Streamlining Space Launch Range Safety (2000)

Aircraft and marine incursions into restricted airspace and waters have not resulted in any casualties and have contributed to only a small percentage of launch holds and scrubs at either the ER or WR. When they do occur, however, delays caused by incursions can be highly disruptive and costly for both the range and the user. Incursions are a particular concern for high profile missions, such as the flight of John Glenn on the space shuttle, that attract large numbers of sightseers, many of whom choose to view the launch from a boat or aircraft. During launch delays caused by intruders other problems may develop, which makes it difficult to assess the historical or future impact of intruders accurately.¹ A launch scrub typically increases launch costs by at least $100,000 and increases risk, especially if it is necessary to de-fuel the launch vehicle or offload the payload.

Space launches typically require a huge investment of time and effort on the part of designers, manufacturers, testers, and support personnel to reduce the likelihood of failures and anomalies. Launch holds triggered by unwitting or irresponsible intruders can frustrate the huge effort that has been made to ensure a successful, on-time launch. Long delays can also adversely affect team performance during subsequent preparations for launch.

Expected increases in marine and airborne traffic, particularly at the ER, and an increase in the pace of space launches, especially commercial launches, are likely to intensify the overall impact of incursions. Increased traffic will further challenge the adequacy of existing surveillance and interdiction capabilities, and a higher launch rate means there will be less time between launches. Thus, not only can the number of scrubs and holds be expected to increase substantially, but their occurrence will be more likely to create a “cascade” effect on subsequent launches, increasing launch disruptions, risks, and costs.

This chapter summarizes the committee’s examination of the Air Force’s safety guidelines and procedures associated with errant aircraft and surface vehicle incursions into restricted airspace, waters, and terrain. The purpose of this examination was to determine if the number of holds and scrubs could be reduced while desired levels of safety are maintained. The following sections summarize current guidelines and procedures associated with aircraft and marine incursions, describe planned improvements, and recommend further improvements. The ER and the WR use similar equipment and procedures for surveillance and interdiction, and the findings and recommendations that appear in this section generally apply to both ranges.

As discussed in Chapter 3, launch risk is expressed in terms of E_c (for collective risk), P_c (for individual risk), and P_i (for the probability of hitting a particular ship or aircraft). E_c provides a measure of the overall risk of the launch to the population as a whole; P_c and P_i are used to evaluate the risk to a person or vehicle at a particular location.

The establishment of hazardous launch areas (e.g., flight hazard and flight caution areas) is fundamental to dealing with errant intruders in space launch operations. Hazardous launch areas begin at the launch points and extend downrange along the intended flight azimuths. The size and shape of the areas are based on calculations of P_i for ships and aircraft for the specific launch vehicle, its payload, the known and expected failure modes and effects (including toxic hazards), and weather conditions.

During a launch, only mission-essential personnel are allowed inside flight hazard areas, where the probability that an individual will be seriously injured or killed, P_c, exceeds 1 × 10⁻⁵, and those personnel must take shelter in blast-hardened structures with adequate breathing protection.

Outside each flight hazard area the ranges define a flight caution area, where P_c exceeds 1 × 10⁻⁶. During a launch, only mission support personnel equipped with breathing protection are permitted inside the caution area.

The presence of offshore oil platforms at the WR is a complicating factor with regard to the evacuation of high-risk areas. Oil companies maintain evacuation and other contingency plans for their oil rigs. However, because of concerns about oil spills on unattended oil rigs, even when oil platforms are “evacuated” because of launch risk, the evacuation orders allow a minimum cadre of personnel to remain on board. These difficulties notwithstanding, exclusion may be the only viable option for some high-risk areas.

Risk assessments are used to evaluate risk and define hazardous launch areas. The ER and WR rely on quantitative methods and data to model hazards and to assess risks to people and property. The modeling algorithms and risk calculations used by the ranges seem to conform to generally accepted practices, some of which have been in use for many years. During the initial development and subsequent refinement of these methods, they have been reviewed repeatedly in collaboration with other organizations, including the Lawrence Livermore National Laboratory, NASA, the U.S. Navy, and the National Oceanic and Atmospheric Administration. Therefore, rather than trying to validate the individual analysis methods, the committee assessed more generally the acceptability of the risk standards currently used at the ER and WR to protect the public.

