Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 38
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report 3 SPENT FUEL POOL STORAGE This chapter addresses the first charge of the committee’s statement of task to assess “potential safety and security risks of spent nuclear fuel presently stored in cooling pools at commercial reactor sites.”1 As noted in Chapter 1, storage of spent fuel in pools at commercial reactor sites has three primary objectives: Cool the fuel to prevent heat-up to high temperatures from radioactive decay. Shield workers and the public from the radiation emitted by radioactive decay in the spent fuel and provide a barrier for any releases of radioactivity. Prevent criticality accidents. The first two of these objectives could be compromised by a terrorist attack that partially or completely drains the spent fuel pool.2 The committee will refer to such scenarios as “loss-of-pool-coolant” events. Such events could have several deleterious consequences; Most immediately, ionizing radiation levels in the spent fuel building rise as the water level in the pool falls. Once the water level drops to within a few feet (a meter or so) of the tops of the fuel racks, elevated radiation fields could prevent direct access to the immediate areas around the lip of the spent fuel pool building by workers. This might hamper but would not necessarily prevent the application of mitigative measures, such as deployment of fire hoses to replenish the water in the pool. The ability to remove decay heat from the spent fuel also would be reduced as the water level drops, especially when it drops below the tops of the fuel assemblies. This would cause temperatures in the fuel assemblies to rise, accelerating the oxidation of the zirconium alloy (zircaloy) cladding that encases the uranium oxide pellets. This oxidation reaction can occur in the presence of both air and steam and is strongly exothermic—that is, the reaction releases large quantities of heat, which can further raise cladding temperatures. The steam reaction also generates large quantities of hydrogen: Reaction in air: Zr+O2→ZrO2 heat released=1.2×107 joules/kilogram Reaction in steam: Zr+2H2O→ZrO2+2H2 heat released=5.8×106 joules/kilogram 1 A basic description of pool storage can be found in Chapter 1 and historical background can be found in Appendix D. Section 3.1 provides additional technical details about pool storage, 2 The committee could probably design configurations in which fuel might be deformed or relocated to enable its re-criticality, but the committee judges such an event to be unlikely. Also, the committee notes that while re-criticality would certainly be an undesirable outcome, criticality accidents have happened several times at locations around the world and have not been catastrophic offsite. An accompanying breach of the fuel cladding would still be the chief concern.
OCR for page 39
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report These oxidation reactions can become locally self-sustaining (i.e., autocatalytic3) at high temperatures (i.e., about a factor of 10 higher than the boiling point of water) if a supply of oxygen and/or steam is available to sustain the reactions. (These reactions will not occur when the spent fuel is under water because heat removal prevents such high temperatures from being reached). The result could be a runaway oxidation reaction—referred to in this report as a zirconium cladding fire—that proceeds as a burn front (e.g., as seen in a forest fire or a fireworks sparkler) along the axis of the fuel rod toward the source of oxidant (i.e., air or steam). The heat released from such fires can be even greater than the decay heat produced in newly discharged spent fuel. As fuel rod temperatures increase, the gas pressure inside the fuel rod increases and eventually can cause the cladding to balloon out and rupture. At higher temperatures (around 1800°C [approximately 3300°F]), zirconium cladding reacts with the uranium oxide fuel to form a complex molten phase containing zirconium-uranium oxide. Beginning with the cladding rupture, these events would result in the release of radioactive fission gases and some of the fuel’s radioactive material in the form of aerosols into the building that houses the spent fuel pool and possibly into the environment. If the heat from one burning assembly is not dissipated, the fire could spread to other spent fuel assemblies in the pool, producing a propagating zirconium cladding fire. The high-temperature reaction of zirconium and steam has been described quantitatively since at least the early 1960s (e.g., Baker and Just, 1962), The accident at the Three Mile Island Unit 2 reactor and a set of experiments (e.g., CORA, FPT 1–6, CODEX, ORNL-VI, VERCORS) have provided a basis for understanding the phenomena of zirconium cladding fires and fission-product releases from irradiated fuel in a reactor core accident. This understanding and data from the experiments form the foundation for computer simulations of severe accidents involving nuclear fuel. These experiments and computer simulations are for inside-reactor vessel events rather than events in an open-air spent fuel pool array. This chapter examines possible initiating factors for such loss-of-pool-coolant events and the potential consequences of such events. It is organized into the following four main sections: Background on spent fuel pool storage. Previous studies on safety and security of pool storage. Evaluation of the potential risks of pool storage. Findings and recommendations. 3 That is, the reaction heat will increase temperatures in adjacent areas of the fuel rod, which in turn will accelerate oxidation and release even more heat. Autocatalytic oxidation leading to a “runaway” reaction requires a complex balance of heat and mass transfer, so assigning a specific ignition temperature is not possible. Empirical equations have been developed to predict the reaction rate as a function of temperature when steam and oxygen supply are not limited (see, e.g., Tong and Weisman, 1996, p. 223). Numerous scaled experiments have found that the oxidation reaction proceeds very slowly below approximately 900°C (1700°F).
