ML23226A004

Research Information Letter 2023-06, Literature Review Space Nuclear System Launch Safety Review Process

ML23226A004
Person / Time
Issue date:	09/30/2023
From:	Shockley S NRC/RES/DSA
To:
Shared Package
ML23223A162	List: ML23226A004
References
RIL-2023-06
Download: ML23226A004 (82)

Text

RIL 2023-06 Literature Review:

Safety Review Process for Space Nuclear System Launches Date Published: September 2023 Prepared by:

S. Shockley Research Information Letter Office of Nuclear Regulatory Research

Disclaimer Legally binding regulatory requirements are stated only in laws; U.S. Nuclear Regulatory Commission regulations; licenses, including technical specifications; or ordersnot in research information letters (RILs). An RIL is not regulatory guidance, although the agencys regulatory offices may consider the information in an RIL to determine whether any regulatory actions are warranted.

ABSTRACT The U.S. Nuclear Regulatory Commission (NRC) has participated in mission-specific Interagency Nuclear Safety Review Panels since its creation. In the 1960s and early 1970s, the Atomic Energy Commission (the NRCs predecessor) contributed to the Navys satellite program and the National Aeronautics and Space Administrations launches through its Systems for Nuclear Auxiliary Power program, which created the first nuclear systems used on U.S. space missions. This report presents a literature review of more than 100 sources selected from over 300 documents pertaining to (1) the history of space nuclear systems, including their risk, past incidents, and future missions, (2) safety analyses conducted for previous space nuclear system missions and how they were conducted, (3) the policy surrounding the approval process for these launches, including the safety review process, and (4) new guidelines of the 2019 National Security Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Systems. The report concludes by identifying potential challenges within the field of space nuclear safety and provides recommendations for further literature review. These recommendations are intended to better equip the NRC staff in preparation for future space nuclear system launches.

iii

TABLE OF CONTENTS ABSTRACT ................................................................................................................................. iii LIST OF FIGURES ...................................................................................................................... vi LIST OF TABLES ....................................................................................................................... vii EXECUTIVE

SUMMARY

........................................................................................................... viii ACKNOWLEDGEMENTS ............................................................................................................ x ABBREVIATIONS AND ACRONYMS ........................................................................................ xi 1 INTRODUCTION ............................................................................................................ 1-1 1.1 Purpose of the Literature Review ................................................................ 1-1 1.2 Scope of the Literature Review ................................................................... 1-1 1.3 Literature Review Methodology................................................................... 1-2 1.4 Groups for Analysis...................................................................................... 1-2 1.5 Exclusion Criteria ......................................................................................... 1-2 2 SPACE NUCLEAR SYSTEMS: RISK AND POTENTIAL ACCIDENTS ....................... 2-1 2.1 Fission Reactors in Space ........................................................................... 2-3 2.2 Nuclear Propulsion ....................................................................................... 2-7 2.3 Radioisotope Power Systems...................................................................... 2-8 2.4 Space Nuclear Incidents ............................................................................ 2-11 2.5 Future Missions .......................................................................................... 2-14 3 SAFETY ANALYSIS FOR SPACE NUCLEAR SYSTEMS ........................................... 3-1 3.1 An Overview of Space Nuclear Safety Analysis ........................................ 3-2 3.2 The Risk of Space Nuclear Fuel Sources (Early 1960s) ............................ 3-3 3.3 Safety Analyses Since the 1980s ................................................................ 3-9 3.4 Calculation Methods for Risk Assessments ............................................ 3-14 4 INTERAGENCY SAFETY REVIEW PROCESS FOR NUCLEAR MISSIONS .............. 4-1 4.1 The Evolving Safety Review Framework .................................................... 4-2 4.2 The Practice of Interagency Safety Review .............................................. 4-10 4.3 The Development of Safety Evaluation Reports ...................................... 4-14 4.4 The U.S. Nuclear Regulatory Commissions Role in the Safety Review Process ........................................................................................................ 4-16 4.5 Foreign and International Nuclear Mission Safety and Approval .......... 4-17 5 CONCLUSIONS ............................................................................................................. 5-1 5.1 Possible Challenges for the Space Nuclear Safety Field .......................... 5-1 5.2 Recommendations for Further Literature Review ..................................... 5-3 iv

6 REFERENCES ............................................................................................................... 6-1 APPENDIX A SAFETY ANALYSIS CODES ........................................................................ A-1 APPENDIX B PAST SAFETY ANALYSIS REPORTS......................................................... B-1 v

LIST OF FIGURES Figure 2-1 A diagram of the SNAP-10A reactor system ............................................................ 2-4 Figure 2-2 The diagram of a potential design for the SP-100 reactor ........................................ 2-6 Figure 2-3 A mockup of the NERVA engine design ................................................................... 2-8 Figure 2-4 Installation of the SNAP generator on a Transit satellite .......................................... 2-9 Figure 2-5 A labeled diagram of an MMRTG and a GPHS ...................................................... 2-11 Figure 2-6 The SNAP-19 RTG, which NASA used in several missions, with modifications, including Nimbus, Pioneer, and Viking ...................................... 2-13 Figure 3-1 The SNAP-1A device ................................................................................................ 3-4 Figure 3-2 A plot of the radiological inventory of SNAP-10A following startup of the reactor ................................................................................................................ 3-8 Figure 3-3 An example subbranch of possibilities from the 1988 LWRHU report .................... 3-10 Figure 3-4 The process for calculating final risk of a space nuclear system launch with the three levels labeled .................................................................................... 3-16 Figure 3-5 A full-scale model of the SNAP-10A reentry vehicle in an acoustic facility at Sandia National Laboratories ........................................................................... 3-19 Figure 4-1 Major events in the launch approval framework ....................................................... 4-3 Figure 4-2 The INSRB safety review process as depicted in the playbook ............................... 4-9 Figure 4-3 INSRP role in the launch approval process ............................................................ 4-12 vi

LIST OF TABLES Table 2-1 Past U.S. Space Nuclear System Launches ............................................................. 2-1 Table 2-2 Summary of SNAP Reactors ..................................................................................... 2-5 Table 2-3 U.S. Space Mission Incidents Involving Nuclear Systems ....................................... 2-12 Table 2-4 Soviet Space Mission Incidents Involving Nuclear Systems .................................... 2-14 Table 3-1 Comparison of Radioisotopes Considered for Use in RPSs ...................................... 3-3 Table 3-2 Levels of Analysis for Nuclear Safety Analysis ........................................................ 3-15 Table 4-1 NSPM-20 NPS Risk Tiers .......................................................................................... 4-5 Table 4-2 Probability-Consequence Curve Targets from NSPM-20 .......................................... 4-5 Table 4-3 INSRB Playbook Suggested Analysis and Review Outline ....................................... 4-8 Table A-1 List of Computer Codes Used for Space Nuclear System Safety Analysis .............. A-1 vii

EXECUTIVE

SUMMARY

The history of space nuclear systems traces back to the first decades of nuclear power itself.

Both the United States and the former Soviet Union launched an extensive number of spacecraft with some form of a nuclear power source (NPS) on it, whether it be nuclear fission or radioisotope decay that generated the heat and energy. Before the launch of an NPS, U.S. policy requires, and international commitments recommend, that a safety review be conducted. This report presents a literature review of the history and details of the safety review process for space nuclear system launches, as well as the history and safety of missions using NPSs.

This literature review surveyed over 300 documents related to the launch of space nuclear systems. Documents were sourced using publicly available databases provided by the U.S. Nuclear Regulatory Commission (NRC) (Agencywide Documents Access and Management System, Technical Librarys Online Catalog), the International Atomic Energy Agency (International Nuclear Information System), the U.S. Department of Energy (Office of Scientific and Technical Information), the National Aeronautics and Space Administration (Technical Reports Server), and the U.S. Department of Commerce (National Technical Reports Library). By using tailored keyword searches and investigating the references of documents, the author selected reports pertaining to (1) the history of space nuclear systems and their risks, (2) past safety analyses and reviews conducted on these systems, and (3) the current and historical framework exercised to review the safety of these systems before launch.

After reviewing the original documents, the author selected over 100 sources that directly pertain to these categories to be referenced in the final literature review. These sources informed the literature review on the topics relevant to space nuclear system launches and their safety. This review describes the relevant contents of these sources and summarizes them below.

The environmental consequences of the few failed missions using NPSs has been negligible.

The U.S. program has experienced two failures of NPS-equipped spacecraft during the launch phase in its nascency. One such failure led to the release of radiological material during a burnup upon reentry as intended by the devices design. One other mission ended with reentry into the Pacific Ocean (the Apollo 13 Lunar Excursion Module) following a successful launch phase but had no measurable release of radiological material.

In the United States, the sponsoring agency of a space nuclear system launch is responsible for a safety analysis report (SAR) summarizing the risks of the mission. In more recent times, the developers of these reports have employed a risk assessment framework to prepare the SAR.

These modern safety analyses typically categorize the mission into six phases:1 (0) prelaunch, (1) early launch, (2) late launch, (3) suborbital, (4) orbital, and (5) long term (Bixler et al., 2013, 21). Systematically, the discussion of each category describes the possible accidents, associated probabilities, NPS response, source terms, dispersion, exposure, and consequences. As not all postulated accidents entail the release of radiological material, such 1

The Cassini missions had an additional phase for an Earth gravity assist performed following a Venus flyby in which it returned for an Earth flyby before its final trajectory to Saturn. The Galileo mission performed a similar maneuver on its route to Jupiter but had only six phases (each referring to slightly different parts of the mission from those described above, except for the shared prelaunch phase).

viii

as many of those considered in the SAR for the Light-Weight Radioisotope Heater Units (Johnson, 1988a), the analysis may only need to calculate the amount of radiological release, the source term, for a limited number of cases.

After issuance of Presidential Directive/National Security Council 25, Scientific or Technological Experiments with Possible Large-Scale Adverse Environmental Effects and Launch of Nuclear Systems into Space, in 1977 (Brzezinski, 1977), the approval process for space nuclear system launches remained much the same until the publication of the National Security Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Systems (NSPM-20) in 2019 (Trump, 2019). The interagency review process evolved from a desire of the Atomic Energy Commission for interagency cooperation on safety reviews. An interagency review for space nuclear systems, it argued, would produce reliable results and earn the trust of legislators and the public.

Over approximately 50 years, the Interagency Nuclear Safety Review Panel (INSRP), an ad hoc organization empaneled for each mission, embodied this process. The INSRP played a crucial role in verifying the safe operation of NPSs up until the Mars 2020 mission. The White House incorporated calls for reform of the process that arose over the years (Camp et al., 2019b) into NSPM-20 in 2019. The memorandum encompassed the adoption of new launch approval metrics, radiological limits for missions warranting safety reviews, and the creation of the standing Interagency Nuclear Safety Review Board (INSRB) primarily tasked with reviewing space nuclear system launches conducted by the U.S. Government. The initial mission to fall under the INSRBs review will likely be the U.S. Department of Defenses Demonstration Rocket for Agile Cislunar Operations (or DRACO) mission (Greiner, 2021).

ix

ACKNOWLEDGEMENTS The completion of this report could not have been possible without the guidance and support of the staff of the U.S. Nuclear Regulatory Commission (NRC). The author would like to thank Tina Ghosh of the NRC staff for her pivotal role in providing comments, direction, and feedback that significantly contributed to the development of this report. The author extends their appreciation to Don Marksberry of the NRC staff for supplying the reviewed and referenced documents, and to Don Helton from the National Aeronautics and Space Administration for his valuable assistance and support in reviewing this report. Lastly, special thanks are given to Luis Betancourt for providing NRC management oversight throughout this project.

x

ABBREVIATIONS AND ACRONYMS AEC Atomic Energy Commission Ce cerium CIA Central Intelligence Agency Cm curium COPUOS Committee on the Peaceful Uses of Outer Space DARPA Defense Advanced Research Projects Agency DOD U.S. Department of Defense DOE U.S. Department of Energy DOS U.S. Department of State DOT U.S. Department of Transportation DRACO Demonstration Rocket for Agile Cislunar Operations EIS environmental impact statement EPA U.S. Environmental Protection Agency ERDA U.S. Energy Research and Development Agency ESA European Space Agency FAA Federal Aviation Administration FSAR final safety analysis report GPHS General Purpose Heat Source IAEA International Atomic Energy Agency INL Idaho National Laboratory INSRB Interagency Nuclear Safety Review Board INSRP Interagency Nuclear Safety Review Panel IRG INSRB Review Group JHU/APL The Johns Hopkins University Applied Physics Laboratory kg kilogram KRUSTY Kilopower Reactor Using Stirling Technology kW kilowatt LANL Los Alamos National Laboratory LES 8/9 Lincoln Experimental Satellites 8 and 9 LWRHU Light-Weight Radioisotope Heater Unit MHW multihundred watt MMRTG multi-mission radioisotope thermoelectric generator xi

MND Martin Nuclear Division MSL Mars Science Laboratory MW megawatt NASA National Aeronautics and Space Administration NEP nuclear electric propulsion NERVA Nuclear Engine for Rocket Vehicle Applications NPS nuclear power source NRC U.S. Nuclear Regulatory Commission NSAM National Security Action Memorandum NSPM National Security Presidential Memorandum NTP nuclear thermal propulsion OSS Office of Space Science OSTP Office of Science and Technology Policy PD/NSC Presidential Directive/National Security Council PPD Presidential Policy Directive Po polonium PRA probabilistic risk assessment Pu plutonium RES United Nations Resolution RHU radioisotope heater unit RIL research information letter RORSAT Radar Ocean Reconnaissance Satellite RPS radioisotope power system RTG radioisotope thermoelectric generator SAR safety analysis report SER safety evaluation report SMD Science Mission Directorate SNAP Systems for Nuclear Auxiliary Power SNL Sandia National Laboratories SNR space nuclear reactor STSC Scientific and Technical Subcommittee U uranium UN United Nations UNGA United Nations General Assembly xii

1 INTRODUCTION The use of nuclear power sources (NPSs) in space missions traces back to the beginning of the U.S. space program, starting with the Systems for Nuclear Auxiliary Power (SNAP) program led by the Atomic Energy Commission (AEC). The program achieved its first flight in 1961 with the SNAP-3A2 radioisotope thermoelectric generator (RTG) launched on the Transit 4-A satellite.

The AEC recognized the potential radiological risk of such power sources and established the Aerospace Nuclear Safety Board, which would analyze their safety and promote standard practices, collaborate with the National Aeronautics and Space Administration (NASA), and work to reduce the radiological risk of launching nuclear material3 into space (U.S. Department of Energy (DOE), 1987a, 15).

Although much has changed since thenthe SNAP program no longer exists, RTGs are a matured technology, and the Energy Reorganization Act of 19744 abolished the AECsafety is still a priority in the launch of space nuclear systems. As a result, the safety review process for such launches has also evolved over the decades. Most recently, the previously ad hoc Interagency Nuclear Safety Review Panel (INSRP) has been restructured as a standing body known as the Interagency Nuclear Safety Review Board (INSRB). In accordance with the mandate outlined in the National Security Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Systems (NSPM-20), dated August 20, 2019 (Trump, 2019), the NRC now designates its own representative to be an equal member of the INSRB.

This literature review aims to support the NRC in fulfilling its role within the INSRB process and addressing the emerging requirements of the field. It examines past safety analyses, risk assessments, and INSRP safety reviews of launches.

1.1 Purpose of the Literature Review This literature reviews purpose is to (1) assist the NRC in fulfilling its role in the recently created INSRB by providing context for safety reviews of space nuclear launches, (2) examine past review methods, risk calculations, and safety analyses, and (3) assess the applicability of publicly available information to future safety reviews of space nuclear launches.

1.2 Scope of the Literature Review The scope of the literature review falls into three categories:

2 The SNAP program used odd numbers to denote the use of RTG systems, while even numbers indicated the use of nuclear reactors.

3 The definition here of nuclear material includes special nuclear material that consists of plutonium, uranium (U)-233 or uranium with U-233 or U-235 content greater than that found in nature (i.e., greater than 0.71 percent U-235).

4 Under the Atomic Energy Act of 1954, a single agency, the AEC, was responsible for developing and producing nuclear weapons and the development and safety regulation of the civilian use of nuclear materials. The Energy Reorganization Act of 1974 split these functions, assigning to one agency, now the DOE, the responsibility for the development and production of nuclear weapons, promotion of nuclear power, and other energy-related work, and establishing the U.S. Nuclear Regulatory Commission (NRC) to carry out the regulatory work, except for the regulation of defense nuclear facilities.

1-1

• an overview of space nuclear systems, including their history and associated risks

• past safety analyses and reviews conducted on these systems

• an overview of the current and historical framework encompassing space nuclear system launch safety review This report is an initial attempt to summarize available knowledge on these topics. The literature review discusses a subset of publicly available information and was conducted over a limited time frame. Therefore, this report does not represent a comprehensive summary of the full set of information that may be available.

1.3 Literature Review Methodology The method for acquiring the documents used in this literature review was to search the NRCs Technical Librarys catalog, the International Atomic Energy Agencys (IAEAs) International Nuclear Information System, the collection of the DOE Office of Scientific and Technical Information, and the U.S. Department of Commerces National Technical Report Library for relevant documents that are publicly available. The searches included the key terms space and nuclear, as well as safety, risk, safety assessment, or risk assessment as supplemental terms. Following references within the reviewed sources resulted in additional documents for the review.

1.4 Groups for Analysis The literature review categorized the documents into three groups for analysis that reflect the scope of the review, with some overlap:

• contextual information for past launches and their risks

• the potential offsite (public) consequences of these missions and their methods for determination

• the past INSRP review process and foreign nations reviews for space nuclear launches 1.5 Exclusion Criteria Given the number of documents found for this literature review, some exclusion was necessary to focus on the reviews scope and achieve its purpose effectively. The items retained directly concern either the launch approval process or the safety analyses for space nuclear systems or discuss the context of a space nuclear system launch and its risks. The author excluded some sources meeting those criteria due to redundancy or outdated information at their discretion.

1-2

2 SPACE NUCLEAR SYSTEMS: RISK AND POTENTIAL ACCIDENTS Starting just years after the launch of the first satellites, nuclear systems have supplied power to spacecraft for over half a century. Space missions use NPSs along with or instead of solar panels to generate power and are crucial when solar power is insufficient. There are two main types of NPSs: (1) space nuclear reactors (SNRs) and (2) radioisotope power systems (RPSs),

which include both RTGs and radioisotope heater units (RHUs).

The United States and the former Soviet Union often used NPSs in their space programs and launched a similar number of missions equipped with them. Between the two nations, the U.S.

program has heavily favored RTGs while the Soviet program relied mostly on SNRs (Lee and Buden, 1994, 1). Table 2-1 lists all U.S. space nuclear system launches. Since 1961, the United States has launched 32 NPS-equipped missions into space, several containing multiple RTGs and many RHUs (The Johns Hopkins University Applied Physics Laboratory (JHU/APL), 2015, 97). One of the U.S. missions experienced an unplanned reentry with dispersal. For its part, the former Soviet Union launched approximately 38 SNRs throughout its space program. Two Soviet SNR-equipped missions, along with three of its RTG-equipped missions, experienced unplanned reentries with dispersal (Lenard, 2008, 206; Bennett, 1990, 276).

Table 2-1 Past U.S. Space Nuclear System Launches Mission name NPS a Launch Status date Transit 4-A SNAP-3B7 Jun. 1961 Successful operation, b termination Transit 4-B SNAP-3B8 Nov. 1961 Successful operation, termination Transit 5-BN-1 SNAP-9A Sep. 1963 Successful operation, termination Transit 5-BN-2 SNAP-9A Dec. 1963 Successful operation, termination Transit 5-BN-3 SNAP-9A Apr. 1964 Mission abort, RTG burned upon reentry SNAPSHOT SNAP-10A c Apr. 1965 Successful operation, nonreactor malfunction before planned termination Nimbus B-1 SNAP-19B2 May 1968 Mission abort, RTG recovered and recycled Nimbus III SNAP-19B3 Apr. 1969 Successful operation, termination Apollo 11 RHU Jul. 1969 Successful operation, termination Apollo 12 SNAP-27 Nov. 1969 Successful operation, termination Apollo 13 SNAP-27 Apr. 1970 Mission abort, RTG returned to South Pacific Ocean Apollo 14 SNAP-27 Jan. 1971 Successful operation, termination Apollo 15 SNAP-27 Jul. 1971 Successful operation, termination Pioneer 10 SNAP-19, Mar. 1972 Successful operation RHU Apollo 16 SNAP-27 Apr. 1972 Successful operation, termination 2-1

Mission name NPS a Launch Status date TRIAD-01-1X Transit-RTG Apr. 1972 Successful operation, termination Apollo 17 SNAP-27 Dec. 1972 Successful operation, termination Pioneer 11 SNAP-19, Apr. 1973 Successful operation RHU Viking 1 SNAP-19 Aug. 1975 Successful operation, termination Viking 2 SNAP-18 Sep. 1975 Successful operation, lost signal LES 8/9 MHW-RTG Mar. 1976 Successful operation Voyager 2 MHW-RTG, Aug. 1977 Successful operation RHU Voyager 1 MHW-RTG, Sep. 1977 Successful operation RHU Galileo GPHS-RTG, Oct. 1989 Successful operation, deorbited into LWRHU Jupiter Ulysses GPHS-RTG Oct. 1990 Successful operation, termination Mars Pathfinder LWRHU Dec. 1996 Successful operation, termination Cassini GPHS-RTG, Oct. 1997 Successful operation, deorbited into LWRHU Saturn MER-A LWRHU Jun. 2003 Successful operation, termination MER-B LWRHU Jul. 2003 Successful operation, termination New Horizons GPHS-RTG Jan. 2006 Successful operation Mars Science MMRTG Nov. 2011 Successful operation Laboratory Mars 2020 MMRTG Jul. 2020 Successful operation Sources: Nuclear Power Assessment Study: Final Report, TSSD-23122, JHU/APL, 2015; NASA, ULA Launch Mars 2020 Perseverance Rover Mission to Red Planet, Johnson, 2020.

a Some missions carried more than one RPS.

b A successful operation is the launch of a spacecraft without an unplanned release of radiological material or premature return of the NPS(s) to Earth. This should mean the NPS has not posed risk to the global population, though Earth-bound missions typically included a planned reentry after the decay of their radiological inventory.

c SNAP-10A is the only fission reactor on this list; all other entries are RPSs.

2-2

From this history, the United States has decades of experience in the review and analysis of RPS launch safety. It has also launched a single SNR, and though it has not flown any since, it has designed and tested several others. The Nations research into nuclear systems has also included nuclear propulsion. Still, since the last reactor launch, no NPS other than RPSs has completed the launch approval process (JHU/APL, 2015, 98), leaving the U.S. safety program with a lack of practical experience for sources other than RPSs.

