1. The maximum acceptable probability of impact (or, similarly, confidence of no impacts) by debris above of a threshold mass OR

2. The maximum probability of casualty for a person on board (e.g. ) together with either a catastrophe based criterion (e.g. for all , ) or a casualty expectation criterion (e.g. )

10.1 Computing Risk to Aircraft

A valid risk mitigation strategy requires accurately computed risks. The computation of risk to aircraft from launch or re-entry operations is relatively complicated compared to the risks to ground based assets. First, it requires the ability to calculate the four dimensional probability density function of each potentially hazardous fragment, , where represents an index to a fragment, is 3-D position, is time. In addition, the fragment is moving with velocity , which is also a function of position and time. Chapter 6 discussed methods used to model these functions. In addition, the probability of impact with an aircraft must account for the size and velocity of the aircraft (Carbon and Larson, 2005). The probability of impact upon a single aircraft from a single fragment is given by:

(1)

Where is the relative velocity vector between the approaching fragment and the aircraft at impact and is the area of the aircraft as viewed from the perspective of the impacting fragment (projected normal to the relative velocity vector between the approaching fragment and the aircraft as explained below):

(2)

Note that the negative sign in this equation reflects the coordinate system used in the computation of the vector sum: the magnitude of the impact velocity increases as the difference in the aircraft and debris velocity increases.

More formally, the projected area is the aircraft area projected onto the plane perpendicular to the impact velocity vector. If the front, top, and side areas of the aircraft, , , and , respectively, are oriented by unit normal vectors , , and as depicted in Figure 10.1, then the projected area is given by:

(3)

Not all impacts lead to risk however: some fragments are too small to cause damage or impact at too high an angle; these factors are accounted for with the vulnerability model (see next section). Thus, an aircraft risk analysis must account for the probability of each consequence of concern (e.g. casualty, fatality, or uncontrolled landing) for each fragment impact. This is dependent on the impact geometry, the location on the aircraft of the impact, and the fragment characteristics, such as mass, shape, material type, and orientation of impact, etc. The orientation at impact is generally unknown, so debris is often assumed to be randomly tumbling, and the probability of a given consequence of concern is averaged over all orientations. Thus, the probability of the consequence given an impact must be incorporated in the above expressions, as:

(4)

The product of the projected area and the probability of a consequence is often called the vulnerable area, i.e.

To account for the total probability of an event, all debris must be accounted for, and this must be accounted for probabilistically, as:

(5)

There are typically two approaches for computing the probability of consequence to an aircraft. The first is straightforward, where the risks are computed for an individual aircraft flight path. This is a direct application of equation (4), with numerical integration used to compute the probability along the flight path. However, the drawback to this method is that the position of the aircraft must be known as a function of time relative to the time of the space vehicle flight. With the exception of mission support aircraft, there is generally no a priori relationship between the position of an aircraft and the time of launch.

A second method is to compute the probability of consequence at a particular location, integrating with respect to time. In this approach, the position of the aircraft is limited to within a grid cell and the probability of side impacts is ignored since the impact velocity vector is not known, but the aircraft in each grid cell is assumed to be flying at a constant speed for the entire duration that debris is in the air. When this computation is performed at many points on a grid, then the risk to a particular type of aircraft can be mapped. This technique usually results in conservative estimate of the risk to an aircraft of that type flying on a realistic flight path. Only in very rare cases is the risk computed in this way not a conservative estimate, such as if an aircraft were allowed to fly under and parallel to the launch vehicle trajectory.

The probability of consequence information is usually visualized through contours of equi-probability (isopleths) for a given aircraft type at a particular altitude. These contours can be used to determine hazard areas. Isopleths of equi-probability are shown for a sample analysis in Figure 10.2. In this example, the isopleths represent the probability of a one gram fragment impacting a Boeing 747 due to debris resulting from a failure from a space lift vehicle launched from a hypothetical launch site on the southern tip of the island of Hawaii. The one in one million probability (heavy dotted contour) region extends approximately 1200 km downrange and the one in ten million region (light solid contour) 3350 km downrange.

This map is the product of a simple analysis: no real consequence model for the effects of the debris on aircraft was applied. It simply shows the likelihood of an impact of debris (of mass one gram or greater) anywhere on the aircraft. Many of these impacts would have little or no consequences.