OCR for page 40
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report 3.1 BACKGROUND ON SPENT FUEL POOL STORAGE After a power reactor is shut down, its nuclear fuel continues to produce heat from radioactive decay (see FIGURE 1.2). Although only one-third of the fuel in the reactor core is replaced during each refueling cycle, operators commonly offload the entire core (especially at pressurized water reactors [PWRs]) into the pool during refueling4 to facilitate loading of fresh fuel or for inspection or repair of the reactor vessel and internals. Heat generation in the pool is at its highest point just after the full core has been offloaded. Pool heat loads can be quite high, as exemplified by a “typical” boiling water reactor (BWR) which was used in some of the analyses discussed elsewhere in this chapter (this BWR is hereafter referred to as the “reference BWR”). This pool has approximately 3800 locations for storage of spent fuel assemblies, about 3000 of which are occupied by four-and-one-third reactor cores (13 one-third-core offloads) in a pool approximately 35 feet wide, 40 feet long, and 39 feet deep (10.7 meters wide, 12.2 meters long, and 11.9 meters deep) with a water capacity of almost 400,000 gallons (1.51 million liters). According to Nuclear Regulatory Commission staff, the total decay heat in the spent fuel pool is 3.9 megawatts (MW) ten days after a one-third-core offload. The vast majority of this heat is from decay in the newly discharged spent fuel. Heat loads would be substantially higher in spent fuel pools that contained a full-core offload. Although spent fuel pools have a variety of designs, they share one common characteristic: Almost all spent fuel pools are located outside of the containment structure that holds the reactor pressure vessel.5 In some reactor designs, the spent fuel pools are contained within the reactor building,6 which is typically constructed of about 2 feet of reinforced concrete (see FIGURE 3.1). In other designs, however, one or more walls of the spent fuel pool may be located on the exterior wall of an auxiliary building that is located adjacent to the containment building (see FIGURE 3.2). As described in more detail below, some pools are built at or below grade, whereas others are located at the top of the reactor building. The enclosing superstructures above the pool are typically steel, industrial-type buildings designed to house cranes that are used to move reactor components, spent fuel, and spent fuel casks. These superstructures above the pool are designed to resist damage from seismic loads but not from large tomado-bome missiles (e.g., cars and telephone poles), which would usually impact the superstructures at low angles (i.e-, moving horizontally). In contrast the typical spent fuel pool is robust. The pool walls and the external walls of the building housing the pool (these external walls may incorporate one or more pool walls in some plants) are designed for seismic stability and to resist horizontal 4 A 1996 survey by the Nuclear Regulatory Commission (USNRC, 1996) found that the majority of commercial power reactors routinely offload their entire core to the spent fuel pool during refueling outages. The practice is more common among PWRs than BWRs, which tend to offload only that fuel that is to be replaced, but some BWRs do offload the full core. In response to a committee inquiry, an Energy Resources International staff member confirmed that this is still the case today. 5 The exceptions in the United States are the Mark III BWRs, which have two pools, one of which is inside the containment As discussed in Appendix C, spent fuel pools at German commercial nuclear power plants also are located inside reactor containment structures. 6 A PWR containment structure is a large, domed building that houses the reactor pressure vessel, the steam generators, and other equipment. In a BWR, the containment structure houses less equipment, is located closer in to the pressure vessel, and sits inside a building called the reactor building, which also houses the spent fuel pool and safety-related equipment to support the reactor.
OCR for page 41
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report FIGURE 3.1 Schematic section through a G.E.Mark I BWR reactor plant. The spent fuel pool is located in the reactor building well above ground level. This diagram is for a BWR with a reinforced concrete superstructure (roof). Most designs have thin steel superstructures, SOURCE: Lamarsh (1975, Figure 11.3). strikes of tomado missiles. The superstructures and pools were not, however, specifically designed to resist terrorist attacks. The typical spent fuel pool is about 40 feet (12 meters) deep and can be 40 or more feet (12 meters) in each horizontal dimension. The pool walls are constructed of reinforced concrete typically having a thickness between 4 and 8 feet (1.2 to 2.4 meters). The pools contain a ¼– to ½–inch-thick (6 to 13 mrn) stainless steel liner, which is attached to the walls with studs embedded in the concrete. The pools also contain vertical storage racks for holding spent and fresh fuel assemblies, and some pools have a gated compartment to hold a spent fuel storage cask while it is being loaded and sealed (see Chapter 4). The storage racks are about 13 feet (4 meters) in height and are installed near the bottom of the spent fuel pool. The racks have feet to provide space between their bottoms and the pool floor. There is also space between the sides of the rack and the steel pool liners for circulation of water (FIGURE 3.3), There are about 26 feet (8 meters) of water above the top of the spent fuel racks. This provides substantial radiation shielding even when an assembly is being moved above the rack. Transfers of spent fuel from the reactor core to the spent fuel pool or from the pool to storage casks are carried out underwater to provide shielding and cooling. The general elevation of the spent fuel pool matches that of the vessel containing the reactor core. Pressurized water reactor designs use comparatively shorter reactor
OCR for page 42
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report FIGURE 3.2 Schematic section through a PWR reactor plant. The spent fuel pool is located in the fuel-handling building next to the domed reactor containment building at or slightly below ground level, SOURCE: Modified from Duderstadt and Hamilton (1976, Figure 3–4). vessels closer to ground level (grade) and also have spent fuel pools that are close to grade (FIGURE 3.2). The design shown in this figure is typical of the fuel pool arrangement for PWRs, Nuclear power plant sites that contain two reactors are usually arranged in a mirror-image fashion, with the two spent fuel pools (or a shared pool) located in a common area adjoining both reactor buildings. For single-plant or two-plant arrangements, the building covering the spent fuel pool and crane structures is typically an ordinary steel industrial building. There are 69 PWRs currently in operation in the United States; 6 PWRs have been decommissioned but continue to have active spent fuel pool storage. In contrast, in boiling water reactor designs, the reactor vessel is at a higher elevation, and the BWR vessels are somewhat taller than PWR vessels,7 Consequently, BWRs have more elevated spent fuel pools, generally well above grade. FIGURE 3.1 shows the general design for the 22 BWR Mark I plants operating in the United States. Nuclear Regulatory Commission staff is conducting a survey of the plants to obtain a better understanding of the variations in design of spent fuel pools across the nation. The following information was provided to the committee from that survey: 7 The higher elevation accommodates control mechanisms that sit under the reactor, and the extra height accommodates steam separation and drying equipment at the top of the vessel. The fuel is about the same length as PWR fuel.
OCR for page 43
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report FIGURE 3.3 Example of a section of a PWR spent fuel pool and support facilities. The pool is located to the right in the figure; the support equipment to the left. SOURCE: American Nuclear Society (1988), PWR spent fuel pools: Spent fuel pools are located in buildings adjoining the reactor containment buildings at PWR plants (see FIGURE 3.2). Some pools are positioned such that their spent fuel is below grade. As shown in Figure 3.2, some pool walls also serve as the external walls of the spent fuel pool buildings. Some plants have structures surrounding the spent fuel pool building that would provide some shielding of the pools from low-angle line-of-sight attacks. A more complete plant survey would be needed to establish the extent of pool exposure to such attacks. BWR spent fuel pools: MARK I and II BWR plants are located above grade and are shielded by at least one exterior building wall. Some pools are also shielded by the reactor buildings. Some pools are also shielded by “significant” surrounding structures, and some have supplemental floor and column supports. The vulnerability of a spent fuel pool to terrorist attack depends in part on its location with respect to ground level as well as its construction. Pools are potentially susceptible to attacks from above or from the sides depending on their elevation with respect to grade and the presence of surrounding shielding structures. As noted in Chapter 1, nearly all pools contain high-density spent fuel racks. These racks allow approximately five times as many assemblies to be stored in the pool as would have been possible with the original racks, which had open lateral channels between the fuel assemblies to enhance water circulation.
