NRC: TAKING SPENT FUEL SECURITY IN THE WRONG DIRECTION

Transcription

1 NRC: TAKING SPENT FUEL SECURITY IN THE WRONG DIRECTION 51st Annual Meeting of the Institute of Nuclear Materials Management Baltimore, Maryland July, 2010 Edwin S. Lyman Senior Staff Scientist, Global Security Program Union of Concerned Scientists, 1825 K St, NW, Ste. 800 Washington, DC ABSTRACT In light of the Obama Administration s cancellation of the Yucca Mountain Project, it is likely that spent fuel will need to be stored at reactor sites for many decades to come, where it will remain vulnerable to sabotage attacks. The Christmas Day 2009 attempted bombing of a U.S. jetliner over Detroit is a stark reminder that U.S. infrastructure remains an attractive target of international terrorism. Nuclear plant licensees and the Nuclear Regulatory Commission (NRC) should be taking steps now to ensure that Independent Spent Fuel Storage Installations (ISFSIs) will have robust protection against attack over the long-term. The NRC is currently undertaking a rulemaking to revise the physical protection requirements for ISFSIs, motivated in part on the results of vulnerability assessments that, according to a December 16, 2009 notice in the Federal Register, challenged previous NRC conclusions on the ability of a malevolent act to breach shielding and/or confinement barriers and thus release radiation or radioactive material. However, the NRC s proposed approach for the rulemaking suffers from a number of flaws. Under the proposal, the NRC would not require any ISFSI licensee to protect the facility from the design basis threat (DBT) of radiological sabotage, and would not require ISFSIs to be targets in force-on-force exercises. Moreover, the proposal does not require that the licensee s security force be able to interdict and neutralize an adversary, provided that the projected dose at the controlled area boundary from a sabotage attack does not exceed 5 rem. Thus the need to apply a denial of access strategy at a particular ISFSI would depend on the results of calculations. However, such calculations are of dubious reliability because they have not been validated with experimental data (and the Department of Energy cancelled a program that would have provided such data). This paper will discuss the problems with the NRC s proposed approach and suggest a better path forward. INTRODUCTION Interim spent fuel storage facilities typically contain large radionuclide inventories and therefore represent potentially valuable targets for radiological sabotage. However, it is difficult to understand the magnitude of the threat from the sparse amount of publicly available information on the subject. On the one hand, spent fuel storage areas such as dry cask-based independent spent fuel storage installations (ISFSIs) could be attractive targets because they are more accessible than the reactors themselves. At many reactor sites, the ISFSI is not within the reactor protected area, but in a separate and less secure protected area, and the spent fuel cask is the only barrier between spent fuel and the environment. On the other hand, some downplay the threat by emphasizing the limited source term per cask, the robustness of the packaging and the difficulty of an assailant in creating conditions that could lead to significant fuel damage and quantitative fission product release.

