Preface. Nuclear cheerleaders love to talk about how safe nuclear power is.  You will never ever hear them talk about nuclear fuel pools because that would destroy their argument. Though like Limits to Growth and Malthusian overpopulation dismissed by capitalists, they would probably use the same “it hasn’t happened so it will never happen”.

2017-5-25. US nuclear regulators greatly underestimate potential for nuclear disaster. Nuclear spent fuel fire could force millions of people to relocate. Princeton University, Woodrow Wilson School of Public and International Affairs, and Frank Von Hippel, Michael Schoeppner and Edwin Lyman. Nuclear safety regulation in the post-Fukushima era. Science, 2017

The US Nuclear Regulatory Commission relied on faulty analysis to justify its refusal to adopt a critical measure for protecting Americans from nuclear-waste fires at dozens of reactor sites around the country. Radioactivity from such a fire could force approximately 8 million people to relocate and result in $2 trillion in damages.

Below are excerpts from two articles in Science magazine and the  report in 2016 by the National Research Council (NRC) “Lessons Learned from the Fukushima Nuclear Accident for Improving Safety and Security of U.S. Nuclear Plants: Phase 2” in which it was learned that:

If electric power were out 12 to 31 days (depending on how hot the stored fuel was), the fuel from the reactor core cooling down in a nearby nuclear spent fuel pool could catch on fire and cause millions of flee from thousands of square miles of contaminated land, because these pools aren’t in a containment vessel.

If the electric grid power fails, backup diesel generators can provide power for 7 days without resupply of diesel fuel under typical nuclear plant emergency plans. If emergency diesel generators stop working, nuclear power plants are only required to have “alternate ac sources” available for a period of 2 to 16 hours. Once electric power is no longer supplied to circulation pumps, the spent fuel pool would begin to heat up and boil off.  It would only take 4 to 22 days from when water was no longer cooling the fuel to ignite the zirconium cladding within 2 to 24 hours (depending on how much the fuel had decayed). Without more water being added to the spent fuel pool, the total time from grid outage to spontaneous zirconium ignition would likely be 12-31 days (NIRS).

The National Research Council estimated that if a spent nuclear fuel fire happened at the Peach Bottom nuclear power plant in Pennsylvania, nearly 3.5 million people would need to be evacuated and 12 thousand square miles of land would be contaminated.  A Princeton University study that looked at the same scenario concluded it was more likely that 18 million people would need to evacuated and 39,000 square miles of land contaminated.

In the worst case, nearly all of U.S. reactors would be involved if there were a nuclear bomb generated electromagnetic pulse, which could take the electric grid down for a year or more (see U.S. House hearing testimony of Dr. Pry at The EMP Commission estimates a nationwide blackout lasting one year could kill up to 9 of 10 Americans through starvation, disease, and societal collapse.  At this hearing, Dr. Pry said “Seven days after the commencement of blackout, emergency generators at nuclear reactors would run out of fuel. The reactors and nuclear fuel rods in cooling ponds would meltdown and catch fire, as happened in the nuclear disaster at Fukushima, Japan. The 104 U.S. nuclear reactors, located mostly among the populous eastern half of the United States, could cover vast swaths of the nation with dangerous plumes of radioactivity” )

After the nuclear fuel that generates power at a nuclear reactor is done, it’s retired to a spent fuel pool full of water about 40 feet deep.  Unlike the nuclear reactor, which is inside a pressure vessel inside a containment vessel, spent fuel pools are almost always outside the main containment vessel.  If the water inside ever leaked or boiled away, it is likely the spent fuel inside would catch on fire and release a tremendous amount of radiation.

Nuclear engineers aren’t stupid.  Originally these pools were designed to be temporary until the fuel had cooled down enough to be transported off-site for reprocessing or disposal.  But now the average pool has 10 to 30 years of fuel stored at a much higher density than the pools were designed for, in buildings that vent to the atmosphere and can’t contain radiation if there’s an accident.

Besides a geomagnetic or nuclear EMP threat, there can also be a loss of offsite power from events initiated by severe weather (i.e. hurricanes, tornadoes, etc) that could cause a spent fuel pool to catch on fire.  Other events include an internal fire, loss of pool cooling, loss of coolant inventory, an earthquake, drop of a cask, aircraft impact, or a missile.

And this just in — or floods: 2019 U.S. Nuclear Power Plants Weren’t Built for Climate Change

Alice Friedemann  www.energyskeptic.com  Author of Life After Fossil Fuels: A Reality Check on Alternative Energy; When Trucks Stop Running: Energy and the Future of Transportation”, Barriers to Making Algal Biofuels, & “Crunch! Whole Grain Artisan Chips and Crackers”.  Women in ecology  Podcasts: WGBH, Financial Sense, Jore, Planet: Critical, Crazy Town, Collapse Chronicles, Derrick Jensen, Practical Prepping, Kunstler 253 &278, Peak Prosperity,  Index of best energyskeptic posts

***

Stone, R. May 24, 2016. Spent fuel fire on U.S. soil could dwarf impact of Fukushima. Science Magazine.

A fire from spent fuel stored at a U.S. nuclear power plant could have catastrophic consequences, according to new simulations of such an event.

A major fire “could dwarf the horrific consequences of the Fukushima accident,” says Edwin Lyman, a physicist at the Union of Concerned Scientists, a nonprofit in Washington, D.C. “We’re talking about trillion-dollar consequences,” says Frank von Hippel, a nuclear security expert at Princeton University, who teamed with Princeton’s Michael Schoeppner on the modeling exercise.

The revelations come on the heels of a report last week from the U.S. National Academies of Sciences, Engineering, and Medicine on the aftermath of the 11 March 2011 earthquake and tsunami in northern Japan. The report details how a spent fuel fire at the Fukushima Daiichi Nuclear Power Plant that was crippled by the twin disasters could have released far more radioactivity into the environment.

The nuclear fuel in three of the plant’s six reactors melted down and released radioactive plumes that contaminated land downwind. Japan declared 1100 square kilometers uninhabitable and relocated 88,000 people. (Almost as many left voluntarily.) After the meltdowns, officials feared that spent fuel stored in pools in the reactor halls would catch fire and send radioactive smoke across a much wider swath of eastern Japan, including Tokyo. By a stroke of luck, that did not happen.

But the national academies’s report warns that spent fuel accumulating at U.S. nuclear plants is also vulnerable. After fuel is removed from a reactor core, the radioactive fission products continue to decay, generating heat. All nuclear power plants store the fuel onsite at the bottom of deep pools for at least 4 years while it slowly cools. To keep it safe, the academies report recommends that the U.S. Nuclear Regulatory Commission (NRC) and nuclear plant operators beef up systems for monitoring the pools and topping up water levels in case a facility is damaged. The panel also says plants should be ready to tighten security after a disaster.

At most U.S. nuclear plants, spent fuel is densely packed in pools, heightening the fire risk. NRC has estimated that a major fire at the spent fuel pool at the Peach Bottom nuclear power plant in Pennsylvania would displace an estimated 3.46 million people from 31,000 square kilometers of contaminated land, an area larger than New Jersey. But Von Hippel and Schoeppner think that NRC has grossly underestimated the scale and societal costs of such a fire.

NRC used a program called MACCS2 for modeling the dispersal and deposition of the radioactivity from a Peach Bottom fire. Schoeppner and Von Hippel instead used HYSPLIT, a program able to craft more sophisticated scenarios based on historical weather data for the whole region.
Nightmare scenarios

In their simulations, the Princeton duo focused on Cs-137, a radioisotope with a 30-year half-life that has made large tracts around Chernobyl and Fukushima uninhabitable. They assumed a release of 1600 petabecquerels, which is the average amount of Cs-137 that NRC estimates would be released from a fire at a densely packed pool. It’s also approximately 100 times the amount of Cs-137 spewed at Fukushima. They simulated such a release on the first day of each month in 2015.

The contamination from such a fire on U.S. soil “would be an unprecedented peacetime catastrophe,” the Princeton researchers conclude in a paper to be submitted to the journal Science & Global Security. In a fire on 1 January 2015, with the winds blowing due east, the radioactive plume would sweep over Philadelphia, Pennsylvania, and nearby cities. Shifting winds on 1 July 2015 would disperse Cs-137 in all directions, blanketing much of the heavily populated mid-Atlantic region. Averaged over 12 monthly calculations, the area exposed to more than 1 megabecquerel per square meter — a level that would trigger a relocation order — is 101,000 square kilometers. That’s more than three times NRC’s estimate, and the relocation of 18.1 million people is about five times NRC’s estimates.

NRC has long mulled whether to compel the nuclear industry to move most of the cooled spent fuel now held in densely packed pools to concrete containers called dry casks. Such a move would reduce the consequences and likelihood of a spent fuel pool fire. As recently as 2013, NRC concluded that the projected benefits do not justify the roughly $4 billion cost of a wholesale transfer. But the national academies’s study concludes that the benefits of expedited transfer to dry casks are fivefold greater than NRC has calculated.

“NRC’s policies have underplayed the risk of a spent fuel fire,” Lyman says. The academies panel recommends that NRC “assess the risks and potential benefits of expedited transfer.” NRC spokesperson Scott Burnell in Washington, D.C., says that the commission’s technical staff “will take an in-depth look” at the issue and report to NRC commissioners later this year.

SIDEBAR 1: According to “Beyond Nuclear“, “Frank von Hippel, a nuclear security expert at Princeton University, teamed up with Princeton’s Michael Schoeppner on the modeling exercise. The study examines the Peach Bottom nuclear power plant in Pennsylvania, a Fukushima Daiichi twin design, two reactor plant. As the article reports:

In their simulations, the Princeton duo focused on Cs-137, a radioisotope with a 30-year half-life that has made large tracts around Chernobyl and Fukushima uninhabitable. They assumed a release of 1600 petabecquerels, which is the average amount of Cs-137 that NRC estimates would be released from a fire at a densely packed pool. It’s also approximately 100 times the amount of Cs-137 spewed at Fukushima. They simulated such a release on the first day of each month in 2015.  The contamination from such a fire on U.S. soil “would be an unprecedented peacetime catastrophe,” the Princeton researchers conclude in a paper to be submitted to the journal Science & Global Security. In a fire on 1 January 2015, with the winds blowing due east, the radioactive plume would sweep over Philadelphia, Pennsylvania, and nearby cities. Shifting winds on 1 July 2015 would disperse Cs-137 in all directions, blanketing much of the heavily populated mid-Atlantic region [see image, above left]. Averaged over 12 monthly calculations, the area exposed to more than 1 megabecquerel per square meter — a level that would trigger a relocation order — is 101,000 square kilometers [nearly 39,000 square miles]. That’s more than three times NRC’s estimate, and the relocation of 18.1 million people is about five times NRC’s estimates. (emphasis added)

Von Hippel also serves on a National Academies of Science (NAS) panel examining lessons to be learned from the Fukushima nuclear catastrophe. As also reported by Richard Stone in Science Magazine, that NAS panel has just released a major report. It reveals that a high-level radioactive waste storage pool fire was narrowly averted at Fukushima Daiichi by sheer luck. It also reveals that major security upgrades are needed at U.S. nuclear power plant high-level radioactive waste “wet” pool and dry cask storage facilities. (See the full NAS report here.)

NAS called on NRC to address safety and security risks to high-level radioactive waste storage as early as 2004. NRC never has, 15 years after the 9/11 attacks, and five years after the Fukushima nuclear catastrophe began.”

Stone, R. May 20, 2016. Near miss at Fukushima is a warning for U.S., panel says. Science Magazine.

Japan’s chief cabinet secretary called it “the devil’s scenario.” Two weeks after the 11 March 2011 earthquake and tsunami devastated the Fukushima Daiichi Nuclear Power Plant, causing three nuclear reactors to melt down and release radioactive plumes, officials were bracing for even worse. They feared that spent fuel stored in the reactor halls would catch fire and send radioactive smoke across a much wider swath of eastern Japan, including Tokyo.

Thanks to a lucky break detailed in a report released today by the U.S. National Academies, Japan dodged that bullet. The near calamity “should serve as a wake-up call for the industry,” says Joseph Shepherd, a mechanical engineer at the California Institute of Technology in Pasadena who chaired the academy committee that produced the report. Spent fuel accumulating at U.S. nuclear reactor plants is also vulnerable, the report warns. A major spent fuel fire at a U.S. nuclear plant “could dwarf the horrific consequences of the Fukushima accident,” says Edwin Lyman, a physicist at the Union of Concerned Scientists, a nonprofit in Washington, D.C., who was not on the panel.