OCR for page 44
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report 3.2 PREVIOUS STUDIES ON SAFETY AND SECURITY OF POOL STORAGE Several reports have been published on the safety of spent fuel pool storage. One of the earliest analyses was contained in the Reactor Safety Study (U.S. Atomic Energy Commission, 1975). which concluded that spent fuel pool safety risks were very much smaller than those involving the cores of nuclear reactors. This conclusion is not surprising: The cooling system in a spent fuel pool is simple. The coolant is at atmospheric pressure; the spent fuel is in a subcritical configuration and generates little heat relative to that generated in an operating reactor; and the design and location of piping in the pool make a severe loss-of-pool-coolant event unlikely during normal operating conditions. Despite changes in reactor and fuel storage operations, such as longer fuel residence times in the core and higher-density pool storage, the conclusions of that study are still broadly applicable today. It is important to recognize, however, that the Reactor Safety Study did not address the consequences of terrorist attacks. The Nuclear Regulatory Commission and its contractors have periodically reanalyzed the safety of spent nuclear fuel storage (see Benjamin et al., 1979; BNL, 1987, 1997; USNRC, 1983, 2001a, 2003b). All of these studies suggest that a loss-of-pool-coolant event could trigger a zirconium cladding fire in the exposed spent fuel. The Nuclear Regulatory Commission considered such an accident to be so unlikely that no specific action was warranted, despite changes in reactor operations that have resulted in increased fuel burn-ups and fuel storage operations that have resulted in more densely packed spent fuel pools, In 2001, the Nuclear Regulatory Commission published NUREG-1738, Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants, to provide a technical basis for rulemaking for power plant decommissioning (USNRC, 2001a). A draft of the study was issued for public comments, including comments by the Advisory Committee on Reactor Safeguards and a quality review of the methods, assumptions, and models used in the analysis was carried out by the Idaho National Engineering and Environmental Laboratory. The study provided a probabilistic risk assessment that identified severe accident scenarios and estimated their consequences. The analysis determined, for a given set of fuel characteristics, how much time would be required to boil off enough water to allow the fuel rods to reach temperatures sufficient to initiate a zirconium cladding fire. The analysis suggested that large earthquakes and drops of fuel casks from an overhead crane during transfer operations were the two event initiators that could lead to a loss-of-pool-coolant accident. For cases where active cooling (but not the coolant) has been lost, the thermal-hydraulic analyses suggested that operators would have about 100 hours (more than four days) to act before the fuel was uncovered sufficiently through boiling of cooling water in the pool to allow the fuel rods to ignite. This time was characterized as an “underestimate” given the simplifications assumed for the loss-of-pool-coolant scenario. The overall conclusion of the study was that the risk of a spent fuel pool accident leading to a zirconium cladding fire was low despite the large consequences because the predicted frequency of such accidents was very low. The study also concluded, however, that the consequences of a zirconium cladding fire in a spent fuel pool could be serious and, that once the fuel was uncovered, it might take only a few hours for the most recently discharged spent fuel rods to ignite.
OCR for page 45
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report A paper by Alvarez et al. (2003a; see also Thompson, 2003) took the analyses in NUREG-1738 to their logical ends in fight of the September 11, 2001, terrorist attacks: Namely, what would happen if there were a loss-of-pool-coolant event that drained the spent fuel pool? Such an event was not considered in NUREG-1738, but the analytical results in that study were presented in a manner that made such an analysis possible. Alvarez and his co-authors concluded that such an event would lead to the rapid heat-up of spent fuel in a dense-packed pool to temperatures at which the zirconium alloy cladding would catch fire and release many of the fuel’s fission products, particularly cesium-137. They suggested that the fire could spread to the older spent fuel, resulting in long-term contamination consequences that were worse than those from the Chemobyl accident. Citing two reports by Brookhaven National Laboratory (BNL, 1987, 1997), they estimated that between 10 and 100 percent of the cesium-137 could be mobilized in the plume from the burning spent fuel pool, which could cause tens of thousands of excess cancer deaths, loss of tens of thousands of square kilometers of land, and economic losses in the hundreds of billions of dollars. The excess cancer estimates were revised downward to between 2000 and 6000 cancer deaths in a subsequent paper (Beyea et at., 2004) that more accurately accounted for average population densities around U.S. power plants. Alvarez and his co-authors recommended that spent fuel be transferred to dry storage within five years of discharge from the reactor. They noted that this would reduce the radioactive inventories in spent fuel pools and allow the remaining fuel to be returned to open-rack storage to allow for more effective coolant circulation, should a loss-of-pool-coolant event occur. The authors also discussed other compensatory measures that could be taken to reduce the consequences of such events. The Alvarez et al. (2003a) paper received extensive attention and comments, including a comment from the Nuclear Regulatory Commission staff (USNRC, 2003a; see Alvarez et al., 2003b, for a response). None of the commentators challenged the main conclusion of the Alvarez et al. (2003a) paper that a severe loss-of-pool-coolant accident might lead to a spent fuel fire in a dense-packed pool. Rather, the commentators challenged the likelihood that such an event could occur through accident or sabotage, the assumptions used to calculate the offsite consequences of such an event, and the cost-effectiveness of the authors’ proposal to move spent fuel into dry cask storage. One commentator summarized these differences in a single sentence (Benjamin, 2003, p. 53): “In a nutshell, [Alvarez et al.] correctly identify a problem that needs to be addressed, but they do not adequately demonstrate that the proposed solution is cost-effective or that it is optimal.” The Nuclear Regulatory Commission staff provided a briefing to the committee that provides a further critique of the Alvarez et al. (2003a) analysis that goes beyond the USNRC (2003a) paper. Commission staff told the committee that the NUREG-1738 analyses attempted to provide a bounding analysis of current and conceivable future spent fuel pools at plants undergoing decommissioning and therefore relied on conservative assumptions. The analysis assumed, for example, that the pool contained an equivalent of three-and-one-half reactor cores of spent fuel, including the core from the most recent reactor cycle. The staff also asserted that NUREG-1738 did not provide a realistic analysis of consequences. Commission staff concluded that “the risks and potential societal cost of [a] terrorist attack on spent fuel pools do not justify the complex and costly measures
OCR for page 46
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report proposed in Alvarez et al. (2003) to move and store 1/3 of spent fuel pools [sic] inventory in dry storage casks,”8 The committee provides a discussion of the Alvarez et al. (2003a) analysts in its classified report. The committee judges that some of their release estimates should not be dismissed. The 2003 Nuclear Regulatory Commission (USNRC, 2003b) staff publication NUREG-0933, A Prioritization of Generic Safety Issues,9 discusses beyond-design-basis accidents in spent fuel pools. The study draws some of the same consequence conclusions as the Alvarez et al. (2003a) paper. It notes that in a dense-packed pool, a zirconium cladding fire “would probably spread to most or all of the spent fuel pool” (p. 1). This could drive what the report refers to as “borderline aged fuel” into a molten condition leading to the release of fission products comparable to molten fuel in a reactor core. The NUREG-0933 report (USNRC, 2003b) summarizes technical analyses of the frequencies of severe accidents for three BWR scenarios. The report concludes that the greatest risk is from a beyond-design-basis seismic event. While the consequences of such accidents are considerable, the report concludes that their frequencies are no greater than would be expected for reactor core damage accidents due to seismic events beyond the design basis safe shutdown earthquake. An analysis of spent fuel operating