Transcript of First Roundtable on Nuclear Security Issues
Charles D. Ferguson II: Thank you all for coming to the first roundtable meeting at the Council on Foreign Relations on nuclear security issues. I’m glad to see we have a full house, we have two very knowledgeable experts on the subject of spent nuclear fuel pools, and I have to mention that, unlike many other Council functions, this will be on the record. We want this to be a public hearing on this issue, but I don’t intend this to be a point-counterpoint kind of debating. I want this to be an opportunity for the National Academies of Science to present their findings and the Nuclear Regulatory Commission to respond to the report.
If there are not any questions at the outset, let me quickly turn to the first speaker, Dr. Kevin Crowley, who has been with the National Academies since 1993, and he was telling me during lunch that he was an academic for a number of years, and got bored with academic life and decided to enter the exciting world of Public Policy. We are very glad he made that career switch more than 10 years ago, and since 1996 he has been the director of the board of radioactive waste management. He told me that the title has changed to “Nuclear and Radiation Studies Board.” He has a Ph.D. in geology from Princeton University and has held teaching positions at the US Geological Survey, University of Oklahoma, and the University of Miami at Ohio
To my left, we have Daniel Dorman, Deputy Director of Nuclear Security at the NRC. Like me, Dan was in the US nuclear navy for a period of time. He has been with the NRC since 1991 as a project engineer, in the office of nuclear reactor regulation. From 92-99, he served as the project manager in various organizations in the NRR, and has served as chief of quality assurance of the safety assessment section. He has been looking at the issue of spent nuclear fuel security in recent years.
Kevin Crowley: I want to thank you for the invitation and the Council for letting me speak today. Charles gave me two instructions, one to keep my comments to fifteen minutes, which I will endeavor to do, and second was to keep in mind that many members of the audience are not familiar with this topic. So with my apologies for those who are, I would like to spend a little time giving you some background information. After giving you the background information, I’d like to describe the principle study conclusions and recommendations and then raise some policy issues that we can discuss once the presentations are concluded.
The request for the study, represented in the handout you have here, arose out of a paper published in 2003 in Science and Global Security. That paper suggested that an accident or a terrorist attack on a spent fuel pool could result in the release of a large amount of radioactive material to the environment. The paper’s authors recommended that spent fuel older than about 5 years be stored in dry casks to reduce the potential for such releases. The authors of the Science & Global Security article were concerned with the consequences of an accident or a terrorist attack that breeched the spent fuel pool causing the pool coolant to be lost. They concluded that such an event could allow the fuel to heat up to the point were its zirconium metal jacket, also called the zirconium cladding, would begin to oxidize rapidly. That oxidation reaction would be manifested as a fire, and it could lead to the melting of the fuel and the release of radionuclides to the environment if no mitigative actions were taken to cool the fuel. This analysis was based on a publication by the NRC which examined the consequences of a loss-of-pool-coolant event in pools at decommissioned nuclear power plants.
As a result of this publication in Science & Global Security, the industry was faced with the prospect of the large-scale removal of spent fuel from its pools into dry casks. Congress was faced with the prospect of having to subsidize this removal possibly to meet national security objectives. Congress turned to the National Academies for technical advice.
The study that we carried out was requested in the 2003 Energy and Water Development Conference report. That report specifically asked the National Academies to address four issues: potential safety and security risks of spent fuel stored at pools; safety and security advantages, if any, of dry cask storage vs. wet pool storage; potential safety and security advantages, if any, of various dry cask storage designs; and the risk of terrorist attacks on these materials and the risk that these materials could be used in a radiological dispersal device.
Nuclear fuel becomes spent, or used, after it has been in a reactor for between about 4.5 and 6 years. The fuel is not actually exhausted at this point, but is no longer an economically viable heat source. Every 18 to 24 months about a third of the fuel of an operating commercial nuclear reactor is removed. The fuel is highly radioactive and continues to produce a large amount of heat through radioactive decay, called “decay heat,” after its removal. A typical spent fuel assembly generates tens of kilowatts of heat immediately after its removal from a reactor. It is cooled by placing it in a water-filled pool that has an active heat removal system. The water in the pool also shields workers from the intense radiation emitted from the fuel.
Most U.S. commercial nuclear power plants were designed with small spent fuel pools-- typically about 40 feet on a side holding hundreds of thousands of gallons of water--because it was assumed that the spent fuel would be sent off-site to be recycled within a couple of years after its removal. But a commercial reprocessing industry never developed in the U.S., so all spent fuel produced by commercial power plants, with a few minor exceptions, has continued to be stored on site.
Power plant operators have taken two steps to accommodate these larger-than-expected on-site spent fuel inventories. First, spent fuel pools have been re-racked to increase the density of storage of spent fuel by about a factor of 5. That is, it has been re-racked so that the spent fuel can be stored more closely together. Typical spent fuel pools can hold the equivalent of 5 to 7 reactor cores of fuel, or several hundred metric tons of fuel. A typical commercial reactor core holds about one hundred metric tons of fuel, so a fuel pool can hold about 5 to 7 times that amount. The heat loads in such pools can be several megawatts.
Second, spent fuel older than about five years is being removed in some plants and stored in massive steel and concrete dry casks on reinforced concrete pads. These dry casks have no moving parts. The fuel is cooled through a combination of radiation, conduction, and convection processes. Radiation shielding is provided by the robust steel and concrete construction of the cask, which can weigh over a hundred metric tons. The use of dry casks to store spent fuel is possible because decay-heat production drops by a factor of about 100 in about five years after the spent fuel is discharged from the reactor, so it no longer needs active cooling.
The main issue with dry cask storage is its cost. It can cost a utility several tens of millions of dollars to build and license a dry cask storage facility and over a million dollars to purchase and load a single dry cask. The cask can only hold between 10 and 15 metric tons of fuel, so three to four casks are needed for each reactor discharge every 18 to 24 months. Additionally, some utilities have run into state and local opposition in efforts to develop dry cask storage facilities.
