Launch and Reentry of Space Nuclear Systems AC 450.45-1 49 A.8.8.2 American Society of Mechanical Engineers (ASME).
• ASME RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications.
Note: ASME/ANS RA-S-1.3-202x, “Standard for Radiological Accident Offsite Consequence Analysis (Level 3 PRA) to Support Nuclear Installation Application” (revision of trial-use standard ASME/ANS RA-S-1.3-2017) ANS RA-S-1.3-2017 and ASME/ANS RA-S-1.3-2017 refer to a joint standard under trial use development by ASME and ANS. It has not been made a final standard.
A.8.8.3 Department of Energy
• DOE-STD-1628(series), Development of Probabilistic Risk Assessments for Nuclear Safety Applications.
A.8.8.4 Nuclear Regulatory Commission
• NUREG-1513, Integrated Safety Analysis Guidance Document.
• NUREG-2201, Probabilistic Risk Assessment and Regulatory Decision-making:
Some Frequently Asked Questions.
• NUREG-2199, An Integrated Human Event Analysis System (IDHEAS) for Nuclear Power Plant Internal Events At-Power Application.
• Regulatory Guide 1.200, Acceptability of Probabilistic Risk Assessment Results for Risk-Informed Activities.
• Regulatory Guide 1.233, Guidance for a Technology-Inclusive, Risk Informed, and Performance-Based Methodology to Inform the Licensing Basis and Content of Applications for Licenses, Certifications, and Approvals for Non-Light Water Reactors.
• Regulatory Guide 1.247, Acceptability of Probabilistic Risk Assessment Results for Non-Light Water Reactor Risk-Informed Activities.
Note: This regulatory guide was issued for trial use at the time of this AC publication.
A final version may now be available.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 50 A.9 RADIOLOGICAL EMERGENCY RESPONSE PLAN.
A.9.1 Consistent with DOE and NRC practices, a radiological emergency response plan (RERP) is needed when an SNS contains sufficient material to have off-site safety implications (Title 10 CFR Chapter I 2021). This determination is made when the amount of radioactive material, as indicated in the RMR, exceeds the thresholds of Title 10 CFR 30.72 Schedule C (Title 10 CFR Chapter I 2021). For the accident environments the SNS may experience, the release fractions stated in Title 10 CFR
30.72 Schedule C may not be appropriate. To avoid making a non-conservative assumption, the FAA uses a default assumption that the SNS release fraction is 1.0, unless evidence is presented to show that the release fraction is lower. This has the net effect of reducing the threshold quantities listed in Title 10 CFR part 30.72 Schedule C unless evidence is provided.
A.9.2 In cases where there are multiple isotopes present, an RERP is required when the sum of all the ratios on any RMR or RMR addendum between SNS isotopes and Title 10 CFR 30.72 Schedule C thresholds exceeds 1.0 (Title 10 CFR Chapter I 2021). For example: consider an SNS with only two isotopes, A and B, where the release fractions of Title 10 CFR 30.72 Schedule C are shown to be correct:
(𝑆𝑆𝑆𝑆𝑆𝑆 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴)𝐴𝐴 (10 𝐶𝐶𝐶𝐶𝐶𝐶 30.72 𝑆𝑆 𝐴𝐴ℎ 𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒 𝐶𝐶 𝑇𝑇ℎ𝑟𝑟 𝑒𝑒 𝑟𝑟ℎ𝑜𝑜𝑒𝑒𝑒𝑒)𝐴𝐴 = 0.55 And (𝑆𝑆𝑆𝑆𝑆𝑆 𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴)𝐵𝐵 (10 𝐶𝐶𝐶𝐶𝐶𝐶 30.72 𝑆𝑆 𝐴𝐴ℎ 𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒𝑒 𝐶𝐶 𝑇𝑇ℎ𝑟𝑟 𝑒𝑒 𝑟𝑟ℎ𝑜𝑜𝑒𝑒𝑒𝑒)𝐵𝐵 = 0.9 A.9.3 The combined value of all isotopes on this SNS would be:
0.55 + 0.9 = 1.45 A.9.4 Because the combined value 1.45 is greater than 1.0, an RERP would be required for this SNS.