experience by the Nuclear Regulatory Commission staff (USNRC, 1997) showed that several accidental partial-loss-of-pool-coolant events have occurred as a result of human error. Two of these involved the loss of more than 5 feet of water from the pool, but none had serious consequences. Nevertheless, Commission staff suggested that plant-specific analyses and corrective actions should be taken to reduce the potential for such events in the future. It is important to recognize that with the exception of the Alvarez et al. (2003a) paper, all of the previous U.S. work reviewed by the committee has focused on safety risks, not security risks. The Nuclear Regulatory Commission analyses of spent fuel storage vulnerabilities were not completed by the time the committee finalized its information gathering for this report, but the committee did receive briefings on this work. In addition, analyses have been undertaken of external impacts on power plant structures by aircraft for the few commercial power plants that are located close enough to airports to consider hardening of the plant design to resist accidental aircraft crashes. These analyses were done as part of the plants’ licensing safety analyses. The committee did not look further into these few plants because the aircraft considered were smaller and the impact velocities considered were much lower than those that might be brought to bear in a well-planned terrorist attack. The committee did learn about work to assess the risks of spent fuel storage to terrorist attacks in Germany (see Appendix C for a description). However, the details of this work are classified by the German government and therefore are unavailable to the 8 The quote is from a PowerPoint presentation made by Nuclear Regulatory Commission staff to the committee at one of its meetings, 9 NUREG-0933 is a historical record that provides a yearly update of generic safety issues. It does not provide any additional technical analysis of these issues.
OCR for page 47
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report committee for review. Consequently, the committee was unable to provide a technical assessment. 3.3 EVALUATION OF THE POTENTIAL RISKS OF POOL STORAGE Prior to the September 11, 2001, terrorist attacks, spent fuel pool analyses by the Nuclear Regulatory Commission were focused almost exclusively on safety. On the basis of these analyses, the Commission concluded that spent fuel storage carried risks that were no greater (and likely much lower) than risks for operating nuclear reactors, as discussed in the previous section of this chapter. The September 11, 2001, terrorist attacks raised the possibility of a new kind of threat to commercial power plants and spent fuel storage: premeditated, carefully planned, high-impact attacks by terrorists to damage these facilities for the purpose of releasing radiation to the environment and spreading fear and panic among civilian populations. The Commission informed the committee that Its conclusions about risks of spent fuel storage are now being reevaluated in light of these new threats. Prior to September 11, the Nuclear Regulatory Commission viewed the most credible sabotage event as a violent external land assault by small groups of well-trained, heavily armed individuals aided by a knowledgeable insider.10 The Commission has long-established requirements for physical protection systems at power plants to thwart such assaults. The committee was told that these requirements have been increased since the September 11, 2001, attacks. To the committee’s knowledge, there are currently no requirements in place to defend against the kinds of larger-scale, premeditated, skillful attacks that were carried out on September 11, 2001, whether or not a commercial aircraft is involved. Staff from the Nuclear Regulatory Commission and representatives from the nuclear industry repeatedly told the committee that they view detecting, preventing, and thwarting such attacks as the federal government’s responsibility. It is important to recognize that nuclear power plants in the United States and most of the rest of the world11 were designed primarily with safety, not security, in mind.12 The reinforced concrete containment buildings that house the reactors were designed to contain internal pressures of up to about 4 atmospheres in case steam is released in the event of various hypothetical reactor accidents. These and other plant structures were not specifically designed to resist external terrorist attacks, although their robust construction would certainly provide significant protection against external assaults with airplanes or other types of weapons. Moreover, commercial power plants are substantially more robust than other critical infrastructure such as chemical plants, refineries, and fossil-fuel-fired electrical generating stations. 10 This is known as the “design basis threat” for radiological sabotage of nuclear power plants. See Chapter 2. 11 Spent fuel storage facilities in Germany are designed to survive the impact of a Phantom military jet without a significant release of radiation. Since September 11, 2001, the Germans have also examined the impact of a range of aircraft, including large civilian airliners, on these facilities, A discussion is provided in Appendix C. 12 No nuclear power plant ordered after the mid-1970s has been built in the United States, so the designs were developed long before domestic terrorism of the kind seen on September 11, 2001, became a concern.
OCR for page 48
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report In the wake of the September 11, 2001, attacks, a great deal of additional work has been or is being carried out by government and private entities to assess the security risks posed by terrorist attacks against nuclear power plants and spent fuel storage. The committee provides a discussion of these studies in the following subsections. Some of these studies are still in progress. The committee’s discussion of this work in the following subsections is organized around the following two questions: Could an accident or terrorist attack lead to a loss-of-pool-coolant event that would partially or completely drain a spent fuel pool? What would be the radioactive releases if a pool were drained? 3.3.1 Could a Terrorist Attack Lead to a Loss-of-Pool-Coolant Event? A terrorist attack that either disrupted the cooling system for the spent fuel pool or damaged or collapsed the pool itself could potentially lead to a loss-of-pool-coolant event. The cooling system could be disrupted by disabling or damaging the system that circulates water from the pool to heat exchangers to remove decay heat. This system would not likely be a primary target of a terrorist attack, but it could be damaged as the result of an attack on the spent fuel pool or other targets at the plant (e.g., the power for the pumps could be interrupted). The loss of cooling capacity would be of much greater concern were it to occur during or shortly after a reactor offloading operation, because the pool would contain a large amount of high decay-heat fuel. The consequences of a damaged cooling system would be quite predictable: The temperature of the pool water would rise until the pool began to boil. Steam produced by boiling would carry away heat, and the steam would cool as it expanded into the open space above the pool.13 Boiling would slowly consume the water in the pool, and if no additional water were added the pool level would drop. It would likely take several days of continuous boiling to uncover the fuel. Unless physical access to the pool were completely restricted (e.g., by high radiation fields or debris), there would likely be sufficient time to bring in auxiliary water supplies to keep the water level in the pool at safe levels until the cooling system could be repaired. This conclusion presumes, of course, that technical means, trained workers, and a sufficient water supply were available to implement such measures. The Nuclear Regulatory Commission requires that alternative sources of water be identified and available as an element of each plant’s operating license. The pool-boiling event described above could result in the release of small amounts of radionuclides that are normally present in pool water.14 These radionuclides would likely have little or no offsite impacts given their small concentrations in the steam and their subsequent dilution in air once released to the environment. Moreover, as long as the spent fuel is covered with a steam-water mixture, it would not heat up sufficiently for the cladding to ignite. A loss-of-pool-coolant event resulting from damage or collapse of the pool could 13 The building above the spent fuel pool contains blow-out panels that could be removed to provide additional ventilation. 14 This contamination may enter the water from damaged fuel or from neutron-activated materials that build up on the external surfaces of the fuel assemblies. The latter material is referred to as “crud.”
