Launch and Reentry of Space Nuclear Systems AC 450.45-1 61 B.2.5 Guidelines Applicable to the Design of Fission-Based SNS.
B.2.5.1 Fission can rapidly release massive amounts of energy. Controlling the critical fission chain reaction is of the utmost importance to protect public safety. Applicants should consider the following description, which relates to criticality accidents when handling fissionable or fissile material in situations where personnel are proximate to the material or system, from the Lecture Notes for Criticality Safety (Fullwood 1992):
A criticality accident is like an explosion or a fire or both in the sense that considerable energy is released. This energy can melt, boil, and vaporize apparatus, boil liquids, blow- apart structures, and produce hazardous missiles. Personnel can be killed or maimed by the energy release but the usual killer is radiation in the form of neutrons, and gammas. Betas and alphas can play a part, but their range is limited. To emphasize these points, a criticality accident may, depending on the severity:
• Throw personnel down and about,
• Rupture containers by steam pressure,
• Fracture equipment and produce flying missiles,
• Violently eject liquids,
• Melt, and possibly ignite, uranium and plutonium metals,
• Disperse radioactive particles,
• Ignite and explode surrounding materials,
• Emit lethal or incapacitating radiation.
Typically, a criticality accident produces an initial pulse of energy and radiation. The only protection for this is to be as far away from, and behind as much shielding material as possible. However, as will be seen from the following accident descriptions, many criticality accidents are of considerable duration (Fullwood 1992).
B.2.5.2 The operation of the fission based SNS significantly changes the radioactive isotope inventory, and thus changes the ionizing radiation exposure risks associated with the system. Fission based SNS are designed in a manner that balances meeting the mission requirements and minimizing the risk to the public, as explained in Table 10 of this AC.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 62 Table 10 – Guidelines for Designing Fission Based SNS Guidelines Rationale For space nuclear reactors that are normally controlled from Earth and are on missions that have the potential to return the reactor to Earth, design features are included to automatically shut down the reactor if communication is lost with the Earth control station.
If all ability to remotely operate the reactor is lost, automatic shutdown occurs to prevent an uncontrolled reentry of a critical reactor and to prevent reactor power excursions while control is lost.
For space nuclear reactors that are normally controlled from Earth and are on missions that have the potential to return the reactor to Earth, design features are included to ensure the reactor remains shut down until the Earth control station regains reliable communication with the reactor.
If the control station can reestablish positive control of the reactor, and all other conditions for criticality are met, reactors may be started up and operated at power. Until that happens, keeping the reactor shutdown best protects public safety.
Design SNS to prevent an inadvertent criticality event regardless of the orientation of the system during pre-flight and flight.
The potential for an SNS to undergo abnormal orientations means that the nuclear system is designed so these orientation changes have no effect on the system.
Design SNS to prevent an inadvertent criticality in challenging space weather environments.
Cosmic radiation, along with solar magnetics and other space weather events may be able to change the neutron flux in a reactor. SNS designs consider these factors and ensure the SNS can maintain control of the critical chain reaction in the expected space weather environment.
Design SNS to minimize the fission product yield during the dynamic conditions of collision in space or with the ground.
The varying forces encountered by an SNS may cause shock and relative position changes of reactor components, changing the geometry of the SNS and potentially leading to criticality (Dabrowski, et al. 2020). Minimizing the fission product yield in these scenarios is essential to minimizing the public safety risk, as history shows that fission yields exceeding 1×1016 fissions have a high probability of causing death if personnel are in close proximity (Fullwood 1992).(Fullwood 1992).
Launch and Reentry of Space Nuclear Systems AC 450.45-1 63 Guidelines Rationale Design SNS to remain subcritical during planned reentries.
Reentries present a risk of contamination and consequent risk to the public due to potential overflight of populated areas or deviation from planned reentry routes. Reentries also subject the SNS to temperature extremes and significant accelerations that could alter reactor parameters and physical systems (Bluck 2006).
Ensuring the system can remain subcritical will minimize the design-basis accident source term by preventing the creation of fission products during the reentry.
Design reactors to rely on delayed critical chain reactions and ensure proper design and operational mitigations are in place to minimize the possibility of prompt critical conditions occurring during times when the SNS may return to Earth.
Prompt-critical reactions are typically unstoppable and typically result in reactors selfdisassembling (Fullwood 1992). This could cause an uncontrolled radioactive release, posing a risk to the public.
Design reactors to minimize the possibility of unintentional criticality occurring, regardless of the medium surrounding the nuclear system (i.e., when submerged in water, sand, dirt, air, in-space radiation, deformation during crashes, etc.) unless reactor startup is intentionally initiated.