So with that background in hand, let me turn to our study. Our study was supported by the NRC and DHS as directed by Congress. The National Academies appointed a committee of experts to serve as the responsible study body. The committee has expertise in structural mechanics, fuel behavior, metal combustion, security, health physics, and human factors. The chairman of the committee, Louis Lanzerotti, is a distinguished scientist and a member of the National Academy of Engineering. I served as the study director. The committee gathered information for its report from a variety of sources. It received classified briefings from the NRC and DHS. It received briefings from authors of the Science & Global Security paper. It received briefings from foreign experts and many other people. The committee visited operating spent fuel storage facilities in the U.S. and Germany. It turns out the Germans are doing some special things with spent fuel storage. The committee issued a classified report to Congress and to the study sponsors in July 2004, and it issued the public report in April of 2005. The public report was released after protracted discussions with the NRC about what was appropriate for public consumption.
Let me now turn to describing some of the principle study results.
The committee judges that successful terrorist attacks on spent fuel pools, though difficult, are possible. If an attack leads to a propagating zirconium cladding fire, it could result in the release of large amounts of radioactive material. The committee concluded that attacks by knowledgeable terrorists with access to appropriate technical means are possible. The committee identified several terrorist attack scenarios that it believed could partially or completely drain a spent fuel pool and lead to zirconium cladding fires. Details are provided in the committee’s classified report. I cannot discuss the details here.
Additional analyses are needed to understand more fully the vulnerabilities and consequences of events that could lead to propagating zirconium cladding fires. The committee recognized that the potential vulnerabilities of spent fuel pools to terrorist attacks are plant-design specific. That is, they depend on the location of the pool with respect to ground level, the location of walls and other structures that could protect the pool from line-of-sight attacks, and the nature of the surrounding terrain that might make certain types of attacks easier or more difficult to carry out. The committee recommended that the Nuclear Regulatory Commission undertake plant-by-plant analyses to obtain a better understanding of potential vulnerabilities. The committee also recommended that the Commission undertake additional analyses to better understand the potential consequences of certain kinds of terrorist attacks and to better understand the initiation and propagation of zirconium cladding fires in spent fuel pools. The committee concluded that once these analyses were complete, the commission itself might determine that earlier than planned movements of fuel from pools to dry casks might be prudent at some plants.
It appears to be feasible to reduce the likelihood of a zirconium cladding fire by rearranging spent fuel assemblies in the pool and making provision for water spray systems that would be able to cool the fuel, even if the pool or overlying building were severely damaged. The good news from this study is that the committee did not recommend the large-scale movement of spent fuel from pools to dry casks because less expensive steps are available to reduce vulnerabilities. The committee explicitly recommended the rearrangement of spent fuel in the pool so that the more recently discharged “hot” assemblies are surrounded by cooler assemblies. This buys more time to take mitigative actions after a loss-of-pool coolant event and, in some cases, will prevent the possibility of a fire altogether. This step could be taken at little time, cost, or exposure of workers to radiation. The committee determined that a water spray system that delivered on the order of 100 gallons per minute onto the tops of the fuel assemblies could also help prevent such fires. The committee notes that such a system could be difficult to design and expensive to install and, moreover, that it may not be needed at all plants. It recommended that cost-benefit considerations be used to determine the needs for these systems.
Dry cask storage has inherent security advantages over pool storage, but it can only be used to store older spent fuel. There are no large security differences among different storage-cask designs. The main advantage of dry cask storage is that it is a passive and robust system, and that each cask stores only a small amount of fuel. Thus, less fuel is at risk in a terrorist attack. While all dry casks could be breached by some types of terrorist attacks, the amount of material that would be released would be relatively small and releases would occur by mechanical means, which would result in less dispersal compared to a zirconium cladding fire. Moreover, there are relatively simple steps that could be taken to make dry casks less vulnerable to terrorist attacks.
It would be difficult for terrorists to steal enough spent fuel from storage facilities for use in a significant radiological dispersal device (dirty bomb). The committee concluded that the size of the spent fuel assemblies and the security procedures in place at power plants combine to make theft difficult. It might be easier for a knowledgeable insider to steal a piece of a fuel rod, but even this would be difficult. The committee recommended that the Nuclear Regulatory Commission review and upgrade its requirements for protecting fuel rods from theft by knowledgeable insiders, especially where individual rods or portions are rods are being stored in pools.
Let me close by raising four policy issues that arise from the report that might be fodder for discussion after the presentations have concluded:
In the absence of quantitative criteria for determining risk, how does one judge which terrorist attack scenarios are credible? The committee and the Nuclear Regulatory Commission examined essentially the same set of data and came to different conclusions about the credibility of some types of terrorist attacks. Is it possible to develop criteria to determine the credibility of various types of attacks?
How should the responsibility for infrastructure protection be apportioned between industry and the government? During this study the committee heard from both the Nuclear Regulatory Commission and the industry that the federal government should take responsibility for preventing the kinds of large-scale terrorist attacks carried out on 9/11. Industry should not be responsible for protecting plants from such attacks. In Germany, the industry is taking steps at the prodding of the government for protecting plants from such attacks.
How to balance infrastructure protection investments across different industrial sectors? The committee heard repeatedly that nuclear power plants are much better protected than most other industrial infrastructure and that the attention and investments should be directed elsewhere. The committee was not asked by Congress to examine this issue.
How to balance information protection and sharing in a democratic society? The committee received many comments during its study from the public and industry about the lack of information sharing about potential vulnerabilities. Even some Commission staff privately expressed frustration with their inability to share information. The committee ran head-on into this issue in its attempts to release a public version of this report.
Charles Ferguson: Kevin, that was excellent, great overview and I am glad that you raised those policy issues so that they will be in the forefront of our minds. So now let me turn to Daniel Dorman, and find out what the NRC has been doing.