OCR for page 49
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report have more severe consequences. Severe damage of the pool wall could potentially result from several types of terrorist attacks, for instance: Attacks with large civilian aircraft, Attacks with high-energy weapons. Attacks with explosive charges. The committee reviewed two independent analyses of aircraft impacts on power plant structures: A study sponsored by EPRI completed in 2002 provides a generic analysis of civilian airliner impacts on commercial power plant structures (EPRI, 2002). A study in progress by Sandia National Laboratories for the Nuclear Regulatory Commission examines the consequences of an aircraft impact on an actual BWR power plant. The EPRI and Sandia analyses used different finite element and finite difference codes that are in common use in research and industry.15 Both sets of analyses attempted to validate the codes against physical tests, such as the Sandia “slug tests” that impacted water barrels into a concrete test wall at high speeds. EPRI’s analysis used a Riera impact loading condition, which models the aircraft impact on a rigid structure and is a slightly conservative assumption because the structures are in fact deformable. The Sandia analysis was carried out on powerful computers that allowed the aircraft to be included explicitly in the calculations. The committee also reviewed the preliminary results of Nuclear Regulatory Commission studies on the response of thick reinforced concrete walls such as those used in spent fuel pools to attacks involving simple explosive charges and other high-energy devices. The details of the analyses were not provided and therefore could not be evaluated quantitatively. However, some of these preliminary results are described in the committee’s classified report. The results of these aircraft and assault studies are classified or safeguards information. The committee has concluded that there are some scenarios that could lead to the partial failure of the spent fuel pool wall, thereby resulting in the partial or complete loss of pool coolant. A zirconium cladding fire could result if timely mitigative actions to cool the fuel were not taken. Details are provided in the classified report. 3.3.2 What would be the Radioactive Releases if a Pool Were Drained? There are two ways in which an attack on a spent fuel pool could spread radioactive contamination: mechanical dispersion and zirconium cladding fires. An explosion or high-energy impact directly on the spent fuel could mechanically pulverize and loft fuel out of the pool. This would contaminate the plant and surrounding site with pieces of spent fuel. Large- 15 The EPRI analyses used several finite element models (ABAQUS, LS DYNA, ANACAP, and WINFRITH) and Riera impact functions. The Sandia analyses used the CTH finite difference model and the Pronto3D finite element analysis model. The CTH code has been used for a wide range of impact penetration and explosive detonation problems by the Department of Energy, the Department of Defense, and industry during the past decade CTH results have been compared extensively with experimental results. As an Eulerian code (where material flows through a fixed grid) it can readily handle severe distortions. It also has a variety of computational material models for dynamic (high-strain-rate) conditions, although it is limited in that it does not explicitly model structural members, such as rebar and metal liners in the concrete structure, because of computational requirements.
OCR for page 50
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report scale offsite releases of the radioactive constituents would not occur, however, unless they were mobilized by a zirconium cladding fire that melted the fuel pellets and released some of their radionuclide inventory. Such fires would create thermal plumes that could potentially transport radioactive aerosols hundreds of miles downwind under appropriate atmospheric conditions. The Nuclear Regulatory Commission is now sponsoring work at Sandia National Laboratories to improve upon the analyses in NUREG-1738 (USNRC, 2001a), and in particular to obtain an improved phenomenological understanding of the thermal and hydraulic processes that would occur in a spent fuel pool from a loss-of-pool-coolant event. The committee received briefings on this work from Commission and Sandia staff during the course of this study. Additionally, the committee received a briefing from ENTERGY Corp. staff and its consultants under contract to analyze and understand the consequences of a loss-of-pool-coolant event in a spent fuel pool in a PWR plant. The Sandia analyses were carried out on the reference BWR described in Section 3.1. Sandia’s analysis of a PWR spent fuel pool had only just begun by the end of May 2004 and has not yet yielded any results. The committee had less opportunity to examine ENTERGY’s approach and results. Because of these limitations, the committee was unable to examine in any detail the effects of the differences between BWR and PWR pools and fuel, except as noted with respect to their locations relative to grade. The analyses were carried out using several well-established computer codes. The MELCOR code, which was developed by Sandia for use in analyzing severe reactor core accidents, was used to model fluid flow, heat transfer, fuel cladding oxidation kinetics, and fission product release phenomena associated with spent fuel assemblies. This code has been benchmarked against data from experiments (e.g., the FPT experiments on the Phébus test facility, and the VERCORS, CORA, and ORNL VI experiments)16 that involve zirconium oxidation kinetics and fission product release. However, none of the experiments was designed to simulate the physical conditions in a spent fuel pool. Many of the phenomena are not significantly different in a reactor core and in a spent fuel pool, but a few important differences, particularly concerning fire propagation from hotter fuel assemblies to cooler fuel assemblies and nuclear fuel volatilities, warrant more detailed analyses or further experiments. In principle, MELCOR can perform “best-estimate” calculations that address a range of accident evolutions, accounting for temperature, availability of oxidizing air and steam,17 and speciation and transport of radionuclides. Sandia calculated the decay heat in the assemblies using the ANSI/ANS 5.1 code based on actual characteristics of the spent fuel (i.e., actual fuel ages, burn-ups, and locations) in the reference BWR pool. Flow and mixing behavior in the pool and reactor building enclosing the pool were modeled using a separate computational fluid dynamics (CFD) code. Two types of analyses were carried out. A “separate effects” analysis was undertaken to examine the thermal responses of a spent fuel assembly (FIGURE 3.4) in a 16 These experiments were designed to examine phenomena that occur in reactor cores during severe accidents. The phenomena include core degradation. 17 Oxygen feeds the zirconium reaction and enhances release and transport of ruthenium-106, and the steam reaction releases hydrogen; whereas limited availability of oxygen starves the reaction. Steam can also entrain released fission products.