Because SNS move, the external environment cannot be assumed constant. External operating environments (i.e., in cold water vice warm air), or changes in system geometry (i.e. deformation during a crash) may affect the neutron flux in the system enough to cause criticality (Corliss 1969). This change to the neutron flux is accounted for in design such that the system can remain subcritical unless criticality is intentionally initiated.
Design reactors so they are inherently stable, i.e., when operating they can adjust their output power based on the power demands of the supplied loads without the need for operator action.
Active and passive safety measures incorporated into the SNS’s design will ensure that any deviations from equilibrium can be sufficiently mitigated and reorient back towards equilibrium, preventing runaway power and damage to the device (IAEA 1999).
When fission based SNS are designed to be controlled from Earth, the control paths between the operator and the SNS are designed with redundancy such that they are at least single failure tolerant.
SNS have designed redundancy such that no single fault impedes the ability to safely operate or shutdown the reactor (IAEA 1999).
Designing SNS with redundant control systems will lower the severity and probability of nuclear accidents, which will lower the risk to the public.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 64 B.2.6 Guidelines Applicable to Design of SNS Host Spacecraft.
The SNS host spacecraft plays a key role in ensuring the safe delivery, operation, and disposal of the SNS. The guidelines in Table 11 of this AC will aid designers in designing or selecting the appropriate spacecraft to host their SNS and minimize public safety risks.
Table 11 – Guidelines Applicable to Design of SNS Host Spacecraft Guideline Rationale Design spacecraft hosting space nuclear reactors with adequate instrumentation and communication capabilities for the operator to determine the power level of the reactor and the integrity of the physical barriers to radioactive release at all times when there is potential for the SNS to return to Earth’s surface.
Monitoring the power level ensures the space nuclear reactor does not violate design specifications ensuring the reactor operates normally (as expected and modeled) preventing damage to the reactor core. The operator always knows the status of fission product physical barriers to release to understand if there is an uncontrolled radiation and fission product release to the environment. Systems with uncontrolled release in the space environment can then be moved further from Earth to minimize the risk to the public.
Design spacecraft that will host SNS in Earth orbit with the capability to maneuver at any time until EOM.
Maneuvers avoid collisions and close approaches to nuclear-sensitive spacecraft, counteract natural orbital decay, and permit disposal into safe locations.
Design spacecraft hosting SNS having independently powered subsystems that give precise orbital position and velocity vector information to ground operators for use in collision avoidance against the on-orbit catalog.
Despite the ability of the Space Surveillance Network’s ability to track a spacecraft’s position, the most accurate data comes in the form of ephemeris reported directly from the owner operator of a spacecraft (18th Space Control Squadron 2020). Hence, the most accurate collision avoidance predictions come from a combination of precise orbital position from the satellite and owner operator coupled with the orbital tracking capabilities of the Space Surveillance Network for the on-orbit catalog (18th Space Control Squadron 2020).
Risk is minimized by using a launch vehicle design with successful operational history under similar conditions with payloads of similar size and weight.
Proven successful operations reduce the uncertainty in the nuclear safety analyses and gives greater confidence that the launch will be safe.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 65 Guideline Rationale Risk is minimized using reentry vehicle designs with successful operational history under similar conditions with payloads of similar size and weight.
Avoid failures during reentry as they are particularly harmful to the public because the radioactive material is returning to Earth. If reentry is desired, using a proven vehicle design reduces the risk and gives greater confidence that the reentry can be performed safely. Reentry of an SNS is still a risky mission operation, but the risk can be mitigated somewhat by using a proven design.
SNS designs and operation plans minimize radioactive contamination or activation of launch vehicle components, which will return to Earth during normal launch operations.
Since these components are known to return to Earth, any radioactivity added to them by the SNS poses a risk to the public. Minimizing the activation and contamination of these components minimizes the risk to the public.
Spacecraft hosting SNS contain propulsion systems to maintain orbital control and prevent orbital decay into the atmosphere due to drag.
The ability to maintain orbital control of any operational spacecraft is important but especially so when dealing with an SNS. Despite expectations that SNS avoid the highly congested low Earth orbital regime, situations may arise where the SNS ends up closer to Earth than intended. In these unintended circumstances, orbital control through propulsion is essential to avoid atmospheric drag and the possibility of an unintended reentry.
Risk is minimized for on-orbit operations using spacecraft with proven propulsion and maneuverability device designs.
