AC 450.45-1

Launch and Reentry of Space Nuclear Systems AC 450.45-1 33

8.3.2 All applicant-developed nuclear safety analyses for payloads should consider the entire mission lifetime. Depending on mission specifics, the mission lifetime may include:

• Pre-Launch;

• Launch;

• Ascent, Early and Late;

• Suborbital, including staging;

• Orbital, including temporary on-orbit operations;

• Earth escape;

• Earth return, including flyby;

• Reentry; and

• End of Mission (EOM), including disposal.

8.3.3 The mission phases for nuclear space launch should cover all launch vehicle or payload potential for any planned or accidental Earth reentry of nuclear material. For example, Earth return scenarios would include considerations for nuclear material launched to:

• Other planetary bodies capable of a free return trajectory to Earth;

• Earth gravity assist fly-by trajectory; or

• Earth orbit intersecting trajectories where planned or accidental Earth reentry of nuclear material is possible.

8.3.4 If reasonably foreseeable scenarios exist that would pose a safety hazard to the public and environment, the nuclear safety analyses performed for licensing should quantify the radiological risk to the public from that scenario and include it in determining the overall mission risk.

8.3.5 The EOM should include safe disposal of the radionuclide. The long-term storage of spent nuclear fuel on Earth has been a problem since the advent of the nuclear industry (GAO 2021). SNS have disposal options at EOM not available to terrestrial nuclear devices, as summarized in Table 4 of this AC, with varying levels of government review required.7 For example, a disposal option for an on-orbit nuclear reactor that has reached criticality might be to boost it into a high disposal orbit to allow sufficient time for radioactive decay of fission products, which could take hundreds or thousands of years (SPD-6 2020). Failure of the vehicle to boost itself or to eject the hot core into a safe disposal orbit could result in an inadvertent public safety reentry hazard (Gummer, et al. 1980). Alternately, if the core were boosted to escape velocity for disposal, it

7 Because spent nuclear fuel is a significant hazard, the disposal plan is evaluated before licensing the launch of the system, even though the ultimate disposal may be years out. Terrestrial disposal will be high risk for systems that have operated critically.

Launch and Reentry of Space Nuclear Systems AC 450.45-1 34 might pose a reentry risk to future public generations should third-body orbital forces cause an eventual inadvertent return. Nuclear safety analyses take into consideration all of these potential scenarios and calculate the PER for each.

Table 4 – Nuclear Material Disposal Options Disposal Location Possibility of Return to Earth Interplanetary Space, No Free- Return Trajectory to Earth None or Extremely Low Lagrange Point L1, L2 and L3 Extremely Low; L4 and L5 None A Sufficiently High Altitude in Earth Orbit Low within the period of concern for radiation exposure to the public On Earth Will happen

8.4 Space Nuclear System Design.

Whether or not an applicant uses the means of compliance outlined in paragraph 8.3 and Appendix A of this AC, the design and any safety analyses conducted by an applicant will be evaluated by the FAA during the license evaluation process to assess public health and safety. SNS designs satisfy a variety of unique, competing design constraints. The performance guidelines in Appendix B give guidance on space specific performance characteristics the FAA has identified to reduce the baseline risk of the SNS.

8.5 Interagency Nuclear Safety Review Board.

8.5.1 When an applicant prepares a SAR, as detailed in Appendix A of this AC, to show compliance with § 450.45(e)(6), applicants should be aware that SARs prepared for commercial launches are distinctly different than those prepared for government launches in that SARs for a Tier II or Tier III government launch must go through an Interagency Nuclear Safety Review Board (INSRB) evaluation, while a SAR for a commercial launch of any Tier may, at the Secretary of Transportation’s discretion, be evaluated by the INSRB. This distinction is important and streamlines the FAA’s ability to license commercial SNS launch and reentry.

8.5.2 Under NSPM-20, the Secretary of Transportation can request no review, a partial review, or a full INSRB evaluation of the SAR. In these cases, the role of the INSRB will be to review the SAR and supporting nuclear safety analyses, to evaluate the quality of the analyses, and to identify specific gaps. This evaluation is then documented in a safety evaluation report, which may include recommendations for how to improve the analyses. The INSRB recommends approvals, and the FAA issues approvals.

Launch and Reentry of Space Nuclear Systems AC 450.45-1 35

8.5.3 The INSRB information is available at https://sma.nasa.gov/sma-disciplines/nuclearflight-safety. Applicants may consider reviewing the INSRB guidance provided to government agencies seeking to launch SNS and other reports related to nuclear technology and safety.