Estimation of the probability of impact or consequence can be a computationally expensive procedure, due to the four-dimensional nature of the problem. However, accurate estimation of the probability of impact or consequence is necessary for determining the risk to aircraft and the effectiveness of mitigations.

10.2 Aircraft Vulnerability

The probability of consequence of obvious concern, such as a casualty or an uncontrolled landing, requires some modeling of the vulnerability of aircraft to debris impacts. Just like on the ground, for inert debris, the kinetic energy of the impact event is a key parameter for determining the effects of a debris impact. And, likewise for debris containing propellants, the yield of an explosion is key. However, there are two significant differences as compared to computing vulnerability to people and objects on the ground:

Vulnerability modeling of aircraft begins with event trees that can lead to a consequence of concern, such as casualties. Casualties can either be caused by direct effects of the debris (penetration of the debris into the fuselage, then impacting a person) or by causing damage to the aircraft that leads to an in-flight emergency and subsequent casualties (a debris impact on an engine could lead to engine fragments that penetrate the fuselage and cause casualties, etc.). Although similar modeling has been performed for the vulnerability (or survivability) of military aircraft to projectiles, the characteristics of an impact from space vehicle debris are significantly different than impacts from bullets or other weapons. Thus, the equation used to evaluate the potential for a penetration by a given impact must account for the irregular shape and other characteristics associated with space vehicle debris (Wilde and Draper, 2010). In addition, a practical aircraft risk computation for space vehicle debris requires a fast-running-model to relate basic debris properties to the probability of a consequence of concern.

A typical event tree for aircraft impacts identifies the paths that can lead to casualties. Critical aircraft systems include the pilot(s), the control systems, and propulsion. If anyone of these is disabled, then aircraft may no longer be able to land successfully, especially if the incident occurs over the open ocean. A pilot may be vulnerable to a direct impact of a fragment or loss of oxygen. Control systems include hydraulics, electrical systems, or aero surfaces, and damage to these can range from insignificant, to recoverable with pilot adaptation, to catastrophic. The propulsion system includes both the engines and the fuel lines. Loss of fuel is a dangerous scenario if there is not sufficient reserve to reach a safe landing area, and any fuel leak presents some risk of fire. These scenarios must be considered when modeling the consequences of a debris impact upon an aircraft. An example flow chart for modeling consequences of an impact on a wing is shown in Figure 10.3 (from Larson, Wilde and Linn, 2005).

Fast-running-models for the vulnerability of commercial aircraft and business jets have been developed (Wilde and Draper, 2008, 2010). These models are significantly based on two steps. One is determining the areas on the aircraft where a consequence can be either casualty or catastrophe producing (using event tree modeling). The other is assessing the fragment characteristics necessary to penetrate the skin of the aircraft in those areas. The models are parameterized to provide the vulnerable projected area of the aircraft as a function of the impacting fragment mass. Mass is a suitable independent parameter because the impact speed is primarily due to the aircraft speed, which can be estimated for each aircraft type and vulnerability model. However, if the fragment mass is the only independent parameter, then it is generally necessary to make an assumption about the fragment shape (e.g. a cube) to facilitate computation of the impact velocity, projected area, potential for penetration, etc.

10.3 Typical Aircraft Risk Mitigation Approach

A typical approach to aircraft risk mitigation is twofold:

Both of these approaches are discussed below, and are performed entirely during pre-mission planning.

For uninvolved aircraft, temporarily restricted airspace is defined and published through a Notice to Airmen (NOTAM). Airspace controlled by the United States Federal Aviation Administration (FAA) may be restricted through the activation of special use airspace (SUA), the implementation of a temporary flight restriction (TFR), or the activation of an altitude reservation (ALTRV). Other countries have typically similar procedures for special operations. SUA have predefined boundaries and they may be always active or they may be activated through the issuance of a NOTAM. SUA includes restricted areas and warning areas. In a region where no SUA exists, the FAA generally uses TFRs to protect domestic airspace and ALTRVs to protect oceanic airspace.

