1-1
1-2
1-3
1-4
1-5
1-6
1-7
1-8
1-9
1-10
1.0 INTRODUCTION

This report has been jointly prepared by the Office of

Commercial Space Transportation (OCST) of the Department of

Transportation (DOT) and the U.S. Environmental Protection Agency

(EPA). This joint effort provides an evaluation of the

buildings, equipment, operations and procedures employed at a

commercial payload processing facility owned and operated by

Astrotech Space Operations (Astrotech), Limited Partnership, in

Titusville, Florida. Astrotech's corporate management gave its

full cooperation to the evaluation. This report provides an

overview of the operations, procedures and methods employed by

Astrotech to protect public health and safety, the environment,

and public and private property in the Titusville area and

presents a summary of the OCST/EPA evaluation team's findings

regarding operating procedures, safety policies, and emergency

planning and preparedness. However, the safety evaluation team

did not examine operations from the standpoint of worker safety,

which is regulated by the Occupational Health and Safety

Administration (OSHA), nor did they perform a detailed analysis

of transportation operations, which are regulated by the Research

and Special Programs Administration (RSPA) of DOT. This report

can also serve as a general model and guide for the evaluation of

similar issues at other existing or proposed facilities that

would support the commercial space launch industry.

Payloads (also called spacecraft) are satellites that are

launched into space to be used in communications systems, for

remote sensing, in weather systems, for planetary exploration and

as scientific experiments. Before launch on an expendable launch

vehicle (ELV) like the Titan, Delta, or Atlas, or on the Space

Shuttle, a payload must be prepared for its mission. The

preparations include such things as checking electrical circuits,

testing lines or tanks for leaks, and loading liquid propellants

into assist motors that will be used once the payload is

separated from the launch vehicle and must move itself into a

specified orbit and then maintain itself in place while

performing its mission. Since these and other preparations must

be done under controlled conditions in clean environments (e.g.,

dust and particulate free) and since some of the materials (i.e.,

liquid and solid propellant and explosives) that are handled or

loaded are hazardous, special facilities were developed by the

National Aeronautics and Space Administration (NASA) and the Air

Force for these operations. With the growth of the commercial

space industry, the ability to process payloads in commercially

available facilities is important and Astrotech is the first such

commercial payload processing facility.

1.1 Background

The safety evaluation was performed in response to a request

by the Lieutenant Governor of the State of Florida, the Honorable

Bobby Brantley. In his letter to OCST, dated October 24, 1989,
he indicated that a unique industrial facility existed in

Titusville, Florida, owned and operated by Astrotech. This

facility provides for the processing and checkout of spacecraft

prior to their delivery and launch at either Kennedy Space

Center (KSC) or Cape Canaveral Air Force Station (CCAFS). 

Processing of spacecraft involves a variety of operations as

described in Section 4.0.

Under the Commercial Space Launch Act of 1984, as amended

(Public Law 98-575, 100-657), the U.S. Department of

Transportation (DOT) is responsible for licensing and regulating

U.S. commercial space launch activities in a manner that protects

public safety, safety of property, and U.S. national security and

foreign policy interests, and encourages development of a viable

domestic commercial launch industry. When questions arose

concerning the safety of Astrotech's activities, the Lieutenant

Governor of Florida requested OCST to conduct an impartial and

focused review of the payload processing facility and operations. 

Because activities at Astrotech could affect safety of licensed

launch operations, OCST agreed to undertake the safety

evaluation.

OCST conducted an initial fact-finding visit and interviewed

individuals from Astrotech, the City of Titusville, Brevard

County, the Florida Department of Environmental Regulation (DER)

and the Air Force to identify the potential issues involved with

the safety evaluation. As a result of this visit, OCST

determined that many of the safety evaluation issues involved

areas in which EPA has recognized expertise. Since EPA has an

on-going chemical safety audit program that addresses emergency

planning and preparedness requirements, inclusion of EPA in a

joint OCST/EPA effort has provided a more thorough and insightful

review and evaluation.

1.2 Overview

In the early 1980's, with the growing opportunity for

commercial access to space via the NASA's shuttle program and

various ELVs, it was believed that the capacity for launch

services support provided by the Government was inadequate to

meet the growing needs of the commercial spacecraft community. 

Astrotech designed and built a commercial facility near KSC and

CCAFS, which would provide state-of-the-art payload processing

and support capabilities to those payload customers that had been

using the NASA-owned facilities at KSC. NASA and Astrotech

entered into a formal Memorandum of Understanding (MOU) whereby

NASA agreed to accept payloads processed at Astrotech as long as

they complied with NASA safety and other requirements. Astrotech

also compiled and presented site selection information, services

to be offered, design concepts and contracting considerations to

spacecraft manufacturers, owners and contractors to elicit

comments. The responses were then used, as appropriate, in

designing, developing and constructing the Astrotech facility in

Titusville, Florida.
The Astrotech complex in Titusville contains six major

buildings located on approximately 37 acres in an industrial

park, 2.75 miles from the Gate 3 entrance to KSC. The facility

provides space and limited support for payload customers (U.S.

and foreign) to perform the final assembly, checkout, fueling,

and telemetric control of their spacecraft. The buildings are

physically separated into hazardous and non-hazardous operations

areas, based on the materials handled during the operations. 

Building 2, the Hazardous Processing Facility, is located several

hundred feet from the rest of Astrotech's buildings and is

constructed to meet Department of Defense (DoD) and Bureau of

Alcohol, Tobacco, and Firearms (ATF) explosives siting standards.

Astrotech provides, through a fixed-price agreement with a

payload customer, approximately the same support services as

those provided by NASA through its Space Transportation System

(STS) Optional Services Package. Services include ancillary

support to the payload customer, local transportation of

propellants to and from KSC/CCAFS for spacecraft fueling,

transportation of the processed payload to the launch site, and

off-load and on-load of spacecraft parts and other support

equipment, as needed. All hazardous operations performed at

Astrotech are directly supervised by the Astrotech Safety

Officer. In order to provide comprehensive services, Astrotech

subcontracts with NASA to provide limited routine support

including propellant storage, cold soak and x-ray of rocket

motors and chemical analysis of liquid propellants.

The payload customer is responsible for, and performs all

hands-on work related to the assembly, processing, and fueling of

the spacecraft; all of which requires highly trained, specialized

personnel. The payload customer conducts these activities

because the investment in the spacecraft is so great (on the

order of $100 million or more) that stringent control measures

are required. The value of a typical spacecraft may be five to

ten times greater than that of the entire Astrotech facility,

estimated to cost approximately $15 to $20 million.

1.3 Data Gathering and Analysis

This evaluation involved a visit to the Astrotech Titusville

payload processing facility to examine buildings and equipment,

to assess policies and procedures encompassing the overall safety

program at Astrotech, and to evaluate the protection afforded to

the public by the program in place. Specific information was

gathered concerning the following:

• Buildings

• Operations and equipment

• Hazardous materials handled on-site

• Safety systems and equipment (including detection

and monitoring systems)

• Emergency preparedness and planning
The on-site visit allowed the OCST/EPA team to examine

buildings, equipment, and safety systems used for hazardous

operations as well as the chance to view hazardous operations,

interview key Astrotech safety personnel and to review relevant

documents, reports, design drawings, regulatory permits, and

other pertinent information. The visit also afforded the

OCST/EPA team members the opportunity to meet with the local

emergency response authorities, the local emergency planning

committee (LEPC), and the Brevard County Emergency Management

Agency to discuss the status of the emergency response and

planning activities for the Astrotech facility and to identify

and characterize the strengths and weaknesses of Astrotech's

specific safety and accident prevention programs.

Following the data gathering phase, the team members

analyzed data, evaluated safety systems, performed hazard

analyses and determined risk to the public from various potential

accident scenarios. Additional questions were asked of Astrotech

personnel on an as needed basis, and Astrotech reviewed selected

draft sections of this report to ensure that the safety

evaluation team had accurately represented the facility's

features and operations.

1.4 Evaluation Report

The results of the extensive data gathering and evaluation

processes are presented in this report. While this safety

evaluation will not ensure that an accident never happens at

Astrotech, this process can help to identify any potentially

hazardous situations that may exist, and highlight areas within

the facility where operational or safety system improvements

might significantly reduce hazards to the public. This report

may also provide state and local emergency response agencies with

guidance for dealing with safety issues concerning these and

other space-related activities, as well as an approach to

learning about and sharing technologies, techniques, and

management practices dealing with safety and emergency

preparedness.

The remainder of the report is organized into the following

sections:

Section 2.0 Executive Summary

Section 3.0 Site Overview

Section 4.0 Buildings and Operations

Section 5.0 Safety Policies and Requirements

Section 6.0 Emergency Preparedness and Planning

Section 7.0 Hazard Analyses and Risk Assessment

Section 8.0 Findings, Recommendations and Guidance

Several appendices are also included with more detailed

information regarding items such as Astrotech's Florida DER air

permit, safety equipment specifications, references for

information on performing hazards analyses, and the Brevard
County Hazards Analysis.
3-1
2.0 EXECUTIVE SUMMARY

This document presents the results of a safety evaluation of

a commercial payload processing facility owned and operated by

Astrotech in Titusville, Florida. The evaluation was performed

by a team of experts from the Office of Commercial Space

Transportation (OCST) and the Environmental Protection Agency

(EPA). Under the Commercial Space Launch Act of 1984, as amended

(Public Law 98-575, 100-657), the U.S. Department of

Transportation (DOT) is responsible for licensing and regulating

U.S. commercial space launch activities in a manner that protects

public safety, safety of property, and U.S. national security and

foreign policy interests, and encourages development of a viable

domestic commercial launch industry. When questions arose

concerning the safety of Astrotech's activities, the Lieutenant

Governor of Florida requested OCST to conduct an impartial and

focused review of the payload processing facility and operations. 

Because activities at Astrotech could affect safety of licensed

launch operations, OCST agreed to undertake the safety

evaluation.

The approach used in the evaluation was first to identify

the major concerns of the state and local regulatory, planning

and emergency preparedness officials, Astrotech, and the

community. These concerns focused on the operations, procedures

and policies in place at Astrotech to protect public health and

safety and the environment. Issues included building safety

design and siting, operating policies and controls, safety

systems, training, and emergency preparedness and planning.

The next step was to visit Astrotech to gather specific

information concerning the buildings, operations and equipment,

hazardous materials handled on-site, safety systems and

equipment, and emergency preparedness and planning. The visit

allowed the evaluation team to see the safety and control

systems; view some hazardous processing operations; interview key

Astrotech safety personnel; review relevant documents, design

drawings, and permits; and interview local emergency response and

planning officials.

After the data gathering phase, the team analyzed the

information, evaluated safety systems, performed hazards

analyses, and identified potential risks to the public posed by

credible accident scenarios that result in worst case releases at

the facility. The final step was to make recommendations for

changes or additions to procedures, policies, equipment, or

facility design that could help prevent future problems or

mitigate anticipated impacts on public health and safety of

possible accident scenarios; in addition, the evaluation team

prepared guidance to assist in evaluating other industrial

facilities where public health and safety concerns may arise.

This report presents the findings and recommendations of the
safety evaluation team, with emphasis on public health and safety

risks that could arise from operations at the Astrotech facility. 

The team did not perform a transportation risk assessment; nor

did the team evaluate issues of worker safety, either during

routine operations or during accidents.

Site Overview

Astrotech is a commercial payload processing facility

located in an industrial park in the city of Titusville, Florida. 

The site is about 3 miles from the Kennedy Space Center (KSC) and

is near an airport, offices, a manufacturing plant and a

residential housing development. The site covers approximately

37 acres and is divided into hazardous and non-hazardous work

areas. Operations are conducted in the work area appropriate for

the nature of the materials involved.

There are six buildings on the site. Buildings 2 and 3 are

in the hazardous area and house the operations that involve the

handling, storage, and transfer of solid rocket propellant,

liquid rocket propellant and explosive material. (Note: no

liquid propellants are allowed in Building 3.) The remaining

buildings (1, 1A, 4, and 5) are in the non-hazardous work area.

They contain space for offices and administrative activities as

well as for storage of support equipment, and for functional

testing, leak checking, and assembly of spacecraft prior to

hazardous operations. Hazardous operations involve handling of

solid rocket motors; transport, transfer and loading of liquid

propellants; and lifting, spin balancing and transporting of

fueled spacecraft to a launch pad at KSC or Cape Canaveral Air

Force Station (CCAFS). Operations are carefully scheduled

between the hazardous and non-hazardous work areas to minimize

risks to processing personnel and sensitive spacecraft equipment

and to maximize efficient processing flow.

Since Astrotech is located in an industrial park, there is

some separation between the site and residential areas. However,

concerns regarding accidents and potential impacts on nearby

populations have focused public attention on the facility and its

operations.

Facility Features

Astrotech provides a specialized facility and limited

facility support under contract to payload customers who perform

the final assembly, inspection and processing of their payloads

prior to launch. The activities involved in preparing a payload

for flight typically include assembly, leak testing of propellant

systems, installation of other equipment, functional testing,

cleaning, propellant loading, pressurization of tanks, spin

balancing (if required), and mating the satellite with assist

motors. These operations require special "clean room" conditions

(with specific limits on the amounts of dust and particles in the
air) and stringent controls on hazardous activities. Astrotech

is one of the newest payload processing facilities in the U.S.

and the only fully integrated one owned and operated by a

commercial entity. Thus, Astrotech has taken advantage of the

experience and knowledge gained by the National Aeronautics and

Space Administration (NASA) and the Air Force over the last three

decades of space launch activities to build and operate a stateof-the-art payload processing facility.

Since Astrotech is a commercial concern it is subject to

federal, state and local regulatory requirements concerning such

things as fire and building safety, worker safety, emergency

response and preparedness planning, waste handling and disposal,

transportation of hazardous materials, environmental emissions,

and notification of accidental releases. The safety evaluation

team found that Astrotech complied with all applicable safety,

environmental, and emergency preparedness regulatory

requirements.

 The buildings in the hazardous work area of the facility

were designed, sited and constructed to meet Department of

Defense (DoD) and Bureau of Alcohol, Tobacco, and Firearms (ATF)

explosives safety standards because solid and liquid rocket

propellants and explosive materials (e.g., ignition and

separation devices) are routinely handled, transferred, and

installed during payload processing operations.

Building 3 is used for the long- and short-term storage of

payloads, solid rocket motors (containing solid propellant

classified by DoD as mass-fire) and any other ordnance-containing

flight hardware, and other environmentally sensitive flight

hardware, as required. No liquid propellants are handled or

stored in Building 3.

Building 2 is used for performing operations considered to

be hazardous, including loading and transfer of solid and liquid

propellant, and is designed to be a total containment facility to

prevent the release of propellant vapor or liquid into the

environment from a small release during normal operations. The

building can effectively be sealed to trap propellant vapors

inside until treated. In constructing one of the newest

facilities of its kind, Astrotech was able not only to

incorporate lessons learned from the years of operation at NASA

and DoD facilities, but also to identify the best technologies

available, some of which had been developed for use in other

industries or applications, and to transfer and apply these

technologies to improve payload processing operations safety.

The special features and systems that were incorporated by

Astrotech and that the safety evaluation team found to be an

improvement over older processing facilities are briefly

described below.

Vapor Containment
Building 2 was designed and built to contain a

propellant leak or spill, should one occur inside

during normal operations. The only exhaust from the

building is through a scrubber that treats any

propellant vapors generated as part of the

fuel/oxidizer containment and neutralization system

(see below). Also, a recirculation fan is installed

inside Building 2 for agitation of air and to aid in

diluting and breaking down of propellant vapor in the

event of a major spill in the building.

Electrostatic Dissipation

The floor in the high bays and North Airlock in

Building 2, where hazardous processing operations are

performed, is covered with vinyl tiles, impregnated

with graphite and bonded to the concrete with

conductive mastic. This dissipates static electricity

to the building grounding grids, reducing the threat of

electrostatic discharge that might ignite SRMs or

flammable liquid propellants. This technology was

originally developed for use in hospital operating

rooms where static electricity created severe potential

safety hazards in dealing with sensitive instruments.

Spill Collection and Containment

Propellant loading operations are conducted on "fueling

islands," which are in the center of a work area and

are surrounded by a stainless steel collection trench

that slopes underground and drains to the containment

and neutralization tanks outside the building

(described below). If a spill occurs, it is directed

into the trench drainage system, confining the spill

and making cleanup easier. In the event of a fuel

spill involving a fire, the trench system would also

serve to confine the fire to the fueling island and

help prevent its spread to other areas.

Fuel/Oxidizer Containment and Neutralization

There is a containment system, consisting of oxidizer

and fuel holding tanks, separated by appropriate

valving and manually-switched piping connected to a

vapor scrubber. The scrubber is operated under a

permit from the Florida Department of Environmental

Regulation (DER) for anhydrous hydrazine, monomethyl

hydrazine and nitrogen oxides. Following a complete

processing operation, the contents of the tanks are

neutralized, and after testing by the city, are

discharged to the city of Titusville sewer.

Remote Visual Access To Hazardous Operations
Since Astrotech monitors all hazardous operations that

are performed by its payload customers, explosion-proof

observation windows were installed between the control

rooms and bays in Building 2 to reduce the number of

personnel in the bay during propellant sampling and

loading. This allows safety and quality control

personnel required to observe and monitor hazardous

operations to do so without being physically present in

the bay.

Pre-Action Suppression System

A computer-controlled fire suppression system was

installed that has compressed air in the lines,

maintaining a "dry pipe" condition. Activation of this

pre-action system requires two independent events:

first, smoke/heat detection alarm signal from any of

the detectors mounted in the bays, airlocks, or the

heating, ventilating and air conditioning (HVAC) system

or from a manual pull station; and second, sufficient

heat to melt the fusible link in the sprinkler head. 

The first opens a valve releasing the water to the

sprinkler system; the second releases the water from

the sprinkler head to wet the area. This system design

provides some special protection for sensitive payloads

and other equipment in case there is a false alarm or

other problem.

Computer Monitoring of Alarms

Alarms are automatically sent to the guard house at the

front gate via computer link for various parameters and

systems including: temperature and humidity (HVAC

system), loss of air pressure in the pre-action fire

suppression system, toxic vapor detector alarm, toxic

vapor detector status problem such as low battery or a

tape break, generator failure, and an automatic or

manual fire alarm. The alarm panel indications

displayed to the guard allow prompt identification of

potential problems and notification of appropriate

personnel.

Vapor Detectors

Astrotech monitors atmospheric conditions in Building 2

using state-of-the-art portable toxic vapor detectors

to supplement the more conventional vapor analysis

techniques used (Draeger tubes). Vapor monitoring is

done at all times that liquid propellant is in the

building. These detectors are extremely sensitive and

are microprocessor-controlled for speed, accuracy and

specificity. The detectors are encased in special

explosion-proof clear plastic boxes for use in

flammable/potentially explosive atmospheres.
Safety Policies and Requirements

Astrotech has strict safety policies and operating

procedures for the use of its facility and support equipment by

its payload customers. Because of the high value of their

satellites, Astrotech's payload customers also have stringent

internal safety requirements. So there is to some extent a

system of safety redundancy and crosschecks between Astrotech and

its payload customer, with each having considerable interest in

ensuring safe and efficient processing operations.

Payload customers are required to provide detailed technical

data and operating procedures for all hazardous operations. 

Astrotech reviews and approves these procedures prior to

initiation of operations. Additional Astrotech safety

requirements include such things as training and certification of

propellant handling teams, scheduling and coordinating all

hazardous operations through Astrotech, and safety monitoring by

Astrotech and customer safety and quality control personnel of

all hazardous operations scheduled for a specific payload.

Astrotech's safety requirements are detailed in two

operating documents, Safety Policy and Safety Standard Operating

Procedures, which identify what is required of the payload

customer by Astrotech in terms of information concerning support

equipment (e.g., pressure systems, electrical systems, tanks and

lines); certification standards; operating procedures and safety

requirements for performing hazardous operations (e.g., ordnance

checkout and installation, propellant loading); baseline weather

conditions for conducting operations; requirements for lifting

and transporting spacecraft; and accident reporting.

Emergency Preparedness and Planning

Astrotech has a written emergency plan that addresses

emergency response procedures for incidents that may occur either

at the facility or while transporting liquid propellant from and

returning any excess to the storage facilities at KSC and CCAFS. 

The plan was updated in 1988 and is considered an adequate

document for dealing with emergencies that could occur. Since it

began operations in 1984, Astrotech has never had a release in

which reporting to or alerting of emergency response agencies has

been necessary.

Astrotech has worked closely with local, county and state

emergency response and planning officials in familiarizing them

with the facility, its safety systems, the types of operations

that are performed, the materials that are handled and their

hazards, and the personal protective equipment necessary for

personnel responding to emergency situations. The public safety

officials interviewed by the evaluation team gave Astrotech high

marks for their efforts in these areas.

Hazards Analyses and Risk Assessment
The overall goal of this evaluation was to identify

potential risks to the public from accidents that could occur at

Astrotech. The hazards analyses were performed by reviewing the

facility design, operations and procedures and then defining

possible accident scenarios that could produce a hazard to the

public. In this evaluation, a scenario leading to a fire and

explosion in Building 2 was the baseline for defining accident

scenarios that could potentially affect the public. For each

accident scenario that could produce impacts on the public an

estimate of the probability of its occurrence was made and the

potential consequences described. For each potentially hazardous

condition, those facility design features and operating

procedures that could mitigate the hazard and reduce the

associated risk were also considered in making the probability

estimates. Any residual risk to the public was then identified.

In performing this assessment, the evaluation team

determined credible accident scenarios, regardless of how

unlikely, which could result in the largest potential negative

impact on the public. If these scenarios produce no significant

negative impacts on public health and safety, any lesser accident

can also be assumed to have no negative impacts. Hazards

analyses and risk assessments require assumptions and data inputs

to models which attempt to predict the results of physical

phenomena like fires, explosions and the release and dispersion

of toxic gases in the atmosphere. The evaluation team made

"conservative" assumptions and used conservative or worst case

data inputs for these analyses. This means that the assumptions

and data inputs err on the side of protecting public health and

safety. Therefore, the actual impacts, if an accident were to

occur, would likely be considerably less than those predicted.

The results of the analyses indicated that a worst case

release is caused by a fire and explosion involving the maximum

quantities of liquid propellant permitted on site (2,500 pounds

of fuel; 5,000 pounds of oxidizer) and the maximum amount of

solid propellant on site (24,600 pounds from the explosive safety

siting analyses), that damage or destroy the walls and/or ceiling

in Building 2. Gases not consumed in the fire and explosion

could then disperse and diffuse in the direction of the

prevailing winds.

The probability that any of the identified credible accident

scenarios will occur and result in the worst case release is

remote (about 2 x 10-4), on the order of two such accidents per

10,000 complete payload processing operations. At an average

processing rate of ten payloads per year, the probable frequency

of such an accident is approximately once in 500 years. In

Government payload processing facilities, with many years of

combined operating experience, accident scenarios of the severity

analyzed in this evaluation have never occurred. So, the safety

evaluation team conservatively estimates that even applying an

uncertainty factor, the maximum frequency of the worst case

release would be once every 100 years. 
The consequences associated with these accidents are

extremely difficult to predict since there are no mathematical

models that take into account fire and explosion inside a

building, followed by damage to the building allowing release of

toxic gases. Thus, conservative estimates for the amount of

propellants involved in the initial accident were made. Also,

conservative assumptions were made based on actual accident

experience, regarding the amounts of propellant that would be

available to be released (i.e., not consumed in the fire and

explosion). Typical ambient temperature and humidity were

assumed, along with conservative wind conditions. These

estimates resulted in very conservative (protective) estimates of

the concentrations of toxic gases that could result in the nearby

atmosphere.

Accident consequences, including ground level concentrations

of toxic gases and overpressure effects of explosions, were

examined to estimate any risk to the public. The analyses

indicated that no explosion effects, including primary

overpressure effects and secondary effects such as glass breakage

and flying debris, would occur beyond the facility boundary. 

To quantify the hazard from toxic gases, it is important to

use a standard measurement for airborne toxic hazards. The

Immediately Dangerous to Life and Health (IDLH) concentration set

by the Occupational Safety and Health Administration/National

Institute of Occupational Safety and Health (OSHA/NIOSH) was

selected for this analysis. An IDLH, set at a specific value for

a particular chemical, is the maximum concentration that one

could inhale for thirty minutes, and still not experience escapeimpairing symptoms or irreversible injury. Thus, both exposure

concentration and duration are important considerations in

evaluating effects. EPA uses the IDLH as a basis for performing

hazards analysis for community planning, but in order to be

protective of the general population has defined a "Level of

Concern" (LOC) for a chemical as 10% of its IDLH.

The safety evaluation team compared the predicted ground

level concentrations of all resulting toxic vapors (hydrazine;

nitric acid, from dissociation and reaction of oxidizer; and

hydrochloric acid, from the burning of a solid rocket motor

[SRM]) to their IDLH values. The hydrazine concentration outside

the facility boundary is never predicted to be above the 10% IDLH

level. Nitric acid and hydrogen chloride concentrations outside

the facility boundary are never predicted to be above the

50% IDLH levels, and their concentrations will diffuse to below

the 10% IDLH levels within approximately 860 feet and 1,225 feet

of downwind travel, respectively. At all locations outside the

facility boundary, even with a conservative assumption of low

wind speed, the exposure duration would be less than a minute. 

There would be no adverse impacts on the public from exposures at

these concentrations for such brief durations.

Thus, a worst case release, which has only a remote
possibility of occurring at the facility, would have no adverse

impacts on public health and safety.

Findings

Overall Astrotech appears to have taken every reasonable

precaution in designing and constructing a facility which is safe

for those living and working nearby and in implementing the

policies and operating procedures that have been successfully

used by DoD and NASA for many years. The owners commissioned

several safety studies, both to site the buildings on the

property initially and before design and construction changes for

modifications were approved. Astrotech has also tried to

identify and incorporate effective safety, monitoring, and

detection features into the facility.

Findings Regarding the Buildings and Operating Procedures

The buildings where hazardous materials are handled are

separated from the public and from the non-hazardous

work areas by distances determined using DoD and ATF

explosives siting criteria.

The buildings and equipment are state-of-the-art design

and quality.

Building 2 is designed and operated to minimize the

risk to the public from any potential releases of

propellant vapor or liquid that could result from a

spill occurring inside the building. The containment

and scrubber systems provide protection to the public

from any incidental exposures during routine

operations.

The physical facility and equipment compare favorably

with Government facilities that serve similar

functions.

Prior to and during operations, policies and procedures

are in place to ensure safety. These include attention

to all aspects of operations, equipment maintenance and

certification, personnel training, and safety systems.

The formal, documented procedures for processing

payloads meet all accepted standards as applied by

industry, DoD and NASA.

No reportable accidents or incidents have occurred at

Astrotech since it began operations in 1984.

Astrotech has continued to update equipment and is

committed to minimizing the generation of hazardous

waste, as evidenced by the recently ordered closed-loop

still for processing and recycling contaminated freon.
Findings Regarding Emergency Response and Preparedness

Astrotech has an adequate written emergency response

plan.

Astrotech has been cooperative and interactive with

local and county emergency response and preparedness

officials.

Procedures and equipment are in place to protect

workers in hazardous situations, to assemble the

facility emergency response team should it be

necessary, and to call for off-site assistance as

required.

Results of Hazards Analyses

If an explosion were to occur in Buildings 2 or 3, the

public would not be exposed to any primary explosion

effects from overpressure, flying fragments, or fire.

The worst case accident scenarios, which involve a fire

and explosion in Building 2, result in no adverse

impacts on public health and safety.

Recommendations

In this section, the evaluation team outlines areas needing

additional evaluation and attention by Astrotech to further

enhance the safety of its facility and operations. These

recommendations can be generally divided into those directed at

the systems, equipment, and operations; those dealing with

policies and procedures; and those dealing specifically with

emergency preparedness and planning:

Systems, Equipment, and Operations

Evaluate the feasibility and safety of modifying the

sequence of processing operations dealing with loading

liquid propellants, lifting and mating the satellite

with the SRM, pressurizing tanks, and spin balancing

operations so that the operations sequence minimizes

the chance of a worst case release.

Provide additional communication capability for cart

storage rooms (e.g., telephones or direct connection to

the guard house).

Policies and Procedures

Include operational sequencing limitations for

propellant loading in the Safety Standard Operating

Procedure (SOP).
Develop written guidelines for necessary activities

following an "uncontrollable" spill including a

definition of incident(s) that initiate an

uncontrollable spill, activities that need to be done

to mitigate and evacuate the area, and the steps and

requirements for re-entry.

Specify with more detail the criteria considered for

proper training and certification of customer

personnel.

Emergency Preparedness and Planning

Provide additional clarification of personnel

assignments, especially regarding an assigned back-up

to the Safety Officer.

Expand the emergency contacts list to include critical

contacts beyond the 911 system (e.g., the county

emergency management director), and the phone numbers

and contact person for the nearest industrial

neighbors.

Add the Superfund Amendments and Reauthorization Act

(SARA) Title III reporting requirements for information

to be furnished in the event of a release to the plans

and procedures.

Perform a simulated exercise of the emergency response

plan with emergency responders, even if only a tabletop exercise.

Guidelines

The safety evaluation team found that in the process of

evaluating the Astrotech facility, there were generic guidelines

that could be outlined in order to assist communities and local

response and planning authorities in evaluating the overall

safety of industrial facilities. It must be noted that these

guidelines are not aimed at the Astrotech facility itself; in

fact, in many of the areas identified, Astrotech can provide a

model for proper implementation.

It is helpful to coordinate early in the design process with

local planning officials, recognized safety experts, and other

facilities with similar functions, so that the original

construction can incorporate as many safety features as possible. 

For example, because the Astrotech facility is sited to meet

explosive safety distance siting criteria, the public is

protected from the primary effects of explosions.