Unlike the U.S. space program, the Soviet space program possessed substantial experience in launching SNRs. However, despite conducting nearly 40 reactor flights, it provided limited insight into its SNR safety program in the open literature. Individuals in the field of space nuclear systems (Bennett, 1992a) were, however, able to note changes in the Soviet space nuclear safety philosophy as evidenced by alterations made to the countrys SNRs and statements to the United Nations (UN) regarding them.

The following section summarizes the history of the three areas of interest for space nuclear systemsSNRs, nuclear propulsion, and RPSsto provide context for the interagency safety review process described later in this report. It then describes several key incidents involving NPSs and their consequences for comparison to the descriptions of the systems safety analyses. The section then ends with a brief summary of current and future projects in the field of space nuclear systems.

2.1 Fission Reactors in Space In April 1965, the United States launched its first and only SNR. Known as SNAP-10A, it was placed into a polar orbit and provided 500 watts of power to various components of the satellite, including a small ion drive (Corliss, 1971, 7). Figure 2-1 depicts a diagram of the system. When modeling its safety, designers found three main types of accidents that could harm the public (Corliss, 1966, 35):

(1) There could be inadvertent criticality of the reactor during a launch failure.

(2) During reentry, the reactor fuel could burn up (a process called ablation) and spread radiation throughout the atmosphere.

(3) Pieces of the reactors fuel could survive intact, emitting significant doses of harmful radiation.

Three aspects of the design addressed these situations (Bennett, 1981, 428):

(1) Operators kept the reactor subcritical and appropriately shielded before launch to minimize radioactivity.

(2) Designers ensured the core would remain subcritical in case of impact before startup.

(3) The spacecrafts final orbit would persist long enough that the fission products could decay until emissions were roughly the same as background radiation levels before reentry.

2-3

While the first two solutions were preventive measures, reentry was ultimately unavoidable as with any Earth-orbiting satellite. Consequently, the spacecraft placed itself in an orbit projected to last 3,800 years before full shutdown. By the time the reactor burned up in the atmosphere, its radiation is expected to have diminished to a negligible level (Lee and Buden, 1994, 2). To guarantee this outcome, the designers incorporated automated systems that would only allow reactor startup after a long-term orbit was achieved. Eventually, a malfunction in the voltage regulator outside of the reactor prematurely shut down SNAP-10A, and to this day, the spacecraft remains in its several-thousand-year-long orbit (Bennett, 1981, 428). Table 2-2 lists the SNAP program reactors, including SNAP-10A.

Figure 2-1 A diagram of the SNAP-10A reactor system Source: HD.6D.512, n.d., in DOE, AECReactor Development, 2013.

2.1.1 Space Nuclear Reactors after SNAP-10A (1960s-1990s)

In the years following the launch of SNAP-10A, three major U.S. SNR projects included (1) the SNAP-50 reactor, (2) the Nuclear Engine for Rocket Vehicle Application (NERVA) program, earlier known as Rover (1955-1973), and (3) the SP-100 program (1983-1994). The SNAP program intended SNAP-50 to be a reactor capable of generating 300 kilowatts (kW) of power.

As it lost funding, the reactor marked the end of the SNAP reactor program and remained in the developmental stage without ever progressing further (Voss, 1984, 87). The second major program, NERVA, developed a nuclear-powered rocket initially based on the successfully tested Kiwi B reactor, a design intended to prove the feasibility of a 1,000-megwatt (MW) nuclear thermal reactor. Phoebus, a reactor with even higher poweraround 5,000 MWwas 2-4

developed in parallel with engine testing. Initially, its components were tested in a smaller reactor, named Pewee. Concerns in the later years with the radiological hazards of engine exhaust during these tests led to the construction of another reactor, the Nuclear Furnace, which operated at 44 MW. Although it never flew, NERVA managed to secure practical tests before its termination (Idaho National Laboratory (INL), 2015, 16-17, 20, 67, 72-75).

Table 2-2 Summary of SNAP Reactors Project Power (kW) Core type Core coolant Generator Final status SNAP-2 3 Uranium Sodium- Rankine-cycle Discontinued zirconium potassium hydride SNAP-8 35 Uranium Sodium- Rankine-cycle Partial zirconium potassium (mercury completion, hydride working fluid) discontinued in 1970 SNAP-10 0.3 Uranium None Thermoelectric Designed using zirconium conductive hydride cooling, modified into SNAP-10A SNAP-10A 0.6 Uranium Sodium- Thermoelectric Completed, zirconium potassium launched hydride SNAP-50 100-1,000 Fast, Lithium Rankine-cycle Discontinued in uranium (potassium 1965 nitride working fluid)

Source: Atomic Power in Space II: A History of Space Nuclear Power and Propulsion in the United States, INL/EXT-15-34409, INL, 2015.

The DOE began a 5-year program to develop a space reactor in 1979, which it called the Space Power Advanced Reactor. It used a uranium oxide core with sodium coolant. Beryllium reflectors controlled the reactors operation. Doubts threatened the reactors development program, but a partnership with NASA, after some initial disagreements in the early 1980s, preserved the program under the new name Space Power 100 kilowatts, or SP-100 (INL, 2015, 60-62). Figure 2-2 The diagram of a potential design for the SP-100 reactor depicts a conceptual diagram of the reactor.

The SP-100 reactor project lacked a practical mission application across agencies and had no clear purpose other than its intended power target (Tarves, 2004, 54). Despite this, designers followed strict safety requirements in anticipation of its planned use. Similar to SNAP-10A, the reactor was to remain subcritical before launch. The safety rods and control drums would be physically locked and require an astronaut or remote signal to activate so that the reactor would only become critical when intended (DOE, 1987b, 4). The reactors reentry philosophy, however, was the opposite of that for SNAP-10A. Its core was designed to survive reentry and impact, keeping all nuclear material sealed, similar to modern RTGs (Buden, 1993, 18-19).

2-5

Before its conclusion, the SP-100 reactor program had made the most significant advancements among domestic SNR programs since the SNAP era. Until the recent Kilopower and Fission Surface Power projects, no other domestic SNR program achieved a comparable level of progress (Lenard, 2008, 206). The project, as with all other SNR projects following the success of SNAP-10A, ended before ever completing the launch approval review process.

Figure 2-2 The diagram of a potential design for the SP-100 reactor Source: DOE Space Nuclear Power and Propulsion (SNPP) Activities, Bishop, 2021.

The former Soviet Union launched almost 40 SNRs, beginning with the Radar Ocean Reconnaissance Satellites (RORSATs) and ending with two reactor experiments the United States named TOPAZ (Bragg-Sitton et al., 2011, 4). After the unplanned reentry of Cosmos 954 and its reactor in the 1970s, the Soviet Union developed a core ejection system that would ensure the full dispersal of the reactors fuel, a method identical to the safety philosophy of SNAP-10A. In the 1990s, the United States imported a model of the TOPAZ-II reactor, cooperating on further design with the newly formed Russian Federation. A flaw discovered early in its safety program was the potential for water-immersion-induced criticality. If a launch failure led to the reactor falling into the ocean or a water-filled launch pad flame trough, this could induce prompt criticality. This flaw had been addressed in the earlier SP-100 design (Camp et al., 2019a, 8).

2.1.2 Space Nuclear Reactors in the 21st Century Another major SNR development project took place with testing in 2017 and 2018. NASA intended the project, called Kilopower, to demonstrate the possibility of affordable fission nuclear power for future planetary (and lunar) missions (NASA, 2021). The reactor design itself included a core of highly enriched uranium, with reactivity determined by beryllium oxide reflectors and a boron carbide control rod. In the tested design, the reactor transferred its heat to a Stirling energy system using a sodium working fluid for power conversion (Gibson et al.,

2018, 3). The project came to an end after a final test in 2018 (NASA, 2021), though it was then succeeded by Fission Surface Power. Taking the progress made from the development of Kilopower and its reactor, NASA intends to design a 40-kW reactor that could be demonstrated on a lunar mission for long-term operations (NASA, 2022).

2-6

The U.S. space programs focus on RTGs has led to limited experience with the launch approval process for SNRs. The safety considerations for SNRs and RPSs are different, and though the Nation has experience in nuclear reactor safety, space missions involve accident environments that are seldom, if ever, considered for terrestrial reactors. These environments encompass scenarios such as propellant fire and impact (Lenard, 2008, 206). While the SNAP-10A mission exemplifies the sole reactor approved for launch in the United States, subsequent programs further developed the field of SNRs as discussed above, including design, with respect to nuclear safety. Publicly available documents from foreign countries describing experience in the field are also scarce. Although the Soviet Union had SNR experience, it only disclosed a few details of its safety systems through statements to the UN Committee on the Peaceful Uses of Outer Space (COPUOS). It refused to provide detailed information or safety analyses conducted for its reactor systems, and though there were hopes that political reforms would lead to openness (Bennett, 1992a, 273-274, 277), there are no readily available documents suggesting more information was ever revealed.

2.2 Nuclear Propulsion Although considered its own type of space nuclear system, nuclear propulsion relies on fission reactors and shares similarities with SNRs. These two types of systems differ in their use of the reactor for either electrical power or propulsion.5 There are two subtypes of nuclear propulsion:

nuclear thermal propulsion (NTP) and nuclear electric propulsion (NEP). NTP systems use propellant instead of typical coolants in an open-cycle reactor system as an alternative to combustion as a source of thermal energy for rocket engines. A significant advantage of NTP includes powerful thrust, which accelerates mission schedules (Voegeli, 2007, 164). However, it produces radiologically hot propellant that may pose safety risks (Tarves, 2004, 17).

Meanwhile, NEP systems use a reactor to ionize gas that is then accelerated through an electric field, creating thrust though much less than that of NTP (Voegeli, 2007, 164). Some assert that NEP provides greater safety as a closed-cycle reactor system (i.e., the coolant is contained) and greater flexibility in the use of its power in other spacecraft systems than NTP (Tarves, 2004, 19). Both designs are intended for use in space alone and would not be part of a missions early launch phase.

Significant U.S. development of nuclear propulsion took place during the Rover/NERVA program, which lasted two decades and to this day serves as a foundation for NTP (Bragg-Sitton et al., 2011, 9). The Rover program began as a U.S. Air Force project to develop propulsion for intercontinental ballistic missiles but was transferred to NASA and reoriented as an interplanetary travel system where it was renamed NERVA (Voegeli, 2007, 167). A major portion of the program included development of reactors specifically for an NTP system, in addition to the engine design itself (INL, 2015, 15). Figure 2-3 depicts an image of a mockup engine design.

Although never reaching the launch approval process, NERVAs design considerations included safety features. For instance, a proposed anti-criticality system would fragment the core by an explosive destruct system in case of launch failures, even if the core were hot. The explosive 5

This is not a strict division: reactors used as propulsion systems may still supply power to the rest of the spacecraft as well. SNRs typically have a primary purpose of providing electrical power, however, so while overlap exists, a reactor with a primary purpose of providing power specifically to the propulsion system is considered a form of nuclear propulsion.

2-7

destruct system approach was even considered for reuse in the later Jupiter Icy Moons Orbiter mission (using the Prometheus reactor) design (Lenard, 2008, 212). Increasing restrictions on radiological releases during tests impacted the NERVA development program. The Nuclear Furnace modular reactor used effluent filters capable of removing fission products from the hydrogen jet. After the end of the Apollo missions in 1972 and the retreat from plans for a Mars mission, the NERVA development program lost funding the same year (INL, 2015, 20-21). The NTP concept was unsuccessfully considered as an application for the SP-100 reactor in the 1980s. Besides the concerns of safety, the issue of addressing vibrational and thermal stress slowed progress, and the development of NTP systems was abandoned in the 1990s (Tarves, 2004, 17).

Figure 2-3 A mockup of the NERVA engine design Source: DOE Space Nuclear Power and Propulsion (SNPP) Activities, Bishop, 2021.

A more recent nuclear propulsion design was Project Prometheus, a proposed NEP system.

The system would have been used by the Jupiter Icy Moons Orbiter in its Jovian tour (Bragg-Sitton et al., 2011, 8). Many reentry scenarios were considered with varying levels of consequence. A high degree of unpredictability in outcomes led to the suggestion of using the NERVA cores explosive fragmentation design to prevent criticality and increase the safety of the system (Lenard, 2008, 212). The program eventually followed NERVAs fate as well and lost funding, never reaching the launch approval process. It now serves as a stepping stone for future NEP programs (Bragg-Sitton et al., 2011, 8).

2.3 Radioisotope Power Systems RPSs are currently a standard technology in the U.S. space program. Unlike SNRs, they have completed decades of safety reviews and been approved for launch dozens of times. Figure 2-4 depicts the installation of one of the first launched devices. The development of RTGs (the electrical power producing type of RPSs) for space missions began with the SNAP program, led by the AEC in cooperation with the U.S. Department of Defense (DOD). During his administration, former President Eisenhower encouraged the program as a peaceful use of nuclear energy, even placing a SNAP-3 RTG on his desk and demonstrating it to foreign 2-8

leaders. An academic nuclear critic complained that the President had been exposed to a lethal device, but an early safety evaluation showed proximity posed negligible risk and accompanied the RTG throughout its international tour (DOE, 1987a, 17-18). The devices would even be used terrestrially in the SNAP-7 series (DOE, 1987a, 29).

An RTG is, essentially, a nuclear battery: the decay of a radioisotope source, rather than fission, produces heat that generates electricity. An RHU is essentially the same device, lacking a thermoelectric converter. Plutonium (Pu)-238 eventually became the standard radioisotope for these devices, as it radiates high-kinetic energy alpha particles. These large particles are easily blocked by the skin; however, they are most hazardous when inhaled or ingested (DOE, 1987a, 37-38).

Figure 2-4 Installation of the SNAP generator on a Transit satellite Source: HD.6D.455, n.d., in DOE, AECReactor Development, 2013.

An engineering firm, while speaking of the Cassini mission, claimed that the form of Pu-238 used, plutonium oxide, was dense enough that any particles in the air would fall into the ocean before posing a threat to human life (Launius, 2015, 365). Similar beliefs inspired the design of early SNAP RTGs up to SNAP-9A to disintegrate upon reentry as part of a burnup of the RTG so that the particles would disperse across the atmosphere. The total amount of Pu-238 in the atmosphere following dispersal would be small compared to contributions from earlier weapons tests, but this philosophy still led to difficulties in gaining launch approval for the RTGs (DOE, 1987a, 38). Following the reentry of a SNAP-9A RTG in 1964, which dispersed as designed, the program chose to design containment vessels for intact reentry instead (Marshall, 1995, 3). This started the modern safety philosophy for RTGs that prioritizes the containment and recovery (if possible) of Pu-238 to prevent any exposure, especially through ingestion or inhalation (Bennett, 1981, 425).

RTGs are widely used within the U.S. space program, having been employed even in the crewed Apollo missions, where RTGs served instruments during cold and long lunar nights 2-9

when solar panels could not (Bragg-Sitton et al., 2011, 2). The U.S. Navy became an early adopter of RTG technology with the Transit satellites launched from 1961 to 1964. In comparison to other power sources, RTGs offered favorable survivability (INL, 2015, 5). NASAs use of RTGs began with its interest in a supplementary power system for its Nimbus weather satellite. The SNAP-19B RTGdesigned specifically for Nimbus and intact reentry following the reentry of Transits SNAP-9Awas the first NPS flown by NASA, launched in 1968. It was also the first RTG flown in the United States following the SNAP-9A reentry, which had inspired the new intact reentry design used in SNAP-19B. Although no SNAP-19B would experience unplanned reentry, the design successfully contained the radioisotope fuel after a failed launch sent two RTGs to the ocean floor (INL, 2015, 8).

The next step in RTG development came with the multihundred watt (MHW) RTG. The Air Force was the first user of this design with the Lincoln Experimental Satellites 8 and 9 (LES 8/9) in 1976. New silicon-germanium thermocouples offered improved efficiency for the MHW-RTGs, which were also used on the Voyager probes (INL, 2015, 13). Near the same time, the DOE worked on the development of new selenide isotope generators that would use an MHW heat source, though tests made flaws of the new devices apparent, and plans for the Galileo mission reverted to the use of an MHW-RTG. The General Purpose Heat Source (GPHS), developed for the International Solar Polar Mission, also proved more successful when used with the past thermocouples rather than the selenide thermoelectric materials. The GPHS-RTG design met the increasing power demands of the Galileo mission and would replace the missions MHW-RTG. These GPHS-RTGs had record efficiency and were used on the Galileo, Ulysses, Cassini, and New Horizons missions (INL, 2015, 23-24).

Much of the GPHSs design was chosen in an effort to increase safety and reduce risk. An iridium alloy metal allows deformation of the plutonium fuel pellets without release. A frit vent releases helium gas fission products produced by the decay of the plutonium to prevent pressure buildup. The module also included impact shells to protect against debris, as well as a carbon-fiber sleeve for high-temperature events. Many practical tests were conducted to gather data on the GPHSs response to various physical situations. Explosions, impacts, propellant fire, and long-term exposure to aquatic and terrestrial environments were all simulated. Even at an impact speed of 52 meters per second (116 miles per hour) against concrete, no fuel was released (INL, 2015, 26, 29).

Modern multi-mission RTGs (MMRTGs) are typically composed of GPHSs, now used by NASA during the last two missions. Figure 2-5 shows a detailed cross-section of the devices. These capsules provide typically around 250 watts (thermal) at mission start (NASA, 2023b). While they do not produce electrical power on their own, they may be stacked within a full RTG system using thermoelectric elements to convert their heat to electricity. Another common RPS is the Light-Weight Radioisotope Heater Unit (LWRHU), which designers have used to regulate the temperature of instruments. The LWRHU is fueled by plutonium oxide encased in pellets to keep them intact, even upon reentry and impact (INL, 2015, 38-39).

2-10

Figure 2-5 A labeled diagram of an MMRTG and a GPHS Source: Multi-Mission Radioisotope Thermoelectric Generator (MMRTG), Bechtel, 2011.

Multiple safety analyses and reviews have been conducted for missions carrying RTGs, which are documented in safety analysis reports (SARs). Since 1970, publicly available environmental impact statements (EISs) or environmental assessments precede SARs and often summarize early analyses of the missions nuclear safety. Contractors that have conducted safety analyses in the past (specifically the GPHS-RTG series) include the Johns Hopkins University Applied Physics Laboratory, the Los Alamos National Laboratory, the Naval Ocean Systems Center, the NUS Corporation, and the Sandia National Laboratories (INL, 2015, 25). The final SARs (FSARs) are generally not available to the public. As required by presidential direction (discussed in section 4.1.2), the INSRP conducted independent reviews of all launches with space nuclear systems and reported its findings in safety evaluation reports (SERs). These SERs are also generally not publicly available; however, presentation papers and journal articles that summarize the process and results for some missions are publicly available.

2.4 Space Nuclear Incidents Given the complex nature of space missions, many factors can lead and have led to mission failure, occasionally impacting missions using NPSs. The United States has experienced four incidents involving NPSs, while the former Soviet Union has experienced eight such incidents.

Of those, one U.S. incident led to the reentry and dispersal of the RTG while five of the former Soviet Unions incidents led to reentry and dispersal, two reactors and three RPSs. None have posed a significant threat to the general population, the exposure from those few with radiological releases having been spread so broadly as to be nearly insignificant6 for a given individual (DOE, 1987a, 38-39; Bennett, 1992a, 274-276), assuming that the Cosmos 300 and 6

In the case of Cosmos 954, the surviving radiological inventory scattered across a less inhabited part of Canada, which was the reason its reentry caused little harm (Bennett, 1992a, 274).

2-11

305 RTG dispersals did not impart doses significantly higher than that of SNAP-9A. Still, these incidents serve as a future guide and show how safeguards have performed in the past.

Table 2-3 summarizes four U.S. space mission incidents involving nuclear systems. The first of these was the Navys Transit 5-BN-3 navigational satellite, carrying a SNAP-9A RTG as its power source. The vehicle failed to achieve orbit and reentered above the Mozambique Channel. At that time, the dispersal design philosophy for RTGs was in effect. SNAP-9A performed as designed, burning up into minuscule particles in the upper atmosphere. According to the AEC, the incident constituted no health hazard to the public (DOE, 1987a, 38-39). The next incident occurred on the SNAPSHOT mission equipped with SNAP-10A. After 3 months of operation, which only began after insertion into a long-term orbit, a voltage regulator malfunction outside of the reactor led to premature shutdown as intended by automated safety systems (Bennett, 1990, 2). The projected reentry of the spacecraft in about 3,800 years is now its only hazard, at which point the core will have decayed and be mostly inert (Lee and Buden, 1994, 2).

Table 2-3 U.S. Space Mission Incidents Involving Nuclear Systems Mission name NPS(s) Incident date Incident description Transit 5-BN-3 SNAP-9A Apr. 1964 Orbital failure, RTG disintegration into atmosphere SNAPSHOT SNAP-10A Apr. 1965 Voltage regulator malfunction, precautionary reactor shutdown after 43 days of operation Nimbus B-1 SNAP-19B May 1968 Launch failure, both RTGs recovered and (two units) fuel reused Apollo 13 SNAP-27 Apr. 1970 Spacecraft damage, RTG reentered and submerged into South Pacific intact Source: Safety Status of Space Radioisotope and Reactor Power Sources, Bennett, 1990.

Following the Transit 5-BN-3 incident, the safety philosophy for RTGs shifted from dispersal to containment upon reentry. The Nimbus B-1 mission made an unplanned test of the SNAP-19B RTGs containment design when it fell off course early in launch, and its operators aborted launch for range safety to fall into the ocean. Although the incident did not help designers determine the success of the intact reentry design, surveyors eventually found the craft with the RTG fuel fully contained and not damaged (DOE, 1987a, 62-64). A later (successful) mission reused the Pu-238 fuel. Figure 2-6 depicts a diagram of the RTG. The last of these incidents occurred with the Apollo 13 mission. Damage to the spacecraft required a mission abort, leading to the reentry of both the command and lunar module, the latter containing a SNAP-27 RTG.

Most of the lunar module disintegrated upon reentry and the RTG landed in the South Pacific Ocean in the vicinity of the Tonga Trench. Radiological surveys found no traces of the RTG, indicating that the plutonium fuel was successfully contained (DOE, 1987a, 69-70).

2-12

Figure 2-6 The SNAP-19 RTG, which NASA used in several missions, with modifications, including Nimbus, Pioneer, and Viking Source: Atomic Power in Space: A History, DE87-010618, DOE, 1987.