A.9.5 RERP’s can be created by applying the principles and process of NUREG 0654/FEMA (Radiological Emergency Preparedness) REP-1 Rev. 2 Preparation and Evaluation of Radiological Emergency Response Plans and Preparedness dated December 2019. The RERP is not itself an analysis, but rather a response plan that provides the FAA assurance that the applicant and involved government entities are prepared to respond in the event of a radiological emergency. RERPs contain contingencies to address scenarios addressing fixed facilities where a member of the public may be exposed to ionizing radiation, as identified in the RHA, HFRSA and criticality safety analysis if applicable. Thus, while the RMR determines whether an RERP is needed, the subsequent analyses may need to be completed before the RERP can be completed.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 51 A.9.6 RERPs for SNS that will operate or linger in Earth orbit include how the radiological risks have been discussed with other nations, and the procedures and governmental collaboration that will be used to recover, mitigate, and decontaminate the area if a SNS has an uncontrolled reentry in another nation.
A.9.7 RERPs can be incorporated in an applicant’s overall mishap plan as required by § 450.173.
A.10 TIER LEVEL DETERMINATION.
After the HFRSA process is complete, the final Tier level of the SNS can be determined, unless it was previously determined due to satisfying automatic criteria.
The applicant will utilize the results of their HFRSA to determine the Tier level, and the FAA will evaluate both the analysis and the final Tier level conclusion.
A.11 SAFETY ANALYSIS REPORT.
An application for launch or reentry of an SNS requires a SAR (NSPM-20 2019). The SAR provides sufficiently detailed and complete enough documentation to support the FAA’s evaluation of the applicant’s safety analysis as applicable for that SNS. The SAR documents the detailed and complete results of all analysis performed to assess the safety of the SNS and elaborates on the comparison to existing analyses for the SNS that are assessed using this method. Additional information might be warranted in the SAR as determined by SNS mission parameters on a case-by-case basis. Creating the SAR provides the applicant an opportunity to communicate to the FAA how the risks of the SNS are being properly assessed and addressed to protect public health and safety and the national security and foreign policy interests of the United States. A SAR should include the following:
• Evidence of technical peer review for all hazard analyses and safety analyses;
• A concise, high-level summary of key risk information:
a. The likelihood of an accident resulting in an exposure more than 5 rem TED to any member of the public;
b. The number of individuals who might receive exposure more than 5 rem TED in an accident scenario;
c. Comparisons of the potential exposure levels to other meaningful measures:
i. Space nuclear system launch safety guidelines;
ii. Average public exposure from natural and human made sources; and iii. Other relevant public safety standards.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 52 A.11.1 In some cases, it may be appropriate to include a system-specific SAR within a mission SAR. This could be advantageous when multiple launches of the same space nuclear system are planned, as the first system-specific SAR could specify the safety basis envelope for the system. The safety basis envelope would set the conditions under which the nuclear safety analyses are valid and provide assurance of safe operation of the SNS. This would limit the scope of the applicant produced nuclear safety analysis for future missions with the same SNS. If a system-specific SAR is used, the mission SAR either:
1. Demonstrates that the mission is within the safety basis envelope established in the system-specific SAR.
a. No additional safety analysis is required for the space nuclear system in this case because the safety of the system has already been established within the safety basis envelope.
2. Includes supplemental safety analysis for deviations outside the established safety basis envelope where safety has not yet been demonstrated.
a. Additional analysis is required to ensure public safety is not adversely impacted by the planned operations outside the initial safety basis envelope.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 53 Appendix B. Guideline Safety Recommendations B.1 SCOPE.
