ASRG life certification: 17-year reliability for dynamic space power

The claim

The Rusick and Zampino paper from NETS 2013 presents the Advanced Stirling Radioisotope Generator (ASRG) life certification plan developed at NASA Glenn Research Center.¹ The central claim is that certifying a dynamic power supply with moving mechanical components for a 17-year operational life requires a fundamentally different approach than certifying a passive system like the Multi-Mission Radioisotope Thermoelectric Generator (MMRTG). The ASRG, being developed by the Department of Energy in partnership with NASA, uses a free-piston Stirling engine to convert heat from a radioisotope source into electricity. Unlike the thermoelectric elements in an MMRTG, which have no moving parts, the Stirling engine has oscillating pistons, flexures, and dynamic seals whose long-term reliability cannot be fully predicted by analysis alone.

The plan therefore emphasizes long-term Stirling engine testing and inspection as the primary certification path, explicitly noting that analysis is relied upon only where it is practical and where long-term test is not.¹ This is a significant methodological commitment: it means that certification confidence is built on accumulated test hours, not on model extrapolation. The 17-year life requirement sets the duration over which this confidence must be established, and the dynamic nature of the Stirling engine sets the depth of testing needed.

How it works

The ASRG converts heat from a plutonium-238 radioisotope heat source into electricity using a free-piston Stirling engine. The Stirling cycle uses a working gas (helium) that is alternately heated and cooled to drive a piston, which in turn drives a linear alternator. The free-piston design eliminates crankshafts and most sliding contacts, relying on gas bearings and flexure springs to maintain piston alignment without lubrication. This is the key reliability feature: no rubbing or sliding wear surfaces in the traditional sense. But the system still has moving components that oscillate at the engine's resonant frequency (tens of Hz), and those components have long-term failure modes that include flexure fatigue, gas leakage past seals, contamination of the working gas, and degradation of the alternator insulation.

The life certification plan addresses these failure modes by building a test program that accumulates operating hours on Stirling engines under representative conditions, combined with periodic inspection of critical components.¹ The emphasis on testing over analysis reflects the practical limit of analytical models: while you can model flexure fatigue life with reasonable confidence given material properties and stress levels, you cannot fully model the cumulative effect of 17 years of continuous operation on a complex mechanical system with interacting failure modes. The plan's authors explicitly state that the approach prioritizes long-term test and inspection where analysis is not practical, which is an admission that the certification problem is partly empirical, not purely analytical.

The 17-year life requirement is driven by mission needs. Deep-space missions to the outer planets or their moons can take a decade or more to reach their destinations, and science operations at the destination may last years. A radioisotope power source must operate continuously from launch through end of mission, with no opportunity for repair or maintenance. This sets a reliability bar that no ground-based power system is held to: 17 years of unattended, continuous, full-power operation with zero maintenance interventions.

Steelman: the best case for the test-based certification approach

The strongest argument for the Rusick-Zampino approach is that it is honest about the limits of analysis. Dynamic systems with interacting mechanical failure modes have failure distributions that are notoriously difficult to extrapolate from short-duration tests. A flexure spring that passes a 1,000-hour bench test might fail at 15 years due to fatigue accumulation that is within the model's uncertainty band but outside its confidence interval. The only way to establish "full confidence in reliable function over mission life," which is the stated goal of the plan,¹ is to accumulate test hours that approach the mission duration, combined with teardown inspection of aged components to characterize the actual degradation modes that the models may not capture.

This approach has a precedent advantage. The MMRTG, which is a passive thermoelectric system, is certified largely by analysis and material heritage because the degradation modes (thermoelectric couple performance decline, structural aging) are slower and better modeled. The ASRG cannot inherit this approach because its failure modes are dynamic and wear-driven. By committing to long-term testing, the ASRG plan builds an empirical basis that a purely analytical certification could not provide. The plan also has a strategic value: if the test program uncovers a failure mode at, say, year 5 of testing, there is still time to redesign before committing to a flight unit. Analysis-only certification would discover the same failure mode only in flight, which is too late.

