3.2 PREVIOUS STUDIES ON SAFETY AND SECURITY OF POOL STORAGE
Several reports have been published on the safety of spent fuel pool storage. One of the earliest analyses was contained in the Reactor Safety Study (U.S. Atomic Energy Commission, 1975). which concluded that spent fuel pool safety risks were very much smaller than those involving the cores of nuclear reactors. This conclusion is not surprising: The cooling system in a spent fuel pool is simple. The coolant is at atmospheric pressure; the spent fuel is in a subcritical configuration and generates little heat relative to that generated in an operating reactor; and the design and location of piping in the pool make a severe loss-of-pool-coolant event unlikely during normal operating conditions. Despite changes in reactor and fuel storage operations, such as longer fuel residence times in the core and higher-density pool storage, the conclusions of that study are still broadly applicable today. It is important to recognize, however, that the Reactor Safety Study did not address the consequences of terrorist attacks.
The Nuclear Regulatory Commission and its contractors have periodically reanalyzed the safety of spent nuclear fuel storage (see Benjamin et al., 1979; BNL, 1987, 1997; USNRC, 1983, 2001a, 2003b). All of these studies suggest that a loss-of-pool-coolant event could trigger a zirconium cladding fire in the exposed spent fuel. The Nuclear Regulatory Commission considered such an accident to be so unlikely that no specific action was warranted, despite changes in reactor operations that have resulted in increased fuel burn-ups and fuel storage operations that have resulted in more densely packed spent fuel pools,
In 2001, the Nuclear Regulatory Commission published NUREG-1738, Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants, to provide a technical basis for rulemaking for power plant decommissioning (USNRC, 2001a). A draft of the study was issued for public comments, including comments by the Advisory Committee on Reactor Safeguards and a quality review of the methods, assumptions, and models used in the analysis was carried out by the Idaho National Engineering and Environmental Laboratory.
The study provided a probabilistic risk assessment that identified severe accident scenarios and estimated their consequences. The analysis determined, for a given set of fuel characteristics, how much time would be required to boil off enough water to allow the fuel rods to reach temperatures sufficient to initiate a zirconium cladding fire.
The analysis suggested that large earthquakes and drops of fuel casks from an overhead crane during transfer operations were the two event initiators that could lead to a loss-of-pool-coolant accident. For cases where active cooling (but not the coolant) has been lost, the thermal-hydraulic analyses suggested that operators would have about 100 hours (more than four days) to act before the fuel was uncovered sufficiently through boiling of cooling water in the pool to allow the fuel rods to ignite. This time was characterized as an “underestimate” given the simplifications assumed for the loss-of-pool-coolant scenario.
The overall conclusion of the study was that the risk of a spent fuel pool accident leading to a zirconium cladding fire was low despite the large consequences because the predicted frequency of such accidents was very low. The study also concluded, however, that the consequences of a zirconium cladding fire in a spent fuel pool could be serious and, that once the fuel was uncovered, it might take only a few hours for the most recently discharged spent fuel rods to ignite.
A paper by Alvarez et al. (2003a; see also Thompson, 2003) took the analyses in NUREG-1738 to their logical ends in fight of the September 11, 2001, terrorist attacks: Namely, what would happen if there were a loss-of-pool-coolant event that drained the spent fuel pool? Such an event was not considered in NUREG-1738, but the analytical results in that study were presented in a manner that made such an analysis possible.
Alvarez and his co-authors concluded that such an event would lead to the rapid heat-up of spent fuel in a dense-packed pool to temperatures at which the zirconium alloy cladding would catch fire and release many of the fuel’s fission products, particularly cesium-137. They suggested that the fire could spread to the older spent fuel, resulting in long-term contamination consequences that were worse than those from the Chemobyl accident. Citing two reports by Brookhaven National Laboratory (BNL, 1987, 1997), they estimated that between 10 and 100 percent of the cesium-137 could be mobilized in the plume from the burning spent fuel pool, which could cause tens of thousands of excess cancer deaths, loss of tens of thousands of square kilometers of land, and economic losses in the hundreds of billions of dollars. The excess cancer estimates were revised downward to between 2000 and 6000 cancer deaths in a subsequent paper (Beyea et at., 2004) that more accurately accounted for average population densities around U.S. power plants.
Alvarez and his co-authors recommended that spent fuel be transferred to dry storage within five years of discharge from the reactor. They noted that this would reduce the radioactive inventories in spent fuel pools and allow the remaining fuel to be returned to open-rack storage to allow for more effective coolant circulation, should a loss-of-pool-coolant event occur. The authors also discussed other compensatory measures that could be taken to reduce the consequences of such events.
The Alvarez et al. (2003a) paper received extensive attention and comments, including a comment from the Nuclear Regulatory Commission staff (USNRC, 2003a; see Alvarez et al., 2003b, for a response). None of the commentators challenged the main conclusion of the Alvarez et al. (2003a) paper that a severe loss-of-pool-coolant accident might lead to a spent fuel fire in a dense-packed pool. Rather, the commentators challenged the likelihood that such an event could occur through accident or sabotage, the assumptions used to calculate the offsite consequences of such an event, and the cost-effectiveness of the authors’ proposal to move spent fuel into dry cask storage. One commentator summarized these differences in a single sentence (Benjamin, 2003, p. 53): “In a nutshell, [Alvarez et al.] correctly identify a problem that needs to be addressed, but they do not adequately demonstrate that the proposed solution is cost-effective or that it is optimal.”
The Nuclear Regulatory Commission staff provided a briefing to the committee that provides a further critique of the Alvarez et al. (2003a) analysis that goes beyond the USNRC (2003a) paper. Commission staff told the committee that the NUREG-1738 analyses attempted to provide a bounding analysis of current and conceivable future spent fuel pools at plants undergoing decommissioning and therefore relied on conservative assumptions. The analysis assumed, for example, that the pool contained an equivalent of three-and-one-half reactor cores of spent fuel, including the core from the most recent reactor cycle. The staff also asserted that NUREG-1738 did not provide a realistic analysis of consequences. Commission staff concluded that “the risks and potential societal cost of [a] terrorist attack on spent fuel pools do not justify the complex and costly measures
proposed in Alvarez et al. (2003) to move and store 1/3 of spent fuel pools [sic] inventory in dry storage casks,”8
The committee provides a discussion of the Alvarez et al. (2003a) analysts in its classified report. The committee judges that some of their release estimates should not be dismissed.
The 2003 Nuclear Regulatory Commission (USNRC, 2003b) staff publication NUREG-0933, A Prioritization of Generic Safety Issues,9 discusses beyond-design-basis accidents in spent fuel pools. The study draws some of the same consequence conclusions as the Alvarez et al. (2003a) paper. It notes that in a dense-packed pool, a zirconium cladding fire “would probably spread to most or all of the spent fuel pool” (p. 1). This could drive what the report refers to as “borderline aged fuel” into a molten condition leading to the release of fission products comparable to molten fuel in a reactor core.
The NUREG-0933 report (USNRC, 2003b) summarizes technical analyses of the frequencies of severe accidents for three BWR scenarios. The report concludes that the greatest risk is from a beyond-design-basis seismic event. While the consequences of such accidents are considerable, the report concludes that their frequencies are no greater than would be expected for reactor core damage accidents due to seismic events beyond the design basis safe shutdown earthquake.
An analysis of spent fuel operating experience by the Nuclear Regulatory Commission staff (USNRC, 1997) showed that several accidental partial-loss-of-pool-coolant events have occurred as a result of human error. Two of these involved the loss of more than 5 feet of water from the pool, but none had serious consequences. Nevertheless, Commission staff suggested that plant-specific analyses and corrective actions should be taken to reduce the potential for such events in the future.
It is important to recognize that with the exception of the Alvarez et al. (2003a) paper, all of the previous U.S. work reviewed by the committee has focused on safety risks, not security risks. The Nuclear Regulatory Commission analyses of spent fuel storage vulnerabilities were not completed by the time the committee finalized its information gathering for this report, but the committee did receive briefings on this work. In addition, analyses have been undertaken of external impacts on power plant structures by aircraft for the few commercial power plants that are located close enough to airports to consider hardening of the plant design to resist accidental aircraft crashes. These analyses were done as part of the plants’ licensing safety analyses. The committee did not look further into these few plants because the aircraft considered were smaller and the impact velocities considered were much lower than those that might be brought to bear in a well-planned terrorist attack.
The committee did learn about work to assess the risks of spent fuel storage to terrorist attacks in Germany (see Appendix C for a description). However, the details of this work are classified by the German government and therefore are unavailable to the