Maneuverability on-orbit plays a significant role in reducing the likelihood of collision, which could result in uncontrolled reentry. Proven systems for propulsion and maneuverability give greater confidence that on-orbit operations will be safe.
For SNS missions that plan deorbits, utilize reentry vehicle designs having proven reliability.
Planning a de-orbit with new unproven technology and low reliability is not an optimal means to ensure environmental or public safety. Hardened and proven reentry vehicle designs give the best chance of safely de-orbiting an SNS regardless of how long it has been on orbit.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 66 B.2.7 Guidelines Applicable to SNS Cybersecurity.
Cybersecurity threats and protection practices are evolving rapidly. Applicants are encouraged to seek out additional cybersecurity and cyber-physical security guidance, utilizing the most developed and suitable means to protect the SNS and its host spacecraft from hacking, and thus protect the public from ionizing radiation exposure.
The National Institute of Standards and Technology has published many cybersecurity guidelines, including some specific to spacecraft, and is a reliable source for detailed cybersecurity information. Table 12 provides specific concerns applicants should endeavor to mitigate.
Table 12 – Guidelines for SNS Cybersecurity Guideline Rationale Design SNS, host spacecraft, and supporting ground stations with the ability to prevent malicious actors from gaining control or executing commands on the system’s power output and control systems.
When the Slammer worm attacked the Davis-Besse nuclear power plant on January 25, 2003, it disabled the Safety Parameter Display System and the Plant Process Computer for several hours (Markey 2003). Proper design will ensure this type of disruption will not occur in an SNS.
Design SNS, host spacecraft, and supporting ground stations with the ability to prevent malicious actors from gaining control or executing commands on the space vehicle control system.
Satellite hacking is a legitimate threat, as evidenced by the 2020 “Hack-A Sat” DEF CON run by the US Department of the Air Force (USDAF 2020). Hacking resulting in physical movement of the SNS or host spacecraft could cause public safety impacts.
Design SNS, host spacecraft, and supporting ground stations with the ability to prevent malicious actors from remotely directing action that could damage the nuclear system.
In August 2006, plant operators at Browns Ferry Unit 3 in Athens, Alabama manually scrammed the reactor after two cooling water recirculation pumps failed due to a sharp spike in data traffic on the plant’s control system network (Case 2007). A malfunctioning programmable logic controller may have caused the data storm, but the plant and the NRC could not determine whether the malfunction resulted from an external distributed denial-of-service cyberattack (Case 2007). This type of disruption could be avoided by designing the SNS to prevent it from occurring.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 67 Guideline Rationale Design SNS, host spacecraft, and supporting ground stations with the ability to prevent malicious actors from remotely directing action that could cause a collision or reentry.
In February 1999, cyber hackers gained control of a United Kingdom SkyNet satellite, moved it on orbit, and then demanded ransom. This type of operation with an SNS has potential for significant negative outcomes, including deliberate malicious reentry into populated areas (dirty bomb from space), or controlled malicious reentry to gain control of nuclear material with the intent of developing a nuclear weapon.
Design SNS, host spacecraft, and supporting ground stations to ensure malicious actors cannot prevent any space vehicle or SNS control command from being executed.
This action against an SNS has potential to cause uncontrolled release of radioactive material to the environment if SNS or space vehicle safety commands are interfered with.
Design SNS, host spacecraft, and supporting ground stations to ensure the intrusion of malicious actors into the control system can be detected.
Cyber hackers breached the air gapped Kudankulam Nuclear Power Plant’s administrative network in Tamil Nadu, India, in 2019 (C.C. Lamb, R.E. Fasano, T. Ortiz 2020).
Detection of air-gapped computer system malware infections may not occur until years after the initial attack, which is not acceptable for SNS due to the risks this intrusion poses to the public (C.C.
Lamb, R.E. Fasano, T. Ortiz 2020).
Design SNS, host spacecraft, and supporting ground stations to ensure that the nuclear power output will be reduced during a denial of service cyberattack.
In the Browns Ferry Unit 3 example above, plant operators manually inserted control rods into the reactor core after the possible denial-of-service incident (Case 2007). This manual scram would not be possible in an autonomous SNS environment; thus, the system needs sufficient autonomy to detect the attack and place itself in a safe condition.
Design SNS, host spacecraft, and supporting ground stations using cybersecurity methods that are quantum proof.
Quantum computing has the potential to compromise traditional cybersecurity and encryption methods (National Institute of Standards and Technology 2021). Given the long hazard potential for SNS, it is vital that the cybersecurity methods utilized are as forward looking as possible to prevent a malicious actor from causing harm to the public using an SNS.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 68 B.2.8 Guidelines Applicable to SNS Analysis.