During its space program, the Soviet Union experienced a greater number of space nuclear incidents than the United States, including the reentry of reactors. Table 2-4 lists these incidents, although some are speculative in their exact nature due to a lack of public information. The most notable incidents begin with Cosmos 954, a RORSAT with an SNR as its power source that reentered the Earths atmosphere following a spacecraft malfunction.

Approximately 4 kilograms (kg) (8.8 pounds) of its fuel and fission products were dispersed above Canadas Great Slave Lake, yet radiation levels were discovered to be lower than background levels except in proximity to the remaining debris, thus posing minimal threat to the Canadian population (Bennett, 1992a, 274). It is possible injuries and even fatalities may have occurred had reentry taken place over a major population center (Central Intelligence Agency (CIA), 1991, 4).

President Carter proposed a coordinated ban on Earth-orbiting nuclear reactors unless fail-safe mechanisms could prevent radiological release into the atmosphere, though such calls were rejected by the Soviet Union (INL, 2015, 58). After Cosmos 954, the Soviet Union prioritized measures to ensure the full disintegration of the reactor core and the dispersal of its fuel.

Cosmos 1402 demonstrated these new measures after failing to achieve orbit. When the spacecraft detected atmospheric heating, it ejected the core and gave it a boost. The core later reentered separately and fully disintegrated with an estimated health impact of much less than one cancer fatality (Bennett, 1992a, 276). Safeguards for the Cosmos satellites included a system to detach the core and place it into a storage orbit upon several failure conditions. This was seen in Cosmos 1900, where either because of excessive reactor temperature or some other spacecraft failure (the Soviet Union never commented on what exactly had occurred), the reactor was automatically separated and boosted into a higher orbit (Bennett, 1992a, 276-277).

2-13

Table 2-4 Soviet Space Mission Incidents Involving Nuclear Systems Mission name NPS type Incident date Incident description Unknown Reactor Jan. 1969 RORSAT launch failure a Cosmos 300 RPS Sep. 1969 Escape trajectory failure, polonium-210 source disintegration in atmosphere a Cosmos 305 RPS Oct. 1969 Escape trajectory failure, polonium-210 source disintegration in atmosphere a Unknown Reactor Apr. 1973 RORSAT launch failure a Cosmos 954 Reactor Jan. 1978 Malfunction leading to uncontrolled reentry Cosmos 1402 Reactor Jan.-Feb. 1983 Orbital failure (spacecraft and core separated at reentry)

Cosmos 1900 Reactor Sep. 1988 Unknown failure, automatic separation and orbital boost Mars 96 RTG Nov. 1996 Escape trajectory failure, Pu-238 RTG intact after reentry and impact Sources: Soviet Space Nuclear Reactor Incidents: Perception Versus Reality, Bennett, 1992; Nuclear Power Assessment Study: Final Report, TSSD-23122, JHU/APL, 2015.

a Marked causes are speculative due to lack of information.

Following Cosmos 1900, it seemed that the Soviet Union amended its space nuclear policy, as no more reactors were launched into space before 1991 (CIA, 1991, 6), the year of the Soviet Unions dissolution. Since assuming control of the former Soviet Unions space program, the Russian Federation has not launched any SNRs of its own.

2.5 Future Missions The field of space nuclear systems is one of active development. This section does not provide an exhaustive list of all current projects targeting the field, but instead refers to examples that have publicly discussed the efforts taken for the safety of each proposed system.

Since the 1970s, there have been projects to develop a dynamic RTG using either Rankine or Brayton cycles for power conversion. These have culminated in the Advanced Stirling Radioisotope Generator (using a Stirling cycle) that is still in development. Dynamic power conversion may offer higher efficiency for these systems, though technical issues have persisted. Recent designs have simply reused the GPHS as a heat source (INL, 2015, 45-53).

There are no specific plans for a mission using a dynamic RTG.

The recent Kilopower project aimed to develop an SNR for use beyond low Earth orbit. The NTP Program aims to develop an engine planned for low Earth orbit departure, possibly with a return to low Earth orbit, as well, if made reusable (Camp et al., 2019a, 8). These projects have been joint ventures between NASA and the DOE. An experiment using a terrestrial prototype of the Kilopower Reactor Using Stirling Technology (KRUSTY), a neutron-moderated 10 kW fission reactor, was successfully demonstrated in 2018 (NASA, 2021), after which the project ended.

The current Fission Space Power project extends the Kilopower projects work and aims to develop systems for use on the Moon and Mars, with lunar operation projected by the late 2-14

2020s (NASA, 2022). Current efforts by the Space Technology Mission Directorate of NASA focus on NTP, but options for NEP are being explored (Calomino, 2021, 9-11).

The Demonstration Rocket for Agile Cislunar Operations (DRACO) is a DOD-led NTP project.

Over the course of the development, NASA and the Defense Advanced Research Projects Agency (DARPA) will collaborate on assembly of the engine before the planned in-space demonstration of the late 2020s (NASA, 2023a). This project is dedicated to the new safety guidelines and approval process outlined by NSPM-20 (Greiner, 2021, 4).

Another planned RTG-equipped mission is NASAs Titan Dragonfly probe. The mission plans to use an MMRTG similar to the Mars Science Laboratory (MSL) and Mars 2020 missions. This would mean that the consequence analysis for the Mars 2020 mission could be adapted, and the safety evaluations from those previous projects would be relevant in reviewing safety for the mission (McHugh and Wheeler, 2021, 1).

2-15

3 SAFETY ANALYSIS FOR SPACE NUCLEAR SYSTEMS The NRC frequently uses the probabilistic risk assessment (PRA) framework as a method for analyzing the risk of nuclear systems. In a passage explaining the approach to space nuclear safety analysis used by the European Space Agency (ESA), PRA is described as the systemic identification and evaluation of the risk posed by the complete spectrum of possible accident scenarios (Pressyl, Panicucci, and Peltonen, 1992, 280).

Three questions are used to define risk: (1) What can go wrong? (2) How likely is it? (3) What are the consequences?7 PRA, if answering all questions, can estimate total risk. The focus of this section, however, is on the third: offsite consequences. Although the NRC helped advanced PRA methods for use in nuclear power regulatory applications, it is important to note that applying these analyses to space nuclear systems involves a significantly distinct environment.

One challenging aspect of space nuclear safety is that, unlike the stationary terrestrial nuclear reactors that the NRC typically regulates, NPSs are highly mobile and often have unpredictable potential affected sites when in flight. Unique failure modes crucial to the source term (the amount of released radiological material) compound this challenge. Before launch, the area around the launch pad is the site at greatest risk. Afterwards, there are new possible accident scenarios, such as impact upon loss of trajectory or a fireball from a propellant accident. During ascent, an accident could occur at any site along the vehicles flight path and has no precise site for analysis. Once in space, the reactor may reenter prematurely and would either disintegrate completely or impact, a failure mode no terrestrial reactor would experience. Even a successful launch may include reentry for Earth-bound NPSs because of inevitable orbital decay (Hagis and Dix, 1960, 25), though that point in time may be thousands of years in the future.

Three terms used throughout this and subsequent sections are safety analysis, safety evaluation, and safety review. It is important to note the precise definitions of the terms, at least as they are used in this report:

• Safety analysisThe safety analysis is typically conducted by the designers of the NPS.

The aim of this analysis is to determine the consequences of the devices use, which include both the hazards and associated probabilities. This includes the launch system and the planned trajectory by necessity, as those dictate many details of the accident environments. Risk assessment, as described previously, is a common approach to these analyses. In recent missions, NASA contracted the DOE to perform the safety analyses of missions, which it describes in the SAR.

• Safety evaluationAlthough the name may suggest a process similar to the safety analysis, this refers to the evaluation of the analysis, and not an evaluation of the device itself (though, at times, safety evaluations have involved analysis to confirm the findings of the safety analysis). Historically, these have been conducted by an interagency group.

7 This is the typical definition of risk for risk assessment purposes. The NRC, as a regulator charged with the safe licensing of nuclear reactors and materials, uses this definition in its risk-informed approach. More details of the NRCs definition of risk are available at https://www.nrc.gov/about-nrc/regulatory/risk-informed.html.

3-1

The evaluations determinationsalternative values, areas lacking in sufficient detail, or any other issues, if applicableare described in the SER.

• Safety reviewThis refers to the entire process, which includes both the safety analysis and the safety evaluation. The safety review, as referred to in this report, begins with the planning of the launch and the beginning of the safety analysis and ends when the SER has been read by the sponsoring agency and launch authority in preparation for deciding whether to proceed with the launch. Since the interagency safety review process typically includes involvement on the evaluators behalf, beginning with the initial drafts of the SAR itself, this phrase is used to indicate activities performed by the interagency groups.

This section provides an overview of space nuclear safety analysis, highlighting key distinctions from terrestrial reactors. It also includes a comprehensive list of historical fuel sources used in NPSs, along with the potential biological hazards of each. It summarizes safety analyses and evaluations wherever possible as examples, including the very first NPS design, SNAP-1A; the very first and only nuclear reactor launched into orbit, SNAP-10A; and modern missions starting with the Galileo and Ulysses missions and ending with the Mars 2020 mission. Lastly, this section lists various methods for the risk assessment of NPSs. While this section is not meant to be comprehensive, the examples should give the reader an appreciation for the evolutions of the use, analysis, and consequences of space NPSs.

3.1 An Overview of Space Nuclear Safety Analysis During the first U.S. space nuclear system launches, designers categorized safety analyses into three areas: (1) launch failure, (2) ascent failure, and (3) final stage failure. Each was then subdivided into specific accident scenarios, such as failure of a propellant tank, propulsion, or guidance (Dix, 1959, 57-65). While accident analyses have evolved since then, the basic division of categories still exists, with modern analyses typically composed of six phases, with their numbers starting at phase 0:

(0) prelaunch (1) early launch (2) late launch (3) suborbital (4) orbital (5) long term (Bixler et al., 2013, 19)

For the Cassini mission, a seventh phase was added to account for an Earth flyby, the Earth gravity assist, used to boost the speed of the probe to its final destination (Frank, 2000, 251-252).

Assessing the risk of NPSs involves answering three main questions:

(1) What are the events that lead to some consequence?

(2) How likely are each of these events?

(3) What are the potential consequences of each of these events?

3-2

Those analyzing nuclear safety often use risk assessment, which the PRA framework divides into three levels. The first covers the damage to the core of the system, and for reactors, designers compute a core damage frequency. The second level calculates the source term and associated release frequencies. The final third level analyzes the offsite consequences, leveraging the results of the first two levels of analysis, and reports the risk of the system that is defined as the offsite consequences (e.g., public health effects) of each event times its frequency (Bixler et al., 2013, 20). The space launch safety guidelines are described in terms of the third level of analysis.

3.2 The Risk of Space Nuclear Fuel Sources (Early 1960s)

While older RPS and associated safety analyses offer valuable insights, the evolving nature of spacecraft, launch vehicles, and NPSs renders them less applicable to modern missions. The state of knowledge and techniques used in these safety analyses have advanced over time.

Nevertheless, these early safety analyses were comprehensive, and some aspects were based on test data. As such, for analyses and reports before the 1980s (i.e., before the Galileo and Ulysses missions), the summaries below focus on fuel source types and their past-calculated consequences for more broadly applicable results than system-specific findings. Past determinations of the fuel sources radiological impacts are typically similar, barring possible changes in knowledge, though launch sites, launch vehicles, and other factors may change.

Consequently, even today, these past reviews give a view of the benefits and risks of each fuel source and show how Pu-238 has become standard among modern RTGs. Table 3-1 shows a few key characteristics of six radioisotopes considered for use in RPSs.

Table 3-1 Comparison of Radioisotopes Considered for Use in RPSs Radioisotope Power density Radiation Half-life Shielding (watts per (years) requirements gram)

Cerium-144 25.6 Beta, Gamma 0.78 High Curium-242 120.0 Alpha 0.45 Low Curium-244 2.8 Alpha 18.0 Medium Plutonium-238 0.56 Alpha a 89.0 Low Polonium-210 141.0 Alpha a 0.38 Low Strontium-90 0.90 Beta 28.0 High Source: Aerospace Nuclear Safety, Blake, 1965.

a The isotope may sporadically emit gamma- or x-ray radiation, or both, as well, but in low intensities.

3-3

3.2.1 Cerium-144 Cerium (Ce)-1448 is among the oldest fuel sources used for RPSs, dating back to the beginning of the SNAP program with the SNAP-1A9 (also known as Task 2) generator, shown in Figure 3-1. The initial fuel load of the generator was 0.88 megacuries (3.256 terabecquerels) of Ce-144 in insoluble fuel form (3.32 kilograms of cerium dioxide), which has a half-life of 285 days (Klein, 1960, ix). Early reports for SNAP-1A include a preliminary assessment of the hazards of operation (Dix, 1959), an interim report on safety procedures (Klein, 1960), and an FSAR (Dix, 1960). The radiation from Ce-144 includes beta and gamma rays. The SNAP-1A RPS interim report attributes the isotopes biological hazard to ingestion and inhalation if released to the biosphere and external exposure from prelaunch operations and accident recovery (Klein, 1960, 9).

Figure 3-1 The SNAP-1A device Source: HD.6D.472, n.d., in DOE, AECReactor Development, 2013.

8 Ce-144 is a fission product that is separated from reactor wastes. The decay of Ce-144 (half-life of 285 days) to its daughter, praseodymium-144, results in the emission of beta particles and gamma rays, but most of the thermal power is derived from the energetic beta decay of praseodymium-144 to neodymium-144. Thus, in addition to the decay gamma radiation emitted by radiocerium, a large portion of the photon radiation emitted is in the form of x-radiation originating from the slowing down of energetic beta decay particles (Bremsstrahlung)

(Klein, 1960, 5).

9 The SNAP-1A generator used a Rankine cycle of liquid mercury driving a turbogenerator, which is referred to as a dynamic RPS rather than an RTG, which are static RPSs. All subsequent SNAP RPS designs had no moving parts and instead used thermoelectric converters (DOE, 1987a, 12).

3-4

The preliminary assessment was an analysis of radiological hazard and did not report the integrated risk of each scenario (Dix, 1959). It divides failure modes into the launch, ascent, and final stages, which were in turn divided into specific subtypes. For an example, launch failures included propellant mixing causing an explosion, propulsion failure (referring to the destruction of the engine), and guidance failure in which the spacecraft loses the launch trajectory. These failure modes are familiar even in later analyses, as they are persistent accident scenarios.

Next, the report identifies the resulting forces in each scenario and calculates their effects. A somewhat pessimistic analysis is presented that considers only aborted missions with the full fuel inventory. Most resulted in a negligible release of fuel if any at all, although all final stage failures would lead to fallout after the disintegration of the containment vessel and fuel from ablation upon reentry. The preliminary report divides this fallout into direct falloutlocated in the Southern Hemisphere following reentry at a well-known pointand random fallout following orbital decay and reentry. The assessment concluded that calculated dosages in both scenarios were much smaller than those from previous nuclear weapons testing, and their low probabilities made their risk even less significant.

The FSAR for SNAP-1A is the update of the preliminary report. In addition to launch failures, the report analyzed the risk from planned reentry, in which the radioactive inventory would decay to a negligible radiological impact by the time of reentry (Dix, 1960, 79). Although the report stated that the mean residence time of fallout at the altitude of release would be 5 years or more, the analysis conservatively assumed a mean residence time of 8 months following 600 days of decay time.

During the same year that the SNAP-1A analysis was completed, a preliminary safety analysis of a low power Ce-144-based generator was issued that compares the SNAP-1A and SNAP-3 (polonium (Po)-210) RTGs (Martin Nuclear Division (MND), 1960). This configuration employs two generators, each containing 9.9 kilocuries. Similar to the SNAP-1A safety analysis, this report considered the integrity of the fuel capsule under the spectrum of launch failure forces.

These forces include internal pressure, external forces from shock overpressures and impact, corrosion, and propellant fires. Following successful missions, the fuel was planned to be released in the stratosphere at a time when the source strength is about 4 kilocuries.

Despite these safety analyses of Ce-144-based systems, the U.S. space program never used cerium as a fuel source on a space mission. The utility of SNAP-1 and its fuel had been made obsolete by longer term operational requirements as well as the advent of more efficient thermoelectric materials (INL, 2015, 4).

3.2.2 Curium-242 Another considered radioisotope was curium (Cm)-242 for use in the SNAP-11 RTG design that was intended for the Surveyor Moon missions (DOE, 1987a, 34). It is a source that decays by alpha emission into Pu-238 that is primarily a hazard if inhaled or ingested. A report (Riggs, 1960) on its potential use as an NPS on future missions that analyzes its safety follows the methods of previous reports (e.g., SNAP-1A, SNAP-3) issued in 1960. While it discusses the endpoint of the fuel for each scenario (i.e., whether it disperses), it lacks detail on the resulting effects on the public. The SAR for SNAP-11 was issued but is not readily available. The SNAP-11 RTG never flew on a mission (JHU/APL, 2015, 98), the short half-life of Cm-242 and rapid development of solar cell technology making the design obsolete even before its use.

3-5

3.2.3 Plutonium-238 Pu-238 has proven to be the most successful RTG fuel, and RPSs typically use it to this day.

The radioisotope emits primarily10 alpha particles. As such, its primary biological hazard is exposure through ingestion and inhalation, which is most easily achieved if the material is dispersed in the biosphere. The risks that ingestion and inhalation posed inspired the containment safety philosophy behind the modern U.S. RTG design (Bennett, 1981, 425). The first space nuclear system design to use Pu-238 was the MOD-1 (also known as Task 5.6) thermoelectric generator. Its safety report found that a high-altitude abort could lead to fallout after the systems disintegration with an insignificant dose to the global population, and its random fallout would decrease over time as the radiological material decreased in amount from decay (Knighton, 1960, 35-38).

The Pu-238-fueled SNAP-3B was the first RTG to fly into space. It provided power to a Transit satellite as a supplement to its solar panels (INL, 2015, 6). Initially, the AEC had not allowed the use of Pu-238, but after designers argued for its advantages over alternative fuels, the commission relented (Schmidt et al., 2009, 5). A report determined the greatest risk came from an early release before the Pu-238 had time to decay, a possible result of dispersal during reentry or sea water corrosion (Willis, 1963, 4). A subsequent safety analysis detailed the possible risk of the system, considering instantaneous release at launch, long-term release at launch, long-term release in coastal water, and high-altitude dispersal of the initial fuel inventory. Small fuel pellets from the system would be hazardous if breached up to a mile downwind, and fuel release was possible under certain impact conditions. Such an event was deemed unlikely, however, and largely prevented by the design of the RTG (Buckalew, Byrne, and Halsey, 1964).

The SNAP-9A RTG was the next SNAP design, once again using Pu-238 as its heat source.

Unlike SNAP-3B, it was the sole power source for three Transit missions (INL, 2015, 6). The generator was not designed for intact reentry, and when the third Transit satellite carrying the device failed to achieve orbit, it ablated into the atmosphere as designed (Hardy et al., 1972, 2).

At the time, determination of the fallout inventory was unsuccessful. Eight years after the incident, in 1972, a report (Hardy et al., 1972) detailed successful measurements of the global deposition. It determined about 13.4 kilocuries (between 11.2 and 15.6 kilocuries, within uncertainty) was deposited globally, though the RTG had an inventory of 17 kilocuries (1 kg (2.2 pounds) of Pu-238) at the time of reentry into the Southern Hemisphere (Hardy et al., 1972, 17). To date, this is the only known instance of fuel release by a U.S. RTG.

3.2.4 Polonium-210 Po-210 is yet another alpha emitter with sporadic gamma-ray emissions, mainly hazardous after ingestion or inhalation. It was the fuel used by early iterations of SNAP-3, the first SNAP RTG (as SNAP-1 had been a dynamic RPS using a Rankine-cycle turbogenerator) and the same design displayed on President Eisenhowers desk. The first report (Dix et al., 1959) on its safety considers the mechanical, thermal, and chemical integrity of the containment vessel. One possible threat to its integrity was internal: helium produced by the decay would increase 10 In addition to alpha particles, Pu-238 emits various gamma- and x-ray particles at much lower intensities than the alpha particle emissions.

3-6

internal pressure on the vessel. Given the design, however, the report concluded it would not cause a breach.

A later report added that the sources emissions would be attenuated by the RTGs shell and turned into heat, posing little hazard to those around it, and, similar to other devices of the time, it was designed to disintegrate upon reentry (Hagis and Dix, 1960, 43-46). A feasibility study for a lunar mission noted that even in the case of the ablation (burnup) of the 696,000-curie source during reentry, the radioactivity in topsoil following any such accident would be less than that from previous weapons testing (MND, 1964, 15-18). Similar to cerium and curium, however, polonium was never used on a flown U.S. NPS. The SNAP-3 design would even be modified to use Pu-238 rather than polonium once the designers received AEC approval (Schmidt et al.,

2009, 5).

3.2.5 Uranium-235 The United States has rarely used uranium for NPSs, as it is a fission-based rather than a decay-based heat source. The sole mission to include uranium on board was SNAPSHOT with the SNAP-10A reactor. Although the context of the missionthe launch vehicle, the power system design, and the planned trajectoryis crucial to all safety analyses, it is difficult to make a general analysis of the hazards of U-235, as it does not present radiological hazards itself.

Instead, its fission is the source of all hazards: a sudden, uncontrolled, and self-sustaining fission of the U-235 fuel, prompt criticality, presents a potentially hazardous release of energy and radiation. Even controlled fission will leave behind fission products in the reactor core that may present radiological hazards.

The SNAP-10A reactor comprised a zirconium hydride and U-235 core, beryllium reflectors, a sodium-potassium liquid coolant, and thermoelectric converters for power conversion. The reactivity was entirely controlled by the beryllium reflectors, which were able to rotate. In thermal energy, the reactors power level was 34 kW (Alexander et al., 1965, 20-21). Launched in 1965, it became the first nuclear reactor to be successfully operated in space (INL, 2015, 8).

A paper (Willis, 1963) showed that, under certain circumstancesno prompt criticality, the core successfully shut down before 8 years of operation at full power and was fully ablated upon reentrythe SNAP-10A biological hazard was less than that of the SNAP-9A RTG for the same orbital life of 900 years. The SNAP-10A reactor remains in orbit to date, and while no SNAP-9A RTG has yet experienced reentry following a successful orbit, one such RTG was ablated shortly after launch after the satellite failed to achieve orbit.

The Final SNAPSHOT Safeguards Report (Alexander et al., 1965), the SAR for the SNAP-10A reactors mission, described the probabilities of specific conditions of failure and accidents. It used predictions of the reactors radiological inventory, a function of the power history of the reactor as well as the time passed since shutdown, and each accident environment to determine the hazards and possible doses.