To manage aircraft risk, we start with the probability as a function of three-dimensional position for most vulnerable potential aircraft at different altitudes for:

For example, a typical individual risk limit is one in a million, and thus the 1 × 10^–6 contour for the probability of casualty for an individual person (crew or passenger) on an aircraft would be determined. For catastrophic risk, let us assume that the criterion is that must be less than one in ten thousand for all (where N is the number of casualties). For a small general aviation craft, there are typically only a few people (two to four) on board. Therefore, the probability of a catastrophe must be less than 1.25 × 10⁻⁵. Since this limit is higher than the individual probability of casualty, it is not important in establishing an appropriate aircraft hazard area. Therefore, the hazard region for small general aviation aircraft is simply the 1 × 10^–6 probability of individual casualty region. Extending this logic, for these two limits, as long as there are less than 21 people on board, the individual criteria is the more stringent one.

However, for large commercial aircraft, the catastrophic criterion can be very important. For example, the maximum number of people on a Boeing 747 is typically around 450. Applying the catastrophic risk criterion, the maximum probability of a catastrophe must be less than 1.0 × 10^–8 for this type of aircraft. Therefore, to determine the hazard region for a Boeing 747, the hazard area is the union of the regions inside the 1 × 10^–6 probability of an impact causing a casualty contour and the 1 × 10^–8 probability of a catastrophe contour. The hazard regions for potentially at risk aircraft then define the airspace areas that should be closed to protect aircraft from risk.

ALTRVs and TFRs are typically defined as two-dimensional polygons, extending from a minimum to a maximum altitude. Currently, no two simultaneously active ALTRVs can be contiguous and any gap in the space between must be large enough for aircraft to pass in order for the gap to be used – they must be separated by 1000 ft in altitude or lateral distance of 50 to 60 nautical miles, depending upon a number of factors. Therefore, for a space mission, typically a single hazard region is defined for malfunctions (which includes the launch area) and possibly others for stage impact regions. ALTRVs were developed for military operations, but they have been used for commercial launches and re-entries, as there is currently no other reasonable option for oceanic areas. Both TFRs and ALTRVs used for space operations typically extend from the surface to an “unlimited” altitude².

This region must account for the risk to all aircraft at any altitude within the affected airspace. It is, of course, impractical to compute hazard areas for every aircraft at every altitude at every potential speed. Therefore, it is important to choose selected aircraft in order that the total hazard region encompasses the hazard region for any aircraft feasibly threatened.

It is, however, somewhat difficult to determine which aircraft have the largest hazard area, as there are many effects which control the size of the area. They include the speed of the aircraft, the size of the aircraft, the speed the debris is falling, the dispersion of debris from the time of the accident, and the vulnerability of aircraft. When only one of these parameters is considered at a time, it is usually clear how to obtain a more conservative hazard area. For example, all else being equal, a faster (or larger area) plane sweeps out more volume in the same period of time, therefore it is more likely to be hit by debris. Likewise, slower falling debris is more likely to be run into by an aircraft. And, closer to the accident (e.g. at higher altitudes) debris has had less time to disperse (such as due to wind and lift effects) making the hazard area more concentrated.

The challenge arises because the different effects are correlated, as they are all related to altitude. At high altitudes, in addition to dispersion being smaller, the terminal velocity of the debris is larger. However, aircraft also travel faster at higher altitude. In addition, larger aircraft are often less vulnerable to debris impacts than smaller aircraft – especially if an aircraft has a single pilot. This may be further complicated if the largest possible aircraft does not fly in the region where risks are present. Another complication, because of the distribution of fragments with respect to ballistic coefficient, is that there may be fewer fragments present at the toe (leading edge) of the footprint compared to the heel (trailing edge). However, since the fragments at the toe are to be those with higher ballistic coefficients which are typically also have largest mass, they more capable of producing a catastrophic impact on an aircraft. Therefore, it is usually necessary to evaluate the risks for several different aircraft, at different altitudes.

In order to develop a hazard area, therefore, the keep out areas must be calculated for several different aircraft, with the attempt to encompass a conservative region for all aircraft that may traverse the region at risk. For a region of the open ocean, where low-altitude aircraft (e.g. flying below FL300) are extremely rare, it is usually sufficient to define just two aircraft to define a conservative hazard area. Basically, only long range aircraft such as commercial transports and business jets need to be considered, and thus the largest aircraft in each class, flying at the maximum cruising speed at the lowest reasonable altitude need to be considered. An example is shown in Table 10.1. As discussed previously, the catastrophe criterion can often be the most conservative for aircraft with many passengers, but the individual casualty criterion is usually the most restrictive for aircraft with few passengers. Note that there is some conservatism here, because the aircraft do not fly at their maximum cruising speeds at this low altitude.

