Launch and Reentry of Space Nuclear Systems AC 450.45-1 57 Table 8 – Design Considerations for All SNS Consideration Rationale SNS are designed with the ability to prevent uncontrolled release of radioactive material to the environment during anticipated operational occurrences.
An uncontrolled release of radioactive material to the environment poses the greatest risk to the public. An uncontrolled release of radioactive material could expose the public to ionizing radiation and fission products that, in large enough doses, can cause human health effects, including death, to those exposed (CDC 2018).
Design SNS to have negligible impact on probability of the launch vehicle experiencing a failure.
The integration of an SNS with the launch vehicle is designed to have no effect on the risk of launch vehicle failure to minimize the risk to the public during an SNS launch.
The use of radiation hardened electronics.
Background space radiation and radiation from the SNS can induce single event upsets, which could cause safety critical components to malfunction (LaBel 2004).
Ensuring systems and components maintain functionality during space weather events.
Space weather conditions, including cosmic radiation and solar magnetic effects are an environmental factor that can influence the behavior of an SNS, potentially creating public safety hazards if inadequate designs are used.
The behavior of fluid systems in a zero-gravity environment.
Convection requires gravity and will be unavailable in space.
Density changes due to temperature differences will not induce motion in the fluid due to insufficient gravitational force (NASA 2001).
Saturated systems will not stratify based on phase (NASA 2001).
Insufficient gravitational force will cause any systems to maintain a mixed quantity of liquid and vapor (NASA 2001). The density difference present between a substance’s liquid and vapor phases will not cause a physical separation.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 58 Consideration Rationale Temperature extremes in space.
Reactor designs derived from terrestrial systems consider increased stress due to temperature extremes and gradients; materials repurposed from reactors on Earth to be utilized within the space environment meet the performance requirements for this hostile environment (Wright 2014).
Temperatures in space fluctuate hundreds of degrees in the matter of minutes (Wright 2014).
The presence (or lack) of sunlight will substantially affect temperatures experienced on or near the exterior of the SNS (Wright 2014).
High cyclic count, cyclic rate, and fatigue stress for components of a system in space that spin.
Any moving or rotating equipment on the spacecraft will cause vibration, cyclic stress, and fatigue stress (McPherson, et al. 2015).
Design SNS to include systems to ensure the safe disposal of the nuclear material after the EOM, in a manner that protects human, environmental and national security assets.
Nuclear safety analyses and licensing criteria are based on the overall lifetime risk of the SNS, and the presence of long-lived fission products remains to this day a significant disposal challenge for spent fuel from terrestrial nuclear systems (GAO 2021).
B.2.4 Guidelines Applicable to Designing SNS that Have Potential to Return to Earth.
When the mission plan calls for the SNS to linger in Earth orbit, operate in Earth orbit, or perform a fly-by, the following additional guidelines in Table 9 of this AC are relevant to reduce the risk to the public. SNS used in this way have potential to return to Earth and merit additional efforts to prevent exposing the public to ionizing radiation.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 59 Table 9 – Guidelines for SNS Designed to Operate in Earth Orbit Guideline Rationale SNS on missions with potential to return to Earth are designed with SNS monitoring signal paths that are at least single fault tolerant.
When an SNS has the potential to return to Earth they present a risk of exposure to the public. Consequently, redundant monitoring signal paths are used to ensure the nuclear device parameters are known and understood by the owner/operators to quickly assess and intervene in the event of an anomaly (IAEA 1999).
Design SNS that will be on missions with potential to return to Earth with the ability to maintain adequate decay heat removal capabilities at temperatures low enough to be handled (~140°F) to prevent physical damage during and after deliberate or uncontrolled reentry.
Unlike the fission process, the heat produced by the decay of fission products does not stop when the reactor is shut down (Nuclear Regulatory Commission 2020). After shutdown, the heat produced by fission products is called decay heat, and decay heat generation continues for years after a reactor is shut down, with the overall rate of decay heat generation decreasing over a long time (Nuclear Regulatory Commission 2020). Applicants should consider decay heat generation in the design of any SNS, and during accident analysis. For public safety, a space nuclear reactor should adequately remove the decay heat during all times when the system could return to Earth to prevent overheating and damaging the nuclear fuel or posing a handling hazard to personnel.