Dan Dorman: Thank you, Charles, and thank you, everybody, I appreciate the opportunity to be here today, and thank you, Kevin, for that overview. First, let me set the stage with where the NRC was with regards to security for the spent fuel pools before 9-11 even occurred. Kevin mentioned that several times from different speakers in his meetings on this study panel how robust the security was for these facilities. These facilities are embedded in the nuclear power plants. The security for nuclear power plants is among the best in civilian infrastructure before 9-11 even occurred. Following the attacks on the World Trade Center and the Pentagon we took all of our licensees to the highest security level. In the days and weeks after 9-11, we continued to work with our partners in the federal family to understand what this new threat environment meant to our license community, and we issued several dozen advisories to our licensees recommending several additional security measures that could be put in place for the interim. By early 2002, the NRC issued a series of orders to its licensees imposing what we called interim compensatory measures. Requirements that we put on our licensees to enhance the number of security officers increased, the standoff distances related to explosive weapons, increasing access controls to the facilities and so on. In 2002, we were focused on working with the intelligence community and the law enforcement community. We developed a supplement to what we called our “design basis threat,” which is a set of adversary characteristics, a description of capabilities of an adversary against which we require the nuclear power plant licensees to protect with high assurance. If you’re familiar with our regulatory construct, most of the things we do, we do with a measure of reasonable assurance of adequate protection health and safety, that’s our statutory authority, that’s our regulatory authority. This is the one area where we require high assurance against a design basis threat. In early 2003, we issued orders requiring supplements to the design basis threat increasing the numbers and capabilities of the adversaries. Over the course of 2003 and 2004, the licensees were developing revised security plans to enhance their ability to protect. All of that applies to the nuclear power plant, which includes the spent fuel pool within the power plant. So in that context, let me turn to the discussion of the NAS report.
We continue, even after the implementation of the revised design basis threat, to look at opportunities to enhance the protection of all of our facilities, including the spent fuel pools. And in that context, the Commission appreciated the efforts of the NAS panel in looking at this issue. There were some areas where the Commission had some disagreement with some of the findings and recommendations of the panel. Kevin touched on the question of the scenarios and which scenarios do you constitute as credible. The panel used the concept of what they defined as the maximum credible scenario. As they applied this in the context of their report, again as Kevin indicated, getting into the details of the various scenarios we won’t be able to do in this context, but as the Commission had looked at what the panel had done, the Commission concluded that the application of that concept as presented by the academies has caused the NRC to focus its resources potentially on things that are not as important and not as credible. I think this goes right to question that Kevin raised right in the first point of his four issues. The Commission determined, sometime back, as a matter of policy, that it was not reasonable to conclude, quantitatively, the probability of an attack on any of these facilities. That was a point with which we agreed with the NAS panel. So I think the first policy question that Kevin posed is a very good one for us to take on here.
Not withstanding that, there are a number of areas where the Commission agreed with the findings and recommendations of the panel, from which we have taken a number of actions. With regard to the propagating zirconium cladding fire, the Academy recommended a number of additional analyses. We are looking at that actual zirconium cladding fire in the open environment in the pool, as Kevin mentioned. We are also doing a number of analyses looking at the vehicle for actually creating the conditions for the appearance of a zirconium cladding fire. So we are looking at the phenomena of attacks which would lead to a drain down of spent fuel pools, which is a prerequisite for creating the conditions for that fire. Kevin mentioned the feasibility of reducing the likelihood of the zirconium cladding fire even if the pool or the overlying pool were severely damaged, the NRC referred to these elsewhere in the report as prompt and effective measures. We have referred that information to our licensees in July of last year.
We conducted workshops with our licensees to address implementation of these recommendations in February of this year. The implementation of those recommendations by our licensees is expected by the end of this year. On his last item here, is it difficult for terrorists to steal enough HEU from the storage facilities? The Commission agrees that that would be extremely difficult. We think the likelihood of that occurring is extremely low. However, we have had over the last several years instances in which licensees, for various reasons, were unable to account for pieces of spent fuel within the pools. The incident at Millstone Unit 1, in which they identified some pieces missing and after investigation were not able to conclusively determine where that material was. They believe and we believe based upon their investigation that they [the missing spent fuel pieces] were treated as other loose pieces that were sent to a leased storage site and that it is now in a site that is licensed for waste material, but not nuclear fuel waste material.
As a follow up to that event, the NRC conducted a series of inspections at its nuclear power plants, one of the outcomes of that was the identification about 1.5 or 2 yrs ago at the Vermont Yankee power station that they were not able to account for material that was in their inventory and that they could not identify it in the pool. They conducted an investigation for about three months and ultimately found that material in their pool. It was in a sealed canister in their pool. That knowledge had not passed down through their staff as it went along. As a result of those events and other NRC inspections to date, the NRC issued a bulletin to its licensees in February of this year. Its licensees mostly have responded to that, and there are still responses coming in. But we expect to do some very focused inspections, based on the information we have, at about a dozen plants later this year, and then make recommendations to the plants for improvement in practices related to inventories by its licensees as well as improvements in the NRC’s own oversight practices in that area.
Charles Ferguson: Thank you very much for that Dan. That was a good overview.
I will use my prerogative as chair to ask the first question of both of you. I know the National Academy specifically was not asked to address the issue of moving spent fuel to Yucca Mountain or some other permanent disposal site, but certainly there should be in the back of our minds or in the forefront of our minds wondering of a way to make it a win-win situation where you eventually have to move spent nuclear fuel to some permanent depository, whether its Yucca or someplace else, where you would have to have it in a dry storage cask. Now it is my understanding, correct me if I’m wrong, the storage casks used in some places is different than the transport casks envisioned using for Yucca Mountain. But I’m wondering if it would be worthwhile to do some kind of study looking at a way to create a dual-purpose cask that could serve as interim dry storage at the power plant and eventually use that same kind of cask to transport to Yucca or some other facility. And I’m wondering if there is some kind of way to create cost savings by doing that? The other question I have in mind is, and I know that this is an unclassified setting here, and its on the record here so that we can’t get into specific plants and plant vulnerabilities, can you, out of the 100 or so commercial nuclear reactors in the United States, can you identify the 10 or 10% or high priority places that might have some higher vulnerability with their spent nuclear fuel pools? And if that is the case, and we are only talking 10, what’s the cost benefit trade off there? Is it worthwhile spending x number of dollars, whatever that amount is, to just focus on the top ten pools and not worry so much about the others?