For risks to airspace over land or in near coastal areas, it is much more complicated, since there are many more classes of aircraft and all aircraft may be flying at much lower altitudes. Also, in this case, it is usually excessively conservative to assume the fastest airspeed (e.g. 550 MPH) at the lowest possible altitude (ground, during takeoff and landing). Table 10.2 shows an example of the additional aircraft parameters that may need to be examined in order to ensure a sufficiently conservative estimate of the hazard area for aircraft. The helicopter top area needs to include the effective area of the rotors, as rotor damage is a potentially serious event for helicopters.

An additional consideration is to define the time that the keep-out area is active. The time should be defined appropriately for both launch and for re-entry.

For a launch, typically the keep-out must begin at the time of launch and must end when all potential debris has reached the bottom of the affected airspace. The launch window must also be accounted for. The start time is typically the opening of the window. The end time is the end of the window, plus the time of flight of the vehicle prior to the debris-producing event and the fall of debris from breakup to the bottom of the affected airspace. However, the keep-out may not always begin at launch time. For example, if the launch occurs in an existing, active restricted area, the additional hazard area would not include the launch site. Then the special keep out area begins when the first debris may enter the airspace beyond the boundary of the restricted area. For a re-entry, the keep-out begins at the first time debris could reach the top of the airspace until the last time the debris has fallen to the bottom of the affected airspace.

SUA, TFRs, and ALTRVs can be immediately released once the mission has successfully cleared the area and all planned jettisons have impacted. Since the duration of a hazard volume is typically defined by the slowly falling debris from an accident, the actual duration of airspace closure may be much less than the original planned closure, especially if the launch window is relatively long and the launch occurs at the beginning of the window. Some examples of the development of aircraft hazard areas during pre-mission planning include Murray (2008) and Gonzalez and Murray (2010).

10.4 Alternative Approaches

Use of the hazard area with the above method as a keep out area for aircraft for the entire launch window (plus debris fall time) may result in unacceptable limitations on air traffic. In this case, more complex approaches may be used to reduce the impacts on air traffic. These are typically not suitable for regular use, but may solve a problem for a particular mission.

If a launch opportunity is long (such as hours), then it may be helpful to separate this into a series of shorter opportunities with gaps in between. For example, if the launch opportunity is instead defined as only 10 minutes out of every hour, air traffic could be allowed to transit the area during time gaps when it is not possible for debris to be in the airspace. However, this can be challenging to implement because, if there is an accident, debris may be in the affected airspace for an extended period of time (30–40 minutes). So, even though the revised launch opportunities are only 10 minutes long, the airspace may still need to be closed for 50 minutes out of every hour. But, if the closure times are coordinated with air traffic control, this may be a sufficient accommodation for air traffic. This method is useful only in certain situations, and requires that the hazarded region is within radar coverage or when an air route has a low frequency of traffic³.

A second alternative is to investigate the risk for a particular flight lane in more detail. An aircraft risk analysis that accounts for the actual four-dimensional flight profile may allow for the opening of a particular corridor though the aircraft hazard area. This can be accomplished by computing the risk to aircraft on a flight path at many different launch-relative times. Usually the maximum risk for a specific flight path is for an aircraft flying parallel to and in the opposite direction as the space vehicle. This occurs because the downrange debris typically has a higher ballistic coefficient and falls through the airspace first, and uprange debris (lower ballistic coefficient) falls later. An aircraft flying perpendicular to the space vehicle path may have the lowest risk of all due to the shorter duration of time spent in the region where debris may fall. This occurs because the debris pattern from an accident is often a long narrow region that extends parallel to the flight path.