Performing the safety analysis for an SNS is a key step prior to licensing. Table 13 below provides guidelines to aid applicants in developing a robust, reliable analysis for their SNS.
Table 12 – SNS Analysis Guidelines Guideline Rationale When assessing the risk of the system, the worst-case scenario is assessed (IAEA 1999).
Applicants assessing the worst-case scenario for their system and mission concept, might consider:
• Source term;
• Time of failure;
• Population;
• Location;
• Spread of contamination
• Maximum dose to members of the public; and
• Extent of the damage.
SNS have well analyzed characteristics for their design-basis accidents.
Expected SNS conditions during the design-basis accident are thoroughly understood to ensure SNS can be accurately characterized during all phases of operation (from normal operations to credible accident scenarios) to quantify the risk the system poses to the public (NSPM-20 2019), (IAEA 1999).
SNS which will operate in Earth orbit give adequate data on the expected and unexpected radiation emissions and orbital location to enable assessment of potential interference with national assets.
All terrestrial based or space-based nuclear systems emit low levels of acceptable radiation non-harmful to life or physical assets. With space becoming a contested environment, it is crucial to have the ability to quickly assess if a national space asset was affected by an SNS or an adversary based on location and the level of radiation emissions and the emission parameters of the SNS.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 69 Guideline Rationale Planned movements to lower orbits after operating fission systems at power are identified and analyzed during the nuclear safety analysis.
Intentionally moving an SNS closer to Earth shortens the natural orbital decay period; in the event of a failure this would minimize the time for the SNS to return to Earth, resulting in more fission products onboard when an uncontrolled reentry occurs. These risks are quantified and analyzed to ensure that an accurate assessment of the overall risk to the public is understood at the time the mission is licensed.
SNS are analyzed for the effects of corrosion.
Corrosion is a major concern for SNS, and materials science expertise is applied to determine the correct materials for each component to avoid premature or unexpected material failure. For example, in the case of a lithium heat-pipe fast reactor SNS at elevated operating temperatures, any contaminants within the lithium heat pipe can accelerate corrosion and heat pipe failure (Obal 2011).
SNS are analyzed for the effects of material fatigue.
In addition to possible low-cycle and high-cycle metal fatigue, in the case of a fission power reactor used in long transport missions, neutron embrittlement will raise the DBTT over time and may also contribute to metal fatigue (Finckenor and de Groh 2020), (Obal 2011).
SNS are analyzed for the effects of outgassing.
Outgassing can change the material properties or have undesirable effects on structural components.
For example, when choosing refractory materials in an SNS, designers are aware of vacuum welding and contaminant outgassing (Obal 2011).
SNS are analyzed for radiation effects on materials and electronics.
In addition to DBTT, in the case of polymers, particulate radiation exposure can lead to chain scission or cross-linking, causing polymer embrittlement (Finckenor and de Groh 2020). In the case of electronics, radiation-induced single event upsets, latch-ups, and bit errors can occur (Finckenor and de Groh 2020). Once again, material science is applied to the design of the SNS to choose suitable materials for each component.
SNS are analyzed for the effects of shock.
The explosive force of a launch mishap can range from thousands of kilograms TNT-equivalent up to one thousand tons TNT-equivalent (Camp, et al.
2019).
Launch and Reentry of Space Nuclear Systems AC 450.45-1 70 Guideline Rationale SNS are analyzed for the effects of thermal cycles.
The cyclic stress from thermal cycles can contribute to material failures. Depending upon the mission orbit, as many as 16 spacecraft thermal cycles a day could take place (Finckenor and de Groh 2020).
Material failure increases the risk to the public, as it can create a path for radioactive material to reach the environment.
SNS are analyzed for the effects of vibration.
Vibration can harm structural and internal components of SNS and may be caused by the spacecraft or the SNS. For instance, in the case of an SNS using fuel particles, the vibration analysis accounts for the possibility of damage to or shifting of the fuel particles, resulting in reactor plugging, or local coolant flow blockage (Idaho National Laboratory 2015).
B.2.9 Guidelines Applicable to SNS Validation, Verification and Testing.
Validation, verification, and testing of the SNS are a key step to ensure the as-built device performs like the as-designed device. In this context, testing an actual nuclear system provides the ability to generate actual test data, but naturally presents greater risk to the surrounding people and property than a computer simulation or mathematical model, since the nuclear system is actually operating. During this process, applicants may discover that the actual performance differs significantly enough to impact the safety analysis conclusions. To aid applicants in developing a robust validation, verification, and testing program, the guidelines in Table 14 of this AC are provided.