Design SNS to be operated in Earth orbit with the ability to monitor and report the structural integrity of its nuclear fuel and surrounding barriers.
Monitoring of the structural integrity of nuclear fuel allows operators to recognize signs of failure before it occurs to prevent or minimize the consequences of the failure to minimize the risk to the public and environment.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 60 Guideline Rationale When the mission plan calls for terrestrial disposal of the SNS (in situations where this is a permissible strategy) they are designed so the physical barriers to radioactive release can survive the environmental conditions of controlled reentry and landing, as well as reentry and landing casualties, considering the neutron embrittlement and fatigue of the physical barriers that occurred while the nuclear system was operated.
Physical barriers prevent the release of radiation and radioactive material to the environment, minimizing the risk to the public (IAEA 1999). The design of a physical barrier considers the unique operating conditions that the SNS will undergo and ensure a significant safety margin for all operating profiles and reentry casualties.
Design physical barriers to radioactive release to remain intact during any space vehicle mishap where the debris could return to Earth.
A physical barrier is intact if it retains sufficient integrity to keep radioactive fuel, solid fission products, and structures together collectively, preventing uncontrolled release of fission products to the environment (IAEA 1999).
When SNS will have the potential to reenter Earth’s atmosphere, they are designed with sufficient safety factors to survive reentry through recovery without experiencing fracture of the physical barriers designed to prevent radioactive material release.
The intent of ensuring containment is to prevent radioactive material from the SNS escaping into the Earth’s environment.
For systems to be disposed in Earth orbit, design SNS having features such as mirrors and corner reflectors that aide in the orbital tracking of the passivated space system.
These features enable the space traffic management agency to easily maintain current orbital parameters of the dead satellite, vital for predicting future collisions against other resident space objects (18th Space Control Squadron 2020).
An SNS that will be disposed through controlled reentry to Earth will likely need more physical barriers to radioactive release.
Physical barriers include design features that allow the spent nuclear material to survive the reentry forces and to be recovered on the ground before any malicious actors can retrieve them.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 61 B.2.5 Guidelines Applicable to the Design of Fission-Based SNS.
B.2.5.1 Fission can rapidly release massive amounts of energy. Controlling the critical fission chain reaction is of the utmost importance to protect public safety. Applicants should consider the following description, which relates to criticality accidents when handling fissionable or fissile material in situations where personnel are proximate to the material or system, from the Lecture Notes for Criticality Safety (Fullwood 1992):
A criticality accident is like an explosion or a fire or both in the sense that considerable energy is released. This energy can melt, boil, and vaporize apparatus, boil liquids, blow- apart structures, and produce hazardous missiles. Personnel can be killed or maimed by the energy release but the usual killer is radiation in the form of neutrons, and gammas. Betas and alphas can play a part, but their range is limited. To emphasize these points, a criticality accident may, depending on the severity:
• Throw personnel down and about,
• Rupture containers by steam pressure,
• Fracture equipment and produce flying missiles,
• Violently eject liquids,
• Melt, and possibly ignite, uranium and plutonium metals,
• Disperse radioactive particles,
• Ignite and explode surrounding materials,
• Emit lethal or incapacitating radiation.
Typically, a criticality accident produces an initial pulse of energy and radiation. The only protection for this is to be as far away from, and behind as much shielding material as possible. However, as will be seen from the following accident descriptions, many criticality accidents are of considerable duration (Fullwood 1992).
B.2.5.2 The operation of the fission based SNS significantly changes the radioactive isotope inventory, and thus changes the ionizing radiation exposure risks associated with the system. Fission based SNS are designed in a manner that balances meeting the mission requirements and minimizing the risk to the public, as explained in Table 10 of this AC.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 62 Table 10 – Guidelines for Designing Fission Based SNS Guidelines Rationale For space nuclear reactors that are normally controlled from Earth and are on missions that have the potential to return the reactor to Earth, design features are included to automatically shut down the reactor if communication is lost with the Earth control station.
If all ability to remotely operate the reactor is lost, automatic shutdown occurs to prevent an uncontrolled reentry of a critical reactor and to prevent reactor power excursions while control is lost.
For space nuclear reactors that are normally controlled from Earth and are on missions that have the potential to return the reactor to Earth, design features are included to ensure the reactor remains shut down until the Earth control station regains reliable communication with the reactor.