As an illustration of this approach, we compute the probability of impact for a particular aircraft along 12 representative flight paths (six paths, with aircraft flying each direction), using the same example as in Figure 10.2. All flight paths pass under the space vehicle track at a single point, where the impact probability computed using the grid cell method described above exceeds 1E-7. Figure 10.4 shows the maximum probability of impact for aircraft on each of the 12 flight paths, where the maximum represents the highest risk based on computations for a set of aircraft that traverse the hazard area at different times relative to the launch. The maximum probability of impact for any aircraft at each azimuth crossing the flight path at any time (relative to the launch) illustrates some interesting results: (1) the maximum probability of impact for any aircraft is less than half that indicated by the maximum contour level computed using the grid cell method; and (2) the impact probability for aircraft flying close to parallel to the space vehicle (azimuths 120 and 300 degrees) are more than two times higher than the ones flying more perpendicular.

Thus, even if the risks are not acceptable for some period of time or for all routes, this kind of analysis can allow for a much shorter closure time or for some routes to remain unrestricted.

Other alternative options require additional coordination with air traffic control. For air traffic routes with a low frequency of flights, it may be that the mission can be timed to occur when no aircraft will fly through the affected airspace. It may not be possible to plan exactly when this gap will occur (due to variability in flight times and schedules) with the options above. Instead, a mission operator could be in real-time contact with air traffic control, obtaining current positions, speeds, headings, and intended flight plans of air traffic that could be affected. These real-time data could then be used in conjunction with the analysis of the risks as a function of time on specific flight paths to allow a mission to commence when there are no aircraft that would exceed the risk criteria. An obvious drawback is that the launch time is subject to external events, which may not be practical. Using historical air traffic data can help to assess whether this scenario is practical in advance of the mission.

10.5 Real-Time Management

Ideally, of course, air traffic would not be affected unless a hazard actually exists. All of the mitigation approaches so far discussed either affect air traffic or place significant constraints on space vehicle missions because there is potential for a hazard in the case of an accident. This is a significant cost to protect against a hazard that only sometimes exists. In addition, the hazard area accounts for all areas where there is a potential hazard, but for any actual accident the hazard area is much smaller. However, if processes and tools are in place, it is possible to allow normal air traffic operations, except in the immediate launch area and for scheduled debris impact areas, until an accident occurs. This can occur when the space vehicle is at sufficient altitude (i.e. most of flight for an orbital launch or return mission) that there is a sufficient delay between the mishap and the time the debris reaches aircraft altitudes. During this time (several minutes), air traffic could be re-routed to avoid the debris much like aircraft are directed to avoid areas of severe weather. The required tools and processes include:

In order to be effective, the entire process – from breakup until an affected aircraft has flown sufficiently far along the new route – may need to be complete within as little as 5–8 minutes. The immediate launch area must still be cleared from aircraft, both to ensure separation from planned space vehicle operation and because an accident could happen too quickly to mitigate. However, outside this immediate region, there is typically about 5 minutes before significant debris density reaches aircraft altitudes. For some aircraft, which are initially further away from the hazarded area, the mitigation could be effective even if the process takes up to 30 minutes. There are many challenges in the development and application of such a real-time system, especially in open ocean regions, because the communication between air traffic and pilots is limited.

However, in regions where pilots have continuously open communication with air traffic, a real-time response is practical. In fact, such a special-purpose system was developed for the several re-entries of the Space Shuttle Orbiter following the Columbia accident (Murray and Mitchell, 2010). The Federal Aviation Administration developed a tool to predict a hazard area given a breakup during re-entry. Once there is evidence that an accident has occurred, the calculation process requires only a few seconds (Larson, Carbon and Murray, 2008). NASA, as the operators of the Shuttle, and the FAA created a means to transmit in real-time the position of the Orbiter to the operators of the tool, as well as communicating above whether there was indication that breakup had initiated.

In order to be prepared for an accident, the FAA performed table top exercises including the tool operators, National Air Traffic Managers, and air traffic controllers at regional centers. These exercises included simulations of an accident scenario. This ensured that the process was practical, increased the familiarity of the traffic managers with these types of operations, and reduced the likelihood of unexpected problems in dealing with the unusual scenario. The entire process was vetted through the safety management system of the FAA, in order to reduce the chance that the system had unintended effects that increased risk instead of reduced it.

In addition, NASA sent the FAA the planned re-entry flight paths for each mission. The tool was used in a planning mode to identify the air traffic control regions that might be affected by an accident and to establish a set hazard areas for all foreseeable accident scenarios. These regional centers rehearsed procedures prior to each re-entry, and communications methods were verified during the actual re-entry, so they were ready to respond rapidly if needed. This system was workable because most of the aircraft regions where there were significant hazards were over the continental United States.