A comprehensive safety program should include operating and

maintenance controls, training, documentation and record keeping,

and internal audits and inspections. Because the safety program
is a key factor in protecting the public and the environment, the

community may want to consider establishing a monitoring program,

where an external expert regularly inspects a facility and

observes operations to ensure that all aspects of the safety

program are implemented.

Along with community emergency planning officials, it is

important for facilities to establish an emergency response plan. 

In order to increase the effectiveness of such a plan, the

community and facility should work together to identify facility

hazards, determine likely accident scenarios, implement

procedures that minimize the likelihood and severity of such

accidents, and finally plan how to respond in the event of an

accident. Because hazardous materials are necessary for many

aspects of industrial processes, it is important that facilities

and communities work together to prevent or minimize accidents.

3.0 SITE OVERVIEW

This section provides an overview of the facility layout and security

measures, and details background regarding the site location, including the

local geography, weather patterns and community demographics.

The Astrotech facility is located in the southernmost part of the City

of Titusville, Florida at 28° 31' 30" North Latitude and 80° 49' 12" West

Longitude, approximately 3,000 feet south of State Road 405 and adjacent to

State Road 407. See Exhibit 3-1.

3.1 Facility Profile

The buildings that comprise the Astrotech facility are divided into

non-hazardous and hazardous work areas. It is common industrial practice to

localize and segregate operations involving activities in which hazardous

materials are handled, to minimize any potential exposure outside of a limited

area and to control and limit access. At Astrotech, operations are scheduled

to take place in the work area appropriate for the materials being transferred

or loaded.

 There are 11 permanent employees at Astrotech (including janitorial

staff), most of whom have been at the facility since its opening. Security

guards are provided to Astrotech under contract.

This section will present a general overview of the buildings that

comprise the facility as well as a general description of the safety design

features of the buildings in both the non-hazardous and hazardous operations

areas. Detailed descriptions of the buildings can be found in Section 4.1.

3.1.1 Buildings

The Astrotech facility opened in April 1984 after a ten month

construction period. After the original design and construction, Astrotech

identified the need to provide more processing space and to facilitate

processing larger spacecraft, and additions were made to Buildings 1 and 2. 

These additions were completed in May 1989, after a ten month construction

period. Additional studies were conducted to ensure that the expansion of

Building 2 met explosive siting criteria (See Section 7.1.1). Astrotech also

requested and obtained a modification of its Florida DER air permit to allow

the handling of larger quantities of liquid propellants on site (See

Section 7.1.2).

The facility consists of six buildings and a free standing antenna

tower. Buildings 1 and 1A, 4, and 5 are located in the designated

non-hazardous area of the site and Buildings 2 and 3 are in the hazardous

operations area. See Exhibit 3-2 for a layout of the buildings on the

property.

1-1
EXHIBIT 3-1 MAP OF ASTROTECH SITE

1-2
EXHIBIT 3-2 LAYOUT OF BUILDINGS AT SITE

1-3
3.1.2 Overview of Facility Design Safety Features

Buildings in the hazardous operations area (Buildings 2 and 3) are

constructed with special design features based on the materials and operations

that are allowed in each. These are detailed in Section 4.4 and are only

briefly mentioned here.

Building 3 is sited and constructed to DoD and ATF explosives safety

criteria for storage of solid rocket motors and any other ordnance-containing

flight hardware, as required. No liquid propellants are stored in Building 3.

Building 2 is designed to contain a release of propellant vapor or

liquid into the environment. The building has a sealed design, which, in the

event of a propellant spill, would trap all toxic vapor inside the building

and its containment system until it was neutralized into harmless materials. 

Also, the building is designed to minimize the possibility of igniting

propellants. For example, extensive lightning protection, consisting of

lightning rods and grounding grids, prevents accidental ignition of materials

and damage to equipment. In the unlikely event of a fire or explosion, there

are fire protection systems designed and installed to meet strict National

Fire Protection Association (NFPA) code requirements. Safe operations are

also enhanced by having backup power for critical functions like facility

lighting, the fire protection system, and vapor monitors.

3.2 Site Conditions1

In performing the safety evaluation, it is important to understand the 

topography, hydrology, weather, and atmospheric conditions in the vicinity of

the site in order to evaluate the effectiveness of the safety features of the

facility and also to identify and evaluate operations that may be sensitive to

site specific phenomena, such as storms and floods.

3.2.1 Soil, Topography and Hydrology

The soil is predominantly sugar sand with some sea shell fragments to a

depth of approximately 100 feet. No shell is evident at the surface, and none

was encountered in excavation to approximately ten feet. The upper region of

the soil is moderately porous and because of the gently rolling slope,

moderately well drained. Vegetation ranges from low grasses to sparse

palmetto.

The site is located outside of the one hundred year flood plain, and

flooding due to either excessive rainfall (i.e., thunderstorms or hurricanes)

or tidal surges is unlikely. The terrain is nearly flat, with a slightly 

rolling slope of less than ten feet. Because of the site's gently sloped

topography and its natural water table of approximately eight feet, rainwater

is rapidly absorbed into the ground. Swales or slight depressions in the

ground located throughout the facility site also contribute to the rapid

absorption of rainwater.

Tidal surge flooding, although possible, is unlikely because the site is

more than twenty feet above mean sea level and approximately fourteen miles

from the nearest Atlantic beach.

3.2.2 Weather Patterns

There are two major weather seasons: May to October is the wet season

and November to April is the dry season. Rainfall, temperature, wind

direction and atmospheric stability all vary depending on the season. 

 

 

1

 Most of the data in Section 3.2 was taken from Final Environmental Impact Statement for the

Kennedy Space Center NASA, October 1979 except for site specific details concerning soils, topography

and terrain.

1-4
Especially in the wet season, hurricanes and lightning are likely weather

patterns, so the facility must carefully monitor the weather before scheduling

hazardous payload operations.

Seasonal Temperature and Wind Patterns

The dominant weather pattern in the May to October wet season is

characterized by southeast winds that travel around the Bermuda Anticyclone,

bringing moisture and warm air, leading to almost daily thundershowers. This

season also has the greatest potential for hurricanes. Approximately

70 percent of the average annual rainfall occurs during the wet season. The

monthly precipitation average is four inches, with the greatest amount of

rainfall in September.

Temperatures during the wet season average 79 degrees Fahrenheit (oF)

and rarely exceed 90oF. Relative humidity averages 90 percent in the early

morning hours and generally declines to approximately 70 percent by early

afternoon.

Weather patterns in the dry season (November to April) are influenced by

cold continental air masses that cause rain when they move over the Florida

peninsula and meet warmer air. In contrast to the localized, heavy

thundershowers of the wet season, rains during the dry season are light and

steady, and tend to be uniform in distribution. Total rainfall averages

15 inches for a monthly average of approximately 2.5 inches.

Dry season temperatures average 64oF, but have sharp gradients when the

cold air masses move over the area. In the past decade, the temperature has

usually not gone below 32oF, and recent winters have had longer cold periods

than previously. Relative humidity during the dry season averages 55 percent.

Weather patterns originate from both daily and seasonal wind patterns. 

Wind directions are influenced by seasonal meteorological conditions and by

the thermal differences between the Atlantic Ocean and the Cape

Canaveral-Merritt Island-Titusville land masses. Cool air always replaces

rising warm air so that during the night offshore (from land to ocean) breezes

predominate and during the day onshore (from ocean to land) breezes are most 

frequent. Exhibit 3-3 illustrates day and night mean wind direction patterns. 

Onshore breezes can be 3,300 feet and higher, and reach farther inland during

the wet season.

1-5
EXHIBIT 3-3 DAY AND NIGHT MEAN WIND DIRECTION PATTERNS

1-6
Seasonal wind directions are influenced primarily by continental

temperature changes. In general, the fall winds occur predominantly from the 

east to northeast. Winter winds occur from the north to northwest shifting to

the southeast in the spring and finally to the south in the summer months. 

Exhibit 3-4 presents seasonal wind direction distributions.

Atmospheric stability is an indicator of air turbulence, inversely

related to the dispersion of gases and particles, and is an important factor

in determining the concentration of gases and particles in the air as well as

how long they might be present. Stable conditions can result in poor

dispersion (e.g., a plume of pollutants would not diffuse and disperse as

quickly) and are most likely to occur during the evening hours; unstable

conditions provide rapid diffusion and removal of gases and particles from an

area. Exhibit 3-5 illustrates the frequency distribution of stability classes

by hours of the day. Exhibit 3-6 presents seasonal distribution of

atmospheric stability detailing both the wind speed and the percent of time

that it occurs. In general, atmospheric conditions are most stable during the

winter months.

EXHIBIT 3-6 SEASONAL DISTRIBUTION OF ATMOSPHERIC STABILITY*

 Summer Winter

June-Aug Dec-Feb Annua l

Average

 

 

 Atmospheric Stability 1/ 2/ 1/ 2/ 1/ 2/

 Turbulence Classification

 

 

Extremely

Unstable 1.8 6.3 0.6 4.9 1.1 6.5

High Unstable 4.4 8.3 1.9 9.2 2.8 9.2

Slightly

Unstable 19.4 10.3 12.9 11.4 15.2 11.2

Moderate Neutral 44.9 9.6 40.4 11.4 44.9

11.0

Slightly

Stable 21.4 6.9 28.9 9.6 24.6 8.5

Low Stable 7.3 4.7 12.9 6.7 9.8 6.0

Extremely

Stable 0.8 3.6 2.6 5.8 1.6 5.1

 

1/ Percent of the time

2/ Miles per hour (wind speed)

*

Final Environmental Impact Statement for the Kennedy Space Center, NASA, John F.

Kennedy Space

Center, October 1979.

1-7
EXHIBIT 3-4 SEASONAL WIND DIRECTION DISTRIBUTIONS

1-8
EXHIBIT 3-5 FREQUENCY DISTRIBUTION OF ATMOSPHERIC STABILITY

BY HOUR OF THE DAY

1-9
3.3 Site Access and Control

All site access routes are publicly maintained roads. The immediate

access to the Astrotech site is via Chaffee Boulevard from Grissom Parkway,

which is off State Road 405, which extends to the east directly into the NASA

Causeway leading to KSC. State Road 405 intersects US Route 1 on the east and

joins State Road 50 to intersect with Interstate 95 on the west. Grissom

Parkway is the major artery into the Spaceport Florida Industrial Park. See

Exhibit 3-1.

Perimeter access is restricted by a chain link fence topped with barbed

wire. Access through the main entrance gate is controlled 24 hours a day in

order to regulate employee, customer, and visitor traffic through conventional

sign in, verification, and numbered badge assignment procedures. Access to

operations buildings is restricted by cipher/key locks on all personnel doors

and all visitors must be escorted. Other special access restriction could be

provided upon customer request. An additional badge exchange guard station

limits access to the entire hazardous work area when certain operations are

taking place in Building 2. 

Liquid propellants are transported to Astrotech from CCAFS/KSC, and,

therefore, the transport route is a short one. See Exhibit 3-7. Propellants

are transported from the CCAFS Liquid Propellant Supply Depot to Astrotech for

fueling payloads, and fueled payloads are transported from Astrotech to launch

pads at KSC and CCAFS.

3.4 Demographics of the Vicinity

It is useful to know the population pattern in the immediate vicinity of

the Astrotech facility as a baseline for risk analysis. After quantifying

specific distance relationships in a hazards analysis, the safety evaluation

team can determine the population affected, if any.

The safety evaluation team has made separate estimates of residential

and industrial populations within one mile of the Astrotech facility, and has

surveyed that area for any specialized concerns, such as ecologically

sensitive zones or sensitive facilities (e.g., hospitals, nursing homes, and

schools). The one-mile radius was selected to be conservative in evaluating

whether the public would be affected (i.e., be more protective of the public),

based upon the results of the Brevard County hazards analysis (see

Appendix A).

Because the facility is located within the existing Spaceport Florida

Industrial Park, there are a substantial number of offices and light

industries within a one-mile radius. Daytime office and light industrial

population is estimated to be 1,500 individuals, and the evening estimate is

150 individuals.

Based on the 1985 actual data2, the residential population by quadrant

(see Exhibit 3-8 for quadrant locations) is projected for years 1990, 1995,

and 2000 in Exhibit 3-9. Each quadrant has a one mile radius. The closest

residences to the facility are in Windover Farms, approximately one quarter of

a mile west of the facility across State Road 407. No residences are located

in the east quadrants.

If a hazardous situation were to arise, certain specialized populations

could require additional attention by emergency responders. EPA guidance

recommends that a community identify facilities, such as hospitals, nursing

homes, schools and parks, so that the community can incorporate their

protection into its emergency preparedness planning. No schools, hospitals,

 

 

2

Brevard County Projections, Populations and Occupied Dwellings, Brevard County Geographic

Research Division, August, 1987.

1-10
nursing homes or environmentally sensitive areas are known to be within a one

mile radius of the Astrotech facility. 

EXHIBIT 3-9 PROJECTIONS OF RESIDENTIAL POPULATION BY QUADRANT

YEAR

1990 1995 2000

NE Quadrant 0 0 0

NW Quadrant 750 1065 1344

SW Quadrant 180 327 480

SE Quadrant 0 0 0

 Population Total 930 1392 1824

1-11
EXHIBIT 3-7 HAZARDOUS MATERIALS TRANSPORTATION ROUTES

1-12
EXHIBIT 3-8 RESIDENTIAL POPULATION QUADRANTS

1-13
5-1
4.0 BUILDINGS AND OPERATIONS

This section provides a more detailed description of the site buildings

(Section 4.1), an overview of the operations that take place within those

buildings (Section 4.2), a listing of the materials handled on site and their

characteristics (Section 4.3) and details regarding the safety design features

of Building 2 (Section 4.4).

Astrotech provides facilities and limited facilities support for the

final assembly, inspection, and processing of payloads prior to launch. 

Payloads can be grouped into four generic classes of satellites based upon

their function: communications satellites, remote sensing satellites, weather

satellites, and scientific experiment satellites. Payload processing begins

at Astrotech once the satellite and its specific ground support equipment

arrive at the site.

The activities which comprise the preparation of the payload for flight

can be grouped into non-hazardous and hazardous operations. The non-hazardous

activities generally include:

• Final assembly or buildup of the spacecraft;

• Leak tests and initial checkout of propellant systems

before propellant loading;

• Installation of solar panels, antennas, insulation and

other equipment;

• Payload function testing;

• Inspection and cleaning;

• Monitoring and checkout of payload electronic systems

via hardlines and microwave communication.

Operations are designated as hazardous by NASA and the Air Force when

significant amounts of potential energy are present and loss of control could

result in injury to personnel or equipment; a significant change (i.e.,

increase or decrease) in the ambient conditions of temperature, pressure, or

oxygen content could occur; or the presence of hazardous materials presents

1-1
the potential for personnel exposure.1

The procedures and operations that are considered to be potentially

hazardous to personnel or to pose potential damage hazards to critical

spacecraft equipment and/or systems, generally include:

• Transport, short-term storage, sampling and loading of

liquid propellants (anhydrous hydrazine, monomethyl

hydrazine, and nitrogen tetroxide);

• Installation of explosive devices used in space to

ignite motors and to separate the payload from the

vehicle;

• Final assembly, lifting, and mating of solid rocket

motors and liquid propellant motors with the payload;

• Dynamic spin balancing of the assembled payload or the

fueled parts of the payload; and

• Transport of the fueled spacecraft from Astrotech to KSC

(See discussion of transport in Section 5).

Payloads have various types of motors that are fueled with either solid

or liquid propellants. See Section 4.2.1 for a discussion of the functions of

various motors. The orbit position control propulsion system in the

spacecraft itself can use either a single liquid fuel referred to as a

monopropellant (i.e., anhydrous hydrazine) or a combination of liquid fuel and

liquid oxidizer referred to as bipropellant (i.e., monomethyl hydrazine and

nitrogen tetroxide) depending on the requirements of the spacecraft. 

Generally, both the perigee kick motor (PKM), when required, and apogee kick

motor (AKM) contain solid propellant. Monopropellant spacecraft usually use a

solid propellant AKM; however, in bipropellant spacecraft the AKM often

utilizes the same liquid bipropellants as the orbit control propulsion system. 

Thus, a fueled spacecraft can have, in addition to solid propellant,

combinations of liquid fuel and liquid oxidizer: (1) anhydrous hydrazine

only, or (2) monomethyl hydrazine plus nitrogen tetroxide.

4.1 Payload Processing Buildings

The buildings in the hazardous and non-hazardous work areas on the

Astrotech site are physically separated by a distance of approximately 335

feet. See Exhibit 4-1. This physical separation ensures that the hazardous

work areas are located beyond the distance required by explosive siting

criteria. See Section 7.1.1. A typical spacecraft is located first in

Building 1, the non-hazardous processing facility, for operations such as

electrical systems checkout and leak check and then moved to Building 2, the

hazardous processing facility, for operations such as propellant loading.

4.1.1 Building Descriptions - Non-Hazardous Areas

Buildings 1 and 1A

Buildings 1 and 1A are separate but adjoining buildings that comprise 

the non-hazardous processing facilities. Building 1 with dimensions of

136 feet x 193 feet x 53 feet (including roof top air conditioning equipment)

contains three payload processing high bays, a common clean room airlock and

 

 

1

 Space Transportation System Payload Ground Safety Handbook, SAMTO HB S-100, KHB 1700.7,

November 1982, p 4-2.

4-2
associated support office space. The building has three antenna towers on the

rooftop, 96 feet above ground, that enable direct line-of-site air links with

nearby launch complexes at KSC and CCAFS.

4-3
EXHIBIT 4-1 SEPARATION BETWEEN HAZARDOUS AND NON-HAZARDOUS FACILITIES

4-4
Building 1A, the later addition, contains one clean room high bay with

its own clean room airlock. The overall building dimensions are 95 feet x

170 feet x 60 feet. Both buildings are constructed of steel columns and beams

with metal stud framing, except for the office and support sections of

Building 1, which are of concrete masonry block.

Overhead cranes within Building 1 provide hoisting capability in each

high bay, and those within Building 1A provide hoisting capability in and

between the high bays and airlock. In addition to the high bays and airlocks,

each of the two buildings contains garment change rooms, office areas,

conference rooms, break rooms, and an administrative area.

Building 4

Building 4 is the warehouse storage facility. It is used for storage of

equipment not requiring a controlled environment, such as shipping containers

and certain ground support equipment. Dimensions are approximately 62 feet x

125 feet x 30 feet. It is constructed of corrugated steel sheeting,

interspersed with translucent corrugated fiberglass.

Building 5

Building 5 is the customer office building. It is primarily used for

client office space during operations. The building is pre-engineered of

structural steel and has approximate dimensions of 60 feet x 60 feet x

16 feet.

4.1.2 Building Descriptions - Hazardous Operations Area

Building 2

Building 2, the hazardous processing facility, is used for activities

such as liquid propellant transfer operations, installation of ignition and

separation ordnance, spin-balancing, and mating of the spacecraft with its

upper stage (perigee kick motor or both perigee and apogee kick motors). 

Since these hazardous operations are the major focus of this evaluation, more

details about Building 2 are presented in this evaluation than for other

buildings on the site.

Building 2 (approximately 120 feet x 120 feet) contains clean room high

bays and airlocks. A system of overhead cranes provides lifting capacity

through the building such that a lifted load can be transferred or passed off

between cranes and moved between the high bays. The major areas of the

building include two airlocks (the North has a ceiling height of 65 feet and

the South 43 feet), three clean room high bays, two propellant cart storage

rooms, two garment change rooms, and two control rooms. See Exhibit 4-2 for

the general layout of Building 2 and Exhibit 4-3 for the room specifications.

4-5
EXHIBIT 4-2 LAYOUT OF BUILDING 2

4-6
EXHIBIT 4-3 BUILDING 2 ROOM SPECIFICATIONS

LARGEST

RM FUNCTION LENGTH WIDTH HEIGHT DOORWAY FLOORS WALLS CEILING

101 South Airlock 38 29 43 20x40 Vinyl GWB GWB

102 South High-Bay 60 37 43 20x40 Vinyl(c) GWB GWB

103 Center High-Bay 48 27 43 20x40 Vinyl(c) GWB GWB

104 North High-Bay 60 37 43 20x40 Vinyl(c) GWB GWB

105 Office 12 11 9-4 3x6-8 Vinyl GWB ACST

108 North Control Room 30 25 9-4 8x8 Vinyl GWB ACST

109 North Change Room 20 10 9-4 3x6-8 Vinyl GWB ACST

110 Corridor

111 Women's Restroom

112 Janitor

113 Men's Restroom

114 South Change Room 19 14 9-4 3x6-8 Vinyl GWB ACST

115 South Control Room 25 15 9-4 8x8 Vinyl GWB ACST

116 Balance Control Room 15 10 9-4 6x6-8 Vinyl GWB ACST

118 Corridor

119 Oxidizer Cart Room 20 20 9-4 10x10 Vinyl ConcreteGWB

121 Fuel Cart Room 20 20 9-4 10x10 Vinyl ConcreteGWB

123 North Airlock High-Bay 55 40 65 20x50 Vinyl(c) GWB GWB

Notes: 1) All dimensions are shown as feet or as feet-inches

2) Vinyl(c) - Conductive Vinyl

3) GWB - Gypsum Wallboard

4) ACST - Acoustic Tile

Building 2 is sited, designed and constructed to meet explosives safety

criteria standards2,3,4 and permitted to contain up to 2,500 pounds of liquid

fuels, 5,000 pounds of liquid oxidizer and sited for 24,600 pounds of solid

propellant. The high bays and airlocks are constructed of structural steel

column and beams with steel reinforced concrete-filled masonry block. The

walls have integral horizontal concrete tie beams and the roof is framed with

steel joists and decked with corrugated steel sheeting. The entire building

is covered on the exterior by insulation sealed with plasticized cement/stucco

for an impact resistant and airtight exterior. The upper surface of the roof

has an attached layer of rigid insulation material covered by a heat sealed

plastic membrane for thermal and moisture protection. The temperature and

humidity inside the clean room (100,000 Class) high bays are monitored and

controlled. 

There are two grounding grids, one outside the building and one inside,

consisting of structural steel ground bars connected to a steel grate in the

floor. All lights and intercoms are purged by positive air flow out of each

device to prevent the possible ignition of any flammable vapors that might be

present in the high bays. All other electrical equipment in the high bays is

explosion-proof.

 

 

2

 Bureau of Alcohol, Tobacco, and Firearms, Department of the Treasury, ATF P 5400.7 (11/82).

 

3

 DoD Directive 6055.9, DoD Ammunition and Explosives Safety Standards, July, 1984.

 

4 Department of the Air Force, AFR 127-100 CHANGE 1, 24 December 1984, Chapter 8 - Site Plans,

Construction, and Utilities, Section A - Explosives Site Planning and Section B - Construction

Considerations.

4-7
Building 3

Building 3 is a storage facility designed for short- or long-term

storage of payloads, SRMs, flight hardware, ground support equipment or other

sensitive equipment. Any stored payloads are, in general, waiting for

processing. The building contains six identical storage bays which are

environmentally controlled but are not clean rooms. Since this building is

used for the storage of SRMs, it is designed to DoD and ATF explosives safety

criteria and sited in the hazardous work area of the Astrotech site, remote

from the other buildings.

Building 3 was designed to store three PKMs called Payload Assist Module

(PAM) solid rocket motors (Thiokol Star 48 or Star 63) and three smaller

unspecified solid rocket AKMs (typically Thiokol Star 15) all using DoD Class

1.3 (mass-fire) solid propellant. Total propellant quantity limit is 24,600

pounds. No liquid propellants are permitted in the building.

4.2 Hazardous Operations

Payload processing operations are comprised of a set of activities that

are performed on a spacecraft or satellite and assist motor(s) to ensure that

the payload is flight-ready before it is mated with the launch vehicle at the

launch pad. Most payloads processed at the Astrotech facility have similar

functional characteristics but vary in size and appearance. Variations in

size and appearance may mean that the sequence of operations differs somewhat

for each payload processing operation. Under typical processing conditions, a

spacecraft will be located in the non-hazardous work area (Buildings 1/1A) for

6-10 weeks and in the hazardous work area (Building 2) for 3-4 weeks. Liquid

propellant loading is one of the last operations performed. The discussion

below describes the "typical" sequence of operations.

4.2.1 Functions of Payload Motors

A typical payload is a communications satellite that needs to be placed

in a geostationary orbit 22,000 miles above the earth. Launch vehicles

provide only enough energy to boost a satellite into a lower orbit, either a

circular one with a diameter of approximately 130 miles, or an elliptical

orbit with its low point at about the same altitude. To be fully operational,

a typical satellite requires additional energy for three functions: first, to

raise the orbit to the 22,000 mile high geosynchronous altitude; second, to

circularize the orbit at that altitude; and third, to maintain the precise

orbit positioning (i.e., station keeping) throughout the seven to fifteen year

operational life of the satellite.

The substantial energy initially required to raise the orbit to the

geosynchronous altitude is normally provided by a PKM, which is generally an

SRM ranging in size from 4 to 8 feet in diameter. As shown in Exhibit 4-4,

the PKM is a separate section of the spacecraft, designed to separate from the

remainder of the payload after the PKM's energy is expended. The fairing is a

shroud used to surround and protect the spacecraft during ascent through the

4-8
EXHIBIT 4-4 SCHEMATIC DIAGRAM OF A TYPICAL PAYLOAD

4-9
atmosphere and is typically jettisoned prior to achieving orbit as soon as the

launch vehicle has escaped the dense atmosphere.

When the satellite arrives at the required apogee altitude, the

additional energy required to circularize the orbit and to adjust the

equatorial inclination to place the satellite into its operational orbit is

provided by an AKM, generally solid propellant, and sometimes augmented by

small motors using liquid propellant(s). Because during its typical

operational life of 7 to 15 years a satellite will drift slightly out of the

required precise orbit, energy is needed to reposition the satellite

periodically. This energy is provided by the small liquid propellant(s)

motors. To improve operational efficiency and reliability, the tendency in

recent years has been to design liquid propellant rocket systems that can

perform both the AKM function and the orbital position control function. 

Although this design avoids the need for a solid rocket AKM, the amount of

liquid propellants required increases significantly.

4.2.2 Typical Payload Processing Operations

Because the PKM is essentially separate from the rest of the payload, 

operations at Astrotech can be performed independently on the PKM and the

remainder of the payload. Because the PKM has solid propellant and igniter

systems, PKM operations are considered hazardous and performed in Building 2. 

In the typical sequence shown in Exhibit 4-5, the PKM operations begin

approximately two weeks before the spacecraft operations and take

approximately six weeks to complete. Upon completion of the PKM processing,

it either remains in a high bay separate from that used for the spacecraft

operations, or it is moved to Building 3 for temporary storage. Simultaneous

to the PKM operations, the satellite undergoes approximately four weeks of

non-hazardous final assembly and checkout in Building 1, including tests to

verify the proper functioning of all electrical systems and leak checks.

As late as possible in the schedule, the liquid propellants are

transported from KSC to Building 2, where they undergo thermal conditioning

and helium saturation for several days. Operations are sequenced carefully so

that completion of PKM operations occurs several days before completion of the

non-hazardous satellite processing operations, leaving Building 2 available

for liquid propellant conditioning. After the propellants are conditioned and

thoroughly saturated with helium, the satellite is moved from Building 1 to

Building 2, where the liquid propellants are loaded and any solid propellant

AKM installed. (For the "typical" sequence illustrated in Exhibit 4-5, no

separate AKM is installed in the satellite.) If the laoded satellite requires

dynamic balancing, a spin balance operation is performed at this point. The

final step in assembling the payload is to mate the satellite with the PKM. 

Before transporting the flight-ready payload to the launch pad, the payload is

either encapsulated in the launch vehicle fairing or placed in a special

container designed to protect the payload during transport.

4.2.3 Transport of Fueled Spacecraft

The transport of the fueled and processed spacecraft from Astrotech to

KSC may be considered a hazardous operation. It is performed under strict

requirements: a convoy of law enforcement officials accompanies the shipment 

4-10
EXHIBIT 4-5 TYPICAL SEQUENCE OF PAYLOAD PROCESSING OPERATIONS

4-11
in a rolling roadblock (one vehicle is ahead of the transporter and one is

behind); the highway intersections are closed to the public ahead of the

transport vehicle; transport only occurs at night; and a maximum speed of 5

mph is maintained while en route.

During the course of gathering data on the various processing operations

at Astrotech, the evaluation team identified the transport of fueled

spacecraft as an area where, despite the fact that it is beyond the scope of

this evaluation, additional coordination was indicated between Astrotech and

RSPA to ensure compliance with all requirements of the Hazardous Materials

Transportation Act. Astrotech acted quickly on the verbal recommendation of

the team to coordinate with RSPA and provided all technical information

identified by RSPA to obtain the transportation approvals called exemptions

for the transport of not only the fueled spacecraft but also propellant carts,

when needed, propellant samples, and the oxidizer filter assembly.

Astrotech transports fueled spacecraft under this approval from the U.S.

DOT. Prior to transport, Astrotech obtains an oversize load permit from the

Florida DOT, and a Florida DOT officer inspects the transport equipment,

procedures, and driver licensing records to assure full compliance with all

applicable federal and state laws and regulations. This Florida DOT officer

also accompanies the transport convoy. Refer back to Exhibit 3-7 for

transport routes.

4.3 Characteristics of Hazardous Materials 

The hazardous materials handled at the Astrotech facility of most

interest are chemicals used in the propulsion system(s) of the spacecraft

(both liquids and solids) and ordnance (electroexplosive devices [EEDs]) used

to ignite SRMs and to separate the spacecraft from assist motor(s).

The liquids used as propellants are two types, fuels and oxidizer. 