As indicated above, the individual risk standard, P_c, for members of the general public is 1 × 10⁻⁶. A different risk standard is appropriate for individual ship-hit probability, P_i, because hitting a ship with a piece of debris will not necessarily result in casualties. At both the WR and ER the maximum allowable P_i is 1 × 10⁻⁵. Chapter 7 of EWR 127-1 (Section 7A.2.8.3.1), however, directs the WR and ER to apply P_i differently. At the WR a launch hold or scrub may be initiated if an individual vessel is exposed to a P_i greater than 10⁻⁵. At the ER, however, a launch hold or scrub may be initiated if the sum of the individual hit probabilities for all targets plotted within, or predicted to be within, the established probability contours exceeds 1 × 10⁻⁵. Thus, the procedure specified for the ER is more conservative than the procedure for the WR.

Unlike the WR, the ER estimates impact blast overpressure to determine if a near miss of solid propellant fragments debris might damage a ship. That is, if calculations show that debris could miss a vessel but create an overpressure of 0. 5 psi (for boats) or 2 psi (for ships), the risk analysis tool counts that as a hit. These limits are not specified in EWR 127-1, and the committee was unable to locate analytical studies supporting the overpressure limits used by the ER, which appear to be quite conservative. However, the committee endorses the use of overpressure limits to improve the accuracy of P_i estimates and recommends adding validated overpressure limits to EWR 127-1.

The number of casualties will depend on the location of the debris impact relative to the people on board and the characteristics of the ship and the debris. In the 30th Space Wing’s Flight Safety Analyst Handbook, a highly simplified approach (a person sitting on an unprotected deck) indicates that a ship-hit probability of 1 × 10⁻⁵ corresponds to an individual risk of 4 × 10⁻⁸. For a launch rate of 33 per year, a P_i of 1 × 10⁻⁵ implies that a ship in a particular location would be hit once about every 3,000 years. That figure appears to be in line with an E_c of 30 × 10⁻⁶, which corresponds to three casualties every 3,000 years for the same launch rate. During the study, the committee asked the Air Force to provide a more sophisticated analysis of risks to ships. In response, the Air Force used the Launch Risk Analysis computer program to assess the risk faced by a medium-sized ship with a crew of 10, assuming that the ship resembled a building with light protection characteristics. The results of this analysis, which were provided to the committee, showed that a plot of E_c equal to 30 × 10⁻⁶ was fairly close to a plot of ship-hit P_i equal to 1 × 10⁻⁵ used operationally at the WR. It may be worthwhile to conduct additional studies to assess factors not included in the analyses described here, such as the possibility that a single big hit could cause multiple casualties by completely destroying a ship or impeding crew escape. Also, comparisons based on practices at the WR do not directly apply to the ER.

Unlike RCC Standard 321-97 (RCC, 1997a), EWR 127-1 does not specify a risk standard for non-mission-essential aircraft. At both the ER and WR, several kinds of special-use airspace zones are activated to keep public aircraft totally away from hazardous operations. Restricted areas over the launch areas were established by FAA rule-making many years ago and are sized to cover a number of different sites and operations. These areas are plotted on standard aeronautical charts and are purposely large enough to create a buffer zone to compensate for the high speed of aircraft. Warning areas extend from the coast to as much as 150 miles offshore and usually take in the extremes of the ILLs (impact limit lines). The ranges also use stationary altitude reservation areas to warn aviators away from ocean areas where expended booster stages are expected to hit. These areas are also conservatively sized and include buffer zones of five miles or more. No other warnings to commercial traffic are invoked outside of these areas, and air lanes around the world continue to operate normally below the flight paths of space and missile launches.

At the WR, hazard areas inside the warning areas are defined using an aircraft P_i of 1 × 10⁻⁸. Mission-essential aircraft are not normally allowed in hazard areas during launches. Exceptions have been made to allow mission-essential aircraft to operate in areas with a P_i up to 1 × 10⁻⁶. In any case, air traffic is not a problem at the WR, which has

not had a launch hold or scrub because of an aircraft intruder within the memory of current staff.