This appendix provides recommendations for an applicant to consider to minimize the public safety risk of an SNS. This appendix also provides recommendations to applicants that, if incorporated, will increase the likelihood that the FAA will be able to issue a safety approval or a favorable payload determination.
B.2 NUCLEAR SAFETY THEMES.
B.2.1.1 From the comprehensive reviews performed to develop this AC, several overarching themes emerged for commercial SNS safety including but not limited to:
• Sustained successful use of nuclear technology requires a license applicant to have a strong safety culture developed in their organization;
• Preventing failure of an SNS does more to protect the public than responding to failures;
• The risk to the public increases if the radioactive material escapes from the SNS;
• The larger the ionizing radiation potential from an SNS, the less likely failures must be to achieve an acceptable overall risk to the public;
• The initial design of the SNS determines the baseline radiation exposure risk that an SNS can pose to the public;
• SNS may increase the risk to the public above the baseline radiation exposure risk any time there is potential for an SNS to return to Earth, including launch, orbit, reentry, and Earth flyby.
• Spacecraft maneuvers can change the risk of the SNS to the public relative to the baseline radiation exposure risk;
• Operation of the SNS can increase the risk to the public from the baseline radiation exposure risk, sometimes significantly;
• The risk to the public increases as the operating time increases for a fission based SNS;
• The risk to the public for any SNS is much higher when a critical chain reaction is in progress than when the chain reaction is sub-critical;
• The uncontrolled reentry of a fission reactor with a critical chain reaction in progress poses a significant risk to the public;
• The risk to the public increases the closer the SNS operates to Earth; and
• EOM disposal decisions can change the risk of the SNS to the public.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 54 B.2.1.2 From reviewing the designs, licensing requirements, and standards that were in place for terrestrial nuclear reactors, it became clear that SNS have unique characteristics that will require additional consideration beyond what has been developed to this point. For example, the sophisticated computer models for analyzing terrestrial nuclear accidents currently lack the flexibility to analyze a radioactive release that begins in orbit and results in an uncontrolled reentry, which will make reactor accident analysis for on-orbit SNS challenging (Nuclear Regulatory Commission 2017), (Sandia National Laboratories 2021). The guidelines in this appendix were developed to help bridge those gaps.
B.2.1.3 These guidelines are intended to reduce the public safety risk of all SNS. The guidelines outlined in this appendix use an engineering approach without biases, and a narrow focus for each guideline, which can lead to apparent redundancy for mission concepts that include multiple guideline categories. Collectively, the guidelines in this appendix provide useful direction for a wide variety of nuclear technologies. In some instances, specific guidelines are applicable only to a specific technology or operational concept to address specific identified vulnerabilities. Applicants should use their judgement to identify the guidelines that do not apply to their SNS or mission. Applicants should also use sound engineering judgement and risk mitigation for their mission and implement these guidelines in a manner that reduces the overall public safety risk of the SNS mission.
B.2.2 Minimizing Public Safety Risks.
B.2.2.1 SNS pose a radiological risk to the public any time there is potential for an SNS to return to Earth, this includes launch, orbit, reentry, and Earth flyby. During the development of this AC, the FAA identified topics that each had the ability to significantly increase the overall risk of the system. Summarized below are vulnerabilities in the form of guidelines, recommending selection of lower risk alternatives, with rationale in italics. Some of the guidelines focus on reducing the mission risk, while others focus on reducing the SNS risk.
B.2.2.2 When assessing the risk of an SNS, operators should consider the risks of the system itself, and how the risks of the overall mission impact the risk of the SNS. This is because the public safety impact of an SNS depends not only on the potential failures, but also on the potential locations and interactions of those failures.
B.2.2.3 The overall risk of radiation exposure to the public is a combination of both risks, taking into consideration that the failure of either the SNS or the spacecraft may induce a subsequent failure in the other component. To stay within public risk range requires using lower risk SNS for higher risk missions or performing lower risk missions for higher risk SNS. The guidelines in this appendix address both the mission risk and the SNS risk to aid applicants in staying below the maximum risk threshold regardless of whether the mission development process is started from the perspective of fulfilling a specific mission (fixed initial mission risk) or using a specific SNS (fixed initial SNS risk).