8.6 A pplication Determination .

8.6.1 If applying for a license, after accepting the application and performing the policy review, safety review, payload review, environmental review, and financial responsibility determination, the FAA makes a licensing determination on the SNS on a case-by-case basis, per §450.45(e)(6). If applying for a payload determination, the FAA issues a favorable payload determination if the applicant has obtained all required licenses, authorizations, and permits and its launch or reentry would not jeopardize public health and safety, safety of property, U.S. national security or foreign policy interests, or international obligations of the United States.

Launch and Reentry of Space Nuclear Systems AC 450.45-1 36 Appendix A. Nuclear Safety Information and Analyses A.1 SCOPE.

An applicant using this AC as a means of compliance to § 450.45(e)(6) or § 450.43(a)(2) should provide to the FAA the information and conduct the analyses in this appendix.

A.2 SNS DEVICE AND MISSION DESCRIPTION.

A.2.1 The following information is foundational to the nuclear safety analyses and ultimately the public safety risks of the SNS mission. The applicant should provide the following information to the FAA such as:

• SNS owner and operator;

• SNS type;

• SNS purpose;

• SNS physical dimensions and weight;

• Structural design of SNS components;

• SNS physical barriers to radioactive release;

• SNS instrumentation, monitoring, and control system characteristics;

• SNS fuel design;

• SNS orbital parameters for parking, transfer, and final orbits;

• Hazardous material quantities, including the radioactive material via the RMR;

• Mission stages for the SNS;

• Intended SNS operations during the entire mission;

• Delivery point in flight at which the SNS will no longer be under the launch licensee’s control;

• Methods to prevent and terminate criticality during launch and reentry, as applicable;

• Shielding design and materials used;

• Decay heat generation rates expected during launch or reentry, as applicable;

• Decay heat removal methods, as applicable;

• Decay heat removal capability, as applicable;

• Signal paths from SNS to the operator;

• SNS control system design and operational parameters; and

• SNS and host spacecraft software design, configuration control, and performance.

Launch and Reentry of Space Nuclear Systems AC 450.45-1 37 A.2.2 The purpose of the SNS device and mission description is for applicants to communicate to the FAA what the SNS mission is and how the SNS will be operated.

This information enables the FAA to determine the completeness of subsequent nuclear safety analyses. If the applicant considers other information relevant to the overall SNS design or mission, that information may also be included in the SNS device and mission description. There is no need to include nuclear safety analyses or public safety calculations in the SNS design and mission description, as this information is included in subsequent nuclear safety analysis reports.

A.3 RADIOLOGICAL MATERIAL REPORT.

A.3.1 All applications for SNS should include a RMR, as the type and quantity of radioactive material onboard is the foundation for determining the public safety risk of the SNS and the Tier level of the SNS. For every radionuclide on a launch or reentry vehicle, the RMR:

• Identifies the specific isotope, quantity, total activity and A2 value;8

• Specifies the moment in time at which the activity was measured for each source;

• Describes any NRC or agreement state approval for pre-flight ground testing involving that isotope;

8 Applicants may choose to use MM to describe the activity of the isotope.

Launch and Reentry of Space Nuclear Systems AC 450.45-1 38 Table 5 – Sample Radiological Material Report Source Description Element Symbol EZA Half- Life (Years) (IAEA 2021) Activity per Source (Ci) as Measured on (date) Number of Sources Total Activity (Ci) IAEA A2 (Ci) (IAEA 2018) Mission Multiple MM Material Supplier General purpose heat source fuel clads (Contained in 3 Spacecraft Radioisotope Thermoelectric Generators) Pu94238 as PuO294238

87.7 1,908 As measured on 8-20-2019 216 412,128 0.027 1.53x107 DOE Radioisotope Heater Unit Fuel Clads (Onboard Payload) Pu94238 as Pu94238 O2

87.7

33.6 As measured on 12-16-2020 129 4,334 0.027 1.61x105 DOE Instrument Calibration Source (Encapsulated) Co2760 5.27 6x10-6 As measured on 2-15-2021 2 1.2x10-5 10.8 1.1x10-6 Commercial Source Total 416,462 1.53x107 A.3.2 NSPM-20 specifies that the Tier level determination considers both launch and “subsequent stages when accidents may result in radiological effects to the public or environment” (NSPM-20 2019), which drives the potential need for RMR addendums to determine the Tier level of the SNS. For example, a fission reactor may meet Tier II criteria at launch, but after operation the resulting risk of the SNS and mission may meet the Tier III criteria, making it a Tier III system. Robust computer codes exist to model the burnup of nuclear fuel and aid in developing the RMR addendums (Argonne National Laboratory 2016), (Nuclear Regulatory Commission 2018). Table 5 of this AC shows a sample RMR for a mission using multiple radioactive devices, applicants may develop their own format that displays the essential information in a clear manner.