At the ER, P_i is used to manage risk for mission-essential aircraft, which may be allowed to operate in areas where P_i is less than 1 × 10⁻⁶. Aircraft intrusions, generally by small private aircraft, are not uncommon. Air surveillance usually detects intruders even before they enter a restricted zone; as described later in this chapter, they are monitored during the countdown, and efforts are made to communicate with the aircraft and warn them away from the area.

Prior to each launch, the flying public is warned to stay clear of the restricted areas for that launch. Despite the large size of the standardized restricted areas, they do not seem to unduly hamper civil or commercial air operations, and using predefined areas that can be permanently plotted on aeronautical charts is much more practical than disseminating precise boundaries of warning areas for each launch using latitude and longitude coordinates. However, the use of standardized areas is not an efficient tool for determining whether a launch hold is needed. Launch hold decisions should be based on the position of intruder aircraft relative to the areas of actual hazard, especially at the ER where aircraft intrusions are more often a problem.

P_i should be calculated differently for aircraft than for ships because even small pieces of debris can endanger aircraft. For example, cylindrical steel or aluminum fragments weighing as little as 2 or 3.5 grams, respectively, can penetrate an aircraft windshield (RCC, 1997b). Such small particles are not normally taken into account in launch risk analyses. Nevertheless, an aircraft P_i limit of 1 × 10⁻⁶, if calculated to account for very small pieces of debris, appears to be consistent with the individual ship-hit risk criteria (P_i of 1 × 10⁻⁵) and the collective risk standard (E_c of 30 × 10⁻⁶).

Each launch vehicle has a “commit sequence” that typically starts one to five minutes before engine ignition. Instituting a hold after the commit sequence starts can be dangerous and costly. Thus, each hazard area should be surrounded by a buffer zone large enough to ensure that aircraft will not enter the hazard area until the launch vehicle has cleared the area even if an aircraft turns toward the hazard area at the beginning of the launch commit cycle. These large buffer zones are not necessary for aircraft flying under the direction of air traffic controllers in airways outside the hazard areas.

Finding 5-1. A limit of 1 × 10⁻⁵ for individual ship-hit probability, P_i, is reasonable and consistent with an E_c of 30 × 10⁻⁶. However, the use of collective risk in the Eastern Range ship exclusion process is not consistent with either the corresponding Western Range process or accepted guidelines for the evacuation of hazard areas, which are both based on individual risk. Aircraft avoidance criterion are not specified by EWR 127-1, are applied differently at the Eastern and Western Ranges, and are not supported by analyses showing that they are consistent with other range safety criteria.

Primary Recommendation on Risk Standards for Aircraft and Ships. AFSPC should apply the individual ship-hit criterion, P_i, of 1 × 10⁻⁵ to the ship exclusion process at the Eastern Range in the same way it is used at the Western Range. EWR 127-1 should be modified to specify an aircraft-hit P_i limit of 1 × 10⁻⁶ (properly calculated to include the probability of impact for very small pieces of debris). Prior to each launch, the range should establish aircraft hazard areas (based on the aircraft P_i) and buffer zones (for uncontrolled aircraft in the vicinity of the hazard area). Launches should be allowed to proceed as long as no intruder aircraft are in the hazard area or buffer zone.

Recommendation 5-1. AFSPC should determine maximum-acceptable blast overpressure limits and apply these limits to ship-hit calculations at both the Western and Eastern Ranges.

Risks to marine traffic in and approaching a launch area are determined by flight analysis personnel using ship-hit probability contours and toxic hazard zones. Safety analyses include risks from both accidents and normal operations, including the jettison of expended stages and the areas and altitudes where toxic hazards may exist. Graphic plots are used to determine the areas that must be cleared of boats and ships (and trains, at the WR). At the ER, multiple contours are provided to show the zones that pertain to various numbers of ships or boats that are allowed within a grid area. For example, a launch would not be allowed to proceed if a boat were located inside the contour in Figure 5-1 labeled “1 boat × 10⁻⁵” or if two boats were located inside the contour labeled “2 boats × 10⁻⁵.”

