Science and Global Security, 11:1-51, 2003 Copyright C 2003 Taylor and Francis 0892-9882/03 $12.00 + .00 DOI: 10.1080/08929880390214124

Robert Alvarez, Jan Beyea, Klaus Janberg, Jungmin Kang, Ed Lyman, Allison Macfarlane, Gordon Thompson, Frank N. von Hippel

Because of the unavailability of off-site storage for spent power-reactor fuel, the NRC has allowed high-density storage of spent fuel in pools originally designed to hold much smaller inventories. As a result, virtually all U.S. spent-fuel pools have been re-racked to hold spent-fuel assemblies at densities that approach those in reactor cores. In order to prevent the spent fuel from going critical, the fuel assemblies are partitioned off from each other in metal boxes whose walls contain neutron-absorbing boron. It has been known for more than two decades that, in case of a loss of water in the pool, convective air cooling would be relatively ineffective in such a "dense-packed" pool. Spent fuel recently discharged from a reactor could heat up relatively rapidly to temperatures at which the zircaloy fuel cladding could catch fire and the fuel's volatile fission products, including 30-year half-life ¹³⁷Cs, would be released. The fire could well spread to older spent fuel. The long-term land-contamination consequences of such an event could be significantly worse than those from Chernobyl.

No such event has occurred thus far. However, the consequences would affect such a large area that alternatives to dense-pack storage must be examined - especially in the context of concerns that terrorists might find nuclear facilities attractive targets. To reduce both the consequences and probability of a spent-fuel-pool fire, it is proposed that all spent fuel be transferred from wet to dry storage within five years of discharge. The cost of on-site dry-cask storage for an additional 35,000 tons of older spent fuel is estimated at $3.5-7 billion dollars or 0.03-0.06 cents per kilowatt-hour generated from that fuel. Later cost savings could offset some of this cost when the fuel is shipped off site. The transfer to dry storage could be accomplished within a decade. The removal of the older fuel would reduce the average inventory of ¹³⁷Cs in the pools by about a factor of four, bringing it down to about twice that in a reactor core. It would also make possible a return to open-rack storage for the remaining more recently discharged fuel. If accompanied by the installation of large emergency doors or blowers to provide large-scale airflow through the buildings housing the pools, natural convection air cooling of this spent fuel should be possible if airflow has not been blocked by collapse of the building or other cause. Other possible risk-reduction measures are also discussed.

Our purpose in writing this article is to make this problem accessible to a broader audience than has been considering it, with the goal of encouraging further public discussion and analysis. More detailed technical discussions of scenarios that could result in loss-of-coolant from spent-fuel pools and of the likelihood of spent-fuel fires resulting are available in published reports prepared for the NRC over the past two decades. Although it may be necessary to keep some specific vulnerabilities confidential, we believe that a generic discussion of the type presented here can and must be made available so that interested experts and the concerned public can hold the NRC, nuclear-power-plant operators, and independent policy analysts such as ourselves accountable.

INTRODUCTION

The U.S. Nuclear Regulatory Commission (NRC) has estimated the probability of a loss of coolant from a spent-fuel storage pool to be so small (about 10^-6 per pool-year) that design requirements to mitigate the consequences have not been required.[1] As a result, the NRC continues to permit pools to move from open-rack configurations, for which natural-convection air cooling would have been effective, to "dense-pack" configurations that eventually fill pools almost wall to wall. A 1979 study done for the NRC by the Sandia National Laboratory showed that, in case of a sudden loss of all the water in a pool, dense-packed spent fuel, even a year after discharge, would likely heat up to the point where its zircaloy cladding would burst and then catch fire.[2] This would result in the airborne release of massive quantities of fission products.

No such event has occurred thus far. However, the consequences would be so severe that alternatives to dense-pack storage must be examined - especially in the context of heightened concerns that terrorists could find nuclear facilities attractive targets.