The report included a figure, reproduced here as Figure 3-2, to show the fission production, which suggested the maximum inventory would occur 1 year into full-power operation at nearly 200 kilocuries. With a shutdown at 3 years, this amount sharply decreased to below 0.1 kilocuries within a couple of years. If shutdown was not achieved, power would decay until, 3-7

at 76 years, the reactors operation would be naturally halted as its components wore down.

Until that point, the inventory would remain between 10 and 100 kilocuries, but afterwards, it would quickly decrease below 10 kilocuries (Alexander et al., 1965, 124). Note that, as described previously, the ablated SNAP-9A RTG resulted in the deposition of around 13.4 kilocuries globally (Hardy et al., 1972). An addendum to the Final SNAPSHOT Safeguards Report found that water immersion could induce prompt criticality by flooding and evacuating the reactor coolant (Hart et al., 1965, 9-12).

Figure 3-2 A plot of the radiological inventory of SNAP-10A following startup of the reactor Source: Final Snapshot Safeguards Report, NAA-S10022, LMSC B-107701, Alexander et al., 1965, 124.

The Flight Tests Final Safeguards Report for the SNAP-10A reactor included a calculation of the total injury probability over different orbital lifetime possibilities. The report included 3-8

accidents such as fuel entering a municipal water source and a probability for each failure scenario (Stewart, 1964, 23-39).

Later studies considered other uses of the reactor that never materialized. In the consideration of meteorological satellite use of the reactor, areas of highest risk were described. It was found that, with the flight procedures, there were no major hazards between the launch of the system and the point at which it achieved orbit except for criticality, which itself was made unlikely by several safeguard systems (Atomics International, 1964, 111-117).

3.3 Safety Analyses Since the 1980s This section summarizes several safety analyses and evaluations as applicable for missions since the late 1980s, though the list is not exhaustive.

As several types of documents are available for the systems and missions discussed in this section, it is important to note the three most common, and crucial, documents. As previously noted, the SAR describes the safety analysis of the system or mission and the risks it presents.

The SER then often summarizes the contents of the SAR and evaluates the quality of the analysis contained in the SAR. These two reports are often unavailable to the public. The third type of document that is always public is the environmental review, typically either the EIS or environmental assessment, mandated by Federal law, which describes the possible environmental impact of the mission and proposed alternatives, including nuclear consequences when applicable. These may include a less detailed safety analysis or may even summarize the SAR, though they are released before the SAR itself is finalized.

3.3.1 The Light-Weight Radioisotope Heater Unit The LWRHU comprises a small cylinder of Pu-238 used to heat spacecraft elements to maintain them at operating temperatures. Missions that have used the current LWRHU design are Galileo with 120 units (1989), Mars Rover Sojourner Pathfinder with three units (1996), Cassini with 117 units (1997), Mars Rover Spirit (2003) with eight units, and Mars Rover Opportunity (2003) with eight units (Zillmer and Gates, 2022). Notably, these systems received a system-specific SAR that suggested most missions would not need to conduct a separate analysis for the integrated risk of the LWRHUs.

One LWRHU used on the Galileo spacecraft is about 1 watt and 26 millimeters (roughly 1 inch) in diameter by 32 millimeters (roughly 1.3 inches) long; each LWRHU weighs about 40 grams (roughly 1.4 ounces) (Zillmer and Gates, 2022). The Galileo mission referred to the generalized LWRHU SAR rather than analyzing the LWRHU with respect to the launch system and spacecraft. The initial volume of the report, which outlines the design and key aspects of its possible accidents, specifically highlights that the fuel release would only occur in the event of an accident during an Earth gravity assist. This conclusion was reached through testing and was accompanied by an assessment of the probabilities associated with various accident scenarios (Johnson, 1988a, 16).

The second volume delves further into these accidents, providing a flowchart of possible mission outcomes with associated conditional probabilities, a portion of which is depicted in Figure 3-3. Each accident that culminates in a fuel release is marked within the flowchart.

Furthermore, the report includes appendices that explain the calculation of these probabilities in 3-9

detail (Johnson, 1988b). Lastly, in the third volume, the calculation of radiological consequence for the gravity-assist phase is performed, focusing solely on this phase as with the potential for fuel release. The volume concludes with a summary that identifies the expected consequence to be a population dose in person-rem of 7.8 de minimis, excluding doses deemed insignificant (Johnson, 1988c, 2-3).

Figure 3-3 An example subbranch of possibilities from the 1988 LWRHU report Source: Light-Weight Radioisotope Heater Unit Final Safety Analysis Report (LWRHU-FSAR), Johnson, 1988b, 37.

While the low risk of this system led designers to make a general SAR, there is no single SER for these systems, as the safety review process is conducted only for missions, not general systems. Galileo and Ulysses are two examples of missions using LWRHUs that underwent the safety review process due to their use of nuclear systems, resulting in mission-specific SERs.

The Mars Pathfinder mission used only the LWRHU and was reviewed by the INSRP with a new mission-specific SER issued before launch.

3.3.2 The Galileo (1989) Mission The Galileo mission to Jupiter would be the sole U.S. space nuclear system launch during the 1980s. Originally planned for a 1986 launch, the destruction of the Space Shuttle Challenger delayed its flight to 1989. This change also included the cancellation of the original upper stage system, the Centaur upper stage launch vehicle (INL, 2015, 32). The Galileo mission provides an example of an SAR and an INSRP SER, as both are public, though as both were written several decades ago, the content may not be fully reflective of more recent reports, such as those for the MSL and Mars 2020 missions. Although a public EIS was also published for this 3-10

mission, the EIS is not described here since the SAR and SER themselves are public. Galileo was the first NPS-equipped spacecraft to make an Earth flyby following its initial escape trajectory,11 which added a phase in which accidents could potentially occur.

The first volume of the Galileo SER begins with a summary of the mission, the purpose and scope of the review, and the safety review process. It then details the mission profile as well as the transportation, launch, spacecraft, and radioisotope systems. Before discussion of the analysis, it also describes the launch site and surrounding areas as well as safety procedures and equipment. Similar to an SAR, it also presents design details and provides a summary of possible accidents and their probabilities. It specifically identifies scenarios that would lead to fuel release and makes note of certain concerns regarding the analysis of the FSAR. Rather than defining phases by the location of the craft, as with the Cassini mission, the phases indicated events in the spacecrafts operation: (0) prelaunch, (1) launch and ascent, (2) solid rocket booster separation and main engine cutoff, (3) on-orbit, (4) deployment to escape, and (5) Earth flyby (INSRP, 1989a, E-2).

Following that, the second volume elucidates the review methodology and describes additional analysis conducted by the INSRP subpanels. It also includes a description of the reference documents for the review (INSRP, 1989b). The Biomedical and Environmental Effects Subpanels supplemental report, separate from the panels SER, is also available, providing a detailed analysis where the FSAR was deemed insufficient, such as the modeling of seafood ingestion (INSRP, 1989c).

3.3.3 The Ulysses (1990) Mission The Ulysses mission, completed in cooperation with the ESA and launched in 1990 (originally planned for 1986 similar to the Galileo mission (INL, 2015, 32)), selected the Suns polar regions as its destination. Two key aspects of its launch and subsequent path to the Sun included the use of the Space Shuttle system as a launch vehicle and a Jupiter flyby for a gravity assist. The latter choice did not impact the safety review, as once the probe escaped the Earths gravity, there would not be a credible risk of reentry for the probe. The choice of the Space Shuttle as a launch system, however, was key to the probes safety analysis, with particular attention to the possibility of a Challenger-type accident (Sholtis et al., 1991, 133, 135), which had occurred only 4 years before the missions launch.

Although the Ulysses SAR and SER are not publicly available, a report (Sholtis et al., 1991) summarizes the results of the INSRP review for the mission. The panel identified 19 possible accidents involving fuel release but narrowed them down to 11 accidents that had any significant effect, based on the release fraction or probability. The SERs results suggested that the expected consequence was insignificant, with any degree of fuel release unlikely. As noted by a technical overview of the report, even in an accident resembling Challenger, no fuel release was expected to occur (Sholtis et al., 1991, 133-135).

11 The use of an Earth gravity assist for the Galileo mission was another effect of the destruction of the Space Shuttle Challenger. The Centaur upper stage launch vehicles replacement, which used solid propellant rather than liquid propellant, was unable to send the probe to Jupiter on its own, and so the Venus-Earth-Earth gravity assist would be used to complete the probes journey (INL, 2015, 32).

3-11

3.3.4 The Cassini Mission (1997)

The Cassini mission to Saturn was the second with an NPS to conduct an Earth flyby following its initial escape trajectory. Although the probabilities suggested that fuel release was highly unlikely, certain conditions led to high source terms in the analysis of the mission.

Consequently, Cassini was subjected to a great degree of public scrutiny, with many activists seeking to delay or even cancel the launch (Kastenberg and Wilson, 2004, 54, 57-58).

Similar to all missions subsequent to the enactment of the National Environmental Policy Act in 1970, the Cassini mission underwent the development of an EIS that outlined the potential impact of the mission. The EIS was issued during the mission planning stage and before the comprehensive safety analysis, though the EIS analysis was also detailed. In addition to the final EIS, a supplemental EIS was later issued for Cassini that incorporated the results from the missions SAR as well as the LWRHU (1997) SAR. Typically, a supplemental EIS is issued when specific details of the mission become known that result in a significant change in the original EIS results. The Cassini supplemental EIS stated that the process used in the safety analyses to determine the risk associated with the Cassini mission is fundamentally similar to the process used for the earlier Galileo and Ulysses missions (Office of Space Science (OSS),

1997, 4-2). The approach undertaken for this mission, however, exhibited a higher level of rigor and better aligned with the modern analysis and safety review processes compared to previous missions (Buenconsejo et al., 2018, 2).

In short, the determination of source terms for the supplemental EIS involved simulating the accident environment responses of the RTGs and RHUs. Subsequently, transport and dispersal modeling were employed to assess the consequence of the source terms, while designers assigned weights to the probability of these consequences (OSS, 1997, 4-2). Unlike the safety analyses of its two predecessors, the Cassini supplemental EIS benefited from the extension of the techniques developed in the earlier analyses and [application] of probabilistic techniques to each of the source term probability distributions (OSS, 1997, 4-6), which resulted in a 50-year collective radiation dose, 50-year latent cancer fatalities from exposure, maximum individual dose and average individual risk (OSS, 1997, 4-6), land area contamination, and radiological risk. The supplement provides health effects as a mean as well as the 5th, 50th, 95th, and 99th percentiles (OSS, 1997, 4-6).

The Cassini SAR and SER are not publicly available. In their absence, the supplemental EIS and other reports describing the analysis and review provide insight into the process and the content of the two safety reports.

The highest average individual risk was a probability less than 1 in 55 million of fatal cancer from exposure compared to an individual risk of fatal cancer from background radiation of 1 in 133 (OSS, 1997, 4-9). Along with an uncertainty analysis of these results, the supplemental EIS analyzed the impacts of the alternative launch possibilities, including a 2001 mission that would have avoided the Earth gravity assist (OSS, 1997, 4-10-4-12).

The INSRP SER primarily focused on launch abort scenarios for its own confirmatory analysis, while accepting the SARs findings for other low-probability accidents. The Launch Abort Subpanel conducted its own analysis, which presented a failure probability but smaller source term and subsequently smaller risk (Kastenberg and Wilson, 2003, 55). The Reentry Subpanel 3-12

also conducted its own analysis that once again presented a smaller risk than shown in the SAR (Kastenberg and Wilson, 2003, 57).

3.3.5 The New Horizons Mission (2006)

The 2005 final EIS for New Horizons references a summary of the DOEs nuclear risk assessment for the New Horizons mission EIS that preceded the FSAR, which appears unpublished but mainly reflected past assessments with additional supplemental analyses where considered appropriate (Science Mission Directorate (SMD), 2005, 4-13-4-14). The report follows the same risk assessment procedure as the general framework for Galileo, Ulysses, and Cassini and identifies the launch vehicle system failures (SMD, 2005, 4-14). Unlike Cassini, the mission contained only six phases (the typical number) because it did not include an Earth gravity assist portion (SMD, 2005, 4-17).

After providing the accident probabilities and source terms (SMD, 2005, 4-25), the radiological consequence was calculated in terms of maximum individual dose, health effects, and land area contaminated at or above specific levels (SMD, 2005, 4-26). In this case, the individual risk was 1 in 2 billion and 1 in 2.3 trillion for a health effect near the launch pad and globally, respectively, compared to a risk of death due to any disease of 1 in 130 (SMD, 2005, 4-35).

Once again, the report includes an uncertainty analysis (SMD, 2005, 4-35-4-36). Neither the New Horizons SAR or SER is publicly available, and so the details found in the final EIS give the best view of what those safety reports would have discussed.

3.3.6 The Mars Science Laboratory (2011) and Mars 2020 (2020) Missions As with those for the Ulysses, Cassini, and New Horizons missions, the SARs and SERs for the MSL and Mars 2020 missions are not publicly available. However, public reports and papers do summarize these analyses, providing insights into their content and structure. Furthermore, a public EIS was created for each mission. EISs follow a distinct format that emphasizes communication with the public, and they include some of the analysis conducted in the SAR.

For these missions, the full EISs include a draft EIS for public comment, a final EIS for NASA approval, an associated nuclear risk assessment report, and a supplemental EIS that may be issued afterwards. Supplements were issued for the MSL EIS, due to the 2-year technical delay of the mission, and for Mars 2020, due to differences in results between the original EIS and the FSAR.

The MSL safety analysis concluded that the early launch phase dominates the risk of the mission and poses the largest potential source term, despite the overall risk of the mission being low (Clayton et al., 2012, 2). Quantitatively, the mean number of health effects was below one, with the total risk (the expectation value calculated as the product of probability and the mean number of effects) calculated as 0.000962. The insignificance of the health effects was attributed to the delayed release of the radionuclide, its small release fraction, and the efficacy of emergency response (Bixler et al., 2013, 10, 30).

The final EIS for the MSL summarizes the radiological impact of both the alternatives and the proposed action from the DOEs nuclear risk assessment. A difference in this analysis was the division of the mission into only five phases, with the orbital phase included in the preorbit and escape phases (SMD, 2006, 4-15-4-16). The methodology and content are otherwise similar to 3-13

those of the New Horizon mission. An individual health-effect risk of 1 in a million is reported for MSL (SMD, 2006, 4-33).

The final EIS for the Mars 2020 mission employs a format similar to previous EISs, reverting to a division of the mission into six phases (SMD, 2014, 4-27). The overall methodology and content are also similar to previous EISs, with the reported individual health-effect risk reported as 1 in 300 million (SMD, 2014, 4-51).

3.3.7 Systems Lacking INSRP Review Although three NPS development projects never undertook a launch safety analysis, they considered the safety of the system in its designs and took steps that would serve as a basis for future launch safety analyses.

The NERVA Engine. Early tests of the NERVA engine were conducted not just for the safety considerations of its use in a launch but also for the subsequent tests to be performed themselves (Camp et al., 2019b, 9). Although no safety analysis was conducted for the engine, as it had no planned mission, it was also used as a common reference design for contemporary papers describing the safety of nuclear propulsion. As such, safety documentation exists, if not a true SAR. A contemporary document postulating the safety of space nuclear systems also considered nuclear engines (Hargrove and Trammell, 1964).

The SP-100 Reactor. Despite never completing the INSRP safety review process, designers created safety analyses theorizing the use of SP-100 on a space mission. One such report described the radiological consequence of accidents involving the reactor for various missions, including a TITAN-launched high-orbit mission, a shuttle-launched NEP mission, or a shuttle-launched low-orbit mission, reporting the risk associated with each possibility (Bartram and Weitzberg, 1988).

The Kilopower Project. Although reaching an advanced stage of development, the Kilopower project ended in 2018 without having ever been used on a mission. As such, no complete launch safety analysis was conducted. However, tests of the reactor yielded useful information regarding the reactivity and possible doses from criticality events (McClure, 2018), which may prove useful for future reactor projects.

3.4 Calculation Methods for Risk Assessments Risk assessment is a general framework that missions can tailor to specific cases. For nuclear risk analyses, systems can range from terrestrial reactors to NPSs, the latter posing unique challenges. While the assessments may adhere to a common outline in their approaches, there are key considerations that distinguish between RPSs and SNRs, just as both differ from terrestrial applications.

A public methodology assessment released before the safety analysis of the MSL MMRTG provides a high-level methodology assessment and describes the framework of a nuclear safety analysis. In this regard, it offers a perspective on a standard risk assessment, where the only noteworthy modifications from an SNR analysis are related to source terms, exposure pathways, radiological effects, and other factors that merely constitute a stage within the 3-14

framework (Bessette et al., 2006). Lastly, the report describes the three levels of a nuclear safety analysis, summarized in Table 3-2.

Table 3-2 Levels of Analysis for Nuclear Safety Analysis Level of detail Type of safety analysis Simulations of the possible accidents and the responses of the system.

Level A Deterministic.

Computation of many event sequences controlled by random variables and Level B incorporating simplified Level A results to produce probability distributions of the source term.

Probabilistic analysis of the results of Level B following atmospheric Level C transport and health effects for each accident scenario and the probabilistic combination of all scenarios.

Source: Methodology Assessment and Recommendations for the MSL Safety Analysis, SAND2006-4563, Bessette et al., 2006.

In Level A, simulations determine all scenarios leading to the release of radiological material.

These simulations require a finite set of representative responses to accident environments, interpolation of which yields all intermediate results (Bessette et al., 2006, 17-18).

In Level B, calculations determine the final release fraction and the probability distribution.

These calculations consider many events using random variables, creating the probability distribution that characterizes the source terms. It incorporates the simplified results of Level A to determine these values (Bessette et al., 2006, 18).

Finally, in Level C, a simulation considers the transport of the source term. Combined with population density, safety measures, and exposure pathways, this determines the probabilistic health consequences. These calculations require models separate from the nuclear system and instead use only the source term and external information, such as meteorological conditions, to determine the consequences (Bessette et al., 2006, 19). Figure 3-4 shows a diagram from the report depicting the detailed process of all levels.

3-15

Figure 3-4 The process for calculating final risk of a space nuclear system launch with the three levels labeled Source: Methodology Assessment and Recommendations for the MSL Safety Analysis, Bessette et al., 2006.

There are multiple ways to represent the final launch risk. The report notes that the best estimate of latent cancer fatalities over 50 years, along with lower and upper bounds for the value from the confidence interval, includes the uncertainty in health consequence from all factors. Beyond this, past SARs have used probability distributions to report their values and divide uncertainty into two types: the epistemic uncertainty tracing back to uncertainty in the state of knowledge, and the variability or aleatory uncertainty from the random factors modeled by Level B. Some reports separate these two uncertainties for clarity (Bessette et al.,

2006, 82-83).

Another common method for reporting health consequence is global exposure, which is the first step to determine the exposure for any given individual. The common unit for this value is the person-sievert (or person-rem), found by multiplying the exposure dose by the number of people affected. This number can be translated into an amount of possible radiologically induced health effects due to the exposure (Goldman et al., 1991, 156).

Because of the different histories of their use and safety analysis calculations, the following section separately describes the risk assessments of RPSs and those of SNRs to give more system-specific detail.

3.4.1 Radioisotope Power System Risk Assessment In the past few decades, safety analyses have maintained similar approaches, albeit with some notable changes. One such change has been the improvement in codes and calculation 3-16

methods. Past reports illustrate the procedural steps involved in conducting a safety analysis, including the use of specific equations that demonstrate the evolution of these methods.

The Galileo FSAR comprises three volumes, with the third outlining the calculation of the missions integrated risk. For each incident that could potentially result in fuel release, the report presents three source terms: the most probable, the most consequential, and the expectation.

Computer codes then analyzed the consequence of these releases, including other factors such as location, with the final mission risk calculated from the expectation amount (Johnson 1988c, 7-9).

The safety analysis of the Ulysses mission employed the same risk assessment process, starting with the identification of accidents and their probabilities. That was followed by determining the physical environment of each event, evaluating the RTG response, conducting a subsequent accident analysis, and ultimately calculating the consequences (NUS Corporation, 1990).

One method the Cassini safety analysis used was the event tree model, which described the potential reentry of the spacecraft following its Earth gravity assist. The event tree model lists possible events and incorporates many factors necessary for determining the risk associated with each individual event in the outcome calculations. Its results were reported in a frequency-consequence graph (Frank, 2000, 252).

Another report outlines a risk assessment framework and analyzes codes that could be used for calculations at each step (Bessette et al., 2006), included in APPENDIX A to this research information letter (RIL). Although not the FSAR itself, the risk assessment for the Mars 2020 EIS included an appendix detailing the analysis, which was similar to that used for the MSL mission (Clayton et al., 2014).

3.4.2 Equations and Computer Codes for Radioisotope Power System Risk Assessment In the description of their methodology, earlier analyses commonly included the exact equations used for modeling certain aspects, whereas modern analyses tend to list the dedicated computer codes. The following discussion lists various calculation methods used for different parts of a safety analysis, ordered by the step of risk assessment to which each contributes.

Accident determination. The Galileo FSAR categorized each accident into subcases that could each be modeled mathematically to identify accidents and the probability of release. The second volume of the report describes this information (Johnson, 1988b, 76-80). These subcases were specific to each component and would have to be adapted for different missions.

The FSAR also assessed the LWRHU response to reentry, incorporating test data for the system.

Source term determination. During the review of the FSAR, the Galileo INSRP employed a NASA Monte Carlo code to calculate the source terms. In addition, events with insignificant probability were excluded to avoid the maximum release of fuel being proportional to the number of trials (INSRP, 1989b, 4). Other codes were used to determine the particle size distribution and modify the source term due to atmospheric transport. The reports appendix summarizes the uncertainty associated with the findings (INSRP, 1989b,88-109).

3-17

The Ulysses FSAR uses another method to calculate source terms. For each accident, an average source term and an average top 5 percent source term were calculated and subsequently employed for further calculation (Sholtis et al., 1991, 133).

A paper (Wyss, 1996) outlines the uncertainty assessment process for the Cassini missions SAR. It further details the codes used in the SAR, included in APPENDIX A to this RIL, while emphasizing three methods of determining the uncertainty. Another report (Robinson, 2012) summarizes the safety analysis for the MSL mission, listing specific codes and describing the release model for the GPHS following impact. Each of these reports encompasses three components: the distribution of particles within the GPHS (cumulative mass fraction), the probability of a breach, and the release fraction.