After spent fuel is removed from a reactor core, the fission products continue to decay radioactively, generating heat. Many nuclear plants, like Fukushima, store the fuel onsite at the bottom of deep pools for at least 5 years while it slowly cools. It is seriously vulnerable there, as the Fukushima accident demonstrated, and so the academy panel recommends that the U.S. Nuclear Regulatory Commission (NRC) and nuclear plant operators beef up systems for monitoring the pools and topping up water levels in case a facility is damaged. It also calls for more robust security measures after a disaster. “Disruptions create opportunities for malevolent acts,” Shepherd says.

At Fukushima, the earthquake and tsunami cut power to pumps that circulated coolant through the reactor cores and cooled water in the spent fuel pools. The pump failure led to the core meltdowns. In the pools, found in all six of Fukushima’s reactor halls, radioactive decay gradually heated the water. Of preeminent concern were the pools in reactor Units 1 through 4: Those buildings had sustained heavy damage on 11 March and in subsequent days, when explosions occurred in Units 1, 3, and 4.

The “devil’s scenario” nearly played out in Unit 4, where the reactor was shut down for maintenance. The entire reactor core—all 548 assemblies—was in the spent fuel pool, and was hotter than fuel in the other pools. When an explosion blew off Unit 4’s roof on 15 March, plant operators assumed the cause was hydrogen—and they feared it had come from fuel in the pool that had been exposed to air. They could not confirm that, because the blast had destroyed instrumentation for monitoring the pool. (Tokyo Electric Power Company, the plant operator, later suggested that the hydrogen that had exploded had come not from exposed spent fuel but from the melted reactor core in the adjacent Unit 3.) But the possibility that the fuel had been exposed was plausible and alarming enough for then-NRC Chairman Gregory Jaczko on 16 March to urge more extensive evacuations than the Japanese government had advised—beyond a 20-kilometer radius from the plant.

Later that day, however, concerns abated after a helicopter overflight captured video of sunlight glinting off water in the spent fuel pool. In fact, the crisis was worsening: The pool’s water was boiling away because of the hot fuel. As the level fell perilously close to the top of the fuel assemblies, something “fortuitous” happened, Shepherd says. As part of routine maintenance, workers had flooded Unit 4’s reactor well, where the core normally sits. Separating the well and the spent fuel pool is a gate through which fuel assemblies are transferred. The gate allowed water from the reactor well to leak into the spent fuel pool, partially refilling it. Without that leakage, the academy panel’s own modeling predicted that the tops of the fuel assemblies would have been exposed by early April; as the water continued to evaporate, the odds of the assemblies’ zirconium cladding catching fire would have skyrocketed. Only good fortune and makeshift measures to pump or spray water into all the spent fuel pools averted that disaster, the academy panel notes.

At U.S. nuclear plants, spent fuel is equally vulnerable. It is for the most part densely packed in pools, heightening the fire risk if cooling systems were to fail. NRC has estimated that a major fire in a U.S. spent fuel pool would displace, on average, 3.4 million people from an area larger than New Jersey. “We’re talking about trillion-dollar consequences,” says panelist Frank von Hippel, a nuclear security expert at Princeton University.

Besides developing better systems for monitoring the pools, the panel recommends that NRC take another look at the benefits of moving spent fuel to other storage as quickly as possible. Spent fuel can be shifted to concrete containers called dry casks as soon as it cools sufficiently, and the academy panel recommends that NRC “assess the risks and potential benefits of expedited transfer.” A wholesale transfer to dry casks at U.S. plants would cost roughly $4 billion.

REFERENCES

NIRS. 2011. Petition for Rulemaking submitted to NRC by Foundation for Resilient Societies.  Nuclear Information and Resource Service.  www.nirs.org/reactorwatch/natureandnukes/petrulemaking262011.pdf

APPENDIX A

[ After finding the Science articles above, I stopped working on my extract and comments. FYI below is how far I got. I was mainly interested in the effects of a power outage, which the last NAS paper said would be covered in their next Fukushima review — this one.  Though much of what I wanted to know was classified and not included in their report. Alice Friedemann ]

NRC. 2016. Lessons Learned from the Fukushima Nuclear Accident for Improving Safety and Security of U.S. Nuclear Plants: Phase 2. National Academies Press.  238 pages.  http://www.nap.edu/21874

The Devil’s Scenario

By late March 2011—some 2 weeks after the earthquake and tsunami struck the Fukushima Daiichi plant—it was far from obvious that the accident was under control and the worst was over. Chief Cabinet Secretary Yukio Edano feared that radioactive material releases from the Fukushima Daiichi plant and its sister plant (Fukushima Daini) located some 12 km south could threaten the entire population of eastern Japan: “That was the devil’s scenario that was on my mind. Common sense dictated that, if that came to pass, then it was the end of Tokyo.” (RJIF, 2014)

Here is the worst case “devil’s scenario (Kubota 2012):

• Multiple vapor and hydrogen explosions and a loss of cooling functions at the six reactors at Tokyo Electric Power Co’s Fukushima Daiichi nuclear plant lead to radiation leaks and reactor failures.
• Thousands of spent fuel rods, crammed into cooling pools at the plant, melt and mix with concrete, then fall to the lower level of the buildings.
• In a possible domino effect, a hydrogen explosion at one reactor forces workers to evacuate due to high levels of radiation, halting cooling operations at all reactors and spent fuel pools. Reactors and cooling pools suffer serious damage and radiation leaks.
• TOKYO EVACUATION. Massive radioactive contamination forces residents in a 170-km radius or further to evacuate while those in a 250-km radius or further may voluntarily evacuate.  Tokyo, Japan’s capital, is located about 240 km (150 miles) southwest of the plant and the greater metropolitan area is home to some 35 million people.
• Radiation levels take several decades to fall.

WHAT ACTUALLY HAPPENED

• The 9.0 magnitude earthquake and a tsunami exceeding 15 meters knocked out cooling systems at the six-reactor plant and meltdowns are believed to have occurred at Nos. 1, 2 and 3.
• Hydrogen explosions occurred at the No. 1 and No. 3 reactor buildings a few days after the quake. Radiation leaks forced some 80,000 residents to evacuate from near the plant and more fled voluntarily, while radioactive materials have been found in food including fish and vegetable and water.
• Reactor No. 4 was under maintenance and 550 fuel rods had been transferred to its spent fuel pool, which already had about 1,000 fuel rods. The pool caught fire and caused an explosion.
• Reactors No. 5 and 6 reached cold shutdown — meaning water used to cool fuel rods is below boiling point — nearly 10 days after the tsunami but it took more than nine months to achieve that state at Nos. 1-3.
• Decommissioning the reactors will take 30 to 40 years and some nearby areas will be uninhabitable for decades.

And here’s what the NRC has to say about the Unit 4 pool

The events in the Unit 4 pool should serve as a wake-up call to nuclear plant operators and regulators about the critical importance of having robust and redundant means to measure, maintain, and, when necessary, restore pool cooling.  These events  also have important implications for accident response actions. As water levels decrease below about 1 meter above the top of the fuel racks, radiation levels on the refueling deck and surrounding areas will increase substantially, limiting personnel access. Moreover, once water levels reach approximately 50% of the fuel assembly height, the tops of the rods will begin to degrade, changing the fuel geometry and increasing the potential for large radioactive material releases into the environment (Gauntt et al., 2012).

These observations bear directly on the safety of pool storage following large offloads of fuel from reactors.  For example, consider what might have occurred in the Unit 4 spent fuel pool had the reactor been shut down and the core been offloaded to the pool 48 days before March 11 rather than the actual 102 days earlier, and had there been no water leakage [into the pool].  [In this case], pool water levels would have reached 50% of fuel assembly height before 10.6 days had elapsed—which was the time elapsed between the onset of the accident on March 11 and the first addition of water to the pool in Unit 4. In this hypothetical situation, if the core had been offloaded closer to the time of the accident or if the water addition had been delayed longer than 10.6 days, then there could have been damage to the fuel with the potential for a large release of radioactive material from the pool, particularly because the most recently offloaded (and highest-power) fuel was not dispersed in the pool but was concentrated in adjacent locations within the racks.

INTRODUCTION

This is the second and final part, focuses on three issues: (1) lessons learned from the accident for nuclear plant security, (2) lessons learned for spent fuel storage, and (3) reevaluation of conclusions from previous Academies studies on spent fuel storage. The present report provides a reevaluation of the findings and recommendations from NRC (2004, 2006).

New recommendations:

1. The U.S. nuclear industry and the U.S. Nuclear Regulatory Commission should strengthen their capabilities for identifying, evaluating, and managing the risks from terrorist attacks, especially spent fuel storage risks
2. Nuclear plant operators and their regulators should upgrade and/or protect nuclear plant security infrastructure and systems and train security personnel to cope with extreme external events and severe accidents. Such upgrades should include: independent, redundant, and protected power sources dedicated to plant security systems that will continue to function independently if safety systems are damaged; diverse and flexible approaches for coping with and reconstituting plant security infrastructure, systems, and staffing during and following extreme external events and severe accidents;
3. The U.S. nuclear industry and its regulator should improve the ability of plant operators to measure real-time conditions in spent fuel pools and maintain adequate cooling of stored spent fuel during severe accidents and terrorist attacks with hardened and redundant physical surveillance systems (e.g., cameras), radiation monitors, pool temperature monitors, pool water-level monitors, and means to deliver pool makeup water or sprays even when physical access to the pools is limited by facility damage or high radiation levels.
4. The U.S. Nuclear Regulatory Commission should perform a spent fuel storage risk assessment to elucidate the risks and potential benefits of expedited transfer of spent fuel from pools to dry casks. This risk assessment should address accident and sabotage risks for both pool and dry storage.
5. Some of the committee-recommended improvements have not been made by the USNRC or nuclear industry. In particular, the USNRC has not required plant licensees to install pool temperature monitors, yet these are essential in an accident to evaluate independently whether drops in pool water levels are due to evaporation or leakage, and must have independent power, be seismically rugged, and operate under severe accident conditions.

The committee found that the spent fuel storage facilities (pools and dry casks) at the Fukushima Daiichi plant maintained their containment functions during and after the March 11, 2011, earthquake and tsunami.

However, the loss of power, spent fuel pool cooling systems, and water level- and temperature-monitoring instrumentation in Units 1-4 and hydrogen explosions in Units 1, 3, and 4 hindered efforts by plant operators to monitor conditions in the pools and restore critical pool-cooling functions.

Plant operators had not been trained to respond to these yet they successfully improvised ways to monitor and cool the pools using helicopters, fire trucks, water cannons, concrete pump trucks, and ad hoc connections to installed cooling systems. These improvised actions were essential for preventing damage to the stored spent fuel and the consequent release of radioactive materials to the environment.

The spent fuel pool in Unit 4 was of particular concern because it had a high decay-heat load.

The committee used a steady-state energy-balance model to provide insights on water levels in the Unit 4 pool during the first 2 months of the accident (i.e., between March 11 and May 12, 2011). This model suggests that water levels in the Unit 4 pool declined to less than 2 m (about 6 ft) above the tops of the spent fuel racks by mid-April 2011.

The model suggests that pool water levels would have dropped below the top of active fuel had there not been leakage of water into the pool from the reactor well and dryer/separator pit through the separating gates. This water leakage was accidental; it was also fortuitous because it likely prevented pool water levels from reaching the tops of the fuel racks. The events in the Unit 4 pool show that gate leakage can be an important pathway for water addition or loss from some spent fuel pools and that reactor outage configuration can affect pool storage risks.

Once water levels reach half of the fuel assembly height, the tops of the rods will begin to degrade, changing the fuel geometry and increasing the potential for large radioactive material releases into the environment.

The safe storage of spent fuel in pools depends critically on the ability of nuclear plant operators to keep the stored fuel covered with water.

This has been known for more than 40 years and was powerfully reinforced by the Fukushima Daiichi accident. If pool water is lost through an accident or terrorist attack, then the stored fuel can become uncovered, possibly leading to fuel damage including runaway oxidation of the fuel cladding (a zirconium cladding fire) and the release of radioactive materials to the environment.