OCR for page 51
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report FIGURE 3.4 Configuration of fuel assemblies used for separate effects analysis, (A) Top view of BWR spent fuel assemblies used in the model. (B) Side view showing spent fuel assemblies in the pool. SOURCE: Nuclear Regulatory Commission briefing materials (2004).
OCR for page 52
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report FIGURE 3.5 Two configurations used in the separate effects models shown in FIGURE 3.4: (A) Center hot spent fuel assembly surrounded by four cold assemblies; and (B) center hot spent fuel assembly surrounded by four hot assemblies. SOURCE: Nuclear Regulatory Commission briefing materials (2004). loss-of-pool-coolant event. This analysis was used to understand how thermal behavior is influenced by factors such as decay heat in the fuel assembly, heat transfer with adjacent assemblies, and heat transfer to circulating air or steam in a drained spent fuel pool. This analysis was used to guide the development of “global response” models to examine the thermal-hydraulic behavior of an entire spent fuel pool. The separate effects analysis examined the thermal behavior of a high decay-heat BWR spent fuel assembly surrounded either by four low decay-heat assemblies (FIGURE 3.5A) or four high decay-heat assemblies (FIGURE 3.5B). This analysis showed that the potential for heat build-up in a fuel assembly sufficient to initiate a zirconium cladding fire depends on its decay heat (which is related to its age) and on the rate at which heat can be transferred to adjacent assemblies and to circulating air or steam.
OCR for page 53
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report In the configuration shown in FIGURE 3.5A, the low decay-heat assemblies act as thermal radiation heat sinks, thereby allowing the more rapid transfer of heat away from the center fuel assembly than would be the case if the center assembly were surrounded by high decay-heat assemblies. The results from this analysis indicate that this configuration can be air cooled sufficiently to prevent the initiation of a zirconium cladding fire within a relatively short time after the center fuel assembly is discharged from the reactor. In the configuration shown in FIGURE 3.5B, heat transfer away from the center assembly is reduced and heat build-up is more rapid. Results indicate that this configuration cannot be air cooled for a significantly longer time after the center fuel assembly is discharged from the reactor, The global analysis modeled the actual design and fuel loading pattern of the reference BWR spent fuel pool. The pool was divided into seven regions based on fuel age. Within each of those seven regions, the model for the fuel racks was subdivided into 16 zones. The grouping of assemblies into zones reduced the computational requirements compared to modeling every assembly.18 Two scenarios were examined: (1) a complete loss-of-pool-coolant scenario in which the pool is drained to a level below the bottom of spent fuel assemblies; and (2) a partial-loss-of-pool-coolant scenario in which water levels in the pool drain to a level somewhere between the top and bottom of the fuel assemblies. In the former case, a convective air circulation path can be established along the entire length of the fuel assemblies, which promotes convective air cooling of the fuel, in the latter case, an effective air circulation path cannot form because the bottom of the assembly is blocked by water. Steam is generated by boiling of the pool water, and the zirconium cladding oxidation reaction produces hydrogen gas. This analysis suggests that circulation blockage has a significant impact on thermal behavior of the fuel assemblies. The specific impact depends on the depth to which the pool is drained. The global analysis examined the thermal behavior of fuel assemblies in the pool at 1, 3, and 12 months after the offloading of one-third of a core of spent fuel from the reactor. Sensitivity studies were carried out to assess the importance of radiation heat transfer between different regions of the pool, the effects of building damage on releases of radioactive material to the environment, and the effects of varying the assumed location and size of the hole in the pool wall. The results of these analyses are provided in the committee’s classified report. For some scenarios, the fuel could be air cooled within a relatively short time after its removal from the reactor. If a loss-of-coolant event took place before the fuel could be air cooled, however, a zirconium cladding fire could be initiated if no mitigative actions were taken. Such fires could release some of the fuel’s radioactive material inventory to the environment in the form of aerosols. For a partial-loss-of-pool-coolant event, the analysis indicates that the potential for zirconium cladding fires would exist for an even greater time (compared to the complete-loss-of-pool-coolant event) after the spent fuel was discharged from the reactor because air circulation can be blocked by water at the bottom of the pool. Thermal coupling between adjacent assemblies will be due primarily to radiative rather than convective heat transfer. However, this heat transfer mode has been modeled simplistically in the MELCOR runs 18 The global-response model runs took between 10 and 12 days on the personal computers used in the Sandia analyses.
OCR for page 54
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report performed by Sandia.19 If the water level is above the top of the fuel racks, decay heat in the fuel could cause the pool water to boil. Once water levels fall below a certain level in the fuel assembly, the exposed portion of the fuel cladding might heat up sufficiently to ignite if no mitigative actions were taken. This could result in the release of a substantial fraction of the cesium inventory to the environment in the form of aerosols. A zirconium cladding fire in the presence of steam could generate hydrogen gas over the course of the event. The generation and transport of hydrogen gas in air was modeled in the Sandia calculations as was the deflagration of a hydrogen-air mixture in the closed building space above the spent fuel pool The deflagration of hydrogen could enhance the release of radioactive material in some scenarios. Sandia was just beginning to carry out a similar set of analyses for a “reference” PWR spent fuel pool when the committee completed information gathering for its classified report. There are reasons to believe that the results for a PWR pool could be somewhat different and possibly more severe, than for a BWR pool: PWR assemblies are larger, have somewhat higher burn-ups, and some assemblies sit directly over the rack feet, which may impede cooling. While PWR fuel assemblies hold more fuel, they also have more open channels within them for water circulation. The committee was told that as part of this work, a sensitivity analysis will be carried out to understand how design differences among U.S. PWRs will influence the model results. ENTERGY Corp. has carried out independent separate-effects modeling of a PWR spent fuel pool using the MELCOR code. The analyses addressed both partial and complete loss-of-pool-coolant events for its PWR spent fuel assemblies in a region of the pool where there are no water channels in the spent fuel racks. The analyses were made for relatively fresh spent fuel assemblies (i.e., separate models were run for assemblies that had been discharged from the reactor for 4, 30, and 90 days) surrounded by four “cold” assemblies that had been discharged for two years. In general, the ENTERGY results are similar to those from the Sandia separate-effects analyses mentioned above. Several steps could be taken to mitigate the effects of such loss-of-pool-coolant events short of removal of spent fuel from the pool. Among these are the following: The spent fuel assemblies in the pools can be reconfigured in a “checkerboard” pattern so that newer, higher decay-heat fuel elements are surrounded by older, lower decay-heat elements. The older elements will act as radiation heat sinks in the event of a coolant loss so that the fuel is air coolable within a short time of its discharge from the reactor. Alternatively, newly discharged fuel can be placed near the pool wall, which also acts as a heat sink. ENTERGY staff estimates that reconfiguring the fuel in one of its pools into a checkerboard pattern would take only about 10 hours of extra work, but would not extend a refueling outage. Reconfiguring of fuel already in the pool could be done at any time. It does not require a reactor outage. 19 In a reactor core accident, heat transfer by thermal radiation is not important because all of the fuel assemblies are at approximately the same temperature. Consequently, there is no net heat transfer between them. But spent fuel pools contain assemblies of different ages, burn-ups, and decay-heat production. The hotter assemblies will radiate heat to cooler assemblies.