Daniel Dorman: I think that there are several people around the table that can speak more to the dual-purpose cask, and certainly that has been a topic of discussion over the years and certainly would be savings associated with simply transferring material from one cask to another just for the purposes of transporting it, especially when it could have been just stored in that transport cask. Let me go to the second question, focusing on the higher priority sites, I think the Academy pointed out some characteristics that were important to consider the relative vulnerabilities of sites. I think that when you look at the benefit accrued based on the studies to date associated with the prompt and effective measures they recommended and are being implemented, I think that the remaining risk exposure will be difficult to get a cost benefit associated with, as Kevin mentioned about the costs associated with off-loading. I think the academy pointed out in their report as well that there is a substantial infrastructure issue associated with building enough casks in the timeframe associated with doing some large scale transfer of fuel from pools to casks. So there is, just on the side of asking to build that many casks, also an issue that needs to be weighed in there.
Kevin Crowley: They [dual-purpose casks] exist right now. As for current dry cask storage, my understanding is that all or most utilities are using either bare-fuel casks-- you put the fuel in the cask and you put the cask on the pad and someday you will put that cask in a repository--or they’re using so-called canister-based casks--you put the cask in a canister, which is welded shut, you put that in a storage overpack, which is stored on a pad at the plant. When it comes time to transport it, you take the canister out of that overpack and you put it into a transportation overpack. With regards to your second question about the vulnerabilities of particular types of plants, if you were looking at it simplistically, you might start by saying, okay, if you’re going to attack a pool, the pool must be exposed, so you should look at plants with exposed pools. About two-thirds of commercial power plants are pressurized water reactors, where the pools are located at or below grade. About one-third are boiling water reactors where the pools can be up to about 80 feet above grade.
Charles Ferguson: But those tend to be inside the reactor building?
Kevin Crowley: They are inside the reactor building, but they are not inside reactor containment. Now that is just a simplistic point of view. So, two thirds at or below grade, one third above grade. But it is not quite that simplistic because those plants have different designs. Some of them have structures that would shield them from line-of-sight attacks. So you really have to look at it on a plant-by-plant basis.
Charles Ferguson: So did you look at it at all from a plant by plant basis?
Kevin Crowley: No, we did not do that, we only had six months for the study, so we did not have time to do that.
Daniel Dorman: That is something that we are getting underway. And we expect to have it done by the end of the year. So we will be going through site by site with these inspections.
Audience member: I am not, and I do not know if there are any, a nuclear terrorist expert. But I get phone calls constantly from the Hill [Capitol Hill]. I sympathize with you, because the people on the Hill understand, politically, one thing. Nuclear terrorism, real or unreal, is exciting. They’ve got to have hearings. Your organization [the NRC] is making it difficult, to be blunt. Now, where the rubber meets the road, and it’s amazing, what is it now, 2005, it’s almost four years after the event. And of course there were some discussions in al Qaeda about doing some of these things. This is not totally out of thin air. What’s interesting to me, and I would like anyone who is sitting around the table that is more knowledgeable than me to talk to, is this fascinating comment you made, Mr. Crowley, and that is “who pays for this?” I mean, that’s fascinating, because that, more than terrorism, will move this monster in one direction or the other, and that’s where Congress comes in and that’s where the utilities come in. And if you could comment a bit more about the debates over that, we could get more fidelity on how important this issue really is. Because I suspect people, based on how they argue who’s gonna pay, will come up with solutions that will go far further, and cost far more, and be even more riskier than anything that has been discussed here so far -- like reprocessing [of spent nuclear fuel to extract plutonium], which is a fantastic solution. So I would like to hear a little more on that. And all I can say is that, this guy’s your friend. You ought to open up a bit because you’re making it very hard for Congress to figure out what to do, to say nothing of the average citizen. And I don’t want the phone calls.
Kevin Crowley: Well I am not sure I can add much to the question of “Who pays?” I can tell you that from an industry point of view, the industry believes that it should not have to pay to protect its infrastructure from 9/11-type attacks. Because industry would assert that there are other, less expensive means to protect not only nuclear power plants, but other industrial infrastructure, which is “keep those planes from being hijacked.”
Audience member: Planes are very important here…
Kevin Crowley: Planes are very important here, but the committee examined two types of attack scenarios. Planes were one of them.
Audience member: This is interesting, because there are a lot of potential solutions to planes, and maybe they’re right.
Daniel Dorman: Let me touch briefly on the question from the NRC’s perspective. The NRC has had on its regulations for decades an enemy of the state. This is something that the industry very quickly wrapped themselves in after 9/11. Basically it says that the federal government does not mandate that the industry protect itself from the enemy of the state. So in the context of post 9/11, the question was what is the enemy of the state? So if the aircraft were to fall into that, what else would fall into that? In its deliberations over creating a supplement to the design basis threat, the NRC decided that the design basis threat should be designed to address the greatest security threat that a private security force should be expected to be able to deal with. Having said that, the NRC said there is a threat environment that is bigger than that, and we need to work with our other federal partners on that piece of it. And so we have been. We have been working with DHS, with FAA, NORAD, TSA, our whole federal family as well as our historical connection with the intelligence and law enforcement communities. So just because our design basis threat does not impose a requirement based on aircraft, we have not said “we’re done.”
Audience member: I really do understand. But you really do you have a public relations problem. There are people trying to pull votes, get re-elected, based on that there is a big bogeyman out there, and we are protecting you. And then you have got an agency that is somehow marginally responsible battering down the hatches about what it is. That is a potent political situation that you want to diffuse, somehow. Nothing good will come of that. You can tell I’m not technical.