These chemicals are stored and handled at ambient conditions without elevated

pressures or reduced temperatures. They are very volatile and when they come

into contact with one another they spontaneously ignite, liberating large

quantities of heat and gas. Because they undergo this reaction (referred to

as a hypergolic reaction), these chemicals are extremely useful as rocket

propellants. The fuels used at Astrotech include anhydrous hydrazine (AH) and

monomethyl hydrazine (MMH); they are also referred to as hydrazine fuels. The

oxidizer is nitrogen tetroxide (N204). A particular spacecraft may require

only fuel (i.e., monopropellant system) or both fuel and oxidizer (i.e.,

bipropellant system).

As detailed below, these chemicals are used in other industries besides

the space industry and have been manufactured, transported, stored, and

handled safely for many years. For an overview of releases of hydrazines and

nitrogen tetroxide reported to the National Response Center (NRC) over an 8-

year period, see Appendix B. In the eight year period, there were 77 separate

releases of hydrazine and 66 of nitrogen oxides. Of the hydrazine releases,

35% were attributable to public utilities and only 9% were space industry

related. Of the nitrogen oxide releases, 74% were attributable to

manufacturing industries and only 10.6% were space industry related. Although

there have been space industry related releases, the safety evaluation team is

not aware of any occurring from payload processing operations.

The major hazards from propellants result from their flammable and

reactive characteristics. However, propellants have properties similar to

other hazardous chemicals which are routinely transported throughout the U.S.

on the nation's highways and are manufactured and used in a variety of

industrial operations. For example, liquified natural gas and propane pose

similar flammability hazards, and are commonly used for home heating and

electricity generation. A typical industrial pressurized spherical propane

4-12
storage tank contains approximately 475 tons of propane with a chemical energy

of 19 x 109 BTU. By comparison, a Titan III ELV, one of the largest users of

liquid propellants in the spacecraft industry has a roughly equivalent weight,

414 tons, but lower chemical energy, 1.7 x 109 BTU. In fire situations, the

greater the chemical energy available, the greater the potential hazard. The

payloads processed at Astrotech have a much lower quantity of propellants than

ELVs, and hence much less chemical energy. Other industrial chemicals, such

as chlorine, ammonia, and sulfuric acid pose similar short-term exposure

hazards.

4.3.1 Hydrazines5

The hydrazine chemicals most commonly used at Astrotech are MMH and AH. 

Both are clear, oily, water-white liquids with a fishy odor. They are

slightly less dense than water. Vapors from these fuels are more dense than

air and therefore tend to hug the ground.

The largest manufacturers of hydrazine in the U.S. are Olin Chemicals

(approximately 21 million pounds per year), Mobay (14 million pounds per year)

and Fairmont Chemical (1 million pounds per year). Total U.S. production

averages around 36 million pounds annually, of which 29 million is sold

commercially. The remainder is retained for use by the manufacturer or

produced directly under contract. Only 5% of all hydrazine produced in the

U.S. is used by the space industry. The greatest consumer of hydrazine is the

agricultural chemical industry which uses 40% of the total hydrazine output.

Hydrazine is a key ingredient in a variety of agrochemicals, including

many common pesticides, fungicides, algaecides, bactericides and herbicides. 

Some blowing agents also contain hydrazine, particularly those used in the

production of foam rubber and plastics (including certain types of vinyl

flooring and automotive cushions). This accounts for another 28 percent of

the hydrazine consumed in the U.S.

Only 15% of the hydrazine that is produced in the U.S. is used as pure

hydrazine. In this form, it is effective as an industrial water treatment

chemical to remove chromates and is also used by electric utilities and other

industries to scavenge oxygen from feed water and reactor cooling waters. The

remaining 12% that is produced is used as a chemical intermediate in a variety

of products and processes. It is a key component of an experimental drug for

sickle-cell disease and is also found in the antituberculant drug Isonoizoid. 

It is used when plating electrolytic metals onto glass and plastics, as an

intermediate in textile dyes, as a polymerization catalyst, and as a reducing

agent in the extraction of plutonium from reactor wastes. Estazolam, a

sedative, and hydrazide salts used in soldering fluxes are also manufactured

from hydrazine.

Monomethyl hydrazine is manufactured in the U.S. by Charkit Chemical

Corporation in Darien, CT and the Olin Corporation in Stanford, CT. The

latest available records show that at least 100,000 pounds were produced in

the U.S. in 1977. Since 1982, however, monomethyl hydrazine has not been sold

on the commercial market. Monomethyl hydrazine is used as a chemical

intermediate, as a solvent, and in the synthesis of the antibiotic

cesftriaxone.

Further information on the properties of the hydrazine fuels can be

found in the Chemical Propulsion Information Agency (CPIA) Publication 394,

Hazards of Chemical Rockets and Propellants, Volumes I, II, and III, Applied

Physics Laboratory, Johns Hopkins University, September 1984 and in Hydrazine

 

 

5

Hypergolic Propellant Hazard Response Guide, Cape Canaveral Air Force Station (CCAFS), Draft Volume I, ICF Technology

Incorporated, July 1, 1988.

4-13
and Its Derivatives Preparation, Properties, Applications, Eckart W. Schmidt,

Wiley-Interscience Publications, USA, 1984.

The hydrazines are volatile chemicals that react readily with carbon

dioxide and oxygen in the air and will also decompose on contact with some

metals. If hydrazine vapor is released into the air in sufficient

concentration, it may ignite or react to form ammonia and oxides of nitrogen

(NOx). Further oxidation will form ammonia-based nutrients and the NOx will

ultimately return to earth as nitric acid rains.

The hydrazines are flammable liquids that can present fire and explosion

hazards, if sufficient quantities are handled improperly. A vapor phase is

readily formed at ambient conditions (the vapor pressures are roughly that of

water) and the vapor can be ignited by spark, open flame, or contact with an

oxidizer. Exposure of MMH or AH to air from a large surface, such as

saturated rags, may result in spontaneous ignition due to the heat evolved

from contact with oxygen in the air.

The hydrazines are also corrosive, poisonous, and can present serious

health hazards if direct contact is made with sufficient quantities of either

the liquid or vapor. The most severe exposures occur through dermal (i.e.,

skin) contact with liquid and inhalation of vapors. Contact of the chemical

on the skin can cause severe burns and the chemical can enter the bloodstream

leading to similar effects caused by inhalation. These effects may include

damage to the central nervous system such as tremors, convulsions, or death in

the case of extremely high concentrations of the chemical involved. Hydrazine

is also a suspect human carcinogen, according to the American Council of

Industrial and Government Hygienists. However, since hydrazine decomposes

quickly upon release into the atmosphere, it is unlikely that vapor

concentrations will remain high enough to cause serious health effects. See

Exhibit 4-6.

4.3.2 Nitrogen Tetroxide6

Nitrogen tetroxide is a thick, heavy, greenish liquid that is very

volatile (its vapor pressure is about 50 times that of water and 5 times that

of acetone). Its yellowish to reddish brown vapor, which is due to the

nitrogen dioxide (NO2) resulting from the N2O4-NO2 equilibrium mixture, has a

pungent odor similar to bleach. Nitrogen tetroxide is manufactured by a

single source in the U.S., Cedar Chemical Corporation in Vicksburg, MS. Based

on data from the U.S. Air Force Directorate of Energy Management, Kelly AFB,

the annual production capacity for N2O4 is estimated to be 3 million pounds

per year.7 Nitrogen tetroxide is produced by oxidation of nitric oxide which

is an intermediate stage in the production of nitric acid from ammonia. N2O4

is used in the manufacture of other chemicals (e.g., nitric acid and ammonia

fertilizer), as a chemical manufacturing intermediate, a nitrating agent, an

oxidizing agent, as a polymerization inhibitor for acrylates, and as a

catalyst. In air, nitrogen tetroxide liquid will vaporize and dissociate to

form gaseous phases of nitrogen tetroxide, nitrogen dioxide, and nitric acid

(mist).

Propellant grades of nitrogen tetroxide, which is mixed with nitric

oxide, are known as MONs (mixed oxides of nitrogen) and are identified by

percent weight of nitrogen tetroxide with no more than 0.17 percent by weight

of water. N2O4 dissociates into NO2 which is rapidly photochemically

 

 

6

 Ibid.

 

7

Post Accident Procedures for Chemicals and Propellants, AFRPL-TR-82-031, Report F04611-80-C0046, Systems Technology Laboratory, Inc., September 1982.

4-14
decomposed to nitrogen oxide (NO) and oxygen. The typical half life for NO2

in sunlight is about 2 minutes.8 Nitrogen oxides react with atmospheric

moisture to form nitric acid rain which can be returned to the land during

precipitation.

Though not flammable itself, nitrogen tetroxide will support the

combustion of most fuel sources. In addition, N2O4 may ignite organic

materials such as wood or rubber on contact. Nitrogen tetroxide will react

with water in a vigorous reaction that will produce nitric and nitrous acids

and NO2.

Contact with corrosive N2O4 liquid or vapor may lead to burns of the

skin and eyes. Inhalation of a sufficient quantity of N2O4 vapor to cause

adverse health effects may initially occur without great discomfort; however,

a few hours later more severe symptoms of tightness in the chest, coughing,

and breathing difficulty may begin and could result in pulmonary edema and

death in severe cases.

4.3.3 Solid Rocket Motors

Solid rocket motors (SRMs) contain solid propellant; those handled at

Astrotech include PKMs and AKMs. The description below of a "typical" SRM

illustrates how it releases energy to perform the perigee and apogee kick,

orbital adjustment functions. A typical SRM is mainly rubber-like propellant

surrounded by a thin-walled case constructed of heat-treated steel, titanium

or glass filament. The forward internal section of the motor consists of a

ring of propellant around a star-shaped hollow area. This star configuration

greatly increases the available surface area, allowing for easy ignition

triggered by the igniter ordnance. The central internal section of the motor

has a hollow, smooth circular core. On the end of the aft closure is the

nozzle where hot gases exit the motor.

The solid propellant burn travels from forward to aft instantaneously

and then from the core outward to the steel casing. Since the propellant

burns at over 6,000 F, the thin-walled case must be insulated from the heat. 

Initially, the unburned propellant contributes to this insulation. For endof-burn insulation, a layer of insulative material is used between the

propellant and the case.

The primary hazard from solid propellant in the SRMs processed at

Astrotech is due to its flammability. Solid propellant is classified by the

DoD as a Class 2, Division 1.3 (non mass-detonating, mass-fire hazard).9 The

material itself is not explosive; however, a solid propellant produces large

volumes of gas upon burning, which can lead to rupture and/or propulsion of

the motor. Additionally, the burning of an SRM generates hydrochloric acid, a

toxic combustion product.

There are several ways to ignite solid propellant, including: 1) hard

impact, caused either by a motor dropping onto a hard, sharp surface from

several feet or by an object falling onto exposed propellant or its steel

case, 2) direct contact of propellant grain with a flame, 3) extreme heat, 4)

an electro-static energy discharge or other large electrical discharge, such

as lightning, and 5) activation of explosive destruct charges or the motor

ignition system. Inadvertent ignition of solid propellant is difficult when

 

 

8

Hazards of Chemical Rockets and Propellants, Volume III, Liquid Propellants, CPIA Publication

394, Chemical Propulsion Information Agency, The Johns Hopkins University, Chapter 14 - Nitrogen

Oxides, September, 1984.

 

9

 DoD Directive 6055.9, DoD Ammunition and Explosives Safety Standards, July 1984.

4-15
standard safety practices are used. In fact, SRMs segments are regularly

transported both by rail and highway carriers, illustrating that they are

routinely safely handled in the normal transport environment.

4.3.4 Ordnance

Ordnance is defined in ESMCR 127-1 as all electroexplosive devices,

detonators, squibs, primer, pyrotechnic devices, initiators, igniters, solid

propellants, explosives, warheads, ammunition, fuzes and energy transfer

systems (e.g., linear shaped charges and Primacord). All initiating ordnance

items, for example, EEDs, are classified as Category A (hazardous)10 or

Category B (non-hazardous) for pre- and post-installation handling situations. 

ESMCR 127-1 details safety requirements for EEDs in Section 3.13.4, ranging

from design, connection, and environmental criteria (shock, vibration,

temperature). The hazards from ordnance are the potential for ignition or

detonation.

4.3.5 Other Hazardous Materials

Other hazardous materials used at the Astrotech facility for various

industrial support operations (e.g., degreasing parts, paint thinners, and

solvents) include isopropyl alcohol, 200 proof alcohol, Freon-113, gaseous

helium, high pressure liquefied nitrogen, gaseous nitrogen, and methyl ethyl

ketone. The use of these products at Astrotech does not pose a danger to the

public.

One Astrotech customer has a leak check procedure that uses helium

containing a small amount of krypton-85, a gas that is a source of ionizing

radiation. All use of ionizing radiation sources must comply with any

necessary requirements, specifically the Nuclear Regulatory Commission's Title

10 Code of Federal Regulations (CFR) and Florida Statute 10D.56 and must be

used under the supervision of a state qualified radiation protection officer.

All leak checking using the helium containing the krypton-85 gas takes

place within Building 1 in a sealed tent to preclude exposures within the

building. The majority of the krypton is recovered and the remainder is

vented out through an exhaust duct above the roof. The exhaust concentration

is limited to 3x10-7 millicuries per liter of air, which rapidly diffuses in

the atmosphere and dissipates before reaching the facility boundary. The

maximum amount of krypton-85 that could be released to the atmosphere,

conservatively assuming a full day of leak checking with a continuous release

at the maximum allowable concentration, corresponds to a dose of less than

2 millirems of radiation.11 Therefore, there are no adverse health effects

posed to the public. No other radiation sources have been or are scheduled to

be used at the Astrotech facility.

4.4 Building 2 Features

The fueling operations at Astrotech by their nature require engineering

controls and personal protective equipment that reduce any risk to systems and

personnel within the facility to as low a level as is reasonably achievable. 

Although this safety evaluation does not focus on the risk to personnel within

Building 2, controls that protect personnel also minimize risk to the general

 

 

10 Category A electro-explosive devices are those which, by expenditure of their own energy or

because they initiate a chain of events, may cause injury or death to people or damage to property

(Eastern Space and Missile Center, Range Safety, ESMCR 127-1, 30 July 1984, Section 3.13.2.2)

 

11 This dose can be compared with radiation doses from other activities, e.g., flying from

Los Angeles to Paris - 4.8 millirems; getting a chest x-ray - 22 millirems; getting a full-mouth

dental x-ray - 910 millirems; and getting a mammogram - 1,500 millirems.

4-16
public and are therefore relevant. As described in this section, the controls

include the design and construction of Building 2 as a "self-contained"

facility, the spill containment system to preclude any release of liquid

propellant from reaching the environment, and the scrubber system to reduce

any point source propellant vapor emissions from normal operations. The

containment and scrubber system work together to ensure that all vapors from

the system are reduced to acceptable levels as detailed in Astrotech's Florida

DER air permit. Standardized work practices and procedures (see Section 5),

similar to those required at KSC and CCAFS, provide additional protection

against unanticipated accidents or releases.

4.4.1 Propellant Containment and Scrubber System

It is essential while performing fueling operations to minimize the

release of propellants. Astrotech has included special design features and

operations procedures which can confine spilled propellant vapors within

Building 2, continuously monitor vapor concentrations, and collect all

fugitive and point source emissions (vapors and liquids) to chemically treat

them. In the event of a spill (with no associated fire or explosion),

Building 2 is designed to contain all propellant vapors and liquid and to

prevent any release to the environment.

Containment Facility

Building 2 was designed and built from the very beginning to be a

containment facility in case a release of propellant liquid or vapor should

occur inside the building during routine operations. In the event of a large

fuel spill, defined as a spill of greater than one gallon, the personnel in

the high bay would evacuate the building, the personnel in the control room

would turn off all power (effectively sealing the building) before evacuating,

and no one would reenter until the ambient concentration of the propellant

vapors decreased sufficiently to allow reentry.12

The rate of decrease of fuel vapor concentration can be predicted using

the hydrazine "half-life" concept that is based on laboratory studies and

detailed by Schmidt in a book titled Hydrazine and Its Derivatives. 

Hydrazines react with oxygen, carbon dioxide and water in the air aided by

agitation and recirculation. Half of the initial volume of anhydrous

hydrazine and monomethyl hydrazine breaks down into non-toxic constituents in

roughly 1 hour and 3 hours, respectively, as presented in Exhibit 4-6. The

evaporation rates are also listed in Exhibit 4-6 as relative indicators of the

volatility of the fuels.

EXHIBIT 4-6 HALF-LIFE TIME AND EVAPORATION RATES

 A recirculation fan inside Building 2 can circulate any vapors within

the building to promote agitation and evaporation and therefore, a more rapid

decay. The self-contained recirculation fan disperses and dilutes vapors and,

in instances of releases of fuel, will assist in the natural "half-life"

deterioration of the fuel vapors. Vapor circulation can be further assisted

by opening internal doors between the high bays and airlocks, thus allowing

greater volume of air within the sealed facility to mix with the vapor and

break down the concentration of fuel vapor (see discussion below).

Vapor Monitoring

At all times that liquid propellants are in Building 2, vapor detectors

 

 

12 Communication with Astrotech, 1990.

4-17
are in use. During propellant loading operations, toxic vapor detectors and

Half-Life Time*

Compound Evap. Rate Air Water

(mg cm-2 min-1) (hours) (days)

 

Anhydrous Hydrazine 0.49 1.1 7

MMH 1.7 2.7 10

 

* Ch. 4 "Hydrazine Handling," p. 600, Hydrazine and Its Derivatives, Schmidt, 1984,

Wiley and

 Sons, Inc.

visual inspection of equipment are used to monitor the area. If a release is

indicated (either by elevated concentrations of propellant [100 parts per

billion {ppb} of anhydrous hydrazine; 200 ppb of monomethyl hydrazine; 3 parts

per million {ppm} of nitrogen dioxide] or by visual observation of a liquid

spill), the fueling team would turn off valves to stop propellant flow and to

minimize damage to the spacecraft and other equipment.

Astrotech has recently obtained state-of-the-art toxic vapor detectors

to supplement and ultimately replace a less sophisticated vapor analysis

system (Draeger Tubes) traditionally used, and has incorporated their use in

revised operating procedures. The increased sensitivity of the new detectors

will improve safety by alerting personnel more quickly of elevated vapor

concentrations. The detectors combine the use of special detection tape keyed

to the material being monitored and microprocessor control for speed, accuracy

and specificity. These detectors are portable and are encased in special

explosion proof clear plastic cases. A concentration alarm is indicated by a

continuous tone and steady alarm light emitting diode (LED). Instrument

problems (e.g., bad battery, tape break) are indicated by a flashing red

indicator and an intermittent beep, and the alarm relay will be activated. 

These detectors have factory set alarm levels available of 200 or 400 ppb for

MMH, 100 or 200 ppb for N2H4, and 3 ppm or 6 ppm for NO2

13. Astrotech monitors

at the lower concentrations. More general instrument specification

information on the new MDA portable toxic gas detector can be found in

Appendix C.

Trenched Fueling Islands

Propellant transfer and loading operations take place in the center of

the high bays on a 25 feet by 25 feet "fueling island" created by a stainless

steel trench which surrounds a center portion of the floor. The trench is

covered by stainless steel grating and slopes to a common point where it

drains into the containment system located underground immediately outside the

building. The trench drainage system would confine a spill and facilitate

cleanup operations. In the event of a spill of fuel that resulted in a fire,

the trench system would also confine the fire to the fueling island and

prevent spread of the fire to any other area of the high bay or the adjoining

rooms.

Containment and Neutralization System

 

 

13 Guide To Operation, TLD - 1 Toxic Gas Detector, MDA Scientific, Inc., 1989.

4-18
The Astrotech waste containment and neutralization system serves both

oxidizer and fuel propellant loading operations. Any propellants (liquid or

vapor phase) released or spilled in Building 2 are processed through this

system. This containment system is comprised of two underground holding tanks

and a vapor scrubber (see discussion below). These tanks collect any liquid

spillage which could occur during propellant sampling and transfer operations. 

Each tank (one dedicated for oxidizer and one dedicated for fuel) has a

capacity of 6,100 gallons and contains approximately 500 to 1,000 gallons of

water mixed with the appropriate neutralizing agent before the start of a

propellant loading operation. A common piping system leads from the fueling

island trenches to a T-valve upstream from the holding tanks. The piping

drawing, examined by the evaluation team, showed that the drain line is a 4

inch, 110 cubic feet per minute (i.e., 50 gallons per minute [gpm]) line. The

valve must be manually operated to connect the trench with either the fuel or

oxidizer tank, depending on the propellant operation. Floor drains in the

propellant cart rooms also drain into the holding tanks, either directly (in

the case of oxidizer) or via the trench drain (for the fuel).

The tanks are constructed of fiberglass reinforced polyethylene with an

inert lining. No secondary containment or monitoring wells are required

around the tanks or lines. Hunter/ESE (an environmental engineering

consulting firm) performs annual leak checks on the tanks. In addition, the

City of Titusville can sample the tanks at any time to confirm that no

hazardous substances are stored. Recently, the City has been sampling the

tanks regularly and has never found a problem with Astrotech's use of the

tanks. The tanks are buried in the ground by tying them to underground

concrete pads, to keep them from "floating" in the buoyant soil. DOT placards

indicating hazards of the contents are posted above each of the tanks.

After loading operations are completed, hose lines are aspirated clean

using suction to draw any vapors or residual liquid into the

containment/scrubber system. Then, the hose lines are capped and bagged for

transport and decontamination by the customer. Any excess fuel or oxidizer is

returned to CCAFS. The propellant loading carts which are used to condition

propellant and then to load the spacecraft are cleaned on-site or the customer

may send the entire cart off-site for cleaning once he has demonstrated full

compliance with all applicable DOT transport requirements. The filter system

used for the transfer of nitrogen tetroxide is cleaned with freon.

Any hazardous waste that must be disposed is packaged and labelled in

accordance with EPA hazardous waste regulations and manifested for transport

according to DOT regulations. Installation of a closed-loop distillation

system is planned. This system will further minimize the generation of

hazardous waste by allowing the freon to be recycled.

 The waste propellant vapor and liquid aspirated into the underground

containment tanks are then neutralized into non-toxic products in preparation

for discharge to the sewer. Anhydrous hydrazine and monomethyl hydrazine are

neutralized with calcium hypochlorite (HTH) and the neutralized liquid in the

tank is checked for approximately 1% residual chlorine as an indication of

destruction of all hydrazine. N2O4 is neutralized with sodium hydroxide

(NaOH) to a pH of 10 to 12.

The neutralized liquid is pumped to the scrubber agitator tanks before

discharge to the Titusville city sewer. The city first samples the material

and tests for biological oxygen demand, chemical oxygen demand, and extraction

procedure toxicity parameters (mostly metals and pesticides). When the city

determines that the waste water presents no hazards to the treatment facility,

the waste water is allowed to be discharged and is then processed through the

sewage treatment system, commonly known as a Publicly Owned Treatment Works. 

The average amount discharged per spacecraft processing operation is about

4-19
5,000 gallons. A discharge is made after every complete spacecraft loading

operation. The current annual processing rate of six payloads results in six

discharges per year.

Vapor Scrubber

The scrubber functions during normal operations as an air pollution

control device by treating any fugitive or point source emissions of

propellant vapor, so that the emissions to the environment meet the Florida

DER air quality permit requirements. Stray vapor is drawn out of the building

through flexible hoselines and goes through the containment tanks into the

scrubber columns. The propellant reacts with the scrubber liquid and is

removed (or "scrubbed") from the vapor phase. The scrubber is not designed to

handle a catastrophic spill or accident but rather to treat point source and

fugitive emissions generated within Building 2 during normal propellant

transfer, sampling and loading operations.

The scrubber consists of two 40 foot packed bed towers that operate in

series using counter-current flow with an approximate 10 inch drop. In each

bay there are two 21⁄2 inch ports (facility vents) located on opposite walls

(north and south). During sampling or fueling operations, a dedicated

flexible hose (for either oxidizer or fuel) is attached to the nearest port

and directed in the close vicinity of the operation to remove any stray

vapors. These vapors are first drawn by a fan to the holding tanks and then

the tank vapor is taken through the scrubber. The centrifugal fan in the

scrubber system, which was activated while the evaluation team was inspecting

it, draws a vacuum through the tanks and to the ports in the high bays. The

vacuum draws any fugitive or point source emissions out of the building to be

treated. Once the vapors are scrubbed, the exhaust is discharged into the

atmosphere through a five inch diameter stack 60 feet above grade.

The scrubber stack parameters14 include:

Exhaust flow rate 400 actual cubic feet per minute (acfm)

Exhaust temperature 70.7 degrees Fahrenheit (annual average)

Scrubber efficiency 90%

Stack diameter 0.42 feet

Standard conditions 68 degrees Fahrenheit; 29.92 pounds per

square inch actual (psia)

 The scrubber is located within the lightning protection of Building 2 as

detailed in Section 4.4.2. Because there is no back-up power supply to the

scrubber system in case of a power outage, the scrubber would automatically be

turned off, sealing the building. In the event of a large spill, the building

would be evacuated and the power to the building including the scrubber would

be turned off from the control room, sealing the building.

The scrubber is designed to handle normal propellant loading operations

involving either fuel or oxidizer. Scrubber liquors are sodium hydroxide in a

10% solution at a pH of 10-12 with sodium sulfide (Na2S) for oxidizer and

water for hydrazine fuels. Different liquors are needed depending on the

vapors present, because the vapor undergoes a chemical reaction with the

scrubbing liquor. The scrubbing liquor can be considered a sponge; just as a

sponge can absorb a large, but limited amount of moisture, the liquor can

absorb (i.e., react with) a limited amount of vapor. The treatment capacity

of the scrubber liquor is more than adequate to handle normal propellant

loading operations. The system can handle a total of 300 pounds of oxidizer

 

 

14 Satellite Fueling Operation Response to FDER Completeness Summary, Hunter/ESE, No. 3901-

010010-0400-3160, July 1989.

4-20
and 100 pounds of hydrazine fuel without recharging the respective scrubber

liquor.15 This translates into approximately 25 gallons of oxidizer and about

12 gallons of fuel, which would be extremely large releases.

The vendor has further indicated that the scrubber exhausts

approximately 100 ppm or less of NOX vapors and has an average efficiency of

90%; therefore, an approximate 1,000 ppm charge of NOX vapors can be scrubbed. 

Astrotech has indicated that the system can effectively handle a charge of

approximately 200 ppm of fuel vapor and remain functional at maximum

efficiency. If fuel vapor concentrations rise above 200 ppm, the scrubber

could handle the higher concentration over a longer period of time. If a

spill of sufficient magnitude occurs such that the scrubbing liquor became

saturated, reducing its capability to react with propellant vapors, the liquor

would be recharged and the scrubbing process resumed. It is important to note

that the scrubber is not designed to handle emergency releases of propellant

nor for use in decontaminating the building in the event of a spill although

over a long enough period of time this could be effected.

The approximate magnitude of anhydrous hydrazine spilled that could

reach 200 ppm depends on the air volume in the high bay or combination high

bay(s) and airlocks available for dilution of the concentration within

Building 2.16 For example, in the south high bay (approximate volume of

95,460 cubic feet of air), it would take about 0.18 gallons (about 3 cups) of

anhydrous hydrazine spilled to reach 200 ppm in the bay; however, in the event

of a spill, the south airlock could also be opened, making an additional

42,920 cubic feet of air available. Then, approximately 0.25 gallons (about a

quart) of anhydrous hydrazine would be required to be released to reach a

concentration of 200 ppm. However, it must be noted that given the total

capacity of the scrubber system, while it would take about 4 hours to process

the 95,460 cubic feet of air containing the fuel vapor (or about 5.75 hours

for the larger volume) at maximum efficiency, the system could obviously

handle a larger release over a much longer time period before reaching

saturation. 

As a benchmark, the lower flammable limit (the vapor concentration which

will ignite and burn in the presence of an external ignition source) of

anhydrous hydrazine in air is 4.7 percent on a weight percent basis or 4,700

ppm; this limit for MMH is 2.5 percent or 2,500 ppm. At these levels in the

high bay, fire would be the most serious hazard. The scrubber is not designed

to handle releases of this magnitude.

4.4.2 Static Electricity Protection

Because flammable liquids and vapors can be present in Building 2 and

because SRMs and EEDs are extremely sensitive to electrical discharge,

significant design features and detailed operations procedures are in place to

minimize the opportunity for spontaneous electrostatic discharge (i.e.,

sparks).

Electrostatic Dissipating Floor Tile

 The floor covering in the high bays and North Airlock is made of a

static dissipating, graphite impregnated, vinyl tile. The tile is bonded to a

substrate with an electrically conductive mastic and connected to the

 

 

15 Correspondence with Tri-Mer Corporation, Air Pollution Control Systems, manufacturer and

supplier of the Astrotech scrubber system, August 1, 1990.

 

16 This section discusses only vapor concentrations within Building 2. See Section 7 for a

discussion of vapor concentration outside the facility.

4-21
grounding grid system. The fuel and oxidizer cart rooms and the South Airlock

do not have conductive tile but do have fixed grounding points in each room. 

The conductive tile and grounding points prevent electrical sparks in

Building 2.

Lightning Protection System and Operations Policy

The entire central Florida area is known for its high incidence of

thunderstorm and lightning activity. The Astrotech facility is constructed

with design features that ensure minimal negative effects in the event the

facility is hit by lightning. (To date no building within the Astrotech

facility has been struck by lightning.)

A lightning protection system surrounds Building 2 and consists of eight

lightning masts approximately 100 feet high, each connected to the primary

grounding grid, designed to prevent induced electrical current damage to all

support equipment.

