5) Range email to the FAA stating that the waiver was approved, or

(6) Operation approval.

(e) Exceptions to Federal launch range meets intent certifications and waivers. Even if a licensed launch from a Federal launch range satisfies paragraph (c) or (d) of this section for a requirement of this part, the requirement applies and a launch operator must satisfy the requirement, obtain FAA approval of any alternative, or obtain FAA approval for any further noncompliance if—

(1) The launch operator modifies the launch vehicle's operation or safety characteristics;

(2) The launch operator uses the launch vehicle, component, system, or subsystem in a new application;

(3) The FAA or the launch operator determines that a previously unforeseen or newly discovered safety hazard exists that is a source of significant risk to public safety; or

(4) The Federal launch range previously accepted a component, system, or subsystem, but did not then identify a noncompliance to a Federal launch range requirement.

(f) Equivalent level of safety. The requirements of this part apply to a launch operator and the launch operator's launch unless the launch operator clearly and convincingly demonstrates that an alternative approach provides an equivalent level of safety.

§ 417.3

[Amended]

29. Amend § 417.3 by removing the definitions for “conjunction on launch” and “launch wait”.

30. Amend § 417.11 by adding paragraph (f) to read as follows:

§ 417.11

Continuing accuracy of license application; application for modification of license.

* * * * *

(f) The Administrator may determine that a modification to a license issued under this part must comply with the requirements in part 450 of this chapter. The Administrator will base the determination on the extent and complexity of the modification, whether the applicant proposes to modify multiple parts of the application, or if the application requires significant evaluation.

31. Amend § 417.107 by adding paragraph (b)(5), and removing and reserving paragraph (e).

The addition reads as follows:

§ 417.107

Flight safety.

* * * * *

(b) * * *

(5) A launch operator may initiate flight of a launch vehicle only if all of the risks to the public satisfy the criteria in the critical asset protection requirements in § 450.101(a)(4) and (b)(4).

* * * * *

32. Amend § 417.113 by revising paragraphs (c)(1) introductory text and (c)(1)(iii) to read as follows:

§ 417.113

Launch safety rules.

* * * * *

(c) * * *

(1) The flight-commit criteria must implement the flight safety analysis of subpart C of this part and collision avoidance requirements in § 450.169 and critical asset protection requirements in § 450.101(a)(4) and (b)(4). These must include criteria for:

* * * * *

(iii) Implementation of any launch wait in the launch window for the purpose of collision avoidance in accordance with collision avoidance requirements in § 450.169.

* * * * *

§ 417.121

[Amended]

32. Amend § 417.121 by removing and reserving paragraph (c).

§ 417.231

[Removed and Reserved.]

33. Remove and reserve § 417.231.

Appendix A to Part 417—[Amended]

34. Amend appendix A to part 417 by removing and reserving section A417.31.

35. Amend appendix C to part 417 by revising paragraph (a) in section C417.1 and removing section C417.11.

The revision reads as follows:

Appendix C to Part 417—Flight Safety Analysis Methodologies and Products for an Unguided Suborbital Launch Vehicle Flown With a Wind Weighting Safety System

* * * * *

C417.1 General

(a) This appendix contains methodologies for performing the flight safety analysis required for the launch of an unguided suborbital launch vehicle flown with a wind weighting safety system, except for the hazard area analysis required by § 417.107, which is covered in appendix B of this part. This appendix includes methodologies for a trajectory analysis, wind weighting analysis, debris analysis, and debris risk analysis.

* * * * *

PART 420—LICENSE TO OPERATE A LAUNCH SITE

36. The authority citation for part 420 continues to read as follows:

Authority: 51 U.S.C. 50901-50923.

§ 420.5

[Amended]

37. Amend § 420.5 by removing the definitions of “Instantaneous impact point”, “Launch site accident”, and “Public”.

38. Amend § 420.15 by revising paragraph (b) to read as follows:

§ 420.15

Information requirements.

* * * * *

(b) Environmental. The FAA is responsible for complying with the procedures and policies of the National Environmental Policy Act (NEPA) and other applicable environmental laws, regulations, and Executive Orders prior to issuing a launch site license. An applicant must provide the FAA with information needed to comply with such requirements. The FAA will consider and document the potential environmental effects associated with issuing a launch site license.

(1) Environmental impact statement or environmental assessment. When directed by the FAA, an applicant must—

(i) Prepare an Environmental Assessment with FAA oversight;

(ii) Assume financial responsibility for preparation of an Environmental Impact Statement by an FAA-selected and -managed consultant contractor; or

(iii) Submit information to support a written re-evaluation of a previously submitted Environmental Assessment or Environmental Impact Statement when requested by the FAA.

(2) Categorical exclusion. The FAA may determine that a categorical exclusion is appropriate upon receipt of supporting information from an applicant.

(3) Environmental information. An application must include an approved FAA Environmental Assessment, Environmental Impact Statement, categorical exclusion determination, or written re-evaluation covering all planned licensed activities in compliance with NEPA and the Council on Environmental Quality Regulations for Implementing the Procedural Provisions of NEPA.

* * * * *

39. Revise § 420.51 to read as follows:

§ 420.51

Responsibilities—general.

A licensee must operate its launch site in accordance with the representations in its application.

40. Amend § 420.57 by revising paragraph (d) to read as follows:

§ 420.57

Notifications.

* * * * *

(d) At least 2 days prior to flight of a launch vehicle, unless the Administrator agrees to a different time frame in accordance with § 404.15, the licensee must notify local officials and all owners of land adjacent to the launch site of the flight schedule.

41. Revise § 420.59 to read as follows:

§ 420.59

Mishap plan.

(a) General. A licensee must report, respond to, and investigate any event that meets either paragraph (1) or (5) of the definition of “mishap” in § 401.7 of this chapter. A licensee must submit a mishap plan that meets the requirements of § 450.173(b) through (f).

(b) Launch mishaps. A launch site operator's mishap plan must also contain procedures for participating in an investigation of a launch mishap for launches launched from the launch site.

(c) Other agency procedures. Emergency response and investigation procedures developed in accordance with 29 CFR 1910.119 and 40 CFR part 68 will satisfy the requirements of § 450.173(d) and (e) to the extent that they include the elements required by § 450.173(d) and (e).

42. Amend § 420.61 by revising paragraph (b) to read as follows:

§ 420.61

Records.

* * * * *

(b) For any event that meets any of paragraph (1), (5), or (8) of the definition of “mishap” in § 401.7 of this chapter, a licensee must preserve all records related to the event. Records must be retained until completion of any Federal investigation and the FAA advises the licensee that the records need not be retained.

* * * * *

PART 431—LAUNCH AND REENTRY OF A REUSABLE LAUNCH VEHICLE (RLV)

43. The authority citation for part 431 continue to read as follows:

Authority: 51 U.S.C. 50901-50923.

PART 431—[REMOVED AND RESERVED]

44. Effective March 10, 2026, remove and reserve part 431.

45. Revise § 431.1 to read as follows:

§ 431.1

General.

(a) Applicability. This part applies to the following—

(1) Licenses issued under this part before June 8, 2021; and

(2) Licenses issued on or after June 8, 2021, if the FAA accepted the application under § 413.11 of this chapter before that date.

(b) Scope. This part prescribes requirements for obtaining a reusable launch vehicle (RLV) mission license and post-licensing requirements with which a licensee must comply to remain licensed. Requirements for preparing a license application are contained in part 413 of this subchapter.

(c) Equivalent level of safety. Each requirement of this part applies unless the applicant or licensee clearly and convincingly demonstrates that an alternative approach provides an equivalent level of safety to the requirement of this part.

46. Add § 431.2 to read as follows:

§ 431.2

Licenses issued under this part.

(a) Definitions. For the purposes of this subpart, the definitions of § 401.5 of this chapter apply.

(b) Compliance with part 450 of this chapter. Operations under this part must comply with launch and reentry collision avoidance requirements in § 450.169 of this chapter and critical asset protection requirements in § 450.101(a)(4) and (b)(4) of this chapter.

47. Amend § 431.3 by adding paragraph (c) to read as follows:

§ 431.3

Types of reusable launch vehicle mission licenses.

* * * * *

(c) Duration of license. Notwithstanding the duration for a license established in paragraphs (a) and (b) of this section, no license issued under this part will be valid after March 10, 2026.

48. Amend § 431.43 by revising paragraph (a)(1) and removing and reserving paragraph (c)(1).

The revision reads as follows:

§ 431.43

Reusable launch vehicle mission operational requirements and restrictions.

(a) * * *

(1) That ensure RLV mission risks do not exceed the criteria set forth in §§ 431.35, 450.169, and in § 450.101(a)(4) and (b)(4) for nominal and non-nominal operations;

* * * * *

49. Amend § 431.73 by adding paragraph (f) to read as follows:

§ 431.73

Continuing accuracy of license application; application for modification of license.

* * * * *

(f) The Administrator may determine that a modification to a license issued under this part must comply with the requirements in part 450 of this chapter. The Administrator will base the determination on the extent and complexity of the modification, whether the applicant proposes to modify multiple parts of the application, or if the application requires significant evaluation.

PART 433—LICENSE TO OPERATE A REENTRY SITE

50. The authority citation for part 433 will continue to read as follows:

Authority: 51 U.S.C. 50901-50923.

51. Revise § 433.7 to read as follows:

§ 433.7

Environmental.

(a) General. The FAA is responsible for complying with the procedures and policies of the National Environmental Policy Act (NEPA) and other applicable environmental laws, regulations, and Executive Orders prior to issuing a reentry site license. An applicant must provide the FAA with information needed to comply with such requirements. The FAA will consider and document the potential environmental effects associated with issuing a license for a reentry site.

(b) Environmental impact statement or environmental assessment. When directed by the FAA, an applicant must—

(1) Prepare an Environmental Assessment with FAA oversight;

(2) Assume financial responsibility for preparation of an Environmental Impact Statement by an FAA-selected and -managed consultant contractor; or

(3) Submit information to support a written re-evaluation of a previously submitted Environmental Assessment or Environmental Impact Statement.

(c) Categorical exclusion. The FAA may determine that a categorical exclusion is appropriate upon receipt of supporting information from an applicant.

(d) Environmental information. An application must include an approved FAA Environmental Assessment, Environmental Impact Statement, categorical exclusion determination, or written re-evaluation covering all planned licensed activities in compliance with NEPA and the Council on Environmental Quality Regulations for Implementing the Procedural Provisions of NEPA.

§ 433.9

[Removed]

52. Remove § 433.9.

PART 435—REENTRY OF A REENTRY VEHICLE OTHER THAN A REUSABLE LAUNCH VEHICLE (RLV)

53. The authority citation for part 435 continues to read as follows:

Authority: 51 U.S.C. 50901-50923.

PART 435—[REMOVED AND RESERVED]

54. Effective March 10, 2026, remove and reserve part 435.

55. Revise § 435.1 to read as follows:

§ 435.1

General.

(a) Applicability. This part applies to the following—

(1) Licenses issued under this part before June 8, 2021; and

(2) Licenses issued on or after June 8, 2021, if the FAA accepted the application under § 413.11 of this chapter before that date.

(b) Scope. This part prescribes requirements for obtaining a license to reenter a reentry vehicle other than a reusable launch vehicle (RLV), and post-licensing requirements with which a licensee must comply to remain licensed. Requirements for preparing a license application are contained in part 413 of this subchapter.

(c) Equivalent level of safety. Each requirement of this part applies unless the applicant or licensee clearly and convincingly demonstrates that an alternative approach provides an equivalent level of safety to the requirement of this part.

56. Add § 435.2 to read as follows:

§ 435.2

Licenses.

(a) Definitions. For the purposes of this subpart, the definitions of § 401.5 of this chapter apply.

(b) Compliance with part 450 of this chapter. Operations under this part must comply with launch and reentry collision avoidance requirements in § 450.169 and critical asset protection requirements in § 450.101(a)(4) and (b)(4).

57. Amend § 435.3 by adding paragraph (c) to read as follows:

§ 435.3

Types of reentry licenses.

* * * * *

(c) Duration of license. Notwithstanding the duration for a license established in paragraphs (a) and (b) of this section, no license issued under this part will be valid after March 10, 2026.

PART 437—EXPERIMENTAL PERMITS

58. The authority citation for part 437 continues to read as follows:

Authority: 51 U.S.C. 50901-50923.

§ 437.3

[Amended]

59. Amend § 437.3 by removing the definitions for “anomaly” and “key flight-safety event”.

60. Amend § 437.21 by revising paragraphs (b) and (c) to read as follows:

§ 437.21

General.

* * * * *

(b) Other regulations—(1) Environmental—(i) General. The FAA is responsible for complying with the procedures and policies of the National Environmental Policy Act (NEPA) and other applicable environmental laws, regulations, and Executive Orders to consider and document the potential environmental effects associated with proposed reusable suborbital rocket launches or reentries. An applicant must provide the FAA with information needed to comply with such requirements. The FAA will consider and document the potential environmental effects associated with proposed reusable suborbital rocket launches or reentries.

(ii) Environmental Impact Statement or Environmental Assessment. When directed by the FAA, an applicant must—

(A) Prepare an Environmental Assessment with FAA oversight;

(B) Assume financial responsibility for preparation of an Environmental Impact Statement by an FAA-selected and -managed consultant contractor; or

(C) Submit information to support a written re-evaluation of a previously submitted Environmental Assessment or Environmental Impact Statement.

(iii) Categorical exclusion. The FAA may determine that a categorical exclusion determination is appropriate upon receipt of supporting information from an applicant.

(iv) Information requirements. An application must include an approved FAA Environmental Assessment, Environmental Impact Statement, categorical exclusion determination, or written re-evaluation covering all planned licensed activities in compliance with NEPA and the Council on Environmental Quality Regulations for Implementing the Procedural Provisions of NEPA.

(2) Financial responsibility. An applicant must provide the information required by part 3 of appendix A of part 440 for the FAA to conduct a maximum probable loss analysis.

(3) Human space flight. An applicant proposing launch or reentry with flight crew or a space flight participant on board a reusable suborbital rocket must demonstrate compliance with §§ 460.5, 460.7, 460.11, 460.13, 460.15, 460.17, 460.51, and 460.53 of this subchapter.

(c) Use of a safety element approval. If an applicant proposes to use any reusable suborbital rocket, safety system, process, service, or personnel for which the FAA has issued a safety element approval under part 414 of this chapter, the FAA will not reevaluate that safety element to the extent its use is within its approved scope. As part of the application process, the FAA will evaluate the integration of that safety element into vehicle systems or operations.

* * * * *

61. Revise § 437.41 to read as follows:

§ 437.41

Mishap plan.

An applicant must submit a mishap plan that meets the requirements of § 450.173 of this chapter.

62. Revise § 437.65 to read as follows:

§ 437.65

Collision avoidance analysis.

For a permitted flight with a planned maximum altitude greater than 150 kilometers, a permittee must obtain a collision avoidance analysis in accordance with § 450.169 of this chapter.

§ 437.75

[Removed and Reserved]

63. Remove and reserve § 437.75.

64. Amend § 437.87 by revising paragraph (b) to read as follows:

§ 437.87

Records.

* * * * *

(b) For any event that meets any of paragraphs (1) through (3), (5), or (8) of the definition of “mishap” in § 401.7 of this chapter, a permittee must preserve all records related to the event. Records shall be retained until any Federal investigation is complete and the FAA advises the permittee that the records need not be retained.

* * * * *

65. Amend § 437.89 by revising paragraphs (a) introductory text and (b) to read as follows:

§ 437.89

Pre-flight reporting.

(a) Not later than 30 days before each flight or series of flights conducted under an experimental permit, unless the Administrator agrees to a different time frame in accordance with § 404.15, a permittee must provide the FAA with the following information:

* * * * *

(b) Not later than 15 days before each permitted flight planned to reach greater than 150 km altitude, unless the Administrator agrees to a different time frame in accordance with § 404.15, a permittee must provide the FAA its planned trajectory for a collision avoidance analysis.

PART 440—FINANCIAL RESPONSIBILITY

66. The authority citation for part 440 continues to read as follows:

Authority: 51 U.S.C. 50901-50923.

67. Amend § 440.3 by revising the introductory text and the definition for “maximum probable loss (MPL)” to read as follows:

§ 440.3

Definitions.

Except as otherwise provided in this section, any term used in this part and defined in 51 U.S.C. 50901-50923, or in § 401.5 or § 401.7 of this chapter shall have the meaning contained therein.

* * * * *

Maximum probable loss (MPL) means the greatest dollar amount of loss for bodily injury or property damage that is reasonably expected to result from a licensed or permitted activity;

(1) Losses to third parties, excluding Government personnel and other launch or reentry participants' employees involved in licensed or permitted activities and neighboring operations personnel, that are reasonably expected to result from a licensed or permitted activity are those that have a probability of occurrence of no less than one in ten million.

(2) Losses to Government property and Government personnel involved in licensed or permitted activities and neighboring operations personnel that are reasonably expected to result from licensed or permitted activities are those that have a probability of occurrence of no less than one in one hundred thousand.

* * * * *

§ 440.3

[Amended]

68. Effective March 10, 2026, further amend § 440.3 in the introductory text by removing “ in §§ 401.5 or 401.7” and add, in its place, “in § 401.7”.

69. Amend § 440.15 by revising paragraphs (a)(1) through (4) to read as follows:

§ 440.15

Demonstration of compliance.

(a) * * *

(1) All reciprocal waiver of claims agreements required under § 440.17(c) must be submitted at least 30 days before the start of any licensed or permitted activity involving a customer, crew member, or space flight participant; unless the Administrator agrees to a different time frame in accordance with § 404.15;

(2) Evidence of insurance must be submitted at least 30 days before commencement of any licensed launch or permitted activity, and for licensed reentry no less than 30 days before commencement of launch activities involving the reentry licensee, unless the Administrator agrees to a different time frame in accordance with § 404.15;

(3) Evidence of financial responsibility in a form other than insurance, as provided under § 440.9(f) must be submitted at least 60 days before commencement of a licensed or permitted activity, unless the Administrator agrees to a different time frame in accordance with § 404.15; and

(4) Evidence of renewal of insurance or other form of financial responsibility must be submitted at least 30 days in advance of its expiration date, unless the Administrator agrees to a different time frame in accordance with § 404.15.

* * * * *

70. Add part 450 to read as follows:

PART 450—LAUNCH AND REENTRY LICENSE REQUIREMENTS

Subpart A—General Information

450.1

Applicability.

450.3

Scope of a vehicle operator license.

450.5

Issuance of a vehicle operator license.

450.7

Duration of a vehicle operator license.

450.9

Additional license terms and conditions.

450.11

Transfer of a vehicle operator license.

450.13

Rights not conferred by a vehicle operator license.

Subpart B—Requirements to Obtain a Vehicle Operator License

450.31

General.

450.33

Incremental review and determinations.

450.35

Means of compliance.

450.37

Equivalent level of safety.

450.39

Use of safety element approval.

450.41

Policy review and approval.

450.43

Payload review and determination.

450.45

Safety review and approval.

450.47

Environmental review.

Subpart C—Safety Requirements Safety Criteria

450.101

Safety criteria.

System Safety Program

450.103

System safety program.

Hazard Control Strategies

450.107

Hazard control strategies.

450.108

Flight abort.

450.109

Flight hazard analysis.

450.110

Physical containment.

450.111

Wind weighting.

Flight Safety Analyses

450.113

Flight safety analysis requirements—scope.

450.115

Flight safety analysis methods.

450.117

Trajectory analysis for normal flight.

450.119

Trajectory analysis for malfunction flight.

450.121

Debris analysis.

450.123

Population exposure analysis.

450.131

Probability of failure analysis.

450.133

Flight hazard area analysis.

450.135

Debris risk analysis.

450.137

Far-field overpressure blast effects analysis.

450.139

Toxic hazards for flight.

Prescribed Hazard Controls for Safety-Critical Hardware and Computing Systems

450.141

Computing systems.

450.143

Safety-critical system design, test, and documentation.

450.145

Highly reliable flight safety system.

Other Prescribed Hazard Controls

450.147

Agreements.

450.149

Safety-critical personnel qualifications.

450.151

Work shift and rest requirements.

450.153

Radio frequency management.

450.155

Readiness.

450.157

Communications.

450.159

Pre-flight procedures.

450.161

Control of hazard areas.

450.163

Lightning hazard mitigation.

450.165

Flight commit criteria.

450.167

Tracking.

450.169

Launch and reentry collision avoidance analysis requirements.

450.171

Safety at end of launch.

450.173

Mishap plan—reporting, response, and investigation requirements.

450.175

Test-induced damage.

450.177

Unique safety policies, requirements, and practices.

Ground Safety

450.179

Ground safety—general.

450.181

Coordination with a site operator.

450.183

Explosive site plan.

450.185

Ground hazard analysis.

450.187

Toxic hazards mitigation for ground operations.

450.189

Ground safety prescribed hazard controls.

Subpart D—Terms and Conditions of a Vehicle Operator License

450.201

Responsibility for public safety and safety of property.

450.203

Compliance.

450.205

Financial responsibility requirements.

450.207

Human spaceflight requirements.

450.209

Compliance monitoring.

450.211

Continuing accuracy of license application; application for modification of license.

450.213

Pre-flight reporting.

450.215

Post-flight reporting.

450.217

Registration of space objects.

450.219

Records.

Appendix A to Part 450—Collision Analysis Worksheet

Authority: 51 U.S.C. 50901-50923.

Subpart A—General Information

§ 450.1

Applicability.

This part prescribes requirements for obtaining and maintaining a license to launch, reenter, or both launch and reenter, a launch or reentry vehicle.

§ 450.3

Scope of a vehicle operator license.