Audience member: Charles alluded to this PWR above ground vs. below ground distinction which is pretty well known and must be pretty decisive in your analysis and to the extent that you are worried about fire. Your report has created a great deal of consternation in certain places that operate PWRs. Did you intend in any way, I mean I notice that your report doesn’t distinguish between the various types of reactors, do you have any intentions to clarify the relative threats to the two different types of reactors and reactor pools? That’s my follow up. My question is: I worked in the international affairs arena for a while, and the spent fuel issue has been boiling up for a while in the U.S., in the U.S. for several years now, I raised it when I went back to State in my G-8 security group, and no one had a clue of the potential for zirconium fires. So my question is, do we have an international context in this regards? And have you noticed any reaction or comments, I mean French reactors are very similar. And my half question is, in a lot of places, particular in those places that use very low enriched fuel, such as RBMK’s, the procedures and the sustainability of the infrastructure isn’t quite the same as the NRC has here, and you really have to worry about people just walking away. Are there any threats from very low enriched uranium, whether it is Canada or Eastern Europe? Or is that just off the table due to the low power density?
Kevin Crowley: Let me answer the first question, regarding the distinction between BWRs and PWRs. I would say two things about that. Firstly, if you get a copy of our public report you will see that that subject is discussed, and we do talk about the differences. Now to your original response to [the audience member’s] question, I said it was somewhat simplistic in the way that we were discussing it, because there are many other complications. One, if you are assuming that you are only concerned about where the spent fuel pool is located with respect to grade, you are only worried about line-of-sight attacks, like the 9/11 attacks. That was not the only kind of attack that the committee was worried about. In fact there was at least one other type of attack that could be carried out on either PWR or BWR plant spent fuel pools that the committee was worried about. So I wouldn’t get too hung up on just that distinction alone.
With respect to your second question as to whether other countries are worried about this, I mentioned during my opening comments that the committee visited Germany. In fact the Germans have been dealing with this issue for a long time and are very worried about this problem. Many of the German spent fuel pools are inside containment, so that there is more robust structure between the outside and the pool. The Germans have done studies since 9/11 to make sure that spent fuel is in a safe storage configuration. In fact some power plants, at the prodding of the government, are taking other steps--for example, we visited a power plant that was getting ready to install what they called a fogging system. If a plane was detected approaching the reactor, the plant would put up a wall of fog that would make it difficult to attack or target certain areas of the plant.
Audience member: Outside of Germany, which has made a national decision that nuclear energy would be judged on an economic basis because it would be going away in Germany, have you had conversations with countries that are moving forward with their development of nuclear energy?
Kevin Crowley: In conjunction with the transportation study, another Academy study, we spent some time at Sellafield. And we took this up with BNFL and we asked whether this was a particular concern in the UK. We did not get much feedback. We only talked to the company; we didn’t talk to the people who lived around the plants.
Audience member: But to a first approximation, we should go in assuming the same potential threats…
Kevin: Well again, I think it is spent-fuel-pool design specific. You can’t--this is the difficulty--you can’t make blanket statements. You have to look at the situation of each spent fuel pool. You also have to think about which attacks are credible, and this again gets back to the issue of which attacks should be on the table and which attacks should be off the table.
Daniel Dorman: And I would just add that on the safety side of the house of doing that probability risk analysis where we quantify and differentiate events that are random events, in addition to which events are credible, is how do you rate them?
Kevin Crowley: Basically, the committee’s use of the maximum credible scenario [in its report]--the committee’s thinking is that because we can’t do that quantitative analysis, we needed to think like a terrorist. If you were a terrorist and wanted to attack a spent fuel pool using the technical means which the committee thought would be reasonably available, what would you do?
Audience member: First I would like to put in a pitch to the NRC about the license we have pending with the NRC, for magnastore, which is our state of the art high level waste dry storage cask that’s multi-purpose, larger casket that provides support to Yucca Mountain, if and when Yucca opens someday. I appreciate the study, and I happened to see the classified version of the study, so I saw the intelligence on which you based your threat assessment, but I don’t want to talk about that so that I don’t get in to other elements of it.
My question to you is, given the recent resurgence in the U.S. about the renaissance of nuclear energy, and the increase in our portfolio, long-term, about nuclear energy, we’ve got three consortia members that are looking to develop the next nuclear power plant. First one since the late 70’s here in the United States since it’s been licensed. We happen to be on the ABWR team, so it is in my interest if you are going to follow up with any studies or if there is any anticipation that the NAS is considering doing any follow up studies, or if the NRC is looking to this although the three consortia members are looking to the Department of Energy which is conducting this study to look at the licensing procedures to seed a new nuclear power plant somewhere here in the United States. Do you have plans to or do you envision any work on this area, or more generally are you planning to do follow ups, or have you been contacted to look at particular areas or new areas that you otherwise didn’t touch on in the earlier study?
Kevin Crowley: Let me tell you about something that we are working on now and something that we might be working on in the future. The study that we are working on now is called “transportation of radioactive waste.” It is examining the transportation of spent fuel and high level waste in the United States. Thinking ahead, if there is an interim repository or storage facility, what are likely to be the technical and societal factors of concern? We are also looking at the risks of transportation. How well do we know the risks, and how do they compare to other societal risks? We are also looking at package performance. We started the study with a safety point of view. But we started the study right before 9/11. We are now talking about adding a security component, and we are in discussions with the NRC to make sure that if we included security in the report, we would not be marching down the same road [as the spent fuel report] in which it took six months to get agreement to release a public version.
Audience member: Was that directed by Congress, or was this something that you took upon yourself?
Kevin Crowley: It’s a self-initiated study. The NRC is one of several sponsors of the study. So that is what we are doing now. The report should be out on the street late summer to early fall of this year. The second thing that we might be doing is a follow-on to the spent fuel storage study. We point out in the public report [for the spent-fuel storage study] that we had trouble getting some information from the NRC. The committee met with the Commission in late January, and the Chairman of the Commission, Chairman Diaz, said that he would like us to provide an addendum to the report using the information we didn’t receive for the original study. What we didn’t have [for the original report] was detailed information about the measures taken by the NRC since 9/11 to improve security at nuclear power plants, including the spent fuel storage facilities. So we have a proposal pending with the NRC to do that follow-up study.
Audience member: Would you use the same criteria for the intelligence and the threat assessments?
Kevin Crowley: We would probably get new briefings because the world could have changed.
Audience member: That could change, fundamentally, the outcome of your assessment.