Public consequence determination. After determining the source term for the possible accidents, the designers proceed to calculate dispersion. The MOD-1 (Pu-238) for the earliest RTG safety analysis includes a formula describing the total deposition following reentry of the RTG (Knighton, 1960, 37). A subsequent report for the SNAP-9A RTG includes an equation describing the deposition (in units of curies) resulting from the instantaneous release of fuel (Buckalew et al., 1964, 10), along with a method for calculating the horizontal diffusion of fuel released in sea water (Buckalew et al., 1964, 17). APPENDIX A to this RIL lists modern computer codes used for these calculations.

Following dispersion, the subsequent calculation entails determining the exposure of the public.

One common measure used in early safety analyses is the effective half-life for radiobiological effects from an isotope. This measure is obtained by multiplying the radiological and biological half-lives and dividing the results by their sum (Hagis and Dix, 1960, 21-23). The effective half-life quantifies the internal exposure to an isotope resulting from inhalation or ingestion. Of these two paths, inhalation is considered the greater concern, as the insoluble form of Pu-238 is relatively harmless when passing through the digestive track (Goldman et al., 1991, 154). The SNAP-9A safety analysis, mentioned in the previous section, includes an equation that describes the lung dosage from the reentry of an RTG (Buckalew et al., 1964, 18).

The Galileo INSRP reports provide detailed information on the calculation methods used for exposure, as documented by the Biomedical and Environmental Effects Subpanel. These methods encompassed an equation for the resuspension factor, which accounts for an additional ingestion and inhalation of the isotope, and the external radiation dose (INSRP, 1989c, 44-47). Subsequent sections of the report include methods used to determine the inhalation dosage, along with the corresponding code for calculations (INSRP, 1989c, 50-59).

The clearance of the Pu-238 isotope, which affects the dosage and cancer effects, is also modeled (INSRP, 1989c, 71-85), as well as the dosage from contaminated vegetation (INSRP, 1989c, 88-91) and seafood (INSRP, 1989c,96-119).

Finally, the comparison report for SNAP-9A and SNAP-10A (Willis, 1963, 3) presents a method that uses maximum permissible body burdens to describe the total radiation hazard. This concept refers to the amount of water or air needed to dilute the exposure to a maximum permissible concentration.

3-18

3.4.3 Space Nuclear Reactor Risk Assessment A report analyzing the effects of the destruction of a nuclear rocket engine before reentry considered four factors: (1) operation history of the reactor, (2) fragment size distribution, (3) reentry timing of the fragments, and (4) the range of fragments on the Earths surface. The report detailed the methods used and described the affected area, but it did not analyze the consequences to the public (Hargrove and Trammell, 1964).

The SNAP-10As safety report, Final SNAPSHOT Safeguards Report, categorized the evaluation into three phases: launch to orbit, orbit to reactor startup, and startup to reentry. The second and third appendices to the report contain the methods used for radiological evaluation and assumptions, respectively (Alexander et al., 1965, 251-334). Appendix E to the report describes the failure mode and impact probabilities (Alexander et al., 1965, 347-402). While modern analysis codes supersede these methods, these methods demonstrate the process used to analyze the safety of the only SNR ever approved for launch in the United States.

Figure 3-5 depicts a test being conducted with a model of the device.

Another report (Bartram and Dougherty, 1987) describes the risks of both Pu-238-fueled RTGs and fission reactors. These risks are inherent in each system since there is no specific launch vehicle or mission described. The report uses the Markov chain technique to calculate mass transport and describes the estimation of risk, atmospheric transfer, aquatic dispersion, and radiological doses for both dispersed and intact fuel.

Figure 3-5 A full-scale model of the SNAP-10A reentry vehicle in an acoustic facility at Sandia National Laboratories Source: HD.6D.512, n.d., in DOE, AECReactor Development, 2013.

3-19

After SNAP-10A, the United States launched no more reactors; however, projects would continue to undergo safety analyses. These projects included the SP-100 reactor, intended for higher power missions. The analysis included five steps:

(1) identification of accidents and their locations and probabilities (2) definition of the source terms (3) dispersion analysis and the resulting environmental concentration (4) determination of exposure rates through various pathways (5) identification of the health consequence The report outlines the calculation methods, which encompass both the specific equations and names of the codes. For assessing the doses received by the public (excluding external radiation due to its insignificance), a proprietary code, TDOS, was used (Bartram and Weitzberg, 1988, 56-62).

Despite a relative lull in activity between the SP-100 reactor project and the Prometheus project, the field of SNR safety analysis has seen renewed interest in the past two decades. While few projects developing SNRs have included specific plans for mission deployment, contemporary projects have tended to consider safety and have even conducted tests for potential safety analyses. A recent paper (Camp et al., 2019a) also analyzes the reentry of a fission reactor, informed by past SNR projects. While it does not calculate risk, it summarizes potential accidents and environments, which could serve as initial steps for a safety analysis. Another report (Camp, 2021) details the use of risk metrics and how they may be applied to fission reactors, although it does not include an actual risk analysis. Nevertheless, this information provides useful insights for future reviews.

3-20

4 INTERAGENCY SAFETY REVIEW PROCESS FOR NUCLEAR MISSIONS While the general framework for the interagency safety reviews of space nuclear missions remains the same, the process has evolved over time. Initially, the safety review involved only the AEC and the DOD, and it was considered an informal measure at the time (DOE, 1987a, 36). The first NPS mission was an experimental Pu-238-fueled SNAP-3 RTG in a DOD Transit satellite. Soon after, NASA joined the safety review process and collaborated by forming an Interagency Panel that actively participated in the evaluation process, similar to the later INSRP (Burke and Illing, 1968, 8; Schmidt et al., 2009).

The Kennedy Administrations National Security Action Memorandum 235, Large-Scale Scientific or Technological Experiments with Possible Adverse Environmental Effects (NSAM-235), in 1963 formally established the safety review process for large-scale scientific or technological experiments with possible adverse environmental effects (Kennedy, 1963). In 1974, just before the panels formal establishment, an act of Congress split the AEC, which had until then been one of the three agencies participating in the interagency review. It established the DOE12 and the NRC as its successors, each of which assumed separate portions of the AECs responsibilities. The DOE focused on the development and promotion of nuclear energy, while the NRC took on the licensing and regulation of the industry. In 1977, the Carter Administrations PD/NSC-25, which superseded NSAM-235 and specifically addressed the launch of space nuclear systems, formally established a separate procedure and structure for the ad hoc INSRP (Brzezinski, 1977).

The NRC joined the INSRP as an observer rather than an equal member to the other three panel agencies (the DOE taking on the role of the AEC in review) in accordance with PD/NSC-25. Few significant changes occurred following the panels establishment, and this status quo lasted into the 1980s and beyond. In 1995 and 1996, the Clinton Administration made separate revisions to the directive while largely maintaining its existing process. In 2019, NSPM-20 reformed the safety review process, replacing the INSRP with the new INSRB among other changes. At present, as discussed further below, the INSRB is developing its procedures, which already differ significantly from those of its predecessors13 (Helton, 2022; INSRB, 2023).

An interagency review panel evaluates the SAR issued by the sponsoring agency of the mission. It assesses the quality of this report, which has, in the past, included a comparison with its own analysis in areas it considered in need of additional attention. The panel summarizes its findings in an SER that is presented to the mission sponsor and then to the Office of Science and Technology Policy (OSTP) when applicable to inform the launch approval decision (JHU/APL, 2015, 104).

Since the beginning of the U.S. space nuclear program, the NRC and its predecessor, the AEC, have actively participated in the safety review process for space nuclear launches. In this 12 The Energy Research and Development Administration (ERDA), established on January 19, 1975, briefly preceded the DOE following the split of the AEC and before the establishment of the DOE as a cabinet-level agency on August 4, 1977.

13 The latest INSRB documents, such as the charter and playbook, are available under the Guidance tab of the NASA Nuclear Flight Safety webpage: https://sma.nasa.gov/sma-disciplines/nuclear-flight-safety.

4-1

process, the NRC offers its experience in conducting reviews of nuclear and radiological safety and maintains an impartial stance (Bennett, 1987, 2). This ensures the INSRB benefits from the agencys knowledge and independence. The U.S. Environmental Protection Agency (EPA), the U.S. Department of State (DOS), and, to a degree, the U.S. Department of Transportation (DOT) also serve as independent members on the board, as they do not sponsor Federal space nuclear system launches.14 These Federal agencies contribute their own expertise to the safety review process by analyzing radiological consequences. Other board members, including the DOD and NASA as mission sponsors, as well as the DOE as a provider of NPSs, have safety review groups within their own organization. These Federal agencies play a crucial role in the safety analysis itself, in addition to their participation on the INSRB.

Due to the potential global impact of space nuclear accidents, the safety of these missions has garnered international attention. Since 1959, the UN, its Office for Outer Space Affairs, and COPUOS have played a significant role in adopting resolutions and establishing international commitments in response to incidents involving space nuclear missions by the United States and the former Soviet Union that resulted in a degree of radiological contamination of the Earths atmosphere.15 These UN resolutions and international commitments impose the requirements of launch safety reviews of NPSs for all nations (UN General Assembly (UNGA),

1992; Scientific and Technical Subcommittee (STSC) and IAEA, 2009, 3).

The following sections summarize the interagency safety review process. Different terminologies are used in these sources to refer to various parties involved, but this text aims to describe each party using a single term, defined as follows:

• Sponsoring agencyIn the case of a government launch (the assumed scenario unless otherwise stated), one single agency is considered the sponsor of the mission that requests a safety review for launch approval. This term is either used in full or shortened to sponsor.

• MemberThis term has sometimes described the individuals serving on the board. Its usage in the following sections refers to the agency that has membership on the board rather than the individuals themselves.

• RepresentativeThe following sections use the term representative rather than member to describe the individuals serving on the board. Past documents described them as coordinators as well, which had been their official title on the INSRP.

4.1 The Evolving Safety Review Framework The policies for approval of space nuclear launches have evolved significantly since the Transit 4-B flight. Initially, the approval processes for these missions lacked standardization and were born of a desire for safety originating within the AEC, the DOD, and NASA. Subsequently, presidential memoranda and directives established a more comprehensive framework and 14 The DOT may serve the role of the sponsoring agency in some reviews according to NSPM-20. In cases of commercial launches meeting the criteria for safety review, the DOT has authority over the approval process but may elect to request an INSRB review of the launch, and in such a case, it is considered the sponsor.

15 More details regarding UN involvement in the field are available on the website of the Office for Outer Space Affairs: https://www.unoosa.org/oosa/index.html.

4-2

structure of the interagency panel. In recent years, there has been movement toward clear decision criteria, particularly with the issuance of NSPM-20 in 2019. Figure 4-1 summarizes key events in this evolution.

Figure 4-1 Major events in the launch approval framework 4.1.1 The Safety Review Framework before NSPM-20 The Transit satellites spurred the development of launch safety reviews for space nuclear systems. As the SNAP program planned to equip the spacecraft with an RTG to test the system in space, the National Security Advisor, in NSAM-50, Official Announcements of Launching Into Space of Systems Involving Nuclear Power in Any Form, issued 1961, expressed the Presidents interest in reserving the right to announce all space nuclear system launches (Bundy, 1961). Two years later, NSAM-235 outlined a more detailed process for a safety review of these missions. The memorandum mandated a review of environmental effects to be sent to the Special Assistant for Science and Technology (Kennedy, 1963), similar to the OSTP in the current process.

In 1970, then-President Nixon signed the National Environmental Policy Act into law. Seven years later, PD/NSC-25 reconciled the relationship between the act and space nuclear launch approval and expanded the involvement of additional agencies beyond the original threethe DOE,16 the DOD, and NASAin the approval process. It also stipulated that the sponsoring agency would notify the DOS so it may consider diplomatic repercussions. The directive was also the first to establish certain criteria for whether a full safety review was required. The President retained the authority to approve the launch of vehicles containing more than 20 curies of material included in Radiotoxicity Groups I and II or 200 curies of material in Radiotoxicity Groups III and IV, as listed in table 1 of the Nuclear Safety Review and Approval Procedures (1970). PD/NSC-25 further described the three permanent members of the INSRP responsible for evaluating risk and inviting the NRC as an observer. These permanent members would draft an SER for review by the OSTP before launch approval (Brzezinski, 1977).

16 The Energy Reorganization Act of 1974 abolished the AEC. Earlier in 1977, the same year that PD/NSC-25 was issued, the Energy Organization Act established the DOE, and it became the permanent member of the panel while the NRC would be an observer.

4-3

Two revisions amended PD/NSC-25, written by the Clinton Administration. In 1995, an Official Use Only revision updated the thresholds for the type of safety review required, and it imposed a requirement for quarterly reports to the OSTP for launches between 0.1 percent and 1,000 times the A2 value for material in IAEA Safety Series No. 6, Regulations for the Safe Transport of Radioactive Material, 1985 Edition (As Amended 1990) (Helton and Witmer, 2023, 2; IAEA, 1990). Launches exceeding the latter limit would undergo an interagency review and require presidential approval. The following year, another revision to PD/NSC-25 stated that the INSRP would no longer have an official reporting obligation to the OSTP (Helton and Witmer, 2023, 2-3). Neither revision is publicly available.

The next major mention of the launch approval process by an administration was in a single section of the broader Presidential Policy Directive 4 (PPD-4) issued in 2010, National Space Policy of the United States of America, called Space Nuclear Power (Obama, 2010). This section reaffirmed the INSRPs role and mandated the Secretary of Energy to conduct the safety analysis of government launches meeting the previously established thresholds of radioactivity, which would then be reviewed by the panel (Obama, 2010, 8). In the end, the revisions and directives following PD/NSC-25 and before NSPM-20 had minimal impact on the safety review process (Buenconsejo et al., 2018, 3).

4.1.2 NSPM-20 and the INSRB Charter NSPM-20, the new and publicly available (previous memoranda and directives were not public at the time they were issued) guiding policy for the safety review of space nuclear launches, marked the first significant change in presidential policy in over four decades and possibly even since the beginning of the process in the sixties (Helton, 2022). It replaced the ad hoc, mission-specific INSRP with the permanent INSRB, which now includes the NRC as an equal member. The policy also explained that the sponsoring agency, not the DOE directly, holds the responsibility for providing the SAR. In addition, NSPM-20 created a set of new tiers to determine whether a launch necessitated presidential approval, updating those set out by PD/NSC-25 and updated in 1995. Table 4-1, which summarizes the current tiers, applies specifically to U.S. Government missions (Trump, 2019).

The changes of NSPM-20 introduced a new governance structure, the incorporation of new probability-consequence curve targets for missions as presented in Table 4-2, and the previously mentioned establishment of an updated three-tier approval for launch (shown in Table 4-1). Permanently joining the DOE, the DOD, NASA, and the EPA are the NRC, the DOT, and the DOS as equal members of the interagency safety review process, though the membership may be restricted for specific mission reviews in the interest of national security.

Under the new tiers, only Tier II and III launches necessitate a sponsor's request for an INSRB review, which entails the agency providing any additional material required for evaluation.

Subsequently, the board presents its findings to the head of the sponsoring agency (Trump, 2019).

4-4

Table 4-1 NSPM-20 NPS Risk Tiers Tier Requirement(s) Launch authority for INSRB safety U.S. Government review missions required?

I Less than or equal to 100,000 times the Head of Sponsoring No radioactivity limit for radioactive material a Agency II Greater than 100,000 times the radioactivity Head of Sponsoring Yes limit for radioactive material a Agency Or risk of 5-25 rem total effective dose to a member of public b with greater than or equal to 1 in 1,000,000 probability Or spacecraft contains fission system or device with potential for criticality using low-enriched uranium (less than 20% U-235)

III Risk of greater than 25 rem total effective Director of OSTP c Yes dose to a member of the public with greater than 1 in 1,000,000 probability Fission systems and devices with a potential for criticality using fuel other than low-enriched uranium Source: National Security Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Systems, Trump, 2019.

a Limit is the value of A in table 2 of the IAEAs Specific Safety Requirements No. SSR-6, Revision 1, Regulations 2

for the Safe Transport of Radioactive Material, 2018 Edition.

b Unlike some requirements, this is a value to any one individual, not a population-averaged exposure.

c The Director may forward such requests to the President at their discretion.

Table 4-2 Probability-Consequence Curve Targets from NSPM-20 Consequence a Probability target (less than) 0.025 mrem - <5 rem 1 in 100 5-25 rem 1 in 10,000

>25 rem 1 in 100,000 Source: National Security Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Systems, Trump, 2019.

a Total effective dose to any member of the public. (1 rem = 0.01 sievert)

National security concerns permit the restriction of board member participation in the review.

Otherwise, the board is authorized to evaluate the quality of the safety analysis and identify any significant gaps in analysis. The INSRB may recommend areas for additional analysis where it identifies gaps, but it is not tasked with repeating or conducting its own analysis (Trump, 2019,

§ 5(c)), providing feedback throughout the process to avoid unnecessary delays (Trump, 2019, 4-5

§ 5(c)). The end of the former phrase is not clear in its precise intention as to whether analysis is to be strictly avoided or focused in scope, though the board has currently adopted the latter interpretation (INSRB, 2023, 17-18). In the case of a commercial launch, the DOT is considered the launch authority, and at Tiers II and III, it may consult with agencies to evaluate the quality of the safety analysis, and identify any significant gaps at its discretion, though it has a right to request an INSRB review in any case (Trump, 2019, § 5(c)). Beyond these duties, the board members must submit annual reports on sponsored or licensed missions making use of 1,000 to 100,000 the A2 value given in IAEA Specific Safety Requirements No. 6, Revision 1 (Trump, 2019, § 6(a)-(b)).

Shortly after its establishment, the board took the initiative to create and adopt a charter for itself, which is also a publicly available document, that primarily reflected the content of NSPM-20, while also incorporating additional clarification for the governance, representative roles and responsibilities, and procedures of the board. The Charter of the Interagency Nuclear Safety Review Board serves as a basic framework for INSRBs conduct of business and contains the boards intent and functionality at the highest level (INSRB, 2023, ii). This living charter, along with the INSRB Playbook discussed later, is subject to revisions as the board continues to establish itself and prepares for its inaugural reviews. According to the INSRB Charter, each mission is assigned to its own INSRB Review Group (IRG) and a Mission-specific Review Plan that outlines the safety review process, including a schedule for the delivery of actionable information regarding the SAR. The sponsoring agency of the review chairs these IRGs, or the DOT in the case of a DOT-requested review. In addition, the IRG has the option to consult and contract nongovernment subject matter experts during a review but may not fulfill the roles of a board representative (INSRB, 2022).

The charter clarifies that the INSRB operates in an advisory capacity and is limited to making recommendations to the sponsorthough this is similar to the text of NSPM-20, the memorandum does not explicitly state the board is limited to this role alone. In making decisions, the board operates by consensus. If a consensus cannot be reached, a minority report is to be prepared, outlining issue(s), and submitted to the sponsoring agency as well as the OSTP (or the Presidents office for Tier III). Subject matter experts and the IRG are required to identify potential conflicts of interests beforehand and notify the board of possible conflicts among its representatives by the affected individuals. The representatives have the responsibility of actively participating in quarterly and as-needed meetings, joining mission-specific reviews, providing subject matter experts from their own agency if appropriate, and contributing to INSRB guidance documentation (INSRB, 2022).

The DODs DRACO mission is expected to become the first Tier II launch under NSPM-20. It will also be the first launch to be reviewed by the INSRB and the first SNR to be considered for launch approval since the SNAP-10A reactor (Greiner, 2021, 3-4).

4.1.3 The INSRB Playbook The INSRBs adopted playbook serves as the most comprehensive and authoritative guidance for INSRB operations. The Interagency Nuclear Safety Review Board (INSRB) Playbook Non-binding Guidance for INSRB and Its Counterparts, for trial use, is also a living document, the board having recently approved its second revision in early 2023 (INSRB, 2023). As such, it is possible for details to change in future revisions.

4-6

This second revision of the playbook provides a greater level of detail than the charter and outlines the expected conduct and behavior of the board. It presents a general framework that fits any mission, including (to an extent) commercial missions as defined in the playbooks appendices (INSRB, 2023, ii-iv). In its preamble, it notes that procedures, policies, approaches, and experience are all separate aspects of nuclear safety and that when seeking to apply terrestrial concepts to space, the latter three aspects may all be appropriate for a general framework, but the procedures must be different (INSRB, 2023, iii).

With the aim of providing guidance, the playbook outlines a tentative structure for the future safety review process, though the details for safety review are tailored to government launches.

However, it acknowledges that this outline may be subject to change if the DOT requests the review. Table 4-3 summarizes various potential cases for analysis, as documented in table 1 of the playbook. The sources it has been based on include the DODs and NASAs approaches to system safety, the DOEs and the NRCs nuclear safety processes, and the IAEA and the UN STSCs Safety Framework for Nuclear Power Source Applications in Outer Space (STSC and IAEA, 2009), though the framework is not a reproduction of any single approach.

Safety Review Process. The safety review process includes three overarching stages, which the playbook summarizes in text as well as its figure 1, reproduced here as Figure 4-2 (INSRB, 2023, 22).

4-7

Table 4-3 INSRB Playbook Suggested Analysis and Review Outline Nuclear Technical Agency Interagency Launch system or SAR source peer review review review authority flight in NSPM-20 Case 1 (e.g., NASA Pu-238 RPS mission)

Nuclear Component of INSRB Technical DOE (incl.

system (i.e., the DOE DOE SER Report (if -

contractors) system SAR) process requested)

NASA DOE/NASA Component of Flight (i.e., Administrator or (incl. the DOE DOE SER INSRB SER mission SAR) Executive Office contractors) process of the President Case 2 (e.g., DOD space reactor mission)

DOD program Separate DOD INSRB Technical Nuclear office (incl. program office DOD SER Report (if -

system contractors) contractor requested)

Sec. of Defense DOD program Separate DOD or Executive Flight office program office DOD SER INSRB SER Office of the contractor contractor President Case 3 (e.g., fully commercial)

NRC applicant NRC INSRB Technical Nuclear (for terrestrial

- terrestrial Report (if -

system safety license requested) aspects)

FAA applicant for launch or FAA launch INSRB SER (if Secretary of Flight reentry (for FAA applicant or reentry requested by Sec.

Transportation flight safety license of Transportation) aspects)

Source: Interagency Nuclear Safety Review Board (INSRB) Playbook: Non-binding Guidance for INSRB and Its Counterparts, Revision 2, INSRB, 2023, table 1.

4-8

Figure 4-2 The INSRB safety review process as depicted in the playbook Source: Interagency Nuclear Safety Review Board (INSRB) Playbook: Non-binding Guidance for INSRB and Its Counterparts, Revision 2, INSRB, 2023, figure 1.