Prior to all hazardous operations, a Stormscope (a state-of-the-art,

commercially available lightning detection system) is activated on site which

receives radio frequency (RF) signals from electrical discharges in the

atmosphere out to a distance of 200 miles from Building 2. If an electrical

storm is indicated within five miles of the facility, Astrotech's policy is

that no hazardous operations are initiated. Any ongoing hazardous operations

may be stopped immediately or continued only until a stable stopping point is

reached, depending upon the determination by the Astrotech Safety Officer and

customer safety official. Because the Stormscope identifies storms out to 200

miles, the Safety Officer knows in advance of a storm's existence and can

delay operations at his discretion if, for instance, a storm twenty miles away

appears to be heading toward the facility. During ongoing operations, safety

personnel are alerted by an audible alarm feature on the Stormscope to the

presence of any lightning within 25 miles of the facility.

Explosion Proof Electrical Systems

All electrical supply and illumination systems operating in Building 2

are either explosion proof by design or are made explosion proof by purging

the fixtures with an explosion preventing gas. The design requirements for

these systems are in accordance with pertinent sections of the National

Electric Code and NFPA Codes.17 The codes require that conduit and outlets be

sealed to preclude vapor entry, that all switching and contacting operations

be in sealed enclosures and that exposed surface temperatures be limited to

levels that will not produce vapor-air ignition. All electrical equipment,

including lighting that cannot practicably be sealed, is purged, eliminating

the possibility of vapor entry and subsequent exposure to potential electrical

ignition sources.

 Physical Separation of Equipment

Non-explosion proof electrical equipment must be kept at least ten feet

away from any SRM assembly. Prior to starting any operations involving SRMs,

the area is "safety checked" by both Astrotech and its customer. This

requirement is also true for operations involving ordnance and liquid

propellants.

Required Grounding Equipment

Grounding equipment, including such items as legstats, wriststats,

 

 

17 National Electric Code, 1987, which is Section 70 of the National Fire Codes.

4-22
conductive shoes, and shoe coverings, is required for personnel handling

ordnance, working within five feet of exposed SRM propellant grain, handling

propellants or working in a high bay containing a fueled cart or spacecraft. 

All grounding equipment is tested before each operation to ensure electrical

resistance levels (i.e., between 0.01 and 1 megohm) that avoid the occurrence

of sparks.

4.4.3 Personnel Protective Measures

Because the hazards associated with the handling of SRMs, PAMs, EEDs,

ordnance, and propellants generally pose a danger only to personnel working in

their immediate vicinity, non-essential personnel are not permitted near

operations involving these items. Special design features and safety

procedures protect personnel that are working in the immediate vicinity of

these materials.

Area Clear Restrictions

Safety precautions and restrictions are established and enforced at

Astrotech to limit the physical presence and access of non-essential personnel

during hazardous operations. These physical access restrictions have been

defined by Astrotech based upon operating expertise and requirements of

several of their payload customers and extend to either a 10-foot radius from

the activity to the entire room (high bay) in which the activity is taking

place, to the entire hazardous section of the facility. In general, the

relative risk associated with each operation is correlated with the size of 

its control area. The operations that take place within Building 2 and their

control areas18 are listed in Exhibit 4-7.

 

 

18 Safety Standard Operating Procedure, 1988, Astrotech Space Operations, L.P.

4-23
EXHIBIT 4-7 AREA CLEAR REQUIREMENTS

OPERATIONS CONTROL AREA

Clampband installation 10-foot radius around operation

Solid rocket motor ordnance 10-foot radius around SRM

installation/removal

Spacecraft ordnance installation 10-foot radius around spacecraft

(or 

greater at discretion of

Spacecraft

Manager)

Solid rocket motor handling and transfer Active high bay in which work is

being conducted. Work may continue

in adjoining high bay(s)

Solid rocket motor grain inspection Active high bay. Work may continue in

adjoining high bay(s)

Solid rocket motor leak test Active high bay. Work may continue in

adjoining high bay(s)

Activation of Shuttle or PAM Active high bay and adjoining high bays

cradle spin system with PAM

Hoisting of solid rocket motor Active high bay and adjoining high

bays

Spin balance solid rocket motor Active high bay and adjoining high

bays

Spacecraft pressurization Active high bay and adjoining bays

Liquid propellant transfer Entire Building 2 with road block manned

into spacecraft by Astrotech

Spin balance with loaded Entire Building 2 with road block

manned

propellants in spacecraft by Astrotech

The transfer and loading of propellants and operations performed on

fueled spacecraft require that Building 2 be cleared of all non-essential

personnel. Access to the area surrounding the building is restricted; only

personnel directly involved in safety monitoring or performance of the 

operation are permitted within the hazardous work area of the facility. 

During "building clear" operations, access to Building 2 can be

restricted by closing a gate arm near the badge house located a safe distance

from the building. A safety monitor is positioned at the gate to limit access

to the Building 2 area. Signs on the gate indicate "Keep Clear" and

"Hazardous Area." The gate arm also has a yellow flashing light activated

from inside the badge house. This badge house is manned by Astrotech

personnel when hazardous fueling operations are taking place; it is equipped

with telephone and power, and serves as the fallback assembly area in case of

emergency evacuation of Building 2. A hazard status board located near the

badge house indicates the nature and location of any hazardous material

present in Buildings 2 or 3. 

Procedures for installation of EEDs are another example of procedures to

limit personnel exposure. EEDs may not be installed until a control area has

4-24
been established and cleared of nonessential personnel. These devices must

not be electrically connected to the spacecraft systems until a power on and

off check is made to ensure there is no stray voltage. The control area is

required to be defined in the operating test procedures provided by the

customer to Astrotech. All personnel in the defined control area are required

to wear protective clothing and grounding equipment.

Personal Protective Equipment

All personnel working in Building 2 when release of liquid propellant

(fuel or oxidizer) or vapor is a possibility are provided with personal

protective equipment (PPE). PPE is designed to protect an individual from

toxic vapors and/or heat generated by fires and provides an appropriate air

supply and air filtering system along with protective coverings (e.g.,

chemical resistant suit, boots, gloves). Equipment used at Astrotech meets

NASA flammability and compatibility requirements for the hazards present. 

Level A, B or C equipment (as defined by the EPA) is available and meets Mine

Safety and Health Administration/National Institute of Occupational Safety and

Health (MSHA/NIOSH) standards and approval. The level of PPE required is

dependent upon the nature of the operation and the potential hazards. For

example, during operations where propellant vapors may be present (e.g., the

leak check, propellant sampling and start of propellant loading operations)

the highest level of protection, a Level A PPE19, is worn. However, once the

closed loop fueling operation has been verified to be leak tight, personnel 

can change into a Level C (splash suit)20 for the remainder of the fueling

operation. If a problem is indicated, the crew can change into Level A and

re-enter to monitor the situation and take appropriate actions.

Breathing Air System

In Building 2, air is purified through a compressed air purification

system that removes particulates, water vapor, and carbon monoxide (CO). A

downstream remote alarm system continuously monitors for CO. In addition, a

reserve air system has the capacity to allow four users at least five minutes

to exit and decontaminate. Further, a five minute emergency air supply is

incorporated into the air line respirator apparatus, allowing the user to

disconnect from the air line umbilical to exit and decontaminate with a 

self-contained breathing apparatus (SCBA). The emergency breathing air system

can be independently connected to a 50 kVA diesel power generator as a standby

power source in case of a general power failure.

During emergency escape from Building 2, individuals could also take

advantage of an Emergency Life Support Apparatus (ELSA). These portable,

self-contained breathing units provide air for five minutes in oxygen

deficient or contaminated atmospheres and are easily accessible to workers in

both the North and South high bays.

Remote Visual Observation

Remote visual monitoring enables individuals, like the Astrotech Safety

Officer and customer safety personnel, who must directly observe hazardous

activities to do so without being in the immediate presence of the hazard. In

Building 2, explosion-proof observation windows installed between the control

 

 

19 Level A PPE includes a supplied air respirator with an auxiliary self-contained 5 minute

emergency air supply; a SCBA with full facepiece; fully-encapsulated chemical resistant suit;

chemical resistant inner and outer gloves; chemical resistant boots; and two-way OIS communications

and umbilical.

 

20 Level C PPE includes chemical resistant disposable overalls; chemical resistant outer gloves;

and 5 minute Emergency Life Support Apparatus (ELSA).

4-25
rooms and the high bays allow Astrotech and customer payload safety officers

and quality control personnel to observe hazardous operations directly. Thus,

safety officers can validate compliance with procedures, but minimize risk to

themselves and eliminate any potential interference with operations that their

presence in the high bay might cause.

In addition, there are five closed circuit television (CCTV) cameras for

remote monitoring of operations in Building 2. However, these cameras

currently have no scanning or zoom capabilities. All three Building 2 high

bays can be monitored by video camera. Videotapes of fueling operations are

routinely made by Astrotech and offered to customers; video monitors can be

set up during fueling operations. Thus, any individual that needs to see

observations performed, but who does not need to provide direct feedback

during those operations, can either watch a monitor located in Building 1

during the ongoing operation, or can watch a videotape later.

4.4.4 Monitoring Systems and Communications

In order to ensure that equipment is functioning properly, as well as to

provide prompt response to any potential emergency, Building 2 is equipped

with detection and monitoring systems that alert the control rooms and the

guard house, as appropriate, of significant changes in the facility status. 

Communications during operations exist between the working area, the control

room and the guard house.

Building 2 is also equipped with an explosion-proof paging system that

can be used from either of the two control rooms. The paging loudspeakers are

located in all high bays and airlocks. The emergency exits in Building 2,

which shut automatically after opening, are also equipped with emergency

communication equipment that sounds a local alarm when activated.

Alarms are automatically sent to the guard house via computer link for

various parameters identified below (additional capacity in the computer link

is available to accommodate additional monitoring system alarms in the

future). The guard house alarm panel was recently installed by Honeywell.

Parameters Monitored

1. Temperature and humidity (HVAC systems)

2. Loss of pressure to fire protection system (i.e.,

compressor failure)

3. Toxic gas detectors and detector status (i.e., tape

break or battery problem)

4. Generator failure

5. Fire alarm

4-26
Also, a fire alarm is sent to the Titusville fire department via automatic

dialup.21

Non-hazardous situations can cause alarms. For example, item 2 on the

above list would alarm if the compressor failed. At that time, there would be

no immediate danger to the facility. However, the pre-action fire suppression

system (see description below), if needed, would require monitoring for loss

of pressure. Similarly, equipment problems with the gas detectors would not

in themselves be a hazard; however, their malfunction would limit the ability

of safety personnel to detect a hazardous atmosphere. If such an alarm

occurred during hazardous operations, operations would be brought to a stable

stopping point, personnel evacuated and the source of the alarm investigated.

Temperature and Humidity

Both temperature and humidity are monitored in the high bays to ensure

safe levels and effective functioning of the HVAC system. The typical control

settings are 70oF and 50 percent humidity with alarms at 60 percent relative

humidity and 75oF. The target levels and alarm settings for temperature and

humidity are designed to protect sensitive spacecraft equipment from damage

and can be specified by individual customers, as required. However, Astrotech

will not allow hazardous operations to take place if the relative humidity is

below 30% due to electrostatic hazards at humidity lower than this level.

Vapor Monitoring System See Section 4.4.1

Fire Alarm and Sprinkler System

The pre-action fire protection system22 is a computer-controlled system

designed to quickly extinguish any fire within Building 2 while protecting

spacecraft and other valuable equipment from inadvertent system activation or

malfunction. The high bays and airlocks have a dry-pipe solenoid actuated

system.23 The piping between a valve and the sprinkler heads is pressurized

and the pressure level monitored to ensure no loss of pressure. In order to

get water to the sprinkler head two things must occur: a smoke/heat detector

(see description below) must indicate a problem or a manual pull station must

be activated and the fusible link on a sprinkler head must melt due to an

intense heat source (the link melts at approximately 155°F).

For areas of the Astrotech facility where immediate danger of damage to

equipment from inadvertent wetting is not as great (i.e., non-high bay, nonairlock rooms in Buildings 1 and 2 and all other buildings), there is a wetpipe system with automatic sprinklers connected directly to a water supply,

that discharges water immediately upon melting of the fusible link at the

sprinkler head.

All water is supplied from the Titusville municipal system and is

assisted by a diesel boost pump, located in the pumphouse at the front of the

property, that upon system activation automatically provides 1,500 gpm of

water at 150 psi pressure. The North and South high bays in Building 2 each

have 28 sprinkler heads with 5/16" orifices and fusible plug activation

temperature of 155oF; the smaller center spin bay has 15 sprinklers; the

airlocks each have 12 sprinklers. Rough estimates of flow from each sprinkler

 

 

21 Safety Standard Operating Procedure, Astrotech Space Operations, L.P., 1988.

 

22 For additional information on fire protection systems see NFPA Fire Protection Handbook,

14th edition.

 

23 The high bays and airlocks in Building 1 have a similar pre-action fire suppression system.

4-27
range from 40 to 50 gpm. If all 28 heads in a Building 2 high bay were open,

the total flow would be approximately 1,260 gpm.

All areas in Building 2 have ceiling-mounted infrared (IR) smoke/heat

detectors that detect rate of heat/rate of rise. There are six detectors in

each high bay and two detectors in each of the return lines of the HVAC

system. There are also thermo-couples mounted on the tanks of the propellant

loading cart and in the spacecraft to monitor temperature during fueling.

There are portable fire extinguishers of both halon and dry chemical

types located throughout the facility.

Generator Failure See Section 4.4.6

Communications During Operations

There is a manually activated intercom (i.e., push-to-talk) for

communication between the control room and the fueling team during propellant

loading operations. Also, hand-held communication boards that can be written

on are available. As mentioned above, Building 2 is equipped with an

explosion-proof area paging system that can be used from either of the two

high bay control rooms.

The guard house is the focal point for the communications and alarm

detection system as described above. There is a cellular telephone and eight

UHF radios available at Astrotech for use by staff. In the event of an

incident, the guard has a list of personnel (with phone and pager numbers) to

be notified. See Section 6.0 for additional detail on emergency

communications.

4.4.5 Hurricane Potential and Restrictions

The potential for hurricanes during the wet season is well known; the

facility continuously monitors the likelihood of hurricanes approaching, and

implements hurricane preparation procedures whenever necessary. In addition

to implementation of specific procedures, buildings on the Astrotech site are

designed and constructed to withstand sustained winds of 125 miles per hour. 

Since 1887 only 24 hurricanes have passed within 100 nautical miles of KSC and

CCAFS. None have entered the Cape Canaveral area. However, hurricane

precautions are taken seriously, not only to protect valuable flight hardware

elements and operations facilities but also to ensure worker and public

safety.

 Weather tracking, specifically hurricane prediction, for the immediate

vicinity is meticulously performed by the U.S. Air Force meteorologists at

CCAFS with support from the National Weather Service. In its MOU with NASA,

Astrotech can contact NASA by telephone at anytime for weather information. 

In addition, contractor teams stationed at the facility are automatically

alerted by the Air Force of potential hurricanes.

Astrotech's hurricane precautions are patterned after those used at

CCAFS and KSC.24 They include successive steps of preparations for the strong

winds and heavy rains. For example, building evacuation and sandbagging of

entrances begins 24 hours before winds of 50 knots (57 miles per hour) are

expected to reach the area. In addition, all "unhardened" temporary or

portable structures are generally secured by anchors or removed and stowed, as

are any loose construction materials.

 

 

24 Hurricane Preparedness Implementation Plan, NASA/KSC, KHB-1040.2

4-28
4.4.6 Backup Power

Florida Power and Light is the prime provider of power to Astrotech. In

case of an unanticipated power failure, each building has a sensing device and

power automatically switches over to a 25 kVA propane-powered generator. The

backup power to Building 2 is fueled by an external propane tank mounted

outside the generator room. The automatic power supply initially goes only to

emergency lighting in the high bays. This light level was tested during the

on-site visit and found to be sufficient for any kind of emergency operation. 

The cranes and the airlock roll-up doors can also be powered from the backup

generator, so that if a spacecraft was being lifted during a power failure,

the lift could be completed. Manual relays must be thrown in the generator

room to direct power to the cranes or to the doors.

There is also a 55-kw diesel generator that can be plugged in and used

during count-down and for power up during ground stations and spacecraft

checkout. (A 50 hertz source is available for European satellites). There

are also several uninterruptable power supplies available to prevent software

crashes during system testing and checkout.

Building 2 has battery backup for the fire protection system and the

portable toxic vapor detectors; however, there is no backup power provided for

the scrubber system. This could negatively impact ongoing fuel operations in

the event of a power failure, especially during sampling operations, allowing

vapors to build up in the bay. It could also impact emergency response

activities since access to the building could be restricted because of

dangerous concentration levels with no system to remove the vapors. However,

since the scrubber was not meant to serve as an emergency system and is not

designed to handle large spills, the fact that it receives no power in the

event of a failure caused by a catastrophic accident is a protective measure

to ensure that no untreated vapors are exhausted directly to the atmosphere

from a scrubber system not designed or intended to treat them.

4-29
5-1
5.0 SAFETY POLICIES AND REQUIREMENTS

Astrotech has strict safety policies and operating requirements

for the use of its facility and support equipment. This section

begins with a discussion of overall management policies and

requirements (Section 5.1), describes operation and maintenance

requirements (Section 5.2), and concludes with specific personnel

training requirements (Section 5.3). 

 Because Astrotech only provides the use of the facility and

limited support equipment to their customers and performs no

hands-on processing of a spacecraft, Astrotech requires that

customers provide detailed technical data and supply operating

procedures for all hazardous equipment and operations. 

Astrotech's schedule for submissions, allowing time for review

and approval prior to initiating operations, is outlined below

(see Section 5.1.1). Additional requirements include such things

as training and certification of propulsion teams, scheduling and

coordinating of all hazardous operations through Astrotech, and

safety monitoring by Astrotech and the customer of all hazardous

operations scheduled to take place for a specific spacecraft.

When hazardous equipment or operations have been or are to be

used at KSC or CCAFS, the customer's detailed technical data and

operating procedures are also reviewed and approved by NASA

and/or the Air Force. The general safety standards against which

these plans and procedures are scrutinized are Air Force

Regulation AFR 127-100 Explosive Safety Standards, Eastern Space

and Missile Center Regulation ESMCR 127-1 Range Safety documents

and Kennedy Space Center safety requirement documents KHB 1700.7

and KHB 1710.2. The responsibilities of all parties involved in

the processing of a payload at ESMC are detailed in ESMCR 127-1. 

The safety evaluation team compared Astrotech's safety policies

and procedures to these requirements for Government facilities.

Further, the safety of operations at the Astrotech facilities is

a partnership between Astrotech and its customers and each has

compelling financial incentives to maintain the highest standards

of safety during payload processing operations. The customer is

bringing in a satellite that may be worth in excess of $100

million. At the same time, Astrotech has an investment of

approximately $15 to $20 million in the facilities and facilities

support equipment which it must protect. In addition Astrotech

wants to maintain its ability to process payloads to ensure

future business and revenues.

Astrotech also commissioned detailed technical analyses, both

before the initial facility construction and before the facility

modifications. These safety analyses are discussed in Section

7.1.1.
5.1 Management Policies and Requirements

The document Safety Policy prepared by Astrotech delineates

corporate policy regarding desired levels of safety and the

safety criteria against which the customers' hazardous operations

safety plan are assessed. It outlines the documentation required

of customers to meet Astrotech's safety requirements for customer

required support equipment, operating procedures, and personnel

certification and training; safety requirements for performing

payload operations including ordnance checkout and installation,

propellant loading, meteorologic baseline conditions for

conducting operations, allowable hazardous atmosphere work levels

(25% LEL)1; safety requirements for handling, lifting and

transporting spacecraft; and accident reporting requirements.

5.1.1 Documentation Requirements

Astrotech requires certain documentation from its customers to

ensure that its own safety criteria and standards are met. These

include:

•At least 90 days prior to processing, data on flight hardware

and safety critical subsystems, an operations schedule, a list of

technical operating procedures and designation of whether

hazardous or not, and a list of safety and emergency equipment

and procedures;

•Certification that each individual performing operations has

been trained and certified, if appropriate, and is medically able

to perform assigned hazardous tasks;

•At least 30 days prior to processing, detailed step-by-step

procedures for hazardous operations; and

•Any necessary federal and state licenses to handle radiation

sources, data on the sources, and documentation on testing,

packaging, transport and transfer of the sources.

The customer must comply with all Astrotech safety requirements

or request a waiver from Astrotech, detailing what system or

equipment is involved, why a waiver is being sought, any

potential hazards created and rationale for acceptance. No

waivers have been requested as of August 1990. Astrotech will

then either approve or deny the waiver. The customer is also

responsible for obtaining any waivers or variances from federal

regulation and must provide these to Astrotech.

 

 

1 25% of the Lower Explosive Limit (LEL). The LEL is the volume percent

concentration of a flammable material in air at which the material will ignite,

propagate flame, and in a confined area an explosion can occur. Using 25% of the

LEL provides a four-to-one margin of safety.
5.1.2 Safety Requirements

Written operating procedures are required for all hazardous

operations that are performed at the Astrotech facility and are

reviewed and approved by Astrotech prior to the operations. 

Simultaneous hazardous operations in the same hazard control area

are prohibited. Joint safety inspections by both Astrotech and

customer safety representatives are generally performed prior to

and immediately after payload and ground support equipment

installation at the facility, before initiation of hazardous

operations, and after any modification to the facilities or

equipment. Specific requirements are identified below for:

•Payload and ground support equipment

•Environmental conditions

•Handling and transport

Payload and Ground Support Equipment

Propellant systems and systems ground support equipment (usually

provided by the customer) must meet the requirements of either

Air Force Manual AFM 127/161 or Kennedy Space Center Handbooks

KHB 1700.7 and KHB 1710.2. These requirements are outlined in

the Astrotech safety policy handbook2 and apply to all operations

at Astrotech. Before any new, modified or repaired propellant

subsystems, storage or transport systems can be used at the

Astrotech facility, the customer must validate and certify that

they meet the requirements. Materials used in propellant systems

must meet compatibility and use standards as detailed in either

AFM 161-30 "Chemical Rocket Hazards," Volume II, or the CPIA

Publication Number 194, "Chemical Rocket and Propellant Hazards,"

Volume III. A leak check using a helium leak detector is

performed on load lines, pressure lines and transfer systems

prior to beginning propellant loading operations to ensure

equipment integrity before introducing propellant.

In Astrotech's Safety Policy, specific requirements are detailed

for standards that must be met by electrical equipment,

electrical equipment in hazardous atmosphere areas, grounding and

bonding, and maintenance operations. These are designed

specifically to preclude hazardous conditions and include

detailed requirements such as hazardous area distances for

flammable liquid propellants, and instructions for "explosionproofing" of electrical equipment operated during pressurization

or flow of flammable propellants.

Pressure systems (e.g., pneumatic and hydraulic systems), that

contain fluids above ambient pressure and include components like

tanks, pipelines, gauges, fittings, valves, regulators, and

relief devices are also closely scrutinized by Astrotech. Such

 

 

2 Safety Policy, Astrotech International Corporation, Sections 3.2.6.1-

3.2.6.3.
things as pressure vessel American Society of Mechanical

Engineers (ASME) design and marking requirements, safety factors

for burst design of components, and system operating relief

pressures and flow capacities are indicated. Flexible hoses, and

inspection, calibration and test requirements are also discussed.

Radiation is also addressed in the safety requirements. This

covers both ionizing (radioactive) radiation and non-ionizing

(microwave, radio frequency, optical or laser) radiation sources. 

General requirements for preventing inadvertent personnel

exposure, assuring fail-safe operations, and testing and

maintaining equipment are outlined. As discussed in

Section 4.3.5, the only use of ionizing radiation at the facility

is for limited leak checks of equipment by one customer.

A significant component of the payload/ground support equipment

safety requirements deals specifically with solid rocket motors,

ordnance (electro-explosive devices used in destruct and

separation systems) and liquid propellants, since these are

considered hazardous materials and any operations involving them

are closely and carefully scrutinized.3 Other hazardous

materials are also mentioned including cleaning solvents and

adhesives because of potential flammability or reactivity. 

Astrotech is also concerned with the toxicity of the propellants

and has installed a containment system to prevent releases to the

environment. The system is described in more detail in Section

4.4.1.

Environmental Conditions

 The major concerns addressed here are ensuring the proper

meteorological conditions are adhered to in scheduling and

conducting propellant handling and loading operations. No

hazardous operations may be initiated if electrical storms are

within five miles of the facility or if hurricanes are predicted;

if operations are ongoing, safety personnel are notified of any

thunderstorm activity within 25 nautical miles.

A hazardous indoor atmosphere is defined (25% of the LEL) for

sampling purposes as well as a level for personnel (oxygen

between 19.5 and 25% by volume) activity. This requirement

assures at least a four-fold safety factor for fires because the

LEL is the minimum vapor concentration at which a compound can

ignite.

Handling, Transport and Storage

 Requirements for hoists, slings and cranes, including safety

factors and load test requirements, test frequency, and

inspection details for each type of lifting equipment are

 

 

3 Safety Policy, Astrotech International Corporation, Section 3.2.
outlined; compliance with applicable OSHA 29 CFR and American

National Standards Institute (ANSI) B30 sections is required4. 

Transport of fueled spacecraft to the launch pad is not allowed

to begin when electrical storms are within five miles, and

general vehicle and safety system checks are required prior to

embarking.

Astrotech requires SRMs to be handled and stored in accordance

with the requirements of their hazard classification and storage

compatibility group. The storage compatibility group is the

group for explosives, propellants or other hazardous materials

which can be stored together without significantly increasing the

probability of accident, or for a given quantity, the magnitude

of the effects of such an accident. The compatibility groups are

based on the system recommended for international use by the

United Nations (UN) as adopted by the DoD. The hazard

classification system is also based on the recommended UN

international system and distinguishes between mass-detonating

and non mass-detonating explosives (including propellants)5.

All explosive materials used at Astrotech are required to be

stored, inspected and tested in approved areas only and in

accordance with the hazard classification and storage

compatibility grouping of the material. Ordnance must be stored

in the high bay ordnance lockers (Hoffman boxes), and work on

Category A6 EEDs must be performed only in Building 2. Work on

Category B7 EEDs requires a 20 foot clear area.

Ordnance and associated flight items are required to be the

natural color of the devise, while non-flight items require color

coding and submittal of the coding key to Astrotech. The color

code facilitates efficient operations.

Generally, all liquid propellants are transported to the

Astrotech facility from CCAFS by Astrotech personnel in DOTapproved transport containers. A maximum of one cylinder

(approximately 3,600 pounds) of nitrogen tetroxide or two 55-

gallon drums of fuel (approximately 925 pounds of anhydrous

hydrazine or approximately 800 pounds of monomethyl hydrazine) is

allowed in any one shipment. On occasions when it is necessary

to load propellant into the propellant carts from the bulk

 

 

4 Ibid. Section 3.4.1.

 

5 Hazards of Chemical Rockets and Propellants, Volume II, Solid Propellants

and Ingredients, C.P.A. Publication 394, September 1984.

 

6 Category A EEDs are those which by the expenditure of their own energy,

or because they initiate a chain of events, may cause injury or death to people

or damage to property. ESMCR 127-1, 30 July 1984, Attachment 1. 

 

7 Category B EEDs are those which will not, in themselves, or by initiating

a chain of events, cause injury to people or damage to property. ESMCR 127-1, 30

July 1984, Attachment 1.
storage facility, the carts are transported to Astrotech under

the protection of a security escort and in accordance with the

applicable DOT transport approval. Transport of fuel and

oxidizer never occurs at the same time.

Liquid propellants are present at the Astrotech facility only as

long as required to condition, sample, load the liquid fuel or

oxidizer into the spacecraft, and transport the spacecraft to the

launch pad. No liquid propellants are stored at the Astrotech

facility. Liquid propellants brought on site are placed in

Building 2 either on a fueling island or in a propellant cart

storage room, where they are conditioned with helium for 5-7 days

until fully saturated. This saturation is done to ensure that

adequate pressure is maintained in the spacecraft propellant

tanks. Vapor detectors, which alarm directly to the guard house,

are used whenever liquid propellants are on site so that any

leaks will be detected immediately.

Only enough liquid propellant is brought on site for loading the

payload with allowance for ullage in the storage cart and

sampling. Following completion of a fueling operation, any

residual propellant is drummed appropriately and returned to

CCAFS for reuse or disposal. A maximum of three nearly empty

drums, containing small amounts of residual fuel, can be

transported at one time.

After nitrogen tetroxide is loaded into a spacecraft, the

micropore filter used for its transfer is contaminated with a

small amount of nitrogen tetroxide. This is removed using freon,

which is planned to be distilled in a closed-loop distillation

system. After the small amount of oxidizer in the freon has been

neutralized, the contaminated freon is run through the unit which

recovers the freon for reuse. Because the closed-loop

distillation system has not yet been installed, the cleaning

solution, which is classified as "waste oxidizer" and is 99%

freon, is currently drummed and treated as a hazardous waste

according to EPA regulations.8 Any other residual chemicals

classified as hazardous waste are shipped off site to an EPA

approved Treatment, Storage, and Disposal facility within 90 days

of their generation. During six years of operation, only one

drum of hazardous waste has been generated that required off-site

disposal.

The largest propellant transfer operation to take place at the

Astrotech facility occurred in 1990 with the processing of

INTELSAT. Approximately 4,000 pounds of oxidizer and 2,400

pounds of fuel were loaded into the spacecraft. Payloads of this

size are rare, and typical payloads are somewhat smaller,

generally requiring about 1,000-1,500 pounds of propellants (fuel

 

 

8 Resource Conservation and Recovery Act (RCRA), Subtitle C, 40 Code of

Federal Regulations (CFR), Part 262 - Regulations Applicable to Generators of

Hazardous Waste. 
and oxidizer) to be brought on site at any one time, depending on

the requirements of the spacecraft. This typical liquid

propellant quantity on site is about twenty percent of

Astrotech's design criteria and DER permit allow; 5,000 pounds of

oxidizer and 2,500 pounds of fuel. These maximum permitted

quantities are 240-650 times less than the amount of propellants

used to fuel a Titan ELV at CCAFS. 