Kevin Crowley: I don’t think so. I think we were very mindful that we may not have seen some of this information, and we were very careful not to go beyond the information we had to digest. I have seen some of this new information now, and I think that if we had had this information we could have talked somewhat more holistically about the scenarios, but I don’t think that it would have fundamentally changed our assessments.
Audience member: I have difficulty with both presentations. Because of the security concerns, the recommendations are so vague that they don’t provide any real useful information. And I want to see if I can put some meat on what both of you said. And maybe I will run into the security roadblock. Your first item is almost meaningless; I mean it didn’t take an Academy committee to state it.
Kevin Crowley: I think the committee would take exception to that. You have to remember that this was a summary for Congress, and I am sure that some members of Congress don’t know about this.
Audience member: The second one, to judge a successful terrorist attack, how do you define success. Is it the draining of a pool, the starting of a fire, or the release of radioactive material?
Kevin Crowley: I think you can define success in a number of different ways. A terrorist might define success as attacking a plant. Even if it wasn’t successful in releasing radiation, it could be considered a successful attack.
Audience member: You mean to tell me that you are conveying information that if a terrorist attacked a pool unsuccessfully, it would be a success because you attacked the pool. Is that what you are saying?
Kevin Crowley: We were purposefully vague, but if you read the report it goes into more detail.
Audience member: It’s obvious that if you spread out the heat load, the probability of a fire will go down. Whether that is significant or not is the issue. But you only say that it will reduce the likelihood. Which is…
Kevin Crowley: That is what it does. You can’t say that in all cases it eliminates the likelihood of a fire.
Audience member: Itdoesn’t say anything of any use that it will reduce the likelihood unless you put some meat on it. So what I want to ask is if you drain the pools completely, you didn’t have your sprays and other stuff, for these typical pools out there that have many discharges loaded into the pool, even if you spread the fuel around, is it likely that you will get a zirconium fire?
Kevin Crowley: That depends, and I am not trying to be flippant here. It really does depend on a lot of factors. It depends on the age distribution of the fuel in the pool, the packing of the pool, the availability of open spaces in the pool…
Audience member: So the calculations are so on the margin between whether it will go or not go…
Kevin Crowley: It is scenario specific…
Audience member: Is there a density at which, if it was five times original design, if it was one times could it be drained?
Audience member: There are rods that have been re-racked. For that set of fuel, if we just took the water out of the pool, would you get a zirconium fire?
Kevin Crowley: In some cases, depending on how the fuel was arranged in the pool, the age of the fuel, you could get a fire. In other cases you wouldn’t.
Audience member: Let me ask about the design basis accident. Is it significantly different than it was 10 years ago? Is the external assault threat significantly greater than it was 10 years ago?
Dan Dorman: Yes, it is significantly greater than it was 10 years ago.
Audience member: Is it significantly greater than the DOE’s numbers for weapons materials?
Dan Dorman: They are different. The NRC has historically maintained comparable threats for comparable materials.
Audience member: Now they are all comparatively enhanced. Now that was implemented when, in 2003?
Dan Dorman: The NRC imposed its new design basis threats in 2003, and they were implemented in late 2003. In 2002, we imposed interim compensatory measures that were significantly enhanced. And even that was on top of advisories that had been issued after 9/11. We went further as we went along. We reached the point that we are making modified regulations.
Audience member: So you are saying that you have high assurance that a design basis threat cannot drain a fuel pool.
Dan Dorman: Yes, and on an ongoing basis, we have a two pronged oversight process, a baseline inspection program that actually looks at the implementation of the security plan requirements including the training requirements for the guards, fitness for duty authorization for access across the whole protective strategy. We also have a force on force exercise program, where every three years at each nuclear power plant, we actually exercise the design basis threat against the security force.
Audience member: Does your design basis threat include his aircraft scenario? Or is it simply a group of people who is broken up into different teams…
Dan Dorman: It does not include an aircraft scenario, and that is as far as I will go on that.
Audience member: I want my money back. I mean I keep reading about the planes.
Kevin Crowley: I think the issues that [the audience member] raises are very legitimate issues. Again it gets back to the policy issue that I shared in my opening comments, about the sharing of information. This was a real frustration to the committee, as I am sure it was to the Commission. There is a real tension between being open and telling people about what threatens their existence and protection of national security. We struggled for a long time to figure out where on that spectrum the right spot should be. I think that if you read our public report and not just the summary for Congress, you will get a clear picture of what we think. We just haven’t provided enough detail to allow a terrorist to say “If I get this type of airplane and I carry out this type of attack it would be successful.”
Audience member: There have been a lot of interesting questions raised and a lot of interesting points made, but some have been left up in the air. So I will try to answer a few of them. I think Henry’s point was very interesting and in many respects gets to the heart of the problem. And also where one goes from where we are today. And that is: what are the costs and who pays? This is a very complex thing.
Let me first let me say that despite Kevin’s words, I have no intention of hyping security concerns in order to sell more casks. We have a nice little business, and I don’t want to use this to sell more casks. Having said that, part of the answer to the question of cost, is that I am selling a product and the utilities are buying a product that they don’t want to have. The utility community is paying the Department of Energy every single day of the year to take their fuel and put it underground at Yucca Mountain so that you can’t hit it with an airplane or any other device short of a nuclear weapon, and then it won’t matter anymore. So, the issue of dry storage is one where the utility company really is spending money that they have already spent, and they really don’t want to spend it. And this is driving them to make decisions that are sometimes maybe not in the right interest of themselves or the public. And if you are buying something that you don’t want, you don’t want to spend much money. So you try to economize and you try to do it on the cheap. And so that drives some of the decisions that are being made.
Now the great majority of the containers that we are selling today are in fact dual purpose. They can be transported and presumably someday will be transported to Yucca Mountain. There is a price premium to build that transportability into the container. Many utilities are paying it, they are paying it in the hopes of moving that material soon or they’re doing it for the politics of it, so they can tell the public in the area that this stuff is going to move, and they are taking a step in that direction. That is the issue of wet vs. dry down at the individual plant level.
But the bigger question is the issue of infrastructure. As rich as this country is, we have limited resources. And we can only spend a certain amount to do so many things. We have a budget that we can use to protect our infrastructure. And the big question is: do we spend it on things nuclear, do we spend it on refineries, do we spend it on skyscrapers, or do we spend it on malls? We haven’t got the money to protect every single situation that’s out there. We have the nuclear infrastructure, which everyone will agree is better protected than everything else in this country today. And we didn’t do this in anticipation of 9/11, but we have.
So, the better question is: do we spend more money to protect spent fuel or do we direct our money towards other vulnerabilities that we have? That’s a fundamental policy question, and I don’t have the answer to that. And I think the Congress is struggling with that one as well. This also comes back and ties into your last question, which is what Tom has been leading up to. We also live in a relatively free society, which allows for a relatively free flow of information. And that’s a good thing. We should not be setting down directions that say, “Here go, attack us like this, or this is where we are most vulnerable.” In this discussion today, we have said that “if you are going to attack a spent fuel pool, you can’t start out by eliminating the 2/3 that are PWRs and instead concentrate on the BWRs.” And at some point you come perilously close to drawing a big bull’s-eye on the side of your plant and say “hit me here.” We should not being doing this. So in that regards I have some deal of sympathy for the NRC and the NAS in trying to balance between how much information do we put out there to increase our security, and at what point have we put out too much information and done ourselves some damage.
And finally, the other issue that might not have been answered is: how do we judge if they are successful? I don’t know what success means in the mind of a terrorist, and I am not a terrorist. I think the answer is, and probably the only reason that I would be willing to spend more money to protect spent fuel, an unsuccessful attack, which I would define one in which there were no off-site radiological health effects, and that is, by the way, the highest probability of any attack scenario, that even that would be so damaging to our industry and to our energy security in this country that that would be a successful attack. So in that regards, the more we talk about this, and the terrorists can read the newspapers too, if they see that we are afraid of attacks on nuclear power plants, and they have one that is totally unsuccessful, you are going to have a clamoring public that says shut them all down. We don’t want the risk. Even though it was unsuccessful, someone is going to come along and say “what if, what if the next time?” We can’t answer that. We can’t make the risk zero. Even if there was an attack where there was no damage, it would be a catastrophe for the energy industry in this country, in my view. That’s my definition of success.
Kevin Crowley: The only thing that I would say, to correct the record, is that the statement about BWR’s and PWR’s is overly simplistic.
Audience member: I may have misunderstood, but I thought I heard in a briefing in a number of instances, the spent fuel is stored in the containment facility itself. And it strikes me that that is the worst possible scenario, because if you have a sabotage attempt against reactors, which is more likely than against spent fuel, but if you had an accident and you had all your spent fuel inside the containment vessel if you had a meltdown and complete explosion, and you throw in all the old fuel, in the event, that is worse than the worst case scenario. I just want to know: is this common in foreign setups? And a related question, did you look at the Japanese spent fuel, because I think they have the most vulnerable setup?
Kevin Crowley: Remember, a lot of foreign countries have their spent fuel recycled. A lot of them send their fuel either to France or the UK to be recycled. The Japanese are sending their spent fuel, and they are building a reprocessing plant, so in a lot of countries you don’t have the kind of inventories of spent fuel that we have in the United States. I can’t speak to what the designs are for spent fuel storage in various countries. I do know that in Germany, the spent fuel pools are located inside the containment in most plants.
Audience member: What is the rationale for that?
Kevin Crowley: Remember, Germany built its plants during the Cold War, when they had a lot of NATO jets flying overhead. So they were worried about the safety of their spent fuel storage. So they had to design their fuel storage in a more robust manner for that reason.
Dan Dorman: Several of the European nations have the F-4 phantom as a design basis accident, an accidental impact that drove the designs of their storage security. So that may have been why the fuel is in the containment.
Kevin Crowley: In addition to having the spent fuel inside of containment, in the latest generation of German plants the plants themselves also have thicker containments.
Dan Dorman: It’s for pressure, and also for seismic considerations, tornados.
Audience member: I had a follow up to this. One of the things you were speaking about was Japan and recycling. You’re right a lot of countries are recycling so that they don’t have the same density problems, but a lot of other countries like Taiwan and South Korea, particularly Taiwan, I think is even under a more difficult situation with regards to spent fuel storage. So I would suspect that they would be even more aggressive than us in making the storage racks as dense as they can. I asked earlier, is there a density that you eliminate the possibility of a fire, even with the hottest fuel that you take out? For example, you mentioned that the racks were 5-7 more dense than what they were designed for. If you went back to 1 times, or 2 times, or 3 times, can you scientifically exclude fires? And, as Tom went down the list here of highlights, he skipped number four, which is additional analyses are needed. Which is the crux of the issue, because you’re saying that the NRC does do site specific stuff, and has done site specific stuff, since 9/11 and before. Can you say what NRC didn’t do that needs to be done, or where the difference lies?
Kevin Crowley: Let me answer your first question. Do this simple thought experiment. You take a freshly discharged spent fuel assembly and put it in air. What happens? Would it burn? Yes, I think it probably would. With respect to the additional analyses we recommended, there were really two kinds of analyses that the NRC should do. One would be to look at specific scenarios that the committee was concerned about with respect to terrorist attacks. I can tell you in general what they were, along the lines of the language that was used in the report, which was planes and large explosives--which is all I can say on that. The other issue that needed further analysis was gaining a better understanding of the mechanisms for zirconium cladding fires. How they initiate, and how they might spread in a spent fuel pool. As I said earlier in my remarks, we have a better understanding of those things in a reactor core. In a reactor core you have an isothermal situation, in a spent fuel pool you don’t. And so the process in a spent fuel pool is really more complicated. And if you use the same type of assumptions that you use in a core accident, you could be over-conservative. In one case the committee thought that the Commission was being over-conservative. The results from their models were actually worse than what you might have gotten using more realistic assumptions. So doing that [more realistic analysis] would be important, because if you could take a scenario off the table, that would be incredibly beneficial. You could say that we don’t have to worry about that, we have done a more realistic analysis, and we just don’t think that this is going to be a problem.