Launch and Reentry of Space Nuclear Systems AC 450.45-1 B.2.2.4 Figure 5 of this AC was developed to aid applicants in understanding the different risk drivers for both mission and SNS risk. The colors assigned to various options are indicators of relative risk within that column, and not indicators of absolute risk, or relative risk between columns. For example, the relative risk between disposal on Earth and a fission system operating close to material limits cannot be definitively stated without knowing additional information about the SNS and the mission. Likewise, the absolute risk for disposal on Earth and operating close to material limits cannot be quantified without additional information about the SNS and mission. What can be definitively stated is that disposal on Earth is riskier than disposal in interplanetary space with no free return trajectory to Earth, and that operating with significant margin to material limits reduces risk compared to operating at material limits.
SNS Design SNS Mission Planning SNS Operations Analysis, Any SNS Cybersecurity Verification Launch Operations EOM Launch Operations EOM and Testing Operating Close Fission System to Material Limits Updated Over Static, Not At Rated Power Critical Testing 1, 2 Populated Areas Overflight of a Densely Planned Lingering in Congested Planned Orbits Planned De-orbit Offshore Winds in the Potential Debris Area Blowing Collision Risk in Exceeds 1x10€ Earth Orbit Disposal on Earth 1,2 1,2 Afterthought 1 Populated Areas Towards Analysis Relies on Novel Increasing Risk Become Critical SNS That May in Accident Conditions 1,2 Meets Generally Cybersecurity Accepted Approaches and Verification and Assumptions Minimal Testing Planned for a Novel Launch Non-Optimal Vehicle and Launch Site Movements to Lower Orbits Planned with SNS Onboard 1 Sufficiently High Disposal in a Planned Orbit Launch Window Second Launch Safe at One- Intervals Orbits with SNS Towards Lower Maneuvers Onboard Sufficiently High Disposal in a Orbit Increasing RIsk Standards and Best Practices at Time of Launch with High Safety Several Barriers Novel Designs Factors and to Release Analysis Based on Accepted Approaches Rigorous Optimal Launch Novel Launch Planned for a Vehicle and Maneuverable Planned on a Beyond GEO Spacecraft Highly Lagrange Point Disposal at a Planned 1 Launch Intervals Launch Window Shown Safe at Sub-Second Gravity Assist Collision Risk Fly-By with Lagrange Point Disposal at a Integrall Site Below 1x10-6 1,2 Designed Quantum-Proof Methods Protect SNS, Planned for a P anned Tor Planned of a Radioactive Natural Decay Host Spacecraft, Up/Downlinks Robust Analysis Rigorous Testing Proven Launch Vehicle and Interplanetary Space with No Interplanetary Disposal in SNS Loaded Late in Launch Interplanetary Disposal in Isotope in a and Ground and Verification Optimal Launch Earth Orbit Space with ivo Countdown Permanent Space with No Robust Package 1, 2 Stations Intersectons Intersections Earth Orbit 1 Departure from Earth's Gravity Intersections Earth Orbit
1. Assessed by FAA Prior to Launch
2. Nuclear Regulator License(s) Required Figure 5 - SINS Mission Risk Drivers B.2.2.5 The risk drivers, and guidelines to minimize risk, fall into these broad categories:
• SNS Design
• Any SNS, appendix B.2.3;
• SNS with Potential to Return to Earth, appendix B.2.4;
o Fission-Based SNS, appendix B.2.5;
• SNS Host Spacecraft, appendix B.2.6;
Launch and Reentry of Space Nuclear Systems AC 450.45-1 56 o SNS Cybersecurity, appendix B.2.7;
o SNS Analysis, appendix B.2.8; and o SNS Validation, Verification and Testing, appendix B.2.9.