(a) General. A vehicle operator license authorizes a licensee to conduct one or more launches or reentries using the same vehicle or family of vehicles. A vehicle operator license identifies the scope of authorization as defined in paragraphs (b) and (c) of this section or as agreed to by the Administrator.

(b) Scope of launch. A vehicle operator license authorizes launch, which includes the flight of a launch vehicle and pre- and post-flight ground operations as follows:

(1) Launch begins when hazardous pre-flight operations commence at a U.S. launch site that may pose a threat to the public. Hazardous pre-flight operations that may pose a threat to the public include pressurizing or loading of propellants into the vehicle, operations involving a fueled launch vehicle, the transfer of energy necessary to initiate flight, or any hazardous activity preparing the vehicle for flight. Hazardous pre-flight operations do not include the period between the end of the previous launch and launch vehicle reuse, when the vehicle is in a safe and dormant state.

(2) At a non-U.S. launch site, launch begins at ignition or at the first movement that initiates flight, whichever occurs earlier.

(3) Launch ends when any of the following events occur:

(i) For an orbital launch of a vehicle without a reentry of the vehicle, launch ends after the licensee's last exercise of control over its vehicle on orbit, after vehicle component impact or landing on Earth, after activities necessary to return the vehicle or component to a safe condition on the ground after impact or landing, or after activities necessary to return the site to a safe condition, whichever occurs latest;

(ii) For an orbital launch of a vehicle with a reentry of the vehicle, launch ends after deployment of all payloads, upon completion of the vehicle's first steady-state orbit if there is no payload deployment, after vehicle component impact or landing on Earth, after activities necessary to return the vehicle or component to a safe condition on the ground after impact or landing, or after activities necessary to return the site to a safe condition, whichever occurs latest;

(iii) For a suborbital launch that includes a reentry, launch ends after reaching apogee;

(iv) For a suborbital launch that does not include a reentry, launch ends after vehicle or vehicle component impact or landing on Earth, after activities necessary to return the vehicle or vehicle component to a safe condition on the ground after impact or landing, or after activities necessary to return the site to a safe condition, whichever occurs latest.

(c) Scope of reentry. A vehicle operator license authorizes reentry. Reentry includes activities conducted in Earth orbit or outer space to determine reentry readiness and that are critical to ensuring public health and safety and the safety of property during reentry flight. Reentry also includes activities necessary to return the reentry vehicle, or vehicle component, to a safe condition on the ground after impact or landing.

(d) Application requirements. An applicant must identify pre- and post-flight ground operations at a U.S. launch site sufficient for the Administrator to determine the scope of activities authorized under the license.

§ 450.5

Issuance of a vehicle operator license.

(a) The FAA issues a vehicle operator license to an applicant who has obtained all approvals and determinations required under this part for a license.

(b) A vehicle operator license authorizes a licensee to conduct launches or reentries, in accordance with the representations contained in the licensee's application, with subparts C and D of this part, and subject to the licensee's compliance with terms and conditions contained in license orders accompanying the license, including financial responsibility requirements.

§ 450.7

Duration of a vehicle operator license.

A vehicle operator license is valid for the period of time determined by the Administrator as necessary to conduct the licensed activity but may not exceed 5 years from the issuance date.

§ 450.9

Additional license terms and conditions.

The FAA may modify a vehicle operator license at any time by modifying or adding license terms and conditions to ensure compliance with the Act and regulations.

§ 450.11

Transfer of a vehicle operator license.

(a) Only the FAA may transfer a vehicle operator license.

(b) Either the holder of a vehicle operator license or the prospective transferee may request a vehicle operator license transfer.

(c) Both the holder and prospective transferee must agree to the transfer.

(d) An applicant for transfer of a vehicle operator license must submit a license application in accordance with part 413 of this chapter and must meet the requirements of part 450 of this chapter.

(e) The FAA will transfer a license to an applicant that has obtained all of the approvals and determinations required under this part for a license. In conducting its reviews and issuing approvals and determinations, the FAA may incorporate by reference any findings made part of the record to support the initial licensing determination. The FAA may modify a license to reflect any changes necessary as a result of a license transfer.

(f) The FAA will provide written notice of its determination to the person requesting the vehicle operator license transfer.

§ 450.13

Rights not conferred by a vehicle operator license.

Issuance of a vehicle operator license does not relieve a licensee of its obligation to comply with all applicable requirements of law or regulation that may apply to its activities, nor does issuance confer any proprietary, property, or exclusive right in the use of any Federal launch or reentry site or related facilities, airspace, or outer space.

Subpart B—Requirements to Obtain a Vehicle Operator License

§ 450.31

General.

(a) To obtain a vehicle operator license, an applicant must—

(1) Submit a license application in accordance with the procedures in part 413 of this chapter;

(2) Obtain a policy approval from the Administrator in accordance with § 450.41;

(3) Obtain a favorable payload determination from the Administrator in accordance with § 450.43, if applicable;

(4) Obtain a safety approval from the Administrator in accordance with § 450.45;

(5) Satisfy the environmental review requirements of § 450.47; and

(6) Provide the information required by appendix A of part 440 for the Administrator to conduct a maximum probable loss analysis for the applicable licensed operation.

(b) An applicant may apply for the approvals and determinations in paragraphs (a)(2) through (6) of this section separately or all together in one complete application, using the application procedures contained in part 413 of this chapter.

(c) An applicant may also apply for a safety approval in an incremental manner, in accordance with § 450.33.

(d) An applicant may reference materials previously provided as part of a license application in order to meet the application requirements of this part.

§ 450.33

Incremental review and determinations.

An applicant may submit its application for a safety review in modules using an incremental approach approved by the Administrator.

(a) An applicant must identify to the Administrator, prior to submitting an application, whether it will submit a modular application for any approval or determination.

(b) An applicant using an incremental approach must have the approach approved by the Administrator prior to submitting an application. In reviewing a proposed approach, the Administrator will consider the following:

(1) Whether the modules can be reviewed independently; and

(2) Whether the modules will be submitted in a workable chronological order.

(c) The Administrator may make incremental determinations as part of this review process.

§ 450.35

Means of compliance.

(a) Prior to application acceptance, a means of compliance must be accepted by the Administrator for the following:

(1) Section 450.115(b)(1) regarding flight safety analyses;

(2) Section 450.139(e)(1) regarding toxic hazards for flight;

(3) Section 450.145(b) regarding highly-reliable flight safety system;

(4) Section 450.163(a)(1) regarding lightning hazard mitigation; and

(5) Section 450.187(e)(1) regarding toxic hazards mitigation for ground operations.

(b) A person requesting acceptance of a proposed means of compliance outside a license application must submit the proposed means of compliance to the FAA in a form and manner acceptable to the Administrator.

§ 450.37

Equivalent level of safety.

(a) An applicant must demonstrate compliance with each requirement of this part, unless the applicant clearly and convincingly demonstrates that an alternative approach provides an equivalent level of safety to the requirement of this part.

(b) Paragraph (a) of this section does not apply to § 450.101(a), (b), (c)(1) and (3), (d), (e)(1), and (g).

§ 450.39

Use of safety element approval.

If an applicant proposes to use any vehicle, safety system, process, service, or personnel for which the FAA has issued a safety element approval under part 414 of this chapter, the FAA will not reevaluate that safety element during a license application evaluation to the extent its use is within its approved scope.

§ 450.41

Policy review and approval.

(a) General. The FAA issues a policy approval to an applicant unless the FAA determines that a proposed launch or reentry would jeopardize U.S. national security or foreign policy interests, or international obligations of the United States.

(b) Interagency consultation. (1) The FAA consults with the Department of Defense to determine whether a license application presents any issues affecting U.S. national security.

(2) The FAA consults with the Department of State to determine whether a license application presents any issues affecting U.S. foreign policy interests or international obligations.

(3) The FAA consults with other Federal agencies, including the National Aeronautics and Space Administration, authorized to address issues identified under paragraph (a) of this section, associated with an applicant's proposal.

(c) Issues during policy review. The FAA will advise an applicant, in writing, of any issue raised during a policy review that would impede issuance of a policy approval. The applicant may respond, in writing, or amend its license application as required by § 413.17 of this chapter.

(d) Denial of policy approval. The FAA notifies an applicant, in writing, if it has denied policy approval for a license application. The notice states the reasons for the FAA's determination. The applicant may seek further review of the determination in accordance with § 413.21 of this chapter.

(e) Application requirements for policy review. In its license application, an applicant must—

(1) Identify the model, type, and configuration of any vehicle proposed for launch or reentry by the applicant;

(2) Describe the vehicle by characteristics that include individual stages, their dimensions, type and amounts of all propellants, and maximum thrust;

(3) Identify foreign ownership of the applicant as follows:

(i) For a sole proprietorship or partnership, identify all foreign ownership;

(ii) For a corporation, identify any foreign ownership interests of 10 percent or more; and

(iii) For a joint venture, association, or other entity, identify any participating foreign entities; and

(4) Identify the proposed vehicle flight profile, including:

(i) Launch or reentry site, including any contingency abort locations;

(ii) Flight azimuths, trajectories, and associated ground tracks and instantaneous impact points for the duration of the licensed activity, including any contingency abort profiles;

(iii) Sequence of planned events or maneuvers during flight;

(iv) Normal impact or landing areas for all mission hardware; and

(v) For each orbital mission, the range of intermediate and final orbits of each vehicle upper stage and their estimated orbital lifetimes.

§ 450.43

Payload review and determination.

(a) General. If applicable, the FAA issues a favorable payload determination for a launch or reentry to a license applicant or payload owner or operator if—

(1) The applicant, payload owner, or payload operator has obtained all required licenses, authorizations, and permits; and

(2) Its launch or reentry would not jeopardize public health and safety, safety of property, U.S. national security or foreign policy interests, or international obligations of the United States.

(b) Relationship to other executive agencies. The FAA does not make a determination under paragraph (a)(2) of this section for—

(1) Those aspects of payloads that are subject to regulation by the Federal Communications Commission or the Department of Commerce; or

(2) Payloads owned or operated by the U.S. Government.

(c) Classes of payloads. The FAA may review and issue findings regarding a proposed class of payload, including communications, remote sensing, or navigation. However, prior to a launch or reentry, each payload is subject to verification by the FAA that its launch or reentry would not jeopardize public health and safety, safety of property, U.S. national security or foreign policy interests, or international obligations of the United States.

(d) Payload owner or payload operator may apply. In addition to a launch or reentry operator, a payload owner or payload operator may request a payload review and determination.

(e) Interagency consultation. The FAA consults with other agencies as follows:

(1) The Department of Defense to determine whether launch or reentry of a proposed payload or payload class would present any issues affecting U.S. national security;

(2) The Department of State to determine whether launch or reentry of a proposed payload or payload class would present any issues affecting U.S. foreign policy interests or international obligations; or

(3) Other Federal agencies, including the National Aeronautics and Space Administration, authorized to address issues of public health and safety, safety of property, U.S. national security or foreign policy interests, or international obligations of the United States, associated with the launch or reentry of a proposed payload or payload class.

(f) Issues during payload review. The FAA will advise a person requesting a payload determination, in writing, of any issue raised during a payload review that would impede issuance of a license to launch or reenter that payload or payload class. The person requesting payload review may respond, in writing, or amend its application as required by § 413.17 of this chapter.

(g) Denial of a payload determination. The FAA notifies an applicant, in writing, if it has denied a favorable payload determination. The notice states the reasons for the FAA's determination. The applicant may seek further review of the determination in accordance with § 413.21 of this chapter.

(h) Incorporation of payload determination in license application. A favorable payload determination issued for a payload or class of payload may be included by a license applicant as part of its application. However, any change in information provided under paragraph (i) of this section must be reported in accordance with § 413.17 of this chapter. The FAA determines whether a favorable payload determination remains valid in light of reported changes and may conduct an additional payload review.

(i) Application requirements. A person requesting review of a particular payload or payload class must identify the following:

(1) For launch of a payload:

(i) Payload name or class of payload, and function;

(ii) Description, including physical dimensions, weight, composition, and any hosted payloads;

(iii) Payload owner and payload operator, if different from the person requesting payload review and determination;

(iv) Any foreign ownership of the payload or payload operator, as specified in § 450.41(e)(3);

(v) Hazardous materials as defined in § 401.7 of this chapter, radioactive materials, and the amounts of each;

(vi) Explosive potential of payload materials, alone and in combination with other materials found on the payload;

(vii) For orbital launches, parameters for parking, transfer and final orbits, and approximate transit times to final orbit;

(viii) Delivery point in flight at which the payload will no longer be under the licensee's control;

(ix) Intended operations during the lifetime of the payload, including anticipated life span and any planned disposal;

(x) Any encryption associated with data storage on the payload and transmissions to or from the payload; and

(xi) Any other information necessary to make a determination based on public health and safety, safety of property, U.S. national security or foreign policy interests, or international obligations of the United States.

(2) For reentry of a payload:

(i) Payload name or class of payload, and function;

(ii) Physical characteristics, dimensions, and weight of the payload;

(iii) Payload owner and payload operator, if different from the person requesting the payload review and determination;

(iv) Type, amount, and container of hazardous materials and radioactive materials in the payload;

(v) Explosive potential of payload materials, alone and in combination with other materials found on the payload or reentry vehicle during reentry; and

(vi) Designated reentry site.

§ 450.45

Safety review and approval.

(a) General. The FAA issues a safety approval to an applicant if it determines that an applicant can conduct launch or reentry without jeopardizing public health and safety and safety of property. A license applicant must satisfy the application requirements in this section and subpart C of this part.

(b) Services or property provided by a Federal launch or reentry site. The FAA will accept any safety-related launch or reentry service or property provided by a Federal launch or reentry site or other Federal entity by contract, as long as the FAA determines that the launch or reentry services or property provided satisfy this part.

(c) Issues during safety review. The FAA will advise an applicant, in writing, of any issues raised during a safety review that would impede issuance of a safety approval. The applicant may respond, in writing, or amend its license application as required by § 413.17 of this chapter.

(d) Denial of a safety approval. The FAA notifies an applicant, in writing, if it has denied a safety approval for a license application. The notice states the reasons for the FAA's determination. The applicant may seek further review of the determination in accordance with § 413.21 of this chapter.

(e) Application requirements. An applicant must submit the information required in the “Application requirements” paragraphs in individual sections in subpart C of this part, as well as the following:

(1) General. An application must—

(i) Contain a glossary of unique terms and acronyms used in alphabetical order;

(ii) Contain a listing of all referenced material;

(iii) Use equations and mathematical relationships derived from or referenced to a recognized standard or text, and define all algebraic parameters;

(iv) Include the units of all numerical values provided; and

(v) Include a legend or key that identifies all symbols used for any schematic diagrams.

(2) Site description. An applicant must identify the proposed launch or reentry site, including contingency abort locations, and submit the following:

(i) Boundaries of the site;

(ii) Launch or landing point locations, including latitude and longitude;

(iii) Identity of any site operator; and

(iv) Identity of any facilities at the site that will be used for pre- or post-flight ground operations.

(3) Vehicle description. An applicant must submit the following:

(i) A written description of the vehicle or family of vehicles, including structural, thermal, pneumatic, propulsion, electrical, and avionics and guidance systems used in each vehicle, and all propellants. The description must include a table specifying the type and quantities of all hazardous materials on each vehicle and must include propellants, explosives, and toxic materials; and

(ii) A drawing of each vehicle that identifies:

(A) Each stage, including strap-on motors;

(B) Physical dimensions and weight;

(C) Location of all safety-critical systems;

(D) Location of all major vehicle control systems, propulsion systems, pressure vessels, and any other hardware that contains potential hazardous energy or hazardous material; and

(E) For an unguided suborbital launch vehicle, the location of the rocket's center of pressure in relation to its center of gravity for the entire flight profile.

(4) Mission schedule. An applicant must submit a generic launch or reentry processing schedule that identifies any readiness activities, such as reviews and rehearsals, and each safety-critical pre-flight operation to be conducted. The mission schedule must also identify day of flight activities.

(5) Human space flight. For a proposed launch or reentry with a human being on board a vehicle, an applicant must demonstrate compliance with §§ 460.5, 460.7, 460.11, 460.13, 460.15, 460.17, 460.51, and 460.53 of this chapter.

(6) Radionuclides. The FAA will evaluate the launch or reentry of any radionuclide on a case-by-case basis, and issue an approval if the FAA finds that the launch or reentry is consistent with public health and safety, safety of property, and national security and foreign policy interests of the United States. For any radionuclide on a launch or reentry vehicle, an applicant must—

(i) Identify the type and quantity;

(ii) Include a reference list of all documentation addressing the safety of its intended use; and

(iii) Describe all approvals by the Nuclear Regulatory Commission for pre-flight ground operations.

(7) Additional material. The FAA may also request—

(i) Any information incorporated by reference in the license application; and

(ii) Additional products that allow the FAA to conduct an independent safety analysis.

§ 450.47

Environmental review.

(a) General. The FAA is responsible for complying with the procedures and policies of the National Environmental Policy Act (NEPA) and other applicable environmental laws, regulations, and Executive Orders prior to issuing a launch or reentry license. An applicant must provide the FAA with information needed to comply with such requirements. The FAA will consider and document the potential environmental effects associated with issuing a launch or reentry license consistent with paragraph (b) of this section.

(b) Environmental Impact Statement or Environmental Assessment. When directed by the FAA, an applicant must—

(1) Prepare an Environmental Assessment with FAA oversight;

(2) Assume financial responsibility for preparation of an Environmental Impact Statement by an FAA-selected and -managed consultant contractor; or

(3) Submit information to support a written re-evaluation of a previously submitted Environmental Assessment or Environmental Impact Statement.

(c) Categorical exclusion. The FAA may determine that a categorical exclusion is appropriate upon receipt of supporting information from an applicant.

(d) Application requirements. An application must include an approved FAA Environmental Assessment, Environmental Impact Statement, categorical exclusion determination, or written re-evaluation, which should address compliance with any other applicable environmental laws, regulations, and Executive Orders covering all planned licensed activities in compliance with NEPA and the Council on Environmental Quality Regulations for Implementing the Procedural Provisions of NEPA.

Subpart C—Safety Requirements

Safety Criteria

§ 450.101

Safety criteria.

(a) Launch risk criteria. For any launch, an operator may initiate the flight of a launch vehicle only if all risks to the public satisfy the criteria in this paragraph (a). For an orbital launch, the criteria in this paragraph apply from liftoff through orbital insertion. For a suborbital launch, or a suborbital launch and reentry, the criteria in this paragraph apply from liftoff through final impact or landing.

(1) Collective risk. The collective risk, measured as expected number of casualties (E_C), consists of risk posed by impacting inert and explosive debris, toxic release, and far field blast overpressure. Public risk due to any other hazard associated with the proposed flight of a launch vehicle will be determined by the Administrator on a case-by-case basis.

(i) The risk to all members of the public, excluding persons in aircraft and neighboring operations personnel, must not exceed an expected number of 1 × 10⁻⁴ casualties.

(ii) The risk to all neighboring operations personnel must not exceed an expected number of 2 × 10⁻⁴ casualties.

(2) Individual risk. The individual risk, measured as probability of casualty (P_C), consists of risk posed by impacting inert and explosive debris, toxic release, and far field blast overpressure. The FAA will determine whether to approve public risk due to any other hazard associated with the proposed flight of a launch vehicle on a case-by-case basis.

(i) The risk to any individual member of the public, excluding neighboring operations personnel, must not exceed a probability of casualty of 1 × 10⁻⁶ per launch.

(ii) The risk to any individual neighboring operations personnel must not exceed a probability of casualty of 1 × 10⁻⁵ per launch.

(3) Aircraft risk. A launch operator must establish any aircraft hazard areas necessary to ensure the probability of impact with debris capable of causing a casualty for aircraft does not exceed 1 × 10⁻⁶.

(4) Risk to critical assets. (i) The risk to critical assets, measured as the probability of loss of functionality, must not exceed the following probabilities:

(A) For each critical asset, except for a critical payload, 1 × 10⁻³ ; and

(B) For each critical payload, 1 × 10⁻⁴.

(ii) The Administrator will consult with relevant Federal agencies, and each agency will identify, for purposes of this part, any critical assets that the agency owns or otherwise depends on. For purposes of this part, the Administrator will accept any identification by the Secretary of Defense that an asset is critical to national security.

(iii) The Administrator or Federal site operator will notify the licensee of any risk to critical assets above the risk criteria in paragraph (a)(4)(i) of this section.

(iv) The Administrator may determine, in consultation with relevant Federal agencies, that a more stringent probability is necessary to protect the national interests of the United States.

(v) The risk criteria in paragraph (a)(4)(i) of this section do not apply to property, facilities, or infrastructure supporting the launch that are within the public area distance, as defined in part 420, appendix E, tables E1 and E2 or associated formulae, of the vehicle's launch point.

(b) Reentry risk criteria. For any reentry, an operator may initiate the deorbit of a vehicle only if all risks to the public satisfy the criteria in this paragraph (b). The following criteria apply to each reentry, other than a suborbital reentry, from the final health check prior to initiating deorbit through final impact or landing:

(1) Collective risk. The collective risk, measured as expected number of casualties (E_C), consists of risk posed by impacting inert and explosive debris, toxic release, and far field blast overpressure. Public risk due to any other hazard associated with the proposed deorbit of a reentry vehicle will be determined by the Administrator on a case-by-case basis.

(i) The risk to all members of the public, excluding persons in aircraft and neighboring operations personnel, must not exceed an expected number of 1 × 10⁻⁴ casualties.

(ii) The risk to all neighboring operations personnel must not exceed an expected number of 2 × 10⁻⁴ casualties.