A tool to compute the hazard areas for aircraft must balance the need for protecting aircraft with the goal of keeping the region where aircraft must be evacuated as small as possible. Even once an accident occurs, there are many uncertainties in the breakup and subsequent propagation of debris. For the Columbia, it was not even clear that the vehicle had broken apart for quite some time, significantly because there was no direct communication between NASA and the FAA and no plan to warn aircraft in the event of the re-entry breakup scenario. Regardless, a breakup cannot always be recognized immediately. Tracking information on the vehicle would likely be lost due to the failure, although breakup may have begun even prior to such a loss of signal. For some scenarios, loss-of-signal is a planned event, such as due to plasma effects during re-entry. In addition, breakup in many cases is a progressive event. And of course, the exact pieces that result from a breakup are not known: the number of pieces, their shapes, and their sizes are all quite uncertain. The predicted hazard region must account for these uncertainties sufficiently to protect the aircraft.

With such a tool and associated process in place, no hazard region is needed for aircraft under air traffic control outside of the immediate launch or landing area. Of course, it is still required for aircraft flying under visual flight rules or otherwise not actively in communication with air traffic control.

10.6 Summary

Space vehicle accidents pose a particular risk to aircraft because aircraft are more vulnerable to debris. The computation of risk to aircraft adds two extra dimensions (time and altitude) beyond the ground risk computation, which requires more complex analysis and more computation time. The most straightforward approach to mitigating risk to aircraft leads to large keep-out areas. Several methods, however, can be applied that reduce the effects on air traffic. The ideal system is post-accident mitigation, where aircraft are re-directed in real-time to be clear of area where risks are high. This requires both a fast and accurate computation of the hazard area as well as procedures in place for air traffic control to manage the risk.

References

1. Ailor W, Wilde P. Requirements for Warning Aircraft of Reentering Debris. Rome, Italy: 3rd IAASS Safety Conference; 2008.

2. Carbon SL, Larson EWF. Modeling of Risk to Aircraft from Space Vehicle Debris. San Francisco, California: AIAA Atmospheric Flight Mechanics Conference and Exhibit; 2005; AIAA #2005-6506.

3. Gonzales EAZ, Murray DP. FAA’s Approach to Ground and NAS Separation Distances for Commercial Rocket Launches. Orlando, Florida: AIAA Aerospace Sciences Meeting Including the New Horizons Forum and Aerospace Exposition; 2010; AIAA #2010-1540.

4. Draper C, Wilde P. Development of a Business Jet Class Survivability Model for Broad Ocean Areas. Honolulu, Hawaii: AIAA Atmospheric Flight Mechanics Conference and Exhibit; 2008; AIAA #2008-7122.

5. Larson EWF, Wilde PD, Linn AM. Determination of Risk to Aircraft from Space Vehicle Debris. Nice, France: 1st IAASS Safety Conference; 2005.

6. Larson E, Carbon S, Murray D. Automated Calculation of Aircraft Hazard Areas from Space Vehicle Accidents: Application to the Shuttle. Honolulu, Hawaii: AIAA Atmospheric Flight Mechanics Conference and Exhibit; 2008; AIAA #2008-6889.

7. Murray DP. Space and Air Traffic Management of Operational Space Vehicles. Honolulu, Hawaii: AIAA Atmospheric Flight Mechanics Conference and Exhibit; 2008; AIAA #2008-6890.

8. Murray DP, Mitchell M. Lessons Learned in Operational Space and Air Traffic Management. Orlando, Florida: 48th AIAA Aerospace Sciences Meeting Including the New Horizons Forum and Aerospace Exposition; 2010; AIAA #2010-1349.

9. Risk Committee, Range Safety Group, Range Commanders’ Council, Standard 321–10: Common Risk Criteria for National Test Ranges: Inert Debris, White Sands Missile Range, December 2010.

10. Wilde PD, Draper C. Aircraft Protection Standards and Implementation Guidelines for Range Safety. Orlando, FL: 48^th AIAA Aerospace Sciences Meeting; 2010; AIAA #2010-1542.