The spent fuel pools at Fukushima Daiichi Units 1-4 contained many fewer assemblies than are typically stored in spent fuel pools at U.S. nuclear plants. [The report doesn’t say how many fewer].

The storage capacity of U.S. spent fuel pools ranges from fewer than 2,000 assemblies to nearly 5,000 assemblies, with an average storage capacity of approximately 3,000 spent fuel assemblies. U.S. spent fuel pools are typically filled with spent fuel assemblies up to approximately three-quarters of their capacity (USNRC NTTF, 2011, p. 43).

ELECTRIC POWER

All offsite electrical power to the plant was lost following the earthquake, and DC power was eventually lost in Units 1-4 following the tsunami. Offsite AC power was not restored until 9 to 11 days later. Security equipment requiring electrical power was probably not operating continuously during this blackout period.

Regulations do not specify the performance requirements for these backup power supplies.  These backup supplies need to be adequately protected and sized to cope with a long-duration event such as occurred at the Fukushima Daiichi plant.

Recommendations:

1. To have portable backup equipment capable of providing water and power to the reactor. Such equipment includes, for example, electrical generators, batteries, and battery chargers; compressors; pumps, hoses, and couplings; equipment for clearing debris; and equipment for temporary protection against flooding.
2. To stage this equipment in locations both on- and offsite where it will be safe and deployable.

The Unit 1-4 spent fuel pools are equipped with active cooling systems; in particular the Spent Fuel Pool Cooling and Cleanup (FPC) systems, which are located within the reactor buildings below the refueling decks and in a nearby radwaste building. This system is designed to maintain pool temperatures in the range 25°C to 35°C (77°F to 95°F) by pumping the pool water through heat exchangers. The system also filters the pool water and adds makeup water as necessary to maintain pool water levels.

All of these features require electrical power.

The pools and refueling levels contain instruments to monitor water levels, temperatures, and air radiation levels. These measurements are displayed in the main control rooms. The temperature and water-level indicators are limited to a few locations near the tops of the pools for the purpose of maintaining appropriate water levels during normal operations: Pool water level is monitored by two level switches installed 1 foot above and half a foot below the normal water level in the pool.  Pool water temperature is monitored by a sensor 1 foot below the normal water level of the pool.

This instrumentation also requires electrical power to operate and has no backup power supply.

NRC (2014) provides a discussion of key events at the Fukushima Daiichi plant following the March 11, 2011, earthquake and tsunami. To summarize, Units 1-4 lost external power as a result of earthquake-related shaking. Units 1-4 also lost all internal AC power and almost all DC power for reactor cooling functions as a result of tsunami-related flooding. Efforts by plant operators to restore cooling and vent containments in time to avert core damage were unsuccessful. As a result, the Unit 1, 2, and 3 reactors sustained severe core damage and the Unit 1, 3, and 4 reactor buildings were damaged by explosions of combustible gas, primarily hydrogen generated by steam oxidation of zirconium and steel in the reactor core and, secondarily, by hydrogen and carbon monoxide generated by the interaction of the molten core with concrete.

The loss of AC and DC power and cooling functions also affected the Unit 1-4 spent fuel pools: The pools’ Spent Fuel Pool Cooling and Cleanup systems, secondary cooling systems, and pool water-level and temperature instrumentation became inoperable. High radiation levels and explosion hazards prevented plant personnel from accessing the Unit 1-4 refueling decks. Consequently, no data on pool water levels or temperatures were available for almost 2 weeks after the earthquake and tsunami. Moreover, even after pool instrumentation was restored, it was of limited value because of the large swings in pool water levels that occurred during the accident.  Improvised instrumentation and aerial observations were used to monitor pool conditions. Aerial and satellite photography were particularly important sources of information in the early stages of the accident although the images were not always interpreted correctly.

EARTHQUAKE EFFECTS

The earthquake caused the reactor buildings to sway, which likely caused water to slosh from the pools. No observational data on sloshing-related water losses are available, however. Analyses performed by the plant owner, TEPCO, suggest that sloshing reduced pool water levels by about 0.5 m (TEPCO, 2012a, Attachment 9-1). The sloshed water spilled onto the refueling decks and likely flowed into the reactor buildings through deck openings such as floor drains.

The explosions in the Unit 1, 3, and 4 reactor buildings likely caused additional water to be sloshed from the pools in those units. Again, no observational data on explosion-related water losses are available. Sloshing due to building motion resulting from the explosions is unlikely to be significant. But sloshing will occur if there is a spatially non-uniform pressure distribution created on the pool surface by an explosion in the region above the pool. This is particularly likely for high-speed explosions that create shock or detonation waves.  TEPCO estimates that an additional 1 meter of water was sloshed from each of the pools as a result of the explosions (TEPCO, 2012a, Attachment 9-1, p. 3/9).

Emergency response center actions

Personnel in the plant’s Emergency Response Center (see NRC, 2014, Appendix D) were focused on cooling the Unit 1-3 reactors and managing their containment pressures during the first 48 hours of the accident. They knew that restoring cooling in the spent fuel pools was less urgent and prioritized accordingly. Beginning on March 13, 2011, operators became increasingly concerned about water levels in the pools; their concerns increased following the explosions in the Unit 3 and 4 reactor buildings on March 14 and 15, respectively

By the morning of March 15, 2011, it was apparent that the Unit 1-3 reactors had been damaged and were releasing radioactive material. TEPCO evacuated all but about 70 personnel from the plant because of safety concerns (personnel began returning a few hours later). That same day, TEPCO initiated a comprehensive review of efforts to cool the spent fuel pools and made it a priority to determine the status of the Unit 4 pool. TEPCO added the Unit 3 pool to its priority list on the morning of March 16 after steam was observed billowing from the top of the Unit 3 reactor building.

Unit 1 Pool. The explosion in the Unit 1 reactor building on March 12, 2011, blew out the wall panels on the fifth floor, but the steel girders that supported the panels remained intact. The roof collapsed onto the refueling deck and became draped around the crane and refueling machinery. This wreckage prevented visual observations of and direct access to the pool. TEPCO estimated that the pool lost about 129 tonnes of water from the earthquake- and explosion-related sloshing. This lowered the water level in the pool to about 5.5 meters above the top of the racks. Because of the very low decay heat in Unit 1, this pool was of least concern.

Spent Fuel Heat-up Following Loss-of-Pool-Coolant Events

Spent fuel continues to generate heat from the decay of its radioactive constituents long after it is removed from a reactor. The fuel is stored in water-filled pools (i.e., spent fuel pools) to provide cooling and radiation shielding. An accident or terrorist attack that damaged a spent fuel pool could result in a partial or complete loss of water coolant. Such loss-of-pool-coolant events can cause the fuel to overheat, resulting in damage to the metal (zirconium) cladding of the fuel rods and the uranium fuel pellets within and the release of radioactive constituents to the environment.

The loss of water coolant from the pool would cause temperatures in the stored spent fuel to increase because air is a less effective coolant than water. The magnitude and rate of temperature increase depends on several factors, including how long the fuel has been out of the reactor and the rate and extent of water loss from the pool. As fuel temperatures rise, internal pressures in the fuel rods will increase and the rod material will soften. At about 800°C (1472°F), internal pressures in the fuel rod will exceed its yield stress, resulting in failure, a process known as fuel ballooning. Thermal creep of the fuel rod above about 700°C (1292°F) can also result in ballooning. Once the fuel cladding fails, the gaseous and volatile fission products stored in the gap between the fuel rod and pellets will be released. The fission product inventory varies depending on the type of fuel and its irradiation history; typically, on the order of a few percent of the total noble gas inventory (xenon, krypton), halogens (iodine, bromine), and alkali metals (cesium, rubidium) present in the fuel will be released. Between about 900°C (1652°F) and 1200°C (2192°F), highly exothermic chemical reactions between the fuel rods and steam or air will begin to accelerate, producing zirconium oxide.

The reaction in steam also generates large quantities of hydrogen. Deflagration (i.e., rapid combustion) of this hydrogen inside the spent fuel pool building can damage the structure and provide a pathway for radioactive material releases into the environment. Further temperature increases can drive more volatile fissile products out of the fuel pellets and cause the fuel rods to buckle, resulting in the physical relocation of rod segments and the dispersal of fuel pellets within the pool.

At about 1200°C the oxidation reaction will become self-sustaining, fully consuming the fuel rod cladding in a short time period if sufficient oxygen is available (e.g., from openings in the spent fuel pool building) and producing uncontrolled (runaway) temperature increases. This rapid and self-sustaining oxidation reaction, sometimes referred to as a zirconium cladding fire, may propagate to other fuel assemblies in the pool. In the extreme, such fires can produce enough heat to melt the fuel pellets and release most of their fission product inventories.

Unit 4 Pool

The Unit 4 reactor was shut down for maintenance, and large-scale repairs were in on March 11, 2011.

The explosion that occurred in the Unit 4 reactor building at 6:14 on March 15, 2011, destroyed the roof and most of the walls on the fourth and fifth (refueling deck) floors, and it damaged some of the walls on the third floor. TEPCO (2012a) has suggested that the explosion was due to the combustion of hydrogen that was generated in Unit 3 and flowed into Unit 4 through the ventilation system. The fifth-floor slab was pushed upward and the fourth-floor slab was depressed. The explosion also deposited debris around the reactor building, onto the refueling deck, and into the pool . Fires were reported in the damaged building later that morning and on the morning of March 16; these fires self-extinguished and were later attributed to the ignition of lubricating oil.

The damage to the Unit 3 and 4 building structures and steam emissions from both buildings raised grave concerns about the spent fuel pools in those units. Unit 4 was of particular concern because the reactor contained no fuel and therefore could not have been the source of hydrogen or other combustible gas. The only apparent source of combustible gas within Unit 4 was hydrogen from the steam oxidation of spent fuel in the fully or partially drained Unit 4 spent fuel pool.

Plant operators well understood the hazard posed by the spent fuel in the Unit 4 pool: The pool was loaded with high-decay-heat fuel; its water level was dropping because of large evaporative water losses; and openings in the Unit 4 building created by the explosion created pathways for radioactive materials releases into the environment.

The extensive visible damage to the Unit 4 reactor building and high level of decay heat in the Unit 4 pool continued to drive concerns about pool water levels. Operators began to add water to the Unit 4 pool.

Prime Minister Kan asked Dr. Kondo, then-chairman of the Japanese Atomic Energy Commission, to prepare a report on worst-case scenarios from the accident. Dr. Kondo led a 3-day study involving other Japanese experts and submitted his report (Kondo, 2011) to the prime minister on March 25, 2011. The existence of the report was initially kept secret because of the frightening nature of the scenarios it described. An article in the Japan Times quoted a senior government official as saying, “The content [of the report] was so shocking that we decided to treat it as if it didn’t exist.” When the existence of the document was finally acknowledged in January 2012, Special Advisor (to the Prime Minister) Hosono stated: “Because we were told there would be enough time to evacuate residents (even in a worst-case scenario), we refrained from disclosing the document due to fear it would cause unnecessary anxiety (among the public). . . .”

One of the scenarios involved a self-sustaining zirconium cladding fire in the Unit 4 spent fuel pool….Voluntary evacuations were envisioned out to 200 km because of elevated dose levels. If release from other spent fuel pools occurred, then contamination could extend as far as Tokyo, requiring compulsory evacuations out to more than 170 km and voluntary evacuations out to more than 250 km; the latter includes a portion of the Tokyo area. There was particular concern that the zirconium cladding fire could produce enough heat to melt the stored fuel, allowing it to flow to the bottom of the pool, melt through the pool liner and concrete bottom, and flow into the reactor building. After leaving office, Prime Minister Kan stated that his greatest fears during the crisis were about the Unit 4 spent fuel pool (RJIF, 2014).

Two important observations can be made from the committee’s analysis of water levels in the Unit 4 pool. First, because of the substantial uncertainties cited above, the committee cannot rule out the possibility that spent fuel in the Unit 4 pool became partially uncovered sometime prior to April 21, 2011. If the fuel was uncovered, however, then it was not substantial enough to cause fuel damage or substantially increase external dose rates in areas around the Unit 4 building. Fuel damage will not begin immediately when the water level drops below the top of the rack. Simulations of loss-of-cooling accidents (Gauntt et al., 2012) predict that it is possible to recover without fuel damage as long as the collapsed25 water level does not drop below the mid-height of the fuel for an extended period of time.

