When working with explosives, it’s essential to fully understand the hazards and potential risks to employees and facilities in the area should something go wrong. However, it’s also possible for non-explosive materials to become energetic in a way that poses similar, potentially deadly and damaging risks. These high-risk operations — whether relative to “traditional” explosives or energetic materials — need to be properly managed to ensure a safe work environment. How Explosives Safety Officers (ESOs) are assessing and managing that risk varies from center to center to accommodate the diverse environments and work being done. The following examples show how three unique NASA centers and facilities are managing these risks.

White Sands Test Facility

White Sands Test Facility is no stranger to working with hypergolic propellants and liquid energetic materials and accounting for the potential risks. To determine the risk of these materials, White Sands equates each liquid hypergolic propellant present at the static test stand to a TNT (trinitrotoluene) equivalency using tables present in NASA-STD-8719.12, Safety Standard for Explosives, Propellants, and Pyrotechnics. These equivalencies are then used to determine the Quantity Distance (QD) — or the area in which the blast (pressure wave) or fragmentation could cause damage or injury should something go wrong — for energetic materials.

“TNT equivalencies to establish QDs are a way to use explosives information to baseline a non-explosive material’s energy, but it can be ultra conservative,” said Mike Hallock, ESO at White Sands. 

Explosives that are hazard classification 1.1 can mass detonate, but hypergolic energetic liquids such as Monomethyl Hydrazine (MMH) and Dinitrogen Tetroxide (N₂O₄) do not mass detonate. In fact, the manufacture’s product Safety Data Sheet reports the hazard classification as Class 6.1 — Toxic Substance, and Class 8 — Corrosive. The NASA standard equates several energetic materials, that are not hazard Class 1, to explosives that do mass detonate, driving the use of hazard Class 1 QD tables.    

“QD is risk assessment information a project uses to abide to the cardinal rule of Explosives Safety: Expose the minimum amount of explosives [energetic liquids — TNT equivalent explosives material] to the minimum number of personnel for the minimum amount of time,” said Hallock. 

QD arcs are important as unrelated personnel should not be within them during hazardous operations, so keeping the distances as small as possible has the least impact on other work. Furthermore, if QDs from separate hazardous operations (like loading propellant) overlap, these operations cannot occur concurrently. This forces projects with competing schedules to deconflict hazardous operations and coordinate schedules (e.g., one occurs in the morning and one in the evening) so that operations in one area are paused during the hazardous operations of the other.  

“QD provides the project the means to assess the explosive hazards, specifically blast and fragments, and plan risk mitigation,” explained Hallock. “Risk mitigation applies the cardinal rule of Explosives Safety, which can include just-in-time loading of propellants and minimized exposure of personnel by offsetting work schedules. Communicating hazards to personnel working at adjacent static test stands is prudent.”

A major factor of QD for energetic materials that are not hazard Class 1 (reference material’s manufactures Safety Data Sheet for hazard class) for static test stands is the Maximum Credible Event (MCE) — essentially, what is the worst thing that could happen should a mishap occur involving this energetic material? NASA-STD-8719.12 defines an MCE as, “In hazards evaluation, the MCE from a hypothesized accidental explosion, fire, or agent release is the worst single event that is likely to occur from a given quantity and disposition of explosives, chemical agents, or reactive material. The event must be realistic with a reasonable probability of occurrence considering the explosion propagation, burning rate characteristics, and physical protection given to the items involved. The MCE evaluation on this basis may then be used as a basis for effects calculations and casualty prediction.”

As a factor of the QD, a smaller MCE means a smaller QD, reducing the restricted area required for hazardous operations. The MCE, and therefore the risk, can be significantly reduced by limiting the amount of energetic liquids being taken into consideration; the standard allows for the amount of energetic liquids held in run tanks to be excluded when static test stands meet certain criteria:

1. All tanks are American Society of Mechanical Engineers (ASME) certified and designed and maintained in accordance with Section VIII Division 1/Division 2/Division 3 of the ASME Code.
2. The configuration of the test stand is such that the thrust measuring structure load cell (heavily built structure) is between the engine and the run tanks so as to prevent fragments from puncturing the tanks in case of engine malfunction.
3. Each feed line contains two remotely operated valves to shut off energetic liquids flow in the event of a malfunction.

Meeting this criteria is an all-or-nothing reduction in the MCE — that is, all three are required to reduce the effects of an event. White Sands is able to ignore the quantity in the run tanks because it configures test stands to meet these criteria and has the benefit of retrofitting new test stand customer interfaces without encroaching on other facilities. Furthermore, test personnel only bring what quantity of propellants are required to the test stand, keeping the amount of energetic materials being factored in to the QD to a minimum. 

(Note: The NASA standard does not provide allowance for the application of the MCE criteria of energetic liquids at a static test stand to hazards class 1 explosives.)

Wallops Flight Facility

Wallops Flight Facility manages risk differently: It calculates risk associated with explosive hazards using commercial software from the Institute of Makers of Explosives (IME) known as IME Safety Analysis for Risk (IMESAFR). The software uses industry-recognized algorithms that factor in site specific considerations, resulting in smaller, less conservative hazard arcs than White Sands achieves using direct TNT equivalency tables and QDs alone. Wallops does this out of necessity as its operations encroach on each other due to real estate limitations.

“Our customer base is becoming more and more diverse, with overlapping operations, and the problem we have is maintaining operational separation without implementing overly restrictive rules like one customer can operate during the day and the another at night,” said Shad Combs, ESO at Wallops, referring to established restrictions for concurrent explosive operations within QDs guidelines. “It’s about who owns the work and the assumption of liability and risk,” said Combs.