Extending downrange from the coastline, the launch corridor is divided into three separate areas: from the coast to three miles offshore (national waters), from 3 to 12 miles (federal waters), and beyond 12 miles (international waters). Different rules of operation apply in each of these areas with implications for surveillance, interdiction, and enforcement. Enforcement action against intruders may not be practical beyond the 12-mile limit.

General requirements for launch area surveillance and control at the ER and WR are included in EWR 127-1. Section 7.9 directs the use of surveillance aircraft and ground-based surveillance radar and requires advance public notification of specific hazard areas and times using Notices to Mariners and marine radio broadcasts. At the ER, Section 7.9 also requires the use of on-shore warning signals, lights, and signs in the vicinity of hazard areas and in channels leading to the ocean.

Guidelines for surveillance and interdiction to prevent and clear surface incursions also address the use of ground-based military and FAA radars, U.S. Coast Guard vessels (at the ER), U.S. Navy ships (at the WR), helicopters, fixed-wing aircraft, voice communications systems, and an automated

FIGURE 5-1 Samples of multiple boat-hit contours. Source: RTI, 1997.

train surveillance system (at the WR). However, many of the ships and aircraft that the ranges rely on for these services are also assigned other duties by the Coast Guard and Navy and are not always available to support launch operations.

The safety of aircraft is ensured through the use of special-use airspace and restricted, warning, and hazard areas. The general requirements described above for launch area surveillance and control of surface traffic apply to aircraft as well. EWR 127-1 also requires advance dissemination of Notices to Airmen (NOTAMs) via the FAA to inform civil and military pilots of the boundaries for hazardous areas and the times they are active.

Nearby military radars and the FAA’s air traffic control (ATC) surveillance radars are key sources of information for surveillance and clearing of launch hazard areas at both ranges. Principal sites at the ER that actively support launches include the radar approach control facility at Patrick Air Force Base and FAA radars at the Miami and Jackson-ville air route traffic control centers. These radars provide aircraft surveillance within a 50-nautical mile radius of the launch site. At the WR, similar radars at Vandenberg Air Force Base and the FAA/Air Force Joint Surveillance System provide comparable air surveillance to a range of 250 nautical miles.

Communications and coordination guidelines and procedures at both ranges support effective coordination among FAA air traffic controllers and Air Force launch support staff. Air traffic controllers use radars and associated communication networks to communicate with civil and military aircraft under their control and keep them clear of hazardous airspace during launch operations. However, general aviation aircraft in the vicinity of the ranges typically fly under visual flight rules (VFR) and operate independently of ATC. Although VFR aircraft are usually equipped with operating transponders and appear on ATC radar displays, they are not uniquely identifiable, and their pilots normally are not in continuous communication with ATC. VFR traffic density at the ER is much greater and presents more of a challenge than at the WR.

Four manned oil platforms lie offshore from the WR facility within some of the launch risk corridors. Current guidelines direct that a platform be totally evacuated if E_c (the cumulative risk to personnel during launch) exceeds the criterion for mission-essential personnel (300 × 10⁻⁶), but this has never occurred within the memory of range safety or oil industry personnel contacted by the committee. If E_c is less than 300 × 10⁻⁶, but P_i is greater than 1 × 10⁻⁵, unnecessary personnel are evacuated, and those who remain take shelter inside the structure of the platform during the launch period. Oil rig operators are routinely advised 10 days prior to a launch that may require personnel to be evacuated or sheltered.

Total evacuation of an oil platform could cost about $15,000 in direct expenses, plus as much as $300,000 in lost production for a total shutdown. The evacuation process also involves inherent risks to equipment and personnel (e.g., the risk associated with a helicopter flight to and from the platform). Sheltering of personnel, however, may result in only 20 to 30 minutes of lost production and little or no additional risk.

In 1988 oil platform operators examined the WR’s analytical tools and the risk levels that pertain to oil platforms.