(2) Individual risk. The individual risk, measured as probability of casualty (P_C), consists of risk posed by impacting inert and explosive debris, toxic release, and far field blast overpressure. Public risk due to any other hazard associated with the proposed flight of a launch vehicle will be determined on a case-by-case basis.

(i) The risk to any individual member of the public, excluding neighboring operations personnel, must not exceed a probability of casualty of 1 × 10⁻⁶ per reentry.

(ii) The risk to any individual neighboring operations personnel must not exceed a probability of casualty of 1 × 10⁻⁵ per reentry.

(3) Aircraft risk. A reentry operator must establish any aircraft hazard areas necessary to ensure the probability of impact with debris capable of causing a casualty for aircraft does not exceed 1 × 10⁻⁶.

(4) Risk to critical assets. (i) The risk to critical assets, measured as the probability of loss of functionality, must not exceed the following probabilities:

(A) For each critical asset, except for a critical payload, 1 × 10⁻³ ; and

(B) For each critical payload, 1 × 10⁻⁴.

(ii) The Administrator will consult with relevant Federal agencies, and each agency will identify, for purposes of this part, any critical assets that the agency owns or otherwise depends on. For purposes of this part, the Administrator will accept any identification by the Secretary of Defense that an asset is critical to national security.

(iii) The Administrator or Federal site operator will notify the licensee of any risk to critical assets above the risk criteria in paragraph (b)(4)(i) of this section.

(iv) The Administrator may determine, in consultation with relevant Federal agencies, that a more stringent probability is necessary to protect the national interests of the United States.

(c) High consequence event protection. An operator must protect against a high consequence event in uncontrolled areas for each phase of flight by:

(1) Using flight abort as a hazard control strategy in accordance with the requirements of § 450.108;

(2) Ensuring the consequence of any reasonably foreseeable failure mode, in any significant period of flight, is no greater than 1 × 10⁻³ conditional expected casualties; or

(3) Establishing the launch or reentry vehicle has sufficient demonstrated reliability as agreed to by the Administrator based on conditional expected casualties criteria during that phase of flight.

(d) Disposal safety criteria. A launch operator must ensure that any disposal meets the criteria of paragraphs (b)(1) through (3) of this section, or targets a broad ocean area.

(e) Protection of people and property on orbit. (1) A launch or reentry operator must prevent the collision between a launch or reentry vehicle stage or component and people or property on orbit, in accordance with the requirements in § 450.169(a).

(2) For any launch vehicle stage or component that reaches Earth orbit, a launch operator must prevent the creation of debris through the conversion of energy sources into energy that fragments the stage or component, in accordance with the requirements in § 450.171.

(f) Notification of planned impacts. For any launch, reentry, or disposal, an operator must notify the public of any region of land, sea, or air that contains, with 97 percent probability of containment, all debris resulting from normal flight events capable of causing a casualty.

(g) Validity of the analysis. For any analysis used to demonstrate compliance with this section, an operator must use accurate data and scientific principles and the analysis must be statistically valid. The method must produce results consistent with or more conservative than the results available from previous mishaps, tests, or other valid benchmarks, such as higher-fidelity methods.

System Safety Program

§ 450.103

System safety program.

An operator must implement and document a system safety program throughout the lifecycle of a launch or reentry system that includes the following:

(a) Safety organization. An operator must maintain a safety organization that has clearly defined lines of communication and approval authority for all public safety decisions. At a minimum, the safety organization must have the following positions:

(1) Mission director. For each launch or reentry, an operator must designate a position responsible for the safe conduct of all licensed activities and authorized to provide final approval to proceed with licensed activities. This position is referred to as the mission director in this part.

(2) Safety official. For each launch or reentry, an operator must designate a position with direct access to the mission director who is—

(i) Responsible for communicating potential safety and noncompliance issues to the mission director; and

(ii) Authorized to examine all aspects of the operator's ground and flight safety operations, and to independently monitor compliance with the operator's safety policies, safety procedures, and licensing requirements.

(3) Addressing safety official concerns. The mission director must ensure that all of the safety official's concerns are addressed.

(b) Hazard management. For hazard management:

(1) An operator must implement methods to assess the system to ensure the validity of the hazard control strategy determination and any flight hazard or flight safety analysis throughout the lifecycle of the launch or reentry system;

(2) An operator must implement methods for communicating and implementing any updates throughout the organization; and

(3) Additionally, an operator required to conduct a flight hazard analysis must implement a process for tracking hazards, risks, mitigation measures, and verification activities.

(c) Configuration management and control. An operator must—

(1) Employ a process that tracks configurations of all safety-critical systems and documentation related to the operation;

(2) Ensure the use of correct and appropriate versions of systems and documentation tracked in paragraph (c)(1) of this section; and

(3) Document the configurations and versions identified in paragraph (c)(2) of this section for each licensed activity.

(d) Post-flight data review. An operator must employ a process for evaluating post-flight data to—

(1) Ensure consistency between the assumptions used for the hazard control strategy determination, any flight hazard or flight safety analyses, and associated mitigation and hazard control measures;

(2) Resolve any inconsistencies identified in paragraph (d)(1) of this section prior to the next flight of the vehicle;

(3) Identify any anomaly that may impact any flight hazard analysis, flight safety analysis, or safety-critical system, or is otherwise material to public safety; and

(4) Address any anomaly identified in paragraph (d)(3) of this section prior to the next flight as necessary to ensure public safety, including updates to any flight hazard analysis, flight safety analysis, or safety-critical system.

(e) Application requirements. An applicant must submit in its application the following:

(1) A description of the applicant's safety organization as required by paragraph (a) of this section, identifying the applicant's lines of communication and approval authority, both internally and externally, for all public safety decisions and the provision of public safety services; and

(2) A summary of the processes and products identified in the system safety program requirements in paragraphs (b), (c), and (d) of this section.

Hazard Control Strategies

§ 450.107

Hazard control strategies.

(a) General. To meet the safety criteria of § 450.101(a), (b), or (c) for the flight, or any phase of flight, of a launch or reentry vehicle, an operator must use one or more of the hazard control strategies identified in § 450.108 through § 450.111.

(b) Hazard control strategy determination. For each phase of flight during a launch or reentry, an operator must use a functional hazard analysis to determine a hazard control strategy or strategies that account for—

(1) All functional failures associated with reasonably foreseeable hazardous events that have the capability to create a hazard to the public;

(2) Safety-critical systems; and

(3) A timeline of all safety-critical events.

(c) Flight hazard analysis. An operator must conduct a flight hazard analysis in accordance with § 450.109 of this part for the flight, or phase of flight, of a launch or reentry vehicle if the public safety hazards cannot be mitigated adequately to meet the public risk criteria of § 450.101(a), (b), and (c) using physical containment, wind weighting, or flight abort.

(d) Application requirements. An applicant must submit in its application—

(1) The results of the hazard control strategy determination, including—

(i) All functional failures identified under paragraph (b)(1) of this section;

(ii) The identification of all safety-critical systems; and

(iii) A timeline of all safety-critical events.

(2) A description of its hazard control strategy or strategies for each phase of flight.

§ 450.108

Flight abort.

(a) Applicability. This section applies to the use of flight abort as a hazard control strategy for the flight, or phase of flight, of a launch or reentry vehicle to meet the safety criteria of § 450.101.

(b) Flight safety system. An operator must use a flight safety system that:

(1) Meets the requirements of § 450.145 if the consequence of any reasonably foreseeable failure mode in any significant period of flight is greater than 1 × 10⁻² conditional expected casualties in uncontrolled areas; or

(2) Meets the requirements of § 450.143 if the consequence of any reasonably foreseeable failure mode in any significant period of flight is between 1 × 10⁻² and 1 × 10⁻³ conditional expected casualties for uncontrolled areas.

(c) Flight safety limits objectives. An operator must determine and use flight safety limits that define when an operator must initiate flight abort for each of the following—

(1) To ensure compliance with the safety criteria of § 450.101(a) and (b);

(2) To prevent continued flight from increasing risk in uncontrolled areas if the vehicle is unable to achieve a useful mission;

(3) To prevent the vehicle from entering a period of materially increased public exposure in uncontrolled areas, including before orbital insertion, if a critical vehicle parameter is outside its pre-established expected range or indicates an inability to complete flight within the limits of a useful mission;

(4) To prevent conditional expected casualties greater than 1 × 10⁻² in uncontrolled areas due to flight abort or due to flight outside the limits of a useful mission from any reasonably foreseeable off-trajectory failure mode in any significant period of flight; and

(5) To prevent the vehicle state from reaching identified conditions that are anticipated to compromise the capability of the flight safety system if further flight has the potential to violate a flight safety limit.

(6) In lieu of paragraphs (c)(2) and (4) of this section, to prevent debris capable of causing a casualty due to any hazard from affecting uncontrolled areas using a flight safety system that complies with § 450.145.

(d) Flight safety limits constraints. An operator must determine flight safety limits that—

(1) Account for temporal and geometric extents on the Earth's surface of any reasonably foreseeable vehicle hazards under all reasonably foreseeable conditions during normal and malfunctioning flight;

(2) Account for physics of hazard generation and transport including uncertainty;

(3) Account for the potential to lose valid data necessary to evaluate the flight abort rules;

(4) Account for the time delay, including uncertainties, between the violation of a flight abort rule and the time when the flight safety system is expected to activate;

(5) Account in individual, collective, and conditional risk evaluations both for proper functioning of the flight safety system and failure of the flight safety system;

(6) Are designed to avoid flight abort that results in increased collective risk to the public in uncontrolled areas, compared to continued flight; and

(7) Ensure that any trajectory within the limits of a useful mission that is permitted to fly without abort would meet the collective risk criteria of § 450.101(a)(1) or (b)(1) when analyzed as if it were the planned mission in accordance with § 450.213(b)(2).

(e) End of flight abort. A flight does not need to be aborted to protect against high consequence events in uncontrolled areas beginning immediately after critical vehicle parameters are validated, if the vehicle is able to achieve a useful mission and the following conditions are met for the remainder of flight:

(1) Flight abort would not materially decrease the risk from a high consequence event; and

(2) There are no key flight safety events.

(f) Flight abort rules. For each launch or reentry, an operator must establish and observe flight abort rules that govern the conduct of the launch or reentry as follows.

(1) Vehicle data required to evaluate flight abort rules must be available to the flight safety system under all reasonably foreseeable conditions during normal and malfunctioning flight.

(2) The flight safety system must abort flight:

(i) When valid, real-time data indicate the vehicle has violated any flight safety limit developed in accordance with this section;

(ii) When the vehicle state approaches identified conditions that are anticipated to compromise the capability of the flight safety system and further flight has the potential to violate a flight safety limit; and

(iii) In accordance with methods used to satisfy (d)(3) of this section, if tracking data is invalid and further flight has the potential to violate a flight safety limit.

(g) Application requirements. An applicant must submit in its application the following:

(1) A description of the methods used to demonstrate compliance with paragraph (c) of this section, including descriptions of how each analysis constraint in paragraph (d) of this section is satisfied in accordance with § 450.115.

(2) A description of how each flight safety limit and flight abort rule is evaluated and implemented during vehicle flight, including the quantitative criteria that will be used, a description of any critical parameters, and how the values required in paragraphs (c)(3) and (e) of this section are identified;

(3) A graphic depiction or series of depictions of flight safety limits for a representative mission together with the launch or landing point, all uncontrolled area boundaries, the nominal trajectory, extents of normal flight, and limits of a useful mission trajectories, with all trajectories in the same projection as each of the flight safety limits; and

(4) A description of the vehicle data that will be available to evaluate flight abort rules under all reasonably foreseeable conditions during normal and malfunctioning flight.

§ 450.109

Flight hazard analysis.

(a) Applicability. This section applies to the use of a flight hazard analysis as a hazard control strategy to derive hazard controls for the flight, or phase of flight, of a launch or reentry vehicle. Hazards associated with computing systems and software are further addressed in § 450.141.

(b) Analysis. A flight hazard analysis must identify, describe, and analyze all reasonably foreseeable hazards to public safety resulting from the flight of a launch or reentry vehicle. Each flight hazard analysis must—

(1) Identify all reasonably foreseeable hazards, and the corresponding failure mode for each hazard, associated with the launch or reentry system relevant to public safety, including those resulting from:

(i) Vehicle operation, including staging and release;

(ii) System, subsystem, and component failures or faults;

(iii) Software operations;

(iv) Environmental conditions;

(v) Human factors;

(vi) Design inadequacies;

(vii) Procedure deficiencies;

(viii) Functional and physical interfaces between subsystems, including any vehicle payload;

(ix) Reuse of components or systems; and

(x) Interactions of any of the above.

(2) Assess each hazard's likelihood and severity.

(3) Ensure that the likelihood of any hazardous condition that may cause death or serious injury to the public is extremely remote.

(4) Identify and describe the risk elimination and mitigation measures required to satisfy paragraph (b)(3) of this section.

(5) Document that the risk elimination and mitigation measures achieve the risk level of paragraph (b)(3) of this section through validation and verification. Verification includes:

(i) Analysis;

(ii) Test;

(iii) Demonstration; or

(iv) Inspection.

(c) New Hazards. An operator must establish and document the criteria and techniques for identifying new hazards throughout the lifecycle of the launch or reentry system.

(d) Completeness Prior to Flight. For every launch or reentry, the flight hazard analysis must be complete and all hazards must be mitigated to an acceptable level in accordance with paragraph (b)(3) of this section.

(e) Updates. An operator must continually update the flight hazard analysis throughout the lifecycle of the launch or reentry system.

(f) Application requirements. An applicant must submit in its application the following:

(1) Flight hazard analysis products of paragraphs (b)(1) through (5) of this section, including data that verifies the risk elimination and mitigation measures resulting from the applicant's flight hazard analyses required by paragraph (b)(5) of this section; and

(2) The criteria and techniques for identifying new hazards throughout the lifecycle of the launch or reentry system as required by paragraph (c) of this section.

§ 450.110

Physical containment.

(a) Applicability. This section applies to the use of physical containment as a hazard control strategy for the flight, or phase of flight, of a launch or reentry vehicle to meet the safety criteria of § 450.101(a), (b), and (c).

(b) Containment. To use physical containment as a hazard control strategy, an operator must—

(1) Develop the flight hazard area in accordance with § 450.133;

(2) Ensure that the launch vehicle does not have sufficient energy for any hazards associated with its flight to reach outside the flight hazard area;

(3) Ensure the hazard area is clear of the public and critical assets; and

(4) Apply other mitigation measures necessary to ensure no public or critical asset exposure to hazards, such as control of public access or wind placards.

(c) Application requirements. An applicant must submit in its application the following:

(1) A demonstration that the launch vehicle does not have sufficient energy for any hazards associated with its flight to reach outside the flight hazard area developed in accordance with § 450.133; and

(2) A description of the methods used to ensure that flight hazard areas are cleared of the public and critical assets.

§ 450.111

Wind weighting.

(a) Applicability. This section applies to the use of wind weighting as a hazard control strategy for the flight of an unguided suborbital launch vehicle to meet the safety criteria of § 450.101(a), (b), and (c).

(b) Wind weighting safety system. The flight of an unguided suborbital launch vehicle that uses a wind weighting safety system must meet the following:

(1) The launcher azimuth and elevation settings must be wind weighted to correct for the effects of wind conditions at the time of flight to provide impact locations that will ensure compliance with the safety criteria in § 450.101; and

(2) An operator must use launcher azimuth and elevation angle settings that ensures the rocket will not fly in an unintended direction accounting for uncertainties in vehicle and launcher design and manufacturing, and atmospheric uncertainties.

(c) Analysis. An operator must—

(1) Establish flight commit criteria and other flight safety rules that control the risk to the public from potential adverse effects resulting from normal and malfunctioning flight;

(2) Establish any wind constraints under which flight may occur; and

(3) Conduct a wind weighting analysis that establishes the launcher azimuth and elevation settings that correct for the windcocking and wind-drift effects on the unguided suborbital launch vehicle.

(d) Stability. An unguided suborbital launch vehicle, in all configurations, must be stable throughout each stage of powered flight.

(e) Application requirements. An applicant must submit in its application the following:

(1) A description of its wind weighting analysis methods, including its method and schedule of determining wind speed and wind direction for each altitude layer;

(2) A description of its wind weighting safety system including all equipment used to perform the wind weighting analysis; and

(3) A representative wind weighting analysis using actual or statistical winds for the launch area and samples of the output.

Flight Safety Analyses

§ 450.113

Flight safety analysis requirements—scope.

(a) An operator must perform and document a flight safety analysis for all phases of flight, except as specified in paragraph (b) of this section, as follows—

(1) For orbital launch, from liftoff through orbital insertion, and through all component impacts or landings;

(2) For suborbital launch, from liftoff through all component impacts or landings;

(3) For disposal, from the initiation of the deorbit through final impact; and

(4) For reentry, from the initiation of the deorbit through all component impacts or landing.

(b) An operator is not required to perform and document a flight safety analysis for a phase of flight if agreed to by the Administrator based on demonstrated reliability. An operator demonstrates reliability by using operational and flight history to show compliance with the risk criteria in § 450.101(a) and (b).

§ 450.115

Flight safety analysis methods.

(a) Scope of the analysis. An operator's flight safety analysis method must account for all reasonably foreseeable events and failures of safety-critical systems during nominal and non-nominal launch or reentry that could jeopardize public safety.

(b) Level of fidelity of the analysis. An operator's flight safety analysis method must have a level of fidelity sufficient to—

(1) Demonstrate that any risk to the public satisfies the safety criteria of § 450.101, including the use of mitigations, accounting for all known sources of uncertainty, using a means of compliance accepted by the Administrator; and

(2) Identify the dominant source of each type of public risk with a criterion in § 450.101(a) or (b) in terms of phase of flight, source of hazard (such as toxic exposure, inert, or explosive debris), and failure mode.

(c) Application requirements. An applicant must submit a description of the flight safety analysis methodology, including identification of:

(1) The scientific principles and statistical methods used;

(2) All assumptions and their justifications;

(3) The rationale for the level of fidelity;

(4) The evidence for validation and verification required by § 450.101(g);

(5) The extent to which the benchmark conditions are comparable to the foreseeable conditions of the intended operations; and

(6) The extent to which risk mitigations were accounted for in the analyses.

§ 450.117

Trajectory analysis for normal flight.

(a) General. A flight safety analysis must include a trajectory analysis that establishes, for any phase of flight within the scope as provided by § 450.113(a), the limits of a launch or reentry vehicle's normal flight as defined by the nominal trajectory, and the following sets of trajectories sufficient to characterize variability and uncertainty during normal flight:

(1) A set of trajectories to characterize variability. This set must describe how the intended trajectory could vary due to conditions known prior to initiation of flight; and

(2) A set of trajectories to characterize uncertainty. This set must describe how the actual trajectory could differ from the intended trajectory due to random uncertainties in all parameters with a significant influence on the vehicle's behavior throughout normal flight.

(b) Trajectory model. A final trajectory analysis must use a six-degree of freedom trajectory model to satisfy the requirements of paragraph (a) of this section.

(c) Atmospheric effects. A trajectory analysis must account for atmospheric conditions that have an effect on the trajectory, including atmospheric profiles that are no less severe than the worst conditions under which flight might be attempted, and for uncertainty in the atmospheric conditions.

(d) Application requirements. An applicant must submit the following:

(1) A description of the methods used to characterize the vehicle's flight behavior throughout normal flight, in accordance with § 450.115(c).

(2) The quantitative input data, including uncertainties, used to model the vehicle's normal flight in six degrees of freedom.

(3) The worst atmospheric conditions under which flight might be attempted, and a description of how the operator will evaluate the atmospheric conditions and uncertainty in the atmospheric conditions prior to initiating the operation;

(4) Representative normal flight trajectory analysis outputs, including the position velocity, and orientation for each second of flight for—

(i) The nominal trajectory;

(ii) A set of trajectories that characterize variability in the intended trajectory based on conditions known prior to initiation of flight; and

(iii) A set of trajectories that characterize how the actual trajectory could differ from the intended trajectory due to random uncertainties.

§ 450.119

Trajectory analysis for malfunction flight.

(a) General. A flight safety analysis must include a trajectory analysis that establishes—

(1) The vehicle's deviation capability in the event of a malfunction during flight,

(2) The trajectory dispersion resulting from reasonably foreseeable malfunctions, and

(3) For vehicles using flight abort as a hazard control strategy under § 450.108, trajectory data or parameters that describe the limits of a useful mission. The FAA does not consider the collection of data related to a failure to be a useful mission.

(b) Analysis constraints. A malfunction trajectory analysis must account for each cause of a malfunction flight, including software and hardware failures, for every period of normal flight. The analysis for each type of malfunction must have sufficient temporal and spatial resolution to establish flight safety limits, if any, and individual risk contours that are smooth and continuous. The analysis must account for—

(1) The relative probability of occurrence of each malfunction;

(2) The probability distribution of position and velocity of the vehicle when each malfunction trajectory will terminate due to vehicle breakup, ground impact, or orbital insertion along with the cause of termination and the state of the vehicle;

(3) The parameters with a significant influence on a vehicle's flight behavior from the time a malfunction begins to cause a flight deviation until the time each malfunction trajectory will terminate due to vehicle breakup, ground impact, or orbital insertion; and

(4) The potential for failure of the flight safety system, if any.

(c) Application requirements. An applicant must submit—

(1) A description of the methodology used to characterize the vehicle's flight behavior throughout malfunction flight, in accordance with § 450.115(c).

(2) A description of the methodology used to determine the limits of a useful mission, in accordance with § 450.115(c).