OCR for page 55
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report If there is sufficient space in the pool, empty slots can also be arranged to promote natural air convection in a complete-loss-of-pool-coolant event. The cask loading area in some pools may serve this purpose if it is in communication with the rest of the pool. Preinstalled emergency water makeup systems in spent fuel pools would provide a mechanism to replace pool water in the event of a coolant loss. Preinstalled water spray systems above or within the pool could also be used to cool the fuel in a loss-of-pool-coolant event.20 The committee carried out a simple aggregate calculation suggesting that a water spray of about 50 to 60 gallons (about 190 to 225 liters) per minute for the whole pool would likely be adequate to prevent a zirconium cladding fire in a loss-of-pool-coolant event. A simple, low-pressure spray distribution experiment could verify what distribution of coolant would be sufficient to cool a spent fuel pool. Such a system would have to be designed to function even if the spent fuel pool or building were severely damaged in an attack.21 Limiting full-core offloads to situations when such offloads are required would reduce the decay heat load in the pool during routine refueling outages. Alternatively, delaying the offload of fuel to the pool after a reactor shutdown would reduce the decay-heat load in the pool. The walls of spent fuel pools could be reinforced to prevent damage that could lead to a loss-of-pool-coolant event. Security levels at the plant could be increased during outages that involve core offloads. Of course, damage to the pool and high radiation fields could make It difficult to take some of these mitigative measures. Multiple redundant and diverse measures may be required so that more than one remedy is available to mitigate a loss-of-pool-coolant event, especially when access to the pool is limited by damage or high radiation fields. Cost considerations might be significant, particularly for measures such as installing hardened spray systems and lengthening refueling outages, but the committee did not examine the costs of these measures. 3.3.3 Discussion The Sandia and ENTERGY analyses described in this chapter were still in progress when the committee completed its classified report. As noted previously, draft technical documents describing the work were not available at the time this study was being completed. Consequently, the committee’s understanding of these analyses is based on briefing materials (i.e., PowerPoint slides) presented before the committee by Nuclear 20 There is an extensive analytic and experimental experience base confirming that spray systems are effective in providing emergency core cooling in BWR reactor cores, which generate much more decay heat than spent fuel. Detailed experiments have shown that some minimum amount of water must be delivered on top of each assembly, and if that is provided, the assembly will be cooled adequately even if there is significant blockage of the cooling channels. 21 ENTERGY staff mentioned the possible use of a specially equipped fire engine to provide spray cooling. The committee does not know whether this would deliver sufficient spray cooling where it is needed or would provide sufficient protection if terrorists are attempting to prevent emergency response, but the strategy is worth further examination.
OCR for page 56
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report Regulatory Commission and ENTERGY staff and consultants, discussions with these experts, and the committee’s own expert judgment, The committee judges that these analyses provide a start for understanding the behavior of spent fuel pools in severe environments. The analyses were carried out by qualified experts using well-known analytical methods and engineering codes to model system behaviors. Although this is a start, the analyses have important limitations. The aircraft attack scenarios consider one type of aircraft. Heavier aircraft could be used in such attacks. These planes are in common use in passenger and/or cargo operations, and some of these planes can be chartered. Equally limiting assumptions were made in the analyses of spent fuel pool thermal behavior. To make the analysis tractable, it was assumed that the fuel in the pool was in an undamaged condition when the loss-of-pool-coolant event occurred. This is not necessarily a valid assumption. Whether such damage would change the outcome of the analyses described in this chapter is unknown. Simplistic modeling assumptions were made about the fuel assembly geometry (e.g., individual fuel bundles were not modeled in the global effects calculation), convective cooling flow paths and mechanisms, thermal radiation heat transfer, propagation of cladding fires to low-power bundles, and radioactivity release mechanisms. In addition, flow blockage due to fission-gas-induced clad ballooning22 was not considered. The thermal analysis experts on the committee judge that these simplistic assumptions could produce results that are more severe (i.e., overconservative) than would be the case had more realistic assumptions been used. More sophisticated models, which involve clad ballooning and detailed thermal-hydraulics, including radiative heat transfer, have been developed for the analysis of severe in-core accidents. These models can be evaluated using more powerful computers. MELCOR appears to have sufficient capability to evaluate more sophisticated models of the spent fuel pool and Sandia has access to large, sophisticated computers. State-of-the-art calculations of this type are needed for the analysis of spent fuel pools so that more informed regulatory decisions can be made. The analyses also do not consider the possibility of an attack that ejects spent fuel from the pool. The ejection of freshly discharged spent fuel from the pool might lead to a zirconium cladding fire if immediate mitigative actions could not be taken. The application of such measures could be hindered by the high radiation fields around the fuel. While the committee judges that some attacks involving aircraft would be feasible to carry out, it can provide no assessment of the probability of such attacks. Nevertheless, analyzing their consequences is useful for informing policy decisions on steps to be taken to protect these facilities from terrorist attack. 22 If a fuel rod reaches relatively high temperatures, the gases inside can cause the cladding to balloon out, restricting and even blocking coolant flow through the spaces between the rods within the assembly.