If the control station can reestablish positive control of the reactor, and all other conditions for criticality are met, reactors may be started up and operated at power. Until that happens, keeping the reactor shutdown best protects public safety.
Design SNS to prevent an inadvertent criticality event regardless of the orientation of the system during pre-flight and flight.
The potential for an SNS to undergo abnormal orientations means that the nuclear system is designed so these orientation changes have no effect on the system.
Design SNS to prevent an inadvertent criticality in challenging space weather environments.
Cosmic radiation, along with solar magnetics and other space weather events may be able to change the neutron flux in a reactor. SNS designs consider these factors and ensure the SNS can maintain control of the critical chain reaction in the expected space weather environment.
Design SNS to minimize the fission product yield during the dynamic conditions of collision in space or with the ground.
The varying forces encountered by an SNS may cause shock and relative position changes of reactor components, changing the geometry of the SNS and potentially leading to criticality (Dabrowski, et al. 2020). Minimizing the fission product yield in these scenarios is essential to minimizing the public safety risk, as history shows that fission yields exceeding 1×1016 fissions have a high probability of causing death if personnel are in close proximity (Fullwood 1992).(Fullwood 1992).
Launch and Reentry of Space Nuclear Systems AC 450.45-1 63 Guidelines Rationale Design SNS to remain subcritical during planned reentries.
Reentries present a risk of contamination and consequent risk to the public due to potential overflight of populated areas or deviation from planned reentry routes. Reentries also subject the SNS to temperature extremes and significant accelerations that could alter reactor parameters and physical systems (Bluck 2006).
Ensuring the system can remain subcritical will minimize the design-basis accident source term by preventing the creation of fission products during the reentry.
Design reactors to rely on delayed critical chain reactions and ensure proper design and operational mitigations are in place to minimize the possibility of prompt critical conditions occurring during times when the SNS may return to Earth.
Prompt-critical reactions are typically unstoppable and typically result in reactors selfdisassembling (Fullwood 1992). This could cause an uncontrolled radioactive release, posing a risk to the public.
Design reactors to minimize the possibility of unintentional criticality occurring, regardless of the medium surrounding the nuclear system (i.e., when submerged in water, sand, dirt, air, in-space radiation, deformation during crashes, etc.) unless reactor startup is intentionally initiated.
Because SNS move, the external environment cannot be assumed constant. External operating environments (i.e., in cold water vice warm air), or changes in system geometry (i.e. deformation during a crash) may affect the neutron flux in the system enough to cause criticality (Corliss 1969). This change to the neutron flux is accounted for in design such that the system can remain subcritical unless criticality is intentionally initiated.
Design reactors so they are inherently stable, i.e., when operating they can adjust their output power based on the power demands of the supplied loads without the need for operator action.
Active and passive safety measures incorporated into the SNS’s design will ensure that any deviations from equilibrium can be sufficiently mitigated and reorient back towards equilibrium, preventing runaway power and damage to the device (IAEA 1999).
When fission based SNS are designed to be controlled from Earth, the control paths between the operator and the SNS are designed with redundancy such that they are at least single failure tolerant.
SNS have designed redundancy such that no single fault impedes the ability to safely operate or shutdown the reactor (IAEA 1999).
Designing SNS with redundant control systems will lower the severity and probability of nuclear accidents, which will lower the risk to the public.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 64 B.2.6 Guidelines Applicable to Design of SNS Host Spacecraft.
The SNS host spacecraft plays a key role in ensuring the safe delivery, operation, and disposal of the SNS. The guidelines in Table 11 of this AC will aid designers in designing or selecting the appropriate spacecraft to host their SNS and minimize public safety risks.
Table 11 – Guidelines Applicable to Design of SNS Host Spacecraft Guideline Rationale Design spacecraft hosting space nuclear reactors with adequate instrumentation and communication capabilities for the operator to determine the power level of the reactor and the integrity of the physical barriers to radioactive release at all times when there is potential for the SNS to return to Earth’s surface.