(3) A description of the input data used to characterize the vehicle's malfunction flight behavior, including:

(i) A list of each cause of malfunction flight considered;

(ii) A list of each type of malfunction flight for which malfunction flight behavior was characterized; and

(iii) A quantitative description of the parameters, including uncertainties, with a significant influence on the vehicle's malfunction behavior for each type of malfunction flight characterized.

(4) Representative malfunction flight trajectory analysis outputs, including the position and velocity as a function of flight time for—

(i) Each set of trajectories that characterizes a type of malfunction flight;

(ii) The probability of each set of trajectories that characterizes a type of malfunction flight; and

(iii) A set of trajectories that characterizes the limits of a useful mission as described in paragraph (a)(3) of this section.

§ 450.121

Debris analysis.

(a) General. A flight safety analysis must include an analysis characterizing the hazardous debris generated from normal and malfunctioning vehicle flight as a function of vehicle flight sequence.

(b) Vehicle impact and breakup analysis. A debris analysis must account for:

(1) Each reasonably foreseeable cause of vehicle breakup and intact impact,

(2) Vehicle structural characteristics and materials, and

(3) Energetic effects during break-up or at impact.

(c) Propagation of debris. A debris analysis must compute statistically valid debris impact probability distributions. The propagation of debris from each predicted breakup location to impact must account for—

(1) All foreseeable forces that can influence any debris impact location; and

(2) All foreseeable sources of impact dispersion, including, at a minimum:

(i) The uncertainties in atmospheric conditions;

(ii) Debris aerodynamic parameters, including uncertainties;

(iii) Pre-breakup position and velocity, including uncertainties; and

(iv) Breakup-imparted velocities, including uncertainties.

(d) Application requirements. An applicant must submit:

(1) A description of all scenarios that can lead to hazardous debris;

(2) A description of the methods used to perform the vehicle impact and breakup analysis, in accordance with § 450.115(c);

(3) A description of the methods used to compute debris impact distributions, in accordance with § 450.115(c);

(4) A description of the atmospheric data used as input to the debris analysis; and

(5) A quantitative description of the physical, aerodynamic, and harmful characteristics of hazardous debris.

§ 450.123

Population exposure analysis.

(a) General. A flight safety analysis must account for the distribution of people for the entire region where there is a significant probability of impact of hazardous debris.

(b) Constraints. The exposure analysis must—

(1) Characterize the distribution of people both geographically and temporally;

(2) Account for the distribution of people among structures and vehicle types;

(3) Use reliable, accurate, and timely source data; and

(4) Account for vulnerability of people to hazardous debris effects.

(c) Application requirements. An applicant must submit:

(1) A description of the methods used to develop the exposure input data in accordance with § 450.115(c), and

(2) Complete population exposure data, in tabular form.

§ 450.131

Probability of failure analysis.

(a) General. For each hazard and phase of flight, a flight safety analysis for a launch or reentry must account for vehicle failure probability. The probability of failure must be consistent for all hazards and phases of flight.

(1) For a vehicle or vehicle stage with fewer than two flights, the failure probability estimate must account for the outcome of all previous flights of vehicles developed and launched or reentered in similar circumstances.

(2) For a vehicle or vehicle stage with two or more flights, vehicle failure probability estimates must account for the outcomes of all previous flights of the vehicle or vehicle stage in a statistically valid manner. The outcomes of all previous flights of the vehicle or vehicle stage must account for data on any mishap and anomaly.

(b) Failure. For flight safety analysis purposes, a failure occurs when a vehicle does not complete any phase of normal flight or when any anomalous condition exhibits the potential for a stage or its debris to impact the Earth or reenter the atmosphere outside the normal trajectory envelope during the mission or any future mission of similar vehicle capability.

(c) Previous flight. For flight safety analysis purposes—

(1) The flight of a launch vehicle begins at a time in which a launch vehicle lifts off from the surface of the Earth; and

(2) The flight of a reentry vehicle or deorbiting upper stage begins at a time in which a vehicle attempts to initiate a reentry.

(d) Allocation. The vehicle failure probability estimate must be distributed across flight phases and failure modes. The distribution must be consistent with—

(1) The data available from all previous flights of vehicles developed and launched or reentered in similar circumstances; and

(2) Data from previous flights of vehicles, stages, or components developed and launched, reentered, flown, or tested by the subject vehicle developer or operator. Such data may include previous experience involving similar—

(i) Vehicle, stage, or component design characteristics;

(ii) Development and integration processes, including the extent of integrated system testing; and

(iii) Level of experience of the vehicle operation and development team members.

(e) Observed vs. conditional failure rate. Probability of failure allocation must account for significant differences in the observed failure rate and the conditional failure rate. A probability of failure analysis must use a constant conditional failure rate for each phase of flight, unless there is clear and convincing evidence of a different conditional failure rate for a particular vehicle, stage, or phase of flight.

(f) Application requirements. An applicant must submit:

(1) A description of the methods used in probability of failure analysis, in accordance with § 450.115(c); and

(2) A representative set of tabular data and graphs of the predicted failure rate and cumulative failure probability for each foreseeable failure mode.

§ 450.133

Flight hazard area analysis.

(a) General. A flight safety analysis must include a flight hazard area analysis that identifies any region of land, sea, or air that must be surveyed, publicized, controlled, or evacuated in order to control the risk to the public. The analysis must account for, at a minimum—

(1) The regions of land, sea, and air potentially exposed to hazardous debris generated during normal flight events and all reasonably foreseeable failure modes;

(2) Any hazard controls implemented to control risk from any hazard;

(3) The limits of a launch or reentry vehicle's normal flight, including—

(i) Atmospheric conditions that are no less severe than the worst atmospheric conditions under which flight might be attempted; and

(ii) Uncertainty in the atmospheric conditions;

(4) All hazardous debris;

(5) Sources of debris dispersion in accordance with § 450.121(c); and

(6) A probability of one for any planned debris hazards or planned impacts.

(b) Waterborne vessel hazard areas. The flight hazard area analysis for waterborne vessels must determine the areas and durations for regions of water—

(1) That are necessary to contain, with 97 percent probability of containment, all debris resulting from normal flight events capable of causing a casualty to persons on waterborne vessels;

(2) That are necessary to contain either where the probability of debris capable of causing a casualty impacting on or near a vessel would exceed 1 × 10⁻⁵, accounting for all relevant hazards, or where the individual probability of casualty for any person on board a vessel would exceed the individual risk criteria in § 450.101(a)(2) or (b)(2); and

(3) Where reduced vessel traffic is necessary to meet the collective risk criteria in § 450.101(a)(1) or (b)(1).

(c) Land hazard areas. The flight hazard area analysis for land must determine the durations and areas regions of land—

(1) That are necessary to contain, with 97 percent probability of containment, all debris resulting from normal flight events capable of causing a casualty to any person on land;

(2) Where the individual probability of casualty for any person on land would exceed the individual risk criteria in § 450.101(a)(2) or (b)(2); and

(3) Where reduced population is necessary to meet the collective risk criteria in § 450.101(a)(1) or (b)(1).

(d) Airspace hazard volumes. The flight hazard area analysis for airspace must determine the durations and volumes for regions of air to be submitted to the FAA for approval—

(1) That are necessary to contain, with 97 percent probability of containment, all debris resulting from normal flight events capable of causing a casualty to persons on an aircraft; and

(2) Where the probability of impact on an aircraft would exceed the aircraft risk criterion in § 450.101(a)(3) or (b)(3).

(e) Application requirements. An applicant must submit:

(1) A description of the methodology to be used in the flight hazard area analysis in accordance with § 450.115(c), including:

(i) Classes of waterborne vessel and vulnerability criteria employed; and

(ii) Classes of aircraft and vulnerability criteria employed.

(2) Tabular data and graphs of the results of the flight hazard area analysis, including:

(i) Geographical coordinates of all hazard areas that are representative of those to be published, in accordance with § 450.161, prior to any proposed operation;

(ii) Representative 97 percent probability of containment contours for all debris resulting from normal flight events capable of causing a casualty for all locations specified in paragraph (a) of this section;

(iii) Representative individual probability of casualty contours for all locations specified in paragraph (a) of this section, including tabular data and graphs showing the hypothetical location of any member of the public that could be exposed to a probability of casualty of 1 × 10⁻⁵ or greater for neighboring operations personnel, and 1 × 10⁻⁶ or greater for other members of the public, given all foreseeable conditions within the flight commit criteria;

(iv) If applicable, representative 1 × 10⁻⁵ and 1 × 10⁻⁶ probability of impact contours for all debris capable of causing a casualty to persons on a waterborne vessel regardless of location; and

(v) Representative 1 × 10⁻⁶ and 1 × 10⁻⁷ probability of impact contours for all debris capable of causing a casualty to persons on an aircraft regardless of location.

§ 450.135

Debris risk analysis.

(a) General. A flight safety analysis must include a debris risk analysis that demonstrates compliance with safety criteria in § 450.101, either—

(1) Prior to the day of the operation, accounting for all foreseeable conditions within the flight commit criteria; or

(2) During the countdown using the best available input data, including flight commit criteria and flight abort rules.

(b) Casualty area and consequence analysis. A debris risk analysis must model the casualty area, and compute the predicted consequences of each reasonably foreseeable failure mode in any significant period of flight in terms of conditional expected casualties. The casualty area and consequence analysis must account for—

(1) All relevant debris fragment characteristics and the characteristics of a representative person exposed to any potential debris hazard;

(2) Statistically-valid debris impact probability distributions;

(3) Any impact or effects of hazardous debris; and

(4) The vulnerability of people to debris impact or effects, including:

(i) Effects of buildings, ground vehicles, waterborne vessel, and aircraft upon the vulnerability of any occupants;

(ii) Effect of atmospheric conditions on debris impact and effects;

(iii) Impact speed and angle, accounting for motion of impacted vehicles;

(iv) Uncertainty in input data, such as fragment impact parameters; and

(v) Uncertainty in modeling methodology.

(c) Application requirements. An applicant must submit:

(1) A description of the methods used to demonstrate compliance with the safety criteria in § 450.101, in accordance with § 450.115(c), including a description of how the operator will account for the conditions immediately prior to enabling the flight of a launch vehicle or the reentry of a reentry vehicle, such as the final trajectory, atmospheric conditions, and the exposure of people;

(2) A description of the atmospheric data used as input to the debris risk analysis;

(3) The effective unsheltered casualty area for all fragment classes, assuming a representative impact vector;

(4) The effective casualty area for all fragment classes for a representative type of building, ground vehicle, waterborne vessel, and aircraft, assuming a representative impact vector;

(5) Collective and individual debris risk analysis outputs under representative conditions and the worst foreseeable conditions, including:

(i) Total collective casualty expectation for the proposed operation;

(ii) A list of the collective risk contribution for at least the top ten population centers and all centers with collective risk exceeding 1 percent of the collective risk criteria in § 450.101(a)(1) or (b)(1);

(iii) A list of the maximum individual probability of casualty for the top ten population centers and all centers that exceed 10 percent of the individual risk criteria in § 450.101(a)(2) or (b)(2); and

(iv) A list of the conditional collective casualty expectation for each failure mode for each significant period of flight under representative conditions and the worst foreseeable conditions.

§ 450.137

Far-field overpressure blast effects analysis.

(a) General. A flight safety analysis must include a far-field overpressure blast effect analysis that demonstrates compliance with safety criteria in § 450.101, either—

(1) Prior to the day of the operation, accounting for all foreseeable conditions within the flight commit criteria; or

(2) During the countdown using the best available input data, including flight commit criteria and flight abort rules.

(b) Analysis constraints. The analysis must account for—

(1) The explosive capability of the vehicle and hazardous debris at impact and at altitude;

(2) The potential influence of meteorological conditions and terrain characteristics; and

(3) The potential for broken windows due to peak incident overpressures below 1.0 psi and related casualties based on the characteristics of exposed windows and the population's susceptibility to injury, with considerations including, at a minimum, shelter types, window types, and the time of day of the proposed operation.

(c) Application requirements. An applicant must submit a description of the far-field overpressure analysis, including all assumptions and justifications for the assumptions, analysis methods, input data, and results. At a minimum, the application must include:

(1) A description of the population centers, terrain, building types, and window characteristics used as input to the far-field overpressure analysis;

(2) A description of the methods used to compute the foreseeable explosive yield probability pairs, and the complete set of yield-probability pairs, used as input to the far-field overpressure analysis;

(3) A description of the methods used to compute peak incident overpressures as a function of distance from the explosion and prevailing meteorological conditions, including sample calculations for a representative range of the foreseeable meteorological conditions, yields, and population center locations;

(4) A description of the methods used to compute the probability of window breakage, including tabular data and graphs for the probability of breakage as a function of the peak incident overpressure for a representative range of window types, building types, and yields accounted for;

(5) A description of the methods used to compute the probability of casualty for a representative individual, including tabular data and graphs for the probability of casualty, as a function of location relative to the window and the peak incident overpressure for a representative range of window types, building types, and yields accounted for;

(6) Tabular data and graphs showing the hypothetical location of any member of the public that could be exposed to a probability of casualty of 1 × 10⁻⁵ or greater for neighboring operations personnel, and 1 × 10⁻⁶ or greater for other members of the public, given foreseeable conditions;

(7) The maximum expected casualties that could result from far-field overpressure hazards given foreseeable conditions; and

(8) A description of the meteorological measurements used as input to any real-time far-field overpressure analysis.

§ 450.139

Toxic hazards for flight.

(a) Applicability. (1) Except as specified in paragraph (a)(2), this section applies to any launch or reentry vehicle, including all vehicle components and payloads, that use toxic propellants or other toxic chemicals.

(2) No toxic release hazard analysis is required for kerosene-based fuels, unless the Administrator determines that an analysis is required to protect public safety.

(b) General. An operator must—

(1) Conduct a toxic release hazard analysis in accordance with paragraph (c) of this section;

(2) Manage the risk of casualties that could arise from the exposure to toxic release through one of the following means:

(i) Contain hazards caused by toxic release in accordance with paragraph (d) of this section; or

(ii) Perform a toxic risk assessment, in accordance with paragraph (e) of this section, that protects the public in compliance with the safety criteria of § 450.101, including toxic release hazards.

(3) Establish flight commit criteria based on the results of its toxic release hazard analysis and toxic containment or toxic risk assessment for any necessary evacuation of the public from any toxic hazard area.

(c) Toxic release hazard analysis. A toxic release hazard analysis must—

(1) Account for any toxic release that could occur during nominal or non-nominal flight;

(2) Include a worst-case release scenario analysis or a maximum-credible release scenario analysis for each process that involves a toxic propellant or other chemical;

(3) Determine if toxic release can occur based on an evaluation of the chemical compositions and quantities of propellants, other chemicals, vehicle materials, and projected combustion products, and the possible toxic release scenarios;

(4) Account for both normal combustion products and any unreacted propellants and phase change or chemical derivatives of released substances; and

(5) Account for any operational constraints and emergency procedures that provide protection from toxic release.

(d) Toxic containment. An operator using toxic containment must manage the risk of any casualty from the exposure to toxic release either by—

(1) Evacuating, or being prepared to evacuate, the public from any toxic hazard area in the event of a worst-case release or maximum-credible release scenario; or

(2) Employing meteorological constraints to limit an operation to times during which prevailing winds and other conditions ensure that any member of the public would not be exposed to toxic concentrations and durations greater than accepted toxic thresholds for acute casualty in the event of a worst-case release or maximum-credible release scenario.

(e) Toxic risk assessment. An operator using toxic risk assessment must establish flight commit criteria that demonstrate compliance with the safety criteria of § 450.101. A toxic risk assessment must—

(1) Account for airborne concentration and duration thresholds of toxic propellants or other chemicals. For any toxic propellant, other chemicals, or combustion product, an operator must use airborne toxic concentration and duration thresholds identified in a means of compliance accepted by the Administrator;

(2) Account for physical phenomena expected to influence any toxic concentration and duration in the area surrounding the potential release site;

(3) Determine a toxic hazard area for the launch or reentry, surrounding the potential release site for each toxic propellant or other chemical based on the amount and toxicity of the propellant or other chemical, the exposure duration, and the meteorological conditions involved;

(4) Account for all members of the public who may be exposed to the toxic release, including all members of the public on land and on any waterborne vessels, populated offshore structures, and aircraft that are not operated in direct support of the launch or reentry; and

(5) Account for any risk mitigation measures applied in the risk assessment.

(f) Application requirements. An applicant must submit:

(1) The identity of toxic propellant, chemical, or combustion products or derivatives in the possible toxic release;

(2) The applicant's selected airborne toxic concentration and duration thresholds;

(3) The meteorological conditions for the atmospheric transport and buoyant cloud rise of any toxic release from its source to downwind receptor locations;

(4) Characterization of the terrain, as input for modeling the atmospheric transport of a toxic release from its source to downwind receptor locations;

(5) The identity of the toxic dispersion model used, and any other input data;

(6) Representative results of an applicant's toxic dispersion modeling to predict concentrations and durations at selected downwind receptor locations, to determine the toxic hazard area for a released quantity of the toxic substance;

(7) A toxic release hazard analysis in accordance with paragraph (c) of this section:

(i) A description of the failure modes and associated relative probabilities for potential toxic release scenarios used in the risk evaluation; and

(ii) The methodology and representative results of an applicant's determination of the worst-case or maximum-credible quantity of any toxic release that might occur during the flight of a vehicle;

(8) In accordance with § 450.139(b)(2),

(i) A toxic containment in accordance with paragraph (d) of this section, identify the evacuation plans or meteorological constraints and associated launch commit criteria needed to ensure that the public will not be within a toxic hazard area in the event of a worst-case release or maximum-credible release scenario; or

(ii) A toxic risk assessment in accordance with paragraph (e) of this section:

(A) A demonstration that the safety criteria in § 450.101 will be met;

(B) The population characteristics in receptor locations that are identified by toxic dispersion modeling as toxic hazard areas;

(C) A description of any risk mitigations applied in the toxic risk assessment; and

(D) A description of the population exposure input data used in accordance with § 450.123.

Prescribed Hazard Controls for Safety-Critical Hardware and Computing Systems

§ 450.141

Computing systems.

(a) Identification of computing system safety items. An operator must identify:

(1) Any software or data that implements a capability that, by intended operation, unintended operation, or non-operation, can present a hazard to the public; and

(2) The level of criticality of each computing system safety item identified in paragraph (a)(1) of this section, commensurate with its degree of control over hazards to the public and the severity of those hazards.

(b) Safety requirements. An operator must develop safety requirements for each computing system safety item. In doing so, the operator must:

(1) Identify and evaluate safety requirements for each computing system safety item;

(2) Ensure the safety requirements are complete and correct;

(3) Implement each safety requirement; and

(4) Verify and validate the implementation of each safety requirement by using a method appropriate for the level of criticality of the computing system safety item. For each computing system safety item that is safety critical under § 401.7, verification and validation must include testing by a test team independent of the development division or organization.

(c) Development process. An operator must implement and document a development process for computing system safety items appropriate for the level of criticality of the computing system safety item. A development process must define:

(1) Responsibilities for each task associated with a computing system safety item;

(2) Processes for internal review and approval—including review that evaluates the implementation of all safety requirements—such that no person approves that person's own work;

(3) Processes to ensure development personnel are trained, qualified, and capable of performing their role;

(4) Processes that trace requirements to verification and validation evidence;

(5) Processes for configuration management that specify the content of each released version of a computing system safety item;

(6) Processes for testing that verify and validate all safety requirements to the extent required by paragraph (b)(4) of this section;

(7) Reuse policies that verify and validate the safety requirements for reused computing system safety items; and

(8) Third-party product use policies that verify and validate the safety requirements for any third-party product.

(d) Application requirements. An applicant must:

(1) Identify and describe all computing system safety items involved in the proposed operations;

(2) Provide the safety requirements for each computing system safety item;

(3) Provide documentation of the development processes that meets paragraph (c) of this section;

(4) Provide evidence of the execution of the appropriate development process for each computing system safety item; and

(5) Provide evidence of the implementation of each safety requirement.

§ 450.143

Safety-critical system design, test, and documentation.

(a) Applicability. This section applies to all safety-critical systems, except for—

(1) Highly reliable flight safety systems covered under § 450.145; or

(2) Safety-critical systems for which an operator demonstrates through its flight hazard analysis that the likelihood of any hazardous condition specifically associated with the system that may cause death or serious injury to the public is extremely remote, pursuant to § 450.109(b)(3).

(b) Design. An operator must design safety-critical systems such that no credible fault can lead to increased risk to the public beyond nominal safety-critical system operation.

(c) Qualification testing of design. An operator must functionally demonstrate the design of the vehicle's safety-critical systems at conditions beyond its predicted operating environments. The operator must select environmental test levels that ensure the design is sufficiently stressed to demonstrate that system performance is not degraded due to design tolerances, manufacturing variances, or uncertainties in the environment.

(d) Acceptance of hardware. An operator must—

(1) Functionally demonstrate any safety-critical system, while exposed to its predicted operating environments with margin, is free of defects, free of integration and workmanship errors, and ready for operational use; or

(2) Combine in-process controls and a quality assurance process to ensure functional capability of any safety-critical system during its service life.

(e) Lifecycle of safety-critical systems. (1) The predicted operating environments must be based on conditions predicted to be encountered in all phases of flight, recovery, and transportation.

(2) An operator must monitor the flight environments experienced by safety-critical system components to the extent necessary to—

(i) Validate the predicted operating environments; and

(ii) Assess the actual component life remaining or adjust any inspection period.