The NRC's standard approach to estimating the probabilities of nuclear accidents has been to rely on fault-tree analysis. This involves quantitative estimates of the probability of release scenarios due to sequences of equipment failure, human error, and acts of nature. However, as the NRC staff stated in a June 2001 briefing on risks from stored spent nuclear fuel:[3] "No established method exists for quantitatively estimating the likelihood of a sabotage event at a nuclear facility."

Recently, the NRC has denied petitions by citizen groups seeking enhanced protections from terrorist acts against reactor spent-fuel pools.[4] In its decision, the NRC has asserted that "the possibility of a terrorist attack . . . is speculative and simply too far removed from the natural or expected consequences of agency action . . . "[5]

In support of its decision, the NRC stated: "Congress has recognized the need for and encouraged high-density spent fuel storage at reactor sites,"[6] referencing the 1982 Nuclear Waste Policy Act (NWPA). In fact, although the NWPA cites the need for "the effective use of existing storage facilities, and necessary additional storage, at the site of each civilian nuclear power reactor consistent with public health and safety," it does not explicitly endorse dense-pack storage.[7]

If probabilistic analysis is of little help for evaluating the risks of terrorism, the NRC and the U.S. Congress will have to make a judgment of the probability estimates that will be used in cost-benefit analyses. Here, we propose physical changes to spent-fuel storage arrangements that would correct the most obvious vulnerabilities of pools to loss of coolant and fire. The most costly of these proposals, shifting fuel to dry cask storage about 5 years after discharge from a reactor, would cost $3.5-7 billion for dry storage of the approximately 35,000 tons of older spent fuel that would otherwise be stored in U.S. pools in 2010. This corresponds to about 0.03-0.06 cents per kilowatt-hour of electricity generated from the fuel. Some of this cost could be recovered later if it reduced costs for the shipment of the spent fuel off-site to a long-term or permanent storage site.

For comparison, the property losses from the deposition downwind of the cesium-137 released by a spent-fuel-pool fire would likely be hundreds of billions of dollars. The removal of the older spent fuel to dry storage would therefore be justified by a traditional cost-benefit analysis if the likelihood of a spent-fuel- pool fire in the U.S. during the next 30 years were judged to be greater than about a percent. Other actions recommended below could be justified by much lower probabilities.

It appears unlikely that the NRC will decide its own to require such actions. According to its Inspector General, the "NRC appears to have informally established an unreasonably high burden of requiring absolute proof of a safety problem, versus lack of a reasonable assurance of maintaining public health and safety . . . "[8]

This situation calls for more explicit guidance from Congress. Indeed, 27 state Attorneys General have recently signed a letter to Congressional leaders asking for legislation to "protect our states and communities from terrorist attacks against civilian nuclear power plants and other sensitive nuclear facilities," specifically mentioning spent-fuel pools.[9]

Congress could do this by updating the Nuclear Waste Policy Act to require "defense in depth" for pool storage; and the minimization of pool inventories of spent fuel. The second requirement would involve the transfer, over a transition period of not more than a decade, of all spent fuel more than five years post discharge to dry, hardened storage modes.

To establish the basis for an informed, democratic decision on risk-reduction measures, it would be desirable to have the relevant analysis available to a full range of concerned parties, including state and local governments and concerned citizens. Despite the need to keep sensitive details confidential, we believe that we have demonstrated in this article that analysts can describe and debate a range of measures in an open process. The same can be done in the regulatory area. Evidentiary hearings held under NRC rules already have specific provisions to exclude security details - along with proprietary and confidential personnel information - from the public record.

In outline, we describe:

• The huge inventories of the long-lived, volatile fission product cesium-137 (¹³⁷Cs) that are accumulating in U.S. spent fuel pools and the consequences if the inventory of one of these pools were released to the atmosphere as a result of a spent-fuel fire;
• The various types of events that have been discussed in the public record that could cause a loss of coolant and the high radiation levels that would result in the building above the pool as a result of the loss of the radiation shielding provided by the water;
• The limitations of the various cooling mechanisms for dry spent fuel: conduction, infrared radiation, steam cooling and convective air cooling;
• Possible measures to reduce the vulnerability of pools to a loss of coolant event and to provide emergency cooling if such an event should occur; and
• The feasibility of moving spent fuel from pools into dry-cask storage within 5 years after discharge from the reactor. This would allow open-rack storage of the more-recently discharged fuel, which would make convective aircooling more effective in case of a loss of water, and would reduce the average inventory of ¹³⁷Cs in U.S. spent-fuel pools by about a factor of four.