Audience member: Charles, I need to do a small correction here. It is certainly true that the Japanese have shipped a lot of fuel to Sullafield for reprocessing, but they have not shipped any fuel recently, and do not have any current contracts covering more shipments. So the Japanese fuel is staying at home, and it has for some years. They are in this country, and they are planning on solving their problems through a combination of either regionalized dry storage, or reprocessing at Kashimora. But there is no more international transport from Japan to Europe for reprocessing at this time.
Audience member: Discussing the issue of how much information should be given out to the public, again it is not just in this area. In a previous job I worked on a study of the threats from WMD from maritime threats, and again we had the same issue there, and it was also within the government, too. There were questions of different levels of classification, and how much could be done within our working group again was limited. So this is across the board, the question of the dissemination of information, it is a problem.
Kevin Crowley: Let me make a comment on that. This is something that we encountered in this study, and we are encountering it in other NAS studies as well. This is the issue of SBU: Sensitive but Unclassified. It is relatively easy to deal with information that is statutorily protected, and there are fairly detailed guides that allow you to look up the pedigree of information--to allow you to look up not only where it was derived, but what kind of protection it requires. The sensitive information that isn’t really protected by any statute is nefarious, and we encountered that big time during this study.
Audience member: As someone who has had clearances, the names of which I can’t even give you, I am a little familiar with this. And I had classification authority, so I could actually classify things. I am absolutely astonished and dismayed by what is going on. We did a study that we got from unclassified material. We were told that the information might hurt our relationship with an international organization and were asked not to publish it. They then proceeded to threaten one of the authors with terminating their contract. Now I actually went ahead and deleted the material, because I didn’t think that anything that I was doing was that important that I should jeopardize someone’s mortgage. But I thought it was outrageous. And I think the lack of discipline with regards to classification is very worrisome. The classification system, even before 9/11, was out of control. And I hope that somebody speaks up about, or maybe even another study, is how to get a handle on this, in some conscious coherent fashion.
Audience member: Let me ask it in a different way. Do you believe that the agency, take the NRC, should be required to publish significant information so that the public can make a judgment about the agency performing its job? In other words, before 9/11 I never believed that it was appropriate regarding the movement of the guards. But you published in your regulations, your design basis threat. It seems to me that you shouldn’t rely heavily on this classification for your security. You should rely on your guard forces and the physical security system, rather than relying on the terrorists, or your adversary, not being smart enough to get the information, which they clearly usually can. So I would publish all of this information about zirconium fires, what it takes to start one.
Dan Dorman: Your initial question was whether we should be publishing enough information so that the public can know if we are doing our jobs right? Generally, yes. Under the Atomic Energy Act that Congress established safeguards information that establish regulations for physical security at nuclear power plants and guarding nuclear materials, we need to provide enough information to Congress to satisfy clearly our oversight committees that we are doing our jobs in those areas that are consistent with our statutory obligations we can’t publish the information. I am very sympathetic to the whole conversation of Sensitive but Unclassified. It is a very thorny area. What I would ask back to you is how far to you go in disseminating this information publicly, and in doing that, are you communicating so much information that you are facilitating the job of a terrorist planner? At what point are you putting so much information into their hands that you are making their job too easy?
Audience member: I would err on the side of making the information available. I though the UCNI [unclassified controlled nuclear information] standards were the right standards, even though the agencies abused it. And this was before 9/11. Under the UCNI standards, which were unclassified information that was restricted, there had to be a significant increase in the risk of releasing the information. You had to make a judgment that the release of that information would significantly increase the risk of a major consequence. And I think that was abused, but I don’t know why that isn’t the standard for releasing the information. I don’t know why saying the analysis of a zirconium cladding fire would significantly increase the risk, and I say no it wouldn’t. And I would make the information available.
Audience member: I was interested in the exchange between Tom and the others, about the zirconium fire if the pool was completely empty. All the water was lost. The answer was it depends. On the basis of what you have learned, and the new analysis, does the NRC have specifications that new pools will be designed that a zirconium fire was impossible, even if all the cooling fire was lost and not replaced in a timely manner?
Dan Dorman: I will go back to what Kevin said earlier, spent fuel pools are necessary for the discharging of hot fuel. If you just take the fuel out of the reactor and hold it in air, it will heat up. Reaching the point where you eliminate the need for the pool, you would need a radically different approach for fuel design.
Audience member: Just a physics question, if you take out spent fuel and hold it in air, would it catch fire?
Dan Dorman: Yes, if you took it directly out of the end of the fuel cycle and held it in air, it would catch fire.
Audience member: You’re saying the answer is: you would have a zirconium fire if you took a typical fuel element out with a typical period of irradiation, you would have a zirconium fire?
Audience member: Well you don’t have to make fuel cladding with zirconium.
Dan Dorman: I think the perspective I would leave you with on that, based on the analysis to date, there is more to be done, the measures that the panel suggested that the licensees are now implementing, significantly reduces to a very short window the period after fuel offload in which you could get to a zirconium fire for the plants that have been analyzed to date. With the existing 103 reactors, you are not going to eliminate the potential for a zirconium fire, but you can reduce the probability of a fire, which is already low. This is not talking about draining the pool first, which is an extremely challenging event. Then the actions that are being taken to re-distribute the fuel and other actions further significantly reduce the likelihood that even if you did get to that point, you would get a fire. We’re talking that it buys you time to take actions. Kevin talked about in his presentation, about 100 gallons a minute of spray. We’re talking to people about how you get that spray in there, given the circumstances that got you to the situation that you needed the spray. That’s the other piece that you need to factor into that. So we’re trying to look at the whole picture, and we are trying to make the likelihood of this ever occurring even with a malicious adversary out there significantly low.
Charles Ferguson: I think we are going to have to leave it at that. I think we generated another round of questions there in the last ten minutes. Thank you all for indulging us for two minutes beyond schedule. Thank you all for coming here, and join me in thanking Kevin and Dan for their excellent remarks.