Table 13 - Guidelines for SNS Validation, Verification, and Testing Guideline Rationale Validate, verify, and test SNS to ensure the as-constructed system and its host spacecraft are within design specifications.
Validating the constructed SNS meets the design requirements minimizes the probability of failure leading to the release of radioactive material to the environment under normal operating conditions and minimizes the probability of the physical barriers to radioactive release failing during abnormal or accident conditions, thus minimizing the risk to the public and environment (IAEA 1999).
Launch and Reentry of Space Nuclear Systems AC 450.45-1 71 Guideline Rationale SNS have well understood operating characteristics for anticipated operational occurrences.
Significant modeling, simulation, validation, verification and testing will be conducted prior to launch approval to ensure that SNS can be operated safely within expected operational parameters (NSPM-20 2019), (IAEA 1999).
The verification and testing of SNS should demonstrate structural integrity for anticipated operational occurrences and design-basis accidents.
Design-basis accidents ensure the SNS can withstand the most severe failures expected. For systems to be operated in Earth orbit, the designbasis accidents include uncontrolled reentry. The risk to the public can be minimized by proper design, informed by modeling, and testing of SNS.
SNS to be operated in orbits that naturally decay to Earth before the activity of the system will decay to about the activity of uranium-235 have overall system reliabilities meeting or exceeding those of highly reliable flight safety systems,
0.999 at 95% confidence (SPD- 6 2020), (Title 14 CFR Part 450 2022).
SNS are designed and manufactured with the reliability standards of highly reliable flight safety systems to minimize the risk to the public if an SNS is not able to remain on orbit. Because SNS have significant public safety risks, they are designed to be as reliable as the most reliable systems on the spacecraft.
To the maximum extent practical, minimize critical operations and testing for a fission based SNS before arriving at a safe orbital altitude (SPD-6 2020).
Starting up a nuclear fission reactor increases the quantity and concentration of shorter lived, higher energy emitting radioactive isotopes and increases the potential source term and radiological risk to the public (Fullwood 1992). In general, fission products pose more exposure risk to the public than nuclear fuels, therefore the amount of fission products in the system is minimized to the extent practical prior to launch (IAEA 2021). Minimizing fission product generation will lessen radiation levels after shutdown and thus the risk to the public.
Launch and Reentry of Space Nuclear Systems AC 450.45-1 72 B.2.10 Guidelines Applicable to Mission Planning for SNS Launch.
B.2.10.1 Launch is a time of particularly high risk to the SNS and the public. Applicants are encouraged to consider the full spectrum of design and operations concepts to identify the one that best minimizes the risk to the public. Guidance for planning SNS launch is provided in Table 15 of this AC. The areas overflown during launch determine the potential locations for the debris field impact during a launch mishap. The populations and land use of the overflown areas, as well as the nuclear proliferation concerns of the overflown areas drive the risk to the public from the SNS crashing during launch.
Because NSPM-20 directs the nuclear safety analyses to consider any subsequent stages of SNS operation, which “may result in radiological effects on the public or the environment,” the overflight areas are relevant to determining the overall risk of the SNS (NSPM-20 2019).
B.2.10.2 The vehicles used for launch, operation, and reentry of an SNS directly affect the risk to the public, as a vehicle failure significantly increases the risk of a nuclear system failure. Additionally, overall vehicle reliability, vehicle control and contingency management capabilities can greatly influence the safety of a launch attempt, including if the launch is unsuccessful. For example, the controllability of a liquid-fueled vehicle might minimize the stress on an SNS payload, or a vehicle with a thrust termination system may mitigate safety risk more effectively than a vehicle with a destruct system.
Table 14 – Guidelines for SNS Launch Planning Guideline Rationale Risk to the public is minimized when the SNS launch vehicle is highly reliable.
Highly reliable launch vehicles are more likely to have launch success, and less likely to expose the public to ionizing radiation.
Maximize overflight of oceans during launch.
Crashing into the ocean versus onto land minimizes the risk to individuals and the cleanup costs of the event, due to the radiation shielding and contamination dilution effects of large bodies of water (National Institute of Standards and Technology 2019).
For a given SNS and launch vehicle, the risk to the public can be changed through the selection of different launch sites and azimuths. Proper risk mitigation for SNS includes a comprehensive review to identify the right combination to best accomplish the mission objectives while minimizing risk.
It is prudent for launch applicants to consider a variety of launch sites and azimuths for launches with SNS to make an informed, riskbased decision when planning missions.