Since that time the WR has shared risk information with operators on a regular, case-by-case basis and allowed them to determine which protective measures should be taken. Reportedly, under this shared decision-making arrangement, partial evacuations are rare (no more than one per year). However, the ownership of the platforms may be changing. If so, it would be prudent for WR managers to contact the new owners and try to preserve the current, mutually beneficial partnership. In view of the cooperative arrangement between the WR and oil platform operators and the infrequent need for even partial evacuations, the committee concluded that current oil platform launch notification and evacuation criteria and procedures, as applied by the WR, are acceptable.

Current assets to accomplish the sea surveillance and interdiction mission at the ER include a U.S. Coast Guard vessel that is subject to diversion for other search and rescue missions, a tower-mounted marine radar with a limited 20-mile range capability, and two U.S. Air Force helicopters. The helicopters are relatively slow (120 knots) and operate at low altitude (500 feet), which provides the crew with a limited field of view. The hazard area at the ER encompasses a large ocean area and frequently contains many fishing boats that routinely operate in areas with the highest hit probability. The clearing process typically involves approaching each intruder and asking the crew to move using marine VHF radio or a streamer with a written message that is dropped onto the boat. Because of the long time required for helicopters to sweep their assigned areas and the high traffic density, search crews sometimes find that an intruder has unexpectedly entered a cleared area between sweeps. As a result, it is sometimes difficult to clear hazardous launch areas and keep them clear.

Air surveillance radar data from several sites is fed to the ROCC for use in detecting and tracking aircraft in and near the launch hazard areas. The current arrangement relies on outdated radars and offers limited data storage and automatic tracking capability. As a result, considerable time and man-power are needed to integrate and interpret this information before it can be acted upon. The committee believes radar data from current ATC and military air surveillance radars may not be adequate under maximum traffic loading to provide an integrated display of aircraft position and tracking information for timely and efficient air surveillance and control purposes, especially at the ER.

Both ranges have developed improvement plans that include new surface radars and replacing military aircraft with commercial aircraft carrying improved sensor, navigation, and communications equipment. Commercial sensor technology and miniaturization have progressed to the point that military surveillance systems are no longer required. The ER estimates that the operating costs of an improved system would be about half the cost of current military helicopters, but it has not yet shifted to such a system. The committee agrees that suitably equipped, commercially operated, fixed-wing aircraft would cut costs and provide a more stable sensor platform with greater mobility, more extensive surveillance of hazard areas, and higher resolution video recording.

The Cape Canaveral Range Surveillance System (CRaSS), proposed by the ER, could also enhance air surveillance and control capabilities and possibly contribute to surface surveillance. The CRaSS system would consist of a mosaic radar display system capable of processing, storing, and displaying data from as many as 16 separate radar sources. CRaSS would greatly increase the ER’s radar surveillance area and automatically track numerous targets.

The WR already is using a limited version of CRaSS. The WR also has plans for a faster and more accurate “digital rail display” for surveillance of trains transiting the range. However, because of funding and other considerations, the schedule for completing these improvements is uncertain.

Increases in launch area marine and air traffic and more frequent space launches are expected to increase the number of boat and aircraft intruders, especially at the ER. Present surveillance and interdiction capabilities at the ER and WR cannot always detect and clear incursions in time to avoid launch holds and scrubs. The committee believes that immediate improvements are warranted.

Finding 5-2. Detecting marine and aircraft intruders earlier and shortening the time required to clear them from the launch area would reduce disruptions, costs, and risks associated with launch holds and scrubs, especially at the Eastern Range where intruders are more of a problem.

Recommendation 5-2. AFSPC should expeditiously improve range surveillance and interdiction capabilities, as follows:

• Use commercial aircraft equipped with suitable surveillance, navigation, communications, and image recording systems in place of military aircraft.

• Implement the proposed Cape Canaveral Range Surveillance System (CRaSS) for surveillance and clearing of aircraft intruders at the Eastern Range.

Notices to Mariners indicating restricted areas to be avoided and the times they are active are issued before launches. Similar voice alerts are broadcast periodically over marine channels. However, these warnings are not easily accessible to many members of the pleasure-boating community, and, as a result, they are only partly effective. Public awareness and community support could be improved by more effective dissemination of information regarding hazardous launch areas. Options include public service and paid announcements on radio and television,

local newspapers, the Internet, town meetings, and focused notices at marinas and commercial fishing ports. The committee believes that an aggressive, concerted education and publicity effort would greatly increase public awareness of launch hazards and reduce the incidence of both surface and airborne incursions.