Skeptic: where the approach is tested by reality

The fundamental skepticism is time. A 17-year life certification that relies on long-term testing faces a schedule problem: if you need 17 years of test data to certify a 17-year life, the certification clock and the mission clock run at the same speed. The plan does not claim that 17 full years of testing are required before flight, but it does commit to an approach where test hours are the primary evidence. This means that early missions using the ASRG will fly with partial test evidence, with certification confidence built on a combination of test hours accumulated to date and analytical extrapolation of remaining life. The transition point between "test-supported certification" and "analysis-supported certification" is not fully specified in the available source material, and it represents the key risk boundary.

A second skepticism is that the ASRG program itself was restructured. The ASRG flight project was cancelled by NASA in 2013, the same year as the NETS paper, in favor of continued MMRTG production. This means the life certification plan as described in the Rusick-Zampino paper was not carried through to completion on a flight program. The test methodology and failure mode characterization work that the plan describes has scientific and engineering value, and it informs subsequent Stirling space power work, but the specific 17-year certification evidence for a flight ASRG was never fully accumulated. This is a program status fact, not a criticism of the technical approach, but it means that the plan should be read as a methodology paper for dynamic power system certification, not as a certification record for a fielded system. TRL framing: the ASRG Stirling converter reached TRL 5 to 6 (component testing in relevant environment) before program cancellation; the life certification methodology is at TRL 6 as an approach but was not demonstrated through to a flight-certified system.

What it means for power in space

Implication: The non-obvious implication is that dynamic power conversion, which offers higher efficiency than passive thermoelectric conversion (Stirling converters can exceed 30 percent conversion efficiency at the alternator output boundary, compared to roughly 6 to 7 percent for MMRTG thermoelectric couples), carries a certification cost that is paid in calendar time, not just in test budget. A program that chooses a dynamic converter is committing to a multi-year test program before flight, and this schedule cost must be factored into mission planning alongside the mass and efficiency benefits. The efficiency advantage is real, but it is purchased with certification risk and schedule.

Threat: The genuine threat is that the test-based certification approach creates a schedule dependency that can become a program-ending constraint. If the certification test program discovers a failure mode late in the test cycle, the redesign-and-retest loop can add years to the development schedule. For a mission with a fixed launch window (driven by planetary alignment), a certification delay can push the mission past its launch opportunity, which is effectively a mission cancellation. The ASRG's own cancellation in 2013 is a case study in how program-level decisions can override a technically sound certification plan.

Opportunity: The opportunity is to build a reusable Stirling converter certification infrastructure. If the long-term test stands, inspection protocols, and failure mode characterization work from the ASRG program are preserved and continued across programs, the certification clock for the next dynamic space power system (whether a new Stirling radioisotope generator or a fission-driven Stirling converter) does not start from zero. The accumulated test hours and failure mode database become a national asset that reduces the certification time for future systems. This is the argument for maintaining test infrastructure even when a specific flight program is cancelled.¹

Bottom line

The Rusick-Zampino life certification plan correctly identifies the core problem: certifying a dynamic power supply for 17 years of unattended operation requires long-term testing because analytical models cannot fully capture the interacting wear and degradation modes of a Stirling engine.¹ The plan's emphasis on test and inspection over analysis where analysis is not practical is methodologically sound and is the right approach for a system with this failure mode profile. The hard reality is that the ASRG flight program was cancelled in 2013, so the plan was not executed through to a flight-certified system. The value of the paper is as a methodology reference for future dynamic space power certification, not as a certification record for a fielded generator. Programs pursuing Stirling or other dynamic conversion for space power should read this paper as the starting point for their own certification planning, with the explicit understanding that the test-time schedule cost is a first-order program constraint, not a secondary detail. Efficiency claims for Stirling converters (30-plus percent at the alternator output) are measured at the converter boundary and do not include the system-level losses, mass of the conversion electronics, or the radioisotope heat source mass, so system-level specific power comparisons with MMRTG require full system mass accounting, not converter-only efficiency comparisons.