ML12321A317
| ML12321A317 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 11/14/2012 |
| From: | Brancato D Riverkeeper |
| To: | Borchardt R NRC/EDO |
| References | |
| 2.206, G20120875 | |
| Download: ML12321A317 (99) | |
Text
1482 U.S. NRC Ulnitcd St¢ N-c-ea, gl: - C i ETS Task Number: G20120875 ProtectingPeople antd the Envionnment Electronic Tracking System a Sn Inorato Lead Assignee: NRR OEDO Due Date: 12/13/2012 Other Assignees: SECY Due Date:
Other Parties:
Subject:
2.206 - Indian Point
Description:
CC Routing: OGC, Regionl ADAMS Accession Numbers - Incoming: Response / Package:
Cross Reference SRM\Other: No Action Type: 2.206 Review OEDO Concurrence: No Signature Level: Direct Reply OCM Concurrence: No Special Instructions: OCA Concurrence: No
'7u e tIfo t~ - - , _1 ; ý Originator Name: Deborah Brancato Date of Incoming: 11/14/2012 Originator Org: Riverkeeper Document Received by OEDO Date: 11/15/2012 Date Response Requested by Originator:
Addressee: R. W. Borchardt, EDO Incoming Task: E-mail OEDO POC: Dan Merzke I(Ak
Jaegers, Cathy From: Borchardt, Bill Sent: Wednesday, November 14, 2012 12:54 PM To: Jaegers, Cathy
Subject:
Fw: 2.206 Enforcement Petition Attachments: 2.206 Enforcementn Petition (Nov. 14, 2012).pdf Bill Borchardt Via blackberry From: Deborah Brancato <DBrancato@riverkeeper.org>
To: Borchardt, Bill Cc: Phillip Musegaas <philliporiverkeeper.org>; Mark Leyse <markleyse(cgmail.com>
Sent: Wed Nov 14 09:24:54 2012
Subject:
2.206 Enforcement Petition
Dear Mr. Borchardt:
Pursuant to 10 C.F.R. § 2.206, attached please find an enforcement petition on behalf of Riverkeeper, Inc., which requests that the NRC permanently shutdown Indian Point because either hydrogen deflagrations or detonations could breach Unit 2 or Unit 3's containments in the event of a severe accident and, thus, expose the public to a large radiological release.
Ahard copy will follow by U.S. Priority Mail.
Should you have any questions concerning this transmittal, please do not hesitate to contact me.
Thank you for your consideration.
Sincerely, Deborah Brancato, Esq.
Staff Attorney Riverkeeper, Inc.
20 Secor Road Ossining, New York 10562 P: (914) 478-4501 x230 F: (914) 478-4527 www.riverkeeper.org
.A RIVERKEEPER.
NY's clean water advocate This message contains information that may be confidential or privileged and is intended only for the individual or entity named above. No one else may disclose, copy, distribute or use the contents of this message.
Unauthorized use, dissemination and duplication is strictly prohibited, and may be unlawful. All personal messages express views solely of the sender, which are not to be attributed to Riverkeeper, Inc. and may not 1 EDO -- G20120875
be copied or distributed without this disclaimer. If you received this message in error, please notify us immediately at info@riverkeeper.orcq or call 914-478-4501.
2
November 14, 2012 R. William Borchardt Executive Director for Operations U.S. Nuclear Regulatory Commission Washington D.C. 20555-0001 10 C.F.R. § 2.206 REQUEST FOR PERMANENT SHUTDOWN OF INDIAN POINT UNITS 2 AND 3 ("IP-2 AND -3"): EITHER HYDROGEN DEFLAGRATIONS OR DETONATIONS COULD BREACH IP-2 AND -3's CONTAINMENTS IN THE EVENT OF A SEVERE ACCIDENT, EXPOSING THE PUBLIC TO A LARGE RADIOLOGICAL RELEASE
TABLE OF CONTENTS PETITION FOR AN ENFORCEMENT ACTION ............................................... 4 I. REQ U EST FO R A CTION ........................................................................ 4 II. STATEMENT OF PETITIONER'S INTEREST ............................................. 5 II.A. Plant Specific Characteristics, Regarding the Location of Indian Point ................. 6 II.B. Plant Specific Characteristics, Regarding the Particular Volume of Indian Point's Containments as well as the Particular Distribution of Steel and Concrete Masses in Indian Point's C ontainm ents ......................................................................... 8 III. FACTS CONSTITUTING THE BASIS FOR PETITIONER'S REQUEST ............. 9 III.A. The Hydrogen Removal Capacity of Hydrogen Recombiners and Hydrogen Production Rates in Severe Accident Scenarios ................................................. 11 III.B. There Is No Assurance that Entergy Could Effectively Mitigate the Hydrogen that Would be Generated in the Event of a Severe Accident at Indian Point .................. 14 III.C. Calculations of the Pressure Loads Resulting from Combustion of the Quantity of Hydrogen Produced from a Metal-Water Reaction of 100 Percent of the Fuel Cladding Active Length Indicate that IP-2 and -3's Containments Could Fail ...................... 16 III.C. 1. The Results of NRC's Calculations for an Adiabatic and Complete Hydrogen Burn at TMI-1, Oconee Units 1, 2, and 3, and Turkey Point Units 3 and 4 May Not have B een C onservative .................................................................................... 22 III.C.2. Additional Hydrogen Combustion Calculations that Indicate IP-2 and -3's C ontainm ents C ould Fail ........................................................................... 23 III.C.3. The Accuracy of Containment Failure Pressure Estimates Is Questionable ....... 24 III.D. A Discussion of Analyses of a Loss-of-Offsite Power Accident for a Future N uclear Pow er Plant D esign ....................................................................... 24 III.E. Reports State that in the Event of a Severe Accident, Containment Integrity and Essential Safety Systems Could Be Compromised by Internally-Generated Missiles and that Containment Integrity Could Be Compromised by a Global Detonation ............ 29 III.F. IP-2 and -3 and the Safety Issue of Internally-Generated Missiles Caused by H ydrogen E xplosions ............................................................................... 33 IV . CON CLU SION ............................................................................... 36 2
Appendix A Figure 6.4.5.2.2-2 Containment Loads from Fast Turbulent Combustion in Future Plant Appendix'B Figure 6.4.5.2.3-2 Calculated Pressures from a Local Detonation in the Containment Dome Appendix C Edwin S. Lyman, Union of Concerned Scientists, "Chernobyl on the Hudson?: The Health and Economic Impacts of a Terrorist Attack at the Indian Point Nuclear Plant," September, 2004 3
November 14, 2012 UNITED STATES OF AMERICA U.S. NUCLEAR REGULATORY COMMISSION BEFORE THE COMMISSION In the Matter of: : TO: R. WILLIAM BORCHARDT Executive Director for Operations ENTERGY CORPORATION : U.S. Nuclear Regulatory Commission (Indian Point Nuclear Generating Station : Washington D.C. 20555-0001 Units No. 2 and No. 3; Docket Nos. 50-247 and:
50-286)
- Docket No.
RIVERKEEPER, Petitioner 10 C.F.R. § 2.206 REQUEST FOR PERMANENT SHUTDOWN OF INDIAN POINT UNITS 2 AND 3 ("IP-2 AND -3"): EITHER HYDROGEN DEFLAGRATIONS OR DETONATIONS COULD BREACH IP-2 AND -3's CONTAINMENTS IN THE EVENT OF A SEVERE ACCIDENT, EXPOSING THE PUBLIC TO A LARGE RADIOLOGICAL RELEASE I. REQUEST FOR ACTION This petition for an enforcement action is submitted pursuant to 10 C.F.R. § 2.206 by Riverkeeper.1 10 C.F.R. § 2.206(a) states that "[a]ny person may file a request to institute a proceeding pursuant to § 2.202 to modify, suspend, or revoke a license, or for any other action as may be proper."
Riverkeeper (hereinafter "Petitioner") requests that United States Nuclear Regulatory Commission ("NRC") revoke the operating license of Indian Point Units 2 and 3 ("IP-2 and -3"), because either hydrogen fast deflagrations 2 or detonations 3 could Mark Leyse wrote this 10 C.F.R. § 2.206 petition for Riverkeeper.
2A deflagration is a combustion wave traveling at a subsonic speed, relative to the unburned gas.
A subsonic speed is a speed that is less than the speed of sound.
3 A detonation is a combustion wave traveling at a supersonic speed, relative to the unburned gas.
A supersonic speed is a speed that is greater than the speed of sound.
4
breach IP-2 and -3's containments in the event of a severe accident, exposing the public to a large radiological release.
II. STATEMENT OF PETITIONER'S INTEREST Petitioner is a member-supported, not-for-profit organization dedicated to protecting the Hudson River and its tributaries.4 Since its inception in 1966, Petitioner has used litigation, science, advocacy, and public education to raise and address concerns relating to the Indian Point nuclear power plant ("NPP"), located on the eastern bank of the Hudson River in Buchanan, NY. Petitioner is headquartered in Ossining, New York, approximately 10 miles from the Indian Point facility, and has numerous members that 5
reside within at least 50 miles of the plant.
For almost a decade, Petitioner has taken an active role in bringing to light critical and problematic safety issues which have notoriously plagued Indian Point, and called for improvements to the facility to ensure the safe operation of the plant. For example, in 2001, Petitioner filed an enforcement petition with the NRC pursuant to 10 C.F.R. § 2.206 seeking enhanced safety and security measures in light of the September 11th terrorist attacks; 6 in 2004, Petitioner commissioned an expert analysis of the potential consequences of a severe accident/terrorist event occurring at Indian Point, which described the catastrophic radioactive releases that can occur as the result of such incidents; 7 and in 2007, Petitioner filed a petition to intervene in the Indian Point license renewal proceeding, raising several technical safety concerns relating to the lack of 4 See generally, Riverkeeper.org, Our Story, http://www.riverkeeper.org/ourstory index.php (last visited March 24, 2011).
5 See Riverkeeper.org, Contact Us, http://www.riverkeeper.org/contact/ (last visited March 24, 2011).
6 In the Matter of Entergy Corporation (Indian Point Nuclear Power Station, Units No. 2 and 3; Facility Operating Licenses. DPR-26 and DPR-64, Section 2.206 Request for Emergency Shutdown Of Indian Point Units 2 and 3 (Nov. 8, 2001), available at, ADAMS Accession No. MLO 13480179.
7 Edwin S. Lyman, Union of Concerned Scientists, Chernobyl on the Hudson?: The Health and Economic hnpacts of a Terrorist Attack at the Indian Point Nuclear Plant, September 2004, available at., http://www.riverkeeper.org/wp-content/uploads/2011/03/Chernobyl-on-the-Hudson_indianpointhealthstudy.pdf (hereinafter "Lyman, Chernobyl on the Hudson?"); see Appendix C for a copy of this report.
5
adequate analysis concerning severe accident mitigation alternatives, fatigue of metal components, and flow-accelerated corrosion of piping at the plant.8 A. Plant Specific Characteristics, Regarding the Location of Indian Point This 10 C.F.R. § 2.206 petition is plant specific, because New York City is located less than 25 miles south of IP-2 and -3 and more than 17 million people live within a 50-mile radius of IP-2 and -3.9 An October 2011 Natural Resources Defense Council report, "Nuclear Accident at Indian Point: Consequences and Costs," with analyses of the potential radiological consequences of a severe accident at Indian Point, states:
An accident at one o f Indian Point's reactors on the scale of the recent catastrophe in Japan could cause a swath of land down to the George Washington Bridge to be uninhabitable for generations due to radiation contamination. A release of radiation on the scale of Chernobyl's would make Manhattan too radioactively contaminated to live in if the city fell within the plume. 10 This 10 C.F.R. § 2.206 petition is also plant specific, because IP-2 and -3 were built within one or two miles of the Ramapo seismic zone: a "system [that] is not so much a single fracture as a braid of smaller ones, where quakes emanate from a set of still ill-defined faults."' 1 Research suggests the area around Indian Point is susceptible to an earthquake of 7.0 in magnitude on the Richter scale.1 2 The owner of Indian Point, Entergy Nuclear Operations, Inc. (hereinafter "Entergy"), indicates that Units 2 and 3 8 Riverkeeper, Inc.'s Request for Hearing and Petition to Intervene in the License Renewal Proceeding for the Indian Point Nuclear Power Plant, Docket Nos. 50-247-LR, 5-286-LR (November 30, 2007), available at, ADAMS Accession No ML073410093.
9 Lyman, Chernobvl on the Hudson?, p. 23.
'0 Matthew McKinzie, NRDC, "Nuclear Accident at Indian Point: Consequences and Costs,"
October 17, 2011, p. 1.
11Lynn R. Sykes, John G. Armbruster, Won-Young Kim, & Leonardo Seeber, Observations and Tectonic Setting of Historic and Instrumentally Located Earthquakes in the Greater New York City-Philadelphia Area, Bulletin of the Seismological Society of America, Vol. 98, No. 4, pp.
1696-1719, August 2008 (hereinafter "Sykes, Earthquakes in New York"); The Earth Institute, Columbia University, "Earthquakes May Endanger New York More than Thought, Says Study:
Indian Point Nuclear Power Plant Seen as Particular Risk," Press Release Posted on The Earth Institute website, August 21, 2008, available at, http://www.earth.columbia.edu/articles/view/2235 (last visited March 24, 2011) (hereinafter "Columbia Earth Institute Earthquake Study Press Release").
12Sykes, Earthquakes in New York; Columbia Earth Institute Earthquake Study Press Release.
6
were built to withstand a 6.0 magnitude earthquake.1 3 Even if this alleged, as yet unsubstantiated estimate were true, a 7.0 magnitude earthquake is approximately 30 times more powerful than a 6.0.14 Thus, IP-2 and -3 are not capable of withstanding earthquakes that could reasonably occur in the area. Indeed, an NRC report dated August 2010 (in conjunction with supplemental data regarding power plants not reviewed in the report) reveals that IP-3 has a higher risk of seismic related core damage than any other NPP in the country. 15 Based on the foregoing, an earthquake occurring in proximity of IP-2 and -3 could cause one or two severe accidents. It would be reasonable to claim that the probability of severe accidents at IP-2 and -3 is higher than it is for most other NPPs licensed by NRC.
Given IP-2 and -3's higher probability for severe accidents and the fact that New York City is located less than 25 miles south of IP-2 and -3 and more than 17 million people live within a 50-mile radius of IP-2 and -3, the safety issues raised in this 10 C.F.R. § 2.206 petition, need prompt resolution. Both of these concerns are discussed in a study conducted by Columbia University's Earth Institute, as documented in "Observations and Tectonic Setting of Historic and Instrumentally Located Earthquakes in the Greater New York City-Philadelphia Area." The study states: "Indian Point is situated at the intersection of the two most striking linear features marking the seismicity and also in the midst of a large population that is at risk in case of an accident... This is 13See, e.g., CBS New York, Japan Crisis Raises Concerns About Indian Point Plant, March 15, 2011, available at, http://newyork.cbslocal.com/2011/03/15/japan-crisis-raises-concerns-about-indian-point-power-plant/ (last visited August 12, 2011) ("Indian Point spokesman Jerry Nappi said.. .the plant is built to withstand approximately a 6.0 magnitude earthquake.").
14FEMA, "Are You Ready?: Earthquakes," states that "[a] magnitude of 7.0 on the Richter Scale indicates an extremely strong earthquake. Each whole number on the scale represents an increase of about 30 times more energy released than the previous whole number represents. Therefore, an earthquake measuring 6.0 is about 30 times more powerful than one measuring 5.0." See FEMA, "Are You Ready?: Earthquakes," available at:
http://www.fema.gov/areyouready/earthquakes.shtm (last visited August 12. 2011).
15 See Generic Issue 199 (GI-199), Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants Safety/Risk Assessment, August 2010, at Appendix D (Seismic Sore-Damage Frequencies), available at, ADAMS Accession Nos. ML100270639, ML100270756; Bill Dedman, What are the odds? US nuke plants
.ranked by quake risk, MSNBC.com, March 17, 2011, available at, http://www.msnbc.msn.com/id/42103936/ns/worldnews-asia-pacific/ (last visited March 24, 2011).
7
clearly one of the least favorable sites in our study area from an earthquake hazard and 16 risk perspective."
(Deborah Brancato of Riverkeeper helped write section II.A.)
B. Plant Specific Characteristics, Regarding the Particular Volume of Indian Point's Containments as well as the Particular Distribution of Steel and Concrete Masses in Indian Point's Containments This 10 C.F.R. § 2.206 petition also is plant specific, because IP-2 and -3 have certain characteristics that are specific to IP-2 and -3 that would affect the quantity of hydrogen generated in the event of a severe accident as well as the hydrogen distribution and combustion: 1) the particular size of the pressurized water reactor ("PWR") cores, comprised of approximately 39,370 fuel rods,17 would affect the quantity of hydrogen 3 18 generated; 2) the particular volume of the containments, approximately 2.61 x 106 ft ,
would affect hydrogen concentrations; and 3) the particular distribution of steel and concrete masses, as well as surfaces, would affect steam concentrations.
Regarding these three characteristics, "State-of-the-Art Report on Flame Acceleration and Deflagration-to-Detonation Transition in Nuclear Safety" states:
The starting point of any analysis is, of course, selection of the plant. This apparently trivial point is included explicitly into the general analysis procedure because the plant design has many important implications for later stages of the [computational fluid dynamics ("CFD")] analysis. For instance, the core size and type of reactor (PWR or [boiling water reactor])
will determine the maximum possible hydrogen source term, the free containment volume will influence hydrogen concentrations, and the distribution of steel and concrete masses, 1as9 well as surfaces, will affect the equally important steam concentrations.
16 Sykes, Earthquakes in New York, supra Note 9, at 1717.
17 Entergy, "Technical Facts: Indian Point Unit 2, Plant Specific Information," available at:
http://www.entergy-nuclear.com/content/resourcelibrary/IPEC EP/TechnicalFacts2.pdf (last visited August 14, 2011); and Entergy, "Technical Facts: Indian Point Unit 3, Plant Specific Information," available at: http://www.entergy-nuclear.com/content/resourcelibrary/IPECEP/TechnicalFacts3.pdf (last visited August 14, 2011).
18 Power Authority of the State of New York, Consolidated Edison Company of New York, "Indian Point Probabilistic Safety Study," Vol. 8, 1982, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML102520201, pp. 5.8.2-6, 5.8.3-8.
19 OECD Nuclear Energy Agency, "State-of-the-Art Report on Flame Acceleration and Deflagration-to-Detonation Transition in Nuclear Safety," NEA/CSNI/R(2000)7, August 2000, 8
In IP-2 and -3 containments, the particular size and arrangement of obstacles (such as tubes, grid-irons, and doors 20 ) would also affect hydrogen combustion.
Regarding this issue, "Report on FA and DDT" states:
The geometry of a combustion volume is the most important and the most complex parameter for [flame acceleration]. Especially, in case of real situations, geometry of a single combustion compartment and arrangement of a multi-compartment combustion process are of main importance. The three main parameters can be summarized as size of obstacles, distance between [two] obstacles, and degree of confinement (all geometrical discontinuities on the combustion path). In actual NPP geometry, data such as blockage ratio or spacing 21 of obstacles cannot always be defined because of their complexity.
It is also significant thatNRC's "Resolution of Generic Safety Issue 121:
Hydrogen Control for Large, Dry PWR Containments" states:
[lI]t was believed that plant-specific vulnerabilities may exist mainly due to the effects of local H 2 detonation. Activities for estimating the likelihood of local H2 detonation and assessing the consequences would require plant-specific information...'-
Clearly, this 10 C.F.R. § 2.206 petition is plant specific, for the reasons discussed above; i.e., IP-2 and -3 have certain characteristics that are specific to IP-2 and -3 that would affect the quantity of hydrogen generated in the event of a severe accident as well as the hydrogen distribution and combustion.
III. FACTS CONSTITUTING THE BASIS FOR PETITIONER'S REQUEST There is no assurance that Entergy could control the total quantity of hydrogen that would be generated in the event of a severe accident at either IP-2 or -3. If such an accident were to occur, it is highly likely that there would be hydrogen combustion in the containment, either in the form of a deflagration or a detonation.
available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number:
ML031340619, p. 6.15 (hereinafter "Report on FA and DDT").
20 Id., p. 5.36.
21Id., p. 6.3.
22 NRC, "Resolution of Generic Safety Issue 121: Hydrogen Control for Large, Dry PWR Containments," available at: http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr0933/sec3/1 21 r2.html (last visited October 3, 2012).
9
NRC's regulations for combustible gas control, 10 C.F.R. § 50.44, do not require PWR facilities with large dry containments, like IP-2 and -3, to control the hydrogen that would be generated in the event of a severe accident. NRC has concluded that "PWR facilities with large dry containments do not control hydrogen buildup inside the containment structure because the containment volume is sufficient to keep the pressure 23 spike of potential hydrogen deflagrations within the design pressure of the structure."
However, according to NRC's own calculations (discussed in section III.C), hydrogen combustion inside PWR large dry containments could cause pressure spikes exceeding 100 pounds per square inch ("psi"), well in excess of the design pressures of such containments (the design pressure of IP-2 and -3's containments is 47 pounds per square inch gauge ("psig") 24 ).
Three Mile Island Unit 2 ("TMI-2") was a PWR with a large dry containment. In the TMI-2 accident, a rapid pressure increase of approximately 28 psi in the containment25 was attributed to the combustion of hydrogen in the form of a deflagration.26 Fortunately, TMI-2's containment was not breached by the hydrogen deflagration; however, that does not preclude the possibility that, in the event of a severe accident at either IP-2 or -3, either a hydrogen fast deflagration or detonation could breach one of IP-2 and r3's containments, exposing the public to a large radiological release.
NRC needs to uphold its congressional mandate to protect the lives, property, and environment of the people of New York and surrounding areas, by revoking the operating license of IP-2 and -3. NRC also needs to acknowledge the results of its own calculations: the volume of a PWR large dry containment is not sufficient to keep the 23 Charles Miller, et al., NRC, "Recommendations for Enhancing Reactor Safety in the 21st Century: The Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident,"
SECY-1 1-0093, July 12, 2011, p. 42, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: MLI 11861807 (hereinafter "Recommendations for Enhancing Reactor Safety in the 21 st Century").
24 Entergy, "Technical Facts: Indian Point Unit 2, Plant Specific Information;"
and Entergy, "Technical Facts: Indian Point Unit 3, Plant Specific Information."
25 W. E. Lowry, et al., Lawrence Livermore National Laboratory, "Final Results of the Hydrogen Igniter Experimental Program," NUREG/CR-2486, February 1982, p. 4.
26 E. Studer, et al., Kurchatov Institute, "Assessment of Hydrogen Risk in PWR," [undated], p. 1.
10
pressure spike of potential hydrogen deflagrations and detonations within the design pressure of the structure.
IP-2 and -3 must not be allowed to continue operating, because there is no assurance that Entergy could control the total quantity of hydrogen generated in the event of a severe accident.
A. The Hydrogen Removal Capacity of Hydrogen Recombiners and Hydrogen Production Rates in Severe Accident Scenarios In 2011, Indian Point spokesman, James Steets, was quoted as saying that IP-2 and -3's containment buildings each have two hydrogen recombiners and that one alone could eliminate all the hydrogen produced in a major accident. Steets is quoted in an article titled "U.S. Dropped Nuclear Rule Meant to Avert Hydrogen Explosions," by Matthew L. Wald, in the New York Times, "A Blog About Energy and the Environment," March 31, 2011.
Steets was quoted using the term "major accident," which could mean either a design basis accident or a severe accident. If Steets meant that one or two hydrogen recombiners could eliminate all the hydrogen produced in a severe accident, he is grossly incorrect: one or two hydrogen recombiners could not eliminate all the hydrogen produced in a severe accident before either a hydrogen deflagration or detonation could occur.
IP-2's hydrogen recombiners are passive autocatalytic recombiners ("PAR");
whereas, IP-3's hydrogen recombiners are electrically powered thermal recombiners.
"Report on FA and DDT" states that "[a] rapid initial H2-source occurs in practically all severe accident scenarios because the large chemical heat release of the Zr-steam reaction causes a fast self-accelerating temperature excursion during which initially large surfaces and masses of reaction partners are available" [emphasis added]. 2 v In a severe accident, "hydrogen generation is a fast process due to the zirconium oxidation by steam, with a magnitude from 0.1 to 5.0 kilograms/sec. (degradation, 27 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.38.
11
reflood of the over heated core);"'2 8 where the hydrogen removal capacity per PAR unit is "several grams per second of H 2 ." 29 Discussing investigations of PAR efficiency using GASFLOW, a 3D CFD code, to model PARs in full-sized German PWR containments, "Report on Flame Acceleration" states:
[I]n one of the investigated cases with about 50 [hydrogen] recombiners and 530 [kilograms ("kg")] H 2 total release, the integral H2 removal rate was initially 180 kg/hr H 2 and then decreased proportionally to the residual H2 or 02 concentration in the containment. 30 On the hydrogen removal capacity of thermal recombiners, "Light Water Reactor Hydrogen Manual" states that thermal recombiners "cannot control a large-scale generation of hydrogen. (Each recombiner is of limited capacity)," 31 and that "[t]he necessity to use many of these recombiners would lead to high installation and 32 maintenance costs."'