There are 103 commercial nuclear reactors operating in the U.S. at 65 sites in 31 states (Figure 1).[11] Of these, 69 are pressurized-water reactors (PWRs) and 34 are boiling-water reactors (BWRs). In addition there are 14 previously-operating light-water-cooled power reactors in various stages of decommissioning. Some of these reactors share spent-fuel pools, so that there is a total of 65 PWR and 34 BWR pools.[12] Figure 2 shows diagrams of "generic" pressurized-water reactor (PWR) and boiling-water-reactor (BWR) spent-fuel pools.[13] For simplicity, when we do illustrative calculations in this article, we use PWR fuel and pool designs. However, the results of detailed studies done for the NRC show that our qualitative conclusions are applicable to BWRs as well.[14]

Figure 1: Locations of nuclear power plants in the United States. Circles represent sites with one reactor, squares represent plants with two; and stars represent plants with three. Open symbols represent sites with at least one shutdown reactor. Only the plant in Zion, Illinois has more than one shutdown reactor. It has two (Source: authors[10]).

Figure 2a: Layout of spent fuel pool and transfer system for pressurized water reactors (Source: NUREG-1275, 1997).

Figure 2b: Layout of spent fuel pool and transfer system for boiling water reactors (Source: NUREG-1275, 1997).

THE HAZARD FROM CESIUM-137 RELEASES

Although a number of isotopes are of concern, we focus here on the fission product ¹³⁷Cs. It has a 30-year half-life, is relatively volatile and, along with its short-lived decay product, barium-137 (2.55 minute half-life), accounts for about half of the fission-product activity in 10-year-old spent fuel.[15] It is a potent land contaminant because 95% of its decays are to an excited state of 137Ba, which de-excites by emitting a penetrating (0.66-MeV) gamma ray.[16]

The damage that can be done by a large release of fission products was demonstrated by the April 1986 Chernobyl accident. More than 100,000 residents from 187 settlements were permanently evacuated because of contamination by ¹³⁷Cs. Strict radiation-dose control measures were imposed in areas contaminated to levels greater than 15 Ci/km² (555 kBq/m²) of ¹³⁷Cs. The total area of this radiation-control zone is huge: 10,000 km², equal to half the area of the State of New Jersey. During the following decade, the population of this area declined by almost half because of migration to areas of lower contamination.[17]

Inventories of Cs-137 in Spent-Fuel Storage Pools

The spent-fuel pools adjacent to most power reactors contain much larger inventories of ¹³⁷Cs than the 2 MegaCuries (MCi) that were released from the core of Chernobyl 1000-Megawatt electric (MWe) unit #4[18] or the approximately 5 MCi in the core of a 1000-MWe light-water reactor. A typical 1000-MWe pressurized water reactor (PWR) core contains about 80 metric tons of uranium in its fuel, while a typical U.S. spent fuel pool today contains about 400 tons of spent fuel (see Figure 3). (In this article, wherever tons are referred to, metric tons are meant.) Furthermore, since the concentration of ¹³⁷Cs builds up almost linearly with burnup, there is on average about twice as much in a ton of spent fuel as in a ton of fuel in the reactor core.