Second, leakage through the gate seals was essential for keeping the fuel in the Unit 4 pool covered with water. Had there been no water in the reactor well, there could well have been severe damage to the stored fuel and substantial releases of radioactive material to the environment. This is the “worst-case scenario” envisioned by then–Atomic Energy Commission of Japan Chairman Dr. Shunsuke Kondo.  To illustrate this second observation, the committee modeled a hypothetical scenario in which there is no water leakage into the Unit 4 pool from the reactor well and dryer-separator pit.  Without water leakage, pool water levels could have dropped well below the top of active fuel (located 4 m above the bottom of the pool) in early April 2011.

Finally, the damage observed in the Unit 3 gates demonstrates a pathway by which a severe accident could compromise spent fuel pool storage safety: drainage of water from a spent fuel pool through a damaged gate breach into an empty volume such as a dry reactor well or fuel transfer canal. A gate breach could drain a spent fuel pool to just above the level of the racks in a matter of hours, and the resulting high radiation fields on the refueling deck could hinder operator response actions. The committee judges that an effort is needed to assess the containment performance of spent fuel pool gates under severe accident conditions during all phases of the operating cycle.

Assessment of spent fuel pool performance, including gate leakage, is not a new topic for the USNRC. A review of historical data in 1997 (USNRC, 1997c) documented numerous instances of significant accidental drainage of pools in pressurized water reactor and BWR plants due to various failures including gate seals. The report recommended that “[t]he overall conclusions are that the typical plant may need improvements in SFP [spent fuel pool] instrumentation, operator procedures and training, and configuration control” (p. xi). Furthermore, the report goes on to identify the most prevalent reason for loss of pool inventory was leaking fuel pool gates. Given the potential for gate leakage under normal operations it is not surprising that it is also an issue under severe accident conditions.

Lessons Learned for Nuclear Plant Security

To the committee’s knowledge, TEPCO has not publicly disclosed the impacts of the earthquake and tsunami on plant security systems. Nevertheless, the committee infers from TEPCO’s written reports, as well as its own observations during a November 2012 tour of the Fukushima Daiichi plant, that security systems at the plant were substantially degraded by the earthquake and tsunami and the subsequent accident.  Tsunami damage and power losses likely affected the integrity and operation of numerous security systems, including lighting, physical barriers and other access controls, intrusion detection and assessment equipment, and communications equipment.

Such disruptions can create opportunities for malevolent acts and increase the susceptibility of critical plant systems to such acts.  Nuclear plant operators and their regulators should upgrade and/or protect nuclear plant security infrastructure and systems and train security personnel to cope with extreme external events and severe accidents. Such upgrades should include 1) Independent, redundant, and protected power sources dedicated to plant security systems that will continue to function independently if safety systems are damaged; 2) Diverse and flexible approaches for coping with and reconstituting plant security infrastructure, systems, and staffing during and following extreme external events and severe accidents; 3) the events at the plant suggest an important lesson from the accident: Extreme external events and severe accidents can have severe and long lasting impacts on the security systems at nuclear plants. Such long-lasting disruptions can create opportunities for malevolent acts and increase the susceptibility of critical plant systems to such acts. Similar situations could occur as a result of other natural disasters. For example, a hurricane or destructive thunderstorm that spawned tornados could damage onsite and offsite power substations and high-voltage pylons, causing a loss of a nuclear plant’s offsite power. The storm could also damage security fences, cameras, and other intrusion detection equipment. Relief security officers and other site personnel may not be able to report to duty on schedule if storm-related damage was widespread in surrounding communities. An adversary could use this disruption to advantage in carrying out a malevolent act.

The Fukushima Daiichi accident illustrates that full restoration of security measures could potentially take days to weeks after an extreme external event or severe accident: Damaged security equipment must be restored and destroyed equipment must be replaced.

TERRORISM, SABOTAGE, SECURITY

A determined violent external assault, attack by stealth, or deceptive actions, including diversionary actions, by an adversary force capable of operating in each of the following modes: A single group attacking through one entry point, multiple groups attacking through multiple entry points, a combination of one or more groups and one or more individuals attacking through multiple entry points, or individuals attacking through separate entry points, with the following attributes, assistance and equipment:

(A) Well-trained (including military training and skills) and dedicated individuals, willing to kill or be killed, with sufficient knowledge to identify specific equipment or locations necessary for a successful attack;

(B) Active (e.g., facilitate entrance and exit, disable alarms and communications, participate in violent attack) or passive (e.g., provide information), or both, knowledgeable inside assistance;

(C) Suitable weapons, including handheld automatic weapons, equipped with silencers and having effective long range accuracy;

(D) Hand-carried equipment, including incapacitating agents and explosives for use as tools of entry or for otherwise destroying reactor, facility, transporter, or container integrity or features of the safeguards system; and

(E) Land and water vehicles, which could be used for transporting personnel and their hand-carried equipment to the proximity of vital areas; and (ii) An internal threat; and (iii) A land vehicle bomb assault, which may be coordinated with an external assault; and (iv) A waterborne vehicle bomb assault, which may be coordinated with an external assault; and (v) A cyber attack.

An adversary who lacks the strength, weaponry, and training of the nuclear plant’s security forces might utilize attack strategies that do not require direct confrontations with those forces. For example, an adversary might choose to attack perceived weak points in the plant’s support infrastructure (e.g., offsite power and water supplies, key personnel) rather than mounting a direct assault on the plant. The goals of such asymmetric attacks might be to cause operational disruptions, economic damage, and/or public panic rather than radiological releases from a plant’s reactors or spent fuel pools. In fact, such attacks would not necessarily need to result in any radiological releases to be considered successful.

Offsite power substations, piping, fiber optic connection points, and other essential systems provide an adversary the opportunity to inflict damage with very little personal risk and without confronting a nuclear plant’s security forces. The psychological effects of such attacks, even if these do not result in the release of radioactive material, might have consequences comparable to or greater than the actual physical damage. In the extreme, such attacks could lead to temporary shutdowns of, or operating restrictions on, other nuclear plants until security enhancements could be implemented. (Japan shut down all its nuclear power reactors and briefly entertained the dismantlement of its nuclear power industry due to public pressure following the Fukushima Daiichi accident.)

Detailed information about the evolution of the accident at the Fukushima Daiichi plant and its compromised safety systems is widely available on the Internet and in reports such as this one. This information could be used by terrorists to plan and carry out asymmetric attacks on nuclear plants in hopes of creating similar cascading failures.

In the event of a catastrophic event or attack, security systems must be designed and installed to be quickly reconstituted. Hardened power and fiber optic cables must permit “plug-and-play” installation of replacements for inoperable equipment. Reestablishment of security is critical because an adversary who might otherwise be deterred from attacking a site might be encouraged to carry out an attack at a compromised facility.

The USNRC requires licensees to implement an Insider Mitigation Program to oversee and monitor the initial and continuing trustworthiness and reliability of individuals having unescorted access in protected or vital areas of nuclear plants. There is a long-standing assumption by the USNRC that this program reduces the likelihood of an active insider (GAO, 2006). USNRC staff was not able to provide an explanation that was adequate to the committee on how it assesses the effectiveness of these measures for mitigating the insider threat. Moreover, to the committee’s knowledge, there are no programs in place at the USNRC to specifically evaluate the effectiveness of these measures for mitigating the insider threat.

4. 2.1 Reevaluation of Finding 3B from NRC (2006)

NRC (2006) considered four general types of terrorist attack scenarios:

1. Air attacks using large civilian aircraft or smaller aircraft laden with explosives,
2. Ground attacks by groups of well-armed and well-trained individuals,
3. Attacks involving combined air and land assaults, and
4. Thefts of spent fuel for use by terrorists (including knowledgeable insiders) in radiological dispersal devices.

The report noted that “. . . only attacks that involve the application of large energy impulses or that allow terrorists to gain interior access have any chance of releasing substantial quantities of radioactive material. This further restricts the scenarios that need to be considered. For example, attacks using rocket-propelled grenades (RPGs) of the type that have been carried out in Iraq against U.S. and coalition forces would not likely be successful if the intent of the attack is to cause substantial damage to the facility. Of course, such an attack would get the public’s attention and might even have economic consequences for the attacked plant and possibly the entire commercial nuclear power industry.” (NRC, 2006, p. 30) The concluding sentence speaks to terrorist intent and metrics for success. That is, if the intent of a terrorist attack is to instill fear into the population and cause economic disruption, then an attack need not result in any release of radioactive material from the plant to be judged a success. The classified report (NRC, 2004) identified particular terrorist attack scenarios that were judged by its authoring committee to have the potential to damage spent fuel pools and result in the loss of water coolant (Section 2.2 in NRC, 2004). The present committee asked USNRC staff whether any of these attack scenarios had been examined further since NRC (2004) was issued. Staff was unable to present the committee with any additional technical analyses of these scenarios. Consequently, the present committee finds that the USNRC has not undertaken additional analyses of terrorist attack scenarios to provide a sufficient technical basis for a reevaluation of Finding 3B in NRC (2004). The present committee did not have enough information to evaluate the particular terrorist attack scenarios identified in NRC (2004) and therefore cannot judge their potential for causing damage to spent fuel pools. The committee notes, however, that new remote-guided aircraft technologies have come into widespread use in the civilian and military sectors since NRC (2004) was issued. These technologies could potentially be employed in the attack scenarios described in NRC (2004). Other types of threats, particularly insider and cyber threats, have grown in prominence since NRC (2004) was issued. There is a need to more fully explore these threats to understand their potential impacts on nuclear plants.

6 Loss-of-Coolant Events in Spent Fuel Pools

Reconfiguring spent fuel in pools can be an effective strategy for reducing the likelihood of fuel damage and zirconium cladding fires following loss-of-pool-coolant events. However, reconfiguring spent fuel in pools does not eliminate the risks of zirconium cladding fires, particularly during certain periods following reactor shutdowns or for certain types of pool drainage conditions. These technical studies also illustrate the importance of maintaining water coolant levels in spent fuel pools so that fuel assemblies do not become uncovered.

The particular conditions under which fuel damage and zirconium cladding fires can occur, as well as the timing of such occurrences, are not provided in this report because they are security sensitive.

Spent Fuel Pool Loss-of-Coolant Accidents (LOCAs)

In a complete-loss-of-pool-coolant scenario, most of the oxidation of zirconium cladding occurs in an air environment.   For a partial-loss-of-pool-coolant scenario (or slow drainage in a complete-loss-of-pool-coolant scenario), the initial oxidation of zirconium cladding will occur in a steam environment:

The zirconium-steam reaction leads to the formation of hydrogen, which can undergo rapid deflagration in the pool enclosure, resulting in overpressures and structural damage. This damage can provide a pathway for air ingress to the pool, which can promote further zirconium oxidation and allow radioactive materials to be released into the environment. Debris from the damaged enclosure can fall into the pool and block coolant passages.

After the water level drops below the rack base plate, convective air flow is established. If the steam is exhausted, then the zirconium-steam reaction is replaced by the zirconium-oxygen reaction. However, prior to the onset of convective air flow, fuel cladding temperatures can exceed the threshold for oxidation, and fuel damage and radioactive material release can occur. The time to damage and release depends on pool water depth relative to the stored fuel assemblies.  There is a higher hazard for zirconium cladding fires in partially drained pools.

[To prevent this] nuclear power plants need to be able to provide at least 500 gallons per minute (gpm) of makeup water to the plant’s spent fuel pools for 12 hours.   The operator would first use installed equipment, if available, to meet these goals. If such equipment is not available, then operators would provide makeup water (e.g., from the condensate storage tank) with a portable injection source (pump, flexible hoses to standard connections, and associated diesel engine-generator) that can provide at least 500 gpm of spent fuel pool makeup. The portable equipment would be staged on site and could also be brought in from regional staging facilities.

If pool water levels cannot be maintained above the tops of the fuel assemblies, then portable pumps and nozzles would be used to spray water on the uncovered fuel assemblies. FLEX requires a minimum of 200 gpm to be sprayed onto the tops of the fuel assemblies to cool them (NEI, 2012).