(f) Application requirements. An applicant must submit to the FAA the following as part of its application:

(1) A list and description of each safety-critical system;

(2) Drawings and schematics for each safety-critical system;

(3) A summary of the analysis to determine the predicted operating environments and duration to be applied to qualification and acceptance testing covering the service life of any safety-critical system;

(4) A description of any method used to validate the predicted operating environments;

(5) A description of any instrumentation or inspection processes to monitor aging of any safety-critical system;

(6) The criteria and procedures for disposal or refurbishment for service life extension of safety-critical system components; and

(7) A description of the standards used in all phases of the lifecycle of each safety-critical system.

§ 450.145

Highly reliable flight safety system.

(a) General. For each phase of flight for which an operator must implement flight abort to meet the requirement of § 450.108(b)(1), the operator must use a highly reliable flight safety system on the launch or reentry vehicle, vehicle component, or payload with a design reliability in accordance with this section.

(b) Reliability. A highly reliable flight safety system must, using a means of compliance accepted by the Administrator—

(1) Have a design reliability of 0.999 at 95 percent confidence and commensurate design, analysis, and testing for the portion of the flight safety system onboard the vehicle; and

(2) Have a design reliability of 0.999 at 95 percent confidence and commensurate design, analysis, and testing for the portion of the flight safety system not onboard the vehicle, if used.

(c) Monitoring. An operator must monitor the flight environments experienced by any flight safety system component to the extent necessary to—

(1) Validate the predicted operating environment; and

(2) Assess the actual component life remaining or adjust any inspection period.

(d) Application requirements. An applicant must submit the information identified below, for any highly reliable flight safety system:

(1) Flight safety system description. An applicant must describe the flight safety system and its operation in detail, including all components, component functions, and possible operational scenarios.

(2) Flight safety system diagram. An applicant must submit a diagram that identifies all flight safety system subsystems and shows the interconnection of all the elements of the flight safety system. The diagram must include any subsystems used to implement flight abort both on and off the vehicle, including any subsystems used to make the decision to abort flight.

(3) Flight safety system analyses. An applicant must submit any analyses and detailed analysis reports of all flight safety system subsystems necessary to calculate the reliability and confidence levels required by paragraph (a) of this section.

(4) Tracking validation procedures. An applicant must document and submit the procedures for validating the accuracy of any vehicle tracking data utilized by the flight safety system to make the decision to abort flight.

(5) Flight safety system test plans. An applicant must submit acceptance, qualification, and preflight test plans of any flight safety system, subsystems, and components. The test plans must include test procedures and test environments.

(6) Monitoring plan. An applicant must submit a description of any method used to validate the predicted operating environments.

Other Prescribed Hazard Controls

§ 450.147

Agreements.

(a) General. An operator must establish a written agreement with any entity that provides a service or property that meets a requirement in this part, including:

(1) Launch and reentry site use agreements. A Federal launch or reentry site operator, a licensed launch or reentry site operator, or any other person that provides services or access to or use of property required to support the safe launch or reentry under this part;

(2) Agreements for notices to mariners. Unless otherwise addressed in agreements with the site operator, for overflight of navigable water, the U.S. Coast Guard or other applicable maritime authority to establish procedures for the issuance of a Notice to Mariners prior to a launch or reentry and other measures necessary to protect public health and safety;

(3) Agreements for notices to airmen. Unless otherwise addressed in agreements with the site operator, the FAA Air Traffic Organization or other applicable air navigation authority to establish procedures for the issuance of a Notice to Airmen prior to a launch or reentry, for closing of air routes during the respective launch and reentry windows, and for other measures necessary to protect public health and safety; and

(4) Mishap response. Emergency response providers, including local government authorities, to satisfy the requirements of § 450.173.

(b) Roles and responsibilities. The agreements required in this section must clearly delineate the roles and responsibilities of each party to support the safe launch or reentry under this part.

(c) Effective date. The agreements required in this section must be in effect before a license can be issued, unless otherwise agreed to by the Administrator.

(d) Application requirements. An applicant must—

(1) Describe each agreement in this section; and

(2) Provide a copy of any agreement, or portion thereof, to the FAA upon request.

§ 450.149

Safety-critical personnel qualifications.

(a) General. An operator must ensure safety-critical personnel are trained, qualified, and capable of performing their safety-critical tasks, and that their training is current.

(b) Application requirements. An applicant must—

(1) Identify safety-critical tasks that require qualified personnel;

(2) Provide internal training and currency requirements, completion standards, or any other means of demonstrating compliance with the requirements of this section; and

(3) Describe the process for tracking training currency.

§ 450.151

Work shift and rest requirements.

(a) General. For any launch or reentry, an operator must document and implement rest requirements that ensure safety-critical personnel are physically and mentally capable of performing all assigned tasks.

(b) Work shifts and deviation approval process. An operator's rest requirements must address the following:

(1) Duration of each work shift and the process for extending this shift, including the maximum allowable length of any extension;

(2) Number of consecutive work shift days allowed before rest is required;

(3) Minimum rest period required—

(i) Between each work shift, including the period of rest required immediately before the flight countdown work shift; and

(ii) After the maximum number of work shift days allowed; and

(4) Approval process for any deviation from the rest requirements.

(c) Application requirement. An applicant must submit rest rules that demonstrate compliance with the requirements of this section.

§ 450.153

Radio frequency management.

(a) General. For any radio frequency used, an operator must—

(1) Ensure radio frequency interference does not adversely affect performance of any flight safety system or safety-critical system; and

(2) Coordinate use of radio frequencies with any site operator and any local and Federal authorities.

(b) Application requirements. An applicant must submit procedures or other means to demonstrate compliance with the radio frequency requirements of this section.

§ 450.155

Readiness.

(a) General. An operator must document and implement procedures to assess readiness to proceed with the flight of a launch or reentry vehicle. These procedures must address, at a minimum, the following:

(1) Readiness of vehicle and launch, reentry, or landing site, including any contingency abort location;

(2) Readiness of safety-critical personnel, systems, software, procedures, equipment, property, and services; and

(3) Readiness to implement the mishap plan required by § 450.173.

(b) Application requirements. An applicant must—

(1) Demonstrate compliance with the requirements of paragraph (a) of this section through procedures that may include a readiness meeting close in time to flight; and

(2) Describe the criteria for establishing readiness to proceed with the flight of a launch or reentry vehicle so that public safety is maintained.

§ 450.157

Communications.

(a) An operator must implement communication procedures during the countdown and flight of a launch or reentry vehicle that—

(1) Define the authority of personnel, by individual or position title, to issue “hold/resume,” “go/no go,” and abort commands;

(2) Assign communication networks so that personnel identified in paragraph (a)(1) of this section have direct access to real-time, safety-critical information required to issue “hold/resume,” “go/no go,” and any abort commands; and

(3) Implement a protocol for using defined radio telephone communications terminology.

(b) An operator must ensure the currency of the communication procedures, and that all personnel are working with the approved version of the communication procedures.

(c) An operator must record all safety-critical communications network channels that are used for voice, video, or data transmissions that support safety-critical systems during each countdown.

§ 450.159

Pre-flight procedures.

(a) An operator must implement pre-flight procedures that—

(1) Verify that each flight commit criterion is satisfied before flight is initiated; and

(2) Ensure the operator can return the vehicle to a safe state after a countdown abort or delay.

(b) An operator must ensure the currency of the pre-flight procedures, and that all personnel are working with the approved version of the pre-flight procedures.

§ 450.161

Control of hazard areas.

(a) General. The operator must publicize, survey, control, or evacuate each flight hazard area identified in accordance with § 450.133 prior to initiating flight of a launch vehicle or the reentry of a reentry vehicle to the extent necessary to ensure compliance with § 450.101.

(b) Verification. The launch or reentry operator must perform surveillance sufficient to verify or update the assumptions, input data, and results of the flight safety analyses.

(c) Publication. An operator must publicize warnings for each flight hazard area, except for regions of land, sea, or air under the control of the vehicle operator, site operator, or other controlling authority with which the operator has an agreement. If the operator relies on another entity to publicize these warnings, it must:

(1) Determine whether the warnings have been issued; and

(2) Notify the FAA if the warnings have not been issued so that the FAA can determine if the launch or reentry can be conducted in a manner that sufficiently protects the public. This notification must provide sufficient information to enable FAA to issue warnings to U.S. aircraft.

(d) Application requirements. An applicant must submit—

(1) A description of how the applicant will provide for day-of-flight surveillance and control of flight hazard areas, if necessary, to ensure that the presence of any member of the public in or near a flight hazard area is consistent with flight commit criteria developed for each launch or reentry as required by § 450.165(b);

(2) A description of how the applicant will provide for any publication of flight hazard areas necessary to meet the requirements of this section; and

(3) A description of how the applicant will establish flight commit criteria based on the results of its toxic release hazard analysis, toxic containment, or toxic risk assessment for any necessary evacuation of the public from any toxic hazard area.

§ 450.163

Lightning hazard mitigation.

(a) Lightning hazard mitigation. An operator must—

(1) Establish flight commit criteria that mitigate the potential for a launch or reentry vehicle intercepting or initiating a direct lightning strike, or encountering a nearby discharge, using a means of compliance accepted by the Administrator; or

(2) Use a vehicle designed to protect safety-critical systems in the event of a direct lightning strike or nearby discharge.

(b) Application requirements. (1) An applicant electing to comply with paragraph (a)(1) of this section must submit flight commit criteria that mitigate the potential for a launch or reentry vehicle intercepting or initiating a direct lightning strike, or encountering a nearby lightning discharge.

(2) An applicant electing to comply with paragraph (a)(2) of this section must submit documentation providing evidence that the vehicle is designed to protect safety-critical systems against the effects of a direct lightning strike or nearby discharge.

§ 450.165

Flight commit criteria.

(a) General. For each launch or reentry, an operator must establish and observe flight commit criteria that identify each condition necessary prior to flight to satisfy the requirements of § 450.101, and must include:

(1) Surveillance of any region of land, sea, or air in accordance with § 450.161;

(2) Monitoring of any meteorological condition necessary to—

(i) Be consistent with any safety analysis required by this part; and

(ii) If necessary in accordance with § 450.163, mitigate the potential for a launch or reentry vehicle intercepting a lightning strike, or encountering a nearby discharge;

(3) Implementation of any launch or reentry window closure in the launch or reentry window for the purpose of collision avoidance in accordance with § 450.169;

(4) Confirmation that any safety-critical system is ready for flight;

(5) Confirmation from the FAA that the risk to critical assets satisfies the requirements of § 450.101(a)(4) or (b)(4);

(6) For any reentry vehicle, except a suborbital vehicle, monitoring by the operator or an onboard system that the status of safety-critical systems is healthy before enabling reentry flight, to assure the vehicle can reenter safely to Earth; and

(7) Any other hazard controls derived from any safety analysis required by this part.

(b) Application requirements. An applicant must submit a list of all flight commit criteria.

§ 450.167

Tracking.

(a) General. During the flight of a launch or reentry vehicle, an operator must measure and record in real time the position and velocity of the vehicle. The system used to track the vehicle must provide data to predict the expected impact locations of all stages and components, and to obtain vehicle performance data for comparison with the pre-flight performance predictions.

(b) Application requirements. An applicant must identify and describe each method or system used to meet the tracking requirements of paragraph (a) of this section.

§ 450.169

Launch and reentry collision avoidance analysis requirements.

(a) Criteria. Except as provided in paragraph (d) of this section, for an orbital or suborbital launch or reentry, an operator must establish window closures needed to ensure that the launch or reentry vehicle, any jettisoned components, or payloads meet the following requirements with respect to orbiting objects, not including any object being launched or reentered.

(1) For inhabitable objects, one of three criteria below must be met:

(i) The probability of collision between the launching or reentering objects and any inhabitable object must not exceed 1 × 10⁻⁶;

(ii) The launching or reentering objects must maintain an ellipsoidal separation distance of 200 km in-track and 50 km cross-track and radially from the inhabitable object; or

(iii) The launching or reentering objects must maintain a spherical separation distance of 200 km from the inhabitable object.

(2) For objects that are neither orbital debris nor inhabitable, one of the two criteria below must be met:

(i) The probability of collision between the launching or reentering objects and any object must not exceed 1 × 10⁻⁵; or

(ii) The launching or reentering objects must maintain a spherical separation distance of 25 km from the object.

(3) For all other known orbital debris identified by the FAA or other Federal Government entity as large objects with radar cross section greater than 1 m² and medium objects with radar cross section 0.1 m² to 1 m²:

(i) The probability of collision between the launching or reentering objects and any known orbital debris must not exceed 1 × 10⁻⁵; or

(ii) The launching or reentering objects must maintain a spherical separation distance of 2.5 km.

(b) Screening time. A launch or reentry operator must ensure the requirements of paragraph (a) of this section are met as follows:

(1) Through the entire segment of flight of a suborbital launch vehicle above 150 km;

(2) For an orbital launch, during ascent from a minimum of 150 km to initial orbital insertion and for a minimum of 3 hours from liftoff;

(3) For reentry, during descent from initial reentry burn to 150 km altitude; and

(4) For disposal, during descent from initial disposal burn to 150 km altitude.

(c) Rendezvous. Planned rendezvous operations that occur within the screening time frame are not considered a violation of collision avoidance if the involved operators have pre-coordinated the rendezvous or close approach.

(d) Exception. A launch collision avoidance analysis is not required for any launched object if the maximum planned altitude by that object is less than 150 km.

(e) Analysis. Collision avoidance analysis must be obtained for each launch or reentry from a Federal entity identified by the FAA, or another entity agreed to by the Administrator.

(1) An operator must use the results of the collision avoidance analysis to establish flight commit criteria for collision avoidance; and

(2) The collision avoidance analysis must account for uncertainties associated with launch or reentry vehicle performance and timing, and ensure that each window closure incorporates all additional time periods associated with such uncertainties.

(f) Timing and information required. An operator must prepare a collision avoidance analysis worksheet for each launch or reentry using a standardized format that contains the input data required by appendix A to this part, as follows:

(1) Except as specified in paragraphs (f)(1)(i) and (ii) of this section, an operator must file the input data with an entity identified in paragraph (e) of this section and the FAA at least 7 days before the first attempt at the flight of a launch vehicle or the reentry of a reentry vehicle.

(i) Operators that have never received a launch or reentry conjunction assessment from the entity identified in paragraph (e) of this section, must file the input data at least 15 days in advance.

(ii) The Administrator may agree to an alternative time frame in accordance with § 404.15;

(2) An operator must obtain a collision avoidance analysis performed by an entity identified in paragraph (e) of this section, no later than 3 hours before the beginning of a launch or reentry window; and

(3) If an operator needs an updated collision avoidance analysis due to a launch or reentry delay, the operator must file the request with the entity identified in paragraph (e) of this section and the FAA at least 12 hours prior to the beginning of the new launch or reentry window.

§ 450.171

Safety at end of launch.

(a) Orbital debris mitigation. An operator must ensure for any proposed launch that for all vehicle stages or components that reach Earth orbit—

(1) There is no unplanned physical contact between the vehicle or any of its components and the payload after payload separation;

(2) Debris generation does not result from the conversion of energy sources into energy that fragments the vehicle or its components. Energy sources include chemical, pressure, and kinetic energy; and

(3) For all vehicle stages or components that are left in orbit, stored energy is removed by depleting residual fuel and leaving all fuel line valves open, venting any pressurized system, leaving all batteries in a permanent discharge state, and removing any remaining source of stored energy.

(b) Application requirement. An applicant must demonstrate compliance with the requirements in paragraph (a) of this section.

§ 450.173

Mishap plan—reporting, response, and investigation requirements.

(a) General. An operator must report, respond to, and investigate mishaps, as defined in § 401.7 of this chapter, in accordance with paragraphs (b) through (g) of this section using a plan or other written means.

(b) Responsibilities. An operator must document—

(1) Responsibilities for personnel assigned to implement the requirements of this section;

(2) Reporting responsibilities for personnel assigned to conduct investigations and for anyone retained by the operator to conduct or participate in investigations; and

(3) Allocation of roles and responsibilities between the launch operator and any site operator for reporting, responding to, and investigating any mishap during ground activities at the site.

(c) Mishap reporting requirements. An operator must—

(1) Immediately notify the FAA Washington Operations Center in case of a mishap that involves a fatality or serious injury (as defined in 49 CFR 830.2);

(2) Notify within 24 hours the FAA Washington Operations Center in the case of a mishap that does not involve a fatality or serious injury (as defined in 49 CFR 830.2); and

(3) Submit a written preliminary report to the FAA Office of Commercial Space Transportation within five days of any mishap. The preliminary report must include the following information, as applicable:

(i) Date and time of the mishap;

(ii) Description of the mishap and sequence of events leading to the mishap, to the extent known;

(iii) Intended and actual location of the launch or reentry or other landing on Earth;

(iv) Hazardous debris impact points, including those outside a planned landing site or designated hazard area;

(v) Identification of the vehicle;

(vi) Identification of any payload;

(vii) Number and general description of any fatalities or injuries;

(viii) Description and estimated costs of any property damage;

(ix) Identification of hazardous materials, as defined in § 401.7 of this chapter, involved in the event, whether on the vehicle, any payload, or on the ground;

(x) Action taken by any person to contain the consequences of the event;

(xi) Weather conditions at the time of the event; and

(xii) Potential consequences for other similar vehicles, systems, or operations.

(d) Emergency response requirements. An operator must—

(1) Activate emergency response services to protect the public and property following a mishap as necessary including, but not limited to:

(i) Evacuating and rescuing members of the public, taking into account debris dispersion and toxic plumes; and

(ii) Extinguishing fires;

(2) Maintain existing hazard area surveillance and clearance as necessary to protect public safety;

(3) Contain and minimize the consequences of a mishap, including:

(i) Securing impact areas to ensure that no members of the public enter;

(ii) Safely disposing of hazardous materials; and

(iii) Controlling hazards at the site or impact areas.

(4) Preserve data and physical evidence; and

(5) Implement agreements with government authorities and emergency response services, as necessary, to satisfy the requirements of this section.

(e) Mishap investigation requirements. In the event of a mishap, an operator must—

(1) Investigate the root causes of the mishap; and

(2) Report investigation results to the FAA.

(f) Preventative measures. An operator must identify and implement preventive measures for avoiding recurrence of the mishap prior to the next flight, unless otherwise approved by the Administrator.

(g) Mishap records. An operator must maintain records associated with the mishap in accordance with § 450.219(b).

(h) Application requirements. An applicant must submit the plan or other written means required by this section.

§ 450.175

Test-induced damage.

(a) Applicability. This section applies to license applicants or operators seeking an optional test-induced damage exception.

(b) Coordination of potential test-induced damage. Test-induced damage is not a mishap if all of the following are true:

(1) A license applicant or operator coordinates potential test-induced damage with the FAA before the planned activity, and with sufficient time for the FAA to evaluate the operator's proposal during the application process or as a license modification;

(2) The test-induced damage did not result in any of the following:

(i) Serious injury or fatality (as defined in 49 CFR 830.2);

(ii) Damage to property not associated with the licensed activity; or

(iii) Hazardous debris leaving the pre-defined hazard area; and

(3) The test-induced damage falls within the scope of activities coordinated with the FAA in paragraph (b)(1) of this section.

(c) Application requirements. An applicant must submit the following information—

(1) Test objectives;

(2) Test limits;

(3) Expected outcomes;

(4) Potential risks, including the applicant's best understanding of the uncertainties in environments, test limits, or system performance;

(5) Applicable procedures;

(6) Expected time and duration of the test; and

(7) Additional information as required by the FAA to ensure protection of public health and safety, safety of property, and the national security and foreign policy interests of the United States.

§ 450.177

Unique safety policies, requirements, and practices.

(a) Unique hazards. An operator must review operations, system designs, analysis, and testing, and identify any unique hazards not otherwise addressed by this part. An operator must implement any unique safety policy, requirement, or practice needed to protect the public from the unique hazard.

(b) Unique requirements. The FAA may identify and impose a unique policy, requirement, or practice as needed to protect the public health and safety.

(c) Application requirements. An applicant must—

(1) Identify any unique safety policy, requirement, or practice necessary in accordance with paragraph (a) of this section, and demonstrate that each unique safety policy, requirement, or practice protects public health and safety.

(2) Demonstrate compliance with each unique safety policy, requirement, or practice imposed by the FAA in accordance with paragraph (b) of this section.

Ground Safety

§ 450.179

Ground safety—general.

(a) At a U.S. launch or reentry site, an operator must protect the public and property from adverse effects of hazardous operations and systems associated with—

(1) Preparing a launch vehicle for flight;

(2) Returning a launch or reentry vehicle to a safe condition after landing, or after an aborted launch attempt; and

(3) Returning a site to a safe condition.

(b) An operator is not required to comply with §§ 450.181 through 450.189 of this part if:

(1) The launch or reentry is being conducted from a Federal launch or reentry site;

(2) The operator has a written agreement with the Federal launch or reentry site for the provision of ground safety services and oversight; and

(3) The Administrator has determined that the Federal launch or reentry site's ground safety processes, requirements, and oversight are not inconsistent with the Secretary's statutory authority over commercial space activities.

(c) In making the determination required by paragraph (b)(3) of this section, the Administrator will consider the nature and frequency of launch and reentry activities conducted from the Federal launch or reentry site, coordination between the FAA and the Federal launch or reentry site safety personnel, and the Administrator's knowledge of the Federal launch or reentry site's requirements.

§ 450.181

Coordination with a site operator.

(a) General. For a launch or reentry conducted from or to a Federal launch or reentry site or a site licensed under part 420 or 433 of this chapter, an operator must coordinate with the site operator to—

(1) Ensure public access is controlled where and when necessary to protect public safety;

(2) Ensure launch or reentry operations are coordinated with other launch and reentry operators and other affected parties to prevent unsafe interference;

(3) Designate any ground hazard area that affects the operations of a launch or reentry site; and

(4) Ensure a prompt and effective response is undertaken in the event of a mishap that could impact the safety of the public and property.