• SNS Mission Planning o Launch and Launch Sites, appendix B.2.10;
o Operations, appendix B.2.11; and o EOM, appendix B.2.12.
• SNS Operations o Launch, appendix B.2.13;
o Operations, appendix B.2.14; and o EOM, appendix B.2.15.
B.2.2.6 These guidelines are not requirements or licensing criteria, as it may be possible to design a system that disregards one or more of these guidelines while still meeting an acceptable overall risk level for licensing. Rather, these guidelines give ways to minimize the overall risk to the public from any given SNS and aid applicants who are unfamiliar with either the risks of radioactive material, commercial space operations, or both.
B.2.3 Guidelines Applicable to All SNS Designs.
B.2.3.1 All SNS should be designed to survive the uniquely challenging space environment, including the conditions identified in Table 8 of this AC. SNS should be designed to have a low probability of releasing radionuclides in the event of a launch mishap, in space collision, or uncontrolled reentry impact. To meet this objective, designs should use materials that are able to withstand the operating environmental conditions without failure. Material failure can create a direct path for radioactive material release to the environment or lead to a subsequent SNS or space vehicle failure that results in a direct path for radioactive release to the environment. Of note, the FAA does not regulate SNS designs. Per the Atomic Energy Act of 1954 and the Energy Reorganization Act of 1974, the commercial use of nuclear material in the U.S. is regulated under the authority of the NRC (Atomic Energy Act of 1954, as amended 2021), (Energy Reorganization Act 1974).
Launch and Reentry of Space Nuclear Systems AC 450.45-1 57 Table 8 – Design Considerations for All SNS Consideration Rationale SNS are designed with the ability to prevent uncontrolled release of radioactive material to the environment during anticipated operational occurrences.
An uncontrolled release of radioactive material to the environment poses the greatest risk to the public. An uncontrolled release of radioactive material could expose the public to ionizing radiation and fission products that, in large enough doses, can cause human health effects, including death, to those exposed (CDC 2018).
Design SNS to have negligible impact on probability of the launch vehicle experiencing a failure.
The integration of an SNS with the launch vehicle is designed to have no effect on the risk of launch vehicle failure to minimize the risk to the public during an SNS launch.
The use of radiation hardened electronics.
Background space radiation and radiation from the SNS can induce single event upsets, which could cause safety critical components to malfunction (LaBel 2004).
Ensuring systems and components maintain functionality during space weather events.
Space weather conditions, including cosmic radiation and solar magnetic effects are an environmental factor that can influence the behavior of an SNS, potentially creating public safety hazards if inadequate designs are used.
The behavior of fluid systems in a zero-gravity environment.
Convection requires gravity and will be unavailable in space.
Density changes due to temperature differences will not induce motion in the fluid due to insufficient gravitational force (NASA 2001).
Saturated systems will not stratify based on phase (NASA 2001).
Insufficient gravitational force will cause any systems to maintain a mixed quantity of liquid and vapor (NASA 2001). The density difference present between a substance’s liquid and vapor phases will not cause a physical separation.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 58 Consideration Rationale Temperature extremes in space.
Reactor designs derived from terrestrial systems consider increased stress due to temperature extremes and gradients; materials repurposed from reactors on Earth to be utilized within the space environment meet the performance requirements for this hostile environment (Wright 2014).
Temperatures in space fluctuate hundreds of degrees in the matter of minutes (Wright 2014).
The presence (or lack) of sunlight will substantially affect temperatures experienced on or near the exterior of the SNS (Wright 2014).
High cyclic count, cyclic rate, and fatigue stress for components of a system in space that spin.
Any moving or rotating equipment on the spacecraft will cause vibration, cyclic stress, and fatigue stress (McPherson, et al. 2015).
Design SNS to include systems to ensure the safe disposal of the nuclear material after the EOM, in a manner that protects human, environmental and national security assets.
