ML23226A004

Research Information Letter 2023-06, Literature Review Space Nuclear System Launch Safety Review Process

ML23226A004
Person / Time
Issue date:	09/30/2023
From:	Shockley S NRC/RES/DSA
To:
Shared Package
ML23223A162	List: ML23226A004
References
RIL-2023-06
Download: ML23226A004 (82)

Text

RIL 2023-06

Literature Review:

Safety Review Process for Space Nuclear System Launches

Date Published: September 2023

Prepared by:

S. Shockley

Research Information Letter Office of Nuclear Regulatory Research Disclaimer

Legally binding regulatory requirements are stated only in laws ; U.S. Nuclear Regulatory Commission regulations; licenses, including technical specifica tions; or ordersnot in research information letters (RILs). An RIL is not regulatory guidance, although the agencys regulatory offices may consider the information in an RIL to determine whe ther any regulatory actions are warranted.

ABSTRACT

The U.S. Nuclear Regulatory Commission (NRC) has participated i n mission-specific Interagency Nuclear Safety Review Panels since its creation. In the 1960s and early 1970s, the Atomic Energy Commission (the NRCs predecessor) contributed to the Navys satellite program and the National Aeronautics and Space Administrations launche s through its Systems for Nuclear Auxiliary Power program, which created the first nuclea r systems used on U.S. space missions. This report presents a literature review of more than 100 sources selected from over 300 documents pertaining to (1) the history of space nuclear sy stems, including their risk, past incidents, and future missions, (2) safety analyses conducted f or previous space nuclear system missions and how they were conducted, (3) the policy surroundin g the approval process for these launches, including the safety review process, and (4) ne w guidelines of the 2019 National Security Presidential Memorandum on Launch of Spacecra ft Containing Space Nuclear Systems. The report concludes by identifying potential challeng es within the field of space nuclear safety and provides recommendations for further literat ure review. These recommendations are intended to better equip the NRC staff in p reparation for future space nuclear system launches.

iii TABLE OF CONTENTS

ABSTRACT................................................................................................................................. iii LIST OF FIGURES...................................................................................................................... vi LIST OF TABLES....................................................................................................................... vii EXECUTIVE

SUMMARY

........................................................................................................... viii ACKNOWLEDGEMENTS............................................................................................................ x ABBREVIATIONS AND ACRONYMS........................................................................................ xi 1 INTRODUCTION............................................................................................................ 1-1 1.1 Purpose of the Literature Review................................................................ 1-1 1.2 Scope of the Literature Review................................................................... 1-1 1.3 Literature Review Methodology................................................................... 1-2 1.4 Groups for Analysis...................................................................................... 1-2 1.5 Exclusion Criteria......................................................................................... 1-2 2 SPACE NUCLEAR SYSTEMS: RISK AND POTENTIAL ACCIDENTS....................... 2-1 2.1 Fission Reactors in Space........................................................................... 2-3 2.2 Nuclear Propulsion....................................................................................... 2-7 2.3 Radioisotope Power Systems...................................................................... 2-8 2.4 Space Nuclear Incidents............................................................................ 2-11 2.5 Future Missions.......................................................................................... 2-14 3 SAFETY ANALYSIS FOR SPACE NUCLEAR SYSTEMS........................................... 3-1 3.1 An Overview of Space Nuclear Safety Analysis........................................ 3-2 3.2 The Risk of Space Nuclear Fuel Sources (Early 1960s)............................ 3-3 3.3 Safety Analyses Since the 1980s................................................................ 3-9 3.4 Calculation Methods for Risk Assessments............................................ 3-14 4 INTERAGENCY SAFETY REVIEW PROCESS FOR NUCLEAR MISSIONS.............. 4-1 4.1 The Evolving Safety Review Framework.................................................... 4-2 4.2 The Practice of Interagency Safety Review.............................................. 4-10 4.3 The Development of Safety Evaluation Reports...................................... 4-14 4.4 The U.S. Nuclear Regulatory Commissions Role in the Safety Rev iew Process........................................................................................................ 4-16 4.5 Foreign and International Nuclear Mission Safety and Approval.......... 4-17 5 CONCLUSIONS............................................................................................................. 5-1 5.1 Possible Challenges for the Space Nuclear Safety Field.......................... 5-1 5.2 Recommendations for Further Literature Review..................................... 5-3

iv 6 REFERENCES............................................................................................................... 6-1 APPENDIX A SAFETY ANALYSIS CODES........................................................................ A-1 APPENDIX B PAST SAFETY ANALYSIS REPORTS......................................................... B-1

v LIST OF FIGURES

Figure 2-1 A diagram of the SNAP-10A reactor system............................................................ 2-4 Figure 2-2 The diagram of a potential design for the SP-100 rea ctor........................................ 2-6 Figure 2-3 A mockup of the NERVA engine design................................................................... 2-8 Figure 2-4 Installation of the SNAP generator on a Transit sate llite.......................................... 2-9 Figure 2-5 A labeled diagram of an MMRTG and a GPHS...................................................... 2-11 Figure 2-6 The SNAP-19 RTG, which NASA used in several missions, with modifications, including Nimbus, Pioneer, and Viking...................................... 2-13 Figure 3-1 The SNAP-1A device................................................................................................ 3 - 4 Figure 3-2 A plot of the radiological inventory of SNAP-10A fol lowing startup of the reactor................................................................................................................ 3-8 Figure 3-3 An example subbranch of possibilities from the 1988 LWRHU report.................... 3-10 Figure 3-4 The process for calculating final risk of a space nu clear system launch with the three levels labeled.................................................................................... 3-16 Figure 3-5 A full-scale model of the SNAP-10A reentry vehicle i n an acoustic facility at Sandia National Laboratories........................................................................... 3-19 Figure 4-1 Major events in the launch approval framework....................................................... 4-3 Figure 4-2 The INSRB safety review process as depicted in the p laybook............................... 4-9 Figure 4-3 INSRP role in the launch approval process............................................................ 4-12

vi LIST OF TABLES

Table 2-1 Past U.S. Space Nuclear System Launches............................................................. 2-1 Table 2-2 Summary of SNAP Reactors..................................................................................... 2-5 Table 2-3 U.S. Space Mission Incidents Involving Nuclear System s....................................... 2-12 Table 2-4 Soviet Space Mission Incidents Involving Nuclear Syst ems.................................... 2-14 Table 3-1 Comparison of Radioisotopes Considered for Use in RPS s...................................... 3-3 Table 3-2 Levels of Analysis for Nuclear Safety Analysis........................................................ 3-15 Table 4-1 NSPM-20 NPS Risk Tiers.......................................................................................... 4-5 Table 4-2 Probability-Consequence Curve Targets from NSPM-20.......................................... 4-5 Table 4-3 INSRB Playbook Suggested Analysis and Review Outline....................................... 4-8 Table A-1 List of Computer Codes Used for Space Nuclear System Safety Analysis.............. A-1

vii EXECUTIVE

SUMMARY

The history of space nuclear systems traces back to the first d ecades of nuclear power itself.

Both the United States and the former Soviet Union launched an extensive number of spacecraft with some form of a nuclear power source (NPS) on it, whether it be nuclear fission or radioisotope decay that generated the heat and energy. Befor e the launch of an NPS, U.S. policy requires, and international commitments recommend, that a safety review be conducted. This report presents a literature review of the hist ory and details of the safety review process for space nuclear system launches, as well as the histo ry and safety of missions using NPSs.

This literature review surveyed over 300 documents related to t he launch of space nuclear systems. Documents were sourced using publicly available databa ses provided by the U.S. Nuclear Regulatory Commission (NRC) (Agencywide Documents Access and Management System, Technical Librarys Online Catalog), the Int ernational Atomic Energy Agency (International Nuclear Information System), the U.S. Dep artment of Energy (Office of Scientific and Technical Information), the National Aeronautics and Space Administration (Technical Reports Server), and the U.S. Department of Commerce (National Technical Reports Library). By using tailored keyword searches and investigating the references of documents, the author selected reports pertaining to (1) the history of space nuclear systems and their risks, (2) past safety analyses and reviews conducted on these systems, and (3) the current and historical framework exercised to review the safety of these sy stems before launch.

After reviewing the original documents, the author selected ove r 100 sources that directly pertain to these categories to be referenced in the final liter ature review. These sources informed the literature review on the topics relevant to space nuclear system launches and their safety. This review describes the relevant contents of these so urces and summarizes them below.

The environmental consequences of the few failed missions using NPSs has been negligible.

The U.S. program has experienced two failures of NPS-equipped s pacecraft during the launch phase in its nascency. One such failure led to the release of r adiological material during a burnup upon reentry as intended by the devices design. One oth er mission ended with reentry into the Pacific Ocean (the Apollo 13 Lunar Excursion Module) f ollowing a successful launch phase but had no measurable release of radiological material.

In the United States, the sponsoring agency of a space nuclear system launch is responsible for a safety analysis report (SAR) summarizing the risks of the mis sion. In more recent times, the developers of these reports have employed a risk assessment fra mework to prepare the SAR.

These modern safety analyses typically categorize the mission i nto six phases:1 (0) prelaunch, (1) early launch, (2) late launch, (3) suborbital, (4) orbital, and (5) long term (Bixler et al., 2013, 21). Systematically, the discussion of each category describes the possible accidents, associated probabilities, NPS response, source terms, dispersio n, exposure, and consequences. As not all postulated accidents entail the releas e of radiological material, such

1 The Cassini missions had an additional phase for an Earth gravity assist performed following a Venus flyby in which it returned for an Earth flyby before its final trajectory to Saturn. The Galileo mission performed a similar maneuver on its route to Jupiter but had only six phases (each referring to slightly different parts of the mission from those described above, except for the shared prelaunch phase).

viii as many of those considered in the SAR for the Light-Weight Rad ioisotope Heater Units (Johnson, 1988a), the analysis may only need to calculate the a mount of radiological release, the source term, for a limited number of cases.

After issuance of Presidential Directive/National Security Coun cil 25, Scientific or Technological Experiments with Possible Large-Scale Adverse Environmental Eff ects and Launch of Nuclear Systems into Space, in 1977 (Brzezinski, 1977), the approval p rocess for space nuclear system launches remained much the same until the publication of the Na tional Security Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Sys tems (NSPM-20) in 2019 (Trump, 2019). The interagency review process evolved from a de sire of the Atomic Energy Commission for interagency cooperation on safety reviews. An in teragency review for space nuclear systems, it argued, would produce reliable results and earn the trust of legislators and the public.

Over approximately 50 years, the Interagency Nuclear Safety Rev iew Panel (INSRP), an ad hoc organization empaneled for each mission, embodied this process. The INSRP played a crucial role in verifying the safe operation of NPSs up until the Mars 2020 mission. The White House incorporated calls for reform of the process that arose over th e years (Camp et al., 2019b) into NSPM-20 in 2019. The memorandum encompassed the adoption of new launch approval metrics, radiological limits for missions warranting safety rev iews, and the creation of the standing Interagency Nuclear Safety Review Board (INSRB) primar ily tasked with reviewing space nuclear system launches conducted by the U.S. Government. The initial mission to fall under the INSRBs review will likely be the U.S. Department of Defenses Demonstration Rocket for Agile Cislunar Operations (or DRACO) mission (Greiner, 2021 ).

ix ACKNOWLEDGEMENTS

The completion of this report could not have been possible with out the guidance and support of the staff of the U.S. Nuclear Regulatory Commission (NRC). The author would like to thank Tina Ghosh of the NRC staff for her pivotal role in providing c omments, direction, and feedback that significantly contributed to the development of this repor t. The author extends their appreciation to Don Marksberry of the NRC staff for supplying t he reviewed and referenced documents, and to Don Helton from the National Aeronautics and Space Administration for his valuable assistance and support in reviewing this report. Lastl y, special thanks are given to Luis Betancourt for providing NRC management oversight througho ut this project.

x ABBREVIATIONS AND ACRONYMS

AEC Atomic Energy Commission Ce cerium CIA Central Intelligence Agency Cm curium COPUOS Committee on the Peaceful Uses of Outer Space DARPA Defense Advanced Research Projects Agency DOD U.S. Department of Defense DOE U.S. Department of Energy DOS U.S. Department of State DOT U.S. Department of Transportation DRACO Demonstration Rocket for Agile Cislunar Operations EIS environmental impact statement EPA U.S. Environmental Protection Agency ERDA U.S. Energy Research and Development Agency ESA European Space Agency FAA Federal Aviation Administration FSAR final safety analysis report GPHS General Purpose Heat Source IAEA International Atomic Energy Agency INL Idaho National Laboratory INSRB Interagency Nuclear Safety Review Board INSRP Interagency Nuclear Safety Review Panel IRG INSRB Review Group JHU/APL The Johns Hopkins University Applied Physics Laboratory kg kilogram KRUSTY Kilopower Reactor Using Stirling Technology kW kilowatt LANL Los Alamos National Laboratory LES 8/9 Lincoln Experimental Satellites 8 and 9 LWRHU Light-Weight Radioisotope Heater Unit MHW multihundred watt MMRTG multi-mission radioisotope thermoelectric generator

xi MND Martin Nuclear Division MSL Mars Science Laboratory MW megawatt NASA National Aeronautics and Space Administration NEP nuclear electric propulsion NERVA Nuclear Engine for Rocket Vehicle Applications NPS nuclear power source NRC U.S. Nuclear Regulatory Commission NSAM National Security Action Memorandum NSPM National Security Presidential Memorandum NTP nuclear thermal propulsion OSS Office of Space Science OSTP Office of Science and Technology Policy PD/NSC Presidential Directive/National Security Council PPD Presidential Policy Directive Po polonium PRA probabilistic risk assessment Pu plutonium RES United Nations Resolution RHU radioisotope heater unit RIL research information letter RORSAT Radar Ocean Reconnaissance Satellite RPS radioisotope power system RTG radioisotope thermoelectric generator SAR safety analysis report SER safety evaluation report SMD Science Mission Directorate SNAP Systems for Nuclear Auxiliary Power SNL Sandia National Laboratories SNR space nuclear reactor STSC Scientific and Technical Subcommittee U uranium UN United Nations UNGA United Nations General Assembly

xii 1 INTRODUCTION

The use of nuclear power sources (NPSs) in space missions trace s back to the beginning of the U.S. space program, starting with the Systems for Nuclear Auxil iary Power (SNAP) program led by the Atomic Energy Commission (AEC). The program achieved its first flight in 1961 with the SNAP-3A2 radioisotope thermoelectric generator (RTG) launched on the Tr ansit 4-A satellite.

The AEC recognized the potential radiological risk of such powe r sources and established the Aerospace Nuclear Safety Board, which would analyze their safet y and promote standard practices, collaborate with the National Aeronautics and Space Administration (NASA), and work to reduce the radiological risk of launching nuclear mater ial3 into space (U.S. Department of Energy (DOE), 1987a, 15).

Although much has changed since thenthe SNAP program no longer exists, RTGs are a matured technology, and the Energy Reorganization Act of 1974 4 abolished the AECsafety is still a priority in the launch of space nuclear systems. As a r esult, the safety review process for such launches has also evolved over the decades. Most recently, the previously ad hoc Interagency Nuclear Safety Review Panel (INSRP) has been restru ctured as a standing body known as the Interagency Nuclear Safety Review Board (INSRB). I n accordance with the mandate outlined in the National Security Presidential Memorand um on Launch of Spacecraft Containing Space Nuclear Systems (NSPM-20), dated August 20, 20 19 (Trump, 2019), the NRC now designates its own representative to be an equal member of the INSRB.

This literature review aims to support the NRC in fulfilling it s role within the INSRB process and addressing the emerging requirements of the field. It examines past safety analyses, risk assessments, and INSRP safety reviews of launches.

1.1 Purpose of the Literature Review

This literature reviews purpose is to (1) assist the NRC in fu lfilling its role in the recently created INSRB by providing context for safety reviews of space nuclear launches, (2) examine past review methods, risk calculations, and safety analyses, and (3) assess the applicability of publicly available information to future safety reviews of spac e nuclear launches.

1.2 Scope of the Literature Review

The scope of the literature review falls into three categories:

2 The SNAP program used odd numbers to denote the use of RTG systems, while even numbers indicated the use of nuclear reactors.

3 The definition here of nuclear material includes special nuclear material that consists of plutonium, uranium (U)-233 or uranium with U-233 or U-235 content greater than that found in nature (i.e., greater than 0.71 percent U-235).

4 Under the Atomic Energy Act of 1954, a single agency, the AEC, was responsible for developing and producing nuclear weapons and the development and safety regulation of the civilian use of nuclear materials. The Energy Reorganization Act of 1974 split these functions, assigning to one agency, now the DOE, the responsibility for the development and production of nuclear weapons, promotion of nuclear power, and other energy-related work, and establishing the U.S. Nuclear Regulatory Commission (NRC) to carry out the regulatory work, except for the regulation of defense nuclear facilities.

1-1

• an overview of space nuclear sys tems, including their history and associated risks

• past safety analyses and reviews conducted on these systems

• an overview of the current and historical framework encompassi ng space nuclear system launch safety review

This report is an initial attempt to summarize available knowle dge on these topics. The literature review discusses a subset of publicly available information and was conducted over a limited time frame. Therefore, this report does not represent a compreh ensive summary of the full set of information that may be available.

1.3 Literature Review Methodology

The method for acquiring the documents used in this literature review was to search the NRCs Technical Librarys catalog, the International Atomic Energy Ag encys (IAEAs) International Nuclear Information System, the collection of the DOE Office of Scientific and Technical Information, and the U.S. Department of Commerces National Tec hnical Report Library for relevant documents that are publicly available. The searches in cluded the key terms space and nuclear, as well as safety, risk, safety assessment, or risk assessment as supplemental terms. Following references within the reviewed so urces resulted in additional documents for the review.

1.4 Groups for Analysis

The literature review categorized the documents into three grou ps for analysis that reflect the scope of the review, with some overlap:

• contextual information for past launches and their risks

• the potential offsite (public) consequences of these missions and their methods for determination

• the past INSRP review process and foreign nations reviews for space nuclear launches

1.5 Exclusion Criteria

Given the number of documents found for this literature review, some exclusion was necessary to focus on the reviews scope and achieve its purpose effectiv ely. The items retained directly concern either the launch approval process or the safety analys es for space nuclear systems or discuss the context of a space nuclear system launch and its ri sks. The author excluded some sources meeting those criteria due to redundancy or outdated in formation at their discretion.

1-2 2 SPACE NUCLEAR SYSTEMS: RISK AND POTENTIAL ACCIDENTS

Starting just years after the launch of the first satellites, n uclear systems have supplied power to spacecraft for over half a century. Space missions use NPSs alo ng with or instead of solar panels to generate power and are crucial when solar power is in sufficient. There are two main types of NPSs: (1) space nuclear reactors (SNRs) and (2) radioi sotope power systems (RPSs),

which include both RTGs and radioisotope heater units (RHUs).

The United States and the former Soviet Union often used NPSs i n their space programs and launched a similar number of missions equipped with them. Betwe en the two nations, the U.S.

program has heavily favored RTGs while the Soviet program relie d mostly on SNRs (Lee and Buden, 1994, 1). Table 2-1 lists all U.S. space nuclear system launches. Since 1961, the United States has launched 32 NPS-equipped missions into space, severa l containing multiple RTGs and many RHUs (The Johns Hopkins University Applied Physics Lab oratory (JHU/APL), 2015, 97). One of the U.S. missions experienced an unplanned reentry with dispersal. For its part, the former Soviet Union launched approximately 38 SNRs throughout i ts space program. Two Soviet SNR-equipped missions, along with three of its RTG-equip ped missions, experienced unplanned reentries with dispersal (Lenard, 2008, 206; Bennett, 1990, 276).

Table 2-1 Past U.S. Space Nuclear System Launches

Mission name NPS a Launch Status date Transit 4-A SNAP-3B7 Jun. 1961 Successful operation, b termination Transit 4-B SNAP-3B8 Nov. 1961 Successful operation, terminatio n Transit 5-BN-1 SNAP-9A Sep. 1963 Successful operation, termination Transit 5-BN-2 SNAP-9A Dec. 1963 Successful operation, terminat ion Transit 5-BN-3 SNAP-9A Apr. 1964 Mission abort, RTG burned upon reentry SNAPSHOT SNAP-10A c Apr. 1965 Successful operation, nonreactor malfunction before planned termination Nimbus B-1 SNAP-19B2 May 1968 Mission abort, RTG recovered and recycled Nimbus III SNAP-19B3 Apr. 1969 Successful operation, termination Apollo 11 RHU Jul. 1969 Successful operation, termination Apollo 12 SNAP-27 Nov. 1969 Successful operation, termination Apollo 13 SNAP-27 Apr. 1970 Mission abort, RTG returned to South Pacific Ocean Apollo 14 SNAP-27 Jan. 1971 Successful operation, termination Apollo 15 SNAP-27 Jul. 1971 Successful operation, termination Pioneer 10 SNAP-19, Mar. 1972 Successful operation RHU Apollo 16 SNAP-27 Apr. 1972 Successful operation, termination

2-1 Mission name NPS a Launch Status date TRIAD-01-1X Transit-RTG Apr. 1972 Successful operation, termination Apollo 17 SNAP-27 Dec. 1972 Successful operation, termination Pioneer 11 SNAP-19, Apr. 1973 Successful operation RHU Viking 1 SNAP-19 Aug. 1975 Successful operation, termination Viking 2 SNAP-18 Sep. 1975 Successful operation, lost signal LES 8/9 MHW-RTG Mar. 1976 Successful operation Voyager 2 MHW-RTG, Aug. 1977 Successful operation RHU Voyager 1 MHW-RTG, Sep. 1977 Successful operation RHU Galileo GPHS-RTG, Oct. 1989 Successful operation, deorbited into LWRHU Jupiter Ulysses GPHS-RTG Oct. 1990 Successful operation, termination Mars Pathfinder LWRHU Dec. 1996 Successful operation, termination Cassini GPHS-RTG, Oct. 1997 Successful operation, deorbited into LWRHU Saturn MER-A LWRHU Jun. 2003 Successful operation, termination MER-B LWRHU Jul. 2003 Successful operation, termination New Horizons GPHS-RTG Jan. 2006 Successful operation Mars Science MMRTG Nov. 2011 Successful operation Laboratory Mars 2020 MMRTG Jul. 2020 Successful operation Sources: Nuclear Power Assessment Study: Final Report, TSSD-23122, JHU/APL, 2015; NASA, ULA Launch Mars 2020 Perseverance Rover Mission to Red Planet, Johnson, 2020.

a Some missions carried more than one RPS.

b A successful operation is the launch of a spacecraft without an unplanned release of radiological material or premature return of the NPS(s) to Earth. This should mean the NPS has not posed risk to the global population, though Earth-bound missions typically included a planned reentry after the decay of their radiological inventory.

c SNAP-10A is the only fission reactor on this list; all other entries are RPSs.

2-2

From this history, the United States has decades of experience in the review and analysis of RPS launch safety. It has also launched a single SNR, and thoug h it has not flown any since, it has designed and tested several others. The Nations research i nto nuclear systems has also included nuclear propulsion. Still, since the last reactor laun ch, no NPS other than RPSs has completed the launch approval process (JHU/APL, 2015, 98), leav ing the U.S. safety program with a lack of practical experience for sources other than RPSs.