The first stage shown in Figure 4-2 is one of active work by the sponsoring agency on mission formulation, software and hardware development, safety basis underpinning activities (e.g., safety criteria formulation, testing, validation and verification), launch vehicle selection, etc., which will likely refer to past activities for guidance and knowledge (INSRB, 2023, 24). To these ends, and for general utility, the board is creating a repository of past review information (INSRB, 2023, 32). The sponsoring agency may also create a generic system-specific SAR and request an early review, which invokes a streamlined approach, though one intended to inform the later review rather than to replace it. Regardless, the board assists by finding issues challenging the safety analysis and safety review process and communicating these to the sponsoring agency through consensus board statements (INSRB, 2023, 24).

The second stage is one of active INSRB and mission interaction (INSRB, 2023, 25), which includes the IRGs empanelment following the completion of a strategy for the establishment of the launch authorization basis and request for launch authorization. The exact timing of the transition into this stage depends on the systems in play: novel and untested systems may begin earlier to allow greater review, while familiar and tested ones may transition later (INSRB, 2023, 25). The IRG must develop the mission-specific review plan, establishing the lines of authority and communication between the reviewer and the reviewee, as well as the expectations for the roles and responsibilities for the review to promote transparency, clarity, effectiveness, and reliability in the review (INSRB, 2023, 28, 37). The plan will be issued as a living document and the IRG will prepare to conduct a sampling-type review that summarizes core review areas to find where it should focus its attention, so that it may go into greater detail regarding the important risks without becoming too resource intensive (INSRB, 2023, 26).

The third and last stage is continued mission involvement, but reduced IRG activity, with the INSRB Safety Evaluation Report having been issued (INSRB, 2023, 27). While the IRG remains empaneled through the launch, the Chair, who was selected by the sponsoring agency, 4-9

will now be able to represent the entire group for last-minute issues and need not rely on the board though they should stay in communication (INSRB, 2023, 27).

Safety Evaluation Report. The playbook also describes its vision for the final SERs as well as high-level success criteria for a review. The reports should contain an evaluation of the quality of the SARs hazard identification and mitigation approach and results, its risk estimates, its treatment of uncertainty, and its identification of essential safety features and assumptions (INSRB, 2023, 43-44). Section 4.3.2 of this RIL describes the proposed outline for INSRB SERs.

The reviews are to refrain from repeating or conducting analysis that would mirror or supplant the safety analysis, and though analysis may be necessary, it may only be performed if it is not resource intensive (a given example is whether the level of effort would exceed 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />),

focuses on a particular area, and is preferably a sensitivity and uncertainty analysis of the SAR (INSRB, 2023, 17-18). Review activities also exclude safety management programs unless directly connected to a hazard in the SAR, steps before the launch, nonflight hazards (such as sabotage and theft), accidents leaving Earth unaffected (such as if the system impacts another celestial body or presents no radiological risk), and end-of-life disposal unless it presents radiological risk to the public or biosphere (INSRB, 2023, 21). Although the board may also support projects other than launch authorization as needed, it must only conduct reviews for that purpose (INSRB, 2023, 20).

Governance. One last component of the playbook is its description of the governance structure of the board in greater detail than that found in the charter. No specific qualifications are given for the representatives themselves, as the appointment indicates proficiency in a subset of nuclear policy applicable to review, an understanding of relevant Federal policy, seniority and access to agency leaders, trust, interpersonal and communication skills, and available time (INSRB, 2023, 5). While all members have equal standing, NASA has assumed additional responsibilities within the INSRB as the empaneling agency. These responsibilities include the position of Board Secretariat, as well as various other organizational roles (INSRB, 2023, 6-7).

The origin of IRGs provides further insight, highlighting their benefits, including the possibility of having a Chair (since the board consists of equal members and cannot have such a figure),

facilitating interactions between the sponsoring agency and a smaller group, ensuring a clear division of responsibilities between missions, and enabling the board to maintain a strategic focus (INSRB, 2023, 9).

4.2 The Practice of Interagency Safety Review Since the beginning of the program, interagency cooperation has been integral to ensuring the safety of space nuclear launches. During the petition to use a SNAP RTG on Transit satellites, the Chairman of the AEC pursued a collaborative effort with the DOD to jointly submit a safety document in order to obtain approval from the Space Council (DOE, 1987a, 24). As NPSs became more prevalent in satellite missions, the AEC, the DOE, and NASA, along with the White House, recognized the need for a formal safety program. In preparation for the SNAP-9A launches in 1963, NASA, the AEC, and the DOD conducted reviews, eventually establishing the joint AEC-NASA Space Nuclear Power Office to oversee the process (DOE, 1987a, 36).

4-10

4.2.1 The History of the Interagency Safety Review Process At a 1963 conference on nuclear safety, an AEC director presented the AECs safety programs and philosophy, highlighting their collaboration with specialized groups across several agencies.

During the presentation, it was acknowledged that there was some overlap in the work of the safety program, prompting the consideration of establishing a joint body to streamline these efforts (Pittman, 1963, 44-45). In an opening speech for the same conference, an AEC Commissioner, James T. Ramey, recognized the inevitability of interagency cooperation on space nuclear system safety. However, concerns were raised regarding the potential strictness of such a panel in relation to the practical development of NPSs and its independence from the sponsoring agency (Ramey, 1963, 15-16).

In 1968, the formation of the Interagency Panel marked a significant development in conducting reviews for space nuclear launches. During this time, the panel was reviewing the AECs SAR for the SNAP-27 RTG intended for Moon experiments during the Apollo missions (Burke and Illing, 1968, 8). The panel proposed to designers that the RTGs be made with containment capabilities rather than relying on disintegration during reentry, a design change for RTG systems that began after the 1964 Transit incident. This recommendation was made after its analysis revealed that an unplanned reentry of the lunar module could result in a dispersal event. The decision to incorporate containment proved crucial when the Apollo 13 Lunar Module returned to Earth with the RTG in 1970 (Lee and Buden, 1994, 7).

Three years later, in 1971, a summary of nuclear safety for power and propulsion highlighted the involvement of the Interagency Safety Evaluation Panel. This panel, comprising members from the AEC, the DOD, and NASA, received the AEC safety document. The panel then provided recommendations to the National Aeronautics and Space Council, similar to the role later assumed by the OSTP in the INSRP and INSRB processes (Graves, 1971, 18-19).

As the AEC underwent a split, resulting in the formation of the ERDA (the short-lived successor to the AEC, subsequently replaced by the DOE) and the NRC in 1975, major changes began to take place. Safety documents for the LES 8/9 launches, conducted by the Air Force Weapons Laboratory in 1976, were submitted for review. As part of this process, the ERDA, taking on the AECs former role, and NASA conducted independent analyses. These were then reportedly given to the INSRP for its safety review, even though the panel would not be established by presidential directive until a year after the satellites launches. The panel at that time was coordinated by a member of the ERDAs Division of Nuclear Research and Applications, NASAs Office of Center Operations, and the DODs Directorate of Nuclear Surety. The SER prepared by the panel was then sent to the National Security Council for approval (Holtzscheiter et al., 1977, 20).

Shortly after the split, PD/NSC-25, issued in 1977 just after the DOEs establishment, reformed the safety review process and formalized the INSRP into the outline that would remain for the next 43 years. Figure 4-3 provides an overview of the process that unfolded after PD/NSC-25, leading up to the subsequent NSPM-20.

4-11

Figure 4-3 The INSRP role in the launch approval process17 Source: Nuclear Power Assessment Study: Final Report, JHU/APL, 2015.

Galileo represented the sole space nuclear launch during the 1980s, though the Ulysses safety review had begun just before the end of the decade. The mission enlisted three INSRP coordinators, each appointed from the NASA Headquarters Safety Office, the Air Force Inspection and Safety Center, and the DOEs Environmental, Safety, and Health Organization standard offices for coordinator roles during that period (OCST, 1990, 12-13). At that time, the panel comprised five subpanels that persisted until the Mars 2020 mission: Launch Abort, Reentry, Power System, Meteorological, and Biomedical and Environmental Effects. Each subpanel conducted evaluations and analyses independent of the sponsoring agency to ensure an impartial assessment of the missions risk. Apart from the FSAR, previous reviews were referenced, and NASA and the DOE provided supplementary test data (INSRP, 1989a, I-3). The Galileo mission operation report summarizes the launch approval process. Following the INSRP's review and summary of the FSAR, the SER was forwarded to the DOE, the DOD, and NASA for review. Both the DOD and the DOE needed to endorse NASA's launch request, which was then submitted to the OSTP, including the supporting documents (Office of Space Science and Applications, 1989, 38-40).

Although the policy changes made by the Clinton and Obama Administrations had minimal impact on the safety review process, it evolved in the years after the Cassini mission. The pursuit of improved outcomes prompted the expansion of SAR development and the INSRPs reviews. The flexibility afforded to the members enabled them to adapt and refine the process according to their preferences and needs over time (Buenconsejo et al., 2018, 3).

The Galileo INSRP participated in the reviews of the preliminary SAR, the updated SAR, and the FSAR, enabling it to provide design feedback and attend various meetings held by the sponsoring agency to stay informed (Bennett, 1987, 2-3). Designers were encouraged to 17 Although included in the diagram, the EPA was not an original member and joined as a coordinator in the 1995 revision to PD/NSC-25. The NRC had a unique title as an observer in the original PD/NSC-25 and a technical advisor in the 1995 revision. In addition, the National Oceanic and Atmospheric Administration had served as an observer for some time (Bennett, 1987, 2), though it is unclear for how long this took place.

4-12

provide regular safety presentations to the panel and would be given certain risk indices to meet, with the INSRP determining the acceptable levels during final review (Cropp, 1984, 5, 7).

The subpanel system ensured that each agency could contribute its expertise effectively (Government Printing Office, 1986, 59), allowing for deeper and more independent analysis (Sholtis et al., 1991, 133). All missions subject to INSRP review received launch approval, although the duration and resources of the safety review varied (Camp et al., 2019a, 20). The entire timelineincluding the EIS, SAR, and SERranged from 4 to 8 years for Cassini18 and subsequent missions with an average of 6.5 years for the entire process, though typically the most time-intensive document was the DOEs SAR (Buenconsejo et al., 2018, 2).

Although there is a wealth of documentation for these previous reviews, as stated in the INSRB Playbook, the number of analyses is still limited compared to terrestrial analyses. Furthermore, the playbook emphasized that changes to the geometry of RTGs relative to the spacecraft over past missions have had important effects (INSRB, 2023, 33) on these analyses. Therefore, in adapting previous work, it is crucial to have a clear understanding of the context and assumptions underlying past analyses and to incorporate them accordingly (INSRB, 2023, 33).

Details such as the launch vehicle can fundamentally change the accident environments a system may experience.

The new process established by NSPM-20 originated from a desire to decrease the duration and cost associated with the safety review process, among others. While it is currently difficult to ascertain the level of success achieved in this regard, some subject matter experts have made predictions. For example, an individual familiar with the EISs for missions reviewed past analyses and suggested that the goals for low-inventory NPSs, specifically RHUs, would be attained. However, it also projected minimal improvements in these measures for missions involving RTGs (Chang, 2021, 13).

4.2.2 The Independence of Interagency Safety Review Observers have often described interagency reviews as independent. Past commentary on the process has asserted that a joint body for safety review naturally increases the independence of the review (Bennett, 1981, 432). This perception is justified by the panel's exclusive focus on risk assessmentrecommendations and risk-benefit analyses are the responsibility of individual agencies and authorities, rather than the representatives of the INSRP. In fact, the panel was cited as an example of an independent safety evaluation in a report on options for DOD licensing with the NRC (Pike and OReilly, 1982, 6-6), which highlighted that having three members typically ensured that one representative would be uninvolved in the mission being reviewed. According to one paper (Lee and Buden, 1994), all representatives were selected from their respective agencys oversight, Inspector General, or Safety Office (Lee and Buden, 1994, 5). Furthermore, the report stated that subpanels were composed of a cadre of independent technical experts drawn from academia, industry, national laboratories, and government and would be the individuals providing INSRP with its own analysis (Lee and Buden, 1994, 5-6).

18 The Cassini mission was a significant outlier, taking almost 8 years from the empanelment of the INSRP to the FSAR alone (Buenconsejo et al., 2018, 2).

4-13

During the 1986 congressional hearing on RTG use in space, the NASA INSRP Coordinator referred to the panel providing an independent evaluation of the risks associated with the launch of a nuclear power system in space (Government Printing Office, 1986, 59). The three agencies sponsored the subpanels, and the membership list provided revealed that the majority of the subpanel members were affiliated with various branches of each agency, though often in safety offices or research groups (Government Printing Office, 1986, 59, 65-71). All representatives agreed that, while they reported their activities to their respective agencies, they saw their work as a service for the OSTP rather than the DOE, the DOD, or NASA (Government Printing Office, 1986, 59, 73-74). The inclusion of the NRC, and later the EPA and the National Oceanic and Atmospheric Administration at times, further validated the independence of the panel (Bennett, 1987, 2).

The formulation of the INSRB under NSPM-20 does not explicitly mention the word independence (Trump, 2019), though it acknowledges this and emphasizes the need for the board to avoid, or at least be mindful of, representatives who may have vested interests in the reviewed mission. Vested interests are defined as involvement in mission planning and execution through the sponsoring agency or a subsidiary, with the aim of advancing the missions objectives. However, this definition excludes involvement in safety programs (INSRB, 2023, 15). The playbook also highlights the distinction between cooperation and collaboration, noting that collaboration may compromise independence, while cooperation is beneficial for the safety review process. To this end, the playbook envisions the INSRB as acting objectively and allowing the sponsoring agency to comment on its products while refraining from misrepresenting its findings to placate the reviewee (INSRB, 2023, 28). Further, the playbook provides guidance for raising safety issues and dissenting opinions from board and IRG members as well as invited subject matter experts.

4.3 The Development of Safety Evaluation Reports The SER summarizes the interagency safety review of the NPS conducted by various agencies.

It relies on the information presented in the sponsoring agencys SAR. Historically, the SAR process typically involved the development of three versions throughout the design process: the preliminary SAR, the updated SAR, and the FSAR. The preliminary SAR represented the design concept and included a PRA. Subsequently, the updated SAR was issued after a design freeze on the NPS, and then was typically finalized about a year before launch, incorporating testing results and updated data (Bennett, 1981, 430-431). While modern SARs may not adhere to this specific structure, they are still subject to revision throughout the process, allowing reviewers to provide comments and suggestions and initiating early SER development, which follows the FSAR or final draft.

4.3.1 Past Safety Evaluation Reports In the early days of the U.S. space nuclear program, the SNAP-10A safety program was initiated with a preliminary SAR. This report, along with parallel analytical studies, design finalization, environmental studies, and testing programs, contributed to the compilation of a final safeguards19 report (Atomics International, 1962). The manager of the AEC Space Nuclear Propulsion Office explained that the purpose of these reports was to ensure the reliability and 19 Safeguards reports were later renamed safety analysis reports.

4-14

full understanding of these systems. While tests were conducted under simulated conditions, the hardware used in actual missions remained untested (Finger, 1963, 34-35). The SNAP Aerospace Nuclear Safety Program, which predates PD/NSC-25, aimed to address hazards and ensure that radiological risk was within acceptable limits, as outlined in a summary of the SNAP programs (Berger et al., 1973, 192).

The INSRP has a primary objective of creating the SER, which serves as a final independent risk assessment by reviewing and summarizing the SARs and supplementary data and cited references (Bennett, 1981, 432). Even before the establishment of the INSRP, the AEC outlined the goals of such a process, which included ensuring public and personnel safety, gaining public confidence in the nuclear launch, retaining capable employees, and creating administrative efficiency (Ramey, 1963, 15-16). The SER does not make recommendations or analyze potential benefits; its sole purpose is to present an objective understanding of the risk of the mission. The original structure of the INSRP, consisting of three coordinating agencies, as mandated by PD/NSC-25, aimed to fulfill its purpose by involving two agencies with expertise in launches; namely, the DOD and NASA, along with the DOE, which held the responsibility for the safety of nuclear space power systems. This point was emphasized by the NASA Coordinator for the Galileo and Ulysses INSRP in a congressional hearing (Government Printing Office, 1986, 54, 59).

Many SARs and SERssuch as those of the MSL and Mars 2020 missionsare not publicly available. However, the publicly available SER of the Galileo mission presents a firsthand view of the content and format of the SER, albeit outdated. The first volume provides an overview of the reports purpose, a mission summary, all considered potential failures, the probabilities of these scenarios, their consequence, a comparison of the risk to those from other events, and a note on the spacecrafts LWRHUs (INSRP, 1989a). While it was customary to create a separate SAR for each new space nuclear system and its intended mission, only a single SAR was prepared for the LWRHUs during the Galileo safety review. The rationale behind this decision was that the devices were small, simple, and posed minimal risk, making a single report sufficient to address their safety (Johnson, 1985a, 5). The second volume of the Galileo SER provides a detailed account of the modifications made to the reviewed SARs and outlines the steps taken to finalize the SER for the launch approval review (INSRP, 1989b).

4.3.2 The INSRB Outline of Safety Evaluation Reports The INSRB playbook outlines future SERs consisting of six sections and the option to include additional appendices:

(1) an executive summary that includes the findings and out-of-scope aspects and that serves as a standalone document (2) a section summarizing NSPM-20 and the INSRBs role (3) a section providing a high-level overview of the mission, space nuclear system, spacecraft, launch vehicle, launch complex, etc. that are pertinent to understanding the results 4-15

(4) a section providing a high-level discussion of the review, activities, and areas left unreviewed (5) a section containing short descriptions of the topical areas reviewed, identifying any omissions, gaps, and recommended actions (6) a section describing a more holistic perspective on the quality of the safety analysis, how any identified omissions or gaps may affect the launch authorization decision, and those key aspects that are critical to the findings of the safety evaluation (INSRB, 2023, 44).

4.4 The U.S. Nuclear Regulatory Commissions Role in the Safety Review Process Although the NRC was established roughly a decade after the safety review process, nuclear regulatory organizations have been involved from the outset through the AEC, which handled matters related to the civilian use of atomic energy, including both regulation and development.

Over time, these two roles were separated, first by separating the AEC regulatory roles from the AEC general manager with both reporting directly to the AEC Commissioners, and then the establishment of the regulatory agency (the NRC) and the development agency (the ERDA, which the DOE quickly succeeded). The AEC played a significant role from the early stages of the space nuclear program, particularly in projects such as SNAP and the Rover/NERVA program, where it was responsible for developing the reactor and its controls (Finger, 1961, 54).

After the AECs abolition, many of its INSRP responsibilities were delegated to the DOE, with the NRC considered only an observer to the review panel (Pike and OReilly, 1982, 65). The NRC provided its expertise in safety review and experience with reactor licensing, giving it the general knowledge necessary for a risk assessment of a space nuclear launch. As an independent agency, the NRC remained unbiased in its observations of the panels activities and did not sponsor any missions of its own (Bennett, 1981, 432).

During the 1986 congressional hearing on space nuclear safety, the NASA INSRP Coordinator acknowledged that the NRC observer consistently attended the meetings before the development of the SER but remained passive in their involvement (Government Printing Office, 1986, 76). Fast forward 8 years to the Cassini review, the NRC and the INSRP reached an agreement that the agency could provide support through active participation in the panel, involvement in the subpanels, and contractor assistance for the subpanels (Taylor, 1995).

According to the former NRC representative to the Mars 2020 INSRP, the primary distinction in the agencys role had become the designation of technical advisor. Unlike the coordinators, the NRC did not have the responsibility of overseeing a specific subpanel (Helton, 2022).

Upon the establishment of the INSRB, the NRC assumed an equal membership position on the board alongside the members from the DOE, the DOD, NASA, the EPA, the DOS, and the DOT (Trump, 2019). In addition, while the commercial space nuclear industry is currently in its nascent stages at the time of this literature review, the NRC may play a role in a separate regulatory approval process for commercial missions in collaboration with the Federal Aviation Administration (FAA).

4-16

Expected to recover almost all of its costs with its own revenue (typically derived from licensing fees) under the Omnibus Budget Reconciliation Act of 1990, the NRC initially made a request for reimbursement to NASA during the Cassini mission, although no policy mandated NASA to fulfill this request (Taylor, 1995). However, under the INSRB process, reimbursement is no longer a concern for each review, as the sponsoring agency assumes the responsibility for such payments. It should be noted that participation in the boards ongoing activities currently does not entail reimbursement (INSRB, 2023, 33).

Given the agencys regulatory oversight of nuclear materials safety, the NRC served as an advisor to the INSRP several times, even before it was an equal member of the INSRB. In this new role, the agency faces interesting challenges of an unfamiliar environment and novel failure modes for the nuclear systems reviewed by the INSRB, as its oversight traditionally focuses on terrestrial reactor and nuclear materials systems.

4.5 Foreign and International Nuclear Mission Safety and Approval As of 2023, space nuclear system launches have been conducted exclusively by the United States and the former Soviet Union, resulting in limited availability of foreign launch safety documentation. The Soviet Union had a long record of launching SNRs and a few RTGs.

However, while the country would notify the international community of impending reentries and provide possible causes for these incidents, its government consistently declined to share the safety analyses or the launch approval process for the missions (Bennett, 1992a, 274).

Despite the rarity of national space nuclear programs, international commitments mandate safety procedures for all nations. The UNs COPUOS has been engaged in discussions in this field for decades, and the UNGA has passed a resolution describing the principles of NPS use.

COPUOS has established specific safety criteria for space nuclear launches, including radiological limits for accidents and design requirements, such as the containment of RPSs upon reentry (Bennett, 1992b). Before the adoption of the UNs Principles Relevant to the Use of Nuclear Power Sources in Outer Space (RES 47/68) in 1992 (UNGA, 1992), there were differing opinions within COPUOSa consensus-based bodyregarding the public availability of safety assessments, though the necessity of these assessments was acknowledged (Hodgkins et al., 1991, 1160).

RES 47/68, adopted by the UNGA in 1992, mandates the conduct of safety assessments for space launches and requires their public availability (UNGA, 1992). The resolution was adopted during the 47th UNGA plenary session without the need for a vote. Subsequently, the UN COPUOS STSC, in collaboration with the IAEA, developed an official framework that aligns with the INSRB review system (STSC and IAEA, 2009, 3-4).

The Working Group on the Use of Nuclear Power Sources in Outer Space (the Working Group),

established in 2000, continues its work as of 2023. Recently, the group published a report highlighting its efforts to promote the framework and suggesting potential updates to RES 47/68, as the resolution includes a provision for review and revision (The Working Group, 2023, 2).