• Includes a RMR addendum addressing the safe terrestrial handling, use, and storage of all the isotopes in the SNS;

• Includes a RMR addendum showing the isotopic makeup of the SNS at the following times:

a. Launch;

b. During all planned flybys;

c. During planned reentry, as applicable for the mission.

• If the SNS can over time develop an isotopic composition more harmful than that at launch, the RMR also includes an addendum for the worst time in life that the SNS will have potential to return to Earth.

Launch and Reentry of Space Nuclear Systems AC 450.45-1 39 A.4 CRITICALITY HAZARD ANALYSIS.

A.4.1 From the RMR, applicants will be able to quickly identify whether their SNS contains fertile material, fissionable material, or fissile material, as defined by the NRC or the IAEA (IAEA 2002), (Nuclear Regulatory Commission 2020). If these isotopes are present, or will become present as the SNS operates, then a criticality hazard analysis is needed to determine if the SNS has potential for criticality during normal SNS operations or off-nominal events in all mission phases (NSPM-20 2019). The criticality hazard analysis step is included even for an SNS with small amounts of fertile, fissionable, or fissile material because critical mass limits have not been established for space environments, since fission can dramatically change the public safety profile of the SNS, including nuclear proliferation concerns and ionizing radiation exposure potential (Connell and Trost 1994).

A.4.2 If a criticality hazard analysis is required, the analysis is conducted by first identifying all reasonably foreseeable hazards which may contribute to fission occurring in the SNS, using valid scientific principles and statistical methods. Examples of relevant information for completing a criticality hazard analysis include:

• The mass of material relative to the theoretical minimum mass limits for criticality emergencies on Earth, as discussed in various standards including American National Standards Institute (ANSI)/ANS-8.1-2014;

• Moderators and reflectors that are inherent to the SNS or spacecraft;

• Deliberate design features of the SNS to control form, shape, or collocation;

• Spacecraft operation, including launch, staging, and release;

• System, subsystem, and component failures or faults;

• Severe physical deformation of the SNS and spacecraft;

• Software operations or malfunctions;

• External environmental changes for all anticipated operational or malfunction environments;

• Interactions with space radiation;

• Proximity to other sources of radioactivity;

• Procedure deficiencies;

• Design inadequacies;

• Human factors;

• Functional and physical interfaces between subsystems; and

• Interactions of any of the above.

Launch and Reentry of Space Nuclear Systems AC 450.45-1 40 A.4.3 There are two possible outcomes for the criticality hazard analysis:

1. Criticality is not possible for the SNS under any reasonably foreseeable criticality hazard scenarios, or;

2. Criticality is possible within reasonably foreseeable criticality hazard scenarios, including deliberately designed capabilities for fission reactors.

A.4.4 When the criticality hazard analysis shows that criticality is possible, the analysis catalogs the scenarios and conditions necessary for criticality. The analysis also identifies and describes the criticality risk mitigation measures used to preclude unintended criticality. Much like a flight hazard analysis, criticality hazard analyses are continually updated throughout the lifecycle of the SNS to ensure the potential for the SNS to achieve criticality is known at all times under all foreseeable operating conditions.

A.5 CRITICALITY SAFETY ANALYSIS.

A.5.1 If the criticality hazard analysis finds that criticality is possible within foreseeable criticality hazard scenarios in any mission phase, a criticality safety analysis is performed to calculate the likelihood and effects of fission in the SNS under each of the foreseeable criticality hazard scenarios that can result in fission. The criticality safety analysis considers scenarios where the SNS is intact, as well as the scenarios that result in uncontrolled radioactive release to the environment. The criticality safety analysis is performed with sufficient fidelity to:

• Determine the conditions and associated probability factors impacting the prompt neutron population and the ability of the SNS to become prompt critical;

• Determine the conditions and associated probability factors impacting the delayed neutron population and the ability of the SNS to become delayed critical;