Unlike the U.S. space program, the Soviet space program possess ed substantial experience in launching SNRs. However, despite conducting nearly 40 reactor f lights, it provided limited insight into its SNR safety program in the open literature. Ind ividuals in the field of space nuclear systems (Bennett, 1992a) were, however, able to note changes in the Soviet space nuclear safety philosophy as evidenced by alterations made to the count rys SNRs and statements to the United Nations (UN) regarding them.

The following section summarizes the history of the three areas of interest for space nuclear systemsSNRs, nuclear propulsion, and RPSsto provide context f or the interagency safety review process described later in this report. It then describe s several key incidents involving NPSs and their consequences for comparison to the descriptions of the systems safety analyses. The section then ends with a brief summary of current and future projects in the field of space nuclear systems.

2.1 Fission Reactors in Space

In April 1965, the United States launched its first and only SN R. Known as SNAP-10A, it was placed into a polar orbit and provided 500 watts of power to va rious components of the satellite, including a small ion drive (Corliss, 1971, 7). Figure 2-1 depi cts a diagram of the system. When modeling its safety, designers found three main types of accide nts that could harm the public (Corliss, 1966, 35):

(1) There could be inadvertent criticality of the reactor durin g a launch failure.

(2) During reentry, the reactor fuel could burn up (a process c alled ablation) and spread radiation throughout the atmosphere.

(3) Pieces of the reactors fuel could survive intact, emitting significant doses of harmful radiation.

Three aspects of the design addressed these situations (Bennett, 1981, 428):

(1) Operators kept the reactor subcritical and appropriately s hielded before launch to minimize radioactivity.

(2) Designers ensured the core would remain subcritical in case of impact before startup.

(3) The spacecrafts final orbit would persist long enough that the fission products could decay until emissions were roughly the same as background radia tion levels before reentry.

2-3 While the first two solutions were preventive measures, reentry was ultimately unavoidable as with any Earth-orbiting satellite. Consequently, the spacecraft placed itself in an orbit projected to last 3,800 years before full shutdown. By the time the react or burned up in the atmosphere, its radiation is expected to have diminished to a negligible le vel (Lee and Buden, 1994, 2). To guarantee this outcome, the designers incorporated automated sy stems that would only allow reactor startup after a long-term orbit was achieved. Eventuall y, a malfunction in the voltage regulator outside of the reactor prematurely shut down SNAP-10A, and to this day, the spacecraft remains in its several-thousand-year-long orbit (Ben nett, 1981, 428). Table 2-2 lists the SNAP program reactors, including SNAP-10A.

Figure 2-1 A diagram of the SNAP-10A reactor system

Source: HD.6D.512, n.d., in DOE, AECReactor Development, 201 3.

2.1.1 Space Nuclear Reactors after SNAP-10A (1960s-1990s)

In the years following the launch of SNAP-10A, three major U.S. SNR projects included (1) the SNAP-50 reactor, (2) the Nuclear Engine for Rocket Vehicle Appl ication (NERVA) program, earlier known as Rover (1955-1973), and (3) the SP-100 program (1983-1994). The SNAP program intended SNAP-50 to be a reactor capable of generating 300 kilowatts (kW) of power.

As it lost funding, the reactor marked the end of the SNAP reac tor program and remained in the developmental stage without ever progressing further (Voss, 198 4, 87). The second major program, NERVA, developed a nuclear-powered rocket initially based on the successfully tested Kiwi B reactor, a design intended to prove the feasibility of a 1,000-megwatt (MW) nuclear thermal reactor. Phoebus, a reactor with even higher powerarou nd 5,000 MWwas

2-4 developed in parallel with engine testing. Initially, its compo nents were tested in a smaller reactor, named Pewee. Concerns in the later years with the radi ological hazards of engine exhaust during these tests led to the construction of another r eactor, the Nuclear Furnace, which operated at 44 MW. Although it never flew, NERVA managed to secure practical tests before its termination (Idaho National Laboratory (INL), 2015, 16-17, 20, 67, 72-75).

Table 2-2 Summary of SNAP Reactors

Project Power (kW) Core type Core coolant Generator Final status SNAP-2 3 Uranium Sodium-Rankine-cycle Discontinued zirconium potassium hydride SNAP-8 35 Uranium Sodium-Rankine-cycle Partial zirconium potassium (mercury completion, hydride working fluid) discontinued in 1970 SNAP-10 0.3 Uranium None Thermoelectric Designed using zirconium conductive hydride cooling, modified into SNAP-10A SNAP-10A 0.6 Uranium Sodium-Thermoelectric Completed, zirconium potassium launched hydride SNAP-50 100-1,000 Fast, Lithium Rankine-cycle Discontinued in uranium (potassium 1965 nitride working fluid)

Source: Atomic Power in Space II: A History of Space Nuclear Power and Propulsion in the United States, INL/EXT-15-34409, INL, 2015.

The DOE began a 5-year program to develop a space reactor in 19 79, which it called the Space Power Advanced Reactor. It used a uranium oxide core with sodiu m coolant. Beryllium reflectors controlled the reactors operation. Doubts threatene d the reactors development program, but a partnership with NASA, after some initial disagr eements in the early 1980s, preserved the program under the new name Space Power 100 kilowa tts, or SP-100 (INL, 2015, 60-62). Figure 2-2 The diagram of a potential design for the SP -100 reactor depicts a conceptual diagram of the reactor.

The SP-100 reactor project lacked a practical mission application across agencies and had no clear purpose other than its intended power target (Tarves, 200 4, 54). Despite this, designers followed strict safety requirements in anticipation of its plan ned use. Similar to SNAP-10A, the reactor was to remain subcritical before launch. The safety rod s and control drums would be physically locked and require an astronaut or remote signal to activate so that the reactor would only become critical when intended (DOE, 1987b, 4). The reactor s reentry philosophy, however, was the opposite of that for SNAP-10A. Its core was de signed to survive reentry and impact, keeping all nuclear mater ial sealed, similar to modern RTGs (Buden, 1993, 18-19).

2-5 Before its conclusion, the SP-100 reactor program had made the most significant advancements among domestic SNR programs since the SNAP era. Until the recen t Kilopower and Fission Surface Power projects, no other domestic SNR program achieved a comparable level of progress (Lenard, 2008, 206). The project, as with all other SN R projects following the success of SNAP-10A, ended before ever completing the launch approval r eview process.

Figure 2-2 The diagram of a potential design for the SP-100 rea ctor

Source: DOE Space Nuclear Power and Propulsion (SNPP) Activities, Bishop, 2021.

The former Soviet Union launched almost 40 SNRs, beginning with the Radar Ocean Reconnaissance Satellites (RORSATs) and ending with two reactor experiments the United States named TOPAZ (Bragg-Sitton et al., 2011, 4). After the unplanned reentry of Cosmos 954 and its reactor in the 1970s, the Soviet Union devel oped a core ejection system that would ensure the full dispersal of the reactors fuel, a m ethod identical to the safety philosophy of SNAP-10A. In the 1990s, the United States importe d a model of the TOPAZ-II reactor, cooperating on further design with the newly formed Ru ssian Federation. A flaw discovered early in its safety program was the potential for wa ter-immersion-induced criticality. If a launch failure led to the reactor falling into the ocean or a water-filled launch pad flame trough, this could induce prompt criticality. This flaw had been addres sed in the earlier SP-100 design (Camp et al., 2019a, 8).

2.1.2 Space Nuclear Reactors in the 21st Century

Another major SNR development project took place with testing i n 2017 and 2018. NASA intended the project, called Kilopower, to demonstrate the poss ibility of affordable fission nuclear power for future planetary (and lunar) missions (NASA, 2021). The reactor design itself included a core of highly enriched uranium, with reactivity det ermined by beryllium oxide reflectors and a boron carbide control rod. In the tested desig n, the reactor transferred its heat to a Stirling energy system using a sodium working fluid for po wer conversion (Gibson et al.,

2018, 3). The project came to an end after a final test in 2018 (NASA, 2021), though it was then succeeded by Fission Surface Power. Taking the progress made fr om the development of Kilopower and its reactor, NASA intends to design a 40-kW react or that could be demonstrated on a lunar mission for long-term operations (NASA, 2022).

2-6 The U.S. space programs focus on RTGs has led to limited exper ience with the launch approval process for SNRs. The safety considerations for SNRs a nd RPSs are different, and though the Nation has experience in nuclear reactor safety, spa ce missions involve accident environments that are seldom, if ever, considered for terrestri al reactors. These environments encompass scenarios such as propellant fire and impact (Lenard, 2008, 206). While the SNAP-10A mission exemplifies the sole reactor approved for laun ch in the United States, subsequent programs further developed the field of SNRs as disc ussed above, including design, with respect to nuclear safety. Publicly available docu ments from foreign countries describing experience in the field are also scarce. Although th e Soviet Union had SNR experience, it only disclosed a few details of its safety syste ms through statements to the UN Committee on the Peaceful Uses of Outer Space (COPUOS). It refu sed to provide detailed information or safety analyses conducted for its reactor system s, and though there were hopes that political reforms would lead to openness (Bennett, 1992a, 273-274, 277), there are no readily available documents suggesting more information was eve r revealed.

2.2 Nuclear Propulsion

Although considered its own type of space nuclear system, nucle ar propulsion relies on fission reactors and shares similarities with SNRs. These two types of systems differ in their use of the reactor for either electrical power or propulsion. 5 There are two subtypes of nuclear propulsion:

nuclear thermal propulsion (NTP) and nuclear electric propulsio n (NEP). NTP systems use propellant instead of typical coolants in an open-cycle react or system as an alternative to combustion as a source of thermal energy for rocket engines. A significant advantage of NTP includes powerful thrust, which accelerates mission schedules ( Voegeli, 2007, 164). However, it produces radiologically hot propellant that may pose safety r isks (Tarves, 2004, 17).

Meanwhile, NEP systems use a reactor to ionize gas that is then accelerated through an electric field, creating thrust though much less than that of NTP (Voege li, 2007, 164). Some assert that NEP provides greater safety as a closed-cycle reactor system (i.e., the coolant is contained) and greater flexibility in the use of its power in other spacec raft systems than NTP (Tarves, 2004, 19). Both designs are intended for use in space alone and would not be part of a missions early launch phase.

Significant U.S. development of nuclear propulsion took place d uring the Rover/NERVA program, which lasted two decades and to this day serves as a f oundation for NTP (Bragg-Sitton et al., 2011, 9). The Rover program began as a U. S. Air Force project to develop propulsion for intercontinental ballistic missiles but was tran sferred to NASA and reoriented as an interplanetary travel system where it was renamed NERVA (Voe geli, 2007, 167). A major portion of the program included development of reactors specifi cally for an NTP system, in addition to the engine design itself (INL, 2015, 15). Figure 2-3 depicts an image of a mockup engine design.

Although never reaching the launch approval process, NERVAs de sign considerations included safety features. For instance, a proposed anti-criticality syst em would fragment the core by an explosive destruct system in case of launch failures, even if t he core were hot. The explosive

5 This is not a strict division: reactors used as propulsion systems may still supply power to the rest of the spacecraft as well. SNRs typically have a primary purpose of providing electrical power, however, so while overlap exists, a reactor with a primary purpose of providing power specifically to the propulsion system is considered a form of nuclear propulsion.

2-7 destruct system approach was even considered for reuse in the l ater Jupiter Icy Moons Orbiter mission (using the Prometheus reactor) design (Lenard, 2008, 21 2). Increasing restrictions on radiological releases during tests impacted the NERVA developme nt program. The Nuclear Furnace modular reactor used effluent filters capable of removi ng fission products from the hydrogen jet. After the end of the Apollo missions in 1972 and the retreat from plans for a Mars mission, the NERVA development program lost funding the same ye ar (INL, 2015, 20-21). The NTP concept was unsuccessfully c onsidered as an application for the SP-100 reactor in the 1980s. Besides the concerns of safety, the issue of addressing vibrational and thermal stress slowed progress, and the development of NTP systems was abandon ed in the 1990s (Tarves, 2004, 17).

Figure 2-3 A mockup of the NERVA engine design

Source: DOE Space Nuclear Power and Propulsion (SNPP) Activities, Bishop, 2021.

A more recent nuclear propulsion design was Project Prometheus, a proposed NEP system.

The system would have been used by the Jupiter Icy Moons Orbite r in its Jovian tour (Bragg-Sitton et al., 2011, 8). Many reentry scenarios were con sidered with varying levels of consequence. A high degree of unpredictability in outcomes led to the suggestion of using the NERVA cores explosive fragmentation design to prevent critical ity and increase the safety of the system (Lenard, 2008, 212). The program eventually followed NERVAs fate as well and lost funding, never reaching the launch approval process. It now ser ves as a stepping stone for future NEP programs (Bragg-Sitton et al., 2011, 8).

2.3 Radioisotope Power Systems

RPSs are currently a standard technology in the U.S. space prog ram. Unlike SNRs, they have completed decades of safety reviews and been approved for launc h dozens of times. Figure 2-4 depicts the installation of one of the first launched devices. The development of RTGs (the electrical power producing type of RPSs) for space missions beg an with the SNAP program, led by the AEC in cooperation with the U.S. Department of Defense ( DOD). During his administration, former Presi dent Eisenhower encouraged the prog ram as a peaceful use of nuclear energy, even placing a SNAP-3 RTG on his desk and demon strating it to foreign

2-8 leaders. An academic nuclear critic complained that the Presi dent had been exposed to a lethal device, but an early safety evaluation showed proximity posed negligible risk and accompanied the RTG throughout its international tour (DOE, 198 7a, 17-18). The devices would even be used terrestrially in the SNAP-7 series (DOE, 198 7a, 29).

An RTG is, essentially, a nuclear battery: the decay of a radio isotope source, rather than fission, produces heat that generates electricity. An RHU is essentially the same device, lacking a thermoelectric converter. Plut onium (Pu)-238 eventually became the standard radioisotope for these devices, as it radiates high-kinetic energy alpha particl es. These large particles are easily blocked by the skin; however, they are most hazardous when inha led or ingested (DOE, 1987a, 37-38).

Figure 2-4 Installation of the SNAP generator on a Transit sate llite

Source: HD.6D.455, n.d., in DOE, AECReactor Development, 201 3.

An engineering firm, while speaking of the Cassini mission, cla imed that the form of Pu-238 used, plutonium oxide, was dense enough that any particles in t he air would fall into the ocean before posing a threat to human life (Launius, 2015, 365). Simi lar beliefs inspired the design of early SNAP RTGs up to SNAP-9A to disintegrate upon reentry as p art of a burnup of the RTG so that the particles would disperse across the atmosphere. The total amount of Pu-238 in the atmosphere following dispersal would be small compared to contr ibutions from earlier weapons tests, but this philosophy still led to difficulties in gaining launch approval for the RTGs (DOE, 1987a, 38). Following the reentry of a SNAP-9A RTG in 1964, whi ch dispersed as designed, the program chose to design containment vessels for intact reentry instead (Marshall, 1995, 3). This started the modern safety philosophy for RTGs that prioritizes the containment and recovery (if possible) of Pu-238 to prevent any exposure, especially through ingestion or inhalation (Bennett, 1981, 425).

RTGs are widely used within the U.S. space program, having been employed even in the crewed Apollo missions, where RTGs served instruments during co ld and long lunar nights

2-9 when solar panels could not (Bragg-Sitton et al., 2011, 2). The U.S. Navy became an early adopter of RTG technology with the Transit satellites launched from 1961 to 1964. In comparison to other power sources, RTGs offered favorable survi vability (INL, 2015, 5). NASAs use of RTGs began with its interest in a supplementary power sy stem for its Nimbus weather satellite. The SNAP-19B RTGdesigned specifically for Nimbus an d intact reentry following the reentry of Transits SNAP-9Awas the first NPS flown by NASA, l aunched in 1968. It was also the first RTG flown in the United States following the SNAP-9A reentry, which had inspired the new intact reentry design used in SNAP-19B. Although no SNAP-19 B would experience unplanned reentry, the design successfully contained the radioi sotope fuel after a failed launch sent two RTGs to the ocean floor (INL, 2015, 8).

The next step in RTG development came with the multihundred wat t (MHW) RTG. The Air Force was the first user of this design with the Lincoln Experi mental Satellites 8 and 9 (LES 8/9) in 1976. New silicon-germanium ther mocouples offered improved efficiency for the MHW-RTGs, which were also used on the Voyager probes (INL, 2015, 13). Nea r the same time, the DOE worked on the development of new selenide isotope generators th at would use an MHW heat source, though tests made flaws of the new devices apparent, an d plans for the Galileo mission reverted to the use of an MHW-RTG. The General Purpose Heat Sou rce (GPHS), developed for the International Solar Polar Mission, also proved more success ful when used with the past thermocouples rather than the selenide thermoelectric materials. The GPHS-RTG design met the increasing power demands of the Galileo mission and would r eplace the missions MHW-RTG. These GPHS-RTGs had record efficiency and were used on the Galileo, Ulysses, Cassini, and New Horizons missions (INL, 2015, 23-24).

Much of the GPHSs design was chosen in an effort to increase s afety and reduce risk. An iridium alloy metal allows deformation of the plutonium fuel pe llets without release. A frit vent releases helium gas fission products produced by the decay of t he plutonium to prevent pressure buildup. The module also included impact shells to pro tect against debris, as well as a carbon-fiber sleeve for high-tem perature events. Many practical tests were conducted to gather data on the GPHSs response to various physical situations. Exp losions, impacts, propellant fire, and long-term exposure to aquatic and terrestrial environments were all simulated. Even at an impact speed of 52 meters per second (116 miles per hour) again st concrete, no fuel was released (INL, 2015, 26, 29).

Modern multi-mission RTGs (MMRTGs) are typically composed of GPHSs, now used by NASA during the last two missions. Figure 2-5 shows a detailed cross -section of the devices. These capsules provide typically around 250 watts (thermal) at missio n start (NASA, 2023b). While they do not produce electrical power on their own, they may be stacked within a full RTG system using thermoelectric elements to convert their heat to e lectricity. Another common RPS is the Light-Weight Radioisotope Heater Unit (LWRHU), which des igners have used to regulate the temperature of instruments. The LWRHU is fueled by plutoniu m oxide encased in pellets to keep them intact, even upon reentry and impact (INL, 2015, 38-3 9).

2-10 Figure 2-5 A labeled diagram of an MMRTG and a GPHS

Source: Multi-Mission Radioisotope Thermoelectric Generator (MMRTG), Bechtel, 2011.

Multiple safety analyses and reviews have been conducted for mi ssions carrying RTGs, which are documented in safety analysis reports (SARs). Since 1970, p ublicly available environmental impact statements (EISs) or environmental assessments precede S ARs and often summarize early analyses of the missions nuclear safety. Contractors tha t have conducted safety analyses in the past (specifically the GPHS-RTG series) include the John s Hopkins University Applied Physics Laboratory, the Los Alamos National Laboratory, the Nav al Ocean Systems Center, the NUS Corporation, and the Sandia National Laboratories (INL, 201 5, 25). The final SARs (FSARs) are generally not available to the public. As required by presidential direction (discussed in section 4.1.2), the INSRP conducted independent r eviews of all launches with space nuclear systems and reported its findings in safety evalu ation reports (SERs). These SERs are also generally not publicly available; however, presen tation papers and journal articles that summarize the process and results for some missio ns are publicly available.

2.4 Space Nuclear Incidents

Given the complex nature of space missions, many factors can le ad and have led to mission failure, occasionally impacting missions using NPSs. The United States has experienced four incidents involving NPSs, while the former Soviet Union has exp erienced eight such incidents.

Of those, one U.S. incident led to the reentry and dispersal of the RTG while five of the former Soviet Unions incidents led to reentry and dispersal, two reac tors and three RPSs. None have posed a significant threat to the general population, the expos ure from those few with radiological releases having been spread so broadly as to be ne arly insignificant6 for a given individual (DOE, 1987a, 38-39; Bennett, 1992a, 274-276), assumi ng that the Cosmos 300 and

6 In the case of Cosmos 954, the surviving radiological inventory scattered across a less inhabited part of Canada, which was the reason its reentry caused little harm (Bennett, 1992a, 274).

2-11 305 RTG dispersals did not impart doses significantly higher th an that of SNAP-9A. Still, these incidents serve as a future guide and show how safeguards have performed in the past.

Table 2-3 summarizes four U.S. space mission incidents involvin g nuclear systems. The first of these was the Navys Transit 5-BN-3 navigational satellite, car rying a SNAP-9A RTG as its power source. The vehicle failed to achieve orbit and reentered above the Mozambique Channel. At that time, the dispersal design philosophy for RTGs was in effect. SNAP-9A performed as designed, burning up into minuscule particles in t he upper atmosphere. According to the AEC, the incident constituted no health hazard to the pu blic (DOE, 1987a, 38-39). The next incident occurred on the SNAPSHOT mission equipped with SN AP-10A. After 3 months of operation, which only began after insertion into a long-term or bit, a voltage regulator malfunction outside of the reactor led to premature shutdown as intended by automated safety systems (Bennett, 1990, 2). The projected reentry of the spacecraft in about 3,800 years is now its only hazard, at which point the core will have decayed and be mostly inert (Lee and Buden, 1994, 2).

Table 2-3 U.S. Space Mission Incidents Involving Nuclear System s

Mission name NPS(s) Incident date Incident description Transit 5-BN-3 SNAP-9A Apr. 1964 Orbital failure, RTG disintegration into atmosphere SNAPSHOT SNAP-10A Apr. 1965 Voltage regulator malfunction, precautionary reactor shutdown after 43 days of operation Nimbus B-1 SNAP-19B May 1968 Launch failure, both RTGs recovered and (two units) fuel reused Apollo 13 SNAP-27 Apr. 1970 Spacecraft damage, RTG reentered an d submerged into South Pacific intact Source: Safety Status of Space Radioisotope and Reactor Power Sources, Bennett, 1990.

Following the Transit 5-BN-3 incident, the safety philosophy fo r RTGs shifted from dispersal to containment upon reentry. The Nimbus B-1 mission made an unplan ned test of the SNAP-19B RTGs containment design when it fell off course early in launc h, and its operators aborted launch for range safety to fall into the ocean. Although the in cident did not help designers determine the success of the intact reentry design, surveyors e ventually found the craft with the RTG fuel fully contained and not damaged (DOE, 1987a, 62-64). A later (successful) mission reused the Pu-238 fuel. Figure 2-6 depicts a diagram of the RTG. The last of these incidents occurred with the Apollo 13 mission. Damage to the spacecraft r equired a mission abort, leading to the reentry of both the command and lunar module, the latter containing a SNAP-27 RTG.

Most of the lunar module disintegrated upon reentry and the RTG landed in the South Pacific Ocean in the vicinity of the Tonga Trench. Radiological surveys found no traces of the RTG, indicating that the plutonium fuel was successfully contained ( DOE, 1987a, 69-70).

2-12 Figure 2-6 The SNAP-19 RTG, which NASA used in several missions, with modi fications, including Nimbus, Pioneer, and Viking

Source: Atomic Power in Space: A History, DE87-010618, DOE, 1987.