Nuclear safety analyses and licensing criteria are based on the overall lifetime risk of the SNS, and the presence of long-lived fission products remains to this day a significant disposal challenge for spent fuel from terrestrial nuclear systems (GAO 2021).
B.2.4 Guidelines Applicable to Designing SNS that Have Potential to Return to Earth.
When the mission plan calls for the SNS to linger in Earth orbit, operate in Earth orbit, or perform a fly-by, the following additional guidelines in Table 9 of this AC are relevant to reduce the risk to the public. SNS used in this way have potential to return to Earth and merit additional efforts to prevent exposing the public to ionizing radiation.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 59 Table 9 – Guidelines for SNS Designed to Operate in Earth Orbit Guideline Rationale SNS on missions with potential to return to Earth are designed with SNS monitoring signal paths that are at least single fault tolerant.
When an SNS has the potential to return to Earth they present a risk of exposure to the public. Consequently, redundant monitoring signal paths are used to ensure the nuclear device parameters are known and understood by the owner/operators to quickly assess and intervene in the event of an anomaly (IAEA 1999).
Design SNS that will be on missions with potential to return to Earth with the ability to maintain adequate decay heat removal capabilities at temperatures low enough to be handled (~140°F) to prevent physical damage during and after deliberate or uncontrolled reentry.
Unlike the fission process, the heat produced by the decay of fission products does not stop when the reactor is shut down (Nuclear Regulatory Commission 2020). After shutdown, the heat produced by fission products is called decay heat, and decay heat generation continues for years after a reactor is shut down, with the overall rate of decay heat generation decreasing over a long time (Nuclear Regulatory Commission 2020). Applicants should consider decay heat generation in the design of any SNS, and during accident analysis. For public safety, a space nuclear reactor should adequately remove the decay heat during all times when the system could return to Earth to prevent overheating and damaging the nuclear fuel or posing a handling hazard to personnel.
Design SNS to be operated in Earth orbit with the ability to monitor and report the structural integrity of its nuclear fuel and surrounding barriers.
Monitoring of the structural integrity of nuclear fuel allows operators to recognize signs of failure before it occurs to prevent or minimize the consequences of the failure to minimize the risk to the public and environment.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 60 Guideline Rationale When the mission plan calls for terrestrial disposal of the SNS (in situations where this is a permissible strategy) they are designed so the physical barriers to radioactive release can survive the environmental conditions of controlled reentry and landing, as well as reentry and landing casualties, considering the neutron embrittlement and fatigue of the physical barriers that occurred while the nuclear system was operated.
Physical barriers prevent the release of radiation and radioactive material to the environment, minimizing the risk to the public (IAEA 1999). The design of a physical barrier considers the unique operating conditions that the SNS will undergo and ensure a significant safety margin for all operating profiles and reentry casualties.
Design physical barriers to radioactive release to remain intact during any space vehicle mishap where the debris could return to Earth.
A physical barrier is intact if it retains sufficient integrity to keep radioactive fuel, solid fission products, and structures together collectively, preventing uncontrolled release of fission products to the environment (IAEA 1999).
When SNS will have the potential to reenter Earth’s atmosphere, they are designed with sufficient safety factors to survive reentry through recovery without experiencing fracture of the physical barriers designed to prevent radioactive material release.
The intent of ensuring containment is to prevent radioactive material from the SNS escaping into the Earth’s environment.
For systems to be disposed in Earth orbit, design SNS having features such as mirrors and corner reflectors that aide in the orbital tracking of the passivated space system.
These features enable the space traffic management agency to easily maintain current orbital parameters of the dead satellite, vital for predicting future collisions against other resident space objects (18th Space Control Squadron 2020).
An SNS that will be disposed through controlled reentry to Earth will likely need more physical barriers to radioactive release.
Physical barriers include design features that allow the spent nuclear material to survive the reentry forces and to be recovered on the ground before any malicious actors can retrieve them.