Monitoring the power level ensures the space nuclear reactor does not violate design specifications ensuring the reactor operates normally (as expected and modeled) preventing damage to the reactor core. The operator always knows the status of fission product physical barriers to release to understand if there is an uncontrolled radiation and fission product release to the environment. Systems with uncontrolled release in the space environment can then be moved further from Earth to minimize the risk to the public.
Design spacecraft that will host SNS in Earth orbit with the capability to maneuver at any time until EOM.
Maneuvers avoid collisions and close approaches to nuclear-sensitive spacecraft, counteract natural orbital decay, and permit disposal into safe locations.
Design spacecraft hosting SNS having independently powered subsystems that give precise orbital position and velocity vector information to ground operators for use in collision avoidance against the on-orbit catalog.
Despite the ability of the Space Surveillance Network’s ability to track a spacecraft’s position, the most accurate data comes in the form of ephemeris reported directly from the owner operator of a spacecraft (18th Space Control Squadron 2020). Hence, the most accurate collision avoidance predictions come from a combination of precise orbital position from the satellite and owner operator coupled with the orbital tracking capabilities of the Space Surveillance Network for the on-orbit catalog (18th Space Control Squadron 2020).
Risk is minimized by using a launch vehicle design with successful operational history under similar conditions with payloads of similar size and weight.
Proven successful operations reduce the uncertainty in the nuclear safety analyses and gives greater confidence that the launch will be safe.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 65 Guideline Rationale Risk is minimized using reentry vehicle designs with successful operational history under similar conditions with payloads of similar size and weight.
Avoid failures during reentry as they are particularly harmful to the public because the radioactive material is returning to Earth. If reentry is desired, using a proven vehicle design reduces the risk and gives greater confidence that the reentry can be performed safely. Reentry of an SNS is still a risky mission operation, but the risk can be mitigated somewhat by using a proven design.
SNS designs and operation plans minimize radioactive contamination or activation of launch vehicle components, which will return to Earth during normal launch operations.
Since these components are known to return to Earth, any radioactivity added to them by the SNS poses a risk to the public. Minimizing the activation and contamination of these components minimizes the risk to the public.
Spacecraft hosting SNS contain propulsion systems to maintain orbital control and prevent orbital decay into the atmosphere due to drag.
The ability to maintain orbital control of any operational spacecraft is important but especially so when dealing with an SNS. Despite expectations that SNS avoid the highly congested low Earth orbital regime, situations may arise where the SNS ends up closer to Earth than intended. In these unintended circumstances, orbital control through propulsion is essential to avoid atmospheric drag and the possibility of an unintended reentry.
Risk is minimized for on-orbit operations using spacecraft with proven propulsion and maneuverability device designs.
Maneuverability on-orbit plays a significant role in reducing the likelihood of collision, which could result in uncontrolled reentry. Proven systems for propulsion and maneuverability give greater confidence that on-orbit operations will be safe.
For SNS missions that plan deorbits, utilize reentry vehicle designs having proven reliability.
Planning a de-orbit with new unproven technology and low reliability is not an optimal means to ensure environmental or public safety. Hardened and proven reentry vehicle designs give the best chance of safely de-orbiting an SNS regardless of how long it has been on orbit.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 66 B.2.7 Guidelines Applicable to SNS Cybersecurity.
Cybersecurity threats and protection practices are evolving rapidly. Applicants are encouraged to seek out additional cybersecurity and cyber-physical security guidance, utilizing the most developed and suitable means to protect the SNS and its host spacecraft from hacking, and thus protect the public from ionizing radiation exposure.
The National Institute of Standards and Technology has published many cybersecurity guidelines, including some specific to spacecraft, and is a reliable source for detailed cybersecurity information. Table 12 provides specific concerns applicants should endeavor to mitigate.
Table 12 – Guidelines for SNS Cybersecurity Guideline Rationale Design SNS, host spacecraft, and supporting ground stations with the ability to prevent malicious actors from gaining control or executing commands on the system’s power output and control systems.
When the Slammer worm attacked the Davis-Besse nuclear power plant on January 25, 2003, it disabled the Safety Parameter Display System and the Plant Process Computer for several hours (Markey 2003). Proper design will ensure this type of disruption will not occur in an SNS.
Design SNS, host spacecraft, and supporting ground stations with the ability to prevent malicious actors from gaining control or executing commands on the space vehicle control system.