(b) Licensed site operator. For a launch or reentry conducted from or to a site licensed under part 420 or 433 of this chapter, an operator must also coordinate with the site operator to establish roles and responsibilities for reporting, responding to, and investigating any mishap during ground activities at the site.

(c) Application requirement. An applicant must describe how it is coordinating with a Federal or licensed launch or reentry site operator in compliance with this section.

§ 450.183

Explosive site plan.

(a) Explosive siting requirements. For a launch or reentry conducted from or to a site exclusive to its own use, an operator must comply with the explosive siting requirements of §§ 420.63, 420.65, 420.66, 420.67, 420.69, and 420.70 of this chapter.

(b) Application requirement. An applicant must submit an explosive site plan in accordance with paragraph (a) of this section.

§ 450.185

Ground hazard analysis.

An operator must perform and document a ground hazard analysis, and continue to maintain it throughout the lifecycle of the launch or reentry system. The analysis must—

(a) Hazard identification. Identify system and operation hazards posed by the vehicle and ground hardware, including site and ground support equipment. Hazards identified must include the following:

(1) System hazards, including:

(i) Vehicle over-pressurization;

(ii) Sudden energy release, including ordnance actuation;

(iii) Ionizing and non-ionizing radiation;

(iv) Fire or deflagration;

(v) Radioactive materials;

(vi) Toxic release;

(vii) Cryogens;

(viii) Electrical discharge; and

(ix) Structural failure.

(2) Operation hazards, including:

(i) Propellant handling and loading;

(ii) Transporting of vehicle or vehicle components;

(iii) Vehicle testing; and

(iv) Vehicle or system activation.

(b) Hazard assessment. Assess each hazard's likelihood and severity.

(c) Risk acceptability criteria. Ensure that the risk associated with each hazard meets the following criteria:

(1) The likelihood of any hazardous condition that may cause death or serious injury to the public must be extremely remote; and

(2) The likelihood of any hazardous condition that may cause major damage to property not associated with the launch or reentry must be remote.

(d) Risk mitigation. Identify and describe the risk elimination and mitigation measures required to satisfy paragraph (c) of this section.

(e) Validation and verification. Document that the risk elimination and mitigation measures achieve the risk levels of paragraph (c) of this section through validation and verification. Verification includes:

(1) Analysis;

(2) Test;

(3) Demonstration; or

(4) Inspection.

(f) Application requirements. An applicant must submit—

(1) A description of the methodology used to perform the ground hazard analysis;

(2) A list of all systems and operations that may cause a hazard involving the vehicle or any payload; and

(3) The ground hazard analysis products of paragraphs (a) through (e) of this section, including data that verifies the risk elimination and mitigation measures.

§ 450.187

Toxic hazards mitigation for ground operations.

(a) Applicability. (1) Except as specified in paragraph (a)(2), this section applies to any launch or reentry vehicle, including all vehicle components and payloads, that use toxic propellants or other toxic chemicals.

(2) No toxic release hazard analysis is required for kerosene-based fuels, unless the Administrator determines that an analysis is required to protect public safety.

(b) General. An operator must—

(1) Conduct a toxic release hazard analysis in accordance with paragraph (c) of this section;

(2) Manage the risk of casualties that could arise from the exposure to toxic release through one of the following means:

(i) Contain hazards caused by toxic release in accordance with paragraph (d) of this section; or

(ii) Perform a toxic risk assessment, in accordance with paragraph (e) of this section, that demonstrates compliance with the risk criteria of § 450.185(c).

(3) Establish ground hazard controls based on the results of its toxic release hazard analysis and toxic containment or toxic risk assessment for any necessary evacuation of the public from any toxic hazard area.

(c) Toxic release hazard analysis. A toxic release hazard analysis must—

(1) Account for any toxic release that could occur during nominal or non-nominal launch or reentry ground operations;

(2) Include a worst-case release scenario analysis or a maximum-credible release scenario analysis for each process that involves a toxic propellant or other chemical;

(3) Determine if toxic release can occur based on an evaluation of the chemical compositions and quantities of propellants, other chemicals, vehicle materials, and projected combustion products, and the possible toxic release scenarios;

(4) Account for both normal combustion products and any unreacted propellants and phase change or chemical derivatives of released substances; and

(5) Account for any operational constraints and emergency procedures that provide protection from toxic release.

(d) Toxic containment. An operator using toxic containment must manage the risk of casualty from the exposure to toxic release either by—

(1) Evacuating, or being prepared to evacuate, the public from any toxic hazard area in the event of a worst-case release or maximum credible release scenario; or

(2) Employing meteorological constraints to limit a ground operation to times during which prevailing winds and other conditions ensure that the public would not be exposed to toxic concentrations and durations greater than accepted toxic thresholds for acute casualty in the event of a worst-case release or maximum credible release scenario.

(e) Toxic risk assessment. An operator using toxic risk assessment must manage the risk from any toxic release hazard and demonstrate compliance with the criteria in § 450.185(c). A toxic risk assessment must—

(1) Account for airborne concentration and duration thresholds of toxic propellants or other chemicals. For any toxic propellant, other chemicals, or combustion product, an operator must use airborne toxic concentration and duration thresholds identified in a means of compliance accepted by the Administrator;

(2) Account for physical phenomena expected to influence any toxic concentration and duration in the area surrounding the potential release site;

(3) Determine a toxic hazard area for each process surrounding the potential release site for each toxic propellant or other chemical based on the amount and toxicity of the propellant or other chemical, the exposure duration, and the meteorological conditions involved;

(4) Account for all members of the public that may be exposed to the toxic release; and

(5) Account for any risk mitigation measures applied in the risk assessment.

(f) Application requirements. An applicant must submit:

(1) The identity of the toxic propellant, chemical, or combustion products or derivatives in the possible toxic release;

(2) The applicant's selected airborne toxic concentration and duration thresholds;

(3) The meteorological conditions for the atmospheric transport and buoyant cloud rise of any toxic release from its source to downwind receptor locations;

(4) Characterization of the terrain, as input for modeling the atmospheric transport of a toxic release from its source to downwind receptor locations;

(5) The identity of the toxic dispersion model used, and any other input data;

(6) Representative results of an applicant's toxic dispersion modeling to predict concentrations and durations at selected downwind receptor locations, to determine the toxic hazard area for a released quantity of the toxic substance;

(7) For toxic release hazard analysis in accordance with paragraph (c) of this section:

(i) A description of the failure modes and associated relative probabilities for potential toxic release scenarios used in the risk evaluation; and

(ii) The methodology and representative results of an applicant's determination of the worst-case or maximum-credible quantity of any toxic release that might occur during ground operations;

(8) For toxic containment in accordance with paragraph (d) of this section, identify the evacuation plans or meteorological constraints and associated ground hazard controls needed to ensure that the public will not be within any toxic hazard area in the event of a worst-case release or maximum credible release scenario.

(9) For toxic risk assessment in accordance with paragraph (e) of this section:

(i) A demonstration that the risk criteria in § 450.185(c) will be met;

(ii) The population characteristics in receptor locations that are identified by toxic dispersion modeling as toxic hazard areas;

(iii) A description of any risk mitigation measures applied in the toxic risk assessment; and

(iv) A description of the population exposure input data used in accordance with § 450.123.

§ 450.189

Ground safety prescribed hazard controls.

(a) General. In addition to the hazard controls derived from an operator's ground hazard analysis and toxic hazard analysis, an operator must comply with paragraphs (b) through (e) of this section.

(b) Protection of public on the site. An operator must document a process for protecting members of the public who enter any area under the control of a launch or reentry operator, including:

(1) Procedures for identifying and tracking the public while on the site; and

(2) Methods the operator uses to protect the public from hazards in accordance with the ground hazard analysis and toxic hazard analysis.

(c) Countdown abort. Following a countdown abort or recycle operation, an operator must establish, maintain, and perform procedures for controlling hazards related to the vehicle and returning the vehicle, stages, or other flight hardware and site facilities to a safe condition. When a launch vehicle does not liftoff after a command to initiate flight was sent, an operator must—

(1) Ensure that the vehicle and any payload are in a safe configuration;

(2) Prohibit entry of the public into any identified hazard areas until the site is returned to a safe condition; and

(3) Maintain and verify that any flight safety system remains operational until verification that the launch vehicle does not represent a risk of inadvertent flight.

(d) Fire suppression. An operator must have reasonable precautions in place to report and control any fire caused by licensed activities.

(e) Emergency procedures. An operator must have general emergency procedures that apply to any emergencies not covered by the mishap plan of § 450.173 that may create a hazard to the public.

(f) Application requirement. An applicant must submit the process for protecting members of the public who enter any area under the control of a launch or reentry operator in accordance with paragraph (b) of this section.

Subpart D—Terms and Conditions of a Vehicle Operator License

§ 450.201

Responsibility for public safety and safety of property.

A licensee is responsible for ensuring public safety and safety of property during the conduct of a licensed launch or reentry.

§ 450.203

Compliance.

A licensee must conduct a licensed launch or reentry in accordance with representations made in its license application, the requirements of subparts C and D of this part, and the terms and conditions contained in the license. A licensee's failure to act in accordance with the representations made in the license application, the requirements of subparts C and D of this part, and the terms and conditions contained in the license, is sufficient basis for the revocation of a license or other appropriate enforcement action.

§ 450.205

Financial responsibility requirements.

A licensee must comply with financial responsibility requirements of part 440 of this chapter and as specified in a license or license order.

§ 450.207

Human spaceflight requirements.

A licensee conducting a launch or reentry with a human being on board the vehicle must comply with human spaceflight requirements of part 460 of this chapter as specified in a license or license order.

§ 450.209

Compliance monitoring.

(a) A licensee must allow access by, and cooperate with, Federal officers or employees or other individuals authorized by the FAA to observe any of its activities, or any of its contractors' or subcontractors' activities, associated with the conduct of a licensed launch or reentry.

(b) For each licensed launch or reentry, a licensee must provide the FAA with a console for monitoring the progress of the countdown and communication on all channels of the countdown communications network, unless the licensee has another acceptable means. A licensee must also provide the FAA with the capability to communicate with the mission director designated by § 450.103(a)(1).

§ 450.211

Continuing accuracy of license application; application for modification of license.

(a) A licensee is responsible for the continuing accuracy of representations contained in its application for the entire term of the license.

(b) After a license has been issued, a licensee must apply to the FAA for modification of the license if—

(1) The licensee proposes to conduct a launch or reentry in a manner not authorized by the license; or

(2) Any representation contained in the license application that is material to public health and safety or the safety of property is no longer accurate and complete or does not reflect the licensee's procedures governing the actual conduct of a launch or reentry. A change is material to public health and safety or the safety of property if it alters or affects—

(i) The class of payload;

(ii) The type of launch or reentry vehicle;

(iii) The type or quantity of hazardous material;

(iv) The flight trajectory;

(v) The launch site or reentry site or other landing site; or

(vi) Any system, policy, procedure, requirement, criteria, or standard that is safety critical.

(c) An application to modify a license must be prepared and submitted in accordance with part 413 of this chapter. If requested during the application process, the FAA may approve an alternate method for requesting license modifications. The licensee must indicate any part of its license or license application that would be changed or affected by a proposed modification.

(d) Upon approval of a modification, the FAA issues either a written approval to the licensee or a license order amending the license if a stated term or condition of the license is changed, added, or deleted. An approval has the full force and effect of a license order and is part of the licensing record.

§ 450.213

Pre-flight reporting.

(a) Reporting method. A licensee must send the information in this section as an email attachment to [e-mail], or other method as agreed to by the Administrator in the license.

(b) Mission information. A licensee must submit to the FAA the following mission-specific information no less than 60 days before each mission conducted under the license, unless the Administrator agrees to a different time frame in accordance with § 404.15 in the license, except when the information was provided in the license application:

(1) Payload information in accordance with § 450.43(i); and

(2) Planned mission information, including the vehicle, launch site, planned flight path, staging and impact locations, each payload delivery point, intended reentry or landing sites including any contingency abort location, and the location of any disposed launch or reentry vehicle stage or component that is deorbited.

(c) Flight abort and flight safety analysis products. A licensee must submit to the FAA updated flight abort and flight safety analysis products, using methodologies previously approved by the FAA, for each mission no less than 30 days before flight, unless the Administrator agrees to a different time frame in accordance with § 404.15 in the license.

(1) A licensee is not required to submit the flight abort and flight safety analysis products if—

(i) The analysis submitted in the license application satisfies all the requirements of this section; or

(ii) The licensee demonstrated during the application process that the analysis does not need to be updated to account for mission-specific factors.

(2) If a licensee is required to submit the flight abort and flight safety analysis products, the licensee—

(i) Must account for vehicle- and mission-specific input data;

(ii) Must account for potential variations in input data that may affect any analysis product within the final 30 days before flight;

(iii) Must submit the analysis products using the same format and organization used in its license application; and

(iv) May not change an analysis product within the final 30 days before flight unless the licensee has a process, approved in the license, for making a change in that period as part of the licensee's flight safety analysis process.

(d) Flight safety system test data. Any licensee that is required by § 450.101(c) to use a flight safety system to protect public safety must submit to the FAA, or provide the FAA access to, any test reports, in accordance with approved flight safety system test plans, no less than 30 days before flight, unless the Administrator agrees to a different time frame in accordance with § 404.15 in the license. These reports must include:

(1) A summary of the system, subsystem, and component-level test results, including all test failures and corrective actions implemented;

(2) A summary of test results demonstrating sufficient margin to predicted operating environments;

(3) A comparison matrix of the actual qualification and acceptance test levels used for each component in each test compared against the predicted flight levels for each environment, including any test tolerances allowed for each test; and

(4) A clear identification of any components qualified by similarity analysis or a combination of analysis and test.

(e) Collision avoidance analysis. A licensee must submit to a Federal entity identified by the FAA and to the FAA the collision avoidance information in appendix A to part 450 in accordance with § 450.169(f).

(f) Launch or reentry schedule. A licensee must file a launch or reentry schedule that identifies each review, rehearsal, and safety-critical operation. The schedule must be filed and updated in time to allow FAA personnel to participate in the reviews, rehearsals, and safety-critical operations.

§ 450.215

Post-flight reporting.

(a) A licensee must submit to the FAA the information in paragraph (b) of this section no later than 90 days after a launch or reentry, unless the Administrator agrees to a different time frame in accordance with § 404.15 of this chapter.

(b) A licensee must send the following information as an email attachment to [e-mail], or other method as agreed to by the Administrator in the license:

(1) Any anomaly that occurred during countdown or flight that is material to public health and safety and the safety of property;

(2) Any corrective action implemented or to be implemented after the flight due to an anomaly or mishap;

(3) The number of humans on board the vehicle;

(4) The actual trajectory flown by the vehicle, if requested by the FAA; and

(5) For an unguided suborbital launch vehicle, the actual impact location of all impacting stages and impacting components, if requested by the FAA.

§ 450.217

Registration of space objects.

(a) To assist the U.S. Government in implementing Article IV of the 1975 Convention on Registration of Objects Launched into Outer Space, each licensee must submit to the FAA the information required by paragraph (b) of this section for all objects placed in space by a licensed launch, including a launch vehicle and any components, except any object owned and registered by the U.S. Government.

(b) For each object that must be registered in accordance with this section, no later than 30 days following the conduct of a licensed launch, a licensee must file the following information:

(1) The international designator of the space object;

(2) Date and location of launch;

(3) General function of the space object;

(4) Final orbital parameters, including:

(i) Nodal period;

(ii) Inclination;

(iii) Apogee;

(iv) Perigee; and

(5) Ownership, and country of ownership, of the space object.

(c) A licensee must notify the FAA when it removes an object that it has previously placed in space.

§ 450.219

Records.

(a) Except as specified in paragraph (b) of this section, a licensee must maintain for 3 years all records, data, and other material necessary to verify that a launch or reentry is conducted in accordance with representations contained in the licensee's application, the requirements of subparts C and D of this part, and the terms and conditions contained in the license.

(b) For an event that meets any of paragraph (1) through (5) or paragraph (8) of the definition of “mishap” in § 401.7 of this chapter, a licensee must preserve all records related to the event. Records must be retained until completion of any Federal investigation and the FAA advises the licensee that the records need not be retained. The licensee must make all records required to be maintained under the regulations available to Federal officials for inspection and copying.

Appendix A to Part 450—Collision Analysis Worksheet

(a) Launch or reentry information. An operator must file the following information:

(1) Mission name. A mnemonic given to the launch vehicle/payload combination identifying the launch mission distinctly from all others;

(2) Launch location. Launch site location in latitude and longitude;

(3) Launch or reentry window. The launch or reentry window opening and closing times in Greenwich Mean Time (referred to as ZULU time) and the Julian dates for each scheduled launch or reentry attempts including primary and secondary launch or reentry dates;

(4) Epoch. The epoch time, in Greenwich Mean Time (GMT), of the expected launch vehicle liftoff time;

(5) Segment number. A segment is defined as a launch vehicle stage or payload after the thrusting portion of its flight has ended. This includes the jettison or deployment of any stage or payload. For each segment, an operator must determine the orbital parameters;

(6) Orbital parameters. An operator must identify the orbital parameters for all objects achieving orbit including the parameters for each segment after thrust ends;

(7) Orbiting objects to evaluate. An operator must identify all orbiting object descriptions including object name, length, width, depth, diameter, and mass;

(8) Time of powered flight and sequence of events. The elapsed time in hours, minutes, and seconds, from liftoff to passivation or disposal. The input data must include the time of powered flight for each stage or jettisoned component measured from liftoff; and

(9) Point of contact. The person or office within an operator's organization that collects, analyzes, and distributes collision avoidance analysis results.

(b) Collision avoidance analysis results transmission medium. An operator must identify the transmission medium, such as voice or email, for receiving results.

(c) Deliverable schedule/need dates. An operator must identify the times before flight, referred to as “L-times,” for which the operator requests a collision avoidance analysis. The final collision avoidance analysis must be used to establish flight commit criteria for a launch.

(d) Trajectory files. Individual position and velocity trajectory files, including:

(1) The position coordinates in the Earth-Fixed Greenwich (EFG) coordinates system measured in kilometers and the EFG velocity components measured in kilometers per second, of each launch vehicle stage or payload starting below 150 km through screening time frame;

(2) Radar cross section values for each individual file;

(3) Position Covariance, if probability of impact analysis option is desired; and

(4) Separate trajectory files identified by valid window time frames, if launch or reentry trajectory changes during launch or reentry window.

(e) Screening. An operator must select spherical, ellipsoidal, or collision probability screening as defined in this paragraph for determining any conjunction:

(1) Spherical screening. Spherical screening centers a sphere on each orbiting object's center-of-mass to determine any conjunction;

(2) Ellipsoidal screening. Ellipsoidal screening utilizes an impact exclusion ellipsoid of revolution centered on the orbiting object's center-of-mass to determine any conjunction. An operator must provide input in the UVW coordinate system in kilometers. The operator must provide delta-U measured in the radial-track direction, delta-V measured in the in-track direction, and delta-W measured in the cross-track direction; or

(3) Probability of Collision. Collision probability is calculated using position and velocity information with covariance in position.

PART 460—HUMAN SPACE FLIGHT REQUIREMENTS

71. The authority citation for part 460 continues to read as follows:

Authority: 51 U.S.C. 50901-50923.

72. Amend § 460.45 by revising paragraph (d) to read as follows:

§ 460.45

Operator informing space flight participant of risk.

* * * * *

(d) An operator must describe the safety record of its vehicle to each space flight participant as follows:

(1) For licenses issued under part 450 of this chapter, the operator's safety record must cover any event that meets any of paragraph (1), (4), (5), or (8) of the definition of “mishap” in § 401.7 that occurred during and after vehicle verification performed in accordance with § 460.17, and include:

(i) The number of vehicle flights;

(ii) The number of events that meet any of paragraph (1), (4), (5), or (8) of the definition of “mishap” in § 401.7 of this chapter; and

(iii) Whether any corrective actions were taken to resolve these mishaps.

(2) For licenses issued under part 415, 431, or 435 of this chapter, the operator's safety record must cover launch and reentry accidents and human space flight incidents as defined by § 401.5, that occurred during and after vehicle verification performed in accordance with § 460.17, and include:

(i) The number of vehicle flights;

(ii) The number of accidents and human space flight incidents as defined by § 401.5; and

(iii) Whether any corrective actions were taken to resolve these accidents and human spaceflight incidents.

* * * * *

73. Effective March 10, 2026, further amend § 460.45 by revising paragraph (d) to read as follows:

§ 460.45

Operator informing space flight participant of risk.

* * * * *

(d) An operator must describe the safety record of its vehicle to each space flight participant. The operator's safety record must cover any event that meets any of paragraph (1), (4), (5), or (8) of the definition of “mishap” in § 401.7 that occurred during and after vehicle verification performed in accordance with § 460.17, and include:

(1) The number of vehicle flights;

(2) The number of events that meet any of paragraph (1), (4), (5), or (8) of the definition of “mishap” in section § 401.7; and

(3) Whether any corrective actions were taken to resolve these mishaps.

* * * * *

Issued under authority provided by 49 U.S.C. 106(f) and 51 U.S.C. Chapter 509 in Washington, DC, on September 30, 2020.

Steve Dickson,

Administrator.

Footnotes

1.  The FAA refers to these licenses as “legacy licenses” throughout this preamble. After that time, all operators must come into compliance with the new regulations.

2.  Operators holding a part 431 mission operator license have a 2-year renewable period, operators holding a part 435 reentry operator license have a 2-year renewable period, and operators holding a part 415 launch operator license have a 5-year renewable period.