In a severe accident, during the reflooding of an overheated core up to 300 kg of hydrogen could be produced in one minute. 33 Such a high rate of hydrogen production would not last long. It is important to remember that there is a finite amount of material in a reactor's core that can produce hydrogen. In the Three Mile Island accident, it is generally estimated that a total of 500 kg was produced.34 Therefore, the claim that one or two hydrogen recombiners could eliminate all the hydrogen produced in a severe accident is incorrect. To help mitigate hydrogen in a wide range of accident scenarios, it is recommended that PWRs have from 30 to 60 28 E. Bachellerie, et al., "Generic Approach for Designing and Implementing a Passive Autocatalytic Recombiner PAR-System in Nuclear Power Plant Containments," Nuclear Engineering and Design, 221, 2003, p. 158 (hereinafter "Designing and Implementing a PAR-System in NPP Containments").
29 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 1.6.
30 Id., p. 1.8.
31 Allen L. Camp, et al., Sandia National Laboratories, "Light Water Reactor Hydrogen Manual,"
NUREG/CR-2726, August 1983, p. 4-106.
32 id.
33 E. Bachellerie, et al., "Designing and Implementing a PAR-System in NPP Containments,"
- p. 158.
34 Jae Sik Yoo, Kune Yull Suh, "Analysis of TMI-2 Benchmark Problem Using MAAP4.03 Code," Nuclear Engineering and Technology, Vol. 41, No. 7, September 2009, p. 949.
12
hydrogen recombiners distributed in their containment buildings. 35 Furthermore, 60 hydrogen recombiners would not be capable of eliminating all the hydrogen produced in some severe accident scenarios within a timeframe that would prevent a hydrogen explosion from occurring.
In 2003, NRC eliminated the requirement for hydrogen recombiners and stated that "[hydrogen recombiner] systems were ineffective at mitigating hydrogen releases from risk-significant beyond design-basis accidents."' 36 Additionally, in "U.S. Dropped Nuclear Rule Meant to Avert Hydrogen Explosions," Eliot Brenner, an NRC spokesman, is quoted saying that "[hydrogen recombiners were not] needed for design basis accidents 37 and they [did not] help with severe accidents."'
(It is noteworthy that the NRC Near-Term Task Force report, "Recommendations for Enhancing Reactor Safety in the 21st Century"' 38 does not discuss the fact that 300 kg of hydrogen could be produced in one minute, in a severe accident, during the reflooding of an overheated core, and that that "must be taken into account in risk analysis and in the design of hydrogen mitigation systems."' 39)
(It is also noteworthy that IP-2's two PAR units could have unintended ignitions 40 in the event of a severe accident, which, in turn, could cause a hydrogen detonation.
35 E. Bachellerie, et al., "Designing and Implementing a PAR-System in NPP Containments,"
- p. 159.
36 NRC, Federal Register Notice, Regarding Eliminating the Hydrogen Recombiner Requirement, Vol. 68, No. 186, September 25, 2003, p. 55419.
31 Matthew L. Wald, "U.S. Dropped Nuclear Rule Meant to Avert Hydrogen Explosions," New York Times, A blog About Energy and the Environment, March 31, 2011.
38 Charles Miller, et al., "Recommendations for Enhancing Reactor Safety in the 21st Century."
39 Report by Nuclear Energy Agency Groups of Experts, OECD Nuclear Energy Agency, "In-Vessel and Ex-Vessel Hydrogen Sources," NEA/CSNI/R(2001)15, October 1, 2001, Part 1, B.
Cl6ment (IPSN), K. Trambauer (GRS), W. Scholtyssek (FZK), Working Group on the Analysis and Management of Accidents, "GAMA Perspective Statement on In-Vessel Hydrogen Sources,"
- p. 9 (hereinafter: "In-Vessel and Ex-Vessel Hydrogen Sources," Part 1).
40 "Hydrogen Removal from LWR Containments by Catalytic-Coated Thermal Insulation Elements (THINCAT)" states that "[i]n a situation when the hydrogen concentration rises, a delayed ignition [such as could be caused by a PAR system] enhances the risk because it may start a detonation." See K. Fischer, et al., "Hydrogen Removal from LWR Containments by Catalytic-Coated Thermal Insulation Elements (THINCAT)," Nuclear Engineering and Design, 221, 2003, p. 146.
13
Experimental data demonstrates that IP-2's two PAR units could have at least one unintended ignition in the event of a severe accident.4 1 IP-2's two PAR units have catalytic surfaces and would operate automatically, without external power or operator action, in the event of a severe accident, commencing operation when enough hydrogen and oxygen were available to react on the PARs' catalytic surfaces. 4 2 In the event of a severe accident, IP-2's operators would not be able to prevent IP-2's PAR units from operating.
IP-3's electrically powered thermal hydrogen recombiner units could also have unintended ignitions, in a hydrogen concentration higher than about 4%,43 if they were actuated by plant operators, in the event of a severe accident.
In the event of a severe accident, operators would be able to control the operation of IP-3's thermal hydrogen recombiner units, if they were functioning properly; however, operators would not be able to control the operation of IP-2's PAR units.)
B. There Is No Assurance that Entergy Could Effectively Mitigate the Hydrogen that Would be Generated in the Event of a Severe Accident at Indian Point Regarding the fact that PARs would be overwhelmed by the quantity of hydrogen produced in a severe accident, "Safety Implementation of Hydrogen Igniters and Recombiners for Nuclear Power Plant Severe Accident Management," published in 2006, states:
Large quantities of hydrogen (release rate at 2 kg/sec.) will be released into the containment under severe accidents. In these cases, the hydrogen can not be removed by recombiners alone. Hydrogen will accumulate in 41 "Studies on Innovative Hydrogen Recombiners as Safety Devices in the Containments of Light Water Reactors" states that "[d]uring experimental investigations at several institutions; e.g.,
Battelle Model Containment, KALI facility, and SURTSEY facility, ignitions were observed.
See Emst-Arndt Reinecke, Inga Maren Tragsdorf, Kerstin Gierling, "Studies on Innovative Hydrogen Recombiners as Safety Devices in the Containments of Light Water Reactors," Nuclear Engineering and Design, 230, 2004, p. 49.
42 IAEA, "Mitigation of Hydrogen Hazards in Severe Accidents in Nuclear Power Plants," IAEA-TECDOC- 1661, July 2011, pp. 77, 79 (hereinafter "Mitigation of Hydrogen Hazards in SA").
41 Id., p. 79.
14
the containment, and once the hydrogen concentration reaches the flammability limitation, deflagration and detonation may occur.44 There is no assurance that Entergy could effectively mitigate the hydrogen that would be generated in the event of a severe accident at either IP-2 or -3. If there were a severe accident at either IP-2 or -3, it is highly likely that there would be hydrogen combustion in either the form of a deflagration or a detonation.
In the TMI-2 accident, a rapid pressure increase of approximately 28 psi in the containment 45 was attributed to the combustion of hydrogen in the form of a deflagration that was most likely caused by an electric spark;46 the deflagration may have even been initiated by a ringing telephone. 47 In the TMI-2 accident, "the hydrogen burn... resulted 48 from a hydrogen concentration of 8.1 volume percent."
At either IP-2 or -3, it is highly unlikely that a hydrogen deflagration in the containment that caused a rapid pressure increase of approximately 28 psi would cause a breach in the containment. According to Entergy, the design pressures of IP-2 and -3's containments are both 47 psig; 49 and according to "Indian Point Probabilistic Safety Study," the failure pressures of IP-2 and -3's containments are both approximately 5
126 psig. 1 However, it is entirely possible that in the event of a severe accident at either IP-2 or -3, that either a hydrogen deflagration or detonation could cause a rapid pressure increase in the containment that would be greater than 28 psi.
44 Xiao Jianjun, Zhou Zhiwei, Jing Xingqing, "Safety Implementation of Hydrogen Igniters and Recombiners for Nuclear Power Plant Severe Accident Management," Tsinghua Science and Technology, Vol. 11, Number 5, October 2006, p. 556.
45 W. E. Lowry, et al., "Final Results of the Hydrogen Igniter Experimental Program,"
NUREG/CR-2486, p. 4.
46 E. Studer, et al., Kurchatov Institute, "Assessment of Hydrogen Risk in PWR," p.
1.
47 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 1.2.
48 Kahtan N. Jabbour, NRC, letter regarding Turkey Point Units 3 and 4, Exemption from Hydrogen Control Requirements, December 12, 2001, Attachment 2, "Safety Evaluation by the Office of Nuclear Reactor Regulation, Turkey Point Units 3 and 4," available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: MLO 13390647, p. 4.
49 Entergy, "Technical Facts: Indian Point Unit 2, Plant Specific Information;" and Entergy, "Technical Facts: Indian Point Unit 3, Plant Specific Information."
50 Power Authority of the State of New York, Consolidated Edison Company of New York, "Indian Point Probabilistic Safety Study," Vol. 8, p. 4.2-1 and Appendix 4.4.1, p. 14.
15
C. Calculations of the Pressure Loads Resulting from Combustion of the Quantity of Hydrogen Produced from a Metal-Water Reaction of 100 Percent of the Fuel Cladding Active Length Indicate that IP-2 and -3's Containments Could Fail In this section Petitioner discusses the results of analyses of the pressure loads that the containments of different PWRs could incur in the event of severe accidents, in which there would be hydrogen deflagrations from the quantity of hydrogen produced from a metal-water reaction of either 75 percent or 100 percent of the active fuel cladding length. These analyses were done for different PWRs, which have containments with different free volumes and different quantities of fuel cladding (active length) in their cores; these PWRs would also have different containment failure pressures. Therefore, the results of these analyses do not directly apply to IP-2 and -3. However, the results of these analyses can still be used to provide a general idea of the magnitude of the pressure loads that IP-2 and -3 containments might be expected to incur if either a hydrogen deflagration or detonation were to occur in the event of a severe accident, in which there was a quantity of hydrogen produced from a metal-water reaction of either 75 percent or 100 percent of the active fuel cladding length.
Discussing calculations of the adiabatic isochoric complete combustion ("AICC")
pressure 5 1 loads that could possibly compromise the large dry containment of a French PWR, an IAEA report, published July 2011, "Mitigation of Hydrogen Hazards in SA" states:
A typical example of pressure loads is given in ["Hydrogen Behaviour and Mitigation in Water-Cooled Nuclear Power Reactors"], which indicates the AICC pressure loads on the large dry containments of French PWRs (with no [passive autocatalytic recombiners ("PAR")] applied). The pressure loads resulting from hydrogen deflagration vary about 6.2-6.5
[bar (89.9-94.3 psi)] for 75% active cladding length and about 7.7-8 [bar (111.7-116 psi)] for 100% active cladding length.
5' The AICC pressure is often termed the Constant Volume Explosion Pressure. See M. P.
Sherman, S. R. Tieszen, W. B. Benedick, SNL, "FLAME Facility: The Effect of Obstacles and Transverse Venting on Flame Acceleration and Transition to Detonation for Hydrogen-Air Mixtures at Large Scale," NUREG/CR-5275, April 1989, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML071700076, p. 6.
52 E. D. Loggia, "Hydrogen Behaviour and Mitigation in Water-Cooled Nuclear Power Reactors,"
European Commission, EUR 14039, 1992.
16
It should be noted that these loads do not include any consideration of flame acceleration or [deflagration-to-detonationtransition ("DDT")]; if such processes are taken into account, higher loads may result [emphasis added]. 5 3 Regarding containment failure and different types of containment failure, "Mitigation of Hydrogen Hazards in SA" states:
If the loads exceed the design strength, the containment may fail. Usually, the containment has a considerable margin to failure, so that damage will first occur at higher loads. ... [T]he containment will not fail unless exposed to loads about 1.5-2.0 larger than the design loads.
The failure mechanism can be of [a] different nature. As the containment exists of a main structure plus a number of penetrations (hatches, pipe and cable penetrations), failure may either be a gross failure of the containment or a failure of one or more of the penetrations. Concrete containments often show initiation of cracks as the first indication of failure. If the cracks are large enough, they will prevent gross containment failure.54 "Mitigation of Hydrogen Hazards in SA" also states:
Containment failure is often represented in a probability curve: the higher the pressure the larger the probability of failure, see Fig. 17 [Failure Probability of the Containment as a Function of the Pressure]. That is to say, once combustion loads are known, 55 it is possible to calculate the failure probability of the containment.
Fig. 17 of "Mitigation of Hydrogen Hazards in SA" is a chart with a curve illustrating that the failure probability of a containment is 80 percent when the absolute pressure reaches approximately 8 bar (116 psi).56 There are also calculations of the pressure loads that could result from a metal-water reaction involving 100 percent of the fuel cladding active length that indicate that American PWR containments could fail.
3 IAEA, "Mitigation of Hydrogen Hazards in SA," p. 61.
IId., pp. 60-61.
"Id., p. 61.
56 id.
17
Regarding the high pressures that could result from hydrogen combustion, an NRC document regarding Three Mile Island Unit I ("TMI-1") states:
The NRC staff estimates the pressure for an adiabatic and complete hydrogen burn involving up to 75 percent core metal-water reaction to be 94 psig. ... For sequences involving up to 100 percent5 7core metal-water reaction, the NRC staff estimated a pressure of 114 psig.
And describing the calculations the same NRC document regarding TMI-1 states:
The NRC staff used the methodology in Section 2.6 of NUREG/CR-5662, "Hydrogen Combustion, Control, and Value-Impact Analysis for PWR Dry Containments," June 1991; assumed a containment free volume of 61,200 cubic meters [2.16 x 106 ft3], and assumed the inventory 58 of zirconium in the core to be 18,700 kg, to estimate the pressure.
The two passages above most likely are intended to pertain to metal-water reactions of 75 percent and 100 percent of the fuel cladding active length, excluding the cladding surrounding the plenum volume. For one thing, a different document regarding the same TMI-1 issue states that "NUREG/CR-5662 (1991) reports the computed containment peak pressure due to [a] global hydrogen burn based on a 75%,fuel cladding 59 metal-water reaction... [emphasis added]",
Regarding the high pressures that could result from hydrogen combustion, an NRC document regarding Oconee Units 1, 2, and 3 states:
Table 2.6.1 of NUREG/CR-5662, "Hydrogen Combustion, Control, and Value-Impact Analysis for PWR Dry Containments," June 1991, estimates the pressure for an adiabatic and complete hydrogen burn involving up to 75 percent core metal-water reaction to be 105 psig. ... For sequences involving up to 100 percent 60 core metal-water reaction, Table 2.6.1 estimated a pressure of 129 psig.
17 T. G. Colburn, NRC, letter regarding Three Mile Island Unit 1, license amendment from hydrogen control requirements, February 8, 2002, Attachment 2, "Safety Evaluation by the Office of Nuclear Reactor Regulation, Related to Amendment No. 240 to Facility Operating License No.
DPR-50, Three Mile Island Unit 1," available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML020100578, p. 5.
58 id.
59 Mark E. Warner, AmerGen Energy Company, letter regarding Three Mile Island Unit 1, Request for Exemption to 10 CFR 50.44, Etc., Attachment 1, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML003756521, p. 6.
60 D. E. LaBarge, NRC, letter regarding Oconee Units 1, 2, and 3, Exemption from Hydrogen Control Requirements., July 17, 2001, Attachment 2, "Safety Evaluation by the Office of Nuclear Reactor Regulation, Hydrogen Recombiner Exemption, Oconee Units 1, 2, and 3," available at:
www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML011710267, pp. 3-4.
18
Also, regarding the high pressures that could result from hydrogen combustion, an NRC document regarding Turkey Point Units 3 and 4 states:
The staff estimates the pressure for an adiabatic and complete hydrogen burn involving up to 75 percent core metal-water reaction to be 109 psig.
.,. For sequences involving up to 100 percent core metal-water reaction, 6
the staff estimates a pressure of 135 psig. 1 Describing the calculations, the same NRC document regarding Turkey Point Units 3 and 4 states:
The staff is using the methodology in Section 2.6 of NUREG/CR-5662, "Hydrogen Combustion, Control, and Value-Impact Analysis for PWR Dry Containments," June 1991, a containment free volume of 43,900 cubic meters [1.55 x 106 ft3], and the inventory of zirconium in the core to be 16,500 kg, to estimate the pressure.62 The calculations discussed above found that the pressure that TMI-I, Oconee's units, and Turkey Point's units' containments could incur from an adiabatic and complete hydrogen burn involving up to 75 percent core metal-water reaction could be 94 psig, 105 psig, and 109 psig, respectively. The calculations also found that for TMI-I, Oconee's units, and Turkey Point's units' containments, the pressure resulting from an adiabatic and complete hydrogen burn involving up to 100 percent core metal-water reaction could be 114 psig (7.86 bar), 129 psig (8.89 bar), and 135 psig (9.31 bar),
respectively.
The failure pressure of TMI-I's containment is estimated to be between 137 psig and 147 psig; 63 the failure pressures of Oconee Units 1, 2, and 3's containments are estimated to be 140 psig;64 and the failure pressures of Turkey Point Units 3 and 4's 61 Kahtan N. Jabbour, NRC, letter regarding Turkey Point Units 3 and 4, Exemption from Hydrogen Control Requirements, December 12, 2001, Attachment 2, "Safety Evaluation by the Office of Nuclear Reactor Regulation, Turkey Point Units 3 and 4," p. 3.
62 Id.
63 T. G. Colburn, NRC, letter regarding Three Mile Island Unit 1, license amendment from hydrogen control requirements, February 8, 2002, Attachment 2, "Safety Evaluation by the Office of Nuclear Reactor Regulation, Related to Amendment No. 240 to Facility Operating License No.
DPR-50, Three Mile Island Unit 1," p. 5.
6' D. E. LaBarge, NRC, letter regarding Oconee Units 1, 2, and 3, Exemption from Hydrogen Control Requirements, July 17, 2001, Attachment 2, "Safety Evaluation by the Office of Nuclear Reactor Regulation, Hydrogen Recombiner Exemption, Oconee Units 1, 2, and 3," p. 3.
19
containments are estimated to be 145 psig. 65 Therefore, the calculations found that the pressure resulting from an adiabatic and complete hydrogen bum involving up to 100 percent core metal-water reaction at Oconee and Turkey Point could be approximately 10 psi lower than their estimated containment failure pressures-not a significant margin of safety. In fact (discussed in section III.C.3), estimated containment failure pressures are not necessarily accurate, so it would be possible that Oconee or Turkey Point's containments would fail if they were to incur internal pressures of 129 psig or 135 psig, respectively.
If one of IP-2 and -3's containments were to incur pressure loads resulting from an adiabatic and complete hydrogen bum involving up to 100 percent core metal-water reaction, it is possible that the containment would fail: "Indian Point Probabilistic Safety Study" states that the estimated failure pressure of IP-2 and -3's containments is approximately 126 psig.66 As mentioned before, Fig. 17 of "Mitigation of Hydrogen Hazards in SA" is a chart with a curve illustrating that the failure probability of a containment is 80 percent when the absolute pressure reaches approximately 8 bar (116 psi). 67 This chart's curve also illustrates that the failure probability of a containment is 100 percent when the absolute pressure reaches 9 bar (130.5 psi). 68 There is some consistency between the conclusions of "Mitigation of Hydrogen Hazards in SA" and "Containment Integrity Research at SNL." "Containment Integrity Research at SNL" states that the failure pressure of Zion is 108 psig at the 5th percentile, 69 approximately 135 psig at the 50th percentile, and 180 psig at the 95th percentile.
65 Kahtan N. Jabbour, NRC, letter regarding Turkey Point Units 3 and 4, Exemption from Hydrogen Control Requirements, December 12, 2001, Attachment 2, "Safety Evaluation by the Office of Nuclear Reactor Regulation, Turkey Point Units 3 and 4,." p. 3.
66 Power Authority of the State of New York, Consolidated Edison Company of New York, "Indian Point Probabilistic Safety Study," Vol. 8, p. 4.2-1 and Appendix 4.4.1, p. 14.
67 IAEA, "Mitigation of Hydrogen Hazards in SA," p. 61.
68 id.
69 M. F. Hessheimer, et al., Sandia National Laboratories, "Containment Integrity Research at Sandia National Laboratories: An Overview," NUREG/CR-6906, July 2006, available at:
www.nrc.gov,. NRC Library, ADAMS Documents, Accession Number: ML062440075, p. 28 (hereinafter "Containment Integrity Research at SNL"); the source of this information is NRC, "Severe Accident Risks: An Assessment or Five U.S. Nuclear Power Plants," NUREG- 1150, December 1990.
20
Again, it is important to clarify that these analyses are for different PWRs, which have containments with different free volumes and different quantities of fuel cladding (active length) in their cores, and that their results do not directly apply to IP-2 and -3.
However, the results of these analyses can still be used to provide a general idea of the magnitude of the pressure loads that IP-2 and -3 containments might be expected to incur if a hydrogen deflagration or detonation were to occur in a the event of a severe accident, in which there was a quantity of hydrogen produced from either 75 percent or 100 percent of the active fuel cladding length.
Furthermore, the total quantity of hydrogen produced in a severe accident could exceed the total quantity of hydrogen produced from the oxidation of 100 percent of the active fuel cladding length. Therefore, the magnitude of the pressure loads that IP-2 and -3's containments could incur if a hydrogen deflagration or detonation were to occur in a the event of a severe accident, could exceed the pressure loads caused by either
- a. deflagration or detonation of the quantity of hydrogen produced from a metal-water reaction of 100 percent of the active fuel cladding length.
(It is noteworthy that in the TMI-2 accident, the oxidation of steel accounted for approximately 10 percent to 15 percent of the total hydrogen production. 70)
(It is also noteworthy that a 2000 NRC document states that more hydrogen could be produced in a severe accident than would be produced from a metal-water reaction of 100% of the active fuel cladding. 71)
Unfortunately, IP-2 and -3 are currently operating without either of the two possibilities for hydrogen management that are expected for future light water reactors
("LWR") 72 : 1) the integrity of IP-2 and -3's containments could fail from the maximum 70 Report by Nuclear Energy Agency Groups of Experts, OECD Nuclear Energy Agency, "In-Vessel and Ex-Vessel Hydrogen Sources," Part 1,p. 15.
71 NRC, "Status Report on Study of Risk-Informed Changes to the Technical Requirements of 10 C.F.R. Part 50 (Option 3) and Recommendations on Risk-Informed Changes to 10 C.F.R.
50.44 (Combustible Gas Control)," SECY-00-0198, 2000, Attachment II, p. 6-6.
72 Regarding the central goal of analyses of hydrogen distribution, combustion, and loads for future LWR design studies, "Report on FA and DDT" states that "[t]he central goal of the future plant hydrogen work is to derive hydrogen control systems that fulfill the safety requirements for future LWRs; namely, to show that the maximum amount of hydrogen that could be present during a severe accident can be confined without loss of containment integrity. In principle, there are two possibilities for hydrogen management in the future plants. The first one is to increase the strength of the containment design to the maximum possible combustion load. The second, 21
possible combustion load and 2) IP-2 and -3 are operating without any assurance that Entergy could control the total quantity of hydrogen generated in the event of a severe accident.
- 1. The Results of NRC's Calculations for an Adiabatic and Complete Hydrogen Burn at TMI-1, Oconee Units 1, 2, and 3, and Turkey Point Units 3 and 4 May Not have Been Conservative Claiming that the results of the calculations (estimates) (discussed in section III.C), for Turkey Point Units 3 and 4 are considered conservative, the NRC document regarding Turkey Point states:
These estimates are considered conservative because of the adiabatic assumption and the hydrogen bum is expected at much lower hydrogen concentrations than those assumed in the estimate, 13.0 and 16.0 volume percent, respectively. For example, the hydrogen burn during the accident at Three Mile Island, Unit 2, resulted from a hydrogen concentration of 8.1 volume percent. Therefore, the licensee's estimated limiting pressure for containment failure bounds 73 conservative estimates of the most likely hydrogen combustion modes.
The claim that the results of the calculations (estimates) are considered conservative also applies to the other calculations discussed in section III.C, in the NRC documents regarding TMI-1 and Oconee Units 1, 2, and 3; there are similar claims in those documents. However, the results of these calculations (estimates) for an adiabatic and complete hydrogen burn may not have been conservative, because the calculations would not have modeled either flame acceleration or DDT. If either flame acceleration or DDT had been considered, higher pressure loads may have resulted.74 more evolutionary way, is to use an existing containment design and install hydrogen control systems for load reduction, so that the original design load (LOCA) will not be exceeded." See OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.37.
73 Kahtan N. Jabbour, NRC, letter regarding Turkey Point Units 3 and 4, Exemption from Hydrogen Control Requirements, December 12, 2001, Attachment 2, "Safety Evaluation by the Office of Nuclear Reactor Regulation, Turkey Point Units 3 and 4," p. 4.
74 IAEA, "Mitigation of Hydrogen Hazards in SA," p. 61.
22
Regarding some of the differences between quasi-static AICC loads and dynamic loads from accelerated flames or detonations, "Mitigation of Hydrogen Hazards in SA" states:
Hydrogen deflagration can pose various risks to the containment and other plant systems. Combustion can give large pressure spikes, varying from relatively low pressure loads, bound by the AICC loads, until large loads from accelerated flames and detonations. Such acceleration can already occur above about 8% H 2 ... so that above that value the AICC load may
[no] longer be the bounding value.