The report acknowledges the adoption of new safety procedures by the United States and the Russian Federation, which are in alignment with the IAEA framework. It also notes the involvement of the ESA and China in working within the framework.

4-17

Regarding the proposed changes to RES 47/68, the report argues that certain sections of the document contain outdated information and address topics beyond the scope of the IAEA safety framework. It recommends the inclusion of a requirement for public safety assessments, as the current framework lacks such a provision. The report also highlights the need to update the requirements for end-of-life NPS applications and addresses the challenge faced by countries with limited experience in space nuclear system safety, emphasizing the difficulty they may encounter in establishing their own safety programs based solely on the existing published guidance (The Working Group, 2023).

4-18

5 CONCLUSIONS This literature review identified a significant number of past documents that demonstrate the safety analysis of space nuclear system launches, along with the subsequent evaluation and safety review process. Although the state of knowledge evolves over time, and new system designs for the power sources, launch vehicles, and spacecraft may modify the safety considerations, past literature is invaluable for future activities. It can inform future analyses of past methods and findings that may be applicable, demonstrate past approaches to recurring challenges, and serve as either a guide or warning due to past historical events.

Despite the changes associated with NSPM-20, it is anticipated that future safety analyses for RPS systems will adhere to similar methodologies and formats as observed in recent launches, such as the MSL and Mars 2020, as indicated by preliminary Dragonfly documents (McHugh and Wheeler, 2021). Consequently, these recent reports serve as examples of the analyses that the board will evaluate and review. Even as some reports become dated and describe systems that have long been redesigned, the methodology and, when included, testing data of these documents may yet be useful for future analysis. There are, however, certain aspects that the INSRB can only grasp through firsthand experience.

The INSRB cannot undertake extensive analyses of these missions. Instead, the board can leverage its expertise to assess and evaluate the quality of the submitted safety analyses and supplemental materials as outlined in NSPM-20 and the INSRB Playbook. Due to its experience in PRAs and nuclear safety analysis, the NRC is likely prepared for the field of space nuclear system SARs reviews, despite the unique accident environments involved.

The challenges that the INSRB will confront can only be fully understood once the safety review process begins. Nevertheless, the following sections aim to summarize potential challenges that both the INSRB and the field of safety review for space nuclear systems may encounter, with possible involvement by the NRC.

5.1 Possible Challenges for the Space Nuclear Safety Field With the U.S. space program venturing into a new era of nuclear systems, which may encompass the implementation of nuclear thermal and electric propulsion (NTP and NEP) technologies, along with the reintroduction of SNRs for space travel and exploration, numerous uncertainties may arise within the novel safety review process, as suggested by the literature, both directly and indirectly.

5.1.1 Lack of Direct Safety Review Experience While INSRPs of the past conducted numerous safety reviews and established a standardized system for safety analysis review, the INSRB now faces new requirements outlined in NSPM-20 (as listed in section 4.1.2) and includes new members that may lack practical experience in launch safety reviews. Reviews of the literature and the experience of the members from past reviews will help combat this, but as most future guidance remains, at this time, in preliminary stages, the new process may incur unexpected challenges.

5-1

5.1.2 Return of Space Fission Reactors Although the United States has prior experience with launching SNRs through the SNAPSHOT mission in 1965 (JHU/APL, 2015), any future mission involving SNRs will be the Nations first reactor launch in over 50 years and the first mission subject to modern requirements for space nuclear system launch reviews. It is important to note that no INSRP has ever reviewed SNRs, which means that the INSRB lacks reference documents for conducting future safety reviews of these systems. Fortunately, there are many documents examining the safety of these systems (e.g., Alexander et al., 1965; McClure, 2018; Camp et al., 2019a) that will help the INSRB prepare for these safety reviews even before they begin.

5.1.3 Use of Nuclear Power for Propulsion To date, the United States has not launched an NTP or NEP system. However, previous projects have explored the safety considerations for these systems, including Rover/NERVA, SP-100, and Project Prometheus (Bragg-Sitton et al., 2011). In addition, more recent missions such as Kilopower, Fission Surface Power, NTP Program, and DRACO missions (Camp et al.,

2019a; Greiner, 2021) have undergone safety analyses to varying extents, including integrated risk assessments with launch systems. While none of these projects represent a comprehensive SAR that would be subject to an INSRB review, they provide insights into the potential content and issues that may arise. In addition to the risks associated with SNRs, there may be other hazards, such as those related to exhaust (Tarves, 2004).

5.1.4 International Commitments and Cooperation The United States and the former Soviet Union have taken the lead in analyzing and reviewing the safety of NPSs for planned launches, making them the only nations to have done so.

However, other space agencies are now preparing to enter the field of space nuclear systems, indicating a potential expansion in the use of nuclear systems in outer space. This expansion could result in increased international cooperation and scrutiny, similar to what occurred in the 1980s at the height of Soviet involvement in the field (Bennett, 1992a). The specific nature of these interactions is currently uncertain, and how new international commitments and collaborations with other space and nuclear agencies will shape the landscape remains to be seen. These developments may present novel challenges that need to be addressed by the relevant stakeholders.

5.1.5 Commercial Space Nuclear System Policy The commercial review field needs to gain experience conducting safety assessments even more than the government-sponsored mission reviews. The collaboration and coordination between the DOT/FAA and other agencies or the INSRB to carry out safety reviews still need to be clarified (INSRB, 2023). Considering the NRCs responsibility for regulating non-DOE commercial nuclear systems and fuel, the agency may oversee these systems as long as they remain on the ground. However, the regulation of commercial space launches involving nuclear systems will be new territory for both the NRC and other involved agencies, and there are numerous uncertainties and unfamiliar aspects that may need to be addressed.

5-2

5.2 Recommendations for Further Literature Review Further consultation of the literature cited in this report and additional reports not covered in this literature review may benefit the SNR safety analysis and review field. This includes past reports, such as the safety analyses of the SNAP-10A reactor (Willis, 1963; Atomics International, 1964; Alexander, 1964; Alexander et al., 1965), which, despite being dated, provide the only example of an SNR launched by the United States. In addition, the risk analysis for the SP-100 reactor by Bartram and Weitzberg (1988) and more recent reports such as Camp et al.s Fission Reactor Inadvertent Reentry (2019), Camps Risk Assessment Metrics for NASA Fission Reactor Applications (2021), and Kilopowers criticality accident study (McClure, 2018) can be useful resources.

It is worth noting that other reports may not be publicly available but could still hold valuable insights. For those conducting future safety analyses and evaluations, it would be prudent to refer to past documents for reference and comparison.

NTP and NEP pose additional challenges compared to SNRs because of their increased complexity or unique risks (e.g., the radiological exhaust of NTP systems). While there is limited literature analyzing the safety of nuclear propulsion systems, practical experience is likely to provide more relevant information on this topic than a further literature review.

In the field of space nuclear systems, there are already existing international commitments.

However, new missions and uses may lead to changes and new agreements. Reviewing past interactions in the field, as reported by Bennett (1992b; 1995; 1996), as well as the results of the UN and COPUOS themselves (UNGA, 1992; STSC and IAEA, 2009) may provide valuable context. However, it is important to recognize that these sources may not necessarily reflect the future international policy in this domain.

As noted in section 1.2, this report does not represent a comprehensive summary of the full set of information that may be available. Developing a more comprehensive NUREG/KM report for knowledge management would be beneficial.

5-3

6 REFERENCES Alexander, R.E. 1964. SNAP 10A Launch and Reentry Hazards Due to Steady-State Operation. NAA-SR-MEMO-8972. Canoga Park, California: Atomics International.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/NAASRMEMO8972.xhtml.

Alexander, R.E., R. Elms, W.T. Harper, R.S. Hart, W.F. Heine, G.P. Kenfield, W.R. Lahs, et al.

1965. Final SNAPSHOT Safeguards Report. NAA-SR-10022, LMSC B-107701.

Canoga Park, California: Atomics International.

Atomics International. 1962. SNAPSHOT Safety Program Plan. NAA-SR-MEMO-7399.

Canoga Park, California.

. 1964. SNAP 10A Powered Meteorological Satellite Study. NAA-SR-9892. Canoga Park, California. https://doi.org/10.2172/4591600.

Bartram, B.W., and A. Weitzberg. 1988. Radiological Risk Analysis of Potential SP-100 Space Mission Scenarios. NUS-5125. Gaithersburg, Maryland: NUS Corporation.

https://doi.org/10.2172/7109343.

Bartram, B.W., and D.K. Dougherty. 1987. A Long Term Radiological Risk Model for Plutonium-Fueled and Fission Reactor Space Nuclear System. DOE/ET/32079-2, NUS-3845, 6120678. Rockville, Maryland: NUS Corp. https://doi.org/10.2172/6120678.

Bechtel, Ryan. "Multi-Mission Radioisotope Thermoelectric Generator (MMRTG)." 2011.

Washington, DC: U.S. Department of Energy Office of Nuclear Energy.

https://www.nasa.gov/sites/default/files/files/4_Mars_2020_MMRTG.pdf.

Bennett, Gary L. 1981. Overview of the U.S. Flight Safety Process for Space Nuclear Power.

Edited by J.R. Buchanan. Nuclear Safety, General Safety Considerations, 22 (4):

423-34. United States.

. 1987. Flight Safety Review Process for Space Nuclear Power Sources. In Energy New Frontiers. Philadelphia, Pennsylvania: American Institute of Aeronautics and Astronautics. https://doi.org/DOI: 10.2514/6.1987-9046.

. 1990. Safety Status of Space Radioisotope and Reactor Power Sources. In Twenty-Five Years of Progress and Future Prospects, 162-67. Reno, Nevada: IEEE.

https://doi.org/DOI: 10.1109/IECEC.1990.716860.

. 1992a. Soviet Space Nuclear Reactor Incidents: Perception Versus Reality. In Space Nuclear Power Systems 1989, edited by M.S. El-Genk and M.D. Hoover, 10:273-78.

Space Nuclear Power Systems. Malabar, Florida: Orbit Book Company.

https://ui.adsabs.harvard.edu/abs/1992snpw.conf..273B/abstract.

. 1992b. The 1981 United Nations Report: An Historical Consensus on the Safe Use of Nuclear Power Sources in Space. In AIP Conference Proceedings, 246:662-67.

Albuquerque, New Mexico: American Institute of Physics.

https://doi.org/10.1063/1.41912.

. 1995. A Technical Review of the U.N. Principles on the Use of Nuclear Power Sources in Outer Space. Oslo, Norway: International Astronautical Federation.

https://nuke.fas.org/space/technical.pdf.

. 1996. Summary of the U.S. Ad Hoc Working Group Meeting on Revising the U.N.

Principles on the Use of Nuclear Power Sources in Outer Space. In 39th International Colloquium on the Law of Outer Space. Beijing, China: International Astronautical Federation. https://nuke.fas.org/space/adhoc.pdf.

Berger, S., K.E. Buttrey, C.R. Davidson, A.A. Jarrett, R.P. Johnson, A.R. Marchese, N.C. Miller, et al. 1973. SNAP Programs Summary Report. AI-AEC-13067. Canoga Park, California: Atomics International Division Rockwell International.

Bessette, Gregory C., Nathan E. Bixler, John C. Hewson, David G. Robinson, Donald L. Potter, Dana A. Powers, Christopher B. Atcitty, et al. 2006. Methodology Assessment and 6-1

Recommendations for the MSL Safety Analysis. SAND2006-4563. Albuquerque, New Mexico: Sandia National Laboratories.

Bishop, Tracey. 2021. "DOE Space Nuclear Power and Propulsion (SNPP) Activities."

Presented at the NRC Regulatory Information Conference, March 10. (Agencywide Documents Access and Management System Accession No. ML21095A119)

Bixler, Nathan E., Chris J. Clutz, Nelson A. Deane, Darryl G. Hoover, and Ronald J. Lipinski.

2013. Probabilistic Risk Assessment and Its Application to the Mission to Mars.

SAND2013-1462C. Albuquerque, New Mexico: Sandia National Laboratories.

Blake, V.E. 1965. "Aerospace Nuclear Safety." Albuquerque, New Mexico: Sandia National Laboratories.

Bragg-Sitton, Shannon M., James E. Werner, Stephen G. Johnson, Donald T. Palac, Lee S. Mason, David I. Poston, and A. Lou Qualls. 2011. Ongoing Space Nuclear Systems Development in the United States, 12. Idaho Falls, Idaho: Idaho National Lab.

https://www.osti.gov/biblio/1037786.

Brzezinski, Zbigniew. 1977. Scientific or Technological Experiments with Possible Large-Scale Adverse Environmental Effects and Launch of Nuclear Systems into Space.

PD/NSC-25. Washington, DC. https://irp.fas.org/offdocs/pd/pd25.pdf.

Buckalew, William, David Byrne, and Robert Halsey. 1964. Safety Analysis of the Operational SNAP-9A System. SC-RR-64-65. Albuquerque, New Mexico: Sandia Corporation.

https://doi.org/10.2172/4178595.

Buden, David. 1993. Summary of Space Nuclear Reactor Power Systems (1983-1992). In Albuquerque, New Mexico. https://www.osti.gov/biblio/10151265.

Buenconsejo, Reina, Susannah Howieson, Jonathan Behrens, and Bhavya Lal. 2018.

Evolution of the Space Nuclear Launch Safety Review Process. LaGrange Park, Illinois: American Nuclear Society.

Bundy, McGeorge. 1961. Official Announcements of Launching into Space of Systems Involving Nuclear Power in Any Form. NSAM-50. Washington, DC.

https://irp.fas.org/offdocs/nsam-jfk/nsam50.jpg.

Burke, E.R., and R.G. Illing. 1968. Aerospace Nuclear Safety Report for May 1968. SC-PR 409. Albuquerque, New Mexico: Sandia National Laboratories.

https://doi.org/10.2172/4220937.

Calomino, Anthony. 2021. Space Nuclear Power and Propulsion (SNPP). Presented at the NRC Regulatory Information Conference, March 10. (Agencywide Documents Access and Management System Accession No. ML21095A118).

Camp, Allen. 2021. Risk Assessment Metrics for NASA Fission Reactor Applications.

NASA/CR-20210017811. Hampton, Virginia: National Aeronautics and Space Administration. https://ntrs.nasa.gov/citations/20210017811.

Camp, Allen, Elan Borenstein, Patrick McClure, Paul VanDamme, Susan Voss, and Andy Klein.

2019a. Fission Reactor Inadvertent Reentry: A Report to the Nuclear Power &

Propulsion Technical Discipline Team. NASA/CR-2019-220397. Hampton, Virginia:

National Aeronautics and Space Administration.

https://ntrs.nasa.gov/citations/20190030875.

Camp, Allen, Andy Klein, Patrick McClure, Peter McCallum, and Susan Voss. 2019b. Potential Improvements to the Nuclear Safety and Launch Approval Process for Nuclear Reactors Utilized for Space Power and Propulsion Applications: A Report to the Nuclear Power &

Propulsion Technical Discipline Team. NASA/TM-2019-220256. Hampton, Virginia:

National Aeronautics and Space Administration.

https://ntrs.nasa.gov/citations/20190001430.

Central Intelligence Agency (CIA). 1991. The Soviet Space Nuclear Power Program.

C05617906. Langley, Virginia.

https://www.archives.gov/files/declassification/iscap/pdf/2011-099-doc01.pdf.

6-2

Chang, Yale. 2021. Considerations for Implementing Presidential Memorandum-20 Guidelines for Nuclear Safety Launch Authorization for Future Civil Space Missions. Presented at Nuclear and Emerging Technologies for Space 2021, April 26-30. Oak Ridge, Tennessee: Oak Ridge National Laboratory. https://nets2021.ornl.gov/wp-content/uploads/gravity_forms/12-b63a96649a525ab5aa39d607840d9d9f/2021/04/NETS2021_Chang_20210423_Final_D istro_A.pdf.

Clayton, D.J., G.M. Lucas, and T.E. Radel. 2012. Resulting Source Term from the Mars Science Laboratory Safety Analysis, 2. Albuquerque, New Mexico: Sandia National Laboratories. https://www.osti.gov/biblio/1118426.

Clayton, Daniel, John Bignell, Christopher Jones, Daniel Rohe, Gregg Flores, Timothy Bartel, Fred Gelbard, et al. 2014. Nuclear Risk Assessment for the Mars 2020 Mission Environmental Impact Statement. SAND2013-10589. Albuquerque, New Mexico:

Sandia National Laboratories. https://doi.org/10.2172/1160266.

Corliss, William R. 1966. SNAP: Nuclear Space Reactors. 1st ed. Understanding the Atom.

Washington, DC: Atomic Energy Commission. https://www.osti.gov/biblio/1132526.

. 1971. Nuclear Reactors for Space Power. 2nd ed. Understanding the Atom.

Washington, DC: Atomic Energy Commission. https://www.osti.gov/biblio/1132520.

Cropp, Louis O. 1984. Safety Program Considerations for Space Nuclear Reactor Systems.

SAND-84-1653. Albuquerque, New Mexico: Sandia National Laboratories.

https://doi.org/10.2172/6409191.

Department of Energy, U.S. (DOE). 1987a. Atomic Power in Space: A History. DE87-010618.

Washington, DC: Planning & Human Systems, Inc. https://inl.gov/research-program/space-power-systems/.

. 1987b. SP-100 Space Reactor Safety. DE/NE-0083. Washington, DC.

https://doi.org/10.2172/6434038.

. 2013. "AEC - REACTOR DEVELOPMENT." Washington, DC.

https://www.flickr.com/photos/departmentofenergy/albums/72157637416489424/with/10 950676473/.

Dix, George P. 1959. Preliminary Operational Hazards Summary Report for the Task 2 Thermoelectric Generator. MND-P-2184. Baltimore, Maryland: Martin Nuclear Division.

https://doi.org/10.2172/4056522.

. 1960. Final Safety Analysis Report - SNAP 1A Radioisotope Fueled Thermoelectric Generator. MND-P-2352. Baltimore, Maryland: Martin Nuclear Division.

https://doi.org/10.2172/4126890.

Dix, George P., Thaddeus J. Dobry, and Paul Guinn. 1959. SNAP-III: Thermoelectric Generator Radiological Safety Analysis. MND-P-2513. Baltimore, Maryland: Martin Nuclear Division. https://doi.org/10.2172/4288904.

Finger, H.B. 1963. The NASA Aerospace Nuclear Safety Philosophy. In Aerospace Nuclear Safety, 33-37. SC-DC-3553. Albuquerque, New Mexico: Sandia Corporation.

https://doi.org/10.2172/4112071.

Finger, Harold B. 1961. Nuclear Propulsion for Space Vehicles. In Proceedings of First National Conference on the Peaceful Uses of Space, 53-63. Proceedings of the First International Conference on the Peaceful Uses of Space. Tulsa, Oklahoma: National Aeronautics and Space Administration.

Frank, Michael V. 2000. Probabilistic Analysis of the Inadvertent Reentry of the Cassini Spacecrafts Radioisotope Thermoelectric Generators. Risk Analysis 20 (2): 251-60.

Hoboken, New Jersey: Wiley-Blackwell. https://doi.org/10.1111/0272-4332.202024.

Gibson, Marc A., David I. Poston, Patrick McClure, Thomas J. Godfroy, Maxwell H. Briggs, and James L. Sanzi. 2018. Kilopower Reactor Using Stirling TechnologY (KRUSTY) Nuclear Ground Test Results and Lessons Learned. NASA/TM-2018-219941. Cleveland, Ohio:

6-3

National Aeronautics and Space Administration Glenn Research Center.

https://ntrs.nasa.gov/citations/20180007389.

Goldman, Marvin, Robert C. Nelson, Lance Bollinger, Mark D. Hoover, William Templeton, and Lynn Anspaugh. 1991. Potential Health Risks from Postulated Accidents Involving the Pu-238 RTG on the Ulysses Solar Exploration Mission. In AIP Conference Proceedings, 217:152-64. Albuquerque, New Mexico: American Institute of Physics.

https://doi.org/10.1063/1.40028.

Government Printing Office, U.S. 1986. Review of RTG Utilization in Space Missions.

Washington, DC.

Graves, G.A. 1971. Nuclear Safety in Nuclear Power and Propulsion Devices for Space.

LA-DC-72-1480. Los Alamos, New Mexico: Los Alamos Scientific Laboratory.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/LADC721480.xhtml.

Greiner, Nathan. 2021. DRACO Program Overview. Presented at the NRC Regulatory Information Conference, March 10. (ML21095A117).

Hagis, W., and George P. Dix. 1960. Final Safety Analysis Report: SNAP III Thermoelectric Generator. MND-P-2364. Baltimore, Maryland: Martin Nuclear Division.

https://doi.org/10.2172/4110813.

Hardy, E.P., P.W. Krey, and H.L. Volchok. 1972. Global Inventory and Distribution of Pu-238 from SNAP-9A. HASL-250. New York, New York: United States Atomic Energy Commission. https://doi.org/10.2172/4689831.

Hargrove, H.G., and M.R. Trammell. 1964. Effect of Orbital Destruct of Nuclear Rockets on Earth Contamination. WANL-TME-896. Pittsburg, Pennsylvania: Westinghouse Electric Corp. https://doi.org/10.2172/4186259.

Hart, R.S., K.E. Buttrey, W.F. Heine, W.R. Lahs, and W.B. Sayer. 1965. Final Snapshot Safeguards Report: Addendum I. NAA-SR-10022, Add. 1 (Rev.). Canoga Park, California: Atomics International. https://doi.org/10.2172/4480423.

Helton, Don. 2022. Nuclear Flight Safety Officer, Office of Safety and Mission Assurance, National Aeronautics and Space Administration, in discussion with the author. August.

Helton, Don, and Michael Witmer. 2023. Technical Basis Related to the Posture of NASAs Office of Safety and Mission Assurance for the Launch of Radioactive Material Other than Space Nuclear Systems: Volume 1-Overview of Analysis and Results.

Washington, DC. https://ntrs.nasa.gov/citations/20230002528.

Hodgkins, Kenneth D., Robert Lange, and Bruce C. Rashkow. 1991. United Nations Consideration of the Use of Space Nuclear Power. In AIP Conference Proceedings, 1159-63. Albuquerque, New Mexico: American Institute of Physics. https://doi.org/DOI:

10.1063/1.40080.

Holtzscheiter, E.W., Dermond Kelleher, G.W. Mitchell, Michael L. Crawford, and J.A. Sholtis.

1977. Safety Methodology for Space Nuclear Systems. AFWL-TR-77-104. Kirtland Air Force Base, New Mexico: Air Force Weapons Laboratory.

https://www.osti.gov/biblio/6816727.

