I417.1   General

This appendix provides methodologies for performing toxic release hazard analysis for the flight of a launch vehicle as required by §417.227 and for launch processing at a launch site in the United States as required by §417.407(f). The requirements of this appendix apply to a launch operator and the launch operator's toxic release hazard analysis unless the launch operator clearly and convincingly demonstrates that an alternative approach provides an equivalent level of safety.

I417.3   Identification of non-toxic and toxic propellants

(a) General. A launch operator's toxic release hazard analysis for launch vehicle flight (section I417.5) and for launch processing (section I417.7) must identify all propellants used for each launch and identify whether each propellant is toxic or non-toxic as required by this section.

(b) Non-toxic exclusion. A launch operator need not conduct a toxic release hazard analysis under this appendix for flight or launch processing if its launch vehicle, including all launch vehicle components and payloads, uses only those propellants listed in Table I417-1.

(c) Identification of toxic propellants. A launch operator's toxic release hazard analysis for flight and for launch processing must identify all toxic propellants used for each launch, including all toxic propellants on all launch vehicle components and payloads. Table I417-2 lists commonly used toxic propellants and the associated toxic concentration thresholds used by the Federal launch ranges for controlling potential public exposure. The toxic concentration thresholds contained in Table I417-2 are peak exposure concentrations in parts per million (ppm). A launch operator must perform a toxic release hazard analysis to ensure that the public is not exposed to concentrations above the toxic concentration thresholds for each toxicant involved in a launch. A launch operator must use the toxic concentration thresholds contained in table I417-2 for those propellants. Any propellant not identified in table I417-1 or table I417-2 falls into the category of unique or uncommon propellants, such as those identified in table I417-3, which are toxic or produce toxic combustion by-products. Table I417.3 is not an exhaustive list of possible toxic propellants and combustion by-products. For a launch that uses any propellant listed in table I417-3 or any other unique propellant not listed, a launch operator must identify the chemical composition of the propellant and all combustion by-products and the release scenarios. A launch operator must determine the toxic concentration threshold in ppm for any uncommon toxic propellant or combustion by-product in accordance with the following:

(1) For a toxicant that has a level of concern (LOC) established by the U.S. Environmental Protection Agency (EPA), Federal Emergency Management Agency (FEMA), or Department of Transportation (DOT), a launch operator must use the LOC as the toxic concentration threshold for the toxic release hazard analysis except as required by paragraph (c)(2) of this section.

(2) If an EPA acute emergency guidance level (AEGL) exists for a toxicant and is more conservative than the LOC (that is, lower after reduction for duration of exposure), a launch operator must use the AEGL instead of the LOC as the toxic concentration threshold.

(3) A launch operator must use the EPA's Hazard Quotient/Hazard Index (HQ/HI) formulation to determine the toxic concentration threshold for mixtures of two or more toxicants.

(4) If a launch operator must determine a toxic concentration threshold for a toxicant for which an LOC has not been established, the launch operator must clearly and convincingly demonstrate through the licensing process that public exposure at the proposed toxic concentration threshold will not cause a casualty.

I417.5   Toxic release hazard analysis for launch vehicle flight

(a) General. For each launch, a launch operator's toxic release hazard analysis must determine all hazards to the public from any toxic release that will occur during the proposed flight of a launch vehicle or that would occur in the event of a flight mishap. A launch operator must use the results of the toxic release hazard analysis to establish for each launch, in accordance with §417.113(c), flight commit criteria that protect the public from a casualty arising out of any potential toxic release. A launch operator's toxic release hazard analysis must determine if toxic release can occur based on an evaluation of the propellants, launch vehicle materials, and estimated combustion products. This evaluation must account for both normal combustion products and the chemical composition of any unreacted propellants.

(b) Evaluating toxic hazards for launch vehicle flight. Each launch must satisfy either the exclusion requirements of section I417.3(b), the containment requirements of paragraph (c) of this section, or the statistical risk management requirements of paragraph (d) of this section, to prevent any casualty that could arise out of exposure to any toxic release.

(c) Toxic containment for launch vehicle flight. For a launch that uses any toxic propellant, a launch operator's toxic release hazard analysis must determine a hazard distance for each toxicant and a toxic hazard area for the launch. A hazard distance for a toxicant is the furthest distance from the launch point where toxic concentrations may be greater than the toxicant's toxic concentration threshold in the event of a release during flight. A launch operator must determine the toxic hazard distance for each toxicant as required by paragraphs (c)(1) and (c)(2) of this section. A toxic hazard area defines the region on the Earth's surface that may be exposed to toxic concentrations greater than any toxic concentration threshold of any toxicant involved in a launch in the event of a release during flight. A launch operator must determine a toxic hazard area in accordance with paragraph (c)(3) of this section. In order to achieve containment, a launch operator must evacuate the public from a toxic hazard area as required by paragraph (c)(4) of this section or employ meteorological constraints as required by paragraph (c)(5) of this section. A launch operator must determine the hazard distance for a quantity of toxic propellant and determine and implement a toxic hazard area for a launch as follows:

(1) Hazard distances for common propellants. Table I417-4 lists toxic hazard distances as a function of propellant quantity and toxic concentration threshold for commonly used propellants released from a catastrophic launch vehicle failure. Tables I417-10 and I417-11 list the hazard distance as a function of solid propellant mass for HC1 emissions during a launch vehicle failure and during normal flight for ammonium perchlorate based solid propellants. A launch operator must use the hazard distances corresponding to the toxic concentration thresholds established for a launch to determine the toxic hazard area for the launch in accordance with paragraph (c)(3) of this section.

(2) Hazard distances for uncommon or unique propellants. For a launch that involves any uncommon or unique propellant, a launch operator must determine the toxic hazard distance for each such propellant using an analysis methodology that accounts for the following worst case conditions:

(i) Surface wind speed of 2.9 knots with a wind speed increase of 1.0 knot per 1000 feet of altitude.

(ii) Surface temperature of 32 degrees Fahrenheit with a dry bulb temperature lapse rate of 13.7 degrees Fahrenheit per 1000 feet over the first 500 feet of altitude and a lapse rate of 3.0 degrees F per 1000 feet above 500 feet.

(iii) Directional wind shear of 2 degrees per 1000 feet of altitude.

(iv) Relative humidity of 50 percent.

(v) Capping temperature inversion at the thermally stabilized exhaust cloud center of mass altitude.

(vi) Worst case initial source term assuming instantaneous release of fully loaded propellant storage tanks or pressurized motor segments.

(vii) Worst case combustion or mixing ratios such that production of toxic chemical species is maximized within the bounds of reasonable uncertainties.

(viii) Evaluation of toxic hazards for both normal launch and vehicle abort failure modes.

(3) Toxic hazard area. Having determined the toxic hazard distance for each toxicant, a launch operator must determine the toxic hazard area for a launch as a circle centered at the launch point with a radius equal to the greatest toxic hazard distance determined as required by paragraphs (c)(1) and (c)(2) of this section, of all the toxicants involved in the launch. A launch operator does not have to satisfy paragraph (c)(3) of this section if:

(i) The launch operator demonstrates that there are no populated areas contained or partially contained within the toxic hazard area; and

(ii) The launch operator ensures that no member of the public is present within the toxic hazard area during preflight fueling, launch countdown, flight and immediate postflight operations at the launch site. To ensure the absence of the public, a launch operator must develop flight commit criteria and related provisions for implementation as part of the launch operator's flight safety plan and hazard area surveillance and clearance plan developed under §§417.111(b) and 417.111(j), respectively.

(4) Evacuation of populated areas within a toxic hazard area. For a launch where there is a populated area that is contained or partially contained within a toxic hazard area, the launch operator does not have to satisfy paragraph (c)(5) of this section if the launch operator evacuates all people from all populated areas at risk and ensures that no member of the public is present within the toxic hazard area during preflight fueling and flight. A launch operator must develop flight commit criteria and provisions for implementation of the evacuations as part of the launch operator's flight safety plan, hazard area surveillance and clearance plan, and local agreements and public coordination plan developed according to §§417.111(b), 417.111(j) and 417.111(i), respectively.

(5) Flight meteorological constraints. For a launch where there is a populated area that is contained or partially contained within a toxic hazard area and that will not be evacuated under paragraph (c)(4) of this section, the launch is exempt from any further requirements of this section if the launch operator constrains the flight of a launch vehicle to favorable wind conditions or during times when atmospheric conditions result in reduced toxic hazard distances such that any potentially affected populated area is outside the toxic hazard area. A launch operator must employ wind and other meteorological constraints as follows:

(i) When employing wind constraints, a launch operator must re-define the toxic hazard area by reducing the circular toxic hazard area determined under paragraph (c)(3) of this section to one or more arc segments that do not contain any populated area. Each arc segment toxic hazard area must have the same radius as the circular toxic hazard area and must be defined by a range of downwind bearings.

(ii) The launch operator must demonstrate that there are no populated areas within any arc segment toxic hazard area and that no member of the public is present within an arc segment toxic hazard area during preflight fueling, launch countdown, and immediate postflight operations at the launch site.

(iii) A launch operator must establish wind constraints to ensure that any winds present at the time of flight will transport any toxicant into an arc segment toxic hazard area and away from any populated area. For each arc segment toxic hazard area, the wind constraints must consist of a range of downwind bearings that are within the arc segment toxic hazard area and that provide a safety buffer, in both the clockwise and counterclockwise directions, that accounts for any uncertainty in the spatial and temporal variations of the transport winds. When determining the wind uncertainty, a launch operator must account for the variance of the mean wind directions derived from measurements of the winds through the first 6000 feet in altitude at the launch point. Each clockwise and counterclockwise safety buffer must be no less than 20 degrees of arc width within the arc segment toxic hazard area. A launch operator must ensure that the wind conditions at the time of flight satisfy the wind constraints. To accomplish this, a launch operator must monitor the launch site vertical profile of winds from the altitude of the launch point to no less than 6,000 feet above ground level. The launch operator must proceed with a launch only if all wind vectors within this vertical range satisfy the wind constraints. A launch operator must develop wind constraint flight commit criteria and implementation provisions as part of the launch operator's flight safety plan and its hazard area surveillance and clearance plan developed according to §§417.111(b) and 417.111(j), respectively.

(iv) A launch operator may reduce the radius of the circular toxic hazard area determined in accordance with paragraph (c)(3) of this section by imposing operational meteorological restrictions on specific parameters that mitigate potential toxic downwind concentrations levels at any potentially affected populated area to levels below the toxic concentration threshold of each toxicant in question. The launch operator must establish meteorological constraints to ensure that flight will be allowed to occur only if the specific meteorological conditions that would reduce the toxic hazard area exist and will continue to exist throughout the flight.

(d) Statistical toxic risk management for flight. If a launch that involves the use of a toxic propellant does not satisfy the containment requirements of paragraph (c) of this section, the launch operator must use statistical toxic risk management to protect public safety. For each such case, a launch operator must perform a toxic risk assessment and develop launch commit criteria that protect the public from unacceptable risk due to planned and potential toxic release. A launch operator must ensure that the resultant toxic risk meets the collective and individual risk criteria requirements contained in §417.107(b). A launch operator's toxic risk assessment must account for the following:

(1) All credible vehicle failure and non-failure modes, along with the consequent release and combustion of propellants and other vehicle combustible materials.

(2) All vehicle failure rates.

(3) The effect of positive or negative buoyancy on the rise or descent of each released toxicant.

(4) The influence of atmospheric physics on the transport and diffusion of each toxicant.

(5) Meteorological conditions at the time of launch.

(6) Population density, location, susceptibility (health categories) and sheltering for all populations within each potential toxic hazard area.

(7) Exposure duration and toxic propellant concentration or dosage that would result in casualty for all populations.

(e) Flight toxic release hazard analysis products. The products of a launch operator's toxic release hazard analysis for launch vehicle flight to be filed in accordance with §417.203(e) must include the following:

(1) For each launch, a listing of all propellants used on all launch vehicle components and any payloads.

(2) The chemical composition of each toxic propellant and all toxic combustion products.

(3) The quantities of each toxic propellant and all toxic combustion products involved in the launch.

(4) For each toxic propellant and combustion product, identification of the toxic concentration threshold used in the toxic risk analysis and a description of how the toxic concentration threshold was determined if other than specified in table I417.2.

(5) When using the toxic containment approach of paragraph (c) of this section:

(i) The hazard distance for each toxic propellant and combustion product and a description of how it was determined.

(ii) A graphic depiction of the toxic hazard area or areas.

(iii) A listing of any wind or other constraints on flight, and any plans for evacuation.

(iv) A description of how the launch operator determines real-time wind direction in relation to the launch site and any populated area and any other meteorological condition in order to implement constraints on flight or to implement evacuation plans.

(6) When using the statistical toxic risk management approach of paragraph (d) of this section:

(i) A description of the launch operator's toxic risk management process, including an explanation of how the launch operator ensures that any toxic risk from launch meets the toxic risk criteria of §417.107(b).

(ii) A listing of all models used.

(iii) A listing of all flight commit criteria that protect the public from unacceptable risk due to planned and potential toxic release.

(iv) A description of how the launch operator measures and displays real-time meteorological conditions in order to determine whether conditions at the time of flight are within the envelope of those used by the launch operator for toxic risk assessment and to develop flight commit criteria, or for use in any real-time physics models used to ensure compliance with the toxic flight commit criteria.

I417.7   Toxic release hazard analysis for launch processing

(a) General. A launch operator must perform a toxic release hazard analysis to determine potential public hazards from toxic releases that will occur during normal launch processing and that will occur in the event of a mishap during launch processing. This section implements the ground safety requirements of §417.407(g). A launch operator must use the results of the toxic release hazard analysis to establish hazard controls for protecting the public. A launch operator must include the toxic release hazard analysis results in the ground safety plan as required by §417.111(c).

(b) Process hazards analysis. A launch operator must perform an analysis on all processes to identify toxic hazards and determine the potential for release of a toxic propellant. The analysis must account for the complexity of the process and must identify and evaluate the hazards and each hazard control involved in the process. An analysis that complies with 29 CFR 1910.119(e) satisfies paragraphs (b)(1) and (b)(2) of this section. A launch operator's process hazards analysis must include the following:

(1) Identify and evaluate each hazard of a process involving a toxic propellant using an analysis method, such as a failure mode and effects analysis or fault tree analysis.

(2) Describe:

(i) Each toxic hazard associated with the process and the potential for release of toxic propellants;

(ii) Each mishap or incident experienced which has a potential for catastrophic consequences;

(iii) Each engineering and administrative control applicable to each hazard and their interrelationships, such as application of detection methodologies to provide early warning of releases and evacuation of toxic hazard areas prior to conducting an operation that involves a toxicant;

(iv) Consequences of failure of engineering and administrative controls;

(v) Location of the source of the release;

(vi) All human factors;

(vii) Each opportunity for equipment malfunction or human error that can cause an accidental release;

(viii) Each safeguard used or needed to control each hazard or prevent equipment malfunctions or human error;

(ix) Each step or procedure needed to detect or monitor releases; and

(x) A qualitative evaluation of a range of the possible safety and health effects of failure of controls.

(3) The process hazards analysis must be updated for each launch. The launch operator must conduct a review of all the hazards associated with each process involving a toxic propellant for launch processing. The review must include inspection of equipment to determine whether the process is designed, fabricated, maintained, and operated according to the current process hazards analysis. A launch operator must revise a process hazards analysis to reflect changes in processes, types of toxic propellants stored or handled, or other aspects of a source of a potential toxic release that can affect the results of overall toxic release hazard analysis.

(4) The personnel who perform a process hazard analysis must possess expertise in engineering and process operations, and at least one person must have experience and knowledge specific to the process being evaluated. At least one person must be knowledgeable in the specific process hazard analysis methodology being used.

(5) A launch operator must resolve all recommendations resulting from a process hazards analysis in a timely manner prior to launch processing and the resolution must be documented. The documentation must identify each corrective action and include a written schedule of when any such actions are to be completed.

(c) Evaluating toxic hazards of launch processing. A launch operator must protect the public from each potential toxic hazard identified by the process hazards analysis required by paragraph (b) of this section, the exclusion requirements of section I417.3(b), the containment requirements of paragraph (d) of this section, or the statistical risk management requirements of paragraph (l) of this section, to prevent any casualty that could arise out of exposure to any toxic release.

(d) Toxic containment for launch processing. A launch operator's toxic release hazard analysis must determine a toxic hazard area surrounding the potential release site for each toxic propellant based on the amount and toxicity of the propellant and the meteorological conditions involved. A launch operator must determine whether there are populated areas located within a toxic hazard area that satisfy paragraph (h) of this section. If necessary to achieve toxic containment, a launch operator must evacuate the public in order to satisfy paragraph (i) of this section or employ meteorological constraints that satisfy paragraph (j) of this section. A launch operator, in determining a toxic hazard area, must first perform a worst-case release scenario analysis that satisfies paragraph (e) of this section or a worst-case alternative release scenario analysis that satisfies paragraph (f) of this section for each process that involves a toxic propellant. The launch operator must then determine a toxic hazard distance for each process that satisfies paragraph (g) of this section.

(e) Worst-case release scenario analysis. A launch operator's worst-case release scenario analysis must account for the following:

(1) Determination of worst-case release quantity. A launch operator must determine the worst-case release quantity of a toxic propellant by selecting the greater of the following:

(i) For substances in a vessel, the greatest amount held in a single vessel, accounting for administrative controls that limit the maximum quantity; or

(ii) For toxic propellants in pipes, the greatest amount in a pipe, accounting for administrative controls that limit the maximum quantity.

(2) Worst-case release scenario for toxic liquids. A launch operator must determine the worst-case release scenario for a toxic liquid propellant as follows:

(i) A launch operator must assume that for toxic propellants that are normally liquids at ambient temperature, the quantity in the vessel or pipe, as determined in paragraph (e)(1) of this section, is spilled instantaneously to form a liquid pool.

(ii) The launch operator must determine surface area of the pool by assuming that the liquid spreads to one centimeter deep unless passive mitigation systems are in place that serve to contain the spill and limit the surface area. Where passive mitigation is in place, the launch operator must use the surface area of the contained liquid to calculate the volatilization rate.

(iii) If the release occurs on a surface that is not paved or smooth, the launch operator may account for actual surface characteristics.

(iv) The volatilization rate must account for the highest daily maximum temperature occurring in the past three years, the temperature of the substance in the vessel, and the concentration of the toxic propellants if the liquid spilled is a mixture or solution.

(v) The launch operator must determine rate of release to the air from the volatilization rate of the liquid pool. A launch operator must use either the methodology provided in the Risk Management Plan (RMP) Offsite Consequence Analysis Guidance, dated April 1999, available at http://www.epa.gov/swercepp/ap-ocgu.htm, or an air dispersion modeling technique that satisfies paragraph (g) of this section.

(3) Worst-case release scenario for toxic gases. A launch operator must determine the worst-case release scenario for a toxic gas as follows:

(i) For toxic propellants that are normally gases at ambient temperature and handled as a gas or as a liquid under pressure, the launch operator must assume that the quantity in the vessel, or pipe, as determined in paragraph (e)(1) of this section, is released as a gas over 10 minutes. The launch operator must assume a release rate that is the total quantity divided by 10 unless passive mitigation systems are in place.

(ii) For gases handled as refrigerated liquids at ambient pressure, if the released toxic propellant is not contained by passive mitigation systems or if the contained pool would have a depth of 1 cm or less, the launch operator must assume that the toxic propellant is released as a gas in 10 minutes.

(iii) For gases handled as refrigerated liquids at ambient pressure, if the released toxic propellant is contained by passive mitigation systems in a pool with a depth greater than 1 cm, the launch operator must assume that the quantity in the vessel or pipe, as defined in paragraph (e)(1) of this section, is spilled instantaneously to form a liquid pool. The launch operator must calculate the volatilization rate at the boiling point of the toxic propellant and at the conditions defined in paragraph (e)(2) of this section.

(4) Consideration of passive mitigation. The launch operator must account for passive mitigation systems in the analysis of a worst case release scenario if the passive mitigation system is capable of withstanding the release event triggering the scenario and would function as intended.

(5) Additional factors in selecting a worst-case scenario. A launch operator's worst-case release scenario for a toxic propellant must account for each factor that would result in a greater toxic hazard distance, such as a smaller quantity of the toxic propellant than required by paragraph (e)(1) of this section, that is handled at a higher process temperature or pressure.