AICC loads are quasi-static; i.e., the structural response can be calculated assuming loads are static. Loads from accelerated flames or detonations require a dynamic analysis; i.e., the dynamic characteristics of the structure need to be taken into account. A simplified approach is using an equivalent static load [emphasis added]. 75 Clearly, the results of the calculations (estimates) for an adiabatic and complete hydrogen burn (discussed in section III.C) may not have been conservative.
- 2. Additional Hydrogen Combustion Calculations that Indicate IP-2 and -3's Containments Could Fail There are calculations-besides the ones (discussed in section III.C) for hydrogen combustion at TMI-I, Oconee Units 1, 2, and 3, and Turkey Point Units 3 and 4-that indicate that hydrogen combustion could cause IP-2 and -3's containments to fail. For example, there are calculations reported in "Indian Point Probabilistic Safety Study,"
from 1982.76 "Indian Point Probabilistic Safety Study" has a table (Table 4.3.5-1) that has the results of calculations in which the peak pressure resulting from combustion exceeds the estimated failure pressure of Indian Point's containments, which is about 126 psig or 141 pounds per square inch absolute ("psia").77 In the table there are calculations for certain scenarios in which the peak pressure was predicted to be 160 psia, 169 psia, about
" Id., p. 113.
76 Power Authority of the State of New York, Consolidated Edison Company of New York, "Indian Point Probabilistic Safety Study," Vol. 8.
" Id., p. 4.2-1 and Appendix 4.4.1, p. 14.
23
157 psia, and 180 psia or greaterV7--well above the estimated failure pressure of IP-2 and -3's containments.
- 3. The Accuracy of Containment Failure Pressure Estimates Is Questionable The estimates of containment failure pressures for Zion and other NPPs that "Containment Integrity Research at SNL" discusses were originally conducted for "Severe Accident Risks: An Assessment or Five U.S. Nuclear Power Plants," NUREG-1150.
"Containment Integrity Research at SNL" provides a quote regarding a review comment on NUREG-1 150 that questions the ability to accurately estimate containment failure pressure. The review comment states:
Experimental data on the ultimate potential strength of containment buildings and their failure modes are lacking. This lack of data renders questionable the methods used in draft NUREG-1 150 for assigning probabilities and locations of failure. 79 One of the authors of NUREG- 1150 responded:
The present data on the potential strength of containment structures under severe accident loadings and the potential modes of failure are limited... 8 ° It is important to remember that estimates of containment failure pressure are not necessarily accurate.
D. A Discussion of Analyses of a Loss-of-Offsite Power Accident for a Future Nuclear Power Plant Design In an OECD Nuclear Energy Agency report, "Report on FA and DDT," there is an example of analyses of a loss-of-offsite power ("LOOP") accident for a future NPP design.81 Of course, these analyses do not directly apply to IP-2 and -3; however, these analyses should be instructive, in that they provide a general idea of the magnitude of the pressure loads that either containment of IP-2 and -3 might be expected to incur if a hydrogen deflagration or detonation were to occur in a the event of a severe accident.
78 Id., pp. 4.3-22, 4.3-23.
'9 M. F. Hessheimer, et al., "Containment Integrity Research at SNL," NUREG/CR-6906, p. 28.
80 id.
81 OECD Nuclear Energy Agency, "Report on FA and DDT," pp. 6.37-6.45.
24
For one thing, the analyses model a containment with 90,000 m 3 (approximately 3.18 x 106 ft3) of free volume 82 and the volume of IP-2 and -3's containments is 3 83 approximately 2.61 x 106 ft .
These analyses are for a LOOP scenario in which there is a low overall concentration of steam in the containment and hydrogen concentrations in the containment that range, in a stratified distribution, from about 9 percent to 13 percent.
There is a total of approximately 900 kg of hydrogen in the containment. 84 The source of the steam is the water that has evaporated from the internal refueling water storage tanks; and the hydrogen has been primarily generated from the oxidation of the Zircaloy fuel cladding.
In the base case analysis, there is not any hydrogen mitigation and in this case "a large detonation in the [containment] dome could not be excluded." 85 In another analysis of the same LOOP scenario but including 44 PARs, designed by Siemens, "[t]he inclusion of [the PARs leads] to a decrease of the maximum H2 inventory in the containment from previously [about] 900 kg to about 720 kg 86 hydrogen."'
Regarding the simulated decrease of approximately 180 kg of hydrogen, "Report on FA and DDT" states:
This relatively small decrease is due to the fact that the H2 release during the first heatup of the core is much faster (10 min) than the recombiner removal time (1 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />). The relatively slow-acting recombiners, which [per unit] remove typically several grams of H2 per second cannot significantly reduce the high initial release rate [of hydrogen] in the LOOP scenario (several kilograms per second). 8 7 Regarding the rapid hydrogen production that "occurs in practically all severe accident scenarios," "Report on FA and DDT" states:
A rapid initial H2-source occurs in practically all severe accident scenarios because the large chemical heat release of the Zr-steam reaction causes a 82 Id., p. 6.37.
83 Power Authority of the State of New York, Consolidated Edison Company of New York, "Indian Point Probabilistic Safety Study," Vol. 8, pp. 5.8.2-6, 5.8.3-8.
84 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.38.
85 Id., p. 6.37.
86 Id., p. 6.38.
87 Id.
25
fast self-accelerating temperature excursion during which initially large 88 surfaces and masses of reaction partners are available.
In the analysis with the 44 PARs there was an accumulation of approximately 720 kg of hydrogen in the containment. It could be "predict[ed] that the mixture present in the upper half of the containment (>11% H 2 ), would be able to support [flame acceleration] .89 "Report on FA and DDT" states that "[a] COM3D calculation was therefore performed using the stratified H 2 distribution from the GASFLOW calculation as initial conditions (9% to 13% H2)" 90 and that "the results are quite surprising and are non-trivial."9' Describing the results, "Report on FA and DDT" states:
The highest flame speeds (150 m/s) do not occur in regions of highest H2 concentration; e.g., the dome, but rather in regions with both sufficient hydrogen concentration and turbulence generation, which is below the operating deck, and along the staircases. The highest loads to the outer containment wall [to the left] (<8.5 bar) [<123.3 psi] develop on the containment side opposite to the ignition point because two propagating flame fronts meet [there], leading to pressure wave superposition (top part of Figure 6.4.5.2.2-2 92). The right wall near the ignition point is loaded quite uniformly with pressures up to about 4 bar [58 psi] (bottom part of Figure 6.4.5.2.2-293). Because this pressure rise time is much longer than the typical containment 94 wall period, this represents a quasi-static load to the structure.
The highest loads to containment are less than and equal to approximately 8.5 bar (123.3 psi); and the containment wall near the ignition point is loaded uniformly with pressures of up to approximately 4 bar (58 psi). Furthermore, the highest flame speeds are 150 m/s. According to "Report on FA and DDT," "[i]n current nuclear power plants, 88 Id.
89 Id., p. 6.39.
90 Id.
91 Id.
92 See Appendix A Figure 6.4.5.2.2-2 Containment Loads from Fast Turbulent Combustion in Future Plant.
93 See Appendix A Figure 6.4.5.2.2-2 Containment Loads from Fast Turbulent Combustion in Future Plant.
94 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.39.
26
the load-bearing capacity of the main internal structures is jeopardized by flame speeds in 95 excess of about 100 m/s."'
Continuing its description of the results, "Report on FA and DDT" states:
The characteristic loading times of the left and right containment wall are quite different, about 50 [milliseconds ("ms")] and 300 ms, respectively.
When compared to the typical natural response times Tcont of a dry PWR concrete containment,96 the first case represents a dynamic load, (Tload/Tcont << 1), and the second case a load regime that is in the transition from dynamic to quasi-static (TIoad / Tcont = 1). In the first domain, the deformation is proportional to the wave impulse, whereas in the quasi-static domain it is proportional to the peak pressure reached.9 7 The highest load of approximately 8.5 bar (123.3 psi) is a dynamic load; and the uniform load on the containment wall near the ignition point of approximately 4 bar (58 psi) is in a load regime that is in transition from dynamic to quasi-static.
"Report on FA and DDT" also discusses another analysis for the LOOP scenario with 44 recombiners in which there is a local detonation in the containment dome. In this analysis there is 690 kg of hydrogen in the containment and hydrogen concentrations between 7 percent and 13 percent.
Describing the results of the analysis with the local detonation, "Report on FA and DDT" states:
This scenario should result in an upper limit for fast local combustion loads, which could be possible with the hydrogen inventory in the containment under the present conditions... A linear H2 gradient from 7%
to 13% was assumed, leading to a total H2 mass of 690 kg in the containment. The initial temperature was 320 K [1 16.6°F], and the initial pressure 1.23 bar [17.8 psi]. Figure 6.4.5.2.3-298 shows the predicted pressure loads at different points along the upper edge of the containment cylinder (1 to 7). Ignition is initiated at point 1 [where the pressure reaches about 2.0 Mpa (290 psi)]. In points 2, 3, and 4 basically side-on pressures are generated [of about 1.25 Mpa (181.3 psi)], whereas in points 5, 6, and 7 higher reflected pressures appear [of about 2.0 Mpa (290 psi)].
Because of the short loading times of typically 10 ms, these loads clearly fall into the impulsive regime, where the building deformation is 95 Id., p. i.
96 E. Studer, M. Petit, "Use of RUT Large Scale Combustion Test Results for Reactor Applications," SMIRT- 14, Lyon, France, August 17-22, 1997.
97 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.41.
98 See Appendix B Figure 6.4.5.2.3-2 Calculated Pressures from a Local Detonation in the Containment Dome.
27
proportional to the wave impulse. The calculated 99 impulses in the detonation wave range from about 5 to 20 kPa.
In the analysis with the local detonation, the predicted pressure loads reach values as high as 290 psi; however, these loads have short loading times of typically 10 ms.
Concluding on what the analyses of the LOOP scenario with 44 recombiners have indicated, "Report on FA and DDT" states:
The described calculations have shown that mitigation with recombiners alone still allows accumulation of up to roughly 700 kg H2 in the containment and that combustion of this hydrogen mass could lead to significant dynamic loads. Although these loads may not endanger the containment integrity in the undisturbed areas, they would certainly require extensive analysis of containment integrity in regions around penetrations [hatches, pipe and cable penetrations R°]. Moreover, these dynamic loads could have severe consequences for safety systems that are needed for further management of an accident. Especially vulnerable 01 are the structurally weak recombiner boxes and the spray system. 1 Again, these LOOP scenario analyses do not directly apply to IP-2 and -3; however, these analyses should be instructive, in that they provide a general idea of the magnitude of the pressure loads that either containment of IP-2 and -3 might be expected to incur if a hydrogen deflagration or detonation were to occur in the event of a severe accident.
In the LOOP scenario-in which the highest flame speeds (150 m/s) occur below the operating deck and along the staircases-the highest dynamic load to the containment, approximately 123.3 psi, is well over the design pressures of IP-2 and -3's containments, 47 psig,10 2 and close in value to the failure pressures of IP-2 and -3's containments, 126 psig.103 Additionally, the uniform loads (a load regime that is in the transition from dynamic to quasi-static) to the containment wall near the ignition point are approximately 58 psi and over the design pressures of IP-2 and -3's containments, 47 psig.
99 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.42.
100 IAEA, "Mitigation of Hydrogen Hazards in SA," p. 60.
101 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.44.
102 Entergy, "Technical Facts: Indian Point Unit 2, Plant Specific Information;" and Entergy, "Technical Facts: Indian Point Unit 3, Plant Specific Information."
'03 Power Authority of the State of New York, Consolidated Edison Company of New York, "Indian Point Probabilistic Safety Study," Vol. 8, p. 4 .2 - 1 and Appendix 4.4.1, p. 14.
28
"Report on FA and DDT" states that the magnitude of the calculated "loads may not endanger the containment integrity in the undisturbed areas" [emphasis added]. 104 In other words, "Report on FA and DDT" does not definitively conclude that the containment integrity would not be endangered. Furthermore, the magnitude of the calculated "loads may not endanger the containment integrity in the undisturbed areas;"' 10 5 however, the magnitude of the calculated loads indicates that "extensive analysis of containment integrity in regions around penetrations [hatches, pipe and cable penetrations' 0 6]" 07 1 would be required.' "Report on FA and DDT" also states that "these dynamic loads could have severe consequences for safety systems that are needed for 0 8 further management of an accident."'
Clearly, it is not in the interest of public safety to have IP-2 and -3 operating without any assurance that Entergy could control the total quantity of hydrogen generated in the event of a severe accident.
E. Reports State that in the Event of a Severe Accident, Containment Integrity and Essential Safety Systems Could Be Compromised by Internally-Generated Missiles and that Containment Integrity Could Be Compromised by a Global Detonation Some reports have stated that in the event of a severe accident, the containment integrity and essential safety systems of a NPP could be compromised by internally-generated missiles, caused by either a hydrogen deflagration or detonation, and that containment integrity could also be compromised by a global detonation.
Below are quotes from such reports:
The significance of [flame acceleration ("FA")] and [deflagration-to-detonation transition ("DDT")] processes for reactor safety is due to the fact that these fast combustion modes can be extremely destructive. They have the highest damage potential for internal containment structures; for safety systems that are required for safe termination of the accident 104 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.44.
105 Id.
106 IAEA, "Mitigation of Hydrogen Hazards in SA," p. 60.
107 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.44.
108 Id.
29
(sprays, recombiners); andfor the outer containment shell that is the last barrieragainst the release of radioactivityinto the environment.
The concern about the outer containment shell is not only connected to its function as the ultimate barrier, but the concern is also due to its complicated structural behavior. All modern containment buildings are a complex composite of different structural elements, including an undisturbed shell, personal and material locks, and hatches of different sizes and design, as well as penetrations for electrical cables and pipes.
This system has been qualified for a certain global and static design pressure, which is generally related to the maximum blowdown pressure from a break of the primary coolant line.
However, in a severe accident, which is not part of the licensing process, in existing plants FA and DDT may become possible. In this case, new containment load classes would arise, namely high local or even global dynamic loads [emphasis added].10 9
- 2) The same OECD Nuclear Energy Agency report states:
[T]he way to jeopardize the containment may be different: possible missiles created by a10 local explosion compared to global pressure loading 1
of the containment.
Containment failure probability is largely dependent on the individual containment design and the particular phenomena or load that challenges the integrity of the containment. Particular severe accident challenges to the containment include: 1) overpressure, 2) dynamic pressure (shock waves), 3) internal missiles, 4) external missiles, 5) melt-through, and 6) bypass. 11
Under unfavorable conditions, thermal stratification can occur that prevents the hydrogen from mixing with the steam. This can occur if mass releases from the primary system are widely apart; e.g., in a small break LOCA, one may first see the steam and only much later the hydrogen.
Hence, scenarios have to be included that can give rise to such phenomena. A typical risk is also if the containment initially is inert, due to the steam, so that hydrogen can accumulate considerably. Combustion 109 Id., p. 1.3.
1 Id., p. 6.2.
...M. F. Hessheimer, et al., "Containment Integrity Research at SNL.," NUREG/CR-6906, pp. 25-26.
30
will then first occur once the steam is largely condensed; i.e., at a fairly large H2 concentration, which then may result in large loads. 112
- 5) The same IAEA report states:
[T]he containment may also suffer indirect damage. This can happen if a local explosion destroys a compartment, after which the missiles from this compartment penetrate the containment or damage lines that go through 113 it.
- 6) A paper, "Igniters to Mitigate the Risk of Hydrogen Explosions-A Critical Review," states:
The hydrogen concentrations averaged over the free volume of the containment may reach values between 7 and 16 percent or even more.
Local concentrations may be much higher, in particular if steam condensation is realistically taken into account. It is concluded that within the large geometries of PWR-containments a slow laminar deflagration would be very unlikely. In most cases, highly efficient combustion modes must be expected ...
Massive pre-stressed concrete containments or concrete containments which are equipped with a steel liner may be some what more favorable in forgiving the consequences of local detonations. According to the mass ratio of concrete to load bearing steel rebars, the internally generated missiles [which may result from a local detonation] may only damage the liner but not necessarily cause catastrophic failure of the steel rebars. In general, it is anticipated that concrete containments are mainly challenged by global detonations involving the entire free volume. 114
Missiles may be generated when combustion (deflagration or detonation) occurs in a confined region or when a propagating combustion front produces dynamic pressure loads on equipment. Such missiles may pose a threat to the containment structure itself, as well as representing a potential threat to safety and control equipment. For instance, electrical cables may not be expected to withstand the impact of a door or metal box. The actual risk to plant safety posed by missiles generated from 5
hydrogen combustion depends upon a number of independent factors. "1 112 IAEA, "Mitigation of Hydrogen Hazards in SA," p. 113.
13 Id.
14 Helmut Karwat, "Igniters to Mitigate the Risk of Hydrogen Explosions-A Critical Review,"
Nuclear Engineering and Design, 118, 1990, p. 267.
1" Allen L. Camp, et al., "Light Water Reactor Hydrogen Manual," NUREG/CR-2726, p. 2-59.
31
- 8) A different SNL report, "FLAME Facility: The Effect of Obstacles and Transverse Venting on Flame Acceleration and Transition to Detonation for Hydrogen-Air Mixtures at Large Scale," states:
The pressure loads at TMI-2 did not threaten the strong containment structure. However, the pressure rise would have been higher and the combustion even more rapid if the hydrogen concentration had been higher. This might occur in smaller sized containments, if more hydrogen had been generated, or if the released hydrogen was more concentrated and not mixed throughout containment. 116
- 9) An NRC letter to licensees, "Completion of Containment Performance Improvement Program, Etc.," states:
Depending on the degree of compartmentalization and the release point of the hydrogen from the vessel, local detonable mixtures of hydrogen could be formed during a severe accident and important equipment, if any is nearby, could be damaged following a detonation. In addition, smaller
[PWR] sub-atmospheric containments may develop detonable mixtures of hydrogen on a global basis. 117 Clearly, in the event of a severe accident at either IP-2 or -3, either a hydrogen deflagration or detonation could cause a substantial amount of damage. Furthermore, it cannot be concluded that IP-2 and -3's containments would not fail in some scenarios.
(It is noteworthy that the NRC Near-Term Task Force report, "Recommendations for Enhancing Reactor Safety in the 21st Century" states that "PWR facilities with large dry containments do not control hydrogen buildup inside the containment structure because the containment volume is sufficient to keep the pressure spike of potential hydrogen deflagrations within the design pressure of the structure."' 118 The Task Force report does not mention that either a fast deflagration or a detonation could occur in the event of a severe accident-a fast deflagration or a detonation that could possibly compromise the integrity of a PWR large dry containment. The report also does not 116 M. P. Sherman, S. R. Tieszen, W. B. Benedick, "FLAME Facility: The Effect of Obstacles and Transverse Venting on Flame Acceleration and Transition to Detonation for Hydrogen-Air Mixtures at Large Scale," pp. 5-6.
117NRC, letter to all licensees holding operating licenses and construction permits for NPPs, except licensees of BWR Mark Is, "Completion of Containment Performance Improvement Program, Etc.," July 6, 1990, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML031210418, p. 1.
118 Charles Miller, et al., "Recommendations for Enhancing Reactor Safety in the 21st Century,"
- p. 42.
32
mention that an internally-generated missile, caused by a hydrogen detonation; could either compromise containment integrity or damage essential safety systems.
Given the fact that a number of hydrogen explosions-including hydrogen detonations' 1 9-- occurred in the Fukushima Dai-ichi accident, it would have seemed appropriate for the Task Force report to discuss the possibility of hydrogen detonations occurring in the event of severe accidents.)
F. IP-2 and -3 and the Safety Issue of Internally-Generated Missiles Caused by Hydrogen Explosions In the event of a severe accident, the containment integrity and essential safety systems of a NPP could be compromised by internally-generated missiles caused by either a hydrogen deflagration or detonation. An IAEA report, "Mitigation of Hydrogen Hazards in SA," published July 2011, states that "no analysis ever has been made on the damage potential of flying objects, generated in an H2-explosion"'12 0 that could occur in the event of a severe accident. The same IAEA report states:
[I]n the case that the containment has many sub-compartments, a local deflagration or detonation may occur that damages the sub-compartment and through this may generate missiles (concrete blocks from the disintegrated compartment walls) that can endanger the containment integrity. ... The resistance of a concrete containment to such objects is larger than that of a steel containment: upon impact, the missile may generate cracks rather than gross failure. 121 If either of IP-2 and -3's PWR large dry containments, which are each comprised of reinforced concrete with a steel liner,122 were impacted by an internally-generated missile caused by either a hydrogen deflagration or detonation, it seems more likely that the containment would incur cracks than gross failure. However, if a PWR large dry containment were to incur cracks it would be a serious problem. Additionally, at IP-2 119 In a September 8, 2011 Advisory Committee on Reactor Safeguards ("ACRS") meeting, Dr. Dana Powers stated that hydrogen detonations occurred in the Fukushima Dai-ichi accident.
See ACRS Full Committee Meeting Transcript, 586th Meeting, September 8, 2011, available at:
www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: MLI 1256A1 17, p. 95.
120 IAEA, "Mitigation of Hydrogen Hazards in SA," p. 62.
121 Id., pp. 61-62.
122 M. F. Hessheimer, et al., "Containment Integrity Research at SNL," NUREG/CR-6906, p. 8.
33
and -3, essential safety systems could be seriously compromised by internally-generated missiles.
Yet, as stated above, the damage potential of these flying objects still lacks sufficient analysis-at least, according to a 2011 IAEA report. Over thirty years ago, May 1980, the safety issue of the damage potential of internally-generated missiles, caused by hydrogen deflagrations or detonations, was addressed in a SNL slide presentation, titled "Hydrogen Behavior and Control." The SNL slide presentation states that one of the concerns of hydrogen combustion is that "detonations may produce missiles which could jeopardize equipment or breach [the] containment."' 23 Since that report, NRC has not required that the licensee of IP-2 and -3 perform severe accident analyses on the damage potential of internally-generated missiles. Furthermore, a SNL report, "Light Water Reactor Hydrogen Manual," published August 1983, states:
Missiles may be generated when combustion (deflagration or detonation) occurs in a confined region or when a propagating combustion front produces dynamic pressure loads on equipment. Such missiles may pose a threat to the containment structure itself, as well as representing a potential threat to safety and control equipment. 124 It is noteworthy that an Institute of Nuclear Power Operations ("INPO") report, published November 2011, documents how in the Fukushima Dai-ichi accident, internally-generated missiles and missiles from secondary containments, resulting from hydrogen explosions, caused a considerable amount of damage and set back efforts to control the accident.' 25 For example, the INPO report states:
[D]ebris from the explosion struck and damaged the cables and mobile generator that had been installed to provide power to the standby liquid control pumps. The debris also damaged the, hoses that had been staged to inject seawater into Unit I and Unit 2. ... Some of the debris was also highly contaminated, resulting in elevated dose rates and contamination levels around the site. As a result, workers were now required to wear additional protective clothing, and stay times in the field were limited.
123 Marshall Berman, Sandia National Laboratories, "Hydrogen Behavior and Control,"
Technology Exchange Meeting 3, Bethesda, Maryland, May 20, 1980, available at: www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML093450113, p. 16.
124 Allen L. Camp, et al., "Light Water Reactor Hydrogen Manual," NUREG/CR-2726, p. 2-59.
125 INPO, "Special Report on the Nuclear Accident at the Fukushima Dai-ichi Nuclear Power Station," INPO 11-005, November 2011, pp. 9, 12, 21, 24, 25, 32, 37, 79, 85, 86, 96.
34
The explosion significantly altered the response to the event and contributed to complications in stabilizing the units. 126 (Of course, the units that incurred meltdowns in the Fukushima Dai-ichi accident were BWR Mark Is, which have different containments than PWRs with large dry containments, like IP-2 and -3.)
It is also noteworthy that Appendix A to Part 50-"General Design Criteria for Nuclear Power Plants," Criterion 4, "Environmental and dynamic effects design bases,"
addresses the fact that a NPP's structures, systems, and components important to safety could be damaged by internally-generated missiles.
Appendix A to Part 50, Criterion 4 states:
Structures, systems, and components important to safety shall be designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents, including loss-of-coolant accidents.
These structures, systems, and components shall be appropriately protected against dynamic effects, including the effects of missiles.. .that may result from equipment failures and from events and conditions outside the nuclear power unit. ...
Therefore, Appendix A to Part 50 makes reference to missiles but issues no further requirement for assessing the damage potential of internally-generated missiles caused by hydrogen deflagrations or detonations in postulated severe accidents in which there could up to 300 kilograms of hydrogen generated in one minute.127 Additionally, it is noteworthy that Entergy's severe accident mitigation alternatives ("SAMA") analysis for the license renewal application for IP-2 and -3, considers missiles, as high wind projectiles outside the nuclear power unit; 28 Entergy's 29 SAMA analysis also discusses hydrogen deflagrations and detonations on four pages,1 and hydrogen combustion on a number of pages; however, Entergy's SAMA analysis 126 Id., p. 9.
127 E. Bachellerie, et al., "Designing and Implementing a PAR-System in NPP Containments,"
- p. 158.
128 Entergy, "Indian Point Energy Center: Applicant's Environmental Report: Operating License Renewal Stage," Attachment E, "Severe Accident Mitigation Alternatives Analysis," available at:
www.nrc.gov, NRC Library, ADAMS Documents, Accession Number: ML071210562, pp. E. 1-76, E. 1-77.
29 Id., pp. E.1-32, E.1-33, E.3-29, E.3-30.
35
does not consider the damage potential of internally-generated missiles, caused by either hydrogen deflagrations or detonations.
Furthermore, it is noteworthy that the technical information of Entergy's license renewal application for IP-2 and -3, states:
Missiles can be generated from internal or external events such as failure of rotating equipment. Inherent non-safety-related features that protect safety-related equipment from missiles require aging management review based on the criterion of 10 CFR 54.4(a)(2).i 3 ° Clearly, Entergy has not considered the damage potential of internally-generated missiles that could be caused by either hydrogen deflagrations or detonations in the event of a severe accident.
IV. CONCLUSION Petitioner requests that NRC revoke the operating license of IP-2 and -3, because either hydrogen fast deflagrations or detonations could breach IP-2 and -3's containments in the event of a severe accident, exposing the public to a large radiological release.
To uphold its congressional mandate to protect the lives, property, and environment of the people of New York and surrounding areas, NRC needs to revoke the operating license of IP-2 and -3.
To: R. William Borchardt Executive Director for Operations U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 130 Indian Point Energy Center, License Renewal Application, Technical Information, 2.0, "Scoping and Screening Methodology for Identifying Structures and Components Subject to Aging Management Review and Implementation Results," p. 2.1-8.
36
Respectfully submitted, Mark Leyse Consultant for Riverkeeper P.O. Box 1314 New York, NY 10025 markleyse@gmail.com Dated: November 14, 2012 37
Appendix A1 Figure 6.4.5.2.2-2 Containment Loads from Fast Turbulent Combustion in Future Plant 1OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.41.
10
-y= 6m y==18m 8 y=24m
_ y=30m y=36 m V)'
--- y=-42m y=48m 2
4 / 1 {j7I 0
0 500 1000 1500 Time, ms 10
-y= 6m
- y =12 m 8 y=18m
__ y 24 m y=30m S6 ... y=436m y 42 m
-y=48m 4-2 0 500 1000 1500 Time, ms Figure 6.4.5.2.2-2 Containment loads from fast turbulent combustion in future plant, 3D COM3D calculation, initial gas distribution from GASFLOW, LOOP scenario, 44 recombiners installed. Top: pressure on the left containment wall, opposite from ignition point. Bottom:
pressures on right containment wall near ignition point.
The characteristic loading times of the left and right containment wall are quite different, about 50 ms and 300 ms, respectively. When compared to the typical natural response times Tont of a dry PWR concrete containment [6.18], the first case represents a dynamic load, (Tjoad/Ton, << 1), and the second case a load regime that is in the transition from dynamic to quasi-static (Tioad / Tont = 1). In the first domain, the deformation is proportional to the wave impulse, whereas in the quasi-static domain it is proportional to the peak pressure reached.
6.41
Appendix B Figure 2 6.4.5.2.3-2 Calculated Pressures from a Local Detonation in the Containment Dome 2 OECD Nuclear Energy Agency, "Report on FA and DDT," p. 6.44.
4,0 CASE C CU, 0-3,0- ignition - at°n:
a) ,0 5. point .....
AA9
'7 0,0 0 20 40 60 8 100 120 140 160 Time, ms Figure 6.4.5.2.3.-2 Calculated pressures from a local detonation in the containment dome. Total H2 inventory in the building 690 kg H2, vertical H2 gradient from 7% to 13% H2, initial pressure 1.23 bar, initial temperature 470 C, LOOP scenario with 44 recombiners.
6.4.5.2.4 Results The described calculations have shown that mitigation with recombiners alone still allows accumulation of up to roughly 700 kg H2 in the containment and that combustion of this hydrogen mass could lead to significant dynamic loads. Although these loads may not endanger the containment integrity in the undisturbed areas, they would certainly require extensive analysis of containment integrity in regions around penetrations. Moreover, these dynamic loads could have severe consequences for safety systems that are needed for further management of an accident. Especially vulnerable are the structurally weak recombiner boxes and the spray system.
A general conclusion from these investigations is that early deliberate ignition in severe accidents, e.g., by igniters, appears necessary for further reduction of the maximum possible hydrogen inventory and of the corresponding pressure loads. Recombiner systems alone will not allow one to fulfil the new safety recommendations for future plants at least for dry LOOP scenarios. Therefore, an analysis with recombiners and igniters was performed.
- 6. 4.5.3 Mitigation with recombiners and igniters In addition to the 44 recombiners, one igniter was installed at each of the four IRWST exits from which the hydrogen-steam mixture would emerge in dry scenarios. Again, the MAAP sources for the LOOP scenario with reflood were used as input to the GASFLOW code.
In the simulation, the first ignition occurred at a hydrogen inventory of 110 kg in the building.
Thereafter a continuous bum was predicted, with one large standing flame at each IRWST exit (Figure 6.4.5.3-1). The evaluation of the 7X.-criterion, as it is implemented in GASFLOW, showed that at no time was there a possibility of a DDT occurring and that a safe implementation of igniters is possible for the LOOP scenario. The early ignition, with most of the hydrogen still in the IRWST as a non-flammable mixture, reduced the maximum combustion pressure effectively to insignificant values.
6.44
Appendix C Edwin S. Lyman, Union of Concerned Scientists, "Chernobyl on the Hudson?: The Health and Economic Impacts of a Terrorist Attack at the Indian Point Nuclear Plant," September, 2004
CHERNOBYL ON THE HUIDSON?
THE HEALTH AND ECONOMIC IMPACTS OF A TERRORIST ATTACK AT THE INDIAN POINT NUCLEAR PLANT Edwin S. Lyman, PhD Union of Concerned Scientists September 2004 Commissioned by Riverkeeper, Inc.
TABLE OF CONTENTS EXECUTIVE
SUMMARY
............................................................................................. 4 INTR O D U C TIO N ...................................................................................................... 7 (a) The terrorist threat to nuclear power plants .......................................................... 7 (b) The Nuclear Regulatory Commission: an agency in denial ................................. 8 (c) T he C R A C 2 R eport ............................................................................................ 12 ACCIDENTS: DESIGN-BASIS, BEYOND-DESIGN-BASIS, AND DELIBERATE.. 19 (a) D esign-basis accidents ........................................................................................ 19 (b) Beyond-design-basis accidents ........................................................................... 19 (c) "D eliberate accidents". ....................................................................................... 21 THE HEALTH CONSEQUENCES OF A RADIOLOGICAL RELEASE FROM IN D IA N P O IN T ................................................................................................................ 23 T H E M A C C S2 C O D E ................................................................................................. 26 THE SABOTAGE SCENARIO .................................................................................... 28 (a) T he source term .................................................................................................. 28 (b ) M eteoro lo g y ............................................................................................................. 33 (c) Protective actions ................................................................................................. 35 (d) Population distribution ........................................................................................ 36 R E SU LTS .......................................................................................................................... 38 (a) Consequences of radiological exposures during "emergency phase" ................ 39 (b) Doses received by individuals outside of the 10-mile EPZ ................................ 42 (i) Thyroid doses to children, their consequences, and the need for KI distribution 42 (ii) Whole-body doses and the need for evacuation or sheltering ....................... 47 (c) Long-term economic and health consequences ................................................... 49 (i) EPA Protective Action Guide cleanup standard ............................................... 49 (ii) Relaxed cleanup standard ............................................................................. 51 (d) A n even w orse case ............................................................................................ 52 C ON C L U S IO N S ............................................................................................................... 54 ACKNOWLEDGMENTS ............................................................................................. 54 2
TABLES TABLE 1: NUREG-1465 radionuclide releases into containment for PWRs ............. 31 TABLE 2: Source term used in MACCS2 model ........................................................ 33 TABLE 3: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs), latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, 100% evacuation of EPZ ..................................................................... 40 TABLE 4: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs), latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, 24-hour sheltering in EPZ .................................................................. 40 TABLE 5: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs), latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, norm al activity in EPZ ....................................................................... 41 TABLE 6: Terrorist attack at IP 2, MACCS2 estimates of centerline thyroid doses to 5-year-olds resulting from emergency phase exposures (all doses in rem) ............. 44 TABLE 7: Terrorist attack at IP 2, MACCS2 estimates of adult centerline whole-body total effective dose equivalents (TEDEs) resulting from emergency phase exposures (all doses in rem ) ................................................................................................. . . 48 TABLE 8: Terrorist attack at IP 2, MACCS2 9 5Ih percentile estimates of early fatalities (EFs) and latent cancer fatalities (LCFs) resulting from emergency phase exposures; 2 5 -m ile E P Z ............................................................................................................. 48 TABLE 9: Terrorist attack at IP 2, MACCS2 estimates of long-term economic and health consequences, EPA intermediate phase PAG (< 2 rem in first year; approx. 5 re m in 5 0 yrs) ............................................................................................................ 51 TABLE 10: Long-term economic and health consequences of a terrorist attack at IP 2, relaxed cleanup standard (25 rem in 50 years) ...................................................... 52 TABLE 11: Terrorist attack at IP 2 and 3, MACCS2 estimates of early fatalities (EFs) and latent cancer fatalities (LCFs) resulting from emergency phase exposures, 100%
evacuation of E PZ ................................................................................................. 53 3
EXECUTIVE
SUMMARY
Since 9/11, the specter of a terrorist attack at the Indian Point nuclear power plant, thirty-five miles upwind from midtown Manhattan, has caused great concern for residents of the New York metropolitan area. Although the Nuclear Regulatory Commission (NRC) ordered modest security upgrades at Indian Point and other nuclear power plants in response to the 9/11 attacks, the plants remain vulnerable, both to air attacks and to ground assaults by large terrorist teams with paramilitary training and advanced weaponry. Many question whether the NRC's security and emergency planning requirements at Indian Point are adequate, given its attractiveness as a terrorist target and the grave consequences for the region of a successful attack.
This report presents the results of an independent analysis of the health and economic impacts of a terrorist attack at Indian Point that results in a core meltdown and a large radiological release to the environment. We find that, depending on the weather conditions, an attack could result in as many as 44,000 near-term deaths from acute radiation syndrome or as many as 518,000 long-term deaths from cancer among individuals within fifty miles of the plant. These findings confirm that Indian Point poses a severe threat to the entire New York metropolitan area. The scope of emergency planning measures should be promptly expanded to provide some protection from the fallout from an attack at Indian Point to those New York area residents who currently have none. Security at Indian Point should also be upgraded to a level commensurate with the threat it poses to the region.
A 1982 study by Sandia National Laboratories found that a core meltdown and radiological release at one of the two operating Indian Point reactors could cause 50,000 near-term deaths from acute radiation syndrome and 14,000 long-term deaths from cancer.
When these results were originally disclosed to the press, an NRC official tried to reassure the public by saying that the kind of accident the study considered would be less likely than 'hi jumbo jet crashing into a football stadium during the Superbowl."
In the post-9/l I era, the possibility of a jumbo jet crashing into the Superbowl --- or even a nuclear power plant --- no longer seems as remote as it did in 1982. Nonetheless, NRC continues to argue that the 1982 Sandia report is unrealistic because it focused on 'Worst-case" accidents involving the simultaneous failure of multiple safety systems, which are highly unlikely to occur by chance. But when the potential for terrorist attacks is considered, this argument no longer applies. 'Worst -case" scenarios are precisely the ones that terrorists have in mind when planning attacks.
Both NRC and Entergy, the owner of Indian Point, assert that even for the most severe terrorist attack, current emergency plans will be adequate to protect residents who live in the evacuation zone within 10 miles of the plant. They also say that there will be no significant radiological impact on New York City or any other location outside of the 10-mile zone. Accordingly, NRC has opposed proposals made after 9/11 to extend the emergency planning zone around Indian Point. However, NRC and Entergy have not 4
provided the public with any documentation of the assumptions and calculations underlying these claims.
In view of the lack of public information available on these controversial issues, we carried out an independent technical analysis to help inform the debate. Our calculations were performed with the same state-of-the-art computer code that NRC uses to assess accident consequences. We used the NRC's guidance on the radiological release from a core meltdown, current estimates of radiation risk, population data from the 2000 census, and the most recent evacuation time estimate for the 10-mile Indian Point emergency planning zone. Following the format of the 1982 Sandia report, we calculated the numbers of near-term deaths from acute radiation syndrome, the numbers of long-term deaths from cancer, and the maximum distance at which near-term deaths can occur. We evaluated the impact of both evacuation and sheltering on these outcomes. We also estimated the economic damages due to the long-term relocation of individuals from contaminated areas, and the cost of cleanup or condemnation of those areas.
The health and environmental impacts of a large radiological release at Indian Point depend strongly on the weather conditions. We have carried out calculations for over 140,000 combinations of weather conditions for the New York area and wind directions for the Indian Point site, based on a year's worth of weather data. For this data set, we have determined the average consequences, the peak consequences, and the consequences for '95 1h percentile" weather conditions (in other words, only 5% of the weather sequences analyzed resulted in greater consequences).
We believe that the 9 5 th percentile results, rather than the average values, represent a reasonable assessment of the likely outcome of a successful terrorist attack, since such attacks would most likely not occur at random, but would be timed to coincide with weather conditions that favor greater casualties. Attacks capable of causing the peak consequences that we calculate would be difficult to achieve because of inaccuracies in weather forecasts, restricted windows of opportunity and other factors, but remain within the realm of possibility.
For a successful attack at one of the two operating Indian Point reactors, we find that
- The number of near-term deaths within 50 miles, due to lethal radiation exposures received within 7 days after the attack, is approximately 31500 for 9 5 1h percentile weather conditions, and approximately 44,000 for the worst case evaluated.
Although we assumed that the 10-mile emergency planning zone was entirely evacuated in these cases, this effort was inadequate because (according to Entergy's own estimate) it would take nearly 9.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to fully evacuate the 10-mile zone, whereas in our model the first radiological release occurs about two hours after the attack.
- Near-term deaths can occur among individuals living as far as 18 miles from Indian Point for the 95th percentile case, and as far as 60 miles away in the worst case evaluated. Timely sheltering could be effective in reducing the number of 5
near-term deaths among people residing outside of the 10-mile emergency planning zone, but currently no formal emergency plan is required for these individuals.
" The number of long-term cancer deaths within 50 miles, due to non-acutely lethal radiation exposures within 7 days after the attack, is almost 100,000 for 9 5 'h percentile weather conditions and more than 500,000 for the worst weather case evaluated. The peak value corresponds to an attack timed to coincide with weather conditions that maximize radioactive fallout over New York City.
- Based on the 9 5 th percentile case, Food and Drug Administration guidance would recommend that many New York City residents under 40, and children in particular, take potassium iodide (KI) to block absorption for radioactive iodine in the thyroid. However, there is no requirement that KI be stockpiled for use in New York City.
- The economic damages within 100 miles would exceed $1.1 trillion for the 9 5 th percentile case, and could be as great as $2.1 trillion for the worst case evaluated, based on Environmental Protection Agency guidance for population relocation and cleanup. Millions of people would require permanent relocation.
We hope that this information will be useful to Federal, State and local homeland security officials as they continue to develop plans to protect all those at risk from terrorist attacks in the post-9/1 1 world.
6
INTRODUCTION (a) The terrorist threat to nuclear power plants Public concern about the vulnerability of nuclear power plants to catastrophic acts of sabotage soared in the aftermath of the September 11 terrorist attacks. There is ample justification for this concern.
Soon after the 9/11 attacks, the Nuclear Regulatory Commission conceded that U.S.
nuclear power plants were not designed to withstand the high-speed impact of a fully fueled, modern passenger jet. The report of the 9/11 Commission has revealed that al Qaeda considered attacks on nuclear plants as part of their original plan, but declined to do so primarily because of their mistaken belief that the airspace around nuclear power plants in the U.S. was 'testricted," and that planes that violated this airspace would likely be shot down before impact.'
But al Qaeda is surely now aware that no such restrictions were in place on 9/11. And it is clear from press reports that even today, no-fly zones around nuclear plants are imposed only at times of elevated threat level, and are limited in scope to minimize their economic impact on the aviation industry. This policy reflects a confidence in the ability of the intelligence community to provide timely advance warning of a surprise attack that
--- given the 9/11 example --- is not entirely warranted. Moreover, even when no-fly zones are in place around nuclear plants, they are not likely to be effectively enforced.
For instance, the U.S. government does not require that surface-to-air anti-aircraft protection be provided at nuclear plants, although such defenses have been routinely employed in Washington, D.C. since the 9/11 attacks.
In addition to the aircraft threat, many have begun to question the adequacy of physical security at nuclear plants to protect against ground-based, paramilitary assaults, in view of revelations that thousands of individuals received sophisticated training in military tactics at al Qaeda camps in Afghanistan. Press reports have documented many security failures at nuclear plants around the country, and have called attention to the troubling statistic that during a series of security performance tests in the 1990s, guard forces at nearly 50% of US plants failed to prevent mock terrorist teams from simulating damage that would have caused meltdowns had they been real attacks. This information, which was widely available but largely ignored before 9/11, suddenly became far more alarming in the new threat environment.
Today, the danger of a terrorist attack at a nuclear power plant in the United States ---
either from the air or from the ground --- is apparently as great as ever. According to a January 14, 2004 2 speech by Robert L. Hutchings, Chairman of the National Intelligence Council (NIC),
' The 9/11 Commission Report. Authorized Edition, W.W. Norton, New York, 2004, p. 245.
2 Robert L. Hutchings, 'Terrorism and Economic Security," speech to the International Security Management Organization, Scottsdale, AZ, January 14, 2004.
7
'targets such as nuclear power plants ... are high on al Qa'ida's targeting list as a way to sow panic and hurt our economy ... The group has continued to hone its use of transportation assets as weapons ... although we have disrupted several airline plots, we have not eliminated the threat to airplanes. There are still al Qaida operatives who we believe have been deployed to hijack planes and fly them into key targets ... Al Qa'ida's intent is clear. Its capabilities are circumscribed but still substantial. And our vulnerabilities are still great."
More recently, the 9/11 Commission concluded that 'Vnajor vulnerabilities still exist in cargo and general aviation security. These, together with inadequate 3 screening and access controls, continue to present aviation security challenges."
(b) The Nuclear Regulatory Commission: an agency in denial Since 9/11, members of the public, non-profit groups and lawmakers across the United States have been calling for major security upgrades at nuclear power plants, including consideration of measures such as military protection against ground assault and anti-aircraft defenses against jet attack. Yet the response of the Nuclear Regulatory Commission (NRC), the agency that regulates both the safety and security of US nuclear reactors, has not been commensurate with the magnitude of the threat.4 And the Department of Homeland Security, the agency charged with coordinating the defense of the entire US critical infrastructure against terrorist attacks, appears to be merely following NRC's lead. 5 Notwithstanding a steady stream of FBI warnings citing nuclear power plants as potential terrorist targets, NRC continues to maintain that there is no need to consider measures that could reduce the vulnerability of nuclear plants to air attack. NRC's position is that
'the best approach to dealing with 6 threats from aircraft is through strengthening airport and airline security measures."
As it became clear that NRC was not going to require the nuclear industry to protect nuclear plants from attacks on the scale of September 11, some groups began calling for plants to be shut permanently. Because many of the most dangerous fission products in a nuclear reactor core decay rapidly after shutdown, the health consequences of a terrorist attack on a shutdown nuclear 7 reactor would be significantly lower than those of an attack on an operating reactor.
3 9/11 Commission Report (2004), op cit., p. 391.
4 D. Hirsch, D. Lochbaum and E. Lyman, 'NRC's Dirty Little Secret," Bulletin of the Atomic Scientists, May/June 2003.
5 E. Lyman, 'Nuclear Plant Protection and the Homeland Security Mandate," Proceedings of the ih 44 Annual Meeting of the Institute of Nuclear Materials Management, Phoenix, Arizona, July 2003.
6 US Nuclear Regulatory Commission, 'Frequently Asked Questions About NRC's Response to the 9/11/01 Events," revised March 15, 2004. On the NRC web site: http://www.nrc.gov/what-we-do/safeguards/911/faq.htnml#3.
7 Calculations by the author, using the computer code MACCS2, indicate that for an attack occurring at twenty days after reactor shutdown and resulting in core melt and loss of containment, the number of early fatalities from acute radiation sickness would be reduced by 80% and the number of latent cancer fatalities 8
Public concern has been greatest for those plants seen as prime terrorist targets because of their symbolic importance or location near large population and commercial centers, such as the Indian Point nuclear power plant in Westchester County, New York, whose two operating reactors are situated only 24 miles from the New York City limits, 35 miles from midtown Manhattan and in close proximity to the reservoir system that supplies drinking water to nine million people. The post-9/11 movement to shut down Indian Point has attracted a level of support from the public and elected officials not seen since the early 1980s, including calls for shutdown by over 400 elected officials and over 50 municipalities.
In response to this challenge, NRC, Entergy (the owner of Indian Point), other nuclear utilities, and their trade group in Washington, the Nuclear Energy Institute (NEI), have undertaken a massive public relations campaign to assuage public fears about the risk of terrorism at Indian Point. First, they assert that a combination of robust nuclear plant design, physical security and redundant safety measures would be able to stop any terrorist attack from causing significant damage to the reactor core. Second, they argue that even if terrorists were to successfully attack Indian Point and cause a large radiological release, the public health consequences could be successfully mitigated by execution of the emergency plans already in place for residents within the 10-mile-radius
'bmergency planning zone" (EPZ). And third, they claim t hat outside of the 10-mile EPZ, exposures would be so low that no special precautions would be necessary to adequately protect the public from 8 radiation, other than possible interdiction of contaminated produce and water.
A typical example of the third argument can be found 9in a recent letter the NRC sent to Alex Matthiessen, Executive Director of Riverkeeper:
'Outside of 10 miles, direct exposure is expected to be sufficiently low that evacuation or sheltering would not be necessary. Exposure to a radioactive plume would not likely result in immediate or serious long-term health effects.
Consideration of public sheltering and evacuation in emergency plans is very conservative and recommended at very low dose levels, well below the levels where health effects would be expected to occur."
resulting from lower exposures would be reduced by 50%, compared to an attack when the reactor is operating at full power. This calculation does not consider an attack on the storage pools for the highly radioactive spent fuel, which could result in significant long-term radiological contamination over a wide area and enormous economic consequences. For an extensive discussion of this threat, as well as an analysis of approaches for mitigating it, see R. Alvarez et al., 'Reducing the Hazards from Stored Spent Power-Reactor Fuel in the United States," Science and Global Security 11 (2003) 1-51.
8 The NRC defines two 'bmergency planning zones," or EPZs. The 10 -mile 'plume exposure" EPZ is the region where evacuation or other actions could be ordered to protect the public from coming into contact with an atmospheric release of radioactivity. The 50-mile 'ingestion" EPZ is the region where interdiction of agricultural products and water supplies could be ordered to prevent the consumption of contaminated produce. No evacuation planning is required for individuals residing within the ingestion EPZ but outside of the plume exposure EPZ.
9 Letter from Cornelius F. Holden, Jr., Office of Nuclear Reactor Regulation, US NRC, to Alex Matthiessen, Riverkeeper, September 30, 2003.
9
The purpose of this report is to address these three claims, with an emphasis on the second and third, by conducting a quantitative assessment of the potential consequences of a terrorist-induced radiological release at Indian Point for individuals both within and without the 10-mile EPZ, including residents of New York City.
There is a considerable need today for an independent study of these questions. At a time when the importance of rigorous emergency planning for catastrophic terrorist attacks is obvious, it is essential that responsible officials be fully apprised of the facts, especially if they contradict long-held assumptions and biases. The lives of many people could be put at jeopardy if emergency plans are not designed with the most accurate information at hand.
This means, in particular, that the emergency planning process should be designed to account for the full spectrum of potential consequences, including so-called 'fast -
breaking" release scenarios in which radioactive releases to the environment would begin within about thirty minutes after an attack. This was one of the major conclusions of the0 report carried out for the government of New York State by James Lee Witt Associates.'
Certain terrorist attack scenarios could be capable of causing such rapid releases.
But NRC and the Federal Emergency Management Agency (FEMA) continue to be reluctant to require testing of fast-breaking radiological releases in emergency planning exercises, asserting that such events are highly unlikely to occur." l However, this argument is no longer relevant in an age when terrorists have acquired unprecedented levels of technical expertise, and are actively targeting critical infrastructure facilities with the intent to maximize casualties and economic damages. If current emergency plans cannot successfully cope with all credible terrorist-induced events, they should be upgraded. If upgrading to a sufficiently protective level is so cumbersome as to be practically impossible, then other options, including plant shutdown, should not be ruled out.
Members of the public deserve to be fully informed of the potential consequences for their health and property of a successful terrorist attack at Indian Point, so that they can prepare for an attack in accordance with their own judgment and willingness to accept risk. This principle is consistent with the guidance of the Department of Homeland Security, whose Web site www.reaidy.gov advises that 'hIl Americans should begin a process of learning about potential threats so we are better prepared to react during an attack." Sources of technical information other than NRC and the nuclear industry are 10James Lee Witt Associates, Review of Emergency Preparednessof Areas Adjacent to Indian Point and Millstone, March 2003, Executive Summary, pg. x.
Although it was anticipated that the widely publicized June 8, 2004 emergency planning exercise at Indian Point would involve a 'fast -breaking" release, NRC in fact chose a scenario in which no release at all occurred. It was assumed that terrorists attacked the plant with a jet aircraft but missed the reactor and only managed to crash into the switchyard, causing a loss of off-site power but not enough damage to result in a radiological release. Thus the exercise provided no information as to the effectiveness of the Indian Point emergency plan in protecting residents of the EPZ from injury had the plane actually hit its target and initiated the damage scenario that is assessed in this report.
10
also essential to facilitate a factually accurate and honest discussion of the risks and benefits of continued operation of Indian Point in the post-9/1 I era.
Some observers may criticize the public release of this report as irresponsible because they believe it (1) could assist terrorists in planning attacks, or (2) could interfere with the successful execution of emergency plans by unnecessarily frightening members of the public who the authorities claim are not at risk.
We aire acutely aware of such concerns and, after careful consideration, have concluded that they do not have merit. We have reviewed this report carefully and omitted any information specific-enough to be useful to terrorists seeking to attack Indian Point.
Unfortunately, far more detailed information about nuclear plant design, operation and vulnerabilities than this report contains has already been --- and continues to be --- widely disseminated. For example, a paper written by staff of the Oak Ridge National Laboratory (ORNL) and the Defense Threat Reduction Agency (DTRA), published in 2004 in a technical journal and available on the Internet, contains a diagram of a generic nuclear power plant indicating where truck bombs of various sizes could be detonated in order to stage an attack with a 100% probability of core damage.
There can be little doubt that al Qaeda and other terrorist organizations are already well aware of the severity of the consequences that could result from an attack at Indian Point.
It is NRC and FEMA that seem not to appreciate this risk, and it is to them above all that we direct this study. We also believe that there is a considerable cost, but no apparent benefit, to withholding information that could help people to protect themselves in the event of a terrorist attack at Indian Point. Better information will enable better coordination of all populations at risk and help to avoid situations where some individuals take inappropriate actions that endanger others.
This report would not have been necessary had we seen any indication that NRC and other government authorities fully appreciate the seriousness of the risk to the public from radiological sabotage, or if certain members of the Nuclear Regulatory Commission had not made statements regarding severe accident consequences and risks that contradicted the results of quantitative analyses developed and refined over several decades by NRC's own technical staff and contractors.
For instance, at a recent briefing on NRC's emergency preparedness program, NRC Commissioner Edward McGaffigan, comparing the radiological exposure from a reactor accident to air travel, radon and other sources of exposure to natural radioactivity, said 12 that the order of magnitude of the release is similar to all of these other things in people's lives and th ey should not panic over a few hundred millirem or even a couple of rem ... but it's this radiation phobia, absolutely inflamed by these anti -
12US NRC, Briefing on Emergency PreparednessProgram Status, Public Meeting, September 24, 2003, transcript, p. 73.
11
nuclear groups putting out their misinformation that actually hurts emergency planning .. "
Commissioner McGaffigan's statement is misleading on at least three counts:
(1) Current emergency planning guidance is already based on the principle that exposures of 'a couple of rem" would be acceptable following a large radiological release; (2) The potential doses from a large radiological release can greatly exceed 'h few hundred millirem or even a couple of rem"far downwind of the release site, and for many individuals could result in a significant increase in their lifetime risk of cancer (10% or greater) or even pose a risk of severe injury or death from acute radiation exposure; (3) Even if the average dose resulting from a large release were on the order of 'h couple of rem," the total collective detriment (latent cancer fatalities and economic damages) could be very high if a large number of people in a densely populated area were so affected.
We believe that misinformation originating within NRC itself is the biggest obstacle to development of the robust radiological emergency planning strategies needed to cope with today's heightened threat. Statements like those cited above raise the concern that those responsible for regulating the nuclear industry and protecting it from terrorist attack are either in a chronic state of denial or actually believe the propaganda generated by the nuclear industry for public consumption. If this is indeed the case, then one cannot have confidence that emergency planning officials are basing their decisions on accurate and unbiased information. Since the departure of NRC Commissioner Greta Dicus a few years ago, the current Commission does not have any members with backgrounds in radiation protection and health issues. One wonders whether the NRC Commissioners truly understand and appreciate the full extent of the dangers posed by the facilities that they regulate.
(c) The CRAC2 Report Given the lack of credible information from public officials on the potential consequences of a terrorist attack at Indian Point, concerned neighbors of the plant turned to one of the few sources on this subject in the public domain --- the so-called 'CRAC2 Report," carried out by Sandia National Laboratories (SNL) under contract for NRC in 1981. This study, formally entitled 'Technical Guidance for Siting Criteria Development," used a computer code developed by SNL known as CRAC2 ('Calculation of Reactor Accident Consequences') to analyze the consequences of severe nuclear plant accidents and to study their dependence on population density, meteorological conditions and other characteristics. The version of the CRAC2 Report that had been submitted to NRC for eventual public release only contained average values of consequence results, 12
but the 'peak" values for worst -case weather conditions were obtained by Congressman Edward Markey in 1982 and provided to the Washington Post.13 At many reactor sites, the CRAC2 Report predicted that for unfavorable weather conditions, a severe nuclear reactor accident could cause tens of thousands of early fatalities as a result of severe radiation exposure, and comparable numbers of latent cancer fatalities from smaller exposures. For Indian Point 3 (which at the time operated at a significantly lower power than it now does), CRAC2 predicted peak values of 50,000 early fatalities and 14,000 latent cancer fatalities, with early fatalities occurring as far as 17.5 miles downwind of the site.
The CRAC2 Report only considered accidents affecting operating nuclear reactors, and did not evaluate the consequences of accidents also involving spent fuel storage pools.
Spent fuel pool loss-of-coolant accidents could themselves result in large numbers of latent cancer fatalities, widespread radiological contamination and huge cleanup bills, even if only a fraction of the fuel in the pool were damaged.
The release of the CRAC2 figures caused a great deal of consternation, but NRC was able to defuse the controversy by claiming that the peak results corresponded to accidents with extremely low probabilities (said to be one in a billion), and hence were not a cause for concern. In fact, Robert Bernero, director of the NRC's risk analysis division at the time, said (in a moment of unfortunate prescience) that such severe accidents would be less likely than 'h jumbo jet crashing into a football stadium during the Super bowl."' 4 When Riverkeeper and other groups dusted off and called attention to the CRAC2 Report following the September 11 attacks, the NRC appeared unable to appreciate the new relevance of the study in a world where the possibility of a jumbo jet crashing into the Superbowl was no longer so remote. For example, in rejecting a 2001 petition filed by Riverkeeper to shut down the Indian Point plant until Entergy implemented a number of prudent security-related 5measures, the NRC merely repeated its old probability-based arguments, saying that'
".. the reactor siting studies in the CRAC2 Report ... used generic postulated releases of radioactivity from a spectrum of severe (core melt) accidents, independent of the probabilities of the event occurring or the impact of the mitigation mechanisms. The studies were never intended to be realistic assessments of accident consequences. The estimated deaths and injuries resulted from assuming the most adverse condition for each parameter in the analytical code. In the cited studies, the number of resulting deaths and injuries also reflected the assumption that no protective actions were taken for the first 24 13Subcommittee on Oversight & Investigations, Committee on Interior and Insular Affairs, U.S. House of Representatives, 'Calculation of Reactor Accident Consequences (CRAC2) For U.S. Nuclear Power Plants Conditional on an 'SSTI' Release," November 1, 1982.
14Robert J. McCloskey, 'The Odds of the Worst Case," Washington Post, November 17, 1982.
15US Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation, Notice of Director's Decision Under 10 CFR 2.206, November 18, 2002.
13
hours. The studies did not, and were never intended to, reflect reality or serve as a basis for emergency planning. The CRAC2 Report analyses used more simplistic models than current technologies."
6 Earlier in 2002, in a letter to the New York City Council, the NRC also said that'
'The Sandia study does not factor in the numerous probabilistic risk studies that have been performed since 1982. More realistic, current inputs, assumptions, and modeling techniques would be expected to result in much smaller health consequences."
In a more recent 'point paper" on homeland protection and preparedness, NRC conti nued to repeat these themes, although its conclusions were somewhat more equivocal: 17
'The Sandia Siting Study ['CRAC2'1 ... was performed to develop technical guidance to support the formulation of new regulations for siting nuclear power reactors. A very large radiation release and delayed evacuation, among other factors, accounts for the more severe consequences ... As an overall conclusion, that report does not present an up-to-date picture of risk at nuclear plants and does not reflect current knowledge in probabilistic or phenomenological modeling.
'Since September 11, 2001, the NRC has been performing assessments of the consequences of a terrorist attack on a nuclear power plant. These assessments are much more detailed than past analyses and reflect our improved understanding of severe accident phenomena. The more recent analyses have involved a more realistic assessment of the radiation release, emergency planning capabilities, radiation spreading, and health effects. More recent analysis indicates a general finding that public health effects from terrorist attacks at most sites are likely to be relatively small."
Although NRC continues to harshly criticize the CRAC2 Report and anyone who cites its results, it has not publicly identified the 'Iore realistic, current inputs, assumptions and modeling techniques that would be expected to result in much smaller health consequences," much less demonstrated the validity of these results by providing the public with its calculations for independent review. In fact, NRC now considers that these analyses are too sensitive for public release, making it impossible for the public to verify its claims.
NRC's unwillingness to share this kind of information with the public is not unexpected.
NRC (like its predecessor, the Atomic Energy Commission) has worked over its history to shield the public from estimates of the consequences of severe accidents without simultaneous consideration of the low probabilities of such accidents. By multiplying 16Hubert Miller, Region I Administrator, US NRC, letter to Donna De Constanzo, Legislative Attorney, New York City Council, July 24, 2002.
17US Nuclear Regulatory Commission, 'Point Paper on Current Homeland Protection and Preparedness Issues," November 2003, on the NRC Web site, www.nrc.gov.
14
high consequence values with very low probability numbers, the consequence figures appear less startling to the layman but are obscured in meaning. For instance, a release that could cause 100,000 cancer fatalities would only appear to cause 1 cancer fatality per year if the associated probability of the release were 1/100,000 per year.
This issue was central to the so-called Indian Point Special Proceeding, a 1.983 review conducted by a panel of NRC administrative judges that examined whether Indian Point posed unusually high risks because of its location in the densely populated New York metropolitan area. Before this proceeding, the NRC ruled that all testimony on accident consequences must also contain a discussion of accident probabilities. However, in its decision, the three-judge Atomic Safety and Licensing Board panel concluded that 'the Commission should not ignore the potential consequences of severe-consequence accidents by always multiplying those consequences by low probability values." 8 One of the judges dissented from this majority opinion, insisting that singling out Indian Point
'to the exclusion of many other sites similarly situated in effect raises again the question of considering consequences without their associated probabilities. This we have been restricted from doing by the Commission."'19 Today, it appears that this minority opinion ultimately prevailed at NRC.
The results of the CRAC2 Report are indeed of questionable applicability today. But the reasons for this are not the ones that NRC has identified, but include, for example, the fact that the CRAC2 Report
" used census data from 1970, at a time before rampant suburban sprawl greatly increased the population densities in formerly rural areas close to some nuclear reactor sites;
" assumed that the entire 10-mile emergency planning zone would be completely evacuated within at most six hours after issuance of a warning (contrary to NRC's assertion that the CRAC2 peak results reflect the assumption that 'ho protective actions were taken for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />'), whereas the current evacuation time estimate for the Indian Point EPZ, based on updated assessments of likely road congestion, is nearly ten hours;
- assumed aggressive medical treatment for all victims of acute radiation exposure in developing estimates of the number of early fatalities, and employed a now-obsolete correlation between radiation dose and cancer risk that underestimated the risk by a factor of 4 relative to current models;
- sampled only 100 weather sequences out of 8760 (an entire year's worth), a method which we find underestimates the peak value occurring over the course of a year by 30%.
18 US Nuclear Regulatory Commission, Atomic Safety and Licensing Board, Indian Point Special Proceeding, Recommendations to the Commission, October 24, 1983, p. 107.
19Ibid, 'Dissenting Views of Judge Gleason," p. 433.
15
In 1990, the CRAC2 code was retired in favor of a new code known as MACCS
('MELCOR Accident Consequence Code System'), which was updated to MACCS2 in 1997. The MACCS2 code, also developed by Sandia National Laboratories, is the state-of-the-art consequence code employed by both NRC and DOE in conducting dose assessments of radiological releases to the atmosphere. It includes numerous improvements over the CRAC2 code.2 ° However, the fundamental physics models that form the basis for both the CRAC2 and MACCS2 codes have not changed in the past two decades. Nor has evidence arisen since the CRAC2 Report was issued that would suggest that the CRAC2 'ource term" --- that is, the fraction of the radioactive contents of the reactor core assumed to be released to the environment during a severe accident --- significantly overestimated potential releases.
On the contrary, the Chernobyl disaster in 1986 demonstrated that such large releases were possible.2" The state-of-the art revised source term developed by NRC, as defined in the NRC report NUREG- 1465, 'Accident Source Terms for Light -Water Nuclear Power Plants," is little different from the source terms used in the CRAC2 Report. 2 Recent experimental work, including the Phrbus tests in France, have provided further confirmation of the NUREG-1465 source term. 23 Other tests, such as the VERCORS experiments in France, have found that NUREG- 1465 actually underestimates the releases of some significant radionuclides.
The NRC continues to stress the absence of consideration of accident probabilities in dismissing the results of the CRAC2 Report. However, this criticism is invalid in the post-9/11 era. Accident probabilities are not relevant for scenarios that are intentionally caused by sabotage. Severe releases resulting from the simultaneous failure of multiple safety systems, while very unlikely if left up to chance, are precisely the outcomes sought by terrorists seeking to maximize the impact of their attack. Thus the most unlikely accident sequences may well be the most likely sabotage sequences.
20 D.I. Chanin and M.L. Young, Code Manualfor MACCS2: Volume 1, User's Guide, SAND97-0594, Sandia National Laboratories, March 1997.
2 The nuclear industry often argues that a Chernobyl-type accident could not happen in the United States because the reactor was of a different and inferior type to US plants and lacked a robust containment structure. While it is true that the specific accident sequence that led to the destruction of the Chernobyl-4 reactor and the resulting radiological release was characteristic of graphite-moderated reactors like Chernobyl and would not likely occur at a US light-water reactor (LWR), it is simply false to claim that there are no possible accident sequences that could result in consequences similar to those of Chernobyl ---
namely, core melt, loss or bypass of containment, and large radiological release to the environment. In fact, because such an event is not as likely to be as energetic as the Chernobyl explosion, and the plume is not likely to be as hot as the Chernobyl plume (which was fed by the burning of a large mass of graphite),
the radiological release from a severe accident at a US LWR will not rise as high or disperse as far.
Therefore, radiological exposure to the public near a US LWR could be far greater than was the case at Chernobyl, because the plume would be more concentrated closer to the plant.
22 L. Soffer, et al., Accident Source Terms for Light-Water Nuclear Power Plants, FinalReport, NUREG-1465, US NRC, February 1995.
23 US NRC, Memorandum from Ashok Thadani to Samuel J. Collins, 'Use of Results from Ph6bus -FP Tests to Validate Severe Accident Codes and the NRC's Revised Accident Source Term (NUREG-1465),"
Research Information Letter RIL-0004, August 21, 2000.
16
Other aspects that add an element of randomness to accident scenarios, such as meteorological conditions, can also be controlled through the advance planning and timing of a terrorist attack. Therefore, even if NRC were correct in claiming that the CRAC2 Report assumes the 'Vnost adverse condition" for each accident -related parameter, such an approach would still be appropriate for analyzing the potential maximum consequences of a sophisticated terrorist attack.
We have not been able to identify any issues that would suggest the consequence estimates provided in the CRAC2 Report were significantly overstated. But in light of the problems with the CRAC2 Report discussed earlier, we have conducted our own analysis of the consequences of a sophisticated terrorist attack at the Indian Point plant, using the MACCS2 code and the most up-to-date information available. This included the NUREG-1465 revised source term, the most current dose conversion and cancer risk coefficients recommended by the International Commission on Radiological Protection (ICRP), and the most recent evacuation time estimate (ETE) for Indian Point developed by consultants for Entergy Nuclear, the plant operator. We used the SECPOP2000 code, developed for NRC by Sandia National Laboratories, to generate a high-resolution MACCS2 site data file that includes a regional population distribution based on 2000 Census data and an economic data distribution based on 1997 government statistics.
For Indian Point, we find that the MACCS2 results for peak early fatalities are generally consistent with the CRAC2 Report, but that the CRAC2 Report significantly underestimates the peak number of latent cancer fatalities that could occur.
Moreover, the consequence estimates in this report are based on a number of optimistic assumptions, or 'tonservatisms," that tend to underes timate the true consequences of a terrorist attack at Indian Point. For example:
- 1. We use an evacuation time estimate that assumes the attack takes place in the summer in good weather, and does not take into account the possibility that terrorists may time their attack when evacuation is more difficult or actively interfere with the evacuation.
- 2. We only consider the permanent resident population of the 10-mile plume exposure EPZ, and not the daily transient population, which would increase the total population of the EPZ by about 25%.
- 3. We use values for the rated power of the Indian Point reactors from 2002 that are about 5% lower than the current values.
- 4. The only health consequences we consider are early fatalities from acute radiation syndrome and latent fatalities from cancer. We do not assess the excess mortality associated with the occurrence of other well-documented health effects of radiation such as cardiovascular disease. We also do not consider non-fatal effects of radiation, such as the reduction in intelligence quotient (IQ) of children irradiated in utero or other birth defects.
17
- 5. The NUREG- 1465 source term does not represent the maximum possible radiological release from a core melt. Also, the assumed delay time between the attack and the start of the radiological release is nearly two hours, which is not nearly as short as the minimum of 30 minutes that is contemplated in NRC's emergency planning regulations.
- 6. The calculations assume only that the reactors itself are attacked and that the large quantity of spent fuel in the wet storage pools remains undamaged.
In the following sections, we discuss some technical issues related to severe accident and sabotage phenomena. Then we describe the methodology, tools and input parameters used to carry out the calculation. Finally, we present our results and conclusions.
18
ACCIDENTS: DESIGN-BASIS, BEYOND-DESIGN-BASIS, AND DELIBERATE The NRC has traditionally grouped nuclear reactor accidents into two main categories:
'ttesign -basis" accidents, and 'beyond -design-basis" or 'ýevere" accidents.
(a) Design-basis accidents Design-basis accidents are accidents that nuclear plants must be able to withstand without experiencing unacceptable damage or resulting in radiological releases that exceed the regulatory limits known as 'Part 100" releases (because of where they can be found in the NRC regulations).
One of the more challenging design-basis accidents for pressurized-water reactors (PWRs) like those at Indian Point is a loss-of-coolant accident (LOCA). In the 'primary" system of a PWR, the reactor core, which is contained in a steel vessel, is directly cooled by the flow of high-pressure water forced through pipes. In a LOCA, a pipe break or other breach of the primary system results in a loss of the water essential for removing heat from the reactor fuel elements. Even if the nuclear reactor is immediately shut down or 'crammed," an enormous quantity of heat is still present in the fuel, and cooling water must be restored before a significant number of fuel elements reach temperatures above a critical limit. If heated beyond this limit, the fuel element cladding can become brittle and shatter upon contact with cooling water. Eventually, the core geometry can become "uncoolable" and the fuel pellets themselves will reach temperatures at which they start to melt.
In a design-basis LOCA, it is assumed that the emergency core cooling system (ECCS) works as designed to provide makeup coolant water to the nuclear fuel, terminating the event before it becomes impossible to control. Even in this case, however, a significant fraction of the radioactive inventory in the core could be released into the coolant and transported out of the primary system through the pipe break. The primary system therefore must be enclosed in a leak-tight containment building to ensure that Part 100 limits are not exceeded in the event of a design-basis LOCA. To demonstrate compliance with Part 100, dose calculations at the site boundary are carried out by specifying a so-called tource term" --- the radioactive contents of the gases within the containment following the LOCA -- : and assuming that the containment building leaks at its maximum design leak rate, typically about 0.1% per day. Such an event was historically considered a 'fnaximum credible accident."
(b) Beyond-design-basis accidents In contrast to design-basis accidents, 'beyond -design-basis" accidents (also known as
'ýevere" accidents) are thos e in which multiple failures occur, backup safety systems do not work as designed, the core experiences a total 'hieltdown" and radiological releases far greater than the Part 100 limits become possible. For example, if the ECCS does not work properly after a LOCA, the core will continue to overheat, eventually forming a 19
molten mass that will breach the bottom of the steel reactor vessel and drop onto the containment floor. It will then react violently with any water that is present and with concrete and other materials in the containment. At this point, there is little hope that the event can be terminated before much of the radioactive material within the fuel is released in the form of gases and aerosols into the containment building.
Even worse is the potential for mechanisms such as steam or hydrogen explosions to rupture the containment building, releasing its radioactive contents into the environment.
Although not the only distinguishing feature, a major distinction between design-basis and severe accidents is whether containment integrity is maintained. Even a small rupture in the containment building --- no more than a foot in diameter --- would be sufficient to depressurize it and to vent the gases and aerosols it contains into the environment in less than half an hour.24 This would result in a catastrophic release of radioactivity on the scale of Chernobyl, and Part 100 radiation exposure limits would be greatly exceeded.
The containment building can also be 'bypassed" if there is a ru pture in one of the interfaces between the primary coolant system and other systems that are outside of containment, such as the 'Uecondary" coolant system (the fluid that drives the turbine generators) or the low-pressure safety injection system. For instance, the rupture in the steam generator that occurred at Indian Point 2 in February 2000 created a pathway in which radioactive steam from the primary system was able to pass into the secondary system, which is not enclosed in a leak-tight boundary. If that event had coincided with significant fuel damage, the radiological release to the environment could have been far greater.
NRC has always had an uncomfortable relationship with beyond-design-basis accidents.
By their very definition, they are accidents that were not considered in the original design basis for the plant. In fact, according to NRC, 'the technical basis for containment design was intended to ensure very low leakage under postulated loss-of-coolant accidents. No explicit consideration was given to performance under severe accidents.'2 Indeed, NRC has never instituted a formal regulatory requirement that severe accidents be prevented. In 1985, the Commission ruled by fiat in its Severe Accident Policy Statement that 'bxisting plants pose no undue risk to health and safety" and that no regulatory changes were required to reduce severe accident risk. NRC's basic assumption is that if a plant meets design basis requirements, then it will have sufficient resistance against severe accidents, and it has devoted considerable resources to the task of 'tbonfirmatory research" to justify this assumption. NRC believes that this approach provides '"dequate protection" of public health and safety because the probability of a 24 US Nuclear Regulatory Commission, Preliminar.Assessment of Core Melt Accidents at the Zion and Indian Point Nuclear Power Plants and Strategiesfor Mitigating Their Effects, Analysis of Containment Building FailureModes, PreliminaryReport, NUREG-0850, Vol. 1, November 1981, p. 3-2.
25 US Nuclear Regulatory Commission, Reactor Risk Reference Document (Appendices J-O), NUREG- 1150, Draft for Comment, February 1987, p. J. 10-1.
20
severe accident capable of rupturing or bypassing the containment prior to effective 26 evacuation of the EPZ is so low in most cases as to be below regulatory concern.
(c) "Deliberate accidents" It is true that a spontaneous occurrence of the multiple system failures necessary to cause a severe accident and large radiological release is typically a very improbable event.
However, if one considers the possibility of sabotage or 'tieliberate" accidents, the low -
probability argument that NRC uses to justify the continued operation of nuclear plants completely breaks down. Terrorists with basic and readily available knowledge of how nuclear plants operate can design their attack to maximize the chance of achieving a core melt and large radiological release. With modest inside assistance, as contemplated by NRC in its regulations and practices, saboteurs would be able to identify a plant-specific set of components known as a 'target set." If all elements of a target set are disabled or destroyed, significant core damage would result. Thus, by deliberately disrupting all redundant safety systems, saboteurs can cause a severe event that would have had only a very low probability of occurrence if left to chance.
The likelihood of a successful attack is enhanced for plants with 'to mmon-cause" failure modes. A common-cause failure is a single event that can lead to the failure of multiple redundant systems. For example, if the diesel fuel supplied to a nuclear plant with two independent emergency diesel generators from the same distributor is impure, then both generators may fail to start for the same reason if off-site power is lost and emergency power is needed. This would result in a station blackout, one of the most serious challenges to pressurized-water reactors like Indian Point. While some common-cause failure modes can be corrected, others are intrinsic to the design of currently operating nuclear plants. Common-cause failure modes make the saboteurs'job easier, as fewer targets would have to be disabled to achieve the desired goal.
In addition to causing a core meltdown, terrorists also have the means to ensure that the radioactive materials released from the melting fuel can escape into the environment by breaching, severely weakening or bypassing the containment. 27 Finally, saboteurs can maximize the harm caused by a radiological release by staging their attack when the meteorological conditions favor a significant dispersal over densely populated areas, and even interfering with the execution of emergency plans.
NRC has formally maintained for at least two decades that it does not make sense28to assign probabilities to terrorist attacks. In a 2002 memorandum, NRC stated that
'the horrors of September 11 notwithstanding, it remains true that the likelihood of a terrorist attack being directed at a particular nuclear facility is not 26 There have been situations where NRC concluded that '%dequate protection" was not met at certain nuclear plants and required additional safety measures. However, such instances are rare.
27 We have decided not to describe such means in greater detail, although we have little doubt that terrorists are already familiar with them.
28 US NRC, Memorandum and Order, CLI-02-025, December 18, 2002, p. 17.
21
quantifiable. Any attempt at quantification or even qualitative assessment would be highly speculative. In fact, the likelihood of attack cannot be ascertained with confidence by any state-of-the-art methodology ... we have no way to calculate the probability portion of the [risk] equation, except in such general terms as to be nearly meaningless."
Yet at other times, NRC does not hesitate to invoke probabilities when arguing that the public has nothing to fear from terrorist attacks on nuclear plants. For example, here is what NRC has to say about the 2 9 CRAC2 study in its recent 'point paper" on homeland protection and preparedness:
'Over the years, the NRC has performed a number of con sequence evaluations to address regulatory issues ... We have considered the extent to which past analyses, often the subject of public statements by advocacy groups and the media, can be superceded [sic] by more recent analysis ... Past studies usually have c onsidered
... a number of scenarios, which resulted in only minor consequences. The most limiting severe scenarios, which comprise a minority of the calculations and represent very low probability events [emphasis added], are the predictions typically cited in press accounts. These scenarios have assumed ... very large radiation releases, bounding emergency response assumptions or bounding conditions (including weather) for the spread of the radiation. The combination of these factors produces large and highly unlikely results."
These two excerpts are inconsistent. If it is meaningless to quantify the likelihood of a terrorist attack, then one cannot dismiss the possibility of terrorist attacks causing the most severe consequences by claiming they are 'high ly unlikely." Therefore, in order to base emergency planning on the best possible information, NRC must accept the fact that the growing threat of domestic terrorism has forever altered the delicate risk calculus that underlies its approach to safety regulation. NRC can no longer shy away from confronting the worst-case consequences of terrorist attacks on nuclear power plants.
And perhaps the most attractive target in the country, where the consequences are likely to be the greatest, is Indian Point.
29 US NRC, 'Point Paper on Current Homeland Protection and Preparedness Issues" (2003), op cit.
22
THE HEALTH CONSEQUENCES OF A RADIOLOGICAL RELEASE FROM INDIAN POINT The Indian Point power plant is located on 239 acres on the Hudson River in the village of Buchanan in Westchester County, New York. There are two operating pressurized-water reactors (PWRs) on site, Indian Point 2, rated at 971 MWe, and Indian Point 3, rated at 984 MWe. Both reactors are operated by Entergy Nuclear.
Indian Point is located in one of the most densely populated metropolitan areas in the United States, situated about 24 miles from the New York City limits and 35 miles from midtown Manhattan. Extrapolating from 2000 Census data, in 2003 over 305,000 persons resided within the roughly ten-mile radius plume exposure emergency planning zone for Indian Point, and over 17 million lived within 50 miles of the site.:3 The types of injury that may occur following a catastrophic release of radioactive material resulting from a terrorist attack at Indian Point fall into two broad categories.
The first category, 'barly" injuries and fatalities, are those that are caused by short-term whole-body exposures to doses of radiation high enough to cause cell death. Early injuries include the constellation of symptoms known as acute radiation syndrome that should be familiar to anyone who has read Hiroshimaby John Hersey --- gastrointestinal disturbance, epilation (hair loss) and bone marrow damage. Other early injuries include severe skin damage, cataracts and sterility. For sufficiently high doses, early fatalities ---
death within days or weeks --- can occur. These so-called 'tHeterministic" effects are induced only when levels of radiation exposure exceed certain thresholds.
Another class of injury caused by ionizing radiation exposure is genetic damage that is insufficient to cause cell death. At doses below the thresholds for deterministic effects, radiation may cause damage to DNA that interferes with the normal process of cell reproduction. This damage can eventually lead to cancer, which may not appear for years or even decades, depending on the type. Because a single radiation-induced DNA lesion is believed to be capable of progressing to cancer, there is no threshold for these so-called
'ýtochastic" effects. 31 The clinical response of individuals to ionizing radiation exposure is highly variable from person to person. Some individuals have a lower capability of DNA repair and thus are more susceptible to the carcinogenic effects of radiation --- a condition that is most severe in people with certain genetic diseases like ataxia telangiectasia. Children are particularly vulnerable to radiation exposure. For the same degree of exposure to a 30 A figure of 20 million people within 50 miles of Indian Point has often been quoted. This value may have been obtained by summing the populations of all counties that are either totally or partially within the 50-mile zone.
31A small but vocal group of pro-nuclear activists continue to maintain, in the face of overwhelming scientific evidence to the contrary, that a threshold dose exists below which ionizing radiation may have no effect or even may provide health benefits. However, there is a growing body of experimental data that indicates that low-dose radiation may actually be a more potent carcinogen than high-dose radiation because of low-dose 'bystander effects."
23
radioactive plume, children will receive a greater absorbed dose than adults because of their lower body weight and higher respiration rate, even though their lung capacity is smaller. And because children and fetuses have much higher growth rates than adults, the same radiation dose has a greater chance of causing cancer in children and fetuses than in adults.
Exposure to low-dose ionizing radiation has also been associated with excess mortality from diseases other than cancer, such as cardiovascular disease, possibly as a result of radiation-induced inflammation. There is growing evidence that the effect of low-dose radiation exposure on mortality from diseases other than cancer may be as great as its effect on mortality from cancer, 32 implying that current, cancer-based risk estimates may be too low by a factor of two.
A radiological release from a nuclear plant accident would consist of many different types of radioactive materials. Some isotopes, such as cesium- 137, emit penetrating gamma rays and can cause radiation injury from outside of the body. Other isotopes do not emit radiation that can penetrate skin but are most dangerous when inhaled or ingested, where they can concentrate in internal organs and deliver high doses to surrounding tissue. Iodine- 131, which concentrates in the thyroid gland, and strontium-90, which concentrates in teeth and bones, are in this category. Some isotopes have short half-lives and do not persist in the environment, while others are long-lived and can result in long-term contamination.
NRC requires that evacuation planning in the event of a radiological emergency take place only within the so-called 'ýlume exposure" emergency planning zone (EPZ), a roughly circular area with a radius of approximately ten miles. The choice of this distance was based in part on NRC analyses indicating that in the event of a severe accident, dose rates high enough to cause early fatalities from acute radiation syndrome would be confined to a region within about ten miles of the release point. However, dose rates outside of this region, although on average not high enough to cause early fatalities, could be high enough to result in a significant risk of cancer unless effective protective measures are taken. NRC's emergency planning regulations were never designed to limit such exposures in the event of the 'Worst core melt sequences," for which th e protection goal is that 'Immediate life threatening doses would generally not occur outside the 33 zone."
Thus the current emergency planning basis is not now, and never was, intended to protect the public from significant but not immediately lethal exposures in the event of the
'Worst core melt sequences," such as those that could result from a well -planned terrorist attack. It should therefore be no surprise that NRC's emergency planning procedures 32 A. MacLachlan, 'UNSCEAR Probes Low -Dose Radiation Link to Non-Cancer Death Rate," Nucleonics Week, June 17, 2004.
33 US NRC, Criteriafor Preparationand Evaluation of Radiological Emnergency Response Plans and Preparednessin Support of NuclearPlants, NUREG-0654, 1980, p. 12.
24
would not protect individuals either inside or outside the EPZ from such exposures in the event of an attack.
The proximity of Indian Point to New York City, its populous suburbs and its watershed.
given the potential hazard it represents, has long been an issue of concern and controversy. Following the Three Mile Island accident in March 1979, the Union of Concerned Scientists (UCS) unsuccessfully petitioned the NRC to suspend operations at Indian Point, in part because of its location in a densely populated area. At the same time, the NRC formed two task forces to examine the risks posed by Indian Point and the Zion plant near Chicago 'because of the high population densities surrounding those units" and initiated a formal adjudication, the Indian Point Special Proceeding, to review the 34 issues raised in the UCS petition and others.
During the Special Proceeding, three NRC administrative judges heard testimony regarding the potential impacts of a severe accident at Indian Point on New York City residents. For instance, the director of New York City's Bureau of Radiation Control testified that potassium iodide (KI), which can block the uptake of radioactive iodine by the thyroid if taken near the time of exposure, should be stockpiled for 'possible immediate use in New York City," at a time when NRC did not recommend that KI be provided even for residents of the 10-mile EPZ.
The administrative judges reached some disturbing conclusions in the proceeding. They stated that 'lander certain meteorological conditions, delayed fatalities from cancer appear to be possible almost anywhere in the city" and that 'h severe release at Indian Point could have more serious consequences than that same release at virtually any other site licensed by the Commission." And they urged the Commission 'to give seri ous consideration to the potential costs to society of dangerous, low probability accidents.
Such accidents could, as Staff testimony has shown, result in fatalities that number in the hundreds or thousands."
The Commission appears to have essentially forgotten these conclusions. Many of the technical issues resolved during the course of the Special Proceeding are being debated all over again today.
34 US NRC, Indian Point Special Proceeding, 1983, p. 5.
25
THE MACCS2 CODE MACCS2 is a computer code that was developed by Sandia National Laboratories under NRC sponsorship as a successor to CRAC2. It is designed to estimate the health, environmental and economic consequences of radiation dispersal accidents, and is widely used by NRC and DOE for various safety applications. It utilizes a standard straight-line Gaussian plume model to estimate the atmospheric dispersion of a point release of radionuclides, consisting of up to four distinct plumes, and well-established models to predict the deposition of radioactive particles on the ground from both gravitational settling ('dry deposition') and precipitation ('Wet deposition'). 36 From the dispersion and deposition patterns, the code can then estimate the radiation doses to individuals as a result of external and inhalation .exposures to the radioactive plume and to external radiation from radionuclides deposited on the ground ('groundshine'). The code also has the capability to model long-term exposures resulting from groundshine, food contamination, water contamination and inhalation of resuspended radioactive dust.
The code also can evaluate the impact of various protective actions on the health and environmental consequences of the release, including evacuation, sheltering and, in the long term, remediation or condemnation of contaminated areas. Most parameters, such as the average evacuation speed, decontamination costs, and the dose criteria for temporary relocation and long-term habitation, can be specified by the user.
MACCS2 requires a large number of user-specified input parameters. A given release is characterized by a '§ource term," which is defined by its radionuclide content, duration and heat content, among other factors. The shape of the Gaussian plume is determined by the wind speed, the release duration, the atmospheric stability (Pasquill) class and the height of the mixing layer at the time of the release.
MACCS2 requires the user to supply population and meteorological data, which can range from a uniform population density to a site-specific population distribution on a high-resolution polar grid. The meteorological data can range from constant weather conditions to a 120-hour weather sequence. The code can process up to 8760 weather sequences --- a year's worth --- and generate a frequency distribution of the results.
The code allows the user to define the dose-response models for early fatalities (EFs) and latent cancer fatalities (LCFs). We use the MACCS2 default models. For EFs, MACCS2 uses a 2-parameter hazard function, with a default LD5 0 dose (the dose associated with a 50% chance of death) of 380 rem. LCFs, MACCS2 uses the standard linear, no-threshold model, with a dose-response coefficient of 0.1 LCF/person-Sievert and a dose-dependent reduction factor of 2, per the 1991 recommendations of the International Committee on 35 Chanin and Young (1997), op cit.
36 Much of the following section is based on a recent comprehensive review of MACCS2 by the Department of Energy, which we would recommend to readers interested in a more in-depth discussion of the capabilities and limitations of the code. See Office of Environment, Safety and Health, U.S.
Department of Energy, MACCS2 Computer Code Application Guidancefor Documented Safely Analysis:
Interim Report, DOE-EH-4.2.1.4-Interim-MACCS2, September 2003.
26
Radiological Protection (ICRP) in ICRP 60. The corresponding coefficients used in the CRAC2 model, based on now-antiquated estimates, were lower by a factor of 4.
For the calculation of the committed effective dose equivalent (CEDE) resulting from inhalation and ingestion of radionuclides, we have replaced the default MACCS2 input file with one based on the more recent dose conversion factors in ICRP 72.38 We have shown previously that this substitution reduces the projected number of latent cancer fatalities from a severe nuclear reactor accident by about one-third.39 (The default MACCS2 file incorporates EPA guidance based on ICRP 30, which although out of date continues to be the basis for regulatory analyses in the United States.)
When using MACCS2 several years ago, we discovered an error that resulted in an overcounting of latent cancer fatalities in the case of very large releases. After pointing this out to the code manager, SNL sent us a revised version of the code with the error corrected, which we have used for the analysis in this report.
Like most radiological consequence codes in common use, MACCS2 has a number of limitations. First of all, because it incorporates a Gaussian plume model, the speed and direction of the plume are determined by the initial wind speed and direction at the time of release, and cannot change in response to changing atmospheric conditions (either in time or in space). Consequently, the code becomes less reliable when predicting dispersion patterns over long distances and long time periods, given the increasing likelihood of wind shifts. Also, the Gaussian plume model does not take into account terrain effects, which can have a highly complex impact on wind field patterns and plume dispersion. And finally, MACCS2 cannot be used for estimating dispersion less than 100 meters from the source.
However, MACCS2 is adequate for the purpose of this report, which is to develop order-of-magnitude estimates of the radiological consequences of a catastrophic attack at Indian Point for residents of New York City and the entire New York metropolitan area, and to assess the impact of different protective actions on these consequences. We restrict our evaluations to a circular area with a radius of 50 miles centered on Indian Point, except for the calculation of long-term doses and economic impacts, which we assess out to 100 miles.
In the next section, we discuss the basis for the MACCS2 input parameters that we use in our evaluation.
37 MACCS2 does not allow the user to specify different dose-response models for different radionuclides.
We use a model with a dose-dependent reduction factor of 2, even though this assumption likely underestimates the carcinogenic potential of alpha-emitters, which is not reduced in effectiveness at low doses or dose rates.
38 International Commission on Radiological Protection (ICRP), Age-Dependent Doses to Members of the Publicfrom Intake of Radionuclides: Part 5, Compilation of lngestion and Inhalation Dose Coefficients, ICRP Publication 72, Pergamon Press, Oxford, 1996.
39 E. Lyman, 'Public Health Risks of Substituting Mixed -Oxide for Uranium Fuel in Pressurized-Water Reactors," Science and Global Security 9 (2001), pgs. 33-79. See Footnote 48.
27
THE SABOTAGE SCENARIO The scenario that we analyze is based on the so-called '-evised source term" that NRC defined in 1995 in NUREG-1465. The revised source term was developed as a more realistic characterization of the magnitude and timing of radionuclide releases during a core-melt accident than the source term originally specified for use in Part 100 siting analyses. In its entirety, the PWR revised source term presented in NUREG-1465 corresponds to a severe accident in which the primary coolant system is depressurized early in the accident sequence. An example is a 'large break loss -of-coolant accident" (LBLOCA), in which primary coolant is rapidly lost and the low-pressure safety injection system fails to operate properly, resulting in core melt and vessel failure. This scenario is one of the most severe events that can occur at PWRs like Indian Point, and could result in a relatively rapid release of radioactivity.
(a) The source term A severe accident of this type would progress through four distinct phases. As the water level in the core decreases and the fuel becomes uncovered, the zirconium cladding tubes encasing the fuel rods overheat, swell, oxidize and rupture. When that occurs, radionuclides that have accumulated in the 'gap" between the fuel a nd the cladding will be released into the reactor coolant system. If there is a break in the reactor coolant system (as would be the case in a LBLOCA), then these radionuclides would be released into the atmosphere of the containment building. These so-called 'tap" releases consist of the more volatile radionuclides contained in irradiated fuel, such as isotopes of krypton, xenon, iodine and cesium. This period is known as the 'tgap release" phase, and is predicted to last about 30 minutes. The oxidation of the zirconium cladding by water also generates hydrogen, which is a flammable gas.
As the core continues to heat up, the ceramic fuel pellets themselves begin to melt, releasing greater quantities of radionuclides into the reactor vessel and through the breach in the reactor coolant system into the containment building atmosphere. The molten fuel mass then collapses and drops to the bottom of the reactor vessel, where it aggressively attacks the steel, melts through the bottom and spills onto the floor of the containment 40 building. The period between the start of fuel melting and breach of the reactor vessel is known as the 'barly in -vessel" phase, and typically would last about an hour.
When the molten fuel breaches the reactor vessel and drops to the containment building floor, it violently reacts with any water that has accumulated in the cavity and with the concrete floor itself. This 'tore -concrete interaction" causes further releases of radionuclides from the molten fuel into the containment building. This period is known as the 'bx -vessel" phase, and would last for several hours.
40 This scenario is not theoretical. During the 1979 accident at Three Mile Island Unit 2, part of the melted core relocated to the bottom of the reactor vessel where it began melting through the steel. The re-introduction of forced cooling water flow terminated this sequence before vessel failure.
28
At the same time, some portion of the molten core may remain in the reactor vessel, where it would continue to degrade in the presence of air and release radionuclides. Also, radionuclides released during the in-vessel phase that deposit on structures within the primary coolant system may be re-released into the containment building. These releases take place during the 'late in -vessel" phase and could continue for many hours.
At the time when the molten core falls to the floor of the reactor vessel, steam explosions may occur that could blow apart the reactor vessel, creating high-velocity 'tnissiles" that could rupture the containment building and violently expel the radioactive gases and aerosols it contains into the environment. This would result in a shorter in-vessel phase.
If the vessel remains intact until melt-through, hydrogen or steam explosions are also possible when the molten fuel spills onto the concrete below the vessel, providing another opportunity for containment failure.
The complete revised source term (all four phases) is a general characterization of a low-pressure severe accident sequence, such as a large-break loss of coolant accident with failure of emergency core cooling systems. According to the timing of the accident phases in the revised source term, the 'gap release" phase would begin within a few minutes after the initiation of the event and lasts for 30 minutes. At that time, the early in-vessel phase begins as the fuel pellets start to melt. This phase is assumed to last for 1.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, and ends when the vessel is breached.
In our scenario, we assume that the attackers have weakened but not fully breached the containment, so that there is a high probability that the containment building will be ruptured by a steam or hydrogen explosion at the time of vessel breach. This results in a rapid purge of the radionuclide content of the containment building atmosphere into the environment, followed by a longer-duration release due to core-concrete interactions and late in-vessel releases.
We do not wish to discuss in detail how saboteurs could initiate this type of accident sequence. However, since NRC asserts that even in a terrorist attack these events are unlikely to occur, we need to present some evidence of the plausibility of these scenarios.
One such scenario would involve a 9/11-type jet aircraft attack on the containment building, possibly accompanied by a ground attack on the on-site emergency power supplies. (One must also assume that interruption of off-site power takes place during an attack, given that off-site power lines are not under the control of the licensee and are not protected.)
The Nuclear Energy Institute (NEI) issued a press release in 2002 describing some of the conclusions of a study conducted by the Electric Power Research Institute (EPRI) that purported to show that penetration of a PWR containment by a jet aircraft attack was impossible. A study participant later acknowledged that (1) the justification for limiting the impact speed to 350 mph was based on pilot interviews and not on the results of simulator testing, and (2) even at 350 mph, their analysis actually found that the 42-inch 29
thick reinforced concrete containment dome of a PWR suffered 'gubstantial damage" and the steel liner was deformed. 4' However, even if penetration of the containment does not occur, the vibrations induced by the impact could well disrupt the supports of the coolant pumps or the steam generators, causing a LBLOCA. The emergency core cooling system pumps, which require electrical power, would not be available under blackout conditions caused by the disabling of both off-site and on-site power supplies. Thus makeup coolant would not be provided, the core would rapidly become uncovered and the NUREG-1465 sequence would begin. Other engineered safety features such as containment sprays and recirculation cooling would not be available in the absence of electrical power. The damaged containment building would then be far less resistant to the pressure pulse caused by a steam spike or hydrogen explosion, and would have a much higher probability of rupture at vessel breach. We note that the steel liner of a reinforced concrete containment structure like that at Indian Point only carries 10 to 20% of the internal pressure load, and therefore may fail well before the design containment failure pressure is reached if the concrete shell is damaged.
Because the emergency diesel generators are themselves quite sensitive to vibration, a ground assault may not even be necessary to disable them, since the aircraft impact itself.,
followed by a fuel-air explosion, could cause them to fail.
One can find support for the credibility of this scenario in the recently leaked summary of a report prepared for the German Environment Ministry by the nuclear safety consultant GRS on the vulnerability of German nuclear reactors to aircraft attacks. 42 In the summary, GRS defined a series of credible damage scenarios and then determined whether or not the resulting accident sequence would be controllable The report considered an attack on the Biblis B PWR by a small jet (Airbus A320) or medium-sized jet (Airbus A300) travelling at speeds from 225 to 394 miles per hour, where the peak speed of 394 mph was determined through the use of simulators. GRS concluded that for an event in which the jet did not penetrate the containment, but the resulting vibrations caused a primary coolant leak, and the control room was destroyed by debris and fire (a condition similar to a station blackout), then control of the sequence of events would be 'tincertain." 43 Biblis B was designed for protection against the crash of a 1960s-era Starfighter jet and as a result is equipped, like most German reactors, with a double containment. In contrast, Indian Point 2 and 3, while of the same 1970s vintage as Biblis B, were not designed to be resistant to airplane crashes, and do not have double containments.
4 R. Nickell, 'Nuclear Plant Structures: Resistance to Aircraft Impact,"44 1h Annual Meeting of the Institute of Nuclear Materials Management, Phoenix, AZ, July 13-17, 2003.
42 Mark Hibbs, 'Utilities Expect Showdown with Trittin over Air Te rror Threat," Nucleonics Week 45, February 12, 2004.
43 Gesellschaft fiur Anlagen und Reaktorsicherheit, Schutz der deutschen Kernkraftwerke vor deml Hintergrundder terroristischenAnschlage in den USA vomn 11. September 2001, (Protectionof German Nuclear Power Plants in the Context of the September 11, 2001 TerroristAttacks in the US), November 27, 2002.
30
The NUREG- 1465 revised source term is shown in Table 1. The source term is characterized by grouping together fission products with similar chemical properties and for each group specifying a '-elease fraction"; that is, the fraction of the core radionuclide inventory released from the damaged fuel into the containment building atmosphere. Noble gases include krypton (Kr); halogens include iodine (I); alkali metals include cesium (Cs); noble metals include ruthenium (Ru); the cerium (Ce) group includes actinides such as plutonium (Pu) and the lanthanide (La) group includes actinides such as curium (Cm).
TABLE 1: NUREG-1465 radionuclide releases into containment for PWRs Gap Early In-Vessel Ex-Vessel Late In-Vessel Duration (hrs) 0.5 1.3 2.0 10.0 Release fractions (%):
Noble Gases (Kr) 0.05 0.95 0 0 Halogens (I) 0.05 0.35 0.25 0.1 Alkali Metals (Cs) 0.05 0.25 0.35 0.1 Tellurium group (Te) 0 0.05 0.25 0.005 Barium, Strontium (Ba, Sr) 0 0.02 0.1 0 Noble Metals (Ru) 0 0.0025 0.0025 0 Cerium group (Ce) 0 0.0005 0.005 0 Lanthanides (La) 0 0.0002 0.005 0 It is important to note that NUREG- 1465 is not intended to be a 'vorst -case" source term.
The accompanying guidance specifically states that 'it is emphasized that the release fractions for the source terms presented in this report are intended to be representative or typical, rather than conservative or bounding values.. ' 44 In fact, the release fractions for tellurium, the cerium group and the lanthanides were significantly lowered in response to industry comments. Upper-bound estimates, which are provided in a table in the back of NUREG- 1465, indicate that 'Virtually all the iodine and cesium could enter the containment.", 45 And experimental evidence obtained since NUREG-1465 was published in 1995 suggests that the tellurium, ruthenium, cerium and lanthanide release fractions in the revised source term may significantly underestimate actual releases of these radionuclide groups.46 Thus our use of the NUREG-1465 source term is far from the worst possible case and may underestimate the impacts of credible scenarios.
44 NUREG-1465, p. 13.
15 NUREG- 1465, p. 17.
46 Energy Research, Inc., Expert Panel Report on Source Terms for High-Bumup and MOX Fuels, 2002.
31
We model this scenario in MACCS2 as a two-plume release. The first release begins at the time of vessel breach and containment failure, 1.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after initiation of the accident, and continues over a period of 200 seconds as the containment atmosphere is rapidly vented. The second plume lasts for two hours as core-concrete interactions occur. For simplicity, only the first two hours of the late in-vessel release are included; the last eight hours are omitted, although this late release would likely make a significant contribution to public exposures, given the nearly ten-hour evacuation time estimate for the 10-mile EPZ.
We further assume that the entire radionuclide inventory released from the damaged fuel into the containment atmosphere escapes into the environment through the rupture in the containment. There is little information in the literature about realistic values for the fraction of the containment inventory that is released to the environment. In NUREG-1150, NRC states that 'In some early failure cases, the [containment to environment]
transmission fraction is quite high for the entire range of uncertainty. In an early containment failure case for the Sequoyah plant ... the fractional release of radioactive material ranges from 25 percent to 90 percent of the material released from the reactor coolant system.' 4 7 A review of the default values of this fraction for the Sequoyah and Surry plants used in supporting analyses for NUREG- 1150 indicates that environmental releases ranging from 80 to 98% of the radionuclides in the containment atmosphere were typically assumed. The only case in which significant retention within the containment building occurs is when there is a delay of several hours between the initiation of core degradation and the time of containment failure, which is not the case for the scenario we are considering. Given that we are using only the first three phases of the NUREG-1465 source term, which may underestimate the maximum release of radionuclides like iodine and cesium by 35%, we believe it is reasonable to neglect the retention within the containment building of at most 20% of the radionuclide inventory.
Another plume characteristic that is very important for determining the distribution and magnitude of consequences is the heat energy that it contains. The oxidation of zirconium cladding during core degradation generates a large amount of heat in a short period of time, which can cause the plume to become buoyant and rise. Greater initial plume heights result in lower radionuclide concentrations close to the plant, but wider dispersal of the plume.
It is unlikely that a radiological release at any US PWR would produce a plume as high as the one released during the Chernobyl disaster. Because of the large mass of graphite moderator in the Chernobyl-4 reactor, a hot and long-duration graphite fire caused a very high plume that was responsible for dispersing radionuclides over vast distances.
However, at the same time, the exposure and contamination within 50 miles of the Chernobyl site was much lower than it would have been if the plume had not risen so high. This means that the cooler plume that would be characteristic of a core meltdown at Indian Point could actually be a greater threat to the New York metropolitan area than the contamination pattern resulting from the Chernobyl accident might suggest.
47 US NRC, Severe Accident Risks: An Assessment for Five Nuclear Power Plants,NUREG- 1150, Volume 2, December 1990, p. C-108.
32
Table 2 shows the two-plume source term for input into MACCS2, adapted from the NUREG-1465 source term in Table 1. The first plume consists of the containment radionuclide inventory at the time of vessel breach (the sum of the first and second columns in Table 1). The second plume consists of the releases generated by core-concrete interactions and a fraction of the late-in-vessel releases (the sum of the third column and one-fifth of the fourth column in Table 1).
TABLE 2: Source term used in MACCS2 model Plume Release Duration(hrs) Energy Kr I Cs Te Ba Ru Ce La time release (hrs) (MW) 1 1.8 0.06 2.8 1 0.4 0.3 0.05 0.02 0.0025 0.0005 0.0002 2 1.86 2 1.6 0 0.27 0.37 0.25 0.1 0.0025 0.005 0.005 The reactor core inventory used was calculated for a representative 3565 MWt PWR at the end of an equilibrium 18-month cycle using the SCALE code, and was then scaled to the Indian Point 2 power rating of 3071 MWt. Since Indian Point 2 operates on a 24-month cycle, the inventory we use here does not represent the peak inventory of the reactor core, which occurs just before refueling.
(b) Meteorology The calculation of radiological consequences from a severe accident is strongly dependent on the meteorological conditions at the time of the release and for several days afterward. Relevant factors include the wind speed, the wind direction, the atmospheric stability, the height of the mixing layer and the occurrence of precipitation.
The MACCS2 code can utilize a weather sequence of hourly data for a 120-hour period following the initial release. The user has the option to supply a file with an entire year's worth of hourly meteorological data (8760 entries), consisting of wind speed, atmospheric stability class, and precipitation. The program can then calculate up to 8760 results, each corresponding to a release beginning at a different hour of the year. For each set of weather data, MACCS2 can also generate sixteen results by rotating the plume direction into each sector of the compass, repeating the calculation for each plume direction, and then weighting the results with the fraction of the time that the wind blows in that direction (as specified by the user-supplied 'Wind rose," or set of probabilities that the wind will be blowing in a certain direction at the site). Finally, the code can tabulate the results in a frequency distribution.
48 Lyman (2001), op cit., pp. 64-66.
33
The MACCS2 code, like the CRAC2 code before it, has the option to sample a reduced number of weather sequences, based on a semi-random sampling method. The reason for employing a sampling scheme in the past was no doubt the length of computing time needed for each calculation; however, the program runs quickly on modem machines, so there is no need to employ the MACCS2 sampling scheme. In fact, a comparison of the results obtained from sampling, which utilizes about 100 weather sequences, and the results obtained from an entire year's worth of sequences, finds that the peak consequence values in the sampling distribution are 30% or more below the peak consequences over the entire year, if the plume rotation option is not utilized. Thus there is a significant sampling error for peak values associated with the MACCS2 sampling scheme (and presumably the CRAC2 sampling scheme as well).
We were unable to obtain the meteorological data for the Indian Point site needed for input into MACCS2. Instead, we used a meteorological data file for New York City, the location of the nearest National Weather Service weather monitoring station, that was supplied with the original CRAC2 code. This is the same approach that was taken in the CRAC2 Report, which was ostensibly a site-specific study of the 91 sites where nuclear reactors were located or planned, but did not use meteorological data files specific to those sites. Instead, the study used data derived from 29 National Weather Service stations that were 'thosen as a representative set of the nation's meteorological conditions."4 9 NRC later had to adopt the same approach, using the New York City meteorological data file as a surrogate for Indian Point-specific data in a CRAC2 50 benchmark exercise, because it was unable to obtain the Indian Point data.
Use of the New York City meteorological data file in lieu of Indian Point site data is a reasonable approximation for the purposes of this report. Two of the most important factors in determining the radiological consequences of a terrorist attack at Indian Point are the wind direction and the precipitation. With regard to the first factor, we use the Indian Point site wind rose to take into account the effect of the variation in wind direction.51 With regard to precipitation data, since the MACCS2 code only allows for uniform precipitation over the entire evaluation area, the precipitation data set from New York City is just as relevant as data from the Indian Point site for determining the consequences for the New York metropolitan area.
One phenomenon that we cannot fully account for without access to meteorological data specific to the Indian Point site is the coupling between wind direction and wind speed that results from the plant's 1ocation in the Hudson River Valley. Wind speeds below a threshold of below 4 meters per second tend to result in plumes that follow the course of the river valley, whereas greater wind speeds produce plumes that are free to travel in any direction and are better approximated by the straight-line Gaussian model. Our use of the 49 R. Davis, A. Hanson, V. Mubayi and H. Nourbakhsh, Reassessment of Selected Factors Affecting Siting of Nuclear Power Plants,NUREG/CR-6295, US Nuclear Regulatory Conmmission, 1997, p. 3-30.
50 US Nuclear Regulatory Commission, Generic Environmental Impact Statement for License Renewal of Nuclear Plants, NUREG-1437, Vol. 1, Sec. 5.3.3.2.3.
51James Lee Witt Associates, Review of Emergency Preparednessof Areas Adjacent to Indian Point and Millstone, March 2003, Figure 3-1, p. 21.
34
Indian Point wind rose accounts for this effect, but to the extent that the distribution of wind speeds in the meteorological data file that we use differs from that at the Indian Point site, the calculations may include some cases that involve unrealistic wind patterns.
However, any errors in the distribution resulting from this approximation are not likely to be significant in comparison to the uncertainties associated with use of the straight-line Gaussian model in MACCS2. In any event, it is likely that properly accounting for this effect would result in the channeling of a greater number of slow-moving, concentrated plumes directly downriver toward densely populated Manhattan, thereby increasing the overall radiological impact.
We have also run the calculations using the meteorological data file for the Surry site in Virginia to compare the maximum consequences obtained. We find that the values for peak early fatalities differ by less than I % and the value for peak latent cancer fatalities differs by less than 5%. We interpret this result as an indication that the peak consequences we found for Indian Point are not due to weather conditions unique to the meteorological data file for New York City.
If Entergy were willing to provide us with data from the Indian Point meteorological monitoring station, we would be pleased to use it to assess whether it would have a significant impact on our results. However, we would expect any impact to be minor.
(c) Protective actions Another crucial factor in determining the consequences associated with a terrorist attack at Indian Point is the effectiveness of the actions taken to protect individuals within the 10-mile emergency planning zone (EPZ).
The MACCS2 emergency planning model requires the user to input the time when notification is given to emergency response officials to initiate protective actions for the surrounding population; the time at which evacuation begins after notification is received; and the effective evacuation speed. Once evacuation begins, each individual then proceeds in a direction radially outward from the release point at a rate given by the effective evacuation speed.
We have assumed that the time at which the off-site alarm is sounded is coincident with the initiation of core melting; that is, 30 minutes after the attack. It is unlikely that the decision to evacuate could be made in much less time. This choice still provides an interval of 78 minutes between the sounding of the alarm and the initiation of the radiological release, consistent with earlier studies such as the CRAC2 Report.
We have assumed that the delay time between receipt of notification by the public within the EPZ and initiation of evacuation is two hours. This is the default parameter in the MACCS2 code, and is consistent both with earlier estimates of the 'hnobilization time" and with the most recent ones for the Indian Point site, which found that 100% of the 52 public within the EPZ would be mobilized to evacuate by two hours after notification.
52 James Lee Witt Associates (2003), op cit., Figure 5-6, p. 96.
35
The effective evacuation speed was obtained from the mobilization time estimate of two hours and the most recent Indian Point evacuation time estimate (ETE) for good summer weather of 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> 25 minutes. 53 Subtracting the two-hour mobilization time leaves a maximum time of 7.42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> for the actual evacuation. Since the maximum travel distance to leave the EPZ is approximately ten miles, this corresponds to an effective evacuation speed of 1.35 miles per hour, or 0.6 meters per second. The high value for the ETE and the correspondingly low effective evacuation speed reflect the severe traffic congestion within the EPZ that is projected to occur in the event that a crisis occurs at Indian Point requiring evacuation.
Outside of the 10-mile EPZ, the baseline dose calculations assume that individuals will take no protective actions. 54 Although this may not be realistic, we believe that it would be inappropriate to assume otherwise. Since NRC and FEMA do not require that any preparation for an emergency be undertaken outside of the 10-mile EPZ, it would not be conservative to assume that individuals outside of the EPZ would receive prompt notification of the event or would know what to do even if they did receive notification.
However, to examine the impact of this assumption on the results, we consider a case where the emergency evacuation zone is extended to 25 miles, and the average evacuation speed remains the same as in the 10-mile EPZ case.
(d) Population distribution In order to accurately calculate the consequences of a terrorist attack at Indian Point, it is necessary to have the correct spatial distribution of population in the vicinity of the site.
MACCS2 has the option to use a site population data file, in which the site-specific population is provided on a grid divided into sixteen angular sectors. The user can specify the lengths of sectors in the radial direction.
Most of our analysis is focused on a circular region centered on the Indian Point site with a radius of fifty miles. The ten-mile EPZ is divided into eleven regions, with divisions at the site exclusion zone (about 0.5 miles), at the one-mile point, and nine successive mile-wide intervals. The region between the EPZ and the fifty-mile limit is subdivided into ten intervals (see Figure 1, below).
Permanent resident population data for the ten-mile EPZ was obtained from the estimates for 2003 generated by KLD Associates for the Evacuation Time Estimate study that it prepared for Entergy. 55 The total number of permanent residents within a ten-mile circular zone around Indian Point in 2003, according to KLD, was 267,099. We have not included the transient population in the region in our calculations, even though it would add another 25% to the permanent population estimate, according to KLD data.
53 KLD Associates, Inc., Indian Point Energy Center Evacuation Time Estimate, Rev. 0 (2003), p. 7-8.
54 However, the calculation of doses within the EPZ does reflect the impact of 'Uhadow evacuation" of individuals outside of the EPZ, since it uses the KLD Associates evacuation time estimate for the EPZ, which assumes that shadow evacuation occurs.
55 KLD Associates, Inc. (2003), op cit., p. 3-7.
36
For the region from 10 to 100 miles from Indian Point, the MACCS2 site data file was generated with the SECPOP2000 code, which is the most recent version of the SECPOP code originally developed by the Environmental Protection Agency and later adopted by NRC for use in regulatory applications. 5 6 SECPOP2000 utilizes 2000 US Census data to estimate population distributions on a user-specified grid surrounding any location in the United States, drawing on a high-resolution database of over eight million census-blocks.
By utilizing the 2000 Census data in SECPOP2000, we have slightly underestimated the population in this region, which appears to have increased by about 1% between 2000 and 2003.
The Indian Point plume exposure EPZ is not in the shape of a perfect circle of ten-mile radius, but includes some regions that are beyond ten miles from the plant. To account for the 38,177 individuals that reside within the EPZ but outside of the 10-mile circular zone (according to KLD estimates for 2003), we used the SECPOP2000 code to determine that an 'Wffective" circular EPZ boundary of 10.68 miles would include the appropriate additional number of permanent residents, and adjusted the MACCS2 grid accordingly.
Figure 1 displays the population rosette generated by SECPOP2000 for Indian Point, out to a distance of 100 miles. The location of New York City is plainly visible on the grid.
FIGURE 1 Radial Distances in Mi Indian Point Population Scale 2.250.000 N
1.01 2.0 NNW NNE 2,100.000 2.0 3.0 1,950,000 3.0 4.
1.800.000 4.0 5.0 5.0 6.0 1,650,000 6.0 7.0 1.500.000 7.0 8.0 WNW ENE 1,350.000 8.0 9.0 9.0 10.7 1,200.000 10.7 12.5 W 1,050.000 12.5 15.0 900.000 15.0 17.5 E 17.5 201 750,000 20.0 25.0 I
600.000 25.0 30.0 A(SW, ESE 450.000 30.0 35,0 35.0 40.0 300.000 40.0 45.0 150,000 S
56 N. Bixler et al., SECPOP2000: Sector Population,Land Fraction,and Economic Estimation Program, NUREG/CR-6525, Rev. 1, Sandia National Laboratories, August 2003.
37
RESULTS In this section, we present the results of the MACCS2 simulation of a terrorist attack at IP2, as previously described.
MACCS2 generates results for two distinct periods following a radiological release. First, it calculates the doses to individuals received during the 'Emergency" phase of the event, defined as the period extending up to the first week following the release. The doses received during this period result from direct exposure to and inhalation of the plume, as well as exposure to plume particles deposited on the ground ('groundshine'). Second, it separately calculates doses received beyond the first week after the release as a result of groundshine, inhalation of resuspended particles, and consumption of contaminated food and water. The first sets of results provided below refer only to the consequences of exposures received during a one-week emergency phase. The economic and long-term health consequences are calculated based on the evaluation of chronic exposures for a period of fifty years following the release, which are dominated by groundshine.
Following the format of the CRAC2 Report summary, our calculation considers several public health and environmental endpoints, including early fatalities, latent cancer fatalities, maximum distance for early fatalities, and total economic costs. The calculations were carried out for each of the 8760 weather sequences in the New York City meteorological data file by rotating the plume direction into each of the 16 sectors of the compass, and then generating a weighted average of the results according to the Indian Point site wind rose. For each endpoint, in addition to the mean of the distribution and the peak value corresponding to the worst-case meteorological conditions encountered during the year, we present the 9 5th and 9 9 .51h percentile values of the distribution.
The results of the MACCS2 frequency distribution are based on the assumption that the radiological release would occur at random during the year, even though the timing of a terrorist attack most likely would be far from random. As we have previously discussed, one must assume that a terrorist attack intended to cause the maximum number of casualties would be timed to coincide as closely as possible with the most favorable weather conditions. In the case of Indian Point, an attack at night --- the time when a terrorist attack is most likely to be successful --- also happens to be the time when the prevailing winds are blowing toward New York City. Consequently, the mean and other statistical parameters derived from a random distribution are not characteristics of the actual distribution of consequences resulting from a terrorist attack, which would be restricted to a much more limited set of potential release times. A meteorological data set confined to the evening hours would skew the distribution in the direction of increased consequences.
In our judgment, the 9 5 th percentile values of these distributions, rather than the mean values, are reasonable representations of the likely outcome of a well-planned terrorist attack. This choice reflects the fact that the attack time will be largely of the terrorists' choosing, but that some factors will necessarily remain out of their control --- for instance, 38
the ability to accurately predict precipitation patterns, and the ability to launch an attack exactly as planned.
In the following tables, it is important to note that the peak results in each category do not correspond in general to the same weather sequence. For example, the weather conditions that lead to the maximum number of early fatalities are typically those that involve rainout and substantial deposition of the plume close to the plant, and thus are not the same conditions that lead to peak latent cancer fatalities, which involve rainout of the plume over New York City.
(a) Consequences of radiological exposures during "emergency phase" Here we consider the consequences of exposures received during the 7-day 'emergency phase." We calculate the number of 'early fatalities" (EFs) resulting from acute radiation syndrome, both for the residents of the 10-mile EPZ, who are assumed to evacuate according to the scheme described previously, and for the entire population within 50 miles of the plant. Following the CRAC2 Report, we also provide the 'early fatality distance," that is, the greatest distance from the Indian Point site at which early fatalities may occur. Finally, we provide an estimate of the number of latent cancer fatalities (LCFs) that will occur over the lifetimes of those who are exposed to doses that are not immediately life-threatening, both for residents of the EPZ and for residents of the 50-mile region.
It is important to note that these estimates are based on dose conversion factors (the radiation doses resulting from internal exposure to unit quantities of radioactive isotopes) appropriate for a uniform population of adults, and do not account for population variations such as age-specific differences. A calculation fully accounting for individual variability of response to radiation exposure is beyond the capability of the MACCS2 code and the scope of this report.
In Table 3, these results are provided for the case in which 100% evacuation of the EPZ occurs, based on the KLD evacuation time estimate and 2-hour mobilization time discussed earlier. Table 4 presents the same information for the case where the EPZ population is sheltered for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> prior to evacuation. Finally, Table 5 presents the results for the extreme case where no special precautions are taken in the EPZ.
In interpreting the results of these tables, one should keep in mind that the MACCS2 code uses different radiation shielding factors for individuals that are evacuating, sheltering or engaged in normal activity. The default MACCS2 parameters (which we adopt in this study) assume that evacuees are not shielded from the radioactive plume by structures, since they are mostly outdoors or in non-airtight vehicles during the evacuation.
Individuals who shelter themselves instead of evacuating are shielded to a considerable extent by structures, but may be exposed to higher levels of radiation overall because they remain in areas closer to the site of plume release. The MACCS2 default shielding parameters assume that sheltering reduces doses from direct plume exposure by 40% and doses from plume inhalation by 67%. The relative benefits of sheltering versus 39
evacuation are obviously quite sensitive to the values of the shielding parameters. Finally, the level of shielding for individuals engaged in 'hormal activity" falls in between the levels for evacuation and for sheltering, with reductions in doses from direct plume exposure and plume inhalation relative to evacuees of 25% and 59%, respectively.
TABLE 3: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs),
latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, 100% evacuation of EPZ Mean 9 5 th percentile 9 9 . 5th percentile Peak Consequence:
EFs, within EPZ 527 2,440 11,500 26,200 EFs, 0-50 mi. 696 3,460 16,600 43,700 EF distance (mi.) 5.3 18 24 60 LCFs, within EPZ 9,200 31,600 59,000 89,500 LCFs, 0-50 mi. 28,100 99,400 208,000 518,000 TABLE 4: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs),
latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, 24-hour sheltering in EPZ Mean 9 5 th percentile 9 9 .5h percentile Peak Consequence:
EFs, within EPZ 626 2,550 6,370 13,000 EFs, 0-50 mi. 795 3,250 10,200 38,700 EF distance (mi.) 6.2 18 24 60 LCFs, within EPZ 3,770 9,920 12,100 19,400 LCFs, 0-50 mi. 22,700 81,000 192,000 512,000 40
TABLE 5: Terrorist attack at IP 2, MACCS2 estimates of early fatalities (EFs),
latent cancer fatalities (LCFs) and the EF distance resulting from emergency phase exposures, normal activity in EPZ Mean 9 5 th percentile 9 9 .5 th percentile Peak Consequence:
EFs, within EPZ 4,050 12,600 22,300 38,500 EFs, 0-50 mi. 4,220 13,500 27,300 71,300 EF distance (mi.) 9 18 24 60 LCFs, within EPZ 4,480 10,400 12,500 20,300 LCFs, 0-50 mi. 23,400 82,600 193,000 516,000 A comparison of Tables 3 and 4 indicates that sheltering instead of evacuation results in slightly higher mean early fatalities, but substantially lower 99. 5 th percentile and peak values. A possible interpretation of this counterintuitive result is that the higher percentile early fatality results for the evacuation case correspond to rare situations in which people evacuate in such a manner as to maximize their radiation exposure (for instance, if they are unfortunate enough to be traveling directly underneath the radioactive plume at the same speed and in the same direction). These situations cannot occur for the sheltering case. Overall, sheltering does appear to substantially reduce the projected number of latent cancer fatalities within the EPZ relative to evacuation, for the default MACCS2 shielding parameters.
A comparison of Table 5 to Tables 3 and 4 indicates that either evacuation or sheltering would substantially reduce the number of early fatalities within the EPZ relative to a case where no protective actions are taken. Also, by comparing Tables 3 and 5. one sees that the number of latent cancer fatalities in the EPZ is considerably lower for the normal activity case than for the evacuation case. There are two reasons for this. First, many evacuees will receive doses that are not high enough to cause early fatalities, yet will contribute to their lifetime cancer risk. In the normal activity case, some of these individuals will receive higher doses and succumb to acute radiation syndrome instead.
Second, the MACCS2 default shielding factors give considerable protection to individuals engaged in normal activity compared to evacuees, and may not be realistic.:
The peak numbers of latent cancer fatalities for all three cases in the 50-mile zone are disturbingly high, and are more than double the number in the 9 9 .5 th percentile. But an examination of the particular weather sequence corresponding to this result indicates that 57 The protection due to shielding has a bigger impact on the number of latent cancer fatalities, which is a linear function of population dose, than on the number of early fatalities, which is a non-linear function of dose. Shielding would only prevent early fatalities for those individuals whose acute radiation doses would be lowered by sheltering from above to below the early fatality threshold.
41
the rarity of the event is an artifact of the meteorological data file that we have used, and not a consequence of very extreme or unusual weather conditions for the New York City region. We are not disclosing the details of this weather sequence.
The reader may also notice that the values for the 'Early fatality distance" for the 95 1h percentile and above are the same in Tables 3-5, but the mean values are not. This is because the distances for the 9 5th percentile and above are all greater than 10 miles, so that they are not affected by differences in protective actions that apply only within the 10-mile EPZ.
(b) Doses received by individuals outside of the 10-mile EPZ It is clear from the previous section that direct exposure to the radioactive plume resulting from a terrorist attack at Indian Point could have severe consequences well beyond the 10-mile EPZ, yet there is no regulatory requirement that local authorities educate residents outside of the EPZ about these risks, or undertake emergency planning to protect these individuals from plume exposures. Therefore, individuals who are now at risk do not have the information that they may need to protect themselves. This is a shortsighted policy, and in fact is inconsistent with government guidelines for protective actions in the event of a radiological emergency.
In this section, we calculate the plume centerline thyroid doses to adults and five-year-old children, and the plume centerline whole-body doses to adults, both at the EPZ boundary and in midtown New York City. (For a given distance downwind of a release, the maximum dose is found at the plume centerline.) We then compare these values to the appropriate protective action recommendations. Thyroid doses are compared to the dose thresholds in the most recent FDA recommendations for potassium iodide administration and whole-body doses are compared to the EPA protective action guides (PAGs) for emergency-phase evacuation. In both cases, the plume centerline doses received to individuals in New York City are well in excess of the projected dose thresholds that would trigger protective actions.
(i) Thyroid doses to children, their consequences, and the need for KI distribution The statistically significant increase in the incidence of thyroid cancer observed among children exposed to fallout from the Chernobyl disaster leaves little doubt of the causal relationship between the occurrence of these cancers and the massive release of radioactive iodine to the environment resulting from the accident.58 The effectiveness of widespread distribution of stable iodine in the form of potassium iodide (KI) to block uptake of radioactive iodine in the thyroid was also confirmed in western areas of Poland, where the timely administration of KI was estimated to have reduced peak doses from radioactive iodine by 30%. 9 58 D. Williams, 'Cancer After Nuclear Fallout: Lessons from The Chernobyl Accident, "Nature Reviews Cancer2 (2002), p. 543-549.
59 Board on Radiation Effects Research, National Research Council, Distribution andAdministration of Potassium Iodide in the Event of a Nuclear Incident, National Academies Press, 2003, p. 58.
42
In the United States, after resisting public demands for many years, the Nuclear Regulatory Commission finally agreed in January 2001 to amend its emergency planning regulations to explicitly consider the use of KI, and to fund the purchase of KI for distribution within the 10-mile plume exposure EPZs of nuclear plants in states that requested it. This effort accelerated after the September 11 attacks, as more states requested the drug, but even today only fewer than two-thirds of the 34 states and tribal governments that qualify for the KI purchase program have actually stockpiled it. New York State is one of the participants.
Despite a few attempts in Congress after September 11 to require the distribution of KI in areas outside of the plume exposure EPZs, the 10-mile limit remains in effect today, and NRC continues to defend it. In a recent 60Commission meeting on emergency planning, NRC employee Trish Milligan said that
",.the [NRC] staff has concluded that recommending consideration of potassium iodide distribution out to 10 miles was adequate for protection of tile public health and safety."
Earlier in this briefing,6 Ms. Milligan provided evidence of the NRC staff's thinking that led to this conclusion: '
'When the population is evacuated out of the [10 -mile] area and potentially contaminated foodstuffs are interdicted, the risk from further radioactive iodine exposure to the thyroid gland is essentially eliminated."
These statements again show that NRC continues to use design-basis accidents, in which the containment remains intact, as the model for its protective action recommendations.
Although NRC claims that its emergency planning requirements take into account all potential releases, including those resulting from terrorist acts, it clearly is not taking into account catastrophic events such as the scenario being analyzed in this report.
These statements also suggest that NRC is committing the fallacy of using the pattern of radioactive iodine exposure that occurred after the Chernobyl accident as the model for the pattern that could occur here. In the Chernobyl event, the majority of the thyroid dose to children occurred through ingestion of contaminated milk and other foodstuffs that were not interdicted-due to the failure of the Soviet authorities to act in a timely manner.
However, the food pathway dominated in that case primarily because of the extremely high elevation of the Chernobyl plume, which reduced the concentration of radioactive iodine in the plume and therefore the doses received through direct inhalation.
But as pointed out earlier, the plume from a severe accident at a water-moderated PWR like Indian Point would probably not rise as high as the Chernobyl plume, and the associated collective thyroid dose would have a greater contribution from direct plume inhalation and a lower contribution from milk consumption. In this case, the importance 60 US NRC, 'Briefing on Emergency Preparedness Program Status" (2003), transcript, p. 21.
61 Ibid, p. 19.
43
of KI prophylaxis would increase relative to that of milk interdiction for controlling overall population exposure to radioactive iodine.
Our calculations clearly indicate that a severe threat to children from exposure to radioactive iodine is present far beyond the 10-mile EPZ where KI is now being made available. In Table 6, we present some results of the distribution for plume centerline thyroid dose to both adults and to five-year-old children at the EPZ boundary and in midtown Manhattan (32.5 miles downwind). In the last column, we provide the projected dose thresholds from the most recent guidelines issued by the FDA for KI prophylaxis.
The thyroid dose to five-year-olds due to 1-131 internal exposure was calculated by using the age-dependent coefficients for dose per unit intake provided in ICRP 72, which are approximately a factor of five greater than those for adults. The calculation must also take into account the difference in the rate of intake of air for children and for adults.
Children have lower lung capacities than adults, but they have higher metabolic rates and therefore breath more rapidly. The higher breathing rate of children tends to partially offset their lower lung capacity. Data collected by the California Environmental Protection Agency indicates that on average, children consume air at a rate about 75% of that of adults. 62 We have used this figure in our calculation.
TABLE 6: Terrorist attack at IP 2, MACCS2 estimates of centerline thyroid doses to 5-year-olds resulting from emergency phase exposures (all doses in rem)
Mean 95 tLh 9 9 .5 th Peak FDA KI percentile percentile threshold Location Age Outside Adult 1,120 3,400 5,850 9,560 10 (ages 18-40)
EPZ 500 (over 40)
(11.6 mi) 5 years 3,620 10,900 18,000 32,100 5 Midtown Adult 164 429 761 1,270 10 (ages 18-40)
Manhattan 500 (over 40)
(32.5 mi) 5 years 530 1,310 2,500 4,240 5 The results in Table 6 show that the thyroid doses to 5-year-olds are approximately three times greater than those for adults. This tracks well with information in the World Health Organization's 1999 guidelines for iodine prophylaxis, which states that thyroid doses from inhalation in63children around three years old will be increased up to threefold relative to adults.
62 Air Resources Board, California Environmental Protection Agency, 'How Much Air Do We Breathe?',
Research Note #94-11, August 1994. On the Web at www.:arb.ca.2ov/IeseaIrch/resIotes/notcs/)4- I thtn.
63 World Health Organization, Guidelinesfor Iodine Prophylvaxis Following NuclearAccidents, WHO, Geneva, 1999, Sec. 3.3.
44
These results make clear that both 9 5 th percentile and mean projected thyroid doses can greatly exceed the FDA-recommended threshold for KI prophylaxis administration at locations well outside the 10-mile EPZ, for 5-year-old children and for adults of all ages.
In Manhattan, KI would be recommended for children and adults under 40, based on the 9 5 th percentile projection.
The health consequences of doses of this magnitude to the thyroid would be considerable.
As the 99. 5 th percentile is approached, the 5-year-old doses are high enough to cause death of thyroid tissue. In fact, they are on the order of the doses that are applied therapeutically to treat hyperthyroidism and other diseases by destroying the thyroid gland. Children with this condition would require thyroid hormone replacement therapy for their entire lives. At lower doses, in which cells are not killed but DNA is damaged, the risk of thyroid cancer to children would be appreciable. According to estimates obtained from Chernobyl studies, a 9 5 th percentile thyroid dose of 1,310 rem to a 5-year-old child in Manhattan would result in an excess risk of about 0.3% per year of contracting thyroid cancer. 64 Given that the average worldwide rate of incidence of childhood thyroid cancer is about 0.0001% per year, this would represent an impressive increase.
These results directly contradict the reassuring statements by NRC quoted earlier. But it is no secret to NRC that such severe thyroid exposures can occur as the result of a catastrophic release. Results very similar to these were issued by NRC staff in 1998 in the first version of a draft report on the use of KI, NUREG-1633.6 5 This draft included a Section VII entitled 'Sample Calculations," in which the NRC staff estimated the centerline thyroid doses at the 10-mile EPZ boundary from severe accidents using the RASCAL computer code. Table 5 of the draft report shows that the NRC's calculated dose to the adult thyroid at the 10-mile limit ranged from 1500 to 19,000 rem for severe accidents with iodine release fractions ranging from 6 to 35%, for a single weather sequence.66 In the introductory section, the report states that 'doses in the range of 25,000 rad are used to ablate thyroids as part of a therapeutic procedure. Such thyroid doses are possible during severe accidents."6 7 NRC's results are even more severe than ours, which were obtained using the NRC revised source term, with a higher iodine release fraction of 67%.
Given NRC's reluctance to provide information of this type to the public, it is no surprise that the Commission withdrew the draft NUREG-1633 and purged it from its web site, ordering the issuance of a 'ýubstantially revised document" t aking into account 'the many useful public comments" that it received. 68 Lo and behold, the second draft of 64 The average excess absolute risk per unit thyroid dose for children exposed to Chernobyl fallout has been estimated 2.1 per million children per rad. D. Williams, op cit., p. 544.
65 F.J. Congel et al., Assessment of the Use of Potassium Iodide (KI) As A Public Protective Action During Severe Reactor Accidents, Draft Report for Comment, NUREG-1633, US Nuclear Regulatory Commission, July 1998.
66 Ibid, p. 26.
67 Ibid, p. 6.
68 US NRC, 'Staff Requirements --- Federal Register Notice on Potassium Iodide," SRM -COMSECY 016, September 30, 1998.
45
NUREG-1633, which was rewritten by Trish Milligan and reissued four years later, mysteriously failed to include Section VII, 'Sample Calculations," as well as all information related to those calculations (such as the clear statement cited earlier that thyroid doses in the range of 25,000 rad are possible during severe accidents).69 This took place even though the Commission's public direction to the NRC staff on changes to be incorporated into the revision made no explicit reference to this section.7 0 However, it is clear that the expurgated information would be inconsistent with NRC's previous rulemaking restricting consideration of KI distribution only to the 10-mile zone. Even after this exercise in censorship, the Commission still voted in 2002 to block release of the revised draft NUREG-1633 as a final document.
Some insight into the level of understanding of the health impacts of a catastrophic release of radioactive iodine of the current Commission can be found in the statement of Commissioner McGaffigan in voting to delay release of 7 the revised NUREG- 1633 for public comment. In his comments, McGaffigan wrote 1
'Both WHO [the World Health Organization] and FDA set the intervention level on KI prophylaxis for those over 40 at 5 gray (500 rem) to the thyroid ... Since we do not expect, even in the worst circumstances, any member of the public to receive 500 rem to the thyroid, it would be useful for FDA to clarify whether we should plan for KI prophylaxis for those over 40." [Emphasis added.]
This statement is not consistent with what is known about the potential consequences of a severe nuclear accident. Few experts would claim that such high doses cannot occur
'even in the worst circumstances," and the NRC's own emergency planning guidance is not intended to prevent such doses in all accidents, but only in most accidents. Given that the Commissioner presumably read the first draft of NUREG-1633, he would have seen the results of the staff's thyroid dose calculations and other supporting material. There is no discussion in the public record that provides a rationale for Commissioner McGaffigan's rejection of the informed judgment and quantitative analysis of his technical staff.
In 2003, at the request of Congress a National Research Council committee released a report addressing the issue of distribution and administration of7 KI 3 in the event of a nuclear incident.7 2 Most notably, the committee concluded that "1. KI should be available to everyone at risk of significant health consequences from accumulation of radioiodine in the thyroid in the event of a radiological incident...
69 US NRC, 'Status of Potassium Iodide Activities, SECY-01-0069, Attachment I (NUREG-1633, draft for comment; 70 prepared by P.A. Milligan, April 11, 2001).
US NRC, SRM-COMSECY-98-016.
71 US NRC, Commission Voting Record on SECY-01-0069, 'Status of Potassium Iodide Activities," June 29, 2001.
72 National Research Council (2003), op cit.
73 Ibid, p. 5.
46
- 2. KI distribution programs should consider ... local stockpiling outside the emergency planning zone .. '
While the committee did not itself take on the politically sensitive question of how to determine the universe of individuals who would be 'ht risk of significant health consequences," it did recommend that 'the decision regarding the geographical area to be covered in a KI distribution program should be based on risk estimates derived from 74 calculations of site-specific averted thyroid doses for the most vulnerable populations.",
This is the type of information that we provide in Table 6 (and the type that NRC struck from draft NUREG-1633). We hope that the information in our report provides a starting point for state and local municipalities to determine the true extent of areas that could be significantly affected by terrorist attacks at nuclear plants in their jurisdiction and to make provisions for availability of KI in those regions. Our calculations show that New York City should be considered part of such an area.
However, even timely administration of KI to all those at risk can only reduce, but cannot fully mitigate, the consequences of a release of radioactive iodine resulting from a terrorist attack at Indian Point. The projected dose to individuals who undergo timely KI prophylaxis can be reduced by about a factor of 10. A review of the results of Table 6 shows that doses and cancer risks to many children in the affected areas will still be high even after a ten-fold reduction in received dose. And KI can only protect people from exposure to radioactive iodine, and not from exposure to the dozens of other radioactive elements that would be released to the environment in the event of a successful attack.
(ii) Whole-body doses and the need for evacuation or sheltering In addition to KI distribution, the other major protective action that will be relied on to reduce exposures following a terrorist attack at Indian Point is evacuation of the population at risk. In Table 7, we present the results of our calculation for the projected centerline whole-body 'total effective dose equivalents" (TEDEs) just outside the EPZ boundary and in downtown Manhattan, and compare those with the EPA recommended dose threshold for evacuation during the emergency phase following a radiological incident. As in the discussion of projected thyroid doses and KI prophylaxis, we find that projected centerline TEDEs would exceed the EPA Protective Action Guide (PAG) for evacuation of 1-5 rem at distances well outside of the 10-mile plume exposure EPZ within which NRC requires evacuation planning.
74 Ibid, p. 162.
47
TABLE 7: Terrorist attack at IP 2, MACCS2 estimates of adult centerline whole-body total effective dose equivalents (TEDEs) resulting from emergency phase exposures (all doses in rem)
Mean 9 5 Ih percentile 9 9 . 5 th percentile Peak EPA PAG Location EPZ boundary 198 549 926 1,490 1-5 (11.6 mi)
Midtown Manhattan 30 77 131 307 1-5 (32.5 mi)
From the results in Table 7, it is clear that according to the EPA early phase PAG for evacuation of 1-5 rem, evacuation would be recommended for individuals in the path of the plume centerline not only outside of the EPZ boundary, but in New York City and beyond. An individual in Manhattan receiving the 9 5 th percentile TEDE of 77 rem during the emergency phase period would have an excess absolute lifetime cancer fatality risk of approximately 8%, which corresponds to a 40% increase in the lifetime individual risk of developing a fatal cancer (which is about one in five in the United States).
We now examine the potential reduction in health consequences that could result from evacuation of a larger region than the current 10-mile EPZ by considering a case in which the boundary of the plume exposure EPZ is expanded from 10.7 to 25 miles. We calculate the impact of different protective actions in this region on the numbers of early fatalities and latent cancer fatalities among the population within the expanded EPZ but outside of the original 10-mile EPZ. The residents of the expanded EPZ are assumed either (1) to evacuate with the same mobilization time and at the same average speed as the residents of the original EPZ, or (2) to shelter in place for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and then evacuate.
The results are provided in Table 8.
TABLE 8: Terrorist attack at IP 2, MACCS2 9 5th percentile estimates of early fatalities (EFs) and latent cancer fatalities (LCFs) resulting from emergency phase exposures; 25-mile EPZ Normal Evacuation Sheltering activity for 24 hrs Consequence:
EFs, 10.7-25 mi 664 0 0 LCFs, 10.7-25 mi 19,800 45,700 9,020 48
These results indicate that evacuation and sheltering are equally effective in eliminating the risk of early fatalities among residents of the 10.7-25 mile region for the 9 5 th percentile case. On the other hand, one sees that evacuation also tends to increase the number of latent cancer fatalities relative to normal activity, while sheltering reduces the number. Thus for this scenario, it appears that sheltering of individuals in the 10.7-25 mile region would be preferable to evacuation of this region for the MACCS2 evacuation and sheltering models we use here. This is consistent with the results we obtained earlier when considering the comparative impacts of evacuation and sheltering of residents of the 10-mile EPZ, again indicating that evacuation tends to increase population doses by placing more people in direct contact with the radioactive plume. However, other models and other shielding parameter choices may lead to different conclusions. We would urge emergency planning officials to evaluate an exhaustive set of scenarios, and to conduct a realistic and site-specific assessment of the degrees of shielding that structures in the region may provide, to determine what types of actions would provide the greatest protection for residents of regions outside of the 10-mile EPZ.
(c) Long-term economic and health consequences In this section we provide MACCS2 order-of-magnitude estimates of the economic costs of the terrorist attack scenario, the numbers of latent cancer fatalities resulting from long-term radiation exposures (primarily as a result of land contamination), and the number of people who will require permanent relocation. NRC has used MACCS2 to estimate the economic damages of reactor accidents for various regulatory applications.7 5 There is no unique definition of the economic damages resulting from a radiological contamination event. In the MACCS2 model, which is a descendant of the CRAC2 model, the total economic costs include the cost of decontamination to a user-specified cleanup standard, the cost of condemnation of property that cannot be cost-effectively decontaminated to the specified standard, and a simple lump-sum compensation payment to all members of the public who are forced to relocate either temporarily or permanently as a result of the attack. Although simplistic, this model does provide a reasonable estimate of the order of magnitude of the direct economic impact of a successful terrorist attack at Indian Point.
(i) EPA ProtectiveAction Guide cleanup standard We first employ the long-term habitability cleanup standards provided by the EPA protective action guide (PAG) for the 'intermediate phase," which is the period that begins after the emergency phase ends, when releases have been brought under control and accurate radiation surveys have been taken of contaminated areas. The EPA intermediate phase PAG recommends temporary relocation of individuals and decontamination if the projected whole-body total effective dose equivalent (TEDE) (not taking into account any shielding from structures) over the first year after a radiological 75 US NRC, Office of Nuclear Regulatory Research, Regulatoty Analysis Technical Evaluation Handbook, NUREG/BR-0184, January 1997, p. 5.37.
49
release would exceed 2 rem. The EPA chose this value with the expectation that if met, then the projected (shielded) TEDE in the second (and any subsequent year) would be below 0.5 rem, and the cumulative TEDE over a fifty-year period would not exceed 5 rem.
The MACCS2 economic consequence model evaluates the cost of restoring contaminated areas to habitability (which we define as reducing the unshielded TEDE during the first year of reoccupancy to below 2 rem), and compares that cost to the cost of condemning the property. All cost parameters, including the costs of decontamination, condemnation and compensation, can be specified by the user. We employ an economic model partly based on parameters developed for a recent study on the consequences of spent fuel pool accidents.7 6 The model utilizes the results of a 1996 Sandia National Laboratories report that estimates radiological decontamination costs for mixed-use urban areas. 77 We refer interested readers to these two references for information on the limitations and assumptions of the model.
The SECPOP2000 code, executed for the Indian Point site, provides the required site-specific inputs for this calculation, including the average values of farm and non-farm wealth for each region of the MACCS2 grid, based on 1997 economic data. These values are used to assess the cost-effectiveness of decontaminating a specific element versus simply condemning it.
Table 9 presents the long-term health and economic consequences calculated by MACCS2 for a region 100 miles downwind of the release, considering only costs related to residential and small business relocation, decontamination and compensation. Since the calculation was performed using values from a 1996 study and from 1997 economic data, we have converted the results to 2003 dollars using an inflation adjustment factor of 1.10. Because of significant uncertainties in the assignments of parameters for this calculation, the results in Table 9 should only be regarded as order-of-magnitude estimates. The reader should note that the latent cancer fatality figures in Table 9 result from doses incurred after the one-week emergency phase is over, and therefore are additional to the numbers of latent cancer fatalities resulting from emergency-phase exposures reported previously in Tables 3 to 5.
76 j. Beyea, E. Lyman and F. von Hippel, 'Damages from a Major Release of 137Cs into the Atmosphere of the United States," Science and Global Securit.' 12 (2004) 1-12.
77 D. Chanin and W. Murfin, Site Restoration: Estimates of Attributable Costs From Plutonium Dispersal Accidents, SND96-0057, Sandia National Laboratories, 1996.
50
TABLE 9: Terrorist attack at IP 2, MACCS2 estimates of long-term economic and health consequences, EPA intermediate phase PAG (< 2 rem in first year; approx. 5 rem in 50 yrs)
Mean 95 thpercentile 9 9 .5 th percentile Peak Consequence Total cost, 0-100 mi $371 billion $1.17 trillion $1.39 trillion $2.12 trillion (2003 $)
People permanently 684,000 3.19 million 7.91 million 11.1 million relocated LCFs, 0-100 mi 12,000 41,200 57,900 84,900 Plume Centerline 4.57 7.04 7.18 7.42 50-year TEDE (rem)
One can see from Table 9 that imposition of the EPA intermediate phase PAG does result in restricting the mean 50-year cumulative TEDE to below 5 rem, but that this limit is exceeded for the higher percentiles of the distribution. Thus for a terrorist attack at the 9 5 th percentile, the subsidiary goal of the EPA intermediate phase PAG is not met.
(ii) Relaxed cleanup standard In the recent NRC meeting on emergency planning described earlier, NRC staff and Commissioners questioned claims by activists that a severe nuclear accident would render large areas 'permanently uninhabitable," arguing that the radiation protection standard underlying that determination is too stringent compared to levels of natural background radiation to which people are already exposed.
78 For instance, Trish Milligan said that
'There's been a concern that a radioactive release as a result of a nuclear power plant accident will render thousands of square miles uninhabitable around a plant.
It is true that radioactive materials can travel long distances. But it is simply not true that the mere presence of radioactive materials are [sic] harmful... the standard applied to this particular claim has been a whole body dose of 10 rem over 30 years, or approximately 330 millirem per year. This dose is almost the average background radiation dose in the United States which is about 360 millirem per year. Some parts of the country have a background radiation dose two or more times higher than the national average. So in effect this additional 330 millirem dose is an additional year background dose or the difference in dose 78 US NRC, Briefing on Emergency Preparedness (2003), op cit., transcript, p. 22.
51
between someone living in a sandy coastal area or someone living in the Rocky Mountains."
Ms. Milligan does not note that her opinion of an acceptable level of radiation is not consistent with national standards, -such as the EPA PAGs. The EPA- long-term goal of limiting chronic exposures after a radiological release to 5 rem in 50 years corresponds to an average annual exposure of 100 millirem above background, while she implies that even a standard of 330 millirem per year, which would double the background dose on average, is unnecessarily stringent.
However, we can evaluate the impact of weakening the EPA PAGs for long-term exposure on costs and risks. In Table 10, we assess the impact of adopting a long-term protective action guide of 25 rem in 50 years, or an average annual dose of 500 millirem per year. By comparing the 95th percentile columns in Table 10 and Table 9, one can see that relaxing the standard would modestly reduce the post-release cleanup costs by about 25% and drastically reduce the number of relocated individuals by 90%. However, weakening the standard would nearly triple the number of long-term cancer deaths among residents of the contaminated area. Cost-benefit analyses of proposals to weaken long-term exposure standards should take this consequence into account.
TABLE 10: Long-term economic and health consequences of a terrorist attack at IP 2, relaxed cleanup standard (25 rem in 50 years)
Mean 9 5 th percentile 9 9 5 th percentile Peak Consequence:
Total cost, 0-100 mi $249 billion $886 billion $1.14 trillion $1.50 trillion (2003 $)
People permanently 118,000 334,000 1.86 million 7.98 million relocated LCFs, 0-100 mi 36,300 115,000 169,000 279,000 (d) An even worse case The previous results were based on the analysis of a terrorist attack that resulted in a catastrophic radiological release from only one of the two operating reactors at the Indian Point site. However, it is plausible that both reactors could be attacked, or that an attack on one could result in the development of an unrecoverable condition at the other. Here we present the results of a scenario in which Indian Point 3 undergoes a similar accident sequence to Indian Point 2 after a time delay of just over two hours. This could occur, for example, if Indian Point 3 experienced a failure of its backup power supplies at the time that Indian Point 2 was attacked. Given the loss of off-site power at the same time, Indian Point 3 could experience a small-break LOCA and eventually a core melt, commencing about two hours after accident initiation. We assume that the attackers 52
weaken the IP3 containment so that it ruptures at the time of vessel failure. In Table 11, we present the results of this scenario for the case of full evacuation of the EPZ.
As bad as this scenario is, it still does not represent the worst case. If any or all of the three spent fuel pools at the Indian Point site were also damaged during the attack, the impacts would be far greater, especially with regard to long-term health and economic consequences.
TABLE 11: Terrorist attack at IP 2 and 3, MACCS2 estimates of early fatalities (EFs) and latent cancer fatalities (LCFs) resulting from emergency phase exposures, 100% evacuation of EPZ Mean 9 5 th percentile 99 .5th percentile Peak Consequence:
EFs, within EPZ 925 4,660 18,400 34,100 EFs, 0-50 mi. 1,620 8,580 30,900 78,400 EF, distance (mi.) 9.1 21 29 60 LCFs, within EPZ 14,800 42,900 75,100 122,000 LCFs, 0-50 mi. 53,400 180,000 342,000 701,000 53
CONCLUSIONS In conclusion, we make the following observations.
- 1) The current emergency planning basis for Indian Point provides insufficient protection for the public within the 10-mile emergency planning zone in the event of a successful terrorist attack. Even in the case of a complete evacuation, up to 44,000 early fatalities are possible.
- 2) The radiological exposure of the population and corresponding long-term health consequences of a successful terrorist attack at Indian Point could be extremely severe, even for individuals well outside of the 10-mile emergency planning zone. We calculate that over 500,000 latent cancer fatalities could occur under certain meteorological conditions. A well-developed emergency plan for these individuals, including comprehensive distribution of potassium iodide throughout the entire area at risk, could significantly mitigate some of the health impacts if promptly and effectively carried out.
However, even in the case of 100% evacuation within the 10-mile EPZ and 100%
sheltering between 10 and 25 miles, the consequences could be catastrophic for residents of New York City and the entire metropolitan area.
- 3) The economic impact and disruption for New York City residents resulting from a terrorist attack on Indian Point could be immense, involving damages from hundreds of billions to trillions of dollars, and the permanent displacement of millions of individuals.
This would dwarf the impacts of the September 11 attacks.
- 4) The potential harm from a successful terrorist attack at Indian Point is significant even when only the mean results are considered, and is astonishing when the results for 95th and 99.51h meteorological conditions are considered. Given the immense public policy implications, a public dialogue should immediately be initiated to identify the protective measures desired by the entire affected population to prevent such an attack or effectively mitigate its consequences should prevention fail. As this study makes abundantly clear, this population extends far beyond the 10-mile zone that is the focus of emergency planning efforts today.
We hope that this information will be useful for officials in the Department of Homeland Security as it carries out its statutory requirement to conduct a comprehensive assessment of the terrorist threat to the US critical infrastructure, as well as for health and emergency planning officials in New York City and other areas that are not now currently engaged in emergency preparedness activities related to a terrorist attack at Indian Point.
ACKNOWLEDGMENTS The author would like to thank David Lochbaum, Kenneth Bergeron, Frank von Hippel, Jan Beyea and Lisbeth Gronlund for reading drafts of this report and providing many useful comments and suggestions. All mistakes are the responsibility of the author.
54