Satellite hacking is a legitimate threat, as evidenced by the 2020 “Hack-A Sat” DEF CON run by the US Department of the Air Force (USDAF 2020). Hacking resulting in physical movement of the SNS or host spacecraft could cause public safety impacts.
Design SNS, host spacecraft, and supporting ground stations with the ability to prevent malicious actors from remotely directing action that could damage the nuclear system.
In August 2006, plant operators at Browns Ferry Unit 3 in Athens, Alabama manually scrammed the reactor after two cooling water recirculation pumps failed due to a sharp spike in data traffic on the plant’s control system network (Case 2007). A malfunctioning programmable logic controller may have caused the data storm, but the plant and the NRC could not determine whether the malfunction resulted from an external distributed denial-of-service cyberattack (Case 2007). This type of disruption could be avoided by designing the SNS to prevent it from occurring.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 67 Guideline Rationale Design SNS, host spacecraft, and supporting ground stations with the ability to prevent malicious actors from remotely directing action that could cause a collision or reentry.
In February 1999, cyber hackers gained control of a United Kingdom SkyNet satellite, moved it on orbit, and then demanded ransom. This type of operation with an SNS has potential for significant negative outcomes, including deliberate malicious reentry into populated areas (dirty bomb from space), or controlled malicious reentry to gain control of nuclear material with the intent of developing a nuclear weapon.
Design SNS, host spacecraft, and supporting ground stations to ensure malicious actors cannot prevent any space vehicle or SNS control command from being executed.
This action against an SNS has potential to cause uncontrolled release of radioactive material to the environment if SNS or space vehicle safety commands are interfered with.
Design SNS, host spacecraft, and supporting ground stations to ensure the intrusion of malicious actors into the control system can be detected.
Cyber hackers breached the air gapped Kudankulam Nuclear Power Plant’s administrative network in Tamil Nadu, India, in 2019 (C.C. Lamb, R.E. Fasano, T. Ortiz 2020).
Detection of air-gapped computer system malware infections may not occur until years after the initial attack, which is not acceptable for SNS due to the risks this intrusion poses to the public (C.C.
Lamb, R.E. Fasano, T. Ortiz 2020).
Design SNS, host spacecraft, and supporting ground stations to ensure that the nuclear power output will be reduced during a denial of service cyberattack.
In the Browns Ferry Unit 3 example above, plant operators manually inserted control rods into the reactor core after the possible denial-of-service incident (Case 2007). This manual scram would not be possible in an autonomous SNS environment; thus, the system needs sufficient autonomy to detect the attack and place itself in a safe condition.
Design SNS, host spacecraft, and supporting ground stations using cybersecurity methods that are quantum proof.
Quantum computing has the potential to compromise traditional cybersecurity and encryption methods (National Institute of Standards and Technology 2021). Given the long hazard potential for SNS, it is vital that the cybersecurity methods utilized are as forward looking as possible to prevent a malicious actor from causing harm to the public using an SNS.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 68 B.2.8 Guidelines Applicable to SNS Analysis.
Performing the safety analysis for an SNS is a key step prior to licensing. Table 13 below provides guidelines to aid applicants in developing a robust, reliable analysis for their SNS.
Table 12 – SNS Analysis Guidelines Guideline Rationale When assessing the risk of the system, the worst-case scenario is assessed (IAEA 1999).
Applicants assessing the worst-case scenario for their system and mission concept, might consider:
• Source term;
• Time of failure;
• Population;
• Location;
• Spread of contamination
• Maximum dose to members of the public; and
• Extent of the damage.
SNS have well analyzed characteristics for their design-basis accidents.
Expected SNS conditions during the design-basis accident are thoroughly understood to ensure SNS can be accurately characterized during all phases of operation (from normal operations to credible accident scenarios) to quantify the risk the system poses to the public (NSPM-20 2019), (IAEA 1999).
SNS which will operate in Earth orbit give adequate data on the expected and unexpected radiation emissions and orbital location to enable assessment of potential interference with national assets.
All terrestrial based or space-based nuclear systems emit low levels of acceptable radiation non-harmful to life or physical assets. With space becoming a contested environment, it is crucial to have the ability to quickly assess if a national space asset was affected by an SNS or an adversary based on location and the level of radiation emissions and the emission parameters of the SNS.