• Determine the extent to which the SNS can remain subcritical in all reasonably foreseeable environments, including malfunction environments, i.e., the shutdown margin of the device;

• Quantify the performance of the system and radiation emissions for the criticality accidents that could occur;

• Quantify the performance of the system and radiation emissions for various power excursions, including short duration dramatic power excursions and long duration marginal power excursions;

• Quantify the risk of ionizing radiation exposure to the public if criticality were to occur within the Earth’s biosphere;

• Quantify the probability of criticality occurring;

• Quantify the expected rate of energy release and duration of criticality;

• Quantify the maximum possible activity in the SNS;

Launch and Reentry of Space Nuclear Systems AC 450.45-1 41

• Quantify the length of time for the fission products to decay to a level of radioactivity comparable to that of U-235 by the time it reenters the Earth’s atmosphere (per Sec. 3(a)(iii) of SPD-6).

• Quantify the radiation types and exposure pathways if the intact SNS were in proximity to a member of the public with the maximum SNS activity.

• Quantify the expected radiation dose rate at various points and distances around the intact SNS, from on-contact to the distance at which the dose rate is 25 mrem per hour TED for various scenarios, including:

a. During fission;

b. Immediately after shutdown;

c. At the time of maximum SNS activity;

d. Hourly for the first 24 hours after shutdown;

e. Daily for the first 7 days after shutdown;

f. Weekly for the first month after shutdown;

g. Monthly for the first year after shutdown;

h. If deliberate reentry is planned:

i. Hourly for the first 24 hours after reentry;

ii. Daily for the first 7 days after reentry;

iii. Weekly for the first month after reentry;

iv. Monthly for the first year after reentry;

• Quantify how the temperature of the SNS would behave over time if the SNS returned to Earth after fission, considering fission product decay heat; and

• Quantify how containing a critical chain reaction in the space operating environment will alter the material properties of the physical barriers to radioactive release.

A.5.2 Criticality safety analysis may require applicants to apply a combination of computer models from the NRC or DOE national labs and analytical techniques described by various standards setting organizations, as applicable to the specific technologies and isotopes present in the SNS. As commercial SNS use increases and the technology matures, the FAA anticipates that standards will be developed that are uniquely applicable to commercial SNS, however those do not exist at the time of this AC. Until then, applicants should take care to use analysis methods with sound underlying scientific principles and valid statistical methods.

Launch and Reentry of Space Nuclear Systems AC 450.45-1 42 A.6 OPTIONAL COMPARISON TO EXISTING NUCLEAR ANALYSES.

A.6.1 Quantifying the ionizing radiation dose from various isotopes has been an ongoing field of research for decades, and practices continue to evolve and adapt. Some analyses have shown long-standing acceptance and may be suitable for SNS applicants to leverage to shorten their own nuclear safety analysis efforts. Some of these analyses have reached final conclusions on the mass or activity of an isotope required for certain dose thresholds to be met, a particularly useful conclusion for assessing the radiation exposure risk of an SNS. For a small SNS, it may be possible to compare the mass or activity of the isotopes to these pre-established values to establish the public safety risk of the SNS. Applicants have the option to compare their SNS and mission to these existing analyses, or to perform the more comprehensive analysis, which still may be required even if the comparison method is attempted.

A.6.2 If this route is utilized, care should be taken to ensure that rigorous analysis without biases that may prove to be non-conservative are used, as the release, exposure, or inhalation fractions used in the existing analyses may not be appropriate for the accident environments an SNS might experience. To meet or exceed the maximum quantity of radioactive material allowed in the existing analyses, evidence is needed that the release and exposure fractions for the SNS in any hazardous scenario will be equivalent to or less than the release and exposure fractions used in the existing analyses. If evidence is not provided, then FAA conservatively assumes the release and exposure fractions for an SNS accident are 1.0, this effectively reduces the threshold quantities of radioactive material to achieve a given maximum dose listed in the established analyses.

A.6.3 References that may be useful for SNS applicants include but are not limited to:

• DOE publications. The DOE may cancel, revise, or publish a new document at any time, when this AC was written the following series were germane to an SNS safety analysis:

a. DOE-HDBK-3010(series), Airborne Release Fractions/Rates and Respirable Fractions for Nonreactor Nuclear Facilities.

b. DOE-STD-1196(series), Derived Concentration Technical Standard.

c. DOE-STD-1027(series), Hazard Categorization of DOE Nuclear Facilities.