(f) Worst-case alternative release scenario analysis. A launch operator's worst-case alternative release scenario analysis must account for the following:

(1) The worst-case release scenario for each toxic propellant and for each toxic propellant handling process;

(2) Each release event that is more likely to occur than the worst-case release scenario that is determined in paragraph (e) of this section;

(3) Each release scenario that exceeds a toxic concentration threshold at a distance that reaches the general public;

(4) Each potential transfer hose release due to splits or sudden hose uncoupling;

(5) Each potential process piping release from failures at flanges, joints, welds, valves, valve seals, and drain bleeds;

(6) Each potential process vessel or pump release due to cracks, seal failure, or drain, bleed, or plug failure;

(7) Each vessel overfilling and spill, or over pressurization and venting through relief valves or rupture disks;

(8) Shipping container mishandling and breakage or puncturing leading to a spill;

(9) Mishandling or dropping flight or ground hardware that contains toxic commodities;

(10) Each active and passive mitigation system provided they are capable of withstanding the event that triggered the release and would still be functional;

(11) History of each accident experienced by the launch operator involving the release of a toxic propellant; and

(12) Each failure scenario.

(g) Toxic hazard distances for launch processing. For each process involving a toxic propellant, a launch operator must perform an air dispersion analysis to determine the hazard distance for the worst-case release scenario or the worst-case alternative release scenario as determined under paragraphs (e) and (f) of this section. A launch operator must use either the methodology provided in the RMP Offsite Consequence Analysis Guidance, dated April 1999, or an air dispersion modeling technique that is applicable to the proposed launch. A launch operator's air dispersion modeling technique must account for the following analysis parameters:

(1) Toxic concentration thresholds. A launch operator must use the toxic concentration thresholds defined by section I417.3(c).

(2) Wind speed and atmospheric stability class. A launch operator, for the worst-case release analysis, must use a wind speed of 1.5 meters per second and atmospheric stability class F. If the launch operator demonstrates that local meteorological data applicable to the source of a toxic release show a higher wind minimum wind speed or less stable atmosphere during the three previous years, the launch operator may use these minimums. The launch operator, for analysis of the worst-case alternative scenario, must use statistical meteorological conditions for the location of the source.

(3) Ambient temperature and humidity. For a worst-case release scenario analysis of a toxic propellant, the launch operator must use the highest daily maximum temperature from the last three years and average humidity for the site, based on temperature and humidity data gathered at the source location or at a local meteorological station. For analysis of a worst-case alternative release scenario, the launch operator must use typical temperature and humidity data gathered at the source location or at a local meteorological station.

(4) Height of release. The launch operator must analyze the worst-case release of a toxic propellant assuming a ground level release. For a worst-case alternative scenario analysis of a toxic propellant, the release scenario may determine release height.

(5) Surface roughness. The launch operator must use either an urban or rural topography, as appropriate. Urban means that there are many obstacles in the immediate area; obstacles include buildings or trees. Rural means there are no buildings in the immediate area and the terrain is generally flat and unobstructed.

(6) Dense or neutrally buoyant gases. Models or tables used for dispersion analysis of a toxic propellant must account for gas density.

(7) Temperature of release substance. For a worst-case release scenario, the launch operator must account for the release of liquids other than gases liquefied by refrigeration at the highest daily maximum temperature, based on data for the previous three years appropriate to the source of the potential toxic release, or at process temperature, whichever is higher. For a worst-case alternative scenario, the launch operator may consider toxic propellants released at a process or ambient temperature that is appropriate for the scenario.

(h) Toxic hazard areas for launch processing. A launch operator, having determined the toxic hazard distance for the toxic concentration threshold for each toxic propellant involved in a process using either a worst-case release scenario or a worst-case alternative release scenario, must determine the toxic hazard area for the process as a circle centered at the potential release point with a radius equal to the greatest toxic hazard distance for the toxic propellants involved in the process. A launch operator does not have to satisfy this section if:

(1) There are no populated areas contained or partially contained within the toxic hazard area; and

(2) There is no member of the public present within the toxic hazard area during the process.

(i) Evacuation of populated areas within a toxic hazard area. For a process where there is a populated area that is contained or partially contained within the toxic hazard area, the launch processing operation does not have to satisfy this section if the launch operator evacuates the public from the populated area and ensures that no member of the public is present within the toxic hazard area during the operation. A launch operator must coordinate notification and evacuation procedures with the Local Emergency Planning Committee (LEPC) and ensure that notification and evacuation occurs according to its launch plans, including the launch operator's ground safety plan, hazard area surveillance and clearance plan, accident investigation plan, and local agreements and public coordination plan.

(j) Meteorological constraints for launch processing. For a launch processing operation with the potential for a toxic release where there is a populated area that is contained or partially contained within the toxic hazard area and that will not be evacuated as required by paragraph (i) of this section, the operation is exempt from further requirements in this section if the launch operator constrains the process to favorable wind conditions or during times when atmospheric conditions result in reduced toxic hazard distances such that the potentially affected populated area is outside the toxic hazard area. A launch operator must employ wind and other meteorological constraints that satisfy the following:

(1) A launch operator must limit a launch processing operation to times during which prevailing winds will transport a toxic release away from populated areas that would otherwise be at risk. If the mean wind speed during the operation is equal to or greater than four knots, the launch operator must re-define the toxic hazard area by reducing the circular toxic hazard area as determined in paragraph (h) of this section to one or more arc segments that do not contain a populated area. Each arc segment toxic hazard area must have the same radius as the circular toxic hazard area and must be defined by a range of downwind bearings. If the mean wind speed during the operation is less than four knots, the toxic hazard area for the operation must be the full 360-degree toxic hazard area as defined by paragraph (h) of this section. The total arc width of an arc segment hazard area for launch processing must be greater than or equal to 30 degrees. If the launch operator determines the standard deviation of the measured wind direction, the total arc width of an arc segment hazard area must include all azimuths within the mean measured wind direction plus three sigma and the mean measured wind direction minus three sigma; otherwise, the following apply for the conditions defined by the Pasquil-Gifford meteorological stability classes:

(i) For stable classes D-F, if the mean wind speed is less than 10 knots, the total arc width of the arc segment toxic hazard area must be no less than 90 degrees;

(ii) For stable classes D-F, if the mean wind speed is greater than or equal to 10 knots, the total arc width of the arc segment toxic hazard area must be no less than 45 degrees;

(iii) For neutral class C, the total arc width of the arc segment toxic hazard area must be no less than 60 degrees;

(iv) For slightly unstable class B, the total arc width of the arc segment toxic hazard area must be no less than 105 degrees; and

(v) For mostly unstable class A, the total arc width of the arc segment toxic hazard area must be no less than 150 degrees.

(2) The launch operator must ensure that there are no populated areas within an arc segment toxic hazard area and that no member of the public is present within an arc segment toxic hazard area during the process as defined by paragraph (i) of this section.

(3) A launch operator must establish wind constraints to ensure that winds present at the time of an operation will transport toxicants into an arc segment toxic hazard area and away from populated areas. For each arc segment toxic hazard area, the wind constraints must consist of a range of downwind bearings that are within the arc segment toxic hazard area and that provide a safety buffer, in both the clockwise and counterclockwise directions, that accounts for uncertainty in the spatial and temporal variations of the transport winds.

(4) A launch operator may reduce the radius of the circular toxic hazard area as determined under paragraph (h) of this section by imposing operational meteorological restrictions on specific parameters that mitigate potential toxic downwind concentrations levels at a potentially affected populated area to levels below the toxic concentration threshold of the toxicant in question. The launch operator must establish meteorological constraints to ensure that the operation will be allowed to occur only if the specific meteorological conditions that would reduce the toxic hazard area exist and will continue to exist throughout the operation, or the operation will be terminated.

(k) Implementation of meteorological constraints. A launch operator must use one or more of the following approaches to determine wind direction or other meteorological conditions in order to establish constraints on a launch processing operation or evacuate the populated area in a potential toxic hazard area:

(1) The launch operator must ensure that the wind conditions at the time of the process comply with the wind constraints used to define each arc segment toxic hazard area. The launch operator must monitor the vertical profile of winds at the potential toxic release site from ground level to an altitude of 10 meters or the maximum height above ground of the potential release, whichever is larger. The launch operator may proceed with a launch processing operation only if wind vectors meet the wind constraints used to define each arc segment toxic hazard area.

(2) A launch operator must monitor the specific meteorological parameters that affect toxic downwind concentrations at a potential toxic release site for a process and for the sphere of influence out to each populated area within the potential toxic hazard area as defined by paragraph (h) of this section. The launch operator must monitor spatial variations in the wind field that could affect the transport of toxic material between the potential release site and populated areas. The launch operator must acquire real-time meteorological data from sites between the potential release site and each populated area sufficient to demonstrate that the toxic hazard area, when adjusted to the spatial wind field variations, excludes populated areas. Meteorological parameters that affect toxic downwind concentrations from the potential release site and covering the sphere of influence out to the populated areas must fall within the conditions as determined in paragraph (j)(4) of this section. A launch operator must use one of the following methods to determine the meteorological conditions that will constrain a launch processing operation:

(i) A launch operator may employ real-time air dispersion models to determine the toxic hazard distance for the toxic concentration threshold and proximity of a toxicant to populated areas. A launch operator, when employing this method, must proceed with a launch processing operation only if real-time modeling of the potential release demonstrates that the toxic hazard distance would not reach populated areas. The launch operator's process for carrying out this method must include the use of an air dispersion modeling technique that complies with paragraph (g) of this section and providing real-time meteorological data for the sphere of influence around a potential toxic release site as input to the air dispersion model. The launch operator's process must also include a review of the meteorological conditions to identify changing conditions that could affect the toxic hazard distance for a toxic concentration threshold prior to proceeding with the operation.

(ii) A launch operator may use air dispersion modeling techniques to define the meteorological conditions that, when present, would prevent a toxic hazard distance for a toxic concentration threshold from reaching populated areas. The launch operator, when employing this method, must constrain the associated launch processing operation to be conducted only when the prescribed meteorological conditions exist. A launch operator's air dispersion modeling technique must comply with paragraph (g) of this section.

(l) Statistical toxic risk management for launch processing. The launch operator must use statistical toxic risk management to protect public safety if a process that involves the use of a toxic propellant does not satisfy the containment requirements of paragraph (d) of this section. A launch operator, for each such case, must perform a toxic risk assessment and develop criteria that protect the public from risks due to planned and potential toxic release. A launch operator must ensure that the resultant toxic risk meets the collective and individual risk criteria requirements defined in §417.107(b). A launch operator's toxic risk assessment must account for the following:

(1) All credible equipment failure and non-failure modes, along with the consequent release and combustion of toxic propellants;

(2) Equipment failure rates;

(3) The effect of positive or negative buoyancy on the rise or descent of the released toxic propellants;

(4) The influence of atmospheric physics on the transport and diffusion of toxic propellants released;

(5) Meteorological conditions at the time of the process;

(6) Population density, location, susceptibility (health categories) and sheltering for populations within each potential toxic hazard area; and

(7) Exposure duration and toxic propellant concentration or dosage that would result in casualty for populations.

(m) Launch processing toxic release hazard analysis products. The products of a launch operator's toxic release hazards analysis for launch processing must include the following:

(1) For each worst-case release scenario, a description of the vessel or pipeline and toxic propellant selected as the worst case for each process, assumptions and parameters used, and the rationale for selection of that scenario. Assumptions must include use of administrative controls and passive mitigation that were assumed to limit the quantity that could be released. The description must include the anticipated effect of the controls and mitigation on the release quantity and rate;

(2) For each worst-case alternative release scenario, a description of the scenario identified for each process, assumptions and parameters used, and the rationale for the selection of that scenario. Assumptions must include use of administrative controls and passive mitigation that were assumed to limit the quantity that could be released. The description must include the anticipated effect of the controls and mitigation on the release quantity and rate;

(3) Estimated quantity released, release rate, and duration of release for each worst-case scenario and worst-case alternative scenario for each process;

(4) A description of the methodology used to determine the toxic hazard distance for each toxic concentration threshold;

(5) Data used to estimate off-site population receptors potentially affected; and

(6) The following data for each worst-case scenario and worst-case alternative release scenario:

(i) Chemical name;

(ii) Physical state;

(iii) Basis of results (provide model name if used, or other methodology);

(iv) Scenario (explosion, fire, toxic gas release, or liquid spill and vaporization);

(v) Quantity released in pounds;

(vi) Release rate;

(vii) Release duration;

(viii) Wind speed and atmospheric stability class;

(ix) Topography;

(x) Toxic hazard distance;

(xi) All members of the public within the toxic hazard distance;

(xii) Any passive mitigation considered; and

(xiii) Active mitigation considered (worst-case alternative release scenario only).

[Docket No. FAA-2000-7953, 71 FR 50537, Aug. 25, 2006, as amended by Amdt. No. 417-5, 81 FR 59439, Aug. 30, 2016]