3.  The FAA changes the title of § 450.101 from “public safety criteria” in the NPRM to “safety criteria” in the final rule. This is because the FAA changed the definition of “public” in new § 401.7 of the final rule. In the NPRM, “public” was defined to include “people and property that are not involved in supporting the launch or reentry and includes those people and property that may be located within the launch or reentry site, such as visitors, individuals providing goods or services not related to launch or reentry processing or flight, and any other operator and its personnel.” In the final rule, the FAA removed references to property, limiting the scope of the term “public” to people. This was done to provide better clarity throughout part 450 regarding the protection of people, property, or both. Because § 450.101 includes criteria for both people and property, the FAA removes “public” from the title.

4.  Streamlined Launch and Reentry Licensing Requirements ARC, Recommendations Final Report (April 30, 2008). The ARC Report is available for reference in the docket (Docket FAA-2019-0229).

5.  See FAA-2019-0229-0088.

6.  See FAA-2019-0229-0106.

7.  See FAA-2019-0229-0107.

8.  See FAA-2019-0229-0127.

9.  See FAA-2019-0229-0178.

10.  See FAA-2019-0229-0129.

11.  See FAA-2019-0229-0128.

12.  See FAA-2019-0229-0126.

13.  Since the information provided at these meetings is already captured in these commenters' clarifying questions or comments submitted to the docket, the FAA gave these commenters the option of not posting to the docket a summary of the meeting, as required by the FAA's Statement Regarding Requests for Public Meetings (see FAA-2019-0229-0107), as this would be a duplicative effort.

14.  See 84 FR 35051.

15.  See FAA-2019-0229-0134 and FAA-2019-0229-0135.

16.  Blue Origin submitted to the rulemaking docket a letter to Admiral James Ellis, Jr, USN (ret.), Chairman, Users' Advisory Group, National Space Council, in which Blue Origin expressed concerns with the NPRM. The letter encouraged Adm. Ellis to communicate the concerns to the Administration and the members of the National Space Council and advise the Office of the Secretary of Transportation and FAA to engage further with industry through a public meeting to address concerns with the NPRM and then to issue a supplemental NPRM that achieves the goals of SPD-2. The FAA is construing the contents of the letter as comments on the proposals in the NPRM.

17.  Section 431.43(d) sets a limit for foreseeable public consequences in terms of CE_C, but only for an unproven RLV. Section 431.43(d) provides an unproven RLV may only be operated so that during any portion of flight, the expected number of casualties does not exceed 1 × 10⁻4. given a vehicle failure will occur at any time the instantaneous impact point is over a populated area. This is in greater detail in the high consequence event protection section of the preamble.

18.  The FAA added equivalent level of safety provisions to parts 431 and 435 in a 2018 final rule. 83 FR 28528 (June 20, 2018).

19.  ELOS is not applicable to § 450.101(a), (b), (c)(1), (c)(3), (d), (e)(1), and (g).

20.  Further discussion on this topic is in the preamble section for performance-based regulations and means of compliance.

21.  A discussion on what constitutes beginning and end of launch is in the preamble section discussing scope of launch.

22.  The FAA notes that an operator operating under a license issued under part 415 would also be subject to the requirements of part 417.

23.  As noted, all operators are also required to comply with the critical assets and COLA provisions of part 450 beginning from the effective date of this rule.

24.  The FAA proposed to move the beginning and end of launch and reentry language from the definition of “launch” in § 401.5 to proposed § 450.3.

25.  See 84 FR at 15361.

26.  See 84 FR at 15359.

27.  See 72 FR 17001, 17002.

28.  See Legal Interpretation to Pamela Meredith from Mark W. Bury, Assistant Chief Counsel for International Law, Legislation and Regulations (Sept. 26, 2013); available at https://www.faa.gov/​about/​office_​org/​headquarters_​offices/​agc/​practice_​areas/​regulations/​interpretations/​Data/​interps/​2013/​Meredith-ZuckertScoutt&​Rasenberger%20-%20(2013)%20Legal%20Interpretation.pdf.

29.  See Legal Interpretation to Laura Montgomery from Lorelei Peter, Assistant Chief Counsel for Regulations (Dec. 10, 2019); available at https://www.faa.gov/​about/​office_​org/​headquarters_​offices/​agc/​practice_​areas/​regulations/​interpretations/​Data/​interps/​2019/​Montgomery-Ground%20Based%20Space%20Matters%20-%202019%20Legal%20Interpretation.pdf.

30.  These criteria derived from the discussion in the preamble to the NPRM on what an applicant should consider when proposing an incremental approach. In relevant part, the NPRM stated: “1. Application increments submitted at different times should be not be dependent on other increments to the extent practicable. 2. Application increments should be submitted in a workable chronological order. In other words, an applicant should not submit an application increment before a separate application increment on which it is dependent. For example, the FAA would not expect to agree to review a risk analysis before reviewing a debris analysis or probability of failure analysis because the risk analysis is directly dependent on the other two analyses.” 84 FR at 15366.

31.  AVS is the FAA's Office of Aviation Safety.

32.  See FAA-2019-0229-0018.

33.  The Range Commanders Council (RCC) addresses the common concerns and needs of operational ranges within the United States. It works with other government departments and agencies to establish various technical standards to assist range users. RCC 319 provides for the safety of people and missions during launch and flight operations.

34.  See AC 450.35-1, Means of Compliance.

35.  Public Law 114-90—Nov. 25, 2015 U.S. Commercial Space Launch Competitiveness Act.

36.  Note that the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (NDAA) includes a provision stating that the Secretary of Defense may not impose any requirement on a licensee or transferee that is duplicative of, or overlaps in intent with, any requirement imposed by the Secretary under 51 U.S.C. chapter 509, unless imposing such a requirement is necessary to avoid negative consequences for the national security space program.

37.  https://www.whitehouse.gov/​presidential-actions/​presidential-memorandum-launch-spacecraft-containing-space-nuclear-systems/​ (August, 2019).

38.  FAA Order 1050.1, Environmental Impacts: Policies and Procedures, provides a more detailed description of the FAA's policies and procedures for NEPA and CEQ compliance.

39.  Currently, the FAA has not established categorical exclusions for this program. However, the FAA may propose new categorical exclusions applicable to the program after the FAA's performance of NEPA reviews of proposed actions finds that the actions, when implemented, do not result in significant individual or cumulative environmental effects.

40.  See FAA Order 1050.1, Section 9-2.

41.  Finding of No Significant Impact.

42.  40 CFR 1506.3 of the Council on Environmental Quality (CEQ) Regulations and FAA Order 1050.1, as of the publication date of this rule.

43.  See Order 1050.1, Section 3-2.

44.  Both of these definitions are being replaced by the new, consolidated definition of “public” in § 401.7.

45.  The FAA is not proposing a higher risk threshold for invited guests or other consenting members of the public at this time.

46.  Specifically, in accordance with § 50902(26), “third party” means a person except—

(A) the United States Government or the Government's contractors or subcontractors involved in launch services or reentry services;

(B) a licensee or transferee under this chapter;

(C) a licensee's or transferee's contractors, subcontractors, or customers involved in launch services or reentry services;

(D) the customer's contractors or subcontractors involved in launch services or reentry services; or

(E) crew, government astronauts, or space flight participants.

47.  Specifically, in accordance with § 50914(a)(4), the insurance must protect the following, to the extent of their potential liability for involvement in launch services or reentry services, at no cost to the Government:

(A) the Government.

(B) executive agencies and personnel, contractors, and subcontractors of the Government.

(C) contractors, subcontractors, and customers of the licensee or transferee.

(D) contractors and subcontractors of the customer.

(E) space flight participants.

48.  51 U.S.C. 50914(b)(2).

49.  Should the FAA grant such a waiver, any individuals to whom the waiver applied would still constitute third parties under title 51 U.S.C. 50902, and operators would continue to be required to obtain liability insurance or demonstrate financial responsibility to cover third party claims as required by 51 U.S.C. 50914 and 14 CFR part 440.

50.  An operator may perform a risk analysis using its own methods or the risk analyses identified in part 450 in order to demonstrate the individual and collective risks imposed on the individuals identified in the waiver request.

51.  “Third party” means a person except—(A) the United States Government or the Government's contractors or subcontractors involved in launch services or reentry services; (B) a licensee or transferee under this chapter; (C) a licensee's or transferee's contractors, subcontractors, or customers involved in launch services or reentry services; (D) the customer's contractors or subcontractors involved in launch services or reentry services; or (E) crew, government astronauts, or space flight participants. 51 U.S.C. 50902(26).

52.  For example, the third party MPL for an Atlas 541 launch from CCAFS is currently $164M, which accounts for an event involving 30 third party casualties based on the risk profile method. An unlicensed government launch of the same vehicle occurred with 12 people deemed neighboring operations personnel that were located within the 1 × 10⁻6. P_C contour. If the conditions present during that unlicensed launch were to occur under part 450, then those 12 neighboring operations personnel would be accounted for in the third party MPL calculation at the 1 × 10⁻5. probability threshold (instead of the current standard 1 × 10⁻7. threshold for third parties as explained in the previous paragraph). The presence of the 12 neighboring operations personnel does not exceed the event involving 30 third party casualties. Therefore, it is unlikely that those 12 neighboring operations personnel would lead to an increase in the MPL for the Atlas 541 under part 450.

53.  In the final rule, flight abort is defined as the process to limit or restrict the hazards to public health and safety, and the safety of property, presented by a launch vehicle or reentry vehicle, including any payload, while in flight by initiating and accomplishing a controlled ending to vehicle flight. Flight abort is discussed more fully in the discussion of § 450.108.

54.  A CE_C value is calculated as the mean number of casualties predicted to occur given a specified failure mode in a given time interval with a probability of 1.

55.  As proposed, § 450.101(c) simply used CE_C to determine whether flight abort would be required as a hazard control strategy. Other proposed regulations relied on CE_C to establish FSS reliability and activation of FSS. These regulations and the response to commenters' concern with using CEC for those purposes are discussed later in the preamble.

56.  See 84 FR at 15298.

57.  Limits of a useful mission are defined in the final rule as the trajectory data or other parameters that bound the performance of a useful mission, including flight azimuth limits. This concept is discussed in greater detail in § 450.119.

58.  The report can be found in docket number FAA-2019-0229.

59.  The ACTA study made four notable conclusions:

1. For two current launch vehicles launched from outside the continential US, the 1 × 10⁻3. CE_C threshold is not exceeded. Thus, part 450 will not require an FSS for either of these two launches, yet both are designed to employ an FSS (as required by part 417).

2. For ten launch vehicles launched from within the continential US9, the part 450 CE_C requirements are consistent with current practice, where part 417 requires the highly reliable FSS.

3. For two piloted launch vehicles, one would require no changes, and the other would require no FSS although a flight abort capability is currently employed under part 431.

4. One current reentry poses CE_C well above the 1 × 10⁻2. threshold. Thus, under part 450 this reentry operation would either need to be modified to reduce the consequence of failure modes that would result in an intact impact, or be granted a waiver.

60.  See e.g., the FAA Flight Safety Analysis Handbook v 1.0, 2009 and the Range Commanders Council Risk Committee of the Range Safety Group, Common Risk Criteria for National Test Ranges—Supplement, RCC 321-20, White Sands Missile Range, New Mexico, 2020.

61.  See Waiver of Debris Containment Requirements for Launch. 81 FR 1470, 1470-1472 (January 12, 2016).

62.  84 FR 15312.

63.  The FAA notes that CE_C is inherent in the calculation of E_C because the total E_C for the operation is the sum of all E_C contributions from each failure mode and failure time, and each E_C contribution for a failure mode and failure time is the probability of failure multiplied by CE_C. Therefore, CE_C for a given failure mode and failure time can be found by dividing the E_C contribution by the probability of failure for that failure mode and failure time.

64.  Proposed § 450.101(c) required an operator to use fight abort with an FSS that met the reliability requirements set forth in § 450.145. The reference to reliability requirements for FSS has been moved to § 450.108(b) and will be discussed in that section of the preamble.

65.  High consequence events include incidents that could involve multiple casualties, massive toxic exposures, extensive property or environmental damage, or events that jeopardize the national security or foreign policy interests of the United States.

66.  The FAA computed this risk profile using NTSB accident data between 1982 and 2019 for fixed-wing aircraft operated under FAR parts 91, 135, and 137, excluding aircraft type certificated under part 25.

67.  RCC 321-17 defines a risk profile as “a plot that shows the probability of N or more casualties (vertical axis) as a function of the number of casualties, N (horizontal axis),” such that the area under a risk profile is equal to the EC. Unlike the single valued EC, risk profiles illustrate whether the collective risk is from a relatively low probability, high consequence event or from more frequent, smaller consequence outcomes.

68.  See, e.g., the 2016 Report to Congress “FAA's Development of an Updated Maximum Probable Loss Method” in response to Public Law 114-90, Section 102. An MPL analysis must model each accident scenario as a discrete event with discrete results, e.g., no casualties, exactly one casualty, two casualties, etc. Each accident scenario also has a quantitative probability of occurrence. The MPL analysis process involves simulation of many thousands of discrete accident scenarios that cover the parameter space of the problem (i.e., all foreseeable accident scenarios for each and every failure time and vehicle failure mode). The predicted results of all foreseeable accident scenarios are accumulated into a histogram and the risk profile is computed as the complementary cumulative distribution. For details, see Collins, Brinkman, and Carbon paper “Determination of Maximum Probable Loss” presented at 2nd IAASS conference in Chicago, May 2007.

69.  For example, Santa Barbara County, California (where Vandenberg AFB is located) uses risk profiles as part of their management of public casualty risks from activities that involve significant quantities of hazardous materials as explained in the County of Santa Barbara, Planning and Development, Environmental Thresholds and Guidelines Manual, October 2008. Several European countries, including the UK and Netherlands, use risk profiles as part of their governance of a wide array of industries that pose public risks.

70.  For example, the catastrophic risk averse pseudo-E_C contribution from people in ships may be computed using a standard E_C computation but replacing the number of casualties contributed by type of ship, N, with N raised to an exponent of 1.5.

71.  As part of the demonstration required under § 431.35(c), a part 431 applicant is required in § 431.35(d)(4) to identify and describe all safety-critical failure modes and their consequences.

72.  As an example of the distinction between “vehicle response mode” in the NPRM and “reasonably foreseeable failure mode,” in the final rule consider, a loss of thrust (LoT) failure mode. Under the NPRM, LoT failure mode would need to be accounted for by three VRMs: A LoT resulting in an intact impact, a LoT resulting in aerodynamic break-up, and a LoT resulting in explosion due to FSS activation. Under the NPRM's proposal, the operator would have been required to compute CE_C for three VRMs associated with LoT, but under the same circumstances the final rule will require only one CE_C for the LoT. The final rule CE_C for LoT will equal the average CE_C for the three VRMs that the NPRM would have required.

73.  In the proposal and the final rule, the FAA uses CE_C not only as a basis to determine whether flight abort is required but also as a basis to determine the appropriate FSS requirements. As noted, FSS requirements are discussed later in the preamble.

74.  CE_F represents conditional expected fatalities and is used to measure the mean number of fatalities predicted to occur given an event with a probability of 1. As noted in the NPRM, the FAA found that about one ground fatality resulted on average from one-hundred fatal accidents involving US aircraft operated under part 91 between 1984 and 2013 based on NTSB data. A comparison of CE_C to CE_F is appropriate here because the CE_F values cited here are empirical results from aviation accidents, whereas the CE_C values used here are the results of physics-based computer simulations for launch and reentry operations. In addition, the differences between aviation and space operations justify some margin in the tolerability of the conditional risks predicted for space transportation operations.

75.  As noted in the NPRM, the FAA found that about one ground fatality resulted on average from a fatal accident involving US aircraft operated under part 121 between 1984 and 2013 based on NTSB data.

76.  As discussed in the preamble section on Hybrid Vehicles, the FAA agreed with a comment that the FAA should not similarly find that an aircraft with only an experimental airworthiness certificate (EAC) would satisfy the demonstrated reliability standard. An aircraft with an EAC may demonstrate sufficient reliability through the use of a rigorous flight test program or numerous flights without a failure as defined in § 450.131.

77.  “Property” includes launch vehicles, reentry vehicles, and payloads.

78.  Part 420 defines public area distance as “the minimum distance permitted between a public area and an explosive hazard facility.”

79.  As proposed, an applicant using physical containment as a hazard control strategy would have been required to describe the methods used to ensure that flight hazard areas are cleared of the public and critical assets. This requirement has been relocated to § 459.110(c)(2) in the final rule.

80.  Proposed § 450.103(b)(1)(ii) and (b)(2)(ii) would have required the system safety program to include methods for updating the preliminary safety assessment and flight hazard analysis. In the final rule, the FAA simplifies the regulatory text of § 450.103(b) in the final rule, which requires an operator to implement methods to assess the system to ensure the validity of the hazard control strategy determination and any flight hazard or flight safety analysis throughout the lifecycle of the launch or reentry system. Updating the safety analyses is a component of ensuring their validity.

81.  In the NPRM, the requirements for flight abort had been scattered throughout proposed §§ 450.107, 450.123, 450.125, 450.127, 450.129, and 450.165. Section 450.108 is discussed more fully later in the preamble section titled Flight Abort.

82.  The NPRM did not include a separate section for physical containment. In the final rule, as will be discussed later, the requirements from proposed § 450.107(b) are relocated to a new § 450.110 (Physical Containment).

83.  The FAA notes that, throughout the preamble, it uses the phrase “as a hazard control strategy” to modify physical containment, wind-weighting, flight abort, and flight hazard analysis. For example, in the preamble, the FAA refers to operators who use “flight abort as a hazard control strategy.” In such instances, the FAA means that flight abort is being used as a hazard control strategy consistent with the requirements in § 450.108. Likewise, when an operator uses flight hazard analysis as a hazard control strategy, the operator is conducting a flight hazard analysis consistent with the requirements set forth in § 450.109.

84.  Although proposed § 450.107 was written in the negative, stating that an operator was not required to conduct a flight hazard analysis if the public safety hazards identified in the preliminary safety assessment for that phase of flight could be mitigated adequately to meet the requirements of § 450.101 through physical containment, wind weighting, or flight abort, the final rule has revised this language to be more easily understood.

85.  The proposed rule also required an applicant using physical containment as a hazard control strategy to demonstrate that the launch vehicle does not have sufficient energy for any hazards associated with its flight to reach outside the flight hazard area developed in accordance with § 450.133, and to describe the methods used to ensure that flight hazard areas are cleared of the public and critical assets.

86.  See 84 FR 15316 (footnote 62).

87.  The operator would also have needed to identify (1) vehicle response modes; (2) public safety hazards associated with vehicle response modes, including impacting inert and explosive debris, toxic release, and far field blast overpressure; (3) geographical areas where vehicle response modes could jeopardize public safety; (4) any population exposed to public safety hazards in or near the identified geographical areas; and (5) the CEC, unless otherwise agreed to by the Administrator based on the demonstrated reliability of the launch or reentry vehicle during any phase of flight.

88.  Department of Defense, Standard Practice for System Safety, MIL-STD-882E, May 11, 2012.

89.  As discussed, § 450.101(c)(2) and (c)(3) allow an operator to demonstrate it can sufficiently protect against a high consequence event through other means that reduce CE_C below 1 × 10⁻3. or through demonstrated reliability.

90.  The FAA anticipated that this proposed relaxation of the FSS reliability requirements would be applicable to operations launching or reentering in remote locations or for stages that do not overfly population centers. 84 FR 15328.

91.  The reliability requirements for a highly reliable FSS will be discussed later in the preamble in the section pertaining to § 450.145.

92.  The reliability requirements for an FSS that is not required to meet the standard for highly reliable FSS will be discussed later in the preamble in the section pertaining to § 450.143.

93.  The FAA has not included in the final rule the language in § 450.123(a) that would have required the operator to identify the location of uncontrolled areas. The FAA finds it is unnecessary to specify this language in the introductory paragraph of § 450.108(c) because an operator must identify the location of uncontrolled areas to meet the objectives of § 450.108(c)(2) through (6).

94.  A useful mission means a mission that can attain one or more objectives. Limits of a useful mission means the trajectory data or other parameters that bound the performance of a useful mission, including flight azimuth limits.

95.  A gate is an opening in a flight safety limit through which a vehicle may fly, provided the vehicle meets certain pre-defined conditions such that the vehicle performance indicates an ability to continue safe flight. Gate analysis has been removed from the final rule.

96.  The performance-based requirement in § 450.108(c)(3) incorporates elements of proposed § 450.125(a), (b)(1), (b)(2), and (b)(4).

97.  For example, a period of materially increased public exposure would include any area where the CE_C from any on-trajectory failure mode is greater than 1 × 10⁻2. .

98.  See 84 FR 15386.

99.  The FAA also notes that the term “in any one-second period of flight” has been changed throughout the final rule to the term “in any significant period of flight,” as described in the preamble section discussing § 450.101(c).

100.  The FAA currently requires in § 417.213 that “a flight safety analysis must identify the location of populated or other protected areas, and establish flight safety limits that define when an FSS must terminate a launch vehicle's flight to prevent the hazardous effects of the resulting debris impacts from reaching any populated or other protected area and ensure that the launch satisfies the public risk criteria.”