5.1.3 Accident Reporting

In the event of an accident, Astrotech has established reporting

requirements so that it can evaluate accident causes and initiate

preventative measures. All customers are required by Astrotech

to prepare a formal written report of any accident involving

serious injury or death to personnel or substantial damage to

equipment or facilities within five working days. Minor

incidents can be reported verbally; however, minor incidents with

high accident potential must be formally reported. In over six

years of operations, there have been no accidents requiring

formal accident reporting. In addition, Astrotech is subject to

accident reporting requirements under SARA Title III and the

Comprehensive Environmental Response, Compensation, and Liability

Act (CERCLA), as outlined in Section 6.4.

5.1.4 Insurance Inspections

An additional external safety inspection is performed by an

inspector representing Astrotech's insurance company to ensure

that the facilities meet the insurance company's safety

standards. Prior to entering into a contract with Astrotech,

each potential customer may have an agent representing his

insurance carrier inspect the facilities to ensure that his own

safety and operating standards are met. The inspections are

performed approximately twice a year.

5.2 Operation and Maintenance Requirements

Astrotech provides continuous safety monitoring during all

hazardous operations by the Safety Officer and he is empowered to

stop an operation if he deems it unsafe or problems are

indicated. Most hazardous operations can be completed in one 8

hour shift and that shift is scheduled during normal business

hours to maximize personnel alertness. At least one shift

separates operations involving fuel and operations involving

oxidizer, during which time the trench drain system is flushed

and reconfigured to prevent any possibility of contact between

fuel and oxidizer.

 Safety procedures and plans for all hazardous operations must be

submitted by the customer to Astrotech for review and approval. 

In addition, Astrotech regularly inspects and tests all equipment

that it provides. As detailed below for specific equipment, the

daily visual checks are common as are semi-annual to annual

system-wide verifications.
There are three Astrotech safety personnel who are always

available to respond to incidents or accidents during critical

periods of handling SRMs, ordnance or liquid propellants. They

all have pagers and can be reached at anytime during the day or

night. All three individuals are intimately familiar with

payload processing operations and have worked at Astrotech since

the facility opened. If a problem arises after work hours, the

guard has a full set of notification procedures to follow, that

include calling the appropriate Astrotech personnel.

Personnel safety equipment (e.g., static dissipating devices,

safety glasses for EEDs or propellant grain inspection, gloves

and cartridge respirators) supplied by the customer must be

approved by Astrotech. Astrotech provides personal protective

equipment (see Section 4.4.3), flame retardant coveralls,

legstats, emergency escape units with a 5-minute air supply, and

Scott air packs with a 30-minute air supply. See Section 4.4.3.

Overhead cranes and hoists are inspected prior to use each shift

visually and by activating the pendant emergency power kill

switch under simulated load conditions. All cranes, hoists and

hooks are proof tested at least yearly at 125% of their rated

load per OSHA requirements (29 CFR 1910) and ANSI B30. All hooks

are magnafluxed yearly. Proof load data are attached to each

crane pendant. Transfer of spacecraft from high bay to high bay

in Building 2 entails the use of the Javelin feature on the

overhead crane, and is only performed by fully trained Astrotech

personnel9. The roll-up doors in Building 2 are also restricted

to operation by Astrotech personnel.

The conductive floors of Building 2 are checked at least annually

by Astrotech per NFPA 56A to verify that the static dissipation

capacity is 1 Megohm or less. This safety check ensures

continuing dissipation of any electrical sparks. Equipment is

bonded or grounded when attached to any device containing

hazardous materials. Grounding straps are inspected prior to use

and daily when in use, and if the integrity of the cable is

suspect for any reason, the cable is checked to ensure proper

functioning (e.g., a resistance of less than 10 ohms).

Prior to beginning operations, area safety checks are performed

by both Astrotech and the customer, if ordnance, solid motor or

liquid propellant are present. Each shift that propellants are

on-site, toxic vapor checks (sniff checks) are made and the

results marked on the high bay door. Once propellants have been

brought into Building 2, continuous monitoring using the MDA

toxic gas detectors is performed. See Section 4.4.1.

Fire protection equipment in Building 2 is checked visually at

the start of each shift. The entire system is tested on a semi-

 

 

9 Safety Standard Operating Procedure 1988, Astrotech Space Operations,

L.P., pp 11-14.
annual basis (every 5 to 7 months depending upon operational

schedules). See Section 4.4.4 for a more detailed description of

the fire protection system.

Security is provided for the high bays by key and cipher control

available only to the customer and Astrotech. The cipher control

may be changed at any time interval specified by the customer.

5.3 Personnel Training Requirements

The Astrotech Safety Officer is responsible for ensuring that

Astrotech employees have adequate training in dealing with

hazardous materials. Employees who have responsibility for

handling hazardous materials, and who are assigned to response

duties, have training equivalent to that required by NASA

personnel who perform similar duties at KSC. This training

exceeds the requirements of Training Standards for Hazardous

Technicians Level III and Level IV as designated under OSHA,

Title 29 CFR Section 1910 and EPA, Title 40 CFR Part III, and

applicable to a wide variety of industries that use hazardous

materials.

Customer personnel coming to Astrotech, who participate in

hazardous operations (e.g., propulsion teams), must each have

certification from the employer noting the individual's training

and qualification as well as physical fitness for his assigned

hazardous task. Astrotech provides safety briefings for customer

employees that include:

•NASA propellant handling safety video

•Facility specific safety/emergency features

•Safe operating procedures and checklists

•Safeguards and safety devices

•Personal protective equipment

•Monitoring and warning devices

•Emergency and contingency procedures

After such training, customer personnel are familiarized with the

Astrotech facility and prepared to implement the safety

procedures effectively.
6-10 DRAFT

September 22, 1995
6.0 EMERGENCY PREPAREDNESS AND PLANNING

Astrotech has a written emergency plan that covers emergency response

actions for incidents that may require action by emergency responders

including medical and fire personnel and evacuation of buildings and nearby

areas. This plan was updated in 1988 and is supported by other Astrotech

1-1
documents.1,2

In the Titusville area, emergency planning and response capabilities

benefit from the planning and working relationship between the City of

Titusville and Brevard County. The officials have worked together during

other activities requiring public safety duties, specifically the

responsibility for thousands of spectators and visitors that are present in

the area before, during and immediately following space launches.

Astrotech takes its safety responsibility seriously as evidenced by its

concern for safety design features during facility construction and

modification as well as its safety record to date. Astrotech has never had a

major spill or a release of toxic vapors from its facility, so the alerting of

emergency response agencies has never been necessary. On one occasion in

connection with sampling anhydrous hydrazine during the fueling of a

satellite, less than a teaspoon of liquid was spilled. The tank and scrubber

systems totally contained this small spill. Even though no notification was

required, Astrotech reported the incident to local officials.

6.1 Emergency Response Equipment and Personnel

Astrotech officials are extremely knowledgeable in the use of and

requirements for safety equipment. The facility is designed with ready access

to personal protection and fire prevention equipment. For an overview of

emergency equipment available in Building 2, see Exhibit 6-1. Local and

county emergency responders are nearby and, as detailed below, experienced in

the operations and materials handled at the facility.

6.1.1 Personnel Protection and Medical Response

 Astrotech has provided personal protection and safety equipment up

through Level A for use by those who work in the hazardous operations area. 

This equipment is also available, if needed, for emergency response personnel. 

See Section 4.4.3. Astrotech has also supplied PPE to emergency response

personnel from both the city fire department and the county specialized

response team.

 

 

1 Safety Standard Operating Documents, Astrotech Space Operations, L.P., 1988.

 

2

Safety Policy, Astrotech International Corporation, 1988.

1-2
EXHIBIT 6-1 BUILDING 2 EMERGENCY EQUIPMENT

EQUIPMENT LOCATION CAPABILITIES

Scott Air Packs (2) South Control Room 30 Minute SCBA

ISI Ranger Air Packs (2) Hallway by Spill Response

Equipment

30 Minute SCBA with

Airline QD

Splash Coveralls (20) Balance Machine Control

Room

Chemical Resistant Suits

Level A Airline Hazmat

Suits (6)

Balance Machine Control

Room

Encapsulated Fullbody

Chemical Resistant

Level A SCBA Hazmat Suits

(4)

Balance Machine Control

Room

Encapsulated Fullbody

Chemical Resistant

Disposable Nitrile Gloves

(12dz)

Balance Machine Control

Room

Chemical Resistant Wide

Range Application

ISI Full Face Pressure

Demand Airline with 5

Min. Escape

Balance Machine Control

Room

ISI Airline System for

Extended Hazardous

Operations

Emergency Life Support

Apparatus (ELSA) (6)

North & South Bays 5 Minute Emergency Escape

Units

MDA TLD-1 Monitors (4) Placed in Areas

Containing N2H4, MMH, &

N2O4

Continuous Monitoring

System that Alarms

Locally and at Guard

House

Spill Control Station Hallway Contains 2 Tyvek Total

Body Coveralls, 2 Splash

Goggles & Gloves, Sorbent

Pads, 15 Polyzorb Spill

Control Pillows and

Disposable Bags

95 Gallon Poly-Overpack

Drums

Fuel Cart Room Twist Top Salvage Drum

Drum Repair Kit Hallway by Spill Response

Equipment

Repair of Most Common

Container Leaks, Contains

Barrier Tape

Absorbent Booms and Dam

Kit

Fuel Cart Room Spill Control

Emergency First Aid Kit Balance Machine Control

Room

Emergency First Aid

Trauma Kit, O2

Open Top Drums (2) Cart Rooms, 1 Each Contaminated Materials,

Rags, Booms. 20 Gallon

Capacity x 2

Wilden Pump (2) Mechanical Room Pneumatic Diaphragm Pump,

60 GPM Capacity

Drum Skid (1) Scrubber Pad 4 Drums

Water Broom Fuel Cart Room 35 psi Water Outlet to

Wash Down Spill Areas

1-3
Should emergency medical attention be needed, the plant has emergency

medical technicians on site during liquid propellant operations. Injured

individuals requiring additional medical attention would be transported to the

Jess Parrish Hospital in Titusville, where the staff has been trained to deal

with the types of injuries that could occur at the Astrotech facility.

6.1.2 Fire Protection Equipment and Personnel

Astrotech relies upon an automatic sprinkler system (both dry and wet

pipe) activated by heat/smoke detectors located throughout the facility. See

Section 4.4.4. Additional facility fire protection equipment includes

portable fire extinguishers, both halon and dry chemical types. The facility

has fire hydrants placed at strategic locations that would be used by public

responders. 

In the event of a fire in Building 2, an automatic dialer, triggered by

activated smoke/heat detectors, calls the Titusville Fire Department. 

Additional available response personnel include the Brevard County Fire

Department Station # 22, located approximately 21⁄4 miles or 5 minutes away, and

the county hazardous materials specialized response team (SRT) based

approximately 20 miles or 25 to 30 minutes from Astrotech. On Exhibit 6-2,

the locations of fire stations are indicated; the SRT is not on the map. All

emergency access routes are over publicly maintained roads.

The Brevard County SRT is an experienced hazardous materials response

unit that is well trained and equipped. This team has a large hazardous

materials response and communications van that can serve as a command post. 

This team responds to approximately 50 hazardous materials calls per month,

but as noted earlier, has never needed to respond to an incident at Astrotech.

6.1.3 Familiarity of Emergency Responders with Facility

The Astrotech Safety Officer, named by the company as emergency response

coordinator, has made the facility emergency plan available to local planning

officials and has fully cooperated with emergency planning and response

leaders in on-site explanations of the company's hazardous materials

operations. Members of the county SRT and county emergency medical

technicians have been invited to and have attended satellite fueling

operations. Additionally, the Titusville Fire Department has been invited to

Astrotech for familiarization with and training in the fire control system at

the plant. Various types of PPE have been donated to the county SRT by

Astrotech.

Coordination between Astrotech and emergency responders began even

before the facility was built. Local fire, building and planning staff, and

NASA officials were consulted during design and construction phases of the

facility and their recommendations were solicited, many of which were

incorporated into the facility.

1-4
EXHIBIT 6-2 LOCATIONS OF EMERGENCY RESPONDERS

1-5
The Brevard County emergency management agency has a staff person, who

is fully aware of hazards at the facility, assigned to deal with distributing

public information. Public information regarding the Astrotech operation is

generally disseminated from the Astrotech Maryland office. However, the

general manager at the facility is assigned to work directly with Brevard

County emergency management to furnish emergency information should there be a

release.

6.2 Emergency Response Communications

Astrotech procedures require that when propellants are on-site, a senior

spacecraft propulsion engineer must be available in the local area and on call

twenty-four hours each day.

The key person in both emergency planning and response for Astrotech is

the Safety Officer. He continuously observes all hazardous operations through

the explosion-proof window in the control room and ensures compliance with

approved procedures. He is also involved in the transportation of fueled

satellites from Astrotech to KSC. When he is away from the facility, he is

available through pager and cellular telephone.

Astrotech considers a spill of hydrazines or nitrogen tetroxide in

excess of one gallon to be an uncontrolled release.3 Should such a spill

occur during working hours, the procedures states that a call for outside

assistance be made by the Safety Officer using the emergency telephone

number 911.

Should conditions preclude this action by the Safety Officer, procedures

are in place for any workman involved to contact the front gate guard who

would then report the accident to public authorities, also by dialing 911. 

Under such circumstances, the following information concerning the spill would

be furnished to the front gate guard:4

1. Exact location

2. Estimated quantity

3. Time and duration

4. Media or medium into which the release

occurred

5. Direction of vapor movement if release is

outside of the Building 25

6. Number of personnel involved.

Also, the guard house would be alerted of problems by the alarm system as

described in Section 4.4.4.

Astrotech's emergency response plan has a roster for contacting and

calling to duty critical response personnel when they are off duty. The

roster lists the names and pager numbers of the Safety Officer and the deputy

general manager and the telephone numbers of three response team members. All

Astrotech employees have in their possession a card listing telephone numbers

of these and additional plant personnel considered critical in emergencies. 

 

 

3 Spills of that amount of fuel could bring the vapor concentration level in the bay to the

lower explosive limit for hydrazine.

 

4

Emergency Spill Response Plan, Astrotech Space Operations, L.P., 1988.

 

5

 A wind sock is located near the hazardous materials working and storage area to identify wind

direction should evacuation become necessary.

1-6
Should an incident occur at night or when Astrotech is not in operation, the

front gate guard, after calling 911, would contact the Safety Officer, the

vice president and the general manager.

Procedures for inter-communication and coordination of company response

operations are in place. Astrotech has a close-knit staff of eleven

individuals, many with long tenure. Contractors servicing satellites bring

with them only four to eight persons involved in handling propellants, so the

total number of individuals in Building 2 during propellant operations is

small. Astrotech has a plant-wide telephone system and has posted the number

of the front gate guard by each telephone. There is an intercom system in the

spacecraft processing areas, including communications capability to and from

personnel working in full protective clothing. Eight of Astrotech's eleven

employees have one-watt portable radios with plant wide coverage. One radio

is maintained at the desk of the administrative assistant in the

administration building.

6.3 Emergency Response Planning

6.3.1 Brevard County Hazards Analysis Study

The Brevard County Emergency Management Agency has performed hazards

analyses (including risk and vulnerability analyses) for the Astrotech

facility as detailed in the EPA guidance document for emergency planning6

under SARA Title III. The results showed that there was "very slight"

possibility of release of anhydrous hydrazine or monomethyl hydrazine from

this facility; that state-of-the-art containment, scrubber and neutralization

systems are in-place to deal with any problems; that the training and safety

program at the facility is "excellent"; and that the emergency response

program is "comprehensive."

 The results of the analyses of releases for these chemicals, including

maps of the identified EPA vulnerable zones, are presented in Appendix A. The

analysis is based on an release scenario where the maximum quantity of fuel

allowed on-site by the Florida DER air permit, is instantaneously released

outside the building. County emergency officials stated that they view this

scenario to be unrealistic given Astrotech's transport and operating

procedures, and believe that a more realistic, but still unlikely accident

scenario would be a release initiated within the building with exposure

confined to the facility and its immediate vicinity.

6.3.2 Building and Area Evacuation

In the event that a spill in excess of one gallon occurs in Building 2,

all personnel would evacuate the building through designated evacuation

routes. See Exhibit 6-3 for these routes. Portable emergency life support

apparatus, if needed for emergency egress, is readily available in hazardous

operations areas. The affected area would be secured, outside help would be

called as detailed above and a command post would be established at a

pre-determined point based on location of the exposed area and the wind

direction. Before evacuation, control room personnel would turn off all power

to the building including the scrubber, and therefore all vapors would be

contained within the building, unless there was a fire or explosion.

Astrotech continuously monitors vapor concentrations in the interior of

 

 

6

Technical Guidance for Hazards Analysis, Emergency Planning for Extremely Hazardous

Substances, U.S. Environmental Protection Agency/Federal Emergency Management Agency/U.S. Department

of Transportation, December 1987.

1-7
the building when liquid propellants are present. However, they have no fixed

monitoring around the perimeter of their property. Should an internal release

occur as described above, portable monitoring equipment would be used to

measure ambient vapor concentrations. From information thus obtained,

Astrotech officials would evaluate any toxic vapor levels and determine safe

areas.

Brevard County has provisions for evacuation of areas surrounding the

facility, if necessary. Should there be a release at Astrotech potentially

affecting an off-site population, alerting and evacuation would be effected by

public safety agencies through door-to-door contact, supported by emergency

broadcasts using pre-determined radio stations. There is no public alerting

device at Astrotech. Neither does the city of Titusville have a public

alerting system maintained in the area surrounding the Astrotech facility.

No formal exercises of the emergency plan involving local emergency

response agencies have been conducted, but the plan has been distributed and

reviewed with the local fire department, the county SRT and emergency agency

heads. The absence of a simulation exercise has been due to logistical

problems in scheduling such an exercise with local agencies. Both local

emergency management agencies and Astrotech stated that they view conducting

the exercise as a high priority.

6.4 Title III Reporting

 In 1986, SARA Title III, also known as the Emergency Planning and

Community Right to Know Act (EPCRA) of 1986, was enacted so that local

government could become aware of inventories of potentially hazardous

chemicals and could plan with the facility to protect the public should a

release occur. Under Section 302 (a) of SARA Title III, chemicals that are

acute toxics are listed as Extremely Hazardous Substances (EHSs). The list

contains three hundred and sixty substances, including commonly used chemicals

1-8
EXHIBIT 6-3 EVACUATION PLAN FOR BUILDING 2

1-9
such as ammonia and chlorine. For each listed chemical, a planning threshold

is identified, and any facility having an amount on site at or above that

level must report its presence to the state, LEPC and fire department(s)

serving the facility. Additionally, SARA Title III identifies reportable

quantities for each EHS. If a release at or above the reportable quantity

extends beyond the facility boundary, the owner or operator must report the

release to local government officials and to the State Emergency Response

Committee (SERC).

Monomethyl hydrazine (Chemical Abstracts Number [CAS #] 60-34-4) and

anhydrous hydrazine (CAS# 302-01-2) are listed as Extremely Hazardous

Substances (EHS). Quantities of anhydrous hydrazine or monomethyl hydrazine

exceeding the planning thresholds of 1,000 pounds and 500 pounds,

respectively, are periodically present at Astrotech (i.e., when satellites are

being fueled). Therefore, Astrotech is subject to SARA Title III reporting

requirements. The reportable quantity for releases is ten pounds for

monomethyl hydrazine and one pound for anhydrous hydrazine.

Nitrogen tetroxide, another chemical that is used during satellite

fueling at Astrotech, is not on the Section 302 (a) Title III EHS list;

however, it is on a list of chemicals, as are anhydrous hydrazine and

monomethyl hydrazine, that is regulated by CERCLA. Any facility releasing

this chemical into the environment in quantities of ten pounds or more must

immediately report the release to the NRC. See Appendix B for a summary of

releases of hydrazines and nitrogen oxides reported to the NRC over an eight

year period.

Under Section 304 (b) of Title III, facilities having releases of

reportable quantities of chemicals listed as EHSs must furnish the following

information, to the extent it is known, to the SERC and to a local emergency

answering point designated by the LEPC:

• Chemical name or identity

• Presence of the chemical on list of "Extremely Hazardous

Substances"

• Quantity released

• Time and duration of release

• Released into air, land, surface water, ground water

• Anticipated acute or chronic health risks

• Medical attention requirements

• Precautions

• Evacuation information

• Name and telephone number of person to be contacted for further

information

Astrotech's plan and procedures do not specifically indicate that these items

of information are to be furnished when reporting a release.

Inquiries made by the safety evaluation team of the Florida SERC, the

LEPC covering Titusville and local emergency planning and response officials,

revealed Astrotech management has filed all required reports and is in

compliance.

1-10
7.0 HAZARDS ANALYSES AND RISK ASSESSMENT

The overall goal of this assessment is to identify risks to the public

that may result from accidents that could occur at the Astrotech facility. 

The risk assessment was performed by reviewing the facility design, operations

and procedures and then defining possible accident scenarios that could

produce a hazard to the public.

In Section 7.1, evaluations performed previously by other experts are

discussed. In Section 7.2, the flammable and explosive properties of liquid

and solid propellants are reviewed and scenarios that could cause an explosion

capable of breaching Building 2 are determined.

In Section 7.3, the accident scenarios capable of producing a fire and

explosion and possible venting of toxic vapors are described. These scenarios

include: 

• Explosion resulting from liquid propellant operations

• Explosion resulting from a dropped payload

• Explosion of a high pressure tank

• Explosion resulting from spin balance accidents

• Ignition of an SRM

 For each accident scenario described in Section 7.3 the probability of

occurrence has been calculated in Section 7.4. A detailed fault tree has been

constructed that indicates contributing events that must occur for the

accident scenario to result, the probability of each contributing event has

been estimated and the overall accident scenario probability calculated. For

each potentially hazardous condition, the facility design features and the

operating procedures that minimize the hazard have been considered as part of

the basis for the assessment.

The severity of the consequences for each accident scenario would depend

primarily on the quantity of fuel, oxidizer and solid propellant involved,

leading to three worst case release conditions:

• Explosion of a payload/fueling cart containing the

maximum quantity of fuel permitted on-site (2,500

pounds)

• Explosion of a payload/fueling cart involving the

maximum quantity of fuel (2,500 pounds) and the

maximum quantity of oxidizer (5,000 pounds) permitted

on-site

• Explosion of a payload/fueling cart with the maximum

quantity of fuel and the maximum quantity of oxidizer

permitted on-site and the amount of solid rocket

propellant used in siting analyses (24,600 pounds).

For these worst case release conditions, the toxic gas concentrations at

ground level were calculated. The calculated concentrations were then

compared to a vapor concentration called the level of concern (LOC) used by

the EPA in hazards analyses for community emergency planning. 

Any risk to the public health was determined by evaluating the results

of the accident scenarios leading to the worst case release conditions. These

were then compared qualitatively with other similar public risks and some

observations were made.

1-1
7.1 Site Evaluations and Modeling Studies

Both before initial construction and before the building modifications,

Astrotech commissioned studies to evaluate whether the proposed facility and

modifications complied with applicable safety criteria and regulations. The

studies, performed by independent consultants, included evaluation of

compliance of the facility with DoD quantity distance criteria and

quantification of the potential air emissions to support the renewal of the

Florida DER air permit. These prior studies have concluded that the Astrotech

facility is in compliance with all applicable standards and represents a

minimal safety hazard to the surrounding community.

7.1.1 Site Distance Criteria Studies

The siting and construction of Building 2 on Astrotech's property was

done in accordance with DoD siting criteria1 specifically to control and limit

the effects of any explosions to within the facility boundaries. A special

report was commissioned by Astrotech as part of the design engineering prior

to construction of the facility to identify the siting criteria and validate

the design, given the proposed operations, and to ensure that these

requirements would be met.2 The evaluations used applicable siting criteria

from DoD Directive 5154.4S (as updated by DoD Directive 6055.9 dated July

1984, DoD Ammunition and Explosives Safety Standards); fragment size and

velocity analyses based on analyses previously performed on similar satellites

by ESMC (TM5-1300, Chapter 8 - equation to determine wall resistance to

fragment penetration); secondary fragment analyses based on Chapter 2 Figure

2-33 of the CPIA Hazards of Chemical Rockets and Propellants, Vol I, Explosive

Effects and Damage; and sympathetic detonation analysis using the results of

the prior fragmentation analyses.

The conclusions of the commissioned report indicated that the proposed

siting of the buildings on the property met DoD explosives quantity distance

criteria, and that Buildings 2 and 3 with their respective siting and design

should not present a hazard to the general public outside of the facility

boundary "...greater than that normally presented from any DoD hazardous

facility site containing similar hazardous liquid and solid propellants."

An additional safety analysis was conducted when the new high bay

hazardous staging airlock was proposed for addition to Building 2.3 The

results showed that the 45 foot high reinforced masonry walls would stop the

primary fragments of an explosion involving the liquid and solid propellants

installed in an INTELSAT-sized spacecraft (approximately 6,400 pounds of

liquids and 16,000 pounds of Class 1.3 solid propellant4). The secondary

building fragments would not be thrown beyond 500 feet. The analysis also

concluded that adequate distance was available to the boundaries and inhabited

non-ordnance buildings to meet the requisite quantity distance requirements

specified in the DoD Directive. An addendum to this study was performed

 

 

1 Department of the Air Force, AFR 127-100, CHANGE 1, 24 December 1984, Chapter 5 - Principles

and Application of Explosives Quantity-Distance Criteria and Related Standards.

 

2 Astrotech Satellite Assembly and Checkout Facility Explosives Quantity Distance Siting, BRPH

Report No. 1-83, Louis J. Ullian, Explosives Ordnance Consultant, January 9, 1983.

 

3 Hazard and Quantity Distance Siting Analysis of Astrotech Hazardous Staging Airlock Addition

to Building 2, ECI Report No. 1-88, Explosives Consultants Inc., February 9, 1988.

 

4

 Class 1.3 class propellant is defined in AFR 127-100 as an item which burns vigorously, and

the fires are difficult to extinguish. Explosions are usually pressure ruptures of containers and

do not produce propagating shock waves or damaging blast overpressure beyond a safe distance between

two explosives storage facilities.

1-2
shortly thereafter to analyze the potential for sympathetic detonation in the

event of dual payload processing in Building 2 (specifically to address the

SKYNET 4 and JCSAT satellites that required processing for a Commercial Titan

III launch).5 This analysis showed no risk of sympathetic detonation as long

as the payloads are separated from one another by at least one reinforced wall

(in Building 2, the separation is made by two reinforced walls).

These hazards analyses have all been concerned mainly with the effects

of explosion (e.g., blast overpressure and flying debris) on surrounding

buildings and public areas, but did not address or analyze toxic vapor

hazards. In fact, one of the recommendations of the Explosives Consultants,

Inc. (ECI) Report 1-886 stated "...An analysis should be made of the potential

toxic hazards in the event of an explosion in the bay which caused sufficient

damage to allow vapor release to the outside atmosphere." Therefore, while

these analyses do adequately assess the siting and design criteria for

handling explosive materials on the site, additional effort is needed to

assess the potential for exposing the public to toxic gases given an accident

involving fire and explosion.

7.1.2 Study to Support Florida DER Air Permit

Astrotech also used an environmental engineering consulting firm to

estimate emission rates from Building 2 during normal propellant loading

operations. The study supported renewal of the Florida DER air permit that

Astrotech holds to operate their scrubber system.7 A copy of the most recent

version of the air permit is attached as Appendix D. The emission rate

estimates were made by reviewing processes at Astrotech and comparing them to

operations at other facilities handling hydrazines (specifically the Olin

anhydrous hydrazine manufacturing facility in Lake Charles, Louisiana). The

scrubber efficiency (90%) as provided by the vendor (Tri-Mer Corporation) was

also a component of the analysis. The resulting fugitive emission estimates

were then input to the Industrial Source Complex Short-Term dispersion model

to project the maximum 8-hour ground level ambient concentrations for the

materials of concern in the permit. The modeling results showed that the

maximum ambient concentrations for all pollutants will be below the DER's

Acceptable Ambient Concentrations. The ISCST model has been approved by both

the Florida DER and the EPA for use in determining compliance with Ambient Air

Quality Standards.8

Although this study confirmed that there are no risks to public health

and safety during normal operations, it did not examine risks during an

accident.

7.2 Potential Fire and Explosion Hazards

In developing accident scenarios that could result in exposure to the

public, the safety evaluation team first determined which propellants or

combinations of propellants would be capable of causing an accident that could

breach Building 2.

 

 

5 Sympathetic Detonation Analysis for Dual Payload Processing in Building #2, Addendum 1 to

ECI Report No. 1-88, Explosives Consultants Inc., March 26, 1988.

 

6

Hazard and Quantity Distance Siting Analysis of Astrotech Hazardous Staging Airlock Addition

to Building #2, ECI Report 1-88, Explosives Consultants Inc., February 9, 1988.

 

7 Satellite Fueling Operation Response to FDER Completeness Summary, Hunter/ESE, No. 3901-

010100-0400-3160, July 1989.

 

8

 Ibid.

1-3
7.2.1 Fire Hazards

The Astrotech facility is equipped with a fire suppression system that

would quickly extinguish most fires (except those involving SRMs or large

quantities of liquid propellants) that could occur. Moreover, the safety

procedures required at Astrotech are designed to avoid situations that could

lead to a fire. However, because an accident in which the public could be

exposed would likely begin with a fire, a brief description of the flammable

characteristics of the hazardous materials handled at the facility is provided

below.

As discussed in Section 4.3.1, the hydrazines are volatile, flammable

chemicals which may present fire and explosion hazards if present in

sufficient concentrations under certain conditions. Nitrogen tetroxide (see

Section 4.3.2) is not flammable but will react with combustible materials. 

Since Astrotech limits the presence of combustible materials in operational

areas, any fire or explosive hazard associated with nitrogen tetroxide would

most likely result from unintentional contact with the hydrazine fuel itself,

as would be the case in a dual propellant spill.

The most severe fire hazard at the Astrotech facility would be posed by

an accidentally ignited SRM, which although difficult to ignite once ignited,

could not be extinguished by the sprinkler system. It would continue to burn

until all the solid propellant was consumed. The burning of an SRM generates

intense heat and certain ignition modes may lead to the potential rupture of

the motor case. If its case ruptures, other fuels in close proximity would

then likely become involved in the fire.

7.2.2 Explosion Hazards

Even if a fire occurred, no public exposure would result if Building 2

remained intact and sealed. Public exposure could only result if, as the

result of a fire, an explosion occurred that breached the walls and/or the

ceiling of the building, allowing vapors to be released.

Solid Rocket Motors

The SRMs processed at Astrotech contain solid propellant that has been

classified by DoD as non-detonable Class 1.3 propellant9. Therefore, severe

explosions of these propellants are not feasible. If an SRM was ignited while

the motor was mounted on fixtures that block the motor exhaust, an internal

pressure-caused explosion could occur. This type of pressure rupture would

produce low overpressures that might result in some limited facility venting. 

Fragments generated by such an event would be retained inside the

facility10,11,12.

 

 

9

Hazards of Chemical Rockets and Propellants, Vol. II, Solid Propellants and Ingredients, CPIA

Publication 394, September 1984, Appendix D.

 

10 Astrotech Satellite Assembly and Checkout Facility Explosives Quantity Distance Siting, BRPH

Report No. 1-83, Louis J. Ullian, Explosives Ordnance Consultant, January 9, 1983.7

 

11 Hazard and Quantity Distance Siting Analysis of Astrotech Hazardous Staging Airlock Addition

to Building 2, ECI Report No. 1-88, Explosives Consultants Inc., February 9, 1988.

 

12 Sympathetic Detonation Analysis for Dual Payload Processing in Building 2, Addendum 1 to ECI

Report No. 1088, Explosives Consultants Inc., March 26, 1988.

1-4
Liquid Propellants13

Most combustion type reactions are classified as deflagrations and would

represent only minimal explosion hazards. However, if large quantities of

liquid propellants were involved or the reaction products were confined in

some way the explosion hazard increases.

Therefore, several conditions would generally be necessary to create an

explosion severe enough to destroy the containment of Building 2:

• Ignition of confined hydrazine or hydrazine-air vapors, which 

leads to a rapid increase in vapor pressure,

• Direct contact of significant amounts of fuel and

oxidizer (without confinement).

The explosions as described above could produce peak blast wave

overpressures sufficient to cause upper side wall and roof failures in

Building 2. Reaction zone overpressures of 125-150 psi could result from

hydrazine or hydrazine-air mixtures and range up to 430 psi for fuel and

oxidizer reactions. During such a fire and explosion event, some of the fuel

and oxidizer would be consumed and the rest would be released. See

Section 7.5.

In summary, spills and fires within the Astrotech facility are not

likely to produce any public exposure, unless a severe explosion occurs and

the building is breached. The events that could potentially produce public

exposure require a fuel/air or fuel/oxidizer explosion. Therefore, the safety

evaluation team determined combinations of events that could lead to an

explosion in order to construct credible accident scenarios. 

7.3 Accident Scenarios

A qualitative description of credible accident scenarios is provided in

this section. The accidents described were determined to have potential to

create a condition that could result in the release of liquid propellant to

the atmosphere. A more quantitative discussion of each of these scenarios,

including probabilities of specific events and conditions that would need to

occur and calculations of the overall accident probability, follows in

Section 7.4. The consequences of these accidents, including vapor

concentrations and exposure durations, are detailed in Section 7.5.

Major events involving only the liquid propellants would most likely

start as small spills which despite several means to terminate the flow, could

not for some reason be stopped (Section 7.3.1). Major events which involve

both liquid and solid propellants would likely start with one of several

scenarios: dropping of a fueled spacecraft (Section 7.3.2), rupture of a high

pressure gas tank (Section 7.3.3), explosion resulting from a spin balance

accident (Section 7.3.4), or ignition of an SRM (Section 7.3.5).

7.3.1 Explosion Resulting from Liquid Propellant Operations

Spills or leaks of liquid propellants are most likely to occur during

sampling and transfer operations. All propellants are sampled and tested for

purity prior to loading. The quantity of fluids taken for each of these

samples is approximately one-quarter of a gallon and the transfer pressure on

 

 

13 Fire, Explosion, Compatibility and Safety Hazards of Hydrazine, M.D. Pedley, et. al., RDWSTF-0002, NASA, Johnson Space Center, White Sands Test Facility, February 20, 1990.

1-5
the fluid in the tanks and lines is less than 10 psi. Under these conditions

it is unlikely that large quantities could leak or be spilled directly. The

most likely cause of an uncontrolled leak would be from mechanical puncturing

of lines or tanks by dropped tools or other equipment.

The hydrazine fuels are extremely flammable liquids and a large spill or

leak would likely result in a fire. The most likely sources of ignition are:

• Electrical equipment that is not powered down before

vapor concentrations exceed the flammability limits at

the electrical equipment location; 

• Contamination in the drainage system that reacts with

fuel and creates autoignition temperatures; or,

• Electrostatic discharge caused by uncontrolled fluid

flow.

The heat released by the burning of these fuels in the bay may overheat

fluids/vapors remaining in payload tanks or fueling drums, thereby, causing

autoignition in the vessels. However, heating rate estimates are

inconclusive. The sprinkler system might activate before the tanks were hot

enough to autoignite and detonate.

Alternately, the NASA White Sands Test Facility has reported14 that

small leaks from transfer lines, if ignited, have propagated to larger events

through a series of small detonations in the lines until eventually the tank

exploded. Shrapnel from the small line explosions may be sufficient to breach

fuel and oxidizer tanks in a bipropellant payload and result in an explosion,

that will likely blow out the roof and/or walls, breaching the building. 

Since anhydrous hydrazine and MMH are highly combustible in air, very little

unreacted gas is likely to escape to the atmosphere, even if the building

undergoes major structural damage. Rather, any escaping gases will consist

largely of gaseous nitrogen and water vapor.15

Nitrogen tetroxide does not undergo decomposition reactions that produce

rapid heat release in the atmosphere. Also, combustion type reactions are

possible only in the unlikely event that the released oxidizer comes into

contact with a fuel source. Since combustible materials such as paper, cloth,

and wood are not allowed in the processing area during propellant transfer,

any spilled or leaked oxidizer will enter the trench-containment system and be

diverted to a holding tank for dilution and neutralization. Since nitrogen

tetroxide dissociates predominantly into nitrogen dioxide on evaporation, the

major result of a large oxidizer spill or leak will be high concentrations of

nitrogen dioxide in the bay involved.

7.3.2 Explosion Resulting from a Dropped Payload

All payloads prepared at Astrotech must be lifted at least once for

loading onto the transporter for movement to the launch pad. However,

payloads are typically lifted several times after fueling (e.g., between high

bays, in preparation for spin balancing). If a payload was dropped during

lifting operations, it would likely be seriously damaged and liquid

propellants would likely be released. Because large quantities of liquid

propellant would be involved, an explosion resulting from such a release would

 

 

14 Personal communication with F. Benz, Project Director at the NASA White Sands Test Facility.

 

15 Ibid.

1-6
generally be worse than one which could occur during fueling. If a payload

was dropped, fire and explosion would be likely; major facility damage, and

possible release of unburned propellants could occur. Although payloads have

been damaged during lifting and crane operations, none has ever been damaged

to the extent necessary to cause this type of accident.

7.3.3 Explosion of a High Pressure Tank

High pressure gases are used on payloads as a source of pressure to pump

liquid propellants. The pressure tanks are usually filled with gaseous

nitrogen or helium and pressurized as high as 6,000 psi using high pressure

gas bottles. This operation is normally performed after spacecraft fueling

operations have been completed, and the spacecraft has been mated to the SRM;

and just before encapsulation and transport. Most payloads contain high

pressure tanks that are designed to leak rather than burst. However, in the

unlikely event that a high pressure tank should burst as the result of

overpressurization or material flaw, its fragments could penetrate nearby

propellant tanks. Although there have been several instances of failures in

high pressure tanks or lines, no failure has resulted in the severe accident

described in this section. The damage caused by such an event, however, could

result in an explosion, loss of building containment and possible release and

dispersion of toxic vapors.

7.3.4 Explosion Resulting from a Spin Balance Accident

A spin balance table is used to measure precisely the center of mass and

moments of inertia of the major elements of a payload. Normally the

spacecraft is attached to the table and spun at a slow rate to make these

measurements before propellants are loaded. Some customers request a

subsequent spin balance after propellants are loaded. At another time in the

processing flow, the solid rocket motor(s) is (are) attached to the table

mated with their upper and/or lower adaptor (mating) sections, as required by

the specific design. Attachments are pretested and attach forces precisely

set prior to each operation.

Fire could result from hydraulic oil leaks under the table if an

ignition source were present. The potential for oil leaks is minimized by

overall inspection prior to each use, frequent detailed scheduled inspection

and maintenance, and on line redundant leak detection measurements. The drive

motor is located in a separate pit, not directly under the spin table, and is

totally encased and purged by two-way air flow.

The spin rates are low, so stress loads do not approach design limits

and no self damage is ever to be expected. The bearing function is provided

by a fully hydraulic system backed up by roller bearings, so bearing seizure

probability is minimized. Dangerous out-of-balance situations are detected

automatically. Visual and audio signals are activated and shutdown is

automatically activated at pre-set limits.

7.3.5 Ignition of a Solid Rocket Motor

An SRM can be ignited accidentally by dropping it from a height of

several feet onto a hard sharp or pointed surface, applying electrical energy

directly to the motor's initiators, electrostatic discharges16, heating the

motor to autoignition temperatures, or penetrating it with high energy

fragments from nearby explosions. The solid propellant motors processed at

 

 

16 Electrostatic Ignition of X-248 Rocket Motors, Technical Report CAL No. DM-1934-EZ-1a,

Cornell Aeronautical Lab, March 1965.

1-7
Astrotech are classified as fire hazards, but they cannot be detonated even

when exposed to fires or explosions of the type possibly resulting from a

payload processing accident.

Ignition of a motor by external heating or penetration of its outer case

by a destruct charge will normally produce external low pressure burning of

the solid propellant contained in the motor. Destruct charges of the type

that could penetrate Building 2 walls if accidentally initiated are not

permitted at Astrotech. Destruct charge initiators are protected by safe-arm

devices. The solid propellant used in these motors contains both fuel and

oxidizer and once ignited cannot normally be extinguished until all solid

propellant is consumed. If initiated while attached to the payload, the heat

released is likely to cause failure of the liquid propellant tanks, leading to

involvement of liquid propellants in a fire and possible explosion.

Internal ignition of an SRM can occur from electrostatic discharge or

stray current introduced into the ignition circuits and will cause internal

pressurization of the motor. At Government launch sites, several SRMs that

had sensitive initiators not protected by safe-arm devices have been ignited

by electrostatic discharge and lightning induced current. However, all SRMs

processed at Astrotech are protected by safe-arm units and use insensitive

initiators which meet ESMC and NASA standards, and significantly reduce the

possibility of ignition from electrical discharge. Ignition of a motor on a

stand with the payload attached may result in the restrained propulsion of the

SRM and fueled payload within the building and explosion on impact. 

Overpressurization and failure of the motor case due to restricted flow from

the nozzle can also occur in this type of event. Fragments generated by this

type of explosion would not penetrate the walls; however, severe damage could

occur to a payload.

Unrestrained motors ignited during preparations or during lifting

operations can become propulsive and accelerate into the walls or ceiling. 

Because of the limited distance to a wall or the ceiling, impact velocities

will be low and escape from the facility is unlikely. Motor case failure and

fragmentation could occur due to impact of the motor with facility equipment

or walls. Any damage would most likely be confined to the bay where the

ignition took place.

7.4 Estimation of Accident Probabilities

The likelihood of an accident that can produce a public exposure for

each of the accident scenarios described in Section 7.3 will be evaluated in

this section. The methodology used in developing these accident probabilities

includes evaluation of the systems involved, past accident histories for

similar operations and systems, the measures taken to minimize the likelihood

of failure or procedural error, and if a failure occurs, the likelihood that

it could worsen and lead to a severe event. 

The method used to estimate the probability of the occurrence of an

event is based on use of both qualitative and quantitative data as shown in

Exhibit 7-1. This method was developed by Sverdrup17 and allows a reasonable

correlation to be made between the MIL-STD-882B definitions and a probability

range (See Appendix E). Exhibit 7-1 is a modification of the Sverdrup

methodology that is more appropriate for estimating and combining event

probabilities shown in the fault trees developed in this analysis. The

quantitative probability ranges represent the number of anticipated event

 

 

17 Combinational Failure Probability Analysis Using MIL-STD-882B, P.L. Clemens, Sverdrup

Training Notes 6000-8i, 3rd Edition, December 1984.

1-8
occurrences in a given number of operations. For example, 8 x 10-2 means 8

occurrences in 100 operations and 8 x 10-3 means 8 occurrences in 1,000

operations, so a descriptive word "probable" means the event is likely to

occur between 8 times in 100 and 8 times in 1,000 operations.

Fault tree analysis is a method for estimating the frequency of a

hazardous accident (top event on the tree) from a logic model of the failure

mechanisms of a system. A fault tree for each accident scenario identifies a

series of contributing events that must occur and their estimated probability

of occurrence. A fault tree is arranged to represent the logical combinations

of various system states (e.g., contributing events) which can lead to a

particular event at the top of the tree. In fault trees, alternative

contributing events are presented that can independently lead to the same 

1-9
EXHIBIT 7-1 DEFINITIONS AND DESCRIPTIONS OF PROBABILITY RANGES

PROBABILITY RANGE | DESCRIPTIVE DEFINITIONS

LIMITS |

|

 Lower Upper | Descriptive Definition

 Limit Limit | Word

|

|

 8 X 10-2 8 X 10-1 | Frequent Likely to occur frequently

|

 8 X 10-3 8 X 10-2 | Probable Will occur several times in life of

item

|

 8 X 10-4 8 X 10-3 | Occasional Likely to occur sometime in life of

item

|

 8 X 10-5 8 X 10-4 | Remote Unlikely but possible to occur in

life

| of item

|

 8 X 10-6 8 X 10-5 | Improbable So unlikely it can be assumed

| occurrence may not be experienced

accident outcome; these events are connected by OR gates and their probability

is summed. If two are more contributing events are combined by an AND gate,

then each event must occur to lead to the accident; their probabilities are

multiplied.

 On each fault tree, formulas are given for the multiplication and

addition of event probabilities that leads to the overall accident

probability. Each fault tree is supported by an exhibit that identifies each

contributing event in the fault tree, the assigned probability value, the

descriptive qualitative probability and the justifications for the probability

assigned. Assigned probabilities estimated are based on accident histories,

past experiences at the Government ranges in processing thousands of payloads

and launch vehicles, and subjective judgment on the applicability of such past

experience to Astrotech's operations.

7.4.1 Explosion Resulting From Liquid Propellant Operations

The contributing events leading up to an accident involving a major

spill, fire, and explosion of liquid propellants are depicted in Exhibit 7-2. 

This fault tree identifies the events that must occur and their estimated

probability of occurrence, and illustrates the sequence of events needed to

cause a fire that results in a fuel tank explosion.

Fault trees are evaluated from the bottom up. As can be seen in the

exhibit, events 1, 2, and 3 are alternative contributing events that can

initiate a major spill. The sum of the probabilities of these three events is

the probability of event 4, a major spill. Events 4, 5 and 7 all occur before

a spill can lead to an explosion. Thus, the probabilities of events 4, 5 and

7 are multiplied to determine the probability of top event 8, an explosion.

Exhibit 7-3 identifies each contributing event in the liquid propellant

1-10
spill fault tree, the assigned probability, and the justification for the

probability assigned. A fuel spill that resulted in a fire and explosion

involving a payload has never occurred in the many thousands of payload

operations conducted at the various federal ranges, so the overall probability

of improbable is supported by actual operations experience.

7.4.2 Explosion Resulting From A Dropped Payload

The majority of payloads processed at Astrotech require one to two

lifting operations. However, if a fueled payload is spin balanced, the

present sequence of operations may require as many as four lifting operations. 

Dropping a fueled payload from any significant height is likely to damage the

payload sufficiently to cause liquid propellant leaks. The events required to

create an explosion are depicted in the fault tree in Exhibit 7-4.

The fault tree indicates that any of the contributing events numbered 1

through 5 can result in a dropped payload. For a drop to cause major damage

to the payload, either the drop must be from a height of at least 5-6 feet or

the entire payload must tip over. Most payload lifts do not exceed 1-2 feet

and a drop from this height is not likely to cause major damage or a tip over. 

Conditional events 7 and 8 are also necessary for a fire and explosion that

breaches the building.

The conditional event probabilities and justifications are shown in

Exhibit 7-5. Although there have been payloads damaged during lifting

operations on rare occasions, none have been damaged to the extent necessary

to cause the accident described, supporting an overall accident probability of

improbable. 

7.4.3 Explosion of A High Pressure Tank

The failure of high pressure tanks used on payloads to pump propellants

can present a serious accident threat. The fault tree describing the

necessary events for this accident is shown in Exhibit 7-6.

There have been rare failures of high pressure components on launch

vehicles during pressurization. To date, no such failures have occurred

during payload pressurization. The probability of damage to propellant tanks

is lessened because many of the current payloads isolate the high pressure gas

tank from the propellant tanks. These facts support an accident probability

of less than improbable. Exhibit 7-7 shows the event probabilities for the

explosion of a high pressure tank leading to explosion of the propellant

tanks.

7.4.4 Explosion Resulting from A Spin Balance Accident

Exhibit 7-8 shows the fault tree events necessary to have a major

explosion accident during spin balance operations. Payloads flown on the

Delta launch vehicle are spin balanced before propellant loading and a few are

re-balanced after loading. The SRMs are spin balanced separately and thus

would not be involved in a payload accident or explosion. Some payloads are

fueled prior to balancing and some are flown without spin balancing (e.g.,

payloads flown on the Titan and Atlas Centaur). 

1-11
EXHIBIT 7-2 FAULT TREE FOR EXPLOSION RESULTING FROM 

LIQUID PROPELLANT OPERATIONS

1-12
EXHIBIT 7-3 EVENT PROBABILITIES FOR EXPLOSION RESULTING FROM 

LIQUID PROPELLANT OPERATIONS

CONTRIBUTING PROBABILITY JUSTIFICATION

 EVENT DESCRIPTION/VALUE

1. Fill and drain Improbable/10-5 Mechanical valve for one

time valve failure use, seals not

likely to fail

Failure for valve to seal

is detectable by operator

and therefore a

preventable condition

Lines can be capped and

therefore a leak can be

sealed by the operator by

cap installation if a leak

occurs

No failures of fill and

drain valves have resulted

in a serious spill

2. Line/tank failure Improbable/10-5 Requires failure

of two 

 due to overpressur- pressure

regulators

 ization of payload or 

 payload equipment Operator failure to detect

first regulator failure

3. Tank/line damaged by Occasional/10-3 Tools and

equipment tethered

 equipment or tools after

 loading Tanks and lines not

generally exposed to these

hazards

5. Ignition of fuel Probable/10-2 No auto-ignition

temperatures available

Facility powered down in

large spill conditions

Electrostatic discharges

possible

7. Sprinklers fail to Frequent/10-1 Heating could be

localized activate or control and

ins

uff

ici

ent

to

act

1-13
The probability of a major accident during this operation is improbable. 

There has never been major damage to a payload or SRM during the spin

balancing operation. There was one accidental ignition of an SRM after

balancing. The SRM had sensitive initiators unprotected by a Safe/Arm device

from electrostatic energy, which built up and ignited the motor. Current

requirements, detailed in Section 7.3.5, essentially eliminate this type of

accident. See Exhibit 7-9 for the event probabilities for a spin balance

accident.

7.4.5 Ignition of a Solid Rocket Motor 

The accidental ignition of an SRM is depicted in the fault tree in

Exhibit 7-10. Three typical events are characterized: SRM fragmentation from

ignition and overpressurization, a propulsive SRM, and a burning SRM that

generates sufficient heat to autoignite the propellant tanks.

With the current design requirements for ignition and destruct systems,

accidental ignition of an SRM is a very improbable event. See Section 7.3.5

for additional discussion. Initiators for these systems are isolated from

their explosive trains by mechanical Safe/Arm units that prevent propagation

even if accidental initiator firing takes place. Additionally, initiators are

designed to be essentially impervious to electrostatic and RF energies which

could activate them. The event probabilities and their justifications are

shown in Exhibit 7-11.

1-14
EXHIBIT 7-4 FAULT TREE FOR EXPLOSION RESULTING FROM A DROPPED PAYLOAD

1-15
EXHIBIT 7-5 EVENT PROBABILITIES FOR EXPLOSION RESULTING 

FROM A DROPPED PAYLOAD

CONTRIBUTING PROBABILITY JUSTIFICATION

 EVENT DESCRIPTION/VALUE

1. Wire rope fails Remote/10-4 Cables inspected before

each lift

Replaced if 3 strands

broken

Astrotech crane technician

monitors all lifts and

activates kill switch if

cross-reeving occurs

2. Brakes fail Improbable/10-5 Brakes are

redundant

Brakes tested during semiannual load testing

3. Sling fails Remote/10-4 Slings 100% load

tested before all

lifts

4. Hook fails Improbable/10-5 Hooks magnafluxed

annually and load

tested semiannually

5. Operator error Remote/10-4 Operators are trained and

certified by Astrotech

The Astrotech crane

technician monitors all

lifting operations and can

prevent errors by using

the kill switch

7. Drop height enough to Frequent/10-1 Generally, at least one

lift

 cause failures/ignition of sufficient height may

occur for most payloads

8. Sprinklers fail to control Frequent/10-1 Heating could be

localized and

insufficient to

activate

sprinklers

Sprinklers may not control

tank heating even if

1-16
EXHIBIT 7-6 FAULT TREE FOR EXPLOSION OF A HIGH PRESSURE TANK 

1-17
EXHIBIT 7-7 EVENT PROBABILITIES FOR EXPLOSION OF A HIGH PRESSURE TANK

CONTRIBUTING PROBABILITY JUSTIFICATION

 EVENT DESCRIPTION/VALUE

1. Material flaw in Improbable/10-5 Tanks are designed with 

 tanks or lines safety factor of 1.3

All tanks and lines proof

tested to greater than

operating pressures

Most tanks designed to

leak rather than burst

2. Tank overpressurized Remote/10-4 Tanks protected by

relief valves

Operator must disable

protective limits and

violate procedures

Difficult to achieve with

tanks used

4. Fragments penetrate fuel Probable/10-2 Fragments penetrating fuel 

 tank and ignite fuels tank have sufficient

energy/heat to ignite

fuels

Pressure tanks are not

always in close proximity

to fuel tanks

1-18
EXHIBIT 7-8 FAULT TREE FOR EXPLOSION RESULTING FROM A SPIN BALANCE ACCIDENT

1-19
EXHIBIT 7-9 EVENT PROBABILITIES FOR EXPLOSION RESULTING 

FROM A SPIN BALANCE ACCIDENT

CONTRIBUTING PROBABILITY JUSTIFICATION

 EVENT DESCRIPTION/VALUE

1. Spin table fire Improbable/10-5 Motor isolated from table

Motor protected by circuit

breakers

No other fire source available

2. Major fuel leak/spill Improbable/10-5 Fuel tanks have little pressure

Spin loads are small

Leak, if any, small and fire

unlikely

4. Sprinklers fail to Frequent/10-1 Heating could be localized

 control and insufficient to activate

sprinklers

Sprinklers may not control tank

heating even if activated

5. Severe imbalance loads Improbable/10-5 Payload static balance performed

before dynamic spin balancing

Spin machine shuts down

automatically if imbalance limits

exceeded

Spin rates are low, 1-2 cps

Loads not likely to exceed

payload attachment strength

6. Spin table seizure Improbable/10-5 Does not appear feasible

for machine design due to

hydraulic bearings with

roller bearing backup

8. Sprinklers fail to Frequent/10-1 Heating could be localized 

 control and insufficient to activate

sprinklers

Sprinklers may not control tank

heating even if activated

9. Severe damage and fire Frequent/10-1 Spin table recessed in floor and

drop height small, however tip

over is likely to cause

sufficient damage to produce

leaks

1-20
EXHIBIT 7-10 FAULT TREE FOR IGNITION OF SRM

1-21
EXHIBIT 7-11 EVENT PROBABILITIES FOR IGNITION OF SRM

CONTRIBUTING PROBABILITY JUSTIFICATION

 EVENT DESCRIPTION/VALUE

1. SRM ignited internally Improbable/10-5 Initiators

protected by

Safe/Arm units

Initiators insensitive to

electrostatic and RF

energy

2. Nozzle blockage or Frequent/10-1 In some cases,

systems do not

 sealed adaptor provide adequate venting

to preclude SRM

overpressurization, if

ignited

3. SRM ignited internally Improbable/10-5 Initiators

protected by

Safe/Arm units

Initiators insensitive to

electrostatic and RF

energy

4. No nozzle blockage or Frequent/10-1 Most systems provide

adequate

 adaptor venting to preclude SRM

overpressurization, if

ignited

5. SRM ignited externally Improbable/10-5 Fire, dropping or

destruct charge

initiation

improbable

Electrostatic ignition

possible but unlikely for

current motor designs

6. SRM in same bay as Frequent/10-1 SRM mating and

1-22
7.5 Consequences of Worst Case Releases

The reason behind defining and using worst case releases is to determine

whether there is any risk posed by the facility to the public and to quantify

that risk. Not all accidents pose health or safety threats to the public. 

For example, Building 2 was designed to contain accidental releases of liquid

propellant that might occur during normal operations. Any propellant vapors

from fuel spills or from incidents involving only nitrogen tetroxide that do

not involve explosive breaching of the Building 2 would be handled and treated

using the established scrubber/containment system and would not pose any

threat to the public. However, even well-designed facilities have their

limits. Therefore, by identifying and evaluating the consequences of worst

case releases and determining their impacts, if any, on the public health and

safety, the safety evaluation team has estimated the maximum risk. If the

maximum risk is minimal, then any release with less severe consequences, but a

higher predicted frequency, will also pose minimal risk.

As indicated previously, the worst case releases are defined as

resulting from fire and explosion accident scenarios involving various

combinations of up to approximately 25,000 pounds of solid propellant,

5,000 pounds of oxidizer and 2,500 pounds of fuel. The evaluation team has

verified the conclusions of the analyses previously carried out by ECI on the

overpressure and fragmentation hazards that could occur from an explosion

involving a large payload with fuel, oxidizer and an SRM. Because these

analyses support the conclusion that there are no hazards to the public from

overpressure and fragmentation explosion effects, in this evaluation, only the

potential for exposure to toxic vapors and glass breakage hazards have been

analyzed. 

It must be noted at this point that there are virtually no mathematical

models which accurately describe the physical phenomena that could cause a

release from a closed facility. Because there are no precise models to

address such an event, the approach used in this analysis produces a very

conservative estimate of the concentrations that could result from an actual

accident. The conservative assumptions, which lead to a conclusion that is

more protective of public health, are both noted in context and summarized

with the conclusions.

7.5.1 Vapor Releases

The maximum release of gas for an incident involving only liquid

propellants would result from an explosive reaction of the fuel with air or

with an oxidizer. These explosions could create the force necessary to

penetrate the walls or ceiling and thus breach the building containment

system. Astrotech is permitted by the Florida DER to have a maximum quantity

of 2,500 pounds of anhydrous hydrazine or monomethyl hydrazine on-site. For

events involving liquid fuels, the maximum quantity of unburned fuel that

could be released to the atmosphere is conservatively estimated at 25%18 of

the quantity involved (since most will be consumed in the fire and explosion

itself). On this basis it is estimated that the maximum quantity of fuel

released is 625 pounds (~75 gallons). The molecular weights of anhydrous

hydrazine and MMH are 32 pounds/mole and 46 pounds/mole, respectively, and

therefore a maximum of 19.5 moles of anhydrous hydrazine or 13.6 moles of MMH

could be released to the atmosphere. Since payloads normally contain a much

larger volume of anhydrous hydrazine than MMH, and anhydrous hydrazine

produces a greater concentration per pound of liquid released than MMH,

 

 

18 Personal Communication with ESMC/SE on Martin Marietta study of hypergol Fuel/Oxidizer

concentrations resulting from the Titan 34D explosion.

1-23
anhydrous hydrazine has been conservatively selected as the fuel in the

release calculations.

If a payload requires N2O4, Astrotech is permitted to have a maximum of

5,000 pounds on-site. Only about 20%19 of the oxidizer is estimated to be

consumed by the fire and explosion. Therefore, approximately 80% or

4,000 pounds could be released to the atmosphere as gaseous nitrogen dioxide. 

The molecular weight of NO2 is 46 pounds/mole, indicating that about 87 moles

could be released.

If the incident were to involve a large SRM, the hydrogen chloride (HCl)

generated during the burning of the solid propellant (approximately 21 percent

of the weight of solid propellant)20 would also be released. Of the

approximate 25,000 pounds of solid propellant, about 5,250 pounds of HCl is

generated; since the molecular weight of HCl is 36.5 pounds/mole,

approximately 144 moles of HCl could be released to the atmosphere.

7.5.2 Initial Cloud and Stem Characteristics

In a fire and explosion, smoke and hot gases are generated that rise due

to buoyancy and form a ball, called a cloud, which stabilizes at the top of a

stem of gases. In the releases considered in this evaluation, the cloud is

primarily comprised of gas products resulting from a fire or explosion. The

components of a typical cloud and stem are depicted in Exhibit 7-12. The

evaluation team calculated public exposure concentrations for vapors contained 

in both the cloud and the stem.