2 It is becoming increasingly important to accurately assess the radiological sabotage threat posed by ISFSIs because by all indications ISFSIs are going to become a more significant part of the nuclear fuel management system in the United States. In the wake of the cancellation of the Yucca Mountain Project by the Obama administration, it is likely that existing ISFSIs may need to be maintained far longer than originally anticipated. (The NRC is currently undertaking a plan to analyze the implications of storing spent fuel in ISFSIs for up to 300 years.) It is also likely that many more ISFSIs will be built, if proposals for the development of centralized interim storage facilities for spent fuel from decommissioning or operating reactors, or reprocessing plants with large front-end storage pools, come to fruition. The need to address this issue in a more serious way is also apparently being driven in part by the results of vulnerability assessments conducted by the NRC after the 9/11 attacks. According to the NRC, these assessments revealed that certain types of explosive attacks could have the potential to breach the confinement barrier of some cask designs and cause larger radiological releases than the NRC had previously anticipated. These results indicated that increased security requirements were warranted for specific scenarios. 1 REGULATORY CONFUSION Because of the peculiarities of the evolution of NRC regulations, there are multiple and sometimes inconsistent requirements for the physical protection of spent fuel, depending on where it is located. For example: (1) The spent fuel pool of an operating reactor must be protected by a security system capable of detecting, assessing, interdicting and neutralizing threats up to and including the design basis threat (DBT) of radiological sabotage. This is the same requirement as for the reactor. (2) A general license ISFSI (a general license for a dry-cask based ISFSI is automatically issued to Part 50 or 52 licensees but the facility is only allowed to store the spent fuel authorized for that reactor to possess) must be protected by a security system capable only of detecting and assessing threats up to and including the DBT. The ISFSI must be located within a protected area (PA) that could be identical to or separate from the reactor PA. The requirements for a separate ISFSI PA are somewhat less stringent than for a reactor PA. (3) A specific license ISFSI (any ISFSI other than a general license ISFSI, which requires NRC approval of a site-specific license application) not co-located with an operating reactor (e.g. at a decommissioning reactor or at an away-from-reactor facility) does not have to be protected against the DBT. Instead, the security system must be designed to prevent a loss of control of the facility that could result in radiation exposure at the controlled area boundary (CAB) of the ISFSI exceeding a limit of 0.05 Sv. 2 This is to be accomplished through detection and assessment of threats by the licensee s security force and communication with local law enforcement agencies (LLEA), which would bear the responsibility of neutralizing the threat. (4) The regulations are unclear as to whether spent fuel stored at a specific license ISFSI colocated with an operating reactor has to be protected against the DBT. It does not have to meet the dose limit that applies to other specific license ISFSIs.

3 This situation, which even NRC refers to as regulatory confusion, 3 has no rational technical basis. In SECY , Independent Spent Fuel Storage Installation Security Requirements for Radiological Sabotage, the staff provided the Commission with a number of options for how to overhaul the regulatory approach for ISFSI security. However, the staff s recommended approach to achieve consistency, which was for the most part accepted by the Commission in SRM-SECY , appears to be a move in the wrong direction. If implemented, it could actually preserve inconsistent treatment of spent fuel in different facilities, increase uncertainties in the risk to public health and safety, and decrease regulatory stability over the lengthy time periods that ISFSIs will likely be needed. The staff released a draft version of the technical basis for its proposed ISFSI rulemaking in December 2009 for public comment. In May 2010, citing critical comments submitted by the Nuclear Energy Institute, the Union of Concerned Scientists and others, an NRC staff member said that the rulemaking will be delayed for a year or two to address public concerns. 4 This delay will hopefully provide an opportunity for the Commission to reconsider its current flawed approach. TO DBT OR NOT TO DBT In attempting to impose consistency on a set of regulations that require some but not all ISFSIs to be protected against the DBT for radiological sabotage, the NRC went in the wrong direction. Instead of requiring that all ISFSI licensees be required to prevent spent fuel sabotage by providing a physical protection program that can protect against the DBT, which would be consistent with the requirements of 10 CFR 73.55(b)(3) for power reactor licensees, the NRC proposed discontinuing the application of the DBT for radiological sabotage for general license ISFSIs. In one fell swoop, the thirty operating general license ISFSIs would no longer have to be protected against the DBT. This would actually replace one inconsistency with another by creating a double standard for protection of spent fuel at reactor sites depending on whether the spent fuel is located in the reactor pool or is stored at a co-located ISFSI. The proposal would also allow power reactor licensees to continue to site ISFSIs outside of the reactor (and spent fuel pool) protected area boundary and in a special ISFSI PA, where capabilities for detection and assessment of adversaries and rapid armed response are below those within the reactor PA. And as a corollary, it would continue to exempt ISFSI licensees from having to conduct NRC-evaluated force-on-force (FOF) exercises, despite the clear value of such exercises in assessing whether security plans that look good on paper will be effective in practice. (The post- 9/11 NRC-evaluated FOF exercise program continues to uncover significant vulnerabilities in power reactor security force performance, as evidenced by the stubbornly high rate of failures (thirteen percent in calendar year 2009). 5 If there is no requirement that security forces interdict adversaries before they commit sabotage on a spent fuel cask, there would be no point in conducting FOF exercises. The NRC staff did consider the alternative of imposing a DBT protection requirement on all ISFSI licensees. While admitting that this option would provide assurance that ISFSI licensees would adequately protect the public from terrorist attacks, it rejected it because of the significant cost burden placed on ISFSI licensees to upgrade their protective strategies so that they are able to prevent or impede attempted act of radiological sabotage 6 The staff also expressed concern that the option may be precedent-setting for other non-reactor facilities and/or activities, such as spent

4 fuel transportation (i.e. there are currently no regulations requiring transporters of spent fuel to impede terrorist attacks). The public may have a difficult time understanding the Commission s rationale on why such drastically different protective strategies are placed on spent nuclear fuel in dry storage casks, but not on spent nuclear fuel in transportation packages. 7 (To this, one might say: Earth to NRC: the public in the post-9/11 era will have a more difficult time understanding why you haven t required licensees to impede terrorist attacks against spent fuel transports in the first place. ) Instead of requiring protection of ISFSIs against the DBT, the NRC decided to apply the 0.05 Sv CAB dose limit requirement of 10 CFR 73.51(b)(3) to all ISFSIs. Licensees would have to perform calculations assessing the impact of a set of security scenarios developed by the NRC staff and determine whether the dose limit is met. If it is exceeded, licensees would have the option to modify the design of the ISFSI by adding additional engineered barriers or increasing the distance of the ISFSI to the CAB. If such passive measures do not allow the dose limit to be met, licensees would need to implement a denial of task protective strategy by assigning armed responders to interdict and neutralize threats against the ISFSI. This proposal appears far more complex and burdensome than the option of requiring that ISFSIs be protected against the DBT. Rather than providing a clear and consistent strategy across all facilities --- keep the bad guys out --- it would lead to a site-specific patchwork of approaches for compliance. It would seem to be much simpler for co-located licensees to integrate the necessary measures to protect ISFSIs from the DBT into their existing reactor security plans. Away-fromreactor ISFSI licensees would have to upgrade their security, but given that NRC has found that some dry casks in current use are vulnerable to certain explosive attacks, such upgrades would appear to be overdue. REGULATORY STABILITY AND THE EVOLVING THREAT TO ISFSIS One of the more confusing aspects of the NRC s proposed approach is that even though the radiological sabotage DBT would not be applied to ISFSIs, NRC would need to develop separate adversary characteristics and security scenario guidance documents that would apply only to attacks on ISFSIs for the purpose of assessing compliance with the dose limit. The Commission approved this option but instructed the staff to ensure that the proposed regulation and guidance documents make it clear that these requirements do not impose a new Design Basis Threat. But despite this admonition, it is hard to see how this approach would not be tantamount to developing an ISFSIspecific DBT, albeit with a different prevention goal than for a reactor (prevention of exceedance of a dose limit instead of prevention of significant core damage). One of the major flaws in this approach is that it would undermine regulatory stability with regard to evolution of the threat over time. As the terrorist threat becomes more severe in the future (as it no doubt will), maintaining the appropriate level of security would be a more difficult task under the staff s approach than under a DBT-based approach. The options available to ISFSI licensees to adjust to increasingly sophisticated adversary tactics and weaponry would be quite limited and could be very burdensome. Constraints might have to be put on the characteristics of spent fuel placed in dry casks; casks might have to be fitted with shields or replaced entirely; additional structures might have to be built, and/or the controlled area boundary might have to be further extended, if possible. In addition, eventually the spent fuel dose rate will decrease below the

5 threshold at which it is considered self-protecting (currently 1 Sv/hr at one meter, but likely to increase), at which point it would need to be protected against theft as well. It is likely that most ISFSIs ultimately would be forced to adopt a denial of task strategy in any event. On the other hand, adjustment of a denial of task strategy would in general be easier, in that it could rely more on operational security changes, such as adding armed responder positions, rather than security hardware changes (although some hardware changes of course could become necessary). The only way to avoid repeated physical upgrades to ISFSIs over the very long time that they will be operational would be to adopt a conservative initial set of adversary characteristics that would attempt to anticipate the nature of the threat many decades from now. This kind of prognostication would be highly uncertain, and the industry would not be likely to embrace such an approach. The ability to impose a set of forward-looking adversary characteristics on ISFSIs would also conflict with the Commission s additional instruction that the ISFSI regulatory guidance should be bounded by the adversary characteristics guidance for the power reactor radiological sabotage DBT. Since the power reactor DBT is developed utilizing current threat information, it is not flexible enough to accommodate threat scenarios that are not judged credible today but may become so in the future. Thus the decision to bound ISFSI security guidance by the power reactor DBT is not compatible with the type of vulnerability-based framework that the staff has proposed in lieu of extending a DBT to all ISFSIs. Another issue that is pertinent to the NRC s proposal to bound ISFSI security guidance by the reactor DBT can be thought of as the off-label problem. The staff have pointed out that certain types of weapons effects caused by explosives that are currently not part of the reactor DBT because they by themselves would not be expected to defeat a power reactor critical target set would in fact be capable of breaching dry cask confinement barriers and causing a radiological release. 8 The staff asks whether it is reasonable and appropriate for the Commission to require licensees to defend their ISFSI against an adversary using explosives in a different manner Thus the question is whether the NRC should assume that adversaries could use explosives that they could possess according to DBT guidance in an off-label application against an ISFSI (as doctors may prescribe FDA-approved drugs for uses not The answer to this question should be obvious: if adversaries have access to these explosives, and if their ability to use them off-label would not require significant additional capabilities (expertise, equipment, resources) beyond those in the DBT, then they should be credited with those capabilities. UNCERTAIN CONSEQUENCES OF ISFSI SABOTAGE One additional problem with the NRC proposal for a dose-based criterion is that its technical foundation is not adequate to support its implementation. This is because there is insufficient experimental data to validate the potential release fractions that could result from sabotage attacks across the entire range of plausible attack modes available to adversaries. Current studies are based on a limited number of tests done decades ago in which shaped charges were used to penetrate casks filled with depleted uranium rods or other spent fuel simulants. In order to observe phenomena relevant to dose analyses, such as the enrichment of semi-volatile fission products such as cesium- 137 relative to low-volatile radionuclides in released aerosols, it is necessary to perform these tests on casks containing actual spent fuel. A few tests using real spent fuel have been done in the past,

6 but the quality and reliability of the data are questionable. Moreover, characteristics of spent fuel today relevant to such studies are quite different (burnup, aging effects, cladding materials). A multi-national effort to better quantify the source term from shaped-charge sabotage attacks on spent fuel casks, centered at Sandia National Laboratories (SNL), was undertaken in the late 1990s. The project systematically developed test protocols and began explosives testing using spent fuel surrogates, with the eventual goal of using actual spent fuel. However, before that final step could be undertaken, the Department of Energy inexplicably suspended the program indefinitely in FY Attempts to restore funding so that the project could be brought to completion were blocked by the DOE Chief Financial Officer, Steve Isakowitz. (Although a George W. Bush appointee, he retained the post in the Obama administration, so it is doubtful that any funding for this effort will be made available by DOE in the near future.) Consequently, the release fractions resulting from a single shaped-charge attack on a spent fuel cask have not been determined experimentally on a reliable basis. However, even under the Sandia program, there were no plans to study more sophisticated attack modes on spent fuel casks that potentially could result in greater damage to both the casks and to the contents, such as multiple-stage attack modes. For example, penetration of a cask by a shaped charge followed with the insertion and detonation of explosives in the cavity would be plausible in the event of a loss of control of the ISFSI. And if conditions could be created that would result in a sustained zirconium fire within the cask, essentially the entire cesium- 137 inventory could be released from the fuel pellets. The potential releases from such scenarios would need to be well-understood under NRC s proposed security scheme in order to accurately determine whether the dose criterion would be exceeded, requiring modifications to the ISFSI or adoption of a denial of task strategy. (NRC asserts that their current source terms are conservative and the kind of data that would be obtained from the Sandia program would only serve to reduce conservatism. However, the source terms it uses in vulnerability assessments are not publicly available, so it is not possible to analyze this claim.) Even if the releases could be accurately quantified, the proposed dose-based criterion is not an appropriate metric for the severity of an ISFSI sabotage attack because it does not capture the longterm radiological and economic impacts of land contamination with fission products and actinides. Certain sabotage attacks may lead to hot plumes that would tend to disperse radionuclides more widely while reducing the calculated dose at the controlled area boundary. The NRC and the U.S. government continue to worry about the threat of dirty bomb attacks, which are not likely to result in many (or any) early fatalities but could cause significant long-term harm to the economy and to public health. A sabotage attack on an ISFSI could be regarded as a type of dirty bomb attack, and due consideration should be given to such long-term consequences even if the immediate radiological threat is determined to be low. CONCLUSIONS The simplest way for NRC to impose consistency on its rules for spent fuel security would be to require ISFSIs to be protected against the DBT with the objective of preventing spent fuel sabotage. Given the potential that NRC has identified for certain explosive attacks to penetrate spent fuel casks and cause radiological releases, meeting this objective would mean requiring that security forces be capable of interdicting and neutralizing threats against ISFSIs, as they are now required to do for threats against reactors and spent fuel pools.

7 The applicable DBT should be fundamentally the power reactor DBT, but it should be suitably augmented with additional capabilities that could be used to challenge cask integrity, even if those capabilities would not be useful for reactor sabotage. In addition, the idea of adopting a vulnerability-based assessment for dry casks tied to a dose criterion should be retained to address the need for defense-in-depth for ISFSIs and the need to provide regulatory stability over the long-term. Guidance should be developed that is sufficiently conservative so that repeated security infrastructure upgrades will not be needed as the threat environment evolves over time, at least for several decades. The Sandia spent fuel sabotage test program should be resumed and expanded to encompass the more severe challenges to cask and spent fuel integrity that one would expect should prolonged loss of control of an ISFSI occur. Until the data becomes available, conservative source terms should be used to compensate for uncertainties in the experimental basis for sabotage-generated releases. REFERENCES [1] U.S. Nuclear Regulatory Commission, Draft Technical Basis for a Rulemaking to Revise the Security Requirements for Facilities Storing Spent Nuclear Fuel and High-Level Radioactive Waste, Revision 1, NRC , December 2009, p.2. [2] 10 CFR 73.51(b)(3) [3] U.S. NRC, Independent Spent Fuel Storage Installation Security Requirements for Radiological Sabotage, SECY , August 28, 2007, Enclosure 3, p.1. [4] Maureen Conley, ISFSI Security Rulemaking Delayed While Staff Addresses Concerns, Inside NRC, May 10, 2010, p. 8. [5] U.S. NRC, Report to Congress on the Security Inspection Program for Commercial Power Reactor and Category I Fuel Cycle Facilities: Results and Status Update, Letter to Senator Barbara Boxer, Chairman, Committee on Environment and Public Works, June 30, 2010, p. 9. [6] SECY , op cit., Enclosure 1, p. 9. [7] SECY , op cit., Enclosure 1, p. 10. [8] SECY , op cit. Enclosure 4, p.4-5.