101.  See Waiver of Debris Containment Requirements for Launch. 81 FR 1470, 1470-1472 (January 12, 2016).

102.  In 2001, the National Research Council published a report on “Streamlining Space Launch Range Safety,” which included a recommendation that “destruct lines and flight termination system requirements should be defined and implemented in a way that is directly traceable to accepted risk standards.” See p. 44 of IBSN 0-309-51648-X available at http://www.nap.edu/​catalog/​9790.html. The flight safety limit requirements currently in § 417.213(d) are not directly traceable to accepted risk standards in that they require the analysis to “establish designated impact limit lines to bound the area where debris with a ballistic coefficient of three or more is allowed to impact if the flight safety system functions properly.” As noted earlier, the approach in § 417.213 has been rejected because it is unnecessarily restrictive, as evidenced by the need for the FAA to grant waivers to allow innovative missions to proceed safely, such as return of boosters to the launch site. The FAA found that those waivers did not jeopardize public safety based on conditional risk analyses that are inherent in methods the NAS referred to as accepted risk standards.

103.  Section 401.5 has a long-standing definition of IIP: “instantaneous impact point means an impact point, following thrust termination of a launch vehicle, calculated in the absence of atmospheric drag effects.”

104.  As part of pre-flight planning, an operator must submit to the FAA planned mission information, including the vehicle, launch site, planned flight path, staging and impact locations, each payload delivery point, intended reentry or landing sites including any contingency abort location, and the location of any disposed launch or reentry vehicle stage or component that is deorbited.

105.  Section 450.115 addresses the scope and level of fidelity required for FSA methods. The level of fidelity must demonstrate that any risk to the public satisfies the safety criteria of § 450.101.

106.  The FAA changes the term “vehicle response mode” in proposed § 450.109(a)(1) to “failure mode,” consistent with similar changes throughout the final rule as discussed in the conditional expected casualty section of the preamble.

107.  The proposed definition of “flight hazard area” in the NPRM was “any region of land, sea, or air that must be surveyed, publicized, controlled, or evacuated in order to protect public health and safety and the safety of property.”

108.  The FAA will determine what constitutes a sufficiently large set of Monte Carlo trajectories pursuant to the level fidelity of analysis requirements in § 450.115(b).

109.  Monte Carlo methods include computational algorithms that, for example, repeatedly sample from probability distributions that characterize input parameters (such as the weight, thrust, and drag of a vehicle) and perform physics-based (such as Newton's laws) simulations to obtain numerical results (such as a set of trajectories that characterize flight under normal or malfunction conditions).

110.  Section 450.115(c) requires an applicant to submit a description of the FSA methodology, including identification of: (1) The scientific principles and statistical methods used; (2) all assumptions and their justifications; (3) the rationale for the level of fidelity; (4) the evidence for validation and verification required by § 450.101(g); (5) the extent that the benchmark conditions are comparable to the foreseeable conditions of the intended operations; and (6) the extent that risk mitigations were accounted for in the analyses.

111.  See Flight Safety Analysis Handbook, V1.0, August 2009 (available at https://www.faa.gov/​about/​office_​org/​headquarters_​offices/​ast/​media/​Flight_​Safety_​Analysis_​Handbook_​final_​9_​2011v1.pdf).

112.  Distorted impact distributions are often caused by actions taken in response to abort criteria.

113.  Publicly available information indicates that the flight of the Ariane 5 VA241 that occurred from the Guiana Space Centre on January 25, 2018 may be a potential empirical example. There the flight path anomaly was evident from the beginning of flight and the payloads were deployed into an orbital inclination that was approximately 18 degrees from the intended orbit, yet the payloads were still able to deliver useful data.

114.  Proposed § 450.119(c)(2)(iv) required an applicant to submit a description of the random uncertainties with a significant influence on the vehicle's behavior throughout malfunction flight for each type of malfunction flight characterized, including a quantitative description of the statistical distribution for each significant parameter.

115.  84 FR 15383.

116.  As proposed, an operator would have been required to include all debris that could impact a human being with a mean expected kinetic energy at impact greater than or equal to 11 ft-lbs; impact a human being with a mean impact kinetic energy per unit area at impact greater than or equal to 34 ft-lb/in2; cause a casualty due to impact with an aircraft; cause a casualty due to impact with a waterborne vessel; or pose a toxic or fire hazard.

117.  “The crash test results and subsequent analysis strongly suggest that RCC-based thresholds are overly conservative because they do not accurately represent the collision dynamics of elastically-deformable sUAS with larger contact areas in comparison to the metallic debris analysis methods for high speed missiles on the national test ranges.” Final Report for the FAA UAS Center of Excellence Task A4; UAS Ground Collision Severity Evaluation Revision 2, Arterburn et al, 2017. http://www.assureuas.org/​projects/​deliverables/​a4/​ASSURE_​A4_​Final_​Report_​UAS_​Ground_​Collision_​Severity_​Evaluation.pdf.

118.  The preamble to the NPRM stated that “this proposal would include debris from a vehicle's jettisoned components and payloads because such debris could cause a casualty due to impact with an aircraft or waterborne vessel or could pose a toxic or fire hazard,” but the proposed regulatory text did not include that specific language.

119.  84 FR 15383.

120.  This language in proposed § 450.135(d)(3)(iii) is removed in the final rule, as discussed in the preamble associated with that section.

121.  Specifically, in § 450.139(f) the FAA proposed to require an applicant submit (ii) the population density in receptor locations that are identified by toxic dispersion modeling as toxic hazard areas; and (iv) the identity of the population database used. Also, in § 450.137(c)(1) the FAA proposed to require an applicant submit a description of the population centers, terrain, building types, and window characteristics used as input to the far-field overpressure analysis.

122.  However, the proposed requirement in § 450.135(c)(4) to characterize the vulnerability of people both geographically and temporally is effectively preserved in the final rule requirement in § 450.123(b)(4) to account for vulnerability of people to hazardous debris effects in the population exposure analysis.

123.  Because the FSA is necessary to demonstrate compliance with the risk criteria in § 450.101, the requirements set forth in that section regarding the validity of analysis apply to all parts of the FSA.

124.  Section 450.115(b)(1) requires an operator to demonstrate that any risk to the public satisfies the safety criteria of § 450.101 accounting for all known sources of uncertainty.

125.  See FAA-2019-02290-0134.

126.  The SpaceShipTwo accident on October 31, 2014, is an example of this situation.

127.  On September 1, 2016.

128.  In 2001, the NRC published a report on “Streamlining Space Launch Range Safety,” which included a recommendation that “safety procedures based on risk avoidance should be replaced with procedures consistent with the risk management philosophy specified by EWR 127-1.” See p. 44 of IBSN 0-309-51648-X available at http://www.nap.edu/​catalog/​9790.html.

129.  The FAA received no comments on § 450.133(e)(2)(i) and (ii) and adopts § 450.133(e)(2)(i) as proposed and § 450.133(e)(2)(ii) a revision include a cross-reference to the hazard area publication requirement in § 450.161.

130.  The FAA received no comments on § 450.135(d)(1), which requires the casualty and consequence analysis to account for all relevant debris fragment characteristics and the characteristics of a representative person exposed to any potential hazard. The FAA adopts this requirement without change.

131.  The FAA re-designates and adopts proposed § 450.135(d)(3)(v) as § 450.135(b)(4)(iii) without substantive changes in the final rule. The FAA received no specific comments on the proposed requirement.

132.  The FAA re-designates and adopts proposed § 450.135(d)(3)(vii) as § 450.135(b)(4)(v) without substantive change in the final rule. The FAA received no specific comments on the proposed requirement.

133.  The FAA adopts without change and re-designates proposed § 450.135(e)(5) through (e)(7) as § 450.135(c)(2) through (c)(4) in the final rule. The FAA received no specific comments on these proposals.

134.  A valid approach is described in “Safety Design for Space Operations,” Allahdadi, Firooz A., Isabelle Rongier, Tommaso Sgobba, Paul D. Wilde (Eds.), “Safety Design for Space Operations,” Sponsored by The International Association for the Advancement of Space Safety, published by Elsevier, Watham, MA, 2013. The only three topics not addressed in that reference (updated explosive impact yield models, launch availability analyses based on past measurements of meteorological conditions, and satisfaction of license application requirements) are addressed in AC 450.137 “Distant Focusing Overpressure Risk Analysis Supplemental Topics,” which is planned to be published after this final rule.

135.  84 FR 15395.

136.  SpaceX made a comment referencing an agreements subsection of § 450.139(b), but no such subsection existed in the NPRM.

137.  As an example, the FAA acknowledges the commenter's concerns in particular with regard to the requirements to document a process for identifying hazards arising from software; to meet software testing standards and hazard analyses based on levels of autonomy; and to detail the functionality of all software having no safety impact.

138.  Since the approach in proposed § 450.111 of using degrees of autonomy was largely informed by MIL-STD-882E, this revised approach in § 450.141 of the final rule will reduce confusion and error caused by translating between different allocation schemes already adopted by other industry standards. This will also improve the rule's resilience to future changes to standards.

139.  Incentive independence means that the independent verification and validation group is rewarded based on some metric other than schedule or throughput, so that the schedule or throughput demands that drive error rates upward do not also drive testing thoroughness downward.

140.  For each level of criticality in proposed 450.111(d) through (g), the FAA proposed that the software component's safety-critical functions must be tested on flight-like hardware, which must include nominal operation and fault responses for all safety-critical functions.

141.  ISO 26262 is an adaptation of the Functional Safety standard IEC 61508 for Automotive Electric/Electronic Systems. ISO 26262 defines functional safety for automotive equipment applicable throughout the lifecycle of all automotive electronic and electrical safety-related systems.

142.  DO-178C, Software Considerations in Airborne Systems and Equipment Certification, is the primary document by which the certification authorities such as FAA, EASA, and Transport Canada approve all commercial software-based aerospace systems. The FAA approved AC 20-115C July 2013, making DO-178C a recognized “acceptable means, but not the only means, for showing compliance with the applicable airworthiness regulations for the software aspects of airborne systems and equipment certification.”

143.  As noted in the NPRM, an FSS is an integral tool to protect public health and safety and the safety of property from hazards presented by a vehicle in flight. An FSS allows an operator to exercise positive control of a launch or reentry vehicle, enabling an operator to destroy the vehicle, terminate thrust, or otherwise achieve flight abort. A highly reliable FSS that controls the ending of vehicle flight according to properly established rules nearly ensures containment of hazards within acceptable limits. For that reason, the FAA considers an FSS a safety-critical system. See 84 FR 15326.

144.  See 84 FR 15329.

145.  In addition to § 450.143, requirements in the final rule that apply to safety-critical systems are also found in §§ 450.45(e)(3)(ii)(C), 450.103(c)(1), 450.103(d)(4), 450.107(b)(2), and 450.107(d)(1)(ii). These requirements are discussed within those sections.

146.  Typically, a fault-tolerant design applies redundancy or a system of safety barriers to ensure the system can function, though perhaps with reduced performance. An example of a fault-tolerant design is an aircraft with multiple engines that can continue flying even if one of the engines fails.

147.  A fail-safe design is a system that can fail in a controlled way, such that the failure will still ensure public safety, like elevator brakes held open by the tension of the elevator cable such that, if the cable snaps, the brakes engage and stop the elevator from falling.

148.  Damage-tolerant design allows for robust design, or design to fail gracefully, for systems like a vehicle hull that cannot be redundant or fail-safe. Fault-tolerant, fail-safe, and damage-tolerant designs are all design concepts meant to prevent credible faults or prevent increased risk to the public if failures do occur.

149.  84 FR 15325-15326.

150.  Qualification testing is an assessment of a prototype or other structural article to verify the structural integrity of a design. Generally, functional demonstration of the design's qualification at operating environments involves testing the design under a number of different environmental factors to stress the design, with a multiplying factor applied to the expected environmental testing limit. This qualification testing is conducted for temperatures, tensile loads, handling shocks, and other expected environmental stressors relevant to system or material degradation.

151.  Unlike qualification testing that is performed on qualification units, acceptance testing or other functional demonstration of acceptance required by § 450.143(d) is performance testing conducted on the actual hardware to be used on a vehicle after the completion of the manufacturing process. Generally, acceptance tests are performed on each article of the safety-critical flight hardware to verify that it is free of defects, free of integration and workmanship errors, and ready for operational use. Acceptance testing includes testing for defects, along with environmental testing similar to the qualification testing described earlier.

152.  Applicants must account for environments that any safety-critical system is expected to encounter throughout the lifecycle of the system in accordance with § 450.143(e), including storage, transportation, installation, and flight, which generally are built into qualification and acceptance testing levels.

153.  84 FR 15323.

154.  Protoqualification is used when test hardware is planned to be used for flight, generally for designs that will have limited production. Tests conducted to demonstrate satisfaction of design requirements use reduced margins, supplemented with other analyses and tests.

155.  CSF commented that by binning the CE_C of a vehicle and then prescribing a fixed reliability requirement for the FSS, the risk of an unmitigated CE_C event is not consistent because the binning requires the same FSS even though the risk varies by an order of magnitude. Although the FAA does not agree with CSF's solution to move the entire concept of CE_C into an Advisory Circular, as discussed earlier, the FAA does agree that it is unnecessary to establish a fixed reliability number for all § 450.108(b)(2) flight FSS required for operations with CE_C s that could be an order of magnitude apart.

156.  As explained in the section of the preamble on high consequence events, this proposed requirement would have applied to all phases of flight unless otherwise agreed to by the Administrator based on the demonstrated reliability of the launch or reentry vehicle during that phase of flight.

157.  The FAA indicated that this approach would be akin to “tailoring” RCC 319, which is current practice at Federal launch ranges.

158.  As previously explained, the FAA has replaced the term “vehicle response mode” with “failure mode” and the term “one-second period of flight” with “significant period of flight,” throughout the final rule. The basis for these changes is discussed in the preamble section on flight abort.

159.  In the NPRM, the FAA stated that the reliability standard in proposed § 450.145(a)(1) would be consistent with various sections of part 417, in particular § 417.309(b)(2), that require major FSS component systems, such as onboard flight termination systems and ground-based command control systems, to be tested to demonstrate 0.999 design reliability at 95 percent confidence. The FAA further noted that this reliability threshold would have to be demonstrated for the operation of the entire system, including any systems located on-board the launch or reentry vehicle, any ground-based systems, and any other component or support systems. 84 FR 15328.

160.  As discussed earlier in the preamble, if the consequence of any vehicle response mode is less than 1 × 10⁻3. , the FAA will not require an FSS or mandate its reliability if an operator chooses to use one.

161.  In the final rule, the definition of FSS is “a system used to implement flight abort. A flight safety system includes any flight safety system located onboard a launch or reentry vehicle; any ground based command control system; any support system, including telemetry subsystems and tracking subsystems, necessary to support a flight abort decision; and the functions of any personnel who operate the flight safety system hardware or software.” In the NRPM, the definition also included that a human can be a part of an FSS. The FAA removed this sentence from the definition because “the functions of any personnel who operate the flight safety system” covers this circumstance.

162.  RCC 324-01 Global Positioning and Inertial Measurements Range Safety Tracking Systems' Commonality Standard.

163.  Eastern and Western Range (EWR) 127-1 Range Safety Requirements.

164.  AFSPCI 91-701, Launch and Range Safety Program Policy and Requirements.

165.  AFI 13-602 Ready Spacecrew Program Training.

166.  See FAA-2019-0229-0019.

167.  More specifically, a different set of outcomes of all previous flights of vehicles developed and launched or reentered in similar circumstances.

168.  A derived vehicle is a term used when analyzing a new variant of a known rocket. A derived vehicle should be alike in substance or essentials considering the following factors that can influence the probability of failure: (1) The development and integration processes of the vehicle, including the extent of testing; (2) the design and manufacture of safety-critical systems, including but not limited to the structure (including the payload faring), propulsion, guidance, control, and navigation; (3) all aspects of the environment experienced by the vehicles, stages, and components that can affect performance and reliability, including but not limited to aerodynamic, thermal, acoustic, vibration, and inertial environments; (4) vehicle performance in terms of payload capability, maximum dynamic pressure, and maximum velocity.

169.  For FSA purposes, the vehicle failure probability accounts for any failure of the launch or reentry system because of the way failure is defined in § 450.131(b). In the context of FSA, any failure of the launch or reentry system, including pilot error, that produced vehicle failure as defined in § 450.131(b) must be accounted for to establish the demonstrated reliability. Therefore, the FAA would consider the pilot experience and training in making a demonstrated reliability determination.

170.  The L-1011 carrier vehicle used for Pegasus launches is an example of a carrier aircraft with enough empirical evidence to demonstrate compliance with the public risk criteria in § 450.101(a) or (b). Using flight history to demonstrate compliance with the risk criteria in § 450.101(a) and (b) is relatively simple, given a statistically significant number of flights relative to the expected casualty limit of 1 × 10⁻4. . As discussed elsewhere in the preamble, the FAA notes that the operator must also perform a system safety analysis to demonstrate that any modifications made to the carrier vehicle introduce only hazards to the public that are extremely remote.

171.  The FAA notes that it has distinguished emergency abort landing sites from planned contingency abort sites in other rulemakings. For example, in the Commercial Space Transportation Reusable Launch Vehicle and Reentry Licensing Regulations final rule, § 431.23 required an operator to identify contingency abort sites in its application. The FAA stated that contingency abort sites are pre-planned, and their potential use may be identified as part of an application in order to meet mission risk criteria and, therefore, are separate and distinct from emergency abort landing situations that may potentially be anywhere. 65 FR 56617, 56635 (November 20, 2000).

172.  84 FR 15334, footnote 98.

173.  84 FR 15337.

174.  Part 417 requirements for establishing and surveying hazard areas for ELVs are found in §§ 417.205, 417.223, and part 417 appendix B. Part 431 does not set explicit requirements for surveillance but both §§ 417.107(b)(2) and 431.35(b)(1)(ii) require that an operator ensure all members of the public are cleared of all regions, whether land, sea, or air, where an individual would be exposed to more than 1 × 10⁻6. PC.

175.  In 2001, the National Research Council published a report on “Streamlining Space Launch Range Safety,” which included a recommendation that “safety procedures based on risk avoidance should be replaced with procedures consistent with the risk management philosophy specified by EWR 127-1.” See p. 44 of IBSN 0-309-51648-X available at http://www.nap.edu/​catalog/​9790.html.

176.  See Waivers of Ship Protection Probability of Impact Requirement, 81 FR 28930 (May 10, 2016).

177.  See 84 FR 15344.

178.  A straight up suborbital trajectory is a nearly vertical suborbital trajectory. “Suborbital trajectory” is defined in § 401.5 as the intentional flight path of a launch vehicle, reentry vehicle, or any portion thereof, whose vacuum instantaneous impact point does not leave the surface of the Earth.

179.  See Report of Columbia Accident Investigation Board at https://www.nasa.gov/​columbia/​home/​CAIB_​Vol1.html.

180.  84 FR 15351 (“The proposed mishap classification system would streamline and clarify the current accident, incident, and mishap definitions to create four mishap categories organized by severity, from most severe (Class 1) to least severe (Class 4).”).

181.  84 FR 15352.

182.  84 FR 15351.

183.  As discussed later in the preamble, § 450.213(b)(2) requires a licensee to submit planned mission information, including the vehicle, launch site, planned flight path, staging and impact locations, each payload delivery point, intended reentry or landing sites including any contingency abort location, and the location of any disposed launch or reentry vehicle stage or component that is deorbited.

184.  See FAA-2019-0229-0106.

185.  The FAA removes proposed § 450.173(c) from the final rule and re-designates § 450.173(d) through (h) as § 450.173(c) through (g).

186.  Proposed § 450.179 required an operator at a U.S. launch or landing site to protect the public from adverse effects of hazardous operations and systems. The FAA changed “protect the public” to “protect the public and property” in the final rule. This change is because, as discussed earlier in this preamble, property was removed from the definition of “public.” Thus, “property” was added to this section to keep the requirement equivalent to what was proposed.

187.  Such activities may include, for example, activities conducted by a carrier aircraft without a rocket attached when the carrier aircraft plus rocket constitutes the launch vehicle.

188.  As discussed earlier, the FAA removed the requirement for a PSA from the final rule.

189.  Convention on Registration of Objects Launched into Outer Space provides that the United Nations maintains a registry of objects left in space by on data provided by the launching state.

190.  See 67 FR 49464 (July 30, 2002).

191.  AIS is a standardized maritime navigation safety communications system that provides vessel information automatically to appropriately equipped shore stations, other ships, and aircraft.

192.  USGC regulations regarding AIS are given in 33 CFR 164.46.

193.  Debris cost analysis is estimated to cost $50,000.

194.  ACTA, LLC is a risk management company that evaluates safety hazards and risks from space launch vehicle debris, blast, fire, and toxic gases. The FAA sponsored ACTA to perform a series of tasks to investigate the potential conditional risks associated with past and foreseeable launch operations. The study provided an independent evaluation of the potential for the CE_C related requirements in the NPRM to necessitate changes to current practice for more than a dozen missions involving large, medium, and small launch vehicles from a wide variety sites.

195.  In selecting which launches to analyze, the FAA analyzed those launches planned from remote areas, suborbital and launches with a certain kind of upper stage. This is because orbital launches that are not from remote areas are going to exceed the risk threshold of greater than 1 × 10⁻3. conditional expected casualties for uncontrolled areas.

196.  The debris data reported can be valuable in assessing the current license representations to allow for adjustments to expand launch availability or enhance the safety of operations.

197.  Based on historical launch data from the FAA Office of Commercial Space Transportation and the 2020 FAA Aerospace Forecast (https://www.faa.gov/​data_​research/​aviation/​aerospace_​forecasts/​media/​FY2020-40_​FAA_​Aerospace_​Forecast.pdf). See the Regulatory Impact Analysis of this rule in the docket for more information. The FAA acknowledges that there is uncertainty estimating future launches over a 10-year period since industry is expanding and planning for more launches in the future given expected business and economic conditions. In addition, historical data has shown that there is uncertainty and variation with the number of planned launches that result in actual launches on annual basis.

198.  See discussion in the FSS preamble section.