International Atomic Energy Agency (IAEA). 1990. Regulations for the Safe Transport of Radioactive Material, 1985 Edition (As Amended 1990). Vienna, Austria: IAEA.

https://gnssn.iaea.org/Superseded%20Safety%20Standards/Safety_Series_006_1990.p df.

. 2018. "Regulations for the Safe Transport of Radioactive Material, 2018 Edition."

Vienna, Austria: IAEA. https://www-pub.iaea.org/MTCD/Publications/PDF/PUB1798_web.pdf.

Idaho National Laboratory (INL). 2015. Atomic Power in Space II: A History of Space Nuclear Power and Propulsion in the United States. INL/EXT-15-34409. Idaho Falls, Idaho.

https://inl.gov/research-program/space-power-systems/.

6-4

Interagency Nuclear Safety Review Board (INSRB). 2022. Charter of the Interagency Nuclear Safety Review Board. Washington, DC. https://sma.nasa.gov/docs/default-source/sma-disciplines-and-programs/nuclear/insrb-charter---508d.pdf.

. 2023. Interagency Nuclear Safety Review Board (INSRB) Playbook: Non-binding Guidance for INSRB and Its Counterparts. Revision 2. January 20. Washington, DC.

https://sma.nasa.gov/docs/default-source/sma-disciplines-and-programs/nuclear/insrb-playbook-rev1-508.pdf.

Interagency Nuclear Safety Review Panel (INSRP). 1989a. Safety Evaluation Report for Galileo: Volume 1. INSRP-89-01. Livermore, California: Published as UCID-21775-V1 by the Lawrence Livermore National Laboratory. September 1989.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/DE90003086.xhtml

. 1989b. Safety Evaluation Report for Galileo: Volume 2. INSRP-89-01. Livermore, California: Published as UCID-21775-V2 by the Lawrence Livermore National Laboratory. September 1989.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/DE90003087.xhtml

. 1989c. Biomedical and Environmental Effects Subpanel Report for Galileo.

INSRP-89-06. Livermore, California: Lawrence Livermore National Laboratory.

https://doi.org/10.2172/5038882.

The Johns Hopkins University Applied Physics Laboratory (JHU/APL). 2015. Nuclear Power Assessment Study: Final Report. TSSD-23122. Laurel, Maryland.

https://rps.nasa.gov/system/downloadable_items/37_NPAS_Final_Report.pdf.

Johnson, Ernest W. 1985a. Light-Weight Radioisotope Heater Unit Safety Analysis Report (LWRHU-SAR): Volume I. A. Introduction and Executive Summary, B. Reference Design Document (RDD). MLM-3293. Miamisburg, Ohio: Mound.

https://doi.org/10.2172/5063463.

. 1985b. Light-Weight Radioisotope Heater Unit Safety Analysis Report (LWRHU-SAR):

Volume II. Accident Model Document. MLM-3293. Miamisburg, Ohio: Mound.

https://doi.org/10.2172/6354684.

. 1988a. Light-Weight Radioisotope Heater Unit Final Safety Analysis Report (LWRHU-FSAR): Volume 1. MLM-3540. Miamisburg, Ohio: Mound.

https://doi.org/10.2172/6622379.

. 1988b. Light-Weight Radioisotope Heater Unit Final Safety Analysis Report (LWRHU-FSAR): Volume 2. MLM-3540. Miamisburg, Ohio: Mound.

https://doi.org/10.2172/6531256.

. 1988c. Light-Weight Radioisotope Heater Unit Final Safety Analysis Report (LWRHU-FSAR): Volume 3. MLM-3540. Miamisburg, Ohio: Mound.

https://doi.org/10.2172/6533509.

Johnson, Alana, Grey Hautaluoma, and D.C. Agle. 2020. NASA, ULA Launch Mars 2020 Perseverance Rover Mission to Red Planet. National Aeronautics and Space Administration. Last modified January 4, 2021. https://www.nasa.gov/press-release/nasa-ula-launch-mars-2020-perseverance-rover-mission-to-red-planet.

Kastenberg, W.E., and Richard Wilson. Risk of Nuclear Powered Space Probes. Reliability Engineering & System Safety 86, no. 1 (2004): 53-59. Amsterdam, Netherlands:

Elsevier. https://doi.org/10.1016/j.ress.2003.12.006.

Kennedy, John F. 1963. Large-Scale Scientific or Technological Experiments with Possible Adverse Environmental Effects. NSAM-235. Washington, DC.

https://irp.fas.org/offdocs/nsam-jfk/nsam-235.htm.

Klein, L.T. 1960. Interim Report on Safety Procedures for the Task 2 Thermoelectric Generator. MND-P-2335. Baltimore, Maryland: Martin Nuclear Division.

https://doi.org/10.2172/4090511.

6-5

Knighton, Daniel. 1960. Preliminary Operational Safety Report for the TASK 5.6 Thermoelectric Generator. MND-P-2356. Baltimore, Maryland: Martin Nuclear Division.

https://doi.org/10.2172/4105882.

Launius, Roger D. 2015. Powering Space Exploration: U.S. Space Nuclear Power, Public Perceptions, and Outer Planetary Probes. In Historical Studies in the Societal Impact of Spaceflight, edited by Steven J. Dick. Washington, DC: National Aeronautics and Space Administration.

https://www.nasa.gov/connect/ebooks/historical_studies_societal_impact_spaceflight_de tail.html.

Lee, James H., and Dave Buden. 1994. Aerospace Nuclear Safety: An Introduction and Historical Overview. Presented at the International topical meeting on the safety of advanced reactors, April 18-20. Pittsburgh, Pennsylvania.

https://www.osti.gov/biblio/10138155.

Lenard, Roger X. 2008. Nuclear Safety: Legal Aspects and Policy Recommendations. In Nuclear Space Power and Propulsion Systems, edited by Claudio Bruno, 203-44.

Reston, Virginia: American Institute of Aeronautics and Astronautics.

https://doi.org/10.2514/4.860096.

Marshall, Albert C. 1995. Space Reactor Safety, 1985-1995 Lessons Learned. SAND95-2362C. Albuquerque, New Mexico: Sandia National Laboratories.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/DE96002073.xhtml.

Martin Nuclear Division (MND). 1960. Preliminary Safety Analysis: Low Power Cerium-144 Generator. MND-P-2363. Baltimore, Maryland: Martin Nuclear Division.

https://doi.org/10.2172/4123642.

. 1964. Feasibility of Isotopic Power for Manned Lunar Missions: Volume 2 - Mission, Fuel, and Nuclear Safety and Radiation. MND-3296-2. Baltimore, Maryland: Martin Nuclear Division. https://doi.org/10.2172/4657806.

McClure, Patrick Ray. 2018. Kilopower Space Reactor Launch SafetyMaximum Credible Dose for a Criticality Accident. LA-UR-18-28899. Los Alamos, New Mexico: Los Alamos National Laboratory. https://doi.org/10.2172/1473765.

McHugh, Caleb, and Tammy Wheeler. 2021. Radiological Consequence Evaluation for Dragonfly Mission. INL/EXT-21-65050 REV0. Idaho Falls, Idaho: Idaho National Laboratory. https://doi.org/10.2172/1835103.

National Aeronautics and Space Administration (NASA). 2021. Kilopower. Space Technology Mission Directorate. Last modified October 18, 2021.

https://www.nasa.gov/directorates/spacetech/kilopower.

. 2022. Fission Surface Power. Space Technology Mission Directorate. Last modified August 3, 2022. https://www.nasa.gov/mission_pages/tdm/fission-surface-power/index.html.

. 2023a. NASA, DARPA Will Test Nuclear Engine for Future Mars Missions. Last modified January 24, 2023. https://www.nasa.gov/press-release/nasa-darpa-will-test-nuclear-engine-for-future-mars-missions.

. 2023b. Thermal Systems: General Purpose Heat Source. Radioisotope Power Systems. Accessed June 13, 2023. https://rps.nasa.gov/power-and-thermal-systems/thermal-systems/general-purpose-heat-source/.

National Aeronautics and Space Council. 1970. "Nuclear Safety Review and Approval Procedures for Minor Radioactive Sources in Space Operations." Washington, DC:

National Aeronautics and Space Council.

NUS Corporation. 1990. Safety Status Report for the Ulysses Mission: Summary.

DE90006828. Gaithersburg, Maryland: NUS Corp.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/DE90006828.xhtml.

6-6

Obama, Barack. 2010. National Space Policy of the United States of America. Washington, DC.

https://irp.fas.org/offdocs/ppd/ppd-4-nsp.pdf.

Office of Commercial Space Transportation (OCST). 1990. Space Applications of Radioactive Materials. Huntsville, Alabama: SRS Technologies.

https://www.faa.gov/about/office_org/headquarters_offices/ast/media/radedits.pdf.

Office of Space Science (OSS). 1997. Final Supplemental Environmental Impact Statement for the Cassini Mission. NASA/TM-1997-111474/SUPPL1. Washington, DC: National Aeronautics and Space Administration. https://ntrs.nasa.gov/citations/19990054126.

Office of Space Science and Applications. 1989. Mission Operation Report: Galileo. E-829 89-89-01. Washington, DC: National Aeronautics and Space Administration.

Pike, W.J., and P.D. OReilly. 1982. NRC Licensing Requirements: DOD Options.

DE87-010471. Gaithersburg, Maryland: NUS Corporation.

https://doi.org/10.2172/5900539.

Pittman, F.K. 1963. AEC Aerospace Safety Programs and Philosophy. In Aerospace Nuclear Safety, 39-45. SC-DC-3553. Albuquerque, New Mexico: Sandia Corporation.

https://doi.org/10.2172/4112071.

Pressyl, C., M. Panicucci, and P. Peltonen. 1992. Safety Risk Assessment for ESA Space Programmes. In Use of Probabilistic Safety Assessment for Operational Safety:

PSA91, 279-89. Vienna, Austria: International Atomic Energy Agency.

Ramey, James T. 1963. Aerospace Nuclear SafetyLessons from Civilian and Military Reactor Experience. In Aerospace Nuclear Safety, 7-16. SC-DC-3553. Albuquerque, New Mexico: Sandia Corporation. https://doi.org/10.2172/4112071.

Riggs, Cecil O. 1960. Curium Fueled Generators for Lunar and Space Missions: Preliminary Safety Analysis Report. MND-P-2366. Baltimore, Maryland: Martin Company, Nuclear Division. https://doi.org/10.2172/4108003.

Robinson, David G. 2012. Mars Science Laboratory Launch Risk Analysis Summary.

SAND2012-1151C. Albuquerque, New Mexico: Sandia National Laboratories.

https://www.osti.gov/biblio/1118349.

Schmidt, George R., Thomas J. Sutliff, Leonard Duddzinski. 2009. Radioisotope Power: A Key Technology for Deep Space Explorations. Presented at the 60th International Astronautical Congress, October 12. https://ntrs.nasa.gov/citations/20120016365.

Science Mission Directorate (SMD). 2005. Final Environmental Impact Statement for the New Horizons Mission, Volume 1: Executive Summary and Chapters 1 Through 8.

Washington, DC: National Aeronautics and Space Administration.

http://pluto.jhuapl.edu/Mission/Spacecraft/docs/NH-FEIS_Vol1.pdf.

. 2006. Final Environmental Impact Statement for the Mars Science Laboratory Mission, Volume 1: Executive Summary and Chapters 1 Through 8. Washington, DC: National Aeronautics and Space Administration. https://netspublic.grc.nasa.gov/main/MSL-FEIS_Vol1.pdf.

. 2014. Final Environmental Impact Statement for the Mars 2020 Mission.

Washington, DC: National Aeronautics and Space Administration.

https://mars.nasa.gov/mars2020/files/mep/Mars2020_Final_EIS.pdf.

Sholtis, Joseph A., Leven B. Gray, Darrell A. Huff, Norman P. Klug, and Robert O. Winchester.

1991. Conduct and Results of the Interagency Nuclear Safety Review Panels Evaluation of the Ulysses Space Mission. In AIP Conference Proceedings, 217:132-39.

Albuquerque, New Mexico: AIP. https://doi.org/DOI: 10.1063/1.40036.

Stewart, John. 1964. Progress Report: SNAP 10A Nuclear Auxiliary Power Unit Development:

October-December 1963. NAA-SR-9293. Canoga Park, California: Atomics International. https://doi.org/10.2172/4471128.

6-7

Tarves, Shaun. 2004. Risk Management Policy of Space Nuclear Power Systems: An Examination of Past and Current Methods & Recommendation for Future Policy. La Grange Park, Illinois: American Nuclear Society and Nuclear Energy Institute.

Taylor, James M., Executive Director for Operations, NRC, to Daniel S. Goldin, Administrator, NASA Headquarters, January 9, 1995. (ML031770485).

Trump, Donald. 2019. National Security Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Systems. NSPM-20. August 20. Washington, DC.

https://trumpwhitehouse.archives.gov/presidential-actions/presidential-memorandum-launch-spacecraft-containing-space-nuclear-systems/.

United Nations Committee on the Peaceful Uses of Outer Space, Scientific and Technical Subcommittee (STSC), and International Atomic Energy Agency (IAEA). 2009. Safety Framework for Nuclear Power Source Applications in Outer Space. A/AC.105/934.

Vienna, Austria. https://www.unoosa.org/pdf/reports/ac105/AC105_934E.pdf.

United Nations General Assembly (UNGA). 1992. Principles Relevant to the Use of Nuclear Power Sources in Outer Space. Resolution 47/68. New York, New York.

https://www.unoosa.org/pdf/gares/ARES_47_68E.pdf.

Voegeli, Nathan. 2007. Space Nuclear Reactors: History and Emerging Policy Issues. The Nonproliferation Review 14 (1): 163-75. Abingdon, United Kingdom. https://doi.org/DOI:

10.1080/10736700601178648.

Voss, Susan S. 1984. SNAP Space Nuclear Auxiliary Power Reactor Overview.

AFWL-TN-84-14. Fort Belvoir, Virginia: Defense Technical Information Center.

https://apps.dtic.mil/sti/citations/ADA146831.

Willis, C.A. 1963. Radiological Hazards Comparison of SNAP 9A to SNAP 10A.

NAA-SR-MEMO-9258. Canoga Park, California: Atomics International.

https://www.osti.gov/biblio/982044.

The Working Group on the Use of Nuclear Power Sources in Outer Space (The Working Group). 2023. Final report on the implementation of the Safety Framework for Nuclear Power Source Applications in Outer Space and recommendations for potential enhancements of the technical content and scope of the Principles Relevant to the Use of Nuclear Power Sources in Outer Space. A/AC.105/C.1/124. Vienna, Austria.

https://daccess-ods.un.org/access.nsf/get?open&DS=A/AC.105/C.1/124&Lang=E.

Wyss, Gregory D. 1996. An Overview of the Risk Uncertainty Assessment Process for the Cassini Space Mission. SAND96-1544C. Albuquerque, New Mexico: Sandia National Laboratories.

Zillmer, Andrew John, and Amanda Gates. 2022. Overview of Light Weight Radioisotope Heating Unit (LWRHU) Users Guide. INL/CON-22-65864-Rev000. Idaho Falls, Idaho:

Idaho National Laboratory. https://www.osti.gov/biblio/1871345.

6-8

APPENDIX A SAFETY ANALYSIS CODES Table A-1 lists computer codes used in missions since 1992. Entries in parentheses in the Programs column indicate general use by an organization rather than a specific mission.

Table A-1 List of Computer Codes Used for Space Nuclear System Safety Analysis Code Uses Programs Owner ABAQUS Thermostructural analysis Cassini a Simulia CARS Risk integration (Sandia) b CINDER Source term calculation KRUSTY c Los Alamos National Laboratory (LANL)

CMA Reentry simulation (Sandia) b, (NASA) a CTH Spacecraft explosive debris (Sandia) b, SNL simulation (NASA) d FDOSE Consequence analysis (Sandia) b, (NASA) d FIREBALL Fireball environment source term Cassini e LANL calculation FRINK Analyzes reactor dynamics and KRUSTY f LANL transients using a point-kinetics model GRAM95 Consequence analysis MSL g HANDI Reentry simulation (Sandia) b, (NASA) d HYSPLIT Consequence analysis (Sandia) b, NOAA (NASA) d IAT Consequence analysis (Sandia) b, (NASA) d LAPS Reentry simulation (Sandia) b, (NASA) d LASEP Source term calculation (Sandia) b, (NASA) d LORAN Ablation simulation Cassini h MACCS2 Calculating dispersion MSL i, SNL coefficients at locations of Dragonfly j interest MCNP Calculating radiation transport KRUSTY f LANL MCNPX Criticality simulation (NASA) d LANL MONTEBURNS Source term calculation KRUSTY c, f LANL A-1

Code Uses Programs Owner NARAC suite Atmospheric transport MSL* i Lawrence Livermore National Laboratory ORIGEN Source term calculation KRUSTY f Oak Ridge National Laboratory PARDOS Dose and health effects MSL k PEVACI Propellant fire simulation (Sandia) b, SNL (NASA) d POSTMAX Calculating dispersion Dragonfly j LANL coefficients at or beyond distance of a location of interest PREDICT Impact probability MSL* i Presto Spacecraft explosive debris (NASA) d simulation PUFF Plume rate of a fireball event MSL k RecpDB LHS95 Consequence analysis MSL g RESRAD-BIOTA Evaluating radiation doses to Mars 2020 l Argonne National aquatic and terrestrial life Laboratory SAR_PostProc Risk integration (NASA) d SATRAP Atmospheric transport Cassini a SETAC/EVNTRE Uncertainty assessment Cassini e SNL SFM Propellant fire simulation (Sandia) b, SNL (NASA) d Sierra/SM Spacecraft explosive debris (Sandia) b SNL simulation SINDA Propellant fire simulation (Sandia) b, Cullimore & Ring (NASA) d Technologies SINRAP Thermal analysis Cassini a SPARRC suite Code suite for dispersion, dose, MSL i, Lockheed Martin and health effect calculation Cassini e STORM Consequence analysis (Sandia) b, SNL (NASA) d TAOS Reentry simulation (Sandia) b, (NASA) d TSAP Point mass trajectory Topaz-II m SNL WindDB Consequence analysis MSL k Zapotec Spacecraft explosive debris (Sandia) b, simulation (NASA) d a

Lockheed Martin Astro Space. 1996. Monthly Technical Progress Report (27 November through 31 December 1995). RR16.

Cassini RTG Program CDRL Transmittal. King of Prussia, Pennsylvania: Lockheed Martin.

A-2

Code Uses Programs Owner b

Clayton, D.J., R.J. Lipinski, and R.D. Bechtel. 2015. Radioisotope Power Systems Launch Safety Process.

SAND2015-9024C. Albuquerque, New Mexico: Sandia National Laboratories.

c McClure, Patrick Ray. 2018. Kilopower Space Reactor Launch SafetyMaximum Credible Dose for a Criticality Accident.

LA-UR--18-28899. Los Alamos National Laboratory. https://doi.org/10.2172/1473765.

d Sholtis, Joseph A. 2015. The 2014 NASA Nuclear Power Assessment Study (NPAS): Safety, Environmental Impact, and Launch Approval Considerations and Findings. Albuquerque, New Mexico, February 23.

e Wyss, Gregory D. 1996. An Overview of the Risk Uncertainty Assessment Process for the Cassini Space Mission.

SAND96-1544C. Albuquerque, New Mexico: Sandia National Laboratories.

f McClure, Patrick R., David I. Poston, Steven D. Clement, Louis Restrepo, Robert Miller, and Manny Negrete. 2020. KRUSTY Experiment: Reactivity Insertion Accident Analysis. Nuclear Technology 206 (sup1): S43-55.

https://doi.org/10.1080/00295450.2020.1722544.

g Robinson, David G. 2012. Mars Science Laboratory Launch Risk Analysis Summary. SAND2012-1151C. Albuquerque, New Mexico: Sandia National Laboratories.

h Lockheed Martin Astro Space. 1995. Monthly Technical Progress Report (29 May Through 2 July 1995). RR16. Cassini RTG Program CDRL Transmittal. King of Prussia, Pennsylvania: Lockheed Martin.

i Bessette, Gregory C., Nathan E. Bixler, John C. Hewson, David G. Robinson, Donald L. Potter, Dana A. Powers, Christopher B.

Atcitty, et al. 2006. Methodology Assessment and Recommendations for the MSL Safety Analysis. SAND2006-4563.

Albuquerque, New Mexico: Sandia National Laboratories.

j McHugh, Caleb, and Tammy Wheeler. 2021. Radiological Consequence Evaluation for Dragonfly Mission. INL/EXT-21-65050 REV0. Idaho Falls, Idaho: Idaho National Laboratory. https://doi.org/10.2172/1835103.

k Bixler, Nathan E., Chris J. Clutz, Nelson A. Deane, Darryl G. Hoover, and Ronald J. Lipinski. 2013. Probabilistic Risk Assessment and Its Application to the Mission to Mars. SAND2013-1462C. Albuquerque, New Mexico: Sandia National Laboratories.

l Science Mission Directorate. 2020. Supplemental Environmental Impact Statement for the Mars 2020 Mission.

Washington, DC: National Aeronautics and Space Administration.

m Connell, L.W., and L.C. Trost. 1994. Reentry Safety for the Topaz II Space Reactor: Issues and Analyses. SAND94-0484.

Albuquerque, New Mexico: Sandia National Laboratories. https://doi.org/10.2172/10184645.

A-3

APPENDIX B PAST SAFETY ANALYSIS REPORTS Many safety analyses are not easily accessible. Although only recent missions (i.e., Mars Science Laboratory, Mars 2020, and, to an extent, New Horizons) are likely to contain information that may warrant protection, past documents (e.g., Ulysses and Cassini) are also unavailable. Table B-1 summarizes the official safety analyses that were made available to the public.

Table B-1 List of Publicly Available Safety Analysis Reports NPS Mission Report name Report number Report date SNAP-1 - Final Safety Analysis MND-P-2352 1960 ReportSNAP 1A Radioisotope-Fueled Thermoelectric Generator SNAP-3 - Final Safety Analysis: MND-P-2364 1960 Report: SNAP 3 Thermoelectric Generator SNAP-9A Transit 5-BN-1-3 Safety Analysis of the SC-RR-64-65 1964 Operational SNAP-9A System SNAP-10A SNAPSHOT Final SNAPSHOT NAA-SR-10022 1965 Safeguards Report LWRHU - Light-Weight MLM-3540 1988 Radioisotope Heater Unit Final Safety Analysis Report (LWRHU-FSAR)

GPHS-RTG Galileo Final Safety Analysis DOE/ET/32043- 1988 Report for the Galileo T26 Mission B-1