Figure 3 For an average cumulative fission energy release of 40 Megawatt-days thermal per kg of uranium originally in the fuel (MWt-days/kgU) and an average subsequent decay time of 15 years, 400 tons of spent power-reactor fuel would contain 35 megaCuries (MCi) of ¹³⁷Cs.[19] If 10-100% of the ¹³⁷Cs in a spent-fuel pool,[20] i.e., 3.5-35 MCi, were released by a spent-fuel fire to the atmosphere in a plume distributed vertically uniformly through the atmosphere's lower "mixing layer" and dispersed downwind in a "wedge model" approximation under median conditions (mixing layer thickness of 1 km, wedge opening angle of 6 degrees, wind speed of 5 m/sec, and deposition velocity of 1 cm/sec) then 37,000- 150,000 km² would be contaminated above 15 Ci/km², 6,000-50,000 km² would be contaminated to greater than 100 Ci/km² and 180-6000 km² to a level of greater than 1000 Ci/km².[21] Table 1 and Figure 4 show typical contaminated areas, calculated using the MACCS2 Gaussian plume dispersion code used by the NRC[22] for fires with 40 MWt thermal power.[23] This corresponds to fire durations of half an hour and 5 hours, respectively for fires that burn 10 or 100 percent of 400 tons of spent fuel.[24] Similar results were obtained for slower-burning fires with powers of 5 MWt.

Table 1: Typical plume areas (km²).

It will be seen in Table 1 that, for the 3.5 MCi release, the area calculated as contaminated above 100 Ci/km² are 5-9 times larger than the area contaminated to this level by the 2 MCi release from the Chernobyl accident. The reasons are that, at Chernobyl: 1) much of the Cs-137 was lifted to heights of up to 2.5 km by the initial explosion and the subsequent hot fire and therefore carried far downwind;[26] and [2]) the release extended over 10 days during which the wind blew in virtually all directions. As a result, more than 90 percent of the ¹³⁷Cs from Chernobyl was dispersed into areas that were contaminated to less than 40 Ci/km².[27] In contrast, in the wedge-model calculations for the 3.5 MCi release, about 50 percent of the ¹³⁷Cs is deposited in areas contaminated to greater than this level.

The projected whole-body dose from external radiation from ¹³⁷Cs to someone living for 10 years in an area contaminated to 100 or 1000 Ci/km² would be 10-20 or 100-200 rem, with an associated additional risk of cancer death of about 1 or 10 percent respectively.[28] A 1 or 10 percent added risk would increase an average person's lifetime cancer death risk from about 20 percent to 21 or 30 percent.

A 1997 study done for the NRC estimated the median consequences of a spent-fuel fire at a pressurized water reactor (PWR) that released 8-80 MCi of ¹³⁷Cs. The consequences included: 54,000-143,000 extra cancer deaths, 2000-7000 km² of agricultural land condemned, and economic costs due to evacuation of $117-566 billion.[29] This is consistent with our own calculations using the MACCS2 code. It is obvious that all practical measures must be taken to prevent the occurrence of such an event.

Figure 4: Typical areas contaminated above 100 (shaded) and 1000 (black) Ci/km² for release of (a) 3.5 MCi and (b) 35 MCi of ¹³⁷Cs. The added chance of cancer death for a person living within the shaded area for 10 years is estimated very roughly as between 1 and 10 percent. For someone living within the black area, the added risk would be greater than 10 percent (i.e. the "normal" 20% lifetime cancer death risk would be increased to over 30 percent.) (Source: authors).

SCENARIOS FOR A LOSS OF SPENT-FUEL-POOL WATER

The cooling water in a spent-fuel pool could be lost in a number of ways, through accidents or malicious acts. Detailed discussions of sensitive information are not necessary for our purposes. Below, we provide some perspective for the following generic cases: boil-off; drainage into other volumes through the opening of some combination of the valves, gates and pipes that hold the water in the pool; a fire resulting from the crash of a large aircraft; and puncture by an aircraft turbine shaft or a shaped charge.

Figure 5: Decay heat as a function of time from 0.01 years (about 4 days) to 100 years for spent-fuel burnups of 33, 43, 53 and 63 MWd/kgU. The lowest burnup was typical for the 1970s. Current burnups are around 50 MWd/kgU (Source: authors[38]).

Boil Off

Keeping spent fuel cool is less demanding than keeping the core in an operating reactor cool. Five minutes after shutdown, nuclear fuel is still releasing 800 kilowatts of radioactive heat per metric ton of uranium (kWt/tU)[30]. However, after several days, the decay heat is down to 100 kWt/tU and after 5 years the level is down to 2-3 kWt/tU (see Figure 5).

In case of a loss of cooling, the time it would take for a spent-fuel pool to boil down to near the top of the spent fuel would be more than 10 days if the most recent spent-fuel discharge had been a year before. If the entire core of a reactor had been unloaded into the spent fuel pool only a few days after shutdown, the time could be as short as a day.[31] Early transfer of spent fuel into storage pools has become common as reactor operators have reduced shutdown periods. Operators often transfer the entire core to the pool in order to expedite refueling or to facilitate inspection of the internals of the reactor pressure vessel and identification and replacement of fuel rods leaking fission products.[32]

Even a day would allow considerable time to provide emergency cooling if operators were not prevented from doing so by a major accident or terrorist act such as an attack on the associated reactor that released a large quantity of radioactivity. In this article, we do not discuss scenarios in which spent-fuel fires compound the consequences of radioactive releases from reactors. We therefore focus on the possibility of an accident or terrorist act that could rapidly drain a pool to a level below the top of the fuel.

Drainage

All spent-fuel pools are connected via fuel-transfer canals or tubes to the cavity holding the reactor pressure vessel. All can be partially drained through failure of interconnected piping systems, moveable gates, or seals designed to close the space between the pressure vessel and its surrounding reactor cavity.[33] A 1997 NRC report described two incidents of accidental partial drainage as follows:[34]

Once the pool water level is below the top of the fuel, the gamma radiation level would climb to 10,000 rems/hr at the edge of the pool and 100's of rems/hr in regions of the spent-fuel building out of direct sight of the fuel because of scattering of the gamma rays by air and the building structure (see Figure 6).[35] At the lower radiation level, lethal doses would be incurred within about an hour.[36] Given such dose rates, the NRC staff assumed that further ad hoc interventions would not be possible.[37]

Fire

A crash into the spent fuel pool by a large aircraft raises concerns of both puncture (see below) and fire. With regard to fire, researchers at the Sandia National Laboratory, using water to simulate kerosene, crashed loaded airplane wings into runways. They concluded that at speeds above 60 m/s (135 mph), approximately

Figure 6: Calculated radiation levels from a drained spent-fuel pool one meter above the level of the floor of a simplified cylindrically-symmetric spent-fuel-pool building. Even out of direct sight of the spent fuel, the radiation dose rates from gamma rays scattered by the air, roof and walls are over a hundred rems/hr.

The blast that would result from such a fuel-air explosion might not destroy the pool but could easily collapse the building above, making access difficult and dropping debris into the pool. A potentially destructive fuel-air deflagration could also occur in spaces below some pools. Any remaining kerosene would be expected to pool and burn at a rate of about 0.6 cm/minute if there is a good air supply.[40]

The burning of 30 cubic meters of kerosene - about one third as much as can be carried by the type of aircraft which struck the World Trade Center on September 11, 200141 - would release about 1012 joules of heat - enough to evaporate 500 tons of water. However, under most circumstances, only a relatively small fraction of the heat would go into the pool.

Puncture by an Airplane Engine Turbine Shaft, Dropped Cask or Shaped Charge

As Figure 2 suggests, many spent-fuel pools are located above ground level or above empty cavities. Such pools could drain completely if their bottoms were punctured or partially if their sides were punctured.

Concerns that the turbine shaft of a crashing high-speed fighter jet or an act of war might penetrate the wall of a spent-fuel storage pool and cause a loss of coolant led Germany in the 1970s to require that such pools be sited with their associated reactors inside thick-walled containment buildings. When Germany decided to establish large away-from-reactor spent-fuel storage facilities, it rejected large spent-fuel storage pools and decided instead on dry storage in thick-walled cast-iron casks cooled on the outside by convectively circulating air. The casks are stored inside reinforced-concrete buildings that provide some protection from missiles.[42]

Today, the turbine shafts of larger, slower-moving passenger and freight aircraft are also of concern. After the September 11, 2001 attacks against the World Trade Center, the Swiss nuclear regulatory authority stated that

The NRC staff has decided that it is prudent to assume that a turbine shaft of a large aircraft engine could penetrate and drain a spent-fuel-storage pool.[44] Based on calculations using phenomenological formulae derived from experiments with projectiles incident on reinforced concrete, penetration cannot be ruled out for a high-speed crash but seems unlikely for a low-speed crash.[45]

This is consistent with the results of a highly-constrained analysis recently publicized by the Nuclear Energy Institute (NEI).[46] The analysis itself has not been made available for independent peer review "because of security considerations." According to the NEI press release, however, it concluded that the engine of an aircraft traveling at the low speed of the aircraft that struck the Pentagon on Sept. 11, 2001 (approximately 350 miles/hr or 156 m/s) would not penetrate the wall of a spent-fuel-storage pool. Crashes at higher speed such as that against the World Trade Center South Tower (590 miles/hr or 260 m/s), which had about three times greater kinetic energy, were ruled out because the "probability of the aircraft striking a specific point on a structure - particularly one of the small size of a nuclear plant - is significantly less as speed increases."

The NEI press release included an illustration showing a huge World Trade Center tower (63 meters wide and 400 meters

tall) in the foreground and a tiny spent-fuel pool (24 meters wide and 12 meters high) in the distance. Apparently no analysis was undertaken as to the possibility of a crash destroying the supports under or overturning a spent-fuel pool. A less constrained analysis should be carried out under U.S. Government auspices.

A terrorist attack with a shaped-charge anti-tank missile could also puncture a pool - as could a dropped spent-fuel cask.[47]

COOLING PROCESSES IN A PARTIALLY OR FULLY-DRAINED SPENT-FUEL POOL

Dense packing

U.S. storage pools - like those in Europe and Japan - were originally sized on the assumption that the spent fuel would be stored on site for only a few years until it was cool enough to transport to a reprocessing plant where the fuel would be dissolved and plutonium and uranium recovered for recycle. In 1974, however, India tested a nuclear explosive made with plutonium recovered for "peaceful" purposes. The Carter Administration responded in 1977 by halting the licensing of an almost completed U.S. reprocessing plant. The rationale was that U.S. reprocessing might legitimize the acquisition of separated plutonium by additional countries interested in developing a nuclear-weapons option. In the 1982 Nuclear Waste Policy Act, therefore, the U.S. Government committed to provide an alternative destination for the spent fuel accumulating in reactor pools by building a deep-underground repository. According to the Act, acceptance of spent fuel at such a repository was supposed to begin by 1998. As of this writing, the US Department of Energy (DoE) projects that it can open the Yucca Mountain repository in 201048 but the US General Accounting Office has identified several factors, including budget limitations, that could delay the opening to 2015 or later.[49]

U.S. nuclear-power plant operators have dealt with the lack of an off-site destination for their accumulating spent fuel by packing as many fuel assemblies as possible into their storage pools and then, when the pools are full, acquiring dry storage casks for the excess. The original design density of spent fuel in the pools associated with PWRs had the fuel assemblies spaced out in a loose square array. The standard spacing for new dense-pack racks today is 23 cm - barely above the 21.4 cm spacing in reactor cores.[50] This "dense-packed" fuel is kept sub-critical by enclosing each fuel assembly in a metal box whose walls contain neutron-absorbing boron[51] (see Figure 7[52]).

Figure 7: Open and dense-pack PWR spent-fuel racks (Sources: Left: NUREG/CR-0649, SAND77-1371, 1979; right: authors).

These boron-containing partitions would block the horizontal circulation of cooling air if the pool water were lost, greatly reducing the benefits of mixing recently-discharged with older, cooler fuel. During a partial uncovering of the fuel, the openings at the bottoms of the spent-fuel racks would be covered in water, completely blocking air from circulating up through the fuel assemblies. The portions above the water would be cooled primarily by steam produced by the decay heat in the below-surface portions of the fuel rods in the assemblies and by blackbody radiation.[53]

In the absence of any cooling, a freshly-discharged core generating decay heat at a rate of 100 kWt/tU would heat up adiabatically within an hour to about 600°C, where the zircaloy cladding would be expected to rupture under the internal pressure from helium and fission product gases,[54] and then to about 900°C where the cladding would begin to burn in air.[55] It will be seen that the cooling mechanisms in a drained dense-packed spent-fuel pool would be so feeble that they would only slightly reduce the heatup rate of such hot fuel.

In 2001, the NRC staff summarized the conclusions of its most recent analysis of the potential consequences of a loss-of-coolant accident in a spent fuel pool as follows:

We have done a series of "back-of-the-envelope" calculations to try to understand the computer-model calculations on which this conclusion is based. We have considered thermal conduction, infrared radiation, steam cooling, and convective air cooling.

Thermal Conduction

Conduction through the length of uncovered fuel could not keep it below failure temperature until the fuel had cooled for decades.[57]

Infrared Radiation

Infrared radiation would bring the exposed tops of the fuel assemblies into thermal equilibrium at a temperature of T₀ = [PM/(Aσ)]^1/4°K, where P is the power (Watts) of decay heat generated per metric ton of uranium, M is the weight of the uranium in the fuel assembly (0.47 tons), A = 500 cm² is the cross-sectional area of the dense-pack box containing the fuel assembly, and σ (= 5.67 x 10^-12 T⁴_K Watts/cm²) is the Stefan-Boltzman constant. (We assume that the top of the fuel assembly radiates as a black body, i.e., maximally.) For P = 1 kW or 10 kW, T₀ is respectively 370 or 860°C.

With radiative cooling only, however, the temperatures in the depths of the fuel assemblies would be much hotter, because most of the radiation from the interior of the fuel would be reabsorbed and reradiated by other fuel rods many times before it reached the top end of the fuel assembly. Even for P = 1 kW/tU (roughly 30-year-old fuel) the temperature at the bottom of the fuel assembly would be about 2000°C.[58] Therefore, while radiation would be effective in cooling the exposed surfaces of older fuel assemblies, it would not be effective in cooling their interiors.

Steam Cooling

Steam cooling could be effective as long as the water level covers more than about the bottom quarter of the spent fuel. Below that level, the rate of steam generation by the fuel will depend increasingly on the rate of heat transfer from the spent fuel to the water via blackbody radiation. The rate at which heat is transferred directly to the water will decline as the water level sinks and the temperature of the fuel above will climb. When the water is at the bottom of the fuel assembly, it appears doubtful that this mechanism could keep the peak temperature below 1200°C for fuel less than a hundred years post discharge.[59] Since even steels designed for high-temperature strength lose virtually all their strength by 1000°C and zircaloy loses its strength by 1200°C, the tops of the racks could be expected to begin to slump by the time this water

level is reached.[60]

Convective Air Cooling

After a complete loss of coolant, when air could gain access to the bottom of the fuel assemblies, convective air cooling would depend upon the velocity of the air through the fuel assemblies. The heat capacity of air is about 1000 joules/kg-°C, its sea-level density at a 100°C (373°K) entrance temperature into the bottom of a fuel assembly is about 0.9 kg/m³, the cross-section of the portion of a dense-pack box that is not obstructed by fuel rods would be about 0.032 m²,[61] and each fuel assembly contains about 0.47 tons of uranium. The vertical flow velocity of air at the bottom of the assembly for an air temperature rise to 900°C (1173°K) then would be 0.023 m/sec per kW/tU. Because the density of the air varies inversely with its absolute temperature, this velocity would increase by a factor of (1173/373) ≈ 3 at the top of the fuel assembly.