Water and spray strategies need to work even if physical access to pools is hindered by structural damage or radiation levels make the site inaccessible even if permanently installed equipment is damaged. However, physical access might not be possible if the building is damaged or the pool is drained (in the latter case, high radiation levels would likely limit physical access to the pool). The spent fuel pools in Units 1-4 of the Fukushima Daiichi plant were not accessible after the hydrogen explosions because of debris and high radiation levels.

Expedited Transfer of Spent Fuel from Pools to Dry Casks

Spent fuel pools at U.S. nuclear plants were originally outfitted with “low-density” storage racks that could hold the equivalent of one or two reactor cores of spent fuel. This capacity was deemed adequate because plant operators planned to store spent fuel only until it was cool enough to be shipped offsite for reprocessing. However, reprocessing of commercial spent fuel was never implemented on a large scale in the United States; consequently, spent fuel has continued to accumulate at operating nuclear plants.

S. nuclear plant operators have taken two steps to manage their growing inventories of spent fuel. First, “high-density” spent fuel storage racks have been installed in pools to increase storage capacities. This action alone increased storage capacities in some pools by up to about a factor of 5 (USNRC, 2003). Second, dry cask storage has been established to store spent fuel that can be air cooled. Typically, transfers of the oldest (and therefore coolest) spent fuel from pools to dry casks are made only when needed to free up space in the pool for offloads of spent fuel resulting from reactor refueling operations. The objective of accelerated or expedited transfer would be to reduce the density of spent fuel stored in pools: “Expedited transfer of spent fuel into dry storage involves loading casks at a faster rate for a period of time to achieve a low density configuration in the spent fuel pool (SFP). The expedited process maintains a low density pool by moving all fuel cooled longer than 5 years out of the pool.

The low-density configuration achieved by expedited transfer would reduce inventories of spent fuel stored in pools. This might improve the coolability of the remaining fuel in the pools if water coolant was lost or if cooling systems malfunctioned.

Events capable of causing the loss of cooling in spent fuel pools:

1. seismic events
2. drops of casks and other heavy loads on pool walls
3. loss of offsite power
4. internal fire
5. loss of pool cooling or water inventory
6. inadvertent aircraft impacts
7. wind-driven missiles (the impacts of heavy objects such as storm debris on the external walls of spent fuel pools)
8. failures of pneumatic seals on the gates in the spent fuel pool

The USNRC’s analyses are of limited use for assessing spent fuel storage risks  because

1. Spent fuel storage sabotage risks are not considered.
2. Dry cask storage risks are not considered.
3. The attributes considered in the cost-benefit analysis (Section 7.3.2) are limited by OMB and USNRC guidance and do not include some expected consequences of severe nuclear accidents.
4. The analysis employs simplifying bounding assumptions that make it technically difficult to assign confidence intervals to the consequence estimates or make valid risk comparisons.

The present committee’s recommended risk analysis would provide policy makers with a more complete technical basis for deciding whether earlier movements of spent fuel from pools into dry cask storage would be prudent to reduce the potential consequences of accidents and terrorist attacks on stored spent fuel. This recommended risk analysis should • Consider accident and sabotage risks for both pool and dry cask storage. • Consider societal, economic, and health consequences of concern to the public, plant operators, and the USNRC. • More fully account for uncertainties in scenario probabilities and consequences.

A complete analysis would also include similar considerations for sabotage threats, including the consequences should a design-basis-threat (DBT) event fail to be mitigated, as well as the consequences should beyond-DBT events occur and fail to be mitigated. A complete analysis would consider a broad range of potential threats including insider and cyber threats. Sabotage initiators can differ from accident initiators in important ways: For example, most accident initiators occur randomly in time compared to the operating cycle of a nuclear plant. Sabotage initiating events can be timed with certain phases of a plant’s operating cycle, changing the conditional probabilities of certain attack scenarios as well as their potential consequences. There may be additional differences between accident and sabotage events with respect to timing, severity of physical damage, and magnitudes of particular consequences, for example radioactive material releases.

The following three conditional probabilities could have correlated and high numerical values if knowledgeable and determined saboteurs attack the plant in certain ways during certain parts of its operating cycle:

P(loss of offsite power | sabotage),

P(operating cycle vulnerability | loss of offsite power & sabotage), and

P(liner damage leading to loss of coolant | operating cycle vulnerability & sabotage).

If one assumes, for example, that these conditional probabilities are 1.0, then release frequencies will be about two orders of magnitude higher than those for a seismic initiator. This increased frequency is a consequence of the correlated behavior of the saboteurs with the reactor operating cycle and a high probability of success using a strategy that exploits plant vulnerabilities. On the other hand, decreasing these three conditional probabilities by a factor of 2 (corresponding to either less successful attackers or more successful defenders) will decrease the likelihood of a release by a factor of 10. Although the conditional probabilities used in the foregoing scenarios are entirely fictitious (and the scenarios themselves are in no way representative of the broad range of scenarios that could be considered), their use illustrates two important points: (1) A large range of F(release) outcomes are possible depending on the conditional probabilities used in the analysis, and, therefore, (2) it is essential to characterize the uncertainties in F(release) as part of the analysis. A sabotage risk assessment could be used to estimate these outcomes and uncertainties. The committee judges that it is not technically justifiable to exclude sabotage risks without the type of technical analysis that is routinely performed for assessing reactor accident risks. Such an analysis would consider both design-basis and beyond-design-basis threats. The likelihoods of these threats could be assessed through elicitation

SPENT FUEL POOL STUDY

The Spent Fuel Pool Study analyzed the consequences of a beyond design- basis earthquake on a spent fuel pool at a reference plant4 containing a General Electric Type 4 boiling water reactor (BWR) with a Mark I containment. The USNRC selected an earthquake having an average occurrence frequency of 1 in 60,000 years and a peak ground acceleration of 0.5-1.0 g (average 0.7 g) as the initiating event for this analysis.6 The study examined the effects of the earthquake on the integrity of the spent fuel pool and the effects of loss of pool coolant on its stored spent fuel.  A modeling analysis was carried out to identify initial damage states to the pool structure from this postulated seismic event. The analysis concluded that structural damage to the pool leading to water leaks (i.e., tears in the steel pool liner and cracks in the reinforced concrete behind the liner) was most likely to occur at the junction of the pool wall and floor. This leak location would result in complete drainage of the pool if no action was taken to plug the leak or add make-up water. Given the assumed earthquake, the leakage probability was estimated to be about 10 percent.

Leak scenarios

1. No leak in the spent fuel pool
2. A “small leak” in the pool that averages about 200 gallons per minute for water heights at least 16 feet above the pool floor (i.e., at the top of the spent fuel rack).
3. A “moderate leak” in the pool that averages about 1,500 gallons per minute for water heights at least 16 feet above the pool floor

Reactor operating cycle phases:7

• OCP1: 2-8 days; reactor is being defueled.
• OCP2: 8-25 days; reactor is being refueled.
• OCP3: 25-60 days; reactor in operation.
• OCP4: 60-240 days; reactor in operation.
• OCP5: 240-700 days; reactor in operation.

Fuel configurations in the pool:8

• A “high-density” storage configuration in which hot (i.e., recently discharged from the reactor) spent fuel assemblies are surrounded by four cooler (i.e., less recently discharged from the reactor) fuel

assemblies in a 1 × 4 configuration throughout the pool (Figure 7.2).

• A “low-density” storage configuration in which all spent fuel older than 5 years has been removed from the pool.

Mitigation scenarios:

• A “mitigation” case in which plant operators are successful in deploying equipment to provide makeup water and spray cooling required by 10 CFR 50.54(hh)(2)10 (see Chapter 2).
• A “no-mitigation” case in which plant operators are not successful in taking these actions [MY NOTE: BECAUSE THE ELECTRIC GRID IS DOWN FROM AN EMP OR OTHER DISASTER ]

Some key results of the consequence modeling are shown in Table 7.1.

Some of the loss-of-coolant scenarios examined in the study resulted in damage to, and the release of, radioactive material from the stored spent fuel. Releases began anywhere from several hours to more than 2 days after the postulated earthquake. The largest releases were estimated to result from high-density fuel storage configurations with no mitigation (Figure 7.1). The releases were estimated to be less than 2 percent of the cesium-137 inventory of the stored fuel for medium-leak scenarios, whereas releases were estimated to be one to two orders of magnitude larger for small-leak scenarios with a hydrogen combustion event. Hydrogen combustion was found to be “possible” for high-density pools but “not predicted” for low-density pools.

Operating-cycle phase (OCP) played a critical role in determining the potential for fuel damage and radioactive materials release. The potential for damage is highest immediately after spent fuel is offloaded into the pool (OCP1) because its decay heat is large. The potential for damage decreases through successive operating-cycle phases (OCP2-OCP5). In fact, only in the first three phases (OCP1-OCP3) is the decay heat sufficiently large to lead to fuel damage in the first 72 hours after the earthquake for complete drainage of the pool. These three “early in operating cycle” phases (Figure 7.1) constitute only about 8 percent of the operating cycle of the reactor.

In fact, a spent fuel pool accident can result in large radioactive material releases, extensive land contamination, and large-scale population dislocations.

NRC 2016 TABLE 7.1 A  & B

TABLE 7.1 Key Results from the Consequence Analysis in the Spent Fuel Pool Study

NOTE: The individual early fatality risk estimates and individual latent cancer fatality risk

estimates shown in the table were not derived from a risk assessment. They were computed using the postulated earthquake and scenario frequencies shown in the table. PGA = peak ground acceleration. a) Seismic hazard model from Petersen et al. (2008). b) Given that the specified seismic event occurs. c) Given atmospheric release occurs. d) Results from a release are averaged over potential variations in leak size, time since reactor shutdown, population distribution, and weather conditions (as applicable); additionally, “release frequency-weighted” results are multiplied by the release frequency. e) Linear no-threshold and population weighted (i.e., total amount of latent cancer fatalities predicted in a specified area, divided by the population that resides within that area). f) First year post-accident; calculation uses a dose limit of 500 mrem per year, according to Pennsylvania Code, Title 25 § 219.51. g) Mitigation can moderately increase release size; the effect is small compared to the reduction in release frequency. h) Largest releases here are associated with small leaks (although sensitivity results show large releases are possible from moderate leaks). Assuming no complications from other spent fuel pools/reactors or shortage of available equipment/staff, there is a good chance to mitigate the small leak event. i) Kevin Witt, USNRC, written communication, December 22, 2015.

For example, Figures 7.3A, 7.3B, and 7.3C show the estimated radioactive material releases, land interdiction, and displaced persons for the reference plant in the Spent Fuel Pool Study. Also shown for comparison purposes are the same consequences for the Fukushima Daiichi accident taken from the committee’s phase 1 report

NRC 2016 FIGURE 7.3    B  C

FIGURE 7.3 Selected consequences from the Spent Fuel Pool Study as a function of fuel loading (1 × 4 loading; low-density loading) and mitigation required by 10 CFR 50.54(hh)(2). Notes: Consequences for the Fukushima Daiichi accident are shown for comparison. (A) Radioactive material releases. (B) Land interdiction (see footnote 26 for an explanation of the values for the Fukushima bar). (C) Displaced populations. SOURCE: Table 7.1 in this report; IAEA (2015), NRA (2013), NRC (2014, Chapter 6), UNSCEAR (2013).

These figures illustrate three important points:

1. A spent fuel pool accident can result in large releases of radioactive material, extensive land interdiction, and large population displacements.
2. Effective mitigation of such accidents can substantially reduce these consequences for some fuel configurations (cf. the bars in the figures for 1 × 4 mitigated and unmitigated scenarios) but can increase consequences for others (cf. the bars in the figures for low density unmitigated and unmitigated scenarios).
3. Low-density loading of spent fuel in pools can also substantially reduce these consequences and also reduce the need for effective mitigation measures.

Note that the Fukushima estimate includes land that is both interdicted and likely condemned

The Spent Fuel Study (USNRC, 2014a) reports only interdicted land. One of the difficulties with USNRC (2014a) is that, unlike previous studies, the condemned land is not reported. Of the 430 mi2 (1,113 km2) that were evacuated as of May 2013, 124 mi2 (320 km2) was reported as “difficult to return,” which gives an indication of the amount of land that may ultimately be condemned.