OCR for page 57
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report 3.4 FINDINGS AND RECOMMENDATIONS Based on its review of spent fuel pool risks, the committee offers the following findings and recommendations. FINDING 3A: Pool storage is required at all operating commercial nuclear power plants to cool newly discharged spent fuel. Operating nuclear power plants typically discharge about one-third of a reactor core of spent fuel every 18–24 months. Additionally, the entire reactor core may be placed into the spent fuel pool (offloaded) during outage periods for refueling. The analyses of spent fuel thermal behavior described in this chapter demonstrate that freshly discharged spent fuel generates too much decay heat to be passively air cooled. The Nuclear Regulatory Commission requires that this fuel be stored in a pool that has an active heat removal system (i.e,, water pumps and heat exchangers) for at least one year as a safety matter. Current design practices for approved dry storage systems require five years’ minimum decay in spent fuel pools. Although spent fuel younger than five years could be stored in dry casks, the changes required for shielding and heat removal could be substantial, especially for fuel that has been discharged for less than about three years. FINDING 3B: The committee finds that, under some conditions, a terrorist attack that partially or completely drained a spent fuel pool could lead to a propagating zirconium cladding fire and the release of large quantities of radioactive materials to the environment Details are provided in the committee’s classified report. It is not possible to predict the precise magnitude of such releases because the computer models have not been validated for this application. FINDING 3C: It appears to be feasible to reduce the likelihood of a zirconium cladding fire following a loss-of-pool-coolant event using readily implemented measures. There appear to be some measures that could be taken to mitigate the risks of spent fuel zirconium cladding fires in a loss-of-pool-coolant event. The following measures appear to have particular merit. Reconfiguring of spent fuel in the pools (i.e., redistribution of high decay-heat assemblies so that they are surrounded by low decay-heat assemblies) to more evenly distribute decay-heat loads. The analyses described elsewhere in this chapter suggest that the potential for zirconium cladding fires can be reduced substantially by surrounding freshly discharged spent fuel assemblies with older spent fuel assemblies in “checkerboard” pattems. The analyses suggest that such arrangements might even be more effective for reducing the potential for zirconium cladding fires than removing this older spent fuel from the pools. However, these advantages have not been demonstrated unequivocally by modeling and experiments. Limiting the frequency of offloads of full cores into spent fuel pools, requiring longer shutdowns of the reactor before any fuel is offloaded to allow decay-heat levels to be managed, and providing enhanced security when such offloads must
OCR for page 58
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report be made. The offloading of the reactor core into the spent fuel pool during reactor outages substantially raises the decay-heat load of the pool and increases the risk of a zirconium cladding fire in a loss-of-pool-coolant event. Of course, any actions that increase the time a power reactor is shut down incur costs, which must be considered in cost-benefit analyses of possible actions to reduce risks. Development of a redundant and diverse response system to mitigate loss-of-pool-coolant events. Any mitigation system, such as a spray cooling system, must be capable of operation even when the pool is drained (which would result in high radiation fields and limit worker access to the pool) and the pool or overlying building, including equipment attached to the roof or walls, is severely damaged. FINDING 3D: The potential vulnerabilities of spent fuel pools to terrorist attacks are plant-design specific. Therefore, specific vulnerabilities can be understood only by examining the characteristics of spent fuel storage at each plant. As described in the classified report, there are substantial differences in the design of PWR and BWR spent fuel pools. PWR pools tend to be located near or below grade, whereas BWR pools typically are located well above grade but are protected by exterior walls and other structures. In addition, there are plant-specific differences among BWRs and PWRs that could increase or decrease the vulnerabilities of the pools to various kinds of terrorist attacks, making generic conclusions difficult. FINDING 3E: The Nuclear Regulatory Commission and independent analysts have made progress in understanding some vulnerabilities of spent fuel pools to certain terrorist attacks and the consequences of such attacks for releases of radioactivity to the environment. However, additional work on specific issues listed in the following recommendation is needed urgently. The analyses carried out to date for the Nuclear Regulatory Commission by Sandia National Laboratories and by other independent organizations such as EPRI and ENTERGY have provided a general understanding of spent fuel behavior in a loss-of-pool-coolant event and the vulnerability of spent fuel pools to certain terrorist attacks that could cause such events to occur. The work to date, however, has not been sufficient to adequately understand the vulnerabilities and consequences. This work has addressed a small number of plant designs that may not be representative of U.S. commercial nuclear power plants as a whole. It has considered only a limited number of threat scenarios that may underestimate the damage that can be inflicted on the pools by determined terrorists. Additional analyses are needed urgently to fill in the knowledge gaps so that well-informed policy decisions can be made. RECOMMENDATION: The Nuclear Regulatory Commission should undertake additional best-estimate analyses to more fully understand the vulnerabilities and consequences of loss-of-pool-coolant events that could lead to a zirconium cladding fire. Based on these analyses, the Commission should take appropriate actions to address any significant vulnerabilities that are identified. The analyses of the BWR and PWR spent fuel pools should be extended to consider the consequences of loss-of-pool-coolant events that are described in the committee’s classified report.
OCR for page 59
Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report The consequence analyses should address the following questions: To what extent would such attacks damage the spent fuel in the pool, and what would be the thermal consequences of such damage? Is it feasible to reconfigure the spent fuel within pools to prevent zirconium cladding fires given the actual characteristics (i.e., heat generation) of spent fuel assemblies in the pool, even if the fuel were damaged in an attack? Is there enough space in the pools at all commercial reactor sites to implement such fuel reconfiguration? In the event of a localized zirconium cladding fire, will such rearrangement prevent its spread to the rest of the pool? How much spray cooling is needed to prevent zirconium cladding fires and prevent propagation of such fires? Which of the different options for providing spray cooling are effective under attack and accident conditions? Sensitivity analyses should also be undertaken to account for the full range of variation in spent fuel pool designs (e.g., rack designs, capacities, spent fuel burn-ups, and ages) at U.S. commercial nuclear power plants. RECOMMENDATION: While the work described in the previous recommendation under Finding 3E, above, is being carried out, the Nuclear Regulatory Commission should ensure that power plant operators take prompt and effective measures to reduce the consequences of loss-of-pool-coolant events in spent fuel pools that could result in propagating zirconium cladding fires. The committee judges that there are at least two such measures that should be implemented promptly: Reconfiguring of fuel in the pools so that high decay-heat fuel assemblies are surrounded by low decay-heat assemblies. This will more evenly distribute decay-heat loads, thus enhancing radiative heat transfer in the event of a loss of pool coolant. Provision for water-spray systems that would be able to cool the fuel even if the pool or overlying building were severely damaged. Reconfiguring of fuel in the pool would be a prudent measure that could probably be implemented at all plants at little cost, time, or exposure of workers to radiation. The second measure would probably be more expensive to implement and may not be needed at all plants, particularly plants in which spent fuel pools are located below grade or are protected from external line-of-sight attacks by exterior walls and other structures. The committee anticipates that the costs and benefits of options for implementing the second measure would be examined to help decide what requirements would be imposed. Further, the committee does not presume to anticipate the best design of such a system—whether it should be installed on the walls of a pool or deployed from a location where it is unlikely to be compromised by the same attack—but simply notes the demanding requirements such a system must meet.
Representative terms from entire chapter: