Transport Canada’s Safety Review: Understanding QRA, Risk Thresholds, and Flight Safety Requirements

Why the Safety Review Is the Heart of Your ATL Application

Of the seven review categories in a Transport Canada Authorization to Launch application, the Safety Review — formally split into Flight Safety and Ground Safety — is the one that most operators underestimate. It is not a bureaucratic checklist. It is a rigorous, engineering-based demonstration that your launch vehicle will not endanger the uninvolved public, civil aviation, or on-orbit assets to an unacceptable degree.

TC’s risk criteria are directly informed by established international standards, and the agency explicitly references the U.S. FAA Part 450 methodology as an Accepted Means of Compliance (AMC). This matters practically: it means that operators who have already built FAA-compatible safety analyses can reuse much of that work — but with Canadian-specific population data and airspace characteristics.

The safety review also interacts heavily with other review categories. Your trajectory analysis feeds the payload review (orbital parameters, disposal), the security review (flight termination system integrity), and the financial responsibility review (the QRA output informs the insurance coverage amount TC will require). Getting the safety analysis right, early, unlocks the rest of the application.

The Four Quantitative Risk Thresholds

Every launch application must demonstrate that all four of the following thresholds are met simultaneously for every flight. Satisfying three out of four is not sufficient — TC treats these as conjunctive requirements, not alternative safety tests.

How Expected Casualties (Ec) Is Calculated

The Ec calculation is the numerical core of every rocket launch safety analysis. TC’s framework, consistent with FAA Part 450, structures it as a summation over all credible failure modes along the trajectory. Here is the canonical form:

Where:

• P_debris(tᵢ) — the probability that a debris-generating failure occurs at trajectory sample point i. This is typically derived from the vehicle’s unreliability curve and mission phase failure modes (FMEA/FTA outputs).
• ρⱼ — the population density (people/km²) in Dissemination Area j within the 3σ impact footprint. Statistics Canada 2021 Census data is the standard source for Canadian territory.
• A_3σ(σᵢ) — the area of the 3-sigma impact dispersion ellipse (km²) at sample i. The dispersion grows with altitude, propellant mass, and wind uncertainty.
• P_cas|deb(σᵢ) — the conditional probability of casualty given debris impact. For fragments above the casualty area threshold (~2.83 cm² presented area), TC references the FAA shelter model: P_cas ≈ A_frag / A_person × (1 − shielding factor).

In practice, the trajectory is discretised into sample points at regular time or altitude intervals. For each sample, the probability-weighted casualty contribution is computed and the results summed. The CanLaunch platform automates this computation using real Statistics Canada Dissemination Area population grids and your vehicle’s simulated 3σ dispersion at each mission phase.

Population Data Requirements

TC’s application requirements are explicit: the QRA must use real population data, not simplified models. For launches overflying Canadian territory, this means Statistics Canada Dissemination Area-level data (the finest spatial resolution of the Census). For trajectories that pass over maritime zones or cross into U.S. airspace, equivalent data sources for those jurisdictions must be used.

Transient population is a common oversight. Residential census data systematically undercounts people in:

• Major airports and their ground access routes during peak hours
• Commercial and industrial zones with large daytime workforces
• Sports venues, concert halls, and major event sites
• Seasonal tourist areas (notably relevant for northern Canadian launch sites)

Your QRA must account for these transient populations, particularly when the High Consequence Event threshold analysis is performed.

System Safety Program (SSP) Requirements

The System Safety Program is not a document — it is a living organizational framework that must be established, documented, and actively operated throughout the entire launch lifecycle. TC requires it to be in place before the ATL is issued and to remain operational through post-mission activities.

The SSP must contain, at minimum:

• Hazard analysis covering all vehicle systems and launch site interfaces. The minimum required level is a Preliminary Hazard Analysis (PHA). For safety-critical systems (propulsion, range safety, flight termination), TC expects Fault Tree Analysis (FTA) and Failure Modes and Effects Analysis (FMEA).
• Safety requirements derived from the hazard analysis, with full traceability — each safety requirement must be traceable back to the specific hazard it mitigates.
• Safety Review Panel (or equivalent oversight body) with documented authority to halt launch operations. This must be a real body, not a paper construct.
• Configuration control procedures for all safety-critical design changes. Any change to a safety-critical system after ATL issuance triggers a notification obligation to TC.
• Emergency response procedures integrated with the launch site’s mishap plan and coordinated with local emergency services.
• Training and qualification records for all personnel involved in hazardous operations.

Flight Safety Documentation Package

The Flight Safety component of the Safety Review requires seven categories of analysis and documentation. Each is a substantial technical work product in its own right.

1. Trajectory Analysis

You must provide nominal and three-sigma dispersed trajectories for all mission phases: ascent, stage separations, fairing jettison, MECO, and reentry/impact of all hardware. The 3σ trajectories define the debris footprint boundaries and drive the Ec calculation. All analysis must use SI (metric) units. TC references RCC 321 as the accepted methodology for trajectory analysis.

2. Quantitative Risk Assessment (QRA)

The complete Ec calculation using real population data addressing all failure modes with probability-weighted casualty expectation. This is the document that directly demonstrates compliance with all four risk thresholds. The QRA must be submitted with supporting data files — not just a summary PDF — so TC can verify the calculations independently.

3. Flight Hazard Areas (FHA)

Defined corridors for land, sea, and air hazard notifications. FHAs must be formally submitted to Nav Canada for NOTAM issuance at least 30 days before the planned launch. They must cover all nominal operations (stage impact zones, fairing impact zones) and all credible abort scenarios. FHA maps must be provided in both PDF and GIS/KML formats.

4. Flight Termination System (FTS)

If required by TC (typically for vehicles with sufficiently high Ec contribution from a malfunction that the FTS enables trajectory correction): full design documentation, bench and integrated test records, reliability demonstration to the required level (typically > 0.999 per activation), and operator qualification records for FTS personnel. TC references RCC 319 as the accepted standard for FTS design and testing.

5. Debris Analysis

Predicted impact footprints for all nominal hardware separations (spent stages, fairings, payload adapters) and for all significant failure modes. For each debris item, the analysis must characterise the presented area, mass, ballistic coefficient, and resulting casualty area — the inputs to the P_cas|deb term in the Ec calculation.

6. Collision Avoidance (COLA)

COLA analysis for both air traffic (using 25th percentile Nav Canada traffic density data) and, for orbital missions, on-orbit objects (coordinated with LeoLabs and US Space Command). The aircraft COLA must be performed for the specific launch window and azimuth, not as a generic assessment.

7. Upper Stage Disposal (Orbital Missions)

Trajectory analysis for all spent upper stages demonstrating compliance with orbital debris mitigation guidelines: LEO objects must deorbit within 5 years; GEO objects must be moved to graveyard orbit. The disposal plan must include remaining propellant margin and confirmation that passivation (propellant venting, battery discharge) can be completed within the required timeframe.

Ground Safety Documentation

The Ground Safety component addresses hazards at the launch site itself, independent of the flight trajectory. Six core areas must be covered:

• Explosive Site Plan (ESP) — uses TC-specified energetic liquid equivalency tables to classify all explosive hazard quantities and calculate required separation distances between propellant storage, handling, and personnel areas.
• Quantity-Distance (QD) calculations — for all propellant storage, transfer, and handling areas per NFPA 495 or equivalent. Must cover liquid oxygen, liquid hydrogen, RP-1, hydrazine, NTO, and solid propellant grains as applicable to your vehicle.
• Lightning protection system — documentation of compliance with NFPA 780, CAN/CSA-B72, or equivalent. Includes bonding and grounding plans for all propellant systems. Lightning-induced ignition of propellants is a well-documented hazard that TC takes seriously.
• Pressure vessel documentation — inspection records, certification, and compliance records for all pressure vessels on the vehicle and ground support equipment.
• Hazardous material handling plans — covering all propellants and oxidisers.
• Public access control — procedures ensuring no unauthorised personnel are within the defined hazard area during any hazardous operations, with documented enforcement mechanisms.

Accepted Means of Compliance: What TC Recognises

TC’s Application Requirements explicitly reference specific FAA technical orders and Range Commanders Council (RCC) standards as Accepted Means of Compliance. Using these standards means TC accepts your approach without requiring a separate methodology justification.

Practical Guidance for Your Safety Case

Start with the trajectory, then build the risk model

The QRA cannot be completed without a trajectory, and the trajectory defines all downstream analysis (FHA, COLA, debris, Ec). Invest early in a high-fidelity trajectory simulation — whether that is a proprietary 6DOF model, RocketPy, or a licensed simulation environment — before building your safety case around it. The CanLaunch platform provides trajectory simulation and Ec computation so you can stress-test your mission parameters before engaging TC.

Select your launch site for its risk profile, not just operational convenience

Canada’s geography is a significant advantage for meeting TC’s risk thresholds. Maritime Launch Services’ Canso Spaceport in Nova Scotia, for example, enables downrange trajectories over the Atlantic Ocean — dramatically reducing the population exposure term in the Ec calculation. Sites closer to major population centres will require more conservative trajectories or additional safety systems to achieve the same risk level.

Model your Ec before you design your trajectory

The Ec threshold is the most likely binding constraint in your safety analysis. Run the calculation at the concept design stage, not just at the application stage. Understanding which mission phases and which geographic segments contribute most to your total Ec lets you design the trajectory to minimize risk — by avoiding population centres, choosing overflight altitudes that reduce debris casualty area, or adjusting launch azimuth to route over lower-density areas.

Plan for iterative safety review interaction

The Safety Review is explicitly described by TC as an iterative process. Expect Requests for Additional Information (RAIs), particularly on QRA methodology and population data sources. Treating the safety case as a living document — rather than a one-time submission — and responding promptly to RAIs is the single most effective way to keep the review moving forward.

How CanLaunch Supports Your Safety Case

The CanLaunch platform is built specifically around the computational requirements of the TC safety review. The dashboard provides:

• Trajectory simulation — parametric 6DOF-style simulation with configurable vehicle presets (Aurora, Falcon-class) or user-uploaded trajectory files (CSV, JSON, KML)
• Real-time Ec computation — convolution of trajectory debris footprints with Statistics Canada 2021 Census Dissemination Area population grids
• Flight Hazard Area visualisation — interactive Mapbox map showing debris corridor, 3σ dispersion envelopes, and population density overlay
• Advanced Risk Mode — step-through visualisation of trajectory → debris corridor → population exposure → convolution heat map, with per-sample Ec breakdown table and parameter sensitivity controls
• Individual Risk (IR) computation — maximum IR along the ground track for uninvolved public exposure
• NOTAM and weather integration — real-time airspace conflict detection and Launch Commit Criteria weather checks

For guidance purposes only — not legal advice. Based on TC Draft Application Requirements v0.4 (April 2025). Verify all requirements at tc.canada.ca.