A similar point can be made by examining the unweighted results from the Expedited Transfer Regulatory Analysis (USNRC, 2013) for a “sensitivity case” that removes the 50-mile limit for land interdiction and population displacements and raises the value of the averted dose conversion factor from $2,000 per person-rem to $4,000 per person-rem. This scenario postulates the evacuation of 3.46 million people from an area of 11,920 mi2, larger than the area of New Jersey (Table 7.2).  In comparison, approximately 88,000 people were involuntarily displaced from an area of about 400 mi2 as a consequence of the Fukushima accident (MOE, 2015).

The cost-benefit analysis did not consider some other important health consequences of spent fuel pool accidents, in particular social distress. The Fukushima Daiichi accident produced considerable psychological stresses within populations in the Fukushima Prefecture over the past 4 years, even in areas where radiation levels are deemed by regulators to be acceptable for habitation. Radiation anxiety, insomnia, and alcohol misuse were significantly elevated 3 years after the accident (Karz et al., 2014). The incidence of mental health problems and suicidal thoughts also were high among residents forced to live in long-term shelters after the accident

Complex psychosocial effects were also observed, including discordance within families over perceptions of radiation risk, between families over unequal compensatory treatments, and between evacuees and their host communities (Hasegawa et al., 2015).

Sailor et al. (1987) used a modified version of SFUEL to estimate the risks (likelihoods) of zirconium cladding fires as a function of racking density. They estimated that risks could be reduced by a factor of 5 by switching from high- to low-density racks. This estimate was based on the reduction of minimum decay times before the fuel could be air cooled, and also on the reduction in the likelihood of propagation of a zirconium cladding fire from recently discharged fuel assemblies to older fuel assemblies in the low-density racks compared to high-density racks. However, Sailor et al. (1987) cautioned that “the uncertainties in the risk estimate are large.

The regulatory analysis for the resolution of Generic Issue 821 (Throm, 1989) was intended to determine whether the use of high-density racks poses an unacceptable risk to the health and safety of the public. The analysis concluded that no regulatory action was needed; that is, the use of high-density storage racks posed an acceptable risk. The technical analysis was based on the studies of Benjamin et al. (1979) and Sailor et al. (1987) and used the factor-of-5 reduction in the likelihood (i.e., the conditional probability of a fire given a drained pool) of a zirconium cladding fire for switching to low-density racks from high-density racks. A cost-benefit analysis analogous to that employed in USNRC (2014a) found that the costs associated with reracking existing pools (and moving older fuel in the pool to dry storage to accommodate reracking) substantially exceeded the benefits in terms of population dose reductions.

The assumptions and methodology used in the regulatory analysis for Generic Issue 82 are similar to those used in USNRC (2014a): A seismic event is considered the most likely initiator of the accident and spent fuel pool damage frequency is taken to be about 2 × 10–6 events per reactoryear. Moreover, USNRC (2014a) reached essentially the same conclusions as the regulatory analysis for the resolution of Generic Issue 82 (Throm, 1989).

A more pessimistic view on the uncertainties of modeling spent fuel pool loss-of-coolant accidents was expressed by Collins and Hubbard (2001): “In its thermal-hydraulic analysis . . . the staff concluded that it was not feasible, without numerous constraints, to establish a generic decay heat level (and therefore a decay time) beyond which a zirconium fire is physically impossible. Heat removal is very sensitive to these additional constraints, which involve factors such as fuel assembly geometry and SFP rack configuration. However, fuel assembly geometry and rack configuration are plant specific, and both are subject to unpredictable changes after an earthquake or cask drop that drains the pool. Therefore, since a non-negligible decay heat source lasts many years and since configurations ensuring sufficient air flow for cooling cannot be assured, the possibility of reaching the zirconium ignition temperature cannot be precluded on a generic basis.” (p. 5-2)

There is still a great deal to be learned about the impacts of the accident on the Fukushima Daiichi plant, including impacts on spent fuel storage. Additional information will likely be uncovered as the plant is dismantled and studied, perhaps resulting in new lessons learned and revisions to existing lessons, including those in this report.

References

ACRS (Advisory Committee on Reactor Safeguards). 2012a. Draft Interim Staff Guidance Documents in Support of Tier 1 Orders. July 17. http://pbadupws.nrc.gov/ docs/ML1219/ML12198A196.pdf.

ACRS. 2012b. Response to the August 15, 2012 Edo Letter Regarding ACRS Recommendations in Letter Dated July 17, 2012 on the Draft Interim Staff Guidance Documents in Support of Tier 1 Orders. November 7. http://pbadupws.nrc.gov/docs/ML1231/ML12312A197.pdf

ACRS. 2013. Spent Fuel Pool Study. July 18. http://pbadupws.nrc.gov/docs/ ML1319/ML13198A433.pdf.

AFM (Department of the Army Field Manual). 1991. Special Operations Forces Intelligence and Electronic Warfare Operations. Field Manual No. 34-36, Appendix D: Target Analysis Process. September 30. Washington, DC: Department of the Army.

Amagai, M., N. Kobayashi, M. Nitta, M. Takahashi, I. Takada, Y. Takeuch, Y. Sawada, and M. Hiroshima. 2014. Factors related to the mental health and suicidal thoughts of adults living in shelters for a protracted period following a large-scale disaster. Academic Journal of Interdisciplinary Studies 3(3): 11-16.

ASME/ANS (American Society of Mechanical Engineers/American Nuclear Society). 2009. Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications.

ASME/ANS RA-Sa-2009. New York: ASME Technical Publishing Office.

Bader, J. A. 2012. Inside the White House during Fukushima: Managing Multiple Crises. Foreign Affairs (Snapshots), March 8. http://www.foreignaffairs.com/articles/137320/jeffrey-a-bader/inside-the-white-house-during-fukushima#.

Benjamin, A. S., D. J. McCloskey, D. A. Powers, and S. A. Dupree. 1979. Fuel Heat-up Following Loss of Water during Storage. NUREG/CR-0649, SAND77-1371. Albuquerque, NM: Sandia National Laboratories. http://pbadupws.nrc.gov/docs/ML1209/ ML120960637.pdf.

Bennett, B. T. 2007. Understanding, Assessing, and Responding to Terrorism: Protecting Critical Infrastructure and Personnel. Hoboken, NJ: John Wiley & Sons.

Bier, V., M. Corradini, R. Youngblood, C. Roh, and S. Liua. 2014. Development of an updated societal-risk goal for nuclear power safety: Probabilistic safety assessment and management, PSAM-12. INL/CON-13-30495. Proceedings of the Conference on Probabilistic Safety Assessment and Management, Honolulu, Hawaii, June 22-27. http:// psam12.org/proceedings/paper/paper_199_1.pdf

Blustein, P. September 26 2013. Fukushima’s Worst-Case Scenarios. Much of what you’ve heard about the nuclear accident is wrong. Slate.com

http://www.slate.com/articles/health_and_science/science/2013/09/fukushima_disaster_new_information_about_worst_case_scenarios.2.html

Boyd, C. F. 2000. Predictions of Spent Fuel Heatup after a Complete Loss of Spent Fuel Pool Coolant. NUREG-1726. Washington, DC: U.S. Nuclear Regulatory Commission. http://pbadupws.nrc.gov/docs/ML0037/ML003727905.pdf.

Bromet, E. J., and L. Litcher-Kelly. 2002. Psychological response of mothers of young children to the Three Mile Island and Chernobyl Nuclear Plant accidents one decade later. In J. Havenaar, J. Cwikel, and E. Bromet (Eds.), Toxic Turmoil: Psychological and Societal Consequences of Ecological Disasters (pp. 69-84). New York: Springer Science+Business Media LLC/Springer US.

Brown, G. G., and L. A. Cox, Jr. 2011a. Making terrorism risk analysis less harmful and more useful: Another try. Risk Analysis 31(2): 193-195.

Brown, G. G., and L. A. Cox, Jr. 2011b. How probabilistic risk assessment can mislead terrorism risk analysts. Risk Analysis 31(2): 196-204.

Budnitz, R. J., G. Apostolakis, D. M. Boore, L. S. Cluff, K. J. Coppersmith, C. Allin Cornell, and P. A. Morris. 1998. Use of technical expert panels: Applications to probabilistic seismic hazard analysis. Risk Analysis 18(4): 463-469.

Chen, S. R., W. C. Lin, Y. M. Ferng, C. C. Chieng, and B. S. Pei. 2014. CFD simulating the transient thermal–hydraulic characteristics in a 17 x 17 bundle for a spent fuel pool under the loss of external cooling system accident. Annals of Nuclear Energy 73(2014): 241-249.

Clauset, A., M. Young, and K. S. Gleditsch. 2007. On the frequency of severe terrorist events. Journal of Conflict Resolution 51(1): 58-87.

Cleveland, K. May 18, 2014. Mobilizing Nuclear Bias: The Fukushima Nuclear Crisis and the Politics of Uncertainty. The Asia-Pacific Journal.  http://apjjf.org/2014/12/20/Kyle-Cleveland/4116/article.html

Collins, T. E., and G. Hubbard. 2001. Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants. NUREG-1738. Washington, DC: U.S. Nuclear Regulatory Commission. http://pbadupws.nrc.gov/docs/ML0104/ ML010430066.pdf.

Cooke, R. M., A. M. Wilson, J. T. Tuomisto, O. Morales, M. Tainio, and J. S. Evans. 2007. A probabilistic characterization of the relationship between fine particulate matter and mortality: Elicitation of European experts. Environ Science & Technology 41(18): 6598-6605.

Danzer, A. M., and N. Danzer. 2014. The Long-Run Consequences of Chernobyl: Evidence on Subjective Well-Being, Mental Health and Welfare. Center for Economic Studies and Ifo Institute, Working Paper No. 4855.

DCLG (Department for Communities and Local Government). 2009. Multi-criteria analysis: A manual. 08ACST05703. London: DCLG. https://www.gov.uk/government/ uploads/system/uploads/attachment_data/file/7612/1132618.pdf

Denning, R., and S. McGhee. 2013. The societal risk of severe accidents in nuclear power plants. Transactions of the American Nuclear Society 108: 521-525.

DHS (U.S. Department of Homeland Security). 2010. Nuclear Reactors, Materials, and Waste Sector-Specific Plan: An Annex to the National Infrastructure Protection Plan. Washington, DC: DHS. https://www.dhs.gov/xlibrary/assets/nipp-ssp-nuclear-2010.pdf

DHS. 2013. NIPP 2013: Partnering for Critical Infrastructure Security and Resilience. Washington, DC: DHS. http://www.dhs.gov/sites/default/files/publications/National-Infrastructure-Protection-Plan-2013-508.pdf

EPRI (Electric Power Research Institute). 2004. Probabilistic Consequence Analysis of Security Threats—A Prototype Vulnerability Assessment Process for Nuclear Power Plants. Technical Report No. 1007975. Palo Alto, CA: EPRI.

EPRI. 2012a. Summary of the EPRI Early Event Analysis of the Fukushima Daiichi Spent Fuel Pools Following the March 11, 2011 Earthquake and Tsunami in Japan, Technical Update. Palo Alto, CA: EPRI. http://www.epri.com/abstracts/Pages/ ProductAbstract.aspx?ProductId=000000000001025058

EPRI. 2012b. Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty. Palo Alto, CA: EPRI. http://www. epri.com/abstracts/Pages/ProductAbstract.aspx?ProductId=000000000001026511

Ezell, B., and A. Collins. 2011. Letter to the Editor. Risk Analysis 31(2): 192.

Ezell, B. C., S. P. Bennett, D. von Winterfeldt, J. Sokolowski, and A. J. Collins. 2010. Probabilistic risk analysis and terrorism risk. Risk Analysis 30(4): 575-589. https://www.dhs.gov/xlibrary/assets/rma-risk-assessment-technical-publication.pdf.

Forester, J., A. Kolaczkowski, S. Cooper, D. Bley, and E. Lois. 2007. ATHEANA User’s Guide: Final Report. NUREG 1880. Washington, DC: U.S. Nuclear Regulatory Commission. http://pbadupws.nrc.gov/docs/ML0721/ML072130359.pdf.

Frye, R. M., Jr. 2013. The use of expert elicitation at the U.S. Nuclear Regulatory Commission. Albany Law Journal of Science and Technology 23(2): 309-382. http://www.albanylawjournal.org/Documents/Articles/23.2.309-Frye.pdf.

GAO (U.S. Government Accountability Office). 2006. Nuclear Power Plants: Efforts Made to Upgrade Security, but the Nuclear Regulatory Commission’s Design Basis Threat Process Should Be Improved. GAO-06-388. Washington, DC: GAO. http://www.gao. gov/new.items/d06388.pdf.