 

 

19 Ibid.

 

20 Parametric Studies with an Atmospheric Diffusion Model that Assesses Toxic Fuel Hazards Due

to Ground Clouds Generated by Rocket Launches, R. B. Stewart and W. L. Grose, NASA Technical Note

TN D--7852, May 1975.

1-24
EXHIBIT 7-12 COMPONENTS OF A TYPICAL CLOUD

1-25
Studies have shown that for conditions in this region, clouds tend to

rise to altitudes in the range of 1,900 to 3,500 feet.21 Since the

concentrations of gases in the stem will be greater for the lower

stabilization altitude, 1,900 feet was conservatively selected as the

stabilization height.

The size of the cloud is proportional to the total weight of the

propellants involved in the explosion. Using weights of 2,500 pounds for

fuels only, 7,500 pounds for fuel plus oxidizer and 32,500 pounds for all

three propellants, cloud diameters of 125, 175 and 280 feet were estimated

using relations developed by NASA for a variety of propellants and propellant

combinations.22 The cloud volumes corresponding to these diameters are 1.0 x

106, 2.8 x 106, and 11.5 x 106 cubic feet, respectively. The clouds are

depicted in Exhibit 7-13. The stem volume in each case is approximately 21 x

106 cubic feet.

The cloud rises essentially intact and most of the released gases will

be contained within the cloud, not in the stem. Models of the cloud and stem

concentrations indicate that a Gaussian distribution may be used for the

vertical distribution of the gases.23 The percentage of gases near the

surface will be very low and increase to a maximum at the stabilization

height. The effect of the building on the vertical distribution of the gases

is unknown, but to be conservative, it is assumed that 20 percent of the gases

emitted will be uniformly distributed in the stem and 80 percent in the cloud.

7.5.3 Initial Cloud and Stem Concentrations

The ground level toxic vapors near the Astrotech facility will primarily

be from gases initially in the stem, and not from gases buoyed upward by the

heat into the cloud. We have assumed that 20 percent of the vapor products

will remain in the stem volume. Involvement of an SRM in the fire and

explosion will tend to ensure that all of the anhydrous hydrazine is burned

and that all of the N2O4 is buoyed up to the stabilization height of the

cloud. The stem diameter was assumed to be 120 feet, the largest overall

approximate dimension of Building 2 at Astrotech. On the basis of these 

 

 

21 Ibid.

 

22 Size and Duration of Fireballs From Propellant Explosions, J. B. Gayle and J. W. Bransford,

NASA-George C. Marshall Space Flight Center, Technical Memorandum X-53314, August 1965.

 

23 Ibid.

1-26
EXHIBIT 7-13 DIMENSIONS OF CLOUDS FOR PROPELLANT EVENTS

1-27
conservative assumptions, the concentrations of the various gases generated

and contained in the cloud and its stem are estimated as follows:

Monopropellant Event

* Stem-(N2H4)-19.5 moles x 0.2 = 3.9 moles

* Cloud-(N2H4)-19.5 x 0.8 = 15.6 moles

* Parts/million-Stem-(N2H4) = 3.9 moles/53,400 moles air = 73 ppm

* Parts/million-Cloud-(N2H4) = 15.6/2440 = 6,393 ppm

Bi-propellant Event

* Stem-(NO2)-87 moles x 0.2 = 16.4 moles

* Stem-(N2H4) = 3.9 moles

* Cloud-(NO2)-87 moles x 0.80 = 69.6 moles

* Cloud-(N2H4)-15.6 moles

* Parts/million-Stem-(NO2) = 326 ppm

* Parts/million-Stem-(N2H4) = 73 ppm

* Parts/million-Cloud-(NO2) = 9,870 ppm

* Parts/million-Cloud-(N2H4) = 2,213 ppm

Solid Rocket Motor(SRM) Event

* Stem-Hydrochloric Acid (HCl)= 490 ppm

* Cloud-(HCl) = 3,600 ppm

For the SRM event, the concentrations of anhydrous hydrazine and

nitrogen dioxide will be less than those shown in the mono- and bipropellant

events because of the increased burning which consumes the hydrazine and

larger cloud size which dilutes the nitrogen dioxide. The largest

concentration for each of the toxic vapors from the above events will be used

as the worst case release in the subsequent analyses.

For an event involving an SRM, the actual stem and cloud volumes will be

greater and therefore, the toxic vapor concentrations lower, than those used

in this analysis. This is because the burning of solid propellant occurs over

a period of time and is not an almost instantaneous reaction like the fuel and

oxidizer reaction. Hence, in the SRM event, the concentrations of all toxic

products will be lower than calculated.

7.5.4 Fate of Toxic Gases in Atmosphere

The safety evaluation team predicted the ground level concentrations of

three toxic vapors: anhydrous hydrazine, nitric acid (HNO3) from release of

N2O4 and hydrochloric acid from the burning of solid propellant.

Any anhydrous hydrazine involved in a fire or explosion will be

substantially consumed. The amounts of unreacted vapors that escape to the

atmosphere, will be diffused by wind and will gradually dissipate by reacting

with oxygen and moisture in the air. 

However, nitrogen tetroxide exists primarily as a liquid that, as it

vaporizes, disassociates into nitrogen dioxide. Nitrogen dioxide then reacts

with moisture and oxygen in the atmosphere and forms HNO3. Therefore, the

evaluation team analyzed vapor concentrations of nitric acid.

4NO2 + 2H2O + O2 ---> 4HNO3

Other reactions are possible but ultimately, almost all of the nitrogen

dioxide released to the atmosphere is converted to nitric acid mist. The rate

1-28
at which this conversion takes place is very rapid24,25. Virtually all of the

relevant data concerning reaction rates for NO2 in the atmosphere were

obtained at or near ambient temperature whereas any release preceded by an

explosion would raise the temperature of the escaping gases by several

hundreds of degrees. Since the rates of most chemical reactions increase with

an increase in temperature, it is likely that the rate of conversion will be

limited only by the availability of moisture in the air.

For the typical relative humidity conditions, approximately

20,000 pounds of moisture is available in the cloud and stem volumes produced. 

Since only about 800 pounds of moisture would be required to react with 4,000

pounds of nitrogen tetroxide (the estimated amount which could be released as

NO2 in an accident), there should be ample moisture present to convert all of

the nitrogen dioxide in the cloud to a nitric acid mist. The 5,250 pounds of

hydrogen chloride gas generated by the SRM burning will also be rapidly

converted to hydrochloric acid by the excess water vapor available.

Both the nitric acid produced from nitrogen dioxide and the hydrochloric

acid from the solid propellant will gradually dissipate and ultimately be

removed in the form of dilute acid rain. The quantities of acid potentially

produced by such an event are significantly less than those discharges

produced by fossil fuel fired power plants in the area. It is estimated that

these plants emit approximately 20,000 pounds of sulfur dioxide each day that

eventually contributes to acid rain. The toxicity of sulfuric acid is similar

to that of both nitric and hydrochloric acids.

7.5.5 Analysis of Vapor Concentrations in the Stem

The initial plume generated by the fire and explosion will form a stem

and cloud at the stabilization altitude that drift with the prevailing wind at

the time of the accident. The stem footprint size in the downwind direction

will be 120-200 feet and the resulting exposure duration less than a minute,

even with a conservative assumption of very low wind speeds (approximately 2.5

mph26). As the stem drifts it will grow both laterally and in the downwind

direction. This growth will increase the volume thereby diffusing the toxic

vapors. Based on data from ESMC at Patrick AFB, Florida, the average daytime

standard deviation of wind direction is 14-degrees (1-sigma) and the average

night standard deviation is 10-degrees. Although fueling operations at

Astrotech are normally conducted only during the daytime, the nighttime

standard deviation of winds was used in the analysis to be conservative. This

variability in wind direction will cause the stem footprint to grow with a

Gaussian distribution laterally around the average downwind direction. Wind

speed variations or gustiness will produce growth of the stem in the downwind

direction. The downwind growth models indicate this growth is probably less

than 1/4 the lateral growth.27 For this analysis, the downwind growth used is

1/5 of the growth of the stem in the lateral direction to be conservative. 

The combination of these assumed wind effects will result in a rapid increase

in footprint area and volume as illustrated in Exhibit 7-14.

 

 

24 Analysis and Model Data Comparisons of Large Scale Releases of Nitrogen Tetroxide, T. G.

McRae, Lawrence Livermore National Lab, Report NO. TR-85-06, June 1985.

 

25 Air Pollution and Its Effects, Second Edition, Volume 1, AIR POLLUTION, Academic Press, 1968.

 

26 See Exhibit 3-6 on Atmospheric Stability. All of the annual average wind speed figures are

greater than 2.5 mph.

 

27 Parametric Studies with an Atmospheric Diffusion Model that Assesses Toxic Fuel Hazards Due

to Ground Clouds Generated by Rocket Launches, R. B. Stewart and W. L. Grose, NASA Technical Note

TN D--7852, May 1975.

1-29
The toxic vapors will be distributed in the percentages shown in

Exhibit 7-14 and will be diffused by the increased volume of each sector. The

highest concentrations will be contained within +/- 1-Sigma of the average

wind direction. The concentrations in the +/- 1- Sigma sectors resulting from

the initial release conditions are plotted as a function of downwind distance

in Exhibit 7-15. 

In order to interpret the data contained on Exhibit 7-15, the safety

evaluation team compared the predicted concentrations of toxic vapors to their

respective IDLH values, established by the OSHA/NIOSH28, and defined as the

maximum concentration allowed for short-term exposures. The IDLH values for

the gases of concern are shown in Exhibit 7-16. These values represent a

maximum concentration from which one could escape within 30 minutes without

any escape-impairing symptoms or irreversible health effects.

To be protective of the general population, EPA has defined 10% of the

IDLH as an LOC in performing hazards analyses to calculate the vulnerable zone

resulting from an unconfined spill for community planning purposes. The

safety evaluation team has compared the ground level concentrations from the

worst case releases to the 10% IDLH values.

Exhibit 7-15 illustrates the rapid diffusion and reduction in

concentration of the toxic gases that occur under the assumed meteorologic

wind conditions. As shown, any unreacted hydrazine will fall below 10% of the

IDLH (8 ppm) by approximately 200 feet downwind. The hydrochloric and nitric

acid concentrations will have diffused to below 50% of the IDLH within the

first several hundred feet of downwind travel. The nitric acid and

hydrochloric acid concentrations are below the 10% IDLH level in approximately

860 feet and 1,225 feet, respectively. Concentrations at the nearest

Astrotech boundary are less than 5 ppm for hydrazine, 20 ppm for nitric acid

 

 

28 NIOSH Pocket Guide to CHEMICAL HAZARDS, U.S. Department of Health and Human Services, Public

Health Service, Centers for Disease Control, National Institute for Occupational Safety and Health,

September 1985. 

1-30
EXHIBIT 7-14 STEM FOOTPRINT DISPERSION

1-31
EXHIBIT 7-15 CONCENTRATIONS OF TOXIC VAPORS VERSUS DISTANCE

1-32
EXHIBIT 7-16 IDLH CONCENTRATIONS

IDLH a

Toxic Material ppm 

Hydrazine - N2H4 80

Nitrogen Dioxide - NO2

and N2O4 50b

Nitric Acid - HNO3 100

Hydrogen Chloride - HCl 100

 

a Immediately dangerous to life and health

 

b There is a single value because N2O4 dissociates into NO2

and 28

ppm for

hydroch

loric acid. Injuries are not likely for the less than one minute exposures

that would occur at these levels.

 The concentration contours for the 50% and 10% of the IDLH for HCl are

shown in Exhibit 7-17. These concentrations were derived from the initial

conditions using the following equation.

Where:

C = concentration per unit volume

QT= total quantity released

Y = crosswind distance

σY= crosswind distance standard deviation

Note that the crosswind distance (width) on the contour is less than 300 feet. 

The exact location of the concentration contour for any toxic vapor is

dependant on wind direction at the time of the release. In order to identify

a zone in which there is a potential for exposure, the safety evaluation team

used the maximum distance at which the 10% IDLH concentration occurs as the

radius to determine a concentration zone for each of the vapors released as

shown in Exhibit 7-18. Although this zone is shown as a circle, for any

particular release only a small portion of the area of the circle would

actually be exposed.

1-33
EXHIBIT 7-17 CONCENTRATION CONTOURS FOR HYDROCHLORIC ACID

1-34
EXHIBIT 7-18 CONCENTRATION ZONES OF TOXIC VAPORS AT 10% IDLH

1-35
7.5.6 Analysis of Vapor Concentrations in the Cloud

By the time the cloud disperses and reaches ground level, even with a

series of conservative assumptions, the predicted concentrations of nitric

acid and hydrochloric acid are 1 ppm and 2 ppm, respectively. These

concentrations are below 10% of the IDLH, and represent no risk to public

health. Details of the calculations follow.

Once the cloud reaches its stabilization altitude, it will drift with

the prevailing wind growing both laterally and in the downwind direction,

increasing in volume, and diffusing the toxic gases. The variability in wind

direction is responsible for the lateral growth of the cloud. Growth in the

downwind dimension is the result of gustiness effects and is generally less

than the lateral growth.29 Since cloud volume is a cubic function of cloud

diameter (volume of a sphere = 0.167 x π x diameter3), growth of the cloud

results in rapid decreases in the average concentration of toxic gases.

If the center of the cloud remains at the stabilization height of

1,900 feet, by the time the cloud has grown sufficiently to contact the ground

(diameter 3,800 feet), the concentration will have decreased by a factor of

approximately 2,500. The resulting average concentrations would thus range

from approximately 1 ppm to 2 ppm by volume for the acids and gases trapped in

the cloud. Since the axial and vertical concentrations should exhibit a

Gaussian distribution, the actual concentration at or near ground level should

be negligible. Note that the composition of the gases will have changed

somewhat by this time as discussed in the previous section, further reducing

the concentrations.

7.5.7 Analysis of Glass Breakage

In general, most of the injuries to the public from explosions are

caused by glass breakage and impacts by flying fragments. Window breakage can

cause injury beginning at overpressures of about 0.5 psi. At overpressures

above 1.5 psi windows are shattered. For the maximum quantities of anhydrous

hydrazine and nitrogen tetroxide permitted, 2,500 pounds and 5,000 pounds,

respectively, the net equivalent explosive weight of TNT is 387.5 pounds,

which exhibits an overpressure impact of 0.5 psi at a distance of 546 feet.30

Therefore, no glass breakage hazard exists for any nearby dwellings from the

potential overpressures predicted for such an accident.

7.6 Summary of Risks to the Public from Worst Case Releases

The overall probability of having an accident involving fire and

explosion with a release of toxic vapors is summarized in Exhibit 7-19. This

exhibit indicates that there is a remote chance of two accidents occurring per

 

 

29 Hazard and Quantity Distance Siting Analysis of Astrotech Hazardous Staging Airlock Addition

to Bldg # 2, ECI Report NO. 1-88, Explosive Consultants Inc., February 1988.

 

30 ATF: Explosives Law and Regulations, ATF P 5400.7, Bureau of Alcohol, Tobacco, and Firearms,

Department of the Treasury, §55.218 Table of Distances for Storage of Explosive Materials, November

1982.

1-36
EXHIBIT 7-19 FAULT TREE FOR WORST CASE ACCIDENT PROBABILITY

1-37
10,000 payload operations. With a maximum processing rate of approximately 10

payloads per year, approximately two such accidents could occur per 1,000

years of payload processing operations. This analysis is in line with

industry experience because there has never been an accident of this severity

in more than 35 years of payload processing operations throughout the United

States. However, because this analysis was based on professional judgment and

best estimates of failure rates, due to the lack of industry-specific accident

data, the safety evaluation team has conservatively estimated that the

accident probability is somewhere between one accident per 100 years and one

accident per 500 years.

The overall consequences of a worst case release would be minimal. It

is unlikely that the vapor concentration estimated in this analysis could ever

be achieved, since the many conservative assumptions listed below were made in

the analysis. The maximum possible exposure concentrations for HNO3 and HCl

are well below one-half of their IDLH threshold levels outside the facility

boundaries. Exposures just beyond the nearest facility boundary will be less

than 8 ppm (10% of the IDLH) for hydrazine and 30 ppm for both nitric acid and

hydrochloric acid. The duration of this exposure is estimated to be less than

a minute (at low wind speed conditions). Reactions of the released vapors in

the atmosphere with oxygen, carbon dioxide, water vapor and other reactive

molecules will also further reduce the concentrations by changing them into

other chemicals like nitrogen, hydrogen, and water.

The vapor concentrations were estimated using the following conservative

assumptions:

• The maximum quantities of liquid and solid propellant

permitted at the facility were used in the analysis. 

Payloads that contain these quantities of propellant

would be extremely rare.

• The cloud stabilization height used was the lowest

reported for large releases. Daytime stabilization

heights are likely to be much higher at the Astrotech

location, hence, concentrations in the stem would be

reduced proportionally.

• An average wind azimuthal standard deviation of 10

degrees was used rather than the average daytime

deviation of 14 degrees. A smaller azimuthal

deviation will increase the concentrations predicted.

• The vertical distribution of gases in the stem was

assumed to be uniform. Both data and models reviewed

indicate that these gases tend to be distributed in a

Gaussian manner with the concentrations decreasing

from the stabilization height to a very low level near

the surface. If a Gaussian distribution had been used

in the vertical stem, concentrations near the ground

would have been at least an order of magnitude (factor

of 10) less.

• Although the toxic gases are known to react in the

atmosphere and form non-toxic products, the analysis

assumed no dissociation. 

• An individual in a building will likely not be exposed

to the calculated ambient concentration because the

concentration inside the building will not reach the

1-38
calculated level in the less than one minute exposure

time.

On this basis, it is concluded that the concentrations estimated above typify

worst case release conditions that are not likely to occur in an actual

accident. The actual concentrations that could result from an accident would

likely be much less.

7.7 Comparison With Other Public Risks

This section will qualitatively compare the probability and severity of

an accident at Astrotech with hazards representative of those that may exist

in communities surrounding the facility to provide a comparison of the risks

posed by the Astrotech facility with commonly encountered risks. For example,

many communities have highways running near or through them that are used for

commercial transport of goods, including hazardous materials. Also, in many

communities hazardous industrial chemicals are used at fixed facilities, such

as water treatment plants, public swimming pools, and power generating

facilities. As a result, there are many hazards in any given community that

present risks of similar, if not greater, severity than the risk posed by the

Astrotech facility.

To assist emergency planners, EPA, DOT, and the Federal Emergency

Management Agency (FEMA) have co-authored two manuals on hazards analysis. 

These are endorsed not only by EPA, DOT, and FEMA but also by numerous other

federal agencies and are routinely used by LEPCs in their emergency planning

efforts. The methods presented in the manuals provide tools for identifying

and examining potential hazards as well as methods for prioritizing emergency

planning efforts.

Emergency planners locate and identify sources of hazardous chemicals

within the local area, and qualitatively assess the frequency of release and

the severity of consequences for such a release. For each facility, a value

ranging from common to very unlikely is assigned for the frequency of

occurrence (see Exhibit 7-20) and a value ranging from minor to catastrophic

is assigned for the severity of the consequences (see Exhibit 7-21).

Local, state, and federal emergency planners evaluate the probability

and severity of a possible event to focus and prioritize their emergency

planning efforts. The accident/severity screening matrix (see Exhibit 7-22)

is provided to emergency planners as a tool for determining the level of

1-39
EXHIBIT 7-20 DEFINITIONS OF FREQUENCY CATEGORIES

Category Frequency of Accident

Common Event expected to occur one or more times per year.

Likely Event expected to occur once every ten years

Reasonably Event expected to occur every 100 years

Likely

Unlikely Event expected to occur every 100 to 1000 years

Very Unlikely Event expected to occur less than once in 1000 years

EXHIBIT 7-21 DEFINITIONS OF SEVERITY CATEGORIES

Severity Category Injuries Fatalities Evacuation

Number of Individuals Effected

Minor accident low none none

Moderate up to 100 up to 10 up to 2,000 people

Major accident up to several up to 100 up to 20,000

hundred

Catastrophic accident more than 300 more than 100 more than 20,000 

1-40
EXHIBIT 7-22 ACCIDENT FREQUENCY/SEVERITY SCREENING MATRIX

1-41
emergency planning necessary for each postulated event. An unlikely

frequency/minor severity event, such as the worst case release described above

for Astrotech, according to the matrix would not require comprehensive

emergency planning, unless local officials deem it necessary; however, a

likely frequency/minor severity event would require comprehensive emergency

planning. Emergency planners are advised to focus their planning efforts on

the mandatory events first, and later move on to the events of lesser risk. 

As mentioned earlier, most communities have highways and state roads

running through and around them that are used for commercial transport.

Materials hauled often include dangerous chemicals or consumer products

containing dangerous chemicals. One such substance is ammonia. Ammonia is

poisonous and may be fatal if inhaled in sufficient quantities. Contact with

the liquid may cause frostbite and will chemically burn eyes and skin. 

Although it is not flammable, it will burn within certain vapor concentration

limits and will increase the fire hazard if present with combustible

materials.

Ammonia has a variety of uses in many different industries including as

a coolant in refrigeration systems, a component in cleaning solutions, and a

common ingredient in many products. Ammonia is often shipped in refrigerated

tank trucks on interstate highways. On these highways, car and truck

accidents are common and subsequently, depending on the annual number of

shipments and the length of the route, a frequency of "reasonably likely"

(event occurs once every 100 years) might be expected for such an accident in

a specific community. If a tanker truck hauling 3,000 pounds of ammonia

became involved in a collision severe enough to rupture the tank and spill the

entire contents, and if that spill occurred in a densely populated area, the

consequences could be major. Not only could individuals on the roadway be

affected, but also individuals in adjacent neighborhoods and business

localities might need medical treatment. Sensitive populations such as

hospitals and schools were included in the area affected by an ammonia release

would be an additional complication for emergency responders.

Overall, this transportation-related release of ammonia might be

evaluated as a reasonably likely/major severity event. As shown in

Exhibit 7-22, this event would require comprehensive emergency planning and

preparedness by emergency planners.

Because water provided by the local municipality to the community must

meet stringent Federal drinking water standards, a common fixed facility in

many communities is a water treatment plant. Many water treatment plants have

chlorine on-site that is used to treat the water to these standards.

Chlorine is a poisonous gas, that can be fatal if inhaled. It is corrosive,

and may cause burns to skin and eyes. A typical water treatment plant has

800 pounds of chlorine on-site, and if one assumes a series of equipment

failures, a spill of the entire 800 pounds could occur from the plant storage

tank. Because many such tanks have leak detection systems and inventory

controls, this event is unlikely.

Again, site specific considerations would be used to evaluate the

severity of this hazard accurately. If one assumes the water treatment plant

is located near a densely populated residential community, the potential

severity is major. The released chlorine would likely not be contained by a

building, and because chlorine is not flammable, none would be consumed in a

fire or explosion. This means that the quantity entering the environment

would equal approximately the entire quantity released. 

Overall, a release of chlorine from a water treatment plant might be

1-42
evaluated as an unlikely frequency/major severity event. According to

Exhibit 7-22, this event would not necessarily require comprehensive emergency

planning and preparedness by the emergency planners.

Many communities also have recreational facilities, such as swimming

pools, located in the community. An average swimming pool may have as much as

750 pounds of chlorine on-site. Chlorine used by pools is often stored in 150

pound cylinders, which are used one at a time. Therefore, it is unlikely that

more than one cylinder would be ruptured in a single accident. Since the

cylinders are handled regularly by pool personnel, the probability of an

accident is reasonably likely (event occurs once every 100 years). Assuming

an operator error leads to breakage of a cylinder seal, all 150 pounds of

chlorine would be immediately released. 

Depending on the density of population in the immediate area, this event

could be considered of moderate or possibly major in severity by emergency

planners. Thus, it would not necessarily require major emergency planning

efforts.

As detailed in the preceding sections, the Astrotech facility has been

designed anticipating possible accidents so that it would contain any releases

of liquid or vapor, except in the event of an explosion or a transport

accident. As a result of the design considerations, the extensive training of

facility personnel, and the particular operating procedures, the frequency or

probability of a hazardous event is unlikely. Similarly, if the worst case

release were to occur, the design features of the facility, the relatively

limited initial quantity of materials, and the likelihood of a fire and

explosion consuming a significant portion of materials present, would prevent

any significant hazards from reaching the community.

Therefore, according to Exhibit 7-22, for the Astrotech facility, which

has an unlikely frequency/minor severity evaluation, comprehensive emergency

planning for this facility may not need to be a community priority. The

Astrotech facility presents a less likely and less severe hazard to the

surrounding community than other hazards that may be present. However, in the

context of Brevard County planning, the LEPC has identified the Astrotech

facility as one to be considered in the local emergency planning process and

the Astrotech facility has consistently been cooperative in providing both

information and assistance towards this planning effort, thereby ensuring the

availability of trained and informed emergency responders in the unlikely

event of an accident leading to a release.

1-43
1-44
8.0 FINDINGS, RECOMMENDATIONS, AND GUIDANCE

This section presents the findings of the safety evaluation team;

comparisons between the Astrotech facility and government facilities with a

similar function; recommendations of the site evaluation team; and some

general guidance for ensuring safe operations at similar industrial

facilities. The determinations presented here are based on a physical

inspection of the Astrotech facility and viewing some of the hazardous

operations, knowledge of existing facilities performing similar operations

owned by NASA and the Air Force, interviews with Astrotech staff, questions

asked of payload owners that use the facility, and discussions with state

regulatory personnel and local and county emergency preparedness and planning

agencies. 

Overall, Astrotech appears to have taken every reasonable precaution in

designing and constructing a facility which is safe for its employees and

those living nearby, and in implementing the policies and operating procedures

that have been successfully used by DoD and NASA for many years. Astrotech

has commissioned safety studies both to initially site the buildings on the

property and to analyze the design and construction changes for expansion. 

Astrotech has also attempted to identify and incorporate as many safety,

monitoring, and detection features into the facility as was feasible.

 Part of Astrotech's incentive for building and maintaining a safe

facility is to convince spacecraft manufacturers that it is prudent and

desirable to use the facility. The extremely high value of the payloads

processed at the Astrotech facility causes both Astrotech and the spacecraft

manufacturers to have a vested interest in ensuring that the Astrotech

facility is operated and maintained as safely as possible.

8.1 Findings of the Safety Evaluation Team

The Astrotech facility is a state-of-the-art design for payload

processing operations. It was apparent that Astrotech has not only complied

with all applicable DoD and NASA requirements, but also sought out additional

recommendations from spacecraft manufacturers and owners as well as government

agencies during the construction stage and during continuing operations, to

ensure maximum safety during efficient operation.

8.1.1 Facility and Procedures

The facility design and operating procedures employed at the Astrotech

facility have been successful in ensuring safe operations at the facility in

large part due to the personal experience of the General Manager, Safety

Officer and others at Astrotech who have had long careers operating and

working at payload processing facilities belonging to NASA and the Air Force. 

It is the direct result of this experience, and the lessons learned during the

time spent at these Government facilities, as well as industry-wide input

solicited prior to design and construction of the facility, that has enabled

Astrotech to build and operate a state-of-the-art commercial facility. This

knowledge, experience base, and interest in operating a facility which meets

or exceeds the standards set by NASA and the Air Force was apparent to the

evaluation team during the on-site inspection and interviews.

Specifically, with regard to the facility and operating procedures, the

evaluation team found that:

• The buildings where hazardous materials are handled

are separated from the public and from the non1-1
hazardous work areas by distances determined using DoD

and ATF explosives siting criteria. Therefore, if an

accident involving an explosion were to occur, the

public would not be exposed to any primary explosion

effects (i.e., overpressure from the blast, flying

fragments, or fire).

• The facility and equipment are state-of-the-art design

and quality. Specific example of Astrotech's

commitment to continuing improvements are their recent

acquisition of portable MDA toxic vapor detectors to

supplement the traditional Draeger tube vapor

analyzers in monitoring liquid propellant handling and

loading operations, and their planned acquisition of a

closed-loop distillation system for recovery of freon

contaminated during equipment cleaning operations.

• Building 2, is designed to minimize the risk to the

public of any potential releases of propellant liquid

or vapor that could result from a small spill inside

the building. The containment and scrubber systems

provide protection to the public from any incidental

exposures during normal operations.

• The physical facilities compare favorably to

Government facilities that serve similar functions. 

See Section 8.2 for a more extensive discussion.

• Prior to and during operations, policies and

procedures are in place to ensure safety. These

include attention to all aspects of operations

including such things as customer safety plans and

documentation for hazardous operations, careful

weather and lightning storm monitoring, proper use of

personal protective equipment, inspection and

maintenance of facility equipment, and emergency

planning.

• The formal, documented procedures for processing

payloads meet accepted standards as applied by

industry and Government agencies, specifically DoD and

NASA.

• No accidents or incidents have occurred at the

Astrotech facility since it began operations in 1984

that have required reporting the National Response

Center. In fact, in the course of operations only one

small spill of anhydrous hydrazine, amounting to less

than a teaspoonful, has ever occurred. This spill was

completely neutralized by the tank and scrubber

systems.

To summarize, the facility and procedures appear more than adequate to safely

support the operations that take place at the Astrotech site.

8.1.2 Emergency Response and Preparedness

The evaluation team found in interviews with local and county emergency

response and preparedness officials that Astrotech management has been

extremely open and cooperative with local public safety officials in the

1-2
construction and operation of their Titusville, Florida facility. Through

detailed planning, training and equipping, the public safety officials

assisted by Astrotech management have been provided means for responding to an

accident should one occur. Although there is interest at Astrotech and in the

public sector for a joint exercise with county emergency personnel based on a

simulated chemical release at Astrotech, no exercise has yet been conducted.

Astrotech's current written emergency response plan has been furnished

to local emergency planning and response officials. Identification and

management of emergency situations on site would be handled by Astrotech's

small and closely-coordinated staff, under the direction of the facility

Safety Officer. Procedures are in place and communications equipment is

available to protect and evacuate workers in hazardous situations, to summon a

facility emergency response team, and to call for off site assistance should

it be required.

8.2 Comparison of Astrotech Facility to Comparable Government Facilities

NASA at KSC and the Air Force at CCAFS have a number of payload

processing facilities where they have performed operations similar to those

that take place at Astrotech. The Government processing facilities, most of

which were built 20 to 25 years ago, handle the identical payload systems,

ground support equipment, and hazardous materials as Astrotech. These

facilities include:

• Delta Payload Spin Test Facility

• Navstar Processing Facility

• Solid Motor Assembly Building

• Shuttle Payload Integration Facility

• Vertical Processing Facility

• Horizontal Processing Facility

• Orbiter Processing Facility

• Vertical Assembly Building

In addition, other hazardous materials operations are conducted at the

Propellant Servicing Facility, and the Propellant Conditioning Facility as

well as, of course, at the launch pads and related service structures. 

The Astrotech facility was designed and constructed by utilizing the

safety and operating experience gained by NASA and the Air Force over the past

three decades. The safety features and related policies and procedures at the

Astrotech facility are a direct benefit from the lessons learned at KSC and

CCAFS. Since the processing facility at Astrotech is one of the newest of its

kind and the only commercial operation to-date, the facility has consequently

taken advantage of and uses state-of-the-art equipment and procedures. Many

users of the facility (Astrotech customers) believe it to be superior to the

existing facilities located on government property nearby. (See customer

letters in Appendix F.)

Because the only other comparable facilities and operations are operated

by the Air Force and NASA; because of the close proximity of the Government

facilities to Astrotech; and because the Astrotech facility has specifically

drawn upon the lessons learned from operations at the Government-operated

processing facilities, some discussion of the special features at the

Astrotech facility that make it more advanced technologically and safe enough

to operate in an industrial park, is warranted here. The specific features

which were incorporated by Astrotech and which are believed to be an

improvement over the existing DoD and NASA processing facilities are described

below.

1-3
Vapor Containment

Vapor containment inside Astrotech's Building 2 is a

characteristic not found in many older payload processing

facilities. The structure was designed and built from the very

beginning to be a containment facility in case a small propellant

release or spill should occur inside the structure during normal

operations. The containment technology has advanced considerably

over the last 30 years since the Government-owned facilities were

originally designed. This same technology is now, according to

Astrotech personnel, being incorporated into the Government-owned

hazardous processing facilities which currently vent any stray

vapor emissions to the atmosphere.

Electrostatic Dissipation

The floor covering in the high bays is electrostatically

dissipating tile. This technology was originally developed for

use in hospital operating rooms where static electricity created

potentially hazardous situations in handling sensitive equipment. 

The tiles are vinyl, impregnated with graphite, and are fixed to

the floor with a conductive mastic that dissipates static

electricity to the building ground system. This reduces

considerably the potential for spontaneous electrostatic discharge

in an environment where highly flammable liquids and vapors and

solid rocket motors could be present. In the older facilities

large metal sheets are laid over the floor in the working bay to

provide a ground link for dissipation of possible electrical

charge buildup, making operations more cumbersome.

Spill Collection and Containment

In the north and south high bays and the north airlock, fueling

operations are performed on "fueling islands." These islands are

surrounded by a stainless steel propellant collection trench. The

fueling island floor does not slope toward the trench, it is

extremely flat to ensure payload stability during loading,

however, the rest of the floor is very slightly sloped toward the

trench. The trench itself is graded and drains toward the

underground propellant containment tanks located outside the

building. This trench drainage system reduces the "wetted area"

of a propellant spill and accommodates containment and cleanup in

case of a release. In the event of a fuel spill involving a fire,

this system would also serve to confine the fire to the fueling

island and help prevent its spread to other areas. The Government

facilities have no internal spill containment system.

Remote Visual Access to Hazardous Operations

Explosion-proof observation windows have been installed between

the control rooms and the high bays in Building 2. This allows

Astrotech and customer payload safety and quality control

personnel to observe hazardous operations directly without

necessitating their physical presence in the high bay during

hazardous operations. Astrotech also has the traditional CCTV

monitoring capacity found in the NASA and DoD payload processing

facilities. In addition, Astrotech videotapes all fueling

operations and makes these tapes available to customers.

Fuel/Oxidizer Containment and Neutralization

1-4
A containment system, consisting of oxidizer and fuel holding

tanks - with the appropriate valving and manually-switched piping

system to separate the tanks - and a scrubber system, has been

installed. The scrubber is operated under permit by the Florida

DER. Astrotech maintains a check-off procedure and visual

verification to ensure proper switching of valves and tanks

between hazardous operations. No such containment and

neutralization system exists at the government facilities.

Vapor Detectors

At all times that liquid propellants are on site, Astrotech

monitors atmospheric conditions in Building 2. They use state-ofthe-art toxic vapor detectors to supplement the more conventional

Draeger tube vapor analyzers. These new monitors are sensitive

and are microprocessor-controlled for speed, accuracy, and

specificity. The detectors are enclosed in special clear plastic

cases designed for use in potentially flammable or explosive

conditions. 

Pre-Action Fire Suppression

A pre-action fire suppression system is in place that has

compressed air in the lines, maintaining a "dry pipe" condition. 

The system is activated by two independent but necessary actions:

first, a smoke/heat detection alarm signal from any of the mounted

detectors or from a manual pull station; and second, an intense

heat source sufficient to melt the fusible link in the sprinkler

head. The IR smoke/heat detection alarm system (or the manual

pull system) opens a valve which then charges the system with

water. A high intensity heat source must then be present to melt

the fusible plug at the sprinkler head, allowing the sprinkler to

wet the area. This system provides some protection for sensitive

payloads and other equipment in case there is a false alarm or

other problem. Government facilities currently use only wet pipe

sprinkler systems.

Computer Monitoring of Alarms

Alarms are automatically sent to the guard house at the front gate

by means of a computer link for various parameters and systems

including:

• temperature and humidity (HVAC system)

• loss of air pressure in the

fire suppression system

• toxic vapor detector alarm

• toxic vapor detector status

alarm (low battery or tape

break)

• generator failure

• fire alarm

The alarm panel indications displayed to the guard allow prompt

identification of potential problems and notification of proper

personnel and authorities.

8.3 Specific Recommendations

8.3.1 Equipment, Operations and Procedures

Evaluate the Operations Sequence

1-5
Although the probability of a major accident at the Astrotech facility

is small, it could possibly be further reduced by modifying the sequence of

processing operations. The presently used sequence was established when

payloads were loaded and pressurized on the launch pad. However, in recent

years the final payload propellant loading, pressurization, and integration

with large apogee kick motors has shifted location and now occurs within a

payload processing facility. Also, the amounts of liquid propellants and the

size of SRMs have increased considerably.

 Given these changes in payload processing, the safety evaluation team

recommends that Astrotech undertake a study to determine the technical and

economic feasibility of altering the operations sequence to further minimize

risk. Even though no such study has been completed, it is possible to suggest

a modified operations sequence. For example, the modified sequence below

minimizes the risks from the greater volume of propellants and takes advantage

of the sequencing flexibility available within the payload processing

facility.

Present Sequence Modified Sequence

Oxidizer load Tank pressurization

Fuel load Fuel Load

Mate payload and SRMs Oxidizer load

Tank pressurization Mate payload and SRMs

Encapsulate and transport Encapsulate and transport

The general rationale for these changes is to sequence activities to

minimize risk by minimizing the opportunities for release of propellants and

for interactions between fuel, oxidizer and SRMs. In the modified sequence,

the first step is to pressurize the payload high pressure tanks because

failure of a tank is most likely to occur during pressurization. In the

modified sequence, pressurization is completed prior to the loading of liquid

propellants, so that a tank failure could not involve liquid propellants. 

This would be feasible if the payload design includes valves that isolate the

high pressure tanks from the propellant tanks.

The sequences above assume a bipropellant spacecraft, where both fuel

and oxidizer are loaded. Because spills or leaks of fuel (i.e., anhydrous

hydrazine or MMH) are more likely to result in fires or explosions than spills

or leaks of oxidizer alone (i.e., nitrogen tetroxide), in the modified

sequence the fuel sampling and loading operations are scheduled before the

oxidizer sampling and loading operations. In the present sequence, it is more

likely that a fire or explosion resulting from a fuel leak would spread and

involve the previously loaded oxidizer.

Because the technical and economic feasibility study necessary to

support a recommendation to resequence operations is beyond the scope of this

study, and because the safety evaluation team has not examined in detail all

possible risks or technical constraints that might arise from the modified

sequence, the above discussion should be considered by Astrotech as a

beginning point for further evaluation, and not an strictly recommended

sequence. 

1-6
Install Additional Communications Capability in Cart Storage Rooms

Currently, the only communication link from the fuel and oxidizer cart

storage rooms is to the control room through an intercom mounted in each cart

storage room. The evaluation team recommends that Astrotech consider

installing an additional communication link out of the cart storage rooms

(e.g., a telephone with an outside line, or an internal connection to the

guard house) so that if an individual needed to make outside contact, and no

one was present in the control rooms, there would be a communication link.

8.3.2 Safety Policies and Requirements

Define Propellant Loading Sequencing in Safety SOP

In considering the possibility of resequencing the sequence of

operations, the safety evaluation team examined the Astrotech Safety Standard

Operating Procedures (SOP) to see if any limitations are placed on operations

sequencing. As none were found in the SOP, the evaluation team assumed the

proposed resequencing may be viable. However, the scrubber procedures

checklist1 does state that fuel must be processed before oxidizer. If the

scrubber system operations checklist indicates that there are operational

sequencing limitations, these limitations should also be detailed in the SOP,

so that payload owner/operators can properly plan their operations.

Specify Training Requirement Criteria

Astrotech requires that payload owner/operator personnel be "properly"

trained and that the payload owner/operator "certify" that this training has

taken place. However, Astrotech Safety policies do not detail the

requirements that, if met, ensure proper training. Although this could be

interpreted as a lack of specificity on Astrotech's part, the evaluation team

is aware that training requirements are not specified elsewhere in the space

launch industry. Because the commercial space industry has a relatively

limited number of facilities and personnel, training to date has largely been

accomplished through on-the-job apprenticeship, supplemented by applicable

courses (e.g., OSHA requirements and the KSC propellant handlers video) in

hazardous materials handling. As the industry expands, it will be important

to detail the training required before personnel can be given responsibility

for certain operations. Of the payload owner/operators that currently use the

Astrotech facility, most have teams for specific hazardous payload processing

operations (i.e., propulsion teams) that have worked together for long periods

of time and have successfully completed many propellant fueling operations. 

The evaluation team recommends that Astrotech review its criteria for proper

training, and also recommends that the industry as a whole evaluate training

program availability and content and begin to institutionalize training and

certification requirements to ensure competency and an adequately trained work

force for the future.

Define Accident Events and Develop Specific Response Procedures

When on the site visit, the evaluation team inquired of Astrotech what

their procedures would be in the event of an uncontrollable spill. Although

Astrotech clearly stated the necessary activities (e.g., attempt to control

spill by turning off valves, evacuate personnel, turn off power and thereby

seal the building), the exact sequencing and timing of these activities is not

documented in plans and procedures. Although the sequence would vary

 

 

1

Scrubber System Check Lists at Astrotech Space Operations, Inc., Titusville, Florida, Don

J. Wade, Manager, Spacecraft Operations, July 18, 1984.

1-7
depending on the specific spill event, more thought should be given and a

written procedure developed for general types of events. The procedure should

include a definition of the accident that initiates the stated response (e.g,

a spill of a stated volume of fuel or oxidizer, a vapor monitor reading at a

specific level), the actions taken to mitigate and evacuate, and the steps for

re-entry at specified vapor concentrations. Specific consideration should be

given to determining the capabilities and limitations of the scrubber and tank

containment systems for a variety of accident scenarios.

8.3.3 Emergency Planning and Preparedness

Although the current emergency planning and preparedness status of the

Astrotech facility appeared to be adequate, the evaluation team has several

recommendations for improvements that would facilitate communications and

rapid response.

Clarify Astrotech Personnel Assignments

Astrotech places heavy reliance on the knowledge and presence of their

Safety Officer in dealing with emergencies. Although all personnel appear to

be familiar with the safety procedures, it is important that Astrotech

formalize the Safety Officer back-up by assigning a specific person to develop

the same detailed familiarity with Astrotech's plans and procedures. By

formalizing a Safety Officer back-up, either one person or several individuals

who would rotate depending on the shift, two goals would be accomplished: the

selected individuals would make an additional effort to learn how to direct

implementation of the safety procedures, and in the event of an emergency

occurring in the absence of the Safety Officer or one that injured him, all

personnel present would know immediately who would assume leadership

responsibility, alleviating possible confusion.

An additional personnel consideration is a local media spokesperson. 

Astrotech's corporate media contact is normally stationed away from the plant. 

It would be helpful for the facility to have a local spokesperson available to

furnish information in coordination with local emergency management officials

should an emergency occur. Although the team has assumed that the Safety

Officer would take on that role, in the event of an emergency, the Safety

Officer's other duties would likely be so time consuming that a different

person would be preferable for the media contact.

1-8
Expand Emergency Contact Lists

Astrotech's procedures depend solely on the emergency telephone number

911 as an entry point into the outside emergency system. Their notification

list needs to be expanded to include telephone numbers of other critical

contacts in the local emergency management system (i.e., county emergency

management director) for reinforcement.

Astrotech's plan should also include a list of contact persons and

telephone numbers for its nearest industrial neighbors, since a situation

could arise that would require Astrotech to notify them. The local emergency

management agency should be able to assist in compiling such a list.

Circulate SARA Title III Reporting Requirements

Three chemicals which are on-site periodically at Astrotech depending on

the specific spacecraft being processed, have been designated as hazardous

substances under CERCLA. Two of these chemicals are listed as Extremely

Hazardous Substances (EHSs) under SARA Title III. SARA has specific reporting

requirements for facilities to follow when designated amounts of these

substances are accidentally released into the environment. Information

required in these reports is itemized in Section 304 of Title III. Astrotech

needs to identify these items specifically in its plans and procedures and

indicate that they are to be furnished when reporting a release.

In the event of a reportable release of a CERCLA chemical, Astrotech

should furnish the same information as that required for the EHSs. In order

to ensure proper implementation of the reporting requirements, Astrotech

should include the reportable quantity for each chemical that it handles on

the notification list.

Exercise Emergency Plan with Local Authorities

Astrotech should schedule, if possible, a full scale exercise of its

emergency plan with local authorities. If scheduling of the full scale

exercise continues to present difficulties, at least a tabletop exercise

should be scheduled.

8.4 General Guidance for Ensuring Safe Operations

The safety evaluation team brought to the Astrotech Safety Evaluation a

wide range and depth of expertise in issues necessary to ensure safe

operations at a payload processing facility. Knowledge of payload processing

procedures, hazardous characteristics of specific materials, emergency

planning requirements, and other applicable regulations was necessary to

evaluate the facility completely. In the event that communities are working

with other existing facilities to evaluate risk, or industrial facilities are

seeking to initiate or expand operations, the safety evaluation team has

prepared general guidance for ensuring safe operations. These general

observations are not aimed at the Astrotech facility, in fact in many cases, 

1-9
Astrotech has followed or exceeded the guidelines that the team has identified

and could be used as an example for effectively implementing them.

Many industries handle and use hazardous chemicals in a variety of

operations and processes under varying handling conditions (e.g., high or low

temperatures, high pressures) at locations throughout the United States. The

occurrence of accidents at major industrial facilities in the chemical and

petrochemical processing industries that have caused injury or death has

focused both public and government attention on safety, training, emergency

preparedness and planning, and accident prevention. When an industry is

considering siting a facility or expanding its operations in an area, the

first step is to consider prior assessments of safety or hazards analyses for

similar facilities in terms of such things as siting criteria and safety

designs. Astrotech accomplished this step by surveying operators of

Government facilities and potential customers for design suggestions, and by

commissioning a safety expert to evaluate compliance with siting criteria.

It is critical to coordinate early with the local planning officials and

begin by laying out the overall plans for siting, design, and construction

regarding safety and accident prevention especially if chemicals will be

handled on site that should be included in the community emergency

preparedness and planning efforts. At this point it may be advisable to bring

in safety experts to help make decisions about where to expend time and

resources to maximize safety by including special designs or safety systems or

by adapting operations sequences.

 In general the components of an adequate safety program at a facility

include not only the design, but also operating and maintenance controls,

training, documentation and record keeping, and internal audits and

inspections. The overall safety program at a facility is a key factor in

protecting the public and the environment. Proactive programs designed to

prevent chemical releases are the most effective way to protect community

health and safety and the environment. To prevent accidents, a facility must

anticipate the circumstances that could result in releases and include

precautionary and preemptive actions appropriate to the nature of the

hazardous chemical(s) handled as well as the operations at the site.

Existing safety, health, and environmental audit programs established at

a facility are important in improving emergency response and risk reduction. 

It is critical to identify facility hazards, carefully evaluate the associated

risks presented by the hazards and if possible, reduce those risks to prevent

and mitigate the effects of releases. This can be effectively achieved

through communication and cooperation between industry and government to

prevent or minimize accidents.

An additional assurance of safe operations can be implemented by

establishing a regular monitoring program for industries in a local area. 

Although many federal, state and local authorities monitor industrial

facilities for compliance with specific regulations (e.g., at Astrotech the

City of Titusville tests neutralized liquid before accepting it into the

sewer), generally there is no established authority that ensures a facility is

complying with its own internal safety requirements. Although the broad

general scope of this Astrotech Safety Evaluation is not likely to be

frequently repeated, it would be reasonable and useful for an expert to

annually monitor and observe that established safety procedures are

implemented at industrial facilities.

Some of the equipment or procedures that may be considered in addressing

safety and accident prevention include:

1-10
1. All equipment used in handling hazardous chemicals

2. Safety procedures addressing:

-storage tanks

-piping

-pressure relief, venting, scrubbing systems

-secondary containment systems

-detection, warning or alarm systems

-emergency shut-down and fail safe systems

-critical controls and interlocks

-safety training

-checklists for critical safety activities

-inspection, maintenance, repair or replacement of

 critical safety systems

-loss of power or utilities

-emergency procedures for employee evacuation and

 notification of emergency responders and nearby

 neighbors

Additional information of interest may include the accident history of

facility or of the industry in general, local weather patterns, proximity to

water sources, any nearby businesses or residences, and any special facilities

(e.g., hospitals or schools) or environmentally sensitive areas in the

vicinity. 

Many groups in the U.S. and in the international community have been

developing methods to provide technical guidance to assist in the evaluation

of industrial safety. The Environmental Protection Agency, the Federal

Emergency Management Agency, and the U.S. Department of Transportation have

all coordinated to publish documents that are also important to these issues. 

Private groups and industrial trade associations have also addressed these

issues. One particularly helpful industrial association, the American

Institute of Chemical Engineers (AIChE) has established the Center for

Chemical Process Safety (CCPS). This group is a leader in producing

guidelines for hazard investigations and evaluations, establishing industrial

safety guidelines, and developing and improving industrial safety procedures. 

Many of the new publications by CCPS may be of use in looking at safety, risk

management, and accident prevention programs. These references and others are

listed in Appendix G, which provides an overview of references that deal with

safety, hazards evaluation, risk management and release prevention programs.

1-11
1-12
GLOSSARY OF TERMS

AIRLOCK - An intermediate chamber or room, usually located between the outer

air and an inner working chamber in which air pressure and/or temperature can

be regulated.

APOGEE KICK MOTOR (AKM) - A solid rocket motor that provides energy and

velocity needed, once a satellite has reached apogee, to circularize the

orbit. 

BIPROPELLANT - Rocket propellant mixtures of fuel and oxidizer not stable at

ordinary atmospheric conditions. Fuel and oxidizer are stored separately with

contact taking place only in a rocket combustion chamber.

CLEAN ROOM - An environmentally controlled area (i.e., humidity and

temperature) in which the airborne concentration of particles is limited by

extensive filtering of all incoming air.

CREDIBLE ACCIDENT SCENARIO - A probable, possible, and/or plausible accident

scenario, or sequence of failure events which can lead to the occurrence of

accidents.

COMBUSTION PRODUCT - Material produced or generated during the burning or

oxidation of a material.

DEFLAGRATION - Rapid burning of material below the speed of sound in the

unreacted material.

DETONATION - A heat-producing reaction that propagates through the unreacted

material at speeds exceeding the speed of sound.

DIFFUSION - The spontaneous movement and scattering of particles (atoms and

molecules) of liquids, gases, and solids.

DOD CLASS 1.3 EXPLOSIVE - Explosives in this class are defined as fire hazards

that burn vigorously with little or no possibility of extinguishment in

storage situations. Explosions normally will be confined to pressure rupture

of containers and will not produce propagating shock waves or damaging

overpressure beyond a specified distance.

EMERGENCY - A situation created by an accidental release or spill of hazardous

chemicals which poses a threat to the safety of workers, residents, the

environment, or property.

EVACUATION - Removal of residents and other persons from an area of danger.

ELECTROEXPLOSIVE DEVICE (EED) - Any detonator or initiator activated by an

electric current.

EXERCISE - A simulated accident or release set up to test emergency response

methods and for use as a training tool.

EXPLOSION - The sudden production of a large quantity of gas or vapor, usually

hot, from a much smaller amount of gas, vapor, liquid or solid. An explosion

may also be viewed as a rapid equilibration of a high pressure gas with the

environment; the equilibration must be so fast that the energy contained in

the high pressure gas is dissipated as a shock wave.

FAULT TREE ANALYSIS - A deductive analysis procedure which represents all

1-1
possible sequences of failures and chains of events which can result in the

final event at the top of the tree.

FLAMMABLE LIMITS - The upper and lower vapor concentrations of fuel to air

which will ignite and burn in the presence of external ignition sources; often

called the explosive limits although these are not identical.

FUEL - A material which may be burned by itself or used with an oxidizer to

liberate energy for use in vehicle propulsion systems.

GAUSSIAN DISTRIBUTION - A statistical distribution named for mathematician

Karl F. Gauss. It is also known as the normal distribution or bell curve, and

the distribution is symmetrical around a point referred to as the mean. The

spread of points is determined by the standard deviation. 

GRAIN - A single mass of solid propellant of the final geometric configuration

as used in a rocket motor.

GROUND SUPPORT EQUIPMENT (GSE) - Non-flight equipment, implements and devices

required for the handling, servicing, inspection, testing, maintenance,

alignment, adjustment, checking, repairing and overhauling of a payload system

or sub-system. This may include equipment required to support another item of

GSE as defined here.

HAZARD - Any situation that has the potential for causing damage to life,

property, and/or the environment.

HYPERGOLIC - Term applied to the ignition upon contact of a fuel and an

oxidizer without a spark or other external aid.

IMMEDIATELY DANGEROUS TO LIFE AND HEALTH (IDLH) - The maximum level to which a

healthy worker can be exposed for 30 minutes and escape without suffering

irreversible health effects or escape-impairing symptoms.

LEGSTAT - A device connecting a person's leg to the bottom of his shoe so that

when that person is standing on a conductive floor, an electrostatic grounding

path is provided.

1-2
MAGNAFLUXING - Using magnetic particles and applying a field to test load

bearing hooks, shackles, eyebolts and critical welds (single point of failure)

for cracks.

MONOPROPELLANT - Liquid mixtures of fuel and oxidizer or liquid molecules

containing both fuel and oxidizer constituents that are stable at ordinary

atmospheric conditions but react when heated, pressurized or catalyzed. 

NFPA 56A - A code of the National Fire Protection Association that contains

specifications for fire protection equipment.

ORDNANCE - All electroexplosive devices (EEDs), detonators, squibs, primer,

pyrotechnic devices, initiators, igniters, solid propellants, explosives,

warheads, ammunition, fuses and energy transfer systems (as defined in ESMCR

127-1). In a spacecraft, ordnance serve as separation devices and as igniters

for motors.

OVERPRESSURE - Blast wave parameter indicating pressure significantly above

what is usual or normal. Overpressure is used to quantify the strength of an

explosion, and the expected damage from an explosion is determined by its

overpressure. Overpressure is strongest at the point of the explosion and

reduces with distance, so damage also decreases with distance.

OXIDIZER - A substance that yields oxygen readily to support the combustion of

organic matter, powered metals, and other flammable material.

PAYLOAD - The total complement of specific instruments, space equipment,

support hardware, and consumables carried into space to accomplish a discrete

activity.

PAYLOAD FAIRING - Outer shroud or casing used to protect a payload during

launch and through the escape of the dense atmosphere of the earth.

PERIGEE KICK MOTOR (PKM) - A solid rocket motor that provides the substantial

energy needed to boost a satellite to a higher apogee from a lower orbit,

typically to the 22,000 mile geosynchronous orbit altitude. This motor

section of the spacecraft is designed to separate from the payload after its

energy is expended.

PERSONAL PROTECTIVE EQUIPMENT (PPE) - Equipment designed and used to protect a

worker from the hazards present during a given operation. The PPE level

(ranging from most protective level A to less protective level C) required

depends on the operation. For example, PPE level A includes a chemical

resistant suit, gloves, and boots, and a self-contained breathing apparatus,

and is suitable for protection in atmospheres where hazardous vapors may be

present. 

PRIMER - A relatively small and sensitive initial explosive train component,

which when actuated, initiates the function of the explosive train, and with

an adequate booster, will reliably initiate high explosives.

PROPELLANTS - Balanced mixtures of fuel and oxidizer designed to produce large

volumes of hot gases at controlled, predetermined rates, once the burning

reaction is initiated.

REPORTABLE QUANTITY (RQ) - The quantity of a hazardous substance that triggers

reporting under CERCLA; if a substance is released in a quantity that exceeds

the RQ, the release must be reported to the National Response Center (NRC), as

well as to the State emergency response commission (SERC), and the community

emergency coordinator for areas likely to be affected by the release.

1-3
RISK - A measure of probability or likelihood that damage to life, property,

and/or the environment will occur if a hazard manifests itself; this measure

includes the severity of anticipated consequences to people.

SAFETY DISTANCES - Safety distances are empirical distances in relation to

quantities of explosives and are the minimum permitted for separation of

facilities within a hazard area of possible explosions and for separation of

the explosive hazard from inhabited buildings, passenger railroads and public

highways in order to control the magnitude of damage, loss of life, and

serious injuries. Separation distances are not absolute safe distances but

are relative.

SCRUBBER - An air pollution control device for removing impurities from a gas

stream. Toxic constituents in the vapor phase are absorbed into and react

with the "scrubber liquor" on the packed bed material in the scrubber tower. 

Vertical flow units like the one at Astrotech commonly use countercurrent flow

of gas and liquid for maximum mixing and contact.

SOLID PROPELLANTS - These propellants act as monopropellants. Homogeneous

propellants are ones in which each molecule contains both fuel and oxygen

(e.g., nitrocellulose-containing compounds). Composite propellants are

physical mixtures of a finely ground oxidizer in a matrix of plastic, resinous

or elastomeric fuel (e.g., ammonium perchlorate in a resin binder).

SOLID ROCKET MOTOR - Motor which operates using homogeneous solid propellants. 

Following ignition, the propellant charge burns, and it is not possible to

interrupt or control the combustion process. The advantages of SRMs are the

short time needed for the activation, a long storage life, and a simple

design.

SPACECRAFT - Another term for payload. 

SPECIAL POPULATIONS - Groups of people that may be more susceptible than the

general population due to preexisting health conditions (e.g., asthmatics) or

age (e.g., infants and the elderly) to the toxic effects of an accidental

release.

SPIN BALANCING - An operation performed during payload processing, to ensure

that all weight is evenly distributed around the spin axis of a spacecraft.

SQUIB - Generally, any various small size pyrotechnic explosive device. 

Specifically, a small explosive device, loaded with low explosive such that

its output is primarily heat as opposed to an explosion. The device is

usually electrically activated and used to initiate the action of pyrotechnic

devices and rocket propellants.

STABILITY CLASSES, ATMOSPHERIC - Pasquill stability classes (ranging from "A"

TO "F") are meteorological categories of atmospheric conditions. Pasquill

stability class A represents unstable conditions under which there are strong

sunlight, clear skies, and high levels of turbulence in the atmosphere,

conditions that promote rapid mixing and dispersal of airborne contaminants. 

At the other extreme, class F represents light, steady winds, fairly clear

nighttime skies, and low levels of turbulence. Airborne contaminants mix and

disperse far more slowly with air under conditions, and may travel further

downwind at hazardous concentrations than in other cases. Stability class D,

midway between A and F, is used for neutral conditions, applicable to heavy,

overcast, daytime or nighttime.

SWALE - A low tract of land or slight depression, especially moist or marshy

ground.

1-4
TOXICITY - The ability of a substance to cause damage to living tissue,

impairment of the central nervous system, severe illness, or death when

ingested, inhaled, or absorbed by the skin.

ULLAGE - The amount a container lacks of being full, the empty space being

filled with gas or vapor.

UPPER STAGE - An expendable launch vehicle such as the Titan, Delta and

Atlas/Centaur have several "stages." As each stage completes its burn during

launch it is discarded. The first stage is usually called the "booster

stage," the second stage the "sustainer stage'" and subsequent stages "upper

stages." The upper stages of most ELVs are capable of placing payloads into

elliptical transfer orbits.

VAPOR DISPERSION - The movement of clouds or plumes in air due to wind,

gravity spreading, and mixing.

VOLATILE - A substance that has a high vapor pressure (i.e., it will readily

vaporize) at a low temperature.

WRISTSTAT - A device that connects a person's wrist to a cable that leads to a

grounding path to the building grounding grid. A wriststat is used when work

is not being performed on a conductive floor and a grounding path cannot be

established through a legstat.

1-5




































Currently Under Development