NOTAMs provide similar warnings to the aviation community. Although NOTAMs are readily accessible to the pilots of most military and commercial flights, they may not be as available to general aviation pilots operating out of small or uncontrolled airports (i.e., airports without air traffic controllers). Many of these pilots do not file flight plans and do not communicate frequently with the FAA’s ATC facilities. As a result, NOTAMs are only partly effective in preventing incursions by this segment of the aviation community. A more effective notification process would benefit both the general aviation community and the ranges.

Enforcement action against marine intruders inside the 12-mile limit can be taken under Title 33, Part 334 of the Code of Federal Regulations. Pilots licensed by the FAA also can be sanctioned. However, enforcement actions against intruders at either the WR or ER are rare. In contrast, at the launch site in Kourou, French Guyana, government authorities are very aggressive in taking action against intruders.

Commercial fishing vessels have substantial financial incentives to continue operations in active hazard areas, and pleasure boaters may have a strong desire to obtain a close vantage point for viewing a launch. They may also be reluctant to interrupt their activities to leave proscribed areas. The frequent incursions of pleasure boaters also demonstrates that the perceived level of personal risk is not an effective deterrent. Finally, intruders rarely face direct penalties, or even censure, for noncompliance.

The situation is much the same with general aviation pilots. Having the equivalent of “front row seats” to a spectacular and dramatic, if not historic, event is understandably appealing to many people. Both the Atlantic and Pacific coastal areas of the United States offer scenic views for pleasure fliers. Because many general aviation pilots don’t understand the risk that a launch accident could pose to their aircraft, it is not surprising that intruders are sometimes a problem.

Finding 5-3. Current guidelines and procedures for notifying operators of general aviation aircraft and small boats of active launch hazard areas do not prevent incursions, especially at the Eastern Range.

Recommendation 5-3. AFSPC should improve the launch communications and notification process, as follows:

• Make greater use of public media, such as newspapers, radio and television broadcasts, the Internet, notices at public marinas and general aviation airports, and aviation and marine weather broadcasts.

• Modify signs, lights, and other warning devices at marinas and along the coast, as necessary.

• Inform the public on the extent of safe viewing areas to discourage operators of small boats and aircraft from encroaching on hazard areas.

Although an aggressive notification and education process directed at the flying and boating public is expected to contribute significantly to increasing community support and reducing the number of incursions, additional action is needed to address the intruder problem.

Recommendation 5-4. In combination with efforts to improve surveillance and interdiction capabilities and the public notification process, AFSPC should aggressively enforce restrictions against intruders at both ranges to encourage compliance with launch notifications. In cooperation with the U.S. Coast Guard, the Federal Aviation Administration, the U.S. Attorney’s Office, and other regulatory and law enforcement agencies, AFSPC should initiate administrative and regulatory changes to facilitate enforcement action against intruders who were afforded ample, timely launch notifications.

EWR 127-1 (Eastern and Western Range Safety Requirements). 1997. Available on line at: http://www.pafb.af.mil/45sw/rangesafety/ewr97.htm January 20, 2000.

RCC (Range Commanders Council). 1997a. Common Risk Criteria for National Test Ranges: Inert Debris. AD-A324356. RCC Standard 321-97. February 1997. Available on line at: http://www.jcte.jcs.mil/RCC/oldoc.htm January 28, 2000.

RCC. 1997b. Supplement to Common Risk Criteria for National Test Ranges: Inert Debris. AD-A324955. February 1997. Available on line at: http://www.jcte.jcs.mil/RCC/oldoc.htm January 28, 2000.

RTI (Research Triangle Institute). 1997. Flight Control and Analysis General Reference Handbook. RTI/6762/03-02F. Prepared for 30th and 45th Space Wings, April 24, 1997. Patrick Air Force Base, Fla.: 45th Space Wing.