Garrick, B. J., J. E. Hall, M. Kilger, J. C. McDonald, T. O’Toole, P. S. Probst, E. R. Parker, R. Rosenthal, A. W. Trivelpiece, L. A. VanArsdal, and E. L. Zebroski. 2004. Confronting the risks of terrorism: Making the right decisions. Reliability Engineering and System Safety 86(2): 129-176.

Gauntt, R., D. Kalinich, J. Cardoni, J. Phillips, A. Goldmann, S. Pickering, M. Francis, K. Robb, L. Ott, D. Wang, C. Smith, S. St. Germain, D. Schwieder, and C. Phelan. 2012. Fukushima Daiichi Accident Study (Status as of April 2012). SAND2012-6173. Albuquerque, NM, and Livermore, CA: Sandia National Laboratories. https://fukushima.inl.gov/PDF/FukushimaDaiichiAccidentStudy.pdf.

GIF (The Proliferation Resistance and Physical Protection Evaluation Methodology Working Group of the Generation IV International Forum). 2011. Evaluation Methodology for Proliferation Resistance and Physical Protection of Generation IV Nuclear Energy Systems. Revision 6. September 15. GEN IV International Forum. https:// www.gen-4.org/gif/upload/docs/application/pdf/2013-09/gif_prppem_rev6_final.pdf. (Last accessed March 8, 2016.)

Gneiting, T., F. Balabdaoui, and A. E. Raftery. 2007. Probabilistic forecasts, calibration and sharpness. Journal of the Royal Statistical Society, Series B 69(2): 243-268. http://onlinelibrary.wiley.com/doi/10.1111/j.1467-9868.2007.00587.x/epdf

Government of Japan. 2011. Report of Japanese Government to the IAEA Ministerial Conference on Nuclear Safety: The Accident at TEPCO’s Fukushima Nuclear Power Stations. June. Tokyo: Government of Japan NERHQ (Nuclear Emergency Response Headquarters). www.kantei.go.jp/foreign/kan/topics/201106/iaea_houkokusho_e.html

Government of Japan. 2015. Events and Highlights on the Progress Related to Recovery Operations at Fukushima Daiichi Nuclear Power Station https://www. iaea.org/sites/default/files/highlights-japan1115.pdf

Hasegawa, A., K. Tanigawa, A. Ohtsuru, H. Yabe, M. Maeda, J. Shigemura, T. Ohira, T. Tominaga, M. Akashi, N. Hirohashi, T. Ishikawa, K. Kamiya, K. Shibuya, S. Yamashita, and R. K. Chhem. 2015. Health effects of radiation and other health problems in the aftermath of nuclear accidents, with an emphasis on Fukushima. The Lancet 386(9992): 479-488.

Hirschberg, S., C. Bauer, P. Burgherr, E. Cazzoli, T. Heck, M. Spada, and K. Treyer. 2016. Health effects of technologies for power generation: Contributions from normal operation, severe accidents and terrorist threat. Reliability Engineering and System Safety 145(2016): 373-387.

Hugo, B. R., and R. P. Omberg. 2015. Evaluation of Fukushima Daiichi Unit 4 spent fuel pool. International Nuclear Safety Journal 4(2): 1-5.

Hung, T.-C., V. K. Dhir, B.-S. Pei, Y.-S. Chen, and F. P. Tsai. 2013. The development of a three-dimensional transient CFD model for predicting cooling ability of spent fuel pools. Applied Thermal Engineering 50(2013): 496-504. IAEA (International Atomic Energy Agency). 2015. The Fukushima Daiichi Accident. http://www-pub.iaea.org/books/IAEABooks/10962/The-Fukushima-DaiichiAccident

Insua, D. R., and S. French. 1991. A framework for sensitivity analysis in discrete multi-objective decision-making. European Journal of Operational Research 54(2): 176-190. Investigation Committee (Investigation Committee on the Accident at Fukushima Nuclear Power Stations of Tokyo Electric Power Company). 2011. Interim Report. December 26. Tokyo: Government of Japan. http://www.cas.go.jp/jp/seisaku/icanps/ eng/interim-report.html

Investigation Committee. 2012. Final Report on the Accident at Fukushima Nuclear Power Stations of Tokyo Electric Power Company. July 23. Tokyo: Government of Japan. http://www.cas.go.jp/jp/seisaku/icanps/eng/final-report.html

Jäckel, B. S. 2015. Status of spent fuel in the reactor buildings of Fukushima Daiichi 1-4. Nuclear Engineering and Design 283(March): 2-7.

Jo, J. H., P. F. Rose, S. D. Unwin, V. L. Sailor, K. R. Perkins, and A. G. Tingle. 1989. Value/ Impact Analyses of Accident Preventive and Mitigative Options for Spent Fuel Pools. NUREG/CR-5281, BNL-NUREG-52180. Upton, NY, and Washington, DC: Brookhaven National Laboratory and U.S. Nuclear Regulatory Commission. http://pbadupws.nrc.gov/docs/ML0716/ML071690022.pdf

Kaplan, S., and B. J. Garrick. 1981. On the quantitative definition of risk. Risk Analysis 1(1): 11-27.

Karz, A., J. Reichstein, R. Yanagisawa, and C. L. Katz. 2014. Ongoing mental health concerns in post-3/11 Japan. Annals of Global Health 80(2): 108-114.

Keeney, R. L., and D. von Winterfeldt. 1991. Eliciting probabilities from experts in complex technical problems. IEEE Transactions on Engineering Management 38: 191-201. Kondo, S. 2011. Sketches of Scenarios of Contingencies at Fukushima Daiichi Nuclear Power Plant [in Japanese]. March 25. http://www.asahi-net.or.jp/~pn8r-fjsk/saiakusinario.pdf

Kotra, J. P., M. P. Lee, N. A. Eisenberg, and A. R. DeWispelare. 1996. Branch Technical Position on the Use of Expert Elicitation in the High-Level Radioactive Waste Program. NUREG-1563. November. Washington, DC: U.S. Nuclear Regulatory Commission. http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1563/sr1563.pdf

Kubota, Yoko. February 17, 2012. Factbox: Japan ‘s hidden nightmare scenario for Fukushima. Reuters.

Lewis, E. E. 2008. Fundamentals of Nuclear Reactor Physics. Burlington, MA, and San Diego, CA: Academic Press (Elsevier). Lienhard IV, J. H., and J. H. Leinhard V. 2015. A Heat Transfer Textbook, 4th Edition. Cambridge, MA: Philgiston Press. http://ahtt.mit.edu/.

Lindgren, E. R., and S. G. Durbin. 2007. Characterization of Thermal-Hydraulic and Ignition Phenomena in Prototypic, Full-Length Boiling Water Reactor Spent Fuel Pool Assemblies Phenomena in Prototypic, Full-Length Boiling Water Reactor Spent Fuel Pool Assemblies 2270. Washington, DC, and Albuquerque, NM: U.S. Nuclear Regulatory Commission and Sandia National Laboratory. http://pbadupws.nrc.gov/docs/ML1307/ ML13072A056.pdf.

Masunaga, T., A. Kozlovsky, A. Lyzikov, N. Takamura, and S. Yamashit. 2014. Mental health status among younger generation around Chernobyl. Archives of Medical Science 9(6): 1114-1116. Mellers, B., E. Stone, T. Murray, A. Minster, N. Rohrbaugh, M. Bishop, E. Chen, J. Baker, Y. Hou, M. Horowitz, L. Ungar, and P. Tetlock. 2015. Identifying and cultivating superforecasters as a method for improving probabilistic predictions. Perspectives on Psychological Science 10(3): 267-281. MOE (Japan Ministry of the Environment). 2015. Progress on Off-site Cleanup Efforts in Japan (April). Tokyo: MOE. http://www.export.gov/japan/build/groups/public/@eg_jp/documents/webcontent/eg_jp_085466.pdf.

Morgan, M. G. 2014. Use (and abuse) of expert elicitation in support of decision making for public policy. Proceedings of the National Academy of Sciences of the United States of America 111(20): 7176-7184. http://www.pnas.org/content/111/20/7176. full.pdf.

NAIIC (Nuclear Accident Independent Investigation Commission). 2012. The Official Report of the Fukushima Nuclear Accident Independent Investigation Commission. Tokyo: National Diet of Japan. https://www.nirs.org/fukushima/naiic_report.pdf.

NEA (Nuclear Energy Agency). 2015. Status Report on Spent Fuel Pools under Loss-ofCooling and Loss-of-Coolant Accident Conditions: Final Report. NEA/CNSI/R(2015)-2. Paris: NEA–Organisation for Economic Co-Operation and Development. https://www.oecd-nea.org/nsd/docs/2015/csni-r2015-2.pdf.

NEI (Nuclear Energy Institute). 2009. B.5.b Phase 2 & 3 Submittal Guidance. NEI 06-12, Revision 3. Washington, DC: NEI.

NEI. 2012. Diverse and Flexible Coping Strategies (FLEX) Implementation Guide. NEI 12-06, Revision B1. Washington, DC: NEI. http://pbadupws.nrc.gov/docs/ML1214/ ML12143A232.pdf.

Nishihara, K., H. Iwamoto, and K. Suyama. 2012. Estimation of Fuel Compositions in Fukushima-Daiichi Nuclear Power Plant. JAEA-Data/Code 2012-018. Tokai, Japan: Japan Atomic Energy Agency.

NRA (Nuclear Regulation Authority of Japan). 2013. Monitoring Air Dose Rates from a Series of Aircraft Surveys across the Two Years after the Fukushima Daiichi NPS Accident. June 5. Tokyo: Radiation Monitoring Division, Secretariat of the Nuclear Regulation Authority. https://www.nsr.go.jp/data/000067128.pdf.

NRA. 2014. Analysis of the TEPCO Fukushima Daiichi NPS Accident: Interim Report (Provisional Translation). October. Tokyo: NRA. https://www.iaea.org/sites/ default/files/anaylysis_nra1014.pdf.

NRC (National Research Council). 2004. Safety and Security of Commercial Spent Nuclear Fuel Storage (U). Washington, DC: National Research Council.

NRC. 2006. Safety and Security of Commercial Spent Nuclear Fuel Storage: Public Report. Washington, DC: The National Academies Press. http://www.nap. edu/catalog/11263/safety-and-security-of-commercial-spent-nuclear-fuel-storage-public.

NRC. 2008. Department of Homeland Security Bioterrorism Risk Assessment: A Call for Change. Washington, DC: The National Academies Press. http://www.nap. edu/catalog/12206/department-of-homeland-security-bioterrorism-risk-assessment-a-callfor.

NRC. 2010. Review of the Department of Homeland Security’s Approach to Risk Analysis. Washington, DC: The National Academies Press. http://www.nap. edu/catalog/12972/review-of-the-department-of-homeland-securitys-approach-to-riskanalysis.

NRC. 2011. Understanding and Managing Risk in Security Systems for the DOE Nuclear Weapons Complex. Washington, DC: The National Academies Press. http:// www.nap.edu/catalog/13108/understanding-and-managing-risk-in-security-systems-forthe-doe-nuclear-weapons-complex.

NRC. 2014. Lessons Learned from the Fukushima Nuclear Accident for Improving Safety of U.S. Nuclear Plants. Washington, DC: The National Academies Press. http://www.nap.edu/catalog/18294/lessons-learned-from-the-fukushima-nuclear-accidentfor-improving-safety-of-us-nuclear-plants.

OMB (U.S. Office of Management and Budget). 1992. Guidelines and Discount Rates for Benefit-Cost Analysis of Federal Programs. Circular No. A-94. Washington, DC: Office of Management and Budget. https://www.whitehouse.gov/sites/default/files/ omb/assets/a94/a094.pdf.

Parfomak, P. W. 2014. Physical Security of the U.S. Power Grid: High Voltage Transformer Substations. July 17. Washington, DC: Congressional Research Service.

Petersen, M. D., A. D. Frankel, S. C. Harmsen, C. S. Mueller, K. M. Haller, R. L. Wheeler, R. L. Wesson, Y. Zeng, O. S. Boyd, D. M. Perkins, N. Luco, E. H. Field, C. J. Wills, and K. S. Rukstales. 2008. Documentation for the 2008 Update of the United States National Seismic Hazard Maps. U.S. Geological Survey Open-File Report 2008–1128. Reston, VA: U.S. Geological Survey. http://pubs.usgs.gov/of/2008/1128/. (Last accessed February 26, 2016.)

Povinec, P., K. Hirose, and M. Aoyama. 2013. Fukushima Accident: Radioactivity Impact on the Environment. Waltham, MA: Elsevier.

RJIF (Rebuild Japan Initiative Foundation’s Independent Investigation Commission on the Fukushima Nuclear Accident). 2014. The Fukushima Daiichi Nuclear Power Station Disaster: Investigating the Myth and Reality. London: Routledge.

Ross, K., J. Phillips, R. O. Gauntt, and K. C. Wagner. 2014. MELCOR Best Practices as Applied in the State-of-the-Art Reactor Consequence Analyses (SOARCA) Project. NUREG/ CR-7008. Washington, DC: Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission. http://pbadupws.nrc.gov/docs/ML1423/ML14234A136. pdf.

Sailor, V. L., K. R. Perkins, J. R. Weeks, and H. R. Connell. 1987. Severe Accidents in Spent Fuel Pools in Support of Generic Safety, Issue 82. NUREG/CR-4982, BNLNUREG-52093. July. Upton, NY: Brookhaven National Laboratory. http:// www.osti.gov/scitech/servlets/purl/6135335.

Satopää, V., J. Baron, D. P. Foster, B. A. Mellers, P. E. Tetlock, and L. H. Ungar. 2014. Combining multiple probability predictions using a simple logit model. International Journal of Forecasting 30(2): 344-356. Sehgal, B. R. (Ed.). 2011. Nuclear Safety in Light Water Reactors: Severe Accident Phenomenology. Oxford, UK: Academic Press (Elsevier).

Sugiyama, G., J. S. Nasstrom, B. Pobanz, K. T. Foster, M. Simpson, P. Vogt, F. Aluzzi, M. Dillon, and S. Homann. 2013. NARAC Modeling During the Response to the Fukushima Dai-ichi Nuclear Power Plant Emergency. LLNL-CONF-529471. Livermore, CA: Lawrence Livermore National Laboratory. https://e-reports-ext.llnl.gov/ pdf/564098.pdf.

Tateiwa, K. 2015. Spent Fuel and Spent Fuel Storage Facilities at Fukushima Daiichi. Presentation to the Committee on Lessons Learned from the Fukushima Nuclear Accident for Improving Safety and Security of U.S. Nuclear Plants. January 29. Washington, DC: National Academies of Sciences, Engineering, and Medicine.

Teodorczyk, A., and J. E. Shepherd. 2012. Interaction of a Shock Wave with a Water Layer. Technical Report FM2012.002. May. Pasadena, CA: California Institute of Technology. http://shepherd.caltech.edu/EDL/publications/reprints/galcit_fm2012-002. pdf.

TEPCO (Tokyo Electric Power Company). 2011. Fukushima Nuclear Accident Analysis Report (Interim Report). December 2. Tokyo: TEPCO. http://www.tepco.co.jp/ en/press/corp-com/release/11120205-e.html.

TEPCO. 2012a. Fukushima Nuclear Accident Analysis Report. June 20. Tokyo: TEPCO. http://www.tepco.co.jp/en/press/corp-com/release/2012/1205638_1870.html.

TEPCO. 2012b. The Integrity Evaluation of the Reactor Building at Unit 4 in the Fukushima Daiichi Nuclear Power Station. Presentation to the Government and TEPCO’s Mid to Long Term Countermeasure Meeting Management Council. May. https:// www.oecd-nea.org/nsd/fukushima/documents/Fukushima4_SFP_integrity_May_2012. pdf.

TEPCO. 2012c. The skimmer surge tank drawdown at the Unit 4 spent fuel pool. January 23. TEPCO. 2012c. The skimmer surge tank drawdown at the Unit 4 spent fuel pool. January 23. e.pdf. (Last Accessed February 26, 2016.)

Throm, E. 1989. Regulatory Analysis for the Resolution of Generic Issue 82 “Beyond Design Basis Accidents in Spent Fuel Pools.” NUREG-1353. April. Washington, DC: Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission. http:// pbadupws.nrc.gov/docs/ML0823/ML082330232.pdf.

UNSCEAR (United Nations Scientific Committee on the Effects of Atomic Radiation). 2013. Sources, Effects and Risks of Ionizing Radiation. New York: United Nations. http://www.unscear.org/docs/reports/2013/14-06336_Report_2013_Annex_A_Ebook_ website.pdf.

USNRC (U.S. Nuclear Regulatory Commission). 1983. Safety Goals for Nuclear Power Plant Operation. NUREG-0880 (Revision 1). Washington, DC: U.S. Nuclear Regulatory Commission. http://pbadupws.nrc.gov/docs/ML0717/ML071770230.pdf.

USNRC. 1986. Safety Goals for the Operation of Nuclear Power Plants. 51 Federal Register 28044 (August 4, 1986) as corrected and republished at 51 Federal Register 30028 (August 21, 1986).

USNRC. 1990. Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants. NUREG-1150. October. Washington, DC: USNRC. http://www.nrc.gov/ reading-rm/doc-collections/nuregs/staff/sr1150/.

USNRC. 1997a. Perimeter Intrusion and Alarm Systems. Regulatory Guide 5.44 (Rev. 3). Washington, DC: Office of Nuclear Regulatory Research, USNRC.

USNRC. 1997b. Regulatory Analysis Technical Evaluation Handbook, Final Report. NUREG/ BR-0184. January. Washington, DC: Office of Nuclear Regulatory Research, USNRC. http://www.nrc.gov/about-nrc/regulatory/crgr/content-rqmts/nuregbr-0184. pdf.

USNRC. 1997c. Operating Experience Feedback Report: Assessment of Spent Fuel Cooling. NUREG-1275, Vol. 12. Washington, DC: Office for Analysis and Evaluation of Operational Data, USNRC. http://pbadupws.nrc.gov/docs/ML0106/ ML010670175.pdf. (Last accessed April 5, 2016.)

USNRC. 2003. Resolution of Generic Safety Issues. NUREG-0933. October. Washington, DC: USNRC. http://nureg.nrc.gov/sr0933/.

USNRC. 2004. Regulatory Analysis Guidelines of the U.S. Nuclear Regulatory Commission. NUREG/BR-0058, Revision 4. September. Washington, DC: Office of Nuclear Regulatory Research, USNRC. http://www.nrc.gov/reading-rm/doc-collections/nuregs/brochures/br0058/br0058r4.pdf.

USNRC. 2007a. Independent Spent Fuel Storage Installation Security Requirements for Radiological Sabotage. SECY-07-0148. Washington, DC: USNRC.

USNRC. 2007b. A Pilot Probabilistic Risk Assessment of a Dry Cask Storage System at a Nuclear Power Plant. NUREG-1864. Washington, DC: Office of Nuclear Regulatory Research, USNRC. http://pbadupws.nrc.gov/docs/ML0713/ML071340012. pdf.

USNRC. 2009a. Draft Technical Basis for a Rulemaking to Revise the Security Requirements for Facilities Storing Spent Nuclear Fuel and High-Level Radioactive Waste, Revision 1. NRC-2009-0558. http://pbadupws.nrc.gov/docs/ML0932/ML093280743.pdf.

USNRC. 2009b. An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities. RG 1.200, Revision 2. March. Washington, DC: USNRC. http://pbadupws.nrc.gov/docs/ML0904/ML090410014. pdf.

USNRC. 2011a. Intrusion Detection Systems and Subsystems: Technical Information for NRC Licensees. NUREG-1959. March. Washington, DC: Office of Nuclear Security and Incident Response, USNRC. Avalable at http://pbadupws.nrc.gov/docs/ML1111/ ML11112A009.pdf.

USNRC. 2011b. Prioritization of Recommended Actions to Be Taken in Response to Fukushima Lessons Learned. SECY-11-0037. October 3. http://pbadupws. nrc.gov/docs/ML1127/ML11272A111.html.

USNRC. 2012a. Letter from E. J. Leeds and M. R. Johnson with Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events. Order EA-12-049. March 12. Washington, DC: USNRC. http:// pbadupws.nrc.gov/docs/ML1205/ML12054A735.pdf.

USNRC. 2012b. State-of-the-Art Reactor Consequence Analyses (SOARCA) Report. NUREG-1935, January. Washington, DC: Office of Nuclear Regulatory Research, USNRC. http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/ sr1935/.

USNRC. 2012c. Proposed Orders and Requests for Information in Response to Lessons Learned from Japan’s March 11, 2011, Great Tohoku Earthquake and Tsunami. SECY12-0025. February 17. Washington, DC: USNRC. http://pbadupws.nrc.gov/ docs/ML1203/ML12039A111.pdf.

USNRC. 2013. Regulatory Analysis for Japan Lessons-Learned Tier 3 Issue on Expedited Transfer of Spent Fuel. COMSECY 13-0030. November 12. Washington, DC: USNRC. http://www.nrc.gov/reading-rm/doc-collections/commission/commsecy/2013/2013-0030comscy.pdf.

USNRC. 2014a. Consequence Study of a Beyond-Design-Basis Earthquake Affecting the Spent Fuel Pool for a U.S. Mark I Boiling Water Reactor. NUREG-2161. September. Washington, DC: Office of Nuclear Regulatory Research, USNRC. http://pbadupws. nrc.gov/docs/ML1425/ML14255A365.pdf.

USNRC. 2014b. Qualitative Consideration of Factors in the Development of Regulatory Analyses and Backfit Analyses. SECY-14-0087. August 14. Washington, DC: USNRC. http://pbadupws.nrc.gov/docs/ML1412/ML14127A451.pdf.

USNRC. 2016. Revision to JLD-ISG-2012-01: Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for BeyondDesign-Basis External Events. Interim Staff Guidance, Revision 1. January 22. Washington, DC: Japan Lessons-Learned Division, USNRC. http://pbadupws.nrc. gov/docs/ML1535/ML15357A163.pdf. (Last accessed April 5, 2016.)

USNRC NTTF (U.S. Nuclear Regulatory Commission Near-Term Task Force). 2011. Recommendations for Enhancing Reactor Safety in the 21st Century: The Near-Term Task Force Review of Insights from the Fukushima Dai-Ichi Accident. Rockville, MD: USNRC. http://pbadupws.nrc.gov/docs/ML1118/ML111861807.pdf.

Wagner, K. C., and R. O. Gauntt. 2008. Analysis of BWR Spent Fuel Pool Flow Patterns Using Computational Fluid Dynamics: Supplemental Air Cases. SANDIA Letter Report, Revision 3. January.

Wang, C., and V. M. Bier. 2012. Optimal defensive allocations in the face of uncertain terrorist preferences, with an emphasis on transportation. Homeland Security Affairs, DHS Centers of Excellence Science and Technology Student Papers. March. https://www.hsaj.org/articles/210.

Wang, D., I. C. Gauld, G. L. Yoder, L. J. Ott, G. F. Flanagan, M. W. Francis, E. L. Popov, J. J. Carbajo, P. K. Jain, J. C. Wagner, and J. C. Gehin. 2012. Study of Fukushima Daiichi Nuclear Power Station Unit 4 spent-fuel pool. Nuclear Technology 180(2): 205-215.

Wataru, M. 2014. Spent Fuel Management in Japan. International Nuclear Materials Management Spent Fuel Management Seminar XXIX, January 15. http://www. inmm.org/AM/Template.cfm?Section=29th_Spent_Fuel_Seminar&Template=/CM/ ContentDisplay.cfm&ContentID=4373.

Willis, H. H., and T. LaTourrette. 2008. Using probabilistic terrorism risk modeling for regulatory benefit-cost analysis: Application to the Western Hemisphere travel initiative in the land environment. Risk Analysis 28(2): 325-339.

Willis, H. H., T. LaTourrette, T. K. Kelly, S. Hickey, and S. Neill. 2007. Terrorism Risk Modeling for Intelligence Analysis and Infrastructure Protection. Technical Report. Santa Monica, CA: Center for Terrorism Risk Management Policy, RAND.

Wreathall, J., D. Bley, E. Roth, J. Multer, and T. Raslear. 2004. Using an integrated process of data and modeling in HRA. Reliability Engineering and System Safety 83(2): 221-228.