During its space program, the Soviet Union experienced a greate r number of space nuclear incidents than the United States, including the reentry of reac tors. Table 2-4 lists these incidents, although some are speculative in their exact nature due to a lack of public information. The most notable incidents begin with Cosmos 954, a RORSAT with an SNR as its power source that reentered the Earths atmosphere following a spacecraft malfunction.

Approximately 4 kilograms (kg) (8.8 pounds) of its fuel and fis sion products were dispersed above Canadas Great Slave Lake, yet radiation levels were disc overed to be lower than background levels except in proximity to the remaining debris, thus posing minimal threat to the Canadian population (Bennett, 1992a, 274). It is possible injur ies and even fatalities may have occurred had reentry taken place over a major population center (Central Intelligence Agency (CIA), 1991, 4).

President Carter proposed a coordinated ban on Earth-orbiting n uclear reactors unless fail-safe mechanisms could prevent radiological release into the atmosphe re, though such calls were rejected by the Soviet Union (INL, 2015, 58). After Cosmos 954, the Soviet Union prioritized measures to ensure the full disintegration of the reactor core and the dispersal of its fuel.

Cosmos 1402 demonstrated these new measures after failing to ac hieve orbit. When the spacecraft detected atmospheric heating, it ejected the core an d gave it a boost. The core later reentered separately and fully disintegrated with an estimated health impact of much less than one cancer fatality (Bennett, 1992a, 276). Safeguards for the C osmos satellites included a system to detach the core and place it into a storage orbit upo n several failure conditions. This was seen in Cosmos 1900, where either because of excessive reac tor temperature or some other spacecraft failure (the Soviet Union never commented on w hat exactly had occurred), the reactor was automatically separated and boosted into a higher o rbit (Bennett, 1992a, 276-277).

2-13 Table 2-4 Soviet Space Mission Incidents Involving Nuclear Syst ems

Mission name NPS type Incident date Incident description Unknown Reactor Jan. 1969 RORSAT launch failure a Cosmos 300 RPS Sep. 1969 Escape trajectory failure, polonium-21 0 source disintegration in atmosphere a Cosmos 305 RPS Oct. 1969 Escape trajectory failure, polonium-210 source disintegration in atmosphere a Unknown Reactor Apr. 1973 RORSAT launch failure a Cosmos 954 Reactor Jan. 1978 Malfunction leading to uncontrolled reentry Cosmos 1402 Reactor Jan.-Feb. 1983 Orbital failure (spacecraft and core separated at reentry)

Cosmos 1900 Reactor Sep. 1988 Unknown failure, automatic separation and orbital boost Mars 96 RTG Nov. 1996 Escape trajectory failure, Pu-238 RTG int act after reentry and impact Sources: Soviet Space Nuclear Reactor Incidents: Perception Versus Reality, Bennett, 1992; Nuclear Power Assessment Study: Final Report, TSSD-23122, JHU/APL, 2015.

a Marked causes are speculative due to lack of information.

Following Cosmos 1900, it seemed that the Soviet Union amended its space nuclear policy, as no more reactors were launched into space before 1991 (CIA, 199 1, 6), the year of the Soviet Unions dissolution. Since assuming control of the former Sovie t Unions space program, the Russian Federation has not launched any SNRs of its own.

2.5 Future Missions

The field of space nuclear systems is one of active development. This section does not provide an exhaustive list of all current projects targeting the field, but instead refers to examples that have publicly discussed the efforts taken for the safety of eac h proposed system.

Since the 1970s, there have been projects to develop a dynamic RTG using either Rankine or Brayton cycles for power conversion. These have culminated in t he Advanced Stirling Radioisotope Generator (using a Stirling cycle) that is still i n development. Dynamic power conversion may offer higher efficiency for these systems, thoug h technical issues have persisted. Recent designs have simply reused the GPHS as a heat source (INL, 2015, 45-53).

There are no specific plans for a mission using a dynamic RTG.

The recent Kilopower project aimed to develop an SNR for use be yond low Earth orbit. The NTP Program aims to develop an engine planned for low Earth orbit d eparture, possibly with a return to low Earth orbit, as well, if made reusable (Camp et al., 201 9a, 8). These projects have been joint ventures between NASA and the DOE. An experiment using a terrestrial prototype of the Kilopower Reactor Using Stirling Technology (KRUSTY), a neutron -moderated 10 kW fission reactor, was successfully demonstrated in 2018 (NASA, 2021), af ter which the project ended.

The current Fission Space Power project extends the Kilopower p rojects work and aims to develop systems for use on the Moon and Mars, with lunar operat ion projected by the late

2-14 2020s (NASA, 2022). Current efforts by the Space Technology Mis sion Directorate of NASA focus on NTP, but options for NEP are being explored (Calomino, 2021, 9-11).

The Demonstration Rocket for Agile Cislunar Operations (DRACO) is a DOD-led NTP project.

Over the course of the development, NASA and the Defense Advanc ed Research Projects Agency (DARPA) will collaborate on assembly of the engine befor e the planned in-space demonstration of the late 2020s (NASA, 2023a). This project is dedicated to the new safety guidelines and approval process outlined by NSPM-20 (Greiner, 2 021, 4).

Another planned RTG-equipped mission is NASAs Titan Dragonfly probe. The mission plans to use an MMRTG similar to the Mars Science Laboratory (MSL) and M ars 2020 missions. This would mean that the consequence analysis for the Mars 2020 miss ion could be adapted, and the safety evaluations from those previous projects would be re levant in reviewing safety for the mission (McHugh and Wheeler, 2021, 1).

2-15 3 SAFETY ANALYSIS FOR SPACE NUCLEAR SYSTEMS

The NRC frequently uses the probab ilistic risk assessment (PRA) framework as a method for analyzing the risk of nuclear systems. In a passage explaining the approach to space nuclear safety analysis used by the European Space Agency (ESA), PRA is described as the systemic identification and evaluation of the risk posed by the complete spectrum of possible accident scenarios (Pressyl, Panicucci, and Peltonen, 1992, 280).

Three questions are used to define risk: (1) What can go wrong ? (2) How likely is it? (3) What are the consequences?7 PRA, if answering all questions, can estimate total risk. The f ocus of this section, however, is on the third: offsite consequences. A lthough the NRC helped advanced PRA methods for use in nuclear power regulatory applications, i t is important to note that applying these analyses to space nuclear systems involves a sig nificantly distinct environment.

One challenging aspect of space nuclear safety is that, unlike the stationary terrestrial nuclear reactors that the NRC typically regulates, NPSs are highly mobi le and often have unpredictable potential affected sites when in flight. Unique failure modes c rucial to the source term (the amount of released radiological material) compound this challen ge. Before launch, the area around the launch pad is the site at greatest risk. Afterwards, there are new possible accident scenarios, such as impact upon loss of trajectory or a fireball from a propellant accident. During ascent, an accident could occur at any site along the vehicles flight path and has no precise site for analysis. Once in space, the reactor may reenter prematurel y and would either disintegrate completely or impact, a failure mode no terrestrial reactor wou ld experience. Even a successful launch may include reentry for Earth-bound NPSs because of inev itable orbital decay (Hagis and Dix, 1960, 25), though that point in time may be thousands of years in the future.

Three terms used throughout this and subsequent sections are s afety analysis, safety evaluation, and safety review. It is important to note the p recise definitions of the terms, at least as they are used in this report:

• Safety analysisThe safety analysis is typically conducted by the designers of the NPS.

The aim of this analysis is to determine the consequences of th e devices use, which include both the hazards and associated probabilities. This inc ludes the launch system and the planned trajectory by necessity, as those dictate many details of the accident environments. Risk assessment, as described previously, is a co mmon approach to these analyses. In recent missions, NASA contracted the DOE to perform the safety analyses of missions, which it describes in the SAR.

• Safety evaluationAlthough the name may suggest a process similar to the safety analysis, this refers to the evaluation of the analysis, and not an evaluation of the device itself (though, at times, safety evaluations have involved anal ysis to confirm the findings of the safety analysis). Historically, these have been conducte d by an interagency group.

7 This is the typical definition of risk for risk assessment purposes. The NRC, as a regulator charged with the safe licensing of nuclear reactors and materials, uses this definition in its risk-informed approach. More details of the NRCs definition of risk are available at https://www.nrc.gov/about-nrc/regulatory/risk-informed.html.

3-1 The evaluations determinationsalternative values, areas lacki ng in sufficient detail, or any other issues, if applicableare described in the SER.

• Safety reviewThis refers to the entire process, which includes both the safe ty analysis and the safety evaluation. The safety review, as referred to in this report, begins with the planning of the launch and the beginning of the safety analysis and ends when the SER has been read by the sponsoring agency and launch authority in preparation for deciding whether to proceed with the launch. Since the interagency safet y review process typically includes involvement on the evaluators behalf, begin ning with the initial drafts of the SAR itself, this phrase is used to indicate activities p erformed by the interagency groups.

This section provides an overview of space nuclear safety analy sis, highlighting key distinctions from terrestrial reactors. It also includes a comprehensive lis t of historical fuel sources used in NPSs, along with the potential biological hazards of each. It s ummarizes safety analyses and evaluations wherever possible as examples, including the very f irst NPS design, SNAP-1A; the very first and only nuclear reactor launched into orbit, SNAP-1 0A; and modern missions starting with the Galileo and Ulysses missions and ending with the Mars 2020 mission. Lastly, this section lists various methods for the risk assessment of NPSs. While this section is not meant to be comprehensive, the examples should give the reader an apprec iation for the evolutions of the use, analysis, and consequences of space NPSs.

3.1 An Overview of Space Nuclear Safety Analysis

During the first U.S. space nuclear system launches, designers categorized safety analyses into three areas: (1) launch failure, (2) ascent failure, and (3) fi nal stage failure. Each was then subdivided into specific accident scenarios, such as failure of a propellant tank, propulsion, or guidance (Dix, 1959, 57-65). While accident analyses have evolv ed since then, the basic division of categories still ex ists, with modern analyses typic ally composed of six phases, with their numbers starting at phase 0:

(0) prelaunch (1) early launch (2) late launch (3) suborbital (4) orbital (5) long term (Bixler et al., 2013, 19)

For the Cassini mission, a seventh phase was added to account f or an Earth flyby, the Earth gravity assist, used to boost the speed of the probe to its fin al destination (Frank, 2000, 251-252).

Assessing the risk of NPSs involves answering three main questi ons:

(1) What are the events that lead to some consequence?

(2) How likely are each of these events?

(3) What are the potential consequences of each of these events ?

3-2 Those analyzing nuclear safety often use risk assessment, which the PRA framework divides into three levels. The first covers the damage to the core of t he system, and for reactors, designers compute a core damage frequency. The second level cal culates the source term and associated release frequencies. The final third level analyzes the offsite consequences, leveraging the results of the first two levels of analysis, and reports the risk of the system that is defined as the offsite consequences (e.g., public health effect s) of each event times its frequency (Bixler et al., 2013, 20). The space launch safety gu idelines are described in terms of the third level of analysis.

3.2 The Risk of Space Nuclear Fuel Sources (Early 1960s)

While older RPS and associated safety analyses offer valuable i nsights, the evolving nature of spacecraft, launch vehicles, and NPSs renders them less applica ble to modern missions. The state of knowledge and techniques used in these safety analyses have advanced over time.

Nevertheless, these early safety analyses were comprehensive, a nd some aspects were based on test data. As such, for analyses and reports before the 1980 s (i.e., before the Galileo and Ulysses missions), the summaries below focus on fuel source typ es and their past-calculated consequences for more broadly applicable results than system-sp ecific findings. Past determinations of the fuel sources radiological impacts are ty pically similar, barring possible changes in knowledge, though launch sites, launch vehicles, and other factors may change.

Consequently, even today, these pas t reviews give a view of the benefits and risks of each fuel source and show how Pu-238 has become standard among modern RTG s. Table 3-1 shows a few key characteristics of six radioisotopes considered for use in RPSs.

Table 3-1 Comparison of Radioisotopes Considered for Use in RPS s

Radioisotope Power density Radiation Half-life Shielding (watts per (years) requirements gram)

Cerium-144 25.6 Beta, Gamma 0.78 High Curium-242 120.0 Alpha 0.45 Low Curium-244 2.8 Alpha 18.0 Medium Plutonium-238 0.56 Alpha a 89.0 Low Polonium-210 141.0 Alpha a 0.38 Low Strontium-90 0.90 Beta 28.0 High Source: Aerospace Nuclear Safety, Blake, 1965.

a The isotope may sporadically emit gamma-or x-ray radiation, or both, as well, but in low intensities.

3-3 3.2.1 Cerium-144

Cerium (Ce)-1448 is among the oldest fuel sources used for RPSs, dating back to the beginning of the SNAP program with the SNAP-1A 9 (also known as Task 2) generator, shown in Figure 3-1. The initial fuel load of the generator was 0.88 megacuries (3.256 terabecquerels) of Ce-144 in insoluble fuel form (3.32 kilograms of cerium dioxide), whic h has a half-life of 285 days (Klein, 1960, ix). Early reports for SNAP-1A include a preliminary asse ssment of the hazards of operation (Dix, 1959), an interim report on safety procedures ( Klein, 1960), and an FSAR (Dix, 1960). The radiation from Ce-144 includes beta and gamma rays. The SNAP-1A RPS interim report attributes the isotopes biological hazard to ingestion and inhalation if released to the biosphere and external exposure from prelaunch operations and a ccident recovery (Klein, 1960, 9).

Figure 3-1 The SNAP-1A device

Source: HD.6D.472, n.d., in DOE, AECReactor Development, 201 3.

8 Ce-144 is a fission product that is separated from reactor wastes. The decay of Ce-144 (half-life of 285 days) to its daughter, praseodymium-144, results in the emission of beta particles and gamma rays, but most of the thermal power is derived from the energetic beta decay of praseodymium-144 to neodymium-144. Thus, in addition to the decay gamma radiation emitted by radiocerium, a large portion of the photon radiation emitted is in the form of x-radiation originating from the slowing down of energetic beta decay particles (Bremsstrahlung)

(Klein, 1960, 5).

9 The SNAP-1A generator used a Rankine cycle of liquid mercury driving a turbogenerator, which is referred to as a dynamic RPS rather than an RTG, which are static RPSs. All subsequent SNAP RPS designs had no moving parts and instead used thermoelectric converters (DOE, 1987a, 12).

3-4 The preliminary assessment was an analysis of radiological haza rd and did not report the integrated risk of each scenario (Dix, 1959). It divides failur e modes into the launch, ascent, and final stages, which were in turn divided into specific subtypes. For an example, launch failures included propellant mixing causing an explosion, propulsion fai lure (referring to the destruction of the engine), and guidance failure in which the spacecraft lo ses the launch trajectory. These failure modes are familiar even in later analyses, as they are persistent accident scenarios.

Next, the report identifies the resulting forces in each scenar io and calculates their effects. A somewhat pessimistic analysis is presented that considers only aborted missions with the full fuel inventory. Most resulted in a negligible release of fuel i f any at all, although all final stage failures would lead to fallout after the disintegration of the containment vessel and fuel from ablation upon reentry. The preliminary report divides this fall out into direct falloutlocated in the Southern Hemisphere following reentry at a well-known pointand random fallout following orbital decay and reentry. The assessment concluded that calcul ated dosages in both scenarios were much smaller than those from previous nuclear weapons test ing, and their low probabilities made their risk even less significant.

The FSAR for SNAP-1A is the update of the preliminary report. I n addition to launch failures, the report analyzed the risk from planned reentry, in which the rad ioactive inventory would decay to a negligible radiological impact by the time of reentry (Dix, 1 960, 79). Although the report stated that the mean residence time of fallout at the altitude of rele ase would be 5 years or more, the analysis conservatively assumed a mean residence time of 8 mont hs following 600 days of decay time.

During the same year that the SNAP-1A analysis was completed, a preliminary safety analysis of a low power Ce-144-based generator was issued that compares the SNAP-1A and SNAP-3 (polonium (Po)-210) RTGs (Martin Nuclear Division (MND), 1960). This configuration employs two generators, each containing 9.9 kilocuries. Similar to the SNAP-1A safety analysis, this report considered the integrity of the fuel capsule under the s pectrum of launch failure forces.

These forces include internal pressure, external forces from sh ock overpressures and impact, corrosion, and propellant fires. Following successful missions, the fuel was planned to be released in the stratosphere at a time when the source strength is about 4 kilocuries.

Despite these safety analyses of Ce-144-based systems, the U.S. space program never used cerium as a fuel source on a space mission. The utility of SNAP -1 and its fuel had been made obsolete by longer term operational requirements as well as the advent of more efficient thermoelectric materials (INL, 2015, 4).

3.2.2 Curium-242

Another considered radioisotope was curium (Cm)-242 for use in the SNAP-11 RTG design that was intended for the Surveyor Moon missions (DOE, 1987a, 34). I t is a source that decays by alpha emission into Pu-238 that is primarily a hazard if inhale d or ingested. A report (Riggs, 1960) on its potential use as an NPS on future missions that an alyzes its safety follows the methods of previous reports (e.g., SNAP-1A, SNAP-3) issued in 1 960. While it discusses the endpoint of the fuel for each scenario (i.e., whether it disper ses), it lacks detail on the resulting effects on the public. The SAR for SNAP-11 was issued but is no t readily available. The SNAP-11 RTG never flew on a mission (JHU/APL, 2015, 98), the sh ort half-life of Cm-242 and rapid development of solar cell technology making the design ob solete even before its use.

3-5 3.2.3 Plutonium-238

Pu-238 has proven to be the most successful RTG fuel, and RPSs typically use it to this day.

The radioisotope emits primarily 10 alpha particles. As such, its primary biological hazard is exposure through ingestion and inhal ation, which is most easily achieved if the material is dispersed in the biosphere. The risks that ingestion and inhala tion posed inspired the containment safety philosophy behind the modern U.S. RTG design (Bennett, 1981, 425). The first space nuclear system design to use Pu-238 was the MOD-1 ( also known as Task 5.6) thermoelectric generator. Its safety report found that a high-a ltitude abort could lead to fallout after the systems disintegration with an insignificant dose to the global population, and its random fallout would decrease over time as the radiological mat erial decreased in amount from decay (Knighton, 1960, 35-38).

The Pu-238-fueled SNAP-3B was the first RTG to fly into space. It provided power to a Transit satellite as a supplement to its solar panels (INL, 2015, 6). I nitially, the AEC had not allowed the use of Pu-238, but after designers argued for its advantages ov er alternative fuels, the commission relented (Schmidt et al., 2009, 5). A report determi ned the greatest risk came from an early release before the Pu-238 had time to decay, a possibl e result of dispersal during reentry or sea water corrosion (Willis, 1963, 4). A subsequent safety analysis detailed the possible risk of the system, considering instantaneous release at launch, long-term release at launch, long-term release in coastal water, and high-altitude d ispersal of the initial fuel inventory. Small fuel pellets fr om the system would be hazardous if breached up to a mile downwind, and fuel release was possible under certain impact co nditions. Such an event was deemed unlikely, however, and largely prevented by the design o f the RTG (Buckalew, Byrne, and Halsey, 1964).

The SNAP-9A RTG was the next SNAP design, once again using Pu-2 38 as its heat source.

Unlike SNAP-3B, it was the sole power source for three Transit missions (INL, 2015, 6). The generator was not designed for intact reentry, and when the thi rd Transit satellite carrying the device failed to achieve orbit, it ablated into the atmosphere as designed (Hardy et al., 1972, 2).

At the time, determination of the fallout inventory was unsucce ssful. Eight years after the incident, in 1972, a report (Hardy et al., 1972) detailed succe ssful measurements of the global deposition. It determined about 13.4 kilocuries (between 11.2 a nd 15.6 kilocuries, within uncertainty) was deposited globally, though the RTG had an inve ntory of 17 kilocuries (1 kg (2.2 pounds) of Pu-238) at the time of reentry into the Souther n Hemisphere (Hardy et al., 1972, 17). To date, this is the only known instance of fuel release b y a U.S. RTG.

3.2.4 Polonium-210

Po-210 is yet another alpha emitter with sporadic gamma-ray emi ssions, mainly hazardous after ingestion or inhalation. It was the fuel used by early iteratio ns of SNAP-3, the first SNAP RTG (as SNAP-1 had been a dynamic RPS u sing a Rankine-cycle turboge nerator) and the same design displayed on President Eisenhowers desk. The first repo rt (Dix et al., 1959) on its safety considers the mechanical, thermal, and chemical integrity of th e containment vessel. One possible threat to its integrity was internal: helium produced by the decay would increase

10 In addition to alpha particles, Pu-238 emits various gamma-and x-ray particles at much lower intensities than the alpha particle emissions.

3-6 internal pressure on the vessel. Given the design, however, the report concluded it would not cause a breach.

A later report added that the sources emissions would be atten uated by the RTGs shell and turned into heat, posing little hazard to those around it, and, similar to other devices of the time, it was designed to disintegrate upon reentry (Hagis and Dix, 19 60, 43-46). A feasibility study for a lunar mission noted that even in the case of the ablation (bu rnup) of the 696,000-curie source during reentry, the radioactivity in topsoil following any such accident would be less than that from previous weapons testing (MND, 1964, 15-18). Similar to ce rium and curium, however, polonium was never used on a flown U.S. NPS. The SNAP-3 design would even be modified to use Pu-238 rather than polonium once the designers received AEC approval (Schmidt et al.,

2009, 5).

3.2.5 Uranium-235

The United States has rarely used uranium for NPSs, as it is a fission-based rather than a decay-based heat source. The sole mission to include uranium on board was SNAPSHOT with the SNAP-10A reactor. Although the context of the missionthe l aunch vehicle, the power system design, and the planned trajectoryis crucial to all saf ety analyses, it is difficult to make a general analysis of the hazards of U-235, as it does not pres ent radiological hazards itself.

Instead, its fission is the source of all hazards: a sudden, un controlled, and self-sustaining fission of the U-235 fuel, prompt criticality, presents a poten tially hazardous release of energy and radiation. Even controlled fission will leave behind fissio n products in the reactor core that may present radiological hazards.

The SNAP-10A reactor comprised a zirconium hydride and U-235 co re, beryllium reflectors, a sodium-potassium liquid coolant, and thermoelectric converters for power conversion. The reactivity was entirely controlled by the beryllium reflectors, which were able to rotate. In thermal energy, the reactors power level was 34 kW (Alexander et al., 1965, 20-21). Launched in 1965, it became the first nuclear reactor to be successfully operated in space (INL, 2015, 8).

A paper (Willis, 1963) showed that, under certain circumstances no prompt criticality, the core successfully shut down before 8 years of operation at full powe r and was fully ablated upon reentrythe SNAP-10A biological hazard was less than that of th e SNAP-9A RTG for the same orbital life of 900 years. The SNAP-10A reactor remains in orbi t to date, and while no SNAP-9A RTG has yet experienced reentry following a successful orbit, o ne such RTG was ablated shortly after launch after the satellite failed to achieve orbi t.

The Final SNAPSHOT Safeguards Report (Alexander et al., 1965), the SAR for the SNAP-10A reactors mission, described the probabilities of specific cond itions of failure and accidents. It used predictions of the reactors radiological inventory, a fun ction of the power history of the reactor as well as the time passed since shutdown, and each acc ident environment to determine the hazards and possible doses.

The report included a figure, reproduced here as Figure 3-2, to show the fission production, which suggested the maximum inventory would occur 1 year into f ull-power operation at nearly 200 kilocuries. With a shutdown at 3 years, this amount sharply decreased to below 0.1 kilocuries within a couple of years. If shutdown was not ac hieved, power would decay until,

3-7 at 76 years, the reactors operation would be naturally halted as its components wore down.

Until that point, the inventory would remain between 10 and 100 kilocuries, but afterwards, it would quickly decrease below 10 kilocuries (Alexander et al., 1 965, 124). Note that, as described previously, the ablated SNAP-9A RTG resulted in the d eposition of around 13.4 kilocuries globally (Hardy et al., 1972). An addendum to t he Final SNAPSHOT Safeguards Report found that water immersion could induce prompt critical ity by flooding and evacuating the reactor coolant (Hart et al., 1965, 9-12).

Figure 3-2 A plot of the radiological inventory of SNAP-10A fol lowing startup of the reactor

Source: Final Snapshot Safeguards Report, NAA-S10022, LMSC B-107701, Alexander et al., 1965, 124.

The Flight Tests Final Safeguards Report for the SNAP-10A rea ctor included a calculation of the total injury probability over different orbital lifetime po ssibilities. The report included

3-8 accidents such as fuel entering a municipal water source and a probability for each failure scenario (Stewart, 1964, 23-39).

Later studies considered other uses of the reactor that never m aterialized. In the consideration of meteorological satellite use of the reactor, areas of highes t risk were described. It was found that, with the flight procedures, there were no major hazards b etween the launch of the system and the point at which it achieved orbit except for criticality, which itself was made unlikely by several safeguard systems (Atomics International, 1964, 111-117 ).

3.3 Safety Analyses Since the 1980s

This section summarizes several safety analyses and evaluations as applicable for missions since the late 1980s, though the list is not exhaustive.

As several types of documents are available for the systems and missions discussed in this section, it is important to note the three most common, and cru cial, documents. As previously noted, the SAR describes the safety analysis of the system or m ission and the risks it presents.

The SER then often summarizes the contents of the SAR and evalu ates the quality of the analysis contained in the SAR. These two reports are often unav ailable to the public. The third type of document that is always public is the environmental rev iew, typically either the EIS or environmental assessment, mandated by Federal law, which descri bes the possible environmental impact of the mission and proposed alternatives, including nuclear consequences when applicable. These may include a less detailed safety analy sis or may even summarize the SAR, though they are released before the SAR itself is finalize d.

3.3.1 The Light-Weight Radioisotope Heater Unit

The LWRHU comprises a small cylinder of Pu-238 used to heat spa cecraft elements to maintain them at operating temperatures. Missions that have used the cur rent LWRHU design are Galileo with 120 units (1989), Mars Rover Sojourner Pathfinder with three units (1996), Cassini with 117 units (1997), Mars Rover Spirit (2003) with eight unit s, and Mars Rover Opportunity (2003) with eight units (Zillmer and Gates, 2022). Notably, the se systems received a system-specific SAR that suggested most missions would not need to conduct a separate analysis for the integrated risk of the LWRHUs.

One LWRHU used on the Galileo spacecraft is about 1 watt and 26 millimeters (roughly 1 inch) in diameter by 32 millimeters (roughly 1.3 inches) long; each L WRHU weighs about 40 grams (roughly 1.4 ounces) (Zillmer and Gates, 2022). The Galileo mis sion referred to the generalized LWRHU SAR rather than analyzing the LWRHU with respect to the l aunch system and spacecraft. The initial volume of the report, which outlines th e design and key aspects of its possible accidents, specifically highlights that the fuel relea se would only occur in the event of an accident during an Earth gravity assist. This conclusion was reached through testing and was accompanied by an assessment of the probabilities associate d with various accident scenarios (Johnson, 1988a, 16).

The second volume delves further into these accidents, providin g a flowchart of possible mission outcomes with associated conditional probabilities, a p ortion of which is depicted in Figure 3-3. Each accident that culminates in a fuel release is marked within the flowchart.

Furthermore, the report includes appendices that explain the ca lculation of these probabilities in

3-9 detail (Johnson, 1988b). Lastly, in the third volume, the calcu lation of radiological consequence for the gravity-assist phase is performed, focusing solely on t his phase as with the potential for fuel release. The volume concludes with a summary that identifi es the expected consequence to be a population dose in person-rem of 7.8 de minimis, excluding doses deemed insignificant (Johnson, 1988c, 2-3).

Figure 3-3 An example subbranch of possibilities from the 1988 LWRHU report

Source: Light-Weight Radioisotope Heater Unit Final Safety Analysis Report (LWRHU-FSAR), Johnson, 1988b, 37.

While the low risk of this system led designers to make a gener al SAR, there is no single SER for these systems, as the safety review process is conducted on ly for missions, not general systems. Galileo and Ulysses are two examples of missions using LWRHUs that underwent the safety review process due to their use of nuclear systems, resu lting in mission-specific SERs.

The Mars Pathfinder mission used only the LWRHU and was reviewe d by the INSRP with a new mission-specific SER issued before launch.

3.3.2 The Galileo (1989) Mission

The Galileo mission to Jupiter would be the sole U.S. space nuc lear system launch during the 1980s. Originally planned for a 1986 launch, the destruction of the Space Shuttle Challenger delayed its flight to 1989. This change also included the cance llation of the original upper stage system, the Centaur upper stage launch vehicle (INL, 2015, 32). The Galileo mission provides an example of an SAR and an INSRP SER, as both are public, thou gh as both were written several decades ago, the content may not be fully reflective of more recent reports, such as those for the MSL and Mars 2020 missions. Although a public EIS was also published for this

3-10 mission, the EIS is not described here since the SAR and SER th emselves are public. Galileo was the first NPS-equipped spacecraft to make an Earth flyby fo llowing its initial escape trajectory,11 which added a phase in which accidents could potentially occur.

The first volume of the Galileo SER begins with a summary of th e mission, the purpose and scope of the review, and the safety review process. It then det ails the mission profile as well as the transportation, launch, spacecraft, and radioisotope system s. Before discussion of the analysis, it also describes the launch site and surrounding are as as well as safety procedures and equipment. Similar to an SAR, it also presents design detai ls and provides a summary of possible accidents and their probabilities. It specifically ide ntifies scenarios that would lead to fuel release and makes note of certain concerns regarding the a nalysis of the FSAR. Rather than defining phases by the location of the craft, as with the Cassini mission, the phases indicated events in the spacecrafts operation: (0) prelaunch, (1) launch and ascent, (2) solid rocket booster separation and main engine cutoff, (3) on-orbit, (4) deployment to escape, and (5) Earth flyby (INSRP, 1989a, E-2).

Following that, the second volume elucidates the review methodo logy and describes additional analysis conducted by the INSRP subpanels. It also includes a d escription of the reference documents for the review (INSRP, 1989b). The Biomedical and Env ironmental Effects Subpanels supplemental report, separate from the panels SER, is also available, providing a detailed analysis where the FSAR was deemed insufficient, such as the modeling of seafood ingestion (INSRP, 1989c).

3.3.3 The Ulysses (1990) Mission

The Ulysses mission, completed in cooperation with the ESA and launched in 1990 (originally planned for 1986 similar to the Galileo mission (INL, 2015, 32) ), selected the Suns polar regions as its destination. Two key aspects of its launch and s ubsequent path to the Sun included the use of the Space Shuttle system as a launch vehicl e and a Jupiter flyby for a gravity assist. The latter choice did not impact the safety rev iew, as once the probe escaped the Earths gravity, there would not be a credible risk of reentry for the probe. The choice of the Space Shuttle as a launch system, however, was key to the probe s safety analysis, with particular attention to the possibility of a Challenger-type ac cident (Sholtis et al., 1991, 133, 135), which had occurred only 4 years before the missions laun ch.

Although the Ulysses SAR and SER are not publicly available, a report (Sholtis et al., 1991) summarizes the results of the INSRP review for the mission. The panel identified 19 possible accidents involving fuel release but narrowed them down to 11 a ccidents that had any significant effect, based on the release fraction or probabilit y. The SERs results suggested that the expected consequence was insignificant, with any degree of fuel release unlikely. As noted by a technical overview of the report, even in an accident rese mbling Challenger, no fuel release was expected to occur (Sholtis et al., 1991, 133-135).

11 The use of an Earth gravity assist for the Galileo mission was another effect of the destruction of the Space Shuttle Challenger. The Centaur upper stage launch vehicles replacement, which used solid propellant rather than liquid propellant, was unable to send the probe to Jupiter on its own, and so the Venus-Earth-Earth gravity assist would be used to complete the probes journey (INL, 2015, 32).

3-11 3.3.4 The Cassini Mission (1997)

The Cassini mission to Saturn was the second with an NPS to con duct an Earth flyby following its initial escape trajectory. Although the probabilities sugge sted that fuel release was highly unlikely, certain conditions led to high source terms in the an alysis of the mission.

Consequently, Cassini was subjected to a great degree of public scrutiny, with many activists seeking to delay or even cancel the launch (Kastenberg and Wils on, 2004, 54, 57-58).

Similar to all missions subsequent to the enactment of the Nati onal Environmental Policy Act in 1970, the Cassini mission underwent the development of an EIS t hat outlined the potential impact of the mission. The EIS was issued during the mission pl anning stage and before the comprehensive safety analysis, though the EIS analysis was also detailed. In addition to the final EIS, a supplemental EIS was later issued for Cassini that incorporated the results from the missions SAR as well as the LWRHU (1997) SAR. Typically, a sup plemental EIS is issued when specific details of the mission become known that result i n a significant change in the original EIS results. The Cassini supplemental EIS stated that the process used in the safety analyses to determine the risk associated with the Cassini miss ion is fundamentally similar to the process used for the earlier Galileo and Ulysses missions (Office of Space Science (OSS),

1997, 4-2). The approach undertaken for this mission, however, exhibited a higher level of rigor and better aligned with the modern analysis and safety review p rocesses compared to previous missions (Buenconsejo et al., 2018, 2).

In short, the determination of source terms for the supplementa l EIS involved simulating the accident environment responses of the RTGs and RHUs. Subsequent ly, transport and dispersal modeling were employed to assess the consequence of the source terms, while designers assigned weights to the probability of these consequences (OSS, 1997, 4-2). Unlike the safety analyses of its two predecessors, the Cassini supplemental EIS benefited from the extension of the techniques developed in the earlier analyses and [applicat ion] of probabilistic techniques to each of the source term probability distributions (OSS, 1997, 4-6), which resulted in a 50-year collective radiation dose, 50-year latent cancer fatalities fro m exposure, maximum individual dose and average individual risk (OSS, 1997, 4-6), land area c ontamination, and radiological risk. The supplement provides health effects as a mean as well as the 5th, 50th, 95th, and 99th percentiles (OSS, 1997, 4-6).

The Cassini SAR and SER are not publicly available. In their ab sence, the supplemental EIS and other reports describing the analysis and review provide in sight into the process and the content of the two safety reports.

The highest average individual risk was a probability less than 1 in 55 million of fatal cancer from exposure compared to an individual risk of fatal cancer fr om background radiation of 1 in 133 (OSS, 1997, 4-9). Along with an uncertainty analysis of the se results, the supplemental EIS analyzed the impacts of the alternative launch possibilities, i ncluding a 2001 mission that would have avoided the Earth gravity assist (OSS, 1997, 4-10-4-12).

The INSRP SER primarily focused on launch abort scenarios for i ts own confirmatory analysis, while accepting the SARs findings for other low-probability ac cidents. The Launch Abort Subpanel conducted its own analysis, which presented a failure probability but smaller source term and subsequently smaller risk (Kastenberg and Wilson, 2003, 55). The Reentry Subpanel

3-12 also conducted its own analysis that once again presented a sma ller risk than shown in the SAR (Kastenberg and Wilson, 2003, 57).

3.3.5 The New Horizons Mission (2006)

The 2005 final EIS for New Horizons references a summary of the DOEs nuclear risk assessment for the New Horizons mission EIS that preceded the FSAR, which appears unpublished but mainly reflected past assessments with additio nal supplemental analyses where considered appropriate (Science Mission Directorate (SMD ), 2005, 4-13-4-14). The report follows the same risk assessment procedure as the genera l framework for Galileo, Ulysses, and Cassini and identifies the launch vehicle system f ailures (SMD, 2005, 4-14). Unlike Cassini, the mission contained only six phases (the typical num ber) because it did not include an Earth gravity assist portion (SMD, 2005, 4-17).

After providing the accident probabilities and source terms (SM D, 2005, 4-25), the radiological consequence was calculated in terms of maximum individual dose, health effects, and land area contaminated at or above specific levels (SMD, 2005, 4-26 ). In this case, the individual risk was 1 in 2 billion and 1 in 2.3 trillion for a health effe ct near the launch pad and globally, respectively, compared to a risk of death due to any disease of 1 in 130 (SMD, 2005, 4-35).

Once again, the report includes an uncertainty analysis (SMD, 2 005, 4-35-4-36). Neither the New Horizons SAR or SER is publicly available, and so the detai ls found in the final EIS give the best view of what those safe ty reports would have discussed.

3.3.6 The Mars Science Laboratory (2011) and Mars 2020 (2020) M issions

As with those for the Ulysses, Cassini, and New Horizons missio ns, the SARs and SERs for the MSL and Mars 2020 missions are not publicly available. However, public reports and papers do summarize these analyses, providing insights into their content and structure. Furthermore, a public EIS was created for each mission. EISs follow a distinct format that emphasizes communication with the public, and they include some of the ana lysis conducted in the SAR.

For these missions, the full EISs include a draft EIS for publi c comment, a final EIS for NASA approval, an associated nuclear risk assessment report, and a s upplemental EIS that may be issued afterwards. Supplements were issued for the MSL EIS, due to the 2-year technical delay of the mission, and for Mars 2020, due to differences in result s between the original EIS and the FSAR.

The MSL safety analysis concluded that the early launch phase d ominates the risk of the mission and poses the largest potential source term, despite th e overall risk of the mission being low (Clayton et al., 2012, 2). Quantitatively, the mean number of health effects was below one, with the total risk (the expectation value calculated as the pr oduct of probability and the mean number of effects) calculated as 0.000962. The insignificance o f the health effects was attributed to the delayed release of the radionuclide, its smal l release fraction, and the efficacy of emergency response (Bixler et al., 2013, 10, 30).

The final EIS for the MSL summarizes the radiological impact of both the alternatives and the proposed action from the DOEs nuclear risk assessment. A diffe rence in this analysis was the division of the mission into only five phases, with the orbital phase included in the preorbit and escape phases (SMD, 2006, 4-15-4-16). The methodology and conte nt are otherwise similar to

3-13 those of the New Horizon mission. An individual health-effect r isk of 1 in a million is reported for MSL (SMD, 2006, 4-33).

The final EIS for the Mars 2020 mission employs a format simila r to previous EISs, reverting to a division of the mission into six phases (SMD, 2014, 4-27). Th e overall methodology and content are also similar to previous EISs, with the reported in dividual health-effect risk reported as 1 in 300 million (SMD, 2014, 4-51).

3.3.7 Systems Lacking INSRP Review

Although three NPS development projects never undertook a launc h safety analysis, they considered the safety of the system in its designs and took ste ps that would serve as a basis for future launch safety analyses.

The NERVA Engine. Early tests of the NERVA engine were conducted not just for the safety considerations of its use in a launch but also for the subseque nt tests to be performed themselves (Camp et al., 2019b, 9). Although no safety analysis was conducted for the engine, as it had no planned mission, it was also used as a common refe rence design for contemporary papers describing the safety of nuclear propulsion. As such, sa fety documentation exists, if not a true SAR. A contemporary document postulating the safety of s pace nuclear systems also considered nuclear engines (Hargrove and Trammell, 1964).

The SP-100 Reactor. Despite never completing the INSR P safety review process, desig ners created safety analyses theorizing the use of SP-100 on a space mission. One such report described the radiological consequence of accidents involving t he reactor for various missions, including a TITAN-launched high-orbit mission, a shuttle-launch ed NEP mission, or a shuttle-launched low-orbit mission, reporting the risk associat ed with each possibility (Bartram and Weitzberg, 1988).

The Kilopower Project. Although reaching an advanced stage of development, the Kilopow er project ended in 2018 without having ever been used on a missio n. As such, no complete launch safety analysis was conducted. However, tests of the rea ctor yielded useful information regarding the reactivity and possible doses from criticality ev ents (McClure, 2018), which may prove useful for future reactor projects.

3.4 Calculation Methods for Risk Assessments

Risk assessment is a general framework that missions can tailor to specific cases. For nuclear risk analyses, systems can range from terrestrial reactors to N PSs, the latter posing unique challenges. While the assessments may adhere to a common outlin e in their approaches, there are key considerations that distinguish between RPSs and SNRs, just as both differ from terrestrial applications.

A public methodology assessment released before the safety anal ysis of the MSL MMRTG provides a high-level methodology assessment and describes the framework of a nuclear safety analysis. In this regard, it offers a perspective on a standard risk assessment, where the only noteworthy modifications from an SNR analysis are related to so urce terms, exposure pathways, radiological effects, and other factors that merely c onstitute a stage within the

3-14 framework (Bessette et al., 2006). Lastly, the report describes the three levels of a nuclear safety analysis, summarized in Table 3-2.

Table 3-2 Levels of Analysis for Nuclear Safety Analysis

Level of detail Type of safety analysis Level A Simulations of the possible accidents and the responses of the system.

Deterministic.

Computation of many event sequences controlled by random variables and Level B incorporating simplified Level A results to produce probability distributions of the source term.

Probabilistic analysis of the results of Level B following atmo spheric Level C transport and health effects for each accident scenario and the probabilistic combination of all scenarios.

Source: Methodology Assessment and Recommendations for the MSL Safety Analysis, SAND2006-4563, Bessette et al., 2006.

In Level A, simulations determine all scenarios leading to the release of radiological material.

These simulations require a finite set of representative respo nses to accident environments, interpolation of which yields all intermediate results (Bessett e et al., 2006, 17-18).

In Level B, calculations determine the final release fraction a nd the probability distribution.

These calculations consider many e vents using random variables, creating the probability distribution that characterizes the source terms. It incorporat es the simplified results of Level A to determine these values (Bessette et al., 2006, 18).

Finally, in Level C, a simulation considers the transport of th e source term. Combined with population density, safety measures, and exposure pathways, thi s determines the probabilistic health consequences. These calculations require models separate from the nuclear system and instead use only the source term and external information, such as meteorological conditions, to determine the consequences (Bessette et al., 2006, 19). Figure 3-4 shows a diagram from the report depicting the detailed process of all levels.

3-15 Figure 3-4 The process for calculating final risk of a space nu clear system launch with the three levels labeled

Source: Methodology Assessment and Recommendations for the MSL Safety Analysis, Bessette et al., 2006.

There are multiple ways to represent the final launch risk. The report notes that the best estimate of latent cancer fatalities over 50 years, along with lower and upper bounds for the value from the confidence interval, includes the uncertainty in health consequence from all factors. Beyond this, past SARs have used probability distribut ions to report their values and divide uncertainty into two types: the epistemic uncertainty tracing back to uncertainty in the state of knowledge, and the variability or aleatory uncerta inty from the random factors modeled by Level B. Some reports s eparate these two uncertainti es for clarity (Bessette et al.,

2006, 82-83).

Another common method for reporting health consequence is globa l exposure, which is the first step to determine the exposure for any given individual. The co mmon unit for this value is the person-sievert (or person-re m), found by multiplying the exposu re dose by the number of people affected. This number can be translated into an amount of possi ble radiologically induced health effects due to the exposure (Goldman et al., 1991, 156).

Because of the different histories of their use and safety anal ysis calculations, the following section separately describes the risk assessments of RPSs and t hose of SNRs to give more system-specific detail.

3.4.1 Radioisotope Power System Risk Assessment

In the past few decades, safet y analyses have maintained simila r approaches, albeit with some notable changes. One such change has been the improvement in co des and calculation

3-16 methods. Past reports illustrate the procedural steps involved in conducting a safety analysis, including the use of specific equations that demonstrate the ev olution of these methods.

The Galileo FSAR comprises three volumes, with the third outlin ing the calculation of the missions integrated risk. For each incident that could potenti ally result in fuel release, the report presents three source terms: the most probable, the most conseq uential, and the expectation.

Computer codes then analyzed the consequence of these releases, including other factors such as location, with the final mission risk calculated from the ex pectation amount (Johnson 1988c, 7-9).

The safety analysis of the Ulysses mission employed the same ri sk assessment process, starting with the identification of accidents and their probabi lities. That was followed by determining the physical environment of each event, evaluating the RTG response, conducting a subsequent accident analysis, and ultimately calculating the consequences (NUS Corporation, 1990).

One method the Cassini safety analysis used was the event tree model, which described the potential reentry of the spacecraft following its Earth gravity assist. The event tree model lists possible events and incorporates many factors necessary for det ermining the risk associated with each individual event in the outcome calculations. Its res ults were reported in a frequency-consequence graph (Frank, 2000, 252).

Another report outlines a risk assessment framework and analyze s codes that could be used for calculations at each step (Bessette et al., 2006), included in APPENDIX A to this research information letter (RIL). Although not the FSAR itself, the ris k assessment for the Mars 2020 EIS included an appendix detailing the analysis, which was similar to that used for the MSL mission (Clayton et al., 2014).

3.4.2 Equations and Computer Codes for Radioisotope Power Syste m Risk Assessment

In the description of their methodology, earlier analyses commo nly included the exact equations used for modeling certain aspects, whereas modern analyses tend to list the dedicated computer codes. The following discussion lists various calculat ion methods used for different parts of a safety analysis, ordered by the step of risk assessm ent to which each contributes.

Accident determination. The Galileo FSAR categorized each accident into subcases that could each be modeled mathematically to identify accidents and the probability of release. The second volume of the report describes this information (Johnson, 1988b, 76-80). These subcases were specific to each component and would have to be a dapted for different missions.

The FSAR also assessed the LWRHU response to reentry, incorpora ting test data for the system.

Source term determination. During the review of the FSAR, the Galileo INSRP employed a NASA Monte Carlo code to calculate the source terms. In additio n, events with insignificant probability were excluded to avoid the maximum release of fuel being proportional to the number of trials (INSRP, 1989b, 4). Other codes were used to de termine the particle size distribution and modify the source term due to atmospheric tran sport. The reports appendix summarizes the uncertainty associated with the findings (INSRP, 1989b,88-109).

3-17 The Ulysses FSAR uses another method to calculate source terms. For each accident, an average source term and an average top 5 percent source term we re calculated and subsequently employed for further calculation (Sholtis et al., 1991, 133).

A paper (Wyss, 1996) outlines the uncertainty assessment proces s for the Cassini missions SAR. It further details the codes used in the SAR, included in APPENDIX A to this RIL, while emphasizing three methods of determining the uncertainty. Anoth er report (Robinson, 2012) summarizes the safety analysis for the MSL mission, listing spe cific codes and describing the release model for the GPHS following impact. Each of these repo rts encompasses three components: the distribution of particles within the GPHS (cumu lative mass fraction), the probability of a breach, and the release fraction.

Public consequence determination. After determining the source term for the possible accidents, the designers proceed to calculate dispersion. The M OD-1 (Pu-238) for the earliest RTG safety analysis includes a formula describing the total dep osition following reentry of the RTG (Knighton, 1960, 37). A subsequent report for the SNAP-9A R TG includes an equation describing the deposition (in units of curies) resulting from t he instantaneous release of fuel (Buckalew et al., 1964, 10), along with a method for calculatin g the horizontal diffusion of fuel released in sea water (Buckalew et al., 1964, 17). APPENDIX A t o this RIL lists modern computer codes used for these calculations.

Following dispersion, the subsequent calculation entails determ ining the exposure of the public.

One common measure used in early safety analyses is the effecti ve half-life for radiobiological effects from an isotope. This measure is obtained by multiplyin g the radiological and biological half-lives and dividing the results by their sum (Hagis and Dix, 1960, 21-23). The effective half-life quantifies the internal exposure to an isotope result ing from inhalation or ingestion. Of these two paths, inhalation is considered the greater concern, as the insoluble form of Pu-238 is relatively harmless when passing through the digestive track (G oldman et al., 1991, 154). The SNAP-9A safety analysis, mentioned in the previous section, inc ludes an equation that describes the lung dosage from the reentry of an RTG (Buckalew et al., 1964, 18).

The Galileo INSRP reports provide detailed information on the c alculation methods used for exposure, as documented by the Biomedical and Environmental Eff ects Subpanel. These methods encompassed an equation for the resuspension factor, wh ich accounts for an additional ingestion and inhalation of the isotope, and the ext ernal radiation dose (INSRP, 1989c, 44-47). Subsequent sections of the report include method s used to determine the inhalation dosage, along with the corresponding code for calcul ations (INSRP, 1989c, 50-59).

The clearance of the Pu-238 isotope, which affects the dosage a nd cancer effects, is also modeled (INSRP, 1989c, 71-85), as well as the dosage from conta minated vegetation (INSRP, 1989c, 88-91) and seafood (INSRP, 1989c,96-119).

Finally, the comparison report for SNAP-9A and SNAP-10A (Willis, 1963, 3) presents a method that uses maximum permissible body burdens to describe the tota l radiation hazard. This concept refers to the amount of water or air needed to dilute t he exposure to a maximum permissible concentration.

3-18 3.4.3 Space Nuclear Reactor Risk Assessment

A report analyzing the effects of the destruction of a nuclear rocket engine before reentry considered four factors: (1) operation history of the reactor, (2) fragment size distribution, (3) reentry timing of the fragments, and (4) the range of fragm ents on the Earths surface. The report detailed the methods used and described the affected are a, but it did not analyze the consequences to the public (Hargrove and Trammell, 1964).

The SNAP-10As safety report, Final SNAPSHOT Safeguards Report, categorized the evaluation into three phases: launch to orbit, orbit to reactor startup, and startup to reentry. The second and third appendices to the report contain the methods u sed for radiological evaluation and assumptions, respectively (Alexander et al., 1965, 251-334). Appendix E to the report describes the failure mode and im pact probabilities (Alexander et al., 1965, 347-402). While modern analysis codes supersede these methods, these methods de monstrate the process used to analyze the safety of the only SNR ever approved for la unch in the United States.

Figure 3-5 depicts a test being conducted with a model of the d evice.

Another report (Bartram and Dougherty, 1987) describes the risk s of both Pu-238-fueled RTGs and fission reactors. These risks are inherent in each system s ince there is no specific launch vehicle or mission described. The report uses the Markov chain technique to calculate mass transport and describes the estimation of risk, atmospheric tra nsfer, aquatic dispersion, and radiological doses for both dispersed and intact fuel.

Figure 3-5 A full-scale model of the SNAP-10A reentry vehicle i n an acoustic facility at Sandia National Laboratories

Source: HD.6D.512, n.d., in DOE, AECReactor Development, 201 3.

3-19 After SNAP-10A, the United States launched no more reactors; ho wever, projects would continue to undergo safety analyses. These projects included th e SP-100 reactor, intended for higher power missions. The analysis included five steps:

(1) identification of accidents and their locations and probabi lities (2) definition of the source terms (3) dispersion analysis and the resulting environmental concent ration (4) determination of exposure rates through various pathways (5) identification of the health consequence

The report outlines the calculation methods, which encompass bo th the specific equations and names of the codes. For assessing the doses received by the pub lic (excluding external radiation due to its insignificance), a proprietary code, TDOS, was used (Bartram and Weitzberg, 1988, 56-62).

Despite a relative lull in activity between the SP-100 reactor project and the Prometheus project, the field of SNR safety analysis has seen renewed interest in t he past two decades. While few projects developing SNRs have included specific plans for missi on deployment, contemporary projects have tended to consider safety and have even conducted tests for potential safety analyses. A recent paper (Camp et al., 2019a) also analyzes the reentry of a fission reactor, informed by past SNR projects. While it does not calculate risk, it summarizes potential accidents and environments, which could serve as initial steps for a safety analysis. Another report (Camp, 2021) details the use of risk metrics and how the y may be applied to fission reactors, although it does not include an actual risk analysis. Nevertheless, this information provides useful insights for future reviews.

3-20 4 INTERAGENCY SAFETY REVIEW PROCESS FOR NUCLEAR MISSIONS

While the general framework for the interagency safety reviews of space nuclear missions remains the same, the process has evolved over time. Initially, the safety review involved only the AEC and the DOD, and it was considered an informal measure at the time (DOE, 1987a, 36). The first NPS mission was an experimental Pu-238-fueled SN AP-3 RTG in a DOD Transit satellite. Soon after, NASA joined the safety review process an d collaborated by forming an Interagency Panel that actively participated in the evaluatio n process, similar to the later INSRP (Burke and Illing, 1968, 8; Schmidt et al., 2009).

The Kennedy Administrations National Security Action Memorandu m 235, Large-Scale Scientific or Technological Experiments with Possible Adverse E nvironmental Effects (NSAM-235), in 1963 formally established the safety review proc ess for large-scale scientific or technological experiments with possible adverse environmental effects (Kennedy, 1963). In 1974, just before the panels formal establishment, an act of C ongress split the AEC, which had until then been one of the three agencies participating in the interagency review. It established the DOE12 and the NRC as its successors, each of which assumed separate portions of the AECs responsibilities. The DOE focused on the development and promotion of nuclear energy, while the NRC took on the licensing and regulation of the indus try. In 1977, the Carter Administrations PD/NSC-25, which superseded NSAM-235 and speci fically addressed the launch of space nuclear systems, formally established a separat e procedure and structure for the ad hoc INSRP (Brzezinski, 1977).

The NRC joined the INSRP as an observer rather than an equal me mber to the other three panel agencies (the DOE taking on the role of the AEC in review ) in accordance with PD/NSC-25. Few significant changes occurred following the panel s establishment, and this status quo lasted into the 1980s and beyond. In 1995 and 1996, the Clinton Administration made separate revisions to the directive while largely maintain ing its existing process. In 2019, NSPM-20 reformed the safety review process, replacing the INSRP with the new INSRB among other changes. At present, as discussed further below, the INSR B is developing its procedures, which already differ significantly from those of its predecesso rs13 (Helton, 2022; INSRB, 2023).

An interagency review panel evaluates the SAR issued by the spo nsoring agency of the mission. It assesses the quality of this report, which has, in the past, included a comparison with its own analysis in areas it considered in need of additional a ttention. The panel summarizes its findings in an SER that is presented to the mission sponsor and then to the Office of Science and Technology Policy (OSTP) when applicable to inform the laun ch approval decision (JHU/APL, 2015, 104).

Since the beginning of the U.S. space nuclear program, the NRC and its predecessor, the AEC, have actively participated in the safety review process for spa ce nuclear launches. In this

12 The Energy Research and Development Administration (ERDA), established on January 19, 1975, briefly preceded the DOE following the split of the AEC and before the establishment of the DOE as a cabinet-level agency on August 4, 1977.

13 The latest INSRB documents, such as the charter and playbook, are available under the Guidance tab of the NASA Nuclear Flight Safety webpage: https://sma.nasa.gov/sma-disciplines/nuclear-flight-safety.

4-1 process, the NRC offers its experience in conducting reviews of nuclear and radiological safety and maintains an impartial stance (Bennett, 1987, 2). This ensu res the INSRB benefits from the agencys knowledge and independence. The U.S. Environmental Pro tection Agency (EPA), the U.S. Department of State (DOS), and, to a degree, the U.S. Depa rtment of Transportation (DOT) also serve as independent members on the board, as they d o not sponsor Federal space nuclear system launches. 14 These Federal agencies contribute their own expertise to the s afety review process by analyzing radiological consequences. Other bo ard members, including the DOD and NASA as mission sponsors, as well as the DOE as a provider of NPSs, have safety review groups within their own organization. These Federal agen cies play a crucial role in the safety analysis itself, in addition to their participation on t he INSRB.

Due to the potential global impact of space nuclear accidents, the safety of these missions has garnered international attention. Since 1959, the UN, its Offic e for Outer Space Affairs, and COPUOS have played a significant role in adopting resolutions and est ablishing international commitments in response to incidents involving space nuclear mi ssions by the United States and the former Soviet Union that resulted in a degree of radiol ogical contamination of the Earths atmosphere.15 These UN resolutions and international commitments impose the requirements of launch safety reviews of NPSs for all nations ( UN General Assembly (UNGA),

1992; Scientific and Technical Subcommittee (STSC) and IAEA, 20 09, 3).

The following sections summarize the interagency safety review process. Different terminologies are used in these sources to refer to various par ties involved, but this text aims to describe each party using a single term, defined as follows:

• Sponsoring agencyIn the case of a government launch (the assumed scenario unles s otherwise stated), one single agency is considered the sponsor of the mission that requests a safety review for launch approval. This term is eith er used in full or shortened to sponsor.

• MemberThis term has sometimes described the individuals serving on t he board. Its usage in the following sections refers to the agency that has membership on the board rather than the individuals themselves.

• RepresentativeThe following sections use the term representative rather th an member to describe the individuals serving on the board. Past documents described them as coordinators as well, which had been their official t itle on the INSRP.

4.1 The Evolving Safety Review Framework

The policies for approval of space nuclear launches have evolve d significantly since the Transit 4-B flight. Initially, the approval processes for these missions lacked standardization and were born of a desire for safety originating within the AEC, th e DOD, and NASA. Subsequently, presidential memoranda and directives established a more compre hensive framework and

14 The DOT may serve the role of the sponsoring agency in some reviews according to NSPM-20. In cases of commercial launches meeting the criteria for safety review, the DOT has authority over the approval process but may elect to request an INSRB review of the launch, and in such a case, it is considered the sponsor.

15 More details regarding UN involvement in the field are available on the website of the Office for Outer Space Affairs: https://www.unoosa.org/oosa/index.html.

4-2 structure of the interagency panel. In recent years, there has been movement toward clear decision criteria, particularly with the issuance of NSPM-20 in 2019. Figure 4-1 summarizes key events in this evolution.

Figure 4-1 Major events in the launch approval framework

4.1.1 The Safety Review Framework before NSPM-20

The Transit satellites spurred the development of launch safety reviews for space nuclear systems. As the SNAP program planned to equip the spacecraft wi th an RTG to test the system in space, the National Security Advisor, in NSAM-50, Official Announcements of Launching Into Space of Systems Involving Nuclear Power in Any Form, issued 1 961, expressed the Presidents interest in reserving the right to announce all spa ce nuclear system launches (Bundy, 1961). Two years later, NSAM-235 outlined a more detail ed process for a safety review of these missions. The memorandum mandated a review of environm ental effects to be sent to the Special Assistant for Science and Technology (Kennedy, 1963 ), similar to the OSTP in the current process.

In 1970, then-President Nixon signed the National Environmental Policy Act into law. Seven years later, PD/NSC-25 reconciled the relationship between the act and space nuclear launch approval and expanded the involv ement of additional agencies be yond the original threethe DOE,16 the DOD, and NASAin the approval process. It also stipulated that the sponsoring agency would notify the DOS so it may consider diplomatic reper cussions. The directive was also the first to establish certain criteria for whether a full safety review was required. The President retained the authority to approve the launch of vehic les containing more than 20 curies of material included in Radiotoxicity Groups I and II or 200 curies of material in Radiotoxicity Groups III and IV, as listed in table 1 of the N uclear Safety Review and Approval Procedures (1970). PD/NSC-25 further described the three perma nent members of the INSRP responsible for evaluating risk and inviting the NRC as an obse rver. These permanent members would draft an SER for review by the OSTP before launch approva l (Brzezinski, 1977).

16 The Energy Reorganization Ac t of 1974 abolished the AEC. Earl ier in 1977, the same year that PD/NSC-25 was issued, the Energy Organization Act established the DOE, and it became the permanent member of the panel while the NRC would be an observer.

4-3 Two revisions amended PD/NSC-25, written by the Clinton Adminis tration. In 1995, an Official Use Only revision updated the thresholds for the type of safet y review required, and it imposed a requirement for quarterly reports to the OSTP for launches be tween 0.1 percent and 1,000 times the A2 value for material in IAEA Safety Series No. 6, Regulations f or the Safe Transport of Radioactive Material, 1985 Edition (As Amended 199 0) (Helton and Witmer, 2023, 2; IAEA, 1990). Launches exceeding the latter limit would under go an interagency review and require presidential approval. The following year, another revi sion to PD/NSC-25 stated that the INSRP would no longer have an official reporting obligation to the OSTP (Helton and Witmer, 2023, 2-3). Neither revision is publicly available.

The next major mention of the launch approval process by an administration was in a single section of the broader Presidential Policy Directive 4 (PPD-4) issued in 2010, National Space Policy of the United States of America, called Space Nuclear Power (Obama, 2010). This section reaffirmed the INSRPs role and mandated the Secretary of Energy to conduct the safety analysis of government launches meeting the previously e stablished thresholds of radioactivity, which would then be reviewed by the panel (Obama, 2010, 8). In the end, the revisions and directives following PD/NSC-25 and before NSPM-20 had minimal impact on the safety review process (Buenconsejo et al., 2018, 3).

4.1.2 NSPM-20 and the INSRB Charter

NSPM-20, the new and publicly available (previous memoranda and directives were not public at the time they were issued) guiding policy for the safety rev iew of space nuclear launches, marked the first significant change in presidential policy in o ver four decades and possibly even since the beginning of the process in the sixties (Helton, 2022 ). It replaced the ad hoc, mission-specific INSRP with the permanent INSRB, which now incl udes the NRC as an equal member. The policy also explained that the sponsoring agency, n ot the DOE directly, holds the responsibility for providing the SAR. In addition, NSPM-20 crea ted a set of new tiers to determine whether a launch necessitated presidential approval, updating those set out by PD/NSC-25 and updated in 1995. Table 4-1, which summarizes the current tiers, applies specifically to U.S. Government missions (Trump, 2019).

The changes of NSPM-20 introduced a new governance structure, t he incorporation of new probability-consequence curve targets for missions as presented in Table 4-2, and the previously mentioned establishment of an updated three-tier app roval for launch (shown in Table 4-1). Permanently joining the DOE, the DOD, NASA, and the EPA are the NRC, the DOT, and the DOS as equal members of the interagency safety review p rocess, though the membership may be restricted for specific mission reviews in th e interest of national security.

Under the new tiers, only Tier II and III launches necessitate a sponsor's request for an INSRB review, which entails the agency providing any additional mater ial required for evaluation.

Subsequently, the board presents its findings to the head of th e sponsoring agency (Trump, 2019).

4-4 Table 4-1 NSPM-20 NPS Risk Tiers

Tier Requirement(s) Launch authority for INSRB safety U.S. Government review missions required?

I Less than or equal to 100,000 times the Head of Sponsoring No radioactivity limit for radioactive material a Agency II Greater than 100,000 times the radioactivity Head of Sponsoring Yes limit for radioactive material a Agency

Or risk of 5-25 rem total effective dose to a member of public b with greater than or equal to 1 in 1,000,000 probability

Or spacecraft contains fission system or device with potential for criticality using low-enriched uranium (less than 20% U-235)

III Risk of greater than 25 rem total effective Director of OSTP c Yes dose to a member of the public with greater than 1 in 1,000,000 probability

Fission systems and devices with a potential for criticality using fuel other than low-enriched uranium Source: National Security Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Systems, Trump, 2019.

a Limit is the value of A2 in table 2 of the IAEAs Specific Safety Requirements No. SSR-6, Revision 1, Regulations for the Safe Transport of Radioactive Material, 2018 Edition.

b Unlike some requirements, this is a value to any one individual, not a population-averaged exposure.

c The Director may forward such requests to the President at their discretion.

Table 4-2 Probability-Consequence Curve Targets from NSPM-20

Consequence a Probability target (less than) 0.025 mrem - <5 rem 1 in 100 5-25 rem 1 in 10,000

>25 rem 1 in 100,000 Source: National Security Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Systems, Trump, 2019.

a Total effective dose to any member of the public. (1 rem = 0.01 sievert)

National security concerns permit the restriction of board memb er participation in the review.

Otherwise, the board is authorized to evaluate the quality of the safety analysis and identify any significant gaps in analysis. The INSRB may recommend areas for additional analysis where it identifies gaps, but it is not tasked with repeating or conduct ing its own analysis (Trump, 2019,

§ 5(c)), providing feedback throughout the process to avoid un necessary delays (Trump, 2019,

4-5

§ 5(c)). The end of the former phrase is not clear in its preci se intention as to whether analysis is to be strictly avoided or focused in scope, though the board has currently adopted the latter interpretation (INSRB, 2023, 17-18). In the case of a commercia l launch, the DOT is considered the launch authority, and at Tiers II and III, it may consult w ith agencies to evaluate the quality of the safety analysis, and identify any significant gaps at i ts discretion, though it has a right to request an INSRB review in any case (Trump, 2019, § 5(c)). Beyo nd these duties, the board members must submit annual reports on sponsored or licensed mis sions making use of 1,000 to 100,000 the A2 value given in IAEA Specific Safety Requirements No. 6, Revisi on 1 (Trump, 2019, § 6(a)-(b)).

Shortly after its establishment, the board took the initiative to create and adopt a charter for itself, which is also a publicly available document, that prima rily reflected the content of NSPM-20, while also incorporating additional clarification for the governance, representative roles and responsibilities, and procedures of the board. The C harter of the Interagency Nuclear Safety Review Board serves as a basic framework for INSRBs c onduct of business and contains the boards intent and functionality at the highest l evel (INSRB, 2023, ii). This living charter, along with the INSRB Playbook discussed later, is subj ect to revisions as the board continues to establish itself and prepares for its inaugural re views. According to the INSRB Charter, each mission is assigned to its own INSRB Review Group (IRG) and a Mission-specific Review Plan that outlines the safety review process, including a schedule for the delivery of actionable information regarding the SAR. The s ponsoring agency of the review chairs these IRGs, or the DOT in the case of a DOT-requested re view. In addition, the IRG has the option to consult and contract nongovernment subject matter experts during a review but may not fulfill the roles of a board representative (INSRB, 202 2).

The charter clarifies that the INSRB operates in an advisory ca pacity and is limited to making recommendations to the sponsorthough this is similar to the te xt of NSPM-20, the memorandum does not explicitly state the board is limited to th is role alone. In making decisions, the board operates by consensus. If a consensus cann ot be reached, a minority report is to be prepared, outlining issue(s), and submitted to the sponsoring agency as well as the OSTP (or the Presidents office for Tier III). Subject matt er experts and the IRG are required to identify potential conflicts of interests beforehand and not ify the board of possible conflicts among its representatives by the affected individuals. The repr esentatives have the responsibility of actively participating in quarterly and as-ne eded meetings, joining mission-specific reviews, providing subject matter experts from their own agency if appropriate, and contributing to INSRB guidance documentation (INSRB, 2022).

The DODs DRACO mission is expected to become the first Tier II launch under NSPM-20. It will also be the first launch to be reviewed by the INSRB and t he first SNR to be considered for launch approval since the SNAP-10A reactor (Greiner, 2021, 3-4).

4.1.3 The INSRB Playbook

The INSRBs adopted playbook serves as the most comprehensive a nd authoritative guidance for INSRB operations. The Interagency Nuclear Safety Review Bo ard (INSRB) Playbook Non-binding Guidance for INSRB and Its Counterparts, for trial use, is also a living document, the board having recently approved its second revision in early 2023 (INSRB, 2023). As such, it is possible for details to change in future revisions.

4-6 This second revision of the playbook provides a greater level o f detail than the charter and outlines the expected conduct and behavior of the board. It pre sents a general framework that fits any mission, including (to an extent) commercial missions as defined in the playbooks appendices (INSRB, 2023, ii-iv). In its preamble, it notes that procedures, policies, approaches, and experience are all separate aspects of nuclear safety and t hat when seeking to apply terrestrial concepts to space, the latter three aspects may all be appropriate for a general framework, but the procedures must be different (INSRB, 2023, i ii).

With the aim of providing guidance, the playbook outlines a ten tative structure for the future safety review process, though the details for safety review are tailored to government launches.

However, it acknowledges that this outline may be subject to ch ange if the DOT requests the review. Table 4-3 summarizes various potential cases for analys is, as documented in table 1 of the playbook. The sources it has been based on include the DOD s and NASAs approaches to system safety, the DOEs and the NRCs nuclear safety processes, and the IAEA and the UN STSCs Safety Framework for Nuclear Power Source Applications in Outer Space (STSC and IAEA, 2009), though the framework is not a reproduction of any single approach.

Safety Review Process. The safety review process includes three overarching stages, which the playbook summarizes in text as well as its figure 1, reprod uced here as Figure 4-2 (INSRB, 2023, 22).

4-7 Table 4-3 INSRB Playbook Suggested Analysis and Review Outline

Nuclear Technical Agency Interagency Launch system or SAR source peer review review review authority flight in NSPM-20 Case 1 (e.g., NASA Pu-238 RPS mission)

Nuclear DOE (incl. Component of INSRB Technical system (i.e., contractors) the DOE DOE SER Report (if -

system SAR) process requested)

DOE/NASA Component of NASA Flight (i.e., (incl. the DOE DOE SER INSRB SER Administrator or mission SAR) contractors) process Executive Office of the President

Case 2 (e.g., DOD space reactor mission)

Nuclear DOD program Separate DOD INSRB Technical system office (incl. program office DOD SER Report (if -

contractors) contractor requested)

DOD program Separate DOD Sec. of Defense Flight office program office DOD SER INSRB SER or Executive contractor contractor Office of the President Case 3 (e.g., fully commercial)

NRC applicant NRC INSRB Technical Nuclear (for terrestrial - terrestrial Report (if -

system safety license requested) aspects)

FAA applicant for launch or FAA launch INSRB SER (if Secretary of Flight reentry (for FAA applicant or reentry requested by Sec. Transportation flight safety license of Transportation) aspects)

Source: Interagency Nuclear Safety Review Board (INSRB) Playbook: Non-binding Guidance for INSRB and Its Counterparts, Revision 2, INSRB, 2023, table 1.

4-8 Figure 4-2 The INSRB safety review process as depicted in the p laybook

Source: Interagency Nuclear Safety Review Board (INSRB) Playbook: Non-binding Guidance for INSRB and Its Counterparts, Revision 2, INSRB, 2023, figure 1.

The first stage shown in Figure 4-2 is one of active work by th e sponsoring agency on mission formulation, software and hardware development, safety basis un derpinning activities (e.g., safety criteria formulation, testing, validation and ver ification), launch vehicle selection, etc., which will likely refer to past activities for guidance and knowledge (INSRB, 2023, 24). To these ends, and for general utility, the board is creating a re pository of past review information (INSRB, 2023, 32). The sponsoring agency may also create a gene ric system-specific SAR and request an early review, which invokes a streamlined approach, though one intended to inform the later review rather than to replace it. Regardless, the boa rd assists by finding issues challenging the safety analysis and safety review process and c ommunicating these to the sponsoring agency through consensus board statements (INSRB, 20 23, 24).

The second stage is one of active INSRB and mission interactio n (INSRB, 2023, 25), which includes the IRGs empanelment following the completion of a st rategy for the establishment of the launch authorization basis and request for launch authoriza tion. The exact timing of the transition into this stage depends on the systems in play: nove l and untested systems may begin earlier to allow greater review, while familiar and teste d ones may transition later (INSRB, 2023, 25). The IRG must develop the mission-specific review pla n, establishing the lines of authority and communication between the reviewer and the review ee, as well as the expectations for the roles and responsibilities for the review to promote transparency, clarity, effectiveness, and reliability in the review (INSRB, 2023, 28, 37). The plan will be issued as a living document and the IRG will prepare to conduct a sampling -type review that summarizes core review areas to find where it should focus its attention, so that it may go into greater detail regarding the important risks without becoming too resource int ensive (INSRB, 2023, 26).

The third and last stage is continued mission involvement, but reduced IRG activity, with the INSRB Safety Evaluation Report having been issued (INSRB, 2023, 27). While the IRG remains empaneled through the launch, the Chair, who was select ed by the sponsoring agency,

4-9 will now be able to represent the entire group for last-minute issues and need not rely on the board though they should stay in communication (INSRB, 2023, 27 ).

Safety Evaluation Report. The playbook also describes its vision for the final SERs as well as high-level success criteria for a review. The reports should c ontain an evaluation of the quality of the SARs hazard identification and mitigation approach and results, its risk estimates, its treatment of uncertainty, and its identification of essential s afety features and assumptions (INSRB, 2023, 43-44). Section 4.3.2 of this RIL describes the p roposed outline for INSRB SERs.

The reviews are to refrain from repeating or conducting analys is that would mirror or supplant the safety analysis, and though analysis may be necessary, it may only be performed if it is not resource intensive (a given example is whether the level of eff ort would exceed 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />),

focuses on a particular area, and is preferably a sensitivity a nd uncertainty analysis of the SAR (INSRB, 2023, 17-18). Review activities also exclude safety man agement programs unless directly connected to a hazard in the SAR, steps before the lau nch, nonflight hazards (such as sabotage and theft), accidents leaving Earth unaffected (such a s if the system impacts another celestial body or presents no radiological risk), and end-of-li fe disposal unless it presents radiological risk to the public or biosphere (INSRB, 2023, 21). Although the board may also support projects other than launch authorization as needed, i t must only conduct reviews for that purpose (INSRB, 2023, 20).

Governance. One last component of the playbook is its description of the governance structure of the board in greater detail than that found in the charter. No specific qualifications are given for the representatives themse lves, as the appointment indicate s proficiency in a subset of nuclear policy applicable to review, an understanding of releva nt Federal policy, seniority and access to agency leaders, trust, interpersonal and communicatio n skills, and available time (INSRB, 2023, 5). While all members have equal standing, NASA h as assumed additional responsibilities within the INSRB as the empaneling agency. The se responsibilities include the position of Board Secretariat, as well as various other organiz ational roles (INSRB, 2023, 6-7).

The origin of IRGs provides further insight, highlighting their benefits, including the possibility of having a Chair (since the board consists of equal members and c annot have such a figure),

facilitating interactions between the sponsoring agency and a s maller group, ensuring a clear division of responsibilities between missions, and enabling the board to maintain a strategic focus (INSRB, 2023, 9).

4.2 The Practice of Interagency Safety Review

Since the beginning of the program, interagency cooperation has been integral to ensuring the safety of space nuclear launches. During the petition to use a SNAP RTG on Transit satellites, the Chairman of the AEC pursued a collaborative effort with the DOD to jointly submit a safety document in order to obtain approval from the Space Council (DO E, 1987a, 24). As NPSs became more prevalent in satellite missions, the AEC, the DOE, and NASA, along with the White House, recognized the need for a formal safety program. I n preparation for the SNAP-9A launches in 1963, NASA, the AEC, and the DOD conducted reviews, eventually establishing the joint AEC-NASA Space Nuclear Power Office to oversee the proces s (DOE, 1987a, 36).

4-10 4.2.1 The History of the Interagency Safety Review Process

At a 1963 conference on nuclear safety, an AEC director present ed the AECs safety programs and philosophy, highlighting their collaboration with specializ ed groups across several agencies.

During the presentation, it was acknowledged that there was som e overlap in the work of the safety program, prompting the consideration of establishing a j oint body to streamline these efforts (Pittman, 1963, 44-45). In an opening speech for the sa me conference, an AEC Commissioner, James T. Ramey, recognized the inevitability of i nteragency cooperation on space nuclear system safety. However, concerns were raised rega rding the potential strictness of such a panel in relation to the practical development of NPS s and its independence from the sponsoring agency (Ramey, 1963, 15-16).

In 1968, the formation of the Interagency Panel marked a sign ificant development in conducting reviews for space nuclear launches. During this time, the panel was reviewing the AECs SAR for the SNAP-27 RTG intended for Moon experiments dur ing the Apollo missions (Burke and Illing, 1968, 8). The panel proposed to designers th at the RTGs be made with containment capabilities rather than relying on disintegration during reentry, a design change for RTG systems that began after the 1964 Transit incident. This re commendation was made after its analysis revealed that an unplanned reentry of the lunar mo dule could result in a dispersal event. The decision to incorporate containment proved crucial w hen the Apollo 13 Lunar Module returned to Earth with the RTG in 1970 (Lee and Buden, 1994, 7).

Three years later, in 1971, a summary of nuclear safety for pow er and propulsion highlighted the involvement of the Interagency Safety Evaluation Panel. T his panel, comprising members from the AEC, the DOD, and NASA, received the AEC safety docume nt. The panel then provided recommendations to the National Aeronautics and Space Council, similar to the role later assumed by the OSTP in the INSRP and INSRB processes (Gra ves, 1971, 18-19).

As the AEC underwent a split, resulting in the formation of the ERDA (the short-lived successor to the AEC, subsequently replaced by the DOE) and the NRC in 19 75, major changes began to take place. Safety documents for the LES 8/9 launches, conducte d by the Air Force Weapons Laboratory in 1976, were submitted for review. As part of this process, the ERDA, taking on the AECs former role, and NASA conducted independent analyses. The se were then reportedly given to the INSRP for its safety review, even though the panel would not be established by presidential directive until a year after the satellites launc hes. The panel at that time was coordinated by a member of the ERDAs Division of Nuclear Resea rch and Applications, NASAs Office of Center Operations, and the DODs Directorate o f Nuclear Surety. The SER prepared by the panel was then sent to the National Security Co uncil for approval (Holtzscheiter et al., 1977, 20).

Shortly after the split, PD/NSC-25, issued in 1977 just after t he DOEs establishment, reformed the safety review process and formalized the INSRP into the out line that would remain for the next 43 years. Figure 4-3 provides an overview of the process t hat unfolded after PD/NSC-25, leading up to the subsequent NSPM-20.

4-11 Figure 4-3 The INSRP role in the launch approval process 17

Source: Nuclear Power Assessment Study: Final Report, JHU/APL, 2015.

Galileo represented the sole space nuclear launch during the 19 80s, though the Ulysses safety review had begun just before the end of the decade. The mission enlisted three INSRP coordinators, each appointed from the NASA Headquarters Safety Office, the Air Force Inspection and Safety Center, and the DOEs Environmental, Safe ty, and Health Organization standard offices for coordinator roles during that period (OCST, 1990, 12-13). At that time, the panel comprised five subpanels that persisted until the Mars 20 20 mission: Launch Abort, Reentry, Power System, Meteorological, and Biomedical and Envir onmental Effects. Each subpanel conducted evaluations and analyses independent of the sponsoring agency to ensure an impartial assessment of the missions risk. Apart from the F SAR, previous reviews were referenced, and NASA and the DOE provided supplementary test da ta (INSRP, 1989a, I-3). The Galileo mission operation report summarizes the launch approval process. Following the INSRP's review and summary of the FSAR, the SER was forwarded t o the DOE, the DOD, and NASA for review. Both the DOD and the DOE needed to endorse NAS A's launch request, which was then submitted to the OSTP, including the supporting docume nts (Office of Space Science and Applications, 1989, 38-40).

Although the policy changes made by the Clinton and Obama Admin istrations had minimal impact on the safety review pro cess, it evolved in the years af ter the Cassini mission. The pursuit of improved outcomes prompted the expansion of SAR deve lopment and the INSRPs reviews. The flexibility afforded to the members enabled them t o adapt and refine the process according to their preferences and needs over time (Buenconsejo et al., 2018, 3).

The Galileo INSRP participated in the reviews of the preliminar y SAR, the updated SAR, and the FSAR, enabling it to provide design feedback and attend var ious meetings held by the sponsoring agency to stay informed (Bennett, 1987, 2-3). Design ers were encouraged to

17 Although included in the diagram, the EPA was not an original member and joined as a coordinator in the 1995 revision to PD/NSC-25. The NRC had a unique title as an observer in the original PD/NSC-25 and a technical advisor in the 1995 revision. In addition, the National Oceanic and Atmospheric Administration had served as an observer for some time (Bennett, 1987, 2), though it is unclear for how long this took place.

4-12 provide regular safety presentations to the panel and would be given certain risk indices to meet, with the INSRP determining the acceptable levels during f inal review (Cropp, 1984, 5, 7).

The subpanel system ensured that each agency could contribute i ts expertise effectively (Government Printing Office, 1986, 59), allowing for deeper and more independent analysis (Sholtis et al., 1991, 133). All missions subject to INSRP revi ew received launch approval, although the duration and resources of the safety review varied (Camp et al., 2019a, 20). The entire timelineincluding the EIS, SAR, and SERranged from 4 t o 8 years for Cassini18 and subsequent missions with an average of 6.5 years for the entire process, though typically the most time-intensive document was the DOEs SAR (Buenconsejo et al., 2018, 2).

Although there is a wealth of documentation for these previous reviews, as stated in the INSRB Playbook, the number of analyses is still limited compared to t errestrial analyses. Furthermore, the playbook emphasized that changes to the geometry of RTGs r elative to the spacecraft over past missions have had important effects (INSRB, 2023, 33) on these analyses. Therefore, in adapting previous work, it is crucial to have a clear understan ding of the context and assumptions underlying past analyses and to incorporate them ac cordingly (INSRB, 2023, 33).

Details such as the launch vehicle can fundamentally change the accident environments a system may experience.

The new process established by NSPM-20 originated from a desire to decrease the duration and cost associated with the safety review process, among other s. While it is currently difficult to ascertain the level of success achieved in this regard, some subject matter experts have made predictions. For example, an individual familiar with the EISs for missions reviewed past analyses and suggested that the goals for low-inventory NPSs, s pecifically RHUs, would be attained. However, it also projected minimal improvements in th ese measures for missions involving RTGs (Chang, 2021, 13).

4.2.2 The Independence of Interagency Safety Review

Observers have often described interagency reviews as independ ent. Past commentary on the process has asserted that a joint body for safety review natura lly increases the independence of the review (Bennett, 1981, 432). This perception is justified b y the panel's exclusive focus on risk assessmentrecommendations and risk-benefit analyses are t he responsibility of individual agencies and authorities, rather than the representatives of th e INSRP. In fact, the panel was cited as an example of an independent safety evaluation in a re port on options for DOD licensing with the NRC (Pike and OReilly, 1982, 6-6), which hi ghlighted that having three members typically ensured that one representative would be unin volved in the mission being reviewed. According to one paper (Lee and Buden, 1994), all rep resentatives were selected from their respective agencys oversight, Inspector General, o r Safety Office (Lee and Buden, 1994, 5). Furthermore, the report stated that subpanels were c omposed of a cadre of independent technical experts drawn from academia, industry, na tional laboratories, and government and would be the individuals providing INSRP with i ts own analysis (Lee and Buden, 1994, 5-6).

18 The Cassini mission was a significant outlier, taking almost 8 years from the empanelment of the INSRP to the FSAR alone (Buenconsejo et al., 2018, 2).

4-13 During the 1986 congressional hearing on RTG use in space, the NASA INSRP Coordinator referred to the panel providing an independent evaluation of t he risks associated with the launch of a nuclear power system in space (Government Printing Office, 1986, 59). The three agencies sponsored the subpanels, and the membership list provi ded revealed that the majority of the subpanel members were affiliated with various branches o f each agency, though often in safety offices or research groups (Government Printing Office, 1986, 59, 65-71). All representatives agreed that, while they reported their activiti es to their respective agencies, they saw their work as a service for the OSTP rather than the DOE, t he DOD, or NASA (Government Printing Office, 1986, 59, 73-74). The inclusion of the NRC, an d later the EPA and the National Oceanic and Atmospheric Administration at times, further valida ted the independence of the panel (Bennett, 1987, 2).

The formulation of the INSRB under NSPM-20 does not explicitly mention the word independence (Trump, 2019), though it acknowledges this and e mphasizes the need for the board to avoid, or at least be mindful of, representatives who may have vested interests in the reviewed mission. Vested interests are defined as involvement i n mission planning and execution through the sponsoring agency or a subsidiary, with t he aim of advancing the missions objectives. However, this definition excludes involve ment in safety programs (INSRB, 2023, 15). The playbook also highlights the distinction between cooperation and collaboration, noting that collaboration may compromise independence, while co operation is beneficial for the safety review process. To this end, the playbook envisions the INSRB as acting objectively and allowing the sponsoring agency to comment on its products while refraining from misrepresenting its findings to placate the reviewee (INSRB, 20 23, 28). Further, the playbook provides guidance for raising safety issues and dissenting opin ions from board and IRG members as well as invited subject matter experts.

4.3 The Development of Safety Evaluation Reports

The SER summarizes the interagency safety review of the NPS con ducted by various agencies.

It relies on the information presented in the sponsoring agency s SAR. Historically, the SAR process typically involved the development of three versions th roughout the design process: the preliminary SAR, the updated SAR, and the FSAR. The preliminary SAR represented the design concept and included a PRA. Subsequently, the updated SAR was i ssued after a design freeze on the NPS, and then was typically finalized about a year befor e launch, incorporating testing results and updated data (Bennett, 1981, 430-431). While modern SARs may not adhere to this specific structure, they are still subject to revision througho ut the process, allowing reviewers to provide comments and suggestions and initiating early SER development, which follows the FSAR or final draft.

4.3.1 Past Safety Evaluation Reports

In the early days of the U.S. space nuclear program, the SNAP-1 0A safety program was initiated with a preliminary SAR. This report, along with paral lel analytical studies, design finalization, environmental studies, and testing programs, cont ributed to the compilation of a final safeguards19 report (Atomics International, 1962). The manager of the AEC S pace Nuclear Propulsion Office explained that the purpose of these reports w as to ensure the reliability and

19 Safeguards reports were later renamed safety analysis reports.

4-14 full understanding of these systems. While tests were conducted under simulated conditions, the hardware used in actual missions remained untested (Finger, 1963, 34-35). The SNAP Aerospace Nuclear Safety Program, which predates PD/NSC-25, aim ed to address hazards and ensure that radiological risk was within acceptable limits, as outlined in a summary of the SNAP programs (Berger et al., 1973, 192).

The INSRP has a primary objective of creating the SER, which se rves as a final independent risk assessment by reviewing and summarizing the SARs and suppl ementary data and cited references (Bennett, 1981, 432). Even before the establishment of the INSRP, the AEC outlined the goals of such a process, which included ensuring public and personnel safety, gaining public confidence in the nuclear launch, retaining capable employees, and creating administrative efficiency (Ramey, 1963, 15-16). The SER does not make recommen dations or analyze potential benefits; its sole purpose is to present an objective understanding of the risk of the mission. The original structure of the INSRP, consisting of thr ee coordinating agencies, as mandated by PD/NSC-25, aimed to fulfill its purpose by involvin g two agencies with expertise in launches; namely, the DOD and NASA, along with the DOE, which h eld the responsibility for the safety of nuclear space power systems. This point was emph asized by the NASA Coordinator for the Galileo and Ulysses INSRP in a congressiona l hearing (Government Printing Office, 1986, 54, 59).

Many SARs and SERssuch as those of the MSL and Mars 2020 missi onsare not publicly available. However, the publicly available SER of the Galileo m ission presents a firsthand view of the content and format of the SER, albeit outdated. The firs t volume provides an overview of the reports purpose, a mission summary, all considered potenti al failures, the probabilities of these scenarios, their consequence, a comparison of the risk to those from other events, and a note on the spacecrafts LWRHUs (INSRP, 1989a). While it was customary to create a separate SAR for each new space nuclear system and its intended mission, only a single SAR was prepared for the LWRHUs during the Galileo safety review. The r ationale behind this decision was that the devices were small, simple, and posed minimal risk, making a single report sufficient to address their safety (Johnson, 1985a, 5). The sec ond volume of the Galileo SER provides a detailed account of the modifications made to the re viewed SARs and outlines the steps taken to finalize the SER for the launch approval review (INSRP, 1989b).

4.3.2 The INSRB Outline of Safety Evaluation Reports

The INSRB playbook outlines future SERs consisting of six secti ons and the option to include additional appendices:

(1) an executive summary that includes the findings and out-of-scope aspects and that serves as a standalone document

(2) a section summarizing NSPM-20 and the INSRBs role

(3) a section providing a high-level overview of the mission, space nuclear system, spacecraft, launch vehicle, launch complex, etc. that are perti nent to understanding the results

4-15 (4) a section providing a high-level discussion of the review, activities, and areas left unreviewed

(5) a section containing short descriptions of the topical area s reviewed, identifying any omissions, gaps, and recommended actions

(6) a section describing a more holistic perspective on the qu ality of the safety analysis, how any identified omissions or gaps may affect the launch auth orization decision, and those key aspects that are critical to the findings of the saf ety evaluation (INSRB, 2023, 44).

4.4 The U.S. Nuclear Regulatory Commissions Role in the Safety Review Process

Although the NRC was established roughly a decade after the saf ety review process, nuclear regulatory organizations have been involved from the outset thr ough the AEC, which handled matters related to the civilian use of atomic energy, including both regulation and development.

Over time, these two roles were separated, first by separating the AEC regulatory roles from the AEC general manager with both reporting directly to the AEC Com missioners, and then the establishment of the regulatory agency (the NRC) and the develo pment agency (the ERDA, which the DOE quickly succeeded). The AEC played a significant role from the early stages of the space nuclear program, particularly in projects such as SNA P and the Rover/NERVA program, where it was responsible for developing the reactor an d its controls (Finger, 1961, 54).

After the AECs abolition, many of its INSRP responsibilities w ere delegated to the DOE, with the NRC considered only an observer to the review panel (Pike a nd OReilly, 1982, 65). The NRC provided its expertise in safety review and experience with reactor licensing, giving it the general knowledge necessary for a risk assessment of a space nu clear launch. As an independent agency, the NRC remained unbiased in its observations of the panels activities and did not sponsor any missions of its own (Bennett, 1981, 432 ).

During the 1986 congressional hearing on space nuclear safety, the NASA INSRP Coordinator acknowledged that the NRC observer consistently attended the me etings before the development of the SER but remained passive in their involvemen t (Government Printing Office, 1986, 76). Fast forward 8 years to the Cassini review, the NRC and the INSRP reached an agreement that the agency could provide support through active participation in the panel, involvement in the subpanels, and contractor assistance for the subpanels (Taylor, 1995).

According to the former NRC representative to the Mars 2020 INS RP, the primary distinction in the agencys role had become the designation of technical advis or. Unlike the coordinators, the NRC did not have the responsibility of overseeing a specific su bpanel (Helton, 2022).

Upon the establishment of the INSRB, the NRC assumed an equal m embership position on the board alongside the members from the DOE, the DOD, NASA, the EP A, the DOS, and the DOT (Trump, 2019). In addition, while the commercial space nuclear industry is currently in its nascent stages at the time of this literature review, the NRC m ay play a role in a separate regulatory approval process for commercial missions in collabor ation with the Federal Aviation Administration (FAA).

4-16 Expected to recover almost all of its costs with its own revenu e (typically derived from licensing fees) under the Omnibus Budget Reconciliation Act of 1990, the NRC initially made a request for reimbursement to NASA during the Cassini mission, although no policy mandated NASA to fulfill this request (Taylor, 1995). However, under the INSRB p rocess, reimbursement is no longer a concern for each review, as the sponsoring agency assu mes the responsibility for such payments. It should be noted that participation in the boards ongoing activities currently does not entail reimbursement (INSRB, 2023, 33).

Given the agencys regulatory oversight of nuclear materials sa fety, the NRC served as an advisor to the INSRP several times, even before it was an equal member of the INSRB. In this new role, the agency faces interesting challenges of an unfamil iar environment and novel failure modes for the nuclear systems reviewed by the INSRB, as its ove rsight traditionally focuses on terrestrial reactor and nuclear materials systems.

4.5 Foreign and International Nuclear Mission Safety and Approval

As of 2023, space nuclear system launches have been conducted e xclusively by the United States and the former Soviet Union, resulting in limited availa bility of foreign launch safety documentation. The Soviet Union had a long record of launching SNRs and a few RTGs.

However, while the country would notify the international commu nity of impending reentries and provide possible causes for these incidents, its government con sistently declined to share the safety analyses or the launch approval process for the missions (Bennett, 1992a, 274).

Despite the rarity of national space nuclear programs, internat ional commitments mandate safety procedures for all nations. The UNs COPUOS has been eng aged in discussions in this field for decades, and the UNGA has passed a resolution describ ing the principles of NPS use.

COPUOS has established specific safety criteria for space nucle ar launches, including radiological limits for accidents and design requirements, such as the containment of RPSs upon reentry (Bennett, 1992b). Before the adoption of the UNs Principles Relevant to the Use of Nuclear Power Sources in Outer Space (RES 47/68) in 1992 (U NGA, 1992), there were differing opinions within COPUOSa consensus-based bodyregardi ng the public availability of safety assessments, though the necessity of these assessment s was acknowledged (Hodgkins et al., 1991, 1160).

RES 47/68, adopted by the UNGA in 1992, mandates the conduct of safety assessments for space launches and requires their public availability (UNGA, 19 92). The resolution was adopted during the 47th UNGA plenary session without the need for a vot e. Subsequently, the UN COPUOS STSC, in collaboration with the IAEA, developed an offic ial framework that aligns with the INSRB review system (STSC and IAEA, 2009, 3-4).

The Working Group on the Use of Nuclear Power Sources in Outer Space (the Working Group),

established in 2000, continues its work as of 2023. Recently, t he group published a report highlighting its efforts to promote the framework and suggestin g potential updates to RES 47/68, as the resolution includes a provision for review and revision (The Working Group, 2023, 2).

The report acknowledges the adoption of new safety procedures b y the United States and the Russian Federation, which are in alignment with the IAEA framew ork. It also notes the involvement of the ESA and China in working within the framewor k.

4-17 Regarding the proposed changes to RES 47/68, the report argues that certain sections of the document contain outdated information and address topics beyond the scope of the IAEA safety framework. It recommends the inclusion of a requirement for pub lic safety assessments, as the current framework lacks such a provision. The report also highl ights the need to update the requirements for end-of-life NPS applications and addresses the challenge faced by countries with limited experience in space nuclear system safety, emphasi zing the difficulty they may encounter in establishing their own safety programs based solel y on the existing published guidance (The Working Group, 2023).

4-18 5 CONCLUSIONS

This literature review identified a significant number of past documents that demonstrate the safety analysis of space nuclear system launches, along with th e subsequent evaluation and safety review process. Although the state of knowledge evolves over time, and new system designs for the power sources, launch vehicles, and spacecraft may modify the safety considerations, past literature is invaluable for future activi ties. It can inform future analyses of past methods and findings that may be applicable, demonstrate p ast approaches to recurring challenges, and serve as either a guide or warning due to past historical events.

Despite the changes associated with NSPM-20, it is anticipated that future safety analyses for RPS systems will adhere to similar methodologies and formats as observed in recent launches, such as the MSL and Mars 2020, as indicated by preliminary Drag onfly documents (McHugh and Wheeler, 2021). Consequently, these recent reports serve as examples of the analyses that the board will evaluate and review. Even as some reports become dated and describe systems that have long been redesigned, the methodology and, when inclu ded, testing data of these documents may yet be useful for future analysis. There are, how ever, certain aspects that the INSRB can only grasp through firsthand experience.

The INSRB cannot undertake extensive analyses of these missions. Instead, the board can leverage its expertise to assess and evaluate the quality of th e submitted safety analyses and supplemental materials as outlined in NSPM-20 and the INSRB Pla ybook. Due to its experience in PRAs and nuclear safety analysis, the NRC is likely prepared for the field of space nuclear system SARs reviews, despite t he unique accident environments i nvolved.

The challenges that the INSRB will confront can only be fully u nderstood once the safety review process begins. Nevertheless, t he following sections aim to summarize potential challenges that both the INSRB and the field of safety review for space nuclear systems may encounter, with possible involvement by the NRC.

5.1 Possible Challenges for the Space Nuclear Safety Field

With the U.S. space program venturing into a new era of nuclear systems, which may encompass the implementation of nuclear thermal and electric pr opulsion (NTP and NEP) technologies, along with the reintroduction of SNRs for space t ravel and exploration, numerous uncertainties may arise within the novel safety review process, as suggested by the literature, both directly and indirectly.

5.1.1 Lack of Direct Safety Review Experience

While INSRPs of the past conducted numerous safety reviews and established a standardized system for safety analysis review, the INSRB now faces new requirements outlined in NSPM-20 (as listed in section 4.1.2) and includes new members that may lack practical experience in launch safety reviews. Reviews of the literature and the experi ence of the members from past reviews will help combat this, but as most future guidance rema ins, at this time, in preliminary stages, the new process may incur unexpected challenges.

5-1 5.1.2 Return of Space Fission Reactors

Although the United States has prior experience with launching SNRs through the SNAPSHOT mission in 1965 (JHU/APL, 2015), any future mission involving S NRs will be the Nations first reactor launch in over 50 years and the first mission subject t o modern requirements for space nuclear system launch reviews. It is important to note that no INSRP has ever reviewed SNRs, which means that the INSRB lacks reference documents for conduc ting future safety reviews of these systems. Fortunately, ther e are many documents examining the safety of these systems (e.g., Alexander et al., 1965; McClure, 2018; Camp et al., 2019 a) that will help the INSRB prepare for these safety reviews even before they begin.

5.1.3 Use of Nuclear Power for Propulsion

To date, the United States has not launched an NTP or NEP syste m. However, previous projects have explored the safety considerations for these syst ems, including Rover/NERVA, SP-100, and Project Prometheus (Bragg-Sitton et al., 2011). In addition, more recent missions such as Kilopower, Fission Surface Power, NTP Program, and DRAC O missions (Camp et al.,

2019a; Greiner, 2021) have undergone safety analyses to varying extents, including integrated risk assessments with launch systems. While none of these proje cts represent a comprehensive SAR that would be subject to an INSRB review, they provide insi ghts into the potential content and issues that may arise. In addition to the risks associated with SNRs, there may be other hazards, such as those related to exhaust (Tarves, 2004).

5.1.4 International Commitments and Cooperation

The United States and the former Soviet Union have taken the le ad in analyzing and reviewing the safety of NPSs for planned launches, making them the only n ations to have done so.

However, other space agencies are now preparing to enter the fi eld of space nuclear systems, indicating a potential expansion in the use of nuclear systems in outer space. This expansion could result in increased international cooperation and scrutin y, similar to what occurred in the 1980s at the height of Soviet involvement in the field (Bennett, 1992a). The specific nature of these interactions is currently uncertain, and how new internat ional commitments and collaborations with other space and nuclear agencies will shape the landscape remains to be seen. These developments may pre sent novel challenges that need to be addressed by the relevant stakeholders.

5.1.5 Commercial Space Nuclear System Policy

The commercial review field needs to gain experience conducting safety assessments even more than the government-sponsored mission reviews. The collabo ration and coordination between the DOT/FAA and other agencies or the INSRB to carry ou t safety reviews still need to be clarified (INSRB, 2023). Considering the NRCs responsibilit y for regulating non-DOE commercial nuclear systems and fuel, the agency may oversee the se systems as long as they remain on the ground. However, the regulation of commercial spa ce launches involving nuclear systems will be new territory for both the NRC and other involv ed agencies, and there are numerous uncertainties and unfamiliar aspects that may need to be addressed.

5-2 5.2 Recommendations for Further Literature Review

Further consultation of the literature cited in this report and additional reports not covered in this literature review may benefit the SNR safety analysis and revie w field. This includes past reports, such as the safety analyses of the SNAP-10A reactor (W illis, 1963; Atomics International, 1964; Alexander, 1964; Alexander et al., 1965), which, despite being dated, provide the only example of an SNR launched by the United State s. In addition, the risk analysis for the SP-100 reactor by Bartram and Weitzberg (1988) and more recent reports such as Camp et al.s Fission Reactor Inadver tent Reentry (2019), Camps Risk Assessment Metrics for NASA Fission Reactor Applications (2021), and Kilopowers crit icality accident study (McClure, 2018) can be useful resources.

It is worth noting that other reports may not be publicly avail able but could still hold valuable insights. For those conducting future safety analyses and evalu ations, it would be prudent to refer to past documents for reference and comparison.

NTP and NEP pose additional challenges compared to SNRs because of their increased complexity or unique risks (e.g., the radiological exhaust of N TP systems). While there is limited literature analyzing the safety of nuclear propulsion systems, practical experience is likely to provide more relevant information on this topic than a further literature review.

In the field of space nuclear systems, there are already existi ng international commitments.

However, new missions and uses may lead to changes and new agre ements. Reviewing past interactions in the field, as reported by Bennett (1992b; 1995; 1996), as well as the results of the UN and COPUOS themselves (UNGA, 1992; STSC and IAEA, 2009) may provide valuable context. However, it is important to recognize that these sourc es may not necessarily reflect the future international policy in this domain.

As noted in section 1.2, this report does not represent a compr ehensive summary of the full set of information that may be available. Developing a more compreh ensive NUREG/KM report for knowledge management would be beneficial.

5-3 6 REFERENCES

Alexander, R.E. 1964. SNAP 10A Launch and Reentry Hazards Due to Steady-State Operation. NAA-SR-MEMO-8972. Canoga Park, California: Atomics International.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/ NAASRMEMO8972.xhtml.

Alexander, R.E., R. Elms, W.T. Harper, R.S. Hart, W.F. Heine, G.P. Kenfield, W.R. Lahs, et al.

1965. Final SNAPSHOT Safeguards Report. NAA-SR-10022, LMSC B-107701.

Canoga Park, California: Atomics International.

Atomics International. 1962. SNAPSHOT Safety Program Plan. NA A-SR-MEMO-7399.

Canoga Park, California.

. 1964. SNAP 10A Powered Meteorological Satellite Study. N AA-SR-9892. Canoga Park, California. https://doi.org/10.2172/4591600.

Bartram, B.W., and A. Weitzberg. 1988. Radiological Risk Analy sis of Potential SP-100 Space Mission Scenarios. NUS-5125. Gaithersburg, Maryland: NUS Corpo ration.

https://doi.org/10.2172/7109343.

Bartram, B.W., and D.K. Dougherty. 1987. A Long Term Radiologi cal Risk Model for Plutonium-Fueled and Fission Reactor Space Nuclear System. DOE /ET/32079-2, NUS-3845, 6120678. Rockville, Maryland: NUS Corp. https://doi.o rg/10.2172/6120678.

Bechtel, Ryan. "Multi-Mission Radioisotope Thermoelectric Gener ator (MMRTG)." 2011.

Washington, DC: U.S. Department of Energy Office of Nuclear Ene rgy.

https://www.nasa.gov/sites/default/files/files/4_Mars_2020_MMRT G.pdf.

Bennett, Gary L. 1981. Overview of the U.S. Flight Safety Proc ess for Space Nuclear Power.

Edited by J.R. Buchanan. Nuclear Safety, General Safety Considerations, 22 (4):

423-34. United States.

. 1987. Flight Safety Review Process for Space Nuclear Powe r Sources. In Energy New Frontiers. Philadelphia, Pennsylvania: American Institute of Aeronautics and Astronautics. https://doi.org/DOI: 10.2514/6.1987-9046.

. 1990. Safety Status of Space Radioisotope and Reactor Pow er Sources. In Twenty-Five Years of Progress and Future Prospects, 162-67. Reno, Nevada: IEEE.

https://doi.org/DOI: 10.1109/IECEC.1990.716860.

. 1992a. Soviet Space Nuclear Reactor Incidents: Perception Versus Reality. In Space Nuclear Power Systems 1989, edited by M.S. El-Genk and M.D. Hoover, 10:273-78.

Space Nuclear Power Systems. Malabar, Florida: Orbit Book Company.

https://ui.adsabs.harvard.edu/abs/1992snpw.conf..273B/abstract.

. 1992b. The 1981 United Nations Report: An Historical Cons ensus on the Safe Use of Nuclear Power Sources in Space. In AIP Conference Proceedings, 246:662-67.

Albuquerque, New Mexico: American Institute of Physics.

https://doi.org/10.1063/1.41912.

. 1995. A Technical Review of the U.N. Principles on the Us e of Nuclear Power Sources in Outer Space. Oslo, Norway: International Astronautical Fede ration.

https://nuke.fas.org/space/technical.pdf.

. 1996. Summary of the U.S. Ad Hoc Working Group Meeting on Revising the U.N.

Principles on the Use of Nuclear Power Sources in Outer Space. In 39th International Colloquium on the Law of Outer Space. Beijing, China: International Astronautical Federation. https://nuke.fas.org/space/adhoc.pdf.

Berger, S., K.E. Buttrey, C.R. Davidson, A.A. Jarrett, R.P. Joh nson, A.R. Marchese, N.C. Miller, et al. 1973. SNAP Programs Summary Report. AI-AEC-13067. Cano ga Park, California: Atomics International Division Rockwell Internation al.

Bessette, Gregory C., Nathan E. Bixler, John C. Hewson, David G. Robinson, Donald L. Potter, Dana A. Powers, Christopher B. Atcitty, et al. 2006. Methodolo gy Assessment and

6-1 Recommendations for the MSL Safety Analysis. SAND2006-4563. Al buquerque, New Mexico: Sandia National Laboratories.

Bishop, Tracey. 2021. "DOE Space Nuclear Power and Propulsion ( SNPP) Activities."

Presented at the NRC Regulatory Information Conference, March 1 0. (Agencywide Documents Access and Management System Accession No. ML21095A11 9)

Bixler, Nathan E., Chris J. Clutz, Nelson A. Deane, Darryl G. Hoover, and Ronald J. Lipinski.

2013. Probabilistic Risk Assessment and Its Application to the Mission to Mars.

SAND2013-1462C. Albuquerque, New Mexico: Sandia National Labora tories.

Blake, V.E. 1965. "Aerospace Nuclear Safety." Albuquerque, New Mexico: Sandia National Laboratories.

Bragg-Sitton, Shannon M., James E. Werner, Stephen G. Johnson, Donald T. Palac, Lee S. Mason, David I. Poston, and A. Lou Qualls. 2011. Ongoin g Space Nuclear Systems Development in the United States, 12. Idaho Falls, Ida ho: Idaho National Lab.

https://www.osti.gov/biblio/1037786.

Brzezinski, Zbigniew. 1977. Scientific or Technological Experi ments with Possible Large-Scale Adverse Environmental Effects and Launch of Nuclear Systems int o Space.

PD/NSC-25. Washington, DC. https://irp.fas.org/offdocs/pd/pd25. pdf.

Buckalew, William, David Byrne, and Robert Halsey. 1964. Safet y Analysis of the Operational SNAP-9A System. SC-RR-64-65. Albuquerque, New Mexico: Sandia C orporation.

https://doi.org/10.2172/4178595.

Buden, David. 1993. Summary of Space Nuclear Reactor Power Sys tems (1983-1992). In Albuquerque, New Mexico. https://www.osti.gov/biblio/10151265.

Buenconsejo, Reina, Susannah Howieson, Jonathan Behrens, and Bh avya Lal. 2018.

Evolution of the Space Nuclear Launch Safety Review Process. LaGrange Park, Illinois: American Nuclear Society.

Bundy, McGeorge. 1961. Official Announcements of Launching int o Space of Systems Involving Nuclear Power in Any Form. NSAM-50. Washington, DC.

https://irp.fas.org/offdocs/nsam-jfk/nsam50.jpg.

Burke, E.R., and R.G. Illing. 1968. Aerospace Nuclear Safety R eport for May 1968. SC-PR 409. Albuquerque, New Mexico: Sandia National Laboratories.

https://doi.org/10.2172/4220937.

Calomino, Anthony. 2021. Space Nuclear Power and Propulsion (S NPP). Presented at the NRC Regulatory Information Conference, March 10. (Agencywide Do cuments Access and Management System Accession No. ML21095A118).

Camp, Allen. 2021. Risk Assessment Metrics for NASA Fission Re actor Applications.

NASA/CR-20210017811. Hampton, Virginia: National Aeronautics an d Space Administration. https://ntrs.nasa.gov/citations/20210017811.

Camp, Allen, Elan Borenstein, Patrick McClure, Paul VanDamme, S usan Voss, and Andy Klein.

2019a. Fission Reactor Inadvertent Reentry: A Report to the Nu clear Power &

Propulsion Technical Discipline Team. NASA/CR-2019-220397. Ham pton, Virginia:

National Aeronautics and Space Administration.

https://ntrs.nasa.gov/citations/20190030875.

Camp, Allen, Andy Klein, Patrick McClure, Peter McCallum, and S usan Voss. 2019b. Potential Improvements to the Nuclear Safety and Launch Approval Process for Nuclear Reactors Utilized for Space Power and Propulsion Applications: A Report to the Nuclear Power &

Propulsion Technical Discipline Team. NASA/TM-2019-220256. Ham pton, Virginia:

National Aeronautics and Space Administration.

https://ntrs.nasa.gov/citations/20190001430.

Central Intelligence Agency (CIA). 1991. The Soviet Space Nucl ear Power Program.

C05617906. Langley, Virginia.

https://www.archives.gov/files/declassification/iscap/pdf/2011-099-doc01.pdf.

6-2 Chang, Yale. 2021. Considerations for Implementing Presidentia l Memorandum-20 Guidelines for Nuclear Safety Launch Authorization for Future Civil Space Missions. Presented at Nuclear and Emerging Technologies for Space 2021, April 26-30. Oak Ridge, Tennessee: Oak Ridge National Laboratory. https://nets2021.ornl.gov/wp-content/uploads/gravity_forms/12-b63a96649a525ab5aa39d607840d9d9f/2021/04/NETS2021_Chang_2021042 3_Final_D istro_A.pdf.

Clayton, D.J., G.M. Lucas, and T.E. Radel. 2012. Resulting Sou rce Term from the Mars Science Laboratory Safety Analysis, 2. Albuquerque, New Mexico : Sandia National Laboratories. https://www.osti.gov/biblio/1118426.

Clayton, Daniel, John Bignell, Christopher Jones, Daniel Rohe, Gregg Flores, Timothy Bartel, Fred Gelbard, et al. 2014. Nuclear Risk Assessment for the Mar s 2020 Mission Environmental Impact Statement. SAND2013-10589. Albuquerque, N ew Mexico:

Sandia National Laboratories. https://doi.org/10.2172/1160266.

Corliss, William R. 1966. SNAP: Nuclear Space Reactors. 1st ed. Understanding the Atom.

Washington, DC: Atomic Energy Commission. https://www.osti.gov/ biblio/1132526.

. 1971. Nuclear Reactors for Space Power. 2nd ed. Understanding the Atom.

Washington, DC: Atomic Energy Commission. https://www.osti.gov/ biblio/1132520.

Cropp, Louis O. 1984. Safety Program Considerations for Space Nuclear Reactor Systems.

SAND-84-1653. Albuquerque, New Mexico: Sandia National Laborato ries.

https://doi.org/10.2172/6409191.

Department of Energy, U.S. (DOE). 1987a. Atomic Power in Space : A History. DE87-010618.

Washington, DC: Planning & Human Systems, Inc. https://inl.gov/ research-program/space-power-systems/.

. 1987b. SP-100 Space Reactor Safety. DE/NE-0083. Washingt on, DC.

https://doi.org/10.2172/6434038.

. 2013. "AEC - REACTOR DEVELOPMENT." Washington, DC.

https://www.flickr.com/photos/departmentofenergy/albums/7215763 7416489424/with/10 950676473/.

Dix, George P. 1959. Preliminary Operational Hazards Summary R eport for the Task 2 Thermoelectric Generator. MND-P-2184. Baltimore, Maryland: Mar tin Nuclear Division.

https://doi.org/10.2172/4056522.

. 1960. Final Safety Analysis Report - SNAP 1A Radioisotope Fueled Thermoelectric Generator. MND-P-2352. Baltimore, Maryland: Martin Nuclear Div ision.

https://doi.org/10.2172/4126890.

Dix, George P., Thaddeus J. Dobry, and Paul Guinn. 1959. SNAP-III: Thermoelectric Generator Radiological Safety Analysis. MND-P-2513. Baltimore, Maryland: Martin Nuclear Division. https://doi.org/10.2172/4288904.

Finger, H.B. 1963. The NASA Aerospace Nuclear Safety Philosoph y. In Aerospace Nuclear Safety, 33-37. SC-DC-3553. Albuquerque, New Mexico: Sandia Corporatio n.

https://doi.org/10.2172/4112071.

Finger, Harold B. 1961. Nuclear Propulsion for Space Vehicles. In Proceedings of First National Conference on the Peaceful Uses of Space, 53-63. Proceedings of the First International Conference on the Peaceful Uses of Space. Tulsa, Oklahoma: National Aeronautics and Space Administration.

Frank, Michael V. 2000. Probabilistic Analysis of the Inadvert ent Reentry of the Cassini Spacecrafts Radioisotope Thermoelectric Generators. Risk Analysis 20 (2): 251-60.

Hoboken, New Jersey: Wiley-Blackwell. https://doi.org/10.1111/0 272-4332.202024.

Gibson, Marc A., David I. Poston, Patrick McClure, Thomas J. Go dfroy, Maxwell H. Briggs, and James L. Sanzi. 2018. Kilopower Reactor Using Stirling Technol ogY (KRUSTY) Nuclear Ground Test Results and Lessons Learned. NASA/TM-2018-219941. Cleveland, Ohio:

6-3 National Aeronautics and Space Administration Glenn Research Ce nter.

https://ntrs.nasa.gov/citations/20180007389.

Goldman, Marvin, Robert C. Nelson, Lance Bollinger, Mark D. Hoo ver, William Templeton, and Lynn Anspaugh. 1991. Potential Health Risks from Postulated Ac cidents Involving the Pu-238 RTG on the Ulysses Solar Exploration Mission. In AIP Conference Proceedings, 217:152-64. Albuquerque, New Mexico: American Institute of Phys ics.

https://doi.org/10.1063/1.40028.

Government Printing Office, U.S. 1986. Review of RTG Utilizati on in Space Missions.

Washington, DC.

Graves, G.A. 1971. Nuclear Safety in Nuclear Power and Propuls ion Devices for Space.

LA-DC-72-1480. Los Alamos, New Mexico: Los Alamos Scientific La boratory.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/ LADC721480.xhtml.

Greiner, Nathan. 2021. DRACO Program Overview. Presented at t he NRC Regulatory Information Conference, March 10. (ML21095A117).

Hagis, W., and George P. Dix. 1960. Final Safety Analysis Repo rt: SNAP III Thermoelectric Generator. MND-P-2364. Baltimore, Maryland: Martin Nuclear Div ision.

https://doi.org/10.2172/4110813.

Hardy, E.P., P.W. Krey, and H.L. Volchok. 1972. Global Invento ry and Distribution of Pu-238 from SNAP-9A. HASL-250. New York, New York: United States Atomic Energy Commission. https://doi.org/10.2172/4689831.

Hargrove, H.G., and M.R. Trammell. 1964. Effect of Orbital Des truct of Nuclear Rockets on Earth Contamination. WANL-TME-896. Pittsburg, Pennsylvania: We stinghouse Electric Corp. https://doi.org/10.2172/4186259.

Hart, R.S., K.E. Buttrey, W.F. Heine, W.R. Lahs, and W.B. Sayer. 1965. Final Snapshot Safeguards Report: Addendum I. NAA-SR-10022, Add. 1 (Rev.). Ca noga Park, California: Atomics International. https://doi.org/10.2172/4480 423.

Helton, Don. 2022. Nuclear Flight Safety Officer, Office of Saf ety and Mission Assurance, National Aeronautics and Space Administration, in discussion wi th the author. August.

Helton, Don, and Michael Witmer. 2023. Technical Basis Related to the Posture of NASAs Office of Safety and Mission Assurance for the Launch of Radioa ctive Material Other than Space Nuclear Systems: Volume 1-Overview of Analysis and R esults.

Washington, DC. https://ntrs.nasa.gov/citations/20230002528.

Hodgkins, Kenneth D., Robert Lange, and Bruce C. Rashkow. 1991. United Nations Consideration of the Use of Space Nuclear Power. In AIP Conference Proceedings, 1159-63. Albuquerque, New Mexico: American Institute of Physics. https://doi.org/DOI:

10.1063/1.40080.

Holtzscheiter, E.W., Dermond Kelleher, G.W. Mitchell, Michael L. Crawford, and J.A. Sholtis.

1977. Safety Methodology for Space Nuclear Systems. AFWL-TR-7 7-104. Kirtland Air Force Base, New Mexico: Air Force Weapons Laboratory.

https://www.osti.gov/biblio/6816727.

International Atomic Energy Agency (IAEA). 1990. Regulations f or the Safe Transport of Radioactive Material, 1985 Edition (As Amended 1990). Vienna, Austria: IAEA.

https://gnssn.iaea.org/Superseded%20Safety%20Standards/Safety_S eries_006_1990.p df.

. 2018. "Regulations for the Safe Transport of Radioactive M aterial, 2018 Edition."

Vienna, Austria: IAEA. https://www-pub.iaea.org/MTCD/Publications/PDF/PUB1798_web.pdf.

Idaho National Laboratory (INL). 2015. Atomic Power in Space I I: A History of Space Nuclear Power and Propulsion in the United States. INL/EXT-15-34409. I daho Falls, Idaho.

https://inl.gov/research-program/space-power-systems/.

6-4 Interagency Nuclear Safety Review Board (INSRB). 2022. Charter of the Interagency Nuclear Safety Review Board. Washington, DC. https://sma.nasa.gov/docs /default-source/sma-disciplines-and-programs/nuclear/insrb-charter---508d.pdf.

. 2023. Interagency Nuclear Safety Review Board (INSRB) Pl aybook: Non-binding Guidance for INSRB and Its Counterparts. Revision 2. January 2 0. Washington, DC.

https://sma.nasa.gov/docs/default-source/sma-disciplines-and-pr ograms/nuclear/insrb-playbook-rev1-508.pdf.

Interagency Nuclear Safety Review Panel (INSRP). 1989a. Safety Evaluation Report for Galileo: Volume 1. INSRP-89-01. Livermore, California: Publish ed as UCID-21775-V1 by the Lawrence Livermore National Laboratory. September 1989.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/ DE90003086.xhtml

. 1989b. Safety Evaluation Report for Galileo: Volume 2. I NSRP-89-01. Livermore, California: Published as UCID-21775-V2 by the Lawrence Livermor e National Laboratory. September 1989.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/ DE90003087.xhtml

. 1989c. Biomedical and Environmental Effects Subpanel Repo rt for Galileo.

INSRP-89-06. Livermore, California: Lawrence Livermore National Laboratory.

https://doi.org/10.2172/5038882.

The Johns Hopkins University Applied Physics Laboratory (JHU/AP L). 2015. Nuclear Power Assessment Study: Final Report. TSSD-23122. Laurel, Maryland.

https://rps.nasa.gov/system/downloadable_items/37_NPAS_Final_Re port.pdf.

Johnson, Ernest W. 1985a. Light-Weight Radioisotope Heater Uni t Safety Analysis Report (LWRHU-SAR): Volume I. A. Introduction and Executive Summary, B. Reference Design Document (RDD). MLM-3293. Miamisburg, Ohio: Mound.

https://doi.org/10.2172/5063463.

. 1985b. Light-Weight Radioisotope Heater Unit Safety Analy sis Report (LWRHU-SAR):

Volume II. Accident Model Document. MLM-3293. Miamisburg, Ohio: Mound.

https://doi.org/10.2172/6354684.

. 1988a. Light-Weight Radioisotope Heater Unit Final Safety Analysis Report (LWRHU-FSAR): Volume 1. MLM-3540. Miamisburg, Ohio: Mound.

https://doi.org/10.2172/6622379.

. 1988b. Light-Weight Radioisotope Heater Unit Final Safety Analysis Report (LWRHU-FSAR): Volume 2. MLM-3540. Miamisburg, Ohio: Mound.

https://doi.org/10.2172/6531256.

. 1988c. Light-Weight Radioisotope Heater Unit Final Safety Analysis Report (LWRHU-FSAR): Volume 3. MLM-3540. Miamisburg, Ohio: Mound.

https://doi.org/10.2172/6533509.

Johnson, Alana, Grey Hautaluoma, and D.C. Agle. 2020. NASA, UL A Launch Mars 2020 Perseverance Rover Mission to Red Planet. National Aeronautics and Space Administration. Last modified January 4, 2021. https://www.nasa.gov/press-release/nasa-ula-launch-mars-2020-perseverance-rover-mission-to -red-planet.

Kastenberg, W.E., and Richard Wilson. Risk of Nuclear Powered Space Probes. Reliability Engineering & System Safety 86, no. 1 (2004): 53-59. Amsterdam, Netherlands:

Elsevier. https://doi.org/10.1016/j.ress.2003.12.006.

Kennedy, John F. 1963. Large-Scale Scientific or Technological Experiments with Possible Adverse Environmental Effects. NSAM-235. Washington, DC.

https://irp.fas.org/offdocs/nsam-jfk/nsam-235.htm.

Klein, L.T. 1960. Interim Report on Safety Procedures for the Task 2 Thermoelectric Generator. MND-P-2335. Baltimore, Maryland: Martin Nuclear Div ision.

https://doi.org/10.2172/4090511.

6-5 Knighton, Daniel. 1960. Preliminary Operational Safety Report for the TASK 5.6 Thermoelectric Generator. MND-P-2356. Baltimore, Maryland: Martin Nuclear Div ision.

https://doi.org/10.2172/4105882.

Launius, Roger D. 2015. Powering Space Exploration: U.S. Space Nuclear Power, Public Perceptions, and Outer Planetary Probes. In Historical Studies in the Societal Impact of Spaceflight, edited by Steven J. Dick. Washington, DC: National Aeronautic s and Space Administration.

https://www.nasa.gov/connect/ebooks/hi storical_studies_societal_impact_spaceflight_de tail.html.

Lee, James H., and Dave Buden. 1994. Aerospace Nuclear Safety: An Introduction and Historical Overview. Presented at the International topical me eting on the safety of advanced reactors, April 18-20. Pittsburgh, Pennsylvania.

https://www.osti.gov/biblio/10138155.

Lenard, Roger X. 2008. Nuclear Safety: Legal Aspects and Polic y Recommendations. In Nuclear Space Power and Propulsion Systems, edited by Claudio Bruno, 203-44.

Reston, Virginia: American Institute of Aeronautics and Astrona utics.

https://doi.org/10.2514/4.860096.

Marshall, Albert C. 1995. Space Reactor Safety, 1985-1995 Less ons Learned. SAND95-2362C. Albuquerque, New Mexico: Sandia National Laboratories.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/ DE96002073.xhtml.

Martin Nuclear Division (MND). 1960. Preliminary Safety Analys is: Low Power Cerium-144 Generator. MND-P-2363. Baltimore, Maryland: Martin Nuclear Div ision.

https://doi.org/10.2172/4123642.

. 1964. Feasibility of Isotopic Power for Manned Lunar Miss ions: Volume 2 - Mission, Fuel, and Nuclear Safety and Radiation. MND-3296-2. Baltimore, Maryland: Martin Nuclear Division. https://doi.org/10.2172/4657806.

McClure, Patrick Ray. 2018. Kilopower Space Reactor Launch Saf etyMaximum Credible Dose for a Criticality Accident. LA-UR-18-28899. Los Alamos, N ew Mexico: Los Alamos National Laboratory. https://doi.org/10.2172/1473765.

McHugh, Caleb, and Tammy Wheeler. 2021. Radiological Consequen ce Evaluation for Dragonfly Mission. INL/EXT-21-65050 REV0. Idaho Falls, Idaho: Idaho National Laboratory. https://doi.org/10.2172/1835103.

National Aeronautics and Space Administration (NASA). 2021. Ki lopower. Space Technology Mission Directorate. Last modified October 18, 2021.

https://www.nasa.gov/directorates/spacetech/kilopower.

. 2022. Fission Surface Power. Space Technology Mission Di rectorate. Last modified August 3, 2022. https://www.nasa.gov/mission_pages/tdm/fission-surface-power/index.html.

. 2023a. NASA, DARPA Will Test Nuclear Engine for Future Ma rs Missions. Last modified January 24, 2023. https://www.nasa.gov/press-release/n asa-darpa-will-test-nuclear-engine-for-future-mars-missions.

. 2023b. Thermal Systems: General Purpose Heat Source. Rad ioisotope Power Systems. Accessed June 13, 2023. https://rps.nasa.gov/power-and -thermal-systems/thermal-systems/general-purpose-heat-source/.

National Aeronautics and Space Council. 1970. "Nuclear Safety R eview and Approval Procedures for Minor Radioactive Sources in Space Operations." Washington, DC:

National Aeronautics and Space Council.

NUS Corporation. 1990. Safety Status Report for the Ulysses Mi ssion: Summary.

DE90006828. Gaithersburg, Maryland: NUS Corp.

https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDetail/ DE90006828.xhtml.

6-6 Obama, Barack. 2010. National Space Policy of the United States of America. Washington, DC.

https://irp.fas.org/offdocs/ppd/ppd-4-nsp.pdf.

Office of Commercial Space Transportation (OCST). 1990. Space Applications of Radioactive Materials. Huntsville, Alabama: SRS Technologies.

https://www.faa.gov/about/office_org/headquarters_offices/ast/m edia/radedits.pdf.

Office of Space Science (OSS). 1997. Final Supplemental Enviro nmental Impact Statement for the Cassini Mission. NASA/TM-1997-111474/SUPPL1. Washington, D C: National Aeronautics and Space Administration. https://ntrs.nasa.gov/cit ations/19990054126.

Office of Space Science and Applications. 1989. Mission Operat ion Report: Galileo. E-829 89-89-01. Washington, DC: National Aeronautics and Space Admini stration.

Pike, W.J., and P.D. OReilly. 1982. NRC Licensing Requirement s: DOD Options.

DE87-010471. Gaithersburg, Maryland: NUS Corporation.

https://doi.org/10.2172/5900539.

Pittman, F.K. 1963. AEC Aerospace Safety Programs and Philosop hy. In Aerospace Nuclear Safety, 39-45. SC-DC-3553. Albuquerque, New Mexico: Sandia Corporatio n.

https://doi.org/10.2172/4112071.

Pressyl, C., M. Panicucci, and P. Peltonen. 1992. Safety Risk Assessment for ESA Space Programmes. In Use of Probabilistic Safety Assessment for Operational Safety:

PSA91, 279-89. Vienna, Austria: International Atomic Energy Agency.

Ramey, James T. 1963. Aerospace Nuclear SafetyLessons from Ci vilian and Military Reactor Experience. In Aerospace Nuclear Safety, 7-16. SC-DC-3553. Albuquerque, New Mexico: Sandia Corporation. https://doi.org/10.2172/4112071.

Riggs, Cecil O. 1960. Curium Fueled Generators for Lunar and S pace Missions: Preliminary Safety Analysis Report. MND-P-2366. Baltimore, Maryland: Marti n Company, Nuclear Division. https://doi.org/10.2172/4108003.

Robinson, David G. 2012. Mars Science Laboratory Launch Risk A nalysis Summary.

SAND2012-1151C. Albuquerque, New Mexico: Sandia National Labora tories.

https://www.osti.gov/biblio/1118349.

Schmidt, George R., Thomas J. Sutliff, Leonard Duddzinski. 2009. Radioisotope Power: A Key Technology for Deep Space Explorations. Presented at the 60th International Astronautical Congress, October 12. https://ntrs.nasa.gov/citat ions/20120016365.

Science Mission Directorate (SMD). 2005. Final Environmental I mpact Statement for the New Horizons Mission, Volume 1: Executive Summary and Chapters 1 Th rough 8.

Washington, DC: National Aeronautics and Space Administration.

http://pluto.jhuapl.edu/Mission/Spacecraft/docs/NH-FEIS_Vol1.pd f.

. 2006. Final Environmental Impact Statement for the Mars S cience Laboratory Mission, Volume 1: Executive Summary and Chapters 1 Through 8. Washingt on, DC: National Aeronautics and Space Administration. https://netspublic.grc.na sa.gov/main/MSL-FEIS_Vol1.pdf.

. 2014. Final Environmental Impact Statement for the Mars 2 020 Mission.

Washington, DC: National Aeronautics and Space Administration.

https://mars.nasa.gov/mars2020/files/mep/Mars2020_Final_EIS.pdf.

Sholtis, Joseph A., Leven B. Gray, Darrell A. Huff, Norman P. K lug, and Robert O. Winchester.

1991. Conduct and Results of the Interagency Nuclear Safety Re view Panels Evaluation of the Ulysses Space Mission. In AIP Conference Proceedings, 217:132-39.

Albuquerque, New Mexico: AIP. https://doi.org/DOI: 10.1063/1.40 036.

Stewart, John. 1964. Progress Report: SNAP 10A Nuclear Auxilia ry Power Unit Development:

October-December 1963. NAA-SR-9293. Canoga Park, California: A tomics International. https://doi.org/10.2172/4471128.

6-7 Tarves, Shaun. 2004. Risk Management Policy of Space Nuclear P ower Systems: An Examination of Past and Current Methods & Recommendation for Fu ture Policy. La Grange Park, Illinois: American Nuclear Society and Nuclear Ene rgy Institute.

Taylor, James M., Executive Director for Operations, NRC, to Da niel S. Goldin, Administrator, NASA Headquarters, January 9, 1995. (ML031770485).

Trump, Donald. 2019. National Security Presidential Memorandum on Launch of Spacecraft Containing Space Nuclear Systems. NSPM-20. August 20. Washingto n, DC.

https://trumpwhitehouse.archives.gov/presidential-actions/presi dential-memorandum-launch-spacecraft-containing-space-nuclear-systems/.

United Nations Committee on the Peaceful Uses of Outer Space, S cientific and Technical Subcommittee (STSC), and International Atomic Energy Agency (IA EA). 2009. Safety Framework for Nuclear Power Source Applications in Outer Space. A/AC.105/934.

Vienna, Austria. https://www.unoosa.org/pdf/reports/ac105/AC105 _934E.pdf.

United Nations General Assembly (UNGA). 1992. Principles Relev ant to the Use of Nuclear Power Sources in Outer Space. Resolution 47/68. New York, New York.

https://www.unoosa.org/pdf/gares/ARES_47_68E.pdf.

Voegeli, Nathan. 2007. Space Nuclear Reactors: History and Eme rging Policy Issues. The Nonproliferation Review 14 (1): 163-75. Abingdon, United Kingdom. https://doi.org/DOI:

10.1080/10736700601178648.

Voss, Susan S. 1984. SNAP Space Nuclear Auxiliary Power Reacto r Overview.

AFWL-TN-84-14. Fort Belvoir, Virginia: Defense Technical Inform ation Center.

https://apps.dtic.mil/sti/citations/ADA146831.

Willis, C.A. 1963. Radiological Hazards Comparison of SNAP 9A to SNAP 10A.

NAA-SR-MEMO-9258. Canoga Park, California: Atomics Internationa l.

https://www.osti.gov/biblio/982044.

The Working Group on the Use of Nuclear Power Sources in Outer Space (The Working Group). 2023. Final report on the implementation of the Safety Framework for Nuclear Power Source Applications in Outer Space and recommendations fo r potential enhancements of the technical content and scope of the Principl es Relevant to the Use of Nuclear Power Sources in Outer Space. A/AC.105/C.1/124. Vie nna, Austria.

https://daccess-ods.un.org/access.nsf/get?open&DS=A/AC.105/C.1/ 124&Lang=E.

Wyss, Gregory D. 1996. An Overview of the Risk Uncertainty Ass essment Process for the Cassini Space Mission. SAND96-1544C. Albuquerque, New Mexico: Sandia National Laboratories.

Zillmer, Andrew John, and Amanda Gates. 2022. Overview of Ligh t Weight Radioisotope Heating Unit (LWRHU) Users Guide. INL/CON-22-65864-Rev000. Id aho Falls, Idaho:

Idaho National Laboratory. https://www.osti.gov/biblio/1871345.

6-8 APPENDIX A SAFETY ANALYSIS CODES

Table A-1 lists computer codes used in missions since 1992. Ent ries in parentheses in the Programs column indicate general use by an organization rathe r than a specific mission.

Table A-1 List of Computer Codes Used for Space Nuclear System Safety Analysis

Code Uses Programs Owner ABAQUS Thermostructural analysis Cassini a Simulia CARS Risk integration (Sandia) b CINDER Source term calculation KRUSTY c Los Alamos National Laboratory (LANL)

CMA Reentry simulation (Sandia) b, (NASA) a CTH Spacecraft explosive debris (Sandia) b, SNL simulation (NASA) d FDOSE Consequence analysis (Sandia) b, (NASA) d FIREBALL Fireball environment source term Cassini e LANL calculation FRINK Analyzes reactor dynamics and KRUSTY f LANL transients using a point-kinetics model GRAM95 Consequence analysis MSL g HANDI Reentry simulation (Sandia) b, (NASA) d HYSPLIT Consequence analysis (Sandia) b, NOAA (NASA) d IAT Consequence analysis (Sandia) b, (NASA) d LAPS Reentry simulation (Sandia) b, (NASA) d LASEP Source term calculation (Sandia) b, (NASA) d LORAN Ablation simulation Cassini h MACCS2 Calculating dispersion MSL i, coefficients at locations of Dragonfly j SNL interest MCNP Calculating radiation transport KRUSTY f LANL MCNPX Criticality simulation (NASA) d LANL MONTEBURNS Source term calculation KRUSTY c, f LANL

A-1 Code Uses Programs Owner NARAC suite Atmospheric transport MSL* i Lawrence Livermore National Laboratory ORIGEN Source term calculation KRUSTY f Oak Ridge National Laboratory PARDOS Dose and health effects MSL k PEVACI Propellant fire simulation (Sandia) b, SNL (NASA) d POSTMAX Calculating dispersion Dragonfly j LANL coefficients at or beyond distance of a location of interest PREDICT Impact probability MSL* i Presto Spacecraft explosive debris (NASA) d simulation PUFF Plume rate of a fireball event MSL k RecpDB LHS95 Consequence analysis MSL g RESRAD-BIOTA Evaluating radiation doses to Mars 2020 l Argonne National aquatic and terrestrial life Laboratory SAR_PostProc Risk integration (NASA) d SATRAP Atmospheric transport Cassini a SETAC/EVNTRE Uncertainty assessment Cassini e SNL SFM Propellant fire simulation (Sandia) b, SNL (NASA) d Sierra/SM Spacecraft explosive debris (Sandia) b SNL simulation SINDA Propellant fire simulation (Sandia) b, Cullimore & Ring (NASA) d Technologies SINRAP Thermal analysis Cassini a SPARRC suite Code suite for dispersion, dose, MSL i, Lockheed Martin and health effect calculation Cassini e STORM Consequence analysis (Sandia) b, SNL (NASA) d TAOS Reentry simulation (Sandia) b, (NASA) d TSAP Point mass trajectory Topaz-II m SNL WindDB Consequence analysis MSL k Zapotec Spacecraft explosive debris (Sandia) b, simulation (NASA) d

a Lockheed Martin Astro Space. 1996. Monthly Technical Progress Report (27 November through 31 December 1995). RR16.

Cassini RTG Program CDRL Transmittal. King of Prussia, Pennsylv ania: Lockheed Martin.

A-2 Code Uses Programs Owner

b Clayton, D.J., R.J. Lipinski, and R.D. Bechtel. 2015. Radioisotope Power Systems Launch Safety Process.

SAND2015-9024C. Albuquerque, New Mexico: Sandia National Laboratories.

c McClure, Patrick Ray. 2018. Kilopower Space Reactor Launch SafetyMaximum Credible Dose for a Criticality Accident.

LA-UR--18-28899. Los Alamos National Laboratory. https://doi.org/10.2172/1473765.

d Sholtis, Joseph A. 2015. The 20 14 NASA Nuclear Power Assessment Study (NPAS): Safety, Environmental Impact, and Launch Approval Considerations and Findings. Albuquerque, New Mexico, February 23.

e Wyss, Gregory D. 1996. An Overview of the Risk Uncertainty Assessment Process for the Cassini Space Mission.

SAND96-1544C. Albuquerque, New Mexico: Sandia National Laboratories.

f McClure, Patrick R., David I. Poston, Steven D. Clement, Louis Restrepo, Robert Miller, and Manny Negrete. 2020. KRUSTY Experiment: Reactivity Insertion Accident Analysis. Nuclear Technology 206 (sup1): S43-55.

https://doi.org/10.1080/00295450.2020.1722544.

g Robinson, David G. 2012. Mars Science Laboratory Launch Risk Analysis Summary. SAND2012-1151C. Albuquerque, New Mexico: Sandia National Laboratories.

h Lockheed Martin Astro Space. 1995. Monthly Technical Progress Report (29 May Through 2 July 1995). RR16. Cassini RTG Program CDRL Transmittal. King of Prussia, Pennsylvania: Lockhe ed Martin.

i Bessette, Gregory C., Nathan E. Bixler, John C. Hewson, David G. Robinson, Donald L. Potter, Dana A. Powers, Christopher B.

Atcitty, et al. 2006. Methodology Assessment and Recommendatio ns for the MSL Safety Analysis. SAND2006-4563.

Albuquerque, New Mexico: Sandia National Laboratories.

j McHugh, Caleb, and Tammy Wheeler. 2021. Radiological Consequen ce Evaluation for Dragonfly Mission. INL/EXT-21-65050 REV0. Idaho Falls, Idaho: Idaho National Laboratory. https://doi.org/10.2172/1835103.

k Bixler, Nathan E., Chris J. Clutz, Nelson A. Deane, Darryl G. Hoover, and Ronald J. Lipinski. 2013. Probabilistic Risk Assessment and Its Application to the Mission to Mars. SAND201 3-1462C. Albuquerque, New Mexico: Sandia National Laboratories.

l Science Mission Directorate. 2 020. Supplemental Environmental Impact Statement for the Mars 2020 Mission.

Washington, DC: National Aeronautics and Space Administration.

m Connell, L.W., and L.C. Trost. 1994. Reentry Safety for the Topaz II Space Reactor: Issues and Analyses. SAND94-0484.

Albuquerque, New Mexico: Sandia National Laboratories. https:// doi.org/10.2172/10184645.

A-3 APPENDIX B PAST SAFETY ANALYSIS REPORTS

Many safety analyses are not easily accessible. Although only r ecent missions (i.e., Mars Science Laboratory, Mars 2020, and, to an extent, New Horizons) are likely to contain information that may warrant protection, past documents (e.g., Ulysses and Cassini) are also unavailable. Table B-1 summarizes the official safety analyses that were made available to the public.

Table B-1 List of Publicly Available Safety Analysis Reports

NPS Mission Report name Report number Report date SNAP-1 - Final Safety Analysis MND-P-2352 1960 ReportSNAP 1A Radioisotope-Fueled Thermoelectric Generator SNAP-3 - Final Safety Analysis: MND-P-2364 1960 Report: SNAP 3 Thermoelectric Generator SNAP-9A Transit 5-BN-1-3 Safety Analysis of the SC-RR-64-65 1964 Operational SNAP-9A System SNAP-10A SNAPSHOT Final SNAPSHOT NAA-SR-10022 1965 Safeguards Report LWRHU - Light-Weight MLM-3540 1988 Radioisotope Heater Unit Final Safety Analysis Report (LWRHU-FSAR)

GPHS-RTG Galileo Final Safety Analysis DOE/ET/32043-1988 Report for the Galileo T26 Mission

B-1