• EPA publications. The EPA may cancel, revise, or publish a new publication at any time. When this AC was written, the following publications were germane to SNS safety analysis:

a. FGR No. 11: Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion, September 1988.

b. FGR No. 15, External Exposure to Radionuclides in Air, Water and Soil, revised August 2019.

Launch and Reentry of Space Nuclear Systems AC 450.45-1 43

• IAEA Publications. Because NSPM-20 is linked to a specific IAEA document, these references will remain valid unless national policy is updated:

a. IAEA Specific Safety Requirements No. SSR-6 (Rev.1), Regulations for the Safe Transport of Radioactive Material, (2018 edition).

b. IAEA Specific Safety Guide No. SSG-26, Advisory Material for the IAEA Regulations for the Safe Transport of Radioactive Material (2012 Edition).

• International Commission on Radiological Protection (ICRP) publications. The ICRP may cancel, revise, or publish a new publication at any time. When this AC was written, the following publications were germane to an SNS safety analysis:

a. ICRP Publication 60, 1990 Recommendations of the International Commission on Radiological Protection, 1990.

b. ICRP Publication 103, The 2007 Recommendations of the International Commission on Radiological Protection, 2007.

c. ICRP Publication 107, Nuclear Decay Data for Dosimetric Calculations, 2008.

d. ICRP Publication 119, Compendium of Dose Coefficients based on ICRP Publication 60, 2012.

e. ICRP Publication 133, The ICRP Computational Framework for Internal Dose Assessment for Reference Adults: Specific Absorbed Fractions, 2016.

• NRC Regulatory Guides (RG) and Technical Reports (NUREG), including:

a. NUREG-1140, January 1988, A Regulatory Analysis on Emergency Preparedness for Fuel Cycle and Other Radioactive Material Licensees, reprinted August 1991.

b. NRC Regulatory Guide 7.9, Revision 2, Standard Format and Content of Part 71 Applications for Approval of Packages for Radioactive Material.

• United Nations Scientific Committee on the Effects of Atomic Radiation, annual report to the General Assembly Sources and Effects of Ionizing Radiation series.

At the time of this AC, the following reports were of particular interest for SNS:

a. 2016 Report Annex A – Methodology for estimating public exposures due to radioactive discharges.

b. 2008 Report Volume II Annex C – Radiation exposure in accidents.

c. 2000 Report Volume I Annex A – Dose assessment methodologies.

A.6.4 Based on the RMR and comparison to the existing analyses mentioned above, it may be possible for applicants to quickly establish that their SNS is Tier I or Tier II without performing an elaborate nuclear safety analysis. The FAA expects that trace amounts of nuclear materials such as that which is typically used in instrumentation may not require any additional analyses.

Launch and Reentry of Space Nuclear Systems AC 450.45-1 44 A.7 RADIOLOGICAL HAZARD ANALYSIS.

A.7.1 When the comparison of existing analysis is unable to establish the public safety risk of the SNS, when fission is possible in the SNS, or for applicants who opt not to compare to existing nuclear safety analyses, a radiological hazard analysis (RHA) is needed. The purpose of the RHA is to identify all reasonably foreseeable hazards to public safety resulting from the launch, operation, or reentry of an SNS in all mission phases. Like a flight hazard analysis, the RHA is updated continually throughout the lifecycle of the SNS, as events may occur that change the performance of the SNS. Functionally, the RHA provides applicants an opportunity to identify hazards and develop hazard control strategies to minimize the public safety risk of the SNS. The FAA does not mandate the specific type of analysis used to perform the RHA so long as the method:

• Considers all mission phases;

• Identifies all reasonably foreseeable hazards, and the corresponding failure mode for each hazard associated with the launch or reentry of the SNS relevant to public safety, including those relevant from:

a. Ionizing radiation;

b. SNS operation;

c. Scenarios where the boundaries to radioactive release remain intact;

d. Scenarios where the boundaries to radioactive release fail;

e. System, subsystem, and component failures or faults; including launch and reentry vehicle failures, flight abort system failure or activation, etc.;

f. Software operations;

g. Environmental conditions;

h. Human factors;

i. Design inadequacies;

j. Procedure deficiencies;

k. Functional and physical interfaces between subsystems, including SNS interaction with the launch or reentry vehicle and other payloads, if applicable;

and

l. Interactions of any of the above.

• Includes known failure modes, such as those addressed in Advisory Circular (AC)

450.101-1 High Consequence Event Protection; and,

• Has sound underlying scientific principles and statistical validity.