The pressure accelerating the air to this velocity would come from the imbalance in density - and therefore weight - of the cool air in the space between the fuel racks and the pool wall (the "down-comer") and the warming air in the fuel assemblies. If we assume that the density of the air in the down-comer is 1 kg/m³ and that it has an average density of 0.5 kg/m³ in the fuel assemblies, then the weight difference creates a driving pressure difference. Neglecting friction losses, this pressure difference would produce a velocity for the air entering the bottom of the fuel assembly of about 2.7 m/s, sufficient to remove heat at a rate of 120 kW/tU. Adding friction losses limits the air velocity to about 0.34 m/s, however, which could not keep PWR fuel below a temperature of 900°C for a decay heat level greater than about 15 kW/tU - corresponding to about a year's cooling.[62] Adding in conductive and radiative cooling would not change this result significantly.

This is consistent with results obtained by more exact numerical calculations that take into account friction losses in the down-comer and the heating of the air in the building above the spent-fuel pool.[63] The 1979 Sandia study obtained similar results. It also found that, in contrast to the situation with dense-pack storage, with open-frame storage and a spacing between fuel assemblies of 53 cm (i.e., a density approximately one fifth that of dense-packed fuels), convective air cooling in a well-ventilated spent-fuel storage building (see below) could maintain spent fuel placed into the spent-fuel pool safely below its cladding failure temperature as soon as 5 days after reactor shutdown.[64] These important conclusions should be confirmed experimentally with, for example, electrically heated fuel rods.[65]

Spread of Fires from Hot to Colder Fuel

The above discussion has focused on the likelihood that recently-discharged dense-packed fuel could heat up to ignition temperature in either a partially or fully drained pool. It is more difficult to discuss quantitatively the spread of such a fire to adjacent cells holding cooler fuel that would not ignite on its own. A 1987 Brookhaven report attempted to model the phenomena involved and concluded that "under some conditions, propagation is predicted to occur for spent fuel that has been stored as long as 2 years."[66] The conditions giving this result were dense-packing with 5 inch (13 cm) diameter orifices at the bottom of the cells - i.e., typical current U.S. storage arrangements.

The report notes, however, that its model

The report therefore concludes that the consequences of two limiting cases should be considered in estimating the consequences of spent-fuel pool fires: 1) only recently discharged fuel burns, and 2) all the fuel in the pool burns.[67] This is what we have done above. We would add, however, that any blockage of air flow in the cooler channels of a dense-packed pool by debris, residual water, or sagging of the box structure would facilitate the propagation of a spent-fuel fire.[68]

MAKING SPENT-FUEL POOLS, THEIR OPERATION, AND THEIR REGULATION SAFER

A variety of possibilities can be identified for reducing the risk posed by spent-fuel pools. Some were considered in reports prepared for the NRC prior to the Sept. 11, 2001 destruction of the World Trade Center and rejected because the estimated probability of an accidental loss of coolant was so low (about 2 chances in a million per reactor year) that protecting against it was not seen to be cost effective.[69]

Now it is necessary to take into account the potentially higher probability that a terrorist attack could cause a loss of coolant. Since the probabilities of specific acts of malevolence cannot be estimated in advance, the NRC and Congress will have to make a judgment of the probability that should be used in cost-benefit analyses. The most costly measures we propose would be justified using the NRC's cost-benefit approach if the probability of an accident or attack on a U.S. spent-fuel pool resulting in a complete release of its ¹³⁷Cs inventory to the atmosphere were judged to be 0.7 percent in a 30-year period. This is at the upper end of the range of probabilities estimated by the NRC staff for spent-fuel fires caused by accidents alone. For a release of one tenth of the ¹³⁷Cs inventory, the break-even probability would rise to about 5 percent in 30 years.[70]

Below, we discuss more specifically initiatives to:

• Reduce the probability of an accidental loss of coolant from a spent-fuel pool,
• Make the pools more resistant to attack,
• Provide emergency cooling,
• Reduce the likelihood of fire should a loss of coolant occur, and
• Red