IMESAFR provides a risk-based approach for determining minimum separation distances between related and unrelated explosives operations. While IMESAFR can perform QD analyses, it can also be used to conduct a Quantitative Risk Assessment, which considers other factors like protective construction, the number of people in the vicinity of the operations, when those employee’s schedules overlap with hazardous operations, when operations overlap with each other, the probability of an unintentional explosive event occurring given a certain type of operation, etc. — what Combs calls “itty-bitty details.”

At first glance, IMESAFR indicates a less conservative approach than the overly conservative standard QD approach, but it’s important to note, the IMESAFR risk-based approach doesn’t introduce additional risk compared to the standard QD approach. The risk-based methodology is used world-wide and recognized by the Department of Defense. 

“There’s a misconception that QD makes you safe,” explained Combs. “QD doesn’t make you safe, but defines an acceptable level of risk. The risk-based approach is equivalent to the QD. We develop explosives site plans for our facility and always try to achieve the separation distances prescribed by QD. If we can’t achieve QD minimum separation distances, then the risk-based approach identifies a scenario-specific distance at the equivalent level of risk to QD.” 

While IMESAFR allows Wallops to manage the growing number of operations between unrelated hazardous operations in its limited space, the risk-based approach takes a lot more time and effort, and therefore money, to perform and maintain. The software needs to be told all the additional factors to use in its algorithm, requiring a lot of data collection and input.

“It is data hungry,” said Combs. “You have to feed it a lot of information. And it relies very heavily on getting the data. You have to know what the facilities are and where the people are.”

For Combs, this means using methods like traffic counters to monitor how many cars go by a particular area, collecting this data and then putting it into the system. Because of NASA’s oversight role when working with customers, he also has to verify that all parties are operating exactly as documented in the software during hazardous operations, because something as simple as the addition of a few people changes the risk. 

“QD is cheaper and easier,” said Combs. “With this risk-based approach, I have to have software. I have to have people who run the software. I have to have data collection. I have to have data analysts. They have to generate reports. The cost burden of risk-based is monumental. For us, it’s really that we don’t have a lot of space. We’re running out of space, so we have to do this.”

Kennedy Space Center

Like Wallops, Kennedy Space Center can’t get by with the conservative approach QDs offer as it has a limited number of facilities, despite the center’s size, with a growing number of hazardous operations from various space partners. 

“Kennedy has averaged about 28 active customers at any given time,” said Bob Russo, ESO at Kennedy. “We have almost every commercial company interested in spaceflight here in some capacity. Our multi-user spaceport has grown exponentially and there are many challenges with such growth.”

According to Russo, while these partners may bring money to the center, there are laws that financially limit NASA’s ability to make infrastructure improvements with those funds.  

“Many of our structures were built years ago for a single-ship government-built entity,” continued Russo. “Planning for building placement and meeting the needs of a multi-user spaceport — government and commercial —was not part of the vision. The concept of moving commercial customers into NASA facilities is a great idea when it comes to limiting the maintenance cost but it also creates a problem on how do you keep people that are not essential to a hazardous operation safe. Our buildings weren’t planned for housing a mixture of customers all doing separate hazardous operations, some even in the same building. In our effort to protect people, this challenge has driven us to re-evaluate our methods and approach to Explosives Safety.”

Kennedy’s method for identifying and managing explosives risks is determined on a case-by-case basis.

“At Kennedy, we examine each individual customer separately,” said Russo. “We strive to identify the Maximum Credible Event of the most credible risks. We use many tools to identify these factors. We use NASA-STD-8719.12 when we have the space, as it is very conservative. Sometimes operations or locality requires us to sharpen our pencils and we will utilize a risk-based program like IMESAFR. Our third option is to do deep dive studies where we team with outside agencies like ACTA and APT [Applied Predictive Technologies] to perform Monte Carlo simulations to calculate fragmentation directions, thermal and blast wave arcs, etc. We often combine several studies and methods to make a final determination. It’s all based on the risks presented.”

Because Kennedy is such a large center, it often can accommodate the QDs outlined in the NASA standard, but there are some areas, like within and near the Vehicle Assembly Building (VAB), where that’s just not possible. While Russo finds IMESAFR useful for areas at Kennedy like launch pads where explosions can be assessed without the context of walls, he finds using it for most operations cost prohibitive because the software was not designed for space applications like the complexity of the structures in the VAB and needs the custom data like Combs provides to get the level of data he needs to ensure safe operations. 

“With a COPV [Composite Overwrapped Pressure Vessel] or an explosion inside of a capsule that’s inside of a building, it gets more complicated,” explained Russo. “It goes through all these walls it [IMESAFR] can’t account for.”

When space is limited and too complex for the standard or IMESAFR, Kennedy turns to deep dives. In these studies, the center looks at everything from thermal blast waves and fragmentation to the acoustics and toxicities. The studies factor in information from the various companies and organizations responsible for the operations and all the structures present in the facility or vicinity. For the VAB, for example, Kennedy obtained all the details of the structure — down to specific beam and platform locations — built a 3D model of it, and then ran Monte Carlos and other studies to form a complete risk-based analysis for the operations. The result is a comprehensive analysis that shows everything from the percentage of glass breakage to the likelihood of other buildings being hit, the chances of one operation blowing up and hitting another, etc. The VAB alone took 11 different studies to evaluate. 

“These methods are not just beneficial, but essential to the success of our and our customers’ missions and for the protection of personnel and assets,” said Russo. “Each customer, be it government or commercial, presents different challenges, and if we are to be successful we need to be flexible in our approach to safety.”

Questions about how these centers handle risk management can be directed